about summary refs log tree commit diff
path: root/pkgs/development
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/development')
-rw-r--r--pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix42
-rw-r--r--pkgs/development/compilers/aldor/default.nix4
-rw-r--r--pkgs/development/compilers/chicken/4/eggDerivation.nix3
-rw-r--r--pkgs/development/compilers/chicken/5/eggDerivation.nix3
-rw-r--r--pkgs/development/compilers/factor-lang/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix6
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/common/configure-flags.nix6
-rw-r--r--pkgs/development/compilers/graalvm/community-edition.nix85
-rw-r--r--pkgs/development/compilers/kotlin/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/11/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/11/libc++/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/libc++abi.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/libunwind.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/lld.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/llvm.nix4
-rw-r--r--pkgs/development/compilers/llvm/11/openmp.nix2
-rw-r--r--pkgs/development/compilers/mercury/default.nix4
-rw-r--r--pkgs/development/compilers/mozart/binary.nix2
-rw-r--r--pkgs/development/compilers/openjdk/11.nix6
-rw-r--r--pkgs/development/compilers/oraclejdk/jdk-linux-base.nix4
-rw-r--r--pkgs/development/compilers/rust/binary.nix4
-rw-r--r--pkgs/development/compilers/rust/make-rust-platform.nix8
-rw-r--r--pkgs/development/compilers/rust/rls/default.nix8
-rw-r--r--pkgs/development/compilers/sbcl/bootstrap.nix2
-rw-r--r--pkgs/development/compilers/scala/2.x.nix2
-rw-r--r--pkgs/development/compilers/scala/dotty-bare.nix2
-rw-r--r--pkgs/development/compilers/smlnj/bootstrap.nix3
-rw-r--r--pkgs/development/compilers/tinygo/default.nix3
-rw-r--r--pkgs/development/compilers/urn/default.nix2
-rw-r--r--pkgs/development/compilers/zulu/8.nix83
-rw-r--r--pkgs/development/compilers/zulu/default.nix80
-rw-r--r--pkgs/development/interpreters/chibi/default.nix2
-rw-r--r--pkgs/development/interpreters/clojure/clooj.nix2
-rw-r--r--pkgs/development/interpreters/elixir/generic-builder.nix3
-rw-r--r--pkgs/development/interpreters/groovy/default.nix3
-rw-r--r--pkgs/development/interpreters/jruby/default.nix2
-rw-r--r--pkgs/development/interpreters/jython/default.nix2
-rw-r--r--pkgs/development/interpreters/perl/default.nix8
-rw-r--r--pkgs/development/interpreters/picolisp/default.nix3
-rw-r--r--pkgs/development/interpreters/pure/default.nix3
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/CVE-2021-3177.patch181
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix3
-rw-r--r--pkgs/development/interpreters/python/cpython/3.6/find_library.patch (renamed from pkgs/development/interpreters/python/cpython/3.7/find_library.patch)0
-rw-r--r--pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch30
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix4
-rw-r--r--pkgs/development/interpreters/python/default.nix20
-rw-r--r--pkgs/development/interpreters/python/hooks/pytest-check-hook.sh10
-rw-r--r--pkgs/development/interpreters/rakudo/zef.nix3
-rw-r--r--pkgs/development/interpreters/rascal/default.nix3
-rw-r--r--pkgs/development/interpreters/spidermonkey/78.nix4
-rw-r--r--pkgs/development/interpreters/tcl/8.6.nix4
-rw-r--r--pkgs/development/interpreters/wasmer/default.nix2
-rw-r--r--pkgs/development/libraries/audio/lilv/default.nix4
-rw-r--r--pkgs/development/libraries/audio/lv2/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/2.32-master.patch.gz (renamed from pkgs/development/libraries/glibc/2.32-35.patch.gz)bin51693 -> 54979 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix8
-rw-r--r--pkgs/development/libraries/gnu-config/default.nix8
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/hunspell/wrapper.nix2
-rw-r--r--pkgs/development/libraries/icu/68.nix4
-rw-r--r--pkgs/development/libraries/java/lombok/default.nix2
-rw-r--r--pkgs/development/libraries/json-glib/default.nix52
-rw-r--r--pkgs/development/libraries/lcms2/default.nix4
-rw-r--r--pkgs/development/libraries/libaom/default.nix4
-rw-r--r--pkgs/development/libraries/libblockdev/default.nix4
-rw-r--r--pkgs/development/libraries/libbytesize/default.nix4
-rw-r--r--pkgs/development/libraries/libcdr/default.nix12
-rw-r--r--pkgs/development/libraries/libdatrie/default.nix2
-rw-r--r--pkgs/development/libraries/libevdev/default.nix4
-rw-r--r--pkgs/development/libraries/libexecinfo/30-linux-makefile.patch44
-rw-r--r--pkgs/development/libraries/libexecinfo/default.nix7
-rw-r--r--pkgs/development/libraries/libgcrypt/default.nix13
-rw-r--r--pkgs/development/libraries/libheif/default.nix12
-rw-r--r--pkgs/development/libraries/libical/default.nix11
-rw-r--r--pkgs/development/libraries/libmbim/default.nix4
-rw-r--r--pkgs/development/libraries/libpcap/default.nix10
-rw-r--r--pkgs/development/libraries/libqmi/default.nix4
-rw-r--r--pkgs/development/libraries/libsodium/default.nix5
-rw-r--r--pkgs/development/libraries/libthai/default.nix6
-rw-r--r--pkgs/development/libraries/libusb1/default.nix8
-rw-r--r--pkgs/development/libraries/libuv/default.nix5
-rw-r--r--pkgs/development/libraries/neardal/default.nix4
-rw-r--r--pkgs/development/libraries/nuspell/wrapper.nix2
-rw-r--r--pkgs/development/libraries/openldap/default.nix24
-rw-r--r--pkgs/development/libraries/openssl/default.nix4
-rw-r--r--pkgs/development/libraries/rabbitmq-java-client/default.nix3
-rw-r--r--pkgs/development/libraries/rinutils/default.nix21
-rw-r--r--pkgs/development/libraries/zeromq/4.x.nix4
-rw-r--r--pkgs/development/mobile/genymotion/default.nix3
-rw-r--r--pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix3
-rw-r--r--pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix3
-rw-r--r--pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix3
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-server/default.nix5
-rw-r--r--pkgs/development/perl-modules/ham/default.nix2
-rw-r--r--pkgs/development/python-modules/adblock/default.nix33
-rw-r--r--pkgs/development/python-modules/blinker/default.nix5
-rw-r--r--pkgs/development/python-modules/buildbot/default.nix2
-rw-r--r--pkgs/development/python-modules/cheroot/default.nix2
-rw-r--r--pkgs/development/python-modules/cryptography/default.nix26
-rw-r--r--pkgs/development/python-modules/cryptography/vectors.nix2
-rw-r--r--pkgs/development/python-modules/fixtures/default.nix25
-rw-r--r--pkgs/development/python-modules/johnnycanencrypt/default.nix37
-rw-r--r--pkgs/development/python-modules/livestreamer/default.nix2
-rw-r--r--pkgs/development/python-modules/lxml/default.nix4
-rw-r--r--pkgs/development/python-modules/pyxml/default.nix2
-rw-r--r--pkgs/development/python-modules/requests/default.nix55
-rw-r--r--pkgs/development/python-modules/retworkx/default.nix29
-rw-r--r--pkgs/development/python-modules/scipy/default.nix11
-rw-r--r--pkgs/development/python-modules/shapely/default.nix34
-rw-r--r--pkgs/development/python-modules/slixmpp/default.nix2
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix10
-rw-r--r--pkgs/development/python-modules/starlette/default.nix2
-rw-r--r--pkgs/development/python-modules/tokenizers/default.nix33
-rw-r--r--pkgs/development/python-modules/typesystem/default.nix2
-rw-r--r--pkgs/development/python-modules/virtualenv/default.nix2
-rw-r--r--pkgs/development/python-modules/wasmer/default.nix62
-rw-r--r--pkgs/development/tools/analysis/lcov/default.nix3
-rw-r--r--pkgs/development/tools/analysis/panopticon/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/apache-ant/1.9.nix2
-rw-r--r--pkgs/development/tools/build-managers/apache-ant/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/apache-maven/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/gradle/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/leiningen/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/redo-sh/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/sbt-extras/default.nix2
-rw-r--r--pkgs/development/tools/database/ephemeralpg/default.nix2
-rw-r--r--pkgs/development/tools/database/liquibase/default.nix3
-rw-r--r--pkgs/development/tools/database/sqldeveloper/default.nix3
-rw-r--r--pkgs/development/tools/diesel-cli/default.nix20
-rw-r--r--pkgs/development/tools/documentation/gtk-doc/default.nix19
-rw-r--r--pkgs/development/tools/google-app-engine-go-sdk/default.nix3
-rw-r--r--pkgs/development/tools/jbake/default.nix3
-rw-r--r--pkgs/development/tools/jbang/default.nix4
-rw-r--r--pkgs/development/tools/jsduck/default.nix3
-rw-r--r--pkgs/development/tools/misc/autobuild/default.nix3
-rw-r--r--pkgs/development/tools/misc/cbrowser/default.nix3
-rw-r--r--pkgs/development/tools/misc/dejagnu/default.nix3
-rw-r--r--pkgs/development/tools/misc/fswatch/default.nix4
-rw-r--r--pkgs/development/tools/misc/gpshell/default.nix4
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix4
-rw-r--r--pkgs/development/tools/misc/kibana/6.x.nix2
-rw-r--r--pkgs/development/tools/misc/kibana/7.x.nix2
-rw-r--r--pkgs/development/tools/misc/macdylibbundler/default.nix2
-rw-r--r--pkgs/development/tools/misc/rolespec/default.nix2
-rw-r--r--pkgs/development/tools/neoload/default.nix2
-rw-r--r--pkgs/development/tools/node-webkit/nw12.nix2
-rw-r--r--pkgs/development/tools/nrpl/default.nix3
-rw-r--r--pkgs/development/tools/nwjs/default.nix2
-rw-r--r--pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix3
-rw-r--r--pkgs/development/tools/ocaml/opam/1.2.2.nix3
-rw-r--r--pkgs/development/tools/ocaml/opam/default.nix3
-rw-r--r--pkgs/development/tools/operator-sdk/default.nix3
-rw-r--r--pkgs/development/tools/out-of-tree/default.nix2
-rw-r--r--pkgs/development/tools/parsing/bison/default.nix4
-rw-r--r--pkgs/development/tools/profiling/systemtap/default.nix2
-rw-r--r--pkgs/development/tools/quilt/default.nix3
-rw-r--r--pkgs/development/tools/ronn/default.nix2
-rw-r--r--pkgs/development/tools/scalafix/default.nix3
-rw-r--r--pkgs/development/tools/selenium/selendroid/default.nix3
-rw-r--r--pkgs/development/tools/selenium/server/default.nix3
-rw-r--r--pkgs/development/tools/sslmate/default.nix3
-rw-r--r--pkgs/development/tools/the-way/default.nix2
-rw-r--r--pkgs/development/tools/thrust/default.nix3
168 files changed, 1050 insertions, 517 deletions
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
index 0fcad6c333f88..1c5fd67f2d955 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@@ -4,16 +4,31 @@ sourcePerArch:
 , lib
 , fetchurl
 , autoPatchelfHook
+, makeWrapper
+# minimum dependencies
 , alsaLib
-, freetype
 , fontconfig
-, zlib
-, xorg
+, freetype
 , libffi
+, xorg
+, zlib
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? true
+, cairo
+, glib
+, gtk3
 }:
 
 let
   cpuName = stdenv.hostPlatform.parsed.cpu.name;
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo glib gtk3
+  ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
 in
 
 let result = stdenv.mkDerivation rec {
@@ -28,11 +43,19 @@ let result = stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    alsaLib freetype fontconfig zlib xorg.libX11 xorg.libXext xorg.libXtst
-    xorg.libXi xorg.libXrender stdenv.cc.cc.lib
+    alsaLib # libasound.so wanted by lib/libjsound.so
+    fontconfig
+    freetype
+    stdenv.cc.cc.lib # libstdc++.so.6
+    xorg.libX11
+    xorg.libXext
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXtst
+    zlib
   ] ++ lib.optional stdenv.isAarch32 libffi;
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
 
   # See: https://github.com/NixOS/patchelf/issues/10
   dontStrip = 1;
@@ -57,6 +80,13 @@ let result = stdenv.mkDerivation rec {
     cat <<EOF >> "$out/nix-support/setup-hook"
     if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
+
+    # We cannot use -exec since wrapProgram is a function but not a command.
+    for bin in $( find "$out" -executable -type f ); do
+      if patchelf --print-interpreter "$bin" &> /dev/null; then
+        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+      fi
+    done
   '';
 
   preFixup = ''
diff --git a/pkgs/development/compilers/aldor/default.nix b/pkgs/development/compilers/aldor/default.nix
index 2654cc467fe26..3799f2c921271 100644
--- a/pkgs/development/compilers/aldor/default.nix
+++ b/pkgs/development/compilers/aldor/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     rev = "15471e75f3d65b93150f414ebcaf59a03054b68d";
   };
 
-  buildInputs = [ gmp which flex bison makeWrapper autoconf automake libtool
-                  jdk perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ gmp which flex bison autoconf automake libtool jdk perl ];
 
   preConfigure = ''
     cd aldor ;
diff --git a/pkgs/development/compilers/chicken/4/eggDerivation.nix b/pkgs/development/compilers/chicken/4/eggDerivation.nix
index 4c84ef8c42b00..10cf91579a404 100644
--- a/pkgs/development/compilers/chicken/4/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/4/eggDerivation.nix
@@ -18,7 +18,8 @@ in
 stdenv.mkDerivation ({
   name = "chicken-${name}";
   propagatedBuildInputs = buildInputs;
-  buildInputs = [ makeWrapper chicken ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ chicken ];
 
   CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
 
diff --git a/pkgs/development/compilers/chicken/5/eggDerivation.nix b/pkgs/development/compilers/chicken/5/eggDerivation.nix
index 7102126206ae4..a6d19eaeb137a 100644
--- a/pkgs/development/compilers/chicken/5/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/5/eggDerivation.nix
@@ -17,7 +17,8 @@ in
 stdenv.mkDerivation ({
   name = "chicken-${name}";
   propagatedBuildInputs = buildInputs;
-  buildInputs = [ makeWrapper chicken ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ chicken ];
 
   CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
 
diff --git a/pkgs/development/compilers/factor-lang/default.nix b/pkgs/development/compilers/factor-lang/default.nix
index fc5f478177cb4..2c9999ccdb490 100644
--- a/pkgs/development/compilers/factor-lang/default.nix
+++ b/pkgs/development/compilers/factor-lang/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
     ./fuel-dir.patch
   ];
 
-  buildInputs = with xorg; [ git rlwrap curl pkg-config perl makeWrapper
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = with xorg; [ git rlwrap curl pkg-config perl
     libX11 pango cairo gtk2 gdk-pixbuf gtkglext
     mesa libXmu libXt libICE libSM openssl unzip ];
 
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index fa7881e398a87..93c9dde61fc34 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -78,7 +78,11 @@ let majorVersion = "6";
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
+      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
+        url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
+        sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
+      });
 
     javaEcj = fetchurl {
       # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 2ea9033ba63ae..d9b4c639b5abc 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -72,6 +72,10 @@ let majorVersion = "7";
       })
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
+      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
+        url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
+        sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
+      })
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 4bdec26fd993f..443ed19235d51 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -94,9 +94,6 @@ let
       # In uclibc cases, libgomp needs an additional '-ldl'
       # and as I don't know how to pass it, I disable libgomp.
       "--disable-libgomp"
-    ] ++ lib.optionals (targetPlatform.libc == "musl") [
-      # musl at least, disable: https://git.buildroot.net/buildroot/commit/?id=873d4019f7fb00f6a80592224236b3ba7d657865
-      "--disable-libmpx"
     ] ++ lib.optional (targetPlatform.libc == "newlib") "--with-newlib"
       ++ lib.optional (targetPlatform.libc == "avrlibc") "--with-avrlibc"
     );
@@ -181,6 +178,9 @@ let
       # On Illumos/Solaris GNU as is preferred
       "--with-gnu-as" "--without-gnu-ld"
     ]
+    ++ lib.optional (targetPlatform.libc == "musl")
+      # musl at least, disable: https://git.buildroot.net/buildroot/commit/?id=873d4019f7fb00f6a80592224236b3ba7d657865
+      "--disable-libmpx"
     ++ lib.optionals (targetPlatform == hostPlatform && targetPlatform.libc == "musl") [
       "--disable-libsanitizer"
       "--disable-symvers"
diff --git a/pkgs/development/compilers/graalvm/community-edition.nix b/pkgs/development/compilers/graalvm/community-edition.nix
index 96ba9afc2379b..ea18be5625032 100644
--- a/pkgs/development/compilers/graalvm/community-edition.nix
+++ b/pkgs/development/compilers/graalvm/community-edition.nix
@@ -1,7 +1,37 @@
-{ lib, stdenv, fetchurl, perl, unzip, glibc, zlib, setJavaClassPath, Foundation, openssl }:
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, setJavaClassPath
+, makeWrapper
+# minimum dependencies
+, Foundation
+, alsaLib
+, fontconfig
+, freetype
+, glibc
+, openssl
+, perl
+, unzip
+, xorg
+, zlib
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? true
+, cairo
+, glib
+, gtk3
+}:
 
 let
   platform = if stdenv.isDarwin then "darwin-amd64" else "linux-amd64";
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo glib gtk3
+  ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
   common = javaVersion:
     let
       javaVersionPlatform = "${javaVersion}-${platform}";
@@ -50,7 +80,27 @@ let
              url    = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/wasm-installable-svm-java${javaVersionPlatform}-${version}.jar";
           })
         ];
-        nativeBuildInputs = [ unzip perl ];
+
+        buildInputs = lib.optionals stdenv.isLinux [
+          alsaLib # libasound.so wanted by lib/libjsound.so
+          fontconfig
+          freetype
+          openssl # libssl.so wanted by languages/ruby/lib/mri/openssl.so
+          stdenv.cc.cc.lib # libstdc++.so.6
+          xorg.libX11
+          xorg.libXext
+          xorg.libXi
+          xorg.libXrender
+          xorg.libXtst
+          zlib
+        ];
+
+        # Workaround for libssl.so.10 wanted by TruffleRuby
+        # Resulting TruffleRuby cannot use `openssl` library.
+        autoPatchelfIgnoreMissingDeps = true;
+
+        nativeBuildInputs = [ unzip perl autoPatchelfHook makeWrapper ];
+
         unpackPhase = ''
            unpack_jar() {
              jar=$1
@@ -136,32 +186,25 @@ let
 
         dontStrip = true;
 
