about summary refs log tree commit diff
path: root/pkgs/development
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/development')
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix8
-rw-r--r--pkgs/development/compilers/openjdk/11.nix6
-rw-r--r--pkgs/development/compilers/openjdk/12.nix6
-rw-r--r--pkgs/development/compilers/openjdk/13.nix6
-rw-r--r--pkgs/development/compilers/openjdk/14.nix6
-rw-r--r--pkgs/development/compilers/openjdk/15.nix6
-rw-r--r--pkgs/development/compilers/openjdk/16.nix6
-rw-r--r--pkgs/development/compilers/openjdk/17.nix6
-rw-r--r--pkgs/development/compilers/openjdk/8.nix6
-rw-r--r--pkgs/development/compilers/rust/1_55.nix63
-rw-r--r--pkgs/development/compilers/rust/1_56.nix63
-rw-r--r--pkgs/development/compilers/vala/default.nix8
-rw-r--r--pkgs/development/libraries/adns/default.nix4
-rw-r--r--pkgs/development/libraries/dbus/default.nix2
-rw-r--r--pkgs/development/libraries/directfb/default.nix11
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix42
-rw-r--r--pkgs/development/libraries/ffmpeg/v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch35
-rw-r--r--pkgs/development/libraries/gcc/libgcc/default.nix2
-rw-r--r--pkgs/development/libraries/glib/default.nix5
-rw-r--r--pkgs/development/libraries/glib/glib-appinfo-watch.patch102
-rw-r--r--pkgs/development/libraries/glibc/2.33-master.patch.gzbin62804 -> 63411 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix10
-rw-r--r--pkgs/development/libraries/glibc/locales.nix6
-rw-r--r--pkgs/development/libraries/gnutls/default.nix8
-rw-r--r--pkgs/development/libraries/gnutls/dummy.crt45
-rw-r--r--pkgs/development/libraries/gperftools/default.nix4
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix6
-rw-r--r--pkgs/development/libraries/icu/70.nix4
-rw-r--r--pkgs/development/libraries/icu/base.nix2
-rw-r--r--pkgs/development/libraries/json-glib/default.nix25
-rw-r--r--pkgs/development/libraries/kde-frameworks/sonnet.nix8
-rw-r--r--pkgs/development/libraries/keybinder3/default.nix2
-rw-r--r--pkgs/development/libraries/libaom/default.nix4
-rw-r--r--pkgs/development/libraries/libb64/default.nix14
-rw-r--r--pkgs/development/libraries/libmediainfo/default.nix12
-rw-r--r--pkgs/development/libraries/libomxil-bellagio/default.nix4
-rw-r--r--pkgs/development/libraries/librsvg/default.nix4
-rw-r--r--pkgs/development/libraries/libseccomp/default.nix6
-rw-r--r--pkgs/development/libraries/libsoup/3.x.nix6
-rw-r--r--pkgs/development/libraries/libsoup/default.nix4
-rw-r--r--pkgs/development/libraries/libvpx/default.nix5
-rw-r--r--pkgs/development/libraries/mesa/default.nix22
-rw-r--r--pkgs/development/libraries/mesa/missing-includes.patch22
-rw-r--r--pkgs/development/libraries/ncurses/clang.patch42
-rw-r--r--pkgs/development/libraries/ncurses/default.nix2
-rw-r--r--pkgs/development/libraries/polkit/default.nix187
-rw-r--r--pkgs/development/libraries/portaudio/default.nix7
-rw-r--r--pkgs/development/libraries/protobuf/3.18.nix4
-rw-r--r--pkgs/development/libraries/protobuf/3.19.nix6
-rw-r--r--pkgs/development/libraries/pth/default.nix7
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix71
-rwxr-xr-x[-rw-r--r--]pkgs/development/libraries/qt-5/5.15/fetch.sh19
-rw-r--r--pkgs/development/libraries/qt-5/5.15/modules41
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json207
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix404
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtbase.nix4
-rw-r--r--pkgs/development/libraries/qt-5/qtModule.nix17
-rw-r--r--pkgs/development/libraries/snappy/default.nix22
-rw-r--r--pkgs/development/libraries/snappy/disable-benchmark.patch5
-rw-r--r--pkgs/development/libraries/srtp/default.nix4
-rw-r--r--pkgs/development/libraries/xalanc/default.nix9
-rw-r--r--pkgs/development/python-modules/Nikola/default.nix4
-rw-r--r--pkgs/development/python-modules/argon2_cffi/default.nix10
-rw-r--r--pkgs/development/python-modules/asgiref/default.nix19
-rw-r--r--pkgs/development/python-modules/bcrypt/default.nix2
-rw-r--r--pkgs/development/python-modules/brotlicffi/default.nix4
-rw-r--r--pkgs/development/python-modules/brotlipy/default.nix2
-rw-r--r--pkgs/development/python-modules/cairocffi/default.nix1
-rw-r--r--pkgs/development/python-modules/cairocffi/generic.nix14
-rw-r--r--pkgs/development/python-modules/cairosvg/default.nix19
-rw-r--r--pkgs/development/python-modules/click/default.nix6
-rw-r--r--pkgs/development/python-modules/cmarkgfm/default.nix2
-rw-r--r--pkgs/development/python-modules/conda/default.nix4
-rw-r--r--pkgs/development/python-modules/construct/2.10.54.nix4
-rw-r--r--pkgs/development/python-modules/construct/default.nix4
-rw-r--r--pkgs/development/python-modules/dateparser/0.x.nix4
-rw-r--r--pkgs/development/python-modules/dateparser/default.nix4
-rw-r--r--pkgs/development/python-modules/drf-yasg/default.nix4
-rw-r--r--pkgs/development/python-modules/editdistance-s/default.nix2
-rw-r--r--pkgs/development/python-modules/fastpbkdf2/default.nix1
-rw-r--r--pkgs/development/python-modules/httplib2/default.nix13
-rw-r--r--pkgs/development/python-modules/jc/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter-repo2docker/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter-telemetry/default.nix4
-rw-r--r--pkgs/development/python-modules/liquidctl/default.nix4
-rw-r--r--pkgs/development/python-modules/mautrix/default.nix4
-rw-r--r--pkgs/development/python-modules/maya/default.nix4
-rw-r--r--pkgs/development/python-modules/miniaudio/default.nix5
-rw-r--r--pkgs/development/python-modules/misaka/default.nix2
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix4
-rw-r--r--pkgs/development/python-modules/monty/default.nix4
-rw-r--r--pkgs/development/python-modules/multidict/default.nix9
-rw-r--r--pkgs/development/python-modules/ntc-templates/default.nix4
-rw-r--r--pkgs/development/python-modules/passlib/default.nix1
-rw-r--r--pkgs/development/python-modules/prance/default.nix4
-rw-r--r--pkgs/development/python-modules/pre-commit-hooks/default.nix4
-rw-r--r--pkgs/development/python-modules/prox-tv/default.nix2
-rw-r--r--pkgs/development/python-modules/pycares/default.nix4
-rw-r--r--pkgs/development/python-modules/pycmarkgfm/default.nix2
-rw-r--r--pkgs/development/python-modules/pygit2/default.nix2
-rw-r--r--pkgs/development/python-modules/pykeepass/default.nix2
-rw-r--r--pkgs/development/python-modules/pymatgen/default.nix4
-rw-r--r--pkgs/development/python-modules/pynacl/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest/4.nix13
-rw-r--r--pkgs/development/python-modules/pytest/5.nix13
-rw-r--r--pkgs/development/python-modules/pytest/default.nix13
-rw-r--r--pkgs/development/python-modules/python-box/default.nix4
-rw-r--r--pkgs/development/python-modules/python-magic/default.nix8
-rw-r--r--pkgs/development/python-modules/python-olm/default.nix4
-rw-r--r--pkgs/development/python-modules/pyuavcan/default.nix4
-rw-r--r--pkgs/development/python-modules/reflink/default.nix10
-rw-r--r--pkgs/development/python-modules/ruamel-base/default.nix (renamed from pkgs/development/python-modules/ruamel_base/default.nix)12
-rw-r--r--pkgs/development/python-modules/ruamel-ordereddict/default.nix (renamed from pkgs/development/python-modules/ruamel_ordereddict/default.nix)7
-rw-r--r--pkgs/development/python-modules/ruamel-yaml-clib/default.nix (renamed from pkgs/development/python-modules/ruamel_yaml_clib/default.nix)16
-rw-r--r--pkgs/development/python-modules/ruamel-yaml/0.16.nix (renamed from pkgs/development/python-modules/ruamel_yaml/0.16.nix)28
-rw-r--r--pkgs/development/python-modules/ruamel-yaml/default.nix (renamed from pkgs/development/python-modules/ruamel_yaml/default.nix)25
-rw-r--r--pkgs/development/python-modules/schema-salad/default.nix4
-rw-r--r--pkgs/development/python-modules/smbus-cffi/default.nix2
-rw-r--r--pkgs/development/python-modules/soundfile/default.nix1
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix13
-rw-r--r--pkgs/development/python-modules/strictyaml/default.nix4
-rw-r--r--pkgs/development/python-modules/tinycss2/default.nix44
-rw-r--r--pkgs/development/python-modules/watchdog/default.nix2
-rw-r--r--pkgs/development/python-modules/xcffib/default.nix2
-rw-r--r--pkgs/development/python-modules/xpybutil/default.nix4
-rw-r--r--pkgs/development/python-modules/yamale/default.nix4
-rw-r--r--pkgs/development/python-modules/zopfli/default.nix11
-rwxr-xr-xpkgs/development/python-modules/zstandard/default.nix2
-rw-r--r--pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch20
-rw-r--r--pkgs/development/tools/analysis/clang-analyzer/default.nix12
-rw-r--r--pkgs/development/tools/analysis/valgrind/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/waf/default.nix9
-rw-r--r--pkgs/development/tools/documentation/gi-docgen/default.nix14
-rw-r--r--pkgs/development/tools/dt-schema/default.nix4
-rw-r--r--pkgs/development/tools/fdroidserver/default.nix2
-rw-r--r--pkgs/development/tools/misc/autogen/default.nix4
-rw-r--r--pkgs/development/tools/misc/binutils/CVE-2021-3487.patch73
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix5
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix4
-rw-r--r--pkgs/development/tools/misc/replacement/default.nix2
-rw-r--r--pkgs/development/tools/parsing/bison/default.nix14
141 files changed, 1344 insertions, 949 deletions
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 850b267441fd4..f71f941540c47 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -57,7 +57,7 @@ with lib;
 with builtins;
 
 let majorVersion = "11";
-    version = "${majorVersion}.1.0";
+    version = "${majorVersion}.2.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -78,9 +78,7 @@ let majorVersion = "11";
       })
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
-
-      ++ [ ../libsanitizer-no-cyclades.patch ];
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@@ -97,7 +95,7 @@ stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "1pwxrjhsymv90xzh0x42cxfnmhjinf2lnrrf3hj5jq1rm2w6yjjc";
+    sha256 = "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 0f19b19b6049d..6f4b78286d63a 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -74,6 +74,12 @@ let
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''
diff --git a/pkgs/development/compilers/openjdk/12.nix b/pkgs/development/compilers/openjdk/12.nix
index 3bbe12477388b..8f2b6d4054622 100644
--- a/pkgs/development/compilers/openjdk/12.nix
+++ b/pkgs/development/compilers/openjdk/12.nix
@@ -83,6 +83,12 @@ let
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ];
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''
diff --git a/pkgs/development/compilers/openjdk/13.nix b/pkgs/development/compilers/openjdk/13.nix
index ed79ceafc55ea..7fb1c35cf9f57 100644
--- a/pkgs/development/compilers/openjdk/13.nix
+++ b/pkgs/development/compilers/openjdk/13.nix
@@ -83,6 +83,12 @@ let
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''
diff --git a/pkgs/development/compilers/openjdk/14.nix b/pkgs/development/compilers/openjdk/14.nix
index 247cf941f002d..29a5c3cc5c312 100644
--- a/pkgs/development/compilers/openjdk/14.nix
+++ b/pkgs/development/compilers/openjdk/14.nix
@@ -78,6 +78,12 @@ let
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''
diff --git a/pkgs/development/compilers/openjdk/15.nix b/pkgs/development/compilers/openjdk/15.nix
index d41a245c54486..987d018cdf378 100644
--- a/pkgs/development/compilers/openjdk/15.nix
+++ b/pkgs/development/compilers/openjdk/15.nix
@@ -78,6 +78,12 @@ let
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''
diff --git a/pkgs/development/compilers/openjdk/16.nix b/pkgs/development/compilers/openjdk/16.nix
index df8a3a68f4878..e6fd12a632b38 100644
--- a/pkgs/development/compilers/openjdk/16.nix
+++ b/pkgs/development/compilers/openjdk/16.nix
@@ -84,6 +84,12 @@ let
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     installPhase = ''
diff --git a/pkgs/development/compilers/openjdk/17.nix b/pkgs/development/compilers/openjdk/17.nix
index 857f7c75c1d27..757fe8f101edb 100644
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@@ -86,6 +86,12 @@ let
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "images" ];
 
     installPhase = ''
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 7a69038d5e0a7..8d68c2a6010ed 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -155,6 +155,12 @@ let
       "-lgtk-x11-2.0" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
     ]);
 
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
     buildFlags = [ "all" ];
 
     doCheck = false; # fails with "No rule to make target 'y'."
diff --git a/pkgs/development/compilers/rust/1_55.nix b/pkgs/development/compilers/rust/1_55.nix
deleted file mode 100644
index 85a8b65b11a1e..0000000000000
--- a/pkgs/development/compilers/rust/1_55.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_12, llvm_12
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.55.0";
-  rustcSha256 = "07l28f7grdmi65naq71pbmvdd61hwcpi40ry7kp7dy7m233rldxj";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_12.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_12;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.54.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "1cd06090463711d50d98374ef52c1a84b9f4e3e35febaaef4890fb10536ceb3a";
-    x86_64-unknown-linux-gnu = "350354495b1d4b6dd2ec7cf96aa9bc61d031951cf667a31e8cf401dc508639e6";
-    x86_64-unknown-linux-musl = "3571db0018fcd32f3b579a32b2301826dbd1cce44b373aed8e8a31c2a6f52fe8";
-    arm-unknown-linux-gnueabihf = "77f4e4c2195f75466c6de0b1d8fd7fb8cef3d12666e3aae777dcfd0d71d080ca";
-    armv7-unknown-linux-gnueabihf = "dd01ccb6a53d5e895a6755a78c213ae601a347366688941d5c543b5af5835d6d";
-    aarch64-unknown-linux-gnu = "33a50c5366a57aaab43c1c19e4a49ab7d8ffcd99a72925c315fb1f9389139e6f";
-    aarch64-unknown-linux-musl = "49d94116a357ea13f5a3231de2472f59210028c3cf81f158b8a367c3155ac544";
-    x86_64-apple-darwin = "5eb27a4f5f7a4699bc70cf1848e340ddd74e151488bfcb26853fd584958e3d33";
-    aarch64-apple-darwin = "801b3b15b992b0321261de8b8ea2728e9a74822c6cb99bf978b34e217c7825ba";
-    powerpc64le-unknown-linux-gnu = "67cadf7ac5bd2e3d5fb4baede69846059f17c4e099f771329b266d08b875ed71";
-    riscv64gc-unknown-linux-gnu = "6113a6cce3500033d0dc0d170b54c5f22562ef3025fd58d804c822a2499c74d7";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_55;
-
-  rustcPatches = [
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_12" "llvm_12"])
diff --git a/pkgs/development/compilers/rust/1_56.nix b/pkgs/development/compilers/rust/1_56.nix
new file mode 100644
index 0000000000000..49df8bcd5ecdc
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_56.nix
@@ -0,0 +1,63 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_13, llvm_13
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.56.1";
+  rustcSha256 = "04cmqx7nn63hzz7z27b2b0dj2qx18rck9ifvip43s6dampx8v2f3";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_13.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_13;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.55.0";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "6e42b6c44d2eb4170f4144423fa3c33338d8d5c3ea00b03bbac200c877bc9e98";
+    x86_64-unknown-linux-gnu = "2080253a2ec36ac8ed6e060d30802d888533124b8d16545cfd4af898b365eaac";
+    x86_64-unknown-linux-musl = "f24f68587253c4bfbe59d3d10fe4897068d9130538de6b2d02097a25718030c2";
+    arm-unknown-linux-gnueabihf = "483444153d35cda51c6aec2c24bc4c97fa4fd30b28df4b60bf9763bd6e06da3a";
+    armv7-unknown-linux-gnueabihf = "8c72f0eb75b10db970fb546c3b41f5e97df294d5dbbf0b8fa96e17f2b281ee9c";
+    aarch64-unknown-linux-gnu = "eebdb2e659ed14884a49f0457d44e5e8c9f89fca3414533752c6dbb96232c156";
+    aarch64-unknown-linux-musl = "2ce36a7d34f1f2aa43b4cbc0b437d96eefb45743828bf9ae699ff581ae257f28";
+    x86_64-apple-darwin = "2e345ac7724c192c9487a2c6bd4f6c52c884d791981510288830d27d9a0bf2f3";
+    aarch64-apple-darwin = "70c71d30d0de76912fcd88d503a6cb4323cfe6250c1a255be7e0d4e644b3d40a";
+    powerpc64le-unknown-linux-gnu = "12bf6447d338cbe2b55539b84e6369b17e7eefe938d1ba7e3dd69781c9cc9812";
+    riscv64gc-unknown-linux-gnu = "effceb45346fef3b0b54b357336e6f374f788b803bb1bee4084f25eace8907f3";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_56;
+
+  rustcPatches = [
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_13" "llvm_13"])
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index ba64e53876cb9..ba9abc0def1d9 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -129,13 +129,13 @@ in rec {
   };
 
   vala_0_52 = generic {
-    version = "0.52.5";
-    sha256 = "sha256-hKG7MSs+Xcrkt7JcRVmNN14stpIzzvtZoV0jUMdr3ZE=";
+    version = "0.52.6";
+    sha256 = "sha256-FNfrTZZLfDrcFuRTcTIIbdxmJO0eDruBEeKsgierOnI=";
   };
 
   vala_0_54 = generic {
-    version = "0.54.1";
-    sha256 = "0jlhd6hr9mai7hhc2c78w6zmnzf7xncp7fhyiavkqqzhhsn7gpjx";
+    version = "0.54.2";
+    sha256 = "iE3nRTF9TVbk6M7emT3I8E1Qz8o2z2DS8vJ4wwwrExE=";
   };
 
   vala = vala_0_54;
diff --git a/pkgs/development/libraries/adns/default.nix b/pkgs/development/libraries/adns/default.nix
index 5f29e0411284c..4b929cdb7f0fe 100644
--- a/pkgs/development/libraries/adns/default.nix
+++ b/pkgs/development/libraries/adns/default.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
   preConfigure =
     lib.optionalString stdenv.isDarwin "sed -i -e 's|-Wl,-soname=$(SHLIBSONAME)||' configure";
 
+  # Autogenerated headers miss interdependencies in Makefile, fail parallel build:
+  #  https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51329
+  enableParallelBuilding = false;
+
   # https://www.mail-archive.com/nix-dev@cs.uu.nl/msg01347.html for details.
   doCheck = false;
 
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 1d1df0d24fc7d..a1e42a435ab4b 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , pkg-config
 , expat
-, enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isMusl
+, enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , systemd
 , audit
 , libapparmor
diff --git a/pkgs/development/libraries/directfb/default.nix b/pkgs/development/libraries/directfb/default.nix
index 1b0b50d28f008..0a06881b5806c 100644
--- a/pkgs/development/libraries/directfb/default.nix
+++ b/pkgs/development/libraries/directfb/default.nix
@@ -48,6 +48,17 @@ stdenv.mkDerivation rec {
     "--with-smooth-scaling"
   ] ++ lib.optional enableX11 "--enable-x11";
 
