about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/aether-lv2/default.nix6
-rw-r--r--pkgs/applications/audio/bespokesynth/default.nix4
-rw-r--r--pkgs/applications/audio/calf/default.nix2
-rw-r--r--pkgs/applications/audio/furnace/default.nix6
-rw-r--r--pkgs/applications/audio/helvum/default.nix9
-rw-r--r--pkgs/applications/audio/jack-rack/default.nix2
-rw-r--r--pkgs/applications/audio/jamin/default.nix2
-rw-r--r--pkgs/applications/audio/lsp-plugins/default.nix22
-rw-r--r--pkgs/applications/audio/mimic/default.nix5
-rw-r--r--pkgs/applications/audio/mpg123/default.nix4
-rw-r--r--pkgs/applications/audio/odin2/default.nix5
-rw-r--r--pkgs/applications/audio/opusfile/default.nix11
-rw-r--r--pkgs/applications/audio/stochas/default.nix5
-rw-r--r--pkgs/applications/blockchains/torq/default.nix13
-rw-r--r--pkgs/applications/editors/ed/default.nix4
-rw-r--r--pkgs/applications/editors/poke/default.nix8
-rw-r--r--pkgs/applications/emulators/dolphin-emu/default.nix238
-rw-r--r--pkgs/applications/emulators/dolphin-emu/master.nix196
-rw-r--r--pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch18
-rw-r--r--pkgs/applications/emulators/dosbox-staging/default.nix52
-rw-r--r--pkgs/applications/emulators/mame/default.nix4
-rw-r--r--pkgs/applications/emulators/rpcs3/default.nix4
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/graphics/eyedropper/default.nix2
-rw-r--r--pkgs/applications/graphics/foxotron/default.nix5
-rw-r--r--pkgs/applications/graphics/goxel/default.nix6
-rw-r--r--pkgs/applications/graphics/hdrmerge/default.nix5
-rw-r--r--pkgs/applications/graphics/jpegoptim/default.nix4
-rw-r--r--pkgs/applications/graphics/krita/default.nix4
-rw-r--r--pkgs/applications/graphics/paraview/default.nix4
-rw-r--r--pkgs/applications/graphics/tesseract/tesseract3.nix12
-rw-r--r--pkgs/applications/graphics/tesseract/tesseract4.nix20
-rw-r--r--pkgs/applications/misc/darkman/default.nix6
-rw-r--r--pkgs/applications/misc/lyx/default.nix6
-rw-r--r--pkgs/applications/misc/mysql-workbench/default.nix7
-rw-r--r--pkgs/applications/misc/qt-box-editor/default.nix14
-rw-r--r--pkgs/applications/misc/regextester/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/linkerd/edge.nix6
-rw-r--r--pkgs/applications/networking/cluster/pluto/default.nix6
-rw-r--r--pkgs/applications/networking/go-graft/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/client.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common156
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux18
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x8610
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches7
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/daemon.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/default.nix30
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix10
-rw-r--r--pkgs/applications/networking/mailreaders/mutt/default.nix2
-rw-r--r--pkgs/applications/networking/syncthing/default.nix4
-rw-r--r--pkgs/applications/office/gnucash/default.nix5
-rw-r--r--pkgs/applications/office/paperwork/paperwork-shell.nix2
-rw-r--r--pkgs/applications/office/paperwork/src.nix4
-rw-r--r--pkgs/applications/plasma-mobile/angelfish.nix4
-rw-r--r--pkgs/applications/plasma-mobile/audiotube.nix4
-rw-r--r--pkgs/applications/plasma-mobile/neochat.nix4
-rw-r--r--pkgs/applications/plasma-mobile/spacebar.nix6
-rw-r--r--pkgs/applications/science/biology/last/default.nix4
-rw-r--r--pkgs/applications/science/biology/octopus/default.nix5
-rw-r--r--pkgs/applications/science/chemistry/octopus/default.nix8
-rw-r--r--pkgs/applications/science/logic/cbmc/default.nix10
-rw-r--r--pkgs/applications/science/math/gap/default.nix2
-rw-r--r--pkgs/applications/science/math/mxnet/default.nix6
-rw-r--r--pkgs/applications/science/math/pari/default.nix10
-rw-r--r--pkgs/applications/science/math/sage/README.md40
-rw-r--r--pkgs/applications/science/math/sage/env-locations.nix3
-rw-r--r--pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch26
-rw-r--r--pkgs/applications/science/math/sage/sage-src.nix74
-rw-r--r--pkgs/applications/science/physics/nnpdf/default.nix12
-rw-r--r--pkgs/applications/terminal-emulators/foot/default.nix2
-rw-r--r--pkgs/applications/version-management/commitizen/default.nix4
-rw-r--r--pkgs/applications/version-management/fnc/default.nix5
-rw-r--r--pkgs/applications/version-management/git-trim/default.nix27
-rw-r--r--pkgs/applications/version-management/sapling/Cargo.lock557
-rw-r--r--pkgs/applications/version-management/sapling/default.nix175
-rw-r--r--pkgs/applications/version-management/sapling/deps.json4
-rw-r--r--pkgs/applications/video/ccextractor/default.nix5
-rw-r--r--pkgs/applications/video/haruna/default.nix4
-rw-r--r--pkgs/applications/video/mirakurun/default.nix3
-rw-r--r--pkgs/applications/video/openshot-qt/default.nix3
-rw-r--r--pkgs/applications/video/openshot-qt/libopenshot.nix7
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix11
-rw-r--r--pkgs/applications/virtualization/singularity/packages.nix6
-rw-r--r--pkgs/applications/window-managers/cardboard/default.nix4
-rw-r--r--pkgs/build-support/build-graalvm-native-image/default.nix8
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix7
-rw-r--r--pkgs/build-support/libredirect/default.nix6
-rw-r--r--pkgs/build-support/libredirect/libredirect.c50
-rw-r--r--pkgs/build-support/libredirect/test.c20
-rw-r--r--pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh2
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix2
-rw-r--r--pkgs/build-support/rust/fetch-cargo-tarball/default.nix3
-rw-r--r--pkgs/build-support/setup-hooks/make-symlinks-relative.sh11
-rw-r--r--pkgs/data/fonts/freefont-ttf/default.nix22
-rw-r--r--pkgs/data/fonts/iosevka/bin.nix2
-rw-r--r--pkgs/data/fonts/iosevka/variants.nix184
-rw-r--r--pkgs/data/fonts/julia-mono/default.nix4
-rw-r--r--pkgs/data/icons/capitaine-cursors-themed/default.nix20
-rw-r--r--pkgs/data/misc/cldr-annotations/default.nix23
-rw-r--r--pkgs/data/misc/papirus-folders/default.nix4
-rw-r--r--pkgs/data/misc/publicsuffix-list/default.nix32
-rw-r--r--pkgs/data/misc/unicode-emoji/default.nix37
-rw-r--r--pkgs/desktops/gnome/apps/seahorse/default.nix9
-rw-r--r--pkgs/desktops/gnome/core/gnome-contacts/default.nix4
-rw-r--r--pkgs/desktops/rox/rox-filer/default.nix2
-rw-r--r--pkgs/development/compilers/dmd/generic.nix7
-rw-r--r--pkgs/development/compilers/gcc/10/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix8
-rw-r--r--pkgs/development/compilers/gcc/11/gcc-issue-103910.patch41
-rw-r--r--pkgs/development/compilers/gcc/12/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/8/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/builder.sh11
-rw-r--r--pkgs/development/compilers/gnu-cim/default.nix45
-rw-r--r--pkgs/development/compilers/go/1.18.nix7
-rw-r--r--pkgs/development/compilers/go/1.19.nix7
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix148
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix73
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/default.nix103
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json42
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json42
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/hashes.nix71
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/mkGraal.nix346
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix58
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/update.nix227
-rwxr-xr-xpkgs/development/compilers/graalvm/community-edition/update.sh86
-rw-r--r--pkgs/development/compilers/llvm/10/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/11/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/12/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/13/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/14/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/6/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/7/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/8/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/mit-scheme/default.nix6
-rw-r--r--pkgs/development/compilers/rust/1_66.nix64
-rw-r--r--pkgs/development/compilers/rust/1_67.nix81
-rw-r--r--pkgs/development/compilers/rust/cargo.nix13
-rw-r--r--pkgs/development/compilers/rust/rustc.nix1
-rw-r--r--pkgs/development/compilers/tinycc/default.nix1
-rw-r--r--pkgs/development/compilers/urweb/default.nix5
-rw-r--r--pkgs/development/compilers/zig/0.10.nix1
-rw-r--r--pkgs/development/interpreters/gnu-apl/default.nix4
-rw-r--r--pkgs/development/interpreters/ruby/default.nix8
-rw-r--r--pkgs/development/interpreters/ruby/patchsets.nix18
-rw-r--r--pkgs/development/interpreters/ruby/rvm-patchsets.nix4
-rw-r--r--pkgs/development/interpreters/tcl/tcl-package-hook.sh2
-rw-r--r--pkgs/development/libraries/arrow-cpp/default.nix83
-rw-r--r--pkgs/development/libraries/assimp/default.nix5
-rw-r--r--pkgs/development/libraries/belle-sip/default.nix5
-rw-r--r--pkgs/development/libraries/boringssl/default.nix5
-rw-r--r--pkgs/development/libraries/bzrtp/default.nix5
-rw-r--r--pkgs/development/libraries/clucene-core/2.x.nix13
-rw-r--r--pkgs/development/libraries/clucene-core/fix-missing-include-time.patch49
-rw-r--r--pkgs/development/libraries/cosmopolitan/default.nix7
-rw-r--r--pkgs/development/libraries/cpp-ipfs-http-client/default.nix2
-rw-r--r--pkgs/development/libraries/dbus-cplusplus/default.nix6
-rw-r--r--pkgs/development/libraries/example-robot-data/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg-full/default.nix511
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix10
-rw-r--r--pkgs/development/libraries/ffmpeg/5.nix9
