summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/mpg123/default.nix25
-rw-r--r--pkgs/applications/editors/ed/default.nix22
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix8
-rw-r--r--pkgs/build-support/go/module.nix12
-rw-r--r--pkgs/build-support/go/package.nix8
-rw-r--r--pkgs/build-support/rust/hooks/default.nix33
-rw-r--r--pkgs/build-support/rust/import-cargo-lock.nix41
-rw-r--r--pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch2
-rw-r--r--pkgs/data/misc/tzdata/default.nix7
-rw-r--r--pkgs/development/compilers/rust/cargo.nix38
-rw-r--r--pkgs/development/compilers/rust/rustc.nix12
-rw-r--r--pkgs/development/libraries/audio/lv2/default.nix54
-rw-r--r--pkgs/development/libraries/dbus/default.nix4
-rw-r--r--pkgs/development/libraries/libnftnl/default.nix6
-rw-r--r--pkgs/development/libraries/libomxil-bellagio/default.nix3
-rw-r--r--pkgs/development/libraries/libpcap/default.nix7
-rw-r--r--pkgs/development/libraries/libsndfile/default.nix13
-rw-r--r--pkgs/development/libraries/libvmaf/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh12
-rw-r--r--pkgs/development/libraries/qt-5/hooks/qmake-hook.sh3
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtbase.nix3
-rw-r--r--pkgs/development/perl-modules/Po4a/default.nix14
-rw-r--r--pkgs/development/python-modules/psutil/default.nix6
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorflow/bin.nix4
-rw-r--r--pkgs/development/python-modules/tensorflow/default.nix5
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix120
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix339
-rwxr-xr-xpkgs/os-specific/darwin/gen-frameworks.py147
-rw-r--r--pkgs/os-specific/linux/bpftools/default.nix11
-rw-r--r--pkgs/os-specific/linux/bpftools/strip-binary-name.patch15
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix4
-rw-r--r--pkgs/tools/compression/xz/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix5
36 files changed, 639 insertions, 370 deletions
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 3eb2cf20ee777..36c8a2409abb2 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , makeWrapper
 , pkg-config
-, perl
+, libOnly ? false # whether to build only the library
 , withAlsa ? stdenv.hostPlatform.isLinux
 , alsa-lib
 , withPulse ? stdenv.hostPlatform.isLinux
@@ -14,29 +14,36 @@
 , withJack ? stdenv.hostPlatform.isUnix
 , jack
 , withConplay ? !stdenv.hostPlatform.isWindows
+, perl
 }:
 
+assert withConplay -> !libOnly;
+
 stdenv.mkDerivation rec {
-  pname = "mpg123";
+  pname = "${lib.optionalString libOnly "lib"}mpg123";
   version = "1.31.2";
 
   src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
+    url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
     sha256 = "sha256-sX8ikF4x9DtrQB399qce0Ru30Fb2jbRJ1wufmug5x94=";
   };
 
-  outputs = [ "out" ] ++ lib.optionals withConplay [ "conplay" ];
+  outputs = [ "out" ] ++ lib.optional withConplay "conplay";
 
-  nativeBuildInputs = lib.optionals withConplay [ makeWrapper ]
-    ++ lib.optionals (withPulse || withJack) [ pkg-config ];
+  nativeBuildInputs = lib.optionals (!libOnly) (
+    lib.optionals withConplay [ makeWrapper ]
+    ++ lib.optionals (withPulse || withJack) [ pkg-config ]
+  );
 
-  buildInputs = lib.optionals withConplay [ perl ]
+  buildInputs = lib.optionals (!libOnly) (
+    lib.optionals withConplay [ perl ]
     ++ lib.optionals withAlsa [ alsa-lib ]
     ++ lib.optionals withPulse [ libpulseaudio ]
     ++ lib.optionals withCoreAudio [ AudioUnit AudioToolbox ]
-    ++ lib.optionals withJack [ jack ];
+    ++ lib.optionals withJack [ jack ]
+  );
 
-  configureFlags = [
+  configureFlags = lib.optionals (!libOnly) [
     "--with-audio=${lib.strings.concatStringsSep "," (
       lib.optional withJack "jack"
       ++ lib.optional withPulse "pulse"
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index b7b70eb501ea1..af6c8f7c6f8d5 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -1,12 +1,11 @@
-{ lib, stdenv, fetchurl, lzip
-}:
+{ lib, stdenv, fetchurl, lzip }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   pname = "ed";
   version = "1.19";
 
@@ -17,11 +16,14 @@ stdenv.mkDerivation (rec {
 
   nativeBuildInputs = [ lzip ];
 
-  doCheck = true; # not cross;
+  configureFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  doCheck = true;
 
   meta = {
     description = "An implementation of the standard Unix editor";
-
     longDescription = ''
       GNU ed is a line-oriented text editor.  It is used to create,
       display, modify and otherwise manipulate text files, both
@@ -32,17 +34,9 @@ stdenv.mkDerivation (rec {
       available.  For most purposes, however, it is superseded by
       full-screen editors such as GNU Emacs or GNU Moe.
     '';
-
     license = lib.licenses.gpl3Plus;
-
     homepage = "https://www.gnu.org/software/ed/";
-
     maintainers = [ ];
     platforms = lib.platforms.unix;
   };
-} // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
-  # This may be moved above during a stdenv rebuild.
-  preConfigure = ''
-    configureFlagsArray+=("CC=$CC")
-  '';
-})
+}
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index d2a1ed39ee07f..388e546461667 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -226,12 +226,10 @@ stdenv.mkDerivation {
         ln -s ${targetPrefix}clang++ $out/bin/${targetPrefix}c++
       fi
 
-      if [ -e $ccPath/cpp ]; then
-        wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
-    '' + lib.optionalString (hostPlatform != targetPlatform) ''
-      elif [ -e $ccPath/${targetPrefix}cpp ]; then
+      if [ -e $ccPath/${targetPrefix}cpp ]; then
         wrap ${targetPrefix}cpp $wrapper $ccPath/${targetPrefix}cpp
-    '' + ''
+      elif [ -e $ccPath/cpp ]; then
+        wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
       fi
     ''
 
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index aca313264a28c..9e401cc68aa2d 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -105,7 +105,7 @@ let
       runHook postConfigure
     '';
 
-    buildPhase = args.modBuildPhase or ''
+    buildPhase = args.modBuildPhase or (''
       runHook preBuild
     '' + lib.optionalString (deleteVendor == true) ''
       if [ ! -d vendor ]; then
@@ -133,7 +133,7 @@ let
       mkdir -p vendor
 
       runHook postBuild
-    '';
+    '');
 
     installPhase = args.modInstallPhase or ''
       runHook preInstall
@@ -176,7 +176,7 @@ let
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
     inherit CGO_ENABLED;
 
-    configurePhase = args.configurePhase or ''
+    configurePhase = args.configurePhase or (''
       runHook preConfigure
 
       export GOCACHE=$TMPDIR/go-cache
@@ -200,9 +200,9 @@ let
       fi
 
       runHook postConfigure
-    '';
+    '');
 
-    buildPhase = args.buildPhase or ''
+    buildPhase = args.buildPhase or (''
       runHook preBuild
 
       exclude='\(/_\|examples\|Godeps\|testdata'
@@ -282,7 +282,7 @@ let
       )
     '' + ''
       runHook postBuild
-    '';
+    '');
 
     doCheck = args.doCheck or true;
     checkPhase = args.checkPhase or ''
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index 9106bf9796ebb..e627058604d9b 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -99,7 +99,7 @@ let
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
 
-    configurePhase = args.configurePhase or ''
+    configurePhase = args.configurePhase or (''
       runHook preConfigure
 
       # Extract the source
@@ -141,7 +141,7 @@ let
       fi
 
       runHook postConfigure
-    '';
+    '');
 
     renameImports = args.renameImports or (
       let
@@ -151,7 +151,7 @@ let
         renames = p: lib.concatMapStringsSep "\n" (rename p.goPackagePath) p.goPackageAliases;
       in lib.concatMapStringsSep "\n" renames inputsWithAliases);
 
-    buildPhase = args.buildPhase or ''
+    buildPhase = args.buildPhase or (''
       runHook preBuild
 
       runHook renameImports
@@ -235,7 +235,7 @@ let
       )
     '' + ''
       runHook postBuild
-    '';
+    '');
 
     doCheck = args.doCheck or false;
     checkPhase = args.checkPhase or ''
diff --git a/pkgs/build-support/rust/hooks/default.nix b/pkgs/build-support/rust/hooks/default.nix
index 168224e39b359..2eb388fe07ba8 100644
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@@ -76,37 +76,14 @@ in {
         # inputs do not cause us to find the wrong `diff`.
         diff = "${lib.getBin buildPackages.diffutils}/bin/diff";
 