+  # Disable parallel building as parallel builds fail due to incomplete
+  # depends between autogenerated CoreSlave.h and it's include sites:
+  #    CC       prealloc_surface_pool_bridge.lo
+  #    prealloc_surface_pool_bridge.c:41:10:
+  #        fatal error: core/CoreSlave.h: No such file or directory
+  #
+  # Dependencies are specified manually in src/core/Makefile.am. Instead
+  # of fixing them one by one locally let's disable parallel builds until
+  # upstream fixes them.
+  enableParallelBuilding = false;
+
   meta = with lib; {
     description = "Graphics and input library designed with embedded systems in mind";
     longDescription = ''
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 14405f40f67da..516c7546f564b 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -2,48 +2,12 @@
 # Darwin frameworks
 , Cocoa, CoreMedia, VideoToolbox
 , stdenv, lib
-, fetchpatch
 , ...
 }@args:
 
 callPackage ./generic.nix (rec {
-  version = "4.4";
-  branch = "4.4";
-  sha256 = "03kxc29y8190k4y8s8qdpsghlbpmchv1m8iqygq2qn0vfm4ka2a2";
+  version = "4.4.1";
+  branch = version;
+  sha256 = "0hmck0placn12kd9l0wam70mrpgfs2nlfmi8krd135gdql5g5jcg";
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
-
-  patches = [
-    (fetchpatch {
-      name = "CVE-2021-33815.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777.patch";
-      sha256 = "0l8dqga5845f7d3wdbvd05i23saldq4pm2cyfdgszbr0c18sxagf";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38114.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/7150f9575671f898382c370acae35f9087a30ba1.patch";
-      sha256 = "0gwkc7v1wsh4j0am2nnskhsca1b5aqzhcfd41sd9mh2swsdyf27i";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38171.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6.patch";
-      sha256 = "0b8hsb45izw7w1vb2b94k9f6kvn2shxrap5ip1krdxg6hs7an0x8";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38291.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/e01d306c647b5827102260b885faa223b646d2d1.patch";
-      sha256 = "0p2p8gcnb5j469xa3czfssm09w3jk08kz8rnl8wi2l9aj9l08my9";
-    })
-    # Fix incorrect segment length in HLS child playlist with fmp4 segment format
-    # FIXME remove in version 4.5
-    # https://trac.ffmpeg.org/ticket/9193
-    # https://trac.ffmpeg.org/ticket/9205
-    (fetchpatch {
-      name = "ffmpeg_fix_incorrect_segment_length_in_hls.patch";
-      url = "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff_plain;h=59032494e81a1a65c0b960aaae7ec4c2cc9db35a";
-      sha256 = "03zz1lw51kkc3g3vh47xa5hfiz3g3g1rbrll3kcnslvwylmrqmy3";
-    })
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Work around https://trac.ffmpeg.org/ticket/9242
-    ./v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch
-  ];
 } // args)
diff --git a/pkgs/development/libraries/ffmpeg/v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch b/pkgs/development/libraries/ffmpeg/v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch
deleted file mode 100644
index c0c2c1fb23bb0..0000000000000
--- a/pkgs/development/libraries/ffmpeg/v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 5b562aaddbc6e7a94a079c2e88230b205a7f4d73 Mon Sep 17 00:00:00 2001
-From: Zane van Iperen <zane@zanevaniperen.com>
-Date: Sat, 15 May 2021 19:33:52 +1000
-Subject: [PATCH v2] avcodec/videotoolboxenc: #define TARGET_CPU_ARM64 to 0 if
- not provided by the SDK
-
-Fixes build failure on older SDKs without it.
-
-Fixes #9242
-
-Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
----
- libavcodec/videotoolboxenc.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-NB: This is untested, I do not have a Mac to try it on.
-
-diff --git a/libavcodec/videotoolboxenc.c b/libavcodec/videotoolboxenc.c
-index 58239e0ab9..f063a86e73 100644
---- a/libavcodec/videotoolboxenc.c
-+++ b/libavcodec/videotoolboxenc.c
-@@ -50,6 +50,10 @@ enum { kCVPixelFormatType_420YpCbCr10BiPlanarFullRange = 'xf20' };
- enum { kCVPixelFormatType_420YpCbCr10BiPlanarVideoRange = 'x420' };
- #endif
- 
-+#ifndef TARGET_CPU_ARM64
-+#   define TARGET_CPU_ARM64 0
-+#endif
-+
- typedef OSStatus (*getParameterSetAtIndex)(CMFormatDescriptionRef videoDesc,
-                                            size_t parameterSetIndex,
-                                            const uint8_t **parameterSetPointerOut,
--- 
-2.29.3
-
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index ab62fdf3fa202..b9b7db729ebaa 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -22,6 +22,8 @@ stdenvNoLibs.mkDerivation rec {
     sourceRoot=$(readlink -e "./libgcc")
   '';
 
+  hardeningDisable = [ "pie" ];
+
   preConfigure = ''
     cd "$buildRoot"
   ''
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 4825dd98976c8..d41bfd2f413b7 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.70.0";
+  version = "2.70.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0hh7hk02fkm1bn48k4z8f3kgv9qbni5z22gizd567fn527w7s390";
+    sha256 = "+be85/UXU6H0OFO7ysqL8J4V6ZQmjinP16dvZWNiY8A=";
   };
 
   patches = optionals stdenv.isDarwin [
@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch
   ] ++ [
+    ./glib-appinfo-watch.patch
     ./schema-override-variable.patch
 
     # GLib contains many binaries used for different purposes;
diff --git a/pkgs/development/libraries/glib/glib-appinfo-watch.patch b/pkgs/development/libraries/glib/glib-appinfo-watch.patch
new file mode 100644
index 0000000000000..cbd78a6db4a6f
--- /dev/null
+++ b/pkgs/development/libraries/glib/glib-appinfo-watch.patch
@@ -0,0 +1,102 @@
+This patch lets GLib's GDesktopAppInfo API watch and notice changes
+to the Nix user and system profiles.  That way, the list of available
+applications shown by the desktop environment is immediately updated
+when the user installs or removes any
+(see <https://issues.guix.gnu.org/35594>).
+
+It does so by monitoring /nix/var/nix/profiles (for changes to the system
+profile) and /nix/var/nix/profiles/per-user/USER (for changes to the user
+profile) as well as /etc/profiles/per-user (for chanes to the user
+environment profile) and crawling their share/applications sub-directory when
+changes happen.
+
+diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
+index b779b30..31069f7 100644
+--- a/gio/gdesktopappinfo.c
++++ b/gio/gdesktopappinfo.c
+@@ -150,6 +150,7 @@ typedef struct
+   gchar                      *alternatively_watching;
+   gboolean                    is_config;
+   gboolean                    is_setup;
++  gchar                      *nix_profile_watch_dir;
+   GFileMonitor               *monitor;
+   GHashTable                 *app_names;
+   GHashTable                 *mime_tweaks;
+@@ -181,6 +182,7 @@ desktop_file_dir_unref (DesktopFileDir *dir)
+     {
+       desktop_file_dir_reset (dir);
+       g_free (dir->path);
++      g_free (dir->nix_profile_watch_dir);
+       g_free (dir);
+     }
+ }
+@@ -205,6 +207,14 @@ desktop_file_dir_get_alternative_dir (DesktopFileDir *dir)
+ {
+   gchar *parent;
+ 
++  /* If DIR is a profile, watch the specified directory--e.g.,
++   * /nix/var/nix/profiles/per-user/$USER/ for the user profile.  Do not watch
++   * ~/.nix-profile or /run/current-system/sw because GFileMonitor does
++   * not pass IN_DONT_FOLLOW and thus cannot notice any change.
++   * /etc/profiles/per-user is monitored directly for the same reason. */
++  if (dir->nix_profile_watch_dir != NULL)
++    return g_strdup (dir->nix_profile_watch_dir);
++
+   /* If the directory itself exists then we need no alternative. */
+   if (g_access (dir->path, R_OK | X_OK) == 0)
+     return NULL;
+@@ -250,11 +260,11 @@ desktop_file_dir_changed (GFileMonitor      *monitor,
+    *
+    * If this is a notification for a parent directory (because the
+    * desktop directory didn't exist) then we shouldn't fire the signal
+-   * unless something actually changed.
++   * unless something actually changed or it's part of a Nix profile.
+    */
+   g_mutex_lock (&desktop_file_dir_lock);
+ 
+-  if (dir->alternatively_watching)
++  if (dir->alternatively_watching && dir->nix_profile_watch_dir == NULL)
+     {
+       gchar *alternative_dir;
+ 
+@@ -1556,6 +1566,40 @@ desktop_file_dirs_lock (void)
+       for (i = 0; dirs[i]; i++)
+         g_ptr_array_add (desktop_file_dirs, desktop_file_dir_new (dirs[i]));
+ 
++      {
++        /* Monitor the system and user profile under /nix/var/nix/profiles and
++         * treat modifications to them as if they were modifications to their
++         * /share sub-directory.  */
++        const gchar *user;
++        DesktopFileDir *system_profile_dir, *user_profile_dir, *user_env_dir;
++
++        system_profile_dir =
++          desktop_file_dir_new ("/nix/var/nix/profiles/system/sw/share");
++        system_profile_dir->nix_profile_watch_dir = g_strdup ("/nix/var/nix/profiles");
++        g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (system_profile_dir));
++
++        user = g_get_user_name ();
++        if (user != NULL)
++          {
++            gchar *profile_dir, *user_data_dir, *env_dir, *env_data_dir;
++
++            profile_dir = g_build_filename ("/nix/var/nix/profiles/per-user", user, NULL);
++            user_data_dir = g_build_filename (profile_dir, "profile", "share", NULL);
++            user_profile_dir = desktop_file_dir_new (user_data_dir);
++            user_profile_dir->nix_profile_watch_dir = profile_dir;
++            
++            env_dir = g_build_filename ("/etc/profiles/per-user", NULL);
++            env_data_dir = g_build_filename (env_dir, user, "share", NULL);
++            user_env_dir = desktop_file_dir_new (env_data_dir);
++            user_env_dir->nix_profile_watch_dir = env_dir;
++
++            g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (user_profile_dir));
++            g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (user_env_dir));
++            g_free (user_data_dir);
++            g_free (env_data_dir);
++          }
++      }
++
+       /* The list of directories will never change after this, unless
+        * g_get_user_config_dir() changes due to %G_TEST_OPTION_ISOLATE_DIRS. */
+       desktop_file_dirs_config_dir = user_config_dir;
diff --git a/pkgs/development/libraries/glibc/2.33-master.patch.gz b/pkgs/development/libraries/glibc/2.33-master.patch.gz
index a5f8154dd823b..3dc7774cf8416 100644
--- a/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.33-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 571a2aa95fe1a..064c2532472e7 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -37,12 +37,14 @@
 , profilingLibraries ? false
 , withGd ? false
 , meta
+, extraBuildInputs ? []
+, extraNativeBuildInputs ? []
 , ...
 } @ args:
 
 let
   version = "2.33";
-  patchSuffix = "-55";
+  patchSuffix = "-56";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -61,7 +63,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-55-g4b95183785
+          glibc-2.33-56-g6090cf1330
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
@@ -189,8 +191,8 @@ stdenv.mkDerivation ({
   outputs = [ "out" "bin" "dev" "static" ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ bison python3Minimal ];
-  buildInputs = [ linuxHeaders ] ++ lib.optionals withGd [ gd libpng ];
+  nativeBuildInputs = [ bison python3Minimal ] ++ extraNativeBuildInputs;
+  buildInputs = [ linuxHeaders ] ++ lib.optionals withGd [ gd libpng ] ++ extraBuildInputs;
 
   # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
   # prevent a retained dependency on the bootstrap tools in the stdenv-linux
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 208eedd719344..bada8b3f31f7c 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -6,7 +6,7 @@
    https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED
 */
 
-{ lib, stdenv, buildPackages, callPackage, writeText
+{ lib, stdenv, buildPackages, callPackage, writeText, glibc
 , allLocales ? true, locales ? [ "en_US.UTF-8/UTF-8" ]
 }:
 
@@ -17,6 +17,8 @@ callPackage ./common.nix { inherit stdenv; } {
 
   outputs = [ "out" ];
 
+  extraNativeBuildInputs = [ glibc ];
+
   # Awful hack: `localedef' doesn't allow the path to `locale-archive'
   # to be overriden, but you *can* specify a prefix, i.e. it will use
   # <prefix>/<path-to-glibc>/lib/locale/locale-archive.  So we use
@@ -24,7 +26,7 @@ callPackage ./common.nix { inherit stdenv; } {
   # $TMPDIR/nix/store/...-glibc-.../lib/locale/locale-archive.
   buildPhase =
     ''
-      mkdir -p $TMPDIR/"${buildPackages.stdenv.cc.libc.out}/lib/locale"
+      mkdir -p $TMPDIR/"${buildPackages.glibc.out}/lib/locale"
 
       echo 'C.UTF-8/UTF-8 \' >> ../glibc-2*/localedata/SUPPORTED
 
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 4c4094987ddea..ace18afdeed8d 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -1,6 +1,6 @@
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip
 , perl, gmp, autoconf, automake, libidn, p11-kit, libiconv
-, unbound, dns-root-data, gettext, cacert, util-linux
+, unbound, dns-root-data, gettext, util-linux
 , guileBindings ? config.gnutls.guile or false, guile
 , tpmSupport ? false, trousers, which, nettools, libunistring
 , withSecurity ? false, Security  # darwin Security.framework
@@ -77,9 +77,9 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ nettle ];
 
   inherit doCheck;
-  # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` broke tests with:
-  #   Error setting the x509 trust file: Error while reading file.
-  checkInputs = [ cacert ];
+  # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
+  # Also empty files won't work, and we want to avoid potentially impure /etc/
+  preCheck = "NIX_SSL_CERT_FILE=${./dummy.crt}";
 
   # Fixup broken libtool and pkg-config files
   preFixup = lib.optionalString (!isDarwin) ''
diff --git a/pkgs/development/libraries/gnutls/dummy.crt b/pkgs/development/libraries/gnutls/dummy.crt
new file mode 100644
index 0000000000000..77300f6376b25
--- /dev/null
+++ b/pkgs/development/libraries/gnutls/dummy.crt
@@ -0,0 +1,45 @@
+ACCVRAIZ1
+-----BEGIN CERTIFICATE-----
+MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE
+AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw
+CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ
+BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND
+VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb
+qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY
+HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo
+G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA
+lHPrzg5XPAOBOp0KoVdDaaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhr
+IA8wKFSVf+DuzgpmndFALW4ir50awQUZ0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/
+0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH
+k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47
+4KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMO
+m3WR5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpa
+cXpkatcnYGMN285J9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPl
+uUsXQA+xtrn13k/c4LOsOxFwYIRKQ26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYI
+KwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRwOi8vd3d3LmFjY3YuZXMvZmls
+ZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEuY3J0MB8GCCsG
+AQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2
+VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeT
+VfZW6oHlNsyMHj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIG
+CCsGAQUFBwICMIIBFB6CARAAQQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUA
+cgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBhAO0AegAgAGQAZQAgAGwAYQAgAEEA
+QwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUAYwBuAG8AbABvAGcA
+7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBjAHQA
+cgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAA
+QwBQAFMAIABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUA
+czAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu
+aHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt
+aW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud
+DwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZIhvcNAQEF
+BQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdp
+D70ER9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gU
+JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m
+AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD
+vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms
+tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH
+7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h
+I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA
+h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF
+d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H
+pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7
+-----END CERTIFICATE-----
diff --git a/pkgs/development/libraries/gperftools/default.nix b/pkgs/development/libraries/gperftools/default.nix
index bdb4e67f85feb..0ed2dea0c4c0e 100644
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gperftools";
-  version = "2.8.1";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "19bj2vlsbfwq7m826v2ccqg47kd7cb5vcz1yw2x0v5qzhaxbakk1";
+    sha256 = "sha256-loUlC6mtR3oyS5opSmicCnfUqcefSk8+kKDcHNmC/oo=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 499615a79c1c7..6fce8ca78e815 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -148,6 +148,8 @@ stdenv.mkDerivation rec {
     "-Dtests=false"
     "-Dtracker3=${lib.boolToString trackerSupport}"
     "-Dbroadway_backend=${lib.boolToString broadwaySupport}"
+    "-Dx11_backend=${lib.boolToString x11Support}"
+    "-Dquartz_backend=${lib.boolToString (stdenv.isDarwin && !x11Support)}"
   ];
 
   doCheck = false; # needs X11
@@ -159,6 +161,10 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
+    # See https://github.com/NixOS/nixpkgs/issues/132259
+    substituteInPlace meson.build \
+      --replace "x11_enabled = false" ""
+
     files=(
       build-aux/meson/post-install.py
       demos/gtk-demo/geninclude.py
diff --git a/pkgs/development/libraries/icu/70.nix b/pkgs/development/libraries/icu/70.nix
new file mode 100644
index 0000000000000..955bbcac02f83
--- /dev/null
+++ b/pkgs/development/libraries/icu/70.nix
@@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "70.1";
+  sha256 = "1m9zgkaf5lyh65nyc6n0n5bs2f5k53nnj1ih6nskpwbvq4l5884d";
+}
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index 47eea8ba1af13..e1b2ccda35525 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -43,7 +43,7 @@ let
 
     meta = with lib; {
       description = "Unicode and globalization support library";
-      homepage = "http://site.icu-project.org/";
+      homepage = "https://icu.unicode.org/";
       maintainers = with maintainers; [ raskin ];
       platforms = platforms.all;
     };
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index 9ef66fd2ce69e..e041908f3f48d 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -9,22 +9,20 @@
 , withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 , gobject-introspection
 , fixDarwinDylibNames
-, gtk-doc
-, docbook-xsl-nons
-, docbook_xml_dtd_43
+, gi-docgen
 , gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "json-glib";
-  version = "1.6.2";
+  version = "1.6.6";
 
   outputs = [ "out" "dev" ]
     ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "092g2dyy1hhl0ix9kp33wcab0pg1qicnsv0cj5ms9g9qs336cgd3";
+    sha256 = "luyYvnqR9t3jNjZyDj2i/27LuQ52zKpJSX8xpoVaSQ4=";
   };
 
   strictDeps = true;
@@ -39,13 +37,11 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     glib
-    docbook-xsl-nons
-    docbook_xml_dtd_43
   ] ++ lib.optional stdenv.hostPlatform.isDarwin [
     fixDarwinDylibNames
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
-    gtk-doc
+    gi-docgen
   ];
 
   propagatedBuildInputs = [
@@ -54,12 +50,23 @@ stdenv.mkDerivation rec {
 
   mesonFlags = lib.optionals (!withIntrospection) [
     "-Dintrospection=disabled"
-    # doc gen uses introspection, doesn't work properly
+    # gi-docgen relies on introspection data
     "-Dgtk_doc=disabled"
   ];
 
   doCheck = true;
 
+  postFixup = ''
+    # Move developer documentation to devdoc output.
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    if [[ -d "$out/share/doc" ]]; then
+        find -L "$out/share/doc" -type f -regex '.*\.devhelp2?' -print0 \
+          | while IFS= read -r -d ''' file; do
+            moveToOutput "$(dirname "''${file/"$out/"/}")" "$devdoc"
+        done
+    fi
+  '';
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/development/libraries/kde-frameworks/sonnet.nix b/pkgs/development/libraries/kde-frameworks/sonnet.nix
index 2eff7bad24029..8647c8e0712c7 100644
--- a/pkgs/development/libraries/kde-frameworks/sonnet.nix
+++ b/pkgs/development/libraries/kde-frameworks/sonnet.nix
@@ -1,10 +1,18 @@
 { mkDerivation
+, fetchpatch
 , extra-cmake-modules
 , aspell, qtbase, qttools
 }:
 
 mkDerivation {
   name = "sonnet";
+  patches = [
+    # Pull upstream path to fix determinism.
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/sonnet/-/commit/a01fc66b8affb01221d1fdf84146a78c172d4c6b.patch";
+      sha256 = "1jzd65rmgvfpcxrsnsmdz8ac1ldqs9rjfryy8fryy0ibzbhc1050";
+    })
+  ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ aspell qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/keybinder3/default.nix b/pkgs/development/libraries/keybinder3/default.nix
index 78755a87919d7..94f10426c7156 100644
--- a/pkgs/development/libraries/keybinder3/default.nix
+++ b/pkgs/development/libraries/keybinder3/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     description = "Library for registering global key bindings";
     homepage = "https://github.com/kupferlauncher/keybinder/";
     license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = [ maintainers.cstrahan ];
   };
 }
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 62415ea1335e1..82e4403331368 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.1.3";
+  version = "3.2.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "08rk31d2cp9k9nj37s6a4n7klpfqfbj62anwyiggzsz7b68psjq3";
+    sha256 = "0fmnbzpl481i7kchx4hbvb507r5pfgyrzfrlrs7jk3bicycm75qv";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/libb64/default.nix b/pkgs/development/libraries/libb64/default.nix
index 605faaebf6963..81ba4263a1d6c 100644
--- a/pkgs/development/libraries/libb64/default.nix
+++ b/pkgs/development/libraries/libb64/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "libb64";
@@ -11,6 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-9loDftr769qnIi00MueO86kjha2EiG9pnCLogp0Iq3c=";
   };
 