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix795
-rw-r--r--pkgs/development/libraries/fizz/default.nix4
-rw-r--r--pkgs/development/libraries/gegl/default.nix9
-rw-r--r--pkgs/development/libraries/gloox/default.nix7
-rw-r--r--pkgs/development/libraries/gsl/default.nix6
-rw-r--r--pkgs/development/libraries/gsmlib/default.nix8
-rw-r--r--pkgs/development/libraries/gtest/default.nix8
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix1
-rw-r--r--pkgs/development/libraries/hunspell/default.nix4
-rw-r--r--pkgs/development/libraries/iqueue/default.nix6
-rw-r--r--pkgs/development/libraries/irr1/default.nix10
-rw-r--r--pkgs/development/libraries/jbig2enc/default.nix60
-rw-r--r--pkgs/development/libraries/kerberos/krb5.nix5
-rw-r--r--pkgs/development/libraries/leptonica/default.nix4
-rw-r--r--pkgs/development/libraries/libassuan/default.nix1
-rw-r--r--pkgs/development/libraries/libbladeRF/default.nix5
-rw-r--r--pkgs/development/libraries/libcamera/default.nix2
-rw-r--r--pkgs/development/libraries/libcbor/default.nix23
-rw-r--r--pkgs/development/libraries/libcli/default.nix5
-rw-r--r--pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch2
-rw-r--r--pkgs/development/libraries/libdatrie/default.nix2
-rw-r--r--pkgs/development/libraries/libde265/default.nix14
-rw-r--r--pkgs/development/libraries/libdynd/default.nix5
-rw-r--r--pkgs/development/libraries/libepoxy/default.nix4
-rw-r--r--pkgs/development/libraries/libfaketime/default.nix12
-rw-r--r--pkgs/development/libraries/libfaketime/nix-store-date.patch4
-rw-r--r--pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch12
-rw-r--r--pkgs/development/libraries/libglvnd/default.nix4
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix9
-rw-r--r--pkgs/development/libraries/libpsl/default.nix4
-rw-r--r--pkgs/development/libraries/libraw/default.nix10
-rw-r--r--pkgs/development/libraries/libraw/unstable.nix12
-rw-r--r--pkgs/development/libraries/libssh/default.nix4
-rw-r--r--pkgs/development/libraries/libtiff/default.nix6
-rw-r--r--pkgs/development/libraries/libubox/default.nix12
-rw-r--r--pkgs/development/libraries/libunistring/default.nix3
-rw-r--r--pkgs/development/libraries/libuv/default.nix17
-rw-r--r--pkgs/development/libraries/libvisual/default.nix16
-rw-r--r--pkgs/development/libraries/libvterm-neovim/default.nix4
-rw-r--r--pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix5
-rw-r--r--pkgs/development/libraries/maplibre-gl-native/default.nix6
-rw-r--r--pkgs/development/libraries/mesa/default.nix10
-rw-r--r--pkgs/development/libraries/newt/default.nix4
-rw-r--r--pkgs/development/libraries/nss_wrapper/default.nix4
-rw-r--r--pkgs/development/libraries/octomap/default.nix6
-rw-r--r--pkgs/development/libraries/openbabel/2.nix4
-rw-r--r--pkgs/development/libraries/openbabel/default.nix4
-rw-r--r--pkgs/development/libraries/opencv/4.x.nix63
-rw-r--r--pkgs/development/libraries/opencv/tests.nix70
-rw-r--r--pkgs/development/libraries/opendbx/default.nix5
-rw-r--r--pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch36
-rw-r--r--pkgs/development/libraries/openssl/default.nix11
-rw-r--r--pkgs/development/libraries/physics/clhep/default.nix4
-rw-r--r--pkgs/development/libraries/pico-sdk/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/default.nix9
-rw-r--r--pkgs/development/libraries/qcoro/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix6
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix4
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix12
-rw-r--r--pkgs/development/libraries/rocm-device-libs/default.nix2
-rw-r--r--pkgs/development/libraries/roctracer/default.nix5
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix2
-rw-r--r--pkgs/development/libraries/science/math/sympow/default.nix10
-rw-r--r--pkgs/development/libraries/stfl/default.nix18
-rw-r--r--pkgs/development/libraries/swiftshader/default.nix6
-rw-r--r--pkgs/development/libraries/tbb/default.nix2
-rw-r--r--pkgs/development/libraries/thrift/default.nix12
-rw-r--r--pkgs/development/libraries/unittest-cpp/default.nix15
-rw-r--r--pkgs/development/libraries/uri/default.nix7
-rw-r--r--pkgs/development/libraries/v8/default.nix1
-rw-r--r--pkgs/development/libraries/wildmidi/default.nix4
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK32.nix4
-rw-r--r--pkgs/development/python-modules/Cython/default.nix11
-rw-r--r--pkgs/development/python-modules/Cython/trashcan.patch354
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/airthings-ble/default.nix1
-rw-r--r--pkgs/development/python-modules/ansible-doctor/default.nix4
-rw-r--r--pkgs/development/python-modules/asf-search/default.nix38
-rw-r--r--pkgs/development/python-modules/atc-ble/default.nix13
-rw-r--r--pkgs/development/python-modules/awswrangler/default.nix88
-rw-r--r--pkgs/development/python-modules/build/default.nix2
-rw-r--r--pkgs/development/python-modules/bundlewrap/default.nix2
-rw-r--r--pkgs/development/python-modules/certomancer/default.nix8
-rw-r--r--pkgs/development/python-modules/chart-studio/default.nix4
-rw-r--r--pkgs/development/python-modules/clustershell/default.nix4
-rw-r--r--pkgs/development/python-modules/coconut/default.nix4
-rw-r--r--pkgs/development/python-modules/collections-extended/default.nix4
-rw-r--r--pkgs/development/python-modules/cvxopt/default.nix12
-rw-r--r--pkgs/development/python-modules/dask/default.nix6
-rw-r--r--pkgs/development/python-modules/datafusion/Cargo.lock.patch78
-rw-r--r--pkgs/development/python-modules/datafusion/default.nix61
-rw-r--r--pkgs/development/python-modules/django/3.nix4
-rw-r--r--pkgs/development/python-modules/drf-yasg/default.nix4
-rw-r--r--pkgs/development/python-modules/effect/default.nix46
-rw-r--r--pkgs/development/python-modules/fiona/default.nix60
-rw-r--r--pkgs/development/python-modules/fpylll/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-container/default.nix4
-rw-r--r--pkgs/development/python-modules/hatch-requirements-txt/default.nix3
-rw-r--r--pkgs/development/python-modules/hist/default.nix45
-rw-r--r--pkgs/development/python-modules/histoprint/default.nix45
-rw-r--r--pkgs/development/python-modules/holoviews/default.nix4
-rw-r--r--pkgs/development/python-modules/ibeacon-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/ibis-framework/default.nix34
-rw-r--r--pkgs/development/python-modules/iminuit/default.nix4
-rw-r--r--pkgs/development/python-modules/inkbird-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/inquirer/default.nix17
-rw-r--r--pkgs/development/python-modules/kegtron-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/led-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/lightning/default.nix30
-rw-r--r--pkgs/development/python-modules/limnoria/default.nix4
-rw-r--r--pkgs/development/python-modules/mediapy/default.nix2
-rw-r--r--pkgs/development/python-modules/moat-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/n3fit/default.nix50
-rw-r--r--pkgs/development/python-modules/oralb-ble/default.nix4
-rw-r--r--pkgs/development/python-modules/oslo-log/default.nix4
-rw-r--r--pkgs/development/python-modules/pc-ble-driver-py/default.nix7
-rw-r--r--pkgs/development/python-modules/primer3/default.nix6
-rw-r--r--pkgs/development/python-modules/pyarrow/default.nix50
-rw-r--r--pkgs/development/python-modules/pyipma/default.nix5
-rw-r--r--pkgs/development/python-modules/pyoutbreaksnearme/default.nix (renamed from pkgs/development/python-modules/pyflunearyou/default.nix)28
-rw-r--r--pkgs/development/python-modules/pytest-httpserver/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest-rerunfailures/default.nix26
-rw-r--r--pkgs/development/python-modules/python-magic/default.nix6
-rw-r--r--pkgs/development/python-modules/pytz/default.nix4
-rw-r--r--pkgs/development/python-modules/pyweatherflowrest/default.nix7
-rw-r--r--pkgs/development/python-modules/qingping-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/quantiphy/default.nix4
-rw-r--r--pkgs/development/python-modules/raincloudy/default.nix35
-rw-r--r--pkgs/development/python-modules/rapt-ble/default.nix58
-rw-r--r--pkgs/development/python-modules/remotezip/default.nix47
-rw-r--r--pkgs/development/python-modules/scipy/default.nix2
-rw-r--r--pkgs/development/python-modules/scmrepo/default.nix6
-rw-r--r--pkgs/development/python-modules/sensorpro-ble/default.nix12
-rw-r--r--pkgs/development/python-modules/shortuuid/default.nix1
-rw-r--r--pkgs/development/python-modules/sqlglot/default.nix10
-rw-r--r--pkgs/development/python-modules/tesserocr/default.nix5
-rw-r--r--pkgs/development/python-modules/thermopro-ble/default.nix1
-rw-r--r--pkgs/development/python-modules/torch/default.nix15
-rw-r--r--pkgs/development/python-modules/types-protobuf/default.nix4
-rw-r--r--pkgs/development/python-modules/uhi/default.nix39
-rw-r--r--pkgs/development/python-modules/validphys2/default.nix2
-rw-r--r--pkgs/development/python-modules/vowpalwabbit/default.nix4
-rw-r--r--pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch15
-rw-r--r--pkgs/development/python-modules/wheel/default.nix4
-rw-r--r--pkgs/development/python-modules/xiaomi-ble/default.nix4
-rw-r--r--pkgs/development/python-modules/xmlschema/default.nix4
-rw-r--r--pkgs/development/python-modules/yalexs-ble/default.nix4
-rw-r--r--pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch37
-rw-r--r--pkgs/development/python2-modules/wheel/default.nix57
-rw-r--r--pkgs/development/tools/analysis/rr/default.nix1
-rw-r--r--pkgs/development/tools/analysis/tflint/default.nix6
-rw-r--r--pkgs/development/tools/analysis/valgrind/default.nix6
