about summary refs log tree commit diff
path: root/pkgs/development/libraries
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/development/libraries')
-rw-r--r--pkgs/development/libraries/CGAL/default.nix4
-rw-r--r--pkgs/development/libraries/accountsservice/default.nix2
-rw-r--r--pkgs/development/libraries/ada/gnatcoll/db.nix2
-rw-r--r--pkgs/development/libraries/apr-util/default.nix24
-rw-r--r--pkgs/development/libraries/apr-util/fix-libxcrypt-build.patch14
-rw-r--r--pkgs/development/libraries/apr/default.nix2
-rw-r--r--pkgs/development/libraries/asio/default.nix4
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix4
-rw-r--r--pkgs/development/libraries/avahi/default.nix6
-rw-r--r--pkgs/development/libraries/boost/generic.nix4
-rw-r--r--pkgs/development/libraries/c-ares/default.nix56
-rw-r--r--pkgs/development/libraries/catch2/default.nix4
-rw-r--r--pkgs/development/libraries/cosmopolitan/default.nix2
-rw-r--r--pkgs/development/libraries/cxxopts/default.nix4
-rw-r--r--pkgs/development/libraries/cyrus-sasl/default.nix6
-rw-r--r--pkgs/development/libraries/dbus/default.nix18
-rw-r--r--pkgs/development/libraries/drogon/default.nix2
-rw-r--r--pkgs/development/libraries/fcft/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix11
-rw-r--r--pkgs/development/libraries/ffmpeg/5.nix7
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix120
-rw-r--r--pkgs/development/libraries/galario/default.nix4
-rw-r--r--pkgs/development/libraries/geographiclib/default.nix34
-rw-r--r--pkgs/development/libraries/glibc/common.nix5
-rw-r--r--pkgs/development/libraries/glibc/default.nix3
-rw-r--r--pkgs/development/libraries/gnutls/default.nix2
-rw-r--r--pkgs/development/libraries/gpgme/default.nix2
-rw-r--r--pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch369
-rw-r--r--pkgs/development/libraries/grpc/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix2
-rw-r--r--pkgs/development/libraries/gvm-libs/default.nix2
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix21
-rw-r--r--pkgs/development/libraries/hunspell/default.nix2
-rw-r--r--pkgs/development/libraries/jellyfin-ffmpeg/default.nix4
-rw-r--r--pkgs/development/libraries/json-glib/default.nix2
-rw-r--r--pkgs/development/libraries/kerberos/krb5.nix2
-rw-r--r--pkgs/development/libraries/libaom/default.nix4
-rw-r--r--pkgs/development/libraries/libav/default.nix4
-rw-r--r--pkgs/development/libraries/libcerf/default.nix10
-rw-r--r--pkgs/development/libraries/libcli/default.nix4
-rw-r--r--pkgs/development/libraries/libdaemon/default.nix2
-rw-r--r--pkgs/development/libraries/libdeflate/default.nix2
-rw-r--r--pkgs/development/libraries/libdeltachat/default.nix6
-rw-r--r--pkgs/development/libraries/libeatmydata/default.nix2
-rw-r--r--pkgs/development/libraries/libff/default.nix2
-rw-r--r--pkgs/development/libraries/libfido2/default.nix4
-rw-r--r--pkgs/development/libraries/libfilezilla/default.nix7
-rw-r--r--pkgs/development/libraries/libfive/default.nix29
-rw-r--r--pkgs/development/libraries/libguestfs/default.nix2
-rw-r--r--pkgs/development/libraries/libical/default.nix17
-rw-r--r--pkgs/development/libraries/libirc/default.nix35
-rw-r--r--pkgs/development/libraries/libksba/default.nix4
-rw-r--r--pkgs/development/libraries/liblc3/default.nix36
-rw-r--r--pkgs/development/libraries/libmcrypt/default.nix2
-rw-r--r--pkgs/development/libraries/libpam-wrapper/default.nix2
-rw-r--r--pkgs/development/libraries/libpst/default.nix16
-rw-r--r--pkgs/development/libraries/libtorrent-rasterbar/default.nix4
-rw-r--r--pkgs/development/libraries/libvdpau/default.nix2
-rw-r--r--pkgs/development/libraries/libvncserver/default.nix2
-rw-r--r--pkgs/development/libraries/libxc/default.nix4
-rw-r--r--pkgs/development/libraries/libxcrypt/default.nix44
-rw-r--r--pkgs/development/libraries/libxml2/default.nix34
-rw-r--r--pkgs/development/libraries/libxslt/default.nix16
-rw-r--r--pkgs/development/libraries/matrix-sdk-crypto-nodejs/default.nix5
-rw-r--r--pkgs/development/libraries/mesa/aarch64-darwin.patch33
-rw-r--r--pkgs/development/libraries/mesa/default.nix31
-rw-r--r--pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch42
-rw-r--r--pkgs/development/libraries/mesa/drop-dri2.patch40
-rw-r--r--pkgs/development/libraries/mesa/opencl.patch9
-rw-r--r--pkgs/development/libraries/mimalloc/default.nix2
-rw-r--r--pkgs/development/libraries/mlt/default.nix2
-rw-r--r--pkgs/development/libraries/nghttp2/default.nix4
-rw-r--r--pkgs/development/libraries/nng/default.nix2
-rw-r--r--pkgs/development/libraries/oneDNN/default.nix4
-rw-r--r--pkgs/development/libraries/openbsm/default.nix2
-rw-r--r--pkgs/development/libraries/opencl-headers/default.nix4
-rw-r--r--pkgs/development/libraries/opencv/3.x.nix2
-rw-r--r--pkgs/development/libraries/openldap/default.nix2
-rw-r--r--pkgs/development/libraries/openmpi/default.nix2
-rw-r--r--pkgs/development/libraries/openvino/default.nix4
-rw-r--r--pkgs/development/libraries/p11-kit/default.nix1
-rw-r--r--pkgs/development/libraries/paho-mqtt-c/default.nix33
-rw-r--r--pkgs/development/libraries/paho-mqtt-cpp/default.nix25
-rw-r--r--pkgs/development/libraries/pangomm/2.48.nix2
-rw-r--r--pkgs/development/libraries/physics/cernlib/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/default.nix15
-rw-r--r--pkgs/development/libraries/poppler/default.nix2
-rw-r--r--pkgs/development/libraries/popt/default.nix4
-rw-r--r--pkgs/development/libraries/precice/default.nix2
-rw-r--r--pkgs/development/libraries/protobuf/3.7.nix6
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix6
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtlocation.nix2
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebengine.nix2
-rw-r--r--pkgs/development/libraries/redis-plus-plus/default.nix4
-rw-r--r--pkgs/development/libraries/rustc-demangle/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/cudnn/extension.nix58
-rw-r--r--pkgs/development/libraries/science/math/faiss/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix6
-rw-r--r--pkgs/development/libraries/science/math/tensorrt/extension.nix4
-rw-r--r--pkgs/development/libraries/science/networking/ns-3/default.nix4
-rw-r--r--pkgs/development/libraries/sentry-native/default.nix4
-rw-r--r--pkgs/development/libraries/shapelib/default.nix19
-rw-r--r--pkgs/development/libraries/sord/default.nix37
-rw-r--r--pkgs/development/libraries/speechd/default.nix16
-rw-r--r--pkgs/development/libraries/speex/default.nix14
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/talloc/default.nix2
-rw-r--r--pkgs/development/libraries/tdb/default.nix2
-rw-r--r--pkgs/development/libraries/tdlib/default.nix11
-rw-r--r--pkgs/development/libraries/vk-bootstrap/default.nix43
-rw-r--r--pkgs/development/libraries/vtk/generic.nix2
-rw-r--r--pkgs/development/libraries/wavpack/default.nix9
-rw-r--r--pkgs/development/libraries/x264/default.nix12
-rw-r--r--pkgs/development/libraries/zeroc-ice/default.nix4
115 files changed, 1096 insertions, 513 deletions
diff --git a/pkgs/development/libraries/CGAL/default.nix b/pkgs/development/libraries/CGAL/default.nix
index 76fe582248399..3b6e5f2498d54 100644
--- a/pkgs/development/libraries/CGAL/default.nix
+++ b/pkgs/development/libraries/CGAL/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cgal";
-  version = "5.5";
+  version = "5.5.1";
 
   src = fetchFromGitHub {
     owner = "CGAL";
     repo = "releases";
     rev = "CGAL-${version}";
-    sha256 = "sha256-C576lYTQd6mgJPBqFRN3Ty6WYeXcXlDZ5sRtDwOuKSo=";
+    sha256 = "sha256-ISmuxvCLb2ueG3FeBzJ7R+LievfXefG3ZQbyAboIv+A=";
   };
 
   # note: optional component libCGAL_ImageIO would need zlib and opengl;
diff --git a/pkgs/development/libraries/accountsservice/default.nix b/pkgs/development/libraries/accountsservice/default.nix
index 4bd7a67871f9d..694aab16d1abd 100644
--- a/pkgs/development/libraries/accountsservice/default.nix
+++ b/pkgs/development/libraries/accountsservice/default.nix
@@ -16,6 +16,7 @@
 , python3
 , vala
 , gettext
+, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -66,6 +67,7 @@ stdenv.mkDerivation rec {
     glib
     polkit
     systemd
+    libxcrypt
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/ada/gnatcoll/db.nix b/pkgs/development/libraries/ada/gnatcoll/db.nix
index 0c597f199c34d..6c87d63063fac 100644
--- a/pkgs/development/libraries/ada/gnatcoll/db.nix
+++ b/pkgs/development/libraries/ada/gnatcoll/db.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
     # confusingly, for gprbuild --target is autoconf --host
     "TARGET=${stdenv.hostPlatform.config}"
     "prefix=${placeholder "out"}"
-  ] ++ lib.optional (component == "sqlite") [
+  ] ++ lib.optionals (component == "sqlite") [
     # link against packaged, not vendored libsqlite3
     "GNATCOLL_SQLITE=external"
   ];
diff --git a/pkgs/development/libraries/apr-util/default.nix b/pkgs/development/libraries/apr-util/default.nix
index 6f38bfa0d076d..909965bb06886 100644
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@@ -2,7 +2,7 @@
 , sslSupport ? true, openssl
 , bdbSupport ? true, db
 , ldapSupport ? !stdenv.isCygwin, openldap
-, libiconv
+, libiconv, libxcrypt
 , cyrus_sasl, autoreconfHook
 }:
 
@@ -21,7 +21,10 @@ stdenv.mkDerivation rec {
     sha256 = "0nq3s1yn13vplgl6qfm09f7n0wm08malff9s59bqf9nid9xjzqfk";
   };
 
-  patches = optional stdenv.isFreeBSD ./include-static-dependencies.patch;
+  patches = [ ./fix-libxcrypt-build.patch ]
+    ++ optional stdenv.isFreeBSD ./include-static-dependencies.patch;
+
+  NIX_CFLAGS_LINK = [ "-lcrypt" ];
 
   outputs = [ "out" "dev" ];
   outputBin = "dev";
@@ -38,15 +41,18 @@ stdenv.mkDerivation rec {
         "--without-freetds" "--without-berkeley-db" "--without-crypto" ]
     ;
 
-  # For some reason, db version 6.9 is selected when cross-compiling.
-  # It's unclear as to why, it requires someone with more autotools / configure knowledge to go deeper into that.
-  # Always replacing the link flag with a generic link flag seems to help though, so let's do that for now.
-  postConfigure = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    substituteInPlace Makefile \
-      --replace "-ldb-6.9" "-ldb"
+  postConfigure = ''
+    echo '#define APR_HAVE_CRYPT_H 1' >> confdefs.h
+  '' +
+    # For some reason, db version 6.9 is selected when cross-compiling.
+    # It's unclear as to why, it requires someone with more autotools / configure knowledge to go deeper into that.
+    # Always replacing the link flag with a generic link flag seems to help though, so let's do that for now.
+    lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+      substituteInPlace Makefile \
+        --replace "-ldb-6.9" "-ldb"
   '';
 
-  propagatedBuildInputs = [ apr expat libiconv ]
+  propagatedBuildInputs = [ apr expat libiconv libxcrypt ]
     ++ optional sslSupport openssl
     ++ optional bdbSupport db
     ++ optional ldapSupport openldap
diff --git a/pkgs/development/libraries/apr-util/fix-libxcrypt-build.patch b/pkgs/development/libraries/apr-util/fix-libxcrypt-build.patch
new file mode 100644
index 0000000000000..2994e5de0f78b
--- /dev/null
+++ b/pkgs/development/libraries/apr-util/fix-libxcrypt-build.patch
@@ -0,0 +1,14 @@
+diff --git a/crypto/apr_passwd.c b/crypto/apr_passwd.c
+index c961de2..a397f27 100644
+--- a/crypto/apr_passwd.c
++++ b/crypto/apr_passwd.c
+@@ -24,9 +24,7 @@
+ #if APR_HAVE_STRING_H
+ #include <string.h>
+ #endif
+-#if APR_HAVE_CRYPT_H
+ #include <crypt.h>
+-#endif
+ #if APR_HAVE_UNISTD_H
+ #include <unistd.h>
+ #endif
diff --git a/pkgs/development/libraries/apr/default.nix b/pkgs/development/libraries/apr/default.nix
index 536c8a5613a9e..0d980db9b5a8b 100644
--- a/pkgs/development/libraries/apr/default.nix
+++ b/pkgs/development/libraries/apr/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
       configureFlagsArray+=("--with-installbuilddir=$dev/share/build")
     '';
 
-  configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # For cross builds, provide answers to the configure time tests.
     # These answers are valid on x86_64-linux and aarch64-linux.
     "ac_cv_file__dev_zero=yes"
diff --git a/pkgs/development/libraries/asio/default.nix b/pkgs/development/libraries/asio/default.nix
index 9c89b27d371f5..4df73c752e5d4 100644
--- a/pkgs/development/libraries/asio/default.nix
+++ b/pkgs/development/libraries/asio/default.nix
@@ -1,6 +1,6 @@
 {callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  version = "1.16.1";
-  sha256 = "1333ca6lnsdck4fsgjpbqf4lagxsnbg9970wxlsrinmwvdvdnwg2";
+  version = "1.24.0";
+  sha256 = "sha256-iXaBLCShGGAPb88HGiBgZjCmmv5MCr7jsN6lKOaCxYU=";
 })
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 270e4632aef15..8e5793b0bcd12 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.5";
+  version = "0.6.6";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "8iq+l3za5AX2hbdRUOf7FVsseJa0cA/VSr5ohA9m6cA=";
+    sha256 = "bdueJqQwYglEiReW/vsbuzi9kUj2z8VYgQwNPyaYdsc=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index e24217434557f..fe9ce9a42dcbf 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -31,10 +31,16 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # CVE-2021-36217 / CVE-2021-3502
     (fetchpatch {
       url = "https://github.com/lathiat/avahi/commit/9d31939e55280a733d930b15ac9e4dda4497680c.patch";
       sha256 = "sha256-BXWmrLWUvDxKPoIPRFBpMS3T4gijRw0J+rndp6iDybU=";
     })
+    # CVE-2021-3468
+    (fetchpatch {
+      url = "https://github.com/lathiat/avahi/commit/447affe29991ee99c6b9732fc5f2c1048a611d3b.patch";
+      sha256 = "sha256-qWaCU1ZkCg2PmijNto7t8E3pYRN/36/9FrG8okd6Gu8=";
+    })
   ];
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index d4e74b5788a70..b6ab49e4b4d9e 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv
+{ lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv, libxcrypt
 , boost-build
 , fetchpatch
 , which
@@ -218,7 +218,7 @@ stdenv.mkDerivation {
     ++ optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [ expat zlib bzip2 libiconv ]
     ++ optional (stdenv.hostPlatform == stdenv.buildPlatform) icu
-    ++ optional enablePython python
+    ++ optionals enablePython [ libxcrypt python ]
     ++ optional enableNumpy python.pkgs.numpy;
 
   configureScript = "./bootstrap.sh";
diff --git a/pkgs/development/libraries/c-ares/default.nix b/pkgs/development/libraries/c-ares/default.nix
index a5a41813bc3e7..42023990c9e1e 100644
--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@@ -1,54 +1,48 @@
-{ lib, stdenv, fetchurl, writeTextDir }:
+{ lib, stdenv, fetchurl, writeTextDir
+, fetchpatch
+, withCMake ? true, cmake
+
+# sensitive downstream packages
+, curl
+, grpc # consumes cmake config
+}:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let self =
 stdenv.mkDerivation rec {
   pname = "c-ares";
   version = "1.18.1";
+  outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
     sha256 = "sha256-Gn1SqKhKn7/7G+kTPA9uFyF9kepab6Yfa0cpzaeOu88=";
   };
 