+  patches = [
+    # Fix parallel build failure: https://github.com/libb64/libb64/pull/9
+    #  make[1]: *** No rule to make target 'libb64.a', needed by 'c-example1'.  Stop.
+    (fetchpatch {
+      name = "parallel-make.patch";
+      url = "https://github.com/libb64/libb64/commit/4fe47c052e9123da8f751545deb48be08c3411f6.patch";
+      sha256 = "18b3np3gpyzimqmk6001riqv5n70wfbclky6zzsrvj5zl1dj4ljf";
+    })
+  ];
+
+  enableParallelBuilding = true;
+
   installPhase = ''
     mkdir -p $out $out/lib $out/bin $out/include
     cp -r include/* $out/include/
diff --git a/pkgs/development/libraries/libmediainfo/default.nix b/pkgs/development/libraries/libmediainfo/default.nix
index 7fa7ce9482a74..2a74c79afaf07 100644
--- a/pkgs/development/libraries/libmediainfo/default.nix
+++ b/pkgs/development/libraries/libmediainfo/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, zlib }:
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, zlib, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "21.09";
@@ -11,7 +11,15 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libzen zlib ];
 
-  sourceRoot = "./MediaInfoLib/Project/GNU/Library/";
+  patches = [
+    # fixes pkgsMusl.libmediainfo build
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/libmediainfo/fix-include-signal.patch?id=b8d666a3d33575c184308e1176f4de9e519af577";
+      sha256 = "sha256-b3HoIwy/hKSh8jUakwVJpnPmYw5KUwZXgLW7IPMY4/c=";
+    })
+  ];
+
+  postPatch = "cd Project/GNU/Library";
 
   configureFlags = [ "--enable-shared" ];
 
diff --git a/pkgs/development/libraries/libomxil-bellagio/default.nix b/pkgs/development/libraries/libomxil-bellagio/default.nix
index 22a6de9fd956f..e49473b79edeb 100644
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@@ -17,6 +17,10 @@ stdenv.mkDerivation rec {
     ./fno-common.patch
   ];
 
+  # Disable parallel build as it fails as:
+  #    ld: cannot find -lomxil-bellagio
+  enableParallelBuilding = false;
+
   doCheck = false; # fails
 
   # Fix for #40213, probably permanent, because upstream doesn't seem to be
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 6610d55b37aee..c59a80c0e0f63 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librsvg";
-  version = "2.52.0";
+  version = "2.52.3";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "14zkdd7a9mymnfs3laqj0gr69c16nwixvbc5a4gvd534w6riz0mx";
+    sha256 = "Nuf1vIjXhgjqf2wF5K/krMFga5rxPChF1DhQc9CCuKQ=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index 7ea7add23f3ee..0a76e59e5b7c0 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "0m8dlg1v7kflcxvajs4p76p275qwsm2abbf5mfapkakp7hw7wc7f";
+    sha256 = "sha256-F6ZS37SR2Wvok5YOm3kZFJNu4WwTt3ejyvVi/kjLh98=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "High level library for the Linux Kernel seccomp filter";
     homepage = "https://github.com/seccomp/libseccomp";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
     platforms = platforms.linux;
     badPlatforms = [
       "alpha-linux"
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index b958ba3076747..5f8c0ec1b4889 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.0.1";
+  version = "3.0.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bwwxbRD4RYuW9WTHZEvjwgEb11rVBUyNsmr7DJqRvEc=";
+    sha256 = "sha256-mO9T7ZtIFewFIyFVNxr4A6mSj0ZSrMaF/wIIa+FqP/U=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     glib
+    python3
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
   ] ++ lib.optionals withVala [
@@ -42,7 +43,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    python3
     sqlite
     libpsl
     glib.out
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index f902d32037761..95926f54f9474 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "2.74.0";
+  version = "2.74.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-M7HU4NY5RWxnXCJ4d+lKgHjXMSM+LVdonBGrzvfTxI4=";
+    sha256 = "sha256-3CejuPowvI/5ULWnWVh1fSJC4+UeTi2cTmI+9195O/g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index d538aa41bff36..9f916e283299f 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -56,13 +56,13 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EZP33U10fchyqy7Jr26vHgUUfWR6xtG3fcMWUII0m9w=";
+    sha256 = "00f1jrclai2b6ys78dpsg6r1mvcyxlna93vxcz8zjyia24c2pjsb";
   };
 
   postPatch = ''
@@ -180,6 +180,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "WebM VP8/VP9 codec SDK";
     homepage    = "https://www.webmproject.org/";
+    changelog   = "https://github.com/webmproject/libvpx/raw/v${version}/CHANGELOG";
     license     = licenses.bsd3;
     maintainers = with maintainers; [ codyopel ];
     platforms   = platforms.all;
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index c4ff6bb469369..31f0a0e750d16 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -54,16 +54,22 @@ self = stdenv.mkDerivation {
   #  revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved
   #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
   patches = [
-    ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
-    ./opencl.patch
-    ./disk_cache-include-dri-driver-path-in-cache-key.patch
-    # Fix `-Werror=int-conversion` pthread warnings on musl.
-    # TODO: Remove when https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6121 is merged and available
+    # fixes pkgsMusl.mesa build
     (fetchpatch {
-      name = "nine_debug-Make-tid-more-type-correct";
-      url = "https://gitlab.freedesktop.org/mesa/mesa/commit/aebbf819df6d1e.patch";
-      sha256 = "17248hyzg43d73c86p077m4lv1pkncaycr3l27hwv9k4ija9zl8q";
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl.patch";
+      sha256 = "sha256-Jyl7ILLhn8hBJG7afnEjE8H56Wz/1bxkvlqfrXK5U7I=";
     })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-endian.patch";
+      sha256 = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk=";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-stacksize.patch";
+      sha256 = "sha256-bEp0AWddsw1Pc3rxdKN8fsrX4x2TQEzMUa5afhLXGsg=";
+    })
+
+    ./opencl.patch
+    ./disk_cache-include-dri-driver-path-in-cache-key.patch
   ] ++ optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # Fix aarch64-darwin build, remove when upstreaam supports it out of the box.
     # See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/1020
diff --git a/pkgs/development/libraries/mesa/missing-includes.patch b/pkgs/development/libraries/mesa/missing-includes.patch
deleted file mode 100644
index c17d549085538..0000000000000
--- a/pkgs/development/libraries/mesa/missing-includes.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- ./src/gallium/winsys/svga/drm/vmw_screen.h.orig
-+++ ./src/gallium/winsys/svga/drm/vmw_screen.h
-@@ -34,7 +34,7 @@
- #ifndef VMW_SCREEN_H_
- #define VMW_SCREEN_H_
- 
--
-+#include <sys/stat.h>
- #include "pipe/p_compiler.h"
- #include "pipe/p_state.h"
- 
---- a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
-+++ b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
-@@ -28,6 +28,8 @@
- #ifndef RADV_AMDGPU_WINSYS_H
- #define RADV_AMDGPU_WINSYS_H
-
-+#include <sys/types.h>
-+
- #include <amdgpu.h>
- #include <pthread.h>
- #include "util/list.h"
diff --git a/pkgs/development/libraries/ncurses/clang.patch b/pkgs/development/libraries/ncurses/clang.patch
deleted file mode 100644
index ce33049bf4051..0000000000000
--- a/pkgs/development/libraries/ncurses/clang.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-diff -ruNp ncurses-5.8.orig/c++/cursesf.h ncurses-5.8/c++/cursesf.h
---- ncurses-5.8.orig/c++/cursesf.h	2005-08-13 21:08:24.000000000 +0300
-+++ ncurses-5.8/c++/cursesf.h	2011-04-03 18:29:29.000000000 +0300
-@@ -681,7 +681,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Fields=FALSE)
--    : NCursesForm (Fields, with_frame, autoDelete_Fields) {
-+    : NCursesForm (&Fields, with_frame, autoDelete_Fields) {
-       if (form)
- 	set_user (const_cast<void *>(p_UserData));
-   };
-@@ -694,7 +694,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Fields=FALSE)
--    : NCursesForm (Fields, nlines, ncols, begin_y, begin_x,
-+    : NCursesForm (&Fields, nlines, ncols, begin_y, begin_x,
- 		   with_frame, autoDelete_Fields) {
-       if (form)
- 	set_user (const_cast<void *>(p_UserData));
-diff -ruNp ncurses-5.8.orig/c++/cursesm.h ncurses-5.8/c++/cursesm.h
---- ncurses-5.8.orig/c++/cursesm.h	2005-08-13 21:10:36.000000000 +0300
-+++ ncurses-5.8/c++/cursesm.h	2011-04-03 18:31:42.000000000 +0300
-@@ -639,7 +639,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Items=FALSE)
--    : NCursesMenu (Items, with_frame, autoDelete_Items) {
-+    : NCursesMenu (&Items, with_frame, autoDelete_Items) {
-       if (menu)
- 	set_user (const_cast<void *>(p_UserData));
-   };
-@@ -651,7 +651,7 @@ public:
- 		   int begin_x = 0,
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE)
--    : NCursesMenu (Items, nlines, ncols, begin_y, begin_x, with_frame) {
-+    : NCursesMenu (&Items, nlines, ncols, begin_y, begin_x, with_frame) {
-       if (menu)
- 	set_user (const_cast<void *>(p_UserData));
-   };
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index dd1eea632e18d..b7ca4df888570 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -27,8 +27,6 @@ stdenv.mkDerivation rec {
     sha256 = "15r2456g0mlq2q7gh2z52vl6zv6y0z8sdchrs80kg4idqd8sm8fd";
   };
 
-  patches = lib.optional (!stdenv.cc.isClang) ./clang.patch;
-
   outputs = [ "out" "dev" "man" ];
   setOutputFlags = false; # some aren't supported
 
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index a8b012a209980..bd731e7b05175 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -1,7 +1,28 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, expat, pam, perl, fetchpatch
-, intltool, spidermonkey_78, gobject-introspection, libxslt, docbook_xsl, dbus
-, docbook_xml_dtd_412, gtk-doc, coreutils
-, useSystemd ? (stdenv.isLinux && !stdenv.hostPlatform.isMusl), systemd, elogind
+{ lib
+, stdenv
+, fetchFromGitLab
+, pkg-config
+, glib
+, expat
+, pam
+, meson
+, ninja
+, perl
+, rsync
+, python3
+, fetchpatch
+, gettext
+, spidermonkey_78
+, gobject-introspection
+, libxslt
+, docbook-xsl-nons
+, dbus
+, docbook_xml_dtd_412
+, gtk-doc
+, coreutils
+, useSystemd ? stdenv.isLinux
+, systemd
+, elogind
 # needed until gobject-introspection does cross-compile (https://github.com/NixOS/nixpkgs/pull/88222)
 , withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
 # A few tests currently fail on musl (polkitunixusertest, polkitunixgrouptest, polkitidentitytest segfault).
@@ -12,54 +33,111 @@
 }:
 
 let
-
   system = "/run/current-system/sw";
   setuid = "/run/wrappers/bin";
-
 in
-
 stdenv.mkDerivation rec {
   pname = "polkit";
-  version = "0.119";
+  version = "0.120";
+
+  outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
 
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/${pname}/releases/${pname}-${version}.tar.gz";
-    sha256 = "0p0zzmr0kh3mpmqya4q27y4h9b920zp5ya0i8909ahp9hvdrymy8";
+  # Tarballs do not contain subprojects.
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "polkit";
+    repo = "polkit";
+    rev = version;
+    sha256 = "oEaRf1g13zKMD+cP1iwIA6jaCDwvNfGy2i8xY8vuVSo=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isMusl [
+  patches = [
+    # Allow changing base for paths in pkg-config file as before.
+    # https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/100
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/7ba07551dfcd4ef9a87b8f0d9eb8b91fabcb41b3.patch";
+      sha256 = "ebbLILncq1hAZTBMsLm+vDGw6j0iQ0crGyhzyLZQgKA=";
+    })
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     # Make netgroup support optional (musl does not have it)
     # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10
     # We use the version of the patch that Alpine uses successfully.
     (fetchpatch {
       name = "make-innetgr-optional.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/polkit/make-innetgr-optional.patch?id=391e7de6ced1a96c2dac812e0b12f1d7e0ea705e";
-      sha256 = "1p9qqqhnrfyjvvd50qh6vpl256kyfblm1qnhz5pm09klrl1bh1n4";
+      url = "https://git.alpinelinux.org/aports/plain/community/polkit/make-innetgr-optional.patch?id=424ecbb6e9e3a215c978b58c05e5c112d88dddfc";
+      sha256 = "0iyiksqk29sizwaa4623bv683px1fny67639qpb1him89hza00wy";
     })
   ];
 
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    sed -i -e "s/-Wl,--as-needed//" configure.ac
-  '';
-
-  outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
+  nativeBuildInputs = [
+    glib
+    gtk-doc
+    pkg-config
+    gettext
+    meson
+    ninja
+    perl
+    rsync
+    (python3.withPackages (pp: with pp; [
+      dbus-python
+      (python-dbusmock.overridePythonAttrs (attrs: {
+        # Avoid dependency cycle.
+        doCheck = false;
+      }))
+    ]))
+
+    # man pages
+    libxslt
+    docbook-xsl-nons
+    docbook_xml_dtd_412
+  ];
 
-  nativeBuildInputs =
-    [ glib gtk-doc pkg-config intltool perl ]
-    ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ]; # man pages
-  buildInputs =
-    [ expat pam spidermonkey_78 ]
+  buildInputs = [
+    expat
+    pam
+    spidermonkey_78
+  ] ++ lib.optionals stdenv.isLinux [
     # On Linux, fall back to elogind when systemd support is off.
-    ++ lib.optional stdenv.isLinux (if useSystemd then systemd else elogind)
-    ++ lib.optional withIntrospection gobject-introspection;
+    (if useSystemd then systemd else elogind)
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ];
 
   propagatedBuildInputs = [
     glib # in .pc Requires
   ];
 
-  preConfigure = ''
-    chmod +x test/mocklibc/bin/mocklibc{,-test}.in
-    patchShebangs .
+  checkInputs = [
+    dbus
+  ];
+
+  mesonFlags = [
+    "--datadir=${system}/share"
+    "--sysconfdir=/etc"
+    "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    "-Dpolkitd_user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
+    "-Dos_type=redhat" # only affects PAM includes
+    "-Dintrospection=${lib.boolToString withIntrospection}"
+    "-Dtests=${lib.boolToString doCheck}"
+    "-Dgtk_doc=${lib.boolToString true}"
+    "-Dman=true"
+  ] ++ lib.optionals stdenv.isLinux [
+    "-Dsession_tracking=${if useSystemd then "libsystemd-login" else "libelogind"}"
+  ];
+
+  # HACK: We want to install policy files files to $out/share but polkit
+  # should read them from /run/current-system/sw/share on a NixOS system.
+  # Similarly for config files in /etc.
+  # With autotools, it was possible to override Make variables
+  # at install time but Meson does not support this
+  # so we need to convince it to install all files to a temporary
+  # location using DESTDIR and then move it to proper one in postInstall.
+  DESTDIR = "${placeholder "out"}/dest";
+
+  inherit doCheck;
+
+  postPatch = ''
+    patchShebangs test/polkitbackend/polkitbackendjsauthoritytest-wrapper.py
 
     # ‘libpolkit-agent-1.so’ should call the setuid wrapper on
     # NixOS.  Hard-coding the path is kinda ugly.  Maybe we can just
@@ -69,45 +147,40 @@ stdenv.mkDerivation rec {
     substituteInPlace test/data/etc/polkit-1/rules.d/10-testing.rules \
       --replace   /bin/true ${coreutils}/bin/true \
       --replace   /bin/false ${coreutils}/bin/false
-
-  '' + lib.optionalString useSystemd /* bogus chroot detection */ ''
-    sed '/libsystemd autoconfigured/s/.*/:/' -i configure
   '';
 
-  configureFlags = [
-    "--datadir=${system}/share"
-    "--sysconfdir=/etc"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--with-polkitd-user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
-    "--with-os-type=NixOS" # not recognized but prevents impurities on non-NixOS
-    (if withIntrospection then "--enable-introspection" else "--disable-introspection")
-  ] ++ lib.optional (!doCheck) "--disable-test";
-
-  makeFlags = [
-    "INTROSPECTION_GIRDIR=${placeholder "out"}/share/gir-1.0"
-    "INTROSPECTION_TYPELIBDIR=${placeholder "out"}/lib/girepository-1.0"
-  ];
-
-  installFlags = [
-    "datadir=${placeholder "out"}/share"
-    "sysconfdir=${placeholder "out"}/etc"
-  ];
+  postConfigure = ''
+    # Unpacked by meson
+    chmod +x subprojects/mocklibc-1.0/bin/mocklibc
+    patchShebangs subprojects/mocklibc-1.0/bin/mocklibc
+  '';
 
-  inherit doCheck;
-  checkInputs = [ dbus ];
   checkPhase = ''
     runHook preCheck
 
-    # unfortunately this test needs python-dbusmock, but python-dbusmock needs polkit,
-    # leading to a circular dependency
-    substituteInPlace test/Makefile --replace polkitbackend ""
-
     # tests need access to the system bus
-    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS make check'
+    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS meson test --print-errorlogs'
 
     runHook postCheck
   '';
 
+  postInstall = ''
+    # Move stuff from DESTDIR to proper location.
+    # We use rsync to merge the directories.
+    rsync --archive "${DESTDIR}/etc" "$out"
+    rm --recursive "${DESTDIR}/etc"
+    rsync --archive "${DESTDIR}${system}"/* "$out"
+    rm --recursive "${DESTDIR}${system}"/*
+    rmdir --parents --ignore-fail-on-non-empty "${DESTDIR}${system}"
+    for o in $outputs; do
+        rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
+        rm --recursive "${DESTDIR}/''${!o}"
+    done
+    # Ensure the DESTDIR is removed.
+    destdirContainer="$(dirname "${DESTDIR}")"
+    pushd "$destdirContainer"; rmdir --parents "''${DESTDIR##$destdirContainer/}${builtins.storeDir}"; popd
+  '';
+
   meta = with lib; {
     homepage = "http://www.freedesktop.org/wiki/Software/polkit";
     description = "A toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes";
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index 9a43d5a921e53..b0ab32c9e392c 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -29,6 +29,13 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ AudioUnit AudioToolbox CoreAudio CoreServices Carbon ];
 
+  # Disable parallel build as it fails as:
+  #   make: *** No rule to make target '../../../lib/libportaudio.la',
+  #     needed by 'libportaudiocpp.la'.  Stop.
+  # Next release should address it with
+  #     https://github.com/PortAudio/portaudio/commit/28d2781d9216115543aa3f0a0ffb7b4ee0fac551.patch
+  enableParallelBuilding = false;
+
   # not sure why, but all the headers seem to be installed by the make install
   installPhase = ''
     make install
diff --git a/pkgs/development/libraries/protobuf/3.18.nix b/pkgs/development/libraries/protobuf/3.18.nix
index c670b56c7c5a7..63fc9b218d307 100644
--- a/pkgs/development/libraries/protobuf/3.18.nix
+++ b/pkgs/development/libraries/protobuf/3.18.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.18.0";
-  sha256 = "0nhjw4m4dm6wqwwsi0b18js5wbh3ibrpsq195g6mk9cx54fx097f";
+  version = "3.18.1";
+  sha256 = "sha256-5PK0uuk7Du9hX/hHy0gninHIKu6b8THdfVh87Gn7y2Q=";
 }
diff --git a/pkgs/development/libraries/protobuf/3.19.nix b/pkgs/development/libraries/protobuf/3.19.nix
new file mode 100644
index 0000000000000..727bf511d5813
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.19.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.19.0";
+  sha256 = "0rx4r4d7hqr0gi3v90jbkm2lnkj9p37dhgwx9d0w7kgh3rvr4i7g";
+}
diff --git a/pkgs/development/libraries/pth/default.nix b/pkgs/development/libraries/pth/default.nix
index 240c903a8a771..16235176d0380 100644
--- a/pkgs/development/libraries/pth/default.nix
+++ b/pkgs/development/libraries/pth/default.nix
@@ -14,6 +14,13 @@ stdenv.mkDerivation rec {
     configureFlagsArray+=("ac_cv_check_sjlj=ssjlj")
   '';
 
+  # Fails parallel build due to missing dependency on autogenrated
+  # 'pth_p.h' file:
+  #     ./shtool scpp -o pth_p.h ...
+  #     ./libtool --mode=compile --quiet gcc -c -I. -O2 -pipe pth_uctx.c
+  #     pth_uctx.c:31:10: fatal error: pth_p.h: No such file
+  enableParallelBuilding = false;
+
   meta = with lib; {
     description = "The GNU Portable Threads library";
     homepage = "https://www.gnu.org/software/pth";
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index a1d5be70c012a..183311c5f18ab 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -2,15 +2,8 @@
 
 # Updates
 
-Before a major version update, make a copy of this directory. (We like to
-keep the old version around for a short time after major updates.) Add a
-top-level attribute to `top-level/all-packages.nix`.
-
-1. Update the URL in `pkgs/development/libraries/qt-5/$VERSION/fetch.sh`.
-2. From the top of the Nixpkgs tree, run
-   `./maintainers/scripts/fetch-kde-qt.sh pkgs/development/libraries/qt-5/$VERSION`.
-3. Check that the new packages build correctly.
-4. Commit the changes and open a pull request.
+Run `./fetch.sh` to update package sources from Git.
+Check for any minor version changes.
 