-rw-r--r--pkgs/development/tools/bbin/default.nix2
-rw-r--r--pkgs/development/tools/bpf-linker/default.nix10
-rw-r--r--pkgs/development/tools/build-managers/cmake/002-application-services.diff36
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix47
-rw-r--r--pkgs/development/tools/build-managers/meson/disable-bitcode.patch24
-rw-r--r--pkgs/development/tools/build-managers/waf/default.nix4
-rw-r--r--pkgs/development/tools/coder/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/fly/default.nix6
-rw-r--r--pkgs/development/tools/cosmoc/default.nix41
-rw-r--r--pkgs/development/tools/cosmocc/default.nix35
-rw-r--r--pkgs/development/tools/gci/default.nix6
-rw-r--r--pkgs/development/tools/glslviewer/default.nix4
-rw-r--r--pkgs/development/tools/jbang/default.nix4
-rw-r--r--pkgs/development/tools/kustomize/kustomize-sops.nix6
-rw-r--r--pkgs/development/tools/misc/binutils/build-components-separately.patch155
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix46
-rw-r--r--pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch71
-rw-r--r--pkgs/development/tools/misc/binutils/libbfd.nix47
-rw-r--r--pkgs/development/tools/misc/binutils/libopcodes.nix42
-rw-r--r--pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch25
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix6
-rw-r--r--pkgs/development/tools/misc/dejagnu/default.nix7
-rw-r--r--pkgs/development/tools/misc/edb/default.nix2
-rw-r--r--pkgs/development/tools/misc/gperf/default.nix2
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix23
-rw-r--r--pkgs/development/tools/misc/lsof/default.nix4
-rw-r--r--pkgs/development/tools/misc/lsof/no-build-info.patch20
-rw-r--r--pkgs/development/tools/misc/pahole/default.nix9
-rw-r--r--pkgs/development/tools/misc/saleae-logic-2/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/ocaml-top/default.nix9
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/default.nix2
-rw-r--r--pkgs/development/tools/picotool/default.nix10
-rw-r--r--pkgs/development/tools/profiling/systemtap/default.nix1
-rw-r--r--pkgs/development/tools/wlcs/default.nix5
-rw-r--r--pkgs/development/web/nodejs/v18.nix2
-rw-r--r--pkgs/games/cataclysm-dda/stable.nix5
-rw-r--r--pkgs/games/cdogs-sdl/default.nix5
-rw-r--r--pkgs/games/eboard/default.nix1
-rw-r--r--pkgs/games/gimx/default.nix8
-rw-r--r--pkgs/games/liquidwar/default.nix10
-rw-r--r--pkgs/games/openmw/default.nix4
-rw-r--r--pkgs/games/openrct2/default.nix5
-rw-r--r--pkgs/games/stepmania/default.nix4
-rw-r--r--pkgs/games/supertux/default.nix4
-rw-r--r--pkgs/games/zod/default.nix7
-rw-r--r--pkgs/misc/uboot/default.nix10
-rw-r--r--pkgs/os-specific/darwin/xcode/default.nix63
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix4
-rw-r--r--pkgs/os-specific/linux/anbox/default.nix5
-rw-r--r--pkgs/os-specific/linux/bbswitch/default.nix1
-rw-r--r--pkgs/os-specific/linux/dracut/default.nix18
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipset/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix8
-rw-r--r--pkgs/os-specific/linux/mxu11x0/default.nix4
-rw-r--r--pkgs/os-specific/linux/ocf-resource-agents/default.nix5
-rw-r--r--pkgs/os-specific/linux/odp-dpdk/default.nix7
-rw-r--r--pkgs/os-specific/linux/pktgen/default.nix6
-rw-r--r--pkgs/os-specific/linux/projecteur/default.nix4
-rw-r--r--pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix5
-rw-r--r--pkgs/os-specific/linux/rtl8189es/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl8723ds/default.nix4
-rw-r--r--pkgs/os-specific/linux/rtl8812au/default.nix5
-rw-r--r--pkgs/os-specific/linux/rtl8814au/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl8821au/default.nix5
-rw-r--r--pkgs/os-specific/linux/rtl8821ce/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl8821cu/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl88x2bu/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix3
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix4
-rw-r--r--pkgs/os-specific/linux/vmware/default.nix2
-rw-r--r--pkgs/servers/foundationdb/cmake.nix5
-rw-r--r--pkgs/servers/gemini/molly-brown/default.nix17
-rw-r--r--pkgs/servers/gemini/molly-brown/deps.nix12
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix2
-rw-r--r--pkgs/servers/home-assistant/default.nix4
-rw-r--r--pkgs/servers/http/nginx/modules.nix4
-rw-r--r--pkgs/servers/libreddit/default.nix6
-rw-r--r--pkgs/servers/mail/exim/default.nix4
-rw-r--r--pkgs/servers/monitoring/nagios/default.nix1
-rw-r--r--pkgs/servers/monitoring/prometheus/artifactory-exporter.nix4
-rw-r--r--pkgs/servers/nosql/ferretdb/default.nix6
-rw-r--r--pkgs/servers/nosql/influxdb/default.nix2
-rw-r--r--pkgs/servers/nosql/influxdb2/default.nix2
-rw-r--r--pkgs/servers/openafs/1.8/default.nix1
-rw-r--r--pkgs/servers/osrm-backend/default.nix6
-rw-r--r--pkgs/servers/pounce/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/default.nix20
-rw-r--r--pkgs/servers/tvheadend/default.nix3
-rw-r--r--pkgs/servers/x11/xorg/default.nix38
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix12
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list10
-rw-r--r--pkgs/shells/bash/5.nix11
-rw-r--r--pkgs/shells/hilbish/default.nix6
-rw-r--r--pkgs/stdenv/darwin/default.nix1
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix47
-rw-r--r--pkgs/stdenv/generic/setup.sh11
-rw-r--r--pkgs/test/stdenv/hooks.nix12
-rw-r--r--pkgs/tools/X11/sunpaper/default.nix6
-rw-r--r--pkgs/tools/admin/awscli2/default.nix4
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/admin/tigervnc/default.nix5
-rw-r--r--pkgs/tools/admin/trivy/default.nix6
-rw-r--r--pkgs/tools/archivers/arc_unpacker/default.nix1
-rw-r--r--pkgs/tools/audio/mpris-scrobbler/default.nix7
-rw-r--r--pkgs/tools/cd-dvd/vobsub2srt/default.nix2
-rw-r--r--pkgs/tools/compression/zstd/default.nix17
-rw-r--r--pkgs/tools/filesystems/blobfuse/default.nix6
-rw-r--r--pkgs/tools/filesystems/ceph/default.nix17
-rw-r--r--pkgs/tools/filesystems/httm/default.nix6
-rw-r--r--pkgs/tools/filesystems/idsk/default.nix5
-rw-r--r--pkgs/tools/filesystems/rmfuse/default.nix81
-rw-r--r--pkgs/tools/filesystems/rmfuse/poetry-git-overlay.nix14
-rw-r--r--pkgs/tools/filesystems/rmfuse/poetry.lock596
-rw-r--r--pkgs/tools/filesystems/rmfuse/pyproject.toml15
-rwxr-xr-xpkgs/tools/filesystems/rmfuse/update5
-rw-r--r--pkgs/tools/graphics/argyllcms/default.nix2
-rw-r--r--pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch47
-rw-r--r--pkgs/tools/graphics/jbig2enc/default.nix35
-rw-r--r--pkgs/tools/graphics/libyafaray/default.nix5
-rw-r--r--pkgs/tools/graphics/pikchr/default.nix16
-rw-r--r--pkgs/tools/graphics/wgpu-utils/default.nix6
-rw-r--r--pkgs/tools/misc/boxxy/default.nix26
-rw-r--r--pkgs/tools/misc/ethtool/default.nix15
-rw-r--r--pkgs/tools/misc/file/default.nix4
-rw-r--r--pkgs/tools/misc/ipxe/default.nix10
-rw-r--r--pkgs/tools/misc/lockfile-progs/default.nix5
-rw-r--r--pkgs/tools/misc/mpdscribble/default.nix4
-rw-r--r--pkgs/tools/misc/steampipe/default.nix4
-rw-r--r--pkgs/tools/misc/wimboot/default.nix14
-rw-r--r--pkgs/tools/misc/yafetch/default.nix2
-rw-r--r--pkgs/tools/networking/dsniff/default.nix2
-rw-r--r--pkgs/tools/networking/frp/default.nix6
-rw-r--r--pkgs/tools/networking/grpc_cli/default.nix31
-rw-r--r--pkgs/tools/networking/ip2unix/default.nix4
-rw-r--r--pkgs/tools/networking/ppp/default.nix8
-rw-r--r--pkgs/tools/networking/snowflake/default.nix6
-rw-r--r--pkgs/tools/networking/tcpdump/default.nix10
-rw-r--r--pkgs/tools/networking/tgt/default.nix5
-rw-r--r--pkgs/tools/networking/uqmi/default.nix5
-rw-r--r--pkgs/tools/networking/xray/default.nix6
-rw-r--r--pkgs/tools/package-management/nfpm/default.nix6
-rw-r--r--pkgs/tools/package-management/repro-get/default.nix6
-rw-r--r--pkgs/tools/security/aflplusplus/default.nix5
-rw-r--r--pkgs/tools/security/chipsec/default.nix5
-rw-r--r--pkgs/tools/security/erosmb/default.nix4
-rw-r--r--pkgs/tools/security/gnupg/24.nix (renamed from pkgs/tools/security/gnupg/23.nix)14
-rw-r--r--pkgs/tools/system/acpica-tools/default.nix6
-rw-r--r--pkgs/tools/system/ddrescue/default.nix4
-rw-r--r--pkgs/tools/system/facter/default.nix4
-rw-r--r--pkgs/tools/system/kanata/default.nix15
-rw-r--r--pkgs/tools/system/rocm-smi/default.nix4
-rw-r--r--pkgs/tools/text/dos2unix/default.nix4
-rw-r--r--pkgs/tools/text/groff/default.nix5
-rw-r--r--pkgs/tools/text/justify/default.nix4
-rw-r--r--pkgs/tools/text/qgrep/default.nix5
-rw-r--r--pkgs/tools/text/tab/default.nix5
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix147
-rw-r--r--pkgs/top-level/darwin-packages.nix9
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix20
-rw-r--r--pkgs/top-level/python2-packages.nix2
489 files changed, 5385 insertions, 5080 deletions
diff --git a/pkgs/applications/audio/aether-lv2/default.nix b/pkgs/applications/audio/aether-lv2/default.nix
index e912c7fa49a42..179c656968ce4 100644
--- a/pkgs/applications/audio/aether-lv2/default.nix
+++ b/pkgs/applications/audio/aether-lv2/default.nix
@@ -18,6 +18,12 @@ stdenv.mkDerivation rec {
     lv2 libX11 libGL libGLU mesa
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=stringop-overflow"
+  ];
+
   installPhase = ''
     mkdir -p $out/lib/lv2
     cp -r aether.lv2 $out/lib/lv2
diff --git a/pkgs/applications/audio/bespokesynth/default.nix b/pkgs/applications/audio/bespokesynth/default.nix
index 6c48c756ab24c..7fc921e59fbfd 100644
--- a/pkgs/applications/audio/bespokesynth/default.nix
+++ b/pkgs/applications/audio/bespokesynth/default.nix
@@ -66,6 +66,10 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i Source/TitleBar.h # gcc12
+  '';
+
   cmakeBuildType = "Release";
 