-        # We want to specify the correct crt-static flag for both
-        # the build and host platforms. This is important when the wanted
-        # value for crt-static does not match the defaults in the rustc target,
-        # like for pkgsMusl or pkgsCross.musl64; Upstream rustc still assumes
-        # that musl = static[1].
-        #
-        # By default, Cargo doesn't apply RUSTFLAGS when building build.rs
-        # if --target is passed, so the only good way to set crt-static for
-        # build.rs files is to use the unstable -Zhost-config Cargo feature.
-        # This allows us to specify flags that should be passed to rustc
-        # when building for the build platform. We also need to use
-        # -Ztarget-applies-to-host, because using -Zhost-config requires it.
-        #
-        # When doing this, we also have to specify the linker, or cargo
-        # won't pass a -C linker= argument to rustc.  This will make rustc
-        # try to use its default value of "cc", which won't be available
-        # when cross-compiling.
-        #
-        # [1]: https://github.com/rust-lang/compiler-team/issues/422
         cargoConfig = ''
-          [host]
+          [target."${rust.toRustTarget stdenv.buildPlatform}"]
           "linker" = "${ccForBuild}"
-          "rustflags" = [ "-C", "target-feature=${if stdenv.buildPlatform.isStatic then "+" else "-"}crt-static" ]
-
-          [target."${shortTarget}"]
-          "linker" = "${ccForHost}"
+          ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
+            [target."${shortTarget}"]
+            "linker" = "${ccForHost}"
+          ''}
           "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
-
-          [unstable]
-          host-config = true
-          target-applies-to-host = true
         '';
       };
     } ./cargo-setup-hook.sh) {};
diff --git a/pkgs/build-support/rust/import-cargo-lock.nix b/pkgs/build-support/rust/import-cargo-lock.nix
index 0e1da7ce5f524..b23bae1090b70 100644
--- a/pkgs/build-support/rust/import-cargo-lock.nix
+++ b/pkgs/build-support/rust/import-cargo-lock.nix
@@ -10,6 +10,15 @@
   # Allow `builtins.fetchGit` to be used to not require hashes for git dependencies
 , allowBuiltinFetchGit ? false
 
+  # Additional registries to pull sources from
+  #   { "https://<registry index URL>" = "https://<registry download URL>"; }
+  # where:
+  # - "index URL" is the "index" value of the configuration entry for that registry
+  #   https://doc.rust-lang.org/cargo/reference/registries.html#using-an-alternate-registry
+  # - "download URL" is the "dl" value of its associated index configuration
+  #   https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
+, extraRegistries ? {}
+
   # Hashes for git dependencies.
 , outputHashes ? {}
 } @ args:
@@ -80,7 +89,7 @@ let
 
   # We can't use the existing fetchCrate function, since it uses a
   # recursive hash of the unpacked crate.
-  fetchCrate = pkg:
+  fetchCrate = pkg: downloadUrl:
     let
       checksum = pkg.checksum or parsedLockFile.metadata."checksum ${pkg.name} ${pkg.version} (${pkg.source})";
     in
@@ -89,10 +98,14 @@ let
     '';
     fetchurl {
       name = "crate-${pkg.name}-${pkg.version}.tar.gz";
-      url = "https://crates.io/api/v1/crates/${pkg.name}/${pkg.version}/download";
+      url = "${downloadUrl}/${pkg.name}/${pkg.version}/download";
       sha256 = checksum;
     };
 
+  registries = {
+    "https://github.com/rust-lang/crates.io-index" = "https://crates.io/api/v1/crates";
+  } // extraRegistries;
+
   # Replaces values inherited by workspace members.
   replaceWorkspaceValues = writers.writePython3 "replace-workspace-values"
     { libraries = with python3Packages; [ tomli tomli-w ]; flakeIgnore = [ "E501" ]; }
@@ -102,10 +115,11 @@ let
   mkCrate = pkg:
     let
       gitParts = parseGit pkg.source;
+      registryIndexUrl = lib.removePrefix "registry+" pkg.source;
     in
-      if pkg.source == "registry+https://github.com/rust-lang/crates.io-index" then
+      if lib.hasPrefix "registry+" pkg.source && builtins.hasAttr registryIndexUrl registries then
       let
-        crateTarball = fetchCrate pkg;
+        crateTarball = fetchCrate pkg registries.${registryIndexUrl};
       in runCommand "${pkg.name}-${pkg.version}" {} ''
         mkdir $out
         tar xf "${crateTarball}" -C $out --strip-components=1
@@ -213,15 +227,24 @@ let
     }
 
     cat > $out/.cargo/config <<EOF
-    [source.crates-io]
-    replace-with = "vendored-sources"
+[source.crates-io]
+replace-with = "vendored-sources"
 
-    [source.vendored-sources]
-    directory = "cargo-vendor-dir"
-    EOF
+[source.vendored-sources]
+directory = "cargo-vendor-dir"
+EOF
 
     declare -A keysSeen
 
+    for registry in ${toString (builtins.attrNames extraRegistries)}; do
+      cat >> $out/.cargo/config <<EOF
+
+[source."$registry"]
+registry = "$registry"
+replace-with = "vendored-sources"
+EOF
+    done
+
     for crate in ${toString depCrates}; do
       # Link the crate directory, removing the output path hash from the destination.
       ln -s "$crate" $out/$(basename "$crate" | cut -c 34-)
diff --git a/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch b/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch
index d44481056c434..af90ce57949a3 100644
--- a/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch
+++ b/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch
@@ -2,7 +2,7 @@ diff --git a/Makefile b/Makefile
 index a9a989e..4da737b 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -579,8 +579,8 @@ install:	all $(DATA) $(REDO) $(MANS)
+@@ -606,8 +606,8 @@ install:	all $(DATA) $(REDO) $(MANS)
  			-t '$(DESTDIR)$(TZDEFAULT)'
  		cp -f $(TABDATA) '$(DESTDIR)$(TZDIR)/.'
  		cp tzselect '$(DESTDIR)$(BINDIR)/.'
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 81f23c9a828f0..68edd93fc98c2 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2022g";
+  version = "2023b";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-RJHbgoGulKhNk55Ce92D3DifJnZNJ9mlxS14LBZ2RHg=";
+      hash = "sha256-m3j9Jk+VYR/ph6lXIUVs1arJ9V5pFb5KnKKZe8fODmw=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-lhC7C5ZW/0BMNhpB8yhtpTBktUadhPAMnLIxTIYU2nQ=";
+      hash = "sha256-EVSC47pm3LZRyI8s2nnFcQNqz5tjhzF41qBELNO+E9I=";
     })
   ];
 
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     "AR=${stdenv.cc.targetPrefix}ar"
   ] ++ lib.optionals stdenv.hostPlatform.isWindows [
     "CFLAGS+=-DHAVE_DIRECT_H"
+    "CFLAGS+=-DHAVE_SETENV=0"
     "CFLAGS+=-DHAVE_SYMLINK=0"
     "CFLAGS+=-DRESERVE_STD_EXT_IDS"
   ];
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 481b4195891ca..eb3dc238a9abc 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, pkgsHostHost
+{ lib, stdenv, pkgsBuildHost, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, rustPlatform, rustc
 , CoreFoundation, Security
@@ -20,6 +20,42 @@ rustPlatform.buildRustPackage {
     inherit (rustc) tests;
   };
 
+  # Upstream rustc still assumes that musl = static[1].  The fix for
+  # this is to disable crt-static by default for non-static musl
+  # targets.
+  #
+  # For every package apart from Cargo, we can fix this by just
+  # patching rustc to not have crt-static by default.  But Cargo is
+  # built with the upstream bootstrap binary for rustc, which we can't
+  # easily patch.  This means we need to find another way to make sure
+  # crt-static is not used during the build of pkgsMusl.cargo.
+  #
+  # By default, Cargo doesn't apply RUSTFLAGS when building build.rs
+  # if --target is passed, so the only good way to set -crt-static for
+  # build.rs files used in the Cargo build is to use the unstable
+  # -Zhost-config Cargo feature.  This allows us to specify flags that
+  # should be passed to rustc when building for the build platform.
+  # We also need to use -Ztarget-applies-to-host, because using
+  # -Zhost-config requires it.
+  #
+  # When doing this, we also have to specify the linker, or cargo
+  # won't pass a -C linker= argument to rustc.  This will make rustc
+  # try to use its default value of "cc", which won't be available
+  # when cross-compiling.
+  #
+  # [1]: https://github.com/rust-lang/compiler-team/issues/422
+  postPatch = lib.optionalString (with stdenv.buildPlatform; isMusl && !isStatic) ''
+    mkdir -p .cargo
+    cat <<EOF >> .cargo/config
+    [host]
+    rustflags = "-C target-feature=-crt-static"
+    linker = "${pkgsBuildHost.stdenv.cc}/bin/${pkgsBuildHost.stdenv.cc.targetPrefix}cc"
+    [unstable]
+    host-config = true
+    target-applies-to-host = true
+    EOF
+  '';
+
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
 
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 7cb6f22c949b4..f9068a7999a20 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -147,6 +147,18 @@ in stdenv.mkDerivation rec {
 