+  # c-ares is used for fetchpatch, so avoid using it for c-aresMinimal
+  patches = lib.optionals withCMake [
+    # fix .pc paths created by cmake build
+    (fetchpatch {
+      url = "https://github.com/jonringer/c-ares/commit/9806a8a2f999a8a3efa3c893f2854dce6919d5bb.patch";
+      sha256 = "sha256-nh/ZKdan2/FTrouApRQA7O8KGZrLEUuWhxGOktiiGwU=";
+    })
+  ];
+
+  nativeBuildInputs = lib.optionals withCMake [ cmake ];
+
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    inherit curl grpc;
+  };
+
   meta = with lib; {
     description = "A C library for asynchronous DNS requests";
     homepage = "https://c-ares.haxx.se";
     license = licenses.mit;
     platforms = platforms.all;
   };
-
-  # Adapted from running a cmake build
-  passthru.cmake-config = let
-    extension = if stdenv.hostPlatform.isStatic then ".a" else stdenv.hostPlatform.extensions.sharedLibrary;
-    buildType = if stdenv.hostPlatform.isStatic then "STATIC" else "SHARED";
-    buildTypeLower = if stdenv.hostPlatform.isStatic then "static" else "shared";
-    in writeTextDir "c-ares-config.cmake"
-    ''
-      set(c-ares_INCLUDE_DIR "${self}/include")
-
-      set(c-ares_LIBRARY c-ares::cares)
-
-      add_library(c-ares::cares ${buildType} IMPORTED)
-
-      set_target_properties(c-ares::cares PROPERTIES
-        INTERFACE_INCLUDE_DIRECTORIES "${self}/include"
-        ${lib.optionalString stdenv.isLinux ''INTERFACE_LINK_LIBRARIES "nsl;rt"''}
-      )
-      set_property(TARGET c-ares::cares APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
-      set_target_properties(c-ares::cares PROPERTIES
-        IMPORTED_LOCATION_RELEASE "${self}/lib/libcares${extension}"
-        IMPORTED_SONAME_RELEASE "libcares${extension}"
-        )
-      add_library(c-ares::cares_${buildTypeLower} INTERFACE IMPORTED)
-      set_target_properties(c-ares::cares_${buildTypeLower} PROPERTIES INTERFACE_LINK_LIBRARIES "c-ares::cares")
-      set(c-ares_${buildType}_LIBRARY c-ares::cares_${buildTypeLower})
-    '';
-
-}; in self
+}
diff --git a/pkgs/development/libraries/catch2/default.nix b/pkgs/development/libraries/catch2/default.nix
index 111f1054f368d..3c51fa9371d94 100644
--- a/pkgs/development/libraries/catch2/default.nix
+++ b/pkgs/development/libraries/catch2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "2.13.9";
+  version = "2.13.10";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    sha256="sha256-G6rMTHvrBJbUaTNkR738YClAn2v2xVBr+tXLjpNzVZg=";
+    sha256="sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/cosmopolitan/default.nix b/pkgs/development/libraries/cosmopolitan/default.nix
index 63f45f62fd145..88e5bcf5d9d7b 100644
--- a/pkgs/development/libraries/cosmopolitan/default.nix
+++ b/pkgs/development/libraries/cosmopolitan/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dist" ];
 
   # slashes are significant because upstream uses o/$(MODE)/foo.o
-  buildFlags = "o/cosmopolitan.h o//cosmopolitan.a o//libc/crt/crt.o o//ape/ape.o o//ape/ape.lds";
+  buildFlags = [ "o/cosmopolitan.h" "o//cosmopolitan.a" "o//libc/crt/crt.o" "o//ape/ape.o" "o//ape/ape.lds" ];
   checkTarget = "o//test";
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/cxxopts/default.nix b/pkgs/development/libraries/cxxopts/default.nix
index cf36a88a35be9..a24127ab56d8b 100644
--- a/pkgs/development/libraries/cxxopts/default.nix
+++ b/pkgs/development/libraries/cxxopts/default.nix
@@ -21,10 +21,10 @@ stdenv.mkDerivation rec {
   # CMake does not set CMAKE_LIBRARY_ARCHITECTURE variable in Nix, which breaks architecture-independent library path generation
   patches = [ ./fix-install-path.patch ];
 
-  buildInputs = lib.optional enableUnicodeHelp [ icu.dev ];
+  buildInputs = lib.optionals enableUnicodeHelp [ icu.dev ];
   cmakeFlags = [ "-DCXXOPTS_BUILD_EXAMPLES=OFF" ]
     ++ lib.optional enableUnicodeHelp "-DCXXOPTS_USE_UNICODE_HELP=TRUE";
-  nativeBuildInputs = [ cmake ] ++ lib.optional enableUnicodeHelp [ pkg-config ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals enableUnicodeHelp [ pkg-config ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index be20a9b1678df..632c8427e4db6 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, openssl, openldap, libkrb5, db, gettext
-, pam, fixDarwinDylibNames, autoreconfHook, enableLdap ? false
+, pam, libxcrypt, fixDarwinDylibNames, autoreconfHook, enableLdap ? false
 , buildPackages, pruneLibtoolFiles, nixosTests }:
 
 with lib;
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pruneLibtoolFiles ]
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs =
-    [ openssl db gettext libkrb5 ]
+    [ openssl db gettext libkrb5 libxcrypt ]
     ++ lib.optional enableLdap openldap
     ++ lib.optional stdenv.isLinux pam;
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     "--enable-shared"
   ] ++ lib.optional enableLdap "--with-ldap=${openldap.dev}";
 
-  installFlags = lib.optional stdenv.isDarwin [ "framedir=$(out)/Library/Frameworks/SASL2.framework" ];
+  installFlags = lib.optionals stdenv.isDarwin [ "framedir=$(out)/Library/Frameworks/SASL2.framework" ];
 
   passthru.tests = {
     inherit (nixosTests) parsedmarc postfix;
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 075f2a67b70e6..2cd6463d5c21a 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , lib
-, fetchpatch
 , fetchurl
 , pkg-config
 , expat
@@ -20,27 +19,16 @@
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.14.0";
+  version = "1.14.4";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.xz";
-    sha256 = "sha256-zNfM43WW4KGVWP1mSNEnKrQ/AR2AyGNa6o/QutWK69Q=";
+    sha256 = "sha256-fA+bjl7A/yR5OD5iwAhKOimvme3xUU6fZZuBsw1ONT4=";
   };
 
-  patches = [
-    # Fix dbus-daemon crashing when running tests due to long XDG_DATA_DIRS.
-    # https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/302
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/dbus/dbus/-/commit/b551b3e9737958216a1a9d359150a4110a9d0549.patch";
-      sha256 = "kOVjlklZzKvBZXmmrE1UiO4XWRoBLViGwdn6/eDH+DY=";
-    })
-  ] ++ (lib.optional stdenv.isSunOS ./implement-getgrouplist.patch);
+  patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;
 
   postPatch = ''
-    # We need to generate the file ourselves.
-    # https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/317
-    rm doc/catalog.xml
-
     substituteInPlace bus/Makefile.am \
       --replace 'install-data-hook:' 'disabled:' \
       --replace '$(mkinstalldirs) $(DESTDIR)$(localstatedir)/run/dbus' ':'
diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index 9cc3503acd6e2..de4aaf32d980b 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional postgresSupport postgresql
     ++ lib.optional redisSupport hiredis
     # drogon uses mariadb for mysql (see https://github.com/drogonframework/drogon/wiki/ENG-02-Installation#Library-Dependencies)
-    ++ lib.optional mysqlSupport [ libmysqlclient mariadb ];
+    ++ lib.optionals mysqlSupport [ libmysqlclient mariadb ];
 
   patches = [
     # this part of the test would normally fail because it attempts to configure a CMake project that uses find_package on itself
diff --git a/pkgs/development/libraries/fcft/default.nix b/pkgs/development/libraries/fcft/default.nix
index 531276b90d792..ecc99092a905d 100644
--- a/pkgs/development/libraries/fcft/default.nix
+++ b/pkgs/development/libraries/fcft/default.nix
@@ -20,14 +20,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fcft";
-  version = "3.1.4";
+  version = "3.1.5";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fcft";
     rev = version;
-    sha256 = "sha256-kSzUZR/5PcYTxPWNh/zAwLQbfeW/44u2elEmGR3NYcM=";
+    sha256 = "sha256-3gsaXnflGiGOpIkqDQe5u6x8d18x67/dc4Hh1iU89+o=";
   };
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index b518b7527ac0d..e37e90d553a3b 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,17 +1,12 @@
-{ callPackage, fetchpatch
-# Darwin frameworks
-, Cocoa, CoreMedia, VideoToolbox
-, stdenv, lib
-, ...
-}@args:
+{ callPackage, fetchpatch, ... }@args:
 
 callPackage ./generic.nix (rec {
   version = "4.4.2";
   branch = version;
   sha256 = "sha256-+YpIJSDEdQdSGpB5FNqp77wThOBZG1r8PaGKqJfeKUg=";
-  darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
+
   patches = [
-    #  sdl2 recently changed their versioning
+    # SDL2 recently changed their versioning
     (fetchpatch {
       url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
       hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index d09d7ccd1cece..b19c22a55f3a8 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,12 +1,7 @@
-{ callPackage
-# Darwin frameworks
-, Cocoa, CoreMedia, VideoToolbox
-, ...
-}@args:
+{ callPackage, ... }@args:
 
 callPackage ./generic.nix (rec {
   version = "5.1.2";
   branch = version;
   sha256 = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
-  darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 } // args)
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 855586649b74c..87b93a868985b 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,22 +1,23 @@
 { lib, stdenv, buildPackages, fetchurl, pkg-config, addOpenGLRunpath, perl, texinfo, yasm
 , alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
-, libssh, libtheora, libva, libdrm, libvorbis, libvpx, xz, soxr
+, libssh, libtheora, libva, libdrm, libvorbis, xz, soxr
 , x264, x265, xvidcore, zimg, zlib, libopus, speex, nv-codec-headers, dav1d
-, srt ? null
-, openglSupport ? false, libGLU ? null, libGL ? null
-, libmfxSupport ? false, intel-media-sdk ? null
-, libaomSupport ? false, libaom ? null
+, vpxSupport ? !stdenv.isAarch32, libvpx
+, srtSupport ? true, srt
+, vaapiSupport ? ((stdenv.isLinux || stdenv.isFreeBSD) && !stdenv.isAarch32)
+, openglSupport ? false, libGLU, libGL
+, libmfxSupport ? false, intel-media-sdk
+, libaomSupport ? false, libaom
 # Build options
 , runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime
 , multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, sdlSupport ? !stdenv.isAarch32, SDL ? null, SDL2 ? null
-, vdpauSupport ? !stdenv.isAarch32, libvdpau ? null
+, sdlSupport ? !stdenv.isAarch32, SDL2
+, vdpauSupport ? !stdenv.isAarch32, libvdpau
 # Developer options
 , debugDeveloper ? false
 , optimizationsDeveloper ? true
 , extraWarningsDeveloper ? false
-# Darwin frameworks
-, Cocoa, darwinFrameworks ? [ Cocoa ]
+, Cocoa, CoreMedia, VideoToolbox
 # Inherit generics
 , branch, sha256, version, patches ? [], knownVulnerabilities ? []
 , doCheck ? true
@@ -35,12 +36,6 @@
  *   pulseaudio
  *
  * Known issues:
- * 0.6     - fails to compile (unresolved) (so far, only disabling a number of
- *           features works, but that is not a feasible solution)
- * 0.6.90  - mmx: compile errors (fix: disable for 0.6.90-rc0)
- * 1.1     - libsoxr: compile error (fix: disable for 1.1)
- *           Support was initially added in 1.1 before soxr api change, fix
- *           would probably be to add soxr-1.0
  * ALL     - Cross-compiling will disable features not present on host OS
  *           (e.g. dxva2 support [DirectX] will not be enabled unless natively
  *           compiled on Cygwin)
@@ -48,34 +43,16 @@
  */
 
 let
-  inherit (stdenv) isDarwin isFreeBSD isLinux isAarch32;
   inherit (lib) optional optionals optionalString enableFeature filter;
 
-  cmpVer = builtins.compareVersions;
-  reqMin = requiredVersion: (cmpVer requiredVersion branch != 1);
-  reqMatch = requiredVersion: (cmpVer requiredVersion branch == 0);
+  reqMin = requiredVersion: (builtins.compareVersions requiredVersion branch != 1);
 
   ifMinVer = minVer: flag: if reqMin minVer then flag else null;
 
   ifVerOlder = maxVer: flag: if (lib.versionOlder branch maxVer) then flag else null;
-
-  # Version specific fix
-  verFix = withoutFix: fixVer: withFix: if reqMatch fixVer then withFix else withoutFix;
-
-  # Disable dependency that needs fixes before it will work on Darwin or Arm
-  disDarwinOrArmFix = origArg: minVer: fixArg: if ((isDarwin || isAarch32) && reqMin minVer) then fixArg else origArg;
-
-  vaapiSupport = reqMin "0.6" && ((isLinux || isFreeBSD) && !isAarch32);
-
-  vpxSupport = reqMin "0.6" && !isAarch32;
 in
 
-assert openglSupport -> libGL != null && libGLU != null;
-assert libmfxSupport -> intel-media-sdk != null;
-assert libaomSupport -> libaom != null;
-
 stdenv.mkDerivation rec {
-
   pname = "ffmpeg";
   inherit version;
 
@@ -87,8 +64,7 @@ stdenv.mkDerivation rec {
   postPatch = "patchShebangs .";
   inherit patches;
 
-  outputs = [ "bin" "dev" "out" "man" ]
-    ++ optional (reqMin "1.0") "doc" ; # just dev-doc
+  outputs = [ "bin" "dev" "out" "man" "doc" ];
   setOutputFlags = false; # doesn't accept all and stores configureFlags in libs!
 
   configurePlatforms = [];
@@ -100,8 +76,8 @@ stdenv.mkDerivation rec {
       "--enable-version3"
     # Build flags
       "--enable-shared"
-      (ifMinVer "0.6" "--enable-pic")
-      (ifMinVer "4.0" (enableFeature (srt != null) "libsrt"))
+      "--enable-pic"
+      (ifMinVer "4.0" (enableFeature srtSupport "libsrt"))
       (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
       "--enable-hardcoded-tables"
     ] ++
@@ -113,63 +89,61 @@ stdenv.mkDerivation rec {
        else
          ["--disable-pthreads" "--disable-w32threads"])
     ++ [
-      (ifMinVer "0.9" "--disable-os2threads") # We don't support OS/2
+      "--disable-os2threads" # We don't support OS/2
       "--enable-network"
-      (ifMinVer "2.4" "--enable-pixelutils")
+      "--enable-pixelutils"
     # Executables
       "--enable-ffmpeg"
       "--disable-ffplay"
-      (ifMinVer "0.6" "--enable-ffprobe")
-      (if reqMin "4" then null else "--disable-ffserver")
+      "--enable-ffprobe"
+      (ifVerOlder "4" "--disable-ffserver")
     # Libraries
-      (ifMinVer "0.6" "--enable-avcodec")
-      (ifMinVer "0.6" "--enable-avdevice")
+      "--enable-avcodec"
+      "--enable-avdevice"
       "--enable-avfilter"
-      (ifMinVer "0.6" "--enable-avformat")
-      (ifMinVer "1.0" (ifVerOlder "5.0" "--enable-avresample"))
-      (ifMinVer "1.1" "--enable-avutil")
+      "--enable-avformat"
+      (ifVerOlder "5.0" "--enable-avresample")
+      "--enable-avutil"
       "--enable-postproc"
-      (ifMinVer "0.9" "--enable-swresample")
+      "--enable-swresample"
       "--enable-swscale"
     # Docs
-      (ifMinVer "0.6" "--disable-doc")
+      "--disable-doc"
     # External Libraries
       "--enable-libass"
       "--enable-bzlib"
       "--enable-gnutls"
-      (ifMinVer "1.0" "--enable-fontconfig")
-      (ifMinVer "0.7" "--enable-libfreetype")
+      "--enable-fontconfig"
+      "--enable-libfreetype"
       "--enable-libmp3lame"
-      (ifMinVer "1.2" "--enable-iconv")
+      "--enable-iconv"
       "--enable-libtheora"
-      (ifMinVer "2.1" "--enable-libssh")
-      (ifMinVer "0.6" (enableFeature vaapiSupport "vaapi"))
-      (ifMinVer "3.4" (enableFeature vaapiSupport "libdrm"))
+      "--enable-libssh"
+      (enableFeature vaapiSupport "vaapi")
+      (enableFeature vaapiSupport "libdrm")
       (enableFeature vdpauSupport "vdpau")
       "--enable-libvorbis"
-      (ifMinVer "0.6" (enableFeature vpxSupport "libvpx"))
-      (ifMinVer "2.4" "--enable-lzma")
-      (ifMinVer "2.2" (enableFeature openglSupport "opengl"))
+      (enableFeature vpxSupport "libvpx")
+      "--enable-lzma"
+      (enableFeature openglSupport "opengl")
       (ifMinVer "4.2" (enableFeature libmfxSupport "libmfx"))
       (ifMinVer "4.2" (enableFeature libaomSupport "libaom"))
-      (disDarwinOrArmFix (ifMinVer "0.9" (lib.optionalString pulseaudioSupport "--enable-libpulse")) "0.9" "--disable-libpulse")
-      (ifMinVer "2.5" (if sdlSupport && reqMin "3.2" then "--enable-sdl2" else if sdlSupport then "--enable-sdl" else null)) # autodetected before 2.5, SDL1 support removed in 3.2 for SDL2
-      (ifMinVer "1.2" "--enable-libsoxr")
+      (lib.optionalString pulseaudioSupport "--enable-libpulse")
+      (enableFeature sdlSupport "sdl2")
+      "--enable-libsoxr"
       "--enable-libx264"
       "--enable-libxvid"
       "--enable-libzimg"
       "--enable-zlib"
-      (ifMinVer "2.8" "--enable-libopus")
+      "--enable-libopus"
       "--enable-libspeex"
-      (ifMinVer "2.8" "--enable-libx265")
-      (ifMinVer "4.2" (enableFeature (dav1d != null) "libdav1d"))
+      "--enable-libx265"
+      (ifMinVer "4.2" (enableFeature (reqMin "4.2") "libdav1d"))
     # Developer flags
       (enableFeature debugDeveloper "debug")
       (enableFeature optimizationsDeveloper "optimizations")
       (enableFeature extraWarningsDeveloper "extra-warnings")
       "--disable-stripping"
-    # Disable mmx support for 0.6.90
-      (verFix null "0.6.90" "--disable-mmx")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       "--cross-prefix=${stdenv.cc.targetPrefix}"
       "--enable-cross-compile"
@@ -180,18 +154,18 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex srt nv-codec-headers
+    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex nv-codec-headers
   ] ++ optionals openglSupport [ libGL libGLU ]
     ++ optional libmfxSupport intel-media-sdk
     ++ optional libaomSupport libaom
     ++ optional vpxSupport libvpx
-    ++ optionals (!isDarwin && !isAarch32 && pulseaudioSupport) [ libpulseaudio ] # Need to be fixed on Darwin and ARM
-    ++ optional ((isLinux || isFreeBSD) && !isAarch32) libva
-    ++ optional ((isLinux || isFreeBSD) && !isAarch32) libdrm
-    ++ optional isLinux alsa-lib
-    ++ optionals isDarwin darwinFrameworks
+    ++ optionals (!stdenv.isDarwin && pulseaudioSupport) [ libpulseaudio ] # Need to be fixed on Darwin
+    ++ optionals vaapiSupport [ libva libdrm ]
+    ++ optional stdenv.isLinux alsa-lib
+    ++ optionals stdenv.isDarwin [ Cocoa CoreMedia VideoToolbox ]
     ++ optional vdpauSupport libvdpau
-    ++ optional sdlSupport (if reqMin "3.2" then SDL2 else SDL)
+    ++ optional sdlSupport SDL2
+    ++ optional srtSupport srt
     ++ optional (reqMin "4.2") dav1d;
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/galario/default.nix b/pkgs/development/libraries/galario/default.nix
index ac7e4f4255e84..7f757fd48197f 100644
--- a/pkgs/development/libraries/galario/default.nix
+++ b/pkgs/development/libraries/galario/default.nix
@@ -34,13 +34,13 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.isDarwin llvmPackages.openmp
   ;
 