   cmakeFlags = lib.optionals enableVST2 [ "-DBESPOKE_VST2_SDK_LOCATION=${vst-sdk}/VST2_SDK" ];
diff --git a/pkgs/applications/audio/calf/default.nix b/pkgs/applications/audio/calf/default.nix
index 4ab651e3fb847..b4c9781ced197 100644
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "17x4hylgq4dn9qycsdacfxy64f5cv57n2qgkvsdp524gnqzw4az3";
   };
 
+  outputs = [ "out" "doc" ];
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/audio/furnace/default.nix b/pkgs/applications/audio/furnace/default.nix
index 0f15775b38d54..f0bb039a79c4a 100644
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@@ -63,6 +63,12 @@ stdenv.mkDerivation rec {
     "-DWARNINGS_ARE_ERRORS=ON"
   ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or aarch64 (old gcc)
+    "-Wno-error=mismatched-new-delete"
+    "-Wno-error=use-after-free"
+  ];
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Normal CMake install phase on Darwin only installs the binary, the user is expected to use CPack to build a
     # bundle. That adds alot of overhead for not much benefit (CPack is currently abit broken, and needs impure access
diff --git a/pkgs/applications/audio/helvum/default.nix b/pkgs/applications/audio/helvum/default.nix
index 684f074b4e612..78891967fa41d 100644
--- a/pkgs/applications/audio/helvum/default.nix
+++ b/pkgs/applications/audio/helvum/default.nix
@@ -16,20 +16,20 @@
 