     # Useful debugging parameter
     # export VERBOSE=1
+  '' + lib.optionalString (stdenv.targetPlatform.isMusl && !stdenv.targetPlatform.isStatic) ''
+    # Upstream rustc still assumes that musl = static[1].  The fix for
+    # this is to disable crt-static by default for non-static musl
+    # targets.
+    #
+    # Even though Cargo will build build.rs files for the build platform,
+    # cross-compiling _from_ musl appears to work fine, so we only need
+    # to do this when rustc's target platform is dynamically linked musl.
+    #
+    # [1]: https://github.com/rust-lang/compiler-team/issues/422
+    substituteInPlace compiler/rustc_target/src/spec/linux_musl_base.rs \
+        --replace "base.crt_static_default = true" "base.crt_static_default = false"
   '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
     # See https://github.com/jemalloc/jemalloc/issues/1997
     # Using a value of 48 should work on both emulated and native x86_64-darwin.
diff --git a/pkgs/development/libraries/audio/lv2/default.nix b/pkgs/development/libraries/audio/lv2/default.nix
index 6371a52b4dff5..d0f85c95a077f 100644
--- a/pkgs/development/libraries/audio/lv2/default.nix
+++ b/pkgs/development/libraries/audio/lv2/default.nix
@@ -1,45 +1,59 @@
 { stdenv
 , lib
 , fetchurl
-, libsndfile
-, pkg-config
-, python3
-, wafHook
+, meson
+, ninja
+
 , pipewire
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "lv2";
-  version = "1.18.2";
+  version = "1.18.10";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "https://lv2plug.in/spec/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-TokfvHRMBYVb6136gugisUkX3Wbpj4K4Iw29HHqy4F4=";
+    url = "https://lv2plug.in/spec/${pname}-${version}.tar.xz";
+    hash = "sha256-eMUbzyG1Tli7Yymsy7Ta4Dsu15tSD5oB5zS9neUwlT8=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
-    pkg-config
-    wafHook
-    python3
+    meson
+    ninja
   ];
 
-  buildInputs = [
-    libsndfile
-    python3
-  ];
+  buildInputs = [ ];
 
-  wafConfigureFlags = [
-    "--includedir=${placeholder "dev"}/include"
+  mesonFlags = [
+    # install validators to $dev
     "--bindir=${placeholder "dev"}/bin"
+
+    # These are just example plugins. They pull in outdated gtk-2
+    # dependency and many other things. Upstream would like to
+    # eventually move them of the project:
+    #   https://gitlab.com/lv2/lv2/-/issues/57#note_1096060029
+    "-Dplugins=disabled"
+    # Pulls in spell checkers among other things.
+    "-Dtests=disabled"
+    # Avoid heavyweight python dependencies.
+    "-Ddocs=disabled"
   ] ++ lib.optionals stdenv.isDarwin [
-    "--lv2dir=${placeholder "out"}/lib/lv2"
+    "-Dlv2dir=${placeholder "out"}/lib/lv2"
   ];
-  dontAddWafCrossFlags = true;
 
-  passthru.tests = {
-    inherit pipewire;
+  passthru = {
+    tests = {
+      inherit pipewire;
+    };
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://gitlab.com/lv2/lv2.git";
+      rev-prefix = "v";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 20856f2ad9b86..f984f33103001 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.14.4";
+  version = "1.14.6";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.xz";
-    sha256 = "sha256-fA+bjl7A/yR5OD5iwAhKOimvme3xUU6fZZuBsw1ONT4=";
+    sha256 = "sha256-/SvfG7idw2WkZTG/9jFTbyKw0cbVzixcXlm1UmWz1ms=";
   };
 
   patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 10ef8e5395a38..afbfa53495223 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.4";
+  version = "1.2.5";
   pname = "libnftnl";
 
   src = fetchurl {
-    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-wP4jO+TN/XA+fVl37462P8vx0AUrYEThsj1HyjViR38=";
+    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
+    hash = "sha256-lm3gqBIMilPbhZiJdJNov7LLoMTwtMGjDSZOzMRfEiY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libomxil-bellagio/default.nix b/pkgs/development/libraries/libomxil-bellagio/default.nix
index 694625c8af818..4f129dc137812 100644
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@@ -33,7 +33,8 @@ stdenv.mkDerivation rec {
   doCheck = false; # fails
 
   env.NIX_CFLAGS_COMPILE =
-    if stdenv.cc.isGNU then "-Wno-error=array-bounds -Wno-error=stringop-overflow=8"
+    # stringop-truncation: see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1028978
+    if stdenv.cc.isGNU then "-Wno-error=array-bounds -Wno-error=stringop-overflow=8 -Wno-error=stringop-truncation"
     else "-Wno-error=absolute-value -Wno-error=enum-conversion -Wno-error=logical-not-parentheses -Wno-error=non-literal-null-conversion";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 0f429062e48c8..04c8a0f16ad8d 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -4,6 +4,7 @@
 , flex
 , bison
 , bluez
+, libnl
 , libxcrypt
 , pkg-config
 , withBluez ? false
@@ -19,10 +20,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-KoiFxANRbPewkz7UsU1sqjDgIFJInr1BTcdaxS51WeY=";
   };
 
-  buildInputs = lib.optionals withRemote [ libxcrypt ];
+  buildInputs = lib.optionals stdenv.isLinux [ libnl ]
+    ++ lib.optionals withRemote [ libxcrypt ];
 
   nativeBuildInputs = [ flex bison ]
-    ++ lib.optionals withBluez [ bluez.dev pkg-config ];
+    ++ lib.optionals stdenv.isLinux [ pkg-config ]
+    ++ lib.optionals withBluez [ bluez.dev ];
 
   # We need to force the autodetection because detection doesn't
   # work in pure build environments.
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index a319de5ce6b25..0dc795a96d843 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -1,20 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, autogen, flac, libogg, libopus, libvorbis, pkg-config, python3
-, Carbon, AudioToolbox
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, autogen, pkg-config, python3
+, flac, lame, libmpg123, libogg, libopus, libvorbis
+, alsa-lib, Carbon, AudioToolbox
 }:
 
 stdenv.mkDerivation rec {
   pname = "libsndfile";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-bhIXVSKuUnUzs5aaLDHt21RcnqekEpLU414sFtl2Lro=";
+    hash = "sha256-zd0HDUzVYLyFjhIudBJQaKJUtYMjZeQRLALSkyD9tXU=";
   };
 
   nativeBuildInputs = [ autoreconfHook autogen pkg-config python3 ];
-  buildInputs = [ flac libogg libopus libvorbis ]
+  buildInputs = [ flac lame libmpg123 libogg libopus libvorbis ]
+    ++ lib.optionals stdenv.isLinux [ alsa-lib ]
     ++ lib.optionals stdenv.isDarwin [ Carbon AudioToolbox ];
 
   enableParallelBuilding = true;
@@ -34,6 +36,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A C library for reading and writing files containing sampled sound";
     homepage    = "https://libsndfile.github.io/libsndfile/";
+    changelog   = "https://github.com/libsndfile/libsndfile/releases/tag/${version}";
     license     = licenses.lgpl2Plus;
     maintainers = with maintainers; [ lovek323 ];
     platforms   = platforms.unix;
diff --git a/pkgs/development/libraries/libvmaf/default.nix b/pkgs/development/libraries/libvmaf/default.nix
index c0fc4d1556f3c..55a08d59ed807 100644
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm, xxd }:
 
 stdenv.mkDerivation rec {
   pname = "libvmaf";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ meson ninja nasm ];
+  nativeBuildInputs = [ meson ninja nasm xxd ];
 
   mesonFlags = [ "-Denable_avx512=true" ];
 