 */
 
@@ -28,58 +21,12 @@ top-level attribute to `top-level/all-packages.nix`.
 
 let
 
+  srcs = import ./srcs.nix { inherit lib fetchgit fetchFromGitHub; };
+
   qtCompatVersion = srcs.qtbase.version;
 
   stdenvActual = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
 
-  mirror = "https://download.qt.io";
-  srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; } // {
-    # qtwebkit does not have an official release tarball on the qt mirror and is
-    # mostly maintained by the community.
-    qtwebkit = rec {
-      src = fetchFromGitHub {
-        owner = "qt";
-        repo = "qtwebkit";
-        rev = "v${version}";
-        sha256 = "0x8rng96h19xirn7qkz3lydal6v4vn00bcl0s3brz36dfs0z8wpg";
-      };
-      version = "5.212.0-alpha4";
-    };
-    qtwebengine =
-      let
-        branchName = "5.15.6";
-        rev = "v${branchName}-lts";
-      in
-      {
-        version = "${branchName}-${lib.substring 0 7 rev}";
-
-        src = fetchgit {
-          url = "https://github.com/qt/qtwebengine.git";
-          sha256 = "17bw9yf04zmr9ck5jkrd435c8b03zpf937vn2nwgsr8p78wkg3kr";
-          inherit rev branchName;
-          fetchSubmodules = true;
-          leaveDotGit = true;
-          name = "qtwebengine-${lib.substring 0 7 rev}.tar.gz";
-          postFetch = ''
-            # remove submodule .git directory
-            rm -rf "$out/src/3rdparty/.git"
-
-            # compress to not exceed the 2GB output limit
-            # try to make a deterministic tarball
-            tar -I 'gzip -n' \
-              --sort=name \
-              --mtime=1970-01-01 \
-              --owner=root --group=root \
-              --numeric-owner --mode=go=rX,u+rw,a-s \
-              --transform='s@^@source/@' \
-              -cf temp  -C "$out" .
-            rm -r "$out"
-            mv temp "$out"
-          '';
-        };
-      };
-  };
-
   patches = {
     qtbase = lib.optionals stdenv.isDarwin [
       ./qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
@@ -107,16 +54,6 @@ let
       ./qtbase.patch.d/0009-qtbase-qtpluginpath.patch
       ./qtbase.patch.d/0010-qtbase-assert.patch
       ./qtbase.patch.d/0011-fix-header_module.patch
-      (fetchpatch { # This can be removed when https://codereview.qt-project.org/c/qt/qtbase/+/339323 is included in an release.
-        name = "0014-gcc11-compat.patch";
-        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=049e14870c13235cd066758f29c42dc96c1ccdf8";
-        sha256 = "1cb2hwi859hds0fa2cbap014qaa7mah9p0rcxcm2cvj2ybl33qfc";
-      })
-      (fetchpatch { # This can be removed when https://codereview.qt-project.org/c/qt/qtbase/+/363880/3 is included in an release.
-        name = "qtbase-mysql-version-vs-functionality-check.patch";
-        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=211369133cf40b2f522caaff259c19069ed23ca4";
-        sha256 = "19kq9h10qm344fpdqa9basrbzh1y5kr48c6jzz3nvk61pk4ja1k4";
-      })
     ];
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtscript = [ ./qtscript.patch ];
diff --git a/pkgs/development/libraries/qt-5/5.15/fetch.sh b/pkgs/development/libraries/qt-5/5.15/fetch.sh
index 81ceb3ef77eab..dcada3649078b 100644..100755
--- a/pkgs/development/libraries/qt-5/5.15/fetch.sh
+++ b/pkgs/development/libraries/qt-5/5.15/fetch.sh
@@ -1,2 +1,17 @@
-WGET_ARGS=( http://download.qt.io/official_releases/qt/5.15/5.15.2/submodules/ \
-            -A '*.tar.xz' )
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-prefetch-scripts jq
+
+set -eox pipefail
+
+here="$(dirname "${BASH_SOURCE[0]}")"
+modules="${here}/modules"
+srcs="${here}/srcs-generated.json"
+
+while read -r module; do
+    if [[ -z "$module" ]]; then continue; fi
+    url="https://invent.kde.org/qt/qt/${module}.git"
+    nix-prefetch-git --url $url --rev refs/heads/kde/5.15 \
+        | jq "{key: \"${module}\", value: {url,rev,sha256}}"
+done < "$modules" | jq -s 'from_entries' > "${srcs}.tmp"
+
+mv "${srcs}.tmp" "$srcs"
diff --git a/pkgs/development/libraries/qt-5/5.15/modules b/pkgs/development/libraries/qt-5/5.15/modules
new file mode 100644
index 0000000000000..d6ce8822d541d
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.15/modules
@@ -0,0 +1,41 @@
+qt3d
+qtactiveqt
+qtandroidextras
+qtbase
+qtcharts
+qtconnectivity
+qtdatavis3d
+qtdeclarative
+qtdoc
+qtgamepad
+qtgraphicaleffects
+qtimageformats
+qtlocation
+qtlottie
+qtmacextras
+qtmultimedia
+qtnetworkauth
+qtpurchasing
+qtquick3d
+qtquickcontrols
+qtquickcontrols2
+qtquicktimeline
+qtremoteobjects
+qtscript
+qtscxml
+qtsensors
+qtserialbus
+qtserialport
+qtspeech
+qtsvg
+qttools
+qttranslations
+qtvirtualkeyboard
+qtwayland
+qtwebchannel
+qtwebglplugin
+qtwebsockets
+qtwebview
+qtwinextras
+qtx11extras
+qtxmlpatterns
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
new file mode 100644
index 0000000000000..76c4237dcaf71
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -0,0 +1,207 @@
+{
+  "qt3d": {
+    "url": "https://invent.kde.org/qt/qt/qt3d.git",
+    "rev": "7edec6e014de27b9dd03f63875c471aac606a918",
+    "sha256": "0qv4vhciigqd8bnqzrs7y71ls7jx1p9cal2rh78m42qgskk1ci59"
+  },
+  "qtactiveqt": {
+    "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
+    "rev": "f0d03da0e37a84029a4eae1733813521482ac1fb",
+    "sha256": "0llk76lf0mh4mzj7pwd8cs55wpmfq8v1bsdzvizb1sx0vfbjh8g6"
+  },
+  "qtandroidextras": {
+    "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
+    "rev": "8cce1098c59534352aa0f343ea73861f603ac04a",
+    "sha256": "130a1yda2m7pa10as3rccz84m3617422n6s51pdn4kp8p8rk7cs6"
+  },
+  "qtbase": {
+    "url": "https://invent.kde.org/qt/qt/qtbase.git",
+    "rev": "c9fde86b0a2440133bc08f4811b6ca793be47f0a",
+    "sha256": "1fqhdkv3sp3nbzqi2a5wvxn5d4v0xcrq2bl609bdyj4nx367a8wp"
+  },
+  "qtcharts": {
+    "url": "https://invent.kde.org/qt/qt/qtcharts.git",
+    "rev": "130463160b4923069eb98da49edaf7d93180f4f8",
+    "sha256": "19g35cddbfh307mk76wac1ps03warynlsj7xi8i596bxiaf7i4pw"
+  },
+  "qtconnectivity": {
+    "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
+    "rev": "69a87a9b831e36a578594a0a13130c384ad03121",
+    "sha256": "0ph07rdf9qfxnw3z2nqbmh6na65z0p2snmlzdw80amd7s0g255kw"
+  },
+  "qtdatavis3d": {
+    "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
+    "rev": "c085311c02dd216e5a041b90c164d55b3cf3ce92",
+    "sha256": "0xya1m2csb42yisl90s9822p9q92n7ags909nlbapfsb49qwsqnj"
+  },
+  "qtdeclarative": {
+    "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
+    "rev": "55324650f9e759a43dce927f823c9858574106c3",
+    "sha256": "0cxz4pqvb8l0wqpc4hr0xmc72csqf7dpbbzdqgil9nyyg21ihkz0"
+  },
+  "qtdoc": {
+    "url": "https://invent.kde.org/qt/qt/qtdoc.git",
+    "rev": "897e90fe304d844beaf694b82a93a50237fa8b9e",
+    "sha256": "1c4m9vlgg6bfw7hwzanl5s4vslg0r7xiz50lanhqrlcrr9i36xs1"
+  },
+  "qtgamepad": {
+    "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
+    "rev": "64afa18a0a1e9588060e2e6d917bb01ccdd48a81",
+    "sha256": "1h9yb0asprynnb2qyjbmyglrkk9f9v19g6zzpk0gmixrp0h8gk46"
+  },
+  "qtgraphicaleffects": {
+    "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
+    "rev": "c36998dc1581167b12cc3de8e4ac68c2a5d9f76e",
+    "sha256": "0x11n2fym765z3gyb4xnfl7v6zrip1wjkkl6nx1bxaya173fvdw8"
+  },
+  "qtimageformats": {
+    "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
+    "rev": "cb82c74310837fe4e832c8ab72176a5d63e4355f",
+    "sha256": "0j4cv5sa6mm3adcjw8cv6kbzrslmhjc1rgxqgc130l8vm3vmgbkr"
+  },
+  "qtlocation": {
+    "url": "https://invent.kde.org/qt/qt/qtlocation.git",
+    "rev": "861e372b6ad81570d4f496e42fb25a6699b72f2f",
+    "sha256": "1g24pg9v6sv5zf80r48innp3h4g0hss69hnr7ygfzfvfnmmn6g52"
+  },
+  "qtlottie": {
+    "url": "https://invent.kde.org/qt/qt/qtlottie.git",
+    "rev": "fa8c8bfc6742ab98b61d1351e054e0e73e9a42f4",
+    "sha256": "1xgykaw8qjnaip6h9jx0nfadc9amb6aclk758vm5pp43dvs5j96r"
+  },
+  "qtmacextras": {
+    "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
+    "rev": "e72896968697e2a8af16a312e1560948e4c40f30",
+    "sha256": "1hndpbr1nnybn7frg76q99bk1c8fhvra6wjm0q78p4a8pinrvcms"
+  },
+  "qtmultimedia": {
+    "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
+    "rev": "bd29c87027637a013f2c5e3b549fcda84e4d7545",
+    "sha256": "11pz9zzrhsr3n78ga7l3kp3gi20rpxsa4iz3wclhcbcm2xr3nd94"
+  },
+  "qtnetworkauth": {
+    "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
+    "rev": "53870ee9bb9117702cd1f11cb1c5d1cfc2d5394a",
+    "sha256": "0idaysqpwrghih7ijrm9hagj9jw3fy9nw539fr4d9rmcggnkkzn2"
+  },
+  "qtpurchasing": {
+    "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
+    "rev": "cbf444fb570ca4f4ca21d963d2ae4010f10d473e",
+    "sha256": "1cki7n62wqm3xxn36mka0y67ngn7jvjkrvr08vsassbjb7kfsmxp"
+  },
+  "qtquick3d": {
+    "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
+    "rev": "3e3e53c834b25dc2959dd30f319d12d6f84ee1e3",
+    "sha256": "1b1khfg26zl3p28yvhwjfldqy3flh10pb5hm5z0av03rz7jy7l8s"
+  },
+  "qtquickcontrols": {
+    "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
+    "rev": "cf3f6d7fec824cdf01f9b329ab3b92b1c0e0a420",
+    "sha256": "1vxp0kwigwhqyyfm0xg8llyd1l1f4l18hmk6xqkm57xpi15x55bc"
+  },
+  "qtquickcontrols2": {
+    "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
+    "rev": "be66bf9a5618c745d2a6ee2262967af6307b3b07",
+    "sha256": "11h3f3rb2kqgsw7njzhjwazw1k03v12i83irjndylafiaqw6c6ks"
+  },
+  "qtquicktimeline": {
+    "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
+    "rev": "67503cdadea43b95ddad0de1a04951aff0ce1a07",
+    "sha256": "0h4b3ibcf6rsmqmcfbwbk9pbvw3b9cac8nx2538aqvnpyyp1vhid"
+  },
+  "qtremoteobjects": {
+    "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
+    "rev": "4d6d1e35fb8e0cb900b5e5e9266edea51dc4f735",
+    "sha256": "1zbxl5jk7x8qklrnbbaikymyviigqdq7vf0wc8gzls4126vcx146"
+  },
+  "qtscript": {
+    "url": "https://invent.kde.org/qt/qt/qtscript.git",
+    "rev": "5cec94b2c1503f106f4ef4778d016410ebb86211",
+    "sha256": "1xdri98cw7m78k9kfb53cgh8wyz98q3i623jhhcv01rvy1zsf8m1"
+  },
+  "qtscxml": {
+    "url": "https://invent.kde.org/qt/qt/qtscxml.git",
+    "rev": "7a15000f42c7a3171719727cd056f82a78244ed7",
+    "sha256": "1i2ajsj9pb1s4lk4djj1h1ay9mkz1z3m75a747cspyc1p1iymipq"
+  },
+  "qtsensors": {
+    "url": "https://invent.kde.org/qt/qt/qtsensors.git",
+    "rev": "921a31375f29e429e95352b08b2b9dbfea663cb1",
+    "sha256": "1ijayk6lf34nwv7s3ib3cfqx9sjrmr1c6jnziwmxa1l6fy3ik4g8"
+  },
+  "qtserialbus": {
+    "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
+    "rev": "8884c5e43df846deac5a0c7c290eeb633d6bfe32",
+    "sha256": "1ydb5x21j26pl58mr6klnwixkqx8h119nvnzvyawz83gji3ay3a5"
+  },
+  "qtserialport": {
+    "url": "https://invent.kde.org/qt/qt/qtserialport.git",
+    "rev": "941d1d8560d1f3e40077c251fbde6fd6a5b0f0d4",
+    "sha256": "0x7ly67gddmz0hqls9109bk4rgaa97ksyv24qk4brrhzkpr7q9cx"
+  },
+  "qtspeech": {
+    "url": "https://invent.kde.org/qt/qt/qtspeech.git",
+    "rev": "a0efc38377e5bf7eed2d354d1cb4d7a0d5dc7e1b",
+    "sha256": "1ljf45f65pfp8x367qnzl0ssz7n17cxhk29qvqpz9z7rh65zqix5"
+  },
+  "qtsvg": {
+    "url": "https://invent.kde.org/qt/qt/qtsvg.git",
+    "rev": "24128cdf8bef53eddf31a5709bbbc46293006b1c",
+    "sha256": "0vinjcbq4saxhlmvb5i93bzgg30qc3j8r2qfwrzaxc4vmfhfgi56"
+  },
+  "qttools": {
+    "url": "https://invent.kde.org/qt/qt/qttools.git",
+    "rev": "33693a928986006d79c1ee743733cde5966ac402",
+    "sha256": "02n0lppsp6g4s9bdvnfxpf7ndkbs9bzm0clcwvirwf2cd8q95a4n"
+  },
+  "qttranslations": {
+    "url": "https://invent.kde.org/qt/qt/qttranslations.git",
+    "rev": "8fbbdf21f127197f97b58c7d80d2fa2a59135638",
+    "sha256": "06r2jb2fsdr5fvxs748war0lr4mm3l3d3b37xc4n73y294vwrmn7"
+  },
+  "qtvirtualkeyboard": {
+    "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
+    "rev": "353b75b2e34bdae901625bbddf5c5e3f3e6c0de5",
+    "sha256": "12nv773zc05yrbai1z6i481yinih0kxcjzgm9pa0580qz69gd9a5"
+  },
+  "qtwayland": {
+    "url": "https://invent.kde.org/qt/qt/qtwayland.git",
+    "rev": "992833ca741efe8f533c61abfaf129a1d8bfcfee",
+    "sha256": "1w8mq38k6s0fncqv113bw1pc7g10ysfmsbyg23hxh9fr5q4ia4q7"
+  },
+  "qtwebchannel": {
+    "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
+    "rev": "47be9a51b01d9fd9e7f6dca81e98d4eedcec6d38",
+    "sha256": "167rp43c86xr4grzxs4bl46y6sf1q9xa0641mgp4r94g2ipxyc1d"
+  },
+  "qtwebglplugin": {
+    "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
+    "rev": "550a8cee241bbf8c11863dec9587d579dcb1108b",
+    "sha256": "0p1y0b8zsm7rrkhhylndp282ghgki2cjrgc4n5zhjn732ahxg515"
+  },
+  "qtwebsockets": {
+    "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
+    "rev": "e7883bc64440b1ff4666272ac6eb710ee4bc221b",
+    "sha256": "1rj99y1f0wn6g1m2k53xkni5v79zgq25yv8b9wx2bz0n2r9iasca"
+  },
+  "qtwebview": {
+    "url": "https://invent.kde.org/qt/qt/qtwebview.git",
+    "rev": "920de5f1cd9f9001cfef1bfd2c19e6720793362f",
+    "sha256": "04hnqalabhypkd2hgl45jxf9p1p6dgjwlc5b7gs4f6588lafgd3f"
+  },
+  "qtwinextras": {
+    "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
+    "rev": "3df03dab21f3e84d5a7274c64dd879854ca1bfe7",
+    "sha256": "12dkw982xcm7hxw3lxhg34wny4srbickxm9s3nz7bdyp9dmqnygx"
+  },
+  "qtx11extras": {
+    "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
+    "rev": "3898f5484fd4864b047729bfeda9a1222f32364f",
+    "sha256": "04rp8arml19b03iybd7sa78dsdv7386m9ymmgqciwl13dhwjssra"
+  },
+  "qtxmlpatterns": {
+    "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
+    "rev": "189e28d0aff1f3d7960228ba318b83e3cadac98c",
+    "sha256": "0vs9j2i1dnlivcrzz175zz66ql1m8mrdqkglvyqjqv6cb7mpskrq"
+  }
+}
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 70e9c3a80225d..e254912b6009f 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,342 +1,72 @@
-# DO NOT EDIT! This file is generated automatically.
-# Command: ./maintainers/scripts/fetch-kde-qt.sh pkgs/development/libraries/qt-5/5.15
-{ fetchurl, mirror }:
+{ lib, fetchgit, fetchFromGitHub }:
 