 stdenv.mkDerivation rec {
   pname = "helvum";
-  version = "0.3.4";
+  version = "0.4.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "pipewire";
     repo = pname;
     rev = version;
-    sha256 = "0nhv6zw2zzxz2bg2zj32w1brywnm5lv6j3cvmmvwshc389z2k5x1";
+    hash = "sha256-TvjO7fGobGmAltVHeXWyMtMLANdVWVGvBYq20JD3mMI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-EIHO9qVPIXgezfFOaarlTU0an762nFmX1ELbQuAZ7rY";
+    hash = "sha256-W5Imlut30cjV4A6TCjBFLbViB0CDUucNsvIUiCXqu7I=";
   };
 
   nativeBuildInputs = [
@@ -50,9 +50,6 @@ stdenv.mkDerivation rec {
     pipewire
   ];
 
-  # FIXME: workaround for Pipewire 0.3.64 deprecated API change, remove when fixed upstream
-  NIX_CFLAGS_COMPILE = [ "-DPW_ENABLE_DEPRECATED" ];
-
   meta = with lib; {
     description = "A GTK patchbay for pipewire";
     homepage = "https://gitlab.freedesktop.org/pipewire/helvum";
diff --git a/pkgs/applications/audio/jack-rack/default.nix b/pkgs/applications/audio/jack-rack/default.nix
index 420c11562e2a0..8cf55289b2f33 100644
--- a/pkgs/applications/audio/jack-rack/default.nix
+++ b/pkgs/applications/audio/jack-rack/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libjack2 ladspaH gtk2 alsa-lib libxml2 lrdf ];
-  NIX_LDFLAGS = "-ldl -lm -lpthread";
+  NIX_LDFLAGS = "-lm -lpthread";
 
   meta = {
     description = ''An effects "rack" for the JACK low latency audio API'';
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index 70cb4d7f11094..36b6345c0f113 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -21,8 +21,6 @@ stdenv.mkDerivation rec {
   #       `l_notebook1'; jamin-callbacks.o:/build/jamin-0.95.0/src/hdeq.h:64: first defined here
   NIX_CFLAGS_COMPILE = "-fcommon";
 
-  NIX_LDFLAGS = "-ldl";
-
   postInstall = ''
     wrapProgram $out/bin/jamin --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa
   '';
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index dd00bd1f2c022..4e4612ef922cb 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -4,19 +4,21 @@
 , ladspaH, php, libXrandr }:
 
 stdenv.mkDerivation rec {
-        pname = "lsp-plugins";
-        version = "1.2.5";
+  pname = "lsp-plugins";
+  version = "1.2.5";
 
-        src = fetchurl {
-                url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-                sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
-        };
+  src = fetchurl {
+    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
+    sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
+  };
 
-        nativeBuildInputs = [ pkg-config php makeWrapper ];
-        buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];
+  outputs = [ "out" "dev" "doc" ];
 
-        makeFlags = [
-                "PREFIX=${placeholder "out"}"
+  nativeBuildInputs = [ pkg-config php makeWrapper ];
+  buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
   ];
 
   NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
diff --git a/pkgs/applications/audio/mimic/default.nix b/pkgs/applications/audio/mimic/default.nix
index 7e11c0a8d75fd..47e043f5d4673 100644
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@@ -38,6 +38,11 @@ stdenv.mkDerivation rec {
     pcre2
   ] ++ lib.optional pulseaudioSupport libpulseaudio;
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=free-nonheap-object"
+  ];
+
   postInstall = ''
     wrapProgram $out/bin/mimic \
       --run "export ALSA_PLUGIN_DIR=${alsa-plugins}/lib/alsa-lib"
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 29f28203e1389..3eb2cf20ee777 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mpg123";
-  version = "1.29.3";
+  version = "1.31.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ljiF2Mx3Ji8ot3GHx9GJ4yGV5kJE3iUwt5jd8yGD6Ec=";
+    sha256 = "sha256-sX8ikF4x9DtrQB399qce0Ru30Fb2jbRJ1wufmug5x94=";
   };
 
   outputs = [ "out" ] ++ lib.optionals withConplay [ "conplay" ];
diff --git a/pkgs/applications/audio/odin2/default.nix b/pkgs/applications/audio/odin2/default.nix
index beb1264679354..de89f9aedead4 100644
--- a/pkgs/applications/audio/odin2/default.nix
+++ b/pkgs/applications/audio/odin2/default.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-N96Nb7G6hqfh8DyMtHbttl/fRZUkS8f2KfPSqeMAhHY=";
   };
 