diff --git a/pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh b/pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh
index 4ca11a223de25..0f17856b4c7d3 100644
--- a/pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh
+++ b/pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh
@@ -17,9 +17,9 @@ fixQtBuiltinPaths() {
             if grep -q '\$\$\[QT_' "${pr_:?}"; then
                 echo "fixQtBuiltinPaths: Fixing Qt builtin paths in \`${pr_:?}'..."
                 sed -i "${pr_:?}" \
-                    -e "s|\\\$\\\$\\[QT_HOST_BINS[^]]*\\]|$dev/bin|g" \
+                    -e "s|\\\$\\\$\\[QT_HOST_BINS[^]]*\\]|"'$$'"NIX_OUTPUT_DEV/bin|g" \
                     -e "s|\\\$\\\$\\[QT_HOST_DATA[^]]*\\]/mkspecs|$dev/mkspecs|g" \
-                    -e "s|\\\$\\\$\\[QT_HOST_PREFIX[^]]*\\]|$dev|g" \
+                    -e "s|\\\$\\\$\\[QT_HOST_PREFIX[^]]*\\]|"'$$'"NIX_OUTPUT_DEV|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_ARCHDATA[^]]*\\]|$lib|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_BINS[^]]*\\]|$bin/bin|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_CONFIGURATION[^]]*\\]|$bin|g" \
@@ -30,7 +30,7 @@ fixQtBuiltinPaths() {
                     -e "s|\\\$\\\$\\[QT_INSTALL_LIBS[^]]*\\]|$lib/lib|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_LIBEXECS[^]]*\\]|$lib/libexec|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_PLUGINS[^]]*\\]|$bin/$qtPluginPrefix|g" \
-                    -e "s|\\\$\\\$\\[QT_INSTALL_PREFIX[^]]*\\]|$lib|g" \
+                    -e "s|\\\$\\\$\\[QT_INSTALL_PREFIX[^]]*\\]|"'$$'"NIX_OUTPUT_LIB|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_TESTS[^]]*\\]|$dev/tests|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_TRANSLATIONS[^]]*\\]|$lib/translations|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_QML[^]]*\\]|$bin/$qtQmlPrefix|g"
@@ -40,9 +40,9 @@ fixQtBuiltinPaths() {
         if grep -q '\$\$\[QT_' "${dir:?}"; then
             echo "fixQtBuiltinPaths: Fixing Qt builtin paths in \`${dir:?}'..."
             sed -i "${dir:?}" \
-                -e "s|\\\$\\\$\\[QT_HOST_BINS[^]]*\\]|$dev/bin|g" \
+                -e "s|\\\$\\\$\\[QT_HOST_BINS[^]]*\\]|"'$$'"NIX_OUTPUT_DEV/bin|g" \
                 -e "s|\\\$\\\$\\[QT_HOST_DATA[^]]*\\]/mkspecs|$dev/mkspecs|g" \
-                -e "s|\\\$\\\$\\[QT_HOST_PREFIX[^]]*\\]|$dev|g" \
+                -e "s|\\\$\\\$\\[QT_HOST_PREFIX[^]]*\\]|"'$$'"NIX_OUTPUT_DEV|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_ARCHDATA[^]]*\\]|$lib|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_BINS[^]]*\\]|$bin/bin|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_CONFIGURATION[^]]*\\]|$bin|g" \
@@ -53,7 +53,7 @@ fixQtBuiltinPaths() {
                 -e "s|\\\$\\\$\\[QT_INSTALL_LIBS[^]]*\\]|$lib/lib|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_LIBEXECS[^]]*\\]|$lib/libexec|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_PLUGINS[^]]*\\]|$bin/$qtPluginPrefix|g" \
-                -e "s|\\\$\\\$\\[QT_INSTALL_PREFIX[^]]*\\]|$lib|g" \
+                -e "s|\\\$\\\$\\[QT_INSTALL_PREFIX[^]]*\\]|"'$$'"NIX_OUTPUT_LIB|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_TESTS[^]]*\\]|$dev/tests|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_TRANSLATIONS[^]]*\\]|$lib/translations|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_QML[^]]*\\]|$bin/$qtQmlPrefix|g"
diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index 0d30f0e26653c..56607df6b4b95 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -22,6 +22,9 @@ qmakePrePhase() {
         qmakeFlags+=( "CONFIG+=release" )
     fi
 
+    # do the stripping ourselves (needed for separateDebugInfo)
+    qmakeFlags+=( "CONFIG+=nostrip" )
+
     qmakeFlags+=( "${qmakeFlags_orig[@]}" )
 }
 prePhases+=" qmakePrePhase"
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index d74bf46dd6c81..8b5d497c5e9a0 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -216,7 +216,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-shared"
     "-accessibility"
     "-optimized-qmake"
-    "-strip"
+    # for separateDebugInfo
+    "-no-strip"
     "-system-proxies"
     "-pkg-config"
 
diff --git a/pkgs/development/perl-modules/Po4a/default.nix b/pkgs/development/perl-modules/Po4a/default.nix
index 99c100455a8a0..f08b5b2361a3b 100644
--- a/pkgs/development/perl-modules/Po4a/default.nix
+++ b/pkgs/development/perl-modules/Po4a/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, lib, fetchurl, docbook_xsl, docbook_xsl_ns, gettext, libxslt, glibcLocales, docbook_xml_dtd_412, docbook_sgml_dtd_41, texlive, opensp, bash
+{ stdenv, lib, fetchurl, docbook_xsl, docbook_xsl_ns, gettext, libxslt, glibcLocales, docbook_xml_dtd_412, docbook_sgml_dtd_41, opensp, bash
 , perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny
-, fetchpatch
+, fetchpatch, writeShellScriptBin
 }:
 
 buildPerlPackage rec {
@@ -20,7 +20,15 @@ buildPerlPackage rec {
   ];
 
   strictDeps = true;
-  nativeBuildInputs = [ gettext libxslt docbook_xsl docbook_xsl_ns ModuleBuild docbook_xml_dtd_412 docbook_sgml_dtd_41 opensp texlive.combined.scheme-basic glibcLocales ];
+  nativeBuildInputs =
+    # the tests for the tex-format use kpsewhich -- texlive's file finding utility.
+    # We don't want to depend on texlive here, so we replace it with a minimal
+    # shellscript that suffices for the tests in t/fmt/tex/, i.e. it looks up
+    # article.cls to an existing file, but doesn't find article-wrong.cls.
+    let kpsewhich-stub = writeShellScriptBin "kpsewhich"
+      ''[[ $1 = "article.cls" ]] && echo /dev/null'';
+    in
+    [ gettext libxslt docbook_xsl docbook_xsl_ns ModuleBuild docbook_xml_dtd_412 docbook_sgml_dtd_41 opensp kpsewhich-stub glibcLocales ];
   propagatedBuildInputs = lib.optional (!stdenv.hostPlatform.isMusl) TextWrapI18N ++ [ LocaleGettext SGMLSpm UnicodeLineBreak PodParser YAMLTiny ];
   # TODO: TermReadKey was temporarily removed from propagatedBuildInputs to unfreeze the build
   buildInputs = [ bash ];
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 5532816a9c128..c77c31faa9603 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -42,15 +42,19 @@ buildPythonPackage rec {
   # - cpu_times was flaky on darwin
   # - the other disabled tests are likely due to sanboxing (missing specific errors)
   pytestFlagsArray = [
+    # Note: $out must be referenced as test import paths are relative
     "$out/${python.sitePackages}/psutil/tests/test_system.py"
   ];
 
-  # Note: $out must be referenced as test import paths are relative
   disabledTests = [
+    # Some of the tests have build-system hardware-based impurities (like
+    # reading temperature sensor values).  Disable them to avoid the failures
+    # that sometimes result.
     "cpu_freq"
     "cpu_times"
     "disk_io_counters"
     "sensors_battery"
+    "sensors_temperatures"
     "user"
     "test_disk_partitions" # problematic on Hydra's Linux builders, apparently
   ];
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index a5154a3e4abd9..9727c4f2ada8d 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.10.3";
+  version = "2.10.4";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Rlr6Ec6BEujTxQkQ9UP+6u0cYeFsJlj7U346MtRM6QM=";
+    hash = "sha256-n7nLEG2+sSR9wnxM+C8FWc2B+Mx74Pan1+IQf+h2bGU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tensorflow/bin.nix b/pkgs/development/python-modules/tensorflow/bin.nix
index c9ed92712166e..ad59074370818 100644
--- a/pkgs/development/python-modules/tensorflow/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/bin.nix
@@ -22,7 +22,6 @@
 , tensorboard
 , cudaSupport ? false
 , cudaPackages ? {}
-, patchelfUnstable
 , zlib
 , python
 , keras-applications
@@ -84,8 +83,7 @@ in buildPythonPackage {
   ] ++ lib.optional (!isPy3k) mock
     ++ lib.optionals (pythonOlder "3.4") [ backports_weakref ];
 
-  # remove patchelfUnstable once patchelf 0.14 with https://github.com/NixOS/patchelf/pull/256 becomes the default
-  nativeBuildInputs = [ wheel ] ++ lib.optionals cudaSupport [ addOpenGLRunpath patchelfUnstable ];
+  nativeBuildInputs = [ wheel ] ++ lib.optionals cudaSupport [ addOpenGLRunpath ];
 
   preConfigure = ''
     unset SOURCE_DATE_EPOCH
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 0b0946f110126..1d3d8c1bc28ac 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -1,5 +1,5 @@
 { stdenv, bazel_5, buildBazelPackage, isPy3k, lib, fetchFromGitHub, symlinkJoin
-, addOpenGLRunpath, fetchpatch, patchelfUnstable
+, addOpenGLRunpath, fetchpatch
 # Python deps
 , buildPythonPackage, pythonOlder, python
 # Python libraries
@@ -509,8 +509,7 @@ in buildPythonPackage {
     tensorboard
   ];
 
-  # remove patchelfUnstable once patchelf 0.14 with https://github.com/NixOS/patchelf/pull/256 becomes the default
-  nativeBuildInputs = lib.optionals cudaSupport [ addOpenGLRunpath patchelfUnstable ];
+  nativeBuildInputs = lib.optionals cudaSupport [ addOpenGLRunpath ];
 
   postFixup = lib.optionalString cudaSupport ''
     find $out -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 749ccf0a29c73..e123240c6330f 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.8";
-  source.sha256 = "sha256-/oLW+JPyFz4TIykm4rnOtvZwJ8fxZr/B49bsfZaZoWQ=";
+  version = "2.4.9";
+  source.sha256 = "sha256-biRQBhoRrRwbkxVR7Se6YOnqzuFI4l4dc6Z92JRFhNM=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index 839548ae8ffd0..1860e150ca1ae 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -160,40 +160,96 @@ in rec {
     };
   };
 