-{
-  qt3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qt3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "03ed6a48c813c75296c19f5d721184ab168280b69d2656cf16f877d3d4c55c1d";
-      name = "qt3d-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtactiveqt = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtactiveqt-everywhere-src-5.15.2.tar.xz";
-      sha256 = "868161fee0876d17079cd5bed58d1667bf19ffd0018cbe515129f11510ad2a5c";
-      name = "qtactiveqt-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtandroidextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtandroidextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "5813278690d89a9c232eccf697fc280034de6f9f02a7c40d95ad5fcf8ac8dabd";
-      name = "qtandroidextras-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtbase = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtbase-everywhere-src-5.15.2.tar.xz";
-      sha256 = "909fad2591ee367993a75d7e2ea50ad4db332f05e1c38dd7a5a274e156a4e0f8";
-      name = "qtbase-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtcharts = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtcharts-everywhere-src-5.15.2.tar.xz";
-      sha256 = "e0750e4195bd8a8b9758ab4d98d437edbe273cd3d289dd6a8f325df6d13f3d11";
-      name = "qtcharts-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtconnectivity = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtconnectivity-everywhere-src-5.15.2.tar.xz";
-      sha256 = "0380327871f76103e5b8c2a305988d76d352b6a982b3e7b3bc3cdc184c64bfa0";
-      name = "qtconnectivity-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdatavis3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdatavis3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "226a6575d573ad78aca459709722c496c23aee526aa0c38eb7c93b0bea1eb6fd";
-      name = "qtdatavis3d-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdeclarative = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdeclarative-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c600d09716940f75d684f61c5bdaced797f623a86db1627da599027f6c635651";
-      name = "qtdeclarative-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdoc = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdoc-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a47809f00f1bd690ca4e699cb32ffe7717d43da84e0167d1f562210da7714ce4";
-      name = "qtdoc-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtgamepad = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtgamepad-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c77611f7898326d69176ad67a9b886f617cdedc368ec29f223d63537d25b075c";
-      name = "qtgamepad-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtgraphicaleffects = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtgraphicaleffects-everywhere-src-5.15.2.tar.xz";
-      sha256 = "ec8d67f64967d5046410490b549c576f9b9e8b47ec68594ae84aa8870173dfe4";
-      name = "qtgraphicaleffects-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtimageformats = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtimageformats-everywhere-src-5.15.2.tar.xz";
-      sha256 = "bf8285c7ce04284527ab823ddc7cf48a1bb79131db3a7127342167f4814253d7";
-      name = "qtimageformats-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtlocation = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtlocation-everywhere-src-5.15.2.tar.xz";
-      sha256 = "984fcb09e108df49a8dac35d5ce6dffc49caafd2acb1c2f8a5173a6a21f392a0";
-      name = "qtlocation-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtlottie = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtlottie-everywhere-src-5.15.2.tar.xz";
-      sha256 = "cec6095ab8f714e609d2ad3ea8c4fd819461ce8793adc42abe37d0f6dc432517";
-      name = "qtlottie-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtmacextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtmacextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "6959b0f2cec71cd66800f36cab797430860e55fa33c9c23698d6a08fc2b8776e";
-      name = "qtmacextras-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtmultimedia = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtmultimedia-everywhere-src-5.15.2.tar.xz";
-      sha256 = "0c3758810e5131aabcf76e4965e4c18b8911af54d9edd9305d2a8278d8346df5";
-      name = "qtmultimedia-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtnetworkauth = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtnetworkauth-everywhere-src-5.15.2.tar.xz";
-      sha256 = "fcc2ec42faa68561efa8f00cd72e662fbc06563ebc6de1dc42d96bb2997acd85";
-      name = "qtnetworkauth-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtpurchasing = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtpurchasing-everywhere-src-5.15.2.tar.xz";
-      sha256 = "87120d319ff2f8106e78971f7296d72a66dfe91e763d213199aea55046e93227";
-      name = "qtpurchasing-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquick3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquick3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "5b0546323365ce34e4716f22f305ebb4902e222c1a0910b65ee448443c2f94bb";
-      name = "qtquick3d-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquickcontrols = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquickcontrols-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c393fb7384b1f047f10e91a6832cf3e6a4c2a41408b8cb2d05af2283e8549fb5";
-      name = "qtquickcontrols-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquickcontrols2 = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquickcontrols2-everywhere-src-5.15.2.tar.xz";
-      sha256 = "671b6ce5f4b8ecc94db622d5d5fb29ef4ff92819be08e5ea55bfcab579de8919";
-      name = "qtquickcontrols2-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquicktimeline = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquicktimeline-everywhere-src-5.15.2.tar.xz";
-      sha256 = "b9c247227607437acec7c7dd18ad46179d20369c9d22bdb1e9fc128dfb832a28";
-      name = "qtquicktimeline-everywhere-src-5.15.2.tar.xz";
-    };
+let
+  version = "5.15.3";
+  overrides = {
+    qtscript.version = "5.15.4";
   };
-  qtremoteobjects = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtremoteobjects-everywhere-src-5.15.2.tar.xz";
-      sha256 = "6781b6bc90888254ea77ce812736dac00c67fa4eeb3095f5cd65e4b9c15dcfc2";
-      name = "qtremoteobjects-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtscript = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtscript-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a299715369afbd1caa4d7fa2875d442eab91adcaacafce54a36922442624673e";
-      name = "qtscript-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtscxml = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtscxml-everywhere-src-5.15.2.tar.xz";
-      sha256 = "60b9590b9a41c60cee7b8a8c8410ee4625f0389c1ff8d79883ec5a985638a7dc";
-      name = "qtscxml-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtsensors = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtsensors-everywhere-src-5.15.2.tar.xz";
-      sha256 = "3f0011f9e9942cad119146b54d960438f4568a22a274cdad4fae06bb4e0e4839";
-      name = "qtsensors-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtserialbus = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtserialbus-everywhere-src-5.15.2.tar.xz";
-      sha256 = "aeeb7e5c0d3f8503215b22e1a84c0002ca67cf63862f6e3c6ef44a67ca31bd88";
-      name = "qtserialbus-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtserialport = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtserialport-everywhere-src-5.15.2.tar.xz";
-      sha256 = "59c559d748417306bc1b2cf2315c1e63eed011ace38ad92946af71f23e2ef79d";
-      name = "qtserialport-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtspeech = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtspeech-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c810fb9eecb08026434422a32e79269627f3bc2941be199e86ec410bdfe883f5";
-      name = "qtspeech-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtsvg = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtsvg-everywhere-src-5.15.2.tar.xz";
-      sha256 = "8bc3c2c1bc2671e9c67d4205589a8309b57903721ad14c60ea21a5d06acb585e";
-      name = "qtsvg-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qttools = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qttools-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c189d0ce1ff7c739db9a3ace52ac3e24cb8fd6dbf234e49f075249b38f43c1cc";
-      name = "qttools-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qttranslations = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qttranslations-everywhere-src-5.15.2.tar.xz";
-      sha256 = "d5788e86257b21d5323f1efd94376a213e091d1e5e03b45a95dd052b5f570db8";
-      name = "qttranslations-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtvirtualkeyboard = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtvirtualkeyboard-everywhere-src-5.15.2.tar.xz";
-      sha256 = "9a3193913be30f09a896e3b8c2f9696d2e9b3f88a63ae9ca8c97a2786b68cf55";
-      name = "qtvirtualkeyboard-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwayland = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwayland-everywhere-src-5.15.2.tar.xz";
-      sha256 = "193732229ff816f3aaab9a5e2f6bed71ddddbf1988ce003fe8dd84a92ce9aeb5";
-      name = "qtwayland-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebchannel = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebchannel-everywhere-src-5.15.2.tar.xz";
-      sha256 = "127fe79c43b386713f151ed7d411cd81e45e29f9c955584f29736f78c9303ec1";
-      name = "qtwebchannel-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebengine = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebengine-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c8afca0e43d84f7bd595436fbe4d13a5bbdb81ec5104d605085d07545b6f91e0";
-      name = "qtwebengine-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebglplugin = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebglplugin-everywhere-src-5.15.2.tar.xz";
-      sha256 = "81e782b517ed29e10bea1aa90c9f59274c98a910f2c8b105fa78368a36b41446";
-      name = "qtwebglplugin-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebsockets = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebsockets-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a0b42d85dd34ff6e2d23400e02f83d8b85bcd80e60efd1521d12d9625d4a233f";
-      name = "qtwebsockets-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebview = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebview-everywhere-src-5.15.2.tar.xz";
-      sha256 = "be9f46167e4977ead5ef5ecf883fdb812a4120f2436383583792f65557e481e7";
-      name = "qtwebview-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwinextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwinextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "65b8272005dec00791ab7d81ab266d1e3313a3bbd8e54e546d984cf4c4ab550e";
-      name = "qtwinextras-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtx11extras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtx11extras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "7014702ee9a644a5a93da70848ac47c18851d4f8ed622b29a72eed9282fc6e3e";
-      name = "qtx11extras-everywhere-src-5.15.2.tar.xz";
-    };
+
+  mk = name: args:
+    let
+      override = overrides.${name} or {};
+    in
+    {
+      version = override.version or version;
+      src = override.src or
+        fetchgit {
+          inherit (args) url rev sha256;
+          fetchLFS = false;
+          fetchSubmodules = false;
+          deepClone = false;
+          leaveDotGit = false;
+        };
+    };
+in
+lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
+// {
+  # qtwebkit does not have an official release tarball on the qt mirror and is
+  # mostly maintained by the community.
+  qtwebkit = rec {
+    src = fetchFromGitHub {
+      owner = "qt";
+      repo = "qtwebkit";
+      rev = "v${version}";
+      sha256 = "0x8rng96h19xirn7qkz3lydal6v4vn00bcl0s3brz36dfs0z8wpg";
+    };
+    version = "5.212.0-alpha4";
   };
-  qtxmlpatterns = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtxmlpatterns-everywhere-src-5.15.2.tar.xz";
-      sha256 = "76ea2162a7c349188d7e7e4f6c77b78e8a205494c90fee3cea3487a1ae2cf2fa";
-      name = "qtxmlpatterns-everywhere-src-5.15.2.tar.xz";
+
+  qtwebengine =
+    let
+      branchName = "5.15.6";
+      rev = "v${branchName}-lts";
+    in
+    {
+      version = "${branchName}-${lib.substring 0 7 rev}";
+
+      src = fetchgit {
+        url = "https://github.com/qt/qtwebengine.git";
+        sha256 = "17bw9yf04zmr9ck5jkrd435c8b03zpf937vn2nwgsr8p78wkg3kr";
+        inherit rev branchName;
+        fetchSubmodules = true;
+        leaveDotGit = true;
+        name = "qtwebengine-${lib.substring 0 7 rev}.tar.gz";
+        postFetch = ''
+          # remove submodule .git directory
+          rm -rf "$out/src/3rdparty/.git"
+
+          # compress to not exceed the 2GB output limit
+          # try to make a deterministic tarball
+          tar -I 'gzip -n' \
+            --sort=name \
+            --mtime=1970-01-01 \
+            --owner=root --group=root \
+            --numeric-owner --mode=go=rX,u+rw,a-s \
+            --transform='s@^@source/@' \
+            -cf temp  -C "$out" .
+          rm -r "$out"
+          mv temp "$out"
+        '';
+      };
     };
-  };
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 0d82acc709297..44f08699824fb 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -115,6 +115,8 @@ stdenv.mkDerivation {
     sed -i '/PATHS.*NO_DEFAULT_PATH/ d' src/corelib/Qt5CoreMacros.cmake
     sed -i 's/NO_DEFAULT_PATH//' src/gui/Qt5GuiConfigExtras.cmake.in
     sed -i '/PATHS.*NO_DEFAULT_PATH/ d' mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+  '' + lib.optionalString (compareVersion "5.15.0" >= 0) ''
+    patchShebangs ./bin
   '' + (
     if stdenv.isDarwin then ''
         sed -i \
@@ -149,6 +151,8 @@ stdenv.mkDerivation {
     ''}
 
     NIX_CFLAGS_COMPILE+=" -DNIXPKGS_QT_PLUGIN_PREFIX=\"$qtPluginPrefix\""
+  '' + lib.optionalString (compareVersion "5.15.0" >= 0) ''
+    ./bin/syncqt.pl -version $version
   '';
 
   postConfigure = ''
diff --git a/pkgs/development/libraries/qt-5/qtModule.nix b/pkgs/development/libraries/qt-5/qtModule.nix
index 767cbc91142d0..12a9a85c7b790 100644
--- a/pkgs/development/libraries/qt-5/qtModule.nix
+++ b/pkgs/development/libraries/qt-5/qtModule.nix
@@ -31,6 +31,23 @@ mkDerivation (args // {
     ${args.preConfigure or ""}
 
     fixQtBuiltinPaths . '*.pr?'
+  '' + lib.optionalString (builtins.compareVersions "5.15.0" version <= 0)
+  # Note: We use ${version%%-*} to remove any tag from the end of the version
+  # string. Version tags are added by Nixpkgs maintainers and not reflected in
+  # the source version.
+  ''
+    if [[ -z "$dontCheckQtModuleVersion" ]] \
+        && grep -q '^MODULE_VERSION' .qmake.conf 2>/dev/null \
+        && ! grep -q -F "''${version%%-*}" .qmake.conf 2>/dev/null
+    then
+      echo >&2 "error: could not find version ''${version%%-*} in .qmake.conf"
+      echo >&2 "hint: check .qmake.conf and update the package version in Nixpkgs"
+      exit 1
+    fi
+
+    if [[ -z "$dontSyncQt" && -f sync.profile ]]; then
+      syncqt.pl -version "''${version%%-*}"
+    fi
   '';
 
   dontWrapQtApps = args.dontWrapQtApps or true;
diff --git a/pkgs/development/libraries/snappy/default.nix b/pkgs/development/libraries/snappy/default.nix
index ece425e85c417..f2b83136cb23d 100644
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@@ -4,17 +4,15 @@
 
 stdenv.mkDerivation rec {
   pname = "snappy";
-  version = "1.1.8";
+  version = "1.1.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "snappy";
     rev = version;
-    sha256 = "1j0kslq2dvxgkcxl1gakhvsa731yrcvcaipcp5k8k7ayicvkv9jv";
+    sha256 = "sha256-JXWl63KVP+CDNWIXYtz+EKqWLJbPKl3ifhr8dKAp/w8=";
   };
 
-  patches = [ ./disable-benchmark.patch ];
-
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
@@ -22,16 +20,28 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
     "-DCMAKE_SKIP_BUILD_RPATH=OFF"
+    "-DSNAPPY_BUILD_TESTS=OFF"
+    "-DSNAPPY_BUILD_BENCHMARKS=OFF"
   ];
 
   postInstall = ''
     substituteInPlace "$out"/lib/cmake/Snappy/SnappyTargets.cmake \
       --replace 'INTERFACE_INCLUDE_DIRECTORIES "''${_IMPORT_PREFIX}/include"' 'INTERFACE_INCLUDE_DIRECTORIES "'$dev'"'
+
+    mkdir -p $dev/lib/pkgconfig
+    cat <<EOF > $dev/lib/pkgconfig/snappy.pc
+      Name: snappy
+      Description: Fast compressor/decompressor library.
+      Version: ${version}
+      Libs: -L$out/lib -lsnappy
+      Cflags: -I$dev/include
+    EOF
   '';
 
-  checkTarget = "test";
+  #checkTarget = "test";
 
-  doCheck = true;
+  # requires gbenchmark and gtest but it also installs them out $dev
+  doCheck = false;
 
   meta = with lib; {
     homepage = "https://google.github.io/snappy/";
diff --git a/pkgs/development/libraries/snappy/disable-benchmark.patch b/pkgs/development/libraries/snappy/disable-benchmark.patch
deleted file mode 100644
index c891c13fe74c9..0000000000000
--- a/pkgs/development/libraries/snappy/disable-benchmark.patch
+++ /dev/null
@@ -1,5 +0,0 @@
---- a/snappy-test.cc
-+++ b/snappy-test.cc
-@@ -46 +46 @@
--DEFINE_bool(run_microbenchmarks, true,
-+DEFINE_bool(run_microbenchmarks, false,
diff --git a/pkgs/development/libraries/srtp/default.nix b/pkgs/development/libraries/srtp/default.nix
index b0ab391a89f00..6c903805175fd 100644
--- a/pkgs/development/libraries/srtp/default.nix
+++ b/pkgs/development/libraries/srtp/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsrtp";
-  version = "2.4.0";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = "libsrtp";
     rev = "v${version}";
-    sha256 = "0syl2ywddgqz29h43d6rc7waf3hp2yc14yhnrvdsja2bg8wrv6sb";
+    sha256 = "sha256-6FAkfxC7Tg7uIAmTmRt5Sn8/YofILfpe7Y4pSaq8XL8=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/xalanc/default.nix b/pkgs/development/libraries/xalanc/default.nix
index b757b737f976c..ba1e1a4c662df 100644
--- a/pkgs/development/libraries/xalanc/default.nix
+++ b/pkgs/development/libraries/xalanc/default.nix
@@ -22,6 +22,15 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ xercesc getopt ];
 
+  # Parallel build fails as:
+  #   c++ ... -c ... ExecutionContext.cpp
+  #   ProblemListenerBase.hpp:28:10: fatal error: LocalMsgIndex.hpp: No such file or directory
+  # The build failure happens due to missing intra-project dependencies
+  # against generated headers. Future 1.12 version dropped
+  # autotools-based build system. Let's disable parallel builds until
+  # next release.
+  enableParallelBuilding = false;
+
   meta = {
     homepage = "http://xalan.apache.org/";
     description = "A XSLT processor for transforming XML documents";
diff --git a/pkgs/development/python-modules/Nikola/default.nix b/pkgs/development/python-modules/Nikola/default.nix
index ae18ce5dc3195..364e50c1024c9 100644
--- a/pkgs/development/python-modules/Nikola/default.nix
+++ b/pkgs/development/python-modules/Nikola/default.nix
@@ -30,7 +30,7 @@
 , pytestCheckHook
 , pythonOlder
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , stdenv
 , toml
 , typogrify
@@ -75,7 +75,7 @@ buildPythonPackage rec {
     pyphen
     PyRSS2Gen
     requests
-    ruamel_yaml
+    ruamel-yaml
     toml
     typogrify
     unidecode
diff --git a/pkgs/development/python-modules/argon2_cffi/default.nix b/pkgs/development/python-modules/argon2_cffi/default.nix
index eec01adfebcac..a40fb806845e6 100644
--- a/pkgs/development/python-modules/argon2_cffi/default.nix
+++ b/pkgs/development/python-modules/argon2_cffi/default.nix
@@ -8,19 +8,25 @@
 , fetchPypi
 , isPy3k
 , lib
+, stdenv
 }:
 
 buildPythonPackage rec {
   pname = "argon2_cffi";
-  version = "20.1.0";
+  version = "21.1.0";
 
   src = fetchPypi {
     pname = "argon2-cffi";
     inherit version;
-    sha256 = "0zgr4mnnm0p4i99023safb0qb8cgvl202nly1rvylk2b7qnrn0nq";
+    sha256 = "sha256-9xC2EQPRofaSyj7L0Tc+KKpeVFrGJboGf/L+yhsruHA=";
   };
 
   propagatedBuildInputs = [ cffi six ] ++ lib.optional (!isPy3k) enum34;
+
+  propagatedNativeBuildInputs = [ cffi ];
+
+  ARGON2_CFFI_USE_SSE2 = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) "0";
+
   checkInputs = [ hypothesis pytest wheel ];
   checkPhase = ''
     pytest tests
diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index f1128c010957f..5eea9a5579a19 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -1,27 +1,29 @@
-{ stdenv
+{ lib
+, stdenv
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
-, lib
 }:
 
 buildPythonPackage rec {
-  version = "3.3.4";
+  version = "3.4.1";
   pname = "asgiref";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "django";
     repo = pname;
     rev = version;
-    sha256 = "1rr76252l6p12yxc0q4k9wigg1jz8nsqga9c0nixy9q77zhvh9n2";
+    sha256 = "sha256-aXD46qH5sTTmp0rlzQGLAN+MfIz1u6obCwtfqoIYgBA=";
   };
 