+  postPatch = ''
+    sed '1i#include <utility>' -i \
+      libs/JUCELV2/modules/juce_gui_basics/windows/juce_ComponentPeer.h # gcc12
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/applications/audio/opusfile/default.nix b/pkgs/applications/audio/opusfile/default.nix
index f86595361b659..47d7a64e3c20d 100644
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, openssl, libogg, libopus }:
+{ lib, stdenv, fetchurl, pkg-config, openssl, libogg, libopus, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "opusfile";
@@ -12,7 +12,14 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl libogg ];
   propagatedBuildInputs = [ libopus ];
   outputs = [ "out" "dev" ];
-  patches = [ ./include-multistream.patch ]
+  patches = [
+    ./include-multistream.patch
+    (fetchpatch {
+      name = "CVE-2022-47021.patch";
+      url = "https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5.patch";
+      sha256 = "sha256-XThI/ys5caB+OncFVfxm5IsvQPy1MbLQKwIlYjPvTJQ=";
+    })
+  ]
     # fixes problem with openssl 1.1 dependency
     # see https://github.com/xiph/opusfile/issues/13
     ++ lib.optionals stdenv.hostPlatform.isWindows [ ./disable-cert-store.patch ];
diff --git a/pkgs/applications/audio/stochas/default.nix b/pkgs/applications/audio/stochas/default.nix
index 84376a1bbe9e2..2b72664347e60 100644
--- a/pkgs/applications/audio/stochas/default.nix
+++ b/pkgs/applications/audio/stochas/default.nix
@@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    sed '1i#include <utility>' -i \
+      lib/JUCE/modules/juce_gui_basics/windows/juce_ComponentPeer.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/applications/blockchains/torq/default.nix b/pkgs/applications/blockchains/torq/default.nix
index 4b786168bce36..657e5b0e3ffab 100644
--- a/pkgs/applications/blockchains/torq/default.nix
+++ b/pkgs/applications/blockchains/torq/default.nix
@@ -6,20 +6,20 @@
 
 let
   pname = "torq";
-  version = "0.17.3";
+  version = "0.18.17";
 
   src = fetchFromGitHub {
     owner = "lncapital";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fqHJZi1NQCrZqsa+N+FVYZ8s9o0D555Sqn5qNlJ1MmI=";
+    hash = "sha256-xiA66yGo8b1+zZ7jQ7SFOtNPmqbdna7fUCT21uibrIM=";
   };
 
   web = buildNpmPackage {
     pname = "${pname}-frontend";
     inherit version;
     src = "${src}/web";
-    npmDepsHash = "sha256-8mUfTFzPjQlQvhC3zZf+WruDBkYnmGt3yckNi0CPWs0=";
+    npmDepsHash = "sha256-/7x5RWYIB5BChYMnMuFVVaZd0pVkew4i4QrF7hSFnCM=";
 
     # copied from upstream Dockerfile
     npmInstallFlags = [ "--legacy-peer-deps" ];
@@ -29,14 +29,14 @@ let
     # override npmInstallHook, we only care about the build/ directory
     installPhase = ''
       mkdir $out
-      cp -r build $out/
+      cp -r build/* $out/
     '';
   };
 in
 buildGoModule rec {
   inherit pname version src;
 
-  vendorHash = "sha256-HETN2IMnpxnTyg6bQDpoD0saJu+gKocdEf0VzEi12Gs=";
+  vendorHash = "sha256-bvisI589Gq9IdyJEqI+uzs3iDPOTUkq95P3n/KoFhF0=";
 
   subPackages = [ "cmd/torq" ];
 
@@ -47,7 +47,8 @@ buildGoModule rec {
   ];
 
   postInstall = ''
-    ln -s ${web} $out/web
+    mkdir -p $out/web/build
+    cp -r ${web}/* $out/web/build/
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index f5ed28cedf68d..b7b70eb501ea1 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (rec {
   pname = "ed";
-  version = "1.18";
+  version = "1.19";
 
   src = fetchurl {
     url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    sha256 = "sha256-rKjvrZgAxYdySiC5eqj8R+a1pH34Fgb+q6gxsHRGK08=";
+    hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/applications/editors/poke/default.nix b/pkgs/applications/editors/poke/default.nix
index 8f4bcfd672634..fba050a040cfc 100644
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@@ -80,13 +80,13 @@ in stdenv.mkDerivation rec {
     moveToOutput share/vim "$out"
   '';
 
+  # Prevent tclPackageHook from auto-wrapping all binaries, we only
+  # need to wrap poke-gui
+  dontWrapTclBinaries = true;
+
   postFixup = lib.optionalString guiSupport ''
     wrapProgram "$out/bin/poke-gui" \
       --prefix TCLLIBPATH ' ' "$TCLLIBPATH"
-
-    # Prevent tclPackageHook from auto-wrapping all binaries, we only
-    # need to wrap poke-gui
-    unset TCLLIBPATH
   '';
 
   passthru = {
diff --git a/pkgs/applications/emulators/dolphin-emu/default.nix b/pkgs/applications/emulators/dolphin-emu/default.nix
index ad9c470bf4279..b9ef4682e87d9 100644
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@@ -1,126 +1,190 @@
-{ stdenv
-, lib
-, fetchpatch
-, pkg-config
+{ lib
+, stdenv
+, fetchFromGitHub
 , cmake
+, pkg-config
+, wrapQtAppsHook
+, alsa-lib
 , bluez
+, bzip2
+, cubeb
+, curl
+, enet
 , ffmpeg
-, libao
-, gtk3
-, glib
-, libGLU
+, fmt_8
+, hidapi
+, libevdev
 , libGL
-, gettext
-, libpthreadstubs
-, libXrandr
-, libXext
-, readline
-, openal
-, libXdmcp
-, portaudio
-, fetchFromGitHub
+, libiconv
+, libpulseaudio
+, libspng
 , libusb1
-, libevdev
-, wxGTK30
-, soundtouch
-, miniupnpc
+, libXdmcp
+, libXext
+, libXrandr
 , mbedtls_2
-, curl
-, lzo
+, mgba
+, miniupnpc
+, minizip-ng
+, openal
+, pugixml
+, qtbase
 , sfml
-, libpulseaudio ? null
+, soundtouch
+, udev
+, vulkan-loader
+, xxHash
+, xz
+
+  # Used in passthru
+, common-updater-scripts
+, dolphin-emu
+, jq
+, testers
+, writeShellScript
+
+  # Darwin-only dependencies
+, CoreBluetooth
+, ForceFeedback
+, IOKit
+, moltenvk
+, OpenGL
+, VideoToolbox
 }:
 
 stdenv.mkDerivation rec {
   pname = "dolphin-emu";
-  version = "5.0";
+  version = "5.0-18498";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = version;
-    sha256 = "07mlfnh0hwvk6xarcg315x7z2j0qbg9g7cm040df9c8psiahc3g6";
+    rev = "46b99671d9158e0ca840c1d8ef249db0f321ced7";
+    sha256 = "sha256-K+OF8o8I1XDLQQcsWC8p8jUuWeb+RoHlBG3cEZ1aWIU=";
+    fetchSubmodules = true;
   };
 