-  overrides = super: {
-    CoreFoundation = lib.overrideDerivation super.CoreFoundation (drv: {
-      setupHook = ./cf-setup-hook.sh;
-    });
-
-    # This framework doesn't exist in newer SDKs (somewhere around 10.13), but
-    # there are references to it in nixpkgs.
-    QuickTime = throw "QuickTime framework not available";
-
-    # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
-    JavaVM = super.JavaNativeFoundation;
-
-    CoreVideo = lib.overrideDerivation super.CoreVideo (drv: {
-      installPhase = drv.installPhase + ''
-        # When used as a module, complains about a missing import for
-        # Darwin.C.stdint. Apparently fixed in later SDKs.
-        awk -i inplace '/CFBase.h/ { print "#include <stdint.h>" } { print }' \
-          $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
-      '';
-    });
-  };
-
-  bareFrameworks = (
-    lib.mapAttrs framework (import ./frameworks.nix {
+  frameworks = let
+    # Dependency map created by gen-frameworks.py.
+    generatedDeps = import ./frameworks.nix {
       inherit frameworks libs;
+    };
+
+    # Additional dependencies that are not picked up by gen-frameworks.py.
+    # Some of these are simply private frameworks the generator does not see.
+    extraDeps = with libs; with frameworks; let
       inherit (pkgs.darwin.apple_sdk_11_0) libnetwork;
       libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
-    })
-  ) // (
-    lib.mapAttrs privateFramework (import ./private-frameworks.nix {
-      inherit frameworks;
-      libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
-    })
-  );
+    in {
+      # Below this comment are entries migrated from before the generator was
+      # added. If, for a given framework, you are able to reverify the extra
+      # deps are really necessary on top of the generator deps, move it above
+      # this comment (and maybe document your findings).
+      AVFoundation            = { inherit ApplicationServices AVFCapture AVFCore; };
+      Accelerate              = { inherit CoreWLAN IOBluetooth; };
+      AddressBook             = { inherit AddressBookCore ContactsPersistence libobjc; };
+      AppKit                  = { inherit AudioToolbox AudioUnit UIFoundation; };
+      AudioToolbox            = { inherit AudioToolboxCore; };
+      AudioUnit               = { inherit Carbon CoreAudio; };
+      Carbon                  = { inherit IOKit QuartzCore libobjc; };
+      CoreAudio               = { inherit IOKit; };
+      CoreFoundation          = { inherit libobjc; };
+      CoreGraphics            = { inherit SystemConfiguration; };
+      CoreMIDIServer          = { inherit CoreMIDI; };
+      CoreMedia               = { inherit ApplicationServices AudioToolbox AudioUnit; };
+      CoreServices            = { inherit CoreAudio NetFS ServiceManagement; };
+      CoreWLAN                = { inherit SecurityFoundation; };
+      DiscRecording           = { inherit IOKit libobjc; };
+      Foundation              = { inherit SystemConfiguration libobjc; };
+      GameKit                 = { inherit GameCenterFoundation GameCenterUI GameCenterUICore ReplayKit; };
+      ICADevices              = { inherit Carbon libobjc; };
+      IOBluetooth             = { inherit CoreBluetooth; };
+      JavaScriptCore          = { inherit libobjc; };
+      Kernel                  = { inherit IOKit; };
+      LinkPresentation        = { inherit URLFormatting; };
+      MediaToolbox            = { inherit AudioUnit; };
+      MetricKit               = { inherit SignpostMetrics; };
+      Network                 = { inherit libnetwork; };
+      PCSC                    = { inherit CoreData; };
+      PassKit                 = { inherit PassKitCore; };
+      QTKit                   = { inherit CoreMedia CoreMediaIO MediaToolbox VideoToolbox; };
+      Quartz                  = { inherit QTKit; };
+      QuartzCore              = { inherit ApplicationServices CoreImage CoreVideo Metal OpenCL libobjc; };
+      Security                = { inherit IOKit libDER; };
+      TWAIN                   = { inherit Carbon; };
+      VideoDecodeAcceleration = { inherit CoreVideo; };
+      WebKit                  = { inherit ApplicationServices Carbon libobjc; };
+    };
 
-  frameworks = bareFrameworks // overrides bareFrameworks;
+    # Overrides for framework derivations.
+    overrides = super: {
+      CoreFoundation = lib.overrideDerivation super.CoreFoundation (drv: {
+        setupHook = ./cf-setup-hook.sh;
+      });
+
+      # This framework doesn't exist in newer SDKs (somewhere around 10.13), but
+      # there are references to it in nixpkgs.
+      QuickTime = throw "QuickTime framework not available";
+
+      # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
+      JavaVM = super.JavaNativeFoundation;
+
+      CoreVideo = lib.overrideDerivation super.CoreVideo (drv: {
+        installPhase = drv.installPhase + ''
+          # When used as a module, complains about a missing import for
+          # Darwin.C.stdint. Apparently fixed in later SDKs.
+          awk -i inplace '/CFBase.h/ { print "#include <stdint.h>" } { print }' \
+            $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
+        '';
+      });
+    };
+
+    # Merge extraDeps into generatedDeps.
+    deps = generatedDeps // (
+      lib.mapAttrs
+        (name: deps: generatedDeps.${name} // deps)
+        extraDeps
+    );
+
+    # Create derivations, and add private frameworks.
+    bareFrameworks = (lib.mapAttrs framework deps) // (
+      lib.mapAttrs privateFramework (import ./private-frameworks.nix {
+        inherit frameworks;
+        libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
+      })
+    );
+  in
+    # Apply derivation overrides.
+    bareFrameworks // overrides bareFrameworks;
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 8c9e16a6ca9a9..1133cca002a8b 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -31,10 +31,7 @@ let
     };
 
     installPhase = ''
-      cd Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk
-
-      mkdir $out
-      cp -r System usr $out/
+      mv Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk $out
     '';
   };
 
@@ -49,10 +46,7 @@ let
     };
 
     installPhase = ''
-      cd Library/Developer/CommandLineTools
-
-      mkdir $out
-      cp -r Library usr $out/
+      mv Library/Developer/CommandLineTools $out
     '';
   };
 