-        # copy-paste openjdk's preFixup
         preFixup = ''
+          # We cannot use -exec since wrapProgram is a function but not a
+          # command.
+          for bin in $( find "$out" -executable -type f -not -path '*/languages/ruby/lib/gems/*' ); do
+            if patchelf --print-interpreter "$bin" &> /dev/null || head -n 1 "$bin" | grep '^#!' -q; then
+              wrapProgram "$bin" \
+                --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+            fi
+          done
+
+          # copy-paste openjdk's preFixup
           # Set JAVA_HOME automatically.
           mkdir -p $out/nix-support
           cat <<EOF > $out/nix-support/setup-hook
             if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
           EOF
-        '';
-
-        postFixup = ''
-          rpath="${ {  "8" = "$out/jre/lib/amd64/jli:$out/jre/lib/amd64/server:$out/jre/lib/amd64:$out/jre/languages/ruby/lib/cext";
-                      "11" = "$out/lib/jli:$out/lib/server:$out/lib:$out/languages/ruby/lib/cext";
-                    }.${javaVersion}
-                 }:${
-            lib.makeLibraryPath [
-              stdenv.cc.cc.lib # libstdc++.so.6
-              zlib             # libz.so.1
-            ]}"
 
-          ${lib.optionalString stdenv.isLinux ''
-          for f in $(find $out -type f -perm -0100); do
-            patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f" || true
-            patchelf --set-rpath   "$rpath"                                    "$f" || true
-            if ldd "$f" | fgrep 'not found'; then echo "in file $f"; fi
-          done
-          ''}
+          find "$out" -name libfontmanager.so -exec \
+            patchelf --add-needed libfontconfig.so {} \;
         '';
 
         # $out/bin/native-image needs zlib to build native executables.
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index cd613c1b33be5..2ddc5b3d3a891 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -12,7 +12,8 @@ in stdenv.mkDerivation {
   };
 
   propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper unzip ] ;
+  buildInputs = [ unzip ] ;
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 3a3e384ad9827..2e03112d827d4 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -8,7 +8,7 @@ let
     pname = "clang";
     inherit version;
 
-    src = fetch "clang" "0kab4zmkxffg98a3rx95756jlwhxflalin5w05g1anpwxv175xbk";
+    src = fetch "clang" "12sm91qx2m79cvj75a9aazf2x8xybjbd593dv6v7rxficpq8i0ha";
     inherit clang-tools-extra_src;
 
     unpackPhase = ''
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt.nix b/pkgs/development/compilers/llvm/11/compiler-rt.nix
index 091f327550b88..5e9e436768511 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt.nix
@@ -11,7 +11,7 @@ in
 stdenv.mkDerivation rec {
   pname = "compiler-rt";
   inherit version;
-  src = fetch pname "1z470r8c5aahdwkmflglx998n0i77j8b1c69d7cir1kf27qy6yq8";
+  src = fetch pname "0x1j8ngf1zj63wlnns9vlibafq48qcm72p4jpaxkmkb4qw0grwfy";
 
   nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index ca9ef4382b4b5..e4d9f45c955eb 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  release_version = "11.0.1";
+  release_version = "11.1.0";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   version = "${release_version}${dash-candidate}"; # differentiating these (variables) is important for RCs
@@ -17,7 +17,7 @@ let
     inherit sha256;
   };
 
-  clang-tools-extra_src = fetch "clang-tools-extra" "1j8n6n4l54k2lrdxh266y1fl4z8vy5dc76wsf0csk5n3ikfi38ic";
+  clang-tools-extra_src = fetch "clang-tools-extra" "18n1w1hkv931xzq02b34wglbv6zd6sd0r5kb8piwvag7klj7qw3n";
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
diff --git a/pkgs/development/compilers/llvm/11/libc++/default.nix b/pkgs/development/compilers/llvm/11/libc++/default.nix
index 7a34977afe242..0bb1ae33acd96 100644
--- a/pkgs/development/compilers/llvm/11/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/11/libc++/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "libc++";
   inherit version;
 
-  src = fetch "libcxx" "0gaybwkn76vhakvipxslp7pmv2wm7agxkqwk5f5aizhzc9lzdmcz";
+  src = fetch "libcxx" "1rgqsqpgi0vkga5d7hy0iyfsqgzfz7q1xy7afdfa1snp1qjks8xv";
 
   postUnpack = ''
     unpackFile ${libcxxabi.src}
diff --git a/pkgs/development/compilers/llvm/11/libc++abi.nix b/pkgs/development/compilers/llvm/11/libc++abi.nix
index 22e4ac4abe4ca..d941044ca6058 100644
--- a/pkgs/development/compilers/llvm/11/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/11/libc++abi.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "libc++abi";
   inherit version;
 
-  src = fetch "libcxxabi" "0gv8pxq95gvsybldj21hdfkmm0r5cn1z7jhd72l231n0lmb70saa";
+  src = fetch "libcxxabi" "1azcf31mxw59hb1x17xncnm3dyw90ylh8rqx462lvypqh3nr6c8l";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
diff --git a/pkgs/development/compilers/llvm/11/libunwind.nix b/pkgs/development/compilers/llvm/11/libunwind.nix
index 1b5fe0f578805..0c635cabc0a97 100644
--- a/pkgs/development/compilers/llvm/11/libunwind.nix
+++ b/pkgs/development/compilers/llvm/11/libunwind.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   pname = "libunwind";
   inherit version;
 
-  src = fetch pname "0zsixkaiwp007afxlpsf5dc7wfrv8sj9wxzjw6f1r4bjv1rv3cvd";
+  src = fetch pname "1vpqs2c358v8fbr1r8jmzkfqk12jllimjcfmgxga127ksq9b37nj";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/llvm/11/lld.nix b/pkgs/development/compilers/llvm/11/lld.nix
index cead886f49b7a..1a16184a6e71a 100644
--- a/pkgs/development/compilers/llvm/11/lld.nix
+++ b/pkgs/development/compilers/llvm/11/lld.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   pname = "lld";
   inherit version;
 
-  src = fetch pname "1dq82dkam8x2niha18v7ckh30zmzyclydzipqkf7h41r3ah0vfk0";
+  src = fetch pname "1kk61i7z5bi9i11rzsd2b388d42if1c7a45zkaa4mk0yps67hyh1";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ llvm libxml2 ];
diff --git a/pkgs/development/compilers/llvm/11/lldb.nix b/pkgs/development/compilers/llvm/11/lldb.nix
index fcc73cfdeb6dd..2f54305736ac0 100644
--- a/pkgs/development/compilers/llvm/11/lldb.nix
+++ b/pkgs/development/compilers/llvm/11/lldb.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (rec {
   pname = "lldb";
   inherit version;
 
-  src = fetch pname "1yzjbsn81l2r3v9js2fxrglkwvz1f2rxyxh6430nydbrs0bqklz8";
+  src = fetch pname "1vlyg015dyng43xqb8cg2l6r9ix8klibxsajazbfnckdnh54hwxj";
 
   patches = [ ./lldb-procfs.patch ];
 
diff --git a/pkgs/development/compilers/llvm/11/llvm.nix b/pkgs/development/compilers/llvm/11/llvm.nix
index 868da1a5b2078..cb44643ff78f2 100644
--- a/pkgs/development/compilers/llvm/11/llvm.nix
+++ b/pkgs/development/compilers/llvm/11/llvm.nix
@@ -32,8 +32,8 @@ in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
-  src = fetch pname "0a5mb65xa5bal8q6cb37xgkqis2bip87fsafgq3wbsva9cjprn6c";
-  polly_src = fetch "polly" "1smrqm9s0r2g9h0v0nil6y9wn2ih4l5bddk4dhgn538ngc7cxpq8";
+  src = fetch pname "199yq3a214avcbi4kk2q0ajriifkvsr0l2dkx3a666m033ihi1ff";
+  polly_src = fetch "polly" "031r23ijhx7v93a5n33m2nc0x9xyqmx0d8xg80z7q971p6qd63sq";
 
   unpackPhase = ''
     unpackFile $src
diff --git a/pkgs/development/compilers/llvm/11/openmp.nix b/pkgs/development/compilers/llvm/11/openmp.nix
index 5503a98ae5f64..86e3faee0909a 100644
--- a/pkgs/development/compilers/llvm/11/openmp.nix
+++ b/pkgs/development/compilers/llvm/11/openmp.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   pname = "openmp";
   inherit version;
 
-  src = fetch pname "19rcv25y41ww3zlfg0lwprzijl3cn7jgc0v5540jzpp7j0ds45ad";
+  src = fetch pname "0bh5cswgpc79awlq8j5i7hp355adaac7s6zaz0zwp6mkflxli1yi";
 
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ llvm ];
diff --git a/pkgs/development/compilers/mercury/default.nix b/pkgs/development/compilers/mercury/default.nix
index e063c4c09217c..c5e767a46cde4 100644
--- a/pkgs/development/compilers/mercury/default.nix
+++ b/pkgs/development/compilers/mercury/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "ef093ae81424c4f3fe696eff9aefb5fb66899e11bb17ae0326adfb70d09c1c1f";
   };
 
-  buildInputs = [ gcc flex bison texinfo jdk erlang makeWrapper
-                  readline ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ gcc flex bison texinfo jdk erlang readline ];
 
   patchPhase = ''
     # Fix calls to programs in /bin
diff --git a/pkgs/development/compilers/mozart/binary.nix b/pkgs/development/compilers/mozart/binary.nix
index 8366fd77a47af..b043187e6c1ee 100644
--- a/pkgs/development/compilers/mozart/binary.nix
+++ b/pkgs/development/compilers/mozart/binary.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   TK_LIBRARY = "${tk-8_5}/lib/tk8.5";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     mkdir $out
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 18440a718d19d..a24dca373f1ee 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -11,8 +11,8 @@
 let
   major = "11";
   minor = "0";
-  update = "9";
-  build = "11";
+  update = "10";
+  build = "9";
 
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
@@ -22,7 +22,7 @@ let
       owner = "openjdk";
       repo = "jdk${major}u";
       rev = "jdk-${version}";
-      sha256 = "11j2rqz9nag5y562g99py4p72f2kv4wwwyrnaspmrzax00wynyx7";
+      sha256 = "06pm3hpz4ggiqwvkgzxr39y9kga7vk4flakfznz5979bvgb926vw";
     };
 
     nativeBuildInputs = [ pkg-config autoconf ];
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 7a6cdf4d70520..41f4befe469fb 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -83,11 +83,9 @@ let result = stdenv.mkDerivation rec {
       sha256 = sha256.${stdenv.hostPlatform.system};
     };
 
-  nativeBuildInputs = [ file ]
+  nativeBuildInputs = [ file makeWrapper ]
     ++ lib.optional installjce unzip;
 
-  buildInputs = [ makeWrapper ];
-
   # See: https://github.com/NixOS/patchelf/issues/10
   dontStrip = 1;
 
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index 770cc3415f2c0..ce4250f675e9a 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -83,8 +83,8 @@ rec {
       license = [ licenses.mit licenses.asl20 ];
     };
 
-    buildInputs = [ makeWrapper bash ]
-      ++ lib.optional stdenv.isDarwin Security;
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ bash ] ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
       patchShebangs .
diff --git a/pkgs/development/compilers/rust/make-rust-platform.nix b/pkgs/development/compilers/rust/make-rust-platform.nix
index 4b1f572bebb88..584b1fdbe438e 100644
--- a/pkgs/development/compilers/rust/make-rust-platform.nix
+++ b/pkgs/development/compilers/rust/make-rust-platform.nix
@@ -12,7 +12,8 @@ rec {
   };
 
   buildRustPackage = callPackage ../../../build-support/rust {
-    inherit rustc cargo fetchCargoTarball;
+    inherit cargoBuildHook cargoCheckHook cargoInstallHook cargoSetupHook
+      fetchCargoTarball rustc;
   };
 
   rustcSrc = callPackage ./rust-src.nix {
@@ -22,4 +23,9 @@ rec {
   rustLibSrc = callPackage ./rust-lib-src.nix {
     inherit rustc;
   };
+
+  # Hooks
+  inherit (callPackage ../../../build-support/rust/hooks {
+    inherit cargo;
+  }) cargoBuildHook cargoCheckHook cargoInstallHook cargoSetupHook maturinBuildHook;
 }
diff --git a/pkgs/development/compilers/rust/rls/default.nix b/pkgs/development/compilers/rust/rls/default.nix
index ee860d782580c..aa55866def515 100644
--- a/pkgs/development/compilers/rust/rls/default.nix
+++ b/pkgs/development/compilers/rust/rls/default.nix
@@ -2,7 +2,7 @@
 , openssh, openssl, pkg-config, cmake, zlib, curl, libiconv
 , CoreFoundation, Security }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
   pname = "rls";
   inherit (rustPlatform.rust.rustc) src version;
 
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage {
 
   preBuild = ''
     # client tests are flaky
-    rm tests/client.rs
+    rm ${buildAndTestSubdir}/tests/client.rs
   '';
 
   # a nightly compiler is required unless we use this cheat code.
@@ -28,8 +28,8 @@ rustPlatform.buildRustPackage {
   # rls-rustc links to rustc_private crates
   CARGO_BUILD_RUSTFLAGS = if stdenv.isDarwin then "-C rpath" else null;
 
-  nativeBuildInputs = [ pkg-config cmake ];
-  buildInputs = [ openssh openssl curl zlib libiconv makeWrapper rustPlatform.rust.rustc.llvm ]
+  nativeBuildInputs = [ pkg-config cmake makeWrapper ];
+  buildInputs = [ openssh openssl curl zlib libiconv rustPlatform.rust.rustc.llvm ]
     ++ (lib.optionals stdenv.isDarwin [ CoreFoundation Security ]);
 
   doCheck = true;
diff --git a/pkgs/development/compilers/sbcl/bootstrap.nix b/pkgs/development/compilers/sbcl/bootstrap.nix
index cb42235bc8e2a..8bdbbadc9d60d 100644
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     sha256 = cfg.sha256;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/compilers/scala/2.x.nix b/pkgs/development/compilers/scala/2.x.nix
index 93eff278dc09e..a0a5f1a2b22c5 100644
--- a/pkgs/development/compilers/scala/2.x.nix
+++ b/pkgs/development/compilers/scala/2.x.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ jre ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/compilers/scala/dotty-bare.nix b/pkgs/development/compilers/scala/dotty-bare.nix
index b173de58049bc..66a634914dfba 100644
--- a/pkgs/development/compilers/scala/dotty-bare.nix
+++ b/pkgs/development/compilers/scala/dotty-bare.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   propagatedBuildInputs = [ jre ncurses.dev ] ;
-  buildInputs = [ makeWrapper ] ;
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/compilers/smlnj/bootstrap.nix b/pkgs/development/compilers/smlnj/bootstrap.nix
index 113b22768d9f9..91eb9fc84172d 100644
--- a/pkgs/development/compilers/smlnj/bootstrap.nix
+++ b/pkgs/development/compilers/smlnj/bootstrap.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "12jn50h5jz0ac1vzld2mb94p1dyc8h0mk0hip2wj5xqk1dbzwxl4";
   };
 
-  buildInputs = [ cpio rsync makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ cpio rsync ];
 
   unpackPhase = ''
     ${xar}/bin/xar -xf $src
diff --git a/pkgs/development/compilers/tinygo/default.nix b/pkgs/development/compilers/tinygo/default.nix
index 0aee1ca1f3943..218b207f24355 100644
--- a/pkgs/development/compilers/tinygo/default.nix
+++ b/pkgs/development/compilers/tinygo/default.nix
@@ -40,7 +40,8 @@ buildGoModule rec {
   '';
 
   subPackages = [ "." ];
-  buildInputs = [ llvm clang-unwrapped makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ llvm clang-unwrapped ];
   propagatedBuildInputs = [ lld avrgcc avrdude openocd gcc-arm-embedded ];
 
   postInstall = ''
diff --git a/pkgs/development/compilers/urn/default.nix b/pkgs/development/compilers/urn/default.nix
index f7e338cf43ff4..8b74f46fd0409 100644
--- a/pkgs/development/compilers/urn/default.nix
+++ b/pkgs/development/compilers/urn/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
     sha256 = "0nclr3d8ap0y5cg36i7g4ggdqci6m5q27y9f26b57km8p266kcpy";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   # Any packages that depend on the compiler have a transitive
   # dependency on the Urn runtime support.
   propagatedBuildInputs = [ urn-rt ];
diff --git a/pkgs/development/compilers/zulu/8.nix b/pkgs/development/compilers/zulu/8.nix
index 2bc90539be1e6..dd1660d9fec77 100644
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@@ -1,7 +1,24 @@
-{ stdenv, lib, fetchurl, unzip, makeWrapper, setJavaClassPath
-, zulu, glib, libxml2, ffmpeg_3, libxslt, libGL, alsaLib
-, fontconfig, freetype, pango, gtk2, cairo, gdk-pixbuf, atk, xorg
-, swingSupport ? true }:
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, unzip
+, makeWrapper
+, setJavaClassPath
+, zulu
+# minimum dependencies
+, alsaLib
+, fontconfig
+, freetype
+, xorg
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? stdenv.isLinux
+, cairo
+, glib
+, gtk3
+}:
 
 let
   version = "8.48.0.53";
@@ -14,14 +31,12 @@ let
   hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
   extension = if stdenv.isDarwin then "zip" else "tar.gz";
 