-  propagatedBuildInputs = lib.optional enablePython [
+  propagatedBuildInputs = lib.optionals enablePython [
     pythonPackages.numpy
     pythonPackages.cython
     pythonPackages.pytest
   ];
 
-  checkInputs = lib.optional enablePython [ pythonPackages.scipy pythonPackages.pytest-cov ];
+  checkInputs = lib.optionals enablePython [ pythonPackages.scipy pythonPackages.pytest-cov ];
 
   preConfigure = ''
     mkdir -p build/external/src
diff --git a/pkgs/development/libraries/geographiclib/default.nix b/pkgs/development/libraries/geographiclib/default.nix
new file mode 100644
index 0000000000000..44576daaf4408
--- /dev/null
+++ b/pkgs/development/libraries/geographiclib/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub, cmake, doxygen }:
+
+stdenv.mkDerivation rec {
+  pname = "geographiclib";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "geographiclib";
+    repo = "geographiclib";
+    rev = "v${version}";
+    hash = "sha256-7K4vI5vNSGPo2d9QNmasjJa4oMDfE8WTW6Guk2604Yg=";
+  };
+
+  nativeBuildInputs = [ cmake doxygen ];
+
+  cmakeFlags = [
+    "-DBUILD_DOCUMENTATION=ON"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+
+  meta = with lib; {
+    description = "C++ geographic library";
+    longDescription = ''
+      GeographicLib is a small C++ library for:
+      * geodesic and rhumb line calculations
+      * conversions between geographic, UTM, UPS, MGRS, geocentric, and local cartesian coordinates
+      * gravity (e.g., EGM2008) and geomagnetic field (e.g., WMM2020) calculations
+    '';
+    homepage = "https://geographiclib.sourceforge.io/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 6ed0a4d4da0fe..83cde07749496 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -36,6 +36,7 @@
 , withLinuxHeaders ? false
 , profilingLibraries ? false
 , withGd ? false
+, withLibcrypt ? false
 , meta
 , extraBuildInputs ? []
 , extraNativeBuildInputs ? []
@@ -183,7 +184,9 @@ stdenv.mkDerivation ({
       # To avoid linking with -lgcc_s (dynamic link)
       # so the glibc does not depend on its compiler store path
       "libc_cv_as_needed=no"
-    ] ++ lib.optional withGd "--with-gd";
+    ]
+    ++ lib.optional withGd "--with-gd"
+    ++ lib.optional (!withLibcrypt) "--disable-crypt";
 
   makeFlags = [
     "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 5f581d7493e3e..791ac47536f94 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -2,6 +2,7 @@
 , withLinuxHeaders ? true
 , profilingLibraries ? false
 , withGd ? false
+, withLibcrypt? false
 , buildPackages
 }:
 
@@ -16,7 +17,7 @@ in
 callPackage ./common.nix { inherit stdenv; } {
     pname = "glibc" + lib.optionalString withGd "-gd";
 
-    inherit withLinuxHeaders profilingLibraries withGd;
+    inherit withLinuxHeaders profilingLibraries withGd withLibcrypt;
 
     # Note:
     # Things you write here override, and do not add to,
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index d04fda98c7fe5..f1ec87ba008db 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     "--with-unbound-root-key-file=${dns-root-data}/root.key"
     (lib.withFeature withP11-kit "p11-kit")
     (lib.enableFeature cxxBindings "cxx")
-  ] ++ lib.optional guileBindings [
+  ] ++ lib.optionals guileBindings [
     "--enable-guile"
     "--with-guile-site-dir=\${out}/share/guile/site"
     "--with-guile-site-ccache-dir=\${out}/share/guile/site"
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 8d4e2e7271d41..8470c62a89065 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Fix compilation on i686, would not be needed after 1.18.1 releases, https://dev.gnupg.org/T5522
+    ./t-addexistingsubkey-i686.patch
     # https://dev.gnupg.org/rMc4cf527ea227edb468a84bf9b8ce996807bd6992
     ./fix_gpg_list_keys.diff
     # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
diff --git a/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch b/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch
new file mode 100644
index 0000000000000..348bd8fa596a4
--- /dev/null
+++ b/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch
@@ -0,0 +1,369 @@
+From c977424a1d39751fc5055131ad3f7819d421dcc8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Wed, 17 Aug 2022 14:51:19 +0200
+Subject: [PATCH 1/5] qt: Make sure expiration time is interpreted as unsigned
+ number
+
+* lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp (add_subkey): Convert
+expiration time to uint_least32_t.
+--
+
+This fixes the corresponding test on 32-bit systems where time_t (the
+return type of expirationTime()) is a signed 32-bit integer type.
+
+GnuPG-bug-id: 6137
+---
+ lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp b/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
+index 32e2c292..b74e7a06 100644
+--- a/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
++++ b/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
+@@ -64,7 +64,8 @@ static QGpgMEAddExistingSubkeyJob::result_type add_subkey(Context *ctx, const Ke
+     std::unique_ptr<GpgAddExistingSubkeyEditInteractor> interactor{new GpgAddExistingSubkeyEditInteractor{subkey.keyGrip()}};
+ 
+     if (!subkey.neverExpires()) {
+-        const auto expiry = QDateTime::fromSecsSinceEpoch(subkey.expirationTime(), Qt::UTC).toString(u"yyyyMMdd'T'hhmmss").toStdString();
++        const auto expiry = QDateTime::fromSecsSinceEpoch(uint_least32_t(subkey.expirationTime()),
++                                                          Qt::UTC).toString(u"yyyyMMdd'T'hhmmss").toStdString();
+         interactor->setExpiry(expiry);
+     }
+ 
+-- 
+2.36.0.windows.1
+
+
+From 81d4b7f2d7077297d76af5728949d8f2bdff8cd5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Wed, 17 Aug 2022 14:56:13 +0200
+Subject: [PATCH 2/5] qt,tests: Log the actual error code if the assertion
+ fails
+
+* lang/qt/tests/t-addexistingsubkey.cpp (
+AddExistingSubkeyJobTest::testAddExistingSubkeyAsync,
+AddExistingSubkeyJobTest::testAddExistingSubkeySync,
+AddExistingSubkeyJobTest::testAddExistingSubkeyWithExpiration): Use
+QCOMPARE instead of QVERIFY for asserting equality.
+--
+
+GnuPG-bug-id: 6137
+---
+ lang/qt/tests/t-addexistingsubkey.cpp | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
+index 589c90bf..2e654cec 100644
+--- a/lang/qt/tests/t-addexistingsubkey.cpp
++++ b/lang/qt/tests/t-addexistingsubkey.cpp
+@@ -168,7 +168,7 @@ private Q_SLOTS:
+         QSignalSpy spy (this, SIGNAL(asyncDone()));
+         QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+ 
+-        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
++        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
+         key.update();
+         QCOMPARE(key.numSubkeys(), 3u);
+     }
+@@ -190,7 +190,7 @@ private Q_SLOTS:
+ 
+         const auto result = job->exec(key, sourceSubkey);
+ 
+-        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
++        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
+         key.update();
+         QCOMPARE(key.numSubkeys(), 3u);
+         QCOMPARE(key.subkey(2).expirationTime(), 0);
+@@ -213,7 +213,7 @@ private Q_SLOTS:
+ 
+         const auto result = job->exec(key, sourceSubkey);
+ 
+-        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
++        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
+         key.update();
+         QCOMPARE(key.numSubkeys(), 3u);
+ 
+-- 
+2.36.0.windows.1
+
+
+From f2b48de26b8f8c48c293423eda712831544924f6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Wed, 17 Aug 2022 15:22:29 +0200
+Subject: [PATCH 3/5] qt,tests: Make sure expiration time is interpreted as
+ unsigned number
+
+* lang/qt/tests/t-addexistingsubkey.cpp,
+lang/qt/tests/t-changeexpiryjob.cpp: Convert expiration time to
+uint_least32_t.
+--
+
+This doesn't change the outcome of the tests (they also pass without
+this change because of the expiration dates of the test keys), but it's
+still good practise to treat the expiration time as an unsigned number
+if the assertions check that the expiration time is in some range.
+
+GnuPG-bug-id: 6137
+---
+ lang/qt/tests/t-addexistingsubkey.cpp |  6 +++---
+ lang/qt/tests/t-changeexpiryjob.cpp   | 26 +++++++++++++-------------
+ 2 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
+index 2e654cec..87eadf43 100644
+--- a/lang/qt/tests/t-addexistingsubkey.cpp
++++ b/lang/qt/tests/t-addexistingsubkey.cpp
+@@ -222,9 +222,9 @@ private Q_SLOTS:
+         // several times
+         const auto allowedDeltaTSeconds = 1;
+         const auto expectedExpirationRange = std::make_pair(
+-            sourceSubkey.expirationTime() - allowedDeltaTSeconds,
+-            sourceSubkey.expirationTime() + allowedDeltaTSeconds);
+-        const auto actualExpiration = key.subkey(2).expirationTime();
++            uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
++            uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
++        const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
+         QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                  ("actual: " + std::to_string(actualExpiration) +
+                   "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+diff --git a/lang/qt/tests/t-changeexpiryjob.cpp b/lang/qt/tests/t-changeexpiryjob.cpp
+index 090002f3..3da74d46 100644
+--- a/lang/qt/tests/t-changeexpiryjob.cpp
++++ b/lang/qt/tests/t-changeexpiryjob.cpp
+@@ -70,7 +70,7 @@ private Q_SLOTS:
+         QVERIFY(!key.isNull());
+         QVERIFY(!key.subkey(0).isNull());
+         QVERIFY(!key.subkey(1).isNull());
+-        const auto subkeyExpiration = key.subkey(1).expirationTime();
++        const auto subkeyExpiration = uint_least32_t(key.subkey(1).expirationTime());
+ 
+         {
+             // Create the job
+@@ -101,7 +101,7 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(1).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -110,7 +110,7 @@ private Q_SLOTS:
+                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QCOMPARE(actualExpiration, subkeyExpiration);  // unchanged
+             }
+         }
+@@ -133,7 +133,7 @@ private Q_SLOTS:
+         QVERIFY(!key.isNull());
+         QVERIFY(!key.subkey(0).isNull());
+         QVERIFY(!key.subkey(1).isNull());
+-        const auto primaryKeyExpiration = key.subkey(0).expirationTime();
++        const auto primaryKeyExpiration = uint_least32_t(key.subkey(0).expirationTime());
+ 
+         {
+             // Create the job
+@@ -164,11 +164,11 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(2).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QCOMPARE(actualExpiration, primaryKeyExpiration);  // unchanged
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -196,7 +196,7 @@ private Q_SLOTS:
+         QVERIFY(!key.isNull());
+         QVERIFY(!key.subkey(0).isNull());
+         QVERIFY(!key.subkey(1).isNull());
+-        const auto subkeyExpiration = key.subkey(1).expirationTime();
++        const auto subkeyExpiration = uint_least32_t(key.subkey(1).expirationTime());
+ 
+         {
+             // Create the job
+@@ -228,7 +228,7 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(3).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -237,7 +237,7 @@ private Q_SLOTS:
+                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QCOMPARE(actualExpiration, subkeyExpiration);  // unchanged
+             }
+         }
+@@ -291,7 +291,7 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(4).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -300,7 +300,7 @@ private Q_SLOTS:
+                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                           "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -359,7 +359,7 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(5).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -368,7 +368,7 @@ private Q_SLOTS:
+                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                           "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+-- 
+2.36.0.windows.1
+
+
+From 2fa5c80aeba4528b3bdf41ec5740e7db5d4b6d2b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Thu, 18 Aug 2022 10:43:19 +0200
+Subject: [PATCH 4/5] cpp: Fix handling of "no key" or "invalid time"
+ situations
+
+* lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
+(GpgAddExistingSubkeyEditInteractor::Private::nextState): Fix inverted
+logic of string comparisons.
+--
+
+This fixes the problem that the interactor didn't return the proper
+error code if gpg didn't accept the key grip or the expiration date.
+
+GnuPG-bug-id: 6137
+---
+ lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp b/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
+index 547e613d..8eec7460 100644
+--- a/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
++++ b/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
+@@ -136,7 +136,7 @@ unsigned int GpgAddExistingSubkeyEditInteractor::Private::nextState(unsigned int
+                 strcmp(args, "keygen.flags") == 0) {
+             return FLAGS;
+         } else if (status == GPGME_STATUS_GET_LINE &&
+-                   strcmp(args, "keygen.keygrip")) {
++                   strcmp(args, "keygen.keygrip") == 0) {
+             err = NO_KEY_ERROR;
+             return ERROR;
+         }
+@@ -157,7 +157,7 @@ unsigned int GpgAddExistingSubkeyEditInteractor::Private::nextState(unsigned int
+                 strcmp(args, "keyedit.prompt") == 0) {
+             return QUIT;
+         } else if (status == GPGME_STATUS_GET_LINE &&
+-                   strcmp(args, "keygen.valid")) {
++                   strcmp(args, "keygen.valid") == 0) {
+             err = INV_TIME_ERROR;
+             return ERROR;
+         }
+-- 
+2.36.0.windows.1
+
+
+From 2e7a61b898fccc1c20000b79dee83cd980901fa9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Thu, 18 Aug 2022 10:55:09 +0200
+Subject: [PATCH 5/5] qt,tests: Make test pass on 32-bit systems
+
+* lang/qt/tests/t-addexistingsubkey.cpp
+(AddExistingSubkeyJobTest::testAddExistingSubkeyWithExpiration): Handle
+negative expiration date.
+--
+
+On 32-bit systems the expiration date of the test key overflows. This
+will cause the AddExistingSubkeyJob to fail. We expect it to fail with
+an "invalid time" error.
+
+GnuPG-bug-id: 6137
+---
+ lang/qt/tests/t-addexistingsubkey.cpp | 42 +++++++++++++++------------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
+index 87eadf43..c0eee57b 100644
+--- a/lang/qt/tests/t-addexistingsubkey.cpp
++++ b/lang/qt/tests/t-addexistingsubkey.cpp
+@@ -213,24 +213,30 @@ private Q_SLOTS:
+ 
+         const auto result = job->exec(key, sourceSubkey);
+ 
+-        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
+-        key.update();
+-        QCOMPARE(key.numSubkeys(), 3u);
+-
+-        // allow 1 second different expiration because gpg calculates with
+-        // expiration as difference to current time and takes current time
+-        // several times
+-        const auto allowedDeltaTSeconds = 1;
+-        const auto expectedExpirationRange = std::make_pair(
+-            uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
+-            uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
+-        const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
+-        QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+-                 ("actual: " + std::to_string(actualExpiration) +
+-                  "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+-        QVERIFY2(actualExpiration <= expectedExpirationRange.second,
+-                 ("actual: " + std::to_string(actualExpiration) +
+-                  "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
++        if (sourceSubkey.expirationTime() > 0) {
++            QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
++            key.update();
++            QCOMPARE(key.numSubkeys(), 3u);
++
++            // allow 1 second different expiration because gpg calculates with
++            // expiration as difference to current time and takes current time
++            // several times
++            const auto allowedDeltaTSeconds = 1;
++            const auto expectedExpirationRange = std::make_pair(
++                uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
++                uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
++            const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
++            QVERIFY2(actualExpiration >= expectedExpirationRange.first,
++                    ("actual: " + std::to_string(actualExpiration) +
++                    "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
++            QVERIFY2(actualExpiration <= expectedExpirationRange.second,
++                    ("actual: " + std::to_string(actualExpiration) +
++                    "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
++        } else {
++            // on 32-bit systems the expiration date of the test key overflows;
++            // in this case we expect an appropriate error code
++            QCOMPARE(result.code(), static_cast<int>(GPG_ERR_INV_TIME));
++        }
+     }
+ 
+ private:
+-- 
+2.36.0.windows.1
+
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 4cba9c1b511b8..d44b85337ddcd 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ]
     ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) grpc;
   propagatedBuildInputs = [ c-ares re2 zlib abseil-cpp ];
-  buildInputs = [ c-ares.cmake-config openssl protobuf ]
+  buildInputs = [ openssl protobuf ]
     ++ lib.optionals stdenv.isLinux [ libnsl ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index a53ffb4f1b3a5..dac712e823877 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     libjpeg
     tremor
     libGL
-  ] ++ lib.optional (!stdenv.isDarwin) [
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     libvisual
   ] ++ lib.optionals stdenv.isDarwin [
     pango
diff --git a/pkgs/development/libraries/gvm-libs/default.nix b/pkgs/development/libraries/gvm-libs/default.nix
index a141d36e33006..ba08fc61f5682 100644
--- a/pkgs/development/libraries/gvm-libs/default.nix
+++ b/pkgs/development/libraries/gvm-libs/default.nix
@@ -12,6 +12,7 @@
 , libpcap
 , libssh
 , libuuid
+, libxcrypt
 , libxml2
 , pkg-config
 , zlib
@@ -46,6 +47,7 @@ stdenv.mkDerivation rec {
     libpcap
     libssh
     libuuid
+    libxcrypt
     libxml2
     zlib
   ];
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index c9f8f83f0f882..0bb6546543dc0 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
-, fetchFromGitHub
-, fetchpatch
+, fetchurl
 , pkg-config
 , glib
 , freetype
@@ -31,7 +30,7 @@
 }:
 
