about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS4
-rw-r--r--doc/stdenv/stdenv.chapter.md2
-rw-r--r--lib/systems/inspect.nix9
-rw-r--r--maintainers/maintainer-list.nix22
-rw-r--r--maintainers/team-list.nix4
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2305.section.xml17
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md7
-rw-r--r--nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json17
-rw-r--r--nixos/modules/services/desktops/pipewire/daemon/jack.conf.json12
-rw-r--r--nixos/modules/services/hardware/bluetooth.nix27
-rw-r--r--nixos/modules/services/networking/openconnect.nix1
-rw-r--r--nixos/modules/services/x11/desktop-managers/plasma5.nix1
-rw-r--r--pkgs/applications/audio/flacon/default.nix4
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix4
-rw-r--r--pkgs/applications/audio/go-musicfox/default.nix50
-rw-r--r--pkgs/applications/audio/open-stage-control/default.nix4
-rw-r--r--pkgs/applications/audio/rhvoice/honor_nix_environment.patch8
-rw-r--r--pkgs/applications/audio/yesplaymusic/default.nix120
-rw-r--r--pkgs/applications/blockchains/haven-cli/default.nix4
-rw-r--r--pkgs/applications/graphics/eyedropper/default.nix6
-rw-r--r--pkgs/applications/graphics/fluxus/default.nix21
-rw-r--r--pkgs/applications/graphics/fluxus/fix-build.patch34
-rw-r--r--pkgs/applications/misc/gremlin-console/default.nix4
-rw-r--r--pkgs/applications/misc/josm/default.nix6
-rw-r--r--pkgs/applications/misc/oxker/default.nix6
-rw-r--r--pkgs/applications/misc/process-compose/default.nix6
-rw-r--r--pkgs/applications/misc/usql/default.nix6
-rw-r--r--pkgs/applications/misc/ydict/default.nix23
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix2
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix2
-rw-r--r--pkgs/applications/networking/cluster/acorn/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/argocd/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/fluxcd/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/k3s/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/k9s/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/karmor/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/minikube/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/nerdctl/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json22
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix22
-rwxr-xr-xpkgs/applications/networking/instant-messengers/deltachat-desktop/update.sh32
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin/default.nix4
-rw-r--r--pkgs/applications/networking/mullvad-vpn/default.nix4
-rw-r--r--pkgs/applications/networking/newsreaders/slrn/default.nix1
-rw-r--r--pkgs/applications/radio/urh/default.nix6
-rw-r--r--pkgs/applications/science/biology/diamond/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/xterm/default.nix4
-rw-r--r--pkgs/applications/version-management/git/default.nix4
-rw-r--r--pkgs/applications/video/cinelerra/default.nix6
-rw-r--r--pkgs/applications/video/mpv/scripts/mpvacious.nix4
-rw-r--r--pkgs/applications/video/w_scan2/default.nix25
-rw-r--r--pkgs/applications/virtualization/conmon-rs/default.nix6
-rw-r--r--pkgs/applications/window-managers/icewm/default.nix4
-rw-r--r--pkgs/applications/window-managers/leftwm/0001-patch-version.patch22
-rw-r--r--pkgs/applications/window-managers/leftwm/default.nix12
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix12
-rw-r--r--pkgs/build-support/fetchbzr/builder.sh4
-rw-r--r--pkgs/build-support/fetchcvs/builder.sh2
-rw-r--r--pkgs/build-support/fetchdarcs/builder.sh4
-rw-r--r--pkgs/build-support/fetchdocker/fetchdocker-builder.sh3
-rw-r--r--pkgs/build-support/fetchdocker/generic-fetcher.nix6
-rw-r--r--pkgs/build-support/fetchfirefoxaddon/default.nix2
-rw-r--r--pkgs/build-support/fetchfossil/builder.sh4
-rw-r--r--pkgs/build-support/fetchgit/builder.sh3
-rw-r--r--pkgs/build-support/fetchhg/builder.sh4
-rw-r--r--pkgs/build-support/fetchmtn/builder.sh12
-rw-r--r--pkgs/build-support/fetchsvn/builder.sh4
-rw-r--r--pkgs/build-support/fetchsvnssh/builder.sh4
-rw-r--r--pkgs/build-support/fetchurl/builder.sh2
-rw-r--r--pkgs/build-support/pkg-config-wrapper/default.nix5
-rw-r--r--pkgs/build-support/release/debian-build.nix6
-rw-r--r--pkgs/build-support/release/nix-build.nix3
-rw-r--r--pkgs/build-support/release/source-tarball.nix3
-rw-r--r--pkgs/build-support/setup-hooks/audit-tmpdir.sh4
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.py7
-rw-r--r--pkgs/build-support/setup-hooks/canonicalize-jars.sh3
-rw-r--r--pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix2
-rw-r--r--pkgs/build-support/setup-hooks/make-symlinks-relative.sh4
-rw-r--r--pkgs/build-support/setup-hooks/multiple-outputs.sh26
-rw-r--r--pkgs/build-support/setup-hooks/patch-shebangs.sh2
-rw-r--r--pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh8
-rw-r--r--pkgs/build-support/setup-hooks/separate-debug-info.sh2
-rw-r--r--pkgs/build-support/setup-hooks/strip.sh2
-rw-r--r--pkgs/build-support/trivial-builders.nix11
-rw-r--r--pkgs/build-support/vm/default.nix6
-rw-r--r--pkgs/data/fonts/comfortaa/default.nix35
-rw-r--r--pkgs/data/fonts/undefined-medium/default.nix6
-rw-r--r--pkgs/desktops/plasma-5/default.nix2
-rw-r--r--pkgs/desktops/plasma-5/kinfocenter.nix62
-rw-r--r--pkgs/desktops/plasma-5/kinfocenter/0001-tool-paths.patch51
-rw-r--r--pkgs/desktops/plasma-5/kinfocenter/default.nix104
-rw-r--r--pkgs/desktops/plasma-5/systemsettings.nix1
-rw-r--r--pkgs/desktops/xfce/default.nix4
-rw-r--r--pkgs/development/compilers/chicken/4/fetchegg/builder.sh4
-rw-r--r--pkgs/development/compilers/chicken/5/fetchegg/builder.sh4
-rw-r--r--pkgs/development/compilers/dmd/generic.nix7
-rw-r--r--pkgs/development/compilers/gcc/10/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/12/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix8
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix8
-rw-r--r--pkgs/development/compilers/gcc/8/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix12
-rw-r--r--pkgs/development/compilers/gcc/builder.sh30
-rw-r--r--pkgs/development/compilers/go/1.19.nix4
-rw-r--r--pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix13
-rw-r--r--pkgs/development/compilers/rust/cargo.nix2
-rw-r--r--pkgs/development/compilers/rust/rustc.nix2
-rw-r--r--pkgs/development/compilers/swift/compiler/default.nix686
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/clang-toolchain-dir.patch (renamed from pkgs/development/compilers/swift/patches/0005-clang-toolchain-dir.patch)0
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/clang-wrap.patch18
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/llvm-module-cache.patch30
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-darwin-plistbuddy-workaround.patch17
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch21
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch67
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-prevent-sdk-dirs-warning.patch39
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-separate-lib.patch26
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-wrap.patch46
-rw-r--r--pkgs/development/compilers/swift/default.nix532
-rw-r--r--pkgs/development/compilers/swift/foundation/default.nix61
-rw-r--r--pkgs/development/compilers/swift/foundation/glue.cmake8
-rw-r--r--pkgs/development/compilers/swift/libdispatch/default.nix42
-rw-r--r--pkgs/development/compilers/swift/libdispatch/disable-swift-overlay.patch35
-rw-r--r--pkgs/development/compilers/swift/libdispatch/glue.cmake5
-rw-r--r--pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch13
-rw-r--r--pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch13
-rw-r--r--pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch23
-rw-r--r--pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch13
-rw-r--r--pkgs/development/compilers/swift/patches/0006-clang-purity.patch16
-rw-r--r--pkgs/development/compilers/swift/patches/0007-build-presets-linux-os-stdlib.patch13
-rw-r--r--pkgs/development/compilers/swift/sourcekit-lsp/default.nix72
-rw-r--r--pkgs/development/compilers/swift/sourcekit-lsp/generated/default.nix16
-rw-r--r--pkgs/development/compilers/swift/sourcekit-lsp/generated/workspace-state.json178
-rw-r--r--pkgs/development/compilers/swift/sourcekit-lsp/patches/indexstore-db-macos-target.patch12
-rw-r--r--pkgs/development/compilers/swift/sources.nix33
-rw-r--r--pkgs/development/compilers/swift/swift-docc/default.nix53
-rw-r--r--pkgs/development/compilers/swift/swift-docc/generated/default.nix15
-rw-r--r--pkgs/development/compilers/swift/swift-docc/generated/workspace-state.json161
-rw-r--r--pkgs/development/compilers/swift/swift-driver/default.nix77
-rw-r--r--pkgs/development/compilers/swift/swift-driver/generated/default.nix11
-rw-r--r--pkgs/development/compilers/swift/swift-driver/generated/workspace-state.json93
-rw-r--r--pkgs/development/compilers/swift/swift-driver/patches/disable-catalyst.patch17
-rw-r--r--pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch40
-rw-r--r--pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch28
-rw-r--r--pkgs/development/compilers/swift/swift-driver/patches/prevent-sdk-dirs-warnings.patch16
-rw-r--r--pkgs/development/compilers/swift/swiftpm/cmake-glue.nix90
-rw-r--r--pkgs/development/compilers/swift/swiftpm/default.nix418
-rw-r--r--pkgs/development/compilers/swift/swiftpm/generated/default.nix14
-rw-r--r--pkgs/development/compilers/swift/swiftpm/generated/workspace-state.json144
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/cmake-disable-rpath.patch36
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/disable-sandbox.patch21
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/disable-xctest.patch48
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/fix-clang-cxx.patch121
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/fix-stdlib-path.patch23
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/llbuild-cmake-disable-rpath.patch14
-rw-r--r--pkgs/development/compilers/swift/swiftpm/setup-hook.sh60
-rw-r--r--pkgs/development/compilers/swift/wrapper/default.nix58
-rw-r--r--pkgs/development/compilers/swift/wrapper/setup-hook.sh28
-rw-r--r--pkgs/development/compilers/swift/wrapper/wrapper.sh291
-rw-r--r--pkgs/development/compilers/swift/xctest/default.nix55
-rw-r--r--pkgs/development/haskell-modules/generic-stack-builder.nix4
-rw-r--r--pkgs/development/interpreters/hashlink/default.nix6
-rw-r--r--pkgs/development/interpreters/hashlink/hashlink.patch32
-rw-r--r--pkgs/development/interpreters/lua-5/wrap-lua.nix2
-rw-r--r--pkgs/development/interpreters/python/wrap-python.nix1
-rw-r--r--pkgs/development/libraries/ace/default.nix4
-rw-r--r--pkgs/development/libraries/audio/roc-toolkit/default.nix16
-rw-r--r--pkgs/development/libraries/catch2/3.nix4
-rw-r--r--pkgs/development/libraries/directx-headers/default.nix25
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/default.nix2
-rw-r--r--pkgs/development/libraries/giflib/default.nix8
-rw-r--r--pkgs/development/libraries/glibc/default.nix14
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix16
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix2
-rw-r--r--pkgs/development/libraries/json-glib/default.nix2
-rw-r--r--pkgs/development/libraries/libcbor/default.nix48
-rw-r--r--pkgs/development/libraries/libclc/default.nix4
-rw-r--r--pkgs/development/libraries/libdeltachat/default.nix6
-rw-r--r--pkgs/development/libraries/libgit2/default.nix4
-rw-r--r--pkgs/development/libraries/libjxl/default.nix9
-rw-r--r--pkgs/development/libraries/libmpc/default.nix4
-rw-r--r--pkgs/development/libraries/liboqs/default.nix38
-rw-r--r--pkgs/development/libraries/libsoup/default.nix1
-rw-r--r--pkgs/development/libraries/libtheora/default.nix2
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libwebp/default.nix4
-rw-r--r--pkgs/development/libraries/libxkbcommon/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix115
-rw-r--r--pkgs/development/libraries/mesa/opencl.patch51
-rw-r--r--pkgs/development/libraries/mpfr/default.nix11
-rw-r--r--pkgs/development/libraries/mtdev/default.nix8
-rw-r--r--pkgs/development/libraries/ncurses/default.nix10
-rw-r--r--pkgs/development/libraries/nghttp2/default.nix6
-rw-r--r--pkgs/development/libraries/ngtcp2/default.nix4
-rw-r--r--pkgs/development/libraries/nss/esr.nix4
-rw-r--r--pkgs/development/libraries/nss/generic.nix13
-rw-r--r--pkgs/development/libraries/pango/default.nix1
-rw-r--r--pkgs/development/libraries/pipewire/default.nix12
-rw-r--r--pkgs/development/libraries/qca-qt5/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix2
-rwxr-xr-xpkgs/development/libraries/qt-5/5.15/fetch.sh2
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json20
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix15
-rw-r--r--pkgs/development/libraries/qt-6/default.nix2
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtbase.nix7
-rw-r--r--pkgs/development/libraries/swift-corelibs-libdispatch/default.nix42
-rw-r--r--pkgs/development/libraries/tracker/default.nix1
-rw-r--r--pkgs/development/misc/brev-cli/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/pyml/default.nix6
-rw-r--r--pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix4
-rw-r--r--pkgs/development/python-modules/cachetools/default.nix7
-rw-r--r--pkgs/development/python-modules/chardet/default.nix3
-rw-r--r--pkgs/development/python-modules/cryptography/default.nix3
-rw-r--r--pkgs/development/python-modules/dacite/default.nix14
-rw-r--r--pkgs/development/python-modules/exceptiongroup/default.nix4
-rw-r--r--pkgs/development/python-modules/future/default.nix17
-rw-r--r--pkgs/development/python-modules/humanize/default.nix7
-rw-r--r--pkgs/development/python-modules/hypothesis/default.nix27
-rw-r--r--pkgs/development/python-modules/internetarchive/default.nix4
-rw-r--r--pkgs/development/python-modules/iso8601/default.nix3
-rw-r--r--pkgs/development/python-modules/iteration-utilities/default.nix28
-rw-r--r--pkgs/development/python-modules/jaraco-context/default.nix11
-rw-r--r--pkgs/development/python-modules/jinja2-ansible-filters/default.nix31
-rw-r--r--pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix18
-rw-r--r--pkgs/development/python-modules/mautrix/default.nix65
-rw-r--r--pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix43
-rw-r--r--pkgs/development/python-modules/numpy/default.nix3
-rw-r--r--pkgs/development/python-modules/opensearch-py/default.nix59
-rw-r--r--pkgs/development/python-modules/orjson/default.nix7
-rw-r--r--pkgs/development/python-modules/poetry-dynamic-versioning/default.nix5
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix4
-rw-r--r--pkgs/development/python-modules/pyhaversion/default.nix4
-rw-r--r--pkgs/development/python-modules/pylitterbot/default.nix4
-rw-r--r--pkgs/development/python-modules/pyramid/default.nix34
-rw-r--r--pkgs/development/python-modules/pysvn/default.nix9
-rw-r--r--pkgs/development/python-modules/pytest-benchmark/default.nix4
-rw-r--r--pkgs/development/python-modules/pyyaml-include/default.nix37
-rw-r--r--pkgs/development/python-modules/qimage2ndarray/default.nix4
-rw-r--r--pkgs/development/python-modules/reportengine/default.nix4
-rw-r--r--pkgs/development/python-modules/requests/default.nix10
-rw-r--r--pkgs/development/python-modules/requests/relax-charset-normalizer.patch55
-rw-r--r--pkgs/development/python-modules/rpi-gpio2/default.nix10
-rw-r--r--pkgs/development/python-modules/simplejson/default.nix15
-rw-r--r--pkgs/development/python-modules/sphinx-codeautolink/default.nix51
-rw-r--r--pkgs/development/python-modules/sphinx-hoverxref/default.nix67
-rw-r--r--pkgs/development/python-modules/sphinx-jquery/default.nix36
-rw-r--r--pkgs/development/python-modules/sphinx-notfound-page/default.nix51
-rw-r--r--pkgs/development/python-modules/sphinx-prompt/default.nix27
-rw-r--r--pkgs/development/python-modules/sphinx-tabs/default.nix55
-rw-r--r--pkgs/development/python-modules/sphinx-version-warning/default.nix59
-rw-r--r--pkgs/development/python-modules/twisted/default.nix3
-rw-r--r--pkgs/development/tools/altair-graphql-client/default.nix4
-rw-r--r--pkgs/development/tools/azcopy/default.nix6
-rw-r--r--pkgs/development/tools/build-managers/wafHook/default.nix1
-rw-r--r--pkgs/development/tools/ctlptl/default.nix6
-rw-r--r--pkgs/development/tools/database/sqlcl/default.nix6
-rw-r--r--pkgs/development/tools/godot/3/dont_clobber_environment.patch26
-rw-r--r--pkgs/development/tools/jql/default.nix6
-rw-r--r--pkgs/development/tools/kafkactl/default.nix6
-rw-r--r--pkgs/development/tools/kustomize/kustomize-sops.nix6
-rw-r--r--pkgs/development/tools/marksman/default.nix4
-rw-r--r--pkgs/development/tools/micronaut/default.nix4
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.11.x.nix3
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.15.x.nix3
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.16.x.nix3
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix23
-rw-r--r--pkgs/development/tools/misc/elfutils/default.nix12
-rw-r--r--pkgs/development/tools/misc/libtool/libtool2.nix22
-rw-r--r--pkgs/development/tools/misc/lsof/default.nix4
-rw-r--r--pkgs/development/tools/misc/patchelf/setup-hook.sh4
-rw-r--r--pkgs/development/tools/misc/pkg-config/default.nix2
-rw-r--r--pkgs/development/tools/mold/default.nix4
-rw-r--r--pkgs/development/tools/ruff/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-semver-checks/default.nix6
-rw-r--r--pkgs/development/tools/swiftpm2nix/default.nix25
-rw-r--r--pkgs/development/tools/swiftpm2nix/support.nix56
-rwxr-xr-xpkgs/development/tools/swiftpm2nix/swiftpm2nix.sh44
-rw-r--r--pkgs/development/tools/xcbuild/sdks.nix3
-rw-r--r--pkgs/development/tools/xcbuild/wrapper.nix2
-rw-r--r--pkgs/games/itchiodl/default.nix4
-rw-r--r--pkgs/games/openra/common.nix4
-rw-r--r--pkgs/misc/dxvk/default.nix65
-rw-r--r--pkgs/misc/dxvk/dxvk.nix81
-rw-r--r--pkgs/misc/dxvk/mcfgthread.patch34
-rw-r--r--pkgs/misc/dxvk/setup_dxvk.sh265
-rw-r--r--pkgs/misc/uboot/default.nix10
-rw-r--r--pkgs/os-specific/bsd/freebsd/default.nix13
-rw-r--r--pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix64
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix17
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix17
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix46
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix5
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix3
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix2
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix4
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix55
-rw-r--r--pkgs/os-specific/linux/lvm2/2_03.nix4
-rw-r--r--pkgs/os-specific/linux/picoprobe-udev-rules/default.nix32
-rw-r--r--pkgs/os-specific/linux/sgx/psw/default.nix4
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/default.nix14
-rw-r--r--pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch44
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix2
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/default.nix19
-rw-r--r--pkgs/servers/headscale/default.nix6
-rw-r--r--pkgs/servers/heisenbridge/default.nix18
-rw-r--r--pkgs/servers/jackett/default.nix4
-rw-r--r--pkgs/servers/komga/default.nix4
-rw-r--r--pkgs/servers/mautrix-googlechat/default.nix35
-rw-r--r--pkgs/servers/mautrix-signal/default.nix20
-rw-r--r--pkgs/servers/mautrix-telegram/default.nix24
-rw-r--r--pkgs/servers/monitoring/prometheus/redis-exporter.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/zfs-exporter.nix6
-rw-r--r--pkgs/servers/pocketbase/default.nix6
-rw-r--r--pkgs/servers/redpanda/default.nix10
-rw-r--r--pkgs/servers/sql/postgresql/ext/pgaudit.nix31
-rw-r--r--pkgs/servers/sql/postgresql/packages.nix2
-rw-r--r--pkgs/servers/tracing/honeycomb/honeymarker/default.nix10
-rw-r--r--pkgs/servers/tracing/honeycomb/honeymarker/versions.nix2
-rw-r--r--pkgs/servers/tracing/honeycomb/honeytail/default.nix10
-rw-r--r--pkgs/servers/tracing/honeycomb/honeytail/versions.nix2
-rw-r--r--pkgs/servers/tracing/honeycomb/honeyvent/default.nix10
-rw-r--r--pkgs/servers/tracing/honeycomb/honeyvent/versions.nix2
-rw-r--r--pkgs/servers/web-apps/discourse/plugins/all-plugins.nix1
-rw-r--r--pkgs/servers/web-apps/discourse/plugins/discourse-reactions/default.nix17
-rwxr-xr-xpkgs/servers/web-apps/discourse/update.py3
-rw-r--r--pkgs/servers/x11/xorg/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix12
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list2
-rw-r--r--pkgs/stdenv/adapters.nix1
-rw-r--r--pkgs/stdenv/darwin/make-bootstrap-tools.nix2
-rw-r--r--pkgs/stdenv/generic/setup.sh89
-rw-r--r--pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh13
-rw-r--r--pkgs/stdenv/linux/default.nix7
-rw-r--r--pkgs/stdenv/linux/make-bootstrap-tools.nix19
-rw-r--r--pkgs/test/stdenv/default.nix22
-rw-r--r--pkgs/tools/admin/procs/default.nix6
-rw-r--r--pkgs/tools/admin/syft/default.nix4
-rw-r--r--pkgs/tools/archivers/unzip/default.nix9
-rw-r--r--pkgs/tools/archivers/xarchiver/default.nix4
-rw-r--r--pkgs/tools/backup/pgbackrest/default.nix4
-rw-r--r--pkgs/tools/backup/tsm-client/default.nix10
-rw-r--r--pkgs/tools/compression/gzip/default.nix15
-rw-r--r--pkgs/tools/compression/lzip/default.nix4
-rw-r--r--pkgs/tools/compression/xz/default.nix4
-rw-r--r--pkgs/tools/games/scarab/default.nix4
-rw-r--r--pkgs/tools/misc/copier/default.nix51
-rw-r--r--pkgs/tools/misc/ipxe/default.nix10
-rw-r--r--pkgs/tools/misc/rmlint/default.nix9
-rw-r--r--pkgs/tools/misc/rmlint/scons-nix-env.patch19
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/twspace-crawler/default.nix23
-rw-r--r--pkgs/tools/misc/wakapi/default.nix31
-rw-r--r--pkgs/tools/misc/wimboot/default.nix9
-rw-r--r--pkgs/tools/networking/openconnect/common.nix5
-rw-r--r--pkgs/tools/networking/openconnect/default.nix3
-rw-r--r--pkgs/tools/networking/pritunl-client/default.nix6
-rw-r--r--pkgs/tools/networking/unbound/default.nix4
-rwxr-xr-xpkgs/tools/nix/info/info.sh4
-rw-r--r--pkgs/tools/package-management/nix/nix-perl.nix2
-rw-r--r--pkgs/tools/package-management/pkg/default.nix36
-rw-r--r--pkgs/tools/text/gawk/default.nix20
-rw-r--r--pkgs/tools/text/igrep/default.nix6
-rw-r--r--pkgs/tools/text/mdbook-open-on-gh/default.nix6
-rw-r--r--pkgs/tools/typesetting/hevea/default.nix7
-rw-r--r--pkgs/tools/virtualization/awsebcli/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix146
-rw-r--r--pkgs/top-level/darwin-packages.nix2
-rw-r--r--pkgs/top-level/make-tarball.nix6
-rw-r--r--pkgs/top-level/nixpkgs-basic-release-checks.nix2
-rw-r--r--pkgs/top-level/python-packages.nix24
377 files changed, 6870 insertions, 1855 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index a4a653b175e3b..fedcd5d75f63a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -134,7 +134,9 @@
 /pkgs/development/ruby-modules      @marsam
 
 # Rust
-/pkgs/development/compilers/rust @Mic92 @LnL7 @zowoq
+/pkgs/development/compilers/rust @Mic92 @LnL7 @zowoq @winterqt @figsoda
+/pkgs/build-support/rust @zowoq @winterqt @figsoda
+/doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
 
 # C compilers
 /pkgs/development/compilers/gcc @matthewbauer
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 1972ca62f4f29..a12d68c0934f8 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -253,7 +253,7 @@ The propagated equivalent of `depsTargetTarget`. This is prefixed for the same r
 
 #### `NIX_DEBUG` {#var-stdenv-NIX_DEBUG}
 
-A natural number indicating how much information to log. If set to 1 or higher, `stdenv` will print moderate debugging information during the build. In particular, the `gcc` and `ld` wrapper scripts will print out the complete command line passed to the wrapped tools. If set to 6 or higher, the `stdenv` setup script will be run with `set -x` tracing. If set to 7 or higher, the `gcc` and `ld` wrapper scripts will also be run with `set -x` tracing.
+A number between 0 and 7 indicating how much information to log. If set to 1 or higher, `stdenv` will print moderate debugging information during the build. In particular, the `gcc` and `ld` wrapper scripts will print out the complete command line passed to the wrapped tools. If set to 6 or higher, the `stdenv` setup script will be run with `set -x` tracing. If set to 7 or higher, the `gcc` and `ld` wrapper scripts will also be run with `set -x` tracing.
 
 ### Attributes affecting build properties {#attributes-affecting-build-properties}
 
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index c3ed528682657..30615c9fde32c 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -82,8 +82,13 @@ rec {
     isMusl         = with abis; map (a: { abi = a; }) [ musl musleabi musleabihf muslabin32 muslabi64 ];
     isUClibc       = with abis; map (a: { abi = a; }) [ uclibc uclibceabi uclibceabihf ];
 
-    isEfi          = map (family: { cpu.family = family; })
-                       [ "x86" "arm" "riscv" ];
+    isEfi = [
+      { cpu = { family = "arm"; version = "6"; }; }
+      { cpu = { family = "arm"; version = "7"; }; }
+      { cpu = { family = "arm"; version = "8"; }; }
+      { cpu = { family = "riscv"; }; }
+      { cpu = { family = "x86"; }; }
+    ];
   };
 
   matchAnyAttrs = patterns:
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index bdf93d4e6d292..f67493a332dd0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2530,6 +2530,12 @@
     githubId = 89596;
     name = "Florian Friesdorf";
   };
+  ChaosAttractor = {
+    email = "lostattractor@gmail.com";
+    github = "LostAttractor";
+    githubId = 46527539;
+    name = "ChaosAttractor";
+  };
   chekoopa = {
     email = "chekoopa@mail.ru";
     github = "chekoopa";
@@ -13990,6 +13996,13 @@
     githubId = 2666479;
     name = "Y Nguyen";
   };
+  superherointj = {
+    name = "Sérgio Marcelo";
+    email = "sergiomarcelo+nixpkgs@ya.ru";
+    matrix = "@superherointj:matrix.org";
+    github = "superherointj";
+    githubId = 5861043;
+  };
   SuperSandro2000 = {
     email = "sandro.jaeckel@gmail.com";
     matrix = "@sandro:supersandro.de";
@@ -14124,6 +14137,15 @@
     githubId = 5991987;
     name = "Alexander Sosedkin";
   };
+  t4ccer = {
+    email = "t4ccer@gmail.com";
+    github = "t4ccer";
+    githubId = 64430288;
+    name = "Tomasz Maciosowski";
+    keys = [{
+      fingerprint = "6866 981C 4992 4D64 D154  E1AC 19E5 A2D8 B1E4 3F19";
+    }];
+  };
   tadeokondrak = {
     email = "me@tadeo.ca";
     github = "tadeokondrak";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index b813948db1d64..49ddf1f10be83 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -698,9 +698,11 @@ with lib.maintainers; {
 
   rust = {
     members = [
-      andir
+      figsoda
       lnl7
       mic92
+      tjni
+      winter
       zowoq
     ];
     scope = "Maintain the Rust compiler toolchain and nixpkgs integration.";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 87535cab12b31..dd0e6a5d068dc 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -353,6 +353,12 @@
       </listitem>
       <listitem>
         <para>
+          Calling <literal>makeSetupHook</literal> without passing a
+          <literal>name</literal> argument is deprecated.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           Qt 5.12 and 5.14 have been removed, as the corresponding
           branches have been EOL upstream for a long time. This affected
           under 10 packages in nixpkgs, largely unmaintained upstream as
@@ -413,6 +419,17 @@
           https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The iputils package, which is installed by default, no longer
+          provides the <literal>ninfod</literal>,
+          <literal>rarpd</literal> and <literal>rdisc</literal> tools.
+          See
+          <link xlink:href="https://github.com/iputils/iputils/releases/tag/20221126">upstream’s
+          release notes</link> for more details and available
+          replacements.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-23.05-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 16f2714267d3e..de455c1293bf7 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -87,6 +87,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.
 
+- Calling `makeSetupHook` without passing a `name` argument is deprecated.
+
 - Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually.
 
 - The [services.wordpress.sites.&lt;name&gt;.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.&lt;name&gt;.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
@@ -101,6 +103,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - .NET 5.0 was removed due to being end-of-life, use a newer, supported .NET version - https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core
 
+- The iputils package, which is installed by default, no longer provides the
+  `ninfod`, `rarpd` and `rdisc` tools. See
+  [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20221126)
+  for more details and available replacements.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json b/nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json
index 9aa51b61431db..c204606193af5 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/client-rt.conf.json
@@ -35,5 +35,20 @@
     }
   ],
   "filter.properties": {},
-  "stream.properties": {}
+  "stream.properties": {},
+  "alsa.properties": {},
+  "alsa.rules": [
+    {
+      "matches": [
+        {
+          "application.process.binary": "resolve"
+        }
+      ],
+      "actions": {
+        "update-props": {
+          "alsa.buffer-bytes": 131072
+        }
+      }
+    }
+  ]
 }
diff --git a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json b/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
index 4a173f7322972..f2e396dd28d76 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
@@ -58,6 +58,18 @@
           "node.passive": true
         }
       }
+    },
+    {
+      "matches": [
+        {
+          "client.name": "Mixxx"
+        }
+      ],
+      "actions": {
+        "update-props": {
+          "jack.merge-monitor": false
+        }
+      }
     }
   ]
 }
diff --git a/nixos/modules/services/hardware/bluetooth.nix b/nixos/modules/services/hardware/bluetooth.nix
index 6453e6968dccb..2a58be51bb023 100644
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@@ -71,6 +71,29 @@ in
         };
         description = lib.mdDoc "Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf).";
       };
+
+      input = mkOption {
+        type = cfgFmt.type;
+        default = { };
+        example = {
+          General = {
+            IdleTimeout = 30;
+            ClassicBondedOnly = true;
+          };
+        };
+        description = lib.mdDoc "Set configuration for the input service (/etc/bluetooth/input.conf).";
+      };
+
+      network = mkOption {
+        type = cfgFmt.type;
+        default = { };
+        example = {
+          General = {
+            DisableSecurity = true;
+          };
+        };
+        description = lib.mdDoc "Set configuration for the network service (/etc/bluetooth/network.conf).";
+      };
     };
   };
 
@@ -80,6 +103,10 @@ in
     environment.systemPackages = [ package ]
       ++ optional cfg.hsphfpd.enable pkgs.hsphfpd;
 
+    environment.etc."bluetooth/input.conf".source =
+      cfgFmt.generate "input.conf" cfg.input;
+    environment.etc."bluetooth/network.conf".source =
+      cfgFmt.generate "network.conf" cfg.network;
     environment.etc."bluetooth/main.conf".source =
       cfgFmt.generate "main.conf" (recursiveUpdate defaults cfg.settings);
     services.udev.packages = [ package ];
diff --git a/nixos/modules/services/networking/openconnect.nix b/nixos/modules/services/networking/openconnect.nix
index 5a02bd072257f..7f9006053b890 100644
--- a/nixos/modules/services/networking/openconnect.nix
+++ b/nixos/modules/services/networking/openconnect.nix
@@ -90,6 +90,7 @@ let
   generateConfig = name: icfg:
     pkgs.writeText "config" ''
       interface=${name}
+      ${optionalString (icfg.protocol != null) "protocol=${icfg.protocol}"}
       ${optionalString (icfg.user != null) "user=${icfg.user}"}
       ${optionalString (icfg.passwordFile != null) "passwd-on-stdin"}
       ${optionalString (icfg.certificate != null)
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index b295b9a109b6d..65b94f61c4aef 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -365,6 +365,7 @@ in
             pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
           ];
           optionalPackages = [
+            pkgs.aha # needed by kinfocenter for fwupd support
             plasma-browser-integration
             konsole
             oxygen
diff --git a/pkgs/applications/audio/flacon/default.nix b/pkgs/applications/audio/flacon/default.nix
index 98b9faf8d24ac..4564fcccc4e16 100644
--- a/pkgs/applications/audio/flacon/default.nix
+++ b/pkgs/applications/audio/flacon/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flacon";
-  version = "9.5.1";
+  version = "10.0.0";
 
   src = fetchFromGitHub {
     owner = "flacon";
     repo = "flacon";
     rev = "v${version}";
-    sha256 = "sha256-45aA2Ib69Gb1Mg/5907rp1nfRbNyQq12pm/aFwTdgeA=";
+    sha256 = "sha256-59p5x+d7Vmxx+bdBDxrlf4+NRIdUBuRk+DqohV98XYY=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index cbed4b36181eb..df42258700cad 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-7SuM7a8IIecAJ83QvJfUba/wArAEXywqL2HwVbeG8H4=";
+    sha256 = "05lr9f0q4x1kvgfa3xrfmagpwvijv9m1s316aa9figqlkcc5vv4k";
   };
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
diff --git a/pkgs/applications/audio/go-musicfox/default.nix b/pkgs/applications/audio/go-musicfox/default.nix
new file mode 100644
index 0000000000000..cf5ac3f8c52e7
--- /dev/null
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, clangStdenv
+, pkg-config
+, alsa-lib
+, flac
+}:
+
+# gcc only supports objc on darwin
+buildGoModule.override { stdenv = clangStdenv; } rec {
+  pname = "go-musicfox";
+  version = "3.6.1";
+
+  src = fetchFromGitHub {
+    owner = "anhoder";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-iinEo+HrcNM3gx1iUqe1duRd45PrYgVybRt9NKphwuY=";
+  };
+
+  deleteVendor = true;
+
+  vendorHash = "sha256-DbdAEvcspTYMYMvc5IBEUtQAJMW8JZpNi0UA/DvzGFo=";
+
+  subPackages = [ "cmd/musicfox.go" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X go-musicfox/pkg/constants.AppVersion=${version}"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    flac
+  ];
+
+  meta = with lib; {
+    description = "Terminal netease cloud music client written in Go";
+    homepage = "https://github.com/anhoder/go-musicfox";
+    license = licenses.mit;
+    mainProgram = "musicfox";
+    maintainers = with maintainers; [ zendo ];
+  };
+}
diff --git a/pkgs/applications/audio/open-stage-control/default.nix b/pkgs/applications/audio/open-stage-control/default.nix
index 3574dc2f5ac92..0860501c87c45 100644
--- a/pkgs/applications/audio/open-stage-control/default.nix
+++ b/pkgs/applications/audio/open-stage-control/default.nix
@@ -2,13 +2,13 @@
 
 buildNpmPackage rec {
   pname = "open-stage-control";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "jean-emmanuel";
     repo = "open-stage-control";
     rev = "v${version}";
-    hash = "sha256-6tRd8boVwWc8qGlklYqA/Kp76VOMvtUJlu/G/InvHkA=";
+    hash = "sha256-tfWimJ9eEFBUxPRVNjgbu8tQNokPbXOxOXO64mFuMfM=";
   };
 
   # Remove some Electron stuff from package.json
diff --git a/pkgs/applications/audio/rhvoice/honor_nix_environment.patch b/pkgs/applications/audio/rhvoice/honor_nix_environment.patch
index fed5a2ea5e1da..0b2cab3975e58 100644
--- a/pkgs/applications/audio/rhvoice/honor_nix_environment.patch
+++ b/pkgs/applications/audio/rhvoice/honor_nix_environment.patch
@@ -1,5 +1,3 @@
-diff --git a/SConstruct b/SConstruct
-index 3ad4d9a..fb02365 100644
 --- a/SConstruct
 +++ b/SConstruct
 @@ -94,11 +94,8 @@ def CheckWiX(context):
@@ -16,13 +14,15 @@ index 3ad4d9a..fb02365 100644
  
  def validate_spd_version(key,val,env):
      m=re.match(r"^\d+\.\d+",val)
-@@ -208,9 +205,9 @@ def create_base_env(user_vars):
+@@ -207,10 +204,10 @@ def create_base_env(user_vars):
+     env_args["LIBS"]=[]
      env_args["package_name"]="RHVoice"
      env_args["CPPDEFINES"]=[("RHVOICE","1")]
-     env=Environment(**env_args)
+-    env=Environment(**env_args)
 -    if env["dev"]:
 -        env["prefix"]=os.path.abspath("local")
 -        env["RPATH"]=env.Dir("$libdir").abspath
++    env=Environment(ENV = os.environ, **env_args)
 +    env.PrependENVPath("PATH", os.environ["PATH"])
 +    env["ENV"]["PKG_CONFIG_PATH"]=os.environ["PKG_CONFIG_PATH"]
 +    env["RPATH"]=env.Dir("$libdir").abspath
diff --git a/pkgs/applications/audio/yesplaymusic/default.nix b/pkgs/applications/audio/yesplaymusic/default.nix
new file mode 100644
index 0000000000000..758dcbbd935a2
--- /dev/null
+++ b/pkgs/applications/audio/yesplaymusic/default.nix
@@ -0,0 +1,120 @@
+{ lib
+, stdenv
+, fetchurl
+, undmg
+, dpkg
+, autoPatchelfHook
+, wrapGAppsHook
+, makeWrapper
+, alsa-lib
+, at-spi2-atk
+, cups
+, nspr
+, nss
+, mesa # for libgbm
+, xorg
+, xdg-utils
+, libdrm
+, libnotify
+, libsecret
+, libuuid
+, gtk3
+, systemd
+}:
+let
+  pname = "YesPlayMusic";
+  version = "0.4.5";
+
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/yesplaymusic_${version}_amd64.deb";
+      hash = "sha256-igd2MzIjwDSOLP0Xi2mSJnEPGWendggPC/MwTDCDui0=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/yesplaymusic_${version}_arm64.deb";
+      hash = "sha256-6MZrAJGXuEJ9HMUje3ppTz2rdaBydwoQKBk6af81pT0=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/YesPlayMusic-mac-${version}-x64.dmg";
+      hash = "sha256-mvmaSrDoIDeOVylkJCVY97yRUHfEI8CysmKrgBUrFGM=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/YesPlayMusic-mac-${version}-arm64.dmg";
+      hash = "sha256-Qo03rGS/qB6Sc1IunU7F81WJ/t+mWR7ZRsKYK97LHik=";
+    };
+  };
+  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  libraries = [
+    alsa-lib
+    at-spi2-atk
+    cups
+    nspr
+    nss
+    mesa
+    xorg.libxshmfence
+    xorg.libXScrnSaver
+    xorg.libXtst
+    xdg-utils
+    libdrm
+    libnotify
+    libsecret
+    libuuid
+    gtk3
+  ];
+
+  meta = with lib; {
+    description = "A good-looking third-party netease cloud music player";
+    homepage = "https://github.com/qier222/YesPlayMusic/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ChaosAttractor ];
+    platforms = builtins.attrNames srcs;
+  };
+in
+if stdenv.isDarwin
+then stdenv.mkDerivation {
+  inherit pname version src meta;
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+  '';
+}
+else stdenv.mkDerivation {
+  inherit pname version src meta;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    wrapGAppsHook
+    makeWrapper
+  ];
+
+  buildInputs = libraries;
+
+  runtimeDependencies = [
+    (lib.getLib systemd)
+  ];
+
+  unpackPhase = ''
+    ${dpkg}/bin/dpkg-deb -x $src .
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r opt $out/opt
+    cp -r usr/share $out/share
+    substituteInPlace $out/share/applications/yesplaymusic.desktop \
+      --replace "/opt/YesPlayMusic/yesplaymusic" "$out/bin/yesplaymusic"
+    makeWrapper $out/opt/YesPlayMusic/yesplaymusic $out/bin/yesplaymusic \
+      --argv0 "yesplaymusic" \
+      --add-flags "$out/opt/YesPlayMusic/resources/app.asar"
+
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/applications/blockchains/haven-cli/default.nix b/pkgs/applications/blockchains/haven-cli/default.nix
index 5b1d12634df5e..4f53eaf580ccb 100644
--- a/pkgs/applications/blockchains/haven-cli/default.nix
+++ b/pkgs/applications/blockchains/haven-cli/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "haven-cli";
-  version = "3.0.3";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "haven-protocol-org";
     repo = "haven-main";
     rev = "v${version}";
-    sha256 = "sha256-JbNk1TF0N3tRYGfZfSBFk+t/8GA4yjqP9G6S0ktdur8=";
+    sha256 = "sha256-HLZ9j75MtF7FkHA4uefkrYp07pVZe1Ac1wny7T0CMpA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/eyedropper/default.nix b/pkgs/applications/graphics/eyedropper/default.nix
index 41999239af1ae..8b4411ad04b36 100644
--- a/pkgs/applications/graphics/eyedropper/default.nix
+++ b/pkgs/applications/graphics/eyedropper/default.nix
@@ -15,19 +15,19 @@
 
 stdenv.mkDerivation rec {
   pname = "eyedropper";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "FineFindus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-sDrMIryVFkjMGHbYvNDmKb1HyJNGb3Hd+muxUJKhogE=";
+    hash = "sha256-kc/UREQpmw3suA6bYEr9fCIwMzNMrEY9E5qf+rhKsC4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-mztc44hHdqzR3WbG6tkCL38EfgBajRLlpMC8ElpXnlo=";
+    hash = "sha256-/eas1PObrj9IuDIzlBVbfhEhH8eDyZ7CD871JmAqnyY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/fluxus/default.nix b/pkgs/applications/graphics/fluxus/default.nix
index 535b177bd7bd2..971ce42c03f9c 100644
--- a/pkgs/applications/graphics/fluxus/default.nix
+++ b/pkgs/applications/graphics/fluxus/default.nix
@@ -22,26 +22,6 @@
 , zlib
 }:
 let
-  libs = [
-    alsa-lib
-    bzip2
-    fftw
-    freeglut
-    freetype
-    glew
-    libjack2
-    libGL
-    libGLU
-    libjpeg
-    liblo
-    libpng
-    libsndfile
-    libtiff
-    ode
-    openal
-    openssl
-    zlib
-  ];
   racket = racket_7_9;
 in
 stdenv.mkDerivation rec {
@@ -77,7 +57,6 @@ stdenv.mkDerivation rec {
     "RacketPrefix=${racket}"
     "RacketInclude=${racket}/include/racket"
     "RacketLib=${racket}/lib/racket"
-    "LIBPATH=${lib.makeLibraryPath libs}"
     "DESTDIR=build"
   ];
   configurePhase = ''
diff --git a/pkgs/applications/graphics/fluxus/fix-build.patch b/pkgs/applications/graphics/fluxus/fix-build.patch
index b19ed9c2cbc7b..b44327520e654 100644
--- a/pkgs/applications/graphics/fluxus/fix-build.patch
+++ b/pkgs/applications/graphics/fluxus/fix-build.patch
@@ -1,5 +1,10 @@
-diff --git a/SConstruct b/SConstruct
-index 32cb644..650333a 100644
+scons does not use os environment by default:
+  https://scons.org/doc/2.1.0/HTML/scons-user/x1750.html
+
+nixpkgs' cc-wrapper on the other hand relies on various NIX_* variables
+to be passed through like NIX_CFLAGS_COMPILE_BEFORE.
+
+While at it ported to python3-style print().
 --- a/SConstruct
 +++ b/SConstruct
 @@ -6,7 +6,7 @@
@@ -11,16 +16,15 @@ index 32cb644..650333a 100644
  
  MajorVersion = "0"
  MinorVersion = "19"
-@@ -225,13 +225,18 @@ if env['PLATFORM'] == 'posix':
-                     ["asound", "alsa/asoundlib.h"],
-                     ["openal", "AL/al.h"]]
+@@ -100,6 +100,7 @@ IncludePaths = [
+ paranoid = ' -W -Wcast-qual -Wwrite-strings -Wcast-align -Wpointer-arith -Wconversion -Wredundant-decls -Wunreachable-code -Winline -Wlarger-than-256'
  
-+env.Append(ENV={'PATH': ' ' + os.environ['PATH'], })
-+env.Append(LIBPATH=ARGUMENTS.get('LIBPATH', '').split(':'))
-+env.Append(CCFLAGS=' ' + os.environ.get('NIX_CFLAGS_COMPILE',''))
-+env.Append(CCFLAGS=' -DNULL=0')
-+
- ################################################################################
+ env = Environment(CCFLAGS = '-ggdb -pipe -Wall -O3 -ffast-math -Wno-unused -fPIC -pthread',
++                  ENV = os.environ,
+                   VERSION_NUM = FluxusVersion)
+ env.MergeFlags(ARGUMENTS.get('CCFLAGS', '').split())
+ env.MergeFlags(ARGUMENTS.get('LDFLAGS', '').split())
+@@ -229,9 +230,9 @@ if env['PLATFORM'] == 'posix':
  # Make sure we have these libraries availible
  
  if not GetOption('clean'):
@@ -33,7 +37,7 @@ index 32cb644..650333a 100644
          # detect ode precision
          if not GetOption('clean'):
            try:
-@@ -240,27 +245,27 @@ if not GetOption('clean'):
+@@ -240,27 +241,27 @@ if not GetOption('clean'):
              if isinstance(ode_str[0], str):
                env.MergeFlags(ode_str[0])
            except:
@@ -65,7 +69,7 @@ index 32cb644..650333a 100644
                          Exit(1)
  
          if not conf.CheckFunc("dInitODE2"):
-@@ -334,7 +339,7 @@ if not GetOption('clean'):
+@@ -334,7 +335,7 @@ if not GetOption('clean'):
  			])
  
  	if raco_status != 0:
@@ -74,7 +78,7 @@ index 32cb644..650333a 100644
  		Exit(1)
  
  
-@@ -377,8 +382,8 @@ if not GetOption('clean') and static_modules:
+@@ -377,8 +378,8 @@ if not GetOption('clean') and static_modules:
  
  		app_env['LIBS'].remove("pthread")
  		app_env['LIBS'].remove("dl")
@@ -85,7 +89,7 @@ index 32cb644..650333a 100644
  
  		# now go through the rest of the libs, removing them from
  		# the environment at the same time
-@@ -425,7 +430,7 @@ SConscript(dirs = build_dirs,
+@@ -425,7 +426,7 @@ SConscript(dirs = build_dirs,
  if not GetOption('clean'):
      helpmap_status = subprocess.call(["racket", "makehelpmap.scm"], cwd="docs/helpmap")
      if helpmap_status != 0:
diff --git a/pkgs/applications/misc/gremlin-console/default.nix b/pkgs/applications/misc/gremlin-console/default.nix
index 051fee4f6fb62..59f71a3f88c29 100644
--- a/pkgs/applications/misc/gremlin-console/default.nix
+++ b/pkgs/applications/misc/gremlin-console/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "gremlin-console";
-  version = "3.6.1";
+  version = "3.6.2";
   src = fetchzip {
     url = "https://downloads.apache.org/tinkerpop/${version}/apache-tinkerpop-gremlin-console-${version}-bin.zip";
-    sha256 = "sha256-lr3ffyAL8LBj7mt4EmN2Kq2pxvW4P7zd66gU9X4qzJw=";
+    sha256 = "sha256-c7uwXqmMrWDYZ9CpGuVoo1e5yWHsoNd0zihZKdCTg7E=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 9890ea9ad8db6..360c97d4a2978 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -3,15 +3,15 @@
 }:
 let
   pname = "josm";
-  version = "18622";
+  version = "18646";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-AtV7Lj+z1GOCEl8xUaumYcN848pMsLIfMGmBXved6WU=";
+      hash = "sha256-nncN1cGpuVy4O3JeH56iQfwZGM5/xs3U/V+gVZbChOE=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      hash = "sha256-q3Kr0YWe6Jm6wO6h7fMANKLCWKfU0zDpBZjRH662eSg=";
+      hash = "sha256-ihBEOl6WnIaA7x40D2HTdVIDb30BYnhlh0sQrbNA/SU=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index 3d6e42bd628d6..56490754e1723 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.1.11";
+  version = "0.2.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-O4fVEYstDkVHn7fBVOGu1ok9K9xiO9uLx0+vb6qMZoA=";
+    sha256 = "sha256-CsfzQN7n/LsNIivJShDG02cHwPktkXl/0udBSPz0i2U=";
   };
 
-  cargoHash = "sha256-LSMAE24E8Is/ejUE/2vogP0GmpF+9oO2pJoQOZ8OfU8=";
+  cargoHash = "sha256-FSuhG+ZSQzwj1YB3xs3A1uFWPhwK8FIfVfUY9V/J2Z8=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";
diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
index 36e95ee8f098d..f71841c1af9a6 100644
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "0.29.7";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gVXil6Gc65/6VMuONfVyxU6SSV0vCbJKXDvtG4a+pbU=";
+    hash = "sha256-8gyALVW+ort76r/zevWAhZlJ/fg5DBmwUNvjZ21wWKY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -43,7 +43,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  vendorHash = "sha256-fL12Rx/0TF2jjciSHgfIDfrqdQxxm2JiGfgO3Dgz81M=";
+  vendorHash = "sha256-rbGKFZY9YEcBAFFxG6v3xaVLQxVoqIehN0LgINku3Xo=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/usql/default.nix b/pkgs/applications/misc/usql/default.nix
index 9300bc3c228da..4911556086c73 100644
--- a/pkgs/applications/misc/usql/default.nix
+++ b/pkgs/applications/misc/usql/default.nix
@@ -10,18 +10,18 @@
 
 buildGoModule rec {
   pname = "usql";
-  version = "0.13.6";
+  version = "0.13.8";
 
   src = fetchFromGitHub {
     owner = "xo";
     repo = "usql";
     rev = "v${version}";
-    hash = "sha256-FmwsiCXSnTEvA1oAScJhnl1ZG7WTfbNQyJBULnNt9/c=";
+    hash = "sha256-oNsA9VM6MN2czeZSTFGvmCWX0T3iVaAhQk1mVRyKgWw=";
   };
 
   buildInputs = [ unixODBC icu ];
 
-  vendorHash = "sha256-lla+smDg6nNNQZYEQI5xY3iRw4gm6WCDh8gDZ6N9lqk=";
+  vendorHash = "sha256-LG5gTHXB1ItDZFbTBHyZGHZLaSYb8wekIHkahTMXzkk=";
   proxyVendor = true;
 
   # Exclude broken impala & hive driver
diff --git a/pkgs/applications/misc/ydict/default.nix b/pkgs/applications/misc/ydict/default.nix
index 9440c23681007..078d6abccf501 100644
--- a/pkgs/applications/misc/ydict/default.nix
+++ b/pkgs/applications/misc/ydict/default.nix
@@ -1,4 +1,9 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, makeWrapper
+, mpg123
+}:
 
 buildGoModule rec {
   pname = "ydict";
@@ -13,16 +18,26 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-c5nQVQd4n978kFAAKcx5mX2Jz16ZOhS8iL/oxS1o5xs=";
 
-  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.Version=${version}"
+  ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  preFixup = ''
+    wrapProgram $out/bin/${pname} \
+      --prefix PATH ":" "${lib.makeBinPath [ mpg123 ]}";
+  '';
 
   # has no tests
   doCheck = false;
 
   meta = with lib; {
-    description = "A command-line Chinese dictionary";
+    description = "Yet another command-line Youdao Chinese dictionary";
     homepage = "https://github.com/TimothyYe/ydict";
     license = licenses.mit;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ zendo ];
   };
 }
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 13645e542640a..948b321724894 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -525,7 +525,7 @@ buildStdenv.mkDerivation ({
             fi
 
             # Extract the debug info.
-            header "separating debug info from $i (build ID $id)"
+            echo "separating debug info from $i (build ID $id)"
             mkdir -p "$dst/''${id:0:2}"
             $OBJCOPY --only-keep-debug "$i" "$dst/''${id:0:2}/''${id:2}.debug"
 
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 378fe1f4039b0..06bd49facb813 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -15,6 +15,7 @@
 , pciutils
 , sndio
 , libjack2
+, speechd
 }:
 
 ## configurability of the wrapper itself
@@ -82,6 +83,7 @@ let
             ++ lib.optional sndioSupport sndio
             ++ lib.optional jackSupport libjack2
             ++ lib.optional smartcardSupport opensc
+            ++ lib.optional (cfg.speechSynthesisSupport or false) speechd
             ++ pkcs11Modules;
       gtk_modules = [ libcanberra-gtk3 ];
 
diff --git a/pkgs/applications/networking/cluster/acorn/default.nix b/pkgs/applications/networking/cluster/acorn/default.nix
index ce0f07f9ec103..e30e78daf7cf7 100644
--- a/pkgs/applications/networking/cluster/acorn/default.nix
+++ b/pkgs/applications/networking/cluster/acorn/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "acorn";
-  version = "0.4.2";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "acorn-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IzjCYVQ9RhuAmgloue421F43ARviaHW7mTkLhLW/VPM=";
+    hash = "sha256-wrtuBme12pilFKDyzKWlZFUu99NQKgwnx2fUOfL+VAY=";
   };
 
-  vendorHash = "sha256-z2ya/CgH9AcxHe73Yt9XWbJqH4OrZWt0bRDsna5hYeo=";
+  vendorHash = "sha256-9cq64397RB4KWVatuKXi1EwjolGEpwAc+tC1zs3boQ4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 8eb6d94f389cd..b028512dd7c90 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.5.8";
+  version = "2.5.9";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-4L0xj4+NLThSLzXTncUnUILOsV3qr9+f8osv19OW6oI=";
+    sha256 = "sha256-RZ3bcuJmUUnucD2lhfxLU8vbrorVUowF8hAW9NGSmbI=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index 97fff7f9bbb3e..4aeb491410bd7 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -65,7 +65,7 @@ in buildGoModule rec {
     '';
     homepage = "https://fluxcd.io";
     license = licenses.asl20;
-    maintainers = with maintainers; [ bryanasdev000 jlesquembre ];
+    maintainers = with maintainers; [ bryanasdev000 jlesquembre superherointj ];
     mainProgram = "flux";
   };
 }
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 74c3e1ccdf577..74f54d28d5941 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -75,7 +75,7 @@ let
     description = "A lightweight Kubernetes distribution";
     license = licenses.asl20;
     homepage = "https://k3s.io";
-    maintainers = with maintainers; [ euank mic92 ];
+    maintainers = with maintainers; [ euank mic92 superherointj ];
     platforms = platforms.linux;
   };
 
diff --git a/pkgs/applications/networking/cluster/k9s/default.nix b/pkgs/applications/networking/cluster/k9s/default.nix
index de9dd27b52646..141a17e34e2f2 100644
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.26.7";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
     rev    = "v${version}";
-    sha256 = "sha256-TshUQJIwGSqVP+YUJvSHSczvnvzr1kX761oIbfQzVzw=";
+    sha256 = "sha256-optEMGB6izGlpcq2AJOY4lTt8igYBilE0Bg8KxE8AsU=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   tags = [ "netgo" ];
 
-  vendorSha256 = "sha256-W0yU5rMUuO2JtKRZpexsCqIUy3h+2hSDRcq/lp0UHX8=";
+  vendorHash = "sha256-57JrBmund2hwcgqWkLos/h1EOgZQb9HfKUf1BX0MYGQ=";
 
   # TODO investigate why some config tests are failing
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
diff --git a/pkgs/applications/networking/cluster/karmor/default.nix b/pkgs/applications/networking/cluster/karmor/default.nix
index bf35eac948d43..b01dac8dc17c9 100644
--- a/pkgs/applications/networking/cluster/karmor/default.nix
+++ b/pkgs/applications/networking/cluster/karmor/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "karmor";
-  version = "0.11.5";
+  version = "0.11.6";
 
   src = fetchFromGitHub {
     owner = "kubearmor";
     repo = "kubearmor-client";
     rev = "v${version}";
-    hash = "sha256-xVYhZT4yqbSmxGH5DaarXzrGYMS1BuTaQ2T+huWYLBw=";
+    hash = "sha256-toN/pIvmmMwIARhY1i/2nmrC5ZVyTR7pttqkyXNuMaE=";
   };
 
-  vendorHash = "sha256-rlvAQ99/3+3VotyYAR2TgWG8ZdTKUT2XRv4hTF+QFpI=";
+  vendorHash = "sha256-TE+VPOhkTPqQTapxAcJzlQzRZfmb1J4pAWUKiTGLnZE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index 997b52434b829..e05e7847cfd48 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -12,9 +12,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.28.0";
+  version = "1.29.0";
 
-  vendorSha256 = "sha256-CyIpzwSYHbv96UoQ/SZXOl6v3xn3pvT39ZO+RpVHU5I=";
+  vendorHash = "sha256-wRCSUDzz+1e4/ijwAnIM8a/AlnNNdVkiz3WO4Nhuy+M=";
 
   doCheck = false;
 
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-Gn/RXZedID0sh5qTcBNg7GeLtI1JZYKXEWg2RZGXlDw=";
+    sha256 = "sha256-rdcMgL7bzdlxrelui+V1APJik0v/4YyUqj9QlMRq1nI=";
   };
 
   nativeBuildInputs = [ installShellFiles pkg-config which makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/nerdctl/default.nix b/pkgs/applications/networking/cluster/nerdctl/default.nix
index e508ee0006f81..bc57c87b2f87c 100644
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nerdctl";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i178AN8LDm1SmCx3G8uLmW1+/F3B8DQsrkawSBoefGw=";
+    hash = "sha256-6AXki9/gJVlHpA3iSS1GqkLWaUqE0c+X8alWdMyCFiU=";
   };
 
-  vendorSha256 = "sha256-0EWrFc55I3EmrAmmIYdsYtvO6xqDHbo5Uo6XC+NezZI=";
+  vendorHash = "sha256-28Wt9uQ7+PEWe+RaNv4HLz7HQbO7hXlX3O7s9SooLu8=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bee8591e4ae56..cbdbd5327dbeb 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -442,22 +442,22 @@
     "vendorHash": "sha256-aVbJT31IIgW0GYzwVX7kT4j7E+dadSbnttThh2lzGyE="
   },
   "google": {
-    "hash": "sha256-R104jYttXER/Pzd3ePHh9ZOvpcziuVQK0JcFqdbWtG0=",
+    "hash": "sha256-yxw+LtrBhfZlTVh36o3uUdt3zGo7VLTjk5Cc8xoqhio=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.50.0",
+    "rev": "v4.51.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-oModEw/gaQCDHLf+2EKf1O1HQSGWnqEReXowE6F7W0o="
   },
   "google-beta": {
-    "hash": "sha256-OrotSvDNK7PC6nyHEAvmTOYgdYFiHEE8YwfWcOAbPsk=",
+    "hash": "sha256-KQxIi9EF59FTcWoiE5oTZx+lVV+Pb+PH0QIz02PztN4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.50.0",
+    "rev": "v4.51.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-oModEw/gaQCDHLf+2EKf1O1HQSGWnqEReXowE6F7W0o="
   },
@@ -571,13 +571,13 @@
     "vendorHash": null
   },
   "ibm": {
-    "hash": "sha256-DvJow7KDyv1wGBw0QIQQ4MoLgQIT8+Cf6fjc7w4W7Ds=",
+    "hash": "sha256-Qdb5HpamjCNGlqSf3etFv0++Skrk/jm6UVBFsKGU+jw=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.49.0",
+    "rev": "v1.50.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Vt1AKXJ8KRoDESFvUeZPTjUFm7gwP/Uji4hyU16GhjY="
+    "vendorHash": "sha256-JkmfZ9yz3r26j1SHIwnyNA+nYWAy4DoaWEMfFUTzD3Y="
   },
   "icinga2": {
     "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",
@@ -843,11 +843,11 @@
     "vendorHash": null
   },
   "opennebula": {
-    "hash": "sha256-+EbEVwgo2HWmVhff7u5ohSJW8wuxK1kvWfvRWRwIP4o=",
+    "hash": "sha256-r8z5rpSvjNSDuvcRLtnOUFnBFFNAlcvfCbmW6LLHP5E=",
     "homepage": "https://registry.terraform.io/providers/OpenNebula/opennebula",
     "owner": "OpenNebula",
     "repo": "terraform-provider-opennebula",
-    "rev": "v1.1.0",
+    "rev": "v1.1.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-zKtBDnvlQHe+q0OZUMUGu1gNsx2wIrIoArtJrt0VaBk="
   },
@@ -870,11 +870,11 @@
     "vendorHash": "sha256-49ViIxICpvWgpv+uY0NTDvXGJthjH6aT38COfS+AOaQ="
   },
   "opsgenie": {
-    "hash": "sha256-NMaTTZQyEJ0vb+eDNTGRozTrme78Vo+/GuIR43AeDbU=",
+    "hash": "sha256-Wbe+DyK5wKuZZX8yd3DJN+2wT8KZt+YsBwJYKnZnfcI=",
     "homepage": "https://registry.terraform.io/providers/opsgenie/opsgenie",
     "owner": "opsgenie",
     "repo": "terraform-provider-opsgenie",
-    "rev": "v0.6.19",
+    "rev": "v0.6.20",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index 2a1bb79b655ed..7adcfc8a9a572 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.24.0";
+  version = "3.25.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+fOcFu52f2PiynF0B8r3zAW/ANypXx9inLnf4ZtwI2M=";
+    sha256 = "sha256-XH9o1DTwG5ne5TZDgsS4HfC5WqLXc16JtjkKQtiE8z0=";
   };
 
-  vendorSha256 = "sha256-+43UegjFjh86vXjH1A4jbORk8xTDZaJRc41RhFPcESk=";
+  vendorSha256 = "sha256-iVyLNPvmzkI46Cp0SgbxK6xIQspJjpYjqPf3mOMoZvU=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index 805aadfc40a9f..3d9fc7627b608 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -21,17 +21,17 @@
 
 let
   libdeltachat' = libdeltachat.overrideAttrs (old: rec {
-    version = "1.106.0";
+    version = "1.107.0";
     src = fetchFromGitHub {
       owner = "deltachat";
       repo = "deltachat-core-rust";
       rev = version;
-      hash = "sha256-S53ghVFb1qDI7MVNbc2ZlHqDN4VRBFQJCJg2J+w0erc=";
+      hash = "sha256-fjiS7GZy1BLgmxu4LFOWgucORcVx+9KleQcga+hRkSY=";
     };
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${old.pname}-${version}";
-      hash = "sha256-k4j814Ao7FAyd0w1nH2fuX1cJKjBkhPw0CVZqNU7Hqs=";
+      hash = "sha256-7XhSI/C0GEmsaL0UupvufB1bfPGbzSQJH720Y4/Do3o=";
     };
   });
   esbuild' = esbuild.override {
@@ -48,24 +48,16 @@ let
   };
 in buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "1.34.2";
+  version = "1.34.3";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     rev = "v${version}";
-    hash = "sha256-XOGfKa0eGVZKKKC0Pm2kw48XWWcrxCyDdYzCSKp+wco=";
+    hash = "sha256-6WZJD8lMsk1WNguMkXygBCTVpOzNkNuVZJ3Ygv6VBkM=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "bump-electron-to-22.1.0.patch";
-      url = "https://github.com/deltachat/deltachat-desktop/commit/944d2735cda6cd5a95cb83c57484fbaf16720a9c.patch";
-      hash = "sha256-kaKi32eFQ3hGLZLjiXmH9qs4GXezcDQ7zTdT2+D8NcQ=";
-    })
-  ];
-
-  npmDepsHash = "sha256-J3/S/jYQvO/U8StDtYI+jozon0d4VCdeqFX6x1hHzMo=";
+  npmDepsHash = "sha256-B91yQ/xi8+uyOllqYR7lZTfLBpJvZat1cIIJk9TkM/c=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -137,8 +129,6 @@ in buildNpmPackage rec {
     ];
   });
 
-  passthru.updateScript = ./update.sh;
-
   meta = with lib; {
     description = "Email-based instant messaging for Desktop";
     homepage = "https://github.com/deltachat/deltachat-desktop";
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/update.sh b/pkgs/applications/networking/instant-messengers/deltachat-desktop/update.sh
deleted file mode 100755
index f31279cf4f0ea..0000000000000
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/update.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils curl gnused jq moreutils nix-prefetch prefetch-npm-deps
-
-set -euo pipefail
-cd "$(dirname "$0")"
-
-owner=deltachat
-repo=deltachat-desktop
-nixpkgs=../../../../..
-
-rev=$(
-    curl -s "https://api.github.com/repos/$owner/$repo/releases" |
-    jq 'map(select(.prerelease | not)) | .[0].tag_name' --raw-output
-)
-ver=$(echo "$rev" | sed 's/^v//')
-old_ver=$(tac default.nix | sed -n 's/.*\bversion = "\(.*\)".*/\1/p' | head -1)
-if [ "$ver" = "$old_ver" ]; then
-    echo "Up to date: $ver"
-    exit
-fi
-echo "$old_ver -> $ver"
-
-hash=$(nix-prefetch -f "$nixpkgs" deltachat-desktop --rev "$rev")
-tac default.nix \
-    | sed -e "0,/version = \".*\"/s//version = \"$ver\"/" \
-          -e "0,/hash = \".*\"/s//hash = \"${hash//\//\\/}\"/" \
-    | tac \
-    | sponge default.nix
-
-src=$(nix-build "$nixpkgs" -A deltachat-desktop.src --no-out-link)
-hash=$(prefetch-npm-deps $src/package-lock.json)
-sed -i "s,npmDepsHash = \".*\",npmDepsHash = \"$hash\"," default.nix
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index f5d2479bdaa15..2023997aa8116 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -9,11 +9,11 @@
 
 let unwrapped = stdenv.mkDerivation rec {
   pname = "pidgin";
-  version = "2.14.10";
+  version = "2.14.12";
 
   src = fetchurl {
     url = "mirror://sourceforge/pidgin/pidgin-${version}.tar.bz2";
-    sha256 = "sha256-RUsbkovGvLsYM1OvMPv95VlfIkWjQjoaRubJei3yKBA=";
+    sha256 = "sha256-KwUka+IIYF7buTrp7cB5WD1EniqXENttNI0X9ZAgpLc=";
   };
 
   nativeBuildInputs = [ makeWrapper intltool ];
diff --git a/pkgs/applications/networking/mullvad-vpn/default.nix b/pkgs/applications/networking/mullvad-vpn/default.nix
index 15dc909aa6466..dc8c5729ddf87 100644
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, dpkg
 , alsa-lib, atk, cairo, cups, dbus, expat, fontconfig, freetype
 , gdk-pixbuf, glib, pango, nspr, nss, gtk3, mesa
-, xorg, autoPatchelfHook, systemd, libnotify, libappindicator
+, wayland, xorg, autoPatchelfHook, systemd, libnotify, libappindicator
 , makeWrapper
 }:
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
 
   unpackPhase = "dpkg-deb -x $src .";
 