-  libraries = [
-    stdenv.cc.libc glib libxml2 ffmpeg_3 libxslt libGL
-    xorg.libXxf86vm alsaLib fontconfig freetype pango
-    gtk2 cairo gdk-pixbuf atk
-  ] ++ (lib.optionals swingSupport (with xorg; [
-    xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXp
-    xorg.libXt xorg.libXrender stdenv.cc.cc
-  ]));
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo glib gtk3
+  ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
 
 in stdenv.mkDerivation {
   inherit version openjdk platform hash extension;
@@ -33,26 +48,28 @@ in stdenv.mkDerivation {
     sha256 = hash;
   };
 
-  buildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin unzip;
+  buildInputs = lib.optionals stdenv.isLinux [
+    alsaLib # libasound.so wanted by lib/libjsound.so
+    fontconfig
+    freetype
+    stdenv.cc.cc # libstdc++.so.6
+    xorg.libX11
+    xorg.libXext
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXtst
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    unzip
+  ];
 
   installPhase = ''
     mkdir -p $out
     cp -r ./* "$out/"
 
-    jrePath="$out/jre"
-
-    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/jli
-    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/server
-    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/xawt
-    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64
-
-    # set all the dynamic linkers
-    find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "$rpath" {} \;
-
-    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
-
     mkdir -p $out/nix-support
     printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
 
@@ -60,9 +77,19 @@ in stdenv.mkDerivation {
     cat <<EOF >> $out/nix-support/setup-hook
     if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
+  '' + lib.optionalString stdenv.isLinux ''
+    # We cannot use -exec since wrapProgram is a function but not a command.
+    for bin in $( find "$out" -executable -type f ); do
+      if patchelf --print-interpreter "$bin" &> /dev/null; then
+        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+      fi
+    done
   '';
 
-  rpath = lib.strings.makeLibraryPath libraries;
+  preFixup = ''
+    find "$out" -name libfontmanager.so -exec \
+      patchelf --add-needed libfontconfig.so {} \;
+  '';
 
   passthru = {
     home = zulu;
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index cbfa9997b8dbf..000530e66a748 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -1,7 +1,25 @@
-{ stdenv, lib, fetchurl, unzip, makeWrapper, setJavaClassPath
-, zulu, glib, libxml2, ffmpeg_3, libxslt, libGL, alsaLib
-, fontconfig, freetype, pango, gtk2, cairo, gdk-pixbuf, atk, xorg, zlib
-, swingSupport ? true }:
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, unzip
+, makeWrapper
+, setJavaClassPath
+, zulu
+# minimum dependencies
+, alsaLib
+, fontconfig
+, freetype
+, zlib
+, xorg
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? stdenv.isLinux
+, cairo
+, glib
+, gtk3
+}:
 
 let
   version = "11.41.23";
@@ -14,14 +32,12 @@ let
   hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
   extension = if stdenv.isDarwin then "zip" else "tar.gz";
 
-  libraries = [
-    stdenv.cc.libc glib libxml2 ffmpeg_3 libxslt libGL
-    xorg.libXxf86vm alsaLib fontconfig freetype pango
-    gtk2 cairo gdk-pixbuf atk zlib
-  ] ++ (lib.optionals swingSupport (with xorg; [
-    xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXp
-    xorg.libXt xorg.libXrender stdenv.cc.cc
-  ]));
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo glib gtk3
+  ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
 
 in stdenv.mkDerivation {
   inherit version openjdk platform hash extension;
@@ -33,23 +49,29 @@ in stdenv.mkDerivation {
     sha256 = hash;
   };
 
-  buildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin unzip;
+  buildInputs = lib.optionals stdenv.isLinux [
+    alsaLib # libasound.so wanted by lib/libjsound.so
+    fontconfig
+    freetype
+    stdenv.cc.cc # libstdc++.so.6
+    xorg.libX11
+    xorg.libXext
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXtst
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    unzip
+  ];
 
   installPhase = ''
     mkdir -p $out
     cp -r ./* "$out/"
 
-    rpath=$rpath''${rpath:+:}$out/lib/jli
-    rpath=$rpath''${rpath:+:}$out/lib/server
-    rpath=$rpath''${rpath:+:}$out/lib
-
-    # set all the dynamic linkers
-    find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "$rpath" {} \;
-
-    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
-
     mkdir -p $out/nix-support
     printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
 
@@ -57,9 +79,17 @@ in stdenv.mkDerivation {
     cat <<EOF >> $out/nix-support/setup-hook
     if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
+  '' + lib.optionalString stdenv.isLinux ''
+    # We cannot use -exec since wrapProgram is a function but not a command.
+    for bin in $( find "$out" -executable -type f ); do
+      wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+    done
   '';
 
-  rpath = lib.strings.makeLibraryPath libraries;
+  preFixup = ''
+    find "$out" -name libfontmanager.so -exec \
+      patchelf --add-needed libfontconfig.so {} \;
+  '';
 
   passthru = {
     home = zulu;
diff --git a/pkgs/development/interpreters/chibi/default.nix b/pkgs/development/interpreters/chibi/default.nix
index 96c884ab602e7..92531eacd20d9 100644
--- a/pkgs/development/interpreters/chibi/default.nix
+++ b/pkgs/development/interpreters/chibi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     sha256 = "0nd63i924ifh39cba1hd4sbi6vh1cb73v97nrn4bf8rrjh3k8pdi";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     make install PREFIX="$out"
diff --git a/pkgs/development/interpreters/clojure/clooj.nix b/pkgs/development/interpreters/clojure/clooj.nix
index 57da5e862e994..baf83c647767f 100644
--- a/pkgs/development/interpreters/clojure/clooj.nix
+++ b/pkgs/development/interpreters/clojure/clooj.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0hbc29bg2a86rm3sx9kvj7h7db9j0kbnrb706wsfiyk3zi3bavnd";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = "installPhase";
 
diff --git a/pkgs/development/interpreters/elixir/generic-builder.nix b/pkgs/development/interpreters/elixir/generic-builder.nix
index aaf368017ffb7..0e4beaa8508f0 100644
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@@ -20,7 +20,8 @@ in
 
     inherit src version;
 
-    buildInputs = [ erlang makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ erlang ];
 
     LANG = "C.UTF-8";
     LC_TYPE = "C.UTF-8";
diff --git a/pkgs/development/interpreters/groovy/default.nix b/pkgs/development/interpreters/groovy/default.nix
index 0e3a0a46afdec..114bc13f5d8ae 100644
--- a/pkgs/development/interpreters/groovy/default.nix
+++ b/pkgs/development/interpreters/groovy/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1xdpjqx7qaq0syw448b32q36g12pgh1hn6knyqi3k5isp0f09qmr";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/interpreters/jruby/default.nix b/pkgs/development/interpreters/jruby/default.nix
index f792471c0619e..fb1fdd3c8e08e 100644
--- a/pkgs/development/interpreters/jruby/default.nix
+++ b/pkgs/development/interpreters/jruby/default.nix
@@ -13,7 +13,7 @@ jruby = stdenv.mkDerivation rec {
     sha256 = "1dg0fz9b8m1k0sypvpxnf4xjqwc0pyy35xw4rsg4a7pha4jkprrj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
      mkdir -pv $out/docs
diff --git a/pkgs/development/interpreters/jython/default.nix b/pkgs/development/interpreters/jython/default.nix
index 61cc8f9cd0f56..38b599d339e7b 100644
--- a/pkgs/development/interpreters/jython/default.nix
+++ b/pkgs/development/interpreters/jython/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "142285hd9mx0nx5zw0jvkpqkb4kbhgyyy52p5bj061ya8bg5jizy";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontUnpack = true;
 
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 75fe1bac8cb46..66e0b284fc0df 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -168,11 +168,11 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "4c55233ae95a6aef4d93291fe8ad12709b11e575"; # Jan 21, 2021
+    crossVersion = "1.3.5"; # Jan 24, 2021
 
     perl-cross-src = fetchurl {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "04bxn43ir7b4c2bb1z1l71l93hrysjv00h879nm70m99q6vxq2hc";
+      sha256 = "1sa2f8s1hc604g5y98w6m6y5q43s9jiyrpnp4b34zkfx1qs3w6l4";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -200,8 +200,8 @@ in {
   perl532 = common {
     perl = pkgs.perl532;
     buildPerl = buildPackages.perl532;
-    version = "5.32.0";
-    sha256 = "1d6001cjnpxfv79000bx00vmv2nvdz7wrnyas451j908y7hirszg";
+    version = "5.32.1";
+    sha256 = "0b7brakq9xs4vavhg391as50nbhzryc7fy5i65r81bnq3j897dh3";
   };
 
   # the latest Devel version
diff --git a/pkgs/development/interpreters/picolisp/default.nix b/pkgs/development/interpreters/picolisp/default.nix
index 341797fa3f4c3..623eefec4162f 100644
--- a/pkgs/development/interpreters/picolisp/default.nix
+++ b/pkgs/development/interpreters/picolisp/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     url = "https://www.software-lab.de/${pname}-${version}.tgz";
     sha256 = "0l51x98bn1hh6kv40sdgp0x09pzg5i8yxbcjvm9n5bxsd6bbk5w2";
   };
-  buildInputs = [makeWrapper openssl] ++ optional stdenv.is64bit jdk;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [openssl] ++ optional stdenv.is64bit jdk;
   patchPhase = ''
     sed -i "s/which java/command -v java/g" mkAsm
 
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 19e6c93378f70..863df66899b14 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256="0px6x5ivcdbbp2pz5n1r1cwg1syadklhjw8piqhl63n91i4r7iyb";
   };
 
-  buildInputs = [ bison flex makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bison flex ];
   propagatedBuildInputs = [ llvm gmp mpfr readline ];
   NIX_LDFLAGS = "-lLLVMJIT";
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-3177.patch b/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-3177.patch
new file mode 100644
index 0000000000000..6c0ae468461f2
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-3177.patch
@@ -0,0 +1,181 @@
+From fab838b2ee7cfb9037c24f0f18dfe01aa379b3f7 Mon Sep 17 00:00:00 2001
+From: Benjamin Peterson <benjamin@python.org>
+Date: Mon, 18 Jan 2021 15:11:46 -0600
+Subject: [3.6] closes bpo-42938: Replace snprintf with Python unicode
+ formatting in ctypes param reprs. (GH-24250)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(cherry picked from commit 916610ef90a0d0761f08747f7b0905541f0977c7)
+
+Co-authored-by: Benjamin Peterson <benjamin@python.org>
+Rebased for Python 2.7 by Michał Górny <mgorny@gentoo.org>
+---
+ Lib/ctypes/test/test_parameters.py                 | 43 +++++++++++++++++++
+ .../2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst       |  2 +
+ Modules/_ctypes/callproc.c                         | 49 +++++++++++-----------
+ 3 files changed, 69 insertions(+), 25 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
+
+diff --git a/Lib/ctypes/test/test_parameters.py b/Lib/ctypes/test/test_parameters.py
+index 23c1b6e225..3456882ccb 100644
+--- a/Lib/ctypes/test/test_parameters.py
++++ b/Lib/ctypes/test/test_parameters.py
+@@ -206,6 +206,49 @@ class SimpleTypesTestCase(unittest.TestCase):
+         with self.assertRaises(ZeroDivisionError):
+             WorseStruct().__setstate__({}, b'foo')
+ 
++    def test_parameter_repr(self):
++        from ctypes import (
++            c_bool,
++            c_char,
++            c_wchar,
++            c_byte,
++            c_ubyte,
++            c_short,
++            c_ushort,
++            c_int,
++            c_uint,
++            c_long,
++            c_ulong,
++            c_longlong,
++            c_ulonglong,
++            c_float,
++            c_double,
++            c_longdouble,
++            c_char_p,
++            c_wchar_p,
++            c_void_p,
++        )
++        self.assertRegexpMatches(repr(c_bool.from_param(True)), r"^<cparam '\?' at 0x[A-Fa-f0-9]+>$")
++        self.assertEqual(repr(c_char.from_param('a')), "<cparam 'c' (a)>")
++        self.assertRegexpMatches(repr(c_wchar.from_param('a')), r"^<cparam 'u' at 0x[A-Fa-f0-9]+>$")
++        self.assertEqual(repr(c_byte.from_param(98)), "<cparam 'b' (98)>")
++        self.assertEqual(repr(c_ubyte.from_param(98)), "<cparam 'B' (98)>")
++        self.assertEqual(repr(c_short.from_param(511)), "<cparam 'h' (511)>")
++        self.assertEqual(repr(c_ushort.from_param(511)), "<cparam 'H' (511)>")
++        self.assertRegexpMatches(repr(c_int.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_uint.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_long.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_ulong.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_longlong.from_param(20000)), r"^<cparam '[liq]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_ulonglong.from_param(20000)), r"^<cparam '[LIQ]' \(20000\)>$")
++        self.assertEqual(repr(c_float.from_param(1.5)), "<cparam 'f' (1.5)>")
++        self.assertEqual(repr(c_double.from_param(1.5)), "<cparam 'd' (1.5)>")
++        self.assertEqual(repr(c_double.from_param(1e300)), "<cparam 'd' (1e+300)>")
++        self.assertRegexpMatches(repr(c_longdouble.from_param(1.5)), r"^<cparam ('d' \(1.5\)|'g' at 0x[A-Fa-f0-9]+)>$")
++        self.assertRegexpMatches(repr(c_char_p.from_param(b'hihi')), "^<cparam 'z' \(0x[A-Fa-f0-9]+\)>$")
++        self.assertRegexpMatches(repr(c_wchar_p.from_param('hihi')), "^<cparam 'Z' \(0x[A-Fa-f0-9]+\)>$")
++        self.assertRegexpMatches(repr(c_void_p.from_param(0x12)), r"^<cparam 'P' \(0x0*12\)>$")
++
+ ################################################################
+ 
+ if __name__ == '__main__':
+diff --git a/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
+new file mode 100644
+index 0000000000..7df65a156f
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
+@@ -0,0 +1,2 @@
++Avoid static buffers when computing the repr of :class:`ctypes.c_double` and
++:class:`ctypes.c_longdouble` values.
+diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
+index 066fefc0cc..421addf353 100644
+--- a/Modules/_ctypes/callproc.c
++++ b/Modules/_ctypes/callproc.c
+@@ -460,50 +460,51 @@ PyCArg_dealloc(PyCArgObject *self)
+ static PyObject *
+ PyCArg_repr(PyCArgObject *self)
+ {
+-    char buffer[256];
+     switch(self->tag) {
+     case 'b':
+     case 'B':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyString_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.b);
+-        break;
+     case 'h':
+     case 'H':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyString_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.h);
+-        break;
+     case 'i':
+     case 'I':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyString_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.i);
+-        break;
+     case 'l':
+     case 'L':
+-        sprintf(buffer, "<cparam '%c' (%ld)>",
++        return PyString_FromFormat("<cparam '%c' (%ld)>",
+             self->tag, self->value.l);
+-        break;
+ 
+ #ifdef HAVE_LONG_LONG
+     case 'q':
+     case 'Q':
+-        sprintf(buffer,
++        return PyString_FromFormat(
+             "<cparam '%c' (%" PY_FORMAT_LONG_LONG "d)>",
+             self->tag, self->value.q);
+-        break;
+ #endif
+     case 'd':
+-        sprintf(buffer, "<cparam '%c' (%f)>",
+-            self->tag, self->value.d);
+-        break;
+-    case 'f':
+-        sprintf(buffer, "<cparam '%c' (%f)>",
+-            self->tag, self->value.f);
+-        break;
+-
++    case 'f': {
++        PyObject *f = PyFloat_FromDouble((self->tag == 'f') ? self->value.f : self->value.d);
++        if (f == NULL) {
++            return NULL;
++        }
++        PyObject *r = PyObject_Repr(f);
++        if (r == NULL) {
++            Py_DECREF(f);
++            return NULL;
++        }
++        PyObject *result = PyString_FromFormat(
++            "<cparam '%c' (%s)>", self->tag, PyString_AsString(r));
++        Py_DECREF(r);
++        Py_DECREF(f);
++        return result;
++    }
+     case 'c':
+-        sprintf(buffer, "<cparam '%c' (%c)>",
++        return PyString_FromFormat("<cparam '%c' (%c)>",
+             self->tag, self->value.c);
+-        break;
+ 
+ /* Hm, are these 'z' and 'Z' codes useful at all?
+    Shouldn't they be replaced by the functionality of c_string
+@@ -512,16 +513,14 @@ PyCArg_repr(PyCArgObject *self)
+     case 'z':
+     case 'Z':
+     case 'P':
+-        sprintf(buffer, "<cparam '%c' (%p)>",
++        return PyString_FromFormat("<cparam '%c' (%p)>",
+             self->tag, self->value.p);
+         break;
+ 
+     default:
+-        sprintf(buffer, "<cparam '%c' at %p>",
++        return PyString_FromFormat("<cparam '%c' at %p>",
+             self->tag, self);
+-        break;
+     }
+-    return PyString_FromString(buffer);
+ }
+ 
+ static PyMemberDef PyCArgType_members[] = {
+-- 
+cgit v1.2.3
+
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 85af394e3f65f..37d43e33d8e51 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -103,6 +103,9 @@ let
 
       # Patch is likely to go away in the next release (if there is any)
       ./CVE-2019-20907.patch
+
+      ./CVE-2021-3177.patch
+
     ] ++ optionals (x11Support && stdenv.isDarwin) [
       ./use-correct-tcl-tk-on-darwin.patch
     ] ++ optionals stdenv.isLinux [
diff --git a/pkgs/development/interpreters/python/cpython/3.7/find_library.patch b/pkgs/development/interpreters/python/cpython/3.6/find_library.patch
index 97fb66662d030..97fb66662d030 100644
--- a/pkgs/development/interpreters/python/cpython/3.7/find_library.patch
+++ b/pkgs/development/interpreters/python/cpython/3.6/find_library.patch
diff --git a/pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch
index a1f9d68eb1663..4324fc5ea61fc 100644
--- a/pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch
@@ -1,18 +1,18 @@
-From 597e73f2a4b2f0b508127931b36d5540d6941823 Mon Sep 17 00:00:00 2001
+From ba458f33f335b217d078fdce56e9c6f9f93adb49 Mon Sep 17 00:00:00 2001
 From: Frederik Rietdijk <fridh@fridh.nl>
 Date: Mon, 28 Aug 2017 09:24:06 +0200
 Subject: [PATCH] Don't use ldconfig
 