-  propagatedBuildInputs = [ async-timeout ];
+  propagatedBuildInputs = [
+    async-timeout
+  ];
 
   checkInputs = [
     pytestCheckHook
@@ -32,9 +34,12 @@ buildPythonPackage rec {
     "test_multiprocessing"
   ];
 
+  pythonImportsCheck = [ "asgiref" ];
+
   meta = with lib; {
     description = "Reference ASGI adapters and channel layers";
-    license = licenses.bsd3;
     homepage = "https://github.com/django/asgiref";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/bcrypt/default.nix b/pkgs/development/python-modules/bcrypt/default.nix
index cfd17262a2b35..d6347b1790465 100644
--- a/pkgs/development/python-modules/bcrypt/default.nix
+++ b/pkgs/development/python-modules/bcrypt/default.nix
@@ -15,6 +15,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ six ] ++ lib.optional (!isPyPy) cffi;
 
+  propagatedNativeBuildInputs = lib.optional (!isPyPy) cffi;
+
   meta = with lib; {
     maintainers = with maintainers; [ domenkozar ];
     description = "Modern password hashing for your software and your servers";
diff --git a/pkgs/development/python-modules/brotlicffi/default.nix b/pkgs/development/python-modules/brotlicffi/default.nix
index 06cb2bf758058..f78598b751a65 100644
--- a/pkgs/development/python-modules/brotlicffi/default.nix
+++ b/pkgs/development/python-modules/brotlicffi/default.nix
@@ -22,6 +22,10 @@ buildPythonPackage rec {
     brotli
   ];
 
+  propagatedNativeBuildInputs = [
+    cffi
+  ];
+
   propagatedBuildInputs = [
     cffi
   ];
diff --git a/pkgs/development/python-modules/brotlipy/default.nix b/pkgs/development/python-modules/brotlipy/default.nix
index f914d2d6c97c6..2cc918b288ce5 100644
--- a/pkgs/development/python-modules/brotlipy/default.nix
+++ b/pkgs/development/python-modules/brotlipy/default.nix
@@ -19,6 +19,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ cffi enum34 construct ];
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   checkInputs = [ pytest hypothesis ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/cairocffi/default.nix b/pkgs/development/python-modules/cairocffi/default.nix
index 9b64dbeb66c17..8e26517ba2185 100644
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@@ -8,7 +8,6 @@
 , makeFontsConf
 , freefont_ttf
 , pytest
-, pytest-runner
 , glibcLocales
 , cairo
 , cffi
diff --git a/pkgs/development/python-modules/cairocffi/generic.nix b/pkgs/development/python-modules/cairocffi/generic.nix
index cdcdbad3395dd..004cf8ae78414 100644
--- a/pkgs/development/python-modules/cairocffi/generic.nix
+++ b/pkgs/development/python-modules/cairocffi/generic.nix
@@ -23,8 +23,20 @@ buildPythonPackage rec {
     fontDirectories = [ freefont_ttf ];
   };
 
-  checkInputs = [ numpy pytest pytest-runner glibcLocales ];
   propagatedBuildInputs = [ cairo cffi ] ++ lib.optional withXcffib xcffib;
+  propagatedNativeBuildInputs = [ cffi ];
+
+  # pytestCheckHook does not work
+  checkInputs = [ numpy pytest glibcLocales ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pytest-runner" "" \
+      --replace "pytest-cov" "" \
+      --replace "pytest-flake8" "" \
+      --replace "pytest-isort" "" \
+      --replace "--flake8 --isort" ""
+  '';
 
   checkPhase = ''
     py.test $out/${python.sitePackages}
diff --git a/pkgs/development/python-modules/cairosvg/default.nix b/pkgs/development/python-modules/cairosvg/default.nix
index 5e8e8d985aab5..df6600e3faacd 100644
--- a/pkgs/development/python-modules/cairosvg/default.nix
+++ b/pkgs/development/python-modules/cairosvg/default.nix
@@ -8,9 +8,6 @@
 , pillow
 , tinycss2
 , pytestCheckHook
-, pytest-runner
-, pytest-flake8
-, pytest-isort
 }:
 
 buildPythonPackage rec {
@@ -23,11 +20,21 @@ buildPythonPackage rec {
     sha256 = "sha256-sLmSnPXboAUXjXRqgDb88AJVUPSYylTbYYczIjhHg7w=";
   };
 
-  nativeBuildInputs = [ pytest-runner ];
-
   propagatedBuildInputs = [ cairocffi cssselect2 defusedxml pillow tinycss2 ];
 
-  checkInputs = [ pytestCheckHook pytest-flake8 pytest-isort ];
+  propagatedNativeBuildInputs = [ cairocffi ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pytest-runner" "" \
+      --replace "pytest-flake8" "" \
+      --replace "pytest-isort" "" \
+      --replace "pytest-cov" "" \
+      --replace "--flake8" "" \
+      --replace "--isort" ""
+  '';
 
   pytestFlagsArray = [
     "cairosvg/test_api.py"
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index a9e83804f7071..3e2e8b6e24f17 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -9,16 +9,16 @@
 
 buildPythonPackage rec {
   pname = "click";
-  version = "8.0.2";
+  version = "8.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7027bc7bbafaab8b2c2816861d8eb372429ee3c02e193fc2f93d6c4ab9de49c5";
+    sha256 = "sha256-QQ6TKwUPXu13PEzalN51lxyJzbMVWnKggxE5p55ey1s=";
   };
 
   postPatch = ''
     substituteInPlace src/click/_unicodefun.py \
-      --replace "'locale'" "'${locale}/bin/locale'"
+      --replace '"locale"' "'${locale}/bin/locale'"
   '';
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
diff --git a/pkgs/development/python-modules/cmarkgfm/default.nix b/pkgs/development/python-modules/cmarkgfm/default.nix
index 42fff42458b3b..1085f4030c1ed 100644
--- a/pkgs/development/python-modules/cmarkgfm/default.nix
+++ b/pkgs/development/python-modules/cmarkgfm/default.nix
@@ -14,6 +14,8 @@ buildPythonPackage rec {
     sha256 = "ec2bf8d5799c4b5bbfbae30a4a1dfcb06512f2e17e9ee60ba7e1d390318582fc";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   checkInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/conda/default.nix b/pkgs/development/python-modules/conda/default.nix
index b097805292e9f..5f1b56cbcde4e 100644
--- a/pkgs/development/python-modules/conda/default.nix
+++ b/pkgs/development/python-modules/conda/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 , pycosat
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , isPy3k
 , enum34
 }:
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     sha256 = "a91ef821343dea3ba9670f3d10b36c1ace4f4c36d70c175d8fc8886e94285953";
   };
 
-  propagatedBuildInputs = [ pycosat requests ruamel_yaml ] ++ lib.optional (!isPy3k) enum34;
+  propagatedBuildInputs = [ pycosat requests ruamel-yaml ] ++ lib.optional (!isPy3k) enum34;
 
   # No tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/construct/2.10.54.nix b/pkgs/development/python-modules/construct/2.10.54.nix
index 6bb279490ab29..b4eaeaec3910a 100644
--- a/pkgs/development/python-modules/construct/2.10.54.nix
+++ b/pkgs/development/python-modules/construct/2.10.54.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
-, six, pytestCheckHook, pytest-benchmark, enum34, numpy, arrow, ruamel_yaml
+, six, pytestCheckHook, pytest-benchmark, enum34, numpy, arrow, ruamel-yaml
 }:
 
 buildPythonPackage rec {
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     sha256 = "1mqspsn6bf3ibvih1zna2glkg8iw7vy5zg9gzg0d1m8zcndk2c48";
   };
 
-  checkInputs = [ pytestCheckHook pytest-benchmark enum34 numpy arrow ruamel_yaml ];
+  checkInputs = [ pytestCheckHook pytest-benchmark enum34 numpy arrow ruamel-yaml ];
 
   disabledTests = lib.optionals stdenv.isDarwin [ "test_multiprocessing" ];
 
diff --git a/pkgs/development/python-modules/construct/default.nix b/pkgs/development/python-modules/construct/default.nix
index 4ad78ddad3b60..47ae573e24c2d 100644
--- a/pkgs/development/python-modules/construct/default.nix
+++ b/pkgs/development/python-modules/construct/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
-, six, pytestCheckHook, pytest-benchmark, numpy, arrow, ruamel_yaml
+, six, pytestCheckHook, pytest-benchmark, numpy, arrow, ruamel-yaml
 , lz4, cloudpickle
 }:
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     lz4
   ];
 
-  checkInputs = [ pytestCheckHook pytest-benchmark numpy arrow ruamel_yaml cloudpickle ];
+  checkInputs = [ pytestCheckHook pytest-benchmark numpy arrow ruamel-yaml cloudpickle ];
 
   disabledTests = lib.optionals stdenv.isDarwin [ "test_multiprocessing" ];
 
diff --git a/pkgs/development/python-modules/dateparser/0.x.nix b/pkgs/development/python-modules/dateparser/0.x.nix
index 2aab262e64d2e..35125453e7869 100644
--- a/pkgs/development/python-modules/dateparser/0.x.nix
+++ b/pkgs/development/python-modules/dateparser/0.x.nix
@@ -11,7 +11,7 @@
 , convertdate
 , umalqurra
 , jdatetime
-, ruamel_yaml
+, ruamel-yaml
 }:
 
 buildPythonPackage rec {
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     # install_requires
     python-dateutil pytz regex tzlocal
     # extra_requires
-    convertdate umalqurra jdatetime ruamel_yaml
+    convertdate umalqurra jdatetime ruamel-yaml
   ];
 
   pythonImportsCheck = [ "dateparser" ];
diff --git a/pkgs/development/python-modules/dateparser/default.nix b/pkgs/development/python-modules/dateparser/default.nix
index e1f2f93368779..f75a355c21841 100644
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@@ -14,7 +14,7 @@
 , parameterized
 , pytestCheckHook
 , GitPython
-, ruamel_yaml
+, ruamel-yaml
 }:
 
 buildPythonPackage rec {
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     parameterized
     pytestCheckHook
     GitPython
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/drf-yasg/default.nix b/pkgs/development/python-modules/drf-yasg/default.nix
index 45842fb809ccc..4b55a08f842da 100644
--- a/pkgs/development/python-modules/drf-yasg/default.nix
+++ b/pkgs/development/python-modules/drf-yasg/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , inflection
-, ruamel_yaml
+, ruamel-yaml
 , setuptools-scm
 , six
 , coreapi
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     six
     inflection
-    ruamel_yaml
+    ruamel-yaml
     coreapi
     djangorestframework
   ];
diff --git a/pkgs/development/python-modules/editdistance-s/default.nix b/pkgs/development/python-modules/editdistance-s/default.nix
index 8d9be707f9b44..548da09b993d3 100644
--- a/pkgs/development/python-modules/editdistance-s/default.nix
+++ b/pkgs/development/python-modules/editdistance-s/default.nix
@@ -16,6 +16,8 @@ buildPythonPackage rec {
     sha256 = "0w2qd5b6a3c3ahd0xy9ykq4wzqk0byqwdqrr26dyn8j2425j46lg";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   checkInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/fastpbkdf2/default.nix b/pkgs/development/python-modules/fastpbkdf2/default.nix
index e154471d7a881..51669f90345d7 100644
--- a/pkgs/development/python-modules/fastpbkdf2/default.nix
+++ b/pkgs/development/python-modules/fastpbkdf2/default.nix
@@ -16,6 +16,7 @@ buildPythonPackage rec {
   buildInputs = [ openssl ];
   checkInputs = [ pytest ];
   propagatedBuildInputs = [ cffi six ];
+  propagatedNativeBuildInputs = [ cffi ];
 
   meta = with lib; {
     homepage = "https://github.com/Ayrx/python-fastpbkdf2";
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index 756d3e4ddcc46..c399049816196 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , isPy27
 , mock
 , pyparsing
@@ -16,23 +15,15 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.19.1";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-e0Mq9AVJEWQ9GEtYFXk2fMIs7GtAUsyJN6XheqAnD3I=";
+    sha256 = "sha256-1zqs3YRVtm5DwewETLtRg5XhMJPJsMi0QLfeGirOURs=";
   };
 
-  patches = [
-    # fix test_inject_space
-    (fetchpatch {
-      url = "https://github.com/httplib2/httplib2/commit/08d6993b69256fbc6c0b1c615c24910803c4d610.patch";
-      sha256 = "0kbd1skn58m20kfkh4qzd66g9bvj31xlkbhsg435dkk4qz6l3yn3";
-    })
-  ];
-
   postPatch = ''
     sed -i "/--cov/d" setup.cfg
   '';
diff --git a/pkgs/development/python-modules/jc/default.nix b/pkgs/development/python-modules/jc/default.nix
index 93fd8d516051d..3a9d24c29dd8e 100644
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, ruamel_yaml
+, ruamel-yaml
 , xmltodict
 , pygments
 , pytestCheckHook
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     sha256 = "sha256-ISggj6oOF0B7TKIQAlZtauRrDAWP88OOFezLJK6edjI=";
   };
 
-  propagatedBuildInputs = [ ruamel_yaml xmltodict pygments ];
+  propagatedBuildInputs = [ ruamel-yaml xmltodict pygments ];
 
   checkInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/jupyter-repo2docker/default.nix b/pkgs/development/python-modules/jupyter-repo2docker/default.nix
index f4eb9190aa4b5..b59b9adb2484b 100644
--- a/pkgs/development/python-modules/jupyter-repo2docker/default.nix
+++ b/pkgs/development/python-modules/jupyter-repo2docker/default.nix
@@ -5,7 +5,7 @@
 , pkgs-docker
 , python-json-logger
 , pyyaml
-, ruamel_yaml
+, ruamel-yaml
 , semver
 , toml
 , traitlets
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     jinja2
     pkgs-docker
     python-json-logger
-    ruamel_yaml
+    ruamel-yaml
     semver
     toml
     traitlets
diff --git a/pkgs/development/python-modules/jupyter-telemetry/default.nix b/pkgs/development/python-modules/jupyter-telemetry/default.nix
index 9dddd8ec5684a..f7efc0a1598c4 100644
--- a/pkgs/development/python-modules/jupyter-telemetry/default.nix
+++ b/pkgs/development/python-modules/jupyter-telemetry/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 , python-json-logger
 , jsonschema
-, ruamel_yaml
+, ruamel-yaml
 , traitlets
 }:
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    python-json-logger jsonschema ruamel_yaml traitlets
+    python-json-logger jsonschema ruamel-yaml traitlets
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/liquidctl/default.nix b/pkgs/development/python-modules/liquidctl/default.nix
index 9ac682b42422d..c37183e22ec0f 100644
--- a/pkgs/development/python-modules/liquidctl/default.nix
+++ b/pkgs/development/python-modules/liquidctl/default.nix
@@ -35,6 +35,10 @@ buildPythonPackage rec {
     colorlog
   ];
 
+  propagatedNativeBuildInputs = [
+    smbus-cffi
+  ];
+
   outputs = [ "out" "man" ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index 4619b1096fd17..90000de8985ce 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchPypi, aiohttp, pythonOlder
-, sqlalchemy, ruamel_yaml, CommonMark, lxml
+, sqlalchemy, ruamel-yaml, CommonMark, lxml
 }:
 
 buildPythonPackage rec {
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
     # defined in optional-requirements.txt
     sqlalchemy
-    ruamel_yaml
+    ruamel-yaml
     CommonMark
     lxml
   ];
diff --git a/pkgs/development/python-modules/maya/default.nix b/pkgs/development/python-modules/maya/default.nix
index 4a751a188c247..baa95f7c7de2f 100644
--- a/pkgs/development/python-modules/maya/default.nix
+++ b/pkgs/development/python-modules/maya/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchPypi, fetchpatch, buildPythonPackage
-, dateparser, humanize, pendulum, ruamel_yaml, tzlocal }:
+, dateparser, humanize, pendulum, ruamel-yaml, tzlocal }:
 
 buildPythonPackage rec {
   pname = "maya";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     })
   ];
 
-  propagatedBuildInputs = [ dateparser humanize pendulum ruamel_yaml tzlocal ];
+  propagatedBuildInputs = [ dateparser humanize pendulum ruamel-yaml tzlocal ];
 
   # No tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/miniaudio/default.nix b/pkgs/development/python-modules/miniaudio/default.nix
index 2056bbb0b9468..0f3372a6048c7 100644
--- a/pkgs/development/python-modules/miniaudio/default.nix
+++ b/pkgs/development/python-modules/miniaudio/default.nix
@@ -19,9 +19,8 @@ buildPythonPackage rec {
     sha256 = "1yx4n4zax103fmjzdiqzw37zibsh68b2p2l5qvgcnx2zrrjd31yl";
   };
 
-  propagatedBuildInputs = [
-    cffi
-  ];
+  propagatedNativeBuildInputs = [ cffi ];
+  propagatedBuildInputs = [ cffi ];
 
   checkInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/misaka/default.nix b/pkgs/development/python-modules/misaka/default.nix
index 07f251f75b5f5..e4c807a5bf5e9 100644
--- a/pkgs/development/python-modules/misaka/default.nix
+++ b/pkgs/development/python-modules/misaka/default.nix
@@ -8,6 +8,8 @@ buildPythonPackage rec {
     sha256 = "1mzc29wwyhyardclj1vg2xsfdibg2lzb7f1azjcxi580ama55wv2";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   # The tests require write access to $out
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 4f31c512197de..bc5835fac5396 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -24,7 +24,7 @@
 , pyopenssl
 , pyparsing
 , pyperclip
-, ruamel_yaml
+, ruamel-yaml
 , setuptools
 , sortedcontainers
 , tornado
@@ -78,7 +78,7 @@ buildPythonPackage rec {
     pyopenssl
     pyparsing
     pyperclip
-    ruamel_yaml
+    ruamel-yaml
     sortedcontainers
     tornado
     urwid
diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index 73325c24d94c6..9f275a99c7484 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -8,7 +8,7 @@
 , pandas
 , pydantic
 , pymongo
-, ruamel_yaml
+, ruamel-yaml
 , tqdm
 }:
 
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    ruamel_yaml
+    ruamel-yaml
     tqdm
     msgpack
   ];
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index 6a167697f9cd1..0ea21ecbe405a 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -2,14 +2,14 @@
 , fetchPypi
 , buildPythonPackage
 , pytestCheckHook
-, isPy3k
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "multidict";
   version = "5.2.0";
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
@@ -17,12 +17,13 @@ buildPythonPackage rec {
   };
 
   postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov=multidict --cov-report term-missing:skip-covered --cov-report xml" ""
+    sed -i '/^addopts/d' setup.cfg
   '';
 
   checkInputs = [ pytestCheckHook ];
 
+  pythonImportsCheck = [ "multidict" ];
+
   meta = with lib; {
     description = "Multidict implementation";
     homepage = "https://github.com/aio-libs/multidict/";
diff --git a/pkgs/development/python-modules/ntc-templates/default.nix b/pkgs/development/python-modules/ntc-templates/default.nix
index d7b3db1f452a8..c04d0e2df0880 100644
--- a/pkgs/development/python-modules/ntc-templates/default.nix
+++ b/pkgs/development/python-modules/ntc-templates/default.nix
@@ -5,7 +5,7 @@
 , poetry-core
 , textfsm
 , pytestCheckHook
-, ruamel_yaml
+, ruamel-yaml
 , yamllint
 }:
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytestCheckHook
-    ruamel_yaml
+    ruamel-yaml
     yamllint
   ];
 
diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index 316abb2ac32cf..c4bcfaf85932c 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -16,6 +16,7 @@ buildPythonPackage rec {
 
   checkInputs = [ nose ];
   propagatedBuildInputs = [ bcrypt argon2_cffi ];
+  propagatedNativeBuildInputs = [ argon2_cffi ];
 
   meta = {
     description = "A password hashing library for Python";
diff --git a/pkgs/development/python-modules/prance/default.nix b/pkgs/development/python-modules/prance/default.nix
index 105fa9e180b7e..cbc931d5c59e9 100644
--- a/pkgs/development/python-modules/prance/default.nix
+++ b/pkgs/development/python-modules/prance/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , chardet
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , six
 , semver
 , pytestCheckHook
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     chardet
     requests
-    ruamel_yaml
+    ruamel-yaml
     six
     semver
   ];
diff --git a/pkgs/development/python-modules/pre-commit-hooks/default.nix b/pkgs/development/python-modules/pre-commit-hooks/default.nix
index 212fdf6a721ae..530cf826917bf 100644
--- a/pkgs/development/python-modules/pre-commit-hooks/default.nix
+++ b/pkgs/development/python-modules/pre-commit-hooks/default.nix
@@ -4,7 +4,7 @@
 , git
 , pythonOlder
 , pytestCheckHook
-, ruamel_yaml
+, ruamel-yaml
 , toml
 }:
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    ruamel_yaml
+    ruamel-yaml
     toml
   ];
 
diff --git a/pkgs/development/python-modules/prox-tv/default.nix b/pkgs/development/python-modules/prox-tv/default.nix
index 1cc2ab89360f4..1af942b926752 100644
--- a/pkgs/development/python-modules/prox-tv/default.nix
+++ b/pkgs/development/python-modules/prox-tv/default.nix
@@ -28,6 +28,8 @@ buildPythonPackage {
     cffi
   ];
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   buildInputs = [ blas lapack ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/python-modules/pycares/default.nix b/pkgs/development/python-modules/pycares/default.nix
index 305c2e01c566f..868dbeca6c6c4 100644
--- a/pkgs/development/python-modules/pycares/default.nix
+++ b/pkgs/development/python-modules/pycares/default.nix
@@ -24,6 +24,10 @@ buildPythonPackage rec {
     idna
   ];
 