-  runtimeDependencies = [ (lib.getLib systemd) libnotify libappindicator ];
+  runtimeDependencies = [ (lib.getLib systemd) libnotify libappindicator wayland ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/networking/newsreaders/slrn/default.nix b/pkgs/applications/networking/newsreaders/slrn/default.nix
index b1fb3b2054f5f..b29d9f494b042 100644
--- a/pkgs/applications/networking/newsreaders/slrn/default.nix
+++ b/pkgs/applications/networking/newsreaders/slrn/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-slang=${slang.dev}"
     "--with-ssl=${openssl.dev}"
+    "--with-slrnpull"
   ];
 
   buildInputs = [ slang ncurses openssl ];
diff --git a/pkgs/applications/radio/urh/default.nix b/pkgs/applications/radio/urh/default.nix
index 93836cee28197..3dd7a5422537e 100644
--- a/pkgs/applications/radio/urh/default.nix
+++ b/pkgs/applications/radio/urh/default.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "urh";
-  version = "2.9.3";
+  version = "2.9.4";
 
   src = fetchFromGitHub {
     owner = "jopohl";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-TrvyPcpSMACrbKPVOjxHsVsC28LmruiVO/CyCPh0KZ8=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Hi0VqBtGeaXMsibxbHk+2FN8mzfpmkuDr37JRW4Fp+s=";
   };
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];
diff --git a/pkgs/applications/science/biology/diamond/default.nix b/pkgs/applications/science/biology/diamond/default.nix
index 8073b1bea1634..6cdae4cb53a23 100644
--- a/pkgs/applications/science/biology/diamond/default.nix
+++ b/pkgs/applications/science/biology/diamond/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "diamond";
-  version = "2.0.15";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "bbuchfink";
     repo = "diamond";
     rev = "v${version}";
-    sha256 = "17z9vwj58i1zc22gv4qscx0dk3nxf5ix443gxsibh3a5zsnc6dkg";
+    sha256 = "sha256-tcUVWfb/EtJ6heJjQ3989uNjkWa6FocReJ5gjE35AMY=";
   };
 
 
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index 24a698ba80358..a5c98cb7df812 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "377";
+  version = "378";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    hash = "sha256-2xCP56Rdjtl+YEchtYRDtHNknmHiY2Mb+HWfhhipkLI=";
+    hash = "sha256-ZJ37/V7dDtnkfPjk2VO0sNPDC8KAFm38T/0Ulz/sPpI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 56f7e697ec87b..317db2924ab3a 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.39.0";
+  version = "2.39.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-uhmbE/tamco97JF7C9c2vA61qd+Hc31DXt398Q1pJls=";
+    sha256 = "sha256-QKOKCEezDDcbNYc7OvzxI4hd1B6j7Lv1EO+pfzzlwWE=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/applications/video/cinelerra/default.nix b/pkgs/applications/video/cinelerra/default.nix
index 0ce0623ec9d9e..972a68e04f03f 100644
--- a/pkgs/applications/video/cinelerra/default.nix
+++ b/pkgs/applications/video/cinelerra/default.nix
@@ -44,13 +44,13 @@
 
 stdenv.mkDerivation {
   pname = "cinelerra-cv";
-  version = "unstable-2021-02-14";
+  version = "unstable-2023-01-29";
 
   src = fetchFromGitHub {
     owner = "cinelerra-cv-team";
     repo = "cinelerra-cv";
-    rev = "7d0e8ede557d0cdf3606e0a8d97166a22f88d89e";
-    sha256 = "0n84y2wp47y89drc48cm1609gads5c6saw6c6bqcf5c5wcg1yfbj";
+    rev = "bb00ac6b70fcf3cf419348b56f9b264bc01c1a89";
+    sha256 = "11965kb3d7xcvlcf8p7jlzk9swk5i78x7wja4s3043wlzmqmwv0q";
   };
 
   preConfigure = ''
diff --git a/pkgs/applications/video/mpv/scripts/mpvacious.nix b/pkgs/applications/video/mpv/scripts/mpvacious.nix
index 4052c968d2ba0..af033781ac2c4 100644
--- a/pkgs/applications/video/mpv/scripts/mpvacious.nix
+++ b/pkgs/applications/video/mpv/scripts/mpvacious.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mpvacious";
-  version = "0.18";
+  version = "0.20";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "mpvacious";
     rev = "v${version}";
-    sha256 = "sha256-FiYEpZVaeJQVSXa9obFYSKNVASJolOBm5D3faOlCzNY=";
+    sha256 = "sha256-9Lf7MVaJ5eC5Gb1PdGBvtENU8AAVq2jsUkY3wJfztt8=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/video/w_scan2/default.nix b/pkgs/applications/video/w_scan2/default.nix
new file mode 100644
index 0000000000000..56000407fce63
--- /dev/null
+++ b/pkgs/applications/video/w_scan2/default.nix
@@ -0,0 +1,25 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "w_scan2";
+  version = "1.0.14";
+
+  src = fetchFromGitHub {
+    owner = "stefantalpalaru";
+    repo = "w_scan2";
+    rev = version;
+    sha256 = "sha256-fDFAJ4EMwu4X1Go3jkRjwA66xDY4tJ5wCKlEdZUT4qQ=";
+  };
+
+  meta = {
+    description = "A small channel scan tool which generates ATSC, DVB-C, DVB-S/S2 and DVB-T/T2 channels.conf files";
+    homepage = "https://github.com/stefantalpalaru/w_scan2";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ _0x4A6F ] ;
+    license = lib.licenses.gpl2Only;
+  };
+}
diff --git a/pkgs/applications/virtualization/conmon-rs/default.nix b/pkgs/applications/virtualization/conmon-rs/default.nix
index 59a2de96e9dd6..ef25427c4a234 100644
--- a/pkgs/applications/virtualization/conmon-rs/default.nix
+++ b/pkgs/applications/virtualization/conmon-rs/default.nix
@@ -7,19 +7,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "conmon-rs";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VwVJWf9tKZ5rVF8tXDf35zsS2PipqC8FPbXUpOzsw/Y=";
+    sha256 = "sha256-mngs5ivRyMJ927VV00mFNIG+nD9EuE3qLyN+OHMMkHQ=";
   };
 
   nativeBuildInputs = [ capnproto protobuf ];
   doCheck = false;
 
-  cargoSha256 = "sha256-zY9fsZK1C3HnCxeNA5dCbQQHYx3IVDMHCHYwFh5ev2k=";
+  cargoSha256 = "sha256-ruChRz2rnPalBiXcpco/WS/eDgg52ckPBLBuoQa9us4=";
 
   meta = with lib; {
     description = "An OCI container runtime monitor written in Rust";
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index ad2ed5bf34617..52a213cda86fe 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     rev = finalAttrs.version;
-    hash = "sha256-Zl7ob0JcFN8sl8Zuf2aB7l7q3W8GmvVBoI1W3aLLXfU=";
+    hash = "sha256-2gEZRkym21X4rvj6kzZh9WChZUkfqgS1wiWh7LBioZM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/leftwm/0001-patch-version.patch b/pkgs/applications/window-managers/leftwm/0001-patch-version.patch
new file mode 100644
index 0000000000000..8c28f0c22abee
--- /dev/null
+++ b/pkgs/applications/window-managers/leftwm/0001-patch-version.patch
@@ -0,0 +1,22 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index ac3125a..c02b11d 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -431,7 +431,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "leftwm"
+-version = "0.4.0"
++version = "0.4.1"
+ dependencies = [
+  "anyhow",
+  "clap",
+@@ -467,7 +467,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "leftwm-core"
+-version = "0.4.0"
++version = "0.4.1"
+ dependencies = [
+  "dirs-next",
+  "futures",
diff --git a/pkgs/applications/window-managers/leftwm/default.nix b/pkgs/applications/window-managers/leftwm/default.nix
index fe3e46f7b47a6..70d7476432a28 100644
--- a/pkgs/applications/window-managers/leftwm/default.nix
+++ b/pkgs/applications/window-managers/leftwm/default.nix
@@ -6,16 +6,20 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "leftwm";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "leftwm";
     repo = "leftwm";
     rev = version;
-    sha256 = "sha256-4f9YOVkOXn7+TzTUZS2Lultgj9WhiOPUa/fHUeyLBUU=";
+    sha256 = "sha256-ZAlX8Vu4JAwQlwBOHT435Bz3g3qqK5ePm9v0cDqP8Q4=";
   };
 
-  cargoSha256 = "sha256-D00IFTELRlqeKQ7zheJKTvu5FBgYQXsZ+OnPnVzweC4=";
+  cargoSha256 = "sha256-nn/P9ZZNf1Zts4JiJ2kXWAAG/HT1GnlYHXcPijYiBlU=";
+
+  cargoPatches = [
+    ./0001-patch-version.patch
+  ];
 
   buildInputs = rpathLibs;
 
@@ -33,7 +37,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/leftwm/leftwm";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ yanganto ];
     changelog = "https://github.com/leftwm/leftwm/blob/${version}/CHANGELOG";
   };
 }
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 55be5f3a9d0a4..33df804d5efec 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -321,6 +321,11 @@ stdenv.mkDerivation {
                       && !(stdenv.targetPlatform.useLLVM or false)
                       && gccForLibs != null) ''
       echo "--gcc-toolchain=${gccForLibs}" >> $out/nix-support/cc-cflags
+
+      # Pull in 'cc.out' target to get 'libstdc++fs.a'. It should be in
+      # 'cc.lib'. But it's a gcc package bug.
+      # TODO(trofi): remove once gcc is fixed to move libraries to .lib output.
+      echo "-L${gccForLibs}/${optionalString (targetPlatform != hostPlatform) "/${targetPlatform.config}"}/lib" >> $out/nix-support/cc-ldflags
     ''
 
     ##
@@ -338,11 +343,18 @@ stdenv.mkDerivation {
     # compile, because it uses "#include_next <limits.h>" to find the
     # limits.h file in ../includes-fixed. To remedy the problem,
     # another -idirafter is necessary to add that directory again.
+    #
+    # We use --sysroot=/nix/store/does/not/exist to drop embedded default
+    # path to glibc headers gcc was built against. Without it -idirafter
+    # only appends to the list and outdated glibc headers end up being
+    # used. 'cc-cflags-before' is used to allow user's --sysroot= option
+    # to override our default.
     + optionalString (libc != null) (''
       touch "$out/nix-support/libc-cflags"
       touch "$out/nix-support/libc-ldflags"
       echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
     '' + optionalString (!(cc.langD or false)) ''
+      echo "--sysroot=/nix/store/does/not/exist" >> $out/nix-support/cc-cflags-before
       echo "-idirafter ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
     '' + optionalString (isGNU && (!(cc.langD or false))) ''
       for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
diff --git a/pkgs/build-support/fetchbzr/builder.sh b/pkgs/build-support/fetchbzr/builder.sh
index 163f6fc60eea3..380642a5e6816 100644
--- a/pkgs/build-support/fetchbzr/builder.sh
+++ b/pkgs/build-support/fetchbzr/builder.sh
@@ -1,10 +1,8 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source "$stdenv/setup"
 
-header "exporting \`$url' (revision $rev) into \`$out'"
+echo "exporting \`$url' (revision $rev) into \`$out'"
 
 # Perform a lightweight checkout so that we don't end up importing
 # all the repository's history.
 BZR_LOG=/dev/null bzr -Ossl.cert_reqs=none export -r "$rev" --format=dir "$out" "$url"
-
-stopNest
diff --git a/pkgs/build-support/fetchcvs/builder.sh b/pkgs/build-support/fetchcvs/builder.sh
index 90363275b9737..4b49e9676ec02 100644
--- a/pkgs/build-support/fetchcvs/builder.sh
+++ b/pkgs/build-support/fetchcvs/builder.sh
@@ -24,5 +24,3 @@ else
 fi
 (cd export && cvs -f -z0 -d "$cvsRoot" export $tag "$module")
 mv export/* $out
-
-stopNest
diff --git a/pkgs/build-support/fetchdarcs/builder.sh b/pkgs/build-support/fetchdarcs/builder.sh
index 018852770504a..ce5537f46f40d 100644
--- a/pkgs/build-support/fetchdarcs/builder.sh
+++ b/pkgs/build-support/fetchdarcs/builder.sh
@@ -11,10 +11,8 @@ elif test -n "$context"; then
     tagflags="--context=$context"
 fi
 
-header "getting $url $partial ${tagtext} into $out"
+echo "getting $url $partial ${tagtext} into $out"
 
 darcs get --lazy $tagflags "$url" "$out"
 # remove metadata, because it can change
 rm -rf "$out/_darcs"
-
-stopNest
diff --git a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
index e5a1a61b78d30..4eb70f672d488 100644
--- a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
+++ b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
@@ -1,6 +1,6 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source "${stdenv}/setup"
-header "exporting ${repository}/${imageName} (tag: ${tag}) into ${out}"
+echo "exporting ${repository}/${imageName} (tag: ${tag}) into ${out}"
 mkdir -p "${out}"
 
 cat <<EOF > "${out}/compositeImage.sh"
@@ -26,4 +26,3 @@ ${gnutar}/bin/tar \
   -c "${manifest}" "${repositories}" -T "${imageFileStorePaths}"
 EOF
 chmod +x "${out}/compositeImage.sh"
-stopNest
diff --git a/pkgs/build-support/fetchdocker/generic-fetcher.nix b/pkgs/build-support/fetchdocker/generic-fetcher.nix
index 3b0c33770467e..6a7b977db29f8 100644
--- a/pkgs/build-support/fetchdocker/generic-fetcher.nix
+++ b/pkgs/build-support/fetchdocker/generic-fetcher.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
   inherit name;
   builder = writeText "${fetcher}-builder.sh" ''
     source "$stdenv/setup"
-    header "${fetcher} exporting to $out"
+    echo "${fetcher} exporting to $out"
 
     declare -A creds
 
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     fi
 
     if [ -f "$dockerCredentialsFile" ]; then
-      header "using credentials from $dockerCredentialsFile"
+      echo "using credentials from $dockerCredentialsFile"
 
       CREDSFILE=$(cat "$dockerCredentialsFile")
       creds[token]=$(${awk} -F'=' '/DOCKER_TOKEN/ {print $2}' <<< "$CREDSFILE" | head -n1)
@@ -77,8 +77,6 @@ stdenv.mkDerivation {
       ${layerDigestFlag} \
       "${repository}/${imageName}" \
       "${tag}"
-
-    stopNest
   '';
 
   buildInputs = [ haskellPackages.hocker ];
diff --git a/pkgs/build-support/fetchfirefoxaddon/default.nix b/pkgs/build-support/fetchfirefoxaddon/default.nix
index 0fa51e69840cd..fe9ff5c469bad 100644
--- a/pkgs/build-support/fetchfirefoxaddon/default.nix
+++ b/pkgs/build-support/fetchfirefoxaddon/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
   builder = writeScript "xpibuilder" ''
     source $stdenv/setup
 
-    header "firefox addon $name into $out"
+    echo "firefox addon $name into $out"
 
     UUID="${extid}"
     mkdir -p "$out/$UUID"
diff --git a/pkgs/build-support/fetchfossil/builder.sh b/pkgs/build-support/fetchfossil/builder.sh
index 009b23c406d6b..36b758ab574e4 100644
--- a/pkgs/build-support/fetchfossil/builder.sh
+++ b/pkgs/build-support/fetchfossil/builder.sh
@@ -1,6 +1,6 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
-header "Cloning Fossil $url [$rev] into $out"
+echo "Cloning Fossil $url [$rev] into $out"
 
 # Fossil, bless its adorable little heart, wants to write global configuration
 # to $HOME/.fossil. AFAICT, there is no way to disable this functionality.
@@ -19,5 +19,3 @@ popd
 
 # Just nuke the checkout file.
 rm $out/.fslckout
-
-stopNest
diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index acb970639ab17..77f6381b09ab2 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -6,7 +6,7 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting $url (rev $rev) into $out"
+echo "exporting $url (rev $rev) into $out"
 
 $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" \
   ${leaveDotGit:+--leave-dotGit} \
@@ -18,4 +18,3 @@ $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" \
   ${branchName:+--branch-name "$branchName"}
 
 runHook postFetch
-stopNest
diff --git a/pkgs/build-support/fetchhg/builder.sh b/pkgs/build-support/fetchhg/builder.sh
index cec0e441f2296..1ce294757713c 100644
--- a/pkgs/build-support/fetchhg/builder.sh
+++ b/pkgs/build-support/fetchhg/builder.sh
@@ -1,10 +1,8 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
-header "getting $url${rev:+ ($rev)} into $out"
+echo "getting $url${rev:+ ($rev)} into $out"
 
 hg clone --insecure "$url" hg-clone
 
 hg archive -q$subrepoClause -y ${rev:+-r "$rev"} --cwd hg-clone $out
 rm -f $out/.hg_archival.txt
-
-stopNest
diff --git a/pkgs/build-support/fetchmtn/builder.sh b/pkgs/build-support/fetchmtn/builder.sh
index 7db66730dab82..1aabd7949ee1d 100644
--- a/pkgs/build-support/fetchmtn/builder.sh
+++ b/pkgs/build-support/fetchmtn/builder.sh
@@ -8,7 +8,7 @@ if ! [ -f "$cacheDB" ]; then
     mtn --db "$cacheDB" db init
 fi
 
-header "getting revision $selector";
+echo "getting revision $selector";
 
 done=;
 for source in $dbs; do
@@ -32,9 +32,7 @@ for source in $dbs; do
     fi;
 done;
 
-stopNest;
-
-header "checking out the revision $revision";
+echo "checking out the revision $revision";
 
 if test -n "$done"; then
     mtn checkout --db "$cacheDB" -r "$revision" "$out" -b "${branch}"
@@ -43,10 +41,6 @@ else
     exit 1;
 fi;
 
-stopNest
-
-header "clearing _MTN in the output"
+echo "clearing _MTN in the output"
 
 rm -rf "$out/_MTN"
-
-stopNest
diff --git a/pkgs/build-support/fetchsvn/builder.sh b/pkgs/build-support/fetchsvn/builder.sh
index b58e5a88b3cd8..aa4d049aba431 100644
--- a/pkgs/build-support/fetchsvn/builder.sh
+++ b/pkgs/build-support/fetchsvn/builder.sh
@@ -1,7 +1,7 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting $url (r$rev) into $out"
+echo "exporting $url (r$rev) into $out"
 
 if test -n "$http_proxy"; then
     # Configure proxy
@@ -22,5 +22,3 @@ fi;
 svn export --trust-server-cert --non-interactive \
     ${ignoreExternals:+--ignore-externals} ${ignoreKeywords:+--ignore-keywords} \
     -r "$rev" "$url" "$out"
-
-stopNest
diff --git a/pkgs/build-support/fetchsvnssh/builder.sh b/pkgs/build-support/fetchsvnssh/builder.sh
index b0441299dd2c6..5782151524f7a 100644
--- a/pkgs/build-support/fetchsvnssh/builder.sh
+++ b/pkgs/build-support/fetchsvnssh/builder.sh
@@ -1,7 +1,7 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting $url (r$rev) into $out"
+echo "exporting $url (r$rev) into $out"
 
 if test "$sshSupport"; then
     export SVN_SSH="$openssh/bin/ssh"
@@ -12,5 +12,3 @@ fi
 # whether the server is being spoofed --- only the cryptographic
 # hash of the output matters.
 expect -f $sshSubversion "$username" "$password" "$rev" "$url" $out
-
-stopNest
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index dd987f41b4467..e8eaba934858e 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -37,7 +37,7 @@ if [ -n "$downloadToTemp" ]; then downloadedFile="$TMPDIR/file"; fi
 tryDownload() {
     local url="$1"
     echo
-    header "trying $url"
+    echo "trying $url"
     local curlexit=18;
 
     success=
diff --git a/pkgs/build-support/pkg-config-wrapper/default.nix b/pkgs/build-support/pkg-config-wrapper/default.nix
index ca14a4495fed6..f68597662608f 100644
--- a/pkgs/build-support/pkg-config-wrapper/default.nix
+++ b/pkgs/build-support/pkg-config-wrapper/default.nix
@@ -46,14 +46,11 @@ stdenv.mkDerivation {
   strictDeps = true;
   dontBuild = true;
   dontConfigure = true;
+  dontUnpack = true;
 
   # Additional flags passed to pkg-config.
   addFlags = lib.optional stdenv.targetPlatform.isStatic "--static";
 
-  unpackPhase = ''
-    src=$PWD
-  '';
-
   installPhase =
     ''
       mkdir -p $out/bin $out/nix-support
diff --git a/pkgs/build-support/release/debian-build.nix b/pkgs/build-support/release/debian-build.nix
index 9104bf2dce5cc..679adad827dac 100644
--- a/pkgs/build-support/release/debian-build.nix
+++ b/pkgs/build-support/release/debian-build.nix
@@ -43,9 +43,8 @@ vmTools.runInLinuxImage (stdenv.mkDerivation (
       [ ! -f /etc/lsb-release ] || (source /etc/lsb-release; echo "OS release: $DISTRIB_DESCRIPTION")
       echo "System/kernel: $(uname -a)"
       if test -e /etc/debian_version; then echo "Debian release: $(cat /etc/debian_version)"; fi
-      header "installed Debian packages"
+      echo "installed Debian packages"
       dpkg-query --list
-      stopNest
     '';
 
     installPhase = ''
@@ -73,11 +72,10 @@ vmTools.runInLinuxImage (stdenv.mkDerivation (
       [ "$(echo $out/debs/*.deb)" != "" ]
 
       for i in $out/debs/*.deb; do
-        header "Generated DEB package: $i"
+        echo "Generated DEB package: $i"
         dpkg-deb --info "$i"
         pkgName=$(dpkg-deb -W "$i" | awk '{print $1}')
         echo "file deb $i" >> $out/nix-support/hydra-build-products
-        stopNest
       done
       dpkg -i $out/debs/*.deb
 
diff --git a/pkgs/build-support/release/nix-build.nix b/pkgs/build-support/release/nix-build.nix
index 5ed2b0752efc5..9578fbf482f26 100644
--- a/pkgs/build-support/release/nix-build.nix
+++ b/pkgs/build-support/release/nix-build.nix
@@ -74,10 +74,9 @@ stdenv.mkDerivation (
       if test -n "$succeedOnFailure"; then
           if test -n "$keepBuildDirectory"; then
               KEEPBUILDDIR="$out/`basename $TMPDIR`"
-              header "Copying build directory to $KEEPBUILDDIR"
+              echo "Copying build directory to $KEEPBUILDDIR"
               mkdir -p $KEEPBUILDDIR
               cp -R "$TMPDIR/"* $KEEPBUILDDIR
-              stopNest
           fi
       fi
     '';
diff --git a/pkgs/build-support/release/source-tarball.nix b/pkgs/build-support/release/source-tarball.nix
index 742cce13b7bf1..d624d071cc21b 100644
--- a/pkgs/build-support/release/source-tarball.nix
+++ b/pkgs/build-support/release/source-tarball.nix
@@ -64,10 +64,9 @@ stdenv.mkDerivation (
       if test -n "$succeedOnFailure"; then
           if test -n "$keepBuildDirectory"; then
               KEEPBUILDDIR="$out/`basename $TMPDIR`"
-              header "Copying build directory to $KEEPBUILDDIR"
+              echo "Copying build directory to $KEEPBUILDDIR"
               mkdir -p $KEEPBUILDDIR
               cp -R "$TMPDIR/"* $KEEPBUILDDIR
-              stopNest
           fi
       fi
     '';
diff --git a/pkgs/build-support/setup-hooks/audit-tmpdir.sh b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
index 9c03bc2ee9354..36714178156bd 100644
--- a/pkgs/build-support/setup-hooks/audit-tmpdir.sh
+++ b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
@@ -13,7 +13,7 @@ auditTmpdir() {
     local dir="$1"
     [ -e "$dir" ] || return 0
 
-    header "checking for references to $TMPDIR/ in $dir..."
+    echo "checking for references to $TMPDIR/ in $dir..."
 
     local i
     find "$dir" -type f -print0 | while IFS= read -r -d $'\0' i; do
@@ -36,6 +36,4 @@ auditTmpdir() {
         fi
 
     done
-
-    stopNest
 }
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.py b/pkgs/build-support/setup-hooks/auto-patchelf.py
index efb65a809962d..e731feb1b1256 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.py
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -131,7 +131,14 @@ def populate_cache(initial: List[Path], recursive: bool =False) -> None:
             if not path.is_file():
                 continue
 
+            # As an optimisation, resolve the symlinks here, as the target is unique
+            # XXX: (layus, 2022-07-25) is this really an optimisation in all cases ?
+            # It could make the rpath bigger or break the fragile precedence of $out.
             resolved = path.resolve()
+            # Do not use resolved paths when names do not match
+            if resolved.name != path.name:
+                resolved = path
+
             try:
                 with open_elf(path) as elf:
                     osabi = get_osabi(elf)
diff --git a/pkgs/build-support/setup-hooks/canonicalize-jars.sh b/pkgs/build-support/setup-hooks/canonicalize-jars.sh
index 8c55810748ea0..5137bfc94b011 100644
--- a/pkgs/build-support/setup-hooks/canonicalize-jars.sh
+++ b/pkgs/build-support/setup-hooks/canonicalize-jars.sh
@@ -6,12 +6,11 @@ fixupOutputHooks+=('if [ -z "$dontCanonicalizeJars" -a -e "$prefix" ]; then cano
 
 canonicalizeJarsIn() {
   local dir="$1"
-  header "canonicalizing jars in $dir"
+  echo "canonicalizing jars in $dir"
   dir="$(realpath -sm -- "$dir")"
   while IFS= read -rd '' f; do
     canonicalizeJar "$f"
   done < <(find -- "$dir" -type f -name '*.jar' -print0)
-  stopNest
 }
 
 source @canonicalize_jar@
diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index c9b03b75cd037..c81a253b0de8d 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -10,6 +10,8 @@
 }:
 
 makeSetupHook {
+  name = "make-binary-wrapper-hook";
+
   deps = [ dieHook ]
     # https://github.com/NixOS/nixpkgs/issues/148189
     ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;
diff --git a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
index cd9c2eaa2d804..f34353a7617b8 100644
--- a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@@ -6,8 +6,8 @@ postFixupHooks+=(_makeSymlinksRelative)
 _makeSymlinksRelative() {
     local symlinkTarget
 
-    if [ -n "${dontRewriteSymlinks-}" ]; then
-        return 0
+    if [ "${dontRewriteSymlinks-}" ] || [ ! -e "$prefix" ]; then
+       return
     fi
 
     while IFS= read -r -d $'\0' f; do
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 8a2fc2f915e91..3a318933f138d 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -4,16 +4,32 @@ preFixupHooks+=(_multioutDocs)
 preFixupHooks+=(_multioutDevs)
 postFixupHooks+=(_multioutPropagateDev)
 
-# Assign the first string containing nonempty variable to the variable named $1
+# _assignFirst varName otherVarNames*
+#
+# Set the value of the variable named $varName to the first of otherVarNames
+# that refers to a non-empty variable name.
+#
+# If none of otherVarNames refers to a non-empty variable, the error message is
+# specific to this function's use case, which is setting up the output variables.
 _assignFirst() {
     local varName="$1"
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
-    while (( $# )); do
-        if [ -n "${!1-}" ]; then eval "${varName}"="$1"; return; fi
-        shift
+    for var in "$@"; do
+        if [ -n "${!var-}" ]; then eval "${varName}"="${var}"; return; fi
     done
-    echo "Error: _assignFirst found no valid variant!"
+    echo
+    echo "error: _assignFirst: could not find a non-empty variable to assign to ${varName}."
+    echo "       The following variables were all unset or empty:"
+    echo "           $*"
+    if [ -z "${out:-}" ]; then
+        echo '       If you do not want an "out" output in your derivation, make sure to define'
+        echo '       the other specific required outputs. This can be achieved by picking one'
+        echo "       of the above as an output."
+        echo '       You do not have to remove "out" if you want to have a different default'
+        echo '       output, because the first output is taken as a default.'
+        echo
+    fi
     return 1 # none found
 }
 
diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 04ebcd2cc64ec..a26113abea88e 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -100,8 +100,6 @@ patchShebangs() {
             fi
         fi
     done < <(find "$@" -type f -perm -0100 -print0)
-
-    stopNest
 }
 
 patchShebangsAuto () {
diff --git a/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh b/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
index 8131304cccf9b..3eec67d60feb4 100644
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
@@ -53,7 +53,7 @@ EOF
     echo >&2 'initdb not found. Did you add postgresql to the nativeCheckInputs?'
     false
   fi
-  header 'initializing postgresql'
+  echo 'initializing postgresql'
   initdb -U postgres
 
   # Move the socket
@@ -65,10 +65,10 @@ EOF
     echo "listen_addresses = ''" >>"$PGDATA/postgresql.conf"
   fi
 
-  header 'starting postgresql'
+  echo 'starting postgresql'
   eval "${postgresqlStartCommands:-pg_ctl start}"
 
-  header 'setting up postgresql'
+  echo 'setting up postgresql'
   eval "$postgresqlTestSetupCommands"
 
   runHook postgresqlTestSetupPost
@@ -76,6 +76,6 @@ EOF
 }
 
 postgresqlStop() {
-  header 'stopping postgresql'
+  echo 'stopping postgresql'
   pg_ctl stop
 }
diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index be94af545be17..3c8c9c294c3e2 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -26,7 +26,7 @@ _separateDebugInfo() {
         fi
 
         # Extract the debug info.
-        header "separating debug info from $i (build ID $id)"
+        echo "separating debug info from $i (build ID $id)"
         mkdir -p "$dst/${id:0:2}"
 
         # This may fail, e.g. if the binary is for a different
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 104b5515b3db6..f5e3bdced6995 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -36,7 +36,7 @@ _doStrip() {
         local -n ranlibCmd="${ranlibCmds[$i]}"
 
         # `dontStrip` disables them all
-        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null
+        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null 1>&2
         then continue; fi
 
         stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags[*]:--S}"
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 80c3214f06a36..3de041636f055 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -546,6 +546,7 @@ rec {
    * # writes a Linux-exclusive setup hook where @bash@ myscript.sh is substituted for the
    * # bash interpreter.
    * myhellohookSub = makeSetupHook {
+   *                 name = "myscript-hook";
    *                 deps = [ hello ];
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
    *                 meta.platforms = lib.platforms.linux;
@@ -553,13 +554,21 @@ rec {
    *
    * # setup hook with a package test
    * myhellohookTested = makeSetupHook {
+   *                 name = "myscript-hook";
    *                 deps = [ hello ];
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
    *                 meta.platforms = lib.platforms.linux;
    *                 passthru.tests.greeting = callPackage ./test { };
    *               } ./myscript.sh;
    */
-  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {}, passthru ? {} }: script:
+  makeSetupHook =
+    { name ? lib.warn "calling makeSetupHook without passing a name is deprecated." "hook"
+    , deps ? []
+    , substitutions ? {}
+    , meta ? {}
+    , passthru ? {}
+    }:
+    script:
     runCommand name
       (substitutions // {
         inherit meta;
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 7bae2fc7cfb27..84754e580302c 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -527,9 +527,8 @@ rec {
       echo "System/kernel: $(uname -a)"
       if test -e /etc/fedora-release; then echo "Fedora release: $(cat /etc/fedora-release)"; fi
       if test -e /etc/SuSE-release; then echo "SUSE release: $(cat /etc/SuSE-release)"; fi
-      header "installed RPM packages"
+      echo "installed RPM packages"
       rpm -qa --qf "%{Name}-%{Version}-%{Release} (%{Arch}; %{Distribution}; %{Vendor})\n"
-      stopNest
     '';
 
     buildPhase = ''
@@ -559,9 +558,8 @@ rec {
       find $rpmout -name "*.rpm" -exec cp {} $out/$outDir \;
 
       for i in $out/$outDir/*.rpm; do
-        header "Generated RPM/SRPM: $i"
+        echo "Generated RPM/SRPM: $i"
         rpm -qip $i
-        stopNest
       done
 
       eval "$postInstall"
diff --git a/pkgs/data/fonts/comfortaa/default.nix b/pkgs/data/fonts/comfortaa/default.nix
index fc7ce56f79651..f47da9fc5306a 100644
--- a/pkgs/data/fonts/comfortaa/default.nix
+++ b/pkgs/data/fonts/comfortaa/default.nix
@@ -1,28 +1,37 @@
-{ lib, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-let
-  version = "2021-07-29";
-in fetchFromGitHub rec {
-  name = "comfortaa-${version}";
+stdenvNoCC.mkDerivation rec {
+  pname = "comfortaa";
+  version = "unstable-2021-07-29";
 
-  owner = "googlefonts";
-  repo = "comfortaa";
-  rev = "2a87ac6f6ea3495150bfa00d0c0fb53dd0a2f11b";
+  src = fetchFromGitHub {
+    owner = "googlefonts";
+    repo = pname;
+    rev = "2a87ac6f6ea3495150bfa00d0c0fb53dd0a2f11b";
+    postFetch = ''
+      # Remove the OTF fonts as they are not needed and cause a hash mismatch
+      rm -rf $out/fonts/{OTF,otf}
+    '';
+    hash = "sha256-4ZBRaQyYlnt9l4NgBHezuCnR3rKTJ37L41RTbGAhd0M=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/truetype $out/share/doc/comfortaa
     cp fonts/TTF/*.ttf $out/share/fonts/truetype
     cp FONTLOG.txt README.md $out/share/doc/comfortaa
-  '';
 
-  sha256 = "12ad7qy11q49iv9h3l2d7x7y7kf0hxbqhclb92bzwig8dzly9n2k";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://aajohan.deviantart.com/art/Comfortaa-font-105395949";
     description = "A clean and modern font suitable for headings and logos";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
   };
 }
diff --git a/pkgs/data/fonts/undefined-medium/default.nix b/pkgs/data/fonts/undefined-medium/default.nix
index 9c605668845bd..3e3087c6abc8b 100644
--- a/pkgs/data/fonts/undefined-medium/default.nix
+++ b/pkgs/data/fonts/undefined-medium/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "undefined-medium";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchzip {
-    url = "https://github.com/andirueckel/undefined-medium/archive/v1.0.zip";
-    hash = "sha256-HG+V7jR7dDI6LeoiCg/8F38lW8Zdo6CyLj2DXy/ff64=";
+    url = "https://github.com/andirueckel/undefined-medium/archive/v1.1.zip";
+    hash = "sha256-iquxt7lo92y4AQZf23Ij5Qzg2U7buL3kGLksQSR6vac=";
   };
 
   installPhase = ''
diff --git a/pkgs/desktops/plasma-5/default.nix b/pkgs/desktops/plasma-5/default.nix
index 6396b7c6c51e0..dcc5c7f7cf3dc 100644
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@@ -130,7 +130,7 @@ let
       kdeplasma-addons = callPackage ./kdeplasma-addons.nix { };
       kgamma5 = callPackage ./kgamma5.nix { };
       khotkeys = callPackage ./khotkeys.nix { };
-      kinfocenter = callPackage ./kinfocenter.nix { };
+      kinfocenter = callPackage ./kinfocenter { };
       kmenuedit = callPackage ./kmenuedit.nix { };
       kpipewire = callPackage ./kpipewire.nix { };
       kscreen = callPackage ./kscreen.nix { };
diff --git a/pkgs/desktops/plasma-5/kinfocenter.nix b/pkgs/desktops/plasma-5/kinfocenter.nix
deleted file mode 100644
index c63d22858a551..0000000000000
--- a/pkgs/desktops/plasma-5/kinfocenter.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ mkDerivation
-, lib
-, extra-cmake-modules
-, kdoctools
-, qtbase
-, kcmutils
-, kcompletion
-, kconfig
-, kconfigwidgets
-, kcoreaddons
-, kdbusaddons
-, kdeclarative
-, ki18n
-, kiconthemes
-, kio
-, kirigami2
-, kpackage
-, kservice
-, kwayland
-, kwidgetsaddons
-, kxmlgui
-, solid
-, systemsettings
-, libraw1394
-, libGLU
-, pciutils
-}:
-
-mkDerivation {
-  pname = "kinfocenter";
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [
-    kcmutils
-    kcompletion
-    kconfig
-    kconfigwidgets
-    kcoreaddons
-    kdbusaddons
-    kdeclarative
-    ki18n
-    kiconthemes
-    kio
-    kirigami2
-    kpackage
-    kservice
-    kwayland
-    kwidgetsaddons
-    kxmlgui
-    solid
-    systemsettings
-
-    libraw1394
-    libGLU
-    pciutils
-  ];
-  preFixup = ''
-    # fix wrong symlink of infocenter pointing to a 'systemsettings5' binary in
-    # the same directory, while it is actually located in a completely different
-    # store path
-    ln -sf ${lib.getBin systemsettings}/bin/systemsettings5 $out/bin/kinfocenter
-  '';
-}
diff --git a/pkgs/desktops/plasma-5/kinfocenter/0001-tool-paths.patch b/pkgs/desktops/plasma-5/kinfocenter/0001-tool-paths.patch
new file mode 100644
index 0000000000000..c6cf9bd8d6df9
--- /dev/null
+++ b/pkgs/desktops/plasma-5/kinfocenter/0001-tool-paths.patch
@@ -0,0 +1,51 @@
+diff --git a/Modules/kwinsupportinfo/kcm_kwinsupportinfo.json.in b/Modules/kwinsupportinfo/kcm_kwinsupportinfo.json.in
+index f591b9c..e883212 100644
+--- a/Modules/kwinsupportinfo/kcm_kwinsupportinfo.json.in
++++ b/Modules/kwinsupportinfo/kcm_kwinsupportinfo.json.in
+@@ -63,6 +63,6 @@
+         "Name[x-test]": "xxWindow Managerxx",
+         "Name[zh_CN]": "窗口管理器"
+     },
+-    "TryExec": "@QtBinariesDir@/qdbus",
++    "TryExec": "@qdbus@",
+     "X-KDE-KInfoCenter-Category": "graphical_information"
+ }
+diff --git a/Modules/kwinsupportinfo/main.cpp b/Modules/kwinsupportinfo/main.cpp
+index 667c079..b727b67 100644
+--- a/Modules/kwinsupportinfo/main.cpp
++++ b/Modules/kwinsupportinfo/main.cpp
+@@ -19,7 +19,7 @@ public:
+     explicit KCMKWinSupportInfo(QObject *parent, const KPluginMetaData &data, const QVariantList &args)
+         : ConfigModule(parent, data, args)
+     {
+-        auto outputContext = new CommandOutputContext(QLibraryInfo::location(QLibraryInfo::BinariesPath) + QStringLiteral("/qdbus"),
++        auto outputContext = new CommandOutputContext(QStringLiteral("@qdbus@"),
+                                                       {QStringLiteral("org.kde.KWin"), QStringLiteral("/KWin"), QStringLiteral("supportInformation")},
+                                                       parent);
+         qmlRegisterSingletonInstance("org.kde.kinfocenter.kwinsupportinfo.private", 1, 0, "InfoOutputContext", outputContext);
+diff --git a/Modules/xserver/kcm_xserver.json b/Modules/xserver/kcm_xserver.json
+index 04acd6b..24b8f36 100644
+--- a/Modules/xserver/kcm_xserver.json
++++ b/Modules/xserver/kcm_xserver.json
+@@ -130,7 +130,7 @@
+         "Name[zh_CN]": "X 服务器",
+         "Name[zh_TW]": "X 伺服器"
+     },
+-    "TryExec": "xdpyinfo",
++    "TryExec": "@xdpyinfo@",
+     "X-DocPath": "kinfocenter/graphical.html#xserver",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "X,X-Server,XServer,XFree86,Display,VideoCard,System Information",
+diff --git a/Modules/xserver/main.cpp b/Modules/xserver/main.cpp
+index c406ff7..a261b90 100644
+--- a/Modules/xserver/main.cpp
++++ b/Modules/xserver/main.cpp
+@@ -17,7 +17,7 @@ public:
+     explicit KCMXServer(QObject *parent, const KPluginMetaData &data, const QVariantList &args)
+         : ConfigModule(parent, data, args)
+     {
+-        auto outputContext = new CommandOutputContext(QStringLiteral("xdpyinfo"), {}, parent);
++        auto outputContext = new CommandOutputContext(QStringLiteral("@xdpyinfo@"), {}, parent);
+         qmlRegisterSingletonInstance("org.kde.kinfocenter.xserver.private", 1, 0, "InfoOutputContext", outputContext);
+ 
+         auto *about = new KAboutData(QStringLiteral("kcm_xserver"), i18nc("@label kcm name", "X-Server"), QStringLiteral("1.0"), QString(), KAboutLicense::GPL);
diff --git a/pkgs/desktops/plasma-5/kinfocenter/default.nix b/pkgs/desktops/plasma-5/kinfocenter/default.nix
new file mode 100644
index 0000000000000..222e785582649
--- /dev/null
+++ b/pkgs/desktops/plasma-5/kinfocenter/default.nix
@@ -0,0 +1,104 @@
+{ mkDerivation
+, lib
+, extra-cmake-modules
+, kdoctools
+, qtbase
+, qttools
+, kcmutils
+, kcompletion
+, kconfig
+, kconfigwidgets
+, kcoreaddons
+, kdbusaddons
+, kdeclarative
+, ki18n
+, kiconthemes
+, kio
+, kirigami2
+, kpackage
+, kservice
+, kwayland
+, kwidgetsaddons
+, kxmlgui
+, solid
+, systemsettings
+, dmidecode
+, fwupd
+, libraw1394
+, libusb1
+, libGLU
+, pciutils
+, smartmontools
+, util-linux
+, vulkan-tools
+, wayland-utils
+, xdpyinfo
+}:
+
+let
+  inherit (lib) getBin getExe;
+
+  qdbus = "${getBin qttools}/bin/qdbus";
+
+in
+mkDerivation {
+  pname = "kinfocenter";
+
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+
+  buildInputs = [
+    kcmutils
+    kcompletion
+    kconfig
+    kconfigwidgets
+    kcoreaddons
+    kdbusaddons
+    kdeclarative
+    ki18n
+    kiconthemes
+    kio
+    kirigami2
+    kpackage
+    kservice
+    kwayland
+    kwidgetsaddons
+    kxmlgui
+    solid
+    systemsettings
+
+    dmidecode
+    fwupd
+    libraw1394
+    libusb1
+    libGLU
+    pciutils
+    smartmontools
+    util-linux
+    vulkan-tools
+    wayland-utils
+    xdpyinfo
+  ];
+
+  patches = [
+    ./0001-tool-paths.patch
+  ];
+
+  postPatch = ''
+    for f in Modules/kwinsupportinfo/{kcm_kwinsupportinfo.json.in,main.cpp}; do
+      substituteInPlace $f \
+        --replace "@qdbus@" "${qdbus}"
+    done
+
+    for f in Modules/xserver/{kcm_xserver.json,main.cpp}; do
+      substituteInPlace $f \
+        --replace "@xdpyinfo@" "${getExe xdpyinfo}"
+    done
+  '';
+
+  # fix wrong symlink of infocenter pointing to a 'systemsettings5' binary in
+  # the same directory, while it is actually located in a completely different
+  # store path
+  preFixup = ''
+    ln -sf ${lib.getExe systemsettings} $out/bin/kinfocenter
+  '';
+}
diff --git a/pkgs/desktops/plasma-5/systemsettings.nix b/pkgs/desktops/plasma-5/systemsettings.nix
index 94d8f92ac4f94..1c438df1b82f3 100644
--- a/pkgs/desktops/plasma-5/systemsettings.nix
+++ b/pkgs/desktops/plasma-5/systemsettings.nix
@@ -45,4 +45,5 @@ mkDerivation {
     plasma-workspace
   ];
   outputs = [ "bin" "dev" "out" ];
+  meta.mainProgram = "systemsettings5";
 }
diff --git a/pkgs/desktops/xfce/default.nix b/pkgs/desktops/xfce/default.nix
index 6ac1199314242..5dc21338a72cb 100644
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@@ -25,7 +25,9 @@ makeScopeWithSplicing
 
       mkXfceDerivation = callPackage ./mkXfceDerivation.nix { };
 
-      automakeAddFlags = pkgs.makeSetupHook { } ./automakeAddFlags.sh;
+      automakeAddFlags = pkgs.makeSetupHook {
+        name = "xfce-automake-add-flags-hook";
+      } ./automakeAddFlags.sh;
 
       #### CORE
 
diff --git a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
index 5f41a36263a9c..cb56eabc5d781 100644
--- a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
@@ -1,10 +1,8 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting egg ${eggName} (version $version) into $out"
+echo "exporting egg ${eggName} (version $version) into $out"
 
 mkdir -p $out
 chicken-install -r "${eggName}:${version}"
 cp -r ${eggName}/* $out/
-
-stopNest
diff --git a/pkgs/development/compilers/chicken/5/fetchegg/builder.sh b/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
index f02e017577873..34c9de37233d3 100644
--- a/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
@@ -1,11 +1,9 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting egg ${eggName} (version $version) into $out"
+echo "exporting egg ${eggName} (version $version) into $out"
 
 mkdir -p $out
 CHICKEN_EGG_CACHE=. chicken-install -r "${eggName}:${version}"
 rm ${eggName}/{STATUS,TIMESTAMP}
 cp -r ${eggName}/* $out/
-
-stopNest
diff --git a/pkgs/development/compilers/dmd/generic.nix b/pkgs/development/compilers/dmd/generic.nix
index 3f8871df4f96d..c1fb9abf77d7e 100644
--- a/pkgs/development/compilers/dmd/generic.nix
+++ b/pkgs/development/compilers/dmd/generic.nix
@@ -151,6 +151,13 @@ stdenv.mkDerivation rec {
     git
   ];
 
+  # Workaround cc-wrapper's --sysroot= value for `staging-next`: it
+  # breaks library lookup via RUNPATH:
+  #   ld: warning: libm.so.6, needed by ./generated/linux/release/64/lib.so, not found (try using -rpath or -rpath-link)
+  #   ld: /build/druntime/generated/linux/release/64/libdruntime.so: undefined reference to `log10@GLIBC_2.2.5'
+  # TODO(trofi): remove the workaround once cc-wrapper is fixed.
+  NIX_CFLAGS_COMPILE = [ "--sysroot=/" ];
+
   buildInputs = [
     curl
     tzdata
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 2751501901f2d..76374201f456d 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -51,8 +51,14 @@ let majorVersion = "10";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches = [ ]
-      ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
+    patches = [
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
+    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
       /* ++ optional (hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
@@ -222,6 +228,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index dc472abec4f4b..1d3dff7c6f2ac 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -51,8 +51,14 @@ let majorVersion = "11";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches =
-         optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
+    patches = [
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
+    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
       /* ++ optional (hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
@@ -228,6 +234,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 7e1847ebba988..3fe6620987a35 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -270,6 +270,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 042e561a2e363..810706ed0f3dc 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -227,6 +227,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 8420cfdde7d5c..e25af867e5374 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -247,6 +247,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 66b53c6d5b5e2..450b23310337e 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -64,6 +64,13 @@ let majorVersion = "6";
 
     patches = optionals (!stdenv.targetPlatform.isRedox) [
       ../use-source-date-epoch.patch ./0001-Fix-build-for-glibc-2.31.patch
+
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
     ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional langAda ../gnat-cflags.patch
@@ -258,6 +265,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 8fd990f95ffba..a0465e8bdd60b 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -56,6 +56,13 @@ let majorVersion = "7";
         ./gcc8-asan-glibc-2.34.patch
 
         ./0001-Fix-build-for-glibc-2.31.patch
+
+        # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+        (fetchurl {
+          name = "fix-bug-80431.patch";
+          url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+          sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+        })
       ]
       ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optionals targetPlatform.isNetBSD [
@@ -226,6 +233,7 @@ stdenv.mkDerivation ({
   ;
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index 2dc141b529fc1..03fb9fb1205cc 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -46,8 +46,14 @@ let majorVersion = "8";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches =
-         optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
+    patches = [
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
+    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional targetPlatform.isNetBSD ../libstdc++-netbsd-ctypes.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       /* ++ optional (hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
@@ -206,6 +212,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 9b5f4504db8e9..317c77ea835f3 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -55,9 +55,14 @@ let majorVersion = "9";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches =
-      [ ]
-      ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
+    patches = [
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
+    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional targetPlatform.isNetBSD ../libstdc++-netbsd-ctypes.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv-gcc9.patch
@@ -221,6 +226,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 113bd83ea53fc..dd5a8de76e2a8 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -203,6 +203,17 @@ preInstall() {
         ln -s lib "$out/${targetConfig}/lib32"
         ln -s lib "${!outputLib}/${targetConfig}/lib32"
     fi
+
+    # cc-wrappers uses --sysroot=/nix/store/does/not/exist as a way to
+    # drop default sysheaders search path. Unfortunately that switches
+    # clang++ into searching libraries in gcc in cross-compiler paths:
+    #   from ${!outputLib}/lib (native)
+    #   to ${!outputLib}/${targetPlatformConfig}/lib
+    # We create the symlink to make both native and cross paths
+    # available even if the toolchain is not the cross-compiler.
+    if [ ! -e ${!outputLib}/${targetPlatformConfig} ] ; then
+        ln -s . ${!outputLib}/${targetPlatformConfig}
+    fi
 }
 
 
@@ -240,25 +251,6 @@ postInstall() {
     # More dependencies with the previous gcc or some libs (gccbug stores the build command line)
     rm -rf $out/bin/gccbug
 
-    if [[ buildConfig == *"linux"* ]]; then
-        # Take out the bootstrap-tools from the rpath, as it's not needed at all having $out
-        for i in $(find "$out"/libexec/gcc/*/*/* -type f -a \! -name '*.la'); do
-            PREV_RPATH=`patchelf --print-rpath "$i"`
-            NEW_RPATH=`echo "$PREV_RPATH" | sed 's,:[^:]*bootstrap-tools/lib,,g'`
-            patchelf --set-rpath "$NEW_RPATH" "$i" && echo OK
-        done
-    fi
-
-    if [[ targetConfig == *"linux"* ]]; then
-        # For some reason, when building for linux on darwin, the libs retain
-        # RPATH to $out.
-        for i in "$lib"/"$targetConfig"/lib/{libtsan,libasan,libubsan}.so.*.*.*; do
-            PREV_RPATH=`patchelf --print-rpath "$i"`
-            NEW_RPATH=`echo "$PREV_RPATH" | sed "s,:${out}[^:]*,,g"`
-            patchelf --set-rpath "$NEW_RPATH" "$i" && echo OK
-        done
-    fi
-
     if type "install_name_tool"; then
         for i in "${!outputLib}"/lib/*.*.dylib "${!outputLib}"/lib/*.so.[0-9]; do
             install_name_tool -id "$i" "$i" || true
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 27223e6dea6eb..84a6059581e73 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.19.4";
+  version = "1.19.5";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-7adNtKxJSACj5m7nhOSVv7ubjlNd+SSosBsagCi382g=";
+    sha256 = "sha256-jkhujoWigfxc4/C+3FudLb9idtfbCyXT7ANPMT2gN18=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix b/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
index 3afa59739a374..b50097d5e66bc 100644
--- a/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
+++ b/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
@@ -1,12 +1,9 @@
-{ lib, writeShellApplication, cargo, cargo-auditable }:
+{ lib, writeShellScriptBin, cargo, cargo-auditable }:
 