 ---
- Lib/ctypes/util.py | 70 ++----------------------------------------------------
- 1 file changed, 2 insertions(+), 68 deletions(-)
+ Lib/ctypes/util.py | 78 ++--------------------------------------------
+ 1 file changed, 2 insertions(+), 76 deletions(-)
 
 diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
-index 5e8b31a854..7b45ce6c15 100644
+index 0c2510e..79635a8 100644
 --- a/Lib/ctypes/util.py
 +++ b/Lib/ctypes/util.py
-@@ -94,46 +94,7 @@ elif os.name == "posix":
-     import re, tempfile
+@@ -100,54 +100,7 @@ elif os.name == "posix":
+             return thefile.read(4) == elf_header
  
      def _findLib_gcc(name):
 -        # Run GCC's linker with the -t (aka --trace) option and examine the
@@ -51,15 +51,23 @@ index 5e8b31a854..7b45ce6c15 100644
 -                # Raised if the file was already removed, which is the normal
 -                # behaviour of GCC if linking fails
 -                pass
--        res = re.search(expr, trace)
+-        res = re.findall(expr, trace)
 -        if not res:
 -            return None
--        return os.fsdecode(res.group(0))
+-
+-        for file in res:
+-            # Check if the given file is an elf file: gcc can report
+-            # some files that are linker scripts and not actual
+-            # shared objects. See bpo-41976 for more details
+-            if not _is_elf(file):
+-                continue
+-            return os.fsdecode(file)
+-
 +        return None
  
- 
      if sys.platform == "sunos5":
-@@ -255,34 +216,7 @@ elif os.name == "posix":
+         # use /usr/ccs/bin/dump on solaris
+@@ -268,34 +221,7 @@ elif os.name == "posix":
      else:
  
          def _findSoname_ldconfig(name):
@@ -96,5 +104,5 @@ index 5e8b31a854..7b45ce6c15 100644
          def _findLib_ld(name):
              # See issue #9998 for why this is needed
 -- 
-2.15.0
+2.30.0
 
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 7bc6084f61ddf..1ae8d19ac58e6 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -222,9 +222,9 @@ in with passthru; stdenv.mkDerivation {
       else
         ./3.7/fix-finding-headers-when-cross-compiling.patch
     )
-  ] ++ optionals (isPy36 || isPy37) [
+  ] ++ optionals (isPy36) [
     # Backport a fix for ctypes.util.find_library.
-    ./3.7/find_library.patch
+    ./3.6/find_library.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index d6030a4bf1d7e..4cf245f26a98e 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -128,10 +128,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "6";
-      patch = "12";
+      patch = "13";
       suffix = "";
     };
-    sha256 = "cJU6m11okdkuZdGEw1EhJqFYFL7hXh7/LdzOBDNOmpk=";
+    sha256 = "pHpDpTq7QihqLBGWU0P/VnEbnmTo0RvyxnAaT7jOGg8=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -141,10 +141,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "9";
+      patch = "10";
       suffix = "";
     };
-    sha256 = "008v6g1jkrjrdmiqlgjlq6msbbj848bvkws6ppwva1ahn03k14li";
+    sha256 = "+NgudXLIbsnVXIYnquUEAST9IgOvQAw4PIIbmAMG7ms=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -154,10 +154,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "8";
-      patch = "7";
+      patch = "8";
       suffix = "";
     };
-    sha256 = "sha256-3cwd8Wu1uHqkLsXSCluQLy0IjKommyjgFZD5enmOxQo=";
+    sha256 = "fGZCSf935EPW6g5M8OWH6ukYyjxI0IHRkV/iofG8xcw=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -167,10 +167,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "9";
-      patch = "1";
+      patch = "2";
       suffix = "";
     };
-    sha256 = "1zq3k4ymify5ig739zyvx9s2ainvchxb1zpy139z74krr653y74r";
+    sha256 = "PCA0xU+BFEj1FmaNzgnSQAigcWw6eU3YY5tTiMveJH0=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -181,9 +181,9 @@ in {
       major = "3";
       minor = "10";
       patch = "0";
-      suffix = "a4";
+      suffix = "a5";
     };
-    sha256 = "sha256-McHBl7IZuOH96je/izkxur0Edirn+igVkQU/pbek73M=";
+    sha256 = "BBjlfnA24hnx5rYwOyHnEfZM/Q/dsIlNjxnzev/8XU0=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
index 85811a374755d..eb45205ff731f 100644
--- a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
@@ -2,7 +2,7 @@
 echo "Sourcing pytest-check-hook"
 
 declare -ar disabledTests
-declare -ar disabledTestFiles
+declare -ar disabledTestPaths
 
 function _concatSep {
     local result
@@ -37,12 +37,12 @@ function pytestCheckPhase() {
         disabledTestsString=$(_pytestComputeDisabledTestsString "${disabledTests[@]}")
       args+=" -k \""$disabledTestsString"\""
     fi
-    for file in ${disabledTestFiles[@]}; do
-      if [ ! -f "$file" ]; then
-        echo "Disabled test file \"$file\" does not exist. Aborting"
+    for path in ${disabledTestPaths[@]}; do
+      if [ ! -e "$path" ]; then
+        echo "Disabled tests path \"$path\" does not exist. Aborting"
         exit 1
       fi
-      args+=" --ignore=\"$file\""
+      args+=" --ignore=\"$path\""
     done
     args+=" ${pytestFlagsArray[@]}"
     eval "@pythonCheckInterpreter@ $args"
diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index 5eccebf024520..42e82cd3a51be 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wccVMEUAfTWs/8hnrT7nrxfYPHyNl+lXt+KUDkyplto=";
   };
 
-  buildInputs = [ rakudo makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ rakudo ];
 
   installPhase = ''
     mkdir -p "$out"
diff --git a/pkgs/development/interpreters/rascal/default.nix b/pkgs/development/interpreters/rascal/default.nix
index cd2b74db05207..8b49a743b4a90 100644
--- a/pkgs/development/interpreters/rascal/default.nix
+++ b/pkgs/development/interpreters/rascal/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1z4mwdbdc3r24haljnxng8znlfg2ihm9bf9zq8apd9a32ipcw4i6";
   };
 
-  buildInputs = [ makeWrapper jdk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ];
 
   dontUnpack = true;
 
diff --git a/pkgs/development/interpreters/spidermonkey/78.nix b/pkgs/development/interpreters/spidermonkey/78.nix
index 81ebcedf7bc05..e04069f6aecc1 100644
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@@ -15,7 +15,7 @@
 , rustc
 , rust-cbindgen
 , yasm
-, llvmPackages
+, llvmPackages_11
 , nspr
 }:
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoconf213
     cargo
-    llvmPackages.llvm # for llvm-objdump
+    llvmPackages_11.llvm # for llvm-objdump
     perl
     pkg-config
     python3
diff --git a/pkgs/development/interpreters/tcl/8.6.nix b/pkgs/development/interpreters/tcl/8.6.nix
index d76ceb3421de4..37a7fee8a859e 100644
--- a/pkgs/development/interpreters/tcl/8.6.nix
+++ b/pkgs/development/interpreters/tcl/8.6.nix
@@ -2,10 +2,10 @@
 
 callPackage ./generic.nix (args // rec {
   release = "8.6";
-  version = "${release}.9";
+  version = "${release}.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/tcl/tcl${version}-src.tar.gz";
-    sha256 = "0kjzj7mkzfnb7ksxanbibibfpciyvsh5ffdlhs0bmfc75kgd435d";
+    sha256 = "0n4211j80mxr6ql0xx52rig8r885rcbminfpjdb2qrw6hmk8c14c";
   };
 })
diff --git a/pkgs/development/interpreters/wasmer/default.nix b/pkgs/development/interpreters/wasmer/default.nix
index 60ce4d89f19cd..91e13ed32cd9e 100644
--- a/pkgs/development/interpreters/wasmer/default.nix
+++ b/pkgs/development/interpreters/wasmer/default.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   # using the [makefile](https://github.com/wasmerio/wasmer/blob/master/Makefile).
   # Enabling cranelift as this used to be the old default. At least one backend is
   # needed for the run subcommand to work.
-  cargoBuildFlags = [ "--features 'backend-cranelift'" ];
+  cargoBuildFlags = [ "--features" "backend-cranelift" ];
 
   LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
 
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 79f09f48464f0..f074287ab1638 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.24.10";
+  version = "0.24.12";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "1565zy0yz46cf2f25pi46msdnzkj6bbhml9gfigdpjnsdlyskfyi";
+    sha256 = "sha256-JqN3kIkMnB+DggO0f1sjIDNP6SwCpNJuu+Jmnb12kGE=";
   };
 
   patches = [ ./lilv-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/audio/lv2/default.nix b/pkgs/development/libraries/audio/lv2/default.nix
index 45caf0b36c509..616ad5b0c8925 100644
--- a/pkgs/development/libraries/audio/lv2/default.nix
+++ b/pkgs/development/libraries/audio/lv2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lv2";
-  version = "1.18.0";
+  version = "1.18.2";
 
   src = fetchurl {
     url = "https://lv2plug.in/spec/${pname}-${version}.tar.bz2";
-    sha256 = "0gs7401xz23q9vajqr31aa2db8dvssgyh5zrvr4ipa6wig7yb8wh";
+    sha256 = "sha256-TokfvHRMBYVb6136gugisUkX3Wbpj4K4Iw29HHqy4F4=";
   };
 
   nativeBuildInputs = [ pkg-config wafHook ];
diff --git a/pkgs/development/libraries/glibc/2.32-35.patch.gz b/pkgs/development/libraries/glibc/2.32-master.patch.gz
index f77e490ebf54b..36aaf51cce9c8 100644
--- a/pkgs/development/libraries/glibc/2.32-35.patch.gz
+++ b/pkgs/development/libraries/glibc/2.32-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 54882ba671857..8bf78300739e1 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -42,7 +42,7 @@
 
 let
   version = "2.32";
-  patchSuffix = "-35";
+  patchSuffix = "-37";
   sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in
 
@@ -63,10 +63,10 @@ stdenv.mkDerivation ({
          and using git or something would complicate bootstrapping.
          Fortunately it's not too big.
           $ git checkout origin/release/2.32/master; git describe
-          glibc-2.32-35-g082798622d
-          $ git show --reverse glibc-2.32.. | gzip -n -9 --rsyncable - > 2.32-35.patch.gz
+          glibc-2.32-37-g760e1d2878
+          $ git show --reverse glibc-2.32.. | gzip -n -9 --rsyncable - > 2.32-master.patch.gz
        */
-      ./2.32-35.patch.gz
+      ./2.32-master.patch.gz
 
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index 74b94e68f5643..a08997ea2cdbe 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -1,20 +1,20 @@
 { lib, stdenv, fetchurl }:
 
 let
-  rev = "e78c96e5288993aaea3ec44e5c6ee755c668da79";
+  rev = "6faca61810d335c7837f320733fe8e15a1431fc2";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "sha256-TSLpYIDGSp1flqCBi2Sgg9IWDV5bcO+Hn2Menv3R6KU=";
+    sha256 = "06wkkhpbx9slmknr2g7mcd8x3zsdhnmmay25l31h3rkdp1wkq7kx";
   };
   configSub = fetchurl {
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "sha256-DkCGDN/DE3phQ1GO/Ua5ZPPtp0Ya93PnW3yfSK8EV9s=";
+    sha256 = "1qkph8cqanmgy3s4a18bm1a4vk62i8pf8cy5pc1hkpqwn4g6l0di";
   };
 in stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2020-05-04";
+  version = "2021-01-25";
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index b3615893b5329..3f31a3f6db3fc 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -11,7 +11,7 @@
 }:
 
 let
-  version = "2.7.2";
+  version = "2.7.4";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     owner  = "harfbuzz";
     repo   = "harfbuzz";
     rev    = version;
-    sha256 = "0vfyxr3lvzp80j1347nrwpr1ndv265p15rj2q8rj31lb26nyz4dm";
+    sha256 = "sha256-uMkniDNBQ2mxDmeM7K/YQtZ3Avh9RVXYe7XsUErGas8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/hunspell/wrapper.nix b/pkgs/development/libraries/hunspell/wrapper.nix
index 34c3d26c55ec0..4ae1772327511 100644
--- a/pkgs/development/libraries/hunspell/wrapper.nix
+++ b/pkgs/development/libraries/hunspell/wrapper.nix
@@ -5,7 +5,7 @@ let
 in
 stdenv.mkDerivation {
   name = (appendToName "with-dicts" hunspell).name;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
     makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${searchPath}
   '';
diff --git a/pkgs/development/libraries/icu/68.nix b/pkgs/development/libraries/icu/68.nix
new file mode 100644
index 0000000000000..5aeba0f2628c7
--- /dev/null
+++ b/pkgs/development/libraries/icu/68.nix
@@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "68.2";
+  sha256 = "09fng7a80xj8d5r1cgbgq8r47dsw5jsr6si9p2cj2ylhwgg974f7";
+}
diff --git a/pkgs/development/libraries/java/lombok/default.nix b/pkgs/development/libraries/java/lombok/default.nix
index ddf95ead249ab..5519a1fb76657 100644
--- a/pkgs/development/libraries/java/lombok/default.nix
+++ b/pkgs/development/libraries/java/lombok/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1msys7xkaj0d7fi112fmb2z50mk46db58agzrrdyimggsszwn1kj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   outputs = [ "out" "bin" ];
 
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index a820d947b7f89..ed086dac90fba 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -1,23 +1,47 @@
-{ lib, stdenv, fetchurl, glib, meson, ninja, pkg-config, gettext
-, gobject-introspection, fixDarwinDylibNames, gnome3
+{ lib
+, stdenv
+, fetchurl
+, glib
+, meson
+, ninja
+, pkg-config
+, gettext
+, gobject-introspection
+, fixDarwinDylibNames
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_43
+, gnome3
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "json-glib";
-  version = "1.4.4";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "1.6.2";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0ixwyis47v5bkx6h8a1iqlw3638cxcv57ivxv4gw2gaig51my33j";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "092g2dyy1hhl0ix9kp33wcab0pg1qicnsv0cj5ms9g9qs336cgd3";
   };
 
-  propagatedBuildInputs = [ glib ];
-  nativeBuildInputs = [ meson ninja pkg-config gettext gobject-introspection glib ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    gobject-introspection
+    glib
+    gtk-doc
+    docbook-xsl-nons
+    docbook_xml_dtd_43
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
+  ];
 
-  outputs = [ "out" "dev" ];
+  propagatedBuildInputs = [
+    glib
+  ];
 
   doCheck = true;
 
@@ -30,8 +54,8 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A library providing (de)serialization support for the JavaScript Object Notation (JSON) format";
     homepage = "https://wiki.gnome.org/Projects/JsonGlib";
-    license = licenses.lgpl2;
-    maintainers = with maintainers; [ lethalman ];
+    license = licenses.lgpl21Plus;
+    maintainers = teams.gnome.members;
     platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index 129b578519896..66bdcc03b9665 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, libtiff, libjpeg, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "lcms2-2.11";
+  name = "lcms2-2.12";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${name}.tar.gz";
-    sha256 = "0bkpf315925lhmd9i4mzjnkq5dh255r1lms0c0vzzkfpwk4bjjfw";
+    sha256 = "sha256-GGY5hehkEARVrD5QdiXEOMNxA1TYXly7fNQEPhH+EPU=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index edbc61957c04e..5483909689d24 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchgit {
     url = "https://aomedia.googlesource.com/aom";
     rev	= "v${version}";
-    sha256 = "1vakwmcwvmmrdw7460m8hzq96y71lxqix8b2g07c6s12br0rrdhl";
+    sha256 = "0f3i983s9yvh9zc6mpy1ck5sjcg9l09lpw9v4md3mv8gbih9f0z0";
   };
 
   patches = [ ./outputs.patch ];
diff --git a/pkgs/development/libraries/libblockdev/default.nix b/pkgs/development/libraries/libblockdev/default.nix
index 11a65006422fb..584ea93293ef4 100644
--- a/pkgs/development/libraries/libblockdev/default.nix
+++ b/pkgs/development/libraries/libblockdev/default.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "libblockdev";
-  version = "2.24";
+  version = "2.25";
 
   src = fetchFromGitHub {
     owner = "storaged-project";
     repo = "libblockdev";
     rev = "${version}-1";
-    sha256 = "1gzwlwdv0jyb3lh2n016limy2ngfdsa05x7jvg9llf2ls672nq89";
+    sha256 = "sha256-eHUHTogKoNrnwwSo6JaI7NMxVt9JeMqfWyhR62bDMuQ=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libbytesize/default.nix b/pkgs/development/libraries/libbytesize/default.nix
index a84f010b9e675..7ce8d6e7f83a0 100644
--- a/pkgs/development/libraries/libbytesize/default.nix
+++ b/pkgs/development/libraries/libbytesize/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "2.4";
+  version = "2.5";
 in stdenv.mkDerivation rec {
   pname = "libbytesize";
   inherit version;
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
     owner = "storaged-project";
     repo = "libbytesize";
     rev = version;
-    sha256 = "1kq0hnw2yxjdmcrwvgp0x4j1arkka23k8vp2l6nqcw9lc15x18fp";
+    sha256 = "sha256-F8Ur8gtNYp4PYfBQ9sDJGBgW7KohJYNEU9SI2SbNuvM=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libcdr/default.nix b/pkgs/development/libraries/libcdr/default.nix
index 087c928b79ce7..b987c3dbb25ac 100644
--- a/pkgs/development/libraries/libcdr/default.nix
+++ b/pkgs/development/libraries/libcdr/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libwpg, libwpd, lcms, pkg-config, librevenge, icu, boost, cppunit }:
+{ lib, stdenv, fetchurl, fetchpatch, libwpg, libwpd, lcms, pkg-config, librevenge, icu, boost, cppunit }:
 
 stdenv.mkDerivation rec {
   name = "libcdr-0.1.6";
@@ -8,6 +8,16 @@ stdenv.mkDerivation rec {
     sha256 = "0qgqlw6i25zfq1gf7f6r5hrhawlrgh92sg238kjpf2839aq01k81";
   };
 