 let
-  version = "5.1.0";
+  version = "5.2.0";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -41,21 +40,11 @@ stdenv.mkDerivation {
   pname = "harfbuzz${optionalString withIcu "-icu"}";
   inherit version;
 
-  src = fetchFromGitHub {
-    owner = "harfbuzz";
-    repo = "harfbuzz";
-    rev = version;
-    sha256 = "sha256-K6iScmg1vNfwb1UYqtXsnijLVpcC+am2ZL+W5bLFzsI=";
+  src = fetchurl {
+    url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
+    sha256 = "0b4lpkidwx0lf8slczjji652yll6g5zgmm5lmisnb4s7gf8r8nkk";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "aarch64-test-narrowing.diff";
-      url = "https://github.com/harfbuzz/harfbuzz/commit/04d28d94e576aab099891e6736fd0088dfac3366.diff";
-      sha256 = "sha256-099GP8t1G0kyYl79A6xJhfyrs3WXYitvn+He7sEz+Oo=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs src/*.py test
   '' + lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index baaa07d7e7ea7..8b82af586704e 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     patchShebangs tests
   '';
 
-  autoreconfFlags = "-vfi";
+  autoreconfFlags = [ "-vfi" ];
 
   configureFlags = [ "--with-ui" "--with-readline" ];
 
diff --git a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
index 23df659a689fd..6beceec390a81 100644
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@@ -8,13 +8,13 @@
   nv-codec-headers = nv-codec-headers-11;
 }).overrideAttrs (old: rec {
   pname = "jellyfin-ffmpeg";
-  version = "5.1.2-1";
+  version = "5.1.2-2";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    sha256 = "sha256-56IDFZnHDL3jArNd/U/ZRdHyJ54oqhY+U4XcwOLTGqQ=";
+    sha256 = "sha256-7Icp1vFnvhuohipGK7BqnxhhtX0iB02v5TXvh5sss3c=";
   };
 
   configureFlags = old.configureFlags ++ [
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index e095945dabaac..9885384e00e19 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     libxslt
     gobject-introspection
     gi-docgen
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin [
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     fixDarwinDylibNames
   ];
 
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index a7197f9ff9846..fc8fb73987017 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--localstatedir=/var/lib" ]
     # krb5's ./configure does not allow passing --enable-shared and --enable-static at the same time.
     # See https://bbs.archlinux.org/viewtopic.php?pid=1576737#p1576737
-    ++ lib.optional staticOnly [ "--enable-static" "--disable-shared" ]
+    ++ lib.optionals staticOnly [ "--enable-static" "--disable-shared" ]
     ++ lib.optional stdenv.isFreeBSD ''WARN_CFLAGS=""''
     ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
        [ "krb5_cv_attr_constructor_destructor=yes,yes"
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 575c2613e5b1b..5ec8c75e2af73 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "sha256-NgzpVxQmsgOPzKkGpJIJrLiNQcruhpEoCi/CYJx5b3A=";
+    sha256 = "sha256-kEU8DVgB4JoyB6Lbh/XfC3LZcsVEM2STkZV8iZBCNis=";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
index a3de9225d1cef..283c2034be7e4 100644
--- a/pkgs/development/libraries/libav/default.nix
+++ b/pkgs/development/libraries/libav/default.nix
@@ -17,7 +17,7 @@
 
 assert faacSupport -> enableUnfree;
 
-let inherit (lib) optional hasPrefix enableFeature; in
+let inherit (lib) optional optionals hasPrefix enableFeature; in
 
 /* ToDo:
     - more deps, inspiration: https://packages.ubuntu.com/raring/libav-tools
@@ -77,7 +77,7 @@ let
       (enableFeature vaapiSupport "vaapi")
       (enableFeature vdpauSupport "vdpau")
       (enableFeature freetypeSupport "libfreetype")
-    ] ++ optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       "--cross-prefix=${stdenv.cc.targetPrefix}"
       "--enable-cross-compile"
     ];
diff --git a/pkgs/development/libraries/libcerf/default.nix b/pkgs/development/libraries/libcerf/default.nix
index 287c9a61b9c74..7a3b963141894 100644
--- a/pkgs/development/libraries/libcerf/default.nix
+++ b/pkgs/development/libraries/libcerf/default.nix
@@ -1,16 +1,20 @@
-{ stdenv, lib, fetchurl, cmake, perl }:
+{ stdenv, lib, fetchurl, cmake, perl, gnuplot }:
 
 stdenv.mkDerivation rec {
   pname = "libcerf";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchurl {
     url = "https://jugit.fz-juelich.de/mlz/libcerf/-/archive/v${version}/libcerf-v${version}.tar.gz";
-    sha256 = "05lpaxmy6275nbzvf1ahxcfymyph89pvlgg8h9sp9iwal4g8nvn8";
+    sha256 = "sha256-ihzYt/rgS4KpUWglISm4wbrKCYooX/jT8leB3q0Ut1o=";
   };
 
   nativeBuildInputs = [ cmake perl ];
 
+  passthru.tests = {
+    inherit gnuplot;
+  };
+
   meta = with lib; {
     description = "Complex error (erf), Dawson, Faddeeva, and Voigt function library";
     homepage = "https://jugit.fz-juelich.de/mlz/libcerf";
diff --git a/pkgs/development/libraries/libcli/default.nix b/pkgs/development/libraries/libcli/default.nix
index 8aa06bfb19bc2..da076a590e19a 100644
--- a/pkgs/development/libraries/libcli/default.nix
+++ b/pkgs/development/libraries/libcli/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "libcli";
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
       })
     ];
 
+  buildInputs = [ libxcrypt ];
+
   enableParallelBuilding = true;
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "AR=${stdenv.cc.targetPrefix}ar" "PREFIX=$(out)" ];
diff --git a/pkgs/development/libraries/libdaemon/default.nix b/pkgs/development/libraries/libdaemon/default.nix
index 51df458097890..581cc723dc414 100644
--- a/pkgs/development/libraries/libdaemon/default.nix
+++ b/pkgs/development/libraries/libdaemon/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   patches = [ ./fix-includes.patch ];
 
   configureFlags = [ "--disable-lynx" ]
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform)
     [ # Can't run this test while cross-compiling
       "ac_cv_func_setpgrp_void=yes"
     ];
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index 449a3d309cd17..39b80238b7191 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace /usr/local $out
   '';
 
-  makeFlags = lib.optional stdenv.hostPlatform.isStatic [ "DISABLE_SHARED=1"];
+  makeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "DISABLE_SHARED=1"];
 
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 6221c355b227a..24b4ec87df747 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.93.0";
+  version = "1.97.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = version;
-    hash = "sha256-nAVZHCp28/ePYtBVSJNmR5728q5lCPGO5VP+6vKbAYo=";
+    hash = "sha256-njeNlpXSeqKrozN1UfKnnhVJN24ZJh+MuR4Vd3S/gSQ=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-m6t/wkCRrILKdR5/NjGlACUuDJydjEKpm178BjPFDbk=";
+    hash = "sha256-bf79yqQv516k0xCp0yd1Vid1yf8EppFFvC3HJ4RczoA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libeatmydata/default.nix b/pkgs/development/libraries/libeatmydata/default.nix
index 3a3abdc5e9ac1..886caaada47b2 100644
--- a/pkgs/development/libraries/libeatmydata/default.nix
+++ b/pkgs/development/libraries/libeatmydata/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./find-shell-lib.patch ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   postPatch = ''
     substituteInPlace eatmydata.in \
diff --git a/pkgs/development/libraries/libff/default.nix b/pkgs/development/libraries/libff/default.nix
index 35b7a33cc38f8..36e8bb78c8398 100644
--- a/pkgs/development/libraries/libff/default.nix
+++ b/pkgs/development/libraries/libff/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = [ "-DWITH_PROCPS=Off" ]
-    ++ lib.optional stdenv.isAarch64 [ "-DCURVE=ALT_BN128" "-DUSE_ASM=OFF" ];
+    ++ lib.optionals stdenv.isAarch64 [ "-DCURVE=ALT_BN128" "-DUSE_ASM=OFF" ];
 
   # CMake is hardcoded to always build static library which causes linker
   # failure for Haskell applications depending on haskellPackages.hevm on macOS.
diff --git a/pkgs/development/libraries/libfido2/default.nix b/pkgs/development/libraries/libfido2/default.nix
index bd4d21fe1b909..04b2c0af9512a 100644
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libfido2";
-  version = "1.11.0";
+  version = "1.12.0";
 
   # releases on https://developers.yubico.com/libfido2/Releases/ are signed
   src = fetchurl {
     url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-CDDFhT47RAmalxZuDOxUpltUt/qqwHBxhy93uOTXswI=";
+    sha256 = "sha256-gT1tJRFhQ9FtLpZ5FxinSCXaFrd0qNCT2W8Grhcw2cU=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/libfilezilla/default.nix b/pkgs/development/libraries/libfilezilla/default.nix
index 16c09b65ff1e8..9d1c2f27b3b68 100644
--- a/pkgs/development/libraries/libfilezilla/default.nix
+++ b/pkgs/development/libraries/libfilezilla/default.nix
@@ -6,21 +6,22 @@
 , nettle
 , pkg-config
 , libiconv
+, libxcrypt
 , ApplicationServices
 }:
 
 stdenv.mkDerivation rec {
   pname = "libfilezilla";
-  version = "0.38.1";
+  version = "0.39.1";
 
   src = fetchurl {
     url = "https://download.filezilla-project.org/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-1AGotagKfBexo2DdnMy23Fb9jTlEE6n7K2uxvF2Y/Uw=";
+    hash = "sha256-89bA3yjzP1LPJTywP8UVeXUq5NrvKqxzRaa9feYjpsU=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
-  buildInputs = [ gettext gnutls nettle ]
+  buildInputs = [ gettext gnutls nettle libxcrypt ]
     ++ lib.optionals stdenv.isDarwin [ libiconv ApplicationServices ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libfive/default.nix b/pkgs/development/libraries/libfive/default.nix
index 00031e66bf506..37eaed3ac6506 100644
--- a/pkgs/development/libraries/libfive/default.nix
+++ b/pkgs/development/libraries/libfive/default.nix
@@ -9,23 +9,41 @@
 , zlib
 , libpng
 , boost
-, guile
+, guile_3_0
 , stdenv
 }:
 
 mkDerivation {
   pname = "libfive-unstable";
-  version = "2020-02-15";
+  version = "2022-05-19";
 
   src = fetchFromGitHub {
     owner = "libfive";
     repo = "libfive";
-    rev = "5b7717a25064478cd6bdb190683566eaf4c7afdd";
-    sha256 = "102zw2n3vzv84i323is4qrwwqqha8v1cniw54ss8f4bq6dmic0bg";
+    rev = "d83cc22709ff1f7c478be07ff2419e30e024834e";
+    sha256 = "lNJg2LCpFcTewSA00s7omUtzhVxycAXvo6wEM/JjrN0=";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook cmake ninja pkg-config ];
-  buildInputs = [ eigen zlib libpng boost guile ];
+  buildInputs = [ eigen zlib libpng boost guile_3_0 ];
+
+  preConfigure = ''
+    substituteInPlace studio/src/guile/interpreter.cpp \
+      --replace "qputenv(\"GUILE_LOAD_COMPILED_PATH\", \"libfive/bind/guile\");" \
+                "qputenv(\"GUILE_LOAD_COMPILED_PATH\", \"libfive/bind/guile:$out/lib/guile/3.0/ccache\");"
+
+    substituteInPlace libfive/bind/guile/CMakeLists.txt \
+      --replace "LIBFIVE_FRAMEWORK_DIR=$<TARGET_FILE_DIR:libfive>" \
+                "LIBFIVE_FRAMEWORK_DIR=$out/lib" \
+      --replace "LIBFIVE_STDLIB_DIR=$<TARGET_FILE_DIR:libfive-stdlib>" \
+                "LIBFIVE_STDLIB_DIR=$out/lib"
+
+    export XDG_CACHE_HOME=$(mktemp -d)/.cache
+  '';
+
+  cmakeFlags = [
+    "-DGUILE_CCACHE_DIR=${placeholder "out"}/lib/guile/3.0/ccache"
+  ];
 
   postInstall = if stdenv.isDarwin then ''
     # No rules to install the mac app, so do it manually.
@@ -47,6 +65,5 @@ mkDerivation {
     maintainers = with maintainers; [ hodapp kovirobi ];
     license = with licenses; [ mpl20 gpl2Plus ];
     platforms = with platforms; linux ++ darwin;
-    broken = true;
   };
 }
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index e2da1a30ff146..745b1a180008c 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , autoreconfHook
 , makeWrapper
+, libxcrypt
 , ncurses
 , cpio
 , gperf
@@ -65,6 +66,7 @@ stdenv.mkDerivation rec {
   ] ++ (with perlPackages; [ perl libintl-perl GetoptLong ModuleBuild ])
   ++ (with ocamlPackages; [ ocaml findlib ]);
   buildInputs = [
+    libxcrypt
     ncurses
     jansson
     pcre2
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 3fef461874c96..3e03d18ced85a 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchurl
 , buildPackages
 , cmake
 , glib
@@ -19,7 +20,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.14";
+  version = "3.0.15";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -27,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "sha256-gZ6IBjG5pNKJ+hWcTzXMP7yxL4he4LTklZGoC9vXra8=";
+    sha256 = "sha256-7M5GBteFKmKCB6556XXV4s6iIC/+3c3Ck17s/QX3Jus=";
   };
 
   strictDeps = true;
@@ -74,6 +75,17 @@ stdenv.mkDerivation rec {
     # Will appear in 3.1.0
     # https://github.com/libical/libical/issues/350
     ./respect-env-tzdir.patch
+
+    # Fixes tests with 32-bit time_t
+    # Remove with next version update (v3.0.16+)
+    (fetchurl {
+      url = "https://github.com/libical/libical/commit/4adc6f1d2b39a1cc3363b57215e12fa81076498b.patch";
+      sha256 = "1k3hav0z86kc1xd1sk23b57aqqjk4gf73574w7f1m66cyz98bxr3";
+    })
+    (fetchurl {
+      url = "https://github.com/libical/libical/commit/cce20bd051408b00521385c0bfb616ba068450d3.patch";
+      sha256 = "097hqmagl0q5p38r1kvx0592cfac2y7jbdqlis6m8gbs812pbqfc";
+    })
   ];
 