-(writeShellApplication {
-  name = "cargo";
-  runtimeInputs = [ cargo cargo-auditable ];
-  text = ''
-    CARGO_AUDITABLE_IGNORE_UNSUPPORTED=1 cargo auditable "$@"
-  '';
-}) // {
+(writeShellScriptBin "cargo" ''
+  export PATH="${lib.makeBinPath [ cargo cargo-auditable ]}:$PATH"
+  CARGO_AUDITABLE_IGNORE_UNSUPPORTED=1 exec cargo auditable "$@"
+'') // {
   meta = cargo-auditable.meta // {
     mainProgram = "cargo";
   };
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 9b10767e5bff7..d04eebe7eadf4 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -76,7 +76,7 @@ rustPlatform.buildRustPackage {
   meta = with lib; {
     homepage = "https://crates.io";
     description = "Downloads your Rust project's dependencies and builds your project";
-    maintainers = with maintainers; [ retrry ];
+    maintainers = with maintainers; [ retrry ] ++ teams.rust.members;
     license = [ licenses.mit licenses.asl20 ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 64254d5025291..426f137788389 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -211,7 +211,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.rust-lang.org/";
     description = "A safe, concurrent, practical language";
-    maintainers = with maintainers; [ cstrahan globin havvy ];
+    maintainers = with maintainers; [ cstrahan globin havvy ] ++ teams.rust.members;
     license = [ licenses.mit licenses.asl20 ];
     platforms = platforms.linux ++ platforms.darwin;
   };
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
new file mode 100644
index 0000000000000..729c011082876
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -0,0 +1,686 @@
+{ lib
+, stdenv
+, callPackage
+, cmake
+, coreutils
+, gnugrep
+, perl
+, ninja
+, pkg-config
+, clang
+, bintools
+, python3
+, git
+, fetchpatch
+, makeWrapper
+, gnumake
+, file
+, runCommand
+, writeShellScriptBin
+# For lldb
+, libedit
+, ncurses
+, swig
+, libxml2
+# Linux-specific
+, glibc
+, libuuid
+# Darwin-specific
+, substituteAll
+, fixDarwinDylibNames
+, runCommandLocal
+, xcbuild
+, cctools # libtool
+, sigtool
+, DarwinTools
+, CoreServices
+, Foundation
+, Combine
+, MacOSX-SDK
+, CLTools_Executables
+}:
+
+let
+
+  inherit (stdenv) hostPlatform targetPlatform;
+
+  sources = callPackage ../sources.nix { };
+
+  # Tools invoked by swift at run-time.
+  runtimeDeps = lib.optionals stdenv.isDarwin [
+    # libtool is used for static linking. This is part of cctools, but adding
+    # that as a build input puts an unwrapped linker in PATH, and breaks
+    # builds. This small derivation exposes just libtool.
+    # NOTE: The same applies to swift-driver, but that is currently always
+    # invoked via the old `swift` / `swiftc`. May change in the future.
+    (runCommandLocal "libtool" { } ''
+      mkdir -p $out/bin
+      ln -s ${cctools}/bin/libtool $out/bin/libtool
+    '')
+  ];
+
+  # There are apparently multiple naming conventions on Darwin. Swift uses the
+  # xcrun naming convention. See `configure_sdk_darwin` calls in CMake files.
+  swiftOs = if targetPlatform.isDarwin
+    then {
+      "macos" = "macosx";
+      "ios" = "iphoneos";
+      #iphonesimulator
+      #appletvos
+      #appletvsimulator
+      #watchos
+      #watchsimulator
+    }.${targetPlatform.darwinPlatform}
+      or (throw "Cannot build Swift for target Darwin platform '${targetPlatform.darwinPlatform}'")
+    else targetPlatform.parsed.kernel.name;
+
+  # Apple Silicon uses a different CPU name in the target triple.
+  swiftArch = if stdenv.isDarwin && stdenv.isAarch64 then "arm64"
+    else targetPlatform.parsed.cpu.name;
+
+  # On Darwin, a `.swiftmodule` is a subdirectory in `lib/swift/<OS>`,
+  # containing binaries for supported archs. On other platforms, binaries are
+  # installed to `lib/swift/<OS>/<ARCH>`. Note that our setup-hook also adds
+  # `lib/swift` for convenience.
+  swiftLibSubdir = "lib/swift/${swiftOs}";
+  swiftModuleSubdir = if hostPlatform.isDarwin
+    then "lib/swift/${swiftOs}"
+    else "lib/swift/${swiftOs}/${swiftArch}";
+
+  # And then there's also a separate subtree for statically linked  modules.
+  toStaticSubdir = lib.replaceStrings [ "/swift/" ] [ "/swift_static/" ];
+  swiftStaticLibSubdir = toStaticSubdir swiftLibSubdir;
+  swiftStaticModuleSubdir = toStaticSubdir swiftModuleSubdir;
+
+  # This matches _SWIFT_DEFAULT_COMPONENTS, with specific components disabled.
+  swiftInstallComponents = [
+    "autolink-driver"
+    "compiler"
+    # "clang-builtin-headers"
+    "stdlib"
+    "sdk-overlay"
+    "parser-lib"
+    "static-mirror-lib"
+    "editor-integration"
+    # "tools"
+    # "testsuite-tools"
+    "toolchain-tools"
+    "toolchain-dev-tools"
+    "license"
+    (if stdenv.isDarwin then "sourcekit-xpc-service" else "sourcekit-inproc")
+    "swift-remote-mirror"
+    "swift-remote-mirror-headers"
+  ];
+
+  # Build a tool used during the build to create a custom clang wrapper, with
+  # which we wrap the clang produced by the swift build.
+  #
+  # This is used in a `POST_BUILD` for the CMake target, so we rename the
+  # actual clang to clang-unwrapped, then put the wrapper in place.
+  #
+  # We replace the `exec ...` command with `exec -a "$0"` in order to
+  # preserve $0 for clang. This is because, unlike Nix, we don't have
+  # separate wrappers for clang/clang++, and clang uses $0 to detect C++.
+  #
+  # Similarly, the C++ detection in the wrapper itself also won't work for us,
+  # so we base it on $0 as well.
+  makeClangWrapper = writeShellScriptBin "nix-swift-make-clang-wrapper" ''
+    set -euo pipefail
+
+    targetFile="$1"
+    unwrappedClang="$targetFile-unwrapped"
+
+    mv "$targetFile" "$unwrappedClang"
+    sed < '${clang}/bin/clang' > "$targetFile" \
+      -e 's|^\s*exec|exec -a "$0"|g' \
+      -e 's|^\[\[ "${clang.cc}/bin/clang" = \*++ ]]|[[ "$0" = *++ ]]|' \
+      -e "s|${clang.cc}/bin/clang|$unwrappedClang|g"
+    chmod a+x "$targetFile"
+  '';
+
+  # Create a tool used during the build to create a custom swift wrapper for
+  # each of the swift executables produced by the build.
+  #
+  # The build produces several `swift-frontend` executables during
+  # bootstrapping. Each of these has numerous aliases via symlinks, and the
+  # executable uses $0 to detect what tool is called.
+  wrapperParams = {
+    inherit bintools;
+    default_cc_wrapper = clang; # Instead of `@out@` in the original.
+    coreutils_bin = lib.getBin coreutils;
+    gnugrep_bin = gnugrep;
+    suffixSalt = lib.replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
+    use_response_file_by_default = 1;
+    swiftDriver = "";
+    # NOTE: @prog@ needs to be filled elsewhere.
+  };
+  swiftWrapper = runCommand "swift-wrapper.sh" wrapperParams ''
+    substituteAll '${../wrapper/wrapper.sh}' "$out"
+  '';
+  makeSwiftcWrapper = writeShellScriptBin "nix-swift-make-swift-wrapper" ''
+    set -euo pipefail
+
+    targetFile="$1"
+    unwrappedSwift="$targetFile-unwrapped"
+
+    mv "$targetFile" "$unwrappedSwift"
+    sed < '${swiftWrapper}' > "$targetFile" \
+      -e "s|@prog@|'$unwrappedSwift'|g" \
+      -e 's|exec "$prog"|exec -a "$0" "$prog"|g'
+    chmod a+x "$targetFile"
+  '';
+
+  # On Darwin, we need to use BOOTSTRAPPING-WITH-HOSTLIBS because of ABI
+  # stability, and have to provide the definitions for the system stdlib.
+  appleSwiftCore = stdenv.mkDerivation {
+    name = "apple-swift-core";
+    dontUnpack = true;
+
+    installPhase = ''
+      mkdir -p $out/lib/swift
+      cp -r \
+        "${MacOSX-SDK}/usr/lib/swift/Swift.swiftmodule" \
+        "${MacOSX-SDK}/usr/lib/swift/libswiftCore.tbd" \
+        $out/lib/swift/
+    '';
+  };
+
+in stdenv.mkDerivation {
+  pname = "swift";
+  inherit (sources) version;
+
+  outputs = [ "out" "lib" "dev" "doc" "man" ];
+
+  nativeBuildInputs = [
+    cmake
+    git
+    ninja
+    perl # pod2man
+    pkg-config
+    python3
+    makeWrapper
+    makeClangWrapper
+    makeSwiftcWrapper
+  ]
+    ++ lib.optionals stdenv.isDarwin [
+      xcbuild
+      sigtool # codesign
+      DarwinTools # sw_vers
+      fixDarwinDylibNames
+    ];
+
+  buildInputs = [
+    # For lldb
+    python3
+    swig
+    libxml2
+  ]
+    ++ lib.optionals stdenv.isLinux [
+      libuuid
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      CoreServices
+      Foundation
+      Combine
+    ];
+
+  # This is a partial reimplementation of our setup hook. Because we reuse
+  # the Swift wrapper for the Swift build itself, we need to do some of the
+  # same preparation.
+  postHook = ''
+    for pkg in "''${pkgsHostTarget[@]}" '${clang.libc}'; do
+      for subdir in ${swiftModuleSubdir} ${swiftStaticModuleSubdir} lib/swift; do
+        if [[ -d "$pkg/$subdir" ]]; then
+          export NIX_SWIFTFLAGS_COMPILE+=" -I $pkg/$subdir"
+        fi
+      done
+      for subdir in ${swiftLibSubdir} ${swiftStaticLibSubdir} lib/swift; do
+        if [[ -d "$pkg/$subdir" ]]; then
+          export NIX_LDFLAGS+=" -L $pkg/$subdir"
+        fi
+      done
+    done
+  '';
+
+  # We invoke cmakeConfigurePhase multiple times, but only need this once.
+  dontFixCmake = true;
+  # We setup custom build directories.
+  dontUseCmakeBuildDir = true;
+
+  unpackPhase = let
+    copySource = repo: "cp -r ${sources.${repo}} ${repo}";
+  in ''
+    mkdir src
+    cd src
+
+    ${copySource "swift-cmark"}
+    ${copySource "llvm-project"}
+    ${copySource "swift"}
+    ${copySource "swift-experimental-string-processing"}
+    ${lib.optionalString
+      (!stdenv.isDarwin)
+      (copySource "swift-corelibs-libdispatch")}
+
+    chmod -R u+w .
+  '';
+
+  patchPhase = ''
+    # Just patch all the things for now, we can focus this later.
+    # TODO: eliminate use of env.
+    find -type f -print0 | xargs -0 sed -i \
+    ${lib.optionalString stdenv.isDarwin
+      "-e 's|/usr/libexec/PlistBuddy|${xcbuild}/bin/PlistBuddy|g'"} \
+      -e 's|/usr/bin/env|${coreutils}/bin/env|g' \
+      -e 's|/usr/bin/make|${gnumake}/bin/make|g' \
+      -e 's|/bin/mkdir|${coreutils}/bin/mkdir|g' \
+      -e 's|/bin/cp|${coreutils}/bin/cp|g' \
+      -e 's|/usr/bin/file|${file}/bin/file|g'
+
+    patch -p1 -d swift -i ${./patches/swift-wrap.patch}
+    patch -p1 -d swift -i ${./patches/swift-nix-resource-root.patch}
+    patch -p1 -d swift -i ${./patches/swift-linux-fix-linking.patch}
+    patch -p1 -d swift -i ${substituteAll {
+      src = ./patches/swift-darwin-plistbuddy-workaround.patch;
+      inherit swiftArch;
+    }}
+    patch -p1 -d swift -i ${substituteAll {
+      src = ./patches/swift-prevent-sdk-dirs-warning.patch;
+      inherit (builtins) storeDir;
+    }}
+    substituteInPlace swift/cmake/modules/SwiftConfigureSDK.cmake \
+      --replace '/usr/include' "${stdenv.cc.libc_dev}/include"
+
+    # This patch needs to know the lib output location, so must be substituted
+    # in the same derivation as the compiler.
+    storeDir="${builtins.storeDir}" \
+      substituteAll ${./patches/swift-separate-lib.patch} $TMPDIR/swift-separate-lib.patch
+    patch -p1 -d swift -i $TMPDIR/swift-separate-lib.patch
+
+    patch -p1 -d llvm-project/llvm -i ${./patches/llvm-module-cache.patch}
+
+    patch -p1 -d llvm-project/clang -i ${./patches/clang-toolchain-dir.patch}
+    patch -p1 -d llvm-project/clang -i ${./patches/clang-wrap.patch}
+    patch -p1 -d llvm-project/clang -i ${../../llvm/14/clang/purity.patch}
+    patch -p2 -d llvm-project/clang -i ${fetchpatch {
+      name = "clang-cmake-fix-interpreter.patch";
+      url = "https://github.com/llvm/llvm-project/commit/b5eaf500f2441eff2277ea2973878fb1f171fd0a.patch";
+      sha256 = "1rma1al0rbm3s3ql6bnvbcighp74lri1lcrwbyacgdqp80fgw1b6";
+    }}
+
+    ${lib.optionalString stdenv.isLinux ''
+    substituteInPlace llvm-project/clang/lib/Driver/ToolChains/Linux.cpp \
+      --replace 'SysRoot + "/lib' '"${glibc}/lib" "' \
+      --replace 'SysRoot + "/usr/lib' '"${glibc}/lib" "' \
+      --replace 'LibDir = "lib";' 'LibDir = "${glibc}/lib";' \
+      --replace 'LibDir = "lib64";' 'LibDir = "${glibc}/lib";' \
+      --replace 'LibDir = X32 ? "libx32" : "lib64";' 'LibDir = "${glibc}/lib";'
+
+    # uuid.h is not part of glibc, but of libuuid.
+    sed -i 's|''${GLIBC_INCLUDE_PATH}/uuid/uuid.h|${libuuid.dev}/include/uuid/uuid.h|' \
+      swift/stdlib/public/Platform/glibc.modulemap.gyb
+    ''}
+
+    # Remove tests for cross compilation, which we don't currently support.
+    rm swift/test/Interop/Cxx/class/constructors-copy-irgen.swift
+    rm swift/test/Interop/Cxx/class/constructors-irgen.swift
+
+    # TODO: consider fixing and re-adding. This test fails due to a non-standard "install_prefix".
+    rm swift/validation-test/Python/build_swift.swift
+
+    # We cannot handle the SDK location being in "Weird Location" due to Nix isolation.
+    rm swift/test/DebugInfo/compiler-flags.swift
+
+    # TODO: Fix issue with ld.gold invoked from script finding crtbeginS.o and crtendS.o.
+    rm swift/test/IRGen/ELF-remove-autolink-section.swift
+
+    # The following two tests fail because we use don't use the bundled libicu:
+    # [SOURCE_DIR/utils/build-script] ERROR: can't find source directory for libicu (tried /build/src/icu)
+    rm swift/validation-test/BuildSystem/default_build_still_performs_epilogue_opts_after_split.test
+    rm swift/validation-test/BuildSystem/test_early_swift_driver_and_infer.swift
+
+    # TODO: This test fails for some unknown reason
+    rm swift/test/Serialization/restrict-swiftmodule-to-revision.swift
+
+    # This test was flaky in ofborg, see #186476
+    rm swift/test/AutoDiff/compiler_crashers_fixed/sr14290-missing-debug-scopes-in-pullback-trampoline.swift
+
+    patchShebangs .
+
+    ${lib.optionalString (!stdenv.isDarwin) ''
+    # NOTE: This interferes with ABI stability on Darwin, which uses the system
+    # libraries in the hardcoded path /usr/lib/swift.
+    fixCmakeFiles .
+    ''}
+  '';
+
+  configurePhase = ''
+    export SWIFT_SOURCE_ROOT="$PWD"
+    mkdir -p ../build
+    cd ../build
+    export SWIFT_BUILD_ROOT="$PWD"
+
+    # Most builds set a target, but LLDB doesn't. Harmless on non-Darwin.
+    export MACOSX_DEPLOYMENT_TARGET=10.15
+  '';
+
+  # These steps are derived from doing a normal build with.
+  #
+  #   ./swift/utils/build-toolchain test --dry-run
+  #
+  # But dealing with the custom Python build system is far more trouble than
+  # simply invoking CMake directly. Few variables it passes to CMake are
+  # actually required or non-default.
+  #
+  # Using CMake directly also allows us to split up the already large build,
+  # and package Swift components separately.
+  #
+  # Besides `--dry-run`, another good way to compare build changes between
+  # Swift releases is to diff the scripts:
+  #
+  #   git diff swift-5.6.3-RELEASE..swift-5.7-RELEASE -- utils/build*
+  #
+  buildPhase = ''
+    # Helper to build a subdirectory.
+    #
+    # Always reset cmakeFlags before calling this. The cmakeConfigurePhase
+    # amends flags and would otherwise keep expanding it.
+    function buildProject() {
+      mkdir -p $SWIFT_BUILD_ROOT/$1
+      cd $SWIFT_BUILD_ROOT/$1
+
+      cmakeDir=$SWIFT_SOURCE_ROOT/''${2-$1}
+      cmakeConfigurePhase
+
+      ninjaBuildPhase
+    }
+
+    cmakeFlags="-GNinja"
+    buildProject swift-cmark
+
+    # Some notes:
+    # - The Swift build just needs Clang.
+    # - We can further reduce targets to just our targetPlatform.
+    cmakeFlags="
+      -GNinja
+      -DLLVM_ENABLE_PROJECTS=clang
+      -DLLVM_TARGETS_TO_BUILD=${{
+        "x86_64" = "X86";
+        "aarch64" = "AArch64";
+      }.${targetPlatform.parsed.cpu.name}}
+    "
+    buildProject llvm llvm-project/llvm
+
+    '' + lib.optionalString stdenv.isDarwin ''
+    # Add appleSwiftCore to the search paths. We can't simply add it to
+    # buildInputs, because it is potentially an older stdlib than the one we're
+    # building. We have to remove it again after the main Swift build, or later
+    # build steps may fail. (Specific case: Concurrency backdeploy uses the
+    # Sendable protocol, which appears to not be present in the macOS 11 SDK.)
+    OLD_NIX_SWIFTFLAGS_COMPILE="$NIX_SWIFTFLAGS_COMPILE"
+    OLD_NIX_LDFLAGS="$NIX_LDFLAGS"
+    export NIX_SWIFTFLAGS_COMPILE+=" -I ${appleSwiftCore}/lib/swift"
+    export NIX_LDFLAGS+=" -L ${appleSwiftCore}/lib/swift"
+    '' + ''
+
+    # Some notes:
+    # - BOOTSTRAPPING_MODE defaults to OFF in CMake, but is enabled in standard
+    #   builds, so we enable it as well. On Darwin, we have to use the system
+    #   Swift libs because of ABI-stability, but this may be trouble if the
+    #   builder is an older macOS.
+    # - Experimental features are OFF by default in CMake, but some are
+    #   required to build the stdlib.
+    # - SWIFT_STDLIB_ENABLE_OBJC_INTEROP is set explicitely because its check
+    #   is buggy. (Uses SWIFT_HOST_VARIANT_SDK before initialized.)
+    #   Fixed in: https://github.com/apple/swift/commit/84083afef1de5931904d5c815d53856cdb3fb232
+    cmakeFlags="
+      -GNinja
+      -DBOOTSTRAPPING_MODE=BOOTSTRAPPING${lib.optionalString stdenv.isDarwin "-WITH-HOSTLIBS"}
+      -DSWIFT_ENABLE_EXPERIMENTAL_CONCURRENCY=ON
+      -DLLVM_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/llvm
+      -DClang_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/clang
+      -DSWIFT_PATH_TO_CMARK_SOURCE=$SWIFT_SOURCE_ROOT/swift-cmark
+      -DSWIFT_PATH_TO_CMARK_BUILD=$SWIFT_BUILD_ROOT/swift-cmark
+      -DSWIFT_PATH_TO_LIBDISPATCH_SOURCE=$SWIFT_SOURCE_ROOT/swift-corelibs-libdispatch
+      -DEXPERIMENTAL_STRING_PROCESSING_SOURCE_DIR=$SWIFT_SOURCE_ROOT/swift-experimental-string-processing
+      -DSWIFT_INSTALL_COMPONENTS=${lib.concatStringsSep ";" swiftInstallComponents}
+      -DSWIFT_STDLIB_ENABLE_OBJC_INTEROP=${if stdenv.isDarwin then "ON" else "OFF"}
+    "
+    buildProject swift
+
+    '' + lib.optionalString stdenv.isDarwin ''
+    # Restore search paths to remove appleSwiftCore.
+    export NIX_SWIFTFLAGS_COMPILE="$OLD_NIX_SWIFTFLAGS_COMPILE"
+    export NIX_LDFLAGS="$OLD_NIX_LDFLAGS"
+    '' + ''
+
+    # These are based on flags in `utils/build-script-impl`.
+    #
+    # LLDB_USE_SYSTEM_DEBUGSERVER=ON disables the debugserver build on Darwin,
+    # which requires a special signature.
+    #
+    # CMAKE_BUILD_WITH_INSTALL_NAME_DIR ensures we don't use rpath on Darwin.
+    #
+    # NOTE: On Darwin, we only want ncurses in the linker search path, because
+    # headers are part of libsystem. Adding its headers to the search path
+    # causes strange mixing and errors. Note that libedit propagates ncurses,
+    # so we add both manually here, instead of relying on setup hooks.
+    # TODO: Find a better way to prevent this conflict.
+    cmakeFlags="
+      -GNinja
+      -DLLDB_SWIFTC=$SWIFT_BUILD_ROOT/swift/bin/swiftc
+      -DLLDB_SWIFT_LIBS=$SWIFT_BUILD_ROOT/swift/lib/swift
+      -DLLVM_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/llvm
+      -DClang_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/clang
+      -DSwift_DIR=$SWIFT_BUILD_ROOT/swift/lib/cmake/swift
+      -DLLDB_ENABLE_CURSES=ON
+      -DLLDB_ENABLE_LIBEDIT=ON
+      -DLLDB_ENABLE_PYTHON=ON
+      -DLLDB_ENABLE_LZMA=OFF
+      -DLLDB_ENABLE_LUA=OFF
+      -DLLDB_INCLUDE_TESTS=OFF
+      -DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON
+      ${lib.optionalString stdenv.isDarwin ''
+      -DLLDB_USE_SYSTEM_DEBUGSERVER=ON
+      ''}
+      -DLibEdit_INCLUDE_DIRS=${libedit.dev}/include
+      -DLibEdit_LIBRARIES=${libedit}/lib/libedit${stdenv.hostPlatform.extensions.sharedLibrary}
+      -DCURSES_INCLUDE_DIRS=${if stdenv.isDarwin then "/var/empty" else ncurses.dev}/include
+      -DCURSES_LIBRARIES=${ncurses}/lib/libncurses${stdenv.hostPlatform.extensions.sharedLibrary}
+      -DPANEL_LIBRARIES=${ncurses}/lib/libpanel${stdenv.hostPlatform.extensions.sharedLibrary}
+    ";
+    buildProject lldb llvm-project/lldb
+
+    ${lib.optionalString stdenv.isDarwin ''
+    # Need to do a standalone build of concurrency for Darwin back deployment.
+    # Based on: utils/swift_build_support/swift_build_support/products/backdeployconcurrency.py
+    cmakeFlags="
+      -GNinja
+      -DCMAKE_Swift_COMPILER=$SWIFT_BUILD_ROOT/swift/bin/swiftc
+
+      -DTOOLCHAIN_DIR=/var/empty
+      -DSWIFT_NATIVE_LLVM_TOOLS_PATH=${stdenv.cc}/bin
+      -DSWIFT_NATIVE_CLANG_TOOLS_PATH=${stdenv.cc}/bin
+      -DSWIFT_NATIVE_SWIFT_TOOLS_PATH=$SWIFT_BUILD_ROOT/swift/bin
+
+      -DCMAKE_CROSSCOMPILING=ON
+
+      -DBUILD_SWIFT_CONCURRENCY_BACK_DEPLOYMENT_LIBRARIES=ON
+      -DSWIFT_INCLUDE_TOOLS=OFF
+      -DSWIFT_BUILD_STDLIB_EXTRA_TOOLCHAIN_CONTENT=OFF
+      -DSWIFT_BUILD_TEST_SUPPORT_MODULES=OFF
+      -DSWIFT_BUILD_STDLIB=OFF
+      -DSWIFT_BUILD_DYNAMIC_STDLIB=OFF
+      -DSWIFT_BUILD_STATIC_STDLIB=OFF
+      -DSWIFT_BUILD_REMOTE_MIRROR=OFF
+      -DSWIFT_BUILD_SDK_OVERLAY=OFF
+      -DSWIFT_BUILD_DYNAMIC_SDK_OVERLAY=OFF
+      -DSWIFT_BUILD_STATIC_SDK_OVERLAY=OFF
+      -DSWIFT_INCLUDE_TESTS=OFF
+      -DSWIFT_BUILD_PERF_TESTSUITE=OFF
+
+      -DSWIFT_HOST_VARIANT_ARCH=${swiftArch}
+      -DBUILD_STANDALONE=ON
+
+      -DSWIFT_INSTALL_COMPONENTS=back-deployment
+
+      -DSWIFT_SDKS=${{
+        "macos" = "OSX";
+        "ios" = "IOS";
+        #IOS_SIMULATOR
+        #TVOS
+        #TVOS_SIMULATOR
+        #WATCHOS
+        #WATCHOS_SIMULATOR
+      }.${targetPlatform.darwinPlatform}}
+
+      -DLLVM_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/llvm
+
+      -DSWIFT_DEST_ROOT=$out
+      -DSWIFT_HOST_VARIANT_SDK=OSX
+
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_OSX=10.15
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_IOS=13.0
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_MACCATALYST=13.0
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_TVOS=13.0
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_WATCHOS=6.0
+    "
+
+    # This depends on the special Clang build specific to the Swift branch.
+    # We also need to call a specific Ninja target.
+    export CC=$SWIFT_BUILD_ROOT/llvm/bin/clang
+    export CXX=$SWIFT_BUILD_ROOT/llvm/bin/clang++
+    ninjaFlags="back-deployment"
+
+    buildProject swift-concurrency-backdeploy swift
+
+    export CC=$NIX_CC/bin/clang
+    export CXX=$NIX_CC/bin/clang++
+    unset ninjaFlags
+  ''}
+  '';
+
+  # TODO: ~50 failing tests on x86_64-linux. Other platforms not checked.
+  doCheck = false;
+  nativeCheckInputs = [ file ];
+  # TODO: consider using stress-tester and integration-test.
+  checkPhase = ''
+    cd $SWIFT_BUILD_ROOT/swift
+    checkTarget=check-swift-all
+    ninjaCheckPhase
+    unset checkTarget
+  '';
+
+  installPhase = ''
+    # Undo the clang and swift wrapping we did for the build.
+    # (This happened via patches to cmake files.)
+    cd $SWIFT_BUILD_ROOT
+    mv llvm/bin/clang-14{-unwrapped,}
+    mv swift/bin/swift-frontend{-unwrapped,}
+
+    mkdir $out $lib
+
+    # Install clang binaries only. We hide these with the wrapper, so they are
+    # for private use by Swift only.
+    cd $SWIFT_BUILD_ROOT/llvm
+    installTargets=install-clang
+    ninjaInstallPhase
+    unset installTargets
+
+    # LLDB is also a private install.
+    cd $SWIFT_BUILD_ROOT/lldb
+    ninjaInstallPhase
+
+    cd $SWIFT_BUILD_ROOT/swift
+    ninjaInstallPhase
+
+    ${lib.optionalString stdenv.isDarwin ''
+    cd $SWIFT_BUILD_ROOT/swift-concurrency-backdeploy
+    installTargets=install-back-deployment
+    ninjaInstallPhase
+    unset installTargets
+    ''}
+
+    # Separate $lib output here, because specific logic follows.
+    # Only move the dynamic run-time parts, to keep $lib small. Every Swift
+    # build will depend on it.
+    moveToOutput "lib/swift" "$lib"
+    moveToOutput "lib/libswiftDemangle.*" "$lib"
+
+    # This link is here because various tools (swiftpm) check for stdlib
+    # relative to the swift compiler. It's fine if this is for build-time
+    # stuff, but we should patch all cases were it would end up in an output.
+    ln -s $lib/lib/swift $out/lib/swift
+
+    # Swift has a separate resource root from Clang, but locates the Clang
+    # resource root via subdir or symlink. Provide a default here, but we also
+    # patch Swift to prefer NIX_CC if set.
+    ln -s ${clang}/resource-root $lib/lib/swift/clang
+
+    ${lib.optionalString stdenv.isDarwin ''
+    # Install required library for ObjC interop.
+    # TODO: Is there no source code for this available?
+    cp -r ${CLTools_Executables}/usr/lib/arc $out/lib/arc
+    ''}
+  '';
+
+  preFixup = lib.optionalString stdenv.isLinux ''
+    # This is cheesy, but helps the patchelf hook remove /build from RPATH.
+    cd $SWIFT_BUILD_ROOT/..
+    mv build buildx
+  '';
+
+  postFixup = lib.optionalString stdenv.isDarwin ''
+    # These libraries need to use the system install name. The official SDK
+    # does the same (as opposed to using rpath). Presumably, they are part of
+    # the stable ABI. Not using the system libraries at run-time is known to
+    # cause ObjC class conflicts and segfaults.
+    declare -A systemLibs=(
+      [libswiftCore.dylib]=1
+      [libswiftDarwin.dylib]=1
+      [libswiftSwiftOnoneSupport.dylib]=1
+      [libswift_Concurrency.dylib]=1
+    )
+
+    for systemLib in "''${!systemLibs[@]}"; do
+      install_name_tool -id /usr/lib/swift/$systemLib $lib/${swiftLibSubdir}/$systemLib
+    done
+
+    for file in $out/bin/swift-frontend $lib/${swiftLibSubdir}/*.dylib; do
+      changeArgs=""
+      for dylib in $(otool -L $file | awk '{ print $1 }'); do
+        if [[ ''${systemLibs["$(basename $dylib)"]} ]]; then
+          changeArgs+=" -change $dylib /usr/lib/swift/$(basename $dylib)"
+        elif [[ "$dylib" = */bootstrapping1/* ]]; then
+          changeArgs+=" -change $dylib $lib/lib/swift/$(basename $dylib)"
+        fi
+      done
+      if [[ -n "$changeArgs" ]]; then
+        install_name_tool $changeArgs $file
+      fi
+    done
+
+    wrapProgram $out/bin/swift-frontend \
+      --prefix PATH : ${lib.makeBinPath runtimeDeps}
+  '';
+
+  passthru = {
+    inherit
+      swiftOs swiftArch
+      swiftModuleSubdir swiftLibSubdir
+      swiftStaticModuleSubdir swiftStaticLibSubdir;
+
+    # Internal attr for the wrapper.
+    _wrapperParams = wrapperParams;
+  };
+
+  meta = {
+    description = "The Swift Programming Language";
+    homepage = "https://github.com/apple/swift";
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+    license = lib.licenses.asl20;
+    platforms = with lib.platforms; linux ++ darwin;
+    # Swift doesn't support 32-bit Linux, unknown on other platforms.
+    badPlatforms = lib.platforms.i686;
+    timeout = 86400; # 24 hours.
+  };
+}
diff --git a/pkgs/development/compilers/swift/patches/0005-clang-toolchain-dir.patch b/pkgs/development/compilers/swift/compiler/patches/clang-toolchain-dir.patch
index 40d7728cf7884..40d7728cf7884 100644
--- a/pkgs/development/compilers/swift/patches/0005-clang-toolchain-dir.patch
+++ b/pkgs/development/compilers/swift/compiler/patches/clang-toolchain-dir.patch
diff --git a/pkgs/development/compilers/swift/compiler/patches/clang-wrap.patch b/pkgs/development/compilers/swift/compiler/patches/clang-wrap.patch
new file mode 100644
index 0000000000000..9c6cafed3699c
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/clang-wrap.patch
@@ -0,0 +1,18 @@
+Wrap the clang produced during the build
+
+--- a/tools/driver/CMakeLists.txt
++++ b/tools/driver/CMakeLists.txt
+@@ -59,6 +59,13 @@ endif()
+ 
+ add_dependencies(clang clang-resource-headers)
+ 
++# Nix: wrap the clang build.
++add_custom_command(
++  TARGET clang POST_BUILD
++  COMMAND nix-swift-make-clang-wrapper $<TARGET_FILE:clang>
++  VERBATIM
++)
++
+ if(NOT CLANG_LINKS_TO_CREATE)
+   set(CLANG_LINKS_TO_CREATE clang++ clang-cl clang-cpp)
+ endif()
diff --git a/pkgs/development/compilers/swift/compiler/patches/llvm-module-cache.patch b/pkgs/development/compilers/swift/compiler/patches/llvm-module-cache.patch
new file mode 100644
index 0000000000000..9a22d0482ea5c
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/llvm-module-cache.patch
@@ -0,0 +1,30 @@
+The compiler fails if LLVM modules are enabled and it cannot write its module
+cache. This patch detects and rejects the fake, non-existant $HOME used in Nix
+builds.
+
+We could simply return false in `cache_directory`, but that completely disables
+module caching, and may unnecessarily slow down builds. Instead, let it use
+'/tmp/.cache'.
+
+--- a/lib/Support/Unix/Path.inc
++++ b/lib/Support/Unix/Path.inc
+@@ -1380,6 +1380,9 @@ bool user_config_directory(SmallVectorImpl<char> &result) {
+   if (!home_directory(result)) {
+     return false;
+   }
++  if (std::equal(result.begin(), result.end(), "/homeless-shelter")) {
++    return false;
++  }
+   append(result, ".config");
+   return true;
+ }
+@@ -1401,6 +1404,9 @@ bool cache_directory(SmallVectorImpl<char> &result) {
+   if (!home_directory(result)) {
+     return false;
+   }
++  if (std::equal(result.begin(), result.end(), "/homeless-shelter")) {
++    system_temp_directory(true/*ErasedOnReboot*/, result);
++  }
+   append(result, ".cache");
+   return true;
+ }
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-darwin-plistbuddy-workaround.patch b/pkgs/development/compilers/swift/compiler/patches/swift-darwin-plistbuddy-workaround.patch
new file mode 100644
index 0000000000000..a3cf4f60675cb
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-darwin-plistbuddy-workaround.patch
@@ -0,0 +1,17 @@
+CMake tries to read a list field from SDKSettings.plist, but the output of
+facebook/xcbuild PlistBuddy is incompatible with Apple's.
+
+Simply set the supported architectures to the one target architecture we're
+building for.
+
+--- a/cmake/modules/SwiftConfigureSDK.cmake
++++ b/cmake/modules/SwiftConfigureSDK.cmake
+@@ -189,7 +189,7 @@ macro(configure_sdk_darwin
+   endif()
+ 
+   # Remove any architectures not supported by the SDK.
+-  remove_sdk_unsupported_archs(${name} ${xcrun_name} ${SWIFT_SDK_${prefix}_PATH} SWIFT_SDK_${prefix}_ARCHITECTURES)
++  set(SWIFT_SDK_${prefix}_ARCHITECTURES "@swiftArch@")
+ 
+   list_intersect(
+     "${SWIFT_DARWIN_MODULE_ARCHS}"            # lhs
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch b/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch
new file mode 100644
index 0000000000000..e09d5162a93a4
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch
@@ -0,0 +1,21 @@
+--- a/lib/Driver/ToolChains.cpp
++++ b/lib/Driver/ToolChains.cpp
+@@ -1475,7 +1475,17 @@ const char *ToolChain::getClangLinkerDriver(
+ 
+     // If there is a linker driver in the toolchain folder, use that instead.
+     if (auto tool = llvm::sys::findProgramByName(LinkerDriver, {toolchainPath}))
+-      LinkerDriver = Args.MakeArgString(tool.get());
++      return Args.MakeArgString(tool.get());
++  }
++
++  // For Nix, prefer linking using the wrapped system clang, instead of using
++  // the unwrapped clang packaged with swift. The latter is unable to link, but
++  // we still want to use it for other purposes (clang importer).
++  if (auto nixCC = llvm::sys::Process::GetEnv("NIX_CC")) {
++    llvm::SmallString<128> binDir(nixCC.getValue());
++    llvm::sys::path::append(binDir, "bin");
++    if (auto tool = llvm::sys::findProgramByName(LinkerDriver, {binDir.str()}))
++      return Args.MakeArgString(tool.get());
+   }
+ 
+   return LinkerDriver;
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch b/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch
new file mode 100644
index 0000000000000..a68326c580b12
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch
@@ -0,0 +1,67 @@
+Swift normally looks for the Clang resource dir in a subdir/symlink of its own
+resource dir. We provide a symlink to the Swift build-time Clang as a default
+there, but we also here patch two checks to try locate it via NIX_CC.
+
+The first (ClangImporter.cpp) happens when Swift code imports C modules. The
+second (ToolChains.cpp) happens when Swift is used to link the final product.
+
+--- a/lib/ClangImporter/ClangImporter.cpp
++++ b/lib/ClangImporter/ClangImporter.cpp
+@@ -68,6 +68,7 @@
+ #include "llvm/Support/FileSystem.h"
+ #include "llvm/Support/Memory.h"
+ #include "llvm/Support/Path.h"
++#include "llvm/Support/Process.h"
+ #include "llvm/Support/YAMLParser.h"
+ #include "llvm/Support/YAMLTraits.h"
+ #include <algorithm>
+@@ -809,6 +810,17 @@ importer::addCommonInvocationArguments(
+ 
+   const std::string &overrideResourceDir = importerOpts.OverrideResourceDir;
+   if (overrideResourceDir.empty()) {
++    // Prefer the Clang resource directory from NIX_CC, to allow swapping in a
++    // different stdenv.
++    // TODO: Figure out how to provide a user override for this. Probably a
++    // niche use case, though, and for now a user can unset NIX_CC to work
++    // around it if necessary.
++    if (auto nixCC = llvm::sys::Process::GetEnv("NIX_CC")) {
++      llvm::SmallString<128> resourceDir(nixCC.getValue());
++      llvm::sys::path::append(resourceDir, "resource-root");
++      invocationArgStrs.push_back("-resource-dir");
++      invocationArgStrs.push_back(std::string(resourceDir.str()));
++    } else {
+     llvm::SmallString<128> resourceDir(searchPathOpts.RuntimeResourcePath);
+ 
+     // Adjust the path to refer to our copy of the Clang resource directory
+@@ -824,6 +836,7 @@ importer::addCommonInvocationArguments(
+     // Set the Clang resource directory to the path we computed.
+     invocationArgStrs.push_back("-resource-dir");
+     invocationArgStrs.push_back(std::string(resourceDir.str()));
++    } // nixCC
+   } else {
+     invocationArgStrs.push_back("-resource-dir");
+     invocationArgStrs.push_back(overrideResourceDir);
+--- a/lib/Driver/ToolChains.cpp
++++ b/lib/Driver/ToolChains.cpp
+@@ -1372,10 +1372,20 @@ void ToolChain::getClangLibraryPath(const ArgList &Args,
+                                     SmallString<128> &LibPath) const {
+   const llvm::Triple &T = getTriple();
+ 
++  // Nix: We provide a `clang` symlink in the default Swift resource root, but
++  // prefer detecting the Clang resource root via NIX_CC, to allow swapping in
++  // a different stdenv. However, always honor a user-provided `-resource-dir`.
++  auto nixCC = llvm::sys::Process::GetEnv("NIX_CC");
++  if (nixCC && !Args.hasArgNoClaim(options::OPT_resource_dir)) {
++    LibPath.assign(nixCC.getValue());
++    llvm::sys::path::append(LibPath, "resource-root");
++  } else {
+   getResourceDirPath(LibPath, Args, /*Shared=*/true);
+   // Remove platform name.
+   llvm::sys::path::remove_filename(LibPath);
+-  llvm::sys::path::append(LibPath, "clang", "lib",
++  llvm::sys::path::append(LibPath, "clang");
++  } // nixCC
++  llvm::sys::path::append(LibPath, "lib",
+                           T.isOSDarwin() ? "darwin"
+                                          : getPlatformNameForTriple(T));
+ }
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-prevent-sdk-dirs-warning.patch b/pkgs/development/compilers/swift/compiler/patches/swift-prevent-sdk-dirs-warning.patch
new file mode 100644
index 0000000000000..987b99d745391
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-prevent-sdk-dirs-warning.patch
@@ -0,0 +1,39 @@
+Prevents a user-visible warning on every compilation:
+
+  ld: warning: directory not found for option '-L.../MacOSX11.0.sdk/usr/lib/swift'
+
+--- a/lib/Driver/ToolChains.cpp
++++ b/lib/Driver/ToolChains.cpp
+@@ -1455,9 +1455,11 @@ void ToolChain::getRuntimeLibraryPaths(SmallVectorImpl<std::string> &runtimeLibP
+       runtimeLibPaths.push_back(std::string(scratchPath.str()));
+     }
+ 
++    if (!SDKPath.startswith("@storeDir@")) {
+     scratchPath = SDKPath;
+     llvm::sys::path::append(scratchPath, "usr", "lib", "swift");
+     runtimeLibPaths.push_back(std::string(scratchPath.str()));
++    }
+   }
+ }
+ 
+--- a/lib/Frontend/CompilerInvocation.cpp
++++ b/lib/Frontend/CompilerInvocation.cpp
+@@ -185,7 +185,9 @@ static void updateRuntimeLibraryPaths(SearchPathOptions &SearchPathOpts,
+       RuntimeLibraryImportPaths.push_back(std::string(LibPath.str()));
+     }
+ 
+-    LibPath = SearchPathOpts.getSDKPath();
++    auto SDKPath = SearchPathOpts.getSDKPath();
++    if (!SDKPath.startswith("@storeDir@")) {
++    LibPath = SDKPath;
+     llvm::sys::path::append(LibPath, "usr", "lib", "swift");
+     if (!Triple.isOSDarwin()) {
+       // Use the non-architecture suffixed form with directory-layout
+@@ -200,6 +202,7 @@ static void updateRuntimeLibraryPaths(SearchPathOptions &SearchPathOpts,
+       llvm::sys::path::append(LibPath, swift::getMajorArchitectureName(Triple));
+     }
+     RuntimeLibraryImportPaths.push_back(std::string(LibPath.str()));
++    }
+   }
+   SearchPathOpts.setRuntimeLibraryImportPaths(RuntimeLibraryImportPaths);
+ }
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-separate-lib.patch b/pkgs/development/compilers/swift/compiler/patches/swift-separate-lib.patch
new file mode 100644
index 0000000000000..20d81a6e8296c
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-separate-lib.patch
@@ -0,0 +1,26 @@
+Patch paths to use the separate 'lib' output. One of the things this patch
+fixes is the output of `swift -frontend -print-target-info`, which swiftpm uses
+to set rpath on Linux.
+
+The check if the executable path starts with 'out' is necessary for
+bootstrapping, or the compiler will fail when run from the build directory.
+
+--- a/lib/Frontend/CompilerInvocation.cpp
++++ b/lib/Frontend/CompilerInvocation.cpp
+@@ -49,11 +49,16 @@ swift::CompilerInvocation::CompilerInvocation() {
+ void CompilerInvocation::computeRuntimeResourcePathFromExecutablePath(
+     StringRef mainExecutablePath, bool shared,
+     llvm::SmallVectorImpl<char> &runtimeResourcePath) {
++  if (mainExecutablePath.startswith("@storeDir@")) {
++    auto libPath = StringRef("@lib@");
++    runtimeResourcePath.append(libPath.begin(), libPath.end());
++  } else {
+   runtimeResourcePath.append(mainExecutablePath.begin(),
+                              mainExecutablePath.end());
+ 
+   llvm::sys::path::remove_filename(runtimeResourcePath); // Remove /swift
+   llvm::sys::path::remove_filename(runtimeResourcePath); // Remove /bin
++  }
+   appendSwiftLibDir(runtimeResourcePath, shared);
+ }
+ 
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-wrap.patch b/pkgs/development/compilers/swift/compiler/patches/swift-wrap.patch
new file mode 100644
index 0000000000000..e4697f631e708
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-wrap.patch
@@ -0,0 +1,46 @@
+Wrap the swift compiler produced during the build
+
+--- a/tools/driver/CMakeLists.txt
++++ b/tools/driver/CMakeLists.txt
+@@ -16,6 +16,13 @@ if(${LIBSWIFT_BUILD_MODE} MATCHES "BOOTSTRAPPING.*")
+                           swiftDriverTool
+                           libswiftStub)
+ 
++  # Nix: wrap the swift build.
++  add_custom_command(
++    TARGET swift-frontend-bootstrapping0 POST_BUILD
++    COMMAND nix-swift-make-swift-wrapper $<TARGET_FILE:swift-frontend-bootstrapping0>
++    VERBATIM
++  )
++
+   swift_create_post_build_symlink(swift-frontend-bootstrapping0
+     SOURCE "swift-frontend${CMAKE_EXECUTABLE_SUFFIX}"
+     DESTINATION "swiftc${CMAKE_EXECUTABLE_SUFFIX}"
+@@ -34,6 +41,13 @@ if(${LIBSWIFT_BUILD_MODE} MATCHES "BOOTSTRAPPING.*")
+                           swiftDriverTool
+                           libswift-bootstrapping1)
+ 
++  # Nix: wrap the swift build.
++  add_custom_command(
++    TARGET swift-frontend-bootstrapping1 POST_BUILD
++    COMMAND nix-swift-make-swift-wrapper $<TARGET_FILE:swift-frontend-bootstrapping1>
++    VERBATIM
++  )
++
+   swift_create_post_build_symlink(swift-frontend-bootstrapping1
+     SOURCE "swift-frontend${CMAKE_EXECUTABLE_SUFFIX}"
+     DESTINATION "swiftc${CMAKE_EXECUTABLE_SUFFIX}"
+@@ -50,6 +64,13 @@ target_link_libraries(swift-frontend
+                         swiftDriverTool
+                         libswift)
+ 
++# Nix: wrap the swift build.
++add_custom_command(
++  TARGET swift-frontend POST_BUILD
++  COMMAND nix-swift-make-swift-wrapper $<TARGET_FILE:swift-frontend>
++  VERBATIM
++)
++
+ # Create a `swift-driver` executable adjacent to the `swift-frontend` executable
+ # to ensure that `swiftc` forwards to the standalone driver when invoked.
+ swift_create_early_driver_copies(swift-frontend)
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index 50bc73582f1ba..e8eb4d738ca93 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -1,475 +1,101 @@
-{ lib, stdenv
-, cmake
-, coreutils
-, glibc
-, gccForLibs
-, which
-, perl
-, libedit
-, ninja
-, pkg-config
-, sqlite
-, libxml2
-, clang_13
-, python3
-, ncurses
-, libuuid
-, libxcrypt
-, icu
-, libgcc
-, libblocksruntime
-, curl
-, rsync
-, git
-, libgit2
-, fetchFromGitHub
-, makeWrapper
-, gnumake
-, file
+{ lib
+, pkgs
+, newScope
+, darwin
+, llvmPackages_latest
+, overrideCC
 }:
 
 let
-  # The Swift toolchain script builds projects with separate repos. By convention, some of them share
-  # the same version with the main Swift compiler project per release. We fetch these with
-  # `fetchSwiftRelease`. The rest have their own versions locked to each Swift release, as defined in the
-  # Swift compiler repo:
-  #   utils/update_checkout/update_checkout-config.json.
-  #
-  # ... among projects listed in that file, we provide our own:
-  # - CMake
-  # - ninja
-  # - icu
-  #
-  # ... we'd like to include the following in the future:
-  # - stress-tester
-  # - integration-tests
+  self = rec {
 
-  versions = {
-    swift = "5.6.2";
-    yams = "4.0.2";
-    argumentParser = "1.0.3";
-    format = "release/5.6";
-    crypto = "1.1.5";
-    nio = "2.31.2";
-    nio-ssl = "2.15.0";
-  };
+    callPackage = newScope self;
 
-  fetchAppleRepo = { repo, rev, sha256 }:
-    fetchFromGitHub {
-      owner = "apple";
-      inherit repo rev sha256;
-      name = "${repo}-${rev}-src";
-    };
+    # Current versions of Swift on Darwin require macOS SDK 10.15 at least.
+    # Re-export this so we can rely on the minimum Swift SDK elsewhere.
+    apple_sdk = pkgs.darwin.apple_sdk_11_0;
 
-  fetchSwiftRelease = { repo, sha256, fetchSubmodules ? false }:
-    fetchFromGitHub {
-      owner = "apple";
-      inherit repo sha256 fetchSubmodules;
-      rev = "swift-${versions.swift}-RELEASE";
-      name = "${repo}-${versions.swift}-src";
-    };
+    # Our current Clang on Darwin is v11, but we need at least v12. The
+    # following applies the newer Clang with the same libc overrides as
+    # `apple_sdk.stdenv`.
+    #
+    # If 'latest' becomes an issue, recommend replacing it with v14, which is
+    # currently closest to the official Swift builds.
+    clang = if pkgs.stdenv.isDarwin
+      then
+        llvmPackages_latest.clang.override rec {
+          libc = apple_sdk.Libsystem;
+          bintools = pkgs.bintools.override { inherit libc; };
+        }
+      else
+        llvmPackages_latest.clang;
 
-  sources = {
-    # Projects that share `versions.swift` for each release.
-
-    swift = fetchSwiftRelease {
-      repo = "swift";
-      sha256 = "sha256-wiRXAXWEksJuy+YQQ+B7tzr2iLkSVkgV6o+wIz7yKJA=";
-    };
-    cmark = fetchSwiftRelease {
-      repo = "swift-cmark";
-      sha256 = "sha256-f0BoTs4HYdx/aJ9HIGCWMalhl8PvClWD6R4QK3qSgAw=";
-    };
-    llbuild = fetchSwiftRelease {
-      repo = "swift-llbuild";
-      sha256 = "sha256-SQ6V0zVshIYMjayx+ZpYuLijgQ89tqRnPlXBPf2FYqM=";
-    };
-    driver = fetchSwiftRelease {
-      repo = "swift-driver";
-      sha256 = "sha256-D5/C4Rbv5KIsKpy6YbuMxGIGaQkn80PD4Cp0l6bPKzY=";
-    };
-    toolsSupportCore = fetchSwiftRelease {
-      repo = "swift-tools-support-core";
-      sha256 = "sha256-FbtQCq1sSlzrskCrgzD4iYuo5eGaXrAUUxoNX/BiOfg=";
-    };
-    swiftpm = fetchSwiftRelease {
-      repo = "swift-package-manager";
-      sha256 = "sha256-esO4Swz3UYngbVgxoV+fkhSC0AU3IaxVjWkgK/s3x68=";
-    };
-    syntax = fetchSwiftRelease {
-      repo = "swift-syntax";
-      sha256 = "sha256-C9FPCtq49BvKXtTWWeReYWNrU70pHzT2DhAv3NiTbPU=";
-    };
-    corelibsXctest = fetchSwiftRelease {
-      repo = "swift-corelibs-xctest";
-      sha256 = "sha256-0hizfnKJaUUA+jXuXzXWk72FmlSyc+UGEf7BTLdJrx4=";
-    };
-    corelibsFoundation = fetchSwiftRelease {
-      repo = "swift-corelibs-foundation";
-      sha256 = "sha256-8sCL8Ia6yb6bRsJZ52gUJH0jN3lwClM573G8jgUdEhw=";
-    };
-    corelibsLibdispatch = fetchSwiftRelease {
-      repo = "swift-corelibs-libdispatch";
-      sha256 = "sha256-1tIskUMnfblnvZaFDQPUMBfWTmBYG98s7rEww7PwZO8=";
-      fetchSubmodules = true;
-    };
-    indexstoreDb = fetchSwiftRelease {
-      repo = "indexstore-db";
-      sha256 = "sha256-/PO4eMiASZN3pjFjBQ1r8vYwGRn6xm3SWaB2HDZlkPs=";
-    };
-    sourcekitLsp = fetchSwiftRelease {
-      repo = "sourcekit-lsp";
-      sha256 = "sha256-ttgUC4ZHD3P/xLHllEbACtHVrJ6HXqeVWccXcoPMkts=";
-    };
-    llvmProject = fetchSwiftRelease {
-      repo = "llvm-project";
-      sha256 = "sha256-YVs3lKV2RlaovpYkdGO+vzypolrmXmbKBBP4+osNMYw=";
-    };
-    docc = fetchSwiftRelease {
-      repo = "swift-docc";
-      sha256 = "sha256-rWiaNamZoHTO1bKpubxuT7m1IBOl7amT5M71mNauilY=";
-    };
-    docc-render-artifact = fetchSwiftRelease {
-      repo = "swift-docc-render-artifact";
-      sha256 = "sha256-AX+rtDLhq8drk7N6/hoH3fQioudmmTCnEhR45bME8uU=";
-    };
-    docc-symbolkit = fetchSwiftRelease {
-      repo = "swift-docc-symbolkit";
-      sha256 = "sha256-Xy1TQ5ucDW+MnkeOvVznsATBmwcQ3p1x+ofQ22ofk+o=";
-    };
-    lmdb = fetchSwiftRelease {
-      repo = "swift-lmdb";
-      sha256 = "sha256-i2GkWRWq1W5j8rF4PiHwWgT4Dur5FCY2o44HvUU3vtQ=";
-    };
-    markdown = fetchSwiftRelease {
-      repo = "swift-markdown";
-      sha256 = "sha256-XtFSBiNHhmULjS4OqSpMgUetLu3peRg7l6HpjwVsTj8=";
+    # Overrides that create a useful environment for swift packages, allowing
+    # packaging with `swiftPackages.callPackage`. These are similar to
+    # `apple_sdk_11_0.callPackage`, with our clang on top.
+    inherit (clang) bintools;
+    stdenv = overrideCC pkgs.stdenv clang;
+    darwin = pkgs.darwin.overrideScope (_: prev: {
+      inherit apple_sdk;
+      inherit (apple_sdk) Libsystem LibsystemCross libcharset libunwind objc4 configd IOKit Security;
+      CF = apple_sdk.CoreFoundation;
+    });
+    xcodebuild = pkgs.xcbuild.override {
+      inherit (apple_sdk.frameworks) CoreServices CoreGraphics ImageIO;
+      inherit stdenv;
+      sdkVer = "10.15";
     };
+    xcbuild = xcodebuild;
 
-    cmark-gfm = fetchAppleRepo {
-      repo = "swift-cmark";
-      rev = "swift-${versions.swift}-RELEASE-gfm";
-      sha256 = "sha256-g28iKmMR2W0r1urf8Fk1HBxAp5OlonNYSVN3Ril66tQ=";
+    swift-unwrapped = callPackage ./compiler {
+      inherit (darwin) DarwinTools cctools sigtool;
+      inherit (apple_sdk) MacOSX-SDK CLTools_Executables;
+      inherit (apple_sdk.frameworks) CoreServices Foundation Combine;
     };
 
-    # Projects that have their own versions during each release
-
-    argumentParser = fetchAppleRepo {
-      repo = "swift-argument-parser";
-      rev = "${versions.argumentParser}";
-      sha256 = "sha256-vNqkuAwSZNCWvwe6E5BqbXQdIbmIia0dENmmSQ9P8Mo=";
-    };
-    format = fetchAppleRepo {
-      repo = "swift-format";
-      rev = "${versions.format}";
-      sha256 = "sha256-1f5sIrv9IbPB7Vnahq1VwH8gT41dcjWldRwvVEaMdto=";
-    };
-    crypto = fetchAppleRepo {
-      repo = "swift-crypto";
-      rev = "${versions.crypto}";
-      sha256 = "sha256-jwxXQuOF+CnpLMwTZ2z52Fgx2b97yWzXiPTx0Ye8KCQ=";
+    swiftNoSwiftDriver = callPackage ./wrapper {
+      swift = swift-unwrapped;
+      useSwiftDriver = false;
     };
-    nio = fetchAppleRepo {
-      repo = "swift-nio";
-      rev = versions.nio;
-      sha256 = "sha256-FscOA/S7on31QCR/MZFjg4ZB3FGJ+rdptZ6MRZJXexE=";
-    };
-    nio-ssl = fetchAppleRepo {
-      repo = "swift-nio-ssl";
-      rev = versions.nio-ssl;
-      sha256 = "sha256-5QGkmkCOXhG3uOdf0bd3Fo1MFekB8/WcveBXGhtVZKo=";
-    };
-    yams = fetchFromGitHub {
-      owner = "jpsim";
-      repo = "Yams";
-      rev = versions.yams;
-      sha256 = "sha256-cTkCAwxxLc35laOon1ZXXV8eAxX02oDolJyPauhZado=";
-      name = "Yams-${versions.yams}-src";
-    };
-  };
-
-  devInputs = [
-    curl
-    glibc
-    icu
-    libblocksruntime
-    libedit
-    libgcc
-    libuuid
-    libxcrypt
-    libxml2
-    ncurses
-    sqlite
-  ];
-
-  python = (python3.withPackages (ps: [ps.six]));
-
-  cmakeFlags = [
-    "-DGLIBC_INCLUDE_PATH=${stdenv.cc.libc.dev}/include"
-    "-DC_INCLUDE_DIRS=${lib.makeSearchPathOutput "dev" "include" devInputs}:${libxml2.dev}/include/libxml2"
-    "-DGCC_INSTALL_PREFIX=${gccForLibs}"
-  ];
-
-in
-stdenv.mkDerivation {
-  pname = "swift";
-  version = versions.swift;
-
-  nativeBuildInputs = [
-    cmake
-    git
-    makeWrapper
-    ninja
-    perl
-    pkg-config
-    python
-    rsync
-    which
-  ];
-  buildInputs = devInputs ++ [
-    clang_13
-  ];
-
-  # TODO: Revisit what needs to be propagated and how.
-  propagatedBuildInputs = [
-    libgcc
-    libgit2
-    python
-  ];
-  propagatedUserEnvPkgs = [ git pkg-config ];
-
-  hardeningDisable = [ "format" ]; # for LLDB
-
-  unpackPhase = ''
-    mkdir src
-    cd src
-    export SWIFT_SOURCE_ROOT=$PWD
-
-    cp -r ${sources.swift} swift
-    cp -r ${sources.cmark} cmark
-    cp -r ${sources.llbuild} llbuild
-    cp -r ${sources.argumentParser} swift-argument-parser
-    cp -r ${sources.driver} swift-driver
-    cp -r ${sources.toolsSupportCore} swift-tools-support-core
-    cp -r ${sources.swiftpm} swiftpm
-    cp -r ${sources.syntax} swift-syntax
-    cp -r ${sources.corelibsXctest} swift-corelibs-xctest
-    cp -r ${sources.corelibsFoundation} swift-corelibs-foundation
-    cp -r ${sources.corelibsLibdispatch} swift-corelibs-libdispatch
-    cp -r ${sources.yams} yams
-    cp -r ${sources.indexstoreDb} indexstore-db
-    cp -r ${sources.sourcekitLsp} sourcekit-lsp
-    cp -r ${sources.format} swift-format
-    cp -r ${sources.crypto} swift-crypto
-    cp -r ${sources.llvmProject} llvm-project
-    cp -r ${sources.cmark-gfm} swift-cmark-gfm
-    cp -r ${sources.docc} swift-docc
-    cp -r ${sources.docc-render-artifact} swift-docc-render-artifact
-    cp -r ${sources.docc-symbolkit} swift-docc-symbolkit
-    cp -r ${sources.lmdb} swift-lmdb
-    cp -r ${sources.markdown} swift-markdown
-    cp -r ${sources.nio} swift-nio
-    cp -r ${sources.nio-ssl} swift-nio-ssl
 
-    chmod -R u+w .
-  '';
+    Dispatch = if stdenv.isDarwin
+      then null # part of libsystem
+      else callPackage ./libdispatch { swift = swiftNoSwiftDriver; };
 
-  patchPhase = ''
-    # Just patch all the things for now, we can focus this later.
-    patchShebangs $SWIFT_SOURCE_ROOT
+    Foundation = if stdenv.isDarwin
+      then apple_sdk.frameworks.Foundation
+      else callPackage ./foundation { swift = swiftNoSwiftDriver; };
 
-    # TODO: eliminate use of env.
-    find -type f -print0 | xargs -0 sed -i \
-      -e 's|/usr/bin/env|${coreutils}/bin/env|g' \
-      -e 's|/usr/bin/make|${gnumake}/bin/make|g' \
-      -e 's|/bin/mkdir|${coreutils}/bin/mkdir|g' \
-      -e 's|/bin/cp|${coreutils}/bin/cp|g' \
-      -e 's|/usr/bin/file|${file}/bin/file|g'
-
-    # Build configuration patches.
-    patch -p1 -d swift -i ${./patches/0001-build-presets-linux-don-t-require-using-Ninja.patch}
-    patch -p1 -d swift -i ${./patches/0002-build-presets-linux-allow-custom-install-prefix.patch}
-    patch -p1 -d swift -i ${./patches/0003-build-presets-linux-don-t-build-extra-libs.patch}
-    patch -p1 -d swift -i ${./patches/0004-build-presets-linux-plumb-extra-cmake-options.patch}
-    patch -p1 -d swift -i ${./patches/0007-build-presets-linux-os-stdlib.patch}
-    substituteInPlace swift/cmake/modules/SwiftConfigureSDK.cmake \
-      --replace '/usr/include' "${stdenv.cc.libc.dev}/include"
-    sed -i swift/utils/build-presets.ini \
-      -e 's/^test-installable-package$/# \0/' \
-      -e 's/^test$/# \0/' \
-      -e 's/^validation-test$/# \0/' \
-      -e 's/^long-test$/# \0/' \
-      -e 's/^stress-test$/# \0/' \
-      -e 's/^test-optimized$/# \0/' \
-      -e 's/^swift-install-components=autolink.*$/\0;editor-integration/'
-
-    # LLVM toolchain patches.
-    patch -p1 -d llvm-project/clang -i ${./patches/0005-clang-toolchain-dir.patch}
-    patch -p1 -d llvm-project/clang -i ${./patches/0006-clang-purity.patch}
-    substituteInPlace llvm-project/clang/lib/Driver/ToolChains/Linux.cpp \
-      --replace 'SysRoot + "/lib' '"${glibc}/lib" "' \
-      --replace 'SysRoot + "/usr/lib' '"${glibc}/lib" "' \
-      --replace 'LibDir = "lib";' 'LibDir = "${glibc}/lib";' \
-      --replace 'LibDir = "lib64";' 'LibDir = "${glibc}/lib";' \
-      --replace 'LibDir = X32 ? "libx32" : "lib64";' 'LibDir = "${glibc}/lib";'
-
-    # Substitute ncurses for curses in llbuild.
-    sed -i 's/curses/ncurses/' llbuild/*/*/CMakeLists.txt
-    sed -i 's/curses/ncurses/' llbuild/*/*/*/CMakeLists.txt
-
-    # uuid.h is not part of glibc, but of libuuid.
-    sed -i 's|''${GLIBC_INCLUDE_PATH}/uuid/uuid.h|${libuuid.dev}/include/uuid/uuid.h|' swift/stdlib/public/Platform/glibc.modulemap.gyb
-
-    # Support library build script patches.
-    PREFIX=''${out/#\/}
-    substituteInPlace swift/utils/swift_build_support/swift_build_support/products/benchmarks.py \
-      --replace \
-      "'--toolchain', toolchain_path," \
-      "'--toolchain', '/build/install/$PREFIX',"
-    substituteInPlace swift/benchmark/scripts/build_script_helper.py \
-      --replace \
-      "swiftbuild_path = os.path.join(args.toolchain, \"usr\", \"bin\", \"swift-build\")" \
-      "swiftbuild_path = os.path.join(args.toolchain, \"bin\", \"swift-build\")"
-    substituteInPlace swift-corelibs-xctest/build_script.py \
-      --replace usr "$PREFIX"
-
-    # Can be removed in later swift-docc versions, see
-    # https://github.com/apple/swift-docc/commit/bff70b847008f91ac729cfd299a85481eef3f581
-    substituteInPlace swift-docc/build-script-helper.py \
-      --replace \
-      "subprocess.check_output(cmd, env=env).strip(), 'docc')" \
-      "subprocess.check_output(cmd, env=env).strip().decode(), 'docc')"
-
-    # Can be removed in later Swift versions, see
-    # https://github.com/apple/swift/pull/58755
-    substituteInPlace swift/utils/process-stats-dir.py \
-      --replace \
-      "type=argparse.FileType('wb', 0)," \
-      "type=argparse.FileType('w', 0),"
-
-    # Apply Python 3 fix, see
-    # https://github.com/apple/swift/commit/ec6bc595092974628b27b114a472e84162261bbd
-    substituteInPlace swift/utils/swift_build_support/swift_build_support/productpipeline_list_builder.py \
-      --replace \
-      "filter(lambda x: x is not None, pipeline)" \
-      "[p for p in pipeline if p is not None]"
-  '';
-
-  configurePhase = ''
-    cd ..
-
-    mkdir build install
-    export SWIFT_BUILD_ROOT=$PWD/build
-    export SWIFT_INSTALL_DIR=$PWD/install
-
-    export INSTALLABLE_PACKAGE=$PWD/swift.tar.gz
-    export NIX_ENFORCE_PURITY=
-
-    cd $SWIFT_BUILD_ROOT
-  '';
-
-  buildPhase = ''
-    # Explicitly include C++ headers to prevent errors where stdlib.h is not found from cstdlib.
-    export NIX_CFLAGS_COMPILE="$(< ${clang_13}/nix-support/libcxx-cxxflags) $NIX_CFLAGS_COMPILE"
-
-    # During the Swift build, a full local LLVM build is performed and the resulting clang is
-    # invoked. This compiler is not using the Nix wrappers, so it needs some help to find things.
-    export NIX_LDFLAGS_BEFORE="-rpath ${gccForLibs.lib}/lib -L${gccForLibs.lib}/lib $NIX_LDFLAGS_BEFORE"
-
-    # However, we want to use the wrapped compiler whenever possible.
-    export CC="${clang_13}/bin/clang"
-
-    $SWIFT_SOURCE_ROOT/swift/utils/build-script \
-      --preset=buildbot_linux \
-      installable_package=$INSTALLABLE_PACKAGE \
-      install_prefix=$out \
-      install_destdir=$SWIFT_INSTALL_DIR \
-      extra_cmake_options="${lib.concatStringsSep "," cmakeFlags}"
-  '';
-
-  doCheck = true;
-
-  nativeCheckInputs = [ file ];
-
-  checkPhase = ''
-    # Remove compiler build system tests which fail due to our modified default build profile and
-    # nixpkgs-provided version of CMake.
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/infer_implies_install_all.test
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/infer_dumps_deps_if_verbose_build.test
-
-    # This test apparently requires Python 2 (strings are assumed to be bytes-like), but the build
-    # process overall now otherwise requires Python 3 (which is what we have updated to). A fix PR
-    # has been submitted upstream.
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/SIL/verify_all_overlays.py
-
-    # TODO: consider fixing and re-adding. This test fails due to a non-standard "install_prefix".
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/Python/build_swift.swift
-
-    # We cannot handle the SDK location being in "Weird Location" due to Nix isolation.
-    rm $SWIFT_SOURCE_ROOT/swift/test/DebugInfo/compiler-flags.swift
-
-    # TODO: Fix issue with ld.gold invoked from script finding crtbeginS.o and crtendS.o.
-    rm $SWIFT_SOURCE_ROOT/swift/test/IRGen/ELF-remove-autolink-section.swift
-
-    # The following two tests fail because we use don't use the bundled libicu:
-    # [SOURCE_DIR/utils/build-script] ERROR: can't find source directory for libicu (tried /build/src/icu)
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/default_build_still_performs_epilogue_opts_after_split.test
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/test_early_swift_driver_and_infer.swift
-
-    # TODO: This test fails for some unknown reason
-    rm $SWIFT_SOURCE_ROOT/swift/test/Serialization/restrict-swiftmodule-to-revision.swift
-
-    # This test was flaky in ofborg, see #186476
-    rm $SWIFT_SOURCE_ROOT/swift/test/AutoDiff/compiler_crashers_fixed/sr14290-missing-debug-scopes-in-pullback-trampoline.swift
-
-    # TODO: consider using stress-tester and integration-test.
-
-    # Match the wrapped version of Swift to be installed.
-    export LIBRARY_PATH=${lib.makeLibraryPath [icu libgcc libuuid]}:$l
-
-    checkTarget=check-swift-all-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.cpu.name}
-    ninjaFlags='-C buildbot_linux/swift-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.cpu.name}'
-    ninjaCheckPhase
-  '';
-
-  installPhase = ''
-    mkdir -p $out
+    # TODO: Apple distributes a binary XCTest with Xcode, but it is not part of
+    # CLTools (or SUS), so would have to figure out how to fetch it. The binary
+    # version has several extra features, like a test runner and ObjC support.
+    XCTest = callPackage ./xctest {
+      inherit (darwin) DarwinTools;
+      swift = swiftNoSwiftDriver;
+    };
 
-    # Extract the generated tarball into the store.
-    tar xf $INSTALLABLE_PACKAGE -C $out --strip-components=3 ''${out/#\/}
-    find $out -type d -empty -delete
+    swiftpm = callPackage ./swiftpm {
+      inherit (darwin) DarwinTools cctools;
+      inherit (apple_sdk.frameworks) CryptoKit LocalAuthentication;
+      swift = swiftNoSwiftDriver;
+    };
 
-    # Fix installation weirdness, also present in Apple’s official tarballs.
-    mv $out/local/include/indexstore $out/include
-    rmdir $out/local/include $out/local
-    rm -r $out/bin/sdk-module-lists $out/bin/swift-api-checker.py
+    swift-driver = callPackage ./swift-driver {
+      swift = swiftNoSwiftDriver;
+    };
 
-    wrapProgram $out/bin/swift \
-      --set CC $out/bin/clang \
-      --suffix C_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix CPLUS_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix LIBRARY_PATH : ${lib.makeLibraryPath [icu libgcc libuuid]} \
-      --suffix PATH : ${lib.makeBinPath [ stdenv.cc.bintools ]}
+    swift = callPackage ./wrapper {
+      swift = swift-unwrapped;
+    };
 
-    wrapProgram $out/bin/swiftc \
-      --set CC $out/bin/clang \
-      --suffix C_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix CPLUS_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix LIBRARY_PATH : ${lib.makeLibraryPath [icu libgcc libuuid]} \
-      --suffix PATH : ${lib.makeBinPath [ stdenv.cc.bintools ]}
-  '';
+    sourcekit-lsp = callPackage ./sourcekit-lsp {
+      inherit (apple_sdk.frameworks) CryptoKit LocalAuthentication;
+    };
 
-  # Hack to avoid build and install directories in RPATHs.
-  preFixup = "rm -rf $SWIFT_BUILD_ROOT $SWIFT_INSTALL_DIR";
+    swift-docc = callPackage ./swift-docc {
+      inherit (apple_sdk.frameworks) CryptoKit LocalAuthentication;
+    };
 