+  propagatedNativeBuildInputs = [
+    cffi
+  ];
+
   # Requires network access
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/pycmarkgfm/default.nix b/pkgs/development/python-modules/pycmarkgfm/default.nix
index 36b171c22b12b..348bca8d49e7b 100644
--- a/pkgs/development/python-modules/pycmarkgfm/default.nix
+++ b/pkgs/development/python-modules/pycmarkgfm/default.nix
@@ -10,6 +10,8 @@ buildPythonPackage rec {
     sha256 = "694cb242f4961437c30b5b015dfbce9d1a1fa48305c2e39f902ce7c65b4cbe0e";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   # I would gladly use pytestCheckHook, but pycmarkgfm relies on a native
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index d0cd948bdcde1..27bfcff16d812 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
     cached-property
   ] ++ lib.optional (!isPyPy) cffi;
 
+  propagatedNativeBuildInputs = lib.optional (!isPyPy) cffi;
+
   checkInputs = [ pytestCheckHook ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/pykeepass/default.nix b/pkgs/development/python-modules/pykeepass/default.nix
index 5d23949eba62b..cb893c98ac928 100644
--- a/pkgs/development/python-modules/pykeepass/default.nix
+++ b/pkgs/development/python-modules/pykeepass/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     argon2_cffi python-dateutil future
   ];
 
+  propagatedNativeBuildInputs = [ argon2_cffi ];
+
   checkPhase = ''
     ${python.interpreter} -m unittest tests.tests
   '';
diff --git a/pkgs/development/python-modules/pymatgen/default.nix b/pkgs/development/python-modules/pymatgen/default.nix
index cc262e004fd3e..f4eb29bedc0be 100644
--- a/pkgs/development/python-modules/pymatgen/default.nix
+++ b/pkgs/development/python-modules/pymatgen/default.nix
@@ -10,7 +10,7 @@
 , plotly
 , pydispatcher
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , scipy
 , six
 , spglib
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     plotly
     pydispatcher
     requests
-    ruamel_yaml
+    ruamel-yaml
     scipy
     six
     spglib
diff --git a/pkgs/development/python-modules/pynacl/default.nix b/pkgs/development/python-modules/pynacl/default.nix
index 8c5c239aeb414..91a197e7cf66f 100644
--- a/pkgs/development/python-modules/pynacl/default.nix
+++ b/pkgs/development/python-modules/pynacl/default.nix
@@ -6,6 +6,7 @@
 , libsodium
 , cffi
 , hypothesis
+, stdenv
 , six
 }:
 
@@ -29,6 +30,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    cffi
     six
   ];
 
diff --git a/pkgs/development/python-modules/pytest/4.nix b/pkgs/development/python-modules/pytest/4.nix
index fd6d3507afb85..0a0ae571ba012 100644
--- a/pkgs/development/python-modules/pytest/4.nix
+++ b/pkgs/development/python-modules/pytest/4.nix
@@ -43,6 +43,19 @@ buildPythonPackage rec {
     }
 
     preDistPhases+=" pytestcachePhase"
+
+    # pytest generates it's own bytecode files to improve assertion messages.
+    # These files similar to cpython's bytecode files but are never laoded
+    # by python interpreter directly. We remove them for a few reasons:
+    # - files are non-deterministic: https://github.com/NixOS/nixpkgs/issues/139292
+    #   (file headers are generatedt by pytest directly and contain timestamps)
+    # - files are not needed after tests are finished
+    pytestRemoveBytecodePhase () {
+        # suffix is defined at:
+        #    https://github.com/pytest-dev/pytest/blob/4.6.11/src/_pytest/assertion/rewrite.py#L32-L47
+        find $out -name "*-PYTEST.py[co]" -delete
+    }
+    preDistPhases+=" pytestRemoveBytecodePhase"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pytest/5.nix b/pkgs/development/python-modules/pytest/5.nix
index b38c1a759fe37..8df7c02b1774f 100644
--- a/pkgs/development/python-modules/pytest/5.nix
+++ b/pkgs/development/python-modules/pytest/5.nix
@@ -70,6 +70,19 @@ buildPythonPackage rec {
         find $out -name .pytest_cache -type d -exec rm -rf {} +
     }
     preDistPhases+=" pytestcachePhase"
+
+    # pytest generates it's own bytecode files to improve assertion messages.
+    # These files similar to cpython's bytecode files but are never laoded
+    # by python interpreter directly. We remove them for a few reasons:
+    # - files are non-deterministic: https://github.com/NixOS/nixpkgs/issues/139292
+    #   (file headers are generatedt by pytest directly and contain timestamps)
+    # - files are not needed after tests are finished
+    pytestRemoveBytecodePhase () {
+        # suffix is defined at:
+        #    https://github.com/pytest-dev/pytest/blob/5.4.3/src/_pytest/assertion/rewrite.py#L42-L45
+        find $out -name "*-pytest-*.py[co]" -delete
+    }
+    preDistPhases+=" pytestRemoveBytecodePhase"
   '';
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index f2438622f6a67..ac036936b991a 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -82,6 +82,19 @@ buildPythonPackage rec {
         find $out -name .pytest_cache -type d -exec rm -rf {} +
     }
     preDistPhases+=" pytestcachePhase"
+
+    # pytest generates it's own bytecode files to improve assertion messages.
+    # These files similar to cpython's bytecode files but are never laoded
+    # by python interpreter directly. We remove them for a few reasons:
+    # - files are non-deterministic: https://github.com/NixOS/nixpkgs/issues/139292
+    #   (file headers are generatedt by pytest directly and contain timestamps)
+    # - files are not needed after tests are finished
+    pytestRemoveBytecodePhase () {
+        # suffix is defined at:
+        #    https://github.com/pytest-dev/pytest/blob/6.2.5/src/_pytest/assertion/rewrite.py#L51-L53
+        find $out -name "*-pytest-*.py[co]" -delete
+    }
+    preDistPhases+=" pytestRemoveBytecodePhase"
   '';
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/python-box/default.nix b/pkgs/development/python-modules/python-box/default.nix
index 6410bbadd27ed..0edf2b6958079 100644
--- a/pkgs/development/python-modules/python-box/default.nix
+++ b/pkgs/development/python-modules/python-box/default.nix
@@ -5,7 +5,7 @@
 , pytestCheckHook
 , pythonOlder
 , pyyaml
-, ruamel_yaml
+, ruamel-yaml
 , toml
 }:
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     msgpack
     pyyaml
-    ruamel_yaml
+    ruamel-yaml
     toml
   ];
 
diff --git a/pkgs/development/python-modules/python-magic/default.nix b/pkgs/development/python-modules/python-magic/default.nix
index 02f1cc6915226..d8a0f638d9685 100644
--- a/pkgs/development/python-modules/python-magic/default.nix
+++ b/pkgs/development/python-modules/python-magic/default.nix
@@ -3,6 +3,7 @@
 , python
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , file
 , glibcLocales
@@ -20,6 +21,13 @@ buildPythonPackage rec {
   };
 
   patches = [
+    # pull upstream patch to support file-5.41
+    (fetchpatch {
+      name = "file-5.41-compat.patch";
+      url = "https://github.com/ahupp/python-magic/commit/0ae7e7ceac0e80e03adc75c858bb378c0427331a.patch";
+      sha256 = "0vclaamb56nza1mcy88wjbkh81hnish2gzvl8visa2cknhgdmk50";
+    })
+
     (substituteAll {
       src = ./libmagic-path.patch;
       libmagic = "${file}/lib/libmagic${stdenv.hostPlatform.extensions.sharedLibrary}";
diff --git a/pkgs/development/python-modules/python-olm/default.nix b/pkgs/development/python-modules/python-olm/default.nix
index 2a8295a65bf7a..d38c33df8c81f 100644
--- a/pkgs/development/python-modules/python-olm/default.nix
+++ b/pkgs/development/python-modules/python-olm/default.nix
@@ -17,6 +17,10 @@ buildPythonPackage {
     future
   ] ++ lib.optionals (!isPy3k) [ typing ];
 
+  propagatedNativeBuildInputs = [
+    cffi
+  ];
+
   # Some required libraries for testing are not packaged yet.
   doCheck = false;
   pythonImportsCheck = [ "olm" ];
diff --git a/pkgs/development/python-modules/pyuavcan/default.nix b/pkgs/development/python-modules/pyuavcan/default.nix
index ff01ea90e227a..c3823a6c3c092 100644
--- a/pkgs/development/python-modules/pyuavcan/default.nix
+++ b/pkgs/development/python-modules/pyuavcan/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub, pythonOlder, numpy, nunavut
-, pyserial , pytest, ruamel_yaml}:
+, pyserial , pytest, ruamel-yaml}:
 
  buildPythonPackage rec {
   pname = "pyuavcan";
@@ -18,7 +18,7 @@
     nunavut
     pyserial
     pytest
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   # allow for writable directory for darwin
diff --git a/pkgs/development/python-modules/reflink/default.nix b/pkgs/development/python-modules/reflink/default.nix
index 9f5024daf7e80..cb0a9fb5856a6 100644
--- a/pkgs/development/python-modules/reflink/default.nix
+++ b/pkgs/development/python-modules/reflink/default.nix
@@ -3,7 +3,6 @@
 , fetchPypi
 , lib
 , pytestCheckHook
-, pytest-runner
 }:
 
 buildPythonPackage rec {
@@ -15,10 +14,17 @@ buildPythonPackage rec {
     sha256 = "sha256-ySU1gtskQTv9cDq/wbKkneePMbSQcjnyhumhkpoebjo=";
   };
 
-  propagatedBuildInputs = [ cffi pytest-runner ];
+  propagatedBuildInputs = [ cffi ];
+
+  propagatedNativeBuildInputs = [ cffi ];
 
   checkInputs = [ pytestCheckHook ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pytest-runner" ""
+  '';
+
   # FIXME: These do not work, and I have been unable to figure out why.
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/ruamel_base/default.nix b/pkgs/development/python-modules/ruamel-base/default.nix
index 1f829bb4e0ba8..2db8a335e8958 100644
--- a/pkgs/development/python-modules/ruamel_base/default.nix
+++ b/pkgs/development/python-modules/ruamel-base/default.nix
@@ -4,18 +4,24 @@
 }:
 
 buildPythonPackage rec {
-  pname = "ruamel.base";
+  pname = "ruamel-base";
   version = "1.0.0";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ruamel.base";
+    inherit version;
     sha256 = "1wswxrn4givsm917mfl39rafgadimf1sldpbjdjws00g1wx36hf0";
   };
 
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "ruamel.base" ];
+
   meta = with lib; {
     description = "Common routines for ruamel packages";
     homepage = "https://sourceforge.net/projects/ruamel-base/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }
diff --git a/pkgs/development/python-modules/ruamel_ordereddict/default.nix b/pkgs/development/python-modules/ruamel-ordereddict/default.nix
index 98c36221dcd55..987680ad596f2 100644
--- a/pkgs/development/python-modules/ruamel_ordereddict/default.nix
+++ b/pkgs/development/python-modules/ruamel-ordereddict/default.nix
@@ -6,12 +6,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "ruamel.ordereddict";
+  pname = "ruamel-ordereddict";
   version = "0.4.15";
   disabled = isPy3k || isPyPy;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ruamel.ordereddict";
+    inherit version;
     sha256 = "d7d9cf8b11e7662deb460260cf062980cd84b87a1d0457132060ab9d44e0a5f4";
   };
 
@@ -19,6 +20,6 @@ buildPythonPackage rec {
     description = "A version of dict that keeps keys in insertion resp. sorted order";
     homepage = "https://sourceforge.net/projects/ruamel-ordereddict/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }
diff --git a/pkgs/development/python-modules/ruamel_yaml_clib/default.nix b/pkgs/development/python-modules/ruamel-yaml-clib/default.nix
index c403239d55255..b12920fc7640d 100644
--- a/pkgs/development/python-modules/ruamel_yaml_clib/default.nix
+++ b/pkgs/development/python-modules/ruamel-yaml-clib/default.nix
@@ -1,28 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchhg
-, ruamel_base
-, ruamel_ordereddict ? null
-, isPy3k
 }:
 
 buildPythonPackage rec {
-  pname = "ruamel.yaml.clib";
-  version = "0.2.0";
+  pname = "ruamel-yaml-clib";
+  version = "0.2.4";
 
   src = fetchhg {
     url = "http://hg.code.sf.net/p/ruamel-yaml-clib/code";
     rev = version;
-    sha256 = "0kq6zi96qlm72lzj90fc2rfk6nm5kqhk6qxdl8wl9s3a42b0v6wl";
+    sha256 = "sha256-HQZY1opUvVQdXUHmsZmcYX2vfgjKsl6xATmVIXjnBlc=";
   };
 
-  # outputs match wheel
+  # no tests
   doCheck = false;
 
+  # circular depedency with ruamel-yaml
+  # pythonImportsCheck = [ "_ruamel_yaml" ];
+
   meta = with lib; {
     description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
     homepage = "https://sourceforge.net/projects/ruamel-yaml-clib/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }
diff --git a/pkgs/development/python-modules/ruamel_yaml/0.16.nix b/pkgs/development/python-modules/ruamel-yaml/0.16.nix
index ed2ddf3306598..0d9b1b4a16372 100644
--- a/pkgs/development/python-modules/ruamel_yaml/0.16.nix
+++ b/pkgs/development/python-modules/ruamel-yaml/0.16.nix
@@ -1,40 +1,38 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, ruamel_base
-, ruamel_ordereddict ? null
-, ruamel_yaml_clib ? null
-, isPy3k
+, ruamel-base
+, ruamel-ordereddict
+, ruamel-yaml-clib ? null
+, isPy27
 , isPyPy
 }:
 
 buildPythonPackage rec {
-  pname = "ruamel.yaml";
+  pname = "ruamel-yaml";
   version = "0.16.13";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ruamel.yaml";
+    inherit version;
     sha256 = "0hm9yg785f46bkrgqknd6fdvmkby9dpzjnm0b63qf0i748acaj5v";
   };
 
   # Tests use relative paths
   doCheck = false;
 
-  propagatedBuildInputs = [ ruamel_base ]
-    ++ lib.optional (!isPy3k) ruamel_ordereddict
-    ++ lib.optional (!isPyPy) ruamel_yaml_clib;
+  propagatedBuildInputs = [ ruamel-base ]
+    ++ lib.optional isPy27 ruamel-ordereddict
+    ++ lib.optional (!isPyPy) ruamel-yaml-clib;
 
   # causes namespace clash on py27
-  dontUsePythonImportsCheck = !isPy3k;
-  pythonImportsCheck = [
-    "ruamel.yaml"
-    "ruamel.base"
-  ];
+  dontUsePythonImportsCheck = isPy27;
+  pythonImportsCheck = [ "ruamel.yaml" ];
 
   meta = with lib; {
     description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
     homepage = "https://sourceforge.net/projects/ruamel-yaml/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }
diff --git a/pkgs/development/python-modules/ruamel_yaml/default.nix b/pkgs/development/python-modules/ruamel-yaml/default.nix
index efd418e454d49..2a30bd95f968b 100644
--- a/pkgs/development/python-modules/ruamel_yaml/default.nix
+++ b/pkgs/development/python-modules/ruamel-yaml/default.nix
@@ -1,40 +1,33 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, ruamel_base
-, ruamel_ordereddict ? null
-, ruamel_yaml_clib ? null
-, isPy3k
+, ruamel-base
+, ruamel-yaml-clib
 , isPyPy
 }:
 
 buildPythonPackage rec {
-  pname = "ruamel.yaml";
+  pname = "ruamel-yaml";
   version = "0.17.16";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "ruamel.yaml";
+    inherit version;
     sha256 = "1a771fc92d3823682b7f0893ad56cb5a5c87c48e62b5399d6f42c8759a583b33";
   };
 
   # Tests use relative paths
   doCheck = false;
 
-  propagatedBuildInputs = [ ruamel_base ]
-    ++ lib.optional (!isPy3k) ruamel_ordereddict
-    ++ lib.optional (!isPyPy) ruamel_yaml_clib;
+  propagatedBuildInputs = [ ruamel-base ]
+    ++ lib.optional (!isPyPy) ruamel-yaml-clib;
 
-  # causes namespace clash on py27
-  dontUsePythonImportsCheck = !isPy3k;
-  pythonImportsCheck = [
-    "ruamel.yaml"
-    "ruamel.base"
-  ];
+  pythonImportsCheck = [ "ruamel.yaml" ];
 
   meta = with lib; {
     description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
     homepage = "https://sourceforge.net/projects/ruamel-yaml/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index 4e778054875e8..97367349112a6 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -6,7 +6,7 @@
 , mistune
 , rdflib
 , rdflib-jsonld
-, ruamel_yaml
+, ruamel-yaml
 , pytestCheckHook
 }:
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     mistune
     rdflib
     rdflib-jsonld
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   checkInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/smbus-cffi/default.nix b/pkgs/development/python-modules/smbus-cffi/default.nix
index 6715cfd60d956..ffb22d1c4b42a 100644
--- a/pkgs/development/python-modules/smbus-cffi/default.nix
+++ b/pkgs/development/python-modules/smbus-cffi/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     })
   ];
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   installCheckPhase = ''
diff --git a/pkgs/development/python-modules/soundfile/default.nix b/pkgs/development/python-modules/soundfile/default.nix
index dea0e345a9997..9a1d614062b78 100644
--- a/pkgs/development/python-modules/soundfile/default.nix
+++ b/pkgs/development/python-modules/soundfile/default.nix
@@ -21,6 +21,7 @@ buildPythonPackage rec {
 
     checkInputs = [ pytest ];
     propagatedBuildInputs = [ numpy libsndfile cffi ];
+    propagatedNativeBuildInputs = [ cffi ];
 
     meta = {
       description = "An audio library based on libsndfile, CFFI and NumPy";
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index a04a0585019fc..9d82b4c598103 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, fetchpatch
 # propagatedBuildInputs
 , Babel
 , alabaster
@@ -29,24 +28,16 @@
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "4.0.2";
+  version = "4.2.0";
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "sphinx-doc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0QdgHFX4r40BDHjpi9R40lXqT4n5ZgrIny+w070LZPE=";
+    sha256 = "1i38n5bxqiycjwmiv9dl72r3f5ks4zmif30znqg8zilclbx6g16x";
   };
 
-  patches = [
-    (fetchpatch {
-      # Fix tests with pygments 2.10
-      url = "https://github.com/sphinx-doc/sphinx/commit/bde6c8d2effc56dc8b9098abee796167f972c306.patch";
-      sha256 = "0d0ddhgrrh7z9ix0f3zrc2gjb4d73f6ffm98zl62fzv5l4fd00lr";
-    })
-  ];
-
   propagatedBuildInputs = [
     Babel
     alabaster
diff --git a/pkgs/development/python-modules/strictyaml/default.nix b/pkgs/development/python-modules/strictyaml/default.nix
index d85113b50d2ef..9b76edc1bae5d 100644
--- a/pkgs/development/python-modules/strictyaml/default.nix
+++ b/pkgs/development/python-modules/strictyaml/default.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchPypi
 , isPy27
-, ruamel_yaml
+, ruamel-yaml
 , python-dateutil
 }:
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
       --replace "ruamel.yaml==0.17.4" "ruamel.yaml"
   '';
 