   # Using install check so we do not have to manually set
@@ -98,7 +110,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     homepage = "https://github.com/libical/libical";
     description = "An Open Source implementation of the iCalendar protocols";
     license = licenses.mpl20;
diff --git a/pkgs/development/libraries/libirc/default.nix b/pkgs/development/libraries/libirc/default.nix
new file mode 100644
index 0000000000000..368cd7e1d8591
--- /dev/null
+++ b/pkgs/development/libraries/libirc/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchFromGitHub, cmake, qtbase }:
+
+stdenv.mkDerivation rec {
+  pname = "libirc";
+  version = "unstable-2022-10-15";
+
+  src = fetchFromGitHub {
+    owner = "grumpy-irc";
+    repo = "libirc";
+    rev = "734082ffffb6d6744070c75587159d927342edea";
+    sha256 = "Qi/YKLlau0rdQ9XCMyreQdv4ctQWHFIoE3YlW6QnbSI=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    "-DQT5_BUILD=1"
+    "-DQt5Core_DIR=${qtbase.dev}/lib/cmake/Qt5Core"
+    "-DQt5Network_DIR=${qtbase.dev}/lib/cmake/Qt5Network"
+  ];
+
+  preFixup = ''
+    mkdir -p $out/libirc/libirc{,client}
+    cp ../libirc/*.h $out/libirc/libirc
+    cp ../libircclient/*.h $out/libirc/libircclient
+  '';
+
+  meta = with lib; {
+    description = "C++ IRC library written in Qt with support for data serialization";
+    homepage = "https://github.com/grumpy-irc/libirc";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ fee1-dead ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/libksba/default.nix b/pkgs/development/libraries/libksba/default.nix
index e6fb5162b7a69..5bfb0d029cdf9 100644
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libksba";
-  version = "1.6.0";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "mirror://gnupg/libksba/libksba-${version}.tar.bz2";
-    sha256 = "sha256-2taD5vLZFdiAqkvtXOqaEVaQuJNbeKG74BZpGJMHpIs=";
+    sha256 = "fce01ccac59812bddadffacff017dac2e4762bdb6ebc6ffe06f6ed4f6192c971";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/liblc3/default.nix b/pkgs/development/libraries/liblc3/default.nix
new file mode 100644
index 0000000000000..d0d95fd47da76
--- /dev/null
+++ b/pkgs/development/libraries/liblc3/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+}:
+
+let
+  name = "liblc3";
+  version = "1.0.1";
+in
+stdenv.mkDerivation {
+  pname = name;
+  version = version;
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "liblc3";
+    rev = "v${version}";
+    sha256 = "sha256-W0pCfFmM+6N6+HdGdQ/GBNHjBspkwtlxZC2m2noKGx0=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  meta = with lib; {
+    description = "LC3 (Low Complexity Communication Codec) is an efficient low latency audio codec";
+    homepage = "https://github.com/google/liblc3";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jansol ];
+  };
+}
+
diff --git a/pkgs/development/libraries/libmcrypt/default.nix b/pkgs/development/libraries/libmcrypt/default.nix
index 50bbf8383e610..953a6d03e5e6c 100644
--- a/pkgs/development/libraries/libmcrypt/default.nix
+++ b/pkgs/development/libraries/libmcrypt/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = optional stdenv.isDarwin darwin.cctools;
 
-  configureFlags = optional disablePosixThreads
+  configureFlags = optionals disablePosixThreads
     [ "--disable-posix-threads" ];
 
   meta = {
diff --git a/pkgs/development/libraries/libpam-wrapper/default.nix b/pkgs/development/libraries/libpam-wrapper/default.nix
index 10d5c98b6687c..0701ae0fc55f5 100644
--- a/pkgs/development/libraries/libpam-wrapper/default.nix
+++ b/pkgs/development/libraries/libpam-wrapper/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sha256 = "00mqhsashx7njrvxz085d0b88nizhdy7m3x17ip5yhvwsl63km6p";
   };
 
-  nativeBuildInputs = [ cmake ] ++ lib.optional enablePython [ python ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals enablePython [ python ];
 
   # We must use linux-pam, using openpam will result in broken fprintd.
   buildInputs = [ linux-pam ];
diff --git a/pkgs/development/libraries/libpst/default.nix b/pkgs/development/libraries/libpst/default.nix
index f51db1d6c6ded..d6d33957b9a62 100644
--- a/pkgs/development/libraries/libpst/default.nix
+++ b/pkgs/development/libraries/libpst/default.nix
@@ -2,29 +2,29 @@
 , stdenv
 , fetchurl
 , autoreconfHook
-, pkg-config
 , bzip2
 , doxygen
 , gettext
 , imagemagick
 , libgsf
+, pkg-config
 , xmlto
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libpst";
   version = "0.6.76";
 
   src = fetchurl {
-    url = "http://www.five-ten-sg.com/libpst/packages/${pname}-${version}.tar.gz";
-    sha256 = "0hhbbb8ddsgjhv9y1xd8s9ixlhdnjmhw12v06jwx4j6vpgp1na9x";
+    url = "http://www.five-ten-sg.com/libpst/packages/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+    hash = "sha256-PSkb7rvbSNK5NGCLwGGVtkHaY9Ko9eDThvLp1tBaC0I=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
-    pkg-config
     doxygen
     gettext
+    pkg-config
     xmlto
   ];
 
@@ -35,9 +35,9 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--enable-python=no"
     "--disable-static"
     "--enable-libpst-shared"
+    "--enable-python=no"
   ];
 
   doCheck = true;
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.five-ten-sg.com/libpst/";
     description = "A library to read PST (MS Outlook Personal Folders) files";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.tohl ];
+    maintainers = [ ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/libtorrent-rasterbar/default.nix b/pkgs/development/libraries/libtorrent-rasterbar/default.nix
index 09788cfef71d3..d4812c6f08233 100644
--- a/pkgs/development/libraries/libtorrent-rasterbar/default.nix
+++ b/pkgs/development/libraries/libtorrent-rasterbar/default.nix
@@ -3,7 +3,7 @@
 }:
 
 let
-  version = "2.0.7";
+  version = "2.0.8";
 
   # Make sure we override python, so the correct version is chosen
   boostPython = boost.override { enablePython = true; inherit python; };
@@ -16,7 +16,7 @@ in stdenv.mkDerivation {
     owner = "arvidn";
     repo = "libtorrent";
     rev = "v${version}";
-    sha256 = "sha256-ikDtx1BIikVEL5jf37byNbuS+ft1lDtHUlFqegndapw=";
+    sha256 = "sha256-mMY3NiSL/lYuYmV/KWgfKbs8XukSV4PvQ87tpgBid6M=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index e3be4db26cd84..906a3c59234a3 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ xorg.libX11 ];
 
-  mesonFlags = lib.optional stdenv.isLinux
+  mesonFlags = lib.optionals stdenv.isLinux
     [ "-Dmoduledir=${mesa.drivers.driverLink}/lib/vdpau" ];
 
   NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lX11";
diff --git a/pkgs/development/libraries/libvncserver/default.nix b/pkgs/development/libraries/libvncserver/default.nix
index b9da7135f92e5..c111a81b0ccb5 100644
--- a/pkgs/development/libraries/libvncserver/default.nix
+++ b/pkgs/development/libraries/libvncserver/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     libpng
   ] ++ lib.optionals stdenv.isLinux [
     systemd
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     Carbon
   ];
 
diff --git a/pkgs/development/libraries/libxc/default.nix b/pkgs/development/libraries/libxc/default.nix
index 3d7021bf35a8e..1706653c71311 100644
--- a/pkgs/development/libraries/libxc/default.nix
+++ b/pkgs/development/libraries/libxc/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libxc";
-  version = "5.2.3";
+  version = "6.0.0";
 
   src = fetchFromGitLab {
     owner = "libxc";
     repo = "libxc";
     rev = version;
-    hash = "sha256-PuLpwhyyht+kkPUTrJTH+VTY5WuOhi2mIUDrFqubF+w=";
+    hash = "sha256-g1BjqzSVauDrzxIqqU2kLl6RFs6/oe2VthtndbnJQCc=";
   };
 
   nativeBuildInputs = [ perl cmake gfortran ];
diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index eadf6f91e1e07..db5f5026f2c15 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -1,44 +1,44 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, pkg-config, perl, fetchpatch }:
+{ lib, stdenv, fetchurl, perl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "libxcrypt";
   version = "4.4.28";
 
-  src = fetchFromGitHub {
-    owner = "besser82";
-    repo = "libxcrypt";
-    rev = "v${version}";
-    sha256 = "sha256-Ohf+RCOXnoCxAFnXXV9e2TCqpfZziQl+FGJTGDSQTF0=";
+  src = fetchurl {
+    url = "https://github.com/besser82/libxcrypt/releases/download/v${version}/libxcrypt-${version}.tar.xz";
+    sha256 = "sha256-npNoEfn60R28ozyhm9l8VcUus8oVkB8nreBGzHnmnoc=";
   };
 
-  patches = [
-    # Fix for tests on musl is being upstreamed:
-    # https://github.com/besser82/libxcrypt/pull/157
-    # Applied in all environments to prevent patchrot
-    (fetchpatch {
-      url = "https://github.com/besser82/libxcrypt/commit/a4228faa0b96986abc076125cf97d352a063d92f.patch";
-      sha256 = "sha256-iGNz8eer6OkA0yR74WisE6GbFTYyXKw7koXl/R7DhVE=";
-    })
+  outputs = [
+    "out"
+    "man"
   ];
 
-  preConfigure = ''
-    patchShebangs autogen.sh
-    ./autogen.sh
-  '';
-
   configureFlags = [
+    "--enable-hashes=all"
+    "--enable-obsolete-api=glibc"
+    "--disable-failure-tokens"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     "--disable-werror"
   ];
 
-  nativeBuildInputs = [ autoconf automake libtool pkg-config perl ];
+  nativeBuildInputs = [
+    perl
+  ];
+
+  enableParallelBuilding = true;
 
-  doCheck = true;
+  doCheck = !stdenv.hostPlatform.isMusl;
+
+  passthru.tests = {
+    inherit (nixosTests) login shadow;
+  };
 
   meta = with lib; {
     description = "Extended crypt library for descrypt, md5crypt, bcrypt, and others";
     homepage = "https://github.com/besser82/libxcrypt/";
     platforms = platforms.all;
-    maintainers = with maintainers; [ dottedmag ];
+    maintainers = with maintainers; [ dottedmag hexa ];
     license = licenses.lgpl21Plus;
   };
 }
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 474afc4ba6ca2..ae97292b68307 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , zlib
 , pkg-config
 , autoreconfHook
@@ -12,7 +11,7 @@
 , ncurses
 , findXMLCatalogs
 , libiconv
-, pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
+, pythonSupport ? enableShared
 , icuSupport ? false
 , icu
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
@@ -20,9 +19,19 @@
 , gnome
 }:
 
+let
+  # Newer versions fail with minimal python, probably because
+  # https://gitlab.gnome.org/GNOME/libxml2/-/commit/b706824b612adb2c8255819c9a55e78b52774a3c
+  # This case is encountered "temporarily" during stdenv bootstrapping on darwin.
+  # Beware that the old version has known security issues, so the final set shouldn't use it.
+  oldVer = python.pname == "python3-minimal";
+in
+  assert oldVer -> stdenv.isDarwin; # reduce likelihood of using old libxml2 unintentionally
+
 stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.10.0";
+  version = if oldVer then "2.10.1" else
+    "2.10.2";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
@@ -31,7 +40,8 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "LdMxEOp3hnbeFL6kmZ7hFzxMpV1f8UUryiJOBvAVJZU=";
+    sha256 = if oldVer then "21a9e13cc7c4717a6c36268d0924f92c3f67a1ece6b7ff9d588958a6db9fb9d8" else
+      "0kCr5tqcZcsZAN2b86NQHM+Is8Khy5gxfQPyct2lsmU=";
   };
 
   patches = [
@@ -47,19 +57,10 @@ stdenv.mkDerivation rec {
     #   https://github.com/NixOS/nixpkgs/pull/63174
     #   https://github.com/NixOS/nixpkgs/pull/72342
     ./utf8-xmlErrorFuncHandler.patch
-
-    # Fix PostgreSQL tests
-    # https://gitlab.gnome.org/GNOME/libxml2/-/issues/397
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/4ad71c2d72beef0d10cf75aa417db10d77846f75.patch";
-      sha256 = "gubGDhBhHNYdEty+sFQFd3pSWB9isN5AjD//ksujGQk=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/5b2d07a72670513e41b481a9d922c983a64027ca.patch";
-      sha256 = "7jYvMW6bgImXubbaWpQhrIw3xBBnaNn+iJt3EQiW3yU=";
-    })
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
@@ -94,7 +95,8 @@ stdenv.mkDerivation rec {
     (lib.enableFeature enableStatic "static")
     (lib.enableFeature enableShared "shared")
     (lib.withFeature icuSupport "icu")
-    (lib.withFeatureAs pythonSupport "python" python)
+    (lib.withFeature pythonSupport "python")
+    (lib.optionalString pythonSupport "PYTHON=${python.pythonForBuild.interpreter}")
   ];
 
   installFlags = lib.optionals pythonSupport [
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index 29c6938911622..9d39c6bf8b34a 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -8,32 +8,35 @@
 , gettext
 , python
 , ncurses
+, libxcrypt
 , libgcrypt
 , cryptoSupport ? false
-, pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
+, pythonSupport ? true
 , gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "libxslt";
-  version = "1.1.36";
+  version = "1.1.37";
 
   outputs = [ "bin" "dev" "out" "doc" "devdoc" ] ++ lib.optional pythonSupport "py";
   outputMan = "bin";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "EoSPCkQI9ltTDTlizZ/2cLaueWGRz+/zdSK1dy3o3I4=";
+    sha256 = "Oksn3IAnzNYUZyWVAzbx7FIJKPMg8UTrX6eZCuYSOrQ=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
   ];
 
   buildInputs = [
-    libxml2.dev
-  ] ++ lib.optional stdenv.isDarwin [
+    libxml2.dev libxcrypt
+  ] ++ lib.optionals stdenv.isDarwin [
     gettext
   ] ++ lib.optionals pythonSupport [
     libxml2.py
@@ -51,7 +54,8 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-    (lib.withFeatureAs pythonSupport "python" python)
+    (lib.withFeature pythonSupport "python")
+    (lib.optionalString pythonSupport "PYTHON=${python.pythonForBuild.interpreter}")
   ] ++ lib.optionals (!cryptoSupport) [
     "--without-crypto"
   ];
diff --git a/pkgs/development/libraries/matrix-sdk-crypto-nodejs/default.nix b/pkgs/development/libraries/matrix-sdk-crypto-nodejs/default.nix
index afb52ddd6b3c8..cce2c24f184df 100644
--- a/pkgs/development/libraries/matrix-sdk-crypto-nodejs/default.nix
+++ b/pkgs/development/libraries/matrix-sdk-crypto-nodejs/default.nix
@@ -23,10 +23,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-G2Um7vHinOuOx9U2BH14LAx+s/0Sxtlc9Nz6nPJfmU8=";
   };
 
-  postPatch = ''
-    cd bindings/${pname}
-  '';
-
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
     rustPlatform.rust.cargo
@@ -40,6 +36,7 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     runHook preBuild
 