-  meta = with lib; {
-    description = "The Swift Programming Language";
-    homepage = "https://github.com/apple/swift";
-    maintainers = with maintainers; [ dtzWill trepetti dduan trundle ];
-    license = licenses.asl20;
-    # Swift doesn't support 32-bit Linux, unknown on other platforms.
-    platforms = platforms.linux;
-    badPlatforms = platforms.i686;
-    timeout = 86400; # 24 hours.
   };
-}
+
+in self
diff --git a/pkgs/development/compilers/swift/foundation/default.nix b/pkgs/development/compilers/swift/foundation/default.nix
new file mode 100644
index 0000000000000..efb35bd74c9fe
--- /dev/null
+++ b/pkgs/development/compilers/swift/foundation/default.nix
@@ -0,0 +1,61 @@
+# TODO: We already package the CoreFoundation component of Foundation in:
+#   pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+# This is separate because the CF build is completely different and part of
+# stdenv. Merging the two was kept outside of the scope of Swift work.
+
+{ lib
+, stdenv
+, callPackage
+, cmake
+, ninja
+, swift
+, Dispatch
+, icu
+, libxml2
+, curl
+}:
+
+let
+  sources = callPackage ../sources.nix { };
+in stdenv.mkDerivation {
+  pname = "swift-corelibs-foundation";
+
+  inherit (sources) version;
+  src = sources.swift-corelibs-foundation;
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ cmake ninja swift ];
+  buildInputs = [ icu libxml2 curl ];
+  propagatedBuildInputs = [ Dispatch ];
+
+  preConfigure = ''
+    # Fails to build with -D_FORTIFY_SOURCE.
+    NIX_HARDENING_ENABLE=''${NIX_HARDENING_ENABLE/fortify/}
+  '';
+
+  postInstall = ''
+    # Split up the output.
+    mkdir $dev
+    mv $out/lib/swift/${swift.swiftOs} $out/swiftlibs
+    mv $out/lib/swift $dev/include
+    mkdir $out/lib/swift
+    mv $out/swiftlibs $out/lib/swift/${swift.swiftOs}
+
+    # Provide a CMake module. This is primarily used to glue together parts of
+    # the Swift toolchain. Modifying the CMake config to do this for us is
+    # otherwise more trouble.
+    mkdir -p $dev/lib/cmake/Foundation
+    export dylibExt="${stdenv.hostPlatform.extensions.sharedLibrary}"
+    export swiftOs="${swift.swiftOs}"
+    substituteAll ${./glue.cmake} $dev/lib/cmake/Foundation/FoundationConfig.cmake
+  '';
+
+  meta = {
+    description = "Core utilities, internationalization, and OS independence for Swift";
+    homepage = "https://github.com/apple/swift-corelibs-foundation";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/foundation/glue.cmake b/pkgs/development/compilers/swift/foundation/glue.cmake
new file mode 100644
index 0000000000000..a34984d19f047
--- /dev/null
+++ b/pkgs/development/compilers/swift/foundation/glue.cmake
@@ -0,0 +1,8 @@
+add_library(Foundation SHARED IMPORTED)
+set_property(TARGET Foundation PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libFoundation@dylibExt@")
+
+add_library(FoundationNetworking SHARED IMPORTED)
+set_property(TARGET FoundationNetworking PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libFoundationNetworking@dylibExt@")
+
+add_library(FoundationXML SHARED IMPORTED)
+set_property(TARGET FoundationXML PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libFoundationXML@dylibExt@")
diff --git a/pkgs/development/compilers/swift/libdispatch/default.nix b/pkgs/development/compilers/swift/libdispatch/default.nix
new file mode 100644
index 0000000000000..4a0616ded5ac5
--- /dev/null
+++ b/pkgs/development/compilers/swift/libdispatch/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, callPackage
+, cmake
+, ninja
+, useSwift ? true, swift
+}:
+
+let
+  sources = callPackage ../sources.nix { };
+in stdenv.mkDerivation {
+  pname = "swift-corelibs-libdispatch";
+
+  inherit (sources) version;
+  src = sources.swift-corelibs-libdispatch;
+
+  outputs = [ "out" "dev" "man" ];
+
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optionals useSwift [ ninja swift ];
+
+  patches = [ ./disable-swift-overlay.patch ];
+
+  cmakeFlags = lib.optional useSwift "-DENABLE_SWIFT=ON";
+
+  postInstall = ''
+    # Provide a CMake module. This is primarily used to glue together parts of
+    # the Swift toolchain. Modifying the CMake config to do this for us is
+    # otherwise more trouble.
+    mkdir -p $dev/lib/cmake/dispatch
+    export dylibExt="${stdenv.hostPlatform.extensions.sharedLibrary}"
+    substituteAll ${./glue.cmake} $dev/lib/cmake/dispatch/dispatchConfig.cmake
+  '';
+
+  meta = {
+    description = "Grand Central Dispatch";
+    homepage = "https://github.com/apple/swift-corelibs-libdispatch";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ cmm dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/libdispatch/disable-swift-overlay.patch b/pkgs/development/compilers/swift/libdispatch/disable-swift-overlay.patch
new file mode 100644
index 0000000000000..0ea1869d5528d
--- /dev/null
+++ b/pkgs/development/compilers/swift/libdispatch/disable-swift-overlay.patch
@@ -0,0 +1,35 @@
+Enabling Swift support is normally intended for building an overlay for a
+Swift SDK, which changes the installation layout. Prevent this.
+
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -287,7 +287,7 @@ configure_file("${PROJECT_SOURCE_DIR}/cmake/config.h.in"
+ add_compile_definitions($<$<OR:$<COMPILE_LANGUAGE:C>,$<COMPILE_LANGUAGE:CXX>>:HAVE_CONFIG_H>)
+ 
+ 
+-if(ENABLE_SWIFT)
++if(0)
+   set(INSTALL_TARGET_DIR "${CMAKE_INSTALL_LIBDIR}/swift$<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:_static>/$<LOWER_CASE:${CMAKE_SYSTEM_NAME}>" CACHE PATH "Path where the libraries will be installed")
+   set(INSTALL_DISPATCH_HEADERS_DIR "${CMAKE_INSTALL_LIBDIR}/swift$<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:_static>/dispatch" CACHE PATH "Path where the headers will be installed for libdispatch")
+   set(INSTALL_BLOCK_HEADERS_DIR "${CMAKE_INSTALL_LIBDIR}/swift$<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:_static>/Block" CACHE PATH "Path where the headers will be installed for the blocks runtime")
+--- a/man/CMakeLists.txt
++++ b/man/CMakeLists.txt
+@@ -1,6 +1,6 @@
+ 
+ # TODO(compnerd) add symlinks
+-if(NOT ENABLE_SWIFT)
++if(1)
+   install(FILES
+             dispatch.3
+             dispatch_after.3
+--- a/src/swift/CMakeLists.txt
++++ b/src/swift/CMakeLists.txt
+@@ -47,7 +47,7 @@ get_swift_host_arch(swift_arch)
+ install(FILES
+   ${CMAKE_CURRENT_BINARY_DIR}/swift/Dispatch.swiftmodule
+   ${CMAKE_CURRENT_BINARY_DIR}/swift/Dispatch.swiftdoc
+-  DESTINATION ${INSTALL_TARGET_DIR}/${swift_arch})
++  DESTINATION ${INSTALL_TARGET_DIR}/swift)
+ set_property(GLOBAL APPEND PROPERTY DISPATCH_EXPORTS swiftDispatch)
+ install(TARGETS swiftDispatch
+   EXPORT dispatchExports
diff --git a/pkgs/development/compilers/swift/libdispatch/glue.cmake b/pkgs/development/compilers/swift/libdispatch/glue.cmake
new file mode 100644
index 0000000000000..dd696dc61085f
--- /dev/null
+++ b/pkgs/development/compilers/swift/libdispatch/glue.cmake
@@ -0,0 +1,5 @@
+add_library(dispatch SHARED IMPORTED)
+set_property(TARGET dispatch PROPERTY IMPORTED_LOCATION "@out@/lib/libdispatch@dylibExt@")
+
+add_library(swiftDispatch SHARED IMPORTED)
+set_property(TARGET swiftDispatch PROPERTY IMPORTED_LOCATION "@out@/lib/libswiftDispatch@dylibExt@")
diff --git a/pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch b/pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch
deleted file mode 100644
index 6c42921cd2338..0000000000000
--- a/pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Don't build Ninja, we use our own.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -779,7 +779,7 @@ swiftpm
-
- dash-dash
-
--build-ninja
-+# build-ninja
- install-llvm
- install-swift
- install-lldb
diff --git a/pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch b/pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch
deleted file mode 100644
index 0b4c2cc55c4fe..0000000000000
--- a/pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Use custom install prefix.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -788,7 +788,7 @@
- install-swiftpm
- install-xctest
- install-libicu
--install-prefix=/usr
-+install-prefix=%(install_prefix)s
- install-libcxx
- install-sourcekit-lsp
- build-swift-static-stdlib
diff --git a/pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch b/pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch
deleted file mode 100644
index eb522ac96f7e9..0000000000000
--- a/pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-Disable targets, where we use Nix packages.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -818,8 +818,6 @@
- swiftpm
- swift-driver
- xctest
--libicu
--libcxx
- swiftdocc
- 
- # build-ninja
-@@ -830,9 +828,7 @@
- install-swiftpm
- install-swift-driver
- install-xctest
--install-libicu
- install-prefix=%(install_prefix)s
--install-libcxx
- install-sourcekit-lsp
- install-swiftdocc
- build-swift-static-stdlib
diff --git a/pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch b/pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch
deleted file mode 100644
index 3cacdfc0c55e7..0000000000000
--- a/pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Plumb extra-cmake-options.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -812,6 +812,8 @@
- # Path to the .tar.gz package we would create.
- installable-package=%(installable_package)s
-
-+extra-cmake-options=%(extra_cmake_options)s
-+
- [preset: buildbot_linux]
- mixin-preset=mixin_linux_installation
- build-subdir=buildbot_linux
diff --git a/pkgs/development/compilers/swift/patches/0006-clang-purity.patch b/pkgs/development/compilers/swift/patches/0006-clang-purity.patch
deleted file mode 100644
index 928c1db6dee87..0000000000000
--- a/pkgs/development/compilers/swift/patches/0006-clang-purity.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-Apply the "purity" patch (updated for 5.4.2).
-
---- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -488,11 +488,5 @@
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
--
--    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE) {
--      CmdArgs.push_back("-dynamic-linker");
--      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
--                                           ToolChain.getDynamicLinker(Args)));
--    }
-   }
-
-   CmdArgs.push_back("-o");
diff --git a/pkgs/development/compilers/swift/patches/0007-build-presets-linux-os-stdlib.patch b/pkgs/development/compilers/swift/patches/0007-build-presets-linux-os-stdlib.patch
deleted file mode 100644
index 46da01635540e..0000000000000
--- a/pkgs/development/compilers/swift/patches/0007-build-presets-linux-os-stdlib.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Use os-stdlib in tests.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -872,7 +872,7 @@
- indexstore-db
- sourcekit-lsp
- swiftdocc
--lit-args=-v --time-tests
-+lit-args=-v --time-tests --param use_os_stdlib
- 
- # rdar://problem/31454823
- lldb-test-swift-only
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
new file mode 100644
index 0000000000000..deb82de20add2
--- /dev/null
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, callPackage
+, swift
+, swiftpm
+, swiftpm2nix
+, Foundation
+, XCTest
+, sqlite
+, ncurses
+, CryptoKit
+, LocalAuthentication
+}:
+let
+  sources = callPackage ../sources.nix { };
+  generated = swiftpm2nix.helpers ./generated;
+
+  # On Darwin, we only want ncurses in the linker search path, because headers
+  # are part of libsystem. Adding its headers to the search path causes strange
+  # mixing and errors.
+  # TODO: Find a better way to prevent this conflict.
+  ncursesInput = if stdenv.isDarwin then ncurses.out else ncurses;
+in
+stdenv.mkDerivation {
+  pname = "sourcekit-lsp";
+
+  inherit (sources) version;
+  src = sources.sourcekit-lsp;
+
+  nativeBuildInputs = [ swift swiftpm ];
+  buildInputs = [
+    Foundation
+    XCTest
+    sqlite
+    ncursesInput
+  ]
+    ++ lib.optionals stdenv.isDarwin [ CryptoKit LocalAuthentication ];
+
+  configurePhase = generated.configure + ''
+    swiftpmMakeMutable indexstore-db
+    patch -p1 -d .build/checkouts/indexstore-db -i ${./patches/indexstore-db-macos-target.patch}
+
+    # This toggles a section specific to Xcode XCTest, which doesn't work on
+    # Darwin, where we also use swift-corelibs-xctest.
+    substituteInPlace Sources/LSPTestSupport/PerfTestCase.swift \
+      --replace '#if os(macOS)' '#if false'
+
+    # Required to link with swift-corelibs-xctest on Darwin.
+    export SWIFTTSC_MACOS_DEPLOYMENT_TARGET=10.12
+  '';
+
+  # TODO: BuildServerBuildSystemTests fails
+  #doCheck = true;
+
+  installPhase = ''
+    binPath="$(swiftpmBinPath)"
+    mkdir -p $out/bin
+    cp $binPath/sourcekit-lsp $out/bin/
+  '';
+
+  # Canary to verify output of our Swift toolchain does not depend on the Swift
+  # compiler itself. (Only its 'lib' output.)
+  disallowedRequisites = [ swift.swift ];
+
+  meta = {
+    description = "Language Server Protocol implementation for Swift and C-based languages";
+    homepage = "https://github.com/apple/sourcekit-lsp";
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/generated/default.nix b/pkgs/development/compilers/swift/sourcekit-lsp/generated/default.nix
new file mode 100644
index 0000000000000..2c822a2ead372
--- /dev/null
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/generated/default.nix
@@ -0,0 +1,16 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "indexstore-db" = "005vvkrncgpryzrn0hzgsapflpyga0n7152b2b565wislpx90cwl";
+    "swift-argument-parser" = "1jph9w7lk9nr20fsv2c8p4hisx3dda817fh7pybd0r0j1jwa9nmw";
+    "swift-collections" = "0l0pv16zil3n7fac7mdf5qxklxr5rwiig5bixgca1ybq7arlnv7i";
+    "swift-crypto" = "020b8q4ss2k7a65r5dgh59z40i6sn7ij1allxkh8c8a9d0jzn313";
+    "swift-driver" = "0nblvs47kh2hl1l70rmrbablx4m5i27w8l3dfrv2h7zccqr8jl0a";
+    "swift-llbuild" = "1bvqbj8ji72ilh3ah2mw411jwzbbjxjyasa6sg4b8da0kqia4021";
+    "swift-package-manager" = "16qvk14f1l0hf5bphx6qk51nn9d36a2iw5v3sgkvmqi8h7l4kqg5";
+    "swift-system" = "0402hkx2q2dv27gccnn8ma79ngvwiwzkhcv4zlcdldmy6cgi0px7";
+    "swift-tools-support-core" = "1ryd5iyx5mfv8bhyq3bf08z7nv886chzzqnmwaj16r2cry9yml7c";
+    "Yams" = "11abhcfkmqm3cmh7vp7rqzvxd1zj02j2866a2pp6v9m89456xb76";
+  };
+}
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/generated/workspace-state.json b/pkgs/development/compilers/swift/sourcekit-lsp/generated/workspace-state.json
new file mode 100644
index 0000000000000..4e8625ed0d6a3
--- /dev/null
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/generated/workspace-state.json
@@ -0,0 +1,178 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "indexstore-db",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/indexstore-db.git",
+          "name": "IndexStoreDB"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "2ff1c0491248cd958a2ac05da9aa613eb27a8eeb"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "indexstore-db"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser.git",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e394bf350e38cb100b6bc4172834770ede1b7232",
+            "version": "1.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-collections",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-collections.git",
+          "name": "swift-collections"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "f504716c27d2e5d4144fa4794b12129301d17729",
+            "version": "1.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-collections"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-crypto",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-crypto.git",
+          "name": "swift-crypto"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "ddb07e896a2a8af79512543b1c7eb9797f8898a5",
+            "version": "1.1.7"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-crypto"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-driver",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-driver.git",
+          "name": "swift-driver"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "6c71f58f89d65eb79f1f6b32a707ddc39cec5ad6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-driver"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-llbuild",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-llbuild.git",
+          "name": "llbuild"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "d99c31577c60a247b065d29289a44fbdd141e2be"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-llbuild"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-package-manager",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-package-manager.git",
+          "name": "SwiftPM"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "f04ad469a6053d713c2fb854fbeb27ee3e6c9dee"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-package-manager"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-system",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-system.git",
+          "name": "swift-system"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "836bc4557b74fe6d2660218d56e3ce96aff76574",
+            "version": "1.1.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-system"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-tools-support-core",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-tools-support-core.git",
+          "name": "swift-tools-support-core"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "0220fc394f2ae820eeacd754fb2c7ce211e9979e"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-tools-support-core"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "yams",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/jpsim/Yams.git",
+          "name": "Yams"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "01835dc202670b5bb90d07f3eae41867e9ed29f6",
+            "version": "5.0.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Yams"
+      }
+    ]
+  },
+  "version": 5
+}
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/patches/indexstore-db-macos-target.patch b/pkgs/development/compilers/swift/sourcekit-lsp/patches/indexstore-db-macos-target.patch
new file mode 100644
index 0000000000000..53e790874d5d2
--- /dev/null
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/patches/indexstore-db-macos-target.patch
@@ -0,0 +1,12 @@
+Raise the deployment target of IndexStoreDB so it can link against our XCTest.
+
+--- a/Package.swift
++++ b/Package.swift
+@@ -4,6 +4,7 @@ import PackageDescription
+
+ let package = Package(
+   name: "IndexStoreDB",
++  platforms: [.macOS("10.12")],
+   products: [
+     .library(
+       name: "IndexStoreDB",
diff --git a/pkgs/development/compilers/swift/sources.nix b/pkgs/development/compilers/swift/sources.nix
new file mode 100644
index 0000000000000..9c28c683406e7
--- /dev/null
+++ b/pkgs/development/compilers/swift/sources.nix
@@ -0,0 +1,33 @@
+{ lib, fetchFromGitHub }:
+
+let
+
+  # These packages are all part of the Swift toolchain, and have a single
+  # upstream version that should match. We also list the hashes here so a basic
+  # version upgrade touches only this file.
+  version = "5.7";
+  hashes = {
+    llvm-project = "sha256-uW6dEAFaDOlHXnq8lFYxrKNLRPEukauZJxX4UCpWpIY=";
+    sourcekit-lsp = "sha256-uA3a+kAqI+XFzkDFEJ8XuRTgfYqacEuTsOU289Im+0Y=";
+    swift = "sha256-n8WVQYinAyIj4wmQnDhvPsH+t8ydANkGbjFJ6blfHOY=";
+    swift-cmark = "sha256-f0BoTs4HYdx/aJ9HIGCWMalhl8PvClWD6R4QK3qSgAw=";
+    swift-corelibs-foundation = "sha256-6XUSC6759dcG24YapWicjRzUnmVVe0QPSsLEw4sQNjI=";
+    swift-corelibs-libdispatch = "sha256-1qbXiC1k9+T+L6liqXKg6EZXqem6KEEx8OctuL4Kb2o=";
+    swift-corelibs-xctest = "sha256-qLUO9/3tkJWorDMEHgHd8VC3ovLLq/UWXJWMtb6CMN0=";
+    swift-docc = "sha256-WlXJMAnrlVPCM+iCIhG0Gyho76BsC2yVBEpX3m/WiIQ=";
+    swift-docc-render-artifact = "sha256-ttdurN/K7OX+I4577jG3YGeRs+GLUTc7BiiEZGmFD+s=";
+    swift-driver = "sha256-sk7XWXYR1MGPEeVxA6eA/vxhN6Gq16iD1RHpVstL3zE=";
+    swift-experimental-string-processing = "sha256-Ar9fQWi8bYSvGErrS0SWrxIxwEwCjsYIZcWweZ8bV28=";
+    swift-package-manager = "sha256-MZah+/XfeK46YamxwuE3Kiv+u5bj7VmjEh6ztDF+0j4=";
+  };
+
+  # Create fetch derivations.
+  sources = lib.mapAttrs (repo: hash: fetchFromGitHub {
+    owner = "apple";
+    inherit repo;
+    rev = "swift-${version}-RELEASE";
+    name = "${repo}-${version}-src";
+    hash = hashes.${repo};
+  }) hashes;
+
+in sources // { inherit version; }
diff --git a/pkgs/development/compilers/swift/swift-docc/default.nix b/pkgs/development/compilers/swift/swift-docc/default.nix
new file mode 100644
index 0000000000000..f85512f840711
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-docc/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, callPackage
+, swift
+, swiftpm
+, swiftpm2nix
+, Foundation
+, XCTest
+, CryptoKit
+, LocalAuthentication
+}:
+let
+  sources = callPackage ../sources.nix { };
+  generated = swiftpm2nix.helpers ./generated;
+in
+stdenv.mkDerivation {
+  pname = "swift-docc";
+
+  inherit (sources) version;
+  src = sources.swift-docc;
+  # TODO: We could build this from `apple/swift-docc-render` source, but that
+  # repository is not tagged.
+  renderArtifact = sources.swift-docc-render-artifact;
+
+  nativeBuildInputs = [ swift swiftpm ];
+  buildInputs = [ Foundation XCTest ]
+    ++ lib.optionals stdenv.isDarwin [ CryptoKit LocalAuthentication ];
+
+  configurePhase = generated.configure;
+
+  # TODO: Tests depend on indexstore-db being provided by an existing Swift
+  # toolchain. (ie. looks for `../lib/libIndexStore.so` relative to swiftc.
+  #doCheck = true;
+
+  installPhase = ''
+    binPath="$(swiftpmBinPath)"
+    mkdir -p $out/bin $out/share/docc
+    cp $binPath/docc $out/bin/
+    ln -s $renderArtifact/dist $out/share/docc/render
+  '';
+
+  # Canary to verify output of our Swift toolchain does not depend on the Swift
+  # compiler itself. (Only its 'lib' output.)
+  disallowedRequisites = [ swift.swift ];
+
+  meta = {
+    description = "Documentation compiler for Swift";
+    homepage = "https://github.com/apple/swift-docc";
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/swift-docc/generated/default.nix b/pkgs/development/compilers/swift/swift-docc/generated/default.nix
new file mode 100644
index 0000000000000..bcd873a44f89d
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-docc/generated/default.nix
@@ -0,0 +1,15 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "070gip241dgn3d0nxgwxva4vp6kbnf11g01q5yaq6kmflcmz58f2";
+    "swift-cmark" = "0xfchdgls3070z16in8ks69y8fpiajmyk7lmp5h7ym7164isa6bb";
+    "swift-crypto" = "0h054rq14jyg94aiymmp37vqz60a13dlczp5g09pln724j4ypv92";
+    "swift-docc-plugin" = "11d6nhi139yzk1lxxrixsbgyj1bnvmh40wj30y725q83nqq49ljh";
+    "swift-docc-symbolkit" = "14hb2wc09hisf2r2yny17z28z0m58cf4lnqaczad2x2hk4s1iayi";
+    "swift-lmdb" = "1m5y6x2vs1wflcv2c57rx87gh12sy0hkwy5iy9inxmda2mcs8qcb";
+    "swift-markdown" = "09270bfrwlp904cma29hsbhr1p25v8kwgvhcfi7lg2av7aaknd97";
+    "swift-nio" = "04bvay94b34ynmlvgyl9a7f431l3cf8k2zr483spv8mvyh1hxiqn";
+    "swift-nio-ssl" = "1ak4aldilmz0pnfgbwq1x4alr38nfyvx2pz7p2vi2plf82da80g5";
+  };
+}
diff --git a/pkgs/development/compilers/swift/swift-docc/generated/workspace-state.json b/pkgs/development/compilers/swift/swift-docc/generated/workspace-state.json
new file mode 100644
index 0000000000000..ced9a6df956c0
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-docc/generated/workspace-state.json
@@ -0,0 +1,161 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "d2930e8fcf9c33162b9fcc1d522bc975e2d4179b",
+            "version": "1.0.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-cmark",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-cmark.git",
+          "name": "cmark-gfm"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7-gfm",
+            "revision": "792c1c3326327515ce9bf64c44196b7f4daab9a6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-cmark"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-crypto",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-crypto.git",
+          "name": "swift-crypto"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "9680b7251cd2be22caaed8f1468bd9e8915a62fb",
+            "version": "1.1.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-crypto"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-docc-plugin",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-docc-plugin",
+          "name": "SwiftDocCPlugin"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "3303b164430d9a7055ba484c8ead67a52f7b74f6",
+            "version": "1.0.0"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-docc-plugin"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-docc-symbolkit",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-docc-symbolkit",
+          "name": "SymbolKit"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "8682202025906dce29a8b04f9263f40ba87b89d8"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-docc-symbolkit"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-lmdb",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-lmdb.git",
+          "name": "CLMDB"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "6ea45a7ebf6d8f72bd299dfcc3299e284bbb92ee"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-lmdb"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-markdown",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-markdown.git",
+          "name": "swift-markdown"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "d6cd065a7e4b6c3fad615dcd39890e095a2f63a2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-markdown"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-nio",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-nio.git",
+          "name": "swift-nio"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "1d425b0851ffa2695d488cce1d68df2539f42500",
+            "version": "2.31.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-nio"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-nio-ssl",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-nio-ssl.git",
+          "name": "swift-nio-ssl"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "2e74773972bd6254c41ceeda827f229bccbf1c0f",
+            "version": "2.15.0"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-nio-ssl"
+      }
+    ]
+  },
+  "version": 5
+}
diff --git a/pkgs/development/compilers/swift/swift-driver/default.nix b/pkgs/development/compilers/swift/swift-driver/default.nix
new file mode 100644
index 0000000000000..60fe2aeb9c92d
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, callPackage
+, fetchpatch
+, swift
+, swiftpm
+, swiftpm2nix
+, Foundation
+, XCTest
+, sqlite
+, ncurses
+, substituteAll
+}:
+let
+  sources = callPackage ../sources.nix { };
+  generated = swiftpm2nix.helpers ./generated;
+
+  # On Darwin, we only want ncurses in the linker search path, because headers
+  # are part of libsystem. Adding its headers to the search path causes strange
+  # mixing and errors.
+  # TODO: Find a better way to prevent this conflict.
+  ncursesInput = if stdenv.isDarwin then ncurses.out else ncurses;
+in
+stdenv.mkDerivation {
+  pname = "swift-driver";
+
+  inherit (sources) version;
+  src = sources.swift-driver;
+
+  nativeBuildInputs = [ swift swiftpm ];
+  buildInputs = [
+    Foundation
+    XCTest
+    sqlite
+    ncursesInput
+  ];
+
+  patches = [
+    ./patches/nix-resource-root.patch
+    ./patches/disable-catalyst.patch
+    ./patches/linux-fix-linking.patch
+    # TODO: Replace with branch patch once merged:
+    # https://github.com/apple/swift-driver/pull/1197
+    (fetchpatch {
+      url = "https://github.com/apple/swift-driver/commit/d3ef9cdf4871a58eddec7ff0e28fe611130da3f9.patch";
+      hash = "sha256-eVBaKN6uzj48ZnHtwGV0k5ChKjak1tDCyE+wTdyGq2c=";
+    })
+    # Prevent a warning about SDK directories we don't have.
+    (substituteAll {
+      src = ./patches/prevent-sdk-dirs-warnings.patch;
+      inherit (builtins) storeDir;
+    })
+  ];
+
+  configurePhase = generated.configure;
+
+  # TODO: Tests depend on indexstore-db being provided by an existing Swift
+  # toolchain. (ie. looks for `../lib/libIndexStore.so` relative to swiftc.
+  #doCheck = true;
+
+  # TODO: Darwin-specific installation includes more, but not sure why.
+  installPhase = ''
+    binPath="$(swiftpmBinPath)"
+    mkdir -p $out/bin
+    for executable in swift-driver swift-help swift-build-sdk-interfaces; do
+      cp $binPath/$executable $out/bin/
+    done
+  '';
+
+  meta = {
+    description = "Swift compiler driver";
+    homepage = "https://github.com/apple/swift-driver";
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/swift-driver/generated/default.nix b/pkgs/development/compilers/swift/swift-driver/generated/default.nix
new file mode 100644
index 0000000000000..c5ee8a8c90cb9
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/generated/default.nix
@@ -0,0 +1,11 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "11did5snqj8chcbdbiyx84mpif940ls2pr1iikwivvfp63i248hm";
+    "swift-llbuild" = "07zbp2dyfqd1bnyg7snpr9brn40jf22ivly5v10mql3hrg76a18h";
+    "swift-system" = "0402hkx2q2dv27gccnn8ma79ngvwiwzkhcv4zlcdldmy6cgi0px7";
+    "swift-tools-support-core" = "1vabl1z5sm2lrd75f5c781rkrq0liinpjvnrjr6i6r8cqrp0q5jb";
+    "Yams" = "1893y13sis2aimi1a5kgkczbf06z4yig054xb565yg2xm13srb45";
+  };
+}
diff --git a/pkgs/development/compilers/swift/swift-driver/generated/workspace-state.json b/pkgs/development/compilers/swift/swift-driver/generated/workspace-state.json
new file mode 100644
index 0000000000000..7671303387ec8
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/generated/workspace-state.json
@@ -0,0 +1,93 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser.git",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e1465042f195f374b94f915ba8ca49de24300a0d",
+            "version": "1.0.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-llbuild",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-llbuild.git",
+          "name": "llbuild"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "564424db5fdb62dcb5d863bdf7212500ef03a87b"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-llbuild"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-system",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-system.git",
+          "name": "swift-system"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "836bc4557b74fe6d2660218d56e3ce96aff76574",
+            "version": "1.1.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-system"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-tools-support-core",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-tools-support-core.git",
+          "name": "swift-tools-support-core"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "afc0938503bac012f76ceb619d031f63edc4c5f7"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-tools-support-core"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "yams",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/jpsim/Yams.git",
+          "name": "Yams"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "9ff1cc9327586db4e0c8f46f064b6a82ec1566fa",
+            "version": "4.0.6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Yams"
+      }
+    ]
+  },
+  "version": 5
+}
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/disable-catalyst.patch b/pkgs/development/compilers/swift/swift-driver/patches/disable-catalyst.patch
new file mode 100644
index 0000000000000..b9eb23f21061d
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/patches/disable-catalyst.patch
@@ -0,0 +1,17 @@
+Tries to parse SDKSettings.plist looking for a Catalyst version map, but we
+don't currently support this.
+
+--- a/Sources/SwiftDriver/Toolchains/DarwinToolchain.swift
++++ b/Sources/SwiftDriver/Toolchains/DarwinToolchain.swift
+@@ -297,11 +297,7 @@ public final class DarwinToolchain: Toolchain {
+                                                debugDescription: "Malformed version string")
+       }
+       self.version = version
+-      if self.canonicalName.hasPrefix("macosx") {
+-        self.versionMap = try keyedContainer.decode(VersionMap.self, forKey: .versionMap)
+-      } else {
+         self.versionMap = VersionMap()
+-      }
+     }
+ 
+ 
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch b/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch
new file mode 100644
index 0000000000000..c0cfe2b7d225d
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch
@@ -0,0 +1,40 @@
+--- a/Sources/SwiftDriver/Jobs/GenericUnixToolchain+LinkerSupport.swift
++++ b/Sources/SwiftDriver/Jobs/GenericUnixToolchain+LinkerSupport.swift
+@@ -9,6 +9,7 @@
+ // See https://swift.org/CONTRIBUTORS.txt for the list of Swift project authors
+ //
+ //===----------------------------------------------------------------------===//
++import Foundation
+ import TSCBasic
+ import SwiftOptions
+ 
+@@ -116,7 +117,20 @@ extension GenericUnixToolchain {
+       // just using `clang` and avoid a dependency on the C++ runtime.
+       let clangTool: Tool =
+         parsedOptions.hasArgument(.enableExperimentalCxxInterop) ? .clangxx : .clang
+-      var clangPath = try getToolPath(clangTool)
++
++      // For Nix, prefer linking using the wrapped system clang, instead of using
++      // the unwrapped clang packaged with swift. The latter is unable to link, but
++      // we still want to use it for other purposes (clang importer).
++      var clangPath: AbsolutePath
++      let env = ProcessInfo.processInfo.environment
++      if let nixCC = env["NIX_CC"],
++         let binPath = try? AbsolutePath(validating: "\(nixCC)/bin"),
++         let tool = lookupExecutablePath(filename: parsedOptions.hasArgument(.enableExperimentalCxxInterop)
++                                                        ? "clang++" : "clang",
++                                         searchPaths: [binPath]) {
++        clangPath = tool
++      } else {
++      clangPath = try getToolPath(clangTool)
+       if let toolsDirPath = parsedOptions.getLastArgument(.toolsDirectory) {
+         // FIXME: What if this isn't an absolute path?
+         let toolsDir = try AbsolutePath(validating: toolsDirPath.asSingle)
+@@ -132,6 +146,7 @@ extension GenericUnixToolchain {
+         commandLine.appendFlag("-B")
+         commandLine.appendPath(toolsDir)
+       }
++      } // nixCC
+ 
+       // Executables on Linux get -pie
+       if targetTriple.os == .linux && linkerOutputType == .executable {
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch b/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch
new file mode 100644
index 0000000000000..6c3ae87d68c98
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch
@@ -0,0 +1,28 @@
+Swift normally looks for the Clang resource dir in a subdir/symlink of its own
+resource dir. We provide a symlink to the Swift build-time Clang as a default
+there, but we also here patch a check to try locate it via NIX_CC.
+
+--- a/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
++++ b/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
+@@ -9,6 +9,7 @@
+ // See https://swift.org/CONTRIBUTORS.txt for the list of Swift project authors
+ //
+ //===----------------------------------------------------------------------===//
++import Foundation
+ import TSCBasic
+ import SwiftOptions
+ 
+@@ -24,6 +25,13 @@ extension Toolchain {
+     for targetInfo: FrontendTargetInfo,
+     parsedOptions: inout ParsedOptions
+   ) throws -> VirtualPath {
++    let env = ProcessInfo.processInfo.environment
++    if let nixCC = env["NIX_CC"] {
++      return try VirtualPath(path: nixCC)
++        .appending(components: "resource-root", "lib",
++                   targetInfo.target.triple.platformName(conflatingDarwin: true)!)
++    }
++
+     return VirtualPath.lookup(targetInfo.runtimeResourcePath.path)
+       .appending(components: "clang", "lib",
+                  targetInfo.target.triple.platformName(conflatingDarwin: true)!)
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/prevent-sdk-dirs-warnings.patch b/pkgs/development/compilers/swift/swift-driver/patches/prevent-sdk-dirs-warnings.patch
new file mode 100644
index 0000000000000..6080865ebe37a
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/patches/prevent-sdk-dirs-warnings.patch
@@ -0,0 +1,16 @@
+Prevents a user-visible warning on every compilation:
+
+  ld: warning: directory not found for option '-L.../MacOSX11.0.sdk/usr/lib/swift'
+
+--- a/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
++++ b/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
+@@ -50,7 +50,9 @@ extension Toolchain {
+         result.append(sdkPath.appending(components: "System", "iOSSupport", "usr", "lib", "swift"))
+       }
+ 
++      if sdkPath.absolutePath?.pathString.starts(with: "@storeDir@") == false {
+       result.append(sdkPath.appending(components: "usr", "lib", "swift"))
++      }
+     }
+ 
+     return result
diff --git a/pkgs/development/compilers/swift/swiftpm/cmake-glue.nix b/pkgs/development/compilers/swift/swiftpm/cmake-glue.nix
new file mode 100644
index 0000000000000..f297eafd389b1
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/cmake-glue.nix
@@ -0,0 +1,90 @@
+# SwiftPM dependencies are normally not installed using CMake, and only provide
+# CMake modules to link them together in a build tree. We have separate
+# derivations, so need a real install step. Here we provide our own minimal
+# CMake modules to install along with the build products.
+{ lib, stdenv, swift }:
+let
+
+  inherit (stdenv.hostPlatform) extensions;
+
+  # This file exports shell snippets for use in postInstall.
+  mkInstallScript = module: template: ''
+    mkdir -p $out/lib/cmake/${module}
+    (
+      export staticLibExt="${extensions.staticLibrary}"
+      export sharedLibExt="${extensions.sharedLibrary}"
+      export swiftOs="${swift.swiftOs}"
+      substituteAll \
+        ${builtins.toFile "${module}Config.cmake" template} \
+        $out/lib/cmake/${module}/${module}Config.cmake
+    )
+  '';
+
+in lib.mapAttrs mkInstallScript {
+  SwiftSystem = ''
+    add_library(SwiftSystem::SystemPackage STATIC IMPORTED)
+    set_property(TARGET SwiftSystem::SystemPackage PROPERTY IMPORTED_LOCATION "@out@/lib/swift_static/@swiftOs@/libSystemPackage@staticLibExt@")
+  '';
+
+  SwiftCollections = ''
+    add_library(SwiftCollections::Collections STATIC IMPORTED)
+    set_property(TARGET SwiftCollections::Collections PROPERTY IMPORTED_LOCATION "@out@/lib/swift_static/@swiftOs@/libCollections@staticLibExt@")
+
+    add_library(SwiftCollections::DequeModule STATIC IMPORTED)
+    set_property(TARGET SwiftCollections::DequeModule PROPERTY IMPORTED_LOCATION "@out@/lib/swift_static/@swiftOs@/libDequeModule@staticLibExt@")
+
+    add_library(SwiftCollections::OrderedCollections STATIC IMPORTED)
+    set_property(TARGET SwiftCollections::OrderedCollections PROPERTY IMPORTED_LOCATION "@out@/lib/swift_static/@swiftOs@/libOrderedCollections@staticLibExt@")
+  '';
+
+  TSC = ''
+    add_library(TSCLibc SHARED IMPORTED)
+    set_property(TARGET TSCLibc PROPERTY IMPORTED_LOCATION "@out@/lib/libTSCLibc@sharedLibExt@")
+
+    add_library(TSCBasic SHARED IMPORTED)
+    set_property(TARGET TSCBasic PROPERTY IMPORTED_LOCATION "@out@/lib/libTSCBasic@sharedLibExt@")
+
+    add_library(TSCUtility SHARED IMPORTED)
+    set_property(TARGET TSCUtility PROPERTY IMPORTED_LOCATION "@out@/lib/libTSCUtility@sharedLibExt@")
+  '';
+
+  ArgumentParser = ''
+    add_library(ArgumentParser SHARED IMPORTED)
+    set_property(TARGET ArgumentParser PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libArgumentParser@sharedLibExt@")
+
+    add_library(ArgumentParserToolInfo SHARED IMPORTED)
+    set_property(TARGET ArgumentParserToolInfo PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libArgumentParserToolInfo@sharedLibExt@")
+  '';
+
+  Yams = ''
+    add_library(CYaml SHARED IMPORTED)
+    set_property(TARGET CYaml PROPERTY IMPORTED_LOCATION "@out@/lib/libCYaml@sharedLibExt@")
+
+    add_library(Yams SHARED IMPORTED)
+    set_property(TARGET Yams PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libYams@sharedLibExt@")
+  '';
+
+  LLBuild = ''
+    add_library(libllbuild SHARED IMPORTED)
+    set_property(TARGET libllbuild PROPERTY IMPORTED_LOCATION "@out@/lib/libllbuild@sharedLibExt@")
+
+    add_library(llbuildSwift SHARED IMPORTED)
+    set_property(TARGET llbuildSwift PROPERTY IMPORTED_LOCATION "@out@/lib/swift/pm/llbuild/libllbuildSwift@sharedLibExt@")
+  '';
+
+  SwiftDriver = ''
+    add_library(SwiftDriver SHARED IMPORTED)
+    set_property(TARGET SwiftDriver PROPERTY IMPORTED_LOCATION "@out@/lib/libSwiftDriver@sharedLibExt@")
+
+    add_library(SwiftDriverExecution SHARED IMPORTED)
+    set_property(TARGET SwiftDriverExecution PROPERTY IMPORTED_LOCATION "@out@/lib/libSwiftDriverExecution@sharedLibExt@")
+
+    add_library(SwiftOptions SHARED IMPORTED)
+    set_property(TARGET SwiftOptions PROPERTY IMPORTED_LOCATION "@out@/lib/libSwiftOptions@sharedLibExt@")
+  '';
+
+  SwiftCrypto = ''
+    add_library(Crypto SHARED IMPORTED)
+    set_property(TARGET Crypto PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libCrypto@sharedLibExt@")
+  '';
+}
diff --git a/pkgs/development/compilers/swift/swiftpm/default.nix b/pkgs/development/compilers/swift/swiftpm/default.nix
new file mode 100644
index 0000000000000..67198a3c25844
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/default.nix
@@ -0,0 +1,418 @@
+{ lib
+, stdenv
+, callPackage
+, cmake
+, ninja
+, git
+, swift
+, swiftpm2nix
+, Foundation
+, XCTest
+, sqlite
+, ncurses
+, substituteAll
+, runCommandLocal
+, makeWrapper
+, DarwinTools # sw_vers
+, cctools # vtool
+, xcbuild
+, CryptoKit
+, LocalAuthentication
+}:
+
+let
+
+  inherit (swift) swiftOs swiftModuleSubdir swiftStaticModuleSubdir;
+  sharedLibraryExt = stdenv.hostPlatform.extensions.sharedLibrary;
+
+  sources = callPackage ../sources.nix { };
+  generated = swiftpm2nix.helpers ./generated;
+  cmakeGlue = callPackage ./cmake-glue.nix { };
+
+  # Common attributes for the bootstrap swiftpm and the final swiftpm.
+  commonAttrs = {
+    inherit (sources) version;
+    src = sources.swift-package-manager;
+    nativeBuildInputs = [ makeWrapper ];
+    # Required at run-time for the host platform to build package manifests.
+    propagatedBuildInputs = [ Foundation ];
+    patches = [
+      ./patches/cmake-disable-rpath.patch
+      ./patches/disable-sandbox.patch
+      ./patches/fix-clang-cxx.patch
+      (substituteAll {
+        src = ./patches/disable-xctest.patch;
+        inherit (builtins) storeDir;
+      })
+      (substituteAll {
+        src = ./patches/fix-stdlib-path.patch;
+        inherit (builtins) storeDir;
+        swiftLib = swift.swift.lib;
+      })
+    ];
+    postPatch = ''
+      # The location of xcrun is hardcoded. We need PATH lookup instead.
+      find Sources -name '*.swift' | xargs sed -i -e 's|/usr/bin/xcrun|xcrun|g'
+
+      # Patch the location where swiftpm looks for its API modules.
+      substituteInPlace Sources/PackageModel/UserToolchain.swift \
+        --replace \
+          'librariesPath = applicationPath.parentDirectory' \
+          "librariesPath = AbsolutePath(\"$out\")"
+    '';
+  };
+
+  # Tools invoked by swiftpm at run-time.
+  runtimeDeps = [ git ]
+    ++ lib.optionals stdenv.isDarwin [
+      xcbuild.xcrun
+      # vtool is used to determine a minimum deployment target. This is part of
+      # cctools, but adding that as a build input puts an unwrapped linker in
+      # PATH, and breaks builds. This small derivation exposes just vtool.
+      (runCommandLocal "vtool" { } ''
+        mkdir -p $out/bin
+        ln -s ${cctools}/bin/vtool $out/bin/vtool
+      '')
+    ];
+
+  # Common attributes for the bootstrap derivations.
+  mkBootstrapDerivation = attrs: stdenv.mkDerivation (attrs // {
+    nativeBuildInputs = (attrs.nativeBuildInputs or [ ])
+      ++ [ cmake ninja swift ]
+      ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
+
+    buildInputs = (attrs.buildInputs or [ ])
+      ++ [ Foundation ];
+
+    postPatch = (attrs.postPatch or "")
+      + lib.optionalString stdenv.isDarwin ''
+        # On Darwin only, Swift uses arm64 as cpu arch.
+        if [ -e cmake/modules/SwiftSupport.cmake ]; then
+          substituteInPlace cmake/modules/SwiftSupport.cmake \
+            --replace '"aarch64" PARENT_SCOPE' '"arm64" PARENT_SCOPE'
+        fi
+      '';
+
+    preConfigure = (attrs.preConfigure or "")
+      + ''
+        # Builds often don't set a target, and our default minimum macOS deployment
+        # target on x86_64-darwin is too low. Harmless on non-Darwin.
+        export MACOSX_DEPLOYMENT_TARGET=10.15.4
+      '';
+
+    postInstall = (attrs.postInstall or "")
+      + lib.optionalString stdenv.isDarwin ''
+        # The install name of libraries is incorrectly set to lib/ (via our
+        # CMake setup hook) instead of lib/swift/. This'd be easily fixed by
+        # fixDarwinDylibNames, but some builds create libraries that reference
+        # eachother, and we also have to fix those references.
+        dylibs="$(find $out/lib/swift* -name '*.dylib')"
+        changes=""
+        for dylib in $dylibs; do
+          changes+=" -change $(otool -D $dylib | tail -n 1) $dylib"
+        done
+        for dylib in $dylibs; do
+          install_name_tool -id $dylib $changes $dylib
+        done
+      '';
+
+    cmakeFlags = (attrs.cmakeFlags or [ ])
+      ++ [
+        # Some builds link to libraries within the same build. Make sure these
+        # create references to $out. None of our builds run their own products,
+        # so we don't have to account for that scenario.
+        "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
+      ];
+  });
+
+  # On Darwin, we only want ncurses in the linker search path, because headers
+  # are part of libsystem. Adding its headers to the search path causes strange
+  # mixing and errors.
+  # TODO: Find a better way to prevent this conflict.
+  ncursesInput = if stdenv.isDarwin then ncurses.out else ncurses;
+
+  # Derivations for bootstrapping dependencies using CMake.
+  # This is based on the `swiftpm/Utilities/bootstrap` script.
+  #
+  # Some of the installation steps here are a bit hacky, because it seems like
+  # these packages were not really meant to be installed using CMake. The
+  # regular swiftpm bootstrap simply refers to the source and build
+  # directories. The advantage of separate builds is that we can more easily
+  # link libs together using existing Nixpkgs infra.
+  #
+  # In the end, we don't expose these derivations, and they only exist during
+  # the bootstrap phase. The final swiftpm derivation does not depend on them.
+
+  swift-system = mkBootstrapDerivation {
+    name = "swift-system";
+    src = generated.sources.swift-system;
+
+    postInstall = cmakeGlue.SwiftSystem
+      + lib.optionalString (!stdenv.isDarwin) ''
+        # The cmake rules apparently only use the Darwin install convention.
+        # Fix up the installation so the module can be found on non-Darwin.
+        mkdir -p $out/${swiftStaticModuleSubdir}
+        mv $out/lib/swift_static/${swiftOs}/*.swiftmodule $out/${swiftStaticModuleSubdir}/
+      '';
+  };
+
+  swift-collections = mkBootstrapDerivation {
+    name = "swift-collections";
+    src = generated.sources.swift-collections;
+
+    postPatch = ''
+      # Only builds static libs on Linux, but this installation difference is a
+      # hassle. Because this installation is temporary for the bootstrap, may
+      # as well build static libs everywhere.
+      sed -i -e '/BUILD_SHARED_LIBS/d' CMakeLists.txt
+    '';
+
+    postInstall = cmakeGlue.SwiftCollections
+      + lib.optionalString (!stdenv.isDarwin) ''
+        # The cmake rules apparently only use the Darwin install convention.
+        # Fix up the installation so the module can be found on non-Darwin.
+        mkdir -p $out/${swiftStaticModuleSubdir}
+        mv $out/lib/swift_static/${swiftOs}/*.swiftmodule $out/${swiftStaticModuleSubdir}/
+      '';
+  };
+
+  swift-tools-support-core = mkBootstrapDerivation {
+    name = "swift-tools-support-core";
+    src = generated.sources.swift-tools-support-core;
+
+    buildInputs = [
+      swift-system
+      sqlite
+    ];
+
+    postInstall = cmakeGlue.TSC + ''
+      # Swift modules are not installed.
+      mkdir -p $out/${swiftModuleSubdir}
+      cp swift/*.swift{module,doc} $out/${swiftModuleSubdir}/
+
+      # Static libs are not installed.
+      cp lib/*.a $out/lib/
+
+      # Headers are not installed.
+      mkdir -p $out/include
+      cp -r ../Sources/TSCclibc/include $out/include/TSC
+    '';
+  };
+
+  swift-argument-parser = mkBootstrapDerivation {
+    name = "swift-argument-parser";
+    src = generated.sources.swift-argument-parser;
+
+    buildInputs = [ ncursesInput sqlite ];
+
+    cmakeFlags = [
+      "-DBUILD_TESTING=NO"
+      "-DBUILD_EXAMPLES=NO"
+    ];
+
+    postInstall = cmakeGlue.ArgumentParser
+      + lib.optionalString stdenv.isLinux ''
+        # Fix rpath so ArgumentParserToolInfo can be found.
+        patchelf --add-rpath "$out/lib/swift/${swiftOs}" \
+          $out/lib/swift/${swiftOs}/libArgumentParser.so
+      '';
+  };
+
+  Yams = mkBootstrapDerivation {
+    name = "Yams";
+    src = generated.sources.Yams;
+
+    # Conflicts with BUILD file on case-insensitive filesystems.
+    cmakeBuildDir = "_build";
+
+    postInstall = cmakeGlue.Yams;
+  };
+
+  llbuild = mkBootstrapDerivation {
+    name = "llbuild";
+    src = generated.sources.swift-llbuild;
+
+    nativeBuildInputs = lib.optional stdenv.isDarwin xcbuild;
+    buildInputs = [ ncursesInput sqlite ];
+
+    patches = [
+      ./patches/llbuild-cmake-disable-rpath.patch
+    ];
+
+    postPatch = ''
+      # Substitute ncurses for curses.
+      find . -name CMakeLists.txt | xargs sed -i -e 's/curses/ncurses/'
+
+      # Use absolute install names instead of rpath.
+      substituteInPlace \
+        products/libllbuild/CMakeLists.txt \
+        products/llbuildSwift/CMakeLists.txt \
+        --replace '@rpath' "$out/lib"
+
+      # This subdirectory is enabled for Darwin only, but requires ObjC XCTest
+      # (and only Swift XCTest is open source).
+      substituteInPlace perftests/CMakeLists.txt \
+        --replace 'add_subdirectory(Xcode/' '#add_subdirectory(Xcode/'
+    '';
+
+    cmakeFlags = [
+      "-DLLBUILD_SUPPORT_BINDINGS=Swift"
+    ];
+
+    postInstall = cmakeGlue.LLBuild + ''
+      # Install module map.
+      cp ../products/libllbuild/include/module.modulemap $out/include
+
+      # Swift modules are not installed.
+      mkdir -p $out/${swiftModuleSubdir}
+      cp products/llbuildSwift/*.swift{module,doc} $out/${swiftModuleSubdir}/
+    '';
+  };
+
+  swift-driver = mkBootstrapDerivation {
+    name = "swift-driver";
+    src = generated.sources.swift-driver;
+
+    buildInputs = [
+      Yams
+      llbuild
+      swift-system
+      swift-argument-parser
+      swift-tools-support-core
+    ];
+
+    postInstall = cmakeGlue.SwiftDriver + ''
+      # Swift modules are not installed.
+      mkdir -p $out/${swiftModuleSubdir}
+      cp swift/*.swift{module,doc} $out/${swiftModuleSubdir}/
+    '';
+  };
+
+  swift-crypto = mkBootstrapDerivation {
+    name = "swift-crypto";
+    src = generated.sources.swift-crypto;
+
+    postPatch = ''
+      substituteInPlace CMakeLists.txt \
+        --replace /usr/bin/ar $NIX_CC/bin/ar
+    '';
+
+    postInstall = cmakeGlue.SwiftCrypto + ''
+      # Static libs are not installed.
+      cp lib/*.a $out/lib/
+
+      # Headers are not installed.
+      cp -r ../Sources/CCryptoBoringSSL/include $out/include
+    '';
+  };
+
+  # Build a bootrapping swiftpm using CMake.
+  swiftpm-bootstrap = mkBootstrapDerivation (commonAttrs // {
+    pname = "swiftpm-bootstrap";
+
+    buildInputs = [
+      llbuild
+      swift-argument-parser
+      swift-collections
+      swift-crypto
+      swift-driver
+      swift-system
+      swift-tools-support-core
+    ];
+
+    cmakeFlags = [
+      "-DUSE_CMAKE_INSTALL=ON"
+    ];
+
+    postInstall = ''
+      for program in $out/bin/swift-*; do
+        wrapProgram $program --prefix PATH : ${lib.makeBinPath runtimeDeps}
+      done
+    '';
+  });
+
+# Build the final swiftpm with the bootstrapping swiftpm.
+in stdenv.mkDerivation (commonAttrs // {
+  pname = "swiftpm";
+
+  nativeBuildInputs = commonAttrs.nativeBuildInputs ++ [
+    swift
+    swiftpm-bootstrap
+  ];
+  buildInputs = [
+    ncursesInput
+    sqlite
+    XCTest
+  ]
+    ++ lib.optionals stdenv.isDarwin [
+      CryptoKit
+      LocalAuthentication
+    ];
+
+  configurePhase = generated.configure + ''
+    # Functionality provided by Xcode XCTest, but not available in
+    # swift-corelibs-xctest.
+    swiftpmMakeMutable swift-tools-support-core
+    substituteInPlace .build/checkouts/swift-tools-support-core/Sources/TSCTestSupport/XCTestCasePerf.swift \
+      --replace 'canImport(Darwin)' 'false'
+
+    # Prevent a warning about SDK directories we don't have.
+    swiftpmMakeMutable swift-driver
+    patch -p1 -d .build/checkouts/swift-driver -i ${substituteAll {
+      src = ../swift-driver/patches/prevent-sdk-dirs-warnings.patch;
+      inherit (builtins) storeDir;
+    }}
+  '';
+
+  buildPhase = ''
+    # Required to link with swift-corelibs-xctest on Darwin.
+    export SWIFTTSC_MACOS_DEPLOYMENT_TARGET=10.12
+
+    TERM=dumb swift-build -c release
+  '';
+
+  # TODO: Tests depend on indexstore-db being provided by an existing Swift
+  # toolchain. (ie. looks for `../lib/libIndexStore.so` relative to swiftc.
+  #doCheck = true;
+  #checkPhase = ''
+  #  TERM=dumb swift-test -c release
+  #'';
+
+  # The following is dervied from Utilities/bootstrap, see install_swiftpm.
+  installPhase = ''
+    binPath="$(swift-build --show-bin-path -c release)"
+
+    mkdir -p $out/bin $out/lib/swift
+
+    cp $binPath/swift-package $out/bin/
+    wrapProgram $out/bin/swift-package \
+      --prefix PATH : ${lib.makeBinPath runtimeDeps}
+    for tool in swift-build swift-test swift-run swift-package-collection; do
+      ln -s $out/bin/swift-package $out/bin/$tool
+    done
+
+    installSwiftpmModule() {
+      mkdir -p $out/lib/swift/pm/$2
+      cp $binPath/lib$1${sharedLibraryExt} $out/lib/swift/pm/$2/
+
+      if [[ -f $binPath/$1.swiftinterface ]]; then
+        cp $binPath/$1.swiftinterface $out/lib/swift/pm/$2/
+      else
+        cp -r $binPath/$1.swiftmodule $out/lib/swift/pm/$2/
+      fi
+      cp $binPath/$1.swiftdoc $out/lib/swift/pm/$2/
+    }
+    installSwiftpmModule PackageDescription ManifestAPI
+    installSwiftpmModule PackagePlugin PluginAPI
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  meta = {
+    description = "The Package Manager for the Swift Programming Language";
+    homepage = "https://github.com/apple/swift-package-manager";
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+})
diff --git a/pkgs/development/compilers/swift/swiftpm/generated/default.nix b/pkgs/development/compilers/swift/swiftpm/generated/default.nix
new file mode 100644
index 0000000000000..978aee7455dcf
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/generated/default.nix
@@ -0,0 +1,14 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "1jph9w7lk9nr20fsv2c8p4hisx3dda817fh7pybd0r0j1jwa9nmw";
+    "swift-collections" = "0l0pv16zil3n7fac7mdf5qxklxr5rwiig5bixgca1ybq7arlnv7i";
+    "swift-crypto" = "020b8q4ss2k7a65r5dgh59z40i6sn7ij1allxkh8c8a9d0jzn313";
+    "swift-driver" = "1lcb5wqragc74nd0fjnk47lyph9hs0i9cps1mplvp2i91yzjqk05";
+    "swift-llbuild" = "07zbp2dyfqd1bnyg7snpr9brn40jf22ivly5v10mql3hrg76a18h";
+    "swift-system" = "0402hkx2q2dv27gccnn8ma79ngvwiwzkhcv4zlcdldmy6cgi0px7";
+    "swift-tools-support-core" = "1vabl1z5sm2lrd75f5c781rkrq0liinpjvnrjr6i6r8cqrp0q5jb";
+    "Yams" = "1893y13sis2aimi1a5kgkczbf06z4yig054xb565yg2xm13srb45";
+  };
+}
diff --git a/pkgs/development/compilers/swift/swiftpm/generated/workspace-state.json b/pkgs/development/compilers/swift/swiftpm/generated/workspace-state.json
new file mode 100644
index 0000000000000..26219857c1779
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/generated/workspace-state.json
@@ -0,0 +1,144 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser.git",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e394bf350e38cb100b6bc4172834770ede1b7232",
+            "version": "1.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-collections",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-collections.git",
+          "name": "swift-collections"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "f504716c27d2e5d4144fa4794b12129301d17729",
+            "version": "1.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-collections"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-crypto",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-crypto.git",
+          "name": "swift-crypto"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "ddb07e896a2a8af79512543b1c7eb9797f8898a5",
+            "version": "1.1.7"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-crypto"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-driver",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-driver.git",
+          "name": "swift-driver"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "82b274af66cfbb8f3131677676517b34d01e30fd"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-driver"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-llbuild",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-llbuild.git",
+          "name": "llbuild"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "564424db5fdb62dcb5d863bdf7212500ef03a87b"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-llbuild"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-system",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-system.git",
+          "name": "swift-system"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "836bc4557b74fe6d2660218d56e3ce96aff76574",
+            "version": "1.1.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-system"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-tools-support-core",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-tools-support-core.git",
+          "name": "swift-tools-support-core"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "afc0938503bac012f76ceb619d031f63edc4c5f7"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-tools-support-core"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "yams",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/jpsim/Yams.git",
+          "name": "Yams"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "9ff1cc9327586db4e0c8f46f064b6a82ec1566fa",
+            "version": "4.0.6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Yams"
+      }
+    ]
+  },
+  "version": 5
+}
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/cmake-disable-rpath.patch b/pkgs/development/compilers/swift/swiftpm/patches/cmake-disable-rpath.patch
new file mode 100644
index 0000000000000..9aeba452f9e80
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/cmake-disable-rpath.patch
@@ -0,0 +1,36 @@
+Disable rpath for the bootstrap build with CMake.
+
+--- a/Sources/PackageDescription/CMakeLists.txt
++++ b/Sources/PackageDescription/CMakeLists.txt
+@@ -31,14 +31,11 @@ if(CMAKE_HOST_SYSTEM_NAME STREQUAL Darwin)
+   set(SWIFT_INTERFACE_PATH ${CMAKE_BINARY_DIR}/pm/ManifestAPI/PackageDescription.swiftinterface)
+   target_compile_options(PackageDescription PUBLIC
+     $<$<COMPILE_LANGUAGE:Swift>:-emit-module-interface-path$<SEMICOLON>${SWIFT_INTERFACE_PATH}>)
+-  target_link_options(PackageDescription PRIVATE
+-    "SHELL:-Xlinker -install_name -Xlinker @rpath/libPackageDescription.dylib")
+ endif()
+ 
+ set_target_properties(PackageDescription PROPERTIES
+     Swift_MODULE_NAME PackageDescription
+     Swift_MODULE_DIRECTORY ${CMAKE_BINARY_DIR}/pm/ManifestAPI
+-    INSTALL_NAME_DIR \\@rpath
+     OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/pm/ManifestAPI
+     OUTPUT_NAME PackageDescription
+     ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/pm/ManifestAPI
+--- a/Sources/PackagePlugin/CMakeLists.txt
++++ b/Sources/PackagePlugin/CMakeLists.txt
+@@ -29,14 +29,11 @@ if(CMAKE_HOST_SYSTEM_NAME STREQUAL Darwin)
+   set(SWIFT_INTERFACE_PATH ${CMAKE_BINARY_DIR}/pm/PluginAPI/PackagePlugin.swiftinterface)
+   target_compile_options(PackagePlugin PUBLIC
+     $<$<COMPILE_LANGUAGE:Swift>:-emit-module-interface-path$<SEMICOLON>${SWIFT_INTERFACE_PATH}>)
+-  target_link_options(PackagePlugin PRIVATE
+-    "SHELL:-Xlinker -install_name -Xlinker @rpath/libPackagePlugin.dylib")
+ endif()
+ 
+ set_target_properties(PackagePlugin PROPERTIES
+   Swift_MODULE_NAME PackagePlugin
+   Swift_MODULE_DIRECTORY ${CMAKE_BINARY_DIR}/pm/PluginAPI
+-  INSTALL_NAME_DIR \\@rpath
+   OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/pm/PluginAPI
+   OUTPUT_NAME PackagePlugin
+   ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/pm/PluginAPI
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/disable-sandbox.patch b/pkgs/development/compilers/swift/swiftpm/patches/disable-sandbox.patch
new file mode 100644
index 0000000000000..406e1d68d0e42
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/disable-sandbox.patch
@@ -0,0 +1,21 @@
+Nix may already sandbox the build, in which case sandbox_apply will fail.
+
+--- a/Sources/Basics/Sandbox.swift
++++ b/Sources/Basics/Sandbox.swift
+@@ -30,12 +30,14 @@ public enum Sandbox {
+         readOnlyDirectories: [AbsolutePath] = []
+     ) -> [String] {
+         #if os(macOS)
++        let env = ProcessInfo.processInfo.environment
++        if env["NIX_BUILD_TOP"] == nil || env["IN_NIX_SHELL"] != nil {
+         let profile = macOSSandboxProfile(strictness: strictness, writableDirectories: writableDirectories, readOnlyDirectories: readOnlyDirectories)
+         return ["/usr/bin/sandbox-exec", "-p", profile] + command
+-        #else
++        }
++        #endif
+         // rdar://40235432, rdar://75636874 tracks implementing sandboxes for other platforms.
+         return command
+-        #endif
+     }
+
+     /// Basic strictness level of a sandbox applied to a command line.
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/disable-xctest.patch b/pkgs/development/compilers/swift/swiftpm/patches/disable-xctest.patch
new file mode 100644
index 0000000000000..e24d154d29873
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/disable-xctest.patch
@@ -0,0 +1,48 @@
+XCTest is not fully open-source, only the Swift library parts. We don't have a
+command-line runner available, so disable support.
+
+--- a/Sources/Commands/TestingSupport.swift
++++ b/Sources/Commands/TestingSupport.swift
+@@ -60,7 +60,7 @@ enum TestingSupport {
+     /// - Returns: Array of TestSuite
+     static func getTestSuites(fromTestAt path: AbsolutePath, swiftTool: SwiftTool, swiftOptions: SwiftToolOptions) throws -> [TestSuite] {
+         // Run the correct tool.
+-        #if os(macOS)
++        #if false
+         let data: String = try withTemporaryFile { tempFile in
+             let args = [try TestingSupport.xctestHelperPath(swiftTool: swiftTool).pathString, path.pathString, tempFile.path.pathString]
+             var env = try TestingSupport.constructTestEnvironment(toolchain: try swiftTool.getToolchain(), options: swiftOptions, buildParameters: swiftTool.buildParametersForTest())
+--- a/Sources/swiftpm-xctest-helper/main.swift
++++ b/Sources/swiftpm-xctest-helper/main.swift
+@@ -9,8 +9,11 @@
+ */
+ 
+ #if os(macOS)
+-import XCTest
+ import func Darwin.C.exit
++print("Not supported in Nix.")
++exit(1)
++#if false
++import XCTest
+ 
+ /// A helper tool to get list of tests from a XCTest Bundle on macOS.
+ ///
+@@ -132,6 +135,7 @@ do {
+     exit(1)
+ }
+ 
++#endif // nix
+ #else
+ 
+ #if os(Windows)
+--- a/Sources/PackageModel/Destination.swift
++++ b/Sources/PackageModel/Destination.swift
+@@ -174,7 +174,7 @@ public struct Destination: Encodable, Equatable {
+             arguments: ["/usr/bin/xcrun", "--sdk", "macosx", "--show-sdk-platform-path"],
+             environment: environment).spm_chomp()
+
+-        if let platformPath = platformPath, !platformPath.isEmpty {
++        if let platformPath = platformPath, !platformPath.isEmpty && !platformPath.starts(with: "@storeDir@") {
+             // For XCTest framework.
+             let fwk = AbsolutePath(platformPath).appending(
+                 components: "Developer", "Library", "Frameworks")
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/fix-clang-cxx.patch b/pkgs/development/compilers/swift/swiftpm/patches/fix-clang-cxx.patch
new file mode 100644
index 0000000000000..60c4e33eb154f
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/fix-clang-cxx.patch
@@ -0,0 +1,121 @@
+Swiftpm may invoke clang, not clang++, to compile C++. Our cc-wrapper also
+doesn't pick up the arguments that enable C++ compilation in this case. Patch
+swiftpm to properly invoke clang++.
+
+--- a/Sources/Build/LLBuildManifestBuilder.swift
++++ b/Sources/Build/LLBuildManifestBuilder.swift
+@@ -782,7 +782,7 @@ extension LLBuildManifestBuilder {
+ 
+             args += ["-c", path.source.pathString, "-o", path.object.pathString]
+ 
+-            let clangCompiler = try buildParameters.toolchain.getClangCompiler().pathString
++            let clangCompiler = try buildParameters.toolchain.getClangCompiler(isCXX: isCXX).pathString
+             args.insert(clangCompiler, at: 0)
+ 
+             let objectFileNode: Node = .file(path.object)
+--- a/Sources/PackageModel/Destination.swift
++++ b/Sources/PackageModel/Destination.swift
+@@ -153,7 +153,7 @@ public struct Destination: Encodable, Equatable {
+ 
+         var extraCPPFlags: [String] = []
+ #if os(macOS)
+-        extraCPPFlags += ["-lc++"]
++        extraCPPFlags += ["-lc++", "-lc++abi"]
+ #elseif os(Windows)
+         extraCPPFlags += []
+ #else
+--- a/Sources/PackageModel/Toolchain.swift
++++ b/Sources/PackageModel/Toolchain.swift
+@@ -20,7 +20,7 @@ public protocol Toolchain {
+     var macosSwiftStdlib: AbsolutePath { get }
+ 
+     /// Path of the `clang` compiler.
+-    func getClangCompiler() throws -> AbsolutePath
++    func getClangCompiler(isCXX: Bool) throws -> AbsolutePath
+ 
+     // FIXME: This is a temporary API until index store is widely available in
+     // the OSS clang compiler. This API should not used for any other purpose.
+--- a/Sources/PackageModel/UserToolchain.swift
++++ b/Sources/PackageModel/UserToolchain.swift
+@@ -57,7 +57,7 @@ public final class UserToolchain: Toolchain {
+     /// Only use search paths, do not fall back to `xcrun`.
+     let useXcrun: Bool
+ 
+-    private var _clangCompiler: AbsolutePath?
++    private var _clangCompiler: [Bool: AbsolutePath] = [:]
+ 
+     private let environment: EnvironmentVariables
+ 
+@@ -150,29 +150,31 @@ public final class UserToolchain: Toolchain {
+     }
+ 
+     /// Returns the path to clang compiler tool.
+-    public func getClangCompiler() throws -> AbsolutePath {
++    public func getClangCompiler(isCXX: Bool) throws -> AbsolutePath {
+         // Check if we already computed.
+-        if let clang = self._clangCompiler {
++        if let clang = self._clangCompiler[isCXX] {
+             return clang
+         }
+ 
+         // Check in the environment variable first.
+-        if let toolPath = UserToolchain.lookup(variable: "CC", searchPaths: self.envSearchPaths, environment: environment) {
+-            self._clangCompiler = toolPath
++        let envVar = isCXX ? "CXX" : "CC";
++        if let toolPath = UserToolchain.lookup(variable: envVar, searchPaths: self.envSearchPaths, environment: environment) {
++            self._clangCompiler[isCXX] = toolPath
+             return toolPath
+         }
+ 
+         // Then, check the toolchain.
++        let tool = isCXX ? "clang++" : "clang";
+         do {
+-            if let toolPath = try? UserToolchain.getTool("clang", binDir: self.destination.binDir) {
+-                self._clangCompiler = toolPath
++            if let toolPath = try? UserToolchain.getTool(tool, binDir: self.destination.binDir) {
++                self._clangCompiler[isCXX] = toolPath
+                 return toolPath
+             }
+         }
+ 
+         // Otherwise, lookup it up on the system.
+-        let toolPath = try UserToolchain.findTool("clang", envSearchPaths: self.envSearchPaths, useXcrun: useXcrun)
+-        self._clangCompiler = toolPath
++        let toolPath = try UserToolchain.findTool(tool, envSearchPaths: self.envSearchPaths, useXcrun: useXcrun)
++        self._clangCompiler[isCXX] = toolPath
+         return toolPath
+     }
+ 
+--- a/Sources/SPMBuildCore/BuildParameters.swift
++++ b/Sources/SPMBuildCore/BuildParameters.swift
+@@ -342,7 +342,7 @@ private struct _Toolchain: Encodable {
+     public func encode(to encoder: Encoder) throws {
+         var container = encoder.container(keyedBy: CodingKeys.self)
+         try container.encode(toolchain.swiftCompilerPath, forKey: .swiftCompiler)
+-        try container.encode(toolchain.getClangCompiler(), forKey: .clangCompiler)
++        try container.encode(toolchain.getClangCompiler(isCXX: false), forKey: .clangCompiler)
+ 
+         try container.encode(toolchain.extraCCFlags, forKey: .extraCCFlags)
+         try container.encode(toolchain.extraCPPFlags, forKey: .extraCPPFlags)
+--- a/Sources/XCBuildSupport/XcodeBuildSystem.swift
++++ b/Sources/XCBuildSupport/XcodeBuildSystem.swift
+@@ -172,7 +172,7 @@ public final class XcodeBuildSystem: SPMBuildCore.BuildSystem {
+         // Generate a table of any overriding build settings.
+         var settings: [String: String] = [:]
+         // An error with determining the override should not be fatal here.
+-        settings["CC"] = try? buildParameters.toolchain.getClangCompiler().pathString
++        settings["CC"] = try? buildParameters.toolchain.getClangCompiler(isCXX: false).pathString
+         // Always specify the path of the effective Swift compiler, which was determined in the same way as for the native build system.
+         settings["SWIFT_EXEC"] = buildParameters.toolchain.swiftCompilerPath.pathString
+         settings["LIBRARY_SEARCH_PATHS"] = "$(inherited) \(buildParameters.toolchain.toolchainLibDir.pathString)"
+--- a/Tests/BuildTests/MockBuildTestHelper.swift
++++ b/Tests/BuildTests/MockBuildTestHelper.swift
+@@ -15,7 +15,7 @@ struct MockToolchain: PackageModel.Toolchain {
+     #else
+     let extraCPPFlags: [String] = ["-lstdc++"]
+     #endif
+-    func getClangCompiler() throws -> AbsolutePath {
++    func getClangCompiler(isCXX: Bool) throws -> AbsolutePath {
+         return AbsolutePath("/fake/path/to/clang")
+     }
+ 
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/fix-stdlib-path.patch b/pkgs/development/compilers/swift/swiftpm/patches/fix-stdlib-path.patch
new file mode 100644
index 0000000000000..327ccf37e4253
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/fix-stdlib-path.patch
@@ -0,0 +1,23 @@
+Swiftpm looks for the Swift stdlib relative to the swift compiler, but that's a
+wrapper in our case. It wants to add the stdlib to the rpath, which is
+necessary for back-deployment of some features.
+
+--- a/Sources/PackageModel/Toolchain.swift
++++ b/Sources/PackageModel/Toolchain.swift
+@@ -43,10 +43,16 @@ extension Toolchain {
+     }
+ 
+     public var macosSwiftStdlib: AbsolutePath { 
++        if swiftCompilerPath.pathString.starts(with: "@storeDir@") {
++            return AbsolutePath("@swiftLib@/lib/swift/macosx")
++        }
+         return AbsolutePath("../../lib/swift/macosx", relativeTo: resolveSymlinks(swiftCompilerPath))
+     }
+ 
+     public var toolchainLibDir: AbsolutePath {
++        if swiftCompilerPath.pathString.starts(with: "@storeDir@") {
++            return AbsolutePath("@swiftLib@/lib")
++        }
+         // FIXME: Not sure if it's better to base this off of Swift compiler or our own binary.
+         return AbsolutePath("../../lib", relativeTo: resolveSymlinks(swiftCompilerPath))
+     }
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/llbuild-cmake-disable-rpath.patch b/pkgs/development/compilers/swift/swiftpm/patches/llbuild-cmake-disable-rpath.patch
new file mode 100644
index 0000000000000..785e82cc34b6d
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/llbuild-cmake-disable-rpath.patch
@@ -0,0 +1,14 @@
+Specifying `-platform_version` targeting macos before 10.15 causes cctools ld
+to link with `@rpath`. This may have something to do with Swift ABI stability.
+
+--- a/products/llbuildSwift/CMakeLists.txt
++++ b/products/llbuildSwift/CMakeLists.txt
+@@ -22,7 +17,7 @@ endif()
+
+ # TODO(compnerd) move both of these outside of the CMake into the invocation
+ if(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+-  add_compile_options(-target ${CMAKE_OSX_ARCHITECTURES}-apple-macosx10.10)
++  add_compile_options(-target ${CMAKE_OSX_ARCHITECTURES}-apple-macosx10.15)
+   if(NOT CMAKE_OSX_SYSROOT STREQUAL "")
+     add_compile_options(-sdk ${CMAKE_OSX_SYSROOT})
+   endif()
diff --git a/pkgs/development/compilers/swift/swiftpm/setup-hook.sh b/pkgs/development/compilers/swift/swiftpm/setup-hook.sh
new file mode 100644
index 0000000000000..160fbb1ccca31
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/setup-hook.sh
@@ -0,0 +1,60 @@
+# Build using 'swift-build'.
+swiftpmBuildPhase() {
+    runHook preBuild
+
+    local buildCores=1
+    if [ "${enableParallelBuilding-1}" ]; then
+        buildCores="$NIX_BUILD_CORES"
+    fi
+
+    local flagsArray=(
+        -j $buildCores
+        -c "${swiftpmBuildConfig-release}"
+        $swiftpmFlags "${swiftpmFlagsArray[@]}"
+    )
+
+    echoCmd 'build flags' "${flagsArray[@]}"
+    TERM=dumb swift-build "${flagsArray[@]}"
+
+    runHook postBuild
+}
+
+if [ -z "${dontUseSwiftpmBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=swiftpmBuildPhase
+fi
+
+# Check using 'swift-test'.
+swiftpmCheckPhase() {
+    runHook preCheck
+
+    local buildCores=1
+    if [ "${enableParallelBuilding-1}" ]; then
+        buildCores="$NIX_BUILD_CORES"
+    fi
+
+    local flagsArray=(
+        -j $buildCores
+        -c "${swiftpmBuildConfig-release}"
+        $swiftpmFlags "${swiftpmFlagsArray[@]}"
+    )
+
+    echoCmd 'check flags' "${flagsArray[@]}"
+    TERM=dumb swift-test "${flagsArray[@]}"
+
+    runHook postCheck
+}
+
+if [ -z "${dontUseSwiftpmCheck-}" ] && [ -z "${checkPhase-}" ]; then
+    checkPhase=swiftpmCheckPhase
+fi
+
+# Helper used to find the binary output path.
+# Useful for performing the installPhase of swiftpm packages.
+swiftpmBinPath() {
+    local flagsArray=(
+        -c "${swiftpmBuildConfig-release}"
+        $swiftpmFlags "${swiftpmFlagsArray[@]}"
+    )
+
+    swift-build --show-bin-path "${flagsArray[@]}"
+}
diff --git a/pkgs/development/compilers/swift/wrapper/default.nix b/pkgs/development/compilers/swift/wrapper/default.nix
new file mode 100644
index 0000000000000..a7d16cc2471af
--- /dev/null
+++ b/pkgs/development/compilers/swift/wrapper/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, swift
+, useSwiftDriver ? true, swift-driver
+}:
+
+stdenv.mkDerivation (swift._wrapperParams // {
+  pname = "swift-wrapper";
+  inherit (swift) version meta;
+
+  outputs = [ "out" "man" ];
+
+  # Wrapper and setup hook variables.
+  inherit swift;
+  inherit (swift)
+    swiftOs swiftArch
+    swiftModuleSubdir swiftLibSubdir
+    swiftStaticModuleSubdir swiftStaticLibSubdir;
+  swiftDriver = if useSwiftDriver
+    then "${swift-driver}/bin/swift-driver" else "";
+
+  passAsFile = [ "buildCommand" ];
+  buildCommand = ''
+    mkdir -p $out/bin $out/nix-support
+
+    # Symlink all Swift binaries first.
+    # NOTE: This specifically omits clang binaries. We want to hide these for
+    # private use by Swift only.
+    ln -s -t $out/bin/ $swift/bin/swift*
+
+    # Replace specific binaries with wrappers.
+    for executable in swift swiftc swift-frontend; do
+      export prog=$swift/bin/$executable
+      rm $out/bin/$executable
+      substituteAll '${./wrapper.sh}' $out/bin/$executable
+      chmod a+x $out/bin/$executable
+    done
+
+    ${lib.optionalString useSwiftDriver ''
+    # Symlink swift-driver executables.
+    ln -s -t $out/bin/ ${swift-driver}/bin/*
+    ''}
+
+    ln -s ${swift.man} $man
+
+    # This link is here because various tools (swiftpm) check for stdlib
+    # relative to the swift compiler. It's fine if this is for build-time
+    # stuff, but we should patch all cases were it would end up in an output.
+    ln -s ${swift.lib}/lib $out/lib
+
+    substituteAll ${./setup-hook.sh} $out/nix-support/setup-hook
+  '';
+
+  passthru = {
+    inherit swift;
+    inherit (swift) swiftOs swiftArch swiftModuleSubdir swiftLibSubdir;
+  };
+})
diff --git a/pkgs/development/compilers/swift/wrapper/setup-hook.sh b/pkgs/development/compilers/swift/wrapper/setup-hook.sh
new file mode 100644
index 0000000000000..398f19977f667
--- /dev/null
+++ b/pkgs/development/compilers/swift/wrapper/setup-hook.sh
@@ -0,0 +1,28 @@
+# Add import paths for build inputs.
+swiftWrapper_addImports () {
+    # Include subdirectories following both the Swift platform convention, and
+    # a simple `lib/swift` for Nix convenience.
+    for subdir in @swiftModuleSubdir@ @swiftStaticModuleSubdir@ lib/swift; do
+        if [[ -d "$1/$subdir" ]]; then
+            export NIX_SWIFTFLAGS_COMPILE+=" -I $1/$subdir"
+        fi
+    done
+    for subdir in @swiftLibSubdir@ @swiftStaticLibSubdir@ lib/swift; do
+        if [[ -d "$1/$subdir" ]]; then
+            export NIX_LDFLAGS+=" -L $1/$subdir"
+        fi
+    done
+}
+
+addEnvHooks "$targetOffset" swiftWrapper_addImports
+
+# Use a postHook here because we rely on NIX_CC, which is set by the cc-wrapper
+# setup hook, so delay until we're sure it was run.
+swiftWrapper_postHook () {
+    # On Darwin, libc also contains Swift modules.
+    if [[ -e "$NIX_CC/nix-support/orig-libc" ]]; then
+        swiftWrapper_addImports "$(<$NIX_CC/nix-support/orig-libc)"
+    fi
+}
+
+postHooks+=(swiftWrapper_postHook)
diff --git a/pkgs/development/compilers/swift/wrapper/wrapper.sh b/pkgs/development/compilers/swift/wrapper/wrapper.sh
new file mode 100644
index 0000000000000..0c56e63b6f29e
--- /dev/null
+++ b/pkgs/development/compilers/swift/wrapper/wrapper.sh
@@ -0,0 +1,291 @@
+#! @shell@
+# NOTE: This wrapper is derived from cc-wrapper.sh, and is hopefully somewhat
+# diffable with the original, so changes can be merged if necessary.
+set -eu -o pipefail +o posix
+shopt -s nullglob
+
+if (( "${NIX_DEBUG:-0}" >= 7 )); then
+    set -x
+fi
+
+cc_wrapper="${NIX_CC:-@default_cc_wrapper@}"
+
+source $cc_wrapper/nix-support/utils.bash
+
+expandResponseParams "$@"
+
+# Check if we should wrap this Swift invocation at all, and how. Specifically,
+# there are some internal tools we don't wrap, plus swift-frontend doesn't link
+# and doesn't understand linker flags. This follows logic in
+# `lib/DriverTool/driver.cpp`.
+prog=@prog@
+progName="$(basename "$prog")"
+firstArg="${params[0]:-}"
+isFrontend=0
+isRepl=0
+
+# These checks follow `shouldRunAsSubcommand`.
+if [[ "$progName" == swift ]]; then
+    case "$firstArg" in
+        "" | -* | *.* | */* | repl)
+            ;;
+        *)
+            exec "swift-$firstArg" "${params[@]:1}"
+            ;;
+    esac
+fi
+
+# These checks follow the first part of `run_driver`.
+#
+# NOTE: The original function short-circuits, but we can't here, because both
+# paths must be wrapped. So we use an 'isFrontend' flag instead.
+case "$firstArg" in
+    -frontend)
+        isFrontend=1
+        # Ensure this stays the first argument.
+        params=( "${params[@]:1}" )
+        extraBefore+=( "-frontend" )
+        ;;
+    -modulewrap)
+        # Don't wrap this integrated tool.
+        exec "$prog" "${params[@]}"
+        ;;
+    repl)
+        isRepl=1
+        params=( "${params[@]:1}" )
+        ;;
+    --driver-mode=*)
+        ;;
+    *)
+        if [[ "$progName" == swift-frontend ]]; then
+            isFrontend=1
+        fi
+        ;;
+esac
+
+# For many tasks, Swift reinvokes swift-driver, the new driver implementation
+# written in Swift. It needs some help finding the executable, though, and
+# reimplementing the logic here is little effort. These checks follow
+# `shouldDisallowNewDriver`.
+if [[
+    $isFrontend = 0 &&
+    -n "@swiftDriver@" &&
+    -z "${SWIFT_USE_OLD_DRIVER:-}" &&
+    ( "$progName" == "swift" || "$progName" == "swiftc" )
+]]; then
+    prog=@swiftDriver@
+    # Driver mode must be the very first argument.
+    extraBefore+=( "--driver-mode=$progName" )
+    if [[ $isRepl = 1 ]]; then
+        extraBefore+=( "-repl" )
+    fi
+
+    # Ensure swift-driver invokes the unwrapped frontend (instead of finding
+    # the wrapped one via PATH), because we don't have to wrap a second time.
+    export SWIFT_DRIVER_SWIFT_FRONTEND_EXEC="@swift@/bin/swift-frontend"
+
+    # Ensure swift-driver can find the LLDB with Swift support for the REPL.
+    export SWIFT_DRIVER_LLDB_EXEC="@swift@/bin/lldb"
+fi
+
+path_backup="$PATH"
+
+# That @-vars are substituted separately from bash evaluation makes
+# shellcheck think this, and others like it, are useless conditionals.
+# shellcheck disable=SC2157
+if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
+    PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
+fi
+
+# Parse command line options and set several variables.
+# For instance, figure out if linker flags should be passed.
+# GCC prints annoying warnings when they are not needed.
+isCxx=0
+dontLink=$isFrontend
+
+for p in "${params[@]}"; do
+    case "$p" in
+        -enable-cxx-interop)
+            isCxx=1 ;;
+    esac
+done
+
+# NOTE: We don't modify these for Swift, but sourced scripts may use them.
+cxxInclude=1
+cxxLibrary=1
+cInclude=1
+
+linkType=$(checkLinkType "${params[@]}")
+
+# Optionally filter out paths not refering to the store.
+if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
+    kept=()
+    nParams=${#params[@]}
+    declare -i n=0
+    while (( "$n" < "$nParams" )); do
+        p=${params[n]}
+        p2=${params[n+1]:-} # handle `p` being last one
+        n+=1
+
+        skipNext=false
+        path=""
+        case "$p" in
+            -[IL]/*) path=${p:2} ;;
+            -[IL]) path=$p2 skipNext=true ;;
+        esac
+
+        if [[ -n $path ]] && badPath "$path"; then
+            skip "$path"
+            $skipNext && n+=1
+            continue
+        fi
+
+        kept+=("$p")
+    done
+    # Old bash empty array hack
+    params=(${kept+"${kept[@]}"})
+fi
+
+# Flirting with a layer violation here.
+if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
+    source @bintools@/nix-support/add-flags.sh
+fi
+
+# Put this one second so libc ldflags take priority.
+if [ -z "${NIX_CC_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
+    source $cc_wrapper/nix-support/add-flags.sh
+fi
+
+if [[ "$isCxx" = 1 ]]; then
+    if [[ "$cxxInclude" = 1 ]]; then
+        NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
+    fi
+    if [[ "$cxxLibrary" = 1 ]]; then
+        NIX_CFLAGS_LINK_@suffixSalt@+=" $NIX_CXXSTDLIB_LINK_@suffixSalt@"
+    fi
+fi
+
+source $cc_wrapper/nix-support/add-hardening.sh
+
+# Add the flags for the C compiler proper.
+addCFlagsToList() {
+    declare -n list="$1"
+    shift
+
+    for ((i = 1; i <= $#; i++)); do
+        local val="${!i}"
+        case "$val" in
+            # Pass through using -Xcc, but also convert to Swift -I.
+            # These have slightly different meaning for Clang, but Swift
+            # doesn't have exact equivalents.
+            -isystem | -idirafter)
+                i=$((i + 1))
+                list+=("-Xcc" "$val" "-Xcc" "${!i}" "-I" "${!i}")
+                ;;
+            # Simple rename.
+            -iframework)
+                i=$((i + 1))
+                list+=("-Fsystem" "${!i}")
+                ;;
+            # Pass through verbatim.
+            -I | -Fsystem)
+                i=$((i + 1))
+                list+=("${val}" "${!i}")
+                ;;
+            -I* | -L* | -F*)
+                list+=("${val}")
+                ;;
+            # Pass through using -Xcc.
+            *)
+                list+=("-Xcc" "$val")
+                ;;
+        esac
+    done
+}
+for i in ${NIX_SWIFTFLAGS_COMPILE:-}; do
+    extraAfter+=("$i")
+done
+for i in ${NIX_SWIFTFLAGS_COMPILE_BEFORE:-}; do
+    extraBefore+=("$i")
+done
+addCFlagsToList extraAfter $NIX_CFLAGS_COMPILE_@suffixSalt@
+addCFlagsToList extraBefore ${hardeningCFlags[@]+"${hardeningCFlags[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@
+
+if [ "$dontLink" != 1 ]; then
+
+    # Add the flags that should only be passed to the compiler when
+    # linking.
+    addCFlagsToList extraAfter $(filterRpathFlags "$linkType" $NIX_CFLAGS_LINK_@suffixSalt@)
+
+    # Add the flags that should be passed to the linker (and prevent
+    # `ld-wrapper' from adding NIX_LDFLAGS_@suffixSalt@ again).
+    for i in $(filterRpathFlags "$linkType" $NIX_LDFLAGS_BEFORE_@suffixSalt@); do
+        extraBefore+=("-Xlinker" "$i")
+    done
+    if [[ "$linkType" == dynamic && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
+        extraBefore+=("-Xlinker" "-dynamic-linker=$NIX_DYNAMIC_LINKER_@suffixSalt@")
+    fi
+    for i in $(filterRpathFlags "$linkType" $NIX_LDFLAGS_@suffixSalt@); do
+        if [ "${i:0:3}" = -L/ ]; then
+            extraAfter+=("$i")
+        else
+            extraAfter+=("-Xlinker" "$i")
+        fi
+    done
+    export NIX_LINK_TYPE_@suffixSalt@=$linkType
+fi
+
+# TODO: If we ever need to expand functionality of this hook, it may no longer
+# be compatible with Swift. Right now, it is only used on Darwin to force
+# -target, which also happens to work with Swift.
+if [[ -e $cc_wrapper/nix-support/add-local-cc-cflags-before.sh ]]; then
+    source $cc_wrapper/nix-support/add-local-cc-cflags-before.sh
+fi
+
+# May need to transform the triple injected by the above.
+for ((i = 1; i < ${#extraBefore[@]}; i++)); do
+    if [[ "${extraBefore[i]}" = -target ]]; then
+        i=$((i + 1))
+        # On Darwin only, need to change 'aarch64' to 'arm64'.
+        extraBefore[i]="${extraBefore[i]/aarch64-apple-/arm64-apple-}"
+        # On Darwin, Swift requires the triple to be annotated with a version.
+        # TODO: Assumes macOS.
+        extraBefore[i]="${extraBefore[i]/-apple-darwin/-apple-macosx${MACOSX_DEPLOYMENT_TARGET:-11.0}}"
+        break
+    fi
+done
+
+# As a very special hack, if the arguments are just `-v', then don't
+# add anything.  This is to prevent `gcc -v' (which normally prints
+# out the version number and returns exit code 0) from printing out
+# `No input files specified' and returning exit code 1.
+if [ "$*" = -v ]; then
+    extraAfter=()
+    extraBefore=()
+fi
+
+# Optionally print debug info.
+if (( "${NIX_DEBUG:-0}" >= 1 )); then
+    # Old bash workaround, see ld-wrapper for explanation.
+    echo "extra flags before to $prog:" >&2
+    printf "  %q\n" ${extraBefore+"${extraBefore[@]}"}  >&2
+    echo "original flags to $prog:" >&2
+    printf "  %q\n" ${params+"${params[@]}"} >&2
+    echo "extra flags after to $prog:" >&2
+    printf "  %q\n" ${extraAfter+"${extraAfter[@]}"} >&2
+fi
+
+PATH="$path_backup"
+# Old bash workaround, see above.
+
+if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
+    exec "$prog" @<(printf "%q\n" \
+       ${extraBefore+"${extraBefore[@]}"} \
+       ${params+"${params[@]}"} \
+       ${extraAfter+"${extraAfter[@]}"})
+else
+    exec "$prog" \
+       ${extraBefore+"${extraBefore[@]}"} \
+       ${params+"${params[@]}"} \
+       ${extraAfter+"${extraAfter[@]}"}
+fi
diff --git a/pkgs/development/compilers/swift/xctest/default.nix b/pkgs/development/compilers/swift/xctest/default.nix
new file mode 100644
index 0000000000000..c8003d8486f10
--- /dev/null
+++ b/pkgs/development/compilers/swift/xctest/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, stdenv
+, callPackage
+, cmake
+, ninja
+, swift
+, Foundation
+, DarwinTools
+}:
+
+let
+  sources = callPackage ../sources.nix { };
+in stdenv.mkDerivation {
+  pname = "swift-corelibs-xctest";
+
+  inherit (sources) version;
+  src = sources.swift-corelibs-xctest;
+
+  outputs = [ "out" ];
+
+  nativeBuildInputs = [ cmake ninja swift ]
+    ++ lib.optional stdenv.isDarwin DarwinTools; # sw_vers
+  buildInputs = [ Foundation ];
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    # On Darwin only, Swift uses arm64 as cpu arch.
+    substituteInPlace cmake/modules/SwiftSupport.cmake \
+      --replace '"aarch64" PARENT_SCOPE' '"arm64" PARENT_SCOPE'
+  '';
+
+  preConfigure = ''
+    # On aarch64-darwin, our minimum target is 11.0, but we can target lower,
+    # and some dependants require a lower target. Harmless on non-Darwin.
+    export MACOSX_DEPLOYMENT_TARGET=10.12
+  '';
+
+  cmakeFlags = lib.optional stdenv.isDarwin "-DUSE_FOUNDATION_FRAMEWORK=ON";
+
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    # Darwin normally uses the Xcode version of XCTest. Installing
+    # swift-corelibs-xctest is probably not officially supported, but we have
+    # no alternative. Fix up the installation here.
+    mv $out/lib/swift/darwin/${swift.swiftArch}/* $out/lib/swift/darwin
+    rmdir $out/lib/swift/darwin/${swift.swiftArch}
+    mv $out/lib/swift/darwin $out/lib/swift/${swift.swiftOs}
+  '';
+
+  meta = {
+    description = "Framework for writing unit tests in Swift";
+    homepage = "https://github.com/apple/swift-corelibs-xctest";
+    platforms = lib.platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/haskell-modules/generic-stack-builder.nix b/pkgs/development/haskell-modules/generic-stack-builder.nix
index 8b3020f886130..eae0337effc07 100644
--- a/pkgs/development/haskell-modules/generic-stack-builder.nix
+++ b/pkgs/development/haskell-modules/generic-stack-builder.nix
@@ -16,7 +16,9 @@ let
 