+  patches = [
+    # Fix build with icu 68
+    # Remove in next release
+    (fetchpatch {
+      name = "libcdr-fix-icu-68";
+      url = "https://cgit.freedesktop.org/libreoffice/libcdr/patch/?id=bf3e7f3bbc414d4341cf1420c99293debf1bd894";
+      sha256 = "0cgra10p8ibgwn8y5q31jrpan317qj0ribzjs4jq0bwavjq92w2k";
+    })
+  ];
+
   buildInputs = [ libwpg libwpd lcms librevenge icu boost cppunit ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libdatrie/default.nix b/pkgs/development/libraries/libdatrie/default.nix
index f4e2df36d9179..257673b1a96d2 100644
--- a/pkgs/development/libraries/libdatrie/default.nix
+++ b/pkgs/development/libraries/libdatrie/default.nix
@@ -7,6 +7,8 @@ stdenv.mkDerivation rec {
   pname = "libdatrie";
   version = "2019-12-20";
 
+  outputs = [ "bin" "out" "lib" "dev" ];
+
   src = fetchFromGitHub {
     owner = "tlwg";
     repo = "libdatrie";
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index daae6984ab25d..33b3f0b32e1d7 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0jidjv78lay8kl3yigwhx9fii908sk7gn9nfd2ny12ql5ipc48im";
+    sha256 = "sha256-Y/TqFImFihCQgOC0C9Q+TgkDoeEuqIjVgduMSVdHwtA=";
   };
 
   nativeBuildInputs = [ python3 ];
diff --git a/pkgs/development/libraries/libexecinfo/30-linux-makefile.patch b/pkgs/development/libraries/libexecinfo/30-linux-makefile.patch
new file mode 100644
index 0000000000000..134c64441d366
--- /dev/null
+++ b/pkgs/development/libraries/libexecinfo/30-linux-makefile.patch
@@ -0,0 +1,44 @@
+--- Makefile.orig
++++ Makefile
+@@ -23,24 +23,25 @@
+ # SUCH DAMAGE.
+ #
+ # $Id: Makefile,v 1.3 2004/07/19 05:19:55 sobomax Exp $
++#
++# Linux Makefile by Matt Smith <mcs@darkregion.net>, 2011/01/04
+ 
+-LIB=	execinfo
++CC=cc
++AR=ar
++EXECINFO_CFLAGS=$(CFLAGS) -O2 -pipe -fno-strict-aliasing -std=gnu99 -c
++EXECINFO_LDFLAGS=$(LDFLAGS)
+ 
+-SRCS=	stacktraverse.c stacktraverse.h execinfo.c execinfo.h
++all: static dynamic
+ 
+-INCS=	execinfo.h
++static:
++	$(CC) $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) stacktraverse.c
++	$(CC) $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) execinfo.c
++	$(AR) rcs libexecinfo.a stacktraverse.o execinfo.o
+ 
+-SHLIB_MAJOR=	1
+-SHLIB_MINOR=	0
++dynamic:
++	$(CC) -fpic -DPIC $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) stacktraverse.c -o stacktraverse.So
++	$(CC) -fpic -DPIC $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) execinfo.c -o execinfo.So
++	$(CC) -shared -Wl,-soname,libexecinfo.so.1 -o libexecinfo.so.1 stacktraverse.So execinfo.So
+ 
+-NOPROFILE=	yes
+-
+-DPADD=		${LIBM}
+-LDADD=		-lm
+-
+-#WARNS?=	4
+-
+-#stacktraverse.c: gen.py
+-#	./gen.py > stacktraverse.c
+-
+-.include <bsd.lib.mk>
++clean:
++	rm -rf *.o *.So *.a *.so
diff --git a/pkgs/development/libraries/libexecinfo/default.nix b/pkgs/development/libraries/libexecinfo/default.nix
index f3f89209707a6..36f956e777242 100644
--- a/pkgs/development/libraries/libexecinfo/default.nix
+++ b/pkgs/development/libraries/libexecinfo/default.nix
@@ -23,14 +23,11 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/libexecinfo/20-define-gnu-source.patch?id=730cdcef6901750f4029d4c3b8639ce02ee3ead1";
       sha256 = "1mp8mc639b0h2s69m5z6s2h3q3n1zl298j9j0plzj7f979j76302";
     })
-    (fetchpatch {
-      name = "30-linux-makefile.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/libexecinfo/30-linux-makefile.patch?id=730cdcef6901750f4029d4c3b8639ce02ee3ead1";
-      sha256 = "1jwjz22z5cjy5h2bfghn62yl9ar8jiqhdvbwrcfavv17ihbhwcaf";
-    })
+    ./30-linux-makefile.patch
   ];
 
   makeFlags = [ "CC:=$(CC)" "AR:=$(AR)" ];
+  hardeningEnable = [ "stackprotector" ];
 
   buildFlags =
       lib.optional enableStatic "static"
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 74098f7e003dd..80cd5bc13cc3b 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, gettext, libgpgerror, enableCapabilities ? false, libcap
-, buildPackages
+, buildPackages, fetchpatch
 }:
 
 assert enableCapabilities -> stdenv.isLinux;
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
     sha256 = "1nb50bgzp83q6r5cz4v40y1mcbhpqwqyxlay87xp1lrbkf5pm9n5";
   };
 
+  patches = [
+    # fix build on 32bit musl
+    (fetchpatch {
+      name = "fix_building_with_disable-asm_on_x86.patch";
+      url = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff_plain;h=af23ab5c5482d625ff52e60606cf044e2b0106c8";
+      sha256 = "1m8apm8wra6fk89ggha4d0bba5absihm38zvb2khklqh9q5hj9jw";
+    })
+  ];
+
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev";
 
@@ -27,6 +36,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isDarwin gettext
     ++ lib.optional enableCapabilities libcap;
 
+  strictDeps = true;
+
   configureFlags = [ "--with-libgpg-error-prefix=${libgpgerror.dev}" ]
       ++ lib.optional (stdenv.hostPlatform.isMusl || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) "--disable-asm"; # for darwin see https://dev.gnupg.org/T5157
 
diff --git a/pkgs/development/libraries/libheif/default.nix b/pkgs/development/libraries/libheif/default.nix
index b0872b9da1e45..71dfca5e64309 100644
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@@ -1,9 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libde265, x265, libpng,
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, dav1d, rav1e, libde265, x265, libpng,
   libjpeg, libaom }:
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.9.1";
+  version = "1.11.0";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -11,21 +11,19 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "0hjs1i076jmy4ryj8y2zs293wx53kzg38y8i42cbcsqydvsdp6hz";
+    sha256 = "sha256-xT0sfYPp5atYXnVpP8TYu2TC9/Z/ClyEP1OTSfcw1gw=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libde265 x265 libpng libjpeg libaom ];
-  # TODO: enable dav1d and rav1e codecs when libheif can find them via pkg-config
+  buildInputs = [ dav1d rav1e libde265 x265 libpng libjpeg libaom ];
 
   enableParallelBuilding = true;
 
   meta = {
     homepage = "http://www.libheif.org/";
     description = "ISO/IEC 23008-12:2017 HEIF image file format decoder and encoder";
-    license = lib.licenses.lgpl3;
+    license = lib.licenses.lgpl3Plus;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ gebner ];
   };
-
 }
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 7f5e739a99cd0..51e2ff52ff6ed 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , buildPackages
 , cmake
 , glib
@@ -22,7 +21,7 @@ assert introspectionSupport -> gobject-introspection != null && vala != null;
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.8";
+  version = "3.0.9";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -30,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "0pkh74bfrgp1slv8wsv7lbmal2m7qkixwm5llpmfwaiv14njlp68";
+    sha256 = "sha256-efdiGktLGITaQ6VinnfYG52fMhO0Av+JKROt2kTvS1U=";
   };
 
   nativeBuildInputs = [
@@ -75,12 +74,6 @@ stdenv.mkDerivation rec {
     # Will appear in 3.1.0
     # https://github.com/libical/libical/issues/350
     ./respect-env-tzdir.patch
-    # Export src-generator binary for use while cross-compiling
-    # https://github.com/libical/libical/pull/439
-    (fetchpatch {
-      url = "https://github.com/libical/libical/commit/1197d84b63dce179b55a6293cfd6d0523607baf1.patch";
-      sha256 = "18i1khnwmw488s7g5a1kf05sladf8dbyhfc69mbcf6dkc4nnc3dg";
-    })
   ];
 
   # Using install check so we do not have to manually set
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 850c7aa1df0c0..9695b221cb97f 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.24.4";
+  version = "1.24.6";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "11djb1d8w9ms07aklfm3pskjw9rnff4p4n3snanschv22zk8wj6x";
+    sha256 = "sha256-dgRlyqoczWmcFCkOl5HaRW1TAN0R6/TBSGFRAz6HXf0=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 0b30bf6c2b0d2..c04d4a001a17b 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -4,11 +4,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libpcap";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchurl {
     url = "https://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "153h1378diqyc27jjgz6gg5nxmb4ddk006d9xg69nqavgiikflk3";
+    sha256 = "sha256-jRK0JiPu7+6HLxI70NyF1TWwDfTULoZfmTxA97/JKx4=";
   };
 
   nativeBuildInputs = [ flex bison ]
@@ -21,13 +21,11 @@ stdenv.mkDerivation rec {
       linux = "linux";
       darwin = "bpf";
     }.${stdenv.hostPlatform.parsed.kernel.name})
+  ] ++ optionals stdenv.isDarwin [
+    "--disable-universal"
   ] ++ optionals (stdenv.hostPlatform == stdenv.buildPlatform)
     [ "ac_cv_linux_vers=2" ];
 
-  prePatch = optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace " -arch i386" ""
-  '';
-
   postInstall = ''
     if [ "$dontDisableStatic" -ne "1" ]; then
       rm -f $out/lib/libpcap.a
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 7bd3fa97029a0..42d8cbf285963 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.26.8";
+  version = "1.26.10";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-73bclasKBjIaG9Jeh1SJy6Esn2YRl0ygE1zwZ7sgyWA=";
+    sha256 = "sha256-fABD8GyHXlzx3jwMlMzH9bBYYry82eT7DV0UJ30dq1k=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libsodium/default.nix b/pkgs/development/libraries/libsodium/default.nix
index db2cd044592b5..64ae1713fd451 100644
--- a/pkgs/development/libraries/libsodium/default.nix
+++ b/pkgs/development/libraries/libsodium/default.nix
@@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
   separateDebugInfo = stdenv.isLinux && stdenv.hostPlatform.libc != "musl";
 
   enableParallelBuilding = true;
+  hardeningDisable = lib.optional (stdenv.targetPlatform.isMusl && stdenv.targetPlatform.isx86_32) "stackprotector";
+
+  # FIXME: the hardeingDisable attr above does not seems effective, so
+  # the need to disable stackprotector via configureFlags
+  configureFlags = lib.optional (stdenv.targetPlatform.isMusl && stdenv.targetPlatform.isx86_32) "--disable-ssp";
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/libthai/default.nix b/pkgs/development/libraries/libthai/default.nix
index ad00906bb8cc3..97745813ef260 100644
--- a/pkgs/development/libraries/libthai/default.nix
+++ b/pkgs/development/libraries/libthai/default.nix
@@ -4,12 +4,16 @@ stdenv.mkDerivation rec {
   pname = "libthai";
   version = "0.1.28";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "https://github.com/tlwg/libthai/releases/download/v${version}/libthai-${version}.tar.xz";
     sha256 = "04g93bgxrcnay9fglpq2lj9nr7x1xh06i60m7haip8as9dxs3q7z";
   };
 
-  nativeBuildInputs = [ installShellFiles pkg-config ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ installShellFiles (lib.getBin libdatrie) pkg-config ];
 
   buildInputs = [ libdatrie ];
 
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index d69c8d670c4a5..69410cf2b9864 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , enableUdev ? stdenv.isLinux && !stdenv.hostPlatform.isMusl
@@ -22,6 +23,13 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  patches = [ (fetchpatch {
+    # https://bugs.archlinux.org/task/69121
+    url = "https://github.com/libusb/libusb/commit/f6d2cb561402c3b6d3627c0eb89e009b503d9067.patch";
+    sha256 = "1dbahikcbwkjhyvks7wbp7fy2bf7nca48vg5z0zqvqzjb9y595cq";
+    excludes = [ "libusb/version_nano.h" ];
+  }) ];
+
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   propagatedBuildInputs =
     lib.optional enableUdev udev ++
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index a4447ed337893..6b1a0120e49eb 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,19 +1,20 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.40.0";
+  version = "1.41.0";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hd0x6i80ca3j0c3a7laygzab5qkgxjkz692jwzrsinsfhvbq0pg";
+    sha256 = "sha256-i6AYD1Ony0L2+3yWK6bxOfwoZEvd9qCg33QSqA7bRXI=";
   };
 
   postPatch = let
     toDisable = [
       "getnameinfo_basic" "udp_send_hang_loop" # probably network-dependent
+      "tcp_connect_timeout" # tries to reach out to 8.8.8.8
       "spawn_setuid_fails" "spawn_setgid_fails" "fs_chown" # user namespaces
       "getaddrinfo_fail" "getaddrinfo_fail_sync"
       "threadpool_multiple_event_loops" # times out on slow machines
diff --git a/pkgs/development/libraries/neardal/default.nix b/pkgs/development/libraries/neardal/default.nix
index 5e02a9fd5222b..43f63d91a618d 100644
--- a/pkgs/development/libraries/neardal/default.nix
+++ b/pkgs/development/libraries/neardal/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     sha256 = "12qwg7qiw2wfpaxfg2fjkmj5lls0g33xp6w433g8bnkvwlq4s29g";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake libtool glib readline makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ autoconf automake libtool glib readline ];
 
   preConfigure = ''
     substituteInPlace "ncl/Makefile.am" --replace "noinst_PROGRAMS" "bin_PROGRAMS"
diff --git a/pkgs/development/libraries/nuspell/wrapper.nix b/pkgs/development/libraries/nuspell/wrapper.nix
index 4386542ff20e5..ab09931579c78 100644
--- a/pkgs/development/libraries/nuspell/wrapper.nix
+++ b/pkgs/development/libraries/nuspell/wrapper.nix
@@ -5,7 +5,7 @@ let
 in
 stdenv.mkDerivation {
   name = (appendToName "with-dicts" nuspell).name;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
     makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${searchPath}
   '';
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index a71b2a61910ee..44a0e017a2ab5 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, openssl, cyrus_sasl, db, groff, libtool }:
+{ lib, stdenv, fetchurl, openssl, db, groff, libtool
+, withCyrusSasl ? true
+, cyrus_sasl
+}:
 
 stdenv.mkDerivation rec {
   pname = "openldap";
@@ -37,8 +40,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "--with-yielding_select=yes"
     "ac_cv_func_memcmp_working=yes"
-  ] ++ lib.optional (openssl == null) "--without-tls"
-    ++ lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
+  ] ++ lib.optional (!withCyrusSasl) "--without-cyrus-sasl"
     ++ lib.optional stdenv.isFreeBSD "--with-pic";
 
   postBuild = ''
@@ -54,19 +56,21 @@ stdenv.mkDerivation rec {
     "moduledir=$(out)/lib/modules"
   ];
 
-  # 1. Fixup broken libtool
-  # 2. Libraries left in the build location confuse `patchelf --shrink-rpath`
+  # 1. Libraries left in the build location confuse `patchelf --shrink-rpath`
   #    Delete these to let patchelf discover the right path instead.
   #    FIXME: that one can be removed when https://github.com/NixOS/patchelf/pull/98
   #    is in Nixpkgs patchelf.
+  # 2. Fixup broken libtool for openssl and cyrus_sasl (if it is not disabled)
   preFixup = ''
-    sed -e 's,-lsasl2,-L${cyrus_sasl.out}/lib -lsasl2,' \
-        -e 's,-lssl,-L${openssl.out}/lib -lssl,' \
-        -i $out/lib/libldap.la -i $out/lib/libldap_r.la
-
-    rm -rf $out/var
+    rm -r $out/var
     rm -r libraries/*/.libs
     rm -r contrib/slapd-modules/passwd/*/.libs
+    for f in $out/lib/libldap.la $out/lib/libldap_r.la; do
+      substituteInPlace "$f" --replace '-lssl' '-L${openssl.out}/lib -lssl'
+  '' + lib.optionalString withCyrusSasl ''
+      substituteInPlace "$f" --replace '-lsasl2' '-L${cyrus_sasl.out}/lib -lsasl2'
+  '' + ''
+    done
   '';
 
   postInstall = ''
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index ce4374be33126..2edf02e738f30 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -160,8 +160,8 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1i";
-    sha256 = "0hjj1phcwkz69lx1lrvr9grhpl4y529mwqycqc1hdla1zqsnmgp8";
+    version = "1.1.1j";
+    sha256 = "1gw17520vh13izy1xf5q0a2fqgcayymjjj5bk0dlkxndfnszrwma";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/rabbitmq-java-client/default.nix b/pkgs/development/libraries/rabbitmq-java-client/default.nix
index b649b1d9c1136..e5657bcb3c300 100644
--- a/pkgs/development/libraries/rabbitmq-java-client/default.nix
+++ b/pkgs/development/libraries/rabbitmq-java-client/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "03kspkgzzjsbq6f8yl2zj5m30qwgxv3l58hrbf6gcgxb5rpfk6sh";
   };
 