+    cd bindings/${pname}
     npm run release-build --offline
 
     runHook postBuild
diff --git a/pkgs/development/libraries/mesa/aarch64-darwin.patch b/pkgs/development/libraries/mesa/aarch64-darwin.patch
deleted file mode 100644
index e60a4ffa308ad..0000000000000
--- a/pkgs/development/libraries/mesa/aarch64-darwin.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 8ac29b952e638ec1ea8c3734a3b91253e50c336d Mon Sep 17 00:00:00 2001
-From: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
-Date: Sun, 24 Jan 2021 21:10:29 -0800
-Subject: [PATCH 4/4] Hack to address build failure when using newer macOS SDKs
- with older deployment targets
-
-Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
----
- include/c11/threads_posix.h | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/include/c11/threads_posix.h b/include/c11/threads_posix.h
-index 45cb6075e6e..355d725f7da 100644
---- a/include/c11/threads_posix.h
-+++ b/include/c11/threads_posix.h
-@@ -382,7 +382,13 @@ tss_set(tss_t key, void *val)
- 
- /*-------------------- 7.25.7 Time functions --------------------*/
- // 7.25.6.1
--#ifndef HAVE_TIMESPEC_GET
-+#if !defined(HAVE_TIMESPEC_GET) || defined(__APPLE__)
-+
-+#ifdef __APPLE__
-+#include <time.h>
-+#define timespec_get(ts, b) mesa_timespec_get(ts, b)
-+#endif
-+
- static inline int
- timespec_get(struct timespec *ts, int base)
- {
--- 
-2.29.2 (Apple Git-129)
-
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 6b78a570cccb8..0fbc3f0c2164c 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -5,7 +5,7 @@
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
 , libglvnd, libunwind
-, vulkan-loader
+, vulkan-loader, glslang
 , galliumDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
@@ -14,6 +14,7 @@
 , enableGalliumNine ? stdenv.isLinux
 , enableOSMesa ? stdenv.isLinux
 , enableOpenCL ? stdenv.isLinux && stdenv.isx86_64
+, enablePatentEncumberedCodecs ? true
 , libclc
 , jdupes
 }:
@@ -34,7 +35,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.1.7";
+  version = "22.2.1";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -43,12 +44,13 @@ self = stdenv.mkDerivation {
 
   src = fetchurl {
     urls = [
+      "https://archive.mesa3d.org/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "da838eb2cf11d0e08d0e9944f6bd4d96987fdc59ea2856f8c70a31a82b355d89";
+    sha256 = "0079beac0a33f45e7e0aec59e6913eafbc4268a3f1e2e330017440494f91b13c";
   };
 
   # TODO:
@@ -57,25 +59,9 @@ self = stdenv.mkDerivation {
   patches = [
     # fixes pkgsMusl.mesa build
     ./musl.patch
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-endian.patch";
-      hash = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk=";
-    })
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-stacksize.patch";
-      hash = "sha256-bEp0AWddsw1Pc3rxdKN8fsrX4x2TQEzMUa5afhLXGsg=";
-    })
 
     ./opencl.patch
     ./disk_cache-include-dri-driver-path-in-cache-key.patch
-  ] ++ optionals (stdenv.isDarwin && stdenv.isAarch64) [
-    # Fix aarch64-darwin build, remove when upstreaam supports it out of the box.
-    # See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/1020
-    ./aarch64-darwin.patch
-  ] ++ optionals stdenv.isDarwin [
-    # 22.1 on darwin won't build: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6519
-    # (already in-tree for 22.2)
-    ./drop-dri2.patch
   ];
 
   postPatch = ''
@@ -86,6 +72,8 @@ self = stdenv.mkDerivation {
       'DATADIR "/drirc.d"' '"${placeholder "out"}/share/drirc.d"'
     substituteInPlace src/util/meson.build --replace \
       "get_option('datadir')" "'${placeholder "out"}/share'"
+    substituteInPlace src/amd/vulkan/meson.build --replace \
+      "get_option('datadir')" "'${placeholder "out"}/share'"
   '';
 
   outputs = [ "out" "dev" "drivers" ]
@@ -130,7 +118,8 @@ self = stdenv.mkDerivation {
   ] ++ optionals enableOpenCL [
     "-Dgallium-opencl=icd" # Enable the gallium OpenCL frontend
     "-Dclang-libdir=${llvmPackages.clang-unwrapped.lib}/lib"
-  ];
+  ] ++ optional enablePatentEncumberedCodecs
+    "-Dvideo-codecs=h264dec,h264enc,h265dec,h265enc,vc1dec";
 
   buildInputs = with xorg; [
     expat llvmPackages.libllvm libglvnd xorgproto
@@ -151,7 +140,7 @@ self = stdenv.mkDerivation {
     meson pkg-config ninja
     intltool bison flex file
     python3Packages.python python3Packages.Mako
-    jdupes
+    jdupes glslang
   ] ++ lib.optionals (elem "wayland" eglPlatforms) [
     wayland-scanner
   ];
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index fa78f4ae730ad..445f26c6bd109 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -1,21 +1,16 @@
-From 980164fd92f5c2302624cd046d30ff21e6e4ba8a Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Mon, 6 Aug 2018 15:52:11 -0300
-Subject: [PATCH] disk_cache: include dri driver path in cache key
+Author: David McFarland <corngood@gmail.com>
+Date:   Mon Aug 6 15:52:11 2018 -0300
 
-This fixes invalid cache hits on NixOS where all shared library
-timestamps in /nix/store are zero.
----
- meson_options.txt     | 6 ++++++
- src/util/disk_cache.c | 3 +++
- src/util/meson.build  | 7 ++++++-
- 3 files changed, 15 insertions(+), 1 deletion(-)
+    [PATCH] disk_cache: include dri driver path in cache key
+    
+    This fixes invalid cache hits on NixOS where all shared library
+    timestamps in /nix/store are zero.
 
 diff --git a/meson_options.txt b/meson_options.txt
-index 2d39d13b6ad..daf06480a60 100644
+index b8f753e2e1a..70d9071c8be 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -368,6 +368,12 @@ option(
+@@ -452,6 +452,12 @@ option(
    value : true,
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
@@ -25,14 +20,14 @@ index 2d39d13b6ad..daf06480a60 100644
 +  value : '',
 +  description : 'Mesa cache key.'
 +)
- option(
-   'prefer-iris',
-   type : 'boolean',
+ option('egl-lib-suffix',
+   type : 'string',
+   value : '',
 diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index a92d621927a..3bd65c6890c 100644
+index 8dbe0938d11..498fe42de70 100644
 --- a/src/util/disk_cache.c
 +++ b/src/util/disk_cache.c
-@@ -401,8 +401,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -194,8 +194,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
  
     /* Create driver id keys */
     size_t id_size = strlen(driver_id) + 1;
@@ -43,7 +38,7 @@ index a92d621927a..3bd65c6890c 100644
     cache->driver_keys_blob_size += gpu_name_size;
  
     /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -423,6 +425,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -216,6 +218,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
     uint8_t *drv_key_blob = cache->driver_keys_blob;
     DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
     DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
@@ -52,13 +47,13 @@ index a92d621927a..3bd65c6890c 100644
     DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
     DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
 diff --git a/src/util/meson.build b/src/util/meson.build
-index 0893f64793b..d46ce85a85f 100644
+index cd44e49bfb4..f17115515a5 100644
 --- a/src/util/meson.build
 +++ b/src/util/meson.build
-@@ -179,7 +179,12 @@ _libmesa_util = static_library(
+@@ -268,7 +268,12 @@ _libmesa_util = static_library(
    include_directories : [inc_include, inc_src, inc_mapi, inc_mesa, inc_gallium, inc_gallium_aux],
    dependencies : deps_for_libmesa_util,
-   link_with: libmesa_format,
+   link_with: [libmesa_format, libmesa_util_sse41],
 -  c_args : [c_msvc_compat_args],
 +  c_args : [
 +    c_msvc_compat_args,
@@ -69,6 +64,3 @@ index 0893f64793b..d46ce85a85f 100644
    gnu_symbol_visibility : 'hidden',
    build_by_default : false
  )
--- 
-2.28.0
-
diff --git a/pkgs/development/libraries/mesa/drop-dri2.patch b/pkgs/development/libraries/mesa/drop-dri2.patch
deleted file mode 100644
index 8c2b85a55aae9..0000000000000
--- a/pkgs/development/libraries/mesa/drop-dri2.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff --git a/a/src/gallium/frontends/dri/dri_util.c b/b/src/gallium/frontends/dri/dri_util.c
-index 8d60526..782360d 100644
---- a/src/gallium/frontends/dri/dri_util.c
-+++ b/src/gallium/frontends/dri/dri_util.c
-@@ -808,35 +808,6 @@ const __DRIcoreExtension driCoreExtension = {
-     .unbindContext              = driUnbindContext
- };
- 
--/** DRI2 interface */
--const __DRIdri2Extension driDRI2Extension = {
--    .base = { __DRI_DRI2, 4 },
--
--    .createNewScreen            = dri2CreateNewScreen,
--    .createNewDrawable          = driCreateNewDrawable,
--    .createNewContext           = driCreateNewContext,
--    .getAPIMask                 = driGetAPIMask,
--    .createNewContextForAPI     = driCreateNewContextForAPI,
--    .allocateBuffer             = dri2AllocateBuffer,
--    .releaseBuffer              = dri2ReleaseBuffer,
--    .createContextAttribs       = driCreateContextAttribs,
--    .createNewScreen2           = driCreateNewScreen2,
--};
--
--const __DRIdri2Extension swkmsDRI2Extension = {
--    .base = { __DRI_DRI2, 4 },
--
--    .createNewScreen            = swkmsCreateNewScreen,
--    .createNewDrawable          = driCreateNewDrawable,
--    .createNewContext           = driCreateNewContext,
--    .getAPIMask                 = driGetAPIMask,
--    .createNewContextForAPI     = driCreateNewContextForAPI,
--    .allocateBuffer             = dri2AllocateBuffer,
--    .releaseBuffer              = dri2ReleaseBuffer,
--    .createContextAttribs       = driCreateContextAttribs,
--    .createNewScreen2           = driCreateNewScreen2,
--};
--
- const __DRIswrastExtension driSWRastExtension = {
-     .base = { __DRI_SWRAST, 4 },
- 
diff --git a/pkgs/development/libraries/mesa/opencl.patch b/pkgs/development/libraries/mesa/opencl.patch
index ce6e3d575085b..d220239770d58 100644
--- a/pkgs/development/libraries/mesa/opencl.patch
+++ b/pkgs/development/libraries/mesa/opencl.patch
@@ -1,5 +1,5 @@
 diff --git a/meson_options.txt b/meson_options.txt
-index a7030aba31e..1d2d8814992 100644
+index b8f753e2e1a..2163e3ab7ee 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -18,6 +18,12 @@
@@ -16,7 +16,7 @@ index a7030aba31e..1d2d8814992 100644
    'platforms',
    type : 'array',
 diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
-index b77826b6e1e..14fa9ba7177 100644
+index 14df6b86f7f..adcd5110342 100644
 --- a/src/gallium/targets/opencl/meson.build
 +++ b/src/gallium/targets/opencl/meson.build
 @@ -30,6 +30,7 @@ if with_ld_version_script
@@ -60,11 +60,12 @@ index b77826b6e1e..14fa9ba7177 100644
      polly_dep, polly_isl_dep,
    ]
    # check clang once more
-@@ -120,6 +121,6 @@ if with_opencl_icd
+@@ -112,7 +113,7 @@ if with_opencl_icd
      input : 'mesa.icd.in',
      output : 'mesa.icd',
      install : true,
 -    install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
 +    install_dir : join_paths(get_option('prefix'), 'etc', 'OpenCL', 'vendors'),
    )
- endif
+ 
+   if meson.version().version_compare('>= 0.58')
diff --git a/pkgs/development/libraries/mimalloc/default.nix b/pkgs/development/libraries/mimalloc/default.nix
index cc67e2070949a..6dcf1978edcfb 100644
--- a/pkgs/development/libraries/mimalloc/default.nix
+++ b/pkgs/development/libraries/mimalloc/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake ninja ];
-  cmakeFlags = [ "-DMI_INSTALL_TOPLEVEL=ON" ] ++ lib.optional secureBuild [ "-DMI_SECURE=ON" ];
+  cmakeFlags = [ "-DMI_INSTALL_TOPLEVEL=ON" ] ++ lib.optionals secureBuild [ "-DMI_SECURE=ON" ];
 
   postInstall = let
     rel = lib.versions.majorMinor version;
diff --git a/pkgs/development/libraries/mlt/default.nix b/pkgs/development/libraries/mlt/default.nix
index b602573706c47..bd83e1caf5726 100644
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     description = "Open source multimedia framework, designed for television broadcasting";
     homepage = "https://www.mltframework.org";
     license = with licenses; [ gpl3Only gpl2Only lgpl21Only ];
-    maintainers = with maintainers; [ tohl peti ];
+    maintainers = with maintainers; [ peti ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index 6d28b79565e7f..8e3264dcbc510 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -6,7 +6,7 @@
 
 # Optional dependencies
 , enableApp ? with stdenv.hostPlatform; !isWindows && !isStatic
-, c-ares, libev, openssl, zlib
+, c-aresMinimal, libev, openssl, zlib
 , enableAsioLib ? false, boost
 , enableGetAssets ? false, libxml2
 , enableHpack ? false, jansson
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals (enableApp) [ installShellFiles ]
     ++ lib.optionals (enablePython) [ python3Packages.cython ];
 
-  buildInputs = lib.optionals enableApp [ c-ares libev openssl zlib ]
+  buildInputs = lib.optionals enableApp [ c-aresMinimal libev openssl zlib ]
     ++ lib.optionals (enableAsioLib) [ boost ]
     ++ lib.optionals (enableGetAssets) [ libxml2 ]
     ++ lib.optionals (enableHpack) [ jansson ]
diff --git a/pkgs/development/libraries/nng/default.nix b/pkgs/development/libraries/nng/default.nix
index 9acc64fea6423..7f0bd15aa542e 100644
--- a/pkgs/development/libraries/nng/default.nix
+++ b/pkgs/development/libraries/nng/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ninja ]
     ++ lib.optionals mbedtlsSupport [ mbedtls ];
 
-  buildInputs = lib.optional mbedtlsSupport [ mbedtls ];
+  buildInputs = lib.optionals mbedtlsSupport [ mbedtls ];
 
   cmakeFlags = [ "-G Ninja" "-DNNG_ENABLE_TLS=ON" ]
     ++ lib.optionals mbedtlsSupport [ "-DMBEDTLS_ROOT_DIR=${mbedtls}" ];
diff --git a/pkgs/development/libraries/oneDNN/default.nix b/pkgs/development/libraries/oneDNN/default.nix
index 3fc8cb7df0cd3..f5e5a2e03d2cc 100644
--- a/pkgs/development/libraries/oneDNN/default.nix
+++ b/pkgs/development/libraries/oneDNN/default.nix
@@ -5,13 +5,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation rec {
   pname = "oneDNN";
-  version = "2.7";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${version}";
-    sha256 = "sha256-b0cBExzS4rsdSmZ8uPtM8+Djy2ncvuGVEwLsf2h0Sro=";
+    sha256 = "sha256-HBCuSZkApd/6UkAxz/KDFb/gyX2SI1S2GwgXAXSTU/c=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/openbsm/default.nix b/pkgs/development/libraries/openbsm/default.nix
index 4719b7fb74704..627e9b830714c 100644
--- a/pkgs/development/libraries/openbsm/default.nix
+++ b/pkgs/development/libraries/openbsm/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0b98359hd8mm585sh145ss828pg2y8vgz38lqrb7nypapiyqdnd1";
   };
 
-  patches = lib.optional stdenv.isDarwin [ ./bsm-add-audit_token_to_pid.patch ];
+  patches = lib.optionals stdenv.isDarwin [ ./bsm-add-audit_token_to_pid.patch ];
 
   preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
     MACOSX_DEPLOYMENT_TARGET=10.16
diff --git a/pkgs/development/libraries/opencl-headers/default.nix b/pkgs/development/libraries/opencl-headers/default.nix
index 273cdea6f8c9b..e5300e9731ac2 100644
--- a/pkgs/development/libraries/opencl-headers/default.nix
+++ b/pkgs/development/libraries/opencl-headers/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opencl-headers";
-  version = "2022.09.23";
+  version = "2022.09.30";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-Headers";
     rev = "v${version}";
-    sha256 = "sha256-kBXkevcapVfpFmI5C77DwULrC8zjcoto+veb49Ksixk=";
+    sha256 = "sha256-Vbh+bt/g+7glEyqMYCKTANggaIOW/n1L3TaCNouc/28=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 550a7f39373a0..56b022d03b9b5 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -248,7 +248,7 @@ stdenv.mkDerivation {
     "-DBUILD_opencv_videoio=OFF"
   ] ++ lib.optionals enablePython [
     "-DOPENCV_SKIP_PYTHON_LOADER=ON"
-  ] ++ lib.optional enableEigen [
+  ] ++ lib.optionals enableEigen [
     # Autodetection broken by https://github.com/opencv/opencv/pull/13337
     "-DEIGEN_INCLUDE_PATH=${eigen}/include/eigen3"
   ];
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index f357b8d4b7208..97a84356f8181 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -11,6 +11,7 @@
 , libtool
 , openssl
 , systemdMinimal
+, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -43,6 +44,7 @@ stdenv.mkDerivation rec {
     libtool
     openssl
   ] ++ lib.optionals (stdenv.isLinux) [
+    libxcrypt # causes linking issues on *-darwin
     systemdMinimal
   ];
 