   # Add all dependencies in buildInputs including propagated ones to
   # STACK_IN_NIX_EXTRA_ARGS.
-  stackHook = makeSetupHook {} ./stack-hook.sh;
+  stackHook = makeSetupHook {
+    name = "stack-hook";
+  } ./stack-hook.sh;
 
 in stdenv.mkDerivation (args // {
 
diff --git a/pkgs/development/interpreters/hashlink/default.nix b/pkgs/development/interpreters/hashlink/default.nix
index e24742ac136e2..dc5f153c5ee1c 100644
--- a/pkgs/development/interpreters/hashlink/default.nix
+++ b/pkgs/development/interpreters/hashlink/default.nix
@@ -17,17 +17,15 @@
 
 stdenv.mkDerivation rec {
   pname = "hashlink";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchFromGitHub {
     owner = "HaxeFoundation";
     repo = "hashlink";
     rev = version;
-    sha256 = "AiUGhTxz4Pkrks4oE+SAuAQPMuC5T2B6jo3Jd3sNrkQ=";
+    sha256 = "lpHW0JWxbLtOBns3By56ZBn47CZsDzwOFBuW9MlERrE=";
   };
 
-  patches = [ ./hashlink.patch ];
-
   makeFlags = [ "PREFIX=$(out)" ];
 
   buildInputs = [
diff --git a/pkgs/development/interpreters/hashlink/hashlink.patch b/pkgs/development/interpreters/hashlink/hashlink.patch
deleted file mode 100644
index 20d4eedd5a8a3..0000000000000
--- a/pkgs/development/interpreters/hashlink/hashlink.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- a/Makefile
-+++ b/Makefile
-@@ -107,6 +107,7 @@ LIBFLAGS += -L/opt/libjpeg-turbo/lib64
- endif
- 
- LIBOPENAL = -lopenal
-+LIBOPENGL = -lGL
- RELEASE_NAME = linux
- 
- endif
---- a/libs/sdl/gl.c
-+++ b/libs/sdl/gl.c
-@@ -7,7 +7,7 @@
- #	include <OpenGLES/ES3/gl.h>

- #	define HL_GLES

- #elif defined(HL_MAC)

--#	include <SDL.h>

-+#	include <SDL2/SDL.h>

- #	include <OpenGL/gl3.h>

- #	define glBindImageTexture(...) hl_error("Not supported on OSX")

- #	define glDispatchCompute(...) hl_error("Not supported on OSX")

---- a/libs/sdl/sdl.c
-+++ b/libs/sdl/sdl.c
-@@ -7,7 +7,7 @@
- #	include <SDL.h>

- #	include <SDL_syswm.h>

- #elif defined(HL_MAC)

--#	include <SDL.h>

-+#	include <SDL2/SDL.h>

- #else

- #	include <SDL2/SDL.h>

- #endif

diff --git a/pkgs/development/interpreters/lua-5/wrap-lua.nix b/pkgs/development/interpreters/lua-5/wrap-lua.nix
index 049afcd6116d9..c9ef151bea3c3 100644
--- a/pkgs/development/interpreters/lua-5/wrap-lua.nix
+++ b/pkgs/development/interpreters/lua-5/wrap-lua.nix
@@ -7,10 +7,10 @@
 # defined in trivial-builders.nix
 # imported as wrapLua in lua-packages.nix and passed to build-lua-derivation to be used as buildInput
 makeSetupHook {
+  name = "wrap-lua-hook";
   deps = makeWrapper;
   substitutions.executable = lua.interpreter;
   substitutions.lua = lua;
   substitutions.LuaPathSearchPaths = lib.escapeShellArgs lua.LuaPathSearchPaths;
   substitutions.LuaCPathSearchPaths = lib.escapeShellArgs lua.LuaPathSearchPaths;
 } ./wrap.sh
-
diff --git a/pkgs/development/interpreters/python/wrap-python.nix b/pkgs/development/interpreters/python/wrap-python.nix
index 3b450c0a85bdf..83da013bfd2d9 100644
--- a/pkgs/development/interpreters/python/wrap-python.nix
+++ b/pkgs/development/interpreters/python/wrap-python.nix
@@ -4,6 +4,7 @@
 , makeWrapper }:
 
 makePythonHook {
+      name = "wrap-python-hook";
       deps = makeWrapper;
       substitutions.sitePackages = python.sitePackages;
       substitutions.executable = python.interpreter;
diff --git a/pkgs/development/libraries/ace/default.nix b/pkgs/development/libraries/ace/default.nix
index 3de86d457269f..2e617ef9e0ad1 100644
--- a/pkgs/development/libraries/ace/default.nix
+++ b/pkgs/development/libraries/ace/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ace";
-  version = "7.0.10";
+  version = "7.0.11";
 
   src = fetchurl {
     url = "https://download.dre.vanderbilt.edu/previous_versions/ACE-${version}.tar.bz2";
-    sha256 = "sha256-G3H1MBGseD/G9kigS3r9TrwRk8TYi2KC1CueKhtlNzA=";
+    sha256 = "sha256-r+LRiu/u1qMcbrjkSr8ErnemX6zvhgvc5cLWu8AQhww=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
index a4916eecfe414..f52800e2e70ce 100644
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -12,7 +12,9 @@
   libunwindSupport ? true,
   libunwind,
   pulseaudioSupport ? true,
-  libpulseaudio
+  libpulseaudio,
+  soxSupport ? true,
+  sox
 }:
 
 stdenv.mkDerivation rec {
@@ -35,17 +37,17 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [
     libuv
-    libunwind
-    openfec
-    libpulseaudio
     speexdsp
-  ];
+  ] ++ lib.optional openfecSupport openfec
+    ++ lib.optional libunwindSupport libunwind
+    ++ lib.optional pulseaudioSupport libpulseaudio
+    ++ lib.optional soxSupport sox;
 
   sconsFlags =
     [ "--build=${stdenv.buildPlatform.config}"
       "--host=${stdenv.hostPlatform.config}"
-      "--prefix=${placeholder "out"}"
-      "--disable-sox" ] ++
+      "--prefix=${placeholder "out"}" ] ++
+    lib.optional (!soxSupport) "--disable-sox" ++
     lib.optional (!libunwindSupport) "--disable-libunwind" ++
     lib.optional (!pulseaudioSupport) "--disable-pulseaudio" ++
     (if (!openfecSupport)
diff --git a/pkgs/development/libraries/catch2/3.nix b/pkgs/development/libraries/catch2/3.nix
index 2d050adcc5b8a..853b1d7d59c68 100644
--- a/pkgs/development/libraries/catch2/3.nix
+++ b/pkgs/development/libraries/catch2/3.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.2.1";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    hash = "sha256-e5S3K0kYCB6nVZDi/DVKzMvrVk6IgXC2g7217sr8xUo=";
+    hash = "sha256-f/tM8b2JGZw2OzhlhMvjzLjgvgj5qncEepYsEwSxeAI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/directx-headers/default.nix b/pkgs/development/libraries/directx-headers/default.nix
new file mode 100644
index 0000000000000..3ac15bb85e248
--- /dev/null
+++ b/pkgs/development/libraries/directx-headers/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, meson, ninja }:
+stdenv.mkDerivation rec {
+  pname = "directx-headers";
+  version = "1.608.2";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "DirectX-Headers";
+    rev = "v${version}";
+    hash = "sha256-F0riTDJpydqe4yhE9GKSSvnRI0Sl3oY2sOP+H/vDHG0=";
+  };
+
+  nativeBuildInputs = [ meson ninja ];
+
+  # tests require WSL2
+  mesonFlags = [ "-Dbuild-test=false" ];
+
+  meta = with lib; {
+    description = "Official D3D12 headers from Microsoft";
+    homepage = "https://github.com/microsoft/DirectX-Headers";
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 87d3285e64bc2..5e44d2221f2ab 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -62,8 +62,6 @@ stdenv.mkDerivation rec {
     fixDarwinDylibNames
   ];
 
-  buildInputs = [ gobject-introspection ];
-
   propagatedBuildInputs = [
     glib
     libtiff
diff --git a/pkgs/development/libraries/giflib/default.nix b/pkgs/development/libraries/giflib/default.nix
index 795aeb88440e4..5202dc0edabc4 100644
--- a/pkgs/development/libraries/giflib/default.nix
+++ b/pkgs/development/libraries/giflib/default.nix
@@ -8,7 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "1gbrg03z1b6rlrvjyc6d41bc8j1bsr7rm8206gb1apscyii5bnii";
   };
 
-  patches = lib.optional stdenv.hostPlatform.isDarwin
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-28506.patch";
+      url = "https://src.fedoraproject.org/rpms/giflib/raw/2e9917bf13df114354163f0c0211eccc00943596/f/CVE-2022-28506.patch";
+      sha256 = "sha256-TBemEXkuox8FdS9RvjnWcTWPaHRo4crcwSR9czrUwBY=";
+    })
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin
     (fetchpatch {
       # https://sourceforge.net/p/giflib/bugs/133/
       name = "darwin-soname.patch";
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 2d7e6614cecc9..9193404d01235 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -76,11 +76,19 @@ in
     # - clang-wrapper in cross-compilation
     # Last attempt: https://github.com/NixOS/nixpkgs/pull/36948
     preInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
-      if [ -f ${stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
+      if [ -f ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
           mkdir -p $out/lib
-          cp ${stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
+          cp ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
           # the .so It used to be a symlink, but now it is a script
-          cp -a ${stdenv.cc.cc}/lib/libgcc_s.so $out/lib/libgcc_s.so
+          cp -a ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so $out/lib/libgcc_s.so
+          # wipe out reference to previous libc it was built against
+          chmod +w $out/lib/libgcc_s.so.1
+          # rely on default RUNPATHs of the binary and other libraries
+          # Do no force-pull wrong glibc.
+          patchelf --remove-rpath $out/lib/libgcc_s.so.1
+          # 'patchelf' does not remove the string itself. Wipe out
+          # string reference to avoid possible link to bootstrapTools
+          ${buildPackages.nukeReferences}/bin/nuke-refs $out/lib/libgcc_s.so.1
       fi
     '';
 
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 112158a47276d..1533f59b4aec8 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -2,7 +2,6 @@
 , stdenv
 , substituteAll
 , fetchurl
-, fetchpatch2
 , pkg-config
 , gettext
 , docbook-xsl-nons
@@ -61,7 +60,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.35";
+  version = "3.24.36";
 
   outputs = [ "out" "dev" ] ++ lib.optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -73,22 +72,12 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-7BD+bXEu8LPGO1+TJjnJ0a6Z/OlPUA9vBpZWKf72C9E=";
+    sha256 = "sha256-J6bvFXdDNQyAf/6lm6odcCJtvt6CpelT/9WOpgWf5pE=";
   };
 
   patches = [
     ./patches/3.0-immodules.cache.patch
     ./patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
-
-    # Add accidentally non-dist’d build file.
-    # https://gitlab.gnome.org/GNOME/gtk/-/commit/b2ad8d2abafbd94c7e58e5e1b98c92e6b6fa6d9a
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/66a199806ceb3daa5e2c7d3a5b45a86007cec46a.patch";
-      includes = [
-        "gdk/wayland/cursor/meson.build"
-      ];
-      sha256 = "cOOcSB3yphff2+7l7YpFbGSswWjV8lJ2tk+Vjgl1ras=";
-    })
   ] ++ lib.optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it
@@ -121,7 +110,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     libxkbcommon
     (libepoxy.override { inherit x11Support; })
     isocodes
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 9da8e8837bc1d..782823cd67483 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     docbook_xml_dtd_43
   ];
 
-  buildInputs = [ glib freetype gobject-introspection ]
+  buildInputs = [ glib freetype ]
     ++ lib.optionals withCoreText [ ApplicationServices CoreText ];
 
   propagatedBuildInputs = lib.optional withGraphite2 graphite2
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index 9885384e00e19..efac3690851e8 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -49,8 +49,6 @@ stdenv.mkDerivation rec {
     fixDarwinDylibNames
   ];
 
-  buildInputs = [ gobject-introspection ];
-
   propagatedBuildInputs = [
     glib
   ];
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 7a7edc5b122e1..7abbd944ed014 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -1,22 +1,50 @@
-{ lib, stdenv, fetchFromGitHub, cmake, cmocka }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, cmocka
 
-stdenv.mkDerivation rec {
+# for passthru.tests
+, libfido2
+, mysql80
+, openssh
+, systemd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "PJK";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-Wp/48yQA17mf/dTgeMcMDvPpKOPkfLhQkCnzgGLpLtk=";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-YJSIZ7o191/0QJf1fH6LUYykS2pvP17knSeRO2WcDeM=";
   };
 
   nativeBuildInputs = [ cmake ];
-  nativeCheckInputs = [ cmocka ];
 
-  doCheck = false; # needs "-DWITH_TESTS=ON", but fails w/compilation error
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DBUILD_SHARED_LIBS=on"
+  ] ++ lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON";
 
-  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" "-DBUILD_SHARED_LIBS=on" ];
+  # 2 tests are not 32-bit clean: overflow size_t:
+  #   https://github.com/PJK/libcbor/issues/263
+  doCheck =
+    !stdenv.hostPlatform.is32bit
+    && (!stdenv.hostPlatform.isStatic)
+    && stdenv.hostPlatform == stdenv.buildPlatform;
+  nativeCheckInputs = [ cmocka ];
+
+  passthru.tests = {
+    inherit libfido2 mysql80;
+    openssh = (openssh.override { withFIDO = true; });
+    systemd = (systemd.override {
+      withFido2 = true;
+      withCryptsetup = true;
+    });
+  };
 
   meta = with lib; {
     description = "CBOR protocol implementation for C and others";
@@ -24,4 +52,4 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ dtzWill ];
   };
-}
+})
diff --git a/pkgs/development/libraries/libclc/default.nix b/pkgs/development/libraries/libclc/default.nix
index 14a20a9579677..647079ae2fb42 100644
--- a/pkgs/development/libraries/libclc/default.nix
+++ b/pkgs/development/libraries/libclc/default.nix
@@ -7,13 +7,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libclc";
-  version = "14.0.6";
+  version = "15.0.7";
 
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "llvm-project";
     rev = "llvmorg-${version}";
-    sha256 = "sha256-vffu4HilvYwtzwgq+NlS26m65DGbp6OSSne2aje1yJE=";
+    sha256 = "sha256-wjuZQyXQ/jsmvy6y1aksCcEDXGBjuhpgngF3XQJ/T4s=";
   };
   sourceRoot = "source/libclc";
 
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 16ea50f6dd9a7..7d8b1c95698a1 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.106.0";
+  version = "1.107.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = version;
-    hash = "sha256-S53ghVFb1qDI7MVNbc2ZlHqDN4VRBFQJCJg2J+w0erc=";
+    hash = "sha256-fjiS7GZy1BLgmxu4LFOWgucORcVx+9KleQcga+hRkSY=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-k4j814Ao7FAyd0w1nH2fuX1cJKjBkhPw0CVZqNU7Hqs=";
+    hash = "sha256-7XhSI/C0GEmsaL0UupvufB1bfPGbzSQJH720Y4/Do3o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libgit2/default.nix b/pkgs/development/libraries/libgit2/default.nix
index 35b3fef3087d6..e6808b47ab096 100644
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libgit2";
-  version = "1.5.0";
+  version = "1.5.1";
   # also check the following packages for updates: python3.pkgs.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "sha256-lXFQo+tt56BFoPgdkTfz6WdIngeotTm+8cAGcBP6XqY=";
+    sha256 = "sha256-KzBMwpqn6wUFhgB3KDclBS0BvZSVcasM5AG/y+L91xM=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 1c03973fff96b..700223cd1a79e 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -34,6 +34,15 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # present in master
+    (fetchpatch {
+      name = "fix-test-failure-on-ia64-ppc64-riscv64";
+      url = "https://github.com/libjxl/libjxl/commit/bb8eac5d6acec223e44cf8cc72ae02f0816de311.patch";
+      hash = "sha256-DuUCStWEquhWo7bOss0RgZ7ouYE4FpWrIMFywYR424s=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     gtest
diff --git a/pkgs/development/libraries/libmpc/default.nix b/pkgs/development/libraries/libmpc/default.nix
index 8421a25030704..481f12e17526f 100644
--- a/pkgs/development/libraries/libmpc/default.nix
+++ b/pkgs/development/libraries/libmpc/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmpc";
-  version = "1.2.1"; # to avoid clash with the MPD client
+  version = "1.3.1"; # to avoid clash with the MPD client
 
   src = fetchurl {
     url = "mirror://gnu/mpc/mpc-${version}.tar.gz";
-    sha256 = "0n846hqfqvmsmim7qdlms0qr86f1hck19p12nq3g3z2x74n3sl0p";
+    sha256 = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/liboqs/default.nix b/pkgs/development/libraries/liboqs/default.nix
new file mode 100644
index 0000000000000..908554a679dfc
--- /dev/null
+++ b/pkgs/development/libraries/liboqs/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, openssl
+, enableStatic ? stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation rec {
+  pname = "liboqs";
+  version = "0.7.2";
+
+  src = fetchFromGitHub {
+    owner = "open-quantum-safe";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-cwrTHj/WFDZ9Ez2FhjpRhEx9aC5xBnh7HR/9T+zUpZc=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ openssl ];
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if enableStatic then "OFF" else "ON"}"
+    "-DOQS_DIST_BUILD=ON"
+    "-DOQS_BUILD_ONLY_LIB=ON"
+  ];
+
+  dontFixCmake = true; # fix CMake file will give an error
+
+  meta = with lib; {
+    description = "C library for prototyping and experimenting with quantum-resistant cryptography";
+    homepage = "https://openquantumsafe.org";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ candyc1oud ];
+  };
+}
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index df753b55b08c1..91b4a42d54edc 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     sqlite
     libpsl
     glib.out
diff --git a/pkgs/development/libraries/libtheora/default.nix b/pkgs/development/libraries/libtheora/default.nix
index 1e88218aa0d40..0e0030558dba6 100644
--- a/pkgs/development/libraries/libtheora/default.nix
+++ b/pkgs/development/libraries/libtheora/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  configureFlags = [ "--disable-examples" ];
+
   outputs = [ "out" "dev" "devdoc" ];
   outputDoc = "devdoc";
 
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index bad8e14d59e40..9f958efe71b34 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "sha256-HTwJQpDND4PjiNpUjHtTgkQdkahm2BUe71UDRQpvo6M=";
+    sha256 = "sha256-Vw62xgWzaaWKQWIZDYpVpOgEUQGUNToImEAo6lwiFFU=";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 13ad9eb29c2ea..dff7abc7dd530 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libwebp";
-  version = "1.2.4";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner  = "webmproject";
     repo   = pname;
     rev    = "v${version}";
-    hash   = "sha256-XX6qOWlIl8TqOQMiGpmmDVKwQnM1taG6lrqq1ZFVk5s=";
+    hash   = "sha256-nhXkq+qKpaa75YQB/W/cRozslTIFPdXeqj1y6emQeHk=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libxkbcommon/default.nix b/pkgs/development/libraries/libxkbcommon/default.nix
index 2d624256eabd7..ed936a9d0377b 100644
--- a/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/pkgs/development/libraries/libxkbcommon/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libxkbcommon";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://xkbcommon.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0fbb2dyjvf71p42y2jmwdcylsvj03w52f5rb23c2d00rwahhfg4l";
+    sha256 = "sha256-Vg8RxLu8oQ9JXz7306aqTKYrT4+wtS59RZ0Yom5G4Bc=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index a79c19eb2ebc7..56fa74e5c0c51 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -6,11 +6,58 @@
 , libelf, libvdpau
 , libglvnd, libunwind
 , vulkan-loader, glslang
-, galliumDrivers ? ["auto"]
-# upstream Mesa defaults to only enabling swrast (aka lavapipe) on aarch64 for some reason, so force building the others
-, vulkanDrivers ? if (stdenv.isLinux && stdenv.isAarch64) then [ "swrast" "broadcom" "freedreno" "panfrost" ] else [ "auto" ]
+, galliumDrivers ?
+  if stdenv.isLinux then
+    [
+      "d3d12" # WSL emulated GPU (aka Dozen)
+      "kmsro" # helper driver for display-only devices
+      "nouveau" # Nvidia
+      "radeonsi" # new AMD (GCN+)
+      "r300" # very old AMD
+      "r600" # less old AMD
+      "swrast" # software renderer (aka LLVMPipe)
+      "svga" # VMWare virtualized GPU
+      "virgl" # QEMU virtualized GPU (aka VirGL)
+      "zink" # generic OpenGL over Vulkan, experimental
+    ]
+    ++ lib.optionals stdenv.isAarch64 [
+      "etnaviv" # Vivante GPU designs (mostly NXP/Marvell SoCs)
+      "freedreno" # Qualcomm Adreno (all Qualcomm SoCs)
+      "lima" # ARM Mali 4xx
+      "panfrost" # ARM Mali Midgard and up (T/G series)
+      "tegra" # Nvidia Tegra SoCs
+      "v3d" # Broadcom VC5 (Raspberry Pi 4)
+      "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
+    ] ++ lib.optionals stdenv.isx86_64 [
+      "iris" # new Intel, could work on non-x86_64 with PCIe cards, but doesn't build as of 22.3.4
+      "crocus" # Intel legacy, x86_64 only
+    ]
+  else [ "auto" ]
+, vulkanDrivers ?
+  if stdenv.isLinux then
+    [
+      "amd" # AMD (aka RADV)
+      "microsoft-experimental" # WSL virtualized GPU (aka DZN/Dozen)
+      "swrast" # software renderer (aka Lavapipe)
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") [
+      # QEMU virtualized GPU (aka VirGL)
+      # Requires ATOMIC_INT_LOCK_FREE == 2.
+      "virtio-experimental"
+    ]
+    ++ lib.optionals stdenv.isAarch64 [
+      "broadcom" # Broadcom VC5 (Raspberry Pi 4, aka V3D)
+      "freedreno" # Qualcomm Adreno (all Qualcomm SoCs)
+      "imagination-experimental" # PowerVR Rogue (currently N/A)
+      "panfrost" # ARM Mali Midgard and up (T/G series)
+    ]
+    ++ lib.optionals stdenv.isx86_64 [
+      "intel" # Intel (aka ANV), could work on non-x86_64 with PCIe cards, but doesn't build as of 22.3.4
+      "intel_hasvk" # Intel Haswell/Broadwell, experimental, x86_64 only
+    ]
+  else [ "auto" ]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
-, vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ "device-select" "overlay" ] # No Vulkan support on Darwin
+, vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ "device-select" "overlay" "intel-nullhw" ] # No Vulkan support on Darwin
 , OpenGL, Xplugin
 , withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light && !valgrind-light.meta.broken, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
@@ -19,10 +66,12 @@
 , enablePatentEncumberedCodecs ? true
 , libclc
 , jdupes
-, cmake
 , rustc
 , rust-bindgen
-, spirv-llvm-translator_14
+, spirv-llvm-translator
+, zstd
+, directx-headers
+, udev
 }:
 
 /** Packaging design:
@@ -39,17 +88,26 @@
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.3.3";
+  version = "22.3.4";
   branch  = lib.versions.major version;
 
   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
 
+  # Align all the Mesa versions used. Required to prevent explosions when
+  # two different LLVMs are loaded in the same process.
+  # FIXME: these should really go into some sort of versioned LLVM package set
   rust-bindgen' = rust-bindgen.override {
     rust-bindgen-unwrapped = rust-bindgen.unwrapped.override {
       clang = llvmPackages.clang;
     };
   };
+  spirv-llvm-translator' = spirv-llvm-translator.override {
+    inherit (llvmPackages) llvm;
+  };
 
+  haveWayland = lib.elem "wayland" eglPlatforms;
+  haveZink = lib.elem "zink" galliumDrivers;
+  haveDozen = (lib.elem "d3d12" galliumDrivers) || (lib.elem "microsoft-experimental" vulkanDrivers);
 self = stdenv.mkDerivation {
   pname = "mesa";
   inherit version;
@@ -62,7 +120,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "sha256-vteZeIvyvZ7wedl82OCTSL9TywhoGFeOQHc7KxeBKSI=";
+    sha256 = "37a1ddaf03f41919ee3c89c97cff41e87de96e00e9d3247959cc8279d8294593";
   };
 
   # TODO:
@@ -91,7 +149,11 @@ self = stdenv.mkDerivation {
   outputs = [ "out" "dev" "drivers" ]
     ++ lib.optional enableOSMesa "osmesa"
     ++ lib.optional stdenv.isLinux "driversdev"
-    ++ lib.optional enableOpenCL "opencl";
+    ++ lib.optional enableOpenCL "opencl"
+    # the Dozen drivers depend on libspirv2dxil, but link it statically, and
+    # libspirv2dxil itself is pretty chonky, so relocate it to its own output
+    # in case anything wants to use it at some point
+    ++ lib.optional haveDozen "spirv2dxil";
 
   # FIXME: this fixes rusticl/iris segfaulting on startup, _somehow_.
   # Needs more investigating.
@@ -122,6 +184,7 @@ self = stdenv.mkDerivation {
     "-Domx-libs-path=${placeholder "drivers"}/lib/bellagio"
     "-Dva-libs-path=${placeholder "drivers"}/lib/dri"
     "-Dd3d-drivers-path=${placeholder "drivers"}/lib/d3d"
+
     "-Dgallium-nine=${lib.boolToString enableGalliumNine}" # Direct3D in Wine
     "-Dosmesa=${lib.boolToString enableOSMesa}" # used by wine
     "-Dmicrosoft-clc=disabled" # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
@@ -130,8 +193,15 @@ self = stdenv.mkDerivation {
     "-Dgbm-backends-path=${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm"
   ] ++ lib.optionals stdenv.isLinux [
     "-Dglvnd=true"
+
+    # Enable RT for Intel hardware
+    "-Dintel-clc=enabled"
   ] ++ lib.optionals enableOpenCL [
-    "-Dgallium-opencl=icd" # Enable the gallium OpenCL frontend
+    # Clover, old OpenCL frontend
+    "-Dgallium-opencl=icd"
+    "-Dopencl-spirv=true"
+
+    # Rusticl, new OpenCL frontend
     "-Dgallium-rusticl=true" "-Drust_std=2021"
     "-Dclang-libdir=${llvmPackages.clang-unwrapped.lib}/lib"
   ] ++ lib.optional enablePatentEncumberedCodecs
@@ -143,24 +213,23 @@ self = stdenv.mkDerivation {
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
     libffi libvdpau libelf libXvMC
     libpthreadstubs openssl /*or another sha1 provider*/
-  ] ++ lib.optionals (lib.elem "wayland" eglPlatforms) [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ]
+    zstd
+  ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
+    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev ]
     ++ lib.optionals stdenv.isDarwin [ libunwind ]
-    ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator_14 ]
+    ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator' ]
     ++ lib.optional withValgrind valgrind-light
-    # Mesa will not build zink when gallium-drivers=auto
-    ++ lib.optional (lib.elem "zink" galliumDrivers) vulkan-loader;
+    ++ lib.optional haveZink vulkan-loader
+    ++ lib.optional haveDozen directx-headers;
 
   depsBuildBuild = [ pkg-config ];
 
   nativeBuildInputs = [
     meson pkg-config ninja
     intltool bison flex file
-    python3Packages.python python3Packages.Mako
+    python3Packages.python python3Packages.Mako python3Packages.ply
     jdupes glslang
-  ] ++ lib.optionals (lib.elem "wayland" eglPlatforms) [
-    wayland-scanner
-  ];
+  ] ++ lib.optional haveWayland wayland-scanner;
 
   propagatedBuildInputs = with xorg; [
     libXdamage libXxf86vm
@@ -217,6 +286,10 @@ self = stdenv.mkDerivation {
     for js in $drivers/share/vulkan/{im,ex}plicit_layer.d/*.json; do
       substituteInPlace "$js" --replace '"libVkLayer_' '"'"$drivers/lib/libVkLayer_"
     done
+  '' + lib.optionalString haveDozen ''
+    mkdir -p $spirv2dxil/{bin,lib}
+    mv -t $spirv2dxil/lib $out/lib/libspirv_to_dxil*
+    mv -t $spirv2dxil/bin $out/bin/spirv2dxil
   '';
 
   postFixup = lib.optionalString stdenv.isLinux ''
@@ -253,6 +326,10 @@ self = stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [ "-fno-common" ] ++ lib.optionals enableOpenCL [
     "-UPIPE_SEARCH_DIR"
     "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
+
+    # Work around regression from https://github.com/NixOS/nixpkgs/pull/210004
+    # TODO(trofi): remove
+    "--sysroot=/"
   ];
 
   passthru = {
diff --git a/pkgs/development/libraries/mesa/opencl.patch b/pkgs/development/libraries/mesa/opencl.patch
index 02558aaa825dc..fb4da5cf7a0aa 100644
--- a/pkgs/development/libraries/mesa/opencl.patch
+++ b/pkgs/development/libraries/mesa/opencl.patch
@@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index e32338b3f9a..fae804fd41e 100644
+index 172c64a7c70..05961e56926 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1894,7 +1894,7 @@ endif
+@@ -1900,7 +1900,7 @@ endif
  
  dep_clang = null_dep
  if with_clc
@@ -29,51 +29,20 @@ index 6f307018815..ab84eb1006c 100644
    'platforms',
    type : 'array',
 diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
-index 7af210b5693..ff6ac8c61ca 100644
+index db3586bd7fb..4d914206d21 100644
 --- a/src/gallium/targets/opencl/meson.build
 +++ b/src/gallium/targets/opencl/meson.build
-@@ -30,6 +30,7 @@ if with_ld_version_script
+@@ -39,7 +39,8 @@ if dep_llvm.version().version_compare('>=10.0.0')
+   polly_isl_dep = cpp.find_library('PollyISL', dirs : llvm_libdir, required : false)
  endif
  
- llvm_libdir = dep_llvm.get_variable(cmake : 'LLVM_LIBRARY_DIR', configtool: 'libdir')
+-dep_clang = cpp.find_library('clang-cpp', dirs : llvm_libdir, required : false)
 +clang_libdir = get_option('clang-libdir')
- opencl_libname = with_opencl_icd ? 'MesaOpenCL' : 'OpenCL'
++dep_clang = cpp.find_library('clang-cpp', dirs : clang_libdir, required : false)
  
- polly_dep = null_dep
-@@ -60,19 +61,19 @@ else
- endif
- if not _shared_llvm or not (dep_clang.found() and dep_clang_usable)
-   dep_clang = [
--    cpp.find_library('clangCodeGen', dirs : llvm_libdir),
--    cpp.find_library('clangFrontendTool', dirs : llvm_libdir),
--    cpp.find_library('clangFrontend', dirs : llvm_libdir),
--    cpp.find_library('clangDriver', dirs : llvm_libdir),
--    cpp.find_library('clangSerialization', dirs : llvm_libdir),
--    cpp.find_library('clangParse', dirs : llvm_libdir),
--    cpp.find_library('clangSema', dirs : llvm_libdir),
--    cpp.find_library('clangAnalysis', dirs : llvm_libdir),
--    cpp.find_library('clangAST', dirs : llvm_libdir),
--    cpp.find_library('clangASTMatchers', dirs : llvm_libdir),
--    cpp.find_library('clangEdit', dirs : llvm_libdir),
--    cpp.find_library('clangLex', dirs : llvm_libdir),
--    cpp.find_library('clangBasic', dirs : llvm_libdir),
-+    cpp.find_library('clangCodeGen', dirs : clang_libdir),
-+    cpp.find_library('clangFrontendTool', dirs : clang_libdir),
-+    cpp.find_library('clangFrontend', dirs : clang_libdir),
-+    cpp.find_library('clangDriver', dirs : clang_libdir),
-+    cpp.find_library('clangSerialization', dirs : clang_libdir),
-+    cpp.find_library('clangParse', dirs : clang_libdir),
-+    cpp.find_library('clangSema', dirs : clang_libdir),
-+    cpp.find_library('clangAnalysis', dirs : clang_libdir),
-+    cpp.find_library('clangAST', dirs : clang_libdir),
-+    cpp.find_library('clangASTMatchers', dirs : clang_libdir),
-+    cpp.find_library('clangEdit', dirs : clang_libdir),
-+    cpp.find_library('clangLex', dirs : clang_libdir),
-+    cpp.find_library('clangBasic', dirs : clang_libdir),
-     polly_dep, polly_isl_dep,
-   ]
-   # check clang once more
-@@ -119,7 +120,7 @@ if with_opencl_icd
+ # meson will return clang-cpp from system dirs if it's not found in llvm_libdir
+ linker_rpath_arg = '-Wl,--rpath=@0@'.format(llvm_libdir)
+@@ -123,7 +124,7 @@ if with_opencl_icd
      configuration : _config,
      input : 'mesa.icd.in',
      output : 'mesa.icd',
diff --git a/pkgs/development/libraries/mpfr/default.nix b/pkgs/development/libraries/mpfr/default.nix
index 7d9e94c6f909e..e0a33e27c12c0 100644
--- a/pkgs/development/libraries/mpfr/default.nix
+++ b/pkgs/development/libraries/mpfr/default.nix
@@ -11,7 +11,7 @@
 # files.
 
 stdenv.mkDerivation rec {
-  version = "4.1.1";
+  version = "4.2.0";
   pname = "mpfr";
 
   src = fetchurl {
@@ -19,16 +19,9 @@ stdenv.mkDerivation rec {
       "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz"
       "mirror://gnu/mpfr/${pname}-${version}.tar.xz"
     ];
-    hash = "sha256-/9GVvVZ9uv/DuYsj/QCq0FN2gMmJYXHkT+P/eeKKwz0=";
+    hash = "sha256-BqN43xNQEkjBsttaqXeiyBJq6Emp2be+JUb7Spwm2ZM=";
   };
 
-  patches = [
-    (fetchurl { # https://gitlab.inria.fr/mpfr/mpfr/-/issues/1
-      url = "https://www.mpfr.org/mpfr-4.1.1/patch01";
-      hash = "sha256-gKPCcJviGsqsEqnMmYiNY6APp3+3VXbyBf6LoZhP9Eo=";
-    })
-  ];
-
   outputs = [ "out" "dev" "doc" "info" ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/mtdev/default.nix b/pkgs/development/libraries/mtdev/default.nix
index 4a510762f7f0f..9e6a45e2975a6 100644
--- a/pkgs/development/libraries/mtdev/default.nix
+++ b/pkgs/development/libraries/mtdev/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, evdev-proto }:
 
 stdenv.mkDerivation rec {
   pname = "mtdev";
@@ -9,8 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1q700h9dqcm3zl6c3gj0qxxjcx6ibw2c51wjijydhwdcm26v5mqm";
   };
 
+  buildInputs = lib.optional stdenv.hostPlatform.isFreeBSD evdev-proto;
+
   meta = with lib; {
-    homepage = "http://bitmath.org/code/mtdev/";
+    homepage = "https://bitmath.org/code/mtdev/";
     description = "Multitouch Protocol Translation Library";
     longDescription = ''
       The mtdev is a stand-alone library which transforms all variants of
@@ -20,6 +22,6 @@ stdenv.mkDerivation rec {
       See the kernel documentation for further details.
     '';
     license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = with platforms; freebsd ++ linux;
   };
 }
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 2cfe41956a4b1..4caf05ef3cfe7 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -11,16 +11,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  ver = "6.3";
-  # We pick fresh intermediate release to get a fix for CVE-2022-29458
-  # which was fixed in 20220416 patchset.
-  patchver = "20220507";
-  version = "${ver}-p${patchver}";
+  version = "6.4";
   pname = "ncurses" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   src = fetchurl {
-    url = "https://invisible-island.net/archives/ncurses/current/ncurses-${ver}-${patchver}.tgz";
-    sha256 = "02y4n4my5qqhw3fdhdjv1zc9xpyglzlzmzjwq2zcwbwv738255ja";
+    url = "https://invisible-island.net/archives/ncurses/ncurses-${version}.tar.gz";
+    hash = "sha256-aTEoPZrIfFBz8wtikMTHXyFjK7T8NgOsgQCBK+0kgVk=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index d267960e36dfe..2fae8135124e1 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -58,7 +58,10 @@ stdenv.mkDerivation rec {
     "--disable-examples"
     (lib.enableFeature enableApp "app")
   ] ++ lib.optionals (enableAsioLib) [ "--enable-asio-lib" "--with-boost-libdir=${boost}/lib" ]
-    ++ lib.optionals (enablePython) [ "--with-cython=${python3Packages.cython}/bin/cython" ];
+    ++ lib.optionals (enablePython) [
+      "--enable-python-bindings"
+      "--with-cython=${python3Packages.cython}/bin/cython"
+    ];
 
   # Unit tests require CUnit and setting TZDIR environment variable
   doCheck = enableTests;
@@ -82,6 +85,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     inherit curl libsoup;
+    python-nghttp2 = python3Packages.nghttp2;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index dda067fd499f2..d6cacc0aa7f70 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OnGzAUfIop/3/0qAAm5rgTlpCdZ/1fwWPJ/KLfGUy8U=";
+    sha256 = "sha256-nUUbGNxr2pGiEoYbArHppNE29rki9SM/3MZWMS9HmqY=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index 2a3b25bc58272..c3f04cf6b15b2 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.2";
-  hash = "sha256-hwcHDI74CgYp2vhQyKspKQ6T/O55f6g/cZvb9z1np4E=";
+  version = "3.79.3";
+  hash = "sha256-8fhrlMe832xWYTYVMnZE7MV20W8sMX+5hHDcAcWYSA4=";
 }
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index 89227b78f2f73..e1b6abc5b253a 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -103,11 +103,14 @@ stdenv.mkDerivation rec {
       runHook postBuild
     '';
 
-  NIX_CFLAGS_COMPILE =
-    "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" "
-    + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1"
-    + lib.optionalString stdenv.hostPlatform.isILP32 " -DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
-  ;
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error"
+    "-DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\""
+  ] ++ lib.optionals stdenv.hostPlatform.is64bit [
+    "-DNSS_USE_64=1"
+  ] ++ lib.optionals stdenv.hostPlatform.isILP32 [
+    "-DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
+  ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index e6d9a6d7b89dc..662437659147c 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     fribidi
     libthai
-    gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     ApplicationServices
     Carbon
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 1126d808642f3..8da35364e2b83 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPackages
 , fetchFromGitLab
+, fetchpatch
 , python3
 , meson
 , ninja
@@ -67,7 +68,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.64";
+    version = "0.3.65";
 
     outputs = [
       "out"
@@ -85,7 +86,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-wIvdciLBWIQjENEipzbVID0eliOcEwqS567pLxVVOsc=";
+      sha256 = "sha256-O5nu58QFlOPTaN4qNi50Wp9acxM6dWNy63BD+AnVl5w=";
     };
 
     patches = [
@@ -101,6 +102,13 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
+
+      # backport a fix to actually install the new module
+      # FIXME: remove after 0.3.66
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/fba7083f8ceb210c7c20aceafeb5c9a8767cf705.patch";
+        hash = "sha256-aZQ4OzK0B5YPq+jQNygxPE0coG2qB0ukbYzyI8E24XM=";
+      })
     ];
 
     nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qca-qt5/default.nix b/pkgs/development/libraries/qca-qt5/default.nix
index d10ebbdd4b772..67d916dd14ee4 100644
--- a/pkgs/development/libraries/qca-qt5/default.nix
+++ b/pkgs/development/libraries/qca-qt5/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qca-qt5";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchurl {
     url = "http://download.kde.org/stable/qca/${version}/qca-${version}.tar.xz";
-    sha256 = "sha256-a2lYgafj/ZX3Oq7m6uq5b2rRflFenCs9SzJy14Yv9cQ=";
+    sha256 = "sha256-kffZFqs2kr9ZkfClU7+BUxYb/doUvQBdSAorTjhDYug=";
   };
 
   buildInputs = [ openssl qtbase ];
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 0e1e2bbe66a75..2829bb0be0278 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -204,6 +204,7 @@ let
         ++ lib.optional (stdenv.isDarwin) qtmacextras);
 
       qmake = makeSetupHook {
+        name = "qmake-hook";
         deps = [ self.qtbase.dev ];
         substitutions = {
           inherit debug;
@@ -212,6 +213,7 @@ let
       } ../hooks/qmake-hook.sh;
 
       wrapQtAppsHook = makeSetupHook {
+        name = "wrap-qt5-apps-hook";
         deps = [ self.qtbase.dev buildPackages.makeWrapper ]
           ++ lib.optional stdenv.isLinux self.qtwayland.dev;
       } ../hooks/wrap-qt-apps-hook.sh;
diff --git a/pkgs/development/libraries/qt-5/5.15/fetch.sh b/pkgs/development/libraries/qt-5/5.15/fetch.sh
index dcada3649078b..7225b432c574c 100755
--- a/pkgs/development/libraries/qt-5/5.15/fetch.sh
+++ b/pkgs/development/libraries/qt-5/5.15/fetch.sh
@@ -10,7 +10,7 @@ srcs="${here}/srcs-generated.json"
 while read -r module; do
     if [[ -z "$module" ]]; then continue; fi
     url="https://invent.kde.org/qt/qt/${module}.git"
-    nix-prefetch-git --url $url --rev refs/heads/kde/5.15 \
+    nix-prefetch-git --url $url --rev refs/heads/kde/5.15 --fetch-submodules \
         | jq "{key: \"${module}\", value: {url,rev,sha256}}"
 done < "$modules" | jq -s 'from_entries' > "${srcs}.tmp"
 
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 229bfabbece2c..3f6c616c39487 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -2,7 +2,7 @@
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
     "rev": "c3c7e6ebc29cce466d954f72f340a257d76b5ec2",
-    "sha256": "0lh05j21acs8wz72g4cs092m1yglpbjkhh55ww1351fjrp5gbzrg"
+    "sha256": "13ixg0gx7sp90k0db2xn7r2rj1w3zw3vs84pav0v8fwfvph9ki98"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "9cf586d629a04040c9414c4f9e17abbc65c644eb",
-    "sha256": "1jvm92m3jz34yvzyn4vnihga2phpgszb2wqk0y7pr0ww6vs9kaf6"
+    "rev": "fa8dee92201448cc4eaa92f222b93d0b044d8ea5",
+    "sha256": "16b0q0anlgmfzbdm0jyakb8cxikrr295pj7avzny26x9609lzqga"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "8defe7bfcae2ac5cb6dc25bfe3678124b09cf6f9",
-    "sha256": "0xzdnrhqalsrc52a326c5baf3si815a4rb2p1a4djyf8anp9wcai"
+    "rev": "05c3f4921d81fb1b0eb497515c24ae56221d1e0a",
+    "sha256": "0101bbpnrj4rp51dcnn2gjcq7vw55g4c8y4lmg2nd5g69whmkl1c"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -62,7 +62,7 @@
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
     "rev": "f991e28cb0a670597f1955585c76ce8a26ce9e4b",
-    "sha256": "1vflnscqc0jidr68v5ikxr579rx7k5yhdik8dcmnfgvmz3fq4jlz"
+    "sha256": "0bvxjciisq2hixhbxxs68zdwfdyvljy8iq48rnwpynqsdrhh5rma"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
@@ -92,7 +92,7 @@
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
     "rev": "47defc8b33b7bdf1dbf289b65b301fba2def9b1c",
-    "sha256": "1w4f02kch7p2jhn6dlzks6jpfcsm9ik04jnnaw6qvpxpsxwvcaah"
+    "sha256": "0kfwkxln3yz0c5rd1kfjmw0y2drwm1gg2s7f52kajfvg4274ha9c"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
@@ -181,8 +181,8 @@
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "63fb8da1ecf8e48262cd515690cf71a425f92bf5",
-    "sha256": "0kjw5dsgn67897laana4h06czr9g8555jiqf1k3pkzv4fxzcqypn"
+    "rev": "90f3590c3c49a0820462af9a778dd13d8df42244",
+    "sha256": "1dxc3imh8455vy3pggrzjflb2v5382q9ha2fwplybxawld9wdw45"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
@@ -202,6 +202,6 @@
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
     "rev": "3199d91de3f38e5ece3d36bcefe2c33b2c014f3f",
-    "sha256": "1hjw5ymbc1fl4r4lym7n7ilmb953izmvyp6z8g5l8l7cz9sjz4ka"
+    "sha256": "1l6babh2cjqwaqk12cqpkkl2qy909b1fd84p0ab19raw419ncawz"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 4bc04dbefd01e..19f36c337e5c0 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -14,7 +14,7 @@ let
         fetchgit {
           inherit (args) url rev sha256;
           fetchLFS = false;
-          fetchSubmodules = false;
+          fetchSubmodules = true;
           deepClone = false;
           leaveDotGit = false;
         };
@@ -22,19 +22,6 @@ let
 in
 lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 // {
-  qt3d = {
-    inherit version;
-    src = fetchgit {
-      url = "https://invent.kde.org/qt/qt/qt3d.git";
-      rev = "c3c7e6ebc29cce466d954f72f340a257d76b5ec2";
-      sha256 = "sha256-KMWZ4N2OO7TBVpcgvQf/gweZRT62i9XABOnq0x94PY4=";
-      fetchLFS = false;
-      fetchSubmodules = true;
-      deepClone = false;
-      leaveDotGit = false;
-    };
-  };
-
   # qtwebkit does not have an official release tarball on the qt mirror and is
   # mostly maintained by the community.
   qtwebkit = rec {
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index 9664f005d7ee5..b09521e34e3cc 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -140,10 +140,12 @@ let
       };
 
       wrapQtAppsHook = makeSetupHook {
+        name = "wrap-qt6-apps-hook";
           deps = [ buildPackages.makeWrapper ];
         } ./hooks/wrap-qt-apps-hook.sh;
 
       qmake = makeSetupHook {
+        name = "qmake6-hook";
         deps = [ self.qtbase.dev ];
         substitutions = {
           inherit debug;
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index ae89c223d2dff..2e35b5e528256 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -222,8 +222,8 @@ stdenv.mkDerivation rec {
     "-DQT_FEATURE_journald=${if systemdSupport then "ON" else "OFF"}"
     "-DQT_FEATURE_vulkan=ON"
   ] ++ lib.optionals stdenv.isDarwin [
-    # error: 'path' is unavailable: introduced in macOS 10.15
-    "-DQT_FEATURE_cxx17_filesystem=OFF"
+    # build as a set of dynamic libraries
+    "-DFEATURE_framework=OFF"
   ];
 
   NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [
@@ -271,7 +271,8 @@ stdenv.mkDerivation rec {
     # fixup .pc file (where to find 'moc' etc.)
     if [ -f "$dev/lib/pkgconfig/Qt6Core.pc" ]; then
       sed -i "$dev/lib/pkgconfig/Qt6Core.pc" \
-        -e "/^bindir=/ c bindir=$dev/bin"
+        -e "/^bindir=/ c bindir=$dev/bin" \
+        -e "/^libexecdir=/ c libexecdir=$dev/libexec"
     fi
 
     patchShebangs $out $dev
diff --git a/pkgs/development/libraries/swift-corelibs-libdispatch/default.nix b/pkgs/development/libraries/swift-corelibs-libdispatch/default.nix
deleted file mode 100644
index 76cc0d3e30ef9..0000000000000
--- a/pkgs/development/libraries/swift-corelibs-libdispatch/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, clangStdenv
-, fetchFromGitHub
-, cmake
-, ninja
-, libbsd
-, libsystemtap
-}:
-
-let
-  version = "5.5";
-in clangStdenv.mkDerivation {
-  pname = "swift-corelibs-libdispatch";
-  inherit version;
-
-  outputs = [ "out" "dev" "man" ];
-
-  src = fetchFromGitHub {
-    owner = "apple";
-    repo = "swift-corelibs-libdispatch";
-    rev = "swift-${version}-RELEASE";
-    sha256 = "sha256-MbLgmS6qRSRT+2dGqbYTNb5MTM4Wz/grDXFk1kup+jk=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    ninja
-  ];
-
-  buildInputs = [
-    libbsd
-    libsystemtap
-  ];
-
-  meta = {
-    description = "Grand Central Dispatch";
-    homepage = "https://github.com/apple/swift-corelibs-libdispatch";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.cmm ];
-  };
-}
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index e5ea8b17f6aaf..9027c14de90c4 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -61,7 +61,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     glib
     libxml2
     sqlite
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index d25bb93d49f4c..70270a58ddf4e 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.197";
+  version = "0.6.199";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+elot37F8VW7BP18zB8wHbxTHLgnTlXLUJlr82/Y05w=";
+    sha256 = "sha256-6sEgxUDKKAFWxWQqTb8hLt+vqlkD/9f5zdj9rh3sDLM=";
   };
 
-  vendorSha256 = "sha256-uaLoh1VhJAT5liGqL77DLhAWviy5Ci8B16LuzCWuek8=";
+  vendorHash = "sha256-hpS8fyyWIw1vkWXyd1OxyorGT5j4bJ5Ey+Hh48QF0p0=";
 
   CGO_ENABLED = 0;
   subPackages = [ "." ];
diff --git a/pkgs/development/ocaml-modules/pyml/default.nix b/pkgs/development/ocaml-modules/pyml/default.nix
index 1cc85833d584d..8358be50032a1 100644
--- a/pkgs/development/ocaml-modules/pyml/default.nix
+++ b/pkgs/development/ocaml-modules/pyml/default.nix
@@ -28,6 +28,10 @@ buildDunePackage rec {
         "CHANGES.md"
       ];
     })
+    (fetchpatch {
+      url = "https://github.com/thierry-martinez/pyml/commit/97407473800b3f6215190643c1e6b9bd25d5caeb.patch";
+      hash = "sha256-7CrVuV4JT7fyi/ktWz4nNOG/BbqsQVCoJwCAhE2y4YU=";
+    })
   ];
 
   buildInputs = [
@@ -40,7 +44,7 @@ buildDunePackage rec {
   ];
 
   nativeCheckInputs = [
-    python3.pkgs.numpy
+    python3.pkgs.numpy python3.pkgs.ipython
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
index d5fe92f320b09..6334df6637475 100644
--- a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-recoveryservicesbackup";
-  version = "5.0.0";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-BciA3sFyja5xo9yS3WVglC73y8gTfw8UejdEzbD4HYE=";
+    hash = "sha256-xl+KbNGceJWFvJKH8Aw02Ho+wMAxvxPZ4T09Qimn7OU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cachetools/default.nix b/pkgs/development/python-modules/cachetools/default.nix
index 114c7275f380b..08e0b559b0f2c 100644
--- a/pkgs/development/python-modules/cachetools/default.nix
+++ b/pkgs/development/python-modules/cachetools/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "cachetools";
-  version = "5.2.0";
+  version = "5.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tkem";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-DheHTD62f1ZxoiS0y0/CzDMHvKGmEiEUAX6oaqTpB78=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1B/vAfGroGABijMWuiKmIkMyjNSp2B3VkH7s1NMlbw0=";
   };
 
   nativeCheckInputs = [
@@ -30,6 +30,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Extensible memoizing collections and decorators";
     homepage = "https://github.com/tkem/cachetools";
+    changelog = "https://github.com/tkem/cachetools/blob/v${version}/CHANGELOG.rst";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/chardet/default.nix b/pkgs/development/python-modules/chardet/default.nix
index 69353dcaec289..e750bbece81de 100644
--- a/pkgs/development/python-modules/chardet/default.nix
+++ b/pkgs/development/python-modules/chardet/default.nix
@@ -23,7 +23,8 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    hypothesis
+    # "hypothesis" indirectly depends on chardet to build its documentation.
+    (hypothesis.override { enableDocumentation = false; })
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index ead0a1b1a5c0f..b8cf310a06ee9 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -62,7 +62,8 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     cryptography-vectors
-    hypothesis
+    # "hypothesis" indirectly depends on cryptography to build its documentation
+    (hypothesis.override { enableDocumentation = false; })
     iso8601
     pretend
     py
diff --git a/pkgs/development/python-modules/dacite/default.nix b/pkgs/development/python-modules/dacite/default.nix
index f2e0a4b2d96c2..a33a26d5224d5 100644
--- a/pkgs/development/python-modules/dacite/default.nix
+++ b/pkgs/development/python-modules/dacite/default.nix
@@ -2,13 +2,12 @@
 , fetchFromGitHub
 , buildPythonPackage
 , pythonOlder
-, pythonAtLeast
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "dacite";
-  version = "1.7.0";
+  version = "1.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,9 +16,14 @@ buildPythonPackage rec {
     owner = "konradhalas";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+yWvlJcOmqDkHl3JZfPnIV3C4ieSo4FiBvoUZ0+J4N0=";
+    hash = "sha256-aQwQHFWaXwTaA6GQgDcWT6ivE9YtWtHCTOtxDi503+M=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "--benchmark-autosave --benchmark-json=benchmark.json" ""
+  '';
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -28,6 +32,10 @@ buildPythonPackage rec {
     "dacite"
   ];
 
+  disabledTestPaths = [
+    "tests/performance"
+  ];
+
   meta = with lib; {
     description = "Python helper to create data classes from dictionaries";
     homepage = "https://github.com/konradhalas/dacite";
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index 9120017a7da52..5e7930bbc9cd7 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.0.4";
+  version = "1.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "exceptiongroup";
     rev = version;
-    hash = "sha256-csyDWVvcsAMzgomb0xq0NbVP7qYQpDv9obBGANlwiVI=";
+    hash = "sha256-XQcYYz4MOxWj9QlgM6KuwBaCHjYzGRkQw3cN5WBSnAo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/future/default.nix b/pkgs/development/python-modules/future/default.nix
index a24ea8ab97239..7c4a5507b5404 100644
--- a/pkgs/development/python-modules/future/default.nix
+++ b/pkgs/development/python-modules/future/default.nix
@@ -5,16 +5,27 @@
 
 buildPythonPackage rec {
   pname = "future";
-  version = "0.18.2";
+  version = "0.18.3";
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b1bead90b70cf6ec3f0710ae53a525360fa360d306a86583adc6bf83a4db537d";
+    hash = "sha256-NKF0Nu0elml6hvnePRWjsL4B2LyN6cHf/Vn7gjTtUwc=";
   };
 
+  pythonImportsCheck = [
+    "future.builtins"
+    "future.moves"
+    "future.standard_library"
+    "past.builtins"
+    "past.translation"
+  ];
+
   doCheck = false;
 
   meta = {
+    changelog = "https://github.com/PythonCharmers/python-future/blob/v${version}/docs/whatsnew.rst";
     description = "Clean single-source support for Python 3 and 2";
     longDescription = ''
       python-future is the missing compatibility layer between Python 2 and
@@ -29,7 +40,7 @@ buildPythonPackage rec {
     '';
     homepage = "https://python-future.org";
     downloadPage = "https://github.com/PythonCharmers/python-future/releases";
-    license = with lib.licenses; [ mit ];
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ prikhi ];
   };
 }
diff --git a/pkgs/development/python-modules/humanize/default.nix b/pkgs/development/python-modules/humanize/default.nix
index aa39edd5c24d1..33348ff252c72 100644
--- a/pkgs/development/python-modules/humanize/default.nix
+++ b/pkgs/development/python-modules/humanize/default.nix
@@ -11,8 +11,8 @@
 }:
 
 buildPythonPackage rec {
-  version = "4.4.0";
   pname = "humanize";
+  version = "4.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "python-humanize";
     repo = pname;
-    rev = version;
-    hash = "sha256-XxlmOs3sfHOLTkrKGsHRiBWpuCIPJua2VkKxDmjOeWE=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-vTfK45sZ9m7TUQJwZpQWhOXgZzO46CwCsnNP+PI1YfA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -57,6 +57,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python humanize utilities";
     homepage = "https://github.com/python-humanize/humanize";
+    changelog = "https://github.com/python-humanize/humanize/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ rmcgibbo Luflosi ];
   };
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 994262a9871a2..61b4f87a6793d 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -9,11 +9,18 @@
 , pytest-xdist
 , sortedcontainers
 , pythonOlder
+, sphinxHook
+, sphinx-rtd-theme
+, sphinx-hoverxref
+, sphinx-codeautolink
+# Used to break internal dependency loop.
+, enableDocumentation ? true
 }:
 
 buildPythonPackage rec {
   pname = "hypothesis";
   version = "6.61.0";
+  outputs = [ "out" ] ++ lib.optional enableDocumentation "doc";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,8 +32,28 @@ buildPythonPackage rec {
     hash = "sha256-gTcdJaOgP8Nc4fN8UH6+sLedivq5ZNxMRULajFOVnSo=";
   };
 