-  patches = [
-    # Fix FTBFS with glibc 2.26
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/02_glibc-2.26.patch";
-      name = "02_glibc-2.26.patch";
-      sha256 = "sha256-LBXT3rf5klwmX9YQXt4/iv06GghsWZprNhLGYlKiDqk=";
-    })
-    # Fix FTBFS with GCC 8
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/03_gcc8.patch";
-      name = "03_gcc8.patch";
-      sha256 = "sha256-uWP6zMjoHYbX6K+oPSQdBn2xWQpvNyhZabMkhtYrSbU=";
-    })
-    # Fix FTBFS with SoundTouch 2.1.2
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/05_soundtouch-2.1.2.patch";
-      name = "05_soundtouch-2.1.2.patch";
-      sha256 = "sha256-Y7CNM6GQC9GRhlOBLZlxkIpj1CFhIwA5L8lGXur/bwY=";
-    })
-    # Use GTK+3 wxWidgets backend
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/06_gtk3.patch";
-      name = "06_gtk3.patch";
-      sha256 = "sha256-pu5Q0+8kNwmpf2DoXCXHFqxF0EGTnFXJipkBz1Vh2cs=";
-    })
-  ];
-
-  cmakeFlags = [
-    "-DENABLE_LTO=True"
-  ];
-
   nativeBuildInputs = [
-    pkg-config
     cmake
+    pkg-config
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    bluez
+    bzip2
+    cubeb
+    curl
+    enet
     ffmpeg
-    libao
-    libGLU
+    fmt_8
+    hidapi
     libGL
-    gtk3
-    glib
-    gettext
-    libpthreadstubs
-    libXrandr
-    libXext
-    readline
-    openal
-    libevdev
-    libXdmcp
-    portaudio
+    libiconv
     libpulseaudio
-    libevdev
-    libXdmcp
-    portaudio
+    libspng
     libusb1
-    libpulseaudio
-    wxGTK30
-    soundtouch
-    miniupnpc
+    libXdmcp
     mbedtls_2
-    curl
-    lzo
+    miniupnpc
+    minizip-ng
+    openal
+    pugixml
+    qtbase
     sfml
+    soundtouch
+    xxHash
+    xz
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    bluez
+    libevdev
+    libXext
+    libXrandr
+    mgba # Derivation doesn't support Darwin
+    udev
+    vulkan-loader
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreBluetooth
+    ForceFeedback
+    IOKit
+    moltenvk
+    OpenGL
+    VideoToolbox
+  ];
+
+  cmakeFlags = [
+    "-DDISTRIBUTOR=NixOS"
+    "-DUSE_SHARED_ENET=ON"
+    "-DDOLPHIN_WC_REVISION=${src.rev}"
+    "-DDOLPHIN_WC_DESCRIBE=${version}"
+    "-DDOLPHIN_WC_BRANCH=master"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
+    "-DUSE_BUNDLED_MOLTENVK=OFF"
+    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
+    "-DSKIP_POSTPROCESS_BUNDLE=ON"
+    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
+    # Note: The updater isn't available on linux, so we dont need to disable it there.
+    "-DENABLE_AUTOUPDATE=OFF"
+  ];
+
+  qtWrapperArgs = lib.optionals stdenv.isLinux [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+    # https://bugs.dolphin-emu.org/issues/11807
+    # The .desktop file should already set this, but Dolphin may be launched in other ways
+    "--set QT_QPA_PLATFORM xcb"
   ];
 