-  buildInputs = [ ant jdk python makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ant jdk python ];
 
   buildPhase = "ant dist";
 
diff --git a/pkgs/development/libraries/rinutils/default.nix b/pkgs/development/libraries/rinutils/default.nix
new file mode 100644
index 0000000000000..35e48140fdd35
--- /dev/null
+++ b/pkgs/development/libraries/rinutils/default.nix
@@ -0,0 +1,21 @@
+{
+  stdenv, lib, fetchurl,
+  cmake, perl,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rinutils";
+  version = "0.8.0";
+
+  meta = with lib; {
+    homepage = "https://github.com/shlomif/rinutils";
+    license = licenses.mit;
+  };
+
+  src = fetchurl {
+    url = "https://github.com/shlomif/${pname}/releases/download/${version}/${pname}-${version}.tar.xz";
+    sha256 = "1q09aihm5m42xiq2prpa9mf0srwiirzgzblkp5nl74i7zg6pg5hx";
+  };
+
+  nativeBuildInputs = [ cmake perl ];
+}
diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index a3c35d123b6a1..b37dfbdd70773 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zeromq";
-  version = "4.3.3";
+  version = "4.3.4";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "libzmq";
     rev = "v${version}";
-    sha256 = "155kb0ih0xj4jvd39bq8d04bgvhy9143r3632ks1m04455z4qdzd";
+    sha256 = "sha256-epOEyHOswUGVwzz0FLxhow/zISmZHxsIgmpOV8C8bQM=";
   };
 
   nativeBuildInputs = [ cmake asciidoc pkg-config ];
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index 5602f598e9d6b..1aa81132c2603 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     sha256 = "0lvfdlpmmsyq2i9gs4mf6a8fxkfimdr4rhyihqnfhjij3fzxz4lk";
   };
 
-  buildInputs = [ makeWrapper which xdg-utils ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ which xdg-utils ];
 
   unpackPhase = ''
     mkdir -p phony-home $out/share/applications
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
index f471dc977b3da..601cac372c8c4 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
index 0742247893c3d..52257bfd4611e 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
index 965a385ac56c7..78044752b54cf 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index b4842da12dd77..cf869b6e5ef90 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -29,9 +29,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xda4fj8p5102lh9xmrn5mv3s0ps6yykqj3mpjf72gf4zd6fzcn7";
   }) ];
 
-  buildInputs = [ which makeWrapper ocaml findlib
-    lwt_react pgocaml camlzip ocaml_sqlite3
-  ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ which ocaml findlib lwt_react pgocaml camlzip ocaml_sqlite3 ];
 
   propagatedBuildInputs = [ cryptokit ipaddr lwt_log lwt_ssl ocamlnet
     ocaml_pcre tyxml xml-light
diff --git a/pkgs/development/perl-modules/ham/default.nix b/pkgs/development/perl-modules/ham/default.nix
index 4f6dc5d9ddb78..8b19c9404fe05 100644
--- a/pkgs/development/perl-modules/ham/default.nix
+++ b/pkgs/development/perl-modules/ham/default.nix
@@ -13,7 +13,7 @@ buildPerlPackage {
 
   outputs = [ "out" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [ openssh GitRepository URI XMLMini ];
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/adblock/default.nix b/pkgs/development/python-modules/adblock/default.nix
index 97734e1b063cd..8fc697828f0ad 100644
--- a/pkgs/development/python-modules/adblock/default.nix
+++ b/pkgs/development/python-modules/adblock/default.nix
@@ -1,10 +1,9 @@
 { stdenv
 , lib
-, rustPlatform
 , fetchFromGitHub
-, pipInstallHook
+, buildPythonPackage
+, rustPlatform
 , pythonImportsCheckHook
-, maturin
 , pkg-config
 , openssl
 , publicsuffix-list
@@ -13,7 +12,7 @@
 , Security
 }:
 
-rustPlatform.buildRustPackage rec {
+buildPythonPackage rec {
   pname = "adblock";
   version = "0.4.0";
   disabled = isPy27;
@@ -25,33 +24,27 @@ rustPlatform.buildRustPackage rec {
     rev = version;
     sha256 = "10d6ks2fyzbizq3kb69q478idj0h86k6ygjb6wl3zq3mf65ma4zg";
   };
-  format = "pyproject";
 
-  cargoSha256 = "0di05j942rrm2crpdpp9czhh65fmidyrvdp2n3pipgnagy7nchc0";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-gEFmj3/KvhvvsOK2nX2L1RUD4Wfp3nYzEzVnQZIsIDY=";
+  };
 
-  nativeBuildInputs = [ pipInstallHook maturin pkg-config pythonImportsCheckHook ];
+  format = "pyproject";
+
+  nativeBuildInputs = [ pkg-config pythonImportsCheckHook ]
+    ++ (with rustPlatform; [ cargoSetupHook maturinBuildHook ]);
 
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
 
   PSL_PATH = "${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat";
 
-  buildPhase = ''
-    runHook preBuild
-    maturin build --release --manylinux off --strip
-    runHook postBuild
-  '';
-
   # There are no rust tests
   doCheck = false;
-  pythonImportsCheck = [ "adblock" ];
 
-  installPhase = ''
-    runHook preInstall
-    install -Dm644 -t dist target/wheels/*.whl
-    pipInstallPhase
-    runHook postInstall
-  '';
+  pythonImportsCheck = [ "adblock" ];
 
   meta = with lib; {
     description = "Python wrapper for Brave's adblocking library, which is written in Rust";
diff --git a/pkgs/development/python-modules/blinker/default.nix b/pkgs/development/python-modules/blinker/default.nix
index 5591113ab0ad6..ca59a0d710aba 100644
--- a/pkgs/development/python-modules/blinker/default.nix
+++ b/pkgs/development/python-modules/blinker/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, nose, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "blinker";
@@ -9,6 +9,9 @@ buildPythonPackage rec {
     sha256 = "1dpq0vb01p36jjwbhhd08ylvrnyvcc82yxx3mwjx6awrycjyw6j7";
   };
 
+  checkInputs = [ nose pytestCheckHook ];
+  pythonImportsCheck = [ "blinker" ];
+
   meta = with lib; {
     homepage = "https://pythonhosted.org/blinker/";
     description = "Fast, simple object-to-object and broadcast signaling";
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 6b27e8e5d4252..30a7e5174a6da 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -9,7 +9,7 @@ let
   withPlugins = plugins: buildPythonPackage {
     name = "${package.name}-with-plugins";
     phases = [ "installPhase" "fixupPhase" ];
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
     propagatedBuildInputs = plugins ++ package.propagatedBuildInputs;
 
     installPhase = ''
diff --git a/pkgs/development/python-modules/cheroot/default.nix b/pkgs/development/python-modules/cheroot/default.nix
index e5c7c23e2e431..4d6c71a7e2a58 100644
--- a/pkgs/development/python-modules/cheroot/default.nix
+++ b/pkgs/development/python-modules/cheroot/default.nix
@@ -73,7 +73,7 @@ buildPythonPackage rec {
     "bind_addr_unix"
   ];
 
-  disabledTestFiles = [
+  disabledTestPaths = [
     # avoid attempting to use 3 packages not available on nixpkgs
     # (jaraco.apt, jaraco.context, yg.lockfile)
     "cheroot/test/test_wsgi.py"
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index eb4eba0f5879e..1038431d31c73 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -2,8 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , fetchpatch
-, isPy27
-, ipaddress
+, rustPlatform
+, setuptools-rust
 , openssl
 , cryptography_vectors
 , darwin
@@ -13,27 +13,38 @@
 , isPyPy
 , cffi
 , pytest
+, pytest-subtests
 , pretend
 , iso8601
 , pytz
 , hypothesis
-, enum34
 }:
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "3.3.2"; # Also update the hash in vectors.nix
+  version = "3.4.6"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vcvw4lkw1spiq322pm1256kail8nck6bbgpdxx3pqa905wd6q2s";
+    sha256 = "11wgsihfq72fav67c3igi0xbhbd6c5dj869byd1jkq0fbcz24cid";
   };
 
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    name = "${pname}-${version}";
+    sha256 = "1i0sd2y4a5g1yqwcpw2ycp6p4p8sk5v7clblq756i5864j52v6w1";
+  };
+
+  cargoRoot = "src/rust";
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = lib.optionals (!isPyPy) [
     cffi
-  ];
+    rustPlatform.cargoSetupHook
+    setuptools-rust
+  ] ++ (with rustPlatform; [ rust.cargo rust.rustc ]);
 
   buildInputs = [ openssl ]
              ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
@@ -42,8 +53,6 @@ buildPythonPackage rec {
     six
   ] ++ lib.optionals (!isPyPy) [
     cffi
-  ] ++ lib.optionals isPy27 [
-    ipaddress enum34
   ];
 
   checkInputs = [
@@ -52,6 +61,7 @@ buildPythonPackage rec {
     iso8601
     pretend
     pytest
+    pytest-subtests
     pytz
   ];
 
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index f9b7c525237ab..a807be9c3bbbe 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1yhaps0f3h2yjb6lmz953z1l1d84y9swk4k3gj9nqyk4vbx5m7cc";
+    sha256 = "1a1d5ix5b3ajhrqaf8rm6qmd6gkaidij0jgd1vrb8q1xn1gqmy75";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/fixtures/default.nix b/pkgs/development/python-modules/fixtures/default.nix
index 9f1549e98f9fd..e802dbaa26914 100644
--- a/pkgs/development/python-modules/fixtures/default.nix
+++ b/pkgs/development/python-modules/fixtures/default.nix
@@ -1,11 +1,12 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
+, pythonAtLeast
 , pbr
 , testtools
 , mock
 , python
-, isPy39
 }:
 
 buildPythonPackage rec {
@@ -17,7 +18,26 @@ buildPythonPackage rec {
     sha256 = "fcf0d60234f1544da717a9738325812de1f42c2fa085e2d9252d8fff5712b2ef";
   };
 
-  propagatedBuildInputs = [ pbr testtools mock ];
+  patches = lib.optional (pythonAtLeast "3.9") [
+    # drop tests that try to monkeypatch a classmethod, which fails on python3.9
+    # https://github.com/testing-cabal/fixtures/issues/44
+    (fetchpatch {
+       url = "https://salsa.debian.org/openstack-team/python/python-fixtures/-/raw/debian/victoria/debian/patches/remove-broken-monkey-patch-test.patch";
+       sha256 = "1s3hg2zmqc4shmnf90kscphzj5qlqpxghzw2a59p8f88zrbsj97r";
+    })
+  ];
+
+  nativeBuildInputs = [
+    pbr
+  ];
+
+  propagatedBuildInputs = [
+    testtools
+  ];
+
+  checkInputs = [
+    mock
+  ];
 
   checkPhase = ''
     ${python.interpreter} -m testtools.run fixtures.test_suite
@@ -27,6 +47,5 @@ buildPythonPackage rec {
     description = "Reusable state for writing clean tests and more";
     homepage = "https://pypi.python.org/pypi/fixtures";
     license = lib.licenses.asl20;
-    broken = isPy39; # see https://github.com/testing-cabal/fixtures/issues/44
   };
 }
diff --git a/pkgs/development/python-modules/johnnycanencrypt/default.nix b/pkgs/development/python-modules/johnnycanencrypt/default.nix
index 77789fa44dbea..a0c82902d3e6d 100644
--- a/pkgs/development/python-modules/johnnycanencrypt/default.nix
+++ b/pkgs/development/python-modules/johnnycanencrypt/default.nix
@@ -1,14 +1,13 @@
 { lib
 , stdenv
-, rustPlatform
 , fetchFromGitHub
-, pipInstallHook
+, buildPythonPackage
+, rustPlatform
 , llvmPackages
 , pkg-config
 , maturin
 , pcsclite
 , nettle
-, python
 , requests
 , vcrpy
 , numpy
@@ -17,7 +16,7 @@
 , PCSC
 }:
 
-rustPlatform.buildRustPackage rec {
+buildPythonPackage rec {
   pname = "johnnycanencrypt";
   version = "0.5.0";
   disabled = pythonOlder "3.7";
@@ -28,7 +27,16 @@ rustPlatform.buildRustPackage rec {
     rev = "v${version}";
     sha256 = "192wfrlyylrpzq70yki421mi1smk8q2cyki2a1d03q7h6apib3j4";
   };
-  cargoPatches = [ ./Cargo.lock.patch ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit patches src;
+    name = "${pname}-${version}";
+    hash = "sha256-2XhXCKyXVlFgbcOoMy/A5ajiIVxBii56YeI29mO720U=";
+  };
+
+  format = "pyproject";
+
+  patches = [ ./Cargo.lock.patch ];
 
   cargoSha256 = "0ifvpdizcdp2c5x2x2j1bhhy5a75q0pk7a63dmh52mlpmh45fy6r";
 
@@ -42,10 +50,10 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     llvmPackages.clang
     pkg-config
-    python
-    maturin
-    pipInstallHook
-  ];
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ]);
 
   buildInputs = [
     pcsclite
@@ -67,17 +75,6 @@ rustPlatform.buildRustPackage rec {
     sed '/project-url = /d' -i Cargo.toml
   '';
 
-  buildPhase = ''
-    runHook preBuild
-    maturin build --release --manylinux off --strip --cargo-extra-args="-j $NIX_BUILD_CORES --frozen"
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    install -Dm644 -t dist target/wheels/*.whl
-    pipInstallPhase
-  '';
-
   preCheck = ''
     export TESTDIR=$(mktemp -d)
     cp -r tests/ $TESTDIR
diff --git a/pkgs/development/python-modules/livestreamer/default.nix b/pkgs/development/python-modules/livestreamer/default.nix
index 184a215c407aa..98878c90640f8 100644
--- a/pkgs/development/python-modules/livestreamer/default.nix
+++ b/pkgs/development/python-modules/livestreamer/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     sha256 = "1fp3d3z2grb1ls97smjkraazpxnvajda2d1g1378s6gzmda2jvjd";
   };
 
-  buildInputs = [ pkgs.makeWrapper ];
+  nativeBuildInputs = [ pkgs.makeWrapper ];
 
   propagatedBuildInputs = [ pkgs.rtmpdump pycrypto requests ]
     ++ lib.optionals isPy27 [ singledispatch futures ];
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index aa009e0a3e732..b58376031039d 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.5.2";
+  version = "4.6.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "1d0cpwdjxfzwjzmnz066ibzicyj2vhx15qxmm775l8hxqi65xps4";
+    sha256 = "1zidx62sxh2r4fmjfjzd4f6i4yxgzkpd20nafbyr0i0wnw9da3fd";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
diff --git a/pkgs/development/python-modules/pyxml/default.nix b/pkgs/development/python-modules/pyxml/default.nix
index a528de8e0ca27..49796054b564f 100644
--- a/pkgs/development/python-modules/pyxml/default.nix
+++ b/pkgs/development/python-modules/pyxml/default.nix
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     sha256 = "04wc8i7cdkibhrldy6j65qp5l75zjxf5lx6qxdxfdf2gb3wndawz";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildPhase = "${python.interpreter} ./setup.py build";
   installPhase = ''
     ${python.interpreter} ./setup.py install --prefix="$out" || exit 1
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index e0dfb9a24a643..169583586a1c4 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -1,24 +1,59 @@
-{ lib, fetchPypi, buildPythonPackage
-, urllib3, idna, chardet, certifi
-, pytest }:
+{ lib
+, buildPythonPackage
+, certifi
+, chardet
+, fetchPypi
+, idna
+, pytest-mock
+, pytest-xdist
+, pytestCheckHook
+, urllib3
+}:
 
 buildPythonPackage rec {
   pname = "requests";
-  version = "2.25.0";
+  version = "2.25.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1y6mb8c0ipd64d5axq2p368yxndp3f966hmabjka2q2a5y9hn6kz";
+    sha256 = "sha256-J5c91KkEpPE7JjoZyGbBO5KjntHJZGVfAl8/jT11uAQ=";
   };
 
-  nativeBuildInputs = [ pytest ];
-  propagatedBuildInputs = [ urllib3 idna chardet certifi ];
-  # sadly, tests require networking
-  doCheck = false;
+  propagatedBuildInputs = [
+    certifi
+    chardet
+    idna
+    urllib3
+  ];
+
+  checkInputs = [
+    pytest-mock
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Disable tests that require network access and use httpbin
+    "requests.api.request"
+    "requests.models.PreparedRequest"
+    "requests.sessions.Session"
+    "requests"
+    "test_redirecting_to_bad_url"
+    "test_requests_are_updated_each_time"
+    "test_should_bypass_proxies_pass_only_hostname"
+    "test_urllib3_pool_connection_closed"
+    "test_urllib3_retries"
+    "test_use_proxy_from_environment"
+    "TestRequests"
+    "TestTimeout"
+  ];
+
+  pythonImportsCheck = [ "requests" ];
 
   meta = with lib; {
-    description = "An Apache2 licensed HTTP library, written in Python, for human beings";
+    description = "Simple HTTP library for Python";
     homepage = "http://docs.python-requests.org/en/latest/";
     license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/retworkx/default.nix b/pkgs/development/python-modules/retworkx/default.nix
index 02a3ef64c573d..8cce139facba7 100644
--- a/pkgs/development/python-modules/retworkx/default.nix
+++ b/pkgs/development/python-modules/retworkx/default.nix
@@ -1,16 +1,14 @@
 { lib
+, buildPythonPackage
 , rustPlatform
-, python
 , fetchFromGitHub
-, pipInstallHook
-, maturin
-, pip
+
   # Check inputs
 , pytestCheckHook
 , numpy
 }:
 
-rustPlatform.buildRustPackage rec {
+buildPythonPackage rec {
   pname = "retworkx";
   version = "0.6.0";
 
@@ -21,11 +19,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "11n30ldg3y3y6qxg3hbj837pnbwjkqw3nxq6frds647mmmprrd20";
   };
 
-  cargoSha256 = "1vg4yf0k6yypqf9z46zz818mz7fdrgxj7zl6zjf7pnm2r8mq3qw5";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-heOBK8qi2nuc/Ib+I/vLzZ1fUUD/G/KTw9d7M4Hz5O0=";
+  };
 
-  propagatedBuildInputs = [ python ];
+  format = "pyproject";
 
-  nativeBuildInputs = [ pipInstallHook maturin pip ];
+  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
 
   # Needed b/c need to check AFTER python wheel is installed (using Rust Build, not buildPythonPackage)
   doCheck = false;
@@ -33,17 +35,6 @@ rustPlatform.buildRustPackage rec {
 
   installCheckInputs = [ pytestCheckHook numpy ];
 