+  # I tried to package sphinx-selective-exclude, but it throws
+  # error about "module 'sphinx' has no attribute 'directives'".
+  #
+  # It probably has to do with monkey-patching internals of Sphinx.
+  # On bright side, this extension does not introduces new commands,
+  # only changes "::only" command, so we probably okay with stock
+  # implementation.
+  #
+  # I wonder how upstream of "hypothesis" builds documentation.
+  postPatch = ''
+    sed -i -e '/sphinx_selective_exclude.eager_only/ d' docs/conf.py
+  '';
+
   postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
 
+  nativeBuildInputs = lib.optionals enableDocumentation [
+    sphinxHook
+    sphinx-rtd-theme
+    sphinx-hoverxref
+    sphinx-codeautolink
+  ];
+
   propagatedBuildInputs = [
     attrs
     sortedcontainers
diff --git a/pkgs/development/python-modules/internetarchive/default.nix b/pkgs/development/python-modules/internetarchive/default.nix
index 2bede522584c6..e0021cbc39e04 100644
--- a/pkgs/development/python-modules/internetarchive/default.nix
+++ b/pkgs/development/python-modules/internetarchive/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "internetarchive";
-  version = "3.2.0";
+  version = "3.3.0";
 
   format = "setuptools";
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-cB7nRDmO2NNaHjNkHCuXH0+15WZfxseS8DBdIqefSzk=";
+    sha256 = "sha256-PLf+PMIXlaoL974e7coQCQKH6cVBYODPhkDxa2vhTB0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/iso8601/default.nix b/pkgs/development/python-modules/iso8601/default.nix
index c3e022cdb38bd..af90e739163c8 100644
--- a/pkgs/development/python-modules/iso8601/default.nix
+++ b/pkgs/development/python-modules/iso8601/default.nix
@@ -25,7 +25,8 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    hypothesis
+    # "hypothesis" indirectly depends on iso8601 to build its documentation
+    (hypothesis.override { enableDocumentation = false; })
     pytestCheckHook
     pytz
   ];
diff --git a/pkgs/development/python-modules/iteration-utilities/default.nix b/pkgs/development/python-modules/iteration-utilities/default.nix
new file mode 100644
index 0000000000000..fd17b76103ba6
--- /dev/null
+++ b/pkgs/development/python-modules/iteration-utilities/default.nix
@@ -0,0 +1,28 @@
+{ lib, buildPythonPackage, fetchFromGitHub
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "iteration-utilities";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "MSeifert04";
+    repo = "iteration_utilities";
+    rev = "v${version}";
+    sha256 = "sha256-Q/ZuwAf+NPikN8/eltwaUilnLw4DKFm864tUe6GLDak=";
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "iteration_utilities" ];
+
+  meta = with lib; {
+    description = "Utilities based on Pythons iterators and generators";
+    homepage = "https://github.com/MSeifert04/iteration_utilities";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/jaraco-context/default.nix b/pkgs/development/python-modules/jaraco-context/default.nix
index 6a8c0fd1ea4a7..7a882c80195c1 100644
--- a/pkgs/development/python-modules/jaraco-context/default.nix
+++ b/pkgs/development/python-modules/jaraco-context/default.nix
@@ -7,16 +7,16 @@
 
 buildPythonPackage rec {
   pname = "jaraco-context";
-  version = "4.2.0";
+  version = "4.3.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jaraco";
     repo = "jaraco.context";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-J7vL+pvwXcKEkqZn44/U01HmP1CI5kIGsJ1aJevp0I4=";
+    hash = "sha256-YdbkpKv7k62uyhmjKoxeA9uf5BWnRD/rK+z46FJN4xk=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -32,11 +32,14 @@ buildPythonPackage rec {
   # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "jaraco.context" ];
+  pythonImportsCheck = [
+    "jaraco.context"
+  ];
 
   meta = with lib; {
     description = "Python module for context management";
     homepage = "https://github.com/jaraco/jaraco.context";
+    changelog = "https://github.com/jaraco/jaraco.context/blob/v${version}/CHANGES.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/jinja2-ansible-filters/default.nix b/pkgs/development/python-modules/jinja2-ansible-filters/default.nix
new file mode 100644
index 0000000000000..33975ee204ea5
--- /dev/null
+++ b/pkgs/development/python-modules/jinja2-ansible-filters/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildPythonPackage, fetchPypi
+, jinja2
+, pyyaml
+}:
+
+buildPythonPackage rec {
+  pname = "jinja2-ansible-filters";
+  version = "1.3.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-B8EM9E1wc/TwEQLKEtmi3DG0HUfkxh7ZLvam0mabNWs=";
+  };
+
+  propagatedBuildInputs = [
+    jinja2
+    pyyaml
+  ];
+
+  # no tests include in sdist, and source not available
+  doCheck = false;
+
+  pythonImportsCheck = [ "jinja2_ansible_filters" ];
+
+  meta = with lib; {
+    description = "Jinja2 Ansible Filters";
+    homepage = "https://pypi.org/project/jinja2-ansible-filters/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
index 3e4f31dff60a3..0a9e26771c4ae 100644
--- a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , six
 , attrs
 , twisted
@@ -9,17 +10,30 @@
 , autobahn
 , treq
 , mock
+, pythonOlder
 }:
 
 buildPythonPackage rec {
-  version = "0.4.1";
   pname = "magic-wormhole-mailbox-server";
+  version = "0.4.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "1af10592909caaf519c00e706eac842c5e77f8d4356215fe9c61c7b2258a88fb";
   };
 
+  patches = [
+    (fetchpatch {
+      # Remove the 'U' open mode removed, https://github.com/magic-wormhole/magic-wormhole-mailbox-server/pull/34
+      name = "fix-for-python-3.11.patch";
+      url = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server/commit/4b358859ba80de37c3dc0a5f67ec36909fd48234.patch";
+      hash = "sha256-RzZ5kD+xhmFYusVzAbGE+CODXtJVR1zN2rZ+VGApXiQ=";
+    })
+  ];
+
   propagatedBuildInputs = [
     attrs
     six
@@ -33,6 +47,7 @@ buildPythonPackage rec {
     mock
     twisted
   ];
+
   checkPhase = ''
     trial -j$NIX_BUILD_CORES wormhole_mailbox_server
   '';
@@ -40,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Securely transfer data between computers";
     homepage = "https://github.com/warner/magic-wormhole-mailbox-server";
+    changelog = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/${version}/NEWS.md";
     license = licenses.mit;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index ff92d814a099f..dd3553419792b 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -1,40 +1,67 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, aiohttp
+, fetchFromGitHub
 , pythonOlder
-, sqlalchemy
-, ruamel-yaml
-, CommonMark
-, lxml
+  # deps
+, aiohttp
+, attrs
+, yarl
+  # optional deps
+, python-magic
+, python-olm
+, unpaddedbase64
+, pycryptodome
+  # check deps
+, pytestCheckHook
+, pytest-asyncio
 , aiosqlite
+, sqlalchemy
+, asyncpg
 }:
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.18.9";
+  version = "0.19.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Ihaz/izB9L6osu3CPwBWOwLZ2JOLKhsDuqOUf/B02qI=";
+  src = fetchFromGitHub {
+    owner = "mautrix";
+    repo = "python";
+    rev = "v${version}";
+    hash = "sha256-7nvy2/DUS2BkcyQUUG8+aT/JHcPu141e5YWOiccS6cU=";
   };
 
   propagatedBuildInputs = [
     aiohttp
+    attrs
+    yarl
+  ];
 
-    # defined in optional-requirements.txt
-    sqlalchemy
-    aiosqlite
-    ruamel-yaml
-    CommonMark
-    lxml
+  passthru.optional-dependencies = {
+    detect_mimetype = [
+      python-magic
+    ];
+    encryption = [
+      python-olm
+      unpaddedbase64
+      pycryptodome
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  # no tests available
-  doCheck = false;
+  checkInputs = [
+    pytest-asyncio
+    aiosqlite
+    sqlalchemy
+    asyncpg
+  ] ++ passthru.optional-dependencies.encryption;
+
+  SQLALCHEMY_SILENCE_UBER_WARNING = 1;
 
   pythonImportsCheck = [
     "mautrix"
@@ -45,6 +72,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/tulir/mautrix-python";
     changelog = "https://github.com/mautrix/python/releases/tag/v${version}";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ nyanloutre ma27 sumnerevans ];
+    maintainers = with maintainers; [ nyanloutre ma27 sumnerevans nickcao ];
   };
 }
diff --git a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
new file mode 100644
index 0000000000000..57f900c6ab124
--- /dev/null
+++ b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
@@ -0,0 +1,43 @@
+{ lib, buildPythonPackage, fetchFromGitHub
+, beautifulsoup4
+, jsbeautifier
+, mkdocs
+, mkdocs-material
+, pymdown-extensions
+, pyyaml
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "mkdocs-mermaid2-plugin";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "fralau";
+    repo = "mkdocs-mermaid2-plugin";
+    rev = "v${version}";
+    sha256 = "sha256-Oe6wkVrsB0NWF+HHeifrEogjxdGPINRDJGkh9p+GoHs=";
+  };
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+    jsbeautifier
+    mkdocs
+    mkdocs-material
+    pymdown-extensions
+    pyyaml
+    requests
+  ];
+
+  # non-traditional python tests (e.g. nodejs based tests)
+  doCheck = false;
+
+  pythonImportsCheck = [ "mermaid2" ];
+
+  meta = with lib; {
+    description = "A MkDocs plugin for including mermaid graphs in markdown sources";
+    homepage = "https://github.com/fralau/mkdocs-mermaid2-plugin";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index ff7bc68dd23c2..5640c01d64306 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -77,7 +77,8 @@ in buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest
-    hypothesis
+    # "hypothesis" indirectly depends on numpy to build its documentation.
+    (hypothesis.override { enableDocumentation = false; })
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/opensearch-py/default.nix b/pkgs/development/python-modules/opensearch-py/default.nix
new file mode 100644
index 0000000000000..7f9fd5c85b16c
--- /dev/null
+++ b/pkgs/development/python-modules/opensearch-py/default.nix
@@ -0,0 +1,59 @@
+{ aiohttp
+, botocore
+, buildPythonPackage
+, certifi
+, fetchFromGitHub
+, lib
+, mock
+, pytest-asyncio
+, pytestCheckHook
+, pyyaml
+, requests
+, urllib3
+}:
+
+buildPythonPackage rec {
+  pname = "opensearch-py";
+  version = "2.1.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "opensearch-project";
+    repo = "opensearch-py";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uJ6fdRPDK76qKHE4E6dI01vKgvfqbc6A1RCwnOtuOTY=";
+  };
+
+  propagatedBuildInputs = [
+    botocore
+    certifi
+    requests
+    urllib3
+  ];
+
+  nativeCheckInputs = [
+    mock
+    pytest-asyncio
+    pytestCheckHook
+    pyyaml
+  ] ++ passthru.optional-dependencies.async;
+
+  disabledTestPaths = [
+    # require network
+    "test_opensearchpy/test_async/test_connection.py"
+    "test_opensearchpy/test_async/test_server"
+    "test_opensearchpy/test_connection.py"
+    "test_opensearchpy/test_server"
+    "test_opensearchpy/test_server_secured"
+  ];
+
+  passthru.optional-dependencies.async = [ aiohttp ];
+
+  meta = {
+    description = "Python low-level client for OpenSearch";
+    homepage = "https://github.com/opensearch-project/opensearch-py";
+    changelog = "https://github.com/opensearch-project/opensearch-py/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mcwitt ];
+  };
+}
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 50ea51adecb1a..4890614ed5a92 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,20 +16,20 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.8.2";
+  version = "3.8.4";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ijl";
     repo = pname;
     rev = version;
-    hash = "sha256-jiyYCjZ6c62zmm4Ge9KbEI8/PtPunu79HVODyoHFdSg=";
+    hash = "sha256-XQBiE8hmLC/AIRt0eJri/ilPHUEYiOxd0onRBQsx+pM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-z1B0oSp37OGJ21Q57UUfmSRfUWLftiiBayN9y6yKNyg=";
+    hash = "sha256-O2W9zO7qHWG+78T+uECICAmecaSIbTTJPktJIPZYElE=";
   };
 
   format = "pyproject";
@@ -57,6 +57,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Fast, correct Python JSON library supporting dataclasses, datetimes, and numpy";
     homepage = "https://github.com/ijl/orjson";
+    changelog = "https://github.com/ijl/orjson/blob/${version}/CHANGELOG.md";
     license = with licenses; [ asl20 mit ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ misuzu ];
diff --git a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
index b8e386d7c2094..7692ab2fceed7 100644
--- a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
+++ b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
@@ -5,6 +5,7 @@
 , jinja2
 , markupsafe
 , poetry-core
+, poetry
 , pytestCheckHook
 , pythonOlder
 , tomlkit
@@ -37,8 +38,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    poetry
   ];
 
+  # virtualenv: error: argument dest: the destination . is not write-able at /
+  doCheck = false;
+
   disabledTests = [
     # these require .git, but leaveDotGit = true doesn't help
     "test__get_version__defaults"
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 1286805a918cf..a5154a3e4abd9 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.10.2";
+  version = "2.10.3";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YxAkozyWNTKMCIEk3AhHZbRHtzhRrCSB3wh/Qy9CIyU=";
+    hash = "sha256-Rlr6Ec6BEujTxQkQ9UP+6u0cYeFsJlj7U346MtRM6QM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyhaversion/default.nix b/pkgs/development/python-modules/pyhaversion/default.nix
index 17966ad58b21a..38b71b80e782c 100644
--- a/pkgs/development/python-modules/pyhaversion/default.nix
+++ b/pkgs/development/python-modules/pyhaversion/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyhaversion";
-  version = "22.8.0";
+  version = "23.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-30UHbxs0WZyIVyq0ai2PsoPTkvoYawS1OBhVbV0JVN8=";
+    sha256 = "sha256-HMJqZn0yzN2dP5WTRCbem1Xw8nyH2Hy7oVP4kEKHHAo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pylitterbot/default.nix b/pkgs/development/python-modules/pylitterbot/default.nix
index 04e397e597043..8b1b41cf3c44c 100644
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pylitterbot";
-  version = "2023.1.1";
+  version = "2023.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "natekspencer";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-nWKBbb2S8V81KQihGQYg9GBK97xv5FXuem5pUPB+cew=";
+    hash = "sha256-PSg0u4Beg0OVUMxaBCPxJSVO/MxBvCpDu2rQhiYT9OM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyramid/default.nix b/pkgs/development/python-modules/pyramid/default.nix
index 44a7779d3a593..426459a67fb40 100644
--- a/pkgs/development/python-modules/pyramid/default.nix
+++ b/pkgs/development/python-modules/pyramid/default.nix
@@ -13,28 +13,48 @@
 , webob
 , zope_deprecation
 , zope_interface
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyramid";
-  version = "2.0";
+  version = "2.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "45431b387587ed0fac6213b54d6e9f0936f0cc85238a8f5af7852fc9484c5c77";
+    hash = "sha256-+r/XRQOeJq1bCRX8OW6HJcD4o9F7lB+WEezR7XbP59o=";
   };
 
-  nativeCheckInputs = [ webtest zope_component ];
+  propagatedBuildInputs = [
+    hupper
+    pastedeploy
+    plaster
+    plaster-pastedeploy
+    repoze_lru
+    translationstring
+    venusian
+    webob
+    zope_deprecation
+    zope_interface
+  ];
 
-  propagatedBuildInputs = [ hupper pastedeploy plaster plaster-pastedeploy repoze_lru translationstring venusian webob zope_deprecation zope_interface ];
+  nativeCheckInputs = [
+    webtest
+    zope_component
+  ];
 
-  pythonImportsCheck = [ "pyramid" ];
+  pythonImportsCheck = [
+    "pyramid"
+  ];
 
   meta = with lib; {
-    description = "The Pyramid Web Framework, a Pylons project";
+    description = "Python web framework";
     homepage = "https://trypyramid.com/";
+    changelog = "https://github.com/Pylons/pyramid/blob/${version}/CHANGES.rst";
     license = licenses.bsd0;
     maintainers = with maintainers; [ domenkozar ];
   };
-
 }
diff --git a/pkgs/development/python-modules/pysvn/default.nix b/pkgs/development/python-modules/pysvn/default.nix
index fc8bdc2ab0d1b..db7848a9282ae 100644
--- a/pkgs/development/python-modules/pysvn/default.nix
+++ b/pkgs/development/python-modules/pysvn/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "pysvn";
-  version = "1.9.18";
+  version = "1.9.20";
   format = "other";
 
   src = fetchurl {
-    url = "https://pysvn.barrys-emacs.org/source_kits/${pname}-${version}.tar.gz";
-    hash = "sha256-lUPsNumMYwZoiR1Gt/hqdLLoHOZybRxwvu9+eU1CY78=";
+    url = "mirror://sourceforge/project/pysvn/pysvn/V${version}/pysvn-${version}.tar.gz";
+    hash = "sha256-LbAz+KjEY3nkSJAzJNwlnSRYoWr4i1ITRUPV3ZBH7cc=";
   };
 
   patches = [
@@ -62,8 +62,7 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
-  # FIXME https://github.com/NixOS/nixpkgs/issues/175227
-  # pythonImportsCheck = [ "pysvn" ];
+  pythonImportsCheck = [ "pysvn" ];
 
   installPhase = ''
     dest=$(toPythonPath $out)/pysvn
diff --git a/pkgs/development/python-modules/pytest-benchmark/default.nix b/pkgs/development/python-modules/pytest-benchmark/default.nix
index b9def8d834afa..6fd0cefb51c3f 100644
--- a/pkgs/development/python-modules/pytest-benchmark/default.nix
+++ b/pkgs/development/python-modules/pytest-benchmark/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-benchmark";
-  version = "3.4.1";
+  version = "4.0.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "ionelmc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qc/8Epax5bPUZvhq42xSj6NUq0T4gbO5dDDS6omWBOU=";
+    hash = "sha256-f9Ty4+5PycraxoLUSa9JFusV5Cot6bBWKfOGHZIRR3o=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pyyaml-include/default.nix b/pkgs/development/python-modules/pyyaml-include/default.nix
new file mode 100644
index 0000000000000..e6effdd72740a
--- /dev/null
+++ b/pkgs/development/python-modules/pyyaml-include/default.nix
@@ -0,0 +1,37 @@
+{ lib, buildPythonPackage, fetchPypi
+, pytestCheckHook
+, pyyaml
+, setuptools-scm
+, setuptools-scm-git-archive
+, toml
+}:
+
+buildPythonPackage rec {
+  pname = "pyyaml-include";
+  version = "1.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-9/vrjnG1C+Dm4HRy98edv7GhW63pyToHg2n/SeV+Z3E=";
+  };
+
+  nativeBuildInputs = [
+    pyyaml
+    setuptools-scm
+    setuptools-scm-git-archive
+    toml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "yamlinclude" ];
+
+  meta = with lib; {
+    description = "Extending PyYAML with a custom constructor for including YAML files within YAML files";
+    homepage = "https://github.com/tanbro/pyyaml-include";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/qimage2ndarray/default.nix b/pkgs/development/python-modules/qimage2ndarray/default.nix
index 431b5c9bfa101..9c54df213dc34 100644
--- a/pkgs/development/python-modules/qimage2ndarray/default.nix
+++ b/pkgs/development/python-modules/qimage2ndarray/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "qimage2ndarray";
-  version = "1.9.0";
+  version = "1.10.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-p5B1xtDYRDxEIu6WmlQJ5E/QJUVxYEzOqHXGyV4/Veo=";
+    sha256 = "sha256-NyUQJEbcimlrLsd1sdKvQ7E69qf56+6KNxFbuVQ6LFg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/reportengine/default.nix b/pkgs/development/python-modules/reportengine/default.nix
index a7f0df89c34c8..17720e8bec2b8 100644
--- a/pkgs/development/python-modules/reportengine/default.nix
+++ b/pkgs/development/python-modules/reportengine/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "reportengine";
-  version = "0.30.dev0";
+  version = "0.31";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eb612994b7f364e872301b4569b544648e95e587d803284ddb5610efc8f2170f";
+    sha256 = "sha256-jrt+ml8o1PUidV1bY0hCyNgcPaVTBloW574/i5Pl7iE=";
   };
 
   nativeBuildInputs = [ flit ];
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 8f68f1459e557..dfa4b16c8e98a 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -18,21 +18,18 @@
 
 buildPythonPackage rec {
   pname = "requests";
-  version = "2.28.1";
+  version = "2.28.2";
   format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   __darwinAllowLocalNetworking = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fFWZsQL+3apmHIJsVqtP7ii/0X9avKHrvj5/GdfJeYM=";
+    hash = "sha256-mLGyeC48bEkEk4uEwOuTJyEGnf25E0MTvv98g8LfJL8=";
   };
 
-  patches = [
-    ./relax-charset-normalizer.patch
-  ];
-
   propagatedBuildInputs = [
     brotlicffi
     certifi
@@ -90,6 +87,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "HTTP library for Python";
     homepage = "http://docs.python-requests.org/";
+    changelog = "https://github.com/psf/requests/blob/v${version}/HISTORY.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/requests/relax-charset-normalizer.patch b/pkgs/development/python-modules/requests/relax-charset-normalizer.patch
deleted file mode 100644
index ef14c09fffb83..0000000000000
--- a/pkgs/development/python-modules/requests/relax-charset-normalizer.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 54ae822ce968f49a4d5a10e30c5d75e76c887fe4 Mon Sep 17 00:00:00 2001
-From: deedy5 <65482418+deedy5@users.noreply.github.com>
-Date: Thu, 20 Oct 2022 18:26:18 +0000
-Subject: [PATCH] Allow charset normalizer >=2 and <4 (#6261)
-
----
- requests/__init__.py | 4 ++--
- setup.cfg            | 2 +-
- setup.py             | 2 +-
- 3 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/requests/__init__.py b/requests/__init__.py
-index 7ac8e29..22db3c1 100644
---- a/requests/__init__.py
-+++ b/requests/__init__.py
-@@ -80,8 +80,8 @@ def check_compatibility(urllib3_version, chardet_version, charset_normalizer_ver
-     elif charset_normalizer_version:
-         major, minor, patch = charset_normalizer_version.split(".")[:3]
-         major, minor, patch = int(major), int(minor), int(patch)
--        # charset_normalizer >= 2.0.0 < 3.0.0
--        assert (2, 0, 0) <= (major, minor, patch) < (3, 0, 0)
-+        # charset_normalizer >= 2.0.0 < 4.0.0
-+        assert (2, 0, 0) <= (major, minor, patch) < (4, 0, 0)
-     else:
-         raise Exception("You need either charset_normalizer or chardet installed")
- 
-diff --git a/setup.cfg b/setup.cfg
-index 93d1f99..ea45aaf 100644
---- a/setup.cfg
-+++ b/setup.cfg
-@@ -5,7 +5,7 @@ provides-extra =
- 	use_chardet_on_py3
- requires-dist = 
- 	certifi>=2017.4.17
--	charset_normalizer>=2,<3
-+	charset_normalizer>=2,<4
- 	idna>=2.5,<4
- 	urllib3>=1.21.1,<1.27
- 
-diff --git a/setup.py b/setup.py
-index 23977ed..092b40d 100755
---- a/setup.py
-+++ b/setup.py
-@@ -59,7 +59,7 @@ if sys.argv[-1] == "publish":
-     sys.exit()
- 
- requires = [
--    "charset_normalizer>=2,<3",
-+    "charset_normalizer>=2,<4",
-     "idna>=2.5,<4",
-     "urllib3>=1.21.1,<1.27",
-     "certifi>=2017.4.17",
--- 
-2.38.1
-
diff --git a/pkgs/development/python-modules/rpi-gpio2/default.nix b/pkgs/development/python-modules/rpi-gpio2/default.nix
index 3adf7a35ea74c..aaf958d269223 100644
--- a/pkgs/development/python-modules/rpi-gpio2/default.nix
+++ b/pkgs/development/python-modules/rpi-gpio2/default.nix
@@ -1,13 +1,15 @@
-{ lib, libgpiod, buildPythonPackage, fetchurl }:
+{ lib, libgpiod, buildPythonPackage, fetchFromGitHub }:
 
 buildPythonPackage rec {
   pname = "rpi-gpio2";
   version = "0.3.0a3";
 
   # PyPi source does not work for some reason
-  src = fetchurl {
-    url = "https://github.com/underground-software/RPi.GPIO2/archive/refs/tags/v${version}.tar.gz";
-    sha256 = "sha256-AY1AD2Yu66eJUqB4OStZnUeEhmISLVRrTOAcmEHjuOM=";
+  src = fetchFromGitHub {
+    owner = "underground-software";
+    repo = "RPi.GPIO2";
+    rev = "v${version}";
+    hash = "sha256-8HQbEnO+4Ppo2Z3HBulbBcSKJF1bNNQYz8k6aUt65oc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/simplejson/default.nix b/pkgs/development/python-modules/simplejson/default.nix
index a58cf5818b72b..381c7688be186 100644
--- a/pkgs/development/python-modules/simplejson/default.nix
+++ b/pkgs/development/python-modules/simplejson/default.nix
@@ -1,19 +1,23 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, stdenv
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "simplejson";
-  version = "3.18.0";
+  version = "3.18.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-X1lD/kCbKDPPgpr2deoVbC5LADqBlNZHvDg7206E9ZE=";
+    hash = "sha256-m5V1wmqkPxZBH25vWajztwa3HF4KtH+HXXs4TCecTm8=";
   };
 
   nativeCheckInputs = [
@@ -22,7 +26,9 @@ buildPythonPackage rec {
 
   doCheck = !stdenv.isDarwin;
 
-  pythonImportsCheck = [ "simplejson" ];
+  pythonImportsCheck = [
+    "simplejson"
+  ];
 
   meta = with lib; {
     description = "Extensible JSON encoder/decoder for Python";
@@ -33,6 +39,7 @@ buildPythonPackage rec {
       for unicode characters).
     '';
     homepage = "https://github.com/simplejson/simplejson";
+    changelog = "https://github.com/simplejson/simplejson/blob/v${version}/CHANGES.txt";
     license = with licenses; [ mit afl21 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/sphinx-codeautolink/default.nix b/pkgs/development/python-modules/sphinx-codeautolink/default.nix
new file mode 100644
index 0000000000000..c9dcec606fa1f
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-codeautolink/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonImportsCheckHook
+# documentation build dependencies
+, sphinxHook
+, sphinx-rtd-theme
+, matplotlib
+, ipython
+# runtime dependencies
+, sphinx
+, beautifulsoup4
+# check dependencies
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-codeautolink";
+  version = "0.12.1";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "felix-hilden";
+    repo = "sphinx-codeautolink";
+    rev = "v${version}";
+    hash = "sha256-x81jhYknJ6lsLxR5ZyuYNNz/zt0kto6bNyaeZmPKDIE=";
+  };
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    sphinxHook
+    sphinx-rtd-theme
+    matplotlib
+    ipython
+  ];
+
+  sphinxRoot = "docs/src";
+
+  propagatedBuildInputs = [ sphinx beautifulsoup4 ];
+
+  nativeCheckInputs = [ pytest ];
+
+  pythonImportsCheck = [ "sphinx_codeautolink" ];
+
+  meta = with lib; {
+    description = "A sphinx extension that makes code examples clickable";
+    homepage = "https://github.com/felix-hilden/sphinx-codeautolink";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-hoverxref/default.nix b/pkgs/development/python-modules/sphinx-hoverxref/default.nix
new file mode 100644
index 0000000000000..c606297e1afc3
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-hoverxref/default.nix
@@ -0,0 +1,67 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flit-core
+, pythonImportsCheckHook
+# documentation build dependencies
+, sphinxHook
+, sphinx-notfound-page
+, sphinx-prompt
+, sphinx-rtd-theme
+, sphinx-tabs
+, sphinx-version-warning
+, sphinxcontrib-autoapi
+, sphinxcontrib-bibtex
+, sphinxemoji
+# runtime dependencies
+, sphinx
+, sphinx-jquery
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-hoverxref";
+  version = "1.3.0";
+  format = "flit";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "readthedocs";
+    repo = "sphinx-hoverxref";
+    rev = version;
+    hash = "sha256-DJ+mHu9IeEYEyf/SD+nDNtWpTf6z7tQzG0ogaECDpkU=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+    pythonImportsCheckHook
+
+    sphinxHook
+    sphinx-notfound-page
+    sphinx-prompt
+    sphinx-rtd-theme
+    sphinx-tabs
+    sphinx-version-warning
+    sphinxcontrib-autoapi
+    sphinxcontrib-bibtex
+    sphinxemoji
+  ];
+
+  propagatedBuildInputs = [ sphinx sphinx-jquery ];
+
+  pythonImportsCheck = [ "hoverxref" ];
+
+  meta = with lib; {
+    description = "A sphinx extension for creating tooltips on the cross references of the documentation";
+    longDescription = ''
+      sphinx-hoverxref is a Sphinx extension to show a floating window
+      (tooltips or modal dialogues) on the cross references of the
+      documentation embedding the content of the linked section on them.
+
+      With sphinx-hoverxref, you don’t need to click a link to see what’s
+      in there.
+    '';
+    homepage = "https://github.com/readthedocs/sphinx-hoverxref";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-jquery/default.nix b/pkgs/development/python-modules/sphinx-jquery/default.nix
new file mode 100644
index 0000000000000..6bbf8687f5a13
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-jquery/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flit-core
+, pythonImportsCheckHook
+, sphinx
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-jquery";
+  version = "3.0.0";
+  format = "flit";
+
+  src = fetchFromGitHub {
+    owner = "sphinx-contrib";
+    repo = "jquery";
+    rev = "v${version}";
+    hash = "sha256-argG+jMUqLiWo4lKWAmHmUxotHl+ddJuJZ/zcUl9u5Q=";
+  };
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    flit-core
+  ];
+
+  propagatedBuildInputs = [ sphinx ];
+
+  pythonImportsCheck = [ "sphinxcontrib.jquery" ];
+
+  meta = with lib; {
+    description = "A sphinx extension that ensures that jQuery is installed for use in Sphinx themes or extensions";
+    homepage = "https://github.com/sphinx-contrib/jquery";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-notfound-page/default.nix b/pkgs/development/python-modules/sphinx-notfound-page/default.nix
new file mode 100644
index 0000000000000..dd2efe81fd151
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-notfound-page/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flit-core
+, pythonImportsCheckHook
+# documentation build dependencies
+, sphinxHook
+, sphinx-prompt
+, sphinx-rtd-theme
+, sphinx-tabs
+, sphinxcontrib-autoapi
+, sphinxemoji
+# runtime dependencies
+, sphinx
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-notfound-page";
+  version = "0.8.3";
+  format = "flit";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "readthedocs";
+    repo = "sphinx-notfound-page";
+    rev = version;
+    hash = "sha256-9iP6X2dqtMC3+CIrNI3fGDLL8xyXVAWNhN90DlMa9JU=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+    pythonImportsCheckHook
+    sphinxHook
+    sphinx-prompt
+    sphinx-rtd-theme
+    sphinx-tabs
+    sphinxcontrib-autoapi
+    sphinxemoji
+  ];
+
+  propagatedBuildInputs = [ sphinx ];
+
+  pythonImportsCheck = [ "notfound" ];
+
+  meta = with lib; {
+    description = "A sphinx extension to create a custom 404 page with absolute URLs hardcoded";
+    homepage = "https://github.com/readthedocs/sphinx-notfound-page";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-prompt/default.nix b/pkgs/development/python-modules/sphinx-prompt/default.nix
new file mode 100644
index 0000000000000..cc5d5f0b2eca6
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-prompt/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, sphinxHook
+, sphinx
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-prompt";
+  version = "1.5.0";
+
+  src = fetchFromGitHub {
+    owner = "sbrunner";
+    repo = "sphinx-prompt";
+    rev = version;
+    hash = "sha256-ClUPAIyPrROJw4GXeakA8U443Vlhy3P/2vFnAtyrPHU=";
+  };
+
+  propagatedBuildInputs = [ sphinx ];
+
+  meta = with lib; {
+    description = "A sphinx extension for creating unselectable prompt";
+    homepage = "https://github.com/sbrunner/sphinx-prompt";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-tabs/default.nix b/pkgs/development/python-modules/sphinx-tabs/default.nix
new file mode 100644
index 0000000000000..a2714c2d12603
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-tabs/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonImportsCheckHook
+# documentation build dependencies
+, sphinxHook
+# runtime dependencies
+, sphinx
+, pygments
+, docutils
+# test dependencies
+, pytest
+, beautifulsoup4
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-tabs";
+  version = "3.4.1";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "executablebooks";
+    repo = "sphinx-tabs";
+    rev = "v${version}";
+    hash = "sha256-5lpo7NRCksXJOdbLSFjDxQV/BsxRBb93lA6tavz6YEs=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py --replace 'docutils~=0.18.0' 'docutils'
+  '';
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    sphinxHook
+  ];
+
+  propagatedBuildInputs = [
+    sphinx
+    pygments
+    docutils
+  ];
+
+  nativeCheckInputs = [ pytest
+    beautifulsoup4
+  ];
+
+  pythonImportsCheck = [ "sphinx_tabs" ];
+
+  meta = with lib; {
+    description = "A sphinx extension for creating tabbed content when building HTML.";
+    homepage = "https://github.com/executablebooks/sphinx-tabs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-version-warning/default.nix b/pkgs/development/python-modules/sphinx-version-warning/default.nix
new file mode 100644
index 0000000000000..bf57d4f2fd834
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-version-warning/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, pythonImportsCheckHook
+, sphinx
+, sphinxHook
+, sphinxcontrib-autoapi
+, sphinx-rtd-theme
+, sphinx-tabs
+, sphinx-prompt
+, sphinxemoji
+}:
+
+# Latest tagged release release "1.1.2" (Nov 2018) does not contain
+# documenation, it was added in commits Aug 10, 2019. Repository does not have
+# any activity since then.
+buildPythonPackage rec {
+  pname = "sphinx-version-warning";
+  version = "unstable-2019-08-10";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "humitos";
+    repo = "sphinx-version-warning";
+    rev = "a82156c2ea08e5feab406514d0ccd9d48a345f48";
+    hash = "sha256-WnJYMk1gPLT0dBn7lmxVDNVkLYkDCgQOtM9fQ3kc6k0=";
+  };
+
+  # It tries to write to file relative to it own location at runtime
+  # and gets permission denied, since Nix store is immutable.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/humitos/sphinx-version-warning/commit/cb1b47becf2a0d3b2570ca9929f42f7d7e472b6f.patch";
+      hash = "sha256-Vj0QAHIBmc0VxE+TTmJePzvr5nc45Sn2qqM+C/pkgtM=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    sphinxHook
+    sphinxcontrib-autoapi
+    sphinx-rtd-theme
+    sphinx-tabs
+    sphinx-prompt
+    sphinxemoji
+  ];
+
+  propagatedBuildInputs = [ sphinx ];
+
+  pythonImportsCheck = [ "versionwarning" ];
+
+  meta = with lib; {
+    description = "A sphinx extension to show a warning banner at the top of your documentation";
+    homepage = "https://github.com/humitos/sphinx-version-warning";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 49a8ca0c9971d..0f0f455a42354 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -143,7 +143,8 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     git
     glibcLocales
-    hypothesis
+    # "hypothesis" indirectly depends on twisted to build its documentation.
+    (hypothesis.override { enableDocumentation = false; })
     pyhamcrest
   ]
   ++ passthru.optional-dependencies.conch
diff --git a/pkgs/development/tools/altair-graphql-client/default.nix b/pkgs/development/tools/altair-graphql-client/default.nix
index f9d1c4549a79b..5d69cef598d00 100644
--- a/pkgs/development/tools/altair-graphql-client/default.nix
+++ b/pkgs/development/tools/altair-graphql-client/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "altair";
-  version = "5.0.10";
+  version = "5.0.13";
 
   src = fetchurl {
     url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-NrFkLZiqX21BSIuE8qF7lurNWKgmf7PAa/1IpPbcUf0=";
+    sha256 = "sha256-kjAC21gZ3VKM+WFKV3tOPzIaG3t9rUSo2M3CEsA1q+I=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/development/tools/azcopy/default.nix b/pkgs/development/tools/azcopy/default.nix
index 55c6a34758792..1a7e13e0ec3df 100644
--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.16.2";
+  version = "10.17.0";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     rev = "v${version}";
-    sha256 = "sha256-Pab4IYktNWWTudAY7Zx9dI+fRp0yihD78L0MmBHxeNY=";
+    sha256 = "sha256-a25MA/fDjCvsKzEh34IM34TyXECJ0j07H9jr6JX1uc0=";
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-OlsNFhduilo8fJs/mynrAiwuXcfCZERdaJk3VcAUCJw=";
+  vendorHash = "sha256-Cb4RVY+E8QcvxSworBujsvqSSGxFGfW0W7nFjmpfLQ8=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/build-managers/wafHook/default.nix b/pkgs/development/tools/build-managers/wafHook/default.nix
index 2131caede3c8c..f0f3a683aab01 100644
--- a/pkgs/development/tools/build-managers/wafHook/default.nix
+++ b/pkgs/development/tools/build-managers/wafHook/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, pkgs, makeSetupHook, waf }:
 
 makeSetupHook {
+  name = "waf-hook";
   substitutions = {
     inherit waf;
     crossFlags = lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system)
diff --git a/pkgs/development/tools/ctlptl/default.nix b/pkgs/development/tools/ctlptl/default.nix
index f4b155da72651..1759596e8f713 100644
--- a/pkgs/development/tools/ctlptl/default.nix
+++ b/pkgs/development/tools/ctlptl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.15";
+  version = "0.8.16";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JCBlP8ESCiqr4pk8QyG5CVs+3qSlnvw0jYS5R0Civk0=";
+    hash = "sha256-JCBlP8ESCiqr4pk8QyG5CVs+3qSlnvw0jYS5R0Civk0=";
   };
 
-  vendorSha256 = "sha256-M9B/rfMBjYJb9szmYPVZqURlcv62qHOLJ3ka0v++z0s=";
+  vendorHash = "sha256-M9B/rfMBjYJb9szmYPVZqURlcv62qHOLJ3ka0v++z0s=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/database/sqlcl/default.nix b/pkgs/development/tools/database/sqlcl/default.nix
index 733282cd40677..ccf3bd4a23d3f 100644
--- a/pkgs/development/tools/database/sqlcl/default.nix
+++ b/pkgs/development/tools/database/sqlcl/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, makeWrapper, requireFile, unzip, jdk }:
 
 let
-  version = "22.3.1";
-  fileVersion = "1032109-01";
+  version = "22.4.0.342.1212";
+  fileVersion = "1032835-01";
 in
   stdenv.mkDerivation {
 
@@ -37,7 +37,7 @@ in
 
         nix-prefetch-url --type sha256 file:///path/to/${name}
     '';
-    sha256 = "0yqj8m2zwl8m7zxrzjnbl2rqnl2imn5h1bfpnmklp03nkakbzjbn";
+    sha256 = "0i4xsj502s465fgmlcqn80r8rqzr11mv74x9fzrlbqmkkh5c782k";
   };
 
   nativeBuildInputs = [ makeWrapper unzip ];
diff --git a/pkgs/development/tools/godot/3/dont_clobber_environment.patch b/pkgs/development/tools/godot/3/dont_clobber_environment.patch
index 74e1241513ba8..cfd3113a6aaea 100644
--- a/pkgs/development/tools/godot/3/dont_clobber_environment.patch
+++ b/pkgs/development/tools/godot/3/dont_clobber_environment.patch
@@ -1,19 +1,23 @@
-diff --git a/SConstruct b/SConstruct
-index d138c7b250..c925bf908e 100644
+scons does not use os environment by default:
+  https://scons.org/doc/2.1.0/HTML/scons-user/x1750.html
+
+nixpkgs' cc-wrapper on the other hand relies on various NIX_* variables
+to be passed through like NIX_CFLAGS_COMPILE_BEFORE.
 --- a/SConstruct
 +++ b/SConstruct
-@@ -65,10 +65,10 @@ elif platform_arg == "javascript":
- # want to have to pull in manually.
- # Then we prepend PATH to make it take precedence, while preserving SCons' own entries.
- env_base = Environment(tools=custom_tools)
+@@ -67,14 +67,7 @@ elif platform_arg == "javascript":
+ elif os.name == "nt" and methods.get_cmdline_bool("use_mingw", False):
+     custom_tools = ["mingw"]
+ 
+-# We let SCons build its default ENV as it includes OS-specific things which we don't
+-# want to have to pull in manually.
+-# Then we prepend PATH to make it take precedence, while preserving SCons' own entries.
+-env_base = Environment(tools=custom_tools)
 -env_base.PrependENVPath("PATH", os.getenv("PATH"))
 -env_base.PrependENVPath("PKG_CONFIG_PATH", os.getenv("PKG_CONFIG_PATH"))
 -if "TERM" in os.environ:  # Used for colored output.
 -    env_base["ENV"]["TERM"] = os.environ["TERM"]
-+for k in ("TERM", "PATH", "PKG_CONFIG_PATH"):
-+    if (k in os.environ):
-+        env_base["ENV"][k] = os.environ[k]
-+
-
++env_base = Environment(ENV = os.environ, tools=custom_tools)
+ 
  env_base.disabled_modules = []
  env_base.use_ptrcall = False
diff --git a/pkgs/development/tools/jql/default.nix b/pkgs/development/tools/jql/default.nix
index 071f944a82f3b..1a1c3e7a99614 100644
--- a/pkgs/development/tools/jql/default.nix
+++ b/pkgs/development/tools/jql/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jql";
-  version = "5.1.4";
+  version = "5.1.6";
 
   src = fetchFromGitHub {
     owner = "yamafaktory";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-D6Y3I5UPChdLlTZ49iToQpE8CrHh3VjWV6PI7fRhU/A=";
+    sha256 = "sha256-ybcX2dm+gnvhWAcraCq22uGqe8NdqNd8QMNKVkqgNqY=";
   };
 
-  cargoSha256 = "sha256-GqfQD8NK/HYODEGUmfo+MMVsWg2CabZFLfBTp4UXV2Q=";
+  cargoHash = "sha256-GzRxXBDMALaXLhpklVoSn+8uCgws5AjkC+fynym0iYo=";
 
   meta = with lib; {
     description = "A JSON Query Language CLI tool built with Rust";
diff --git a/pkgs/development/tools/kafkactl/default.nix b/pkgs/development/tools/kafkactl/default.nix
index c3af6e9c1a4b5..d18b32c6f440b 100644
--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lwyM2l4eBCtkyAtG51cEy29Jw/vakjrfYVBSZ9pIBFs=";
+    sha256 = "sha256-ZEXW9nqkR0yuVIY9qr1RyKVE7tSlP59Xb4JZfdAK2To=";
   };
 
-  vendorSha256 = "sha256-ba7amhYuCB3k1esu1qYBCgUZMjlq5iac498TMqeGuz0=";
+  vendorHash = "sha256-e7SJjDWcHPgupZujeRD3Zg6vFAudDC3V60R2B61fjGU=";
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/tools/kustomize/kustomize-sops.nix b/pkgs/development/tools/kustomize/kustomize-sops.nix
index 6efeaad638486..28c80444650d2 100644
--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kustomize-sops";
-  version = "3.1.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "viaduct-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sufP/+YixgrOCJJ4P1SjmZpRlSaufRmnVDiv6H+RCyQ=";
+    sha256 = "sha256-8CZcPZLainc7iRZ5Ul27QxW3oK7sikCjzCBEkfCeNUc=";
   };
 
-  vendorHash = "sha256-WZb8VsFKpvvMys1iK3irEsWCnvKaKDzuyFertVswpdE=";
+  vendorHash = "sha256-GBjMN6pyB+48e5LNqLBbh6a5fC9P0T53CZUPGNcbBDc=";
 
   installPhase = ''
     mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
diff --git a/pkgs/development/tools/marksman/default.nix b/pkgs/development/tools/marksman/default.nix
index aa3b292751320..d31268f9cedda 100644
--- a/pkgs/development/tools/marksman/default.nix
+++ b/pkgs/development/tools/marksman/default.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "marksman";
-  version = "2022-12-28";
+  version = "2023-01-29";
 
   src = fetchFromGitHub {
     owner = "artempyanykh";
     repo = "marksman";
     rev = version;
-    sha256 = "sha256-IOmAOO45sD0TkphbHWLCXXyouxKNJoiNYHXV/bw0xH4=";
+    sha256 = "sha256-UPPO4ueu7gMR7a573M2/xT3N0QgRSNBshJAqoyXEZpc=";
   };
 
   projectFile = "Marksman/Marksman.fsproj";
diff --git a/pkgs/development/tools/micronaut/default.nix b/pkgs/development/tools/micronaut/default.nix
index 8d3d492649e5e..a7c8c1f8db302 100644
--- a/pkgs/development/tools/micronaut/default.nix
+++ b/pkgs/development/tools/micronaut/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-starter/releases/download/v${version}/micronaut-cli-${version}.zip";
-    sha256 = "sha256-a07vFya7c8ai0YjNvXCAWSoQLH81U4cIr0QsgX3WcJY=";
+    sha256 = "sha256-IrgypySq5RUi9X3pVC0t+Ezw7aNu8mIKZYY4CEaKhU4=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/development/tools/misc/automake/automake-1.11.x.nix b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
index 4f9a92d362bcb..161dca6f1805d 100644
--- a/pkgs/development/tools/misc/automake/automake-1.11.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
@@ -22,9 +22,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ perl autoconf ];
   buildInputs = [ autoconf ];
 
-  # Disable indented log output from Make, otherwise "make.test" will
-  # fail.
-  preCheck = "unset NIX_INDENT_MAKE";
   doCheck = false; # takes _a lot_ of time, fails 11 of 782 tests
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
diff --git a/pkgs/development/tools/misc/automake/automake-1.15.x.nix b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
index 470827c2b45e9..f0df759ee2cf6 100644
--- a/pkgs/development/tools/misc/automake/automake-1.15.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
@@ -16,9 +16,6 @@ stdenv.mkDerivation rec {
 
   patches = [ ./help2man-SOURCE_DATE_EPOCH-support.patch ];
 
-  # Disable indented log output from Make, otherwise "make.test" will
-  # fail.
-  preCheck = "unset NIX_INDENT_MAKE";
   doCheck = false; # takes _a lot_ of time, fails 3 out of 2698 tests, all seem to be related to paths
   doInstallCheck = false; # runs the same thing, fails the same tests
 
diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 65d6185f50c07..0d9572c6f3140 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -15,9 +15,6 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  # Disable indented log output from Make, otherwise "make.test" will
-  # fail.
-  preCheck = "unset NIX_INDENT_MAKE";
   doCheck = false; # takes _a lot_ of time, fails 3 out of 2698 tests, all seem to be related to paths
   doInstallCheck = false; # runs the same thing, fails the same tests
 
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 3d53c5122f00d..39e852a60bbba 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -15,7 +15,6 @@ in
 , noSysDirs
 , perl
 , substitute
-, texinfo
 , zlib
 
 , enableGold ? withGold stdenv.targetPlatform
@@ -52,7 +51,7 @@ let
   targetPrefix = lib.optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-";
 in
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = targetPrefix + "binutils";
   inherit version;
 
@@ -110,10 +109,12 @@ stdenv.mkDerivation {
 
   strictDeps = true;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
+  # texinfo was removed here in https://github.com/NixOS/nixpkgs/pull/210132
+  # to reduce rebuilds during stdenv bootstrap.  Please don't add it back without
+  # checking the impact there first.
   nativeBuildInputs = [
     bison
     perl
-    texinfo
   ]
   ++ lib.optionals targetPlatform.isiOS [ autoreconfHook ]
   ++ lib.optionals buildPlatform.isDarwin [ autoconf269 automake gettext libtool ]
@@ -144,6 +145,20 @@ stdenv.mkDerivation {
     for i in binutils/Makefile.in gas/Makefile.in ld/Makefile.in gold/Makefile.in; do
         sed -i "$i" -e 's|ln |ln -s |'
     done
+
+    # autoreconfHook is not included for all targets.
+    # Call it here explicitly as well.
+    ${finalAttrs.postAutoreconf}
+  '';
+
+  postAutoreconf = ''
+    # As we regenerated configure build system tries hard to use
+    # texinfo to regenerate manuals. Let's avoid the dependency
+    # on texinfo in bootstrap path and keep manuals unmodified.
+    touch gas/doc/.dirstamp
+    touch gas/doc/asconfig.texi
+    touch gas/doc/as.1
+    touch gas/doc/as.info
   '';
 
   # As binutils takes part in the stdenv building, we don't want references
@@ -226,4 +241,4 @@ stdenv.mkDerivation {
     # collision due to the ld/as wrappers/symlinks in the latter.
     priority = 10;
   };
-}
+})
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index 7eead6137e97b..2b71fa7116705 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -37,6 +37,18 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strndupa.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "sha256-7daehJj1t0wPtQzTv+/Rpuqqs5Ng/EYnZzrcf2o/Lb0=";
     })
+    (fetchpatch {
+      name = "use-curlopt_protocols_str-for-new-libcurl.patch";
+      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=6560fb26a62ef135a804357ef4f15a47de3e49b3;hp=a5b07cdf9c491fb7a4a16598c482c68b718f59b9";
+      excludes = [ "debuginfod/ChangeLog" ]; # Doesn't apply
+      sha256 = "sha256-yjeliqojRGvfwbXynmxFGyKqAY7AEr0mbSGQEliYhZ4=";
+    })
+    (fetchpatch {
+      name = "fix-usage-of-deprecated-curlinfo.patch";
+      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=d2bf497b12fbd49b4996ccf0744303ffd67735b1;hp=6ecd16410ce1fe5cb0ac5b7c3342c5cc330e3a04";
+      excludes = [ "debuginfod/ChangeLog" ]; # Doesn't apply
+      sha256 = "sha256-zMx/TazM7vXJre2XagIWvwRS8cd8pbzMTmAbpbqZmx0=";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [ ./musl-error_h.patch ];
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 8625a421af64f..a2c58010eff7c 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, autoconf, automake, m4, perl, help2man
+{ lib, stdenv, fetchurl, fetchpatch, m4
 , runtimeShell
 , file
 }:
@@ -23,28 +23,22 @@ stdenv.mkDerivation rec {
   #   https://lists.gnu.org/archive/html/autotools-announce/2022-03/msg00000.html
   FILECMD = "${file}/bin/file";
 
-  # Normally we'd use autoreconfHook, but that includes libtoolize.
-  postPatch = ''
-    aclocal -I m4
-    automake
-    autoconf
-
-    pushd libltdl
-    aclocal -I ../m4
-    automake
-    autoconf
-    popd
-  '' +
+  postPatch =
   # libtool commit da2e352735722917bf0786284411262195a6a3f6 changed
   # the shebang from `/bin/sh` (which is a special sandbox exception)
   # to `/usr/bin/env sh`, meaning that we now need to patch shebangs
   # in libtoolize.in:
   ''
     substituteInPlace libtoolize.in       --replace '#! /usr/bin/env sh' '#!${runtimeShell}'
+    # avoid help2man run after 'libtoolize.in' update
+    touch doc/libtoolize.1
   '';
 
   strictDeps = true;
-  nativeBuildInputs = [ autoconf automake help2man m4 perl ];
+  # As libtool is an early bootstrap dependency try hard not to
+  # add autoconf and automake or help2man dependencies here. That way we can
+  # avoid pulling in perl and get away with just an `m4` depend.
+  nativeBuildInputs = [ m4 file ];
   propagatedBuildInputs = [ m4 file ];
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index ac80fc471e063..017367e90ba61 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -6,13 +6,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.96.4";
+  version = "4.96.5";
 
   src = fetchFromGitHub {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    sha256 = "sha256-S+8KizjayqeiWsMySWjRoZQf7ODCjdMq5ULoetOdYiA=";
+    hash = "sha256-3ZEGCKc7inbqcE4LuhfKON3C8LebVOlZPEhOHVgx8Lo=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/misc/patchelf/setup-hook.sh b/pkgs/development/tools/misc/patchelf/setup-hook.sh
index 576b9ca2103ec..8f010a3f4d0b1 100644
--- a/pkgs/development/tools/misc/patchelf/setup-hook.sh
+++ b/pkgs/development/tools/misc/patchelf/setup-hook.sh
@@ -8,7 +8,7 @@ patchELF() {
     local dir="$1"
     [ -e "$dir" ] || return 0
 
-    header "shrinking RPATHs of ELF executables and libraries in $dir"
+    echo "shrinking RPATHs of ELF executables and libraries in $dir"
 
     local i
     while IFS= read -r -d $'\0' i; do
@@ -17,6 +17,4 @@ patchELF() {
         echo "shrinking $i"
         patchelf --shrink-rpath "$i" || true
     done < <(find "$dir" -type f -print0)
-
-    stopNest
 }
diff --git a/pkgs/development/tools/misc/pkg-config/default.nix b/pkgs/development/tools/misc/pkg-config/default.nix
index 9e14815910edd..d4feca6dfe6e5 100644
--- a/pkgs/development/tools/misc/pkg-config/default.nix
+++ b/pkgs/development/tools/misc/pkg-config/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     rm -f check/check-requires-private check/check-gtk check/missing
   '';
 
-  buildInputs = lib.optional (stdenv.isCygwin || stdenv.isDarwin || stdenv.isSunOS) libiconv;
+  buildInputs = [ libiconv ];
 
   configureFlags = [ "--with-internal-glib" ]
     ++ lib.optionals (stdenv.isSunOS) [ "--with-libiconv=gnu" "--with-system-library-path" "--with-system-include-path" "CFLAGS=-DENABLE_NLS" ]
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index b6c018693e5e8..bb55ba8079644 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "1.9.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-i4+MOEZWt+Qb05HgXcGR0uDuMoOAyMhVeLPQwnGiEw8=";
+    hash = "sha256-5zE5a+BYzQjgVb0Ti7bSQrGzTyysOTTR0NMOO5IKG68=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 54ff2962f9837..2789a3d608f20 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.237";
+  version = "0.0.238";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-c2mD03gxbBnnifTXPpdJk4kwpeHdrwckymaFGKJwDc8=";
+    sha256 = "sha256-hsJJsPJQrkzn+otpFhsESLRhfYEcUSXJULkScWPyQNk=";
   };
 
-  cargoSha256 = "sha256-pYOMCmNrI4uzqXkbc2D9UvNHg2PlibmEhtml+A1V1BQ=";
+  cargoSha256 = "sha256-stEPoiXKXnjYcKqlJPwcjWAV4W2GLIp2lQ0ejVd/EF8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/rust/cargo-semver-checks/default.nix b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
index bac2d2d9f3938..359f5dbe64d22 100644
--- a/pkgs/development/tools/rust/cargo-semver-checks/default.nix
+++ b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iUeEZ6u5IIRP0NEXzgMcleuUQ11meCFIpweTdod5SIk=";
+    sha256 = "sha256-zObflf9BKq24km54LW7It4Lvff0OKYNDb02uatdX7g4=";
   };
 
-  cargoSha256 = "sha256-Fct5ebwGDGMqAHP+2NRseKTIsVQlQZFeZfbssaBzRgg=";
+  cargoSha256 = "sha256-itL6WpM4OLn4mzdB0ytM2J7F1fRDrXwCaI/8WdLo6y0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/swiftpm2nix/default.nix b/pkgs/development/tools/swiftpm2nix/default.nix
new file mode 100644
index 0000000000000..25d6b06ef98bb
--- /dev/null
+++ b/pkgs/development/tools/swiftpm2nix/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, callPackage, makeWrapper, jq, nix-prefetch-git }:
+
+stdenv.mkDerivation {
+  name = "swiftpm2nix";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    install -vD ${./swiftpm2nix.sh} $out/bin/swiftpm2nix
+    wrapProgram $out/bin/$name \
+      --prefix PATH : ${lib.makeBinPath [ jq nix-prefetch-git ]} \
+  '';
+
+  preferLocalBuild = true;
+
+  passthru = callPackage ./support.nix { };
+
+  meta = {
+    description = "Generate a Nix expression to fetch swiftpm dependencies";
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/swiftpm2nix/support.nix b/pkgs/development/tools/swiftpm2nix/support.nix
new file mode 100644
index 0000000000000..94076517ebfcf
--- /dev/null
+++ b/pkgs/development/tools/swiftpm2nix/support.nix
@@ -0,0 +1,56 @@
+{ lib, fetchgit, formats }:
+with lib;
+let
+  json = formats.json { };
+in rec {
+
+  # Derive a pin file from workspace state.
+  mkPinFile = workspaceState:
+    assert workspaceState.version == 5;
+    json.generate "Package.resolved" {
+      version = 1;
+      object.pins = map (dep: {
+        package = dep.packageRef.name;
+        repositoryURL = dep.packageRef.location;
+        state = dep.state.checkoutState;
+      }) workspaceState.object.dependencies;
+    };
+
+  # Make packaging helpers from swiftpm2nix generated output.
+  helpers = generated: let
+    inherit (import generated) workspaceStateFile hashes;
+    workspaceState = builtins.fromJSON (builtins.readFile workspaceStateFile);
+    pinFile = mkPinFile workspaceState;
+  in rec {
+
+    # Create fetch expressions for dependencies.
+    sources = listToAttrs (
+      map (dep: nameValuePair dep.subpath (fetchgit {
+        url = dep.packageRef.location;
+        rev = dep.state.checkoutState.revision;
+        sha256 = hashes.${dep.subpath};
+      })) workspaceState.object.dependencies
+    );
+
+    # Configure phase snippet for use in packaging.
+    configure = ''
+      mkdir -p .build/checkouts
+      ln -sf ${pinFile} ./Package.resolved
+      install -m 0600 ${workspaceStateFile} ./.build/workspace-state.json
+    ''
+      + concatStrings (mapAttrsToList (name: src: ''
+        ln -s '${src}' '.build/checkouts/${name}'
+      '') sources)
+      + ''
+        # Helper that makes a swiftpm dependency mutable by copying the source.
+        swiftpmMakeMutable() {
+          local orig="$(readlink .build/checkouts/$1)"
+          rm .build/checkouts/$1
+          cp -r "$orig" .build/checkouts/$1
+          chmod -R u+w .build/checkouts/$1
+        }
+      '';
+
+  };
+
+}
diff --git a/pkgs/development/tools/swiftpm2nix/swiftpm2nix.sh b/pkgs/development/tools/swiftpm2nix/swiftpm2nix.sh
new file mode 100755
index 0000000000000..72051b4e448df
--- /dev/null
+++ b/pkgs/development/tools/swiftpm2nix/swiftpm2nix.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# Generates a Nix expression to fetch swiftpm dependencies, and a
+# configurePhase snippet to prepare a working directory for swift-build.
+
+set -eu -o pipefail
+shopt -s lastpipe
+
+stateFile=".build/workspace-state.json"
+if [[ ! -f "$stateFile" ]]; then
+  echo >&2 "Missing $stateFile. Run 'swift package resolve' first."
+  exit 1
+fi
+
+if [[ "$(jq .version $stateFile)" != "5" ]]; then
+  echo >&2 "Unsupported $stateFile version"
+  exit 1
+fi
+
+# Iterate dependencies and prefetch.
+hashes=""
+jq -r '.object.dependencies[] | "\(.subpath) \(.packageRef.location) \(.state.checkoutState.revision)"' $stateFile \
+| while read -r name url rev; do
+  echo >&2 "-- Fetching $name"
+  sha256="$(nix-prefetch-git $url $rev | jq -r .sha256)"
+  hashes+="
+    \"$name\" = \"$sha256\";"
+  echo >&2
+done
+hashes+=$'\n'"  "
+
+# Generate output.
+mkdir -p nix
+# Copy the workspace state, but clear 'artifacts'.
+jq '.object.artifacts = []' < $stateFile > nix/workspace-state.json
+# Build an expression for fetching sources, and preparing the working directory.
+cat > nix/default.nix << EOF
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {$hashes};
+}
+EOF
+echo >&2 "-- Generated ./nix"
diff --git a/pkgs/development/tools/xcbuild/sdks.nix b/pkgs/development/tools/xcbuild/sdks.nix
index 5ff3ca6808dc8..e1b8254d7fd89 100644
--- a/pkgs/development/tools/xcbuild/sdks.nix
+++ b/pkgs/development/tools/xcbuild/sdks.nix
@@ -2,7 +2,7 @@
 , writeText, version, xcodePlatform }:
 
 let
-  inherit (lib.generators) toPlist;
+  inherit (lib.generators) toPlist toJSON;
 
   SDKSettings = {
     CanonicalName = sdkName;
@@ -22,6 +22,7 @@ in
 runCommand "SDKs" {} ''
   sdk=$out/${sdkName}.sdk
   install -D ${writeText "SDKSettings.plist" (toPlist {} SDKSettings)} $sdk/SDKSettings.plist
+  install -D ${writeText "SDKSettings.json" (toJSON {} SDKSettings)} $sdk/SDKSettings.json
   install -D ${writeText "SystemVersion.plist" (toPlist {} SystemVersion)} $sdk/System/Library/CoreServices/SystemVersion.plist
   ln -s $sdk $sdk/usr
 
diff --git a/pkgs/development/tools/xcbuild/wrapper.nix b/pkgs/development/tools/xcbuild/wrapper.nix
index 2dbea4e3833ae..35eddd40f859a 100644
--- a/pkgs/development/tools/xcbuild/wrapper.nix
+++ b/pkgs/development/tools/xcbuild/wrapper.nix
@@ -77,7 +77,7 @@ while [ $# -gt 0 ]; do
          --toolchain | -toolchain) shift ;;
          --find | -find | -f)
            shift
-           command -v $1 ;;
+           command -v $1 || exit 1 ;;
          --log | -log) ;; # noop
          --verbose | -verbose) ;; # noop
          --no-cache | -no-cache) ;; # noop
diff --git a/pkgs/games/itchiodl/default.nix b/pkgs/games/itchiodl/default.nix
index ba84b5c3e8181..c68be798f4dc7 100644
--- a/pkgs/games/itchiodl/default.nix
+++ b/pkgs/games/itchiodl/default.nix
@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "itchiodl";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "Emersont1";
     repo = "itchio";
     rev = "v${version}";
-    hash = "sha256-U9oLrocwVdTqTQ26/MMiYO++yFGdOjnn8g+ea1jCl/A=";
+    hash = "sha256-tylMEsUdeMUuLcxRMkkJE7vPAVuqc/cVJ4DB3xmV+iA=";
   };
 
   format = "pyproject";
diff --git a/pkgs/games/openra/common.nix b/pkgs/games/openra/common.nix
index 59c897ba37135..d9cc93e823484 100644
--- a/pkgs/games/openra/common.nix
+++ b/pkgs/games/openra/common.nix
@@ -12,7 +12,9 @@ with lib;
 let
   path = makeBinPath ([ mono python3 ] ++ optional (zenity != null) zenity);
   rpath = makeLibraryPath [ lua freetype openal SDL2 ];
-  mkdirp = makeSetupHook { } ./mkdirp.sh;
+  mkdirp = makeSetupHook {
+    name = "openra-mkdirp-hook";
+  } ./mkdirp.sh;
 
 in {
   patchEngine = dir: version: ''
diff --git a/pkgs/misc/dxvk/default.nix b/pkgs/misc/dxvk/default.nix
index 2c55b6b50cef7..0e46011e7e102 100644
--- a/pkgs/misc/dxvk/default.nix
+++ b/pkgs/misc/dxvk/default.nix
@@ -1,75 +1,34 @@
 { lib
-, pkgs
 , stdenvNoCC
 , fetchFromGitHub
 , pkgsCross
+, stdenv
+, bash
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs:
   let
-    system = lib.toLower stdenvNoCC.targetPlatform.uname.system;
-
-    # DXVK needs to be a separate derivation because it’s actually a set of DLLs for Windows that
-    # needs to be built with a cross-compiler.
-    dxvk32 = pkgsCross.mingw32.callPackage ./dxvk.nix {
-      inherit (finalAttrs) src version dxvkPatches;
-    };
-    dxvk64 = pkgsCross.mingwW64.callPackage ./dxvk.nix {
-      inherit (finalAttrs) src version dxvkPatches;
-    };
-
-    # Split out by platform to make maintenance easy in case supported versions on Darwin and other
-    # platforms diverge (due to the need for Darwin-specific patches that would fail to apply).
-    # Should that happen, set `darwin` to the last working `rev` and `hash`.
-    srcs = rec {
-      darwin = {
-        rev = "v${finalAttrs.version}";
-        hash = "sha256-T93ZylxzJGprrP+j6axZwl2d3hJowMCUOKNjIyNzkmE=";
-        version = "1.10.3";
-      };
-      default = {
-        rev = "v${finalAttrs.version}";
-        hash = "sha256-mboVLdPgZMzmqyeF0jAloEz6xqfIDiY/X98e7l2KZnw=";
-        version = "2.0";
-      };
-    };
+    dxvk32 = if stdenv.isDarwin then pkgsCross.mingw32.dxvk_1 else pkgsCross.mingw32.dxvk_2;
+    dxvk64 = if stdenv.isDarwin then pkgsCross.mingwW64.dxvk_1 else pkgsCross.mingwW64.dxvk_2;
   in
   {
     name = "dxvk";
-    inherit (srcs."${system}" or srcs.default) version;
-
-    src = fetchFromGitHub {
-      owner = "doitsujin";
-      repo = "dxvk";
-      inherit (srcs."${system}" or srcs.default) rev hash;
-    };
-
-    # Override this to patch DXVK itself (rather than the setup script).
-    dxvkPatches = lib.optionals stdenvNoCC.isDarwin [
-      # Patch DXVK to work with MoltenVK even though it doesn’t support some required features.
-      # Some games work poorly (particularly Unreal Engine 4 games), but others work pretty well.
-      ./darwin-dxvk-compat.patch
-      # Use synchronization primitives from the C++ standard library to avoid deadlocks on Darwin.
-      # See: https://www.reddit.com/r/macgaming/comments/t8liua/comment/hzsuce9/
-      ./darwin-thread-primitives.patch
-    ];
+    inherit (dxvk64) version;
 
     outputs = [ "out" "bin" "lib" ];
 
-    # Also copy `mcfgthread-12.dll` due to DXVK’s being built in a MinGW cross environment.
-    patches = [ ./mcfgthread.patch ];
-
+    dontUnpack = true;
     dontConfigure = true;
     dontBuild = true;
 
     installPhase = ''
       mkdir -p $out/bin $bin $lib
-      # Replace both basedir forms to support both DXVK 2.0 and older versions.
-      substitute setup_dxvk.sh $out/bin/setup_dxvk.sh \
+      substitute ${./setup_dxvk.sh} $out/bin/setup_dxvk.sh \
+        --subst-var-by bash ${bash} \
+        --subst-var-by dxvk32 ${dxvk32} \
+        --subst-var-by dxvk64 ${dxvk64} \
         --subst-var-by mcfgthreads32 "${pkgsCross.mingw32.windows.mcfgthreads}" \
-        --subst-var-by mcfgthreads64 "${pkgsCross.mingwW64.windows.mcfgthreads}" \
-        --replace 'basedir=$(dirname "$(readlink -f $0)")' "basedir=$bin" \
-        --replace 'basedir="$(dirname "$(readlink -f "$0")")"' "basedir=$bin"
+        --subst-var-by mcfgthreads64 "${pkgsCross.mingwW64.windows.mcfgthreads}"
       chmod a+x $out/bin/setup_dxvk.sh
       declare -A dxvks=( [x32]=${dxvk32} [x64]=${dxvk64} )
       for arch in "''${!dxvks[@]}"; do
@@ -79,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs:
     '';
 
     meta = {
-      description = "A Vulkan-based translation layer for Direct3D 9/10/11";
+      description = "Setup script for DXVK";
       homepage = "https://github.com/doitsujin/dxvk";
       changelog = "https://github.com/doitsujin/dxvk/releases";
       maintainers = [ lib.maintainers.reckenrode ];
diff --git a/pkgs/misc/dxvk/dxvk.nix b/pkgs/misc/dxvk/dxvk.nix
index 7607c9ee44128..793264f9b30b8 100644
--- a/pkgs/misc/dxvk/dxvk.nix
+++ b/pkgs/misc/dxvk/dxvk.nix
@@ -5,31 +5,81 @@
 , meson
 , ninja
 , windows
-, src
-, version
+, dxvkVersion
 , spirv-headers
 , vulkan-headers
-, dxvkPatches
+, SDL2
+, glfw
+, pkgsBuildHost
+, sdl2Support ? true
+, glfwSupport ? false
 }:
 