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 723f1848c6a06..f2392bb00726a 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
     ++ lib.optionals cudaSupport [ cudatoolkit ]
     ++ [ libevent hwloc ]
     ++ lib.optional (stdenv.isLinux || stdenv.isFreeBSD) rdma-core
-    ++ lib.optional fabricSupport [ libpsm2 libfabric ];
+    ++ lib.optionals fabricSupport [ libpsm2 libfabric ];
 
   nativeBuildInputs = [ perl ]
     ++ lib.optionals fortranSupport [ gfortran ];
diff --git a/pkgs/development/libraries/openvino/default.nix b/pkgs/development/libraries/openvino/default.nix
index dabf56d9056b1..e3ebb97cbdff4 100644
--- a/pkgs/development/libraries/openvino/default.nix
+++ b/pkgs/development/libraries/openvino/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     "-DNGRAPH_UNIT_TEST_ENABLE:BOOL=OFF"
     "-DENABLE_SAMPLES:BOOL=OFF"
     "-DENABLE_CPPLINT:BOOL=OFF"
-  ] ++ lib.optional enablePython [
+  ] ++ lib.optionals enablePython [
     "-DENABLE_PYTHON:BOOL=ON"
   ];
 
@@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
     python
     tbb
     shellcheck
-  ] ++ lib.optional enablePython (with python.pkgs; [
+  ] ++ lib.optionals enablePython (with python.pkgs; [
     cython
     pybind11
   ]);
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index fee4a2e8259fe..1f2646a03638d 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
       "/etc/ssl/certs/ca-certificates.crt"     # NixOS + Debian/Ubuntu/Arch/Gentoo...
       "/etc/pki/tls/certs/ca-bundle.crt"       # Fedora/CentOS
       "/var/lib/ca-certificates/ca-bundle.pem" # openSUSE
+      "/etc/ssl/cert.pem"                      # Darwin/macOS
     ]}"
   ];
 
diff --git a/pkgs/development/libraries/paho-mqtt-c/default.nix b/pkgs/development/libraries/paho-mqtt-c/default.nix
new file mode 100644
index 0000000000000..37a829088d819
--- /dev/null
+++ b/pkgs/development/libraries/paho-mqtt-c/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchFromGitHub, cmake, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "paho.mqtt.c";
+  version = "1.3.11";
+
+  src = fetchFromGitHub {
+    owner = "eclipse";
+    repo = "paho.mqtt.c";
+    rev = "v${version}";
+    hash = "sha256-TGCWA9tOOx0rCb/XQWqLFbXb9gOyGS8u6o9fvSRS6xI=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/MQTTVersion.c \
+      --replace "namebuf[60]" "namebuf[120]" \
+      --replace "lib%s" "$out/lib/lib%s"
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ openssl ];
+
+  cmakeFlags = [ "-DPAHO_WITH_SSL=TRUE" ];
+
+  meta = with lib; {
+    description = "Eclipse Paho MQTT C Client Library";
+    homepage = "https://www.eclipse.org/paho/";
+    license = licenses.epl20;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/paho-mqtt-cpp/default.nix b/pkgs/development/libraries/paho-mqtt-cpp/default.nix
new file mode 100644
index 0000000000000..b62e774ba5139
--- /dev/null
+++ b/pkgs/development/libraries/paho-mqtt-cpp/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, cmake, openssl, paho-mqtt-c }:
+
+stdenv.mkDerivation rec {
+  pname = "paho.mqtt.cpp";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "eclipse";
+    repo = "paho.mqtt.cpp";
+    rev = "v${version}";
+    hash = "sha256-tcq0a4X5dKE4rnczRMAVe3Wt43YzUKbxsv9Sk+q+IB8=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ openssl paho-mqtt-c ];
+
+  meta = with lib; {
+    description = "Eclipse Paho MQTT C++ Client Library";
+    homepage = "https://www.eclipse.org/paho/";
+    license = licenses.epl10;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/pangomm/2.48.nix b/pkgs/development/libraries/pangomm/2.48.nix
index 478378f64c271..52affe360f84c 100644
--- a/pkgs/development/libraries/pangomm/2.48.nix
+++ b/pkgs/development/libraries/pangomm/2.48.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     python3
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices
   ];
 
diff --git a/pkgs/development/libraries/physics/cernlib/default.nix b/pkgs/development/libraries/physics/cernlib/default.nix
index 77ad6e201a32b..8eae6fcaad55c 100644
--- a/pkgs/development/libraries/physics/cernlib/default.nix
+++ b/pkgs/development/libraries/physics/cernlib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gfortran, imake, makedepend, motif, xorg }:
+{ lib, stdenv, fetchurl, gfortran, imake, makedepend, motif, xorg, libxcrypt }:
 
 stdenv.mkDerivation rec {
   version = "2006";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0awla1rl96z82br7slcmg8ks1d2a7slk6dj79ywb871j2ksi3fky";
   };
 
-  buildInputs = with xorg; [ gfortran motif libX11 libXft libXt ];
+  buildInputs = with xorg; [ gfortran motif libX11 libXft libXt libxcrypt ];
   nativeBuildInputs = [ imake makedepend ];
   sourceRoot = ".";
 
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index a02ecc1e9b743..f2907afab0188 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPackages
 , fetchFromGitLab
+, fetchpatch
 , removeReferencesTo
 , python3
 , meson
@@ -45,6 +46,7 @@
 , sbc
 , libfreeaptx
 , ldacbt
+, liblc3
 , fdk_aac
 , libopus
 , nativeHspSupport ? true
@@ -70,7 +72,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.58";
+    version = "0.3.59";
 
     outputs = [
       "out"
@@ -88,7 +90,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-r8sDXyXwtA2o2xqglOI8XflttSScrqJ57cj1//k2tZ8=";
+      sha256 = "sha256-4wDtdgkjBRlthhwbI3cSQFnbr+gxPQP5j5YnrWiQVp4=";
     };
 
     patches = [
@@ -104,6 +106,12 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
+
+      # remove when updating to 0.3.60
+      (fetchpatch { # filter-chain: iterate the port correctly
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/94a64268613adac8ef6f3e6c1f04468220540d00.patch";
+        sha256 = "sha256-IDTB7NgadgR3vKv97Nvd9pBfnOnMi21YsvLdD1Ew7HE=";
+      })
     ];
 
     nativeBuildInputs = [
@@ -134,7 +142,7 @@ let
     ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
     ++ lib.optionals libcameraSupport [ libcamera libdrm ]
     ++ lib.optional ffmpegSupport ffmpeg
-    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt sbc fdk_aac libopus ]
+    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt liblc3 sbc fdk_aac libopus ]
     ++ lib.optional pulseTunnelSupport libpulseaudio
     ++ lib.optional zeroconfSupport avahi
     ++ lib.optional raopSupport openssl
@@ -167,6 +175,7 @@ let
       "-Dbluez5-backend-ofono=${mesonEnableFeature ofonoSupport}"
       "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
       "-Dbluez5-codec-lc3plus=disabled"
+      "-Dbluez5-codec-lc3=${mesonEnableFeature bluezSupport}"
       "-Dsysconfdir=/etc"
       "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
       "-Draop=${mesonEnableFeature raopSupport}"
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index cba1af7046079..8ff218b79316c 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: rec {
     pcre
     libiconv
     libintl
-  ] ++ lib.optional withData [
+  ] ++ lib.optionals withData [
     poppler_data
   ];
 
diff --git a/pkgs/development/libraries/popt/default.nix b/pkgs/development/libraries/popt/default.nix
index 307408e4db1d5..37d83ff5b2b2a 100644
--- a/pkgs/development/libraries/popt/default.nix
+++ b/pkgs/development/libraries/popt/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "popt";
-  version = "1.18";
+  version = "1.19";
 
   src = fetchurl {
     url = "https://ftp.osuosl.org/pub/rpm/popt/releases/popt-1.x/popt-${version}.tar.gz";
-    sha256 = "1lf5zlj5rbg6s4bww7hbhpca97prgprnarx978vcwa0bl81vqnai";
+    sha256 = "sha256-wlpIOPyOTByKrLi9Yg7bMISj1jv4mH/a08onWMYyQPk=";
   };
 
   patches = lib.optionals stdenv.isCygwin [
diff --git a/pkgs/development/libraries/precice/default.nix b/pkgs/development/libraries/precice/default.nix
index bc6a9359e614f..01ab32577cb26 100644
--- a/pkgs/development/libraries/precice/default.nix
+++ b/pkgs/development/libraries/precice/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     "-DPYTHON_INCLUDE_DIR=${python3}/include/${python3.libPrefix}"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [ "-D_GNU_SOURCE" ];
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [ "-D_GNU_SOURCE" ];
 
   nativeBuildInputs = [ cmake gcc ];
   buildInputs = [ boost eigen libxml2 mpi python3 python3.pkgs.numpy ];
diff --git a/pkgs/development/libraries/protobuf/3.7.nix b/pkgs/development/libraries/protobuf/3.7.nix
deleted file mode 100644
index 9bfb307e3286a..0000000000000
--- a/pkgs/development/libraries/protobuf/3.7.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... }:
-
-callPackage ./generic-v3.nix {
-  version = "3.7.1";
-  sha256 = "00zkijvj80bmhlj8290x4bc416mng2dlbzwc4bkvfmbal1fx93m2";
-}
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 8c40a49ac0a7f..ef625a7c763db 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -36,7 +36,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
   qtwebengine =
     let
-      branchName = "5.15.8";
+      branchName = "5.15.11";
       rev = "v${branchName}-lts";
     in
     {
@@ -44,11 +44,11 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
       src = fetchgit {
         url = "https://github.com/qt/qtwebengine.git";
-        sha256 = "04xhg5qpnxm8hzgkanml45za64c9i5pbxhki2l2wcq4b4y7f3hyr";
+        sha256 = "sha256-yrKPof18G10VjrwCn/4E/ywlpATJQZjvmVeM+9hLY0U=";
         inherit rev branchName;
         fetchSubmodules = true;
         leaveDotGit = true;
-        name = "qtwebengine-${lib.substring 0 7 rev}.tar.gz";
+        name = "qtwebengine-${lib.substring 0 8 rev}.tar.gz";
         postFetch = ''
           # remove submodule .git directory
           rm -rf "$out/src/3rdparty/.git"
diff --git a/pkgs/development/libraries/qt-5/modules/qtlocation.nix b/pkgs/development/libraries/qt-5/modules/qtlocation.nix
index 687571f18d296..b5fdc918dc69a 100644
--- a/pkgs/development/libraries/qt-5/modules/qtlocation.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtlocation.nix
@@ -4,7 +4,7 @@ qtModule {
   pname = "qtlocation";
   qtInputs = [ qtbase qtmultimedia ];
   outputs = [ "bin" "out" "dev" ];
-  qmakeFlags = lib.optional stdenv.isDarwin [
+  qmakeFlags = lib.optionals stdenv.isDarwin [
      # boost uses std::auto_ptr which has been disabled in clang with libcxx
      # This flag re-enables this feature
      # https://libcxx.llvm.org/docs/UsingLibcxx.html#c-17-specific-configuration-macros
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index ece389b98ea38..120caae9a440c 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -262,6 +262,6 @@ qtModule {
     # and qtwebengine 5.14+ requires at least SDK 10.14
     # (qtwebengine 5.12 is fine with SDK 10.12)
     # on aarch64-darwin we are already at MacOS SDK 11.0
-    broken = stdenv.isDarwin && stdenv.isx86_64 && (lib.versionAtLeast qtCompatVersion "5.14");
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/libraries/redis-plus-plus/default.nix b/pkgs/development/libraries/redis-plus-plus/default.nix
index 7d3d7d486714e..61e593d28c930 100644
--- a/pkgs/development/libraries/redis-plus-plus/default.nix
+++ b/pkgs/development/libraries/redis-plus-plus/default.nix
@@ -22,9 +22,9 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DREDIS_PLUS_PLUS_BUILD_TEST=OFF"
-  ] ++ lib.optional (!enableShared) [
+  ] ++ lib.optionals (!enableShared) [
     "-DREDIS_PLUS_PLUS_BUILD_SHARED=OFF"
-  ] ++ lib.optional (!enableStatic) [
+  ] ++ lib.optionals (!enableStatic) [
     "-DREDIS_PLUS_PLUS_BUILD_STATIC=OFF"
   ];
 
diff --git a/pkgs/development/libraries/rustc-demangle/default.nix b/pkgs/development/libraries/rustc-demangle/default.nix
index be02fedfde717..e0329085bd56e 100644
--- a/pkgs/development/libraries/rustc-demangle/default.nix
+++ b/pkgs/development/libraries/rustc-demangle/default.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
     ./add-Cargo.lock.patch
   ];
   cargoSha256 = "sha256-1tW5TOap5MstxTXAFij3IB8TIpI+FryEX9TXlVXjRl4=";
-  cargoBuildFlags = "-p rustc-demangle-capi";
+  cargoBuildFlags = [ "-p" "rustc-demangle-capi" ];
   postInstall = ''
     mkdir -p $out/lib
     cp target/${rust.toRustTargetSpec stdenv.hostPlatform}/release/librustc_demangle.so $out/lib
diff --git a/pkgs/development/libraries/science/math/cudnn/extension.nix b/pkgs/development/libraries/science/math/cudnn/extension.nix
index bd7935783b738..ac22faeabb02c 100644
--- a/pkgs/development/libraries/science/math/cudnn/extension.nix
+++ b/pkgs/development/libraries/science/math/cudnn/extension.nix
@@ -2,6 +2,7 @@ final: prev: let
 
   inherit (final) callPackage;
   inherit (prev) cudatoolkit cudaVersion lib pkgs;
+  inherit (prev.lib.versions) major;
 
   ### CuDNN
 
@@ -27,7 +28,9 @@ final: prev: let
     # Add all supported builds as attributes
     allBuilds = mapAttrs' (version: file: nameValuePair (computeName version) (buildCuDnnPackage (removeAttrs file ["fileVersion"]))) supportedVersions;
     # Set the default attributes, e.g. cudnn = cudnn_8_3_1;
-    defaultBuild = { "cudnn" = allBuilds.${computeName cuDnnDefaultVersion}; };
+    defaultBuild = { "cudnn" = if allBuilds ? ${computeName cuDnnDefaultVersion}
+      then allBuilds.${computeName cuDnnDefaultVersion}
+      else throw "cudnn-${cuDnnDefaultVersion} does not support your cuda version ${cudaVersion}"; };
   in allBuilds // defaultBuild;
 
   cuDnnVersions = let
@@ -113,21 +116,54 @@ final: prev: let
         supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" "11.7" ];
       }
     ];
+    "8.5.0" = [
+      rec {
+        fileVersion = "10.2";
+        fullVersion = "8.5.0.96";
+        hash = "sha256-1mzhbbzR40WKkHnQLtJHhg0vYgf7G8a0OBcCwIOkJjM=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        supportedCudaVersions = [ "10.2" ];
+      }
+      rec {
+        fileVersion = "11.7";
+        fullVersion = "8.5.0.96";
+        hash = "sha256-VFSm/ZTwCHKMqumtrZk8ToXvNjAuJrzkO+p9RYpee20=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" "11.7" ];
+      }
+    ];
+    "8.6.0" = [
+      rec {
+        fileVersion = "10.2";
+        fullVersion = "8.6.0.163";
+        hash = "sha256-t4sr/GrFqqdxu2VhaJQk5K1Xm/0lU4chXG8hVL09R9k=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        supportedCudaVersions = [ "10.2" ];
+      }
+      rec {
+        fileVersion = "11.8";
+        fullVersion = "8.6.0.163";
+        hash = "sha256-u8OW30cpTGV+3AnGAGdNYIyxv8gLgtz0VHBgwhcRFZ4=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" "11.7" "11.8" ];
+      }
+    ];
   };
 
   # Default attributes
   cuDnnDefaultVersion = {
     "10.0" = "7.4.2";
     "10.1" = "7.6.5";
-    "10.2" = "8.3.2";
-    "11.0" = "8.3.2";
-    "11.1" = "8.3.2";
-    "11.2" = "8.3.2";
-    "11.3" = "8.3.2";
-    "11.4" = "8.3.2";
-    "11.5" = "8.3.2";
-    "11.6" = "8.3.2";
-    "11.7" = "8.4.0";
-  }.${cudaVersion} or "8.3.2";
+    "10.2" = "8.6.0";
+    "11.0" = "8.6.0";
+    "11.1" = "8.6.0";
+    "11.2" = "8.6.0";
+    "11.3" = "8.6.0";
+    "11.4" = "8.6.0";
+    "11.5" = "8.6.0";
+    "11.6" = "8.6.0";
+    "11.7" = "8.6.0";
+    "11.8" = "8.6.0";
+  }.${cudaVersion} or "8.6.0";
 
 in cuDnnPackages
diff --git a/pkgs/development/libraries/science/math/faiss/default.nix b/pkgs/development/libraries/science/math/faiss/default.nix
index 2f180725ab19b..3e4e227f83e2d 100644
--- a/pkgs/development/libraries/science/math/faiss/default.nix
+++ b/pkgs/development/libraries/science/math/faiss/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake ] ++ lib.optionals cudaSupport [
     cudatoolkit
     addOpenGLRunpath
-  ] ++ lib.optional pythonSupport [
+  ] ++ lib.optionals pythonSupport [
     pythonPackages.python
   ];
 