-  buildPhase = ''
-    runHook preBuild
-    maturin build --release --manylinux off --strip
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    install -Dm644 -t dist target/wheels/*.whl
-    pipInstallPhase
-  '';
-
   preCheck = ''
     export TESTDIR=$(mktemp -d)
     cp -r tests/ $TESTDIR
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 8d08e43bc7139..0bc8499a373b1 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -9,11 +9,11 @@ let
   });
 in buildPythonPackage rec {
   pname = "scipy";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0rh5b1rwdcvvagld8vpxnpaibszy1skpx39a0fwzd5gx5pwcjvfb";
+    sha256 = "048vd4c843xaq45yk3kn491gvqnvhp2i9rxhg671ddlh923fpz64";
   };
 
   checkInputs = [ nose pytest ];
@@ -53,9 +53,10 @@ in buildPythonPackage rec {
 
   SCIPY_USE_G77_ABI_WRAPPER = 1;
 
-  meta = {
-    description = "SciPy (pronounced 'Sigh Pie') is open-source software for mathematics, science, and engineering. ";
+  meta = with lib; {
+    description = "SciPy (pronounced 'Sigh Pie') is open-source software for mathematics, science, and engineering";
     homepage = "https://www.scipy.org/";
-    maintainers = with lib.maintainers; [ fridh ];
+    license = licenses.bsd3;
+    maintainers = [ maintainers.fridh ];
   };
 }
diff --git a/pkgs/development/python-modules/shapely/default.nix b/pkgs/development/python-modules/shapely/default.nix
index 91c34734a8c59..1e18027c4be41 100644
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@@ -1,31 +1,55 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, fetchpatch, substituteAll, pythonOlder
-, geos, pytestCheckHook, cython
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, substituteAll
+, pythonOlder
+, geos
+, pytestCheckHook
+, cython
 , numpy
+, fetchpatch
 }:
 
 buildPythonPackage rec {
   pname = "Shapely";
   version = "1.7.1";
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0adiz4jwmwxk7k1awqifb1a9bj5x4nx4gglb5dz9liam21674h8n";
   };
-  disabled = pythonOlder "3.5";
 
   nativeBuildInputs = [
     geos # for geos-config
     cython
   ];
 
-  propagatedBuildInputs = [ numpy ];
+  propagatedBuildInputs = [
+    numpy
+  ];
 
-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   # environment variable used in shapely/_buildcfg.py
   GEOS_LIBRARY_PATH = "${geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
 
   patches = [
+    # Fix with geos 3.9. This patch will be part of the next release after 1.7.1
+    (fetchpatch {
+      url = "https://github.com/Toblerity/Shapely/commit/77879a954d24d1596f986d16ba3eff5e13861164.patch";
+      sha256 = "1w7ngjqbpf9vnvrfg4nyv34kckim9a60gvx20h6skc79xwihd4m5";
+      excludes = [
+        "tests/test_create_inconsistent_dimensionality.py"
+        "appveyor.yml"
+        ".travis.yml"
+      ];
+    })
+
+    # Patch to search form GOES .so/.dylib files in a Nix-aware way
     (substituteAll {
       src = ./library-paths.patch;
       libgeos_c = GEOS_LIBRARY_PATH;
diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index 341f53cfe0b52..f648905251e23 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   checkInputs = [ pytestCheckHook ];
 
   # Exclude live tests
-  disabledTestFiles = [ "tests/live_test.py" ];
+  disabledTestPaths = [ "tests/live_test.py" ];
 
   pythonImportsCheck = [ "slixmpp" ];
 
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 83fd3e7b10b34..7d35bb8487c8a 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchPypi, buildPythonPackage, isPy3k, isPy35
+{ stdenv, lib, fetchPypi, buildPythonPackage, isPy3k, isPy35, fetchpatch
 , mock
 , pysqlite
 , pytestCheckHook
@@ -13,6 +13,14 @@ buildPythonPackage rec {
     sha256 = "d2f25c7f410338d31666d7ddedfa67570900e248b940d186b48461bd4e5569a1";
   };
 
+  patches = [
+    # fix test_pyodbc_extra_connect_azure test failure
+    (fetchpatch {
+      url = "https://github.com/sqlalchemy/sqlalchemy/commit/7293b3dc0e9eb3dae84ffd831494b85355df8e73.patch";
+      sha256 = "1z61lzxamz74771ddlqmbxba1dcr77f016vqfcmb44dxb228w2db";
+    })
+  ];
+
   checkInputs = [
     pytestCheckHook
     mock
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 94513e5d620c4..071bbcd3061a1 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
-  disabledTestFiles = [ "tests/test_graphql.py" ];
+  disabledTestPaths = [ "tests/test_graphql.py" ];
   # https://github.com/encode/starlette/issues/1131
   disabledTests = [ "test_debug_html" ];
   pythonImportsCheck = [ "starlette" ];
diff --git a/pkgs/development/python-modules/tokenizers/default.nix b/pkgs/development/python-modules/tokenizers/default.nix
index cf122613f633c..ef265b87c054c 100644
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@@ -1,12 +1,10 @@
 { lib
-, rustPlatform
 , fetchFromGitHub
 , fetchurl
-, pipInstallHook
+, buildPythonPackage
+, rustPlatform
 , setuptools-rust
-, wheel
 , numpy
-, python
 , datasets
 , pytestCheckHook
 , requests
@@ -49,7 +47,7 @@ let
     url = "https://s3.amazonaws.com/models.huggingface.co/bert/openai-gpt-merges.txt";
     sha256 = "09a754pm4djjglv3x5pkgwd6f79i2rq8ydg0f7c3q1wmwqdbba8f";
   };
-in rustPlatform.buildRustPackage rec {
+in buildPythonPackage rec {
   pname = "tokenizers";
   version = "0.10.0";
 
@@ -60,19 +58,22 @@ in rustPlatform.buildRustPackage rec {
     hash = "sha256-rQ2hRV52naEf6PvRsWVCTN7B1oXAQGmnpJw4iIdhamw=";
   };
 
-  cargoSha256 = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src sourceRoot;
+    name = "${pname}-${version}";
+    hash = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
+  };
 
   sourceRoot = "source/bindings/python";
 
-  nativeBuildInputs = [
-    pipInstallHook
-    setuptools-rust
-    wheel
-  ];
+  nativeBuildInputs = [ setuptools-rust ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
 
   propagatedBuildInputs = [
     numpy
-    python
   ];
 
   installCheckInputs = [
@@ -99,14 +100,6 @@ in rustPlatform.buildRustPackage rec {
       ln -s ${openaiMerges} openai-gpt-merges.txt )
   '';
 
-  buildPhase = ''
-    ${python.interpreter} setup.py bdist_wheel
-  '';
-
-  installPhase = ''
-    pipInstallPhase
-  '';
-
   preCheck = ''
     HOME=$TMPDIR
   '';
diff --git a/pkgs/development/python-modules/typesystem/default.nix b/pkgs/development/python-modules/typesystem/default.nix
index e93fd83656f89..c278680404ba0 100644
--- a/pkgs/development/python-modules/typesystem/default.nix
+++ b/pkgs/development/python-modules/typesystem/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     # the default string formatting of regular expression flags which breaks test assertion
     "test_to_json_schema_complex_regular_expression"
   ];
-  disabledTestFiles = [
+  disabledTestPaths = [
     # for some reason jinja2 not picking up forms directory (1% of tests)
     "tests/test_forms.py"
   ];
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 8b64bddc5a4fe..6d2c19d36750b 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -69,7 +69,7 @@ buildPythonPackage rec {
   '';
 
   # Ignore tests which require network access
-  disabledTestFiles = [
+  disabledTestPaths = [
     "tests/unit/create/test_creator.py"
     "tests/unit/seed/embed/test_bootstrap_link_via_app_data.py"
   ];
diff --git a/pkgs/development/python-modules/wasmer/default.nix b/pkgs/development/python-modules/wasmer/default.nix
index ff4fffc821fb2..28c9b8b5c1660 100644
--- a/pkgs/development/python-modules/wasmer/default.nix
+++ b/pkgs/development/python-modules/wasmer/default.nix
@@ -1,62 +1,34 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
-, maturin
 , buildPythonPackage
-, python
 }:
 let
   pname = "wasmer";
   version = "1.0.0";
+in buildPythonPackage rec {
+  inherit pname version;
 
-  wheel = rustPlatform.buildRustPackage rec {
-    inherit pname version;
-
-    src = fetchFromGitHub {
-      owner = "wasmerio";
-      repo = "wasmer-python";
-      rev = version;
-      hash = "sha256-I1GfjLaPYMIHKh2m/5IQepUsJNiVUEJg49wyuuzUYtY=";
-    };
-
-    cargoHash = "sha256-txOOia1C4W+nsXuXp4EytEn82CFfSmiOYwRLC4WPImc=";
-
-    nativeBuildInputs = [ maturin python ];
-
-    preBuild = ''
-      cd packages/api
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-      maturin build --release --manylinux off --strip
-      runHook postBuild
-    '';
-
-    postBuild = ''
-      cd ../..
-    '';
-
-    doCheck = false;
+  src = fetchFromGitHub {
+    owner = "wasmerio";
+    repo = "wasmer-python";
+    rev = version;
+    hash = "sha256-I1GfjLaPYMIHKh2m/5IQepUsJNiVUEJg49wyuuzUYtY=";
+  };
 
-    installPhase = ''
-      runHook preInstall
-      install -Dm644 -t $out target/wheels/*.whl
-      runHook postInstall
-    '';
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-txOOia1C4W+nsXuXp4EytEn82CFfSmiOYwRLC4WPImc=";
   };
 
-in
-buildPythonPackage rec {
-  inherit pname version;
+  format = "pyproject";
+
+  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
 
-  format = "wheel";
-  src = wheel;
+  buildAndTestSubdir = "packages/api";
 
-  unpackPhase = ''
-    mkdir -p dist
-    cp $src/*.whl dist
-  '';
+  doCheck = false;
 
   pythonImportsCheck = [ "wasmer" ];
 
diff --git a/pkgs/development/tools/analysis/lcov/default.nix b/pkgs/development/tools/analysis/lcov/default.nix
index 35c75d67da507..30df5daed6ff0 100644
--- a/pkgs/development/tools/analysis/lcov/default.nix
+++ b/pkgs/development/tools/analysis/lcov/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1kvc7fkp45w48f0bxwbxvxkicnjrrydki0hllg294n1wrp80zzyk";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   preBuild = ''
     patchShebangs bin/
diff --git a/pkgs/development/tools/analysis/panopticon/default.nix b/pkgs/development/tools/analysis/panopticon/default.nix
index 91f3f24d6f1fe..f7f933392ab4c 100644
--- a/pkgs/development/tools/analysis/panopticon/default.nix
+++ b/pkgs/development/tools/analysis/panopticon/default.nix
@@ -12,8 +12,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1zv87nqhrzsxx0m891df4vagzssj3kblfv9yp7j96dw0vn9950qa";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
   propagatedBuildInputs = with qt5; [
      qt5.qtbase
      qtdeclarative
diff --git a/pkgs/development/tools/build-managers/apache-ant/1.9.nix b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
index 182b8633aa015..93644caa5a4ec 100644
--- a/pkgs/development/tools/build-managers/apache-ant/1.9.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "ant";
   inherit version;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchurl {
     url = "mirror://apache/ant/binaries/apache-ant-${version}-bin.tar.bz2";
diff --git a/pkgs/development/tools/build-managers/apache-ant/default.nix b/pkgs/development/tools/build-managers/apache-ant/default.nix
index d88068c1c3ee3..d2ef8361ec0e3 100644
--- a/pkgs/development/tools/build-managers/apache-ant/default.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "ant";
   inherit version;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchurl {
     url = "mirror://apache/ant/binaries/apache-ant-${version}-bin.tar.bz2";
diff --git a/pkgs/development/tools/build-managers/apache-maven/default.nix b/pkgs/development/tools/build-managers/apache-maven/default.nix
index 4658703f8b103..3a1866e0b3990 100644
--- a/pkgs/development/tools/build-managers/apache-maven/default.nix
+++ b/pkgs/development/tools/build-managers/apache-maven/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "1i9qlj3vy4j1yyf22nwisd0pg88n9qzp9ymfhwqabadka7br3b96";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   inherit jdk;
 
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 5de894bd1b420..7c2e5372e7312 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -20,12 +20,12 @@ stdenv.mkDerivation (rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.19.3";
+  version = "3.19.4";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "sha256-P6ynwTFJSh401m6fiXL/U2nkjUGeqM6qPcFbTBE2dzI=";
+    sha256 = "sha256-fQIyufHFfo3oHzgHHvggPmgg/n7siuRqHfEl2I28wuE=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 93935e47b36b1..4c5d9a5df809e 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -33,7 +33,8 @@ rec {
         echo ${stdenv.cc.cc} > $out/nix-support/manual-runtime-dependencies
       '';
 
-    buildInputs = [ unzip java makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ unzip java ];
 
     meta = {
       description = "Enterprise-grade build system";
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 488697033d91b..51b97b242d5c8 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [ jdk ];
 
   # the jar is not in share/java, because it's a standalone jar and should
diff --git a/pkgs/development/tools/build-managers/redo-sh/default.nix b/pkgs/development/tools/build-managers/redo-sh/default.nix
index d22f4bc487f88..093a825723c07 100644
--- a/pkgs/development/tools/build-managers/redo-sh/default.nix
+++ b/pkgs/development/tools/build-managers/redo-sh/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "0d3hz3vy5qmjr9r4f8a5cx9hikpzs8h8f0fsl3dpbialf4wck24g";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   sourceRoot = ".";
   installPhase = ''
diff --git a/pkgs/development/tools/build-managers/sbt-extras/default.nix b/pkgs/development/tools/build-managers/sbt-extras/default.nix
index 06bf2c54678c2..46f7e8cfa88d7 100644
--- a/pkgs/development/tools/build-managers/sbt-extras/default.nix
+++ b/pkgs/development/tools/build-managers/sbt-extras/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/database/ephemeralpg/default.nix b/pkgs/development/tools/database/ephemeralpg/default.nix
index ae10c402945fe..0fb3ae81030bb 100644
--- a/pkgs/development/tools/database/ephemeralpg/default.nix
+++ b/pkgs/development/tools/database/ephemeralpg/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
     url = "http://ephemeralpg.org/code/${pname}-${version}.tar.gz";
     sha256 = "1ap22ki8yz6agd0qybcjgs4b9izw1rwwcgpxn3jah2ccfyax34s6";
   };
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     mkdir -p $out
     PREFIX=$out make install
diff --git a/pkgs/development/tools/database/liquibase/default.nix b/pkgs/development/tools/database/liquibase/default.nix
index 32c606e0e218a..0be77237f4289 100644
--- a/pkgs/development/tools/database/liquibase/default.nix
+++ b/pkgs/development/tools/database/liquibase/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-hOemDLfkjjPXQErKKCIMl8c5EPZe40B1HlNfvg7IZKU=";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   unpackPhase = ''
     tar xfz ${src}
diff --git a/pkgs/development/tools/database/sqldeveloper/default.nix b/pkgs/development/tools/database/sqldeveloper/default.nix
index c42197e13cf13..8fb7677f58454 100644
--- a/pkgs/development/tools/database/sqldeveloper/default.nix
+++ b/pkgs/development/tools/database/sqldeveloper/default.nix
@@ -49,7 +49,8 @@ in
     sha256 = "1h53gl41ydr7kim6q9ckg3xyhb0rhmwj7jnis0xz6vms52b3h59k";
   };
 
-  buildInputs = [ makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   unpackCmd = "unzip $curSrc";
 
diff --git a/pkgs/development/tools/diesel-cli/default.nix b/pkgs/development/tools/diesel-cli/default.nix
index bd8e71090c536..20185ff7d1374 100644
--- a/pkgs/development/tools/diesel-cli/default.nix
+++ b/pkgs/development/tools/diesel-cli/default.nix
@@ -9,11 +9,9 @@ assert lib.assertMsg (sqliteSupport == true || postgresqlSupport == true || mysq
 
 let
   inherit (lib) optional optionals optionalString;
-  features = ''
-    ${optionalString sqliteSupport "sqlite"} \
-    ${optionalString postgresqlSupport "postgres"} \
-    ${optionalString mysqlSupport "mysql"} \
-  '';
+  features = optional sqliteSupport "sqlite"
+    ++ optional postgresqlSupport "postgres"
+    ++ optional mysqlSupport "mysql";
 in
 
 rustPlatform.buildRustPackage rec {
@@ -35,11 +33,12 @@ rustPlatform.buildRustPackage rec {
     ./allow-warnings.patch
   ];
 
-  cargoBuildFlags = [ "--no-default-features --features \"${features}\"" ];
+  cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
   cargoPatches = [ ./cargo-lock.patch ];
   cargoSha256 = "1vbb7r0dpmq8363i040bkhf279pz51c59kcq9v5qr34hs49ish8g";
 
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ openssl ]
     ++ optional stdenv.isDarwin Security
     ++ optional (stdenv.isDarwin && mysqlSupport) libiconv
@@ -47,12 +46,7 @@ rustPlatform.buildRustPackage rec {
     ++ optional postgresqlSupport postgresql
     ++ optionals mysqlSupport [ mysql zlib ];
 
-  # We must `cd diesel_cli`, we cannot use `--package diesel_cli` to build
-  # because --features fails to apply to the package:
-  # https://github.com/rust-lang/cargo/issues/5015
-  # https://github.com/rust-lang/cargo/issues/4753
-  preBuild = "cd diesel_cli";
-  postBuild = "cd ..";
+  buildAndTestSubdir = "diesel_cli";
 
   checkPhase = optionalString sqliteSupport ''
     (cd diesel_cli && cargo check --features sqlite)
@@ -65,7 +59,7 @@ rustPlatform.buildRustPackage rec {
 