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
index 59cbc2b1063a1..fa6945f76718f 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -1,193 +1,196 @@
-{ frameworks, libs, libobjc, libnetwork }: with frameworks; with libs;
+# This file is generated by gen-frameworks.nix.
+# Do not edit, put overrides in apple_sdk.nix instead.
+{ libs, frameworks }: with libs; with frameworks;
 {
   AGL                              = { inherit Carbon OpenGL; };
-  AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics simd UniformTypeIdentifiers; };
-  AVKit                            = {};
-  Accelerate                       = { inherit CoreWLAN IOBluetooth; };
-  Accessibility                    = {};
-  Accounts                         = {};
-  AdSupport                        = {};
-  AddressBook                      = { inherit AddressBookCore Carbon ContactsPersistence libobjc; };
-  AppKit                           = { inherit ApplicationServices AudioToolbox AudioUnit Foundation QuartzCore UIFoundation; };
-  AppTrackingTransparency          = {};
+  AVFoundation                     = { inherit AudioToolbox CoreAudio CoreAudioTypes CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia CoreVideo Foundation IOKit ImageIO MediaToolbox Metal QuartzCore UniformTypeIdentifiers simd; };
+  AVKit                            = { inherit AVFoundation AppKit Cocoa Foundation; };
+  Accelerate                       = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  Accessibility                    = { inherit CoreGraphics Foundation; };
+  Accounts                         = { inherit Foundation; };
+  AdServices                       = { inherit Foundation; };
+  AdSupport                        = { inherit Foundation; };
+  AddressBook                      = { inherit Carbon Cocoa CoreFoundation Foundation; };
+  AppKit                           = { inherit ApplicationServices CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal OpenGL QuartzCore; };
+  AppTrackingTransparency          = { inherit Foundation; };
   AppleScriptKit                   = {};
-  AppleScriptObjC                  = {};
-  ApplicationServices              = { inherit ColorSync CoreGraphics CoreServices CoreText ImageIO; };
-  AudioToolbox                     = { inherit AudioToolboxCore CoreAudio CoreMIDI; };
-  AudioUnit                        = { inherit AudioToolbox Carbon CoreAudio; };
-  AudioVideoBridging               = { inherit Foundation; };
-  AuthenticationServices           = {};
-  AutomaticAssessmentConfiguration = {};
-  Automator                        = {};
-  BackgroundTasks                  = {};
-  BusinessChat                     = {};
-  CFNetwork                        = {};
+  AppleScriptObjC                  = { inherit Foundation; };
+  ApplicationServices              = { inherit ColorSync CoreFoundation CoreGraphics CoreServices CoreText ImageIO; };
+  AudioToolbox                     = { inherit Carbon CoreAudio CoreAudioTypes CoreFoundation CoreMIDI Foundation; };
+  AudioUnit                        = { inherit AudioToolbox; };
+  AudioVideoBridging               = { inherit Foundation IOKit; };
+  AuthenticationServices           = { inherit AppKit Foundation; };
+  AutomaticAssessmentConfiguration = { inherit Foundation; };
+  Automator                        = { inherit AppKit Cocoa Foundation OSAKit; };
+  BackgroundTasks                  = { inherit Foundation; };
+  BusinessChat                     = { inherit Cocoa Foundation; };
+  CFNetwork                        = { inherit CoreFoundation; };
   CalendarStore                    = {};
-  CallKit                          = {};
-  Carbon                           = { inherit ApplicationServices CoreServices Foundation IOKit QuartzCore Security libobjc; };
-  ClassKit                         = {};
-  CloudKit                         = { inherit CoreLocation; };
-  Cocoa                            = { inherit AppKit CoreData; };
-  Collaboration                    = {};
-  ColorSync                        = {};
+  CallKit                          = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Carbon                           = { inherit ApplicationServices CoreServices Foundation Security; };
+  ClassKit                         = { inherit CoreGraphics Foundation; };
+  CloudKit                         = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
+  Cocoa                            = { inherit AppKit CoreData Foundation; };
+  Collaboration                    = { inherit AppKit CoreServices Foundation; };
+  ColorSync                        = { inherit CoreFoundation; };
   Combine                          = {};
-  Contacts                         = {};
-  ContactsUI                       = {};
-  CoreAudio                        = { inherit IOKit CoreAudioTypes; };
-  CoreAudioKit                     = { inherit AudioUnit; };
-  CoreAudioTypes                   = {};
-  CoreBluetooth                    = {};
-  CoreData                         = { inherit CloudKit; };
+  Contacts                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ContactsUI                       = { inherit AppKit; };
+  CoreAudio                        = { inherit CoreAudioTypes CoreFoundation; };
+  CoreAudioKit                     = { inherit AppKit AudioUnit Cocoa Foundation; };
+  CoreAudioTypes                   = { inherit CoreFoundation; };
+  CoreBluetooth                    = { inherit Foundation; };
+  CoreData                         = { inherit CloudKit Combine CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
   CoreDisplay                      = {};
-  CoreFoundation                   = { inherit libobjc; };
-  CoreGraphics                     = { inherit Accelerate IOKit IOSurface SystemConfiguration; };
-  CoreHaptics                      = {};
-  CoreImage                        = {};
-  CoreLocation                     = {};
-  CoreMIDI                         = {};
-  CoreMIDIServer                   = { inherit CoreMIDI; };
-  CoreML                           = {};
-  CoreMedia                        = { inherit ApplicationServices AudioToolbox AudioUnit CoreAudio CoreGraphics CoreVideo; };
-  CoreMediaIO                      = { inherit CoreMedia; };
-  CoreMotion                       = {};
-  CoreServices                     = { inherit CFNetwork CoreAudio CoreData CoreFoundation DiskArbitration NetFS OpenDirectory Security ServiceManagement; };
-  CoreSpotlight                    = {};
+  CoreFoundation                   = {};
+  CoreGraphics                     = { inherit CoreFoundation IOKit; };
+  CoreHaptics                      = { inherit Foundation; };
+  CoreImage                        = { inherit ApplicationServices CoreFoundation CoreGraphics CoreVideo Foundation IOKit IOSurface ImageIO Metal OpenGL; };
+  CoreLocation                     = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDI                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDIServer                   = {};
+  CoreML                           = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit ImageIO Metal; };
+  CoreMedia                        = { inherit CoreAudio CoreAudioTypes CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  CoreMediaIO                      = { inherit CoreFoundation CoreMedia; };
+  CoreMotion                       = { inherit Foundation; };
+  CoreServices                     = { inherit CFNetwork CoreFoundation DiskArbitration Security; };
+  CoreSpotlight                    = { inherit Foundation UniformTypeIdentifiers; };
   CoreTelephony                    = {};
-  CoreText                         = { inherit CoreGraphics; };
-  CoreVideo                        = { inherit ApplicationServices CoreGraphics IOSurface OpenGL; };
-  CoreWLAN                         = { inherit SecurityFoundation; };
-  CryptoKit                        = {};
-  CryptoTokenKit                   = {};
-  DVDPlayback                      = {};
-  DeveloperToolsSupport            = {};
-  DeviceCheck                      = {};
-  DirectoryService                 = {};
-  DiscRecording                    = { inherit CoreServices IOKit libobjc; };
-  DiscRecordingUI                  = {};
-  DiskArbitration                  = { inherit IOKit; };
+  CoreText                         = { inherit CoreFoundation CoreGraphics; };
+  CoreVideo                        = { inherit ApplicationServices CoreFoundation CoreGraphics IOSurface Metal OpenGL; };
+  CoreWLAN                         = { inherit Foundation IOKit; };
+  CryptoKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit LocalAuthentication Security; };
+  CryptoTokenKit                   = { inherit CoreFoundation CoreGraphics Foundation IOKit Security; };
+  DVDPlayback                      = { inherit ApplicationServices CoreFoundation Security; };
+  DeveloperToolsSupport            = { inherit Foundation; };
+  DeviceCheck                      = { inherit Foundation; };
+  DirectoryService                 = { inherit CoreFoundation; };
+  DiscRecording                    = { inherit CoreServices Foundation; };
+  DiscRecordingUI                  = { inherit Carbon Cocoa DiscRecording; };
+  DiskArbitration                  = { inherit CoreFoundation IOKit; };
   DriverKit                        = {};
-  EventKit                         = {};
-  ExceptionHandling                = {};
-  ExecutionPolicy                  = {};
-  ExternalAccessory                = {};
-  FWAUserLib                       = {};
-  FileProvider                     = {};
-  FileProviderUI                   = {};
-  FinderSync                       = {};
-  ForceFeedback                    = { inherit IOKit; };
-  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration Combine libobjc; };
-  GLKit                            = {};
+  EventKit                         = { inherit CoreGraphics CoreLocation Foundation; };
+  ExceptionHandling                = { inherit Foundation; };
+  ExecutionPolicy                  = { inherit Foundation; };
+  ExternalAccessory                = { inherit Foundation; };
+  FWAUserLib                       = { inherit IOKit; };
+  FileProvider                     = { inherit CoreGraphics Foundation; };
+  FileProviderUI                   = { inherit AppKit FileProvider Foundation; };
+  FinderSync                       = { inherit AppKit Foundation; };
+  ForceFeedback                    = { inherit CoreFoundation IOKit; };
+  Foundation                       = { inherit ApplicationServices Combine CoreFoundation CoreGraphics CoreServices IOKit Security; };
+  GLKit                            = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal ModelIO OpenGL QuartzCore simd; };
   GLUT                             = { inherit OpenGL; };
-  GSS                              = {};
-  GameController                   = {};
-  GameKit                          = { inherit Cocoa Foundation GameCenterFoundation GameCenterUI GameCenterUICore GameController GameplayKit Metal MetalKit ModelIO ReplayKit SceneKit SpriteKit; };
-  GameplayKit                      = {};
-  HIDDriverKit                     = {};
+  GSS                              = { inherit CoreFoundation; };
+  GameController                   = { inherit AppKit Foundation IOKit; };
+  GameKit                          = { inherit AppKit Cocoa Contacts CoreGraphics Foundation GameController GameplayKit Metal MetalKit ModelIO SceneKit SpriteKit simd; };
+  GameplayKit                      = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore SceneKit SpriteKit simd; };
+  HIDDriverKit                     = { inherit IOKit USBDriverKit; };
   Hypervisor                       = {};
-  ICADevices                       = { inherit Carbon IOBluetooth libobjc; };
-  IMServicePlugIn                  = {};
-  IOBluetooth                      = { inherit CoreBluetooth IOKit; };
-  IOBluetoothUI                    = { inherit IOBluetooth; };
-  IOKit                            = {};
-  IOSurface                        = { inherit IOKit; };
-  IOUSBHost                        = {};
-  IdentityLookup                   = {};
-  ImageCaptureCore                 = {};
-  ImageIO                          = { inherit CoreGraphics; };
-  InputMethodKit                   = { inherit Carbon; };
+  ICADevices                       = { inherit CoreFoundation CoreGraphics CoreServices IOBluetooth; };
+  IMServicePlugIn                  = { inherit Foundation; };
+  IOBluetooth                      = { inherit CoreAudio CoreFoundation CoreServices Foundation IOKit; };
+  IOBluetoothUI                    = { inherit Cocoa IOBluetooth; };
+  IOKit                            = { inherit CoreFoundation; };
+  IOSurface                        = { inherit CoreFoundation Foundation IOKit; };
+  IOUSBHost                        = { inherit Foundation IOKit; };
+  IdentityLookup                   = { inherit Foundation; };
+  ImageCaptureCore                 = { inherit Cocoa CoreGraphics Foundation; };
+  ImageIO                          = { inherit CoreFoundation CoreGraphics; };
+  InputMethodKit                   = { inherit Carbon Cocoa Foundation; };
   InstallerPlugins                 = {};
   InstantMessage                   = {};
-  Intents                          = {};
-  JavaNativeFoundation             = {};
-  JavaRuntimeSupport               = {};
-  JavaScriptCore                   = { inherit libobjc; };
+  Intents                          = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
+  JavaNativeFoundation             = { inherit Foundation; };
+  JavaRuntimeSupport               = { inherit ApplicationServices Cocoa Foundation QuartzCore; };
+  JavaScriptCore                   = { inherit CoreFoundation CoreGraphics Foundation; };
   Kerberos                         = {};
-  Kernel                           = { inherit IOKit; };
-  KernelManagement                 = {};
+  Kernel                           = {};
+  KernelManagement                 = { inherit Foundation; };
   LDAP                             = {};
-  LatentSemanticMapping            = { inherit Carbon; };
-  LinkPresentation                 = { inherit URLFormatting; };
-  LocalAuthentication              = {};
-  MLCompute                        = {};
-  MapKit                           = {};
-  MediaAccessibility               = { inherit CoreGraphics CoreText QuartzCore; };
-  MediaLibrary                     = {};
-  MediaPlayer                      = {};
-  MediaToolbox                     = { inherit AudioToolbox AudioUnit CoreMedia; };
+  LatentSemanticMapping            = { inherit Carbon CoreFoundation; };
+  LinkPresentation                 = { inherit AppKit Foundation; };
+  LocalAuthentication              = { inherit Foundation; };
+  MLCompute                        = { inherit CoreFoundation CoreGraphics Foundation IOKit Metal; };
+  MapKit                           = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  MediaAccessibility               = { inherit CoreFoundation CoreGraphics CoreText QuartzCore; };
+  MediaLibrary                     = { inherit Foundation; };
+  MediaPlayer                      = { inherit AVFoundation CoreGraphics Foundation; };
+  MediaToolbox                     = { inherit AudioToolbox CoreFoundation CoreMedia; };
   Message                          = {};
-  Metal                            = {};
-  MetalKit                         = { inherit Metal ModelIO; };
-  MetalPerformanceShaders          = {};