-  propagatedBuildInputs = [ ruamel_yaml python-dateutil ];
+  propagatedBuildInputs = [ ruamel-yaml python-dateutil ];
 
   # Library tested with external tool
   # https://hitchdev.com/approach/contributing-to-hitch-libraries/
diff --git a/pkgs/development/python-modules/tinycss2/default.nix b/pkgs/development/python-modules/tinycss2/default.nix
index 05ca81772d818..7e49433bc2f3b 100644
--- a/pkgs/development/python-modules/tinycss2/default.nix
+++ b/pkgs/development/python-modules/tinycss2/default.nix
@@ -1,44 +1,36 @@
 { lib
 , buildPythonPackage
 , pythonOlder
-, fetchPypi
-, fetchpatch
+, fetchFromGitHub
 , webencodings
-# Check inputs
-, pytest
-, pytest-runner
-, pytest-cov
-, pytest-flake8
-, pytest-isort
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "tinycss2";
-  version = "1.0.2";
+  version = "1.1.0";
   disabled = pythonOlder "3.5";
+  format = "flit";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1kw84y09lggji4krkc58jyhsfj31w8npwhznr7lf19d0zbix09v4";
+  src = fetchFromGitHub {
+    owner = "kozea";
+    repo = "tinycss2";
+    rev = "v${version}";
+    # for tests
+    fetchSubmodules = true;
+    sha256 = "sha256-WA88EYolL76WqeA1UKR3Sfw11j8NuOGOxPezujYizH8=";
   };
 
-  patches = [
-    (
-      fetchpatch {
-        name = "tinycss2-fix-pytest-flake8-fail.patch";
-        url = "https://github.com/Kozea/tinycss2/commit/6556604fb98c2153412384d6f0f705db2da1aa60.patch";
-        sha256 = "1srvdzg1bak65fawd611rlskcgn5abmwmyjnk8qrrrasr554bc59";
-      }
-    )
-  ];
-
   propagatedBuildInputs = [ webencodings ];
 
-  checkInputs = [ pytest pytest-runner pytest-cov pytest-flake8 pytest-isort ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  # https://github.com/PyCQA/pycodestyle/issues/598
-  preCheck = ''
-    printf "[flake8]\nignore=W504,E741,E126" >> setup.cfg
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "'pytest-cov', 'pytest-flake8', 'pytest-isort', 'coverage[toml]'" "" \
+      --replace "--isort --flake8 --cov" ""
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index c68fc2980cee8..de277749a6e7f 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, argh
 , pathtools
 , pyyaml
 , flaky
@@ -23,7 +22,6 @@ buildPythonPackage rec {
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
   propagatedBuildInputs = [
-    argh
     pathtools
     pyyaml
   ];
diff --git a/pkgs/development/python-modules/xcffib/default.nix b/pkgs/development/python-modules/xcffib/default.nix
index 59a2c8d7c1bc0..cb9e1ddf921ca 100644
--- a/pkgs/development/python-modules/xcffib/default.nix
+++ b/pkgs/development/python-modules/xcffib/default.nix
@@ -23,6 +23,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ cffi six ];
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   checkInputs = [ nose ];
 
   pythonImportsCheck = [ "xcffib" ];
diff --git a/pkgs/development/python-modules/xpybutil/default.nix b/pkgs/development/python-modules/xpybutil/default.nix
index 07cfc96e7fddf..af8fda8a7d2c0 100644
--- a/pkgs/development/python-modules/xpybutil/default.nix
+++ b/pkgs/development/python-modules/xpybutil/default.nix
@@ -13,7 +13,9 @@ buildPythonPackage rec {
   };
 
   # pillow is a dependency in image.py which is not listed in setup.py
-  propagatedBuildInputs = [ xcffib pillow ];
+  propagatedBuildInputs = [ pillow xcffib ];
+
+  propagatedNativeBuildInputs = [ xcffib ];
 
   checkInputs = [ nose ];
 
diff --git a/pkgs/development/python-modules/yamale/default.nix b/pkgs/development/python-modules/yamale/default.nix
index f590e8d896c06..fce4e9d38c558 100644
--- a/pkgs/development/python-modules/yamale/default.nix
+++ b/pkgs/development/python-modules/yamale/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 , pytestCheckHook
 , pyyaml
-, ruamel_yaml
+, ruamel-yaml
 }:
 
 buildPythonPackage rec {
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     pyyaml
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/zopfli/default.nix b/pkgs/development/python-modules/zopfli/default.nix
index 9d67577935116..d7e9cf507f031 100644
--- a/pkgs/development/python-modules/zopfli/default.nix
+++ b/pkgs/development/python-modules/zopfli/default.nix
@@ -1,15 +1,20 @@
-{ lib, buildPythonPackage, fetchPypi, pytest }:
+{ lib, buildPythonPackage, fetchPypi, setuptools-scm, zopfli, pytest }:
 
 buildPythonPackage rec {
   pname = "zopfli";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8b977dc07e3797907ab59e08096583bcd0b7e6c739849fbbeec09263f6356623";
+    sha256 = "78de3cc08a8efaa8013d61528907d91ac4d6cc014ffd8a41cc10ee75e9e60d7b";
     extension = "zip";
   };
 
+  nativeBuildInputs = [ setuptools-scm ];
+
+  buildInputs = [ zopfli ];
+  USE_SYSTEM_ZOPFLI = "True";
+
   # doesn't work with pytestCheckHook
   checkInputs = [ pytest ];
 
diff --git a/pkgs/development/python-modules/zstandard/default.nix b/pkgs/development/python-modules/zstandard/default.nix
index 5f8909577171c..5d2066f45f21f 100755
--- a/pkgs/development/python-modules/zstandard/default.nix
+++ b/pkgs/development/python-modules/zstandard/default.nix
@@ -14,6 +14,8 @@ buildPythonPackage rec {
     sha256 = "eaae2d3e8fdf8bfe269628385087e4b648beef85bb0c187644e7df4fb0fe9046";
   };
 
+  propagatedNativeBuildInputs = [ cffi ];
+
   propagatedBuildInputs = [ cffi ];
 
   checkInputs = [ hypothesis ];
diff --git a/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch b/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch
index 16470740877e3..87d79a070cd00 100644
--- a/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch
+++ b/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch
@@ -1,21 +1,22 @@
-From 40239d92957f1969652cdd41d6d2749c41ac4338 Mon Sep 17 00:00:00 2001
+From 99a7e55a60c8d96e160f9104a3dd31b7914d3488 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
 Date: Fri, 31 Jul 2020 09:22:03 +0100
-Subject: [PATCH] [PATCH] Fix scan-build to use NIX_CFLAGS_COMPILE
+Subject: [PATCH] Fix scan-build to use NIX_CFLAGS_COMPILE
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
 ---
- tools/scan-build/libexec/ccc-analyzer | 8 ++++++++
+ clang/tools/scan-build/libexec/ccc-analyzer | 8 ++++++++
  1 file changed, 8 insertions(+)
 
-diff --git a/tools/scan-build/libexec/ccc-analyzer b/tools/scan-build/libexec/ccc-analyzer
-index 800f38b5..0fb50fb3 100755
---- a/tools/scan-build/libexec/ccc-analyzer
-+++ b/tools/scan-build/libexec/ccc-analyzer
-@@ -246,6 +246,14 @@ sub Analyze {
+diff --git a/clang/tools/scan-build/libexec/ccc-analyzer
+b/clang/tools/scan-build/libexec/ccc-analyzer
+index ed0d4d3d73f3..2d5113435ca5 100755
+--- a/clang/tools/scan-build/libexec/ccc-analyzer
++++ b/clang/tools/scan-build/libexec/ccc-analyzer
+@@ -249,6 +249,14 @@ sub Analyze {
        push @Args, "-target", $AnalyzerTarget;
      }
  
@@ -31,5 +32,4 @@ index 800f38b5..0fb50fb3 100755
      @CmdArgs = @$AnalysisArgs;
    }
 -- 
-2.27.0
-
+2.33.0
diff --git a/pkgs/development/tools/analysis/clang-analyzer/default.nix b/pkgs/development/tools/analysis/clang-analyzer/default.nix
index 4752b31649d34..46e04aaf389f3 100644
--- a/pkgs/development/tools/analysis/clang-analyzer/default.nix
+++ b/pkgs/development/tools/analysis/clang-analyzer/default.nix
@@ -12,9 +12,9 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out/share/scan-view $out/bin
-    cp -R tools/scan-view/share/* $out/share/scan-view
-    cp -R tools/scan-view/bin/* $out/bin/scan-view
-    cp -R tools/scan-build/* $out
+    cp -R clang/tools/scan-view/share/* $out/share/scan-view
+    cp -R clang/tools/scan-view/bin/* $out/bin/scan-view
+    cp -R clang/tools/scan-build/* $out
 
     rm $out/bin/*.bat $out/libexec/*.bat $out/CMakeLists.txt
 
@@ -26,7 +26,11 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Clang Static Analyzer";
-    homepage    = "http://clang-analyzer.llvm.org";
+    longDescription = ''
+      The Clang Static Analyzer is a source code analysis tool that finds bugs
+      in C, C++, and Objective-C programs.
+    '';
+    homepage    = "https://clang-analyzer.llvm.org/";
     license     = lib.licenses.bsd3;
     platforms   = lib.platforms.unix;
     maintainers = [ lib.maintainers.thoughtpolice ];
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 5d747317e4531..be7841c3a0d47 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.17.0";
+  version = "3.18.1";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "18l5jbk301j3462gipqn9bkfx44mdmwn0pwr73r40gl1irkfqfmd";
+    sha256 = "sha256-AIWaoTp3Lt33giIl9LRu4NOa++Bx0yd42k2ZmECB9/U=";
   };
 
   outputs = [ "out" "dev" "man" "doc" ];
diff --git a/pkgs/development/tools/build-managers/waf/default.nix b/pkgs/development/tools/build-managers/waf/default.nix
index 4d4bb6957eaa4..65ea525d5afab 100644
--- a/pkgs/development/tools/build-managers/waf/default.nix
+++ b/pkgs/development/tools/build-managers/waf/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, python, ensureNewerSourcesForZipFilesHook
+{ lib, stdenv, fetchFromGitLab, python3, ensureNewerSourcesForZipFilesHook
 # optional list of extra waf tools, e.g. `[ "doxygen" "pytest" ]`
 , withTools ? null
 }:
@@ -17,7 +17,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-WGGyhvQdFYmC0NOA5VVqCRMF1fvfPcTI42x1nHvz0W0=";
   };
 
-  buildInputs = [ python ensureNewerSourcesForZipFilesHook ];
+  nativeBuildInputs = [ python3 ensureNewerSourcesForZipFilesHook ];
+
+  # waf bin has #!/usr/bin/env python
+  buildInputs = [ python3 ];
 
   configurePhase = ''
     python waf-light configure
@@ -29,6 +32,8 @@ stdenv.mkDerivation rec {
     install -D waf $out/bin/waf
   '';
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "Meta build system";
     homepage    = "https://waf.io";
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index 7e8c61e1c8d28..ac715147dc3f4 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , python3
@@ -7,7 +8,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2021.7";
+  version = "2021.8";
 
   format = "other";
 
@@ -16,9 +17,18 @@ python3.pkgs.buildPythonApplication rec {
     owner = "GNOME";
     repo = pname;
     rev = version;
-    sha256 = "i2s4JXg+D9sYq1QwVcDRLIr9qnRmzHC+cBInHv4SXHI=";
+    sha256 = "Y1IdCH6bytxbKIj48IAw/3XUQhoqwPshvdj/d1hRS3o=";
   };
 
+  patches = [
+    # Fix building docs of some packages (e.g. gnome-builder)
+    # https://gitlab.gnome.org/GNOME/gi-docgen/-/issues/111
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/72f3c5dbe27aabb5f7a376afda23f3dfc3c2e212.patch";
+      sha256 = "iVXc3idmcjmFVZQdE2QX2V53YZ79lqxZid9nWdxAZ/Q=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/tools/dt-schema/default.nix b/pkgs/development/tools/dt-schema/default.nix
index 6ee649595ae25..a5445c8e021de 100644
--- a/pkgs/development/tools/dt-schema/default.nix
+++ b/pkgs/development/tools/dt-schema/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , git
-, ruamel_yaml
+, ruamel-yaml
 , jsonschema
 , rfc3987
 , setuptools
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [ setuptools-scm git ];
   propagatedBuildInputs = [
     setuptools
-    ruamel_yaml
+    ruamel-yaml
     jsonschema
     rfc3987
   ];
diff --git a/pkgs/development/tools/fdroidserver/default.nix b/pkgs/development/tools/fdroidserver/default.nix
index 5977d0c28d176..328860385596e 100644
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@@ -44,7 +44,7 @@ python.pkgs.buildPythonApplication rec {
     pyyaml
     qrcode
     requests
-    ruamel_yaml
+    ruamel-yaml
     yamllint
   ];
 
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index da5bdf9742e70..8f2121c259927 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -86,9 +86,9 @@ stdenv.mkDerivation rec {
     done
 
   '' + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    # remove /build/** from RPATHs
+    # remove build directory (/build/**, or /tmp/nix-build-**) from RPATHs
     for f in "$bin"/bin/*; do
-      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)/build/[^:]*:@\1@g')"
+      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)'$NIX_BUILD_TOP'[^:]*:@\1@g')"
       patchelf --set-rpath "$nrp" "$f"
     done
   '';
diff --git a/pkgs/development/tools/misc/binutils/CVE-2021-3487.patch b/pkgs/development/tools/misc/binutils/CVE-2021-3487.patch
new file mode 100644
index 0000000000000..004271bd45abe
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2021-3487.patch
@@ -0,0 +1,73 @@
+From: Nick Clifton <nickc@redhat.com>
+Date: Thu, 26 Nov 2020 17:08:33 +0000 (+0000)
+Subject: Prevent a memory allocation failure when parsing corrupt DWARF debug sections.
+X-Git-Tag: binutils-2_36~485
+X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=647cebce12a6b0a26960220caff96ff38978cf24;hp=239ca5e497dda2c151009d664d500086a5c2173a
+
+Prevent a memory allocation failure when parsing corrupt DWARF debug sections.
+
+	PR 26946
+	* dwarf2.c (read_section): Check for debug sections with excessive
+	sizes.
+---
+
+diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
+index 977bf43a6a1..8bbfc81d3e7 100644
+--- a/bfd/dwarf2.c
++++ b/bfd/dwarf2.c
+@@ -531,22 +531,24 @@ read_section (bfd *	      abfd,
+ 	      bfd_byte **     section_buffer,
+ 	      bfd_size_type * section_size)
+ {
+-  asection *msec;
+   const char *section_name = sec->uncompressed_name;
+   bfd_byte *contents = *section_buffer;
+-  bfd_size_type amt;
+ 
+   /* The section may have already been read.  */
+   if (contents == NULL)
+     {
++      bfd_size_type amt;
++      asection *msec;
++      ufile_ptr filesize;
++
+       msec = bfd_get_section_by_name (abfd, section_name);
+-      if (! msec)
++      if (msec == NULL)
+ 	{
+ 	  section_name = sec->compressed_name;
+ 	  if (section_name != NULL)
+ 	    msec = bfd_get_section_by_name (abfd, section_name);
+ 	}
+-      if (! msec)
++      if (msec == NULL)
+ 	{
+ 	  _bfd_error_handler (_("DWARF error: can't find %s section."),
+ 			      sec->uncompressed_name);
+@@ -554,12 +556,23 @@ read_section (bfd *	      abfd,
+ 	  return FALSE;
+ 	}
+ 
+-      *section_size = msec->rawsize ? msec->rawsize : msec->size;
++      amt = bfd_get_section_limit_octets (abfd, msec);
++      filesize = bfd_get_file_size (abfd);
++      if (amt >= filesize)
++	{
++	  /* PR 26946 */
++	  _bfd_error_handler (_("DWARF error: section %s is larger than its filesize! (0x%lx vs 0x%lx)"),
++			      section_name, (long) amt, (long) filesize);
++	  bfd_set_error (bfd_error_bad_value);
++	  return FALSE;
++	}
++      *section_size = amt;
+       /* Paranoia - alloc one extra so that we can make sure a string
+ 	 section is NUL terminated.  */
+-      amt = *section_size + 1;
++      amt += 1;
+       if (amt == 0)
+ 	{
++	  /* Paranoia - this should never happen.  */
+ 	  bfd_set_error (bfd_error_no_memory);
+ 	  return FALSE;
+ 	}
+
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 97f7a6dd8d033..a8c20bbd128fa 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -27,7 +27,7 @@ assert gold -> execFormatIsELF stdenv.targetPlatform;
 let
   reuseLibs = enableShared && withAllTargets;
 
-  version = "2.35.1";
+  version = "2.35.2";
   basename = "binutils";
   # The targetPrefix prepended to binary names to allow multiple binuntils on the
   # PATH to both be usable.
@@ -42,7 +42,7 @@ let
   # HACK to ensure that we preserve source from bootstrap binutils to not rebuild LLVM
   normal-src = stdenv.__bootPackages.binutils-unwrapped.src or (fetchurl {
     url = "mirror://gnu/binutils/${basename}-${version}.tar.bz2";
-    sha256 = "sha256-Mg56HQ9G/Nn0E/EEbiFsviO7K85t62xqYzBEJeSLGUI=";
+    sha256 = "sha256-z6dkTb7PRZHhNutAfBwdoWV4vSsD8MLorNzroZS7nWE=";
   });
 in
 
@@ -84,6 +84,7 @@ stdenv.mkDerivation {
     ./gold-Update-GNU_PROPERTY_X86_XXX-macros.patch
 
     ./CVE-2020-35448.patch
+    ./CVE-2021-3487.patch
   ] ++ lib.optional stdenv.targetPlatform.isiOS ./support-ios.patch
     ++ # This patch was suggested by Nick Clifton to fix
        # https://sourceware.org/bugzilla/show_bug.cgi?id=16177
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index d4d6dc41657dd..24edb2c5955b8 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "help2man";
-  version = "1.48.1";
+  version = "1.48.5";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-3op0dAvQWGRlZ7kqtOzeudqfGgfMfE9gejwU3TjRB5k=";
+    sha256 = "sha256-ZznkyqQuau0zmb5Dh8p5OZZAlnM06RcohjuOqpIlgr4=";
   };
 
   nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
diff --git a/pkgs/development/tools/misc/replacement/default.nix b/pkgs/development/tools/misc/replacement/default.nix
index 3d0218ffab232..cbdd8e37c5cd6 100644
--- a/pkgs/development/tools/misc/replacement/default.nix
+++ b/pkgs/development/tools/misc/replacement/default.nix
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python3Packages; [
-    ruamel_yaml
+    ruamel-yaml
   ];
 
   checkInputs = with python3Packages; [
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index 1de45b08447bd..3d2daba239a33 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -7,18 +7,24 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.7.6";
+  version = "3.8.2";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-adwLtG6o/DB9TKHgthyMNV6yB9Cwxp9PhGIyjnTXueo=";
+    sha256 = "sha256-BsnhO99+sk1M62tZIFpPZ8LH5yExGWREMP6C+9FKCrs=";
   };
 
+  # gnulib relies on --host= to detect iconv() features on musl().
+  # Otherwise tests fail due to incorrect unicode symbol oconversion.
+  configurePlatforms = [ "build" "host" ];
+
   nativeBuildInputs = [ m4 perl ] ++ lib.optional stdenv.isSunOS help2man;
   propagatedBuildInputs = [ m4 ];
 
-  doCheck = false; # fails
-  doInstallCheck = false; # fails
+  enableParallelBuilding = true;
+
+  doCheck = true;
+  doInstallCheck = true;
 
   meta = {
     homepage = "https://www.gnu.org/software/bison/";