+# SDL2 and GLFW support are mutually exclusive.
+assert !sdl2Support || !glfwSupport;
+
 let
   # DXVK 2.0+ no longer vendors certain dependencies. This derivation also needs to build on Darwin,
   # which does not currently support DXVK 2.0, so adapt conditionally for this situation.
-  isDxvk2 = lib.versionAtLeast version "2.0";
+  isDxvk2 = lib.versionAtLeast (srcs.${dxvkVersion}.version) "2.0";
+
+  # DXVK has effectively the same build script regardless of platform.
+  srcs = {
+    "1.10" = rec {
+      version = "1.10.3";
+      src = fetchFromGitHub {
+        owner = "doitsujin";
+        repo = "dxvk";
+        rev = "v${version}";
+        hash = "sha256-T93ZylxzJGprrP+j6axZwl2d3hJowMCUOKNjIyNzkmE=";
+      };
+      # These patches are required when using DXVK with Wine on Darwin.
+      patches = lib.optionals stdenv.buildPlatform.isDarwin [
+        # Patch DXVK to work with MoltenVK even though it doesn’t support some required features.
+        # Some games work poorly (particularly Unreal Engine 4 games), but others work pretty well.
+        ./darwin-dxvk-compat.patch
+        # Use synchronization primitives from the C++ standard library to avoid deadlocks on Darwin.
+        # See: https://www.reddit.com/r/macgaming/comments/t8liua/comment/hzsuce9/
+        ./darwin-thread-primitives.patch
+      ];
+    };
+    "2.1" = rec {
+      version = "2.1";
+      src = fetchFromGitHub {
+        owner = "doitsujin";
+        repo = "dxvk";
+        rev = "v${version}";
+        hash = "sha256-A4KR11brfQbR56dGt371MRwMN/H6HFAU8TlFC97/bRs=";
+        fetchSubmodules = true; # Needed for the DirectX headers and libdisplay-info
+      };
+      patches = [ ];
+    };
+  };
+
+  isWindows = stdenv.targetPlatform.uname.system == "Windows";
+  isCross = stdenv.hostPlatform != stdenv.targetPlatform;
 in
 stdenv.mkDerivation {
   pname = "dxvk";
-  inherit src version;
+  inherit (srcs.${dxvkVersion}) version src patches;
 
   nativeBuildInputs = [ glslang meson ninja ];
-  buildInputs = [ windows.pthreads ]
-    ++ lib.optionals isDxvk2 [ spirv-headers vulkan-headers ];
+  buildInputs = lib.optional isWindows [ windows.pthreads ]
+    ++ lib.optionals isDxvk2 (
+      [ spirv-headers vulkan-headers ]
+      ++ lib.optional (!isWindows && sdl2Support) SDL2
+      ++ lib.optional (!isWindows && glfwSupport) glfw
+    );
 
-  patches = dxvkPatches;
+  postPatch = lib.optionalString isDxvk2 ''
+    substituteInPlace "subprojects/libdisplay-info/tool/gen-search-table.py" \
+      --replace "/usr/bin/env python3" "${lib.getBin pkgsBuildHost.python3}/bin/python3"
+  '';
 
-  preConfigure = lib.optionalString isDxvk2 ''
-    ln -s ${lib.getDev spirv-headers}/include include/spirv/include
-    ln -s ${lib.getDev vulkan-headers}/include include/vulkan/include
+  # Build with the Vulkan SDK in nixpkgs.
+  preConfigure = ''
+    rm -rf include/spirv/include include/vulkan/include
+    mkdir -p include/spirv/include include/vulkan/include
   '';
 
   mesonFlags =
@@ -38,9 +88,12 @@ stdenv.mkDerivation {
     in
     [
       "--buildtype" "release"
-      "--cross-file" "build-win${arch}.txt"
       "--prefix" "${placeholder "out"}"
-    ];
+    ]
+    ++ lib.optionals isCross [ "--cross-file" "build-win${arch}.txt" ]
+    ++ lib.optional glfwSupport "-Ddxvk_native_wsi=glfw";
+
+  doCheck = isDxvk2 && !isCross;
 
   meta = {
     description = "A Vulkan-based translation layer for Direct3D 9/10/11";
@@ -48,6 +101,6 @@ stdenv.mkDerivation {
     changelog = "https://github.com/doitsujin/dxvk/releases";
     maintainers = [ lib.maintainers.reckenrode ];
     license = lib.licenses.zlib;
-    platforms = lib.platforms.windows;
+    platforms = lib.platforms.windows ++ lib.optionals isDxvk2 lib.platforms.linux;
   };
 }
diff --git a/pkgs/misc/dxvk/mcfgthread.patch b/pkgs/misc/dxvk/mcfgthread.patch
deleted file mode 100644
index 037071630172d..0000000000000
--- a/pkgs/misc/dxvk/mcfgthread.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/setup_dxvk.sh b/setup_dxvk.sh
-index 3e63ecf0..87c04f23 100755
---- a/setup_dxvk.sh
-+++ b/setup_dxvk.sh
-@@ -133,6 +133,8 @@
-         rm -v "${dstfile}"
-       fi
-       $file_cmd "${srcfile}" "${dstfile}"
-+    elif [ "${4}" = "--force" ]; then
-+      $file_cmd "${srcfile}" "${dstfile}"
-     else
-       echo "${dstfile}: File not found in wine prefix" >&2
-       return 1
-@@ -170,12 +172,12 @@
- }
- 
- install() {
--  installFile "$win64_sys_path" "$dxvk_lib64" "$1"
-+  installFile "$win64_sys_path" "$dxvk_lib64" "$1" "${2-}"
-   inst64_ret="$?"
- 
-   inst32_ret=-1
-   if $wow64; then
--    installFile "$win32_sys_path" "$dxvk_lib32" "$1"
-+    installFile "$win32_sys_path" "$dxvk_lib32" "$1" "${2-}"
-     inst32_ret="$?"
-   fi
- 
-@@ -214,3 +216,5 @@
- 
- $action d3d10core
- $action d3d11
-+
-+basedir="" dxvk_lib32=@mcfgthreads32@/bin dxvk_lib64=@mcfgthreads64@/bin $action mcfgthread-12 --force
diff --git a/pkgs/misc/dxvk/setup_dxvk.sh b/pkgs/misc/dxvk/setup_dxvk.sh
new file mode 100644
index 0000000000000..8fadb264fd3d8
--- /dev/null
+++ b/pkgs/misc/dxvk/setup_dxvk.sh
@@ -0,0 +1,265 @@
+#!@bash@/bin/bash -e
+
+set -eu -o pipefail
+
+dxvk32_dir=@dxvk32@/bin
+dxvk64_dir=@dxvk64@/bin
+
+mcfgthreads32_dir=@mcfgthreads32@/bin
+mcfgthreads64_dir=@mcfgthreads64@/bin
+
+## Defaults
+
+declare -A dlls=(
+    [d3d9]="dxvk/d3d9.dll"
+    [d3d10]="dxvk/d3d10.dll dxvk/d3d10_1.dll dxvk/d3d10core.dll"
+    [d3d11]="dxvk/d3d11.dll"
+    [dxgi]="dxvk/dxgi.dll"
+    [mcfgthreads]="mcfgthreads/mcfgthread-12.dll"
+)
+
+declare -A targets=([d3d9]=1 [d3d11]=1 [dxgi]=1 [mcfgthreads]=1)
+
+## Command-line Parsing
+
+usage() {
+    echo "DXVK @version@"
+    echo "Set up Wine prefix with DXVK DLLs"
+    echo
+    echo "USAGE"
+    echo "    $0 [install|uninstall] [OPTIONS]"
+    echo
+    echo "COMMANDS"
+    echo "    install                  Copy the DXVK DLLs into the prefix"
+    echo "    uninstall                Restore the backed up Wine DLLs in the prefix"
+    echo
+    echo "OPTIONS"
+    echo "    --with(out)-dxgi         Copy DXVK DXGI DLL into prefix (default: with DXGI)"
+    echo "    --with(out)-d3d10        Copy D3D10 DLLs into prefix (default: without D3D10)"
+    echo "    -s, --symlink            Symlink instead of copy"
+    echo "    -f, --force              Create a Wine prefix even if it does not exist"
+    echo "    -p, --prefix <PREFIX>    Wine prefix to manage (default: \$WINEPREFIX)"
+    exit 1
+}
+
+case "$1" in
+    uninstall|install)
+        action=$1
+        shift
+        ;;
+    -h|--help)
+        usage
+        ;;
+    *)
+        if [ ! -z "${1:-}" ]; then
+            echo "Unrecognized command: $1"
+        fi
+        usage
+        ;;
+esac
+
+
+do_symlink=false
+do_makeprefix=false
+
+while [ ! -z "${1:-}" ]; do
+    case "$1" in
+        --with-dxgi)
+            targets[dxgi]=1
+            ;;
+        --without-dxgi)
+            unset targets[dxgi]
+            ;;
+        --with-d3d10)
+            targets[d3d10]=1
+            ;;
+        --without-d3d10)
+            unset targets[d3d10]
+            ;;
+        -s|--symlink)
+            do_symlink=true
+            ;;
+        --no-symlink)
+            do_symlink=false
+            ;;
+        -f|--force)
+            do_makeprefix=true
+            ;;
+        --no-force)
+            do_makeprefix=false
+            ;;
+        -p|--prefix)
+            shift
+            if [ ! -z "${1:-}" ]; then
+                WINEPREFIX=$1
+            else
+                echo "Required PREFIX missing"
+                usage
+            fi
+            ;;
+        -h|--help)
+            usage
+            ;;
+        *)
+            echo "Unrecognized option: $1"
+            usage
+            ;;
+    esac
+    shift
+done
+
+## Get information on the Wine environment
+
+export WINEPREFIX=${WINEPREFIX:-"$HOME/.wine"}
+
+# check wine prefix before invoking wine, so that we
+# don't accidentally create one if the user screws up
+if ! $do_makeprefix && [ -n "$WINEPREFIX" ] && ! [ -f "$WINEPREFIX/system.reg" ]; then
+    echo "$WINEPREFIX: Not a valid wine prefix." >&2
+    exit 1
+fi
+
+export WINEDEBUG=-all
+# disable mscoree and mshtml to avoid downloading
+# wine gecko and mono
+export WINEDLLOVERRIDES="mscoree,mshtml="
+
+wine="wine"
+wine64="wine64"
+wineboot="wineboot"
+
+# $PATH is the way for user to control where wine is located (including custom Wine versions).
+# Pure 64-bit Wine (non Wow64) requries skipping 32-bit steps.
+# In such case, wine64 and winebooot will be present, but wine binary will be missing,
+# however it can be present in other PATHs, so it shouldn't be used, to avoid versions mixing.
+wine_path=$(dirname "$(command -v $wineboot)")
+wow64=true
+if ! [ -f "$wine_path/$wine" ]; then
+   wine=$wine64
+   wow64=false
+fi
+
+# resolve 32-bit and 64-bit system32 path
+winever=$($wine --version | grep wine)
+if [ -z "$winever" ]; then
+    echo "$wine: Not a wine executable. Check your $wine." >&2
+    exit 1
+fi
+
+# ensure wine placeholder dlls are recreated
+# if they are missing
+$wineboot -u
+
+win64_sys_path=$($wine64 winepath -u 'C:\windows\system32' 2> /dev/null)
+win64_sys_path="${win64_sys_path/$'\r'/}"
+if $wow64; then
+  win32_sys_path=$($wine winepath -u 'C:\windows\system32' 2> /dev/null)
+  win32_sys_path="${win32_sys_path/$'\r'/}"
+fi
+
+if [ -z "${win32_sys_path:-}" ] && [ -z "${win64_sys_path:-}" ]; then
+  echo 'Failed to resolve C:\windows\system32.' >&2
+  exit 1
+fi
+
+## Utility functions
+
+install_file() {
+    $do_symlink && file_cmd="ln -sv" || file_cmd="install -m 755 -v"
+
+    srcfile=$1
+    dstfile=$2
+
+    if [ -f "${srcfile}.so" ]; then
+        srcfile="${srcfile}.so"
+    fi
+
+    if ! [ -f "${srcfile}" ]; then
+        echo "${srcfile}: File not found. Skipping." >&2
+        return 1
+    fi
+
+    if [ -n "$1" ]; then
+        if [ -f "${dstfile}" ] || [ -h "${dstfile}" ]; then
+            if ! [ -f "${dstfile}.old" ]; then
+                mv -v "${dstfile}" "${dstfile}.old"
+            else
+                rm -v "${dstfile}"
+            fi
+        fi
+        $file_cmd "${srcfile}" "${dstfile}"
+    else
+        echo "${dstfile}: File not found in wine prefix" >&2
+        return 1
+    fi
+}
+
+uninstall_file() {
+    srcfile=$1
+    dstfile=$2
+
+    if [ -f "${srcfile}.so" ]; then
+        srcfile="${srcfile}.so"
+    fi
+
+    if ! [ -f "${srcfile}" ]; then
+        echo "${srcfile}: File not found. Skipping." >&2
+        return 1
+    fi
+
+    if ! [ -f "${dstfile}" ] && ! [ -h "${dstfile}" ]; then
+        echo "${dstfile}: File not found. Skipping." >&2
+        return 1
+    fi
+
+    if [ -f "${dstfile}.old" ]; then
+        rm -v "${dstfile}"
+        mv -v "${dstfile}.old" "${dstfile}"
+        return 0
+    else
+        return 1
+    fi
+}
+
+install_override() {
+    dll=$(basename "$1")
+    $wine reg add 'HKEY_CURRENT_USER\Software\Wine\DllOverrides' /v "$dll" /d native /f >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        echo -e "Failed to add override for $dll"
+        exit 1
+    fi
+}
+
+uninstall_override() {
+    dll=$(basename "$1")
+    $wine reg delete 'HKEY_CURRENT_USER\Software\Wine\DllOverrides' /v "$dll" /f > /dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        echo "Failed to remove override for $dll"
+    fi
+}
+
+## Perform the requested command
+
+declare -A paths
+
+for target in "${!targets[@]}"; do
+    [ ${targets[$target]} -eq 1 ] || continue
+    for dll in ${dlls[$target]}; do
+        dllname=$(basename "$dll")
+        basedir=$(dirname "$dll")
+
+        if [ ! -z "${win32_sys_path:-}" ]; then
+            basedir32=${basedir}32_dir
+            paths["${!basedir32}/$dllname"]="$win32_sys_path/$dllname"
+        fi
+        if [ ! -z "${win64_sys_path:-}" ]; then
+            basedir64=${basedir}64_dir
+            paths["${!basedir64}/$dllname"]="$win64_sys_path/$dllname"
+        fi
+    done
+done
+
+for srcpath in "${!paths[@]}"; do
+    ${action}_file "$srcpath" "${paths["$srcpath"]}"
+    ${action}_override "$(basename srcpath)"
+done
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index a360058725006..42d7021f3452b 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -92,6 +92,16 @@ let
 
     passAsFile = [ "extraConfig" ];
 
+    # Workaround '-idirafter' ordering bug in staging-next:
+    #   https://github.com/NixOS/nixpkgs/pull/210004
+    # where libc '-idirafter' gets added after user's idirafter and
+    # breaks.
+    # TODO(trofi): remove it in staging once fixed in cc-wrapper.
+    preConfigure = ''
+      export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] buildPackages.stdenv.hostPlatform.config}=$(< ${buildPackages.stdenv.cc}/nix-support/libc-cflags)
+      export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"]               stdenv.hostPlatform.config}=$(<               ${stdenv.cc}/nix-support/libc-cflags)
+    '';
+
     configurePhase = ''
       runHook preConfigure
 
diff --git a/pkgs/os-specific/bsd/freebsd/default.nix b/pkgs/os-specific/bsd/freebsd/default.nix
index 3a53916a46de0..e7252ab35e631 100644
--- a/pkgs/os-specific/bsd/freebsd/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/default.nix
@@ -2,7 +2,7 @@
 , makeScopeWithSplicing, generateSplicesForMkScope
 , buildPackages
 , bsdSetupHook, makeSetupHook
-, fetchgit, fetchurl, coreutils, groff, mandoc, byacc, flex, which, m4, gawk, substituteAll, runtimeShell
+, fetchgit, fetchzip, coreutils, groff, mandoc, byacc, flex, which, m4, gawk, substituteAll, runtimeShell
 , zlib, expat, libmd
 , runCommand, writeShellScript, writeText, symlinkJoin
 }:
@@ -75,6 +75,11 @@ in makeScopeWithSplicing
   in {
   inherit freebsdSrc;
 
+  ports = fetchzip {
+    url = "https://cgit.freebsd.org/ports/snapshot/ports-dde3b2b456c3a4bdd217d0bf3684231cc3724a0a.tar.gz";
+    sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
+  };
+
   # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
   # See note in ../netbsd/default.nix.
 
@@ -388,6 +393,12 @@ in makeScopeWithSplicing
     outputs = [ "out" "man" "test" ];
   };
 
+  sed = mkDerivation {
+    path = "usr.bin/sed";
+    TESTSRC = "${freebsdSrc}/contrib/netbsd-tests";
+    MK_TESTS = "no";
+  };
+
   # Don't add this to nativeBuildInputs directly.  Use statHook instead.
   stat = mkDerivation {
     path = "usr.bin/stat";
diff --git a/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix b/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
new file mode 100644
index 0000000000000..3c3dcb6d5d67a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
@@ -0,0 +1,64 @@
+{ lib, stdenv, linuxHeaders, freebsd, runCommandCC, buildPackages }:
+
+stdenv.mkDerivation {
+  pname = "evdev-proto";
+  inherit (linuxHeaders) version;
+
+  src = freebsd.ports;
+
+  sourceRoot = "source/devel/evdev-proto";
+
+  useTempPrefix = true;
+
+  nativeBuildInputs = [ freebsd.makeMinimal ];
+
+  ARCH = freebsd.makeMinimal.MACHINE_ARCH;
+  OPSYS = "FreeBSD";
+  _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";
+
+  AWK = "awk";
+  CHMOD = "chmod";
+  FIND = "find";
+  MKDIR = "mkdir -p";
+  PKG_BIN = "${buildPackages.pkg}/bin/pkg";
+  RM = "rm -f";
+  SED = "${buildPackages.freebsd.sed}/bin/sed";
+  SETENV = "env";
+  SH = "sh";
+  TOUCH = "touch";
+  XARGS = "xargs";
+
+  ABI_FILE = runCommandCC "abifile" {} "$CC -shared -o $out";
+  CLEAN_FETCH_ENV = true;
+  INSTALL_AS_USER = true;
+  NO_CHECKSUM = true;
+  NO_MTREE = true;
+  SRC_BASE = freebsd.freebsdSrc;
+
+  preUnpack = ''
+    export MAKE_JOBS_NUMBER="$NIX_BUILD_CORES"
+
+    export DISTDIR="$PWD/distfiles"
+    export PKG_DBDIR="$PWD/pkg"
+    export PREFIX="$prefix"
+
+    mkdir -p "$DISTDIR/evdev-proto"
+    tar -C "$DISTDIR/evdev-proto" \
+        -xf ${linuxHeaders.src} \
+        --strip-components 4 \
+        linux-${linuxHeaders.version}/include/uapi/linux
+  '';
+
+  makeFlags = [ "DIST_SUBDIR=evdev-proto" ];
+
+  postInstall = ''
+    mv $prefix $out
+  '';
+
+  meta = with lib; {
+    description = "Input event device header files for FreeBSD";
+    maintainers = with maintainers; [ qyliss ];
+    platforms = platforms.freebsd;
+    license = licenses.gpl2Only;
+  };
+}
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 8903db9f36b7b..1033927ce6755 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -680,6 +680,13 @@ in makeScopeWithSplicing
   ##
   ## START LIBRARIES
   ##
+  libarch = mkDerivation {
+    path = "lib/libarch";
+    version = "9.2";
+    sha256 = "6ssenRhuSwp0Jn71ErT0PrEoCJ+cIYRztwdL4QTDZsQ=";
+    meta.platforms = lib.platforms.netbsd;
+  };
+
   libutil = mkDerivation {
     path = "lib/libutil";
     version = "9.2";
@@ -809,6 +816,16 @@ in makeScopeWithSplicing
     meta.platforms = lib.platforms.netbsd;
   };
 
+  libpci = mkDerivation {
+    pname = "libpci";
+    path = "lib/libpci";
+    version = "9.2";
+    sha256 = "+IOEO1Bw3/H3iCp3uk3bwsFZbvCqN5Ciz70irnPl8E8=";
+    NIX_CFLAGS_COMPILE = [ "-I." ];
+    meta.platforms = lib.platforms.netbsd;
+    extraPaths = with self; [ sys.src ];
+  };
+
   libpthread-headers = mkDerivation {
     pname = "libpthread-headers";
     path = "lib/libpthread";
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index d7ac5d9fd9040..839548ae8ffd0 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -45,12 +45,20 @@ let
 
         cp -r ${MacOSX-SDK}${standardFrameworkPath name private} $out/Library/Frameworks
 
+        if [[ -d ${MacOSX-SDK}/usr/lib/swift/${name}.swiftmodule ]]; then
+          mkdir -p $out/lib/swift
+          cp -r -t $out/lib/swift \
+            ${MacOSX-SDK}/usr/lib/swift/${name}.swiftmodule \
+            ${MacOSX-SDK}/usr/lib/swift/libswift${name}.tbd
+        fi
+
         # Fix and check tbd re-export references
         chmod u+w -R $out
         find $out -name '*.tbd' -type f | while read tbd; do
           echo "Fixing re-exports in $tbd"
           rewrite-tbd \
             -p ${standardFrameworkPath name private}/:$out/Library/Frameworks/${name}.framework/ \
+            -p /usr/lib/swift/:$out/lib/swift/ \
             ${mkDepsRewrites deps} \
             -r ${builtins.storeDir} \
             "$tbd"
@@ -163,6 +171,15 @@ in rec {
 
     # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
     JavaVM = super.JavaNativeFoundation;
+
+    CoreVideo = lib.overrideDerivation super.CoreVideo (drv: {
+      installPhase = drv.installPhase + ''
+        # When used as a module, complains about a missing import for
+        # Darwin.C.stdint. Apparently fixed in later SDKs.
+        awk -i inplace '/CFBase.h/ { print "#include <stdint.h>" } { print }' \
+          $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
+      '';
+    });
   };
 
   bareFrameworks = (
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index a4f71f12821da..dfa52606c8177 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -3,16 +3,7 @@
 , xar, cpio, python3, pbzx }:
 
 let
-  MacOSX-SDK = stdenvNoCC.mkDerivation rec {
-    pname = "MacOSX-SDK";
-    version = "11.0.0";
-
-    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
-    src = fetchurl {
-      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_macOSNMOS_SDK.pkg";
-      sha256 = "0n425smj4q1vxbza8fzwnk323fyzbbq866q32w288c44hl5yhwsf";
-    };
-
+  mkSusDerivation = args: stdenvNoCC.mkDerivation (args // {
     dontBuild = true;
     darwinDontCodeSign = true;
 
@@ -24,16 +15,45 @@ let
       pbzx $src | cpio -idm
     '';
 
+    passthru = {
+      inherit (args) version;
+    };
+  });
+
+  MacOSX-SDK = mkSusDerivation {
+    pname = "MacOSX-SDK";
+    version = "11.0.0";
+
+    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_macOSNMOS_SDK.pkg";
+      sha256 = "0n425smj4q1vxbza8fzwnk323fyzbbq866q32w288c44hl5yhwsf";
+    };
+
     installPhase = ''
       cd Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk
 
       mkdir $out
       cp -r System usr $out/
     '';
+  };
 
-    passthru = {
-      inherit version;
+  CLTools_Executables = mkSusDerivation {
+    pname = "CLTools_Executables";
+    version = "11.0.0";
+
+    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_Executables.pkg";
+      sha256 = "0nvb1qx7l81l2wcl8wvgbpsg5rcn51ylhivqmlfr2hrrv3zrrpl0";
     };
+
+    installPhase = ''
+      cd Library/Developer/CommandLineTools
+
+      mkdir $out
+      cp -r Library usr $out/
+    '';
   };
 
   callPackage = newScope (packages // pkgs.darwin // { inherit MacOSX-SDK; });
@@ -43,7 +63,7 @@ let
 
     # TODO: this is nice to be private. is it worth the callPackage above?
     # Probably, I don't think that callPackage costs much at all.
-    inherit MacOSX-SDK;
+    inherit MacOSX-SDK CLTools_Executables;
 
     Libsystem = callPackage ./libSystem.nix {};
     LibsystemCross = pkgs.darwin.Libsystem;
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
index dc4ab1955b506..59cbc2b1063a1 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -75,7 +75,7 @@
   FileProviderUI                   = {};
   FinderSync                       = {};
   ForceFeedback                    = { inherit IOKit; };
-  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration libobjc; };
+  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration Combine libobjc; };
   GLKit                            = {};
   GLUT                             = { inherit OpenGL; };
   GSS                              = {};
@@ -169,7 +169,7 @@
   Speech                           = {};
   SpriteKit                        = {};
   StoreKit                         = {};
-  SwiftUI                          = {};
+  SwiftUI                          = { inherit AppKit DeveloperToolsSupport UniformTypeIdentifiers; };
   SyncServices                     = {};
   System                           = {};
   SystemConfiguration              = { inherit Security; };
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
index 0297f8897f12d..7be670425d7af 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation {
   ];
 
   installPhase = ''
-    mkdir -p $out/{include,lib}
+    mkdir -p $out/{include,lib/swift}
 
     for dir in $includeDirs; do
       from=${MacOSX-SDK}/usr/include/$dir
@@ -57,6 +57,13 @@ stdenvNoCC.mkDerivation {
         $out/lib
     done
 
+    for name in os Dispatch; do
+      cp -dr \
+        ${MacOSX-SDK}/usr/lib/swift/$name.swiftmodule \
+        ${MacOSX-SDK}/usr/lib/swift/libswift$name.tbd \
+        $out/lib/swift
+    done
+
     for f in $csu; do
       from=${MacOSX-SDK}/usr/lib/$f
       if [ -e "$from" ]; then
@@ -71,6 +78,7 @@ stdenvNoCC.mkDerivation {
       rewrite-tbd \
         -c /usr/lib/libsystem.dylib:$out/lib/libsystem.dylib \
         -p /usr/lib/system/:$out/lib/system/ \
+        -p /usr/lib/swift/:$out/lib/swift/ \
         -r ${builtins.storeDir} \
         "$tbd"
     done
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
index 63ef2a1c263e0..9288097ef3699 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
@@ -8,14 +8,17 @@ let self = stdenvNoCC.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/{include,lib}
+    mkdir -p $out/{include,lib/swift}
     cp -r ${MacOSX-SDK}/usr/include/objc $out/include
     cp ${MacOSX-SDK}/usr/lib/libobjc* $out/lib
+    cp -r ${MacOSX-SDK}/usr/lib/swift/ObjectiveC.swiftmodule $out/lib/swift
+    cp ${MacOSX-SDK}/usr/lib/swift/libswiftObjectiveC.tbd $out/lib/swift
   '';
 
   passthru = {
     tbdRewrites = {
       const."/usr/lib/libobjc.A.dylib" = "${self}/lib/libobjc.A.dylib";
+      const."/usr/lib/swift/libswiftObjectiveC.dylib" = "${self}/lib/swift/libswiftObjectiveC.dylib";
     };
   };
 }; in self
diff --git a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
index b413744677d24..74f1160e43066 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
@@ -5,8 +5,6 @@ appleDerivation' stdenv {
   srcs = lib.attrValues IOKitSrcs;
   sourceRoot = ".";
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   __propagatedImpureHostDeps = [
     "/System/Library/Frameworks/IOKit.framework/IOKit"
     "/System/Library/Frameworks/IOKit.framework/Resources"
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
index bb09adce252e1..f4fe65b8066c7 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
@@ -1,8 +1,6 @@
 { appleDerivation', stdenv, darwin-stubs }:
 
 appleDerivation' stdenv {
-  phases = [ "unpackPhase" "installPhase" ];
-
   __propagatedImpureHostDeps = [
     "/System/Library/Frameworks/Security.framework/Security"
     "/System/Library/Frameworks/Security.framework/Resources"
diff --git a/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix b/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
index 64de728805fd3..4082f5b760cf8 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
@@ -1,8 +1,7 @@
 { appleDerivation', stdenvNoCC }:
 
 appleDerivation' stdenvNoCC {
-  phases = [ "unpackPhase" "installPhase" ];
-
+  dontBuild = true;
   installPhase = ''
     mkdir -p $out/include
     cp mDNSShared/dns_sd.h $out/include
diff --git a/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix b/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
index 2fc4afa77d9f8..315f0fb06219b 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
@@ -1,8 +1,6 @@
 { appleDerivation, darwin-stubs }:
 
 appleDerivation {
-  phases = [ "unpackPhase" "installPhase" ];
-
   # Not strictly necessary, since libSystem depends on it, but it's nice to be explicit so we
   # can easily find out what's impure.
   __propagatedImpureHostDeps = [
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 020aee04af79d..303eb801478c4 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -130,6 +130,10 @@ in stdenv.mkDerivation rec {
     mkdir $out/etc/bluetooth
     ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf
 
+    # https://github.com/NixOS/nixpkgs/issues/204418
+    ln -s /etc/bluetooth/input.conf $out/etc/bluetooth/input.conf
+    ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
+
     # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
     for files in `find tools/ -type f -perm -755`; do
       filename=$(basename $files)
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 951c84eaf492c..8396fd5e3d33b 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -1,42 +1,43 @@
-{ lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, gettext, libxslt, docbook_xsl_ns
-, libcap, libidn2
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, gettext
+, libxslt
+, docbook_xsl_ns
+, libcap
+, libidn2
 , iproute2
 , apparmorRulesFromClosure
 }:
 
-let
-  version = "20211215";
-  sunAsIsLicense = {
-    fullName = "AS-IS, SUN MICROSYSTEMS license";
-    url = "https://github.com/iputils/iputils/blob/s${version}/rdisc.c";
-  };
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "iputils";
-  inherit version;
+  version = "20221126";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1vzdch1xi2x2j8mvnsr4wwwh7kdkgf926xafw5kkb74yy1wac5qv";
+    hash = "sha256-XVoQhdjBmEK8TbCpaKLjebPw7ZT8iEvyLJDTCkzezeE=";
   };
 
-  outputs = ["out" "apparmor"];
+  outputs = [ "out" "apparmor" ];
 
   # We don't have the required permissions inside the build sandbox:
   # /build/source/build/ping/ping: socket: Operation not permitted
   doCheck = false;
 
   mesonFlags = [
-    "-DBUILD_RARPD=true"
     "-DNO_SETCAP_OR_SUID=true"
     "-Dsystemdunitdir=etc/systemd/system"
     "-DINSTALL_SYSTEMD_UNITS=true"
     "-DSKIP_TESTS=${lib.boolToString (!doCheck)}"
   ]
-    # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
-    ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
+  # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
+  ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
 
   nativeBuildInputs = [ meson ninja pkg-config gettext libxslt.bin docbook_xsl_ns ];
   buildInputs = [ libcap ]
@@ -65,23 +66,19 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    homepage = "https://github.com/iputils/iputils";
+    changelog = "https://github.com/iputils/iputils/releases/tag/${version}";
     description = "A set of small useful utilities for Linux networking";
-    inherit (src.meta) homepage;
-    changelog = "https://github.com/iputils/iputils/releases/tag/s${version}";
-    license = with licenses; [ gpl2Plus bsd3 sunAsIsLicense ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos lheckemann ];
-
     longDescription = ''
       A set of small useful utilities for Linux networking including:
 
-      arping
-      clockdiff
-      ninfod
-      ping
-      rarpd
-      rdisc
-      tracepath
+      - arping: send ARP REQUEST to a neighbour host
+      - clockdiff: measure clock difference between hosts
+      - ping: send ICMP ECHO_REQUEST to network hosts
+      - tracepath: traces path to a network host discovering MTU along this path
     '';
+    license = with licenses; [ gpl2Plus bsd3 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos lheckemann ];
   };
 }
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 2f48448541b32..5a5193997be08 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.17";
-  hash = "sha256-cobPqWUYKMWJOJUJVGMzuNqWXfqEoaTIqz5oGkf6uuc=";
+  version = "2.03.18";
+  hash = "sha256-n2g+KYDZXA3Ou9JcfBdwMsVhXXJnv8iF6r/OWSgPR2k=";
 }
diff --git a/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix b/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix
new file mode 100644
index 0000000000000..4a651bf473e5b
--- /dev/null
+++ b/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenv, fetchurl }:
+
+## Usage
+# In NixOS, simply add this package to services.udev.packages:
+#   services.udev.packages = [ pkgs.picoprobe-udev-rules ];
+
+stdenv.mkDerivation rec {
+  pname = "picoprobe-udev-rules";
+  version = "unstable-2023-01-31";
+
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/probe-rs/webpage/1cba61acc6ecb5ff96f74641269844ad88ad8ad5/static/files/69-probe-rs.rules";
+    sha256 = "sha256-vQMPX3Amttja0u03KWGnPDAVTGM9ekJ+IBTjW+xlJS0=";
+  };
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -D $src $out/lib/udev/rules.d/69-probe-rs.rules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://probe.rs/docs/getting-started/probe-setup/#udev-rules";
+    description = "Picoprobe udev rules list";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ mglolenstine ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index ba2d0967e45de..4a5e50d9c6abb 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -132,7 +132,7 @@ stdenv.mkDerivation rec {
   # NixOS module which is based on those files without relying on them. Still, it
   # is helpful to have properly patched versions for non-NixOS distributions.
   postFixup = ''
-    header "Fixing aesmd.service"
+    echo "Fixing aesmd.service"
     substituteInPlace $out/lib/systemd/system/aesmd.service \
       --replace '@aesm_folder@' \
                 "$out/aesm" \
@@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
       --replace "/bin/kill" \
                 "${coreutils}/bin/kill"
 
-    header "Fixing remount-dev-exec.service"
+    echo "Fixing remount-dev-exec.service"
     substituteInPlace $out/lib/systemd/system/remount-dev-exec.service \
       --replace '/bin/mount' \
                 "${util-linux}/bin/mount"
diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
index 5213dc1e4fda8..053aaecbcbb7e 100644
--- a/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -109,7 +109,7 @@ stdenv.mkDerivation rec {
       };
     in
     ''
-      header "Setting up IPP crypto build artifacts"
+      echo "Setting up IPP crypto build artifacts"
 
       pushd 'external/ippcp_internal'
 
@@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
     ./linux/installer/bin/sgx_linux_x64_sdk_${version}.bin -prefix $installDir
     installDir=$installDir/sgxsdk
 
-    header "Move files created by installer"
+    echo "Move files created by installer"
 
     mkdir -p $out/bin
     pushd $out
@@ -206,15 +206,15 @@ stdenv.mkDerivation rec {
 
 
   preFixup = ''
-    header "Strip sgxsdk prefix"
+    echo "Strip sgxsdk prefix"
     for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"; do
       substituteInPlace $path --replace "$TMPDIR/sgxsdk" "$out"
     done
 
-    header "Fixing pkg-config files"
+    echo "Fixing pkg-config files"
     sed -i "s|prefix=.*|prefix=$out|g" $out/lib/pkgconfig/*.pc
 
-    header "Fixing SGX_SDK default in samples"
+    echo "Fixing SGX_SDK default in samples"
     substituteInPlace $out/share/SampleCode/LocalAttestation/buildenv.mk \
       --replace '/opt/intel/sgxsdk' "$out"
     for file in $out/share/SampleCode/*/Makefile; do
@@ -222,12 +222,12 @@ stdenv.mkDerivation rec {
         --replace '/opt/intel/sgxsdk' "$out"
     done
 
-    header "Fixing BINUTILS_DIR in buildenv.mk"
+    echo "Fixing BINUTILS_DIR in buildenv.mk"
     substituteInPlace $out/share/bin/buildenv.mk \
       --replace 'BINUTILS_DIR ?= /usr/local/bin' \
                 'BINUTILS_DIR ?= ${BINUTILS_DIR}'
 
-    header "Fixing GDB path in bin/sgx-gdb"
+    echo "Fixing GDB path in bin/sgx-gdb"
     substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
   '';
 
diff --git a/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
new file mode 100644
index 0000000000000..c64fdd8d34c0b
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
@@ -0,0 +1,44 @@
+From 236e9281cb158be3191c500524fbc5f397a25e03 Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Sun, 15 Jan 2023 20:15:55 +0800
+Subject: [PATCH] tpm2_context_init: fix driver name checking
+
+https://github.com/systemd/systemd/commit/542dbc623e introduced
+additional checks for tpm2 driver names, namely ensuring the driver
+name, when concated with "libtss2-tcti-" and ".so.0", generates a valid
+filename (with no '/' inside).
+
+For example, if the driver is name "device", the line
+  fn = strjoina("libtss2-tcti-", driver, ".so.0")
+would yield "libtss2-tcti-device.so.0", passing the check. And the
+filename is then passed to dlopen for loading the driver.
+
+Our current approach for systemd to correctly locate these dynamically
+loaded libraries is to patch the filenames to include their absolute
+path. Thus the line mentioned above is patched into
+  fn = strjoina("/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-", driver, ".so.0")
+yielding "/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-device.so.0",
+tripping the check.
+
+This patch relaxes the check to also accept absolute paths, by replacing
+filename_is_valid with path_is_valid.
+---
+ src/shared/tpm2-util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
+index ba8dfb041d..7de5d5fc77 100644
+--- a/src/shared/tpm2-util.c
++++ b/src/shared/tpm2-util.c
+@@ -192,7 +192,7 @@ int tpm2_context_init(const char *device, struct tpm2_context *ret) {
+                 fn = strjoina("libtss2-tcti-", driver, ".so.0");
+ 
+                 /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
+-                if (!filename_is_valid(fn))
++                if (!path_is_valid(fn))
+                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
+ 
+                 dl = dlopen(fn, RTLD_NOW);
+-- 
+2.39.0
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 805dd9d5ba8bd..e871d6618c34a 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -93,6 +93,7 @@
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
+    && stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6" # assumes hard floats
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
 , withLocaled ? true
 , withLogind ? true
@@ -174,6 +175,7 @@ stdenv.mkDerivation {
     ./0016-pkg-config-derive-prefix-from-prefix.patch
     ./0017-inherit-systemd-environment-when-calling-generators.patch
     ./0018-core-don-t-taint-on-unmerged-usr.patch
+    ./0019-tpm2_context_init-fix-driver-name-checking.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 2d954d83ecf3a..ba4fe8356ce76 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, fetchurl, openssl, pkg-config, libnl
 , nixosTests, wpa_supplicant_gui
-, dbusSupport ? true, dbus
+, dbusSupport ? !stdenv.hostPlatform.isStatic, dbus
 , withReadline ? true, readline
-, withPcsclite ? true, pcsclite
+, withPcsclite ? !stdenv.hostPlatform.isStatic, pcsclite
 , readOnlyModeSSIDs ? false
 }:
 
@@ -73,6 +73,15 @@ stdenv.mkDerivation rec {
     CONFIG_CTRL_IFACE_DBUS=y
     CONFIG_CTRL_IFACE_DBUS_NEW=y
     CONFIG_CTRL_IFACE_DBUS_INTRO=y
+  ''
+    # Upstream uses conditionals based on ifdef, so opposite of =y is
+    # not =n, as one may expect, but undefine.
+    #
+    # This config is sourced into makefile.
+    + optionalString (!dbusSupport) ''
+    undefine CONFIG_CTRL_IFACE_DBUS
+    undefine CONFIG_CTRL_IFACE_DBUS_NEW
+    undefine CONFIG_CTRL_IFACE_DBUS_INTRO
   '' + (if withReadline then ''
     CONFIG_READLINE=y
   '' else ''
@@ -104,13 +113,15 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/man/man5 $out/share/man/man8
     cp -v "doc/docbook/"*.5 $out/share/man/man5/
     cp -v "doc/docbook/"*.8 $out/share/man/man8/
-
+  ''
+  + lib.optionalString dbusSupport ''
     mkdir -p $out/share/dbus-1/system.d $out/share/dbus-1/system-services $out/etc/systemd/system
     cp -v "dbus/"*service $out/share/dbus-1/system-services
     sed -e "s@/sbin/wpa_supplicant@$out&@" -i "$out/share/dbus-1/system-services/"*
     cp -v dbus/dbus-wpa_supplicant.conf $out/share/dbus-1/system.d
     cp -v "systemd/"*.service $out/etc/systemd/system
-
+  ''
+  + ''
     rm $out/share/man/man8/wpa_priv.8
     install -Dm444 wpa_supplicant.conf $out/share/doc/wpa_supplicant/wpa_supplicant.conf.example
   '';
diff --git a/pkgs/servers/headscale/default.nix b/pkgs/servers/headscale/default.nix
index b84632746c944..c8a4b99d58e03 100644
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "headscale";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "juanfont";
     repo = "headscale";
     rev = "v${version}";
-    hash = "sha256-0viXsBRCiaxBTTKXJngSov5M7toscQUOdXDTr1l0U3I=";
+    hash = "sha256-/KT3JZ/xYcKRynksWgsPsioCLTSxeQxr6WjRUzYXJcU=";
   };
 
-  vendorHash = "sha256-SuKT+b8g6xEK15ry2IAmpS/vwDG+zJqK9nfsWpHNXuU=";
+  vendorHash = "sha256-8p5NFxXKaZPsW4B6NMzfi0pqfVroIahSgA0fukvB3JI=";
 
   ldflags = ["-s" "-w" "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}"];
 
diff --git a/pkgs/servers/heisenbridge/default.nix b/pkgs/servers/heisenbridge/default.nix
index db7d40ad35d5a..1371bac15d66f 100644
--- a/pkgs/servers/heisenbridge/default.nix
+++ b/pkgs/servers/heisenbridge/default.nix
@@ -4,17 +4,18 @@ let
   python = python3.override {
     packageOverrides = self: super: {
       mautrix = super.mautrix.overridePythonAttrs (oldAttrs: rec {
-        version = "0.16.3";
-        src = oldAttrs.src.override {
-          inherit (oldAttrs) pname;
-          inherit version;
-          hash = "sha256-OpHLh5pCzGooQ5yxAa0+85m/szAafV+l+OfipQcfLtU=";
+        version = "0.16.10";
+        src = fetchFromGitHub {
+          owner = "mautrix";
+          repo = "python";
+          rev = "v${version}";
+          hash = "sha256-YQsQ7M+mHcRdGUZp+mo46AlBmKSdmlgRdGieEG0Hu9k=";
         };
       });
     };
   };
-
-in python.pkgs.buildPythonApplication rec {
+in
+python.pkgs.buildPythonApplication rec {
   pname = "heisenbridge";
   version = "1.13.1";
 
@@ -30,11 +31,10 @@ in python.pkgs.buildPythonApplication rec {
   '';
 
   propagatedBuildInputs = with python.pkgs; [
-    aiohttp
     irc
+    ruamel-yaml
     mautrix
     python-socks
-    pyyaml
   ];
 
   nativeCheckInputs = with python.pkgs; [
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 2bd89a7c143bc..ba6e1cdcc7a7a 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.2732";
+  version = "0.20.2782";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-h9vQ4OFXt3Fb7+2QSsXJh/uqy9glRFAZfZ8fdBqqna/59PV8GtItYWSJi7FhGVeFMX+WMQnsxG0/8Hq1z7akMA==";
+    hash = "sha512-qBstaZfBts2EfYVt+iU9QqIEVRfPIqt122NAMlS42yoV7iLqeXfK989Wm6FoYtTvvgtNpVJ9rLPNMSSH3AX3TQ==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/servers/komga/default.nix b/pkgs/servers/komga/default.nix
index 47aca84a80b27..e1db293f64991 100644
--- a/pkgs/servers/komga/default.nix
+++ b/pkgs/servers/komga/default.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "0.160.0";
+  version = "0.161.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/v${version}/${pname}-${version}.jar";
-    sha256 = "sha256-maNOiC+hFv/mniU1spZVZrUJETT5sgdi1OmbYR2smFk=";
+    sha256 = "sha256-TZ/TxX9OgDGx8zD2mI8cTDPZSqBjkYN3Uy+W9MXbJOI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/mautrix-googlechat/default.nix b/pkgs/servers/mautrix-googlechat/default.nix
index db1f7c6d1f254..74389663455fb 100644
--- a/pkgs/servers/mautrix-googlechat/default.nix
+++ b/pkgs/servers/mautrix-googlechat/default.nix
@@ -1,17 +1,19 @@
-{ fetchFromGitHub, fetchpatch
+{ fetchFromGitHub
+, fetchpatch
 , lib
 , python3
-, protobuf3_20
-, enableE2be ? true, enableMetrics ? true, enableSqlite ? true
+, enableE2be ? true
+, enableMetrics ? true
+, enableSqlite ? true
 }: python3.pkgs.buildPythonApplication rec {
   pname = "mautrix-googlechat";
-  version = "0.4.0";
+  version = "unstable-2023-01-25";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "googlechat";
-    rev = "v${version}";
-    sha256 = "sha256-UVWYT0HTOUEkBG0n6KNhCSSO/2PAF1rIvCaw478z+q0=";
+    rev = "e2eb528745466468f059c506c22e500e0cd832aa";
+    sha256 = "sha256-FNlEHzuy89RuFUwZPmVA+4AmpQHGD+18BguGC6qBdBM=";
   };
 
   patches = [
@@ -24,13 +26,6 @@
     })
   ];
 
-  doCheck = false;
-
-  postPatch = ''
-    sed -i requirements.txt \
-      -e 's/asyncpg>=.*/asyncpg/'
-  '';
-
   baseConfigPath = "share/mautrix-googlechat/example-config.yaml";
   postInstall = ''
     rm $out/example-config.yaml
@@ -43,8 +38,12 @@
       pycryptodome
       unpaddedbase64
     ];
-    metrics = [ prometheus-client ];
-    sqlite = [ aiosqlite ];
+    metrics = [
+      prometheus-client
+    ];
+    sqlite = [
+      aiosqlite
+    ];
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -54,14 +53,14 @@
     ruamel-yaml
     CommonMark
     python-magic
-    (protobuf.override {
-      protobuf = protobuf3_20;
-    })
+    protobuf3
     mautrix
   ] ++ lib.optionals enableE2be passthru.optional-dependencies.e2be
   ++ lib.optionals enableMetrics passthru.optional-dependencies.metrics
   ++ lib.optionals enableSqlite passthru.optional-dependencies.sqlite;
 
+  doCheck = false;
+
   meta = with lib; {
     homepage = "https://github.com/mautrix/googlechat";
     description = "A Matrix-Google Chat puppeting bridge";
diff --git a/pkgs/servers/mautrix-signal/default.nix b/pkgs/servers/mautrix-signal/default.nix
index 7aada1e2eed5b..8ff6f1d36694b 100644
--- a/pkgs/servers/mautrix-signal/default.nix
+++ b/pkgs/servers/mautrix-signal/default.nix
@@ -11,6 +11,20 @@ python3.pkgs.buildPythonPackage rec {
     sha256 = "sha256-UbetU1n9zD/mVFaJc9FECDq/Zell1TI/aYPsGXGB8Js=";
   };
 
+  postPatch = ''
+    # the version mangling in mautrix_signal/get_version.py interacts badly with pythonRelaxDepsHook
+    substituteInPlace setup.py \
+      --replace 'version=version' 'version="${version}"'
+  '';
+
+  nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "mautrix"
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     CommonMark
     aiohttp
@@ -31,12 +45,6 @@ python3.pkgs.buildPythonPackage rec {
 
   doCheck = false;
 
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "asyncpg>=0.20,<0.26" "asyncpg>=0.20" \
-      --replace "mautrix>=0.16.0,<0.17" "mautrix>=0.16.0"
-  '';
-
   postInstall = ''
     mkdir -p $out/bin
 
diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index 468df32bbddde..2284a677b6562 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -9,28 +9,31 @@ let
   python = python3.override {
     packageOverrides = self: super: {
       tulir-telethon = self.telethon.overridePythonAttrs (oldAttrs: rec {
-        version = "1.27.0a1";
+        version = "1.27.0a7";
         pname = "tulir-telethon";
         src = super.fetchPypi {
           inherit pname version;
-          sha256 = "sha256-tABAY4UlTyMK1ZafIFawegjBAtcnq3HMNbE1L6WaT3E=";
+          sha256 = "sha256-w4WILvLvJBKf3Nlj0omTCDDD4z+b0XFlCplQ/IHwIPs=";
         };
         doCheck = false;
       });
     };
   };
-in python.pkgs.buildPythonPackage rec {
+in
+python.pkgs.buildPythonPackage rec {
   pname = "mautrix-telegram";
-  version = "0.12.2";
+  version = "unstable-2023-01-28";
   disabled = python.pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "telegram";
-    rev = "v${version}";
-    sha256 = "sha256-htCk0VLr6GfXbpYWF/2bmpko7gSVlkH6HwDjOMhW8is=";
+    rev = "f12abbe03846fd5897d58572ab24b70a58b337d2";
+    sha256 = "sha256-5ZZ85FOmTO26q2zhAIsF7mTlN4BLNLW2dQF+0culkUM=";
   };
 
+  format = "setuptools";
+
   patches = [ ./0001-Re-add-entrypoint.patch ];
 
   propagatedBuildInputs = with python.pkgs; ([
@@ -43,19 +46,24 @@ in python.pkgs.buildPythonPackage rec {
     tulir-telethon
     asyncpg
     Mako
-    # optional
+    # speedups
     cryptg
-    cchardet
     aiodns
     brotli
+    # qr_login
     pillow
     qrcode
+    # formattednumbers
     phonenumbers
+    # metrics
     prometheus-client
+    # sqlite
     aiosqlite
   ] ++ lib.optionals withHQthumbnails [
+    # hq_thumbnails
     moviepy
   ] ++ lib.optionals withE2BE [
+    # e2be
     python-olm
     pycryptodome
     unpaddedbase64
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index afe28b690f794..44d86af8957d5 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.45.0";
+  version = "1.46.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-5KiqVrhb/yEaxgLJ3SB/WHNOfCbPzfJcgdPZ2kuNFEY=";
+    sha256 = "sha256-5OZ4DuGIVMw0Yvd4JC+dbX01RAUAZHmROzl+7Pd6+tc=";
   };
 
-  vendorSha256 = "sha256-SBag82QLLPeGowt10edaAnUWI36i71Ps0pdixiAXVB8=";
+  vendorHash = "sha256-p6C/j1591cmPtIvBH1022YRkfBo07KQ8fqUwJ5YIUn8=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/servers/monitoring/prometheus/zfs-exporter.nix b/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
index 8f0be0901e058..488d3e22e6546 100644
--- a/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "zfs_exporter";
-  version = "2.2.5";
+  version = "2.2.7";
 
   src = fetchFromGitHub {
     owner = "pdf";
     repo = pname;
     rev = "v" + version;
-    hash = "sha256-FY3P2wmNWyr7mImc1PJs1G2Ae8rZvDzq0kRZfiRTzyc=";
+    hash = "sha256-bc9bmGrRGhm58JzrVLLJBUc1zaGXqz2fqx+ZphidFbc=";
   };
 
-  vendorSha256 = "sha256-jQiw3HlqWcsjdadDdovCsDMBB3rnWtacfbtzDb5rc9c=";
+  vendorHash = "sha256-jQiw3HlqWcsjdadDdovCsDMBB3rnWtacfbtzDb5rc9c=";
 
   postInstall = ''
     install -Dm444 -t $out/share/doc/${pname} *.md
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 71b1bf567847f..357da5292821c 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.11.3";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-M55IylFGAKy9TEIyLSHGbf9FjU5OjvoHjwYkiS31Zpk=";
+    sha256 = "sha256-Ptp01SnVqQ+qFxX4Qsoyw9bkw+inm9gMSRqtmAcFlVE=";
   };
 
-  vendorHash = "sha256-D8nFoTggxYNj7ZSY1rvA4YSJHbB7wwpPSu1g+S3c1C0=";
+  vendorHash = "sha256-8NBudXcU3cjSbo6qpGZVLtbrLedzwijwrbiTgC+OMcU=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index 84b63d5984e3b..e2a265c0f5ef5 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchzip }:
 
 let
-  version = "22.3.5";
+  version = "22.3.11";
   platform = if stdenv.isLinux then "linux" else "darwin";
   arch = if stdenv.isAarch64 then "arm" else "amd";
   sha256s = {
-    darwin.amd = "sha256-AXk3aP1SGiHTfHTCBRTagX0DAVmdcVVIkxWaTnZxB8g=";
-    darwin.arm = "sha256-pvOVvNc8lZ2d2fVZVYWvumVWYpnLORNY/3o1t4BN2N4=";
-    linux.amd = "sha256-wsUuSCstYucjMpFsqssPGEhm3zCrAdE9Mldtkypbthg=";
-    linux.arm = "sha256-WHjYAbytiu747jFqN0KZ/CkIwAVI7fb32ywtRiQOBm8=";
+    darwin.amd = "sha256-kwAKxFg7BSNInvsQvFqgtpq8EEwSnmDeDyaF5b8L8SQ=";
+    darwin.arm = "sha256-kH5Ii672SeAIiRcWuAO3oVJVSBWp+r78RmTiR3BaDbg=";
+    linux.amd = "sha256-EKgkRKBrM4+X2YGoP2LpWRHL+fdHu44LYwCZ+O+c5ZY=";
+    linux.arm = "sha256-9b4oerRXjUVUYoswJWtnMBJSQDoCKClf673VjDQFUAw=";
   };
 in stdenv.mkDerivation rec {
   pname = "redpanda";
diff --git a/pkgs/servers/sql/postgresql/ext/pgaudit.nix b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
new file mode 100644
index 0000000000000..c5e536363fda3
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, libkrb5, openssl, postgresql }:
+
+stdenv.mkDerivation rec {
+  pname = "pgaudit";
+  version = "1.7.0";
+
+  src = fetchFromGitHub {
+    owner = "pgaudit";
+    repo = "pgaudit";
+    rev = version;
+    hash = "sha256-8pShPr4HJaJQPjW1iPJIpj3CutTx8Tgr+rOqoXtgCcw=";
+  };
+
+  buildInputs = [ libkrb5 openssl postgresql ];
+
+  makeFlags = [ "USE_PGXS=1" ];
+
+  installPhase = ''
+    install -D -t $out/lib *.so
+    install -D -t $out/share/postgresql/extension *.sql
+    install -D -t $out/share/postgresql/extension *.control
+  '';
+
+  meta = with lib; {
+    description = "Open Source PostgreSQL Audit Logging";
+    homepage = "https://github.com/pgaudit/pgaudit";
+    maintainers = with maintainers; [ idontgetoutmuch ];
+    platforms = postgresql.meta.platforms;
+    license = licenses.postgresql;
+  };
+}
diff --git a/pkgs/servers/sql/postgresql/packages.nix b/pkgs/servers/sql/postgresql/packages.nix
index 80065bde4ba16..2bf9db061a918 100644
--- a/pkgs/servers/sql/postgresql/packages.nix
+++ b/pkgs/servers/sql/postgresql/packages.nix
@@ -24,6 +24,8 @@ self: super: {
 
     pg_similarity = super.callPackage ./ext/pg_similarity.nix { };
 
+    pgaudit = super.callPackage ./ext/pgaudit.nix { };
+
     pgroonga = super.callPackage ./ext/pgroonga.nix { };
 
     pgvector = super.callPackage ./ext/pgvector.nix { };
diff --git a/pkgs/servers/tracing/honeycomb/honeymarker/default.nix b/pkgs/servers/tracing/honeycomb/honeymarker/default.nix
index ab059b518e745..86da469e34683 100644
--- a/pkgs/servers/tracing/honeycomb/honeymarker/default.nix
+++ b/pkgs/servers/tracing/honeycomb/honeymarker/default.nix
@@ -1,13 +1,15 @@
-{ lib, buildGoModule, fetchurl }:
+{ lib, buildGoModule, fetchFromGitHub }:
 import ./versions.nix ({version, sha256}:
   buildGoModule {
   pname = "honeymarker";
   inherit version;
   vendorSha256 = "sha256-ZuDobjC/nizZ7G0o/zVTQmDfDjcdBhfPcmkhgwFc7VU=";
 
-  src = fetchurl {
-    url = "https://github.com/honeycombio/honeymarker/archive/refs/tags/v${version}.tar.gz";
-    inherit sha256;
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeymarker";
+    rev = "v${version}";
+    hash = sha256;
   };
   inherit (buildGoModule.go) GOOS GOARCH;
 
diff --git a/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix b/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix
index c7fde50e15d0f..60e6a537e42eb 100644
--- a/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix
+++ b/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix
@@ -1,6 +1,6 @@
 generic: {
   v0_2_1 = generic {
     version = "0.2.1";
-    sha256 = "0gp427bsc1y7k6j1sqgl8r3kng5b0qhmqd4bpfb9139ivmp2sykk";
+    sha256 = "sha256-tiwX94CRvXnUYpiux94XhOj2abn1Uc+wjcDOmw79ab4=";
   };
 }
diff --git a/pkgs/servers/tracing/honeycomb/honeytail/default.nix b/pkgs/servers/tracing/honeycomb/honeytail/default.nix
index cbe901f2859a1..b5c21ed1d94a3 100644
--- a/pkgs/servers/tracing/honeycomb/honeytail/default.nix
+++ b/pkgs/servers/tracing/honeycomb/honeytail/default.nix
@@ -1,13 +1,15 @@
-{ lib, buildGoModule, fetchurl }:
+{ lib, buildGoModule, fetchFromGitHub }:
 import ./versions.nix ({version, sha256}:
   buildGoModule {
   pname = "honeytail";
   inherit version;
   vendorSha256 = "sha256-LtiiLGLjhbfT49A6Fw5CbSbnmTHMxtcUssr+ayCVrvY=";
 
-  src = fetchurl {
-    url = "https://github.com/honeycombio/honeytail/archive/refs/tags/v${version}.tar.gz";
-    inherit sha256;
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeytail";
+    rev = "v${version}";
+    hash = sha256;
   };
   inherit (buildGoModule.go) GOOS GOARCH;
 
diff --git a/pkgs/servers/tracing/honeycomb/honeytail/versions.nix b/pkgs/servers/tracing/honeycomb/honeytail/versions.nix
index 370d645ab6269..295cc7c6353e2 100644
--- a/pkgs/servers/tracing/honeycomb/honeytail/versions.nix
+++ b/pkgs/servers/tracing/honeycomb/honeytail/versions.nix
@@ -1,6 +1,6 @@
 generic: {
   v1_6_0 = generic {
     version = "1.6.0";
-    sha256 = "039svpvqjck7s3rq86s29xgcyxl1wr0zj90s3jsyp058zk1dgwdy";
+    sha256 = "sha256-S0hIgNNzF1eNe+XJs+PT7EUIl5oJCXu+B/zQago4sf8=";
   };
 }
diff --git a/pkgs/servers/tracing/honeycomb/honeyvent/default.nix b/pkgs/servers/tracing/honeycomb/honeyvent/default.nix
index 839b8ec053f73..e1009c35a8823 100644
--- a/pkgs/servers/tracing/honeycomb/honeyvent/default.nix
+++ b/pkgs/servers/tracing/honeycomb/honeyvent/default.nix
@@ -1,13 +1,15 @@
-{ lib, buildGoModule, fetchurl }:
+{ lib, buildGoModule, fetchFromGitHub }:
 import ./versions.nix ({version, sha256}:
   buildGoModule {
   pname = "honeyvent";
   inherit version;
   vendorSha256 = null;
 
-  src = fetchurl {
-    url = "https://github.com/honeycombio/honeyvent/archive/refs/tags/v${version}.tar.gz";
-    inherit sha256;
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeyvent";
+    rev = "v${version}";
+    hash = sha256;
   };
   inherit (buildGoModule.go) GOOS GOARCH;
 
diff --git a/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix b/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix
index 831de6c93372f..1bf2443aa183a 100644
--- a/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix
+++ b/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix
@@ -1,6 +1,6 @@
 generic: {
   v1_1_0 = generic {
     version = "1.1.0";
-    sha256 = "0ar2m25ngdd1wk7d70j2781wbrvhjhf9cj9qvp24jjrhqng6hvn7";
+    sha256 = "sha256-yFQEOshjaH6fRCQ7IZChANI9guZlTXk35p1NzQvxUdI=";
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix b/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
index 0712a06863e5c..4ddb8995b6220 100644
--- a/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
@@ -18,6 +18,7 @@ in
   discourse-oauth2-basic = callPackage ./discourse-oauth2-basic {};
   discourse-openid-connect = callPackage ./discourse-openid-connect {};
   discourse-prometheus = callPackage ./discourse-prometheus {};
+  discourse-reactions = callPackage ./discourse-reactions {};
   discourse-saved-searches = callPackage ./discourse-saved-searches {};
   discourse-solved = callPackage ./discourse-solved {};
   discourse-spoiler-alert = callPackage ./discourse-spoiler-alert {};
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-reactions/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-reactions/default.nix
new file mode 100644
index 0000000000000..ac48f83ae90b2
--- /dev/null
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-reactions/default.nix
@@ -0,0 +1,17 @@
+{ lib, mkDiscoursePlugin, fetchFromGitHub }:
+
+mkDiscoursePlugin {
+  name = "discourse-reactions";
+  src = fetchFromGitHub {
+    owner = "discourse";
+    repo = "discourse-reactions";
+    rev = "3afaabc8e430dfe655be4efbbcb20ab7f0c7c8d3";
+    sha256 = "sha256-CdrInrPFDpvYW7j0epIeAFUoPGTbmMOGdm2DpkIQBbs=";
+  };
+  meta = with lib; {
+    homepage = "https://github.com/discourse/discourse-reactions";
+    maintainers = with maintainers; [ bbenno ];
+    license = licenses.mit;
+    description = "Allows users to react to a post from a choice of emojis, rather than only the like heart";
+  };
+}
diff --git a/pkgs/servers/web-apps/discourse/update.py b/pkgs/servers/web-apps/discourse/update.py
index aa0ddbd60ede9..2c5c8f4b44a51 100755
--- a/pkgs/servers/web-apps/discourse/update.py
+++ b/pkgs/servers/web-apps/discourse/update.py
@@ -294,8 +294,9 @@ def update_plugins():
         {'name': 'discourse-ldap-auth', 'owner': 'jonmbake'},
         {'name': 'discourse-math'},
         {'name': 'discourse-migratepassword', 'owner': 'discoursehosting'},
-        {'name': 'discourse-prometheus'},
         {'name': 'discourse-openid-connect'},
+        {'name': 'discourse-prometheus'},
+        {'name': 'discourse-reactions'},
         {'name': 'discourse-saved-searches'},
         {'name': 'discourse-solved'},
         {'name': 'discourse-spoiler-alert'},
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 53ec9e9865eff..0907d814171f9 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1180,11 +1180,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXpm = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXt, gettext }: stdenv.mkDerivation {
     pname = "libXpm";
-    version = "3.5.13";
+    version = "3.5.15";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXpm-3.5.13.tar.bz2";
-      sha256 = "09dc6nwlb2122h02vl64k9x56mxnyqz2gwpga0abfv4bb1bxmlcw";
+      url = "mirror://xorg/individual/lib/libXpm-3.5.15.tar.xz";
+      sha256 = "1hfivygzrzpq81vg9z2l46pd5nrzm326k6z3cfw6syiibin91fv0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 6de759498b21c..b0530977f7e24 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -3,7 +3,8 @@
   lib, stdenv, makeWrapper, fetchurl, fetchpatch, fetchFromGitLab, buildPackages,
   automake, autoconf, libiconv, libtool, intltool,
   freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
-  libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
+  libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm, netbsd,
+  ncompress,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
   mcpp, libepoxy, openssl, pkg-config, llvm, libxslt, libxcrypt,
   ApplicationServices, Carbon, Cocoa, Xplugin,
@@ -313,6 +314,7 @@ self: super:
   libXpm = super.libXpm.overrideAttrs (attrs: {
     outputs = [ "bin" "dev" "out" ]; # tiny man in $bin
     patchPhase = "sed -i '/USE_GETTEXT_TRUE/d' sxpm/Makefile.in cxpm/Makefile.in";
+    XPM_PATH_COMPRESS = lib.makeBinPath [ ncompress ];
   });
 
   libXpresent = super.libXpresent.overrideAttrs (attrs: {
@@ -328,7 +330,13 @@ self: super:
   });
 
   libpciaccess = super.libpciaccess.overrideAttrs (attrs: {
-    meta = attrs.meta // { platforms = lib.platforms.linux; };
+    buildInputs = lib.optionals stdenv.hostPlatform.isNetBSD (with netbsd; [ libarch libpci ]);
+
+    meta = attrs.meta // {
+      # https://gitlab.freedesktop.org/xorg/lib/libpciaccess/-/blob/master/configure.ac#L108-114
+      platforms = lib.fold (os: ps: ps ++ lib.platforms.${os}) []
+        [ "cygwin" "freebsd" "linux" "netbsd" "openbsd" "illumos" ];
+    };
   });
 
   setxkbmap = super.setxkbmap.overrideAttrs (attrs: {
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 07f98eef9f1a2..9a82416d30508 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -193,7 +193,7 @@ mirror://xorg/individual/lib/libXinerama-1.1.4.tar.bz2
 mirror://xorg/individual/lib/libxkbfile-1.1.0.tar.bz2
 mirror://xorg/individual/lib/libXmu-1.1.3.tar.bz2
 mirror://xorg/individual/lib/libXp-1.0.3.tar.bz2
-mirror://xorg/individual/lib/libXpm-3.5.13.tar.bz2
+mirror://xorg/individual/lib/libXpm-3.5.15.tar.xz
 mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2
 mirror://xorg/individual/lib/libXrandr-1.5.2.tar.bz2
 mirror://xorg/individual/lib/libXrender-0.9.10.tar.bz2
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 85bd8d2087f66..42d19a0fad4b9 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -100,6 +100,7 @@ rec {
         + lib.optionalString (stdenv.cc.isGNU or false) " -static-libgcc";
       nativeBuildInputs = (args.nativeBuildInputs or []) ++ [
         (pkgs.buildPackages.makeSetupHook {
+          name = "darwin-portable-libSystem-hook";
           substitutions = {
             libsystem = "${stdenv.cc.libc}/lib/libSystem.B.dylib";
           };
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index 5e549e48287c5..2cc44b319ffaa 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -71,7 +71,7 @@ in rec {
       cp ${gawk}/bin/gawk $out/bin
       cp -d ${gawk}/bin/awk $out/bin
       cp ${gnutar}/bin/tar $out/bin
-      cp ${gzip}/bin/gzip $out/bin
+      cp ${gzip}/bin/.gzip-wrapped $out/bin/gzip
       cp ${bzip2_.bin}/bin/bzip2 $out/bin
       cp -d ${gnumake}/bin/* $out/bin
       cp -d ${patch}/bin/* $out/bin
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index b07420bb4185c..b1b982ecdffc1 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1,4 +1,5 @@
 # shellcheck shell=bash
+# shellcheck disable=1090,2154,2123,2034,2178,2048,2068,1091
 __nixpkgs_setup_set_original=$-
 set -eu
 set -o pipefail
@@ -32,7 +33,7 @@ if [ -n "$__structuredAttrs" ]; then
     export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
     export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
 else
-    : ${outputs:=out}
+    : "${outputs:=out}"
 fi
 
 getAllOutputNames() {
@@ -125,11 +126,6 @@ _eval() {
 ######################################################################
 # Logging.
 