-  MetalPerformanceShadersGraph     = {};
-  MetricKit                        = { inherit SignpostMetrics; };
-  ModelIO                          = {};
-  MultipeerConnectivity            = {};
-  NaturalLanguage                  = {};
-  NearbyInteraction                = {};
-  NetFS                            = {};
-  Network                          = { inherit libnetwork; };
-  NetworkExtension                 = { inherit Network; };
+  Metal                            = { inherit CoreFoundation CoreGraphics Foundation IOKit IOSurface; };
+  MetalKit                         = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal ModelIO QuartzCore simd; };
+  MetalPerformanceShaders          = { inherit CoreGraphics Foundation Metal simd; };
+  MetalPerformanceShadersGraph     = { inherit Foundation MetalPerformanceShaders; };
+  MetricKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ModelIO                          = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  MultipeerConnectivity            = { inherit Cocoa Foundation; };
+  NaturalLanguage                  = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  NearbyInteraction                = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  NetFS                            = { inherit CoreFoundation; };
+  Network                          = { inherit CoreFoundation Foundation Security; };
+  NetworkExtension                 = { inherit Foundation Network Security; };
   NetworkingDriverKit              = {};
-  NotificationCenter               = {};
-  OSAKit                           = { inherit Carbon; };
-  OSLog                            = {};
+  NotificationCenter               = { inherit AppKit Foundation; };
+  OSAKit                           = { inherit Carbon Cocoa; };
+  OSLog                            = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
   OpenAL                           = {};
-  OpenCL                           = { inherit IOSurface OpenGL; };
-  OpenDirectory                    = {};
+  OpenCL                           = { inherit OpenGL; };
+  OpenDirectory                    = { inherit CoreFoundation Foundation; };
   OpenGL                           = {};
-  PCIDriverKit                     = {};
-  PCSC                             = { inherit CoreData; };
-  PDFKit                           = {};
-  ParavirtualizedGraphics          = {};
-  PassKit                          = { inherit PassKitCore; };
-  PencilKit                        = {};
-  Photos                           = {};
-  PhotosUI                         = {};
-  PreferencePanes                  = {};
-  PushKit                          = {};
-  Python                           = {};
-  QTKit                            = { inherit CoreMedia CoreMediaIO MediaToolbox VideoToolbox; };
-  Quartz                           = { inherit QTKit QuartzCore QuickLook PDFKit; };
-  QuartzCore                       = { inherit ApplicationServices CoreImage CoreVideo Metal OpenCL libobjc; };
-  QuickLook                        = { inherit ApplicationServices; };
-  QuickLookThumbnailing            = {};
-  RealityKit                       = {};
-  ReplayKit                        = {};
+  PCIDriverKit                     = { inherit IOKit; };
+  PCSC                             = {};
+  PDFKit                           = { inherit AppKit Cocoa; };
+  ParavirtualizedGraphics          = { inherit AppKit CoreVideo Foundation IOSurface Metal; };
+  PassKit                          = { inherit AppKit Contacts CoreGraphics Foundation; };
+  PencilKit                        = { inherit AppKit CloudKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  Photos                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreLocation CoreMIDI CoreMedia Foundation IOKit ImageIO Metal QuartzCore UniformTypeIdentifiers simd; };
+  PhotosUI                         = { inherit AppKit Foundation MapKit Photos; };
+  PreferencePanes                  = { inherit Cocoa; };
+  PushKit                          = { inherit Foundation; };
+  Python                           = { inherit Carbon; };
+  QTKit                            = {};
+  Quartz                           = { inherit AppKit ApplicationServices Cocoa Foundation ImageCaptureCore OpenGL PDFKit QuartzCore QuickLook; };
+  QuartzCore                       = { inherit CoreFoundation CoreGraphics CoreImage CoreVideo Foundation IOKit Metal OpenGL; };
+  QuickLook                        = { inherit ApplicationServices CoreFoundation; };
+  QuickLookThumbnailing            = { inherit CoreGraphics Foundation UniformTypeIdentifiers; };
+  RealityKit                       = { inherit AVFoundation AppKit AudioToolbox CloudKit Combine CoreAudio CoreData CoreFoundation CoreGraphics CoreImage CoreLocation CoreMIDI CoreText Foundation IOKit Metal MultipeerConnectivity QuartzCore simd; };
+  ReplayKit                        = { inherit AVFoundation AppKit Foundation; };
   Ruby                             = {};
-  SafariServices                   = {};
-  SceneKit                         = {};
-  ScreenSaver                      = {};
-  ScreenTime                       = {};
-  ScriptingBridge                  = {};
-  Security                         = { inherit IOKit libDER; };
-  SecurityFoundation               = { inherit Security; };
-  SecurityInterface                = { inherit Security SecurityFoundation; };
-  SensorKit                        = {};
-  ServiceManagement                = { inherit Security; };
-  Social                           = {};
-  SoundAnalysis                    = {};
-  Speech                           = {};
-  SpriteKit                        = {};
-  StoreKit                         = {};
-  SwiftUI                          = { inherit AppKit DeveloperToolsSupport UniformTypeIdentifiers; };
+  SafariServices                   = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  SceneKit                         = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  ScreenSaver                      = { inherit AppKit Foundation; };
+  ScreenTime                       = { inherit AppKit Foundation; };
+  ScriptingBridge                  = { inherit ApplicationServices CoreServices Foundation; };
+  Security                         = { inherit CoreFoundation; };
+  SecurityFoundation               = { inherit Foundation Security; };
+  SecurityInterface                = { inherit AppKit Cocoa Security SecurityFoundation; };
+  SensorKit                        = { inherit CoreFoundation CoreLocation Foundation; };
+  ServiceManagement                = { inherit CoreFoundation Security; };
+  Social                           = { inherit AppKit Foundation; };
+  SoundAnalysis                    = { inherit AVFoundation CoreML CoreMedia Foundation; };
+  Speech                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia Foundation IOKit Metal QuartzCore UniformTypeIdentifiers simd; };
+  SpriteKit                        = { inherit AppKit CloudKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  StoreKit                         = { inherit AppKit CoreGraphics Foundation; };
+  SwiftUI                          = { inherit AppKit CloudKit Combine CoreData CoreFoundation CoreGraphics CoreImage CoreLocation DeveloperToolsSupport Foundation IOKit Metal QuartzCore UniformTypeIdentifiers; };
   SyncServices                     = {};
   System                           = {};
-  SystemConfiguration              = { inherit Security; };
-  SystemExtensions                 = {};
-  TWAIN                            = { inherit Carbon; };
+  SystemConfiguration              = { inherit CoreFoundation Security; };
+  SystemExtensions                 = { inherit Foundation; };
+  TWAIN                            = {};
   Tcl                              = {};
   Tk                               = {};
-  USBDriverKit                     = {};
-  UniformTypeIdentifiers           = {};
-  UserNotifications                = {};
-  UserNotificationsUI              = {};
-  VideoDecodeAcceleration          = { inherit CoreVideo; };
-  VideoSubscriberAccount           = {};
-  VideoToolbox                     = { inherit CoreMedia CoreVideo; };
-  Virtualization                   = {};
-  Vision                           = {};
-  WebKit                           = { inherit ApplicationServices Carbon JavaScriptCore OpenGL libobjc; };
-  WidgetKit                        = {};
-  iTunesLibrary                    = {};
+  USBDriverKit                     = { inherit IOKit; };
+  UniformTypeIdentifiers           = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  UserNotifications                = { inherit Foundation; };
+  UserNotificationsUI              = { inherit AppKit; };
+  VideoDecodeAcceleration          = {};
+  VideoSubscriberAccount           = { inherit Foundation; };
+  VideoToolbox                     = { inherit CoreFoundation CoreGraphics CoreMedia CoreVideo; };
+  Virtualization                   = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Vision                           = { inherit CoreAudio CoreFoundation CoreGraphics CoreML CoreMedia CoreVideo Foundation IOKit ImageIO Metal simd; };
+  WebKit                           = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit JavaScriptCore Metal OpenGL QuartzCore; };
+  WidgetKit                        = { inherit Combine CoreFoundation CoreGraphics CoreVideo Foundation IOKit Intents Metal SwiftUI; };
+  iTunesLibrary                    = { inherit Foundation; };
   vmnet                            = {};
 }
diff --git a/pkgs/os-specific/darwin/gen-frameworks.py b/pkgs/os-specific/darwin/gen-frameworks.py
new file mode 100755
index 0000000000000..ec2a6c7c16ecd
--- /dev/null
+++ b/pkgs/os-specific/darwin/gen-frameworks.py
@@ -0,0 +1,147 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python -p python3 swiftPackages.swift-unwrapped
+
+"""
+Generate a frameworks.nix for a macOS SDK.
+
+You may point this tool at an Xcode bundled SDK, but more ideal is using the
+SDK from Nixpkgs. For example:
+
+SDK_PATH="$(nix-build --no-link -A darwin.apple_sdk_11_0.MacOSX-SDK)"
+./gen-frameworks.py "$SDK_PATH" > ./new-frameworks.nix
+"""
+
+import json
+import os
+import subprocess
+import sys
+
+ALLOWED_LIBS = ["simd"]
+
+HEADER = """\
+# This file is generated by gen-frameworks.nix.
+# Do not edit, put overrides in apple_sdk.nix instead.
+{ libs, frameworks }: with libs; with frameworks;
+{
+"""
+
+FOOTER = """\
+}
+"""
+
+
+def eprint(*args):
+    print(*args, file=sys.stderr)
+
+
+def name_from_ident(ident):
+    return ident.get("swift", ident.get("clang"))
+
+
+def scan_sdk(sdk):
+    # Find frameworks by scanning the SDK frameworks directory.
+    frameworks = [
+        framework.removesuffix(".framework")
+        for framework in os.listdir(f"{sdk}/System/Library/Frameworks")
+        if not framework.startswith("_")
+    ]
+    frameworks.sort()
+
+    # Determine the longest name for padding output.
+    width = len(max(frameworks, key=len))
+
+    output = HEADER
+
+    for framework in frameworks:
+        deps = []
+
+        # Use Swift to scan dependencies, because a module may have both Clang
+        # and Swift parts. Using Clang only imports the Clang module, whereas
+        # using Swift will usually import both Clang + Swift overlay.
+        #
+        # TODO: The above is an assumption. Not sure if it's possible a Swift
+        # module completely shadows a Clang module. (Seems unlikely)
+        #
+        # TODO: Handle "module 'Foobar' is incompatible with feature 'swift'"
+        #
+        # If there were a similar Clang invocation for scanning, we could fix
+        # the above todos, but that doesn't appear to exist.
+        eprint(f"# scanning {framework}")
+        result = subprocess.run(
+            [
+                "swiftc",
+                "-scan-dependencies",
+                # We provide a source snippet via stdin.
+                "-",
+                # Use the provided SDK.
+                "-sdk",
+                sdk,
+                # This search path is normally added automatically by the
+                # compiler based on the SDK, but we have a patch in place that
+                # removes that for SDKs in /nix/store, because our xcbuild stub
+                # SDK doesn't have the directory.
+                # (swift-prevent-sdk-dirs-warning.patch)
+                "-I",
+                f"{sdk}/usr/lib/swift",
+                # For some reason, 'lib/swift/shims' from both the SDK and
+                # Swift compiler are picked up, causing redefinition errors.
+                # This eliminates the latter.
+                "-resource-dir",
+                f"{sdk}/usr/lib/swift",
+            ],
+            input=f"import {framework}".encode(),
+            stdout=subprocess.PIPE,
+        )
+        if result.returncode != 0:
+            eprint(f"# Scanning {framework} failed (exit code {result.returncode})")
+            result.stdout = b""
+
+        # Parse JSON output.
+        if len(result.stdout) != 0:
+            data = json.loads(result.stdout)
+
+            # Entries in the modules list come in pairs. The first is an
+            # identifier (`{ swift: "foobar" }` or `{ clang: "foobar" }`), and
+            # the second metadata for that module. Here we look for the pair
+            # that matches the framework we're scanning (and ignore the rest).
+            modules = data["modules"]
+            for i in range(0, len(modules), 2):
+                ident, meta = modules[i : i + 2]
+
+                # NOTE: We may match twice, for a Swift module _and_ for a
+                # Clang module. So matching here doesn't break from the loop,
+                # and deps is appended to.
+                if name_from_ident(ident) == framework:
+                    dep_idents = meta["directDependencies"]
+                    deps += [name_from_ident(ident) for ident in dep_idents]
+                    # List unfiltered deps in progress output.
+                    eprint(ident, "->", dep_idents)
+
+        # Filter out modules that are not separate derivations.
+        # Also filter out duplicates (when a Swift overlay imports the Clang module)
+        allowed = frameworks + ALLOWED_LIBS
+        deps = set([dep for dep in deps if dep in allowed])
+
+        # Filter out self-references. (Swift overlay importing Clang module.)
+        if framework in deps:
+            deps.remove(framework)
+
+        # Generate a Nix attribute line.
+        if len(deps) != 0:
+            deps = list(deps)
+            deps.sort()
+            deps = " ".join(deps)
+            output += f"  {framework.ljust(width)} = {{ inherit {deps}; }};\n"
+        else:
+            output += f"  {framework.ljust(width)} = {{}};\n"
+
+    output += FOOTER
+    sys.stdout.write(output)
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        eprint(f"Usage: {sys.argv[0]} <path to MacOSX.sdk>")
+        sys.exit(64)
+
+    scan_sdk(sys.argv[1])
diff --git a/pkgs/os-specific/linux/bpftools/default.nix b/pkgs/os-specific/linux/bpftools/default.nix
index 287ad9d42264b..a23c4eb7b9e66 100644
--- a/pkgs/os-specific/linux/bpftools/default.nix
+++ b/pkgs/os-specific/linux/bpftools/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, linuxHeaders
 , libopcodes, libopcodes_2_38
 , libbfd, libbfd_2_38
 , elfutils, readline
@@ -8,15 +8,12 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftools";
-  version = "5.19.12";
 