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 69e529234f016..f3ec52f6a5d75 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -179,6 +179,8 @@ stdenv.mkDerivation rec {
     buildPackages.stdenv.cc
   ];
 
+  enableParallelBuilding = true;
+
   makeFlags = mkMakeFlagsFromConfig (config // {
     FC = "${stdenv.cc.targetPrefix}gfortran";
     CC = "${stdenv.cc.targetPrefix}${if stdenv.cc.isClang then "clang" else "cc"}";
@@ -196,6 +198,10 @@ stdenv.mkDerivation rec {
     NO_BINARY_MODE = if stdenv.isx86_64
         then toString (stdenv.hostPlatform != stdenv.buildPlatform)
         else stdenv.hostPlatform != stdenv.buildPlatform;
+    # This disables automatic build job count detection (which honours neither enableParallelBuilding nor NIX_BUILD_CORES)
+    # and uses the main make invocation's job count, falling back to 1 if no parallelism is used.
+    # https://github.com/xianyi/OpenBLAS/blob/v0.3.20/getarch.c#L1781-L1792
+    MAKE_NB_JOBS = 0;
   } // (lib.optionalAttrs singleThreaded {
     # As described on https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
     USE_THREAD = false;
diff --git a/pkgs/development/libraries/science/math/tensorrt/extension.nix b/pkgs/development/libraries/science/math/tensorrt/extension.nix
index 2c4503272785b..b4f47a8969c14 100644
--- a/pkgs/development/libraries/science/math/tensorrt/extension.nix
+++ b/pkgs/development/libraries/science/math/tensorrt/extension.nix
@@ -24,7 +24,9 @@ final: prev: let
     # Add all supported builds as attributes
     allBuilds = mapAttrs' (version: file: nameValuePair (computeName version) (buildTensorRTPackage (removeAttrs file ["fileVersionCuda"]))) supportedVersions;
     # Set the default attributes, e.g. tensorrt = tensorrt_8_4;
-    defaultBuild = { "tensorrt" = allBuilds.${computeName tensorRTDefaultVersion}; };
+    defaultBuild = { "tensorrt" = if allBuilds ? ${computeName tensorRTDefaultVersion}
+      then allBuilds.${computeName tensorRTDefaultVersion}
+      else throw "tensorrt-${tensorRTDefaultVersion} does not support your cuda version ${cudaVersion}"; };
   in allBuilds // defaultBuild;
 
   tensorRTVersions = {
diff --git a/pkgs/development/libraries/science/networking/ns-3/default.nix b/pkgs/development/libraries/science/networking/ns-3/default.nix
index b9f7946f71611..9f80470eff2c6 100644
--- a/pkgs/development/libraries/science/networking/ns-3/default.nix
+++ b/pkgs/development/libraries/science/networking/ns-3/default.nix
@@ -53,8 +53,8 @@ stdenv.mkDerivation rec {
 
   # ncurses is a hidden dependency of waf when checking python
   buildInputs = lib.optionals pythonSupport [ castxml ncurses ]
-    ++ lib.optional enableDoxygen [ doxygen graphviz imagemagick ]
-    ++ lib.optional withManual [ dia tetex ghostscript texlive.combined.scheme-medium ];
+    ++ lib.optionals enableDoxygen [ doxygen graphviz imagemagick ]
+    ++ lib.optionals withManual [ dia tetex ghostscript texlive.combined.scheme-medium ];
 
   propagatedBuildInputs = [ pythonEnv ];
 
diff --git a/pkgs/development/libraries/sentry-native/default.nix b/pkgs/development/libraries/sentry-native/default.nix
index 83f84d4d4fd39..a4b096cee39b6 100644
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentry-native";
-  version = "0.5.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     rev = version;
-    sha256 = "sha256-whbzoKIYLwj4yoFaT3frghJd/WzfpolSAuZzQRtnP5E=";
+    sha256 = "sha256-zSu6jcls1PtoSZNp6VGnXrXS5ViiY6ZghPYWaVwPVtw=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/shapelib/default.nix b/pkgs/development/libraries/shapelib/default.nix
index 1604578a10c90..f0afda7a90011 100644
--- a/pkgs/development/libraries/shapelib/default.nix
+++ b/pkgs/development/libraries/shapelib/default.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+}:
 
 stdenv.mkDerivation rec {
   pname = "shapelib";
@@ -9,6 +13,19 @@ stdenv.mkDerivation rec {
     sha256 = "1qfsgb8b3yiqwvr6h9m81g6k9fjhfys70c22p7kzkbick20a9h0z";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-0699.patch";
+      url = "https://github.com/OSGeo/shapelib/commit/c75b9281a5b9452d92e1682bdfe6019a13ed819f.patch";
+      sha256 = "sha256-zJ7JHUtInA5q/RbkSs1DqVK+UQi2vIw2t1jqxocnQQI=";
+    })
+  ];
+
+  doCheck = true;
+  preCheck = ''
+    patchShebangs tests contrib/tests
+  '';
+
   meta = with lib; {
     description = "C Library for reading, writing and updating ESRI Shapefiles";
     homepage = "http://shapelib.maptools.org/";
diff --git a/pkgs/development/libraries/sord/default.nix b/pkgs/development/libraries/sord/default.nix
index dee53bd3b2a7c..efb8bf0b89529 100644
--- a/pkgs/development/libraries/sord/default.nix
+++ b/pkgs/development/libraries/sord/default.nix
@@ -1,31 +1,42 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, python3, serd, pcre, wafHook }:
+{ lib
+, stdenv
+, doxygen
+, fetchFromGitHub
+, meson
+, ninja
+, pcre
+, pkg-config
+, python3
+, serd
+}:
 
 stdenv.mkDerivation rec {
   pname = "sord";
-  version = "unstable-2021-01-12";
+  version = "0.16.14";
 
-  # Commit picked in mitigation of #109729
   src = fetchFromGitHub {
     owner = "drobilla";
     repo = pname;
-    rev = "d2efdb2d026216449599350b55c2c85c0d3efb89";
-    sha256 = "hHTwK+K6cj9MGO77a1IXiUZtEbXZ08cLGkYZ5eMOIVA=";
-    fetchSubmodules = true;
+    rev = "v${version}";
+    hash = "sha256-S22Szpg6iXeana5t6EpbOtRstthgrJ4Z2cBrf7a9ZBk=";
   };
 
-  preConfigure = ''
-    export PKGCONFIG="$PKG_CONFIG"
-  '';
-
-  nativeBuildInputs = [ pkg-config python3 wafHook ];
+  nativeBuildInputs = [
+    doxygen
+    meson
+    ninja
+    pkg-config
+    python3
+  ];
   buildInputs = [ pcre ];
   propagatedBuildInputs = [ serd ];
-  dontAddWafCrossFlags = true;
+
+  doCheck = true;
 
   meta = with lib; {
     homepage = "http://drobilla.net/software/sord";
     description = "A lightweight C library for storing RDF data in memory";
-    license = licenses.mit;
+    license = with licenses; [ bsd0 isc ];
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/libraries/speechd/default.nix b/pkgs/development/libraries/speechd/default.nix
index d27eabecf4651..021246d73028f 100644
--- a/pkgs/development/libraries/speechd/default.nix
+++ b/pkgs/development/libraries/speechd/default.nix
@@ -69,9 +69,9 @@ in stdenv.mkDerivation rec {
     espeak
     sonic
     pcaudiolib
-  ] ++ lib.optional withFlite [
+  ] ++ lib.optionals withFlite [
     flite
-  ] ++ lib.optional withPico [
+  ] ++ lib.optionals withPico [
     svox
   ];
 
@@ -83,17 +83,17 @@ in stdenv.mkDerivation rec {
     # Audio method falls back from left to right.
     "--with-default-audio-method=\"libao,pulse,alsa,oss\""
     "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-  ] ++ lib.optional withPulse [
+  ] ++ lib.optionals withPulse [
   "--with-pulse"
-  ] ++ lib.optional withAlsa [
+  ] ++ lib.optionals withAlsa [
     "--with-alsa"
-  ] ++ lib.optional withLibao [
+  ] ++ lib.optionals withLibao [
     "--with-libao"
-  ] ++ lib.optional withOss [
+  ] ++ lib.optionals withOss [
     "--with-oss"
-  ] ++ lib.optional withEspeak [
+  ] ++ lib.optionals withEspeak [
     "--with-espeak-ng"
-  ] ++ lib.optional withPico [
+  ] ++ lib.optionals withPico [
     "--with-pico"
   ];
 
diff --git a/pkgs/development/libraries/speex/default.nix b/pkgs/development/libraries/speex/default.nix
index 5509be7822d7e..cc7f8abd670e8 100644
--- a/pkgs/development/libraries/speex/default.nix
+++ b/pkgs/development/libraries/speex/default.nix
@@ -1,26 +1,18 @@
-{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, pkg-config, fftw, speexdsp }:
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fftw, speexdsp }:
 
 stdenv.mkDerivation rec {
   pname = "speex";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "http://downloads.us.xiph.org/releases/speex/speex-${version}.tar.gz";
-    sha256 = "150047wnllz4r94whb9r73l5qf0z5z3rlhy98bawfbblmkq8mbpa";
+    sha256 = "sha256-S0TU8rOKNwotmKeDKf78VqDPk9HBvnACkhe6rmYo/uo=";
   };
 
   postPatch = ''
     sed -i '/AC_CONFIG_MACRO_DIR/i PKG_PROG_PKG_CONFIG' configure.ac
   '';
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2020-23903.patch";
-      url = "https://github.com/xiph/speex/commit/870ff845b32f314aec0036641ffe18aba4916887.patch";
-      sha256 = "sha256-uEMDhDTw/LIWNPPCXW6kF+udBmNO88G/jJTojAA9fs8=";
-    })
-  ];
-
   outputs = [ "out" "dev" "doc" ];
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 786c3c9e313cb..085e330bed486 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${optionalString interactive "-interactive"}";
-  version = "3.39.3";
+  version = "3.39.4";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-eGj7MIK+Pyz0SRxvum3ivdy8KTo1/vsGJO48E/AUIrk=";
+    sha256 = "sha256-8x1EW0jmfihM8gZxfMFwq2PL5P1/eagnk7dyKF54/bs=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 92d521b1916c1..4467f38b0479b 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.39.3";
+    version = "3.39.4";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-GMEvLh2hEkIRc8hcT4rtQyYScsGwR0qgdZKI/TD6ufw=";
+      sha256 = "sha256-AtlsbM+BGrm2ORnvcX9+UqRQxCDga9Ep+0g81ww7O7o=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index cb7af61a63ed2..fb52f75f8c101 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , readline
 , libxslt
+, libxcrypt
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , fixDarwinDylibNames
@@ -33,6 +34,7 @@ stdenv.mkDerivation rec {
     python3
     readline
     libxslt
+    libxcrypt
   ];
 
   wafPath = "buildtools/bin/waf";
diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index f040022cc91b8..9a534c4c14652 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -5,6 +5,7 @@
 , python3
 , readline
 , libxslt
+, libxcrypt
 , docbook-xsl-nons
 , docbook_xml_dtd_45
 }:
@@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     python3
     readline # required to build python
+    libxcrypt
   ];
 
   wafPath = "buildtools/bin/waf";
diff --git a/pkgs/development/libraries/tdlib/default.nix b/pkgs/development/libraries/tdlib/default.nix
index 79a11e2958ad8..afbdc374ce493 100644
--- a/pkgs/development/libraries/tdlib/default.nix
+++ b/pkgs/development/libraries/tdlib/default.nix
@@ -2,14 +2,17 @@
 
 stdenv.mkDerivation rec {
   pname = "tdlib";
-  version = "1.8.3";
+  version = "1.8.7";
 
   src = fetchFromGitHub {
     owner = "tdlib";
     repo = "td";
-    # https://github.com/tdlib/td/issues/1790
-    rev = "054a823c1a812ee3e038f702c6d8ba3e6974be9c";
-    sha256 = "sha256-YlvIGR3Axej0nfcGBQ5lwwYVWsLgqFrYgOxoNubYMPM=";
+
+    # The tdlib authors do not set tags for minor versions, but
+    # external programs depending on tdlib constrain the minor
+    # version, hence we set a specific commit with a known version.
+    rev = "a7a17b34b3c8fd3f7f6295f152746beb68f34d83";
+    sha256 = "sha256:0a5609knn7rmiiblz315yrvc9f2r207l2nl6brjy5bnhjdspmzs6";
   };
 
   buildInputs = [ gperf openssl readline zlib ];
diff --git a/pkgs/development/libraries/vk-bootstrap/default.nix b/pkgs/development/libraries/vk-bootstrap/default.nix
new file mode 100644
index 0000000000000..8b7ce6cd930a2
--- /dev/null
+++ b/pkgs/development/libraries/vk-bootstrap/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, vulkan-headers
+, glfw
+, catch2
+}:
+
+stdenv.mkDerivation rec {
+  pname = "vk-bootstrap";
+  version = "0.5";
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "charles-lunarg";
+    repo = "vk-bootstrap";
+    rev = "v${version}";
+    sha256 = "sha256-rKyfUWfRYiVNzLWh6y44ASHW4j+yabY0kZTdZi8j2Dc=";
+  };
+
+  postPatch = ''
+    # Upstream uses cmake FetchContent to resolve glfw and catch2
+    # needed for examples and tests
+    sed -iE 's=add_subdirectory(ext)==g' CMakeLists.txt
+    sed -iE 's=Catch2==g' tests/CMakeLists.txt
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ vulkan-headers glfw catch2 ];
+
+  cmakeFlags = [
+    "-DVK_BOOTSTRAP_VULKAN_HEADER_DIR=${vulkan-headers}/include"
+  ];
+
+  meta = with lib; {
+    description = "Vulkan Bootstrapping Library";
+    license = licenses.mit;
+    homepage = "https://github.com/charles-lunarg/vk-bootstrap";
+    maintainers = with maintainers; [ shamilton ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index b88ddee6b249b..555e7d0a45de6 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
       ImageIO
       OpenGL
       GLUT
-    ] ++ optional enablePython [
+    ] ++ optionals enablePython [
       pythonInterpreter
     ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ libobjc ];
diff --git a/pkgs/development/libraries/wavpack/default.nix b/pkgs/development/libraries/wavpack/default.nix
index e3527ac32a464..67d8bccf51f04 100644
--- a/pkgs/development/libraries/wavpack/default.nix
+++ b/pkgs/development/libraries/wavpack/default.nix
@@ -1,19 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, libiconv }:
+{ lib, stdenv, fetchFromGitHub, gettext, autoreconfHook, libiconv }:
 
 stdenv.mkDerivation rec {
   pname = "wavpack";
-  version = "5.4.0";
+  version = "5.5.0";
 
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
+  # autogen.sh:9
+  preAutoreconf = "cp ${gettext}/share/gettext/config.rpath .";
+
   src = fetchFromGitHub {
     owner = "dbry";
     repo = "WavPack";
     rev = version;
-    sha256 = "1b6szk2vmnqnv5w7h8yc1iazjlidlraq1lwjbmc3fi0snbn6qj44";
+    hash = "sha256-4QDtLywu0PT+YsMV26M74bL2P7p4s1tk8ZBQtQcubaU=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index df248f6b4d433..1537900023905 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitLab, nasm
+{ stdenv, lib, fetchFromGitLab, fetchpatch, nasm
 , enableShared ? !stdenv.hostPlatform.isStatic
  }:
 
@@ -16,7 +16,15 @@ stdenv.mkDerivation rec {
 
   # Upstream ./configure greps for (-mcpu|-march|-mfpu) in CFLAGS, which in nix
   # is put in the cc wrapper anyway.
-  patches = [ ./disable-arm-neon-default.patch ];
+  patches = [
+    ./disable-arm-neon-default.patch
+    (fetchpatch {
+      # https://code.videolan.org/videolan/x264/-/merge_requests/114
+      name = "fix-parallelism.patch";
+      url = "https://code.videolan.org/videolan/x264/-/commit/e067ab0b530395f90b578f6d05ab0a225e2efdf9.patch";
+      hash = "sha256-16h2IUCRjYlKI2RXYq8QyXukAdfoQxyBKsK/nI6vhRI=";
+    })
+  ];
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/zeroc-ice/default.nix b/pkgs/development/libraries/zeroc-ice/default.nix
index 4eef03c4a6193..3050525c2a29e 100644
--- a/pkgs/development/libraries/zeroc-ice/default.nix
+++ b/pkgs/development/libraries/zeroc-ice/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub
-, bzip2, expat, libedit, lmdb, openssl
+, bzip2, expat, libedit, lmdb, openssl, libxcrypt
 , python3 # for tests only
 , cpp11 ? false
 }:
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-h455isEmnRyoasXhh1UaA5PICcEEM8/C3IJf5yHRl5g=";
   };
 
-  buildInputs = [ zeroc_mcpp bzip2 expat libedit lmdb openssl ];
+  buildInputs = [ zeroc_mcpp bzip2 expat libedit lmdb openssl libxcrypt ];
 
   preBuild = ''
     makeFlagsArray+=(