-# Obsolete.
-stopNest() { true; }
-header() { echo "$1"; }
-closeNest() { true; }
-
 # Prints a command such that all word splits are unambiguous. We need
 # to split the command in three parts because the middle format string
 # will be, and must be, repeated for each argument. The first argument
@@ -210,8 +206,8 @@ addToSearchPath() {
 # syntax when they switch to setting __structuredAttrs = true.
 prependToVar() {
     local -n nameref="$1"
+    local useArray type
 
-    useArray=
     if [ -n "$__structuredAttrs" ]; then
         useArray=true
     else
@@ -243,8 +239,8 @@ prependToVar() {
 # Same as above
 appendToVar() {
     local -n nameref="$1"
+    local useArray type
 
-    useArray=
     if [ -n "$__structuredAttrs" ]; then
         useArray=true
     else
@@ -398,7 +394,7 @@ fi
 # implementation uses zip archive and zip does not support dates going back to
 # 1970.
 export SOURCE_DATE_EPOCH
-: ${SOURCE_DATE_EPOCH:=315532800}
+: "${SOURCE_DATE_EPOCH:=315532800}"
 
 
 # Wildcard expansions that don't match should expand to an empty list.
@@ -448,7 +444,6 @@ runHook addInputsHook
 
 # Package accumulators
 
-# shellcheck disable=SC2034
 declare -a pkgsBuildBuild pkgsBuildHost pkgsBuildTarget
 declare -a pkgsHostHost pkgsHostTarget
 declare -a pkgsTargetTarget
@@ -473,7 +468,6 @@ declare -a pkgTargetHookVars=(envTargetTargetHook)
 declare -a pkgHookVarVars=(pkgBuildHookVars pkgHostHookVars pkgTargetHookVars)
 
 # those variables are declared here, since where and if they are used varies
-# shellcheck disable=SC2034
 declare -a preFixupHooks fixupOutputHooks preConfigureHooks postFixupHooks postUnpackHooks unpackCmdHooks
 
 # Add env hooks for all sorts of deps with the specified host offset.
@@ -521,7 +515,7 @@ findInputs() {
     local -r targetOffset="$3"
 
     # Sanity check
-    (( hostOffset <= targetOffset )) || exit -1
+    (( hostOffset <= targetOffset )) || exit 1
 
     local varVar="${pkgAccumVarVars[hostOffset + 1]}"
     local varRef="$varVar[$((targetOffset - hostOffset))]"
@@ -610,12 +604,12 @@ findInputs() {
 # in each list must be store paths, and therefore space-free.
 
 # Make sure all are at least defined as empty
-: ${depsBuildBuild=} ${depsBuildBuildPropagated=}
-: ${nativeBuildInputs=} ${propagatedNativeBuildInputs=} ${defaultNativeBuildInputs=}
-: ${depsBuildTarget=} ${depsBuildTargetPropagated=}
-: ${depsHostHost=} ${depsHostHostPropagated=}
-: ${buildInputs=} ${propagatedBuildInputs=} ${defaultBuildInputs=}
-: ${depsTargetTarget=} ${depsTargetTargetPropagated=}
+: "${depsBuildBuild=}" "${depsBuildBuildPropagated=}"
+: "${nativeBuildInputs=}" "${propagatedNativeBuildInputs=}" "${defaultNativeBuildInputs=}"
+: "${depsBuildTarget=}" "${depsBuildTargetPropagated=}"
+: "${depsHostHost=}" "${depsHostHostPropagated=}"
+: "${buildInputs=}" "${propagatedBuildInputs=}" "${defaultBuildInputs=}"
+: "${depsTargetTarget=}" "${depsTargetTargetPropagated=}"
 
 for pkg in ${depsBuildBuild[@]} ${depsBuildBuildPropagated[@]}; do
     findInputs "$pkg" -1 -1
@@ -650,7 +644,7 @@ activatePackage() {
     local -r targetOffset="$3"
 
     # Sanity check
-    (( hostOffset <= targetOffset )) || exit -1
+    (( hostOffset <= targetOffset )) || exit 1
 
     if [ -f "$pkg" ]; then
         source "$pkg"
@@ -798,10 +792,6 @@ unset _HOST_PATH
 unset _XDG_DATA_DIRS
 
 
-# Make GNU Make produce nested output.
-export NIX_INDENT_MAKE=1
-
-
 # Normalize the NIX_BUILD_CORES variable. The value might be 0, which
 # means that we're supposed to try and auto-detect the number of
 # available CPU cores at run-time.
@@ -888,7 +878,7 @@ substituteStream() {
 # fail loudly if provided with a binary (containing null bytes)
 consumeEntire() {
     # read returns non-0 on EOF, so we want read to fail
-    if IFS='' read -r -d '' $1 ; then
+    if IFS='' read -r -d '' "$1" ; then
         echo "consumeEntire(): ERROR: Input null bytes, won't process" >&2
         return 1
     fi
@@ -1033,7 +1023,7 @@ _defaultUnpack() {
 
 unpackFile() {
     curSrc="$1"
-    header "unpacking source archive $curSrc" 3
+    echo "unpacking source archive $curSrc"
     if ! runOneHook unpackCmd "$curSrc"; then
         echo "do not know how to unpack source archive $curSrc"
         exit 1
@@ -1079,7 +1069,7 @@ unpackPhase() {
     # Find the source directory.
 
     # set to empty if unset
-    : ${sourceRoot=}
+    : "${sourceRoot=}"
 
     if [ -n "${setSourceRoot:-}" ]; then
         runOneHook setSourceRoot
@@ -1130,7 +1120,7 @@ patchPhase() {
     fi
 
     for i in "${patchesArray[@]}"; do
-        header "applying patch $i" 3
+        echo "applying patch $i"
         local uncompress=cat
         case "$i" in
             *.gz)
@@ -1183,7 +1173,7 @@ configurePhase() {
     runHook preConfigure
 
     # set to empty if unset
-    : ${configureScript=}
+    : "${configureScript=}"
 
     if [[ -z "$configureScript" && -x ./configure ]]; then
         configureScript=./configure
@@ -1253,7 +1243,7 @@ buildPhase() {
     runHook preBuild
 
     if [[ -z "${makeFlags-}" && -z "${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ]]; then
-        echo "no Makefile, doing nothing"
+        echo "no Makefile or custom buildPhase, doing nothing"
     else
         foundMakefile=1
 
@@ -1323,6 +1313,15 @@ checkPhase() {
 installPhase() {
     runHook preInstall
 
+    # Dont reuse 'foundMakefile' set in buildPhase, a makefile may have been created in buildPhase
+    if [[ -z "${makeFlags-}" && -z "${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ]]; then
+        echo "no Makefile or custom installPhase, doing nothing"
+        runHook postInstall
+        return
+    else
+        foundMakefile=1
+    fi
+
     if [ -n "$prefix" ]; then
         mkdir -p "$prefix"
     fi
@@ -1436,7 +1435,7 @@ installCheckPhase() {
         echo "no Makefile or custom installCheckPhase, doing nothing"
     #TODO(@oxij): should flagsArray influence make -n?
     elif [[ -z "${installCheckTarget:-}" ]] \
-       && ! make -n ${makefile:+-f $makefile} ${installCheckTarget:-installcheck} >/dev/null 2>&1; then
+       && ! make -n ${makefile:+-f $makefile} "${installCheckTarget:-installcheck}" >/dev/null 2>&1; then
         echo "no installcheck target in ${makefile:-Makefile}, doing nothing"
     else
         # Old bash empty array hack
@@ -1485,15 +1484,15 @@ distPhase() {
 showPhaseHeader() {
     local phase="$1"
     case "$phase" in
-        unpackPhase) header "unpacking sources";;
-        patchPhase) header "patching sources";;
-        configurePhase) header "configuring";;
-        buildPhase) header "building";;
-        checkPhase) header "running tests";;
-        installPhase) header "installing";;
-        fixupPhase) header "post-installation fixup";;
-        installCheckPhase) header "running install tests";;
-        *) header "$phase";;
+        unpackPhase) echo "unpacking sources";;
+        patchPhase) echo "patching sources";;
+        configurePhase) echo "configuring";;
+        buildPhase) echo "building";;
+        checkPhase) echo "running tests";;
+        installPhase) echo "installing";;
+        fixupPhase) echo "post-installation fixup";;
+        installCheckPhase) echo "running install tests";;
+        *) echo "$phase";;
     esac
 }
 
@@ -1503,19 +1502,23 @@ showPhaseFooter() {
     local startTime="$2"
     local endTime="$3"
     local delta=$(( endTime - startTime ))
-    (( $delta < 30 )) && return
+    (( delta < 30 )) && return
 
     local H=$((delta/3600))
     local M=$((delta%3600/60))
     local S=$((delta%60))
     echo -n "$phase completed in "
-    (( $H > 0 )) && echo -n "$H hours "
-    (( $M > 0 )) && echo -n "$M minutes "
+    (( H > 0 )) && echo -n "$H hours "
+    (( M > 0 )) && echo -n "$M minutes "
     echo "$S seconds"
 }
 
 
 genericBuild() {
+    # variable used by our gzip wrapper to add -n.
+    # gzip is in common-path.nix and is added to nix-shell but we only want to change its behaviour in nix builds. do not move to a setupHook in gzip.
+    export GZIP_NO_TIMESTAMPS=1
+
     if [ -f "${buildCommandPath:-}" ]; then
         source "$buildCommandPath"
         return
@@ -1548,7 +1551,7 @@ genericBuild() {
         if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then continue; fi
 
         if [[ -n $NIX_LOG_FD ]]; then
-            echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&$NIX_LOG_FD
+            echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&"$NIX_LOG_FD"
         fi
 
         showPhaseHeader "$curPhase"
diff --git a/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh b/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
index f394869ea915b..5b5677eef1366 100644
--- a/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
+++ b/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
@@ -17,6 +17,15 @@ else
    LD_BINARY=$out/lib/ld-*so.?
 fi
 
+# path to version-specific libraries, like libstdc++.so
+LIBSTDCXX_SO_DIR=$(echo $out/lib/gcc/*/*)
+
+# Move version-specific libraries out to avoid library mix when we
+# upgrade gcc.
+# TODO(trofi): update bootstrap tarball script and tarballs to put them
+# into expected location directly.
+LD_LIBRARY_PATH=$out/lib $LD_BINARY $out/bin/mv $out/lib/libstdc++.* $LIBSTDCXX_SO_DIR/
+
 # On x86_64, ld-linux-x86-64.so.2 barfs on patchelf'ed programs.  So
 # use a copy of patchelf.
 LD_LIBRARY_PATH=$out/lib $LD_BINARY $out/bin/cp $out/bin/patchelf .
@@ -25,8 +34,8 @@ for i in $out/bin/* $out/libexec/gcc/*/*/*; do
     if [ -L "$i" ]; then continue; fi
     if [ -z "${i##*/liblto*}" ]; then continue; fi
     echo patching "$i"
-    LD_LIBRARY_PATH=$out/lib $LD_BINARY \
-        ./patchelf --set-interpreter $LD_BINARY --set-rpath $out/lib --force-rpath "$i"
+    LD_LIBRARY_PATH=$out/lib:$LIBSTDCXX_SO_DIR $LD_BINARY \
+        ./patchelf --set-interpreter $LD_BINARY --set-rpath $out/lib:$LIBSTDCXX_SO_DIR --force-rpath "$i"
 done
 
 for i in $out/lib/librt-*.so $out/lib/libpcre*; do
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 870fb04c3883f..5c7dfcceec644 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -296,7 +296,7 @@ in
 
     overrides = self: super: {
       inherit (prevStage)
-        ccWrapperStdenv
+        ccWrapperStdenv gettext
         gcc-unwrapped coreutils gnugrep
         perl gnum4 bison;
       dejagnu = super.dejagnu.overrideAttrs (a: { doCheck = false; } );
@@ -332,7 +332,8 @@ in
         # and that can fail to load.  Therefore we upgrade `ld` to use newer libc;
         # apparently the interpreter needs to match libc, too.
         bintools = self.stdenvNoCC.mkDerivation {
-          inherit (prevStage.bintools.bintools) name;
+          pname = prevStage.bintools.bintools.pname + "-patchelfed-ld";
+          inherit (prevStage.bintools.bintools) version;
           enableParallelBuilding = true;
           dontUnpack = true;
           dontBuild = true;
@@ -369,7 +370,7 @@ in
     overrides = self: super: rec {
       inherit (prevStage)
         ccWrapperStdenv
-        binutils coreutils gnugrep
+        binutils coreutils gnugrep gettext
         perl patchelf linuxHeaders gnum4 bison libidn2 libunistring;
       ${localSystem.libc} = getLibc prevStage;
       gcc-unwrapped =
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index e98ba0c085950..3aa7f6a3df537 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -115,7 +115,7 @@ in with pkgs; rec {
         cp ${gawk.out}/bin/gawk $out/bin
         cp -d ${gawk.out}/bin/awk $out/bin
         cp ${tarMinimal.out}/bin/tar $out/bin
-        cp ${gzip.out}/bin/gzip $out/bin
+        cp ${gzip.out}/bin/.gzip-wrapped $out/bin/gzip
         cp ${bzip2.bin}/bin/bzip2 $out/bin
         cp -d ${gnumake.out}/bin/* $out/bin
         cp -d ${patch}/bin/* $out/bin
@@ -272,16 +272,17 @@ in with pkgs; rec {
       gcc --version
 
     '' + lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
-      ldlinux=$(echo ${bootstrapTools}/lib/${builtins.unsafeDiscardStringContext /* only basename */ (builtins.baseNameOf binutils.dynamicLinker)})
-      export CPP="cpp -idirafter ${bootstrapTools}/include-glibc -B${bootstrapTools}"
-      export CC="gcc -idirafter ${bootstrapTools}/include-glibc -B${bootstrapTools} -Wl,-dynamic-linker,$ldlinux -Wl,-rpath,${bootstrapTools}/lib"
-      export CXX="g++ -idirafter ${bootstrapTools}/include-glibc -B${bootstrapTools} -Wl,-dynamic-linker,$ldlinux -Wl,-rpath,${bootstrapTools}/lib"
+      rtld=$(echo ${bootstrapTools}/lib/${builtins.unsafeDiscardStringContext /* only basename */ (builtins.baseNameOf binutils.dynamicLinker)})
+      libc_includes=${bootstrapTools}/include-glibc
     '' + lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
-      ldmusl=$(echo ${bootstrapTools}/lib/ld-musl*.so.?)
-      export CPP="cpp -idirafter ${bootstrapTools}/include-libc -B${bootstrapTools}"
-      export CC="gcc -idirafter ${bootstrapTools}/include-libc -B${bootstrapTools} -Wl,-dynamic-linker,$ldmusl -Wl,-rpath,${bootstrapTools}/lib"
-      export CXX="g++ -idirafter ${bootstrapTools}/include-libc -B${bootstrapTools} -Wl,-dynamic-linker,$ldmusl -Wl,-rpath,${bootstrapTools}/lib"
+      rtld=$(echo ${bootstrapTools}/lib/ld-musl*.so.?)
+      libc_includes=${bootstrapTools}/include-libc
     '' + ''
+      # path to version-specific libraries, like libstdc++.so
+      cxx_libs=$(echo ${bootstrapTools}/lib/gcc/*/*)
+      export CPP="cpp -idirafter $libc_includes -B${bootstrapTools}"
+      export  CC="gcc -idirafter $libc_includes -B${bootstrapTools} -Wl,-dynamic-linker,$rtld -Wl,-rpath,${bootstrapTools}/lib -Wl,-rpath,$cxx_libs"
+      export CXX="g++ -idirafter $libc_includes -B${bootstrapTools} -Wl,-dynamic-linker,$rtld -Wl,-rpath,${bootstrapTools}/lib -Wl,-rpath,$cxx_libs"
 
       echo '#include <stdio.h>' >> foo.c
       echo '#include <limits.h>' >> foo.c
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 5ff18298f217a..bad6eb7ba7aa3 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -4,7 +4,8 @@
 { stdenv
 , pkgs
 , lib
-,
+, runCommand
+, testers
 }:
 
 let
@@ -99,6 +100,25 @@ in
   # tests for hooks in `stdenv.defaultNativeBuildInputs`
   hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenv; pkgs = earlyPkgs; });
 
+  outputs-no-out = runCommand "outputs-no-out-assert" {
+    result = testers.testBuildFailure (stdenv.mkDerivation {
+      NIX_DEBUG = 1;
+      name = "outputs-no-out";
+      outputs = ["foo"];
+      buildPhase = ":";
+      installPhase = ''
+        touch $foo
+      '';
+    });
+
+    # Assumption: the first output* variable to be configured is
+    #   _overrideFirst outputDev "dev" "out"
+    expectedMsg = "_assignFirst: could not find a non-empty variable to assign to outputDev. The following variables were all unset or empty: dev out.";
+  } ''
+    grep -F "$expectedMsg" $result/testBuildFailure.log >/dev/null
+    touch $out
+  '';
+
   test-env-attrset = testEnvAttrset { name = "test-env-attrset"; stdenv' = bootStdenv; };
 
   # Test compatibility with derivations using `env` as a regular variable.
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index efdfae8268a9f..99eedf9991193 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JVxlfwCA+EetV4QYB6uEKe1yWt3sCvMPZwyIr6Td7Bw=";
+    sha256 = "sha256-PTUATmnpJGeY0Ushf7sAapsZ51VC2IdnKMzYJX5+h9A=";
   };
 
-  cargoSha256 = "sha256-uUxwQIQTzQkKgR4F4sf4J1G2LaXiGbIvA6VM55zLK2E=";
+  cargoHash = "sha256-jxGdozSEIop2jBL4lK3ZcEuuR7P8qDoQD/Lrl4yaBN0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 30e61e00522fe..e7d13b20b60a9 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.68.1";
+  version = "0.69.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iOJnSeVRAjmJblaipmk05J9BvAkYgyS1OA8b3xDykXc=";
+    hash = "sha256-nwS5Oar8ck9StNJtbnZoRv3/v/fYKq/RXVl7CPWBfGY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index e7f22ad0ff965..f61bc9df66d58 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -51,6 +51,15 @@ stdenv.mkDerivation rec {
       ];
       sha256 = "1h00djdvgjhwfb60wl4qrxbyfsbbnn1qw6l2hkldnif4m8f8r1zj";
     })
+    (fetchurl {
+      urls = [
+        # original link (will be dead eventually):
+        "https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch"
+
+        "https://web.archive.org/web/20230106200319/https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch"
+      ];
+      sha256 = "sha256-on79jElQ+z2ULWAq14RpluAqr9d6itHiZwDkKubBzTc=";
+    })
   ] ++ lib.optional enableNLS
     (fetchurl {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/unzip/files/unzip-6.0-natspec.patch?id=56bd759df1d0c750a065b8c845e93d5dfa6b549d";
diff --git a/pkgs/tools/archivers/xarchiver/default.nix b/pkgs/tools/archivers/xarchiver/default.nix
index 8862ad8030bff..3a3223728a7ae 100644
--- a/pkgs/tools/archivers/xarchiver/default.nix
+++ b/pkgs/tools/archivers/xarchiver/default.nix
@@ -2,14 +2,14 @@
   coreutils, zip, unzip, p7zip, unar, gnutar, bzip2, gzip, lhasa, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
-  version = "0.5.4.19";
+  version = "0.5.4.20";
   pname = "xarchiver";
 
   src = fetchFromGitHub {
     owner = "ib";
     repo = "xarchiver";
     rev = version;
-    sha256 = "sha256-YCfjOGbjjv4ntNDK3E49hYCVYDhMsRBJ7zsHt8hqQ7Y=";
+    sha256 = "sha256-OzcfIFYaWez2B1lmAYvhm+knuYbyMu2ohs+kGEVG7K0=";
   };
 
   nativeBuildInputs = [ intltool pkg-config makeWrapper wrapGAppsHook ];
diff --git a/pkgs/tools/backup/pgbackrest/default.nix b/pkgs/tools/backup/pgbackrest/default.nix
index e6bdca7c92d85..d8ab7956ade77 100644
--- a/pkgs/tools/backup/pgbackrest/default.nix
+++ b/pkgs/tools/backup/pgbackrest/default.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "pgbackrest";
-  version = "2.43";
+  version = "2.44";
 
   src = fetchFromGitHub {
     owner = "pgbackrest";
     repo = "pgbackrest";
     rev = "release/${version}";
-    sha256 = "sha256-JZHE68d8fzqr0kI35TxoVB3Frt/v22xkZexfzhkqzBU=";
+    sha256 = "sha256-N56HUW1JZNvaqzU01xaZ8BsFA2KW4z8ixulPngYCIY0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix
index ef94eee2429fa..03bd62924048d 100644
--- a/pkgs/tools/backup/tsm-client/default.nix
+++ b/pkgs/tools/backup/tsm-client/default.nix
@@ -159,16 +159,6 @@ let
         ln --symbolic --force --no-target-directory "$out/$(cut -b 7- <<< "$target")" "$link"
       done
     '';
-
-    # since 7b9fd5d1c9802131ca0a01ff08a3ff64379d2df4
-    # autopatchelf misses to add $out/lib to rpath;
-    # we have to call autopatchelf manually as it would
-    # run too late and overwrite our rpath otherwise
-    dontAutoPatchelf = true;
-    postFixup = ''
-      autoPatchelf $out
-      patchelf --add-rpath $out/lib $out/lib/*
-    '';
   };
 
   binPath = lib.makeBinPath ([ acl gnugrep procps ]
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 771188a98cd9f..24f81d99da3c9 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchurl
+, makeWrapper
 , xz
-, writeText
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ xz.bin ];
+  nativeBuildInputs = [ xz.bin makeWrapper ];
 
   makeFlags = [
     "SHELL=/bin/sh"
@@ -40,12 +40,13 @@ stdenv.mkDerivation rec {
   preFixup = ''
     sed -i '1{;/#!\/bin\/sh/aPATH="'$out'/bin:$PATH"
     }' $out/bin/*
-  '';
-
-  # set GZIP env variable to "-n" to stop gzip from adding timestamps
+  ''
+  # run gzip with "-n" when $GZIP_NO_TIMESTAMPS (set by stdenv's setup.sh) is set to stop gzip from adding timestamps
   # to archive headers: https://github.com/NixOS/nixpkgs/issues/86348
-  setupHook = writeText "setup-hook" ''
-    export GZIP="-n"
+  # if changing so that there's no longer a .gzip-wrapped then update copy in make-bootstrap-tools.nix
+  + ''
+    wrapProgram $out/bin/gzip \
+      --add-flags "\''${GZIP_NO_TIMESTAMPS:+-n}"
   '';
 
   meta = {
diff --git a/pkgs/tools/compression/lzip/default.nix b/pkgs/tools/compression/lzip/default.nix
index 7fa7b4e35c858..b41b3c843da6e 100644
--- a/pkgs/tools/compression/lzip/default.nix
+++ b/pkgs/tools/compression/lzip/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, texinfo }:
+{ lib, stdenv, fetchurl }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -10,8 +10,6 @@ stdenv.mkDerivation rec {
   version = "1.23";
   outputs = [ "out" "man" "info" ];
 
-  nativeBuildInputs = [ texinfo ];
-
   src = fetchurl {
     url = "mirror://savannah/lzip/${pname}-${version}.tar.gz";
     sha256 = "sha256-R5LAR93xXvKdVbqOaKGiHgy3aS2H7N9yBEGYZFgvKA0=";
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index 59f1901bd9fd0..d49cc314b4a81 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "eV6gSUxm1QmwUt3DbcY71jTln/Kg85wWo7VkTdAdh+Y=";
+    sha256 = "3Rcqy1OGemgBL5TBc4lAGy8nShqlro+Ey/uLfjg+qNM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/games/scarab/default.nix b/pkgs/tools/games/scarab/default.nix
index 039e46f71944f..56e94807fec16 100644
--- a/pkgs/tools/games/scarab/default.nix
+++ b/pkgs/tools/games/scarab/default.nix
@@ -17,13 +17,13 @@
 
 buildDotnetModule rec {
   pname = "scarab";
-  version = "1.19.0.0";
+  version = "1.20.0.0";
 
   src = fetchFromGitHub {
     owner = "fifty-six";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10pmzy7nhcam0686kpn64cgar59shzzy5k7j3vrgmnm27zgkr22v";
+    sha256 = "sha256-VfXIxir4SaELuF2QpqbVzTvlkYxwERa0ddGEn1OAh04=";
   };
 
   nugetDeps = ./deps.nix;
diff --git a/pkgs/tools/misc/copier/default.nix b/pkgs/tools/misc/copier/default.nix
new file mode 100644
index 0000000000000..55d1ea6693e70
--- /dev/null
+++ b/pkgs/tools/misc/copier/default.nix
@@ -0,0 +1,51 @@
+{ lib, git, python3, fetchFromGitHub }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "copier";
+  version = "7.0.1";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "copier-org";
+    repo = "copier";
+    rev = "v${version}";
+    sha256 = "sha256-8lTvyyKfAkvnUvw3e+r9C/49QASR8Zeokm509jxGK2g=";
+  };
+
+  POETRY_DYNAMIC_VERSIONING_BYPASS = version;
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+    python3.pkgs.poetry-dynamic-versioning
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    colorama
+    dunamai
+    iteration-utilities
+    jinja2
+    jinja2-ansible-filters
+    mkdocs-material
+    mkdocs-mermaid2-plugin
+    mkdocstrings
+    packaging
+    pathspec
+    plumbum
+    pydantic
+    pygments
+    pyyaml
+    pyyaml-include
+    questionary
+  ];
+
+  makeWrapperArgs = [
+    "--suffix PATH : ${lib.makeBinPath [ git ] }"
+  ];
+
+  meta = with lib; {
+    description = "Library and command-line utility for rendering projects templates";
+    homepage = "https://copier.readthedocs.io";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index c3a0c5aa906d4..65c88eac4e880 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -48,6 +48,16 @@ stdenv.mkDerivation rec {
     substituteInPlace src/util/genfsimg --replace "	syslinux " "	true "
   ''; # calling syslinux on a FAT image isn't going to work
 
+  # Workaround '-idirafter' ordering bug in staging-next:
+  #   https://github.com/NixOS/nixpkgs/pull/210004
+  # where libc '-idirafter' gets added after user's idirafter and
+  # breaks.
+  # TODO(trofi): remove it in staging once fixed in cc-wrapper.
+  preConfigure = ''
+    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] buildPackages.stdenv.hostPlatform.config}=$(< ${buildPackages.stdenv.cc}/nix-support/libc-cflags)
+    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"]               stdenv.hostPlatform.config}=$(<               ${stdenv.cc}/nix-support/libc-cflags)
+  '';
+
   # not possible due to assembler code
   hardeningDisable = [ "pic" "stackprotector" ];
 
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 850bdb83c8987..e3969d01eec3e 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
     sha256 = "15xfkcw1bkfyf3z8kl23k3rlv702m0h7ghqxvhniynvlwbgh6j2x";
   };
 
+  patches = [
+    # pass through NIX_* environment variables to scons.
+    ./scons-nix-env.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     sphinx
@@ -56,9 +61,6 @@ stdenv.mkDerivation rec {
   ];
 
   prePatch = ''
-    export CFLAGS="$NIX_CFLAGS_COMPILE"
-    export LDFLAGS="''${NIX_LDFLAGS//-rpath /-Wl,-rpath=}"
-
     # remove sources of nondeterminism
     substituteInPlace lib/cmdline.c \
       --replace "__DATE__" "\"Jan  1 1970\"" \
@@ -67,6 +69,7 @@ stdenv.mkDerivation rec {
       --replace "gzip -c " "gzip -cn "
   '';
 
+  # Otherwise tries to access /usr.
   prefixKey = "--prefix=";
 
   sconsFlags = lib.optionals (!withGui) [ "--without-gui" ];
diff --git a/pkgs/tools/misc/rmlint/scons-nix-env.patch b/pkgs/tools/misc/rmlint/scons-nix-env.patch
new file mode 100644
index 0000000000000..10ed5698be3a7
--- /dev/null
+++ b/pkgs/tools/misc/rmlint/scons-nix-env.patch
@@ -0,0 +1,19 @@
+scons does not use os environment by default:
+  https://scons.org/doc/2.1.0/HTML/scons-user/x1750.html
+
+nixpkgs' cc-wrapper on the other hand relies on various NIX_* variables
+to be passed through like NIX_CFLAGS_COMPILE_BEFORE.
+--- a/SConstruct
++++ b/SConstruct
+@@ -559,10 +559,7 @@ options = dict(
+     SHLINKCOMSTR=link_shared_library_message,
+     LINKCOMSTR=link_program_message,
+     PREFIX=GetOption('prefix'),
+-    ENV = dict([ (key, os.environ[key])
+-                 for key in os.environ
+-                 if key in ['PATH', 'TERM', 'HOME', 'PKG_CONFIG_PATH']
+-              ])
++    ENV = os.environ,
+ )
+ 
+ if ARGUMENTS.get('VERBOSE') == "1":
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 44029fb5d4efa..aaaa297a55987 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "10.2.4";
+  version = "10.3.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     rev = "v${version}";
-    hash = "sha256-b1nWTQ+m4b6XzDTR36ubf5nTdUuWK94F2P4Q3tUvHAw=";
+    hash = "sha256-BKrErM1d90o+yJ/R0vVgXDBwPgQSP3Qj26x4JmB7SXw=";
   };
 
-  cargoHash = "sha256-7GSkFh0Fefl9VlCdPdVZ9IsyN0IKUob5c43v84PtrcI=";
+  cargoHash = "sha256-jm97lfWHTtd3tE+Yql9CIss78B+bW9nUQAhs5anDb6c=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/twspace-crawler/default.nix b/pkgs/tools/misc/twspace-crawler/default.nix
new file mode 100644
index 0000000000000..eead04e0138c6
--- /dev/null
+++ b/pkgs/tools/misc/twspace-crawler/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildNpmPackage, fetchFromGitHub }:
+
+buildNpmPackage rec {
+  pname = "twspace-crawler";
+  version = "1.11.13";
+
+  src = fetchFromGitHub {
+    owner = "HitomaruKonpaku";
+    repo = "twspace-crawler";
+    rev = "v${version}";
+    hash = "sha256-MGFVIQDb++oVbTQubl7CNYwT/ofTNFQfFiveXcNgQpA=";
+  };
+
+  npmDepsHash = "sha256-zKy/DngBwnfUqG6JfCULoDIrg1V16hX0Q4zNz45z888=";
+
+  meta = with lib; {
+    description = "Script to monitor & download Twitter Spaces 24/7";
+    homepage = "https://github.com/HitomaruKonpaku/twspace-crawler";
+    changelog = "https://github.com/HitomaruKonpaku/twspace-crawler/raw/v${version}/CHANGELOG.md";
+    license = licenses.isc;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/tools/misc/wakapi/default.nix b/pkgs/tools/misc/wakapi/default.nix
new file mode 100644
index 0000000000000..c04c98e053155
--- /dev/null
+++ b/pkgs/tools/misc/wakapi/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "wakapi";
+  version = "2.6.1";
+
+  src = fetchFromGitHub {
+    owner = "muety";
+    repo = pname;
+    rev = version;
+    sha256 = "1bhd96la2ipwna9lic50pd5klcc3xj9yqd5rd1cgzznbm4ylpjqb";
+  };
+
+  vendorHash = "sha256-fkSXaP9hHCCyO8mFB5CKPExifuNjTvDnXupjCVllG9I";
+
+  # Not a go module required by the project, contains development utilities
+  excludedPackages = [ "scripts" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = with lib; {
+    homepage = "https://wakapi.dev/";
+    changelog = "https://github.com/muety/wakapi/releases/tag/${version}";
+    description = "A minimalist self-hosted WakaTime-compatible backend for coding statistics";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ t4ccer ];
+  };
+}
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index bc43d77bbfba5..71f31c720d024 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/src";
 
+  # Workaround '-idirafter' ordering bug in staging-next:
+  #   https://github.com/NixOS/nixpkgs/pull/210004
+  # where libc '-idirafter' gets added after user's idirafter and
+  # breaks.
+  # TODO(trofi): remove it in staging once fixed in cc-wrapper.
+  preConfigure = ''
+    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] stdenv.hostPlatform.config}=$(< ${stdenv.cc}/nix-support/libc-cflags)
+  '';
+
   buildInputs = [ libbfd zlib libiberty ];
   makeFlags = [ "wimboot.x86_64.efi" ];
 
diff --git a/pkgs/tools/networking/openconnect/common.nix b/pkgs/tools/networking/openconnect/common.nix
index 555fd43035e68..146a2fc6ea503 100644
--- a/pkgs/tools/networking/openconnect/common.nix
+++ b/pkgs/tools/networking/openconnect/common.nix
@@ -15,6 +15,8 @@
 , zlib
 , vpnc-scripts
 , PCSC
+, useDefaultExternalBrowser ? true
+, xdg-utils
 , autoreconfHook
 }:
 
@@ -32,7 +34,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gmp libxml2 stoken zlib (if useOpenSSL then openssl else gnutls) ]
     ++ lib.optional stdenv.isDarwin PCSC
-    ++ lib.optional stdenv.isLinux p11-kit;
+    ++ lib.optional stdenv.isLinux p11-kit
+    ++ lib.optional (stdenv.isLinux && useDefaultExternalBrowser) xdg-utils;
   nativeBuildInputs = [ pkg-config autoreconfHook ];
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index e0e0b6078f730..1ea893948dc5e 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -26,6 +26,3 @@ in rec {
     useOpenSSL = true;
   };
 }
-
-
-
diff --git a/pkgs/tools/networking/pritunl-client/default.nix b/pkgs/tools/networking/pritunl-client/default.nix
index 09cca7d2eef22..0764c274084af 100644
--- a/pkgs/tools/networking/pritunl-client/default.nix
+++ b/pkgs/tools/networking/pritunl-client/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "pritunl-client";
-  version = "1.3.3373.6";
+  version = "1.3.3420.31";
 
   src = fetchFromGitHub {
     owner = "pritunl";
     repo = "pritunl-client-electron";
     rev = version;
-    sha256 = "sha256-Ttg6SNDcNIQlbNnKQY32hmsrgLhzHkeQfwlmCHe0bI0=";
+    sha256 = "sha256-FKLYpn2HeAVGN9OjLowv2BJRLZKReqXLPFvbin/jaBo=";
   };
 
   modRoot = "cli";
-  vendorSha256 = "sha256-fI2RIzvfbqBgchsvY8hsiecXYItM2XX9h8oiP3zmfTA=";
+  vendorHash = "sha256-fI2RIzvfbqBgchsvY8hsiecXYItM2XX9h8oiP3zmfTA=";
 
   postInstall = ''
     mv $out/bin/cli $out/bin/pritunl-client
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 96a71c1aba46e..690cf3d97013b 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,11 +48,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.17.0";
+  version = "1.17.1";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-3LyV14kdn5EMZuTtyfHy/eTeou7Bjjr591rtRKAvE0E=";
+    hash = "sha256-7kCFzszhJYTmAPPYFKKPqCLfqs7B+UyEv9Z/ilVxpfQ=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/nix/info/info.sh b/pkgs/tools/nix/info/info.sh
index c309e8be1649f..6ec8273504692 100755
--- a/pkgs/tools/nix/info/info.sh
+++ b/pkgs/tools/nix/info/info.sh
@@ -70,7 +70,7 @@ nixev() {
 }
 
 desc_system() {
-    nixev '(import <nixpkgs> {}).stdenv.hostPlatform.system'
+    nixev 'builtins.currentSystem'
 }
 
 desc_host_os() {
@@ -98,7 +98,7 @@ desc_multi_user() {
 }
 
 desc_nixpkgs_path() {
-    nixev '<nixpkgs>'
+    nixev '<nixpkgs>' 2>/dev/null || echo "not found"
 }
 
 channel_facts() {
diff --git a/pkgs/tools/package-management/nix/nix-perl.nix b/pkgs/tools/package-management/nix/nix-perl.nix
index 3c44dbdbe1440..0796a0914f1f5 100644
--- a/pkgs/tools/package-management/nix/nix-perl.nix
+++ b/pkgs/tools/package-management/nix/nix-perl.nix
@@ -40,6 +40,4 @@ stdenv.mkDerivation {
   ];
 
   preConfigure = "export NIX_STATE_DIR=$TMPDIR";
-
-  preBuild = "unset NIX_INDENT_MAKE";
 }
diff --git a/pkgs/tools/package-management/pkg/default.nix b/pkgs/tools/package-management/pkg/default.nix
new file mode 100644
index 0000000000000..a2bac43e5924e
--- /dev/null
+++ b/pkgs/tools/package-management/pkg/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchFromGitHub, m4, pkg-config, tcl
+, bzip2, libarchive, libbsd, lzma, openssl, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pkg";
+  version = "1.19.0";
+
+  src = fetchFromGitHub {
+    owner = "freebsd";
+    repo = "pkg";
+    rev = finalAttrs.version;
+    sha256 = "W66g8kVvaPJSyOZcgyDcUBrWQQ5YDkRqofSWfIsjd+k=";
+  };
+
+  setOutputFlags = false;
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ m4 pkg-config tcl ];
+  buildInputs = [ bzip2 libarchive lzma openssl zlib ]
+    ++ lib.optional stdenv.isLinux libbsd;
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    mkdir -p $out/etc
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/freebsd/pkg";
+    description = "Package management tool for FreeBSD";
+    maintainers = with maintainers; [ qyliss ];
+    platforms = with platforms; darwin ++ freebsd ++ linux ++ netbsd ++ openbsd;
+    license = licenses.bsd2;
+  };
+})
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index a85e91b1a0c16..c376411e6f7f0 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -16,7 +16,7 @@
 
 assert (doCheck && stdenv.isLinux) -> glibcLocales != null;
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   pname = "gawk" + lib.optionalString interactive "-interactive";
   version = "5.2.1";
 
@@ -31,13 +31,19 @@ stdenv.mkDerivation (rec {
     ./darwin-no-pma.patch
   ];
 
+  # PIE is incompatible with the "persistent malloc" ("pma") feature.
+  # While build system attempts to pass -no-pie to gcc. nixpkgs' `ld`
+  # wrapped still passes `-pie` flag to linker and breaks linkage.
+  # Let's disable "pie" until `ld` is fixed to do the right thing.
+  hardeningDisable = [ "pie" ];
+
   # When we do build separate interactive version, it makes sense to always include man.
   outputs = [ "out" "info" ]
     ++ lib.optional (!interactive) "man";
 
-  nativeBuildInputs = lib.optional (doCheck && stdenv.isLinux) glibcLocales
-    # no-pma fix
-    ++ [ autoreconfHook ];
+  # no-pma fix
+  nativeBuildInputs = [ autoreconfHook ]
+    ++ lib.optional (doCheck && stdenv.isLinux) glibcLocales;
 
   buildInputs = lib.optional withSigsegv libsigsegv
     ++ lib.optional interactive readline
@@ -83,8 +89,4 @@ stdenv.mkDerivation (rec {
     platforms = platforms.unix ++ platforms.windows;
     maintainers = [ ];
   };
-} // lib.optionalAttrs stdenv.hostPlatform.isMusl {
-  # PIE is incompatible with the "persistent malloc" ("pma") feature.
-  # FIXME: make unconditional in staging (added to avoid rebuilds in staging-next)
-  hardeningDisable = [ "pie" ];
-})
+}
diff --git a/pkgs/tools/text/igrep/default.nix b/pkgs/tools/text/igrep/default.nix
index ea0ecf58a96d8..1e17cda75d5f4 100644
--- a/pkgs/tools/text/igrep/default.nix
+++ b/pkgs/tools/text/igrep/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "igrep";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "konradsz";
     repo = "igrep";
     rev = "v${version}";
-    sha256 = "sha256-pXgmbSmOLeAtI7pP0X9go4KnlLv4RChBQNCPYeG4Q84=";
+    sha256 = "sha256-g6DY3+HwBNQ+jxByXyTJK5CjAaC48FpmsDf1qGGO/Lk=";
   };
 
-  cargoHash = "sha256-n1AVD6PuZFdZbTuGxNHvR6ngoVmSAixabcJl6nIcyP0=";
+  cargoHash = "sha256-7cSUIwWyWPxFDuRWplidbI93zbBV84T7e4Q//Uwj6N4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/tools/text/mdbook-open-on-gh/default.nix b/pkgs/tools/text/mdbook-open-on-gh/default.nix
index ea7fd3a22e70a..cba1e97591ef9 100644
--- a/pkgs/tools/text/mdbook-open-on-gh/default.nix
+++ b/pkgs/tools/text/mdbook-open-on-gh/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-open-on-gh";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "badboy";
     repo = pname;
     rev = version;
-    hash = "sha256-omQTyJ7XKRBjX8jyWLONajAYnwr93nElrwDLdvs2MxM=";
+    hash = "sha256-uXfvE34yRrTUjh/HTMvOeZVxX4Drt6sxziaazg0CR3I=";
   };
 
-  cargoHash = "sha256-57KcqALWbiGtp6HWSN42gZ0St38oHu3inZ0TT77j7go=";
+  cargoHash = "sha256-ol06ErggVLw2ThpXq9NRWEr7ymDSEBN4ae5zUmHKa7k=";
 
   meta = with lib; {
     description = "mdbook preprocessor to add a open-on-github link on every page";
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index c2d9238bdd69d..a0eb1f75a35d7 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -5,17 +5,18 @@ stdenv.mkDerivation rec {
   version = "2.36";
 
   src = fetchurl {
-    url = "https://pauillac.inria.fr/~maranget/hevea/distri/hevea-${version}.tar.gz";
+    url = "https://hevea.inria.fr/distri/hevea-${version}.tar.gz";
     sha256 = "sha256-XWdZ13AqKVx2oSwbKhoWdUqw7B/+1z/J0LE4tB5yBkg=";
   };
 
-  buildInputs = with ocamlPackages; [ ocaml ocamlbuild ];
+  nativeBuildInputs = with ocamlPackages; [ ocaml ocamlbuild ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
     description = "A quite complete and fast LATEX to HTML translator";
-    homepage = "http://pauillac.inria.fr/~maranget/hevea/";
+    homepage = "https://hevea.inria.fr/";
+    changelog = "https://github.com/maranget/hevea/raw/v${version}/CHANGES";
     license = licenses.qpl;
     maintainers = with maintainers; [ pSub ];
     platforms = with platforms; unix;
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index 25841ae92b49c..e58b8f342d056 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -16,7 +16,6 @@ let
       self = localPython;
       packageOverrides = self: super: {
         cement = changeVersion super.cement.overridePythonAttrs "2.8.2" "1li2whjzfhbpg6fjb6r1r92fb3967p1xv6hqs3j787865h2ysrc7";
-        future = changeVersion super.future.overridePythonAttrs "0.16.0" "1nzy1k4m9966sikp0qka7lirh8sqrsyainyf8rk97db7nwdfv773";
         wcwidth = changeVersion super.wcwidth.overridePythonAttrs "0.1.9" "1wf5ycjx8s066rdvr0fgz4xds9a8zhs91c4jzxvvymm1c8l8cwzf";
         semantic-version = changeVersion super.semantic-version.overridePythonAttrs "2.8.5" "d2cb2de0558762934679b9a104e82eca7af448c9f4974d1f3eeccff651df8a54";
         pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
@@ -48,10 +47,11 @@ with localPython.pkgs; buildPythonApplication rec {
   preConfigure = ''
     substituteInPlace setup.py \
       --replace "six>=1.11.0,<1.15.0" "six==1.16.0" \
-      --replace "requests>=2.20.1,<=2.26" "requests==2.28.1" \
+      --replace "requests>=2.20.1,<=2.26" "requests<3" \
       --replace "botocore>1.23.41,<1.24.0" "botocore>1.23.41,<2" \
       --replace "pathspec==0.9.0" "pathspec>=0.10.0,<0.11.0" \
       --replace "colorama>=0.2.5,<0.4.4" "colorama>=0.2.5,<=0.4.6" \
+      --replace "future>=0.16.0,<0.17.0" "future" \
       --replace "termcolor == 1.1.0" "termcolor>=2.0.0,<2.2.0"
   '';
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cd0415aa89f0b..e49545db3510b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -165,9 +165,10 @@ with pkgs;
 
   autoreconfHook = callPackage (
     { makeSetupHook, autoconf, automake, gettext, libtool }:
-    makeSetupHook
-      { deps = [ autoconf automake gettext libtool ]; }
-      ../build-support/setup-hooks/autoreconf.sh
+    makeSetupHook {
+      name = "autoreconf-hook";
+      deps = [ autoconf automake gettext libtool ];
+    } ../build-support/setup-hooks/autoreconf.sh
   ) { };
 
   autoreconfHook264 = autoreconfHook.override {
@@ -209,8 +210,9 @@ with pkgs;
     substitutions = { canonicalize_jar = canonicalize-jar; };
   } ../build-support/setup-hooks/canonicalize-jars.sh;
 
-  ensureNewerSourcesHook = { year }: makeSetupHook {}
-    (writeScript "ensure-newer-sources-hook.sh" ''
+  ensureNewerSourcesHook = { year }: makeSetupHook {
+    name = "ensure-newer-sources-hook";
+  } (writeScript "ensure-newer-sources-hook.sh" ''
       postUnpackHooks+=(_ensureNewerSources)
       _ensureNewerSources() {
         '${findutils}/bin/find' "$sourceRoot" \
@@ -343,9 +345,10 @@ with pkgs;
   # ValueError: ZIP does not support timestamps before 1980
   ensureNewerSourcesForZipFilesHook = ensureNewerSourcesHook { year = "1980"; };
 
-  updateAutotoolsGnuConfigScriptsHook = makeSetupHook
-    { substitutions = { gnu_config = gnu-config;}; }
-    ../build-support/setup-hooks/update-autotools-gnu-config-scripts.sh;
+  updateAutotoolsGnuConfigScriptsHook = makeSetupHook {
+    name = "update-autotools-gnu-config-scripts-hook";
+    substitutions = { gnu_config = gnu-config; };
+  } ../build-support/setup-hooks/update-autotools-gnu-config-scripts.sh;
 
   gogUnpackHook = makeSetupHook {
     name = "gog-unpack-hook";
@@ -621,7 +624,9 @@ with pkgs;
 
   diffPlugins = (callPackage ../build-support/plugins.nix {}).diffPlugins;
 
-  dieHook = makeSetupHook {} ../build-support/setup-hooks/die.sh;
+  dieHook = makeSetupHook {
+    name = "die-hook";
+  } ../build-support/setup-hooks/die.sh;
 
   archiver = callPackage ../applications/misc/archiver { };
 
@@ -970,11 +975,15 @@ with pkgs;
 
   madonctl = callPackage ../applications/misc/madonctl { };
 
-  copyDesktopItems = makeSetupHook { } ../build-support/setup-hooks/copy-desktop-items.sh;
+  copyDesktopItems = makeSetupHook {
+    name = "copy-desktop-items-hook";
+  } ../build-support/setup-hooks/copy-desktop-items.sh;
 
   makeDesktopItem = callPackage ../build-support/make-desktopitem { };
 
-  copyPkgconfigItems = makeSetupHook { } ../build-support/setup-hooks/copy-pkgconfig-items.sh;
+  copyPkgconfigItems = makeSetupHook {
+    name = "copy-pkg-config-items-hook";
+  } ../build-support/setup-hooks/copy-pkgconfig-items.sh;
 
   makePkgconfigItem = callPackage ../build-support/make-pkgconfigitem { };
 
@@ -991,17 +1000,17 @@ with pkgs;
 
   makeWrapper = makeShellWrapper;
 
-  makeShellWrapper = makeSetupHook
-    { deps = [ dieHook ];
-      substitutions = {
-        # targetPackages.runtimeShell only exists when pkgs == targetPackages (when targetPackages is not  __raw)
-        shell = if targetPackages ? runtimeShell then targetPackages.runtimeShell else throw "makeWrapper/makeShellWrapper must be in nativeBuildInputs";
-      };
-      passthru = {
-        tests = tests.makeWrapper;
-      };
-    }
-    ../build-support/setup-hooks/make-wrapper.sh;
+  makeShellWrapper = makeSetupHook {
+    name = "make-shell-wrapper-hook";
+    deps = [ dieHook ];
+    substitutions = {
+      # targetPackages.runtimeShell only exists when pkgs == targetPackages (when targetPackages is not  __raw)
+      shell = if targetPackages ? runtimeShell then targetPackages.runtimeShell else throw "makeWrapper/makeShellWrapper must be in nativeBuildInputs";
+    };
+    passthru = {
+      tests = tests.makeWrapper;
+    };
+  } ../build-support/setup-hooks/make-wrapper.sh;
 
   makeBinaryWrapper = callPackage ../build-support/setup-hooks/make-binary-wrapper { };
 
@@ -1042,9 +1051,10 @@ with pkgs;
 
   setupSystemdUnits = callPackage ../build-support/setup-systemd-units.nix { };
 
-  shortenPerlShebang = makeSetupHook
-    { deps = [ dieHook ]; }
-    ../build-support/setup-hooks/shorten-perl-shebang.sh;
+  shortenPerlShebang = makeSetupHook {
+    name = "shorten-perl-shebang-hook";
+    deps = [ dieHook ];
+  } ../build-support/setup-hooks/shorten-perl-shebang.sh;
 
   singularity-tools = callPackage ../build-support/singularity-tools { };
 
@@ -1081,7 +1091,9 @@ with pkgs;
 
   inherit (lib.systems) platforms;
 
-  setJavaClassPath = makeSetupHook { } ../build-support/setup-hooks/set-java-classpath.sh;
+  setJavaClassPath = makeSetupHook {
+    name = "set-java-classpath-hook";
+  } ../build-support/setup-hooks/set-java-classpath.sh;
 
   fixDarwinDylibNames = makeSetupHook {
     name = "fix-darwin-dylib-names-hook";
@@ -1092,23 +1104,31 @@ with pkgs;
   writeDarwinBundle = callPackage ../build-support/make-darwin-bundle/write-darwin-bundle.nix { };
 
   desktopToDarwinBundle = makeSetupHook {
+    name = "desktop-to-darwin-bundle-hook";
     deps = [ writeDarwinBundle librsvg imagemagick python3Packages.icnsutil ];
   } ../build-support/setup-hooks/desktop-to-darwin-bundle.sh;
 
-  keepBuildTree = makeSetupHook { } ../build-support/setup-hooks/keep-build-tree.sh;
+  keepBuildTree = makeSetupHook {
+    name = "keep-build-tree-hook";
+  } ../build-support/setup-hooks/keep-build-tree.sh;
 
-  enableGCOVInstrumentation = makeSetupHook { } ../build-support/setup-hooks/enable-coverage-instrumentation.sh;
+  enableGCOVInstrumentation = makeSetupHook {
+    name = "enable-gcov-instrumentation-hook";
+  } ../build-support/setup-hooks/enable-coverage-instrumentation.sh;
 
-  makeGCOVReport = makeSetupHook
-    { deps = [ lcov enableGCOVInstrumentation ]; }
-    ../build-support/setup-hooks/make-coverage-analysis-report.sh;
+  makeGCOVReport = makeSetupHook {
+    name = "make-gcov-report-hook";
+    deps = [ lcov enableGCOVInstrumentation ];
+  } ../build-support/setup-hooks/make-coverage-analysis-report.sh;
 
   makeHardcodeGsettingsPatch = callPackage ../build-support/make-hardcode-gsettings-patch { };
 
   # intended to be used like nix-build -E 'with import <nixpkgs> {}; enableDebugging fooPackage'
   enableDebugging = pkg: pkg.override { stdenv = stdenvAdapters.keepDebugInfo pkg.stdenv; };
 
-  findXMLCatalogs = makeSetupHook { } ../build-support/setup-hooks/find-xml-catalogs.sh;
+  findXMLCatalogs = makeSetupHook {
+    name = "find-xml-catalogs-hook";
+  } ../build-support/setup-hooks/find-xml-catalogs.sh;
 
   wrapGAppsHook = callPackage ../build-support/setup-hooks/wrap-gapps-hook {
     makeWrapper = makeBinaryWrapper;
@@ -1118,11 +1138,17 @@ with pkgs;
 
   wrapGAppsNoGuiHook = wrapGAppsHook.override { isGraphical = false; };
 
-  separateDebugInfo = makeSetupHook { } ../build-support/setup-hooks/separate-debug-info.sh;
+  separateDebugInfo = makeSetupHook {
+    name = "separate-debug-info-hook";
+  } ../build-support/setup-hooks/separate-debug-info.sh;
 
-  setupDebugInfoDirs = makeSetupHook { } ../build-support/setup-hooks/setup-debug-info-dirs.sh;
+  setupDebugInfoDirs = makeSetupHook {
+    name = "setup-debug-info-dirs-hook";
+  } ../build-support/setup-hooks/setup-debug-info-dirs.sh;
 
-  useOldCXXAbi = makeSetupHook { } ../build-support/setup-hooks/use-old-cxx-abi.sh;
+  useOldCXXAbi = makeSetupHook {
+    name = "use-old-cxx-abi-hook";
+  } ../build-support/setup-hooks/use-old-cxx-abi.sh;
 
   iconConvTools = callPackage ../build-support/icon-conv-tools {};
 
@@ -1381,6 +1407,8 @@ with pkgs;
 
   dwarfs = callPackage ../tools/filesystems/dwarfs { };
 
+  copier = callPackage ../tools/misc/copier { };
+
   gamemode = callPackage ../tools/games/gamemode {
     libgamemode32 = pkgsi686Linux.gamemode.lib;
   };
@@ -3766,7 +3794,9 @@ with pkgs;
   brutespray = callPackage ../tools/security/brutespray { };
 
   breakpointHook = assert stdenv.buildPlatform.isLinux;
-    makeSetupHook { } ../build-support/setup-hooks/breakpoint-hook.sh;
+    makeSetupHook {
+      name = "breakpoint-hook";
+    } ../build-support/setup-hooks/breakpoint-hook.sh;
 
   btrfs-progs = callPackage ../tools/filesystems/btrfs-progs { };
 
@@ -5314,6 +5344,8 @@ with pkgs;
 
   pika = callPackage ../applications/graphics/pika { };
 
+  pkg = callPackage ../tools/package-management/pkg { };
+
   playerctl = callPackage ../tools/audio/playerctl { };
 
   pn = callPackage ../tools/text/pn { };
@@ -12700,6 +12732,8 @@ with pkgs;
 
   twitterBootstrap = callPackage ../development/web/twitter-bootstrap {};
 
+  twspace-crawler = callPackage ../tools/misc/twspace-crawler { };
+
   twspace-dl = callPackage ../tools/misc/twspace-dl { };
 
   twtxt = python3Packages.callPackage ../applications/networking/twtxt { };
@@ -12977,6 +13011,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) OpenCL;
   };
 
+  wakapi = callPackage ../tools/misc/wakapi { };
+
   wakatime = python2Packages.callPackage ../tools/misc/wakatime { };
 
   weather = callPackage ../applications/misc/weather { };
@@ -15912,8 +15948,6 @@ with pkgs;
 
   spirv-llvm-translator = callPackage ../development/compilers/spirv-llvm-translator { };
 
-  spirv-llvm-translator_14 = callPackage ../development/compilers/spirv-llvm-translator { llvm = llvm_14; };
-
   sqldeveloper = callPackage ../development/tools/database/sqldeveloper {
     jdk = oraclejdk;
   };
@@ -15940,7 +15974,10 @@ with pkgs;
 
   svdtools = callPackage ../development/embedded/svdtools { };
 
-  swift = callPackage ../development/compilers/swift { };
+  swiftPackages = recurseIntoAttrs (callPackage ../development/compilers/swift { });
+  inherit (swiftPackages) swift swiftpm sourcekit-lsp;
+
+  swiftpm2nix = callPackage ../development/tools/swiftpm2nix { };
 
   swiProlog = callPackage ../development/compilers/swi-prolog {
     openssl = openssl_1_1;
@@ -18730,11 +18767,13 @@ with pkgs;
   xcodebuild6 = xcodebuild.override { stdenv = llvmPackages_6.stdenv; };
   xcbuild = xcodebuild;
   xcbuildHook = makeSetupHook {
+    name = "xcbuild-hook";
     deps = [ xcbuild ];
   } ../development/tools/xcbuild/setup-hook.sh  ;
 
   # xcbuild with llvm 6
   xcbuild6Hook = makeSetupHook {
+    name = "xcbuild6-hook";
     deps = [ xcodebuild6 ];
   } ../development/tools/xcbuild/setup-hook.sh  ;
 
@@ -21463,6 +21502,8 @@ with pkgs;
 
   libopusenc = callPackage ../development/libraries/libopusenc { };
 
+  liboqs = callPackage ../development/libraries/liboqs { };
+
   libosinfo = callPackage ../development/libraries/libosinfo { };
 
   libosip = callPackage ../development/libraries/osip {};
@@ -22001,6 +22042,7 @@ with pkgs;
 
   memorymapping = callPackage ../development/libraries/memorymapping { };
   memorymappingHook = makeSetupHook {
+    name = "memorymapping-hook";
     deps = [ memorymapping ];
   } ../development/libraries/memorymapping/setup-hook.sh;
 
@@ -22008,6 +22050,7 @@ with pkgs;
 
   memstream = callPackage ../development/libraries/memstream { };
   memstreamHook = makeSetupHook {
+    name = "memstream-hook";
     deps = [ memstream ];
   } ../development/libraries/memstream/setup-hook.sh;
 
@@ -22031,7 +22074,7 @@ with pkgs;
   libGLU = mesa_glu;
 
   mesa = callPackage ../development/libraries/mesa {
-    llvmPackages = llvmPackages_latest;
+    llvmPackages = llvmPackages_15;
     stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
     inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
     inherit (darwin.apple_sdk_11_0.libs) Xplugin;
@@ -22686,9 +22729,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) ApplicationServices OpenGL Cocoa AGL;
   };
 
-  qmake48Hook = makeSetupHook
-    { substitutions = { qt4 = qt48; }; }
-    ../development/libraries/qt-4.x/4.8/qmake-hook.sh;
+  qmake48Hook = makeSetupHook {
+    name = "qmake4.8-hook";
+    substitutions = { qt4 = qt48; };
+  } ../development/libraries/qt-4.x/4.8/qmake-hook.sh;
 
   qmake4Hook = qmake48Hook;
 
@@ -24223,6 +24267,8 @@ with pkgs;
 
   diod = callPackage ../servers/diod { lua = lua5_1; };
 
+  directx-headers = callPackage ../development/libraries/directx-headers {};
+
   directx-shader-compiler = callPackage ../tools/graphics/directx-shader-compiler {};
 
   dkimproxy = callPackage ../servers/mail/dkimproxy { };
@@ -25595,6 +25641,8 @@ with pkgs;
 
   erofs-utils = callPackage ../os-specific/linux/erofs-utils { };
 
+  evdev-proto = callPackage ../os-specific/bsd/freebsd/evdev-proto { };
+
   fscryptctl = callPackage ../os-specific/linux/fscryptctl { };
   # unstable until the first 1.x release
   fscrypt-experimental = callPackage ../os-specific/linux/fscrypt { };
@@ -26311,6 +26359,8 @@ with pkgs;
 
   perf-tools = callPackage ../os-specific/linux/perf-tools { };
 
+  picoprobe-udev-rules = callPackage ../os-specific/linux/picoprobe-udev-rules { };
+
   pipes = callPackage ../misc/screensavers/pipes { };
 
   pipes-rs = callPackage ../misc/screensavers/pipes-rs { };
@@ -29016,6 +29066,8 @@ with pkgs;
 
   go-motion = callPackage ../development/tools/go-motion { };
 
+  go-musicfox = callPackage ../applications/audio/go-musicfox { };
+
   gpg-mdp = callPackage ../applications/misc/gpg-mdp { };
 
   greenfoot = callPackage ../applications/editors/greenfoot {
@@ -29387,6 +29439,8 @@ with pkgs;
 
   w_scan = callPackage ../applications/video/w_scan { };
 
+  w_scan2 = callPackage ../applications/video/w_scan2 { };
+
   wavrsocvt = callPackage ../applications/misc/audio/wavrsocvt { };
 
   welle-io = libsForQt5.callPackage ../applications/radio/welle-io { };
@@ -37280,6 +37334,8 @@ with pkgs;
   dump = callPackage ../tools/backup/dump { };
 
   dxvk = callPackage ../misc/dxvk { };
+  dxvk_1 = callPackage ../misc/dxvk/dxvk.nix { dxvkVersion = "1.10"; };
+  dxvk_2 = callPackage ../misc/dxvk/dxvk.nix { dxvkVersion = "2.1"; };
 
   ecdsatool = callPackage ../tools/security/ecdsatool { };
 
@@ -38849,6 +38905,8 @@ with pkgs;
 
   xmcp = callPackage ../tools/X11/xmcp { };
 
+  yesplaymusic = callPackage ../applications/audio/yesplaymusic { };
+
   ymuse = callPackage ../applications/audio/ymuse { };
 
   zk = callPackage ../applications/office/zk {};
@@ -38869,7 +38927,7 @@ with pkgs;
 
   mictray = callPackage ../tools/audio/mictray { };
 
-  swift-corelibs-libdispatch = callPackage ../development/libraries/swift-corelibs-libdispatch { };
+  swift-corelibs-libdispatch = swiftPackages.Dispatch;
 
   swaysettings = callPackage ../applications/misc/swaysettings { };
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index cb32a46ca25d6..cf00c3da93cfd 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -120,6 +120,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
   rewrite-tbd = callPackage ../os-specific/darwin/rewrite-tbd { };
 
   checkReexportsHook = pkgs.makeSetupHook {
+    name = "darwin-check-reexports-hook";
     deps = [ pkgs.darwin.print-reexports ];
   } ../os-specific/darwin/print-reexports/setup-hook.sh;
 
@@ -140,6 +141,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
   signingUtils = callPackage ../os-specific/darwin/signing-utils { };
 
   autoSignDarwinBinariesHook = pkgs.makeSetupHook {
+    name = "auto-sign-darwin-binaries-hook";
     deps = [ self.signingUtils ];
   } ../os-specific/darwin/signing-utils/auto-sign-hook.sh;
 
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 6858e37fabeb8..dbe96bd096f89 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -47,10 +47,10 @@ pkgs.releaseTools.sourceTarball {
     opts=(--option build-users-group "")
     nix-store --init
 
-    header "checking eval-release.nix"
+    echo "checking eval-release.nix"
     nix-instantiate --eval --strict --show-trace ./maintainers/scripts/eval-release.nix > /dev/null
 
-    header "checking find-tarballs.nix"
+    echo "checking find-tarballs.nix"
     nix-instantiate --readonly-mode --eval --strict --show-trace --json \
        ./maintainers/scripts/find-tarballs.nix \
       --arg expr 'import ./maintainers/scripts/all-tarballs.nix' > $TMPDIR/tarballs.json
@@ -61,7 +61,7 @@ pkgs.releaseTools.sourceTarball {
       exit 1
     fi
 
-    header "generating packages.json"
+    echo "generating packages.json"
     mkdir -p $out/nix-support
     echo -n '{"version":2,"packages":' > tmp
     nix-env -f . -I nixpkgs=$src -qa --meta --json --arg config 'import ${./packages-config.nix}' "''${opts[@]}" >> tmp
diff --git a/pkgs/top-level/nixpkgs-basic-release-checks.nix b/pkgs/top-level/nixpkgs-basic-release-checks.nix
index e2b81b20c5b08..ab9dac4b380ca 100644
--- a/pkgs/top-level/nixpkgs-basic-release-checks.nix
+++ b/pkgs/top-level/nixpkgs-basic-release-checks.nix
@@ -32,7 +32,7 @@ pkgs.runCommand "nixpkgs-release-checks" { src = nixpkgs; buildInputs = [nix]; }
 
     # Check that all-packages.nix evaluates on a number of platforms without any warnings.
     for platform in ${pkgs.lib.concatStringsSep " " supportedSystems}; do
-        header "checking Nixpkgs on $platform"
+        echo "checking Nixpkgs on $platform"
 
         # To get a call trace; see https://nixos.org/manual/nixpkgs/stable/#function-library-lib.trivial.warn
         # Relies on impure eval
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2fa5610aed5ca..cea21c667260f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4765,6 +4765,8 @@ self: super: with self; {
 
   itemloaders = callPackage ../development/python-modules/itemloaders { };
 
+  iteration-utilities = callPackage ../development/python-modules/iteration-utilities { };
+
   iterm2 = callPackage ../development/python-modules/iterm2 { };
 
   itsdangerous = callPackage ../development/python-modules/itsdangerous { };
@@ -4857,6 +4859,8 @@ self: super: with self; {
 
   jinja2 = callPackage ../development/python-modules/jinja2 { };
 
+  jinja2-ansible-filters = callPackage ../development/python-modules/jinja2-ansible-filters { };
+
   jinja2-git = callPackage ../development/python-modules/jinja2-git { };
 
   jinja2_pluralize = callPackage ../development/python-modules/jinja2_pluralize { };
@@ -5922,6 +5926,8 @@ self: super: with self; {
 
   mkdocstrings-python = callPackage ../development/python-modules/mkdocstrings-python { };
 
+  mkdocs-mermaid2-plugin = callPackage ../development/python-modules/mkdocs-mermaid2-plugin { };
+
   mkl-service = callPackage ../development/python-modules/mkl-service { };
 
   ml-collections = callPackage ../development/python-modules/ml-collections { };
@@ -6649,6 +6655,8 @@ self: super: with self; {
 
   openrouteservice = callPackage ../development/python-modules/openrouteservice { };
 
+  opensearch-py = callPackage ../development/python-modules/opensearch-py { };
+
   opensensemap-api = callPackage ../development/python-modules/opensensemap-api { };
 
   opensfm = callPackage ../development/python-modules/opensfm { };
@@ -9655,6 +9663,8 @@ self: super: with self; {
 
   pyyaml-env-tag = callPackage ../development/python-modules/pyyaml-env-tag { };
 
+  pyyaml-include = callPackage ../development/python-modules/pyyaml-include { };
+
   pyzerproc = callPackage ../development/python-modules/pyzerproc { };
 
   pyzmq = callPackage ../development/python-modules/pyzmq { };
@@ -10755,6 +10765,8 @@ self: super: with self; {
 
   sphinx-book-theme = callPackage ../development/python-modules/sphinx-book-theme { };
 
+  sphinx-codeautolink = callPackage ../development/python-modules/sphinx-codeautolink { };
+
   sphinx-comments = callPackage ../development/python-modules/sphinx-comments { };
 
   sphinx-design = callPackage ../development/python-modules/sphinx-design { };
@@ -10763,14 +10775,22 @@ self: super: with self; {
 
   sphinx-fortran = callPackage ../development/python-modules/sphinx-fortran { };
 
+  sphinx-hoverxref = callPackage ../development/python-modules/sphinx-hoverxref { };
+
   sphinx-jupyterbook-latex = callPackage ../development/python-modules/sphinx-jupyterbook-latex { };
 
   sphinx-multitoc-numbering = callPackage ../development/python-modules/sphinx-multitoc-numbering { };
 
+  sphinx-notfound-page = callPackage ../development/python-modules/sphinx-notfound-page { };
+
   sphinx-pytest = callPackage ../development/python-modules/sphinx-pytest { };
 
+  sphinx-prompt = callPackage ../development/python-modules/sphinx-prompt { };
+
   sphinx-thebe = callPackage ../development/python-modules/sphinx-thebe { };
 
+  sphinx-tabs = callPackage ../development/python-modules/sphinx-tabs { };
+
   sphinx-togglebutton = callPackage ../development/python-modules/sphinx-togglebutton { };
 
   sphinxcontrib-actdiag = callPackage ../development/python-modules/sphinxcontrib-actdiag { };
@@ -10839,6 +10859,8 @@ self: super: with self; {
 
   sphinx-argparse = callPackage ../development/python-modules/sphinx-argparse { };
 
+  sphinx-jquery = callPackage ../development/python-modules/sphinx-jquery { };
+
   sphinx-autobuild = callPackage ../development/python-modules/sphinx-autobuild { };
 
   sphinx-autodoc-typehints = callPackage ../development/python-modules/sphinx-autodoc-typehints { };
@@ -10871,6 +10893,8 @@ self: super: with self; {
 
   sphinx-testing = callPackage ../development/python-modules/sphinx-testing { };
 
+  sphinx-version-warning = callPackage ../development/python-modules/sphinx-version-warning { };
+
   sphinxext-opengraph = callPackage ../development/python-modules/sphinxext-opengraph { };
 
   spidev = callPackage ../development/python-modules/spidev { };