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "sha256-xDalSMcxLOb8WjRyy+rYle749ShB++fHH9jki9/isLo=";
-  };
+  inherit (linuxHeaders) version src;
+
+  separateDebugInfo = true;
 
   patches = [
-    ./strip-binary-name.patch
     # fix unknown type name '__vector128' on ppc64le
     ./include-asm-types-for-ppc64le.patch
   ];
diff --git a/pkgs/os-specific/linux/bpftools/strip-binary-name.patch b/pkgs/os-specific/linux/bpftools/strip-binary-name.patch
deleted file mode 100644
index 623e90963bd9b..0000000000000
--- a/pkgs/os-specific/linux/bpftools/strip-binary-name.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Strip path to the binary from prints.
-
-I see no sense in including the full path in outputs like bpftool --version
-Especially as argv[0] may not include it, based on calling via $PATH or not.
---- a/tools/bpf/bpftool/main.c
-+++ b/tools/bpf/bpftool/main.c
-@@ -443 +443,7 @@
--	bin_name = argv[0];
-+	/* Strip the path if any. */
-+	const char *bin_name_slash = strrchr(argv[0], '/');
-+	if (bin_name_slash) {
-+		bin_name = bin_name_slash + 1;
-+	} else {
-+		bin_name = argv[0];
-+	}
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 340ad619ecb6c..26c7b6a9ea34e 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -9,12 +9,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.6";
+  version = "1.0.7";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.xz";
-    hash = "sha256-JAdDDd2CmHZw5I3C/anigLqoMHq+wEqxjWCd89sAXkw=";
+    hash = "sha256-wSrJQf/5ra7fFzZ9XOITeJuYoNMUJ3vCKz1x4QiR9BI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index d49cc314b4a81..41237a953cb88 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.4.1";
+  version = "5.4.2";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "3Rcqy1OGemgBL5TBc4lAGy8nShqlro+Ey/uLfjg+qNM=";
+    sha256 = "sha256-qkmQnL2QKMRmajX6SXX5piA+2YFU+7giPuQ++c7ul8M=";
   };
 
   strictDeps = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dbf47a733ec8c..195ff597b2b94 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -31882,6 +31882,11 @@ with pkgs;
     jack = libjack2;
   };
 
+  libmpg123 = mpg123.override {
+    libOnly = true;
+    withConplay = false;
+  };
+
   mpg321 = callPackage ../applications/audio/mpg321 { };
 
   mpc-cli = callPackage ../applications/audio/mpc {