   # Fix the build with mariadb, which otherwise shows "error adding symbols:
   # DSO missing from command line" errors for libz and libssl.
-  NIX_LDFLAGS = lib.optionalString mysqlSupport "-lz -lssl -lcrypto";
+  NIX_LDFLAGS = optionalString mysqlSupport "-lz -lssl -lcrypto";
 
   meta = with lib; {
     description = "Database tool for working with Rust projects that use Diesel";
diff --git a/pkgs/development/tools/documentation/gtk-doc/default.nix b/pkgs/development/tools/documentation/gtk-doc/default.nix
index d82c288e5aad4..e74a6b9c3c6a4 100644
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , python3
 , docbook_xml_dtd_43
-, docbook_xsl
+, docbook-xsl-nons
 , libxslt
 , gettext
 , gnome3
@@ -14,7 +14,9 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gtk-doc";
-  version = "1.33.1";
+  version = "1.33.2";
+
+  outputDevdoc = "out";
 
   format = "other";
 
@@ -23,15 +25,13 @@ python3.pkgs.buildPythonApplication rec {
     owner = "GNOME";
     repo = pname;
     rev = version;
-    sha256 = "L9CjhZ60F42xbo50x7cdKfJrav/9mf38pff8S4xkEVo=";
+    sha256 = "A6OXpazrJ05SUIO1ZPVN0xHTXOSov8UnPvUolZAv/Iw=";
   };
 
   patches = [
     passthru.respect_xml_catalog_files_var_patch
   ];
 
-  outputDevdoc = "out";
-
   nativeBuildInputs = [
     pkg-config
     gettext
@@ -42,7 +42,7 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [
     docbook_xml_dtd_43
-    docbook_xsl
+    docbook-xsl-nons
     libxslt
   ] ++ lib.optionals withDblatex [
     dblatex
@@ -50,7 +50,6 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonPath = with python3.pkgs; [
     pygments # Needed for https://gitlab.gnome.org/GNOME/gtk-doc/blob/GTK_DOC_1_32/meson.build#L42
-    (anytree.override { withGraphviz = false; })
     lxml
   ];
 
@@ -79,8 +78,8 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Tools to extract documentation embedded in GTK and GNOME source code";
-    homepage = "https://www.gtk.org/gtk-doc";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ pSub worldofpeace ];
+    homepage = "https://gitlab.gnome.org/GNOME/gtk-doc";
+    license = licenses.gpl2Plus;
+    maintainers = teams.gnome.members ++ (with maintainers; [ pSub ]);
   };
 }
diff --git a/pkgs/development/tools/google-app-engine-go-sdk/default.nix b/pkgs/development/tools/google-app-engine-go-sdk/default.nix
index 4d572e070e76d..c20d7a2e49a6f 100644
--- a/pkgs/development/tools/google-app-engine-go-sdk/default.nix
+++ b/pkgs/development/tools/google-app-engine-go-sdk/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
         sha256 = "0s8sqyc72lnc7dxd4cl559gyfx83x71jjpsld3i3nbp3mwwamczp";
       };
 
-  buildInputs = [ python makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/
diff --git a/pkgs/development/tools/jbake/default.nix b/pkgs/development/tools/jbake/default.nix
index 97d1c75368211..e14cfe874040c 100644
--- a/pkgs/development/tools/jbake/default.nix
+++ b/pkgs/development/tools/jbake/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ripayv1vf4f4ylxr7h9kad2xhy3y98ca8s4p38z7dn8l47zg0qw";
   };
 
-  buildInputs = [ makeWrapper jre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   postPatch = "patchShebangs .";
 
diff --git a/pkgs/development/tools/jbang/default.nix b/pkgs/development/tools/jbang/default.nix
index c41fb4c639f3b..afabfc4b88105 100644
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:
 
 stdenv.mkDerivation rec {
-  version = "0.65.1";
+  version = "0.66.0";
   pname = "jbang";
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-Puddnem03RGORKkvcLy5o/eOzKzrOuRvqPk5FsjQ3Lw=";
+    sha256 = "sha256-iWM9IcvrcsX/rTzouT7rQbuGSFTIVPnHSCmAHxzFOQo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/jsduck/default.nix b/pkgs/development/tools/jsduck/default.nix
index 233b393387606..15a3a68340348 100644
--- a/pkgs/development/tools/jsduck/default.nix
+++ b/pkgs/development/tools/jsduck/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   phases = [ "installPhase" ];
 
-  buildInputs = [ env makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ env ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/misc/autobuild/default.nix b/pkgs/development/tools/misc/autobuild/default.nix
index da387105cef50..186608cde3f1a 100644
--- a/pkgs/development/tools/misc/autobuild/default.nix
+++ b/pkgs/development/tools/misc/autobuild/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gv7g61ja9q9zg1m30k4snqwwy1kq7b4df6sb7d2qra7kbdq8af1";
   };
 
-  buildInputs = [ makeWrapper perl openssh rsync ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl openssh rsync ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/cbrowser/default.nix b/pkgs/development/tools/misc/cbrowser/default.nix
index 0f7edeea812f2..62aa0ab5decf6 100644
--- a/pkgs/development/tools/misc/cbrowser/default.nix
+++ b/pkgs/development/tools/misc/cbrowser/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./backslashes-quotes.diff ];
 
-  buildInputs = [ tk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tk ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/${name}
diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index 285805ccb02c6..6125143457855 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0qfj2wd4qk1yn9yzam6g8nmyxfazcc0knjyyibycb2ainkhp21hd";
   };
 
-  buildInputs = [ expect makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ expect ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/fswatch/default.nix b/pkgs/development/tools/misc/fswatch/default.nix
index 6f9f5e113c06c..47716b5ea9e8d 100644
--- a/pkgs/development/tools/misc/fswatch/default.nix
+++ b/pkgs/development/tools/misc/fswatch/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "11479ac436g8bwk0lfnmdms0cirv9k11pdvfrrg9jwkki1j1abkk";
   };
 
-  nativeBuildInputs = [ autoreconfHook ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
-  buildInputs = [ gettext libtool makeWrapper texinfo ];
+  nativeBuildInputs = [ autoreconfHook makeWrapper ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
+  buildInputs = [ gettext libtool texinfo ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/tools/misc/gpshell/default.nix b/pkgs/development/tools/misc/gpshell/default.nix
index 13437b7195362..f5298d685eba7 100644
--- a/pkgs/development/tools/misc/gpshell/default.nix
+++ b/pkgs/development/tools/misc/gpshell/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "19a77zvyf2vazbv17185s4pynhylk2ky8vhl4i8pg9zww29sicqi";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ globalplatform pcsclite makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ globalplatform pcsclite ];
 
   postFixup = ''
     wrapProgram "$out/bin/gpshell" --prefix LD_LIBRARY_PATH : "${gppcscconnectionplugin}/lib"
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 6afc4415e1138..ba1fa720dd40a 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -6,11 +6,11 @@
 # files.
 
 stdenv.mkDerivation rec {
-  name = "help2man-1.47.16";
+  name = "help2man-1.47.17";
 
   src = fetchurl {
     url = "mirror://gnu/help2man/${name}.tar.xz";
-    sha256 = "1x586h7wvripcay35kdh2kvydx84y8yy93ffjah2rqw6bc65iy1y";
+    sha256 = "sha256-2jo1xQseH4yPoyLWn6R8kBHORDqPuNHWcbHwG4sACOs=";
   };
 
   nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
diff --git a/pkgs/development/tools/misc/kibana/6.x.nix b/pkgs/development/tools/misc/kibana/6.x.nix
index 3fa2d219fe3a3..9ba19c836b597 100644
--- a/pkgs/development/tools/misc/kibana/6.x.nix
+++ b/pkgs/development/tools/misc/kibana/6.x.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
     ./disable-nodejs-version-check.patch
   ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/libexec/kibana $out/bin
diff --git a/pkgs/development/tools/misc/kibana/7.x.nix b/pkgs/development/tools/misc/kibana/7.x.nix
index 7f46d6f651201..754559969d50e 100644
--- a/pkgs/development/tools/misc/kibana/7.x.nix
+++ b/pkgs/development/tools/misc/kibana/7.x.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
     ./disable-nodejs-version-check-7.patch
   ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/libexec/kibana $out/bin
diff --git a/pkgs/development/tools/misc/macdylibbundler/default.nix b/pkgs/development/tools/misc/macdylibbundler/default.nix
index c92d7b077983c..f37815081ee46 100644
--- a/pkgs/development/tools/misc/macdylibbundler/default.nix
+++ b/pkgs/development/tools/misc/macdylibbundler/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "149p3dcnap4hs3nhq5rfvr3m70rrb5hbr5xkj1h0gsfp0d7gvxnj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/development/tools/misc/rolespec/default.nix b/pkgs/development/tools/misc/rolespec/default.nix
index d86277993caa9..b26fbf75031d0 100644
--- a/pkgs/development/tools/misc/rolespec/default.nix
+++ b/pkgs/development/tools/misc/rolespec/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     inherit name;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # The default build phase (`make`) runs the test code. It's difficult to do
   # the test in the build environment because it depends on the system package
diff --git a/pkgs/development/tools/neoload/default.nix b/pkgs/development/tools/neoload/default.nix
index fb85aa80dc355..63452728b91e8 100644
--- a/pkgs/development/tools/neoload/default.nix
+++ b/pkgs/development/tools/neoload/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation {
       { url = "http://neoload.installers.neotys.com/documents/download/neoload/v4.1/neoload_4_1_4_linux_x86.sh";
         sha256 = "1z66jiwcxixsqqwa0f4q8m2p5kna4knq6lic8y8l74dgv25mw912"; } );
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   phases = [ "installPhase" ];
 
   # TODO: load generator / monitoring agent only builds
diff --git a/pkgs/development/tools/node-webkit/nw12.nix b/pkgs/development/tools/node-webkit/nw12.nix
index 31358129821eb..475c08eb169fa 100644
--- a/pkgs/development/tools/node-webkit/nw12.nix
+++ b/pkgs/development/tools/node-webkit/nw12.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
     ln -s $out/share/nwjs/nwjc $out/bin
   '';
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   meta = with lib; {
     description = "An app runtime based on Chromium and node.js";
diff --git a/pkgs/development/tools/nrpl/default.nix b/pkgs/development/tools/nrpl/default.nix
index 72177582919a1..67a86ca8dec59 100644
--- a/pkgs/development/tools/nrpl/default.nix
+++ b/pkgs/development/tools/nrpl/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1cly9lhrawnc42r31b7r0p0i6hcx8r00aa17gv7w9pcpj8ngb4v2";
   };
 
-  buildInputs = [ makeWrapper nim pcre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ nim pcre ];
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/tools/nwjs/default.nix b/pkgs/development/tools/nwjs/default.nix
index d3490b2b9c999..1356bc46ced80 100644
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@@ -83,7 +83,7 @@ in stdenv.mkDerivation rec {
       ln -s $out/share/nwjs/nw $out/bin
   '';
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   meta = with lib; {
     description = "An app runtime based on Chromium and node.js";
diff --git a/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix b/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
index 047246cd0a0da..5a4b55cc7fec1 100644
--- a/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
+++ b/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
@@ -20,7 +20,8 @@ stdenv.mkDerivation {
   patchFlags = [ "-p0" ];
   patches = [ ./warn.patch ];
 
-  buildInputs = [ ocaml makeWrapper ncurses ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ocaml ncurses ];
 
   phases = "unpackPhase patchPhase buildPhase";
   buildPhase = ''
diff --git a/pkgs/development/tools/ocaml/opam/1.2.2.nix b/pkgs/development/tools/ocaml/opam/1.2.2.nix
index a128f2144e9f3..610093af19ffd 100644
--- a/pkgs/development/tools/ocaml/opam/1.2.2.nix
+++ b/pkgs/development/tools/ocaml/opam/1.2.2.nix
@@ -47,7 +47,8 @@ in stdenv.mkDerivation {
   pname = "opam";
   version = "1.2.2";
 
-  buildInputs = [ unzip curl ncurses ocaml makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip curl ncurses ocaml ];
 
   src = srcs.opam;
 
diff --git a/pkgs/development/tools/ocaml/opam/default.nix b/pkgs/development/tools/ocaml/opam/default.nix
index b99880fe7f33e..30bc089ee0fec 100644
--- a/pkgs/development/tools/ocaml/opam/default.nix
+++ b/pkgs/development/tools/ocaml/opam/default.nix
@@ -63,7 +63,8 @@ in stdenv.mkDerivation {
   pname = "opam";
   version = "2.0.8";
 
-  buildInputs = [ unzip curl ncurses ocaml makeWrapper getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip curl ncurses ocaml getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
 
   src = srcs.opam;
 
diff --git a/pkgs/development/tools/operator-sdk/default.nix b/pkgs/development/tools/operator-sdk/default.nix
index 8090fc6ff1f04..764041b6ad4a4 100644
--- a/pkgs/development/tools/operator-sdk/default.nix
+++ b/pkgs/development/tools/operator-sdk/default.nix
@@ -17,7 +17,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/operator-sdk" ];
 
-  buildInputs = [ go makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ go ];
 
   # operator-sdk uses the go compiler at runtime
   allowGoReference = true;
diff --git a/pkgs/development/tools/out-of-tree/default.nix b/pkgs/development/tools/out-of-tree/default.nix
index 4547012e2f325..597d680cc2bbc 100644
--- a/pkgs/development/tools/out-of-tree/default.nix
+++ b/pkgs/development/tools/out-of-tree/default.nix
@@ -4,7 +4,7 @@ buildGoModule rec {
   pname = "out-of-tree";
   version = "1.4.0";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchgit {
     rev = "refs/tags/v${version}";
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index 662961ae46aaf..42c9ee872fed0 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.7.4";
+  version = "3.7.5";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1qkp2rfi5njyp5c5avajab00aj74pkmkgzkvshv4p2ydkhswgazv";
+    sha256 = "sha256-FRy18ScW4/6TonoxfNRIeDKWWfJ1s0J3m/rvSlJrv3A=";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index c5d65a8239eae..641c1581b0519 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -37,7 +37,7 @@ let
 
 in runCommand "systemtap-${kernel.version}-${version}" {
   inherit stapBuild kernelBuildDir;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   meta = {
     homepage = "https://sourceware.org/systemtap/";
     repositories.git = url;
diff --git a/pkgs/development/tools/quilt/default.nix b/pkgs/development/tools/quilt/default.nix
index 71cf10e63b91a..94b5e5a6dcc20 100644
--- a/pkgs/development/tools/quilt/default.nix
+++ b/pkgs/development/tools/quilt/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "01vfvk4pqigahx82fhaaffg921ivd3k7rylz1yfvy4zbdyd32jri";
   };
 
-  buildInputs = [ makeWrapper perl bash diffutils patch findutils diffstat ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl bash diffutils patch findutils diffstat ];
 
   postInstall = ''
     wrapProgram $out/bin/quilt --prefix PATH : \
diff --git a/pkgs/development/tools/ronn/default.nix b/pkgs/development/tools/ronn/default.nix
index 9e4ac0b58ebee..8b5166272202e 100644
--- a/pkgs/development/tools/ronn/default.nix
+++ b/pkgs/development/tools/ronn/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   phases = ["installPhase"];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/scalafix/default.nix b/pkgs/development/tools/scalafix/default.nix
index 00fda8bfc3682..c27d6e8a65f39 100644
--- a/pkgs/development/tools/scalafix/default.nix
+++ b/pkgs/development/tools/scalafix/default.nix
@@ -19,7 +19,8 @@ in
 stdenv.mkDerivation {
   name = "${baseName}-${version}";
 
-  buildInputs = [ jdk makeWrapper deps ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk deps ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/selenium/selendroid/default.nix b/pkgs/development/tools/selenium/selendroid/default.nix
index c25190cab74e9..b029e7711a3ed 100644
--- a/pkgs/development/tools/selenium/selendroid/default.nix
+++ b/pkgs/development/tools/selenium/selendroid/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation {
 
   dontUnpack = true;
 
-  buildInputs = [ jdk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ];
 
   installPhase = ''
     mkdir -p $out/share/lib/selendroid
diff --git a/pkgs/development/tools/selenium/server/default.nix b/pkgs/development/tools/selenium/server/default.nix
index 10893a9d17001..c4f8653794fe1 100644
--- a/pkgs/development/tools/selenium/server/default.nix
+++ b/pkgs/development/tools/selenium/server/default.nix
@@ -18,7 +18,8 @@ in stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -p $out/share/lib/${pname}-${version}
diff --git a/pkgs/development/tools/sslmate/default.nix b/pkgs/development/tools/sslmate/default.nix
index cdf2242bdbaa2..ef04725e562f8 100644
--- a/pkgs/development/tools/sslmate/default.nix
+++ b/pkgs/development/tools/sslmate/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  buildInputs = [ perlPackages.perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl ];
 
   postInstall = ''
     wrapProgram $out/bin/sslmate --prefix PERL5LIB : \
diff --git a/pkgs/development/tools/the-way/default.nix b/pkgs/development/tools/the-way/default.nix
index e8f52fa83345a..6d7fbef2f19b7 100644
--- a/pkgs/development/tools/the-way/default.nix
+++ b/pkgs/development/tools/the-way/default.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-jTZso61Lyt6jprBxBAhvchgOsgM9y1qBleTxUx1jCnE=";
   checkFlagsArray = lib.optionals stdenv.isDarwin [ "--skip=copy" ];
-  cargoParallelTestThreads = false;
+  dontUseCargoParallelTests = true;
 
   postInstall = ''
     $out/bin/the-way config default tmp.toml
diff --git a/pkgs/development/tools/thrust/default.nix b/pkgs/development/tools/thrust/default.nix
index 44dfa1a4ba11c..02183282ce163 100644
--- a/pkgs/development/tools/thrust/default.nix
+++ b/pkgs/development/tools/thrust/default.nix
@@ -22,7 +22,8 @@ in stdenv.mkDerivation rec {
     sha256 = "07rrnlj0gk500pvar4b1wdqm05p4n9yjwn911x93bd2qwc8r5ymc";
   };
 
-  buildInputs = [ thrustEnv makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ thrustEnv unzip ];
 
   phases = [ "installPhase" "fixupPhase" ];