+  # https://github.com/NixOS/nixpkgs/issues/201254
+  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
+
+  # Use nix-provided libraries instead of submodules
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace "if(NOT APPLE)" "if(true)" \
+      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
+  '';
+
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Only gets installed automatically if the standalone executable is used
+    mkdir -p $out/Applications
+    cp -r ./Binaries/Dolphin.app $out/Applications
+    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
   '';
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = dolphin-emu;
+      command = "dolphin-emu-nogui --version";
+    };
+
+    updateScript = writeShellScript "dolphin-update-script" ''
+      set -eou pipefail
+      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
+
+      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
+      version="$(jq -r '.shortrev' <<< "$json")"
+      rev="$(jq -r '.hash' <<< "$json")"
+      update-source-version dolphin-emu "$version" --rev="$rev"
+    '';
+  };
+
   meta = with lib; {
-    homepage = "https://dolphin-emu.org/";
+    homepage = "https://dolphin-emu.org";
     description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
+    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
+    branch = "master";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ MP2E ashkitten ];
-    # x86_32 is an unsupported platform.
-    # Enable generic build if you really want a JIT-less binary.
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      MP2E
+      ashkitten
+      xfix
+      ivar
+    ];
+    # Requires both LLVM and SDK bump
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }
diff --git a/pkgs/applications/emulators/dolphin-emu/master.nix b/pkgs/applications/emulators/dolphin-emu/master.nix
deleted file mode 100644
index 7f68b58214953..0000000000000
--- a/pkgs/applications/emulators/dolphin-emu/master.nix
+++ /dev/null
@@ -1,196 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, cmake
-, wrapQtAppsHook
-, qtbase
-, bluez
-, ffmpeg
-, libGL
-, libXrandr
-, libusb1
-, libXdmcp
-, libXext
-, openal
-, udev
-, libevdev
-, cubeb
-, curl
-, alsa-lib
-, miniupnpc
-, enet
-, mbedtls_2
-, soundtouch
-, sfml
-, minizip-ng
-, xz
-, hidapi
-, fmt_8
-, vulkan-loader
-, libpulseaudio
-, bzip2
-, libiconv
-, pugixml
-, xxHash
-
-  # Used in passthru
-, testers
-, dolphin-emu-beta
-, writeShellScript
-, common-updater-scripts
-, jq
-
-  # Darwin-only dependencies
-, CoreBluetooth
-, ForceFeedback
-, IOKit
-, VideoToolbox
-, OpenGL
-, libpng
-, moltenvk
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dolphin-emu";
-  version = "5.0-17995";
-
-  src = fetchFromGitHub {
-    owner = "dolphin-emu";
-    repo = "dolphin";
-    rev = "8bad821019721b9b72701b495da95656ace5fea5";
-    sha256 = "sha256-uxHzn+tXRBr11OPpZ4ELBw7DTJH4mnqUBOeyPlXNAh8=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # On x86_64-darwin CMake reportedly does not work without this in some cases.
-    # See https://github.com/NixOS/nixpkgs/pull/190373#issuecomment-1241310765
-    ./minizip-external-missing-include.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    cubeb
-    curl
-    ffmpeg
-    pugixml
-    xxHash
-    libGL
-    libpulseaudio
-    openal
-    libusb1
-    libiconv
-    libpng
-    libXdmcp
-    hidapi
-    miniupnpc
-    enet
-    mbedtls_2
-    soundtouch
-    sfml
-    minizip-ng
-    xz
-    qtbase
-    fmt_8
-    bzip2
-  ] ++ lib.optionals stdenv.isLinux [
-    libXrandr
-    libXext
-    bluez
-    udev
-    libevdev
-    alsa-lib
-    vulkan-loader
-  ] ++ lib.optionals stdenv.isDarwin [
-    CoreBluetooth
-    OpenGL
-    ForceFeedback
-    IOKit
-    VideoToolbox
-    moltenvk
-  ];
-
-  cmakeFlags = [
-    "-DDISTRIBUTOR=NixOS"
-    "-DUSE_SHARED_ENET=ON"
-    "-DDOLPHIN_WC_REVISION=${src.rev}"
-    "-DDOLPHIN_WC_DESCRIBE=${version}"
-    "-DDOLPHIN_WC_BRANCH=master"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
-    "-DUSE_BUNDLED_MOLTENVK=OFF"
-    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
-    "-DSKIP_POSTPROCESS_BUNDLE=ON"
-    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
-    # Note: The updater isn't available on linux, so we dont need to disable it there.
-    "-DENABLE_AUTOUPDATE=OFF"
-  ];
-
-  qtWrapperArgs = lib.optionals stdenv.isLinux [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
-    # https://bugs.dolphin-emu.org/issues/11807
-    # The .desktop file should already set this, but Dolphin may be launched in other ways
-    "--set QT_QPA_PLATFORM xcb"
-    # https://bugs.dolphin-emu.org/issues/12913
-    "--set QT_XCB_NO_XI2 1"
-  ];
-
-  # https://github.com/NixOS/nixpkgs/issues/201254
-  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
-
-  # Use nix-provided libraries instead of submodules
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace CMakeLists.txt \
-      --replace "if(NOT APPLE)" "if(true)" \
-      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
-  '';
-
-  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
-    install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Only gets installed automatically if the standalone executable is used
-    mkdir -p $out/Applications
-    cp -r ./Binaries/Dolphin.app $out/Applications
-    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = dolphin-emu-beta;
-      command = "dolphin-emu-nogui --version";
-    };
-
-    updateScript = writeShellScript "dolphin-update-script" ''
-      set -eou pipefail
-      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
-
-      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
-      version="$(jq -r '.shortrev' <<< "$json")"
-      rev="$(jq -r '.hash' <<< "$json")"
-      update-source-version dolphin-emu-beta "$version" --rev="$rev"
-    '';
-  };
-
-  meta = with lib; {
-    homepage = "https://dolphin-emu.org";
-    description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
-    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
-    branch = "master";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
-      MP2E
-      ashkitten
-      xfix
-      ivar
-    ];
-    # Requires both LLVM and SDK bump
-    broken = stdenv.isDarwin && stdenv.isx86_64;
-  };
-}
diff --git a/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch b/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
deleted file mode 100644
index 7da013ecd8f69..0000000000000
--- a/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-commit 5e0cb8066fb1653399c54e93e42375295c2562bd
-Author: Ivar Scholten <ivar.scholten@protonmail.com>
-Date:   Fri Sep 9 14:27:55 2022 +0200
-
-    Externals/minizip: add missing include to CheckFunctionExists
-
-diff --git a/Externals/minizip/CMakeLists.txt b/Externals/minizip/CMakeLists.txt
-index c3d7c5512e..f59f8b295c 100644
---- a/Externals/minizip/CMakeLists.txt
-+++ b/Externals/minizip/CMakeLists.txt
-@@ -60,6 +60,7 @@ if (HAVE_INTTYPES_H)
-   target_compile_definitions(minizip PRIVATE HAVE_INTTYPES_H)
- endif()
-
-+include(CheckFunctionExists)
- check_function_exists(fseeko HAVE_FSEEKO)
- if (NOT HAVE_FSEEKO)
-   target_compile_definitions(minizip PRIVATE NO_FSEEKO)
diff --git a/pkgs/applications/emulators/dosbox-staging/default.nix b/pkgs/applications/emulators/dosbox-staging/default.nix
index f26fb7c9d76c4..d66f9136bcf11 100644
--- a/pkgs/applications/emulators/dosbox-staging/default.nix
+++ b/pkgs/applications/emulators/dosbox-staging/default.nix
@@ -1,10 +1,15 @@
-{ alsa-lib
-, copyDesktopItems
+{ lib
+, stdenv
 , fetchFromGitHub
+, SDL2
+, SDL2_image
+, SDL2_net
+, alsa-lib
+, copyDesktopItems
 , fluidsynth
 , glib
 , gtest
-, lib
+, irr1
 , libGL
 , libGLU
 , libjack2
@@ -20,22 +25,17 @@
 , ninja
 , opusfile
 , pkg-config
-, irr1
-, SDL2
-, SDL2_image
-, SDL2_net
 , speexdsp
-, stdenv
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
   pname = "dosbox-staging";
   version = "0.80.1";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
+    owner = "dosbox-staging";
+    repo = "dosbox-staging";
+    rev = "v${self.version}";
     hash = "sha256-I90poBeLSq1c8PXyjrx7/UcbfqFNnnNiXfJdWhLPGMc=";
   };
 
@@ -49,6 +49,9 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    SDL2
+    SDL2_image
+    SDL2_net
     alsa-lib
     fluidsynth
     glib
@@ -63,9 +66,6 @@ stdenv.mkDerivation rec {
     libslirp
     libsndfile
     opusfile
-    SDL2
-    SDL2_image
-    SDL2_net
     speexdsp
   ];
 
@@ -91,17 +91,17 @@ stdenv.mkDerivation rec {
     # original dosbox. Doing it this way allows us to work with frontends and
     # launchers that expect the binary to be named dosbox, but get out of the
     # way of vanilla dosbox if the user desires to install that as well.
-    mv $out/bin/dosbox $out/bin/${pname}
+    mv $out/bin/dosbox $out/bin/${self.pname}
     makeWrapper $out/bin/dosbox-staging $out/bin/dosbox
 
     # Create a symlink to dosbox manual instead of merely copying it
     pushd $out/share/man/man1/
-    mv dosbox.1.gz ${pname}.1.gz
-    ln -s ${pname}.1.gz dosbox.1.gz
+    mv dosbox.1.gz ${self.pname}.1.gz
+    ln -s ${self.pname}.1.gz dosbox.1.gz
     popd
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://dosbox-staging.github.io/";
     description = "A modernized DOS emulator";
     longDescription = ''
@@ -110,10 +110,14 @@ stdenv.mkDerivation rec {
       existing DOSBox codebase while leveraging modern development tools and
       practices.
     '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ joshuafern AndersonTorres ];
-    platforms = platforms.unix;
+    changelog = "https://github.com/dosbox-staging/dosbox-staging/releases/tag/v${self.version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [
+      lib.maintainers.joshuafern
+      lib.maintainers.AndersonTorres
+    ];
+    platforms = lib.platforms.unix;
     priority = 101;
   };
-}
-# TODO: report upstream about not finding SDL2_net
+})
+# TODO: report upstream about not finding extra SDL2 libraries
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index 084bf07454298..aedf42ee126b5 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -117,6 +117,10 @@ stdenv.mkDerivation rec {
       --subst-var-by mamePath "$out/opt/mame"
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=use-after-free"
+  ];
+
   desktopItems = [
     (makeDesktopItem {
       name = "MAME";
diff --git a/pkgs/applications/emulators/rpcs3/default.nix b/pkgs/applications/emulators/rpcs3/default.nix
index b2861184a61bf..b9efcaaf4f6e5 100644
--- a/pkgs/applications/emulators/rpcs3/default.nix
+++ b/pkgs/applications/emulators/rpcs3/default.nix
@@ -1,4 +1,4 @@
-{ gcc11Stdenv, lib, fetchFromGitHub, wrapQtAppsHook, cmake, pkg-config, git
+{ gcc12Stdenv, lib, fetchFromGitHub, wrapQtAppsHook, cmake, pkg-config, git
 , qtbase, qtquickcontrols, qtmultimedia, openal, glew, vulkan-headers, vulkan-loader, libpng
 , ffmpeg, libevdev, libusb1, zlib, curl, wolfssl, python3, pugixml, faudio, flatbuffers
 , sdl2Support ? true, SDL2
@@ -21,7 +21,7 @@ let
     sha256 = "0c3g30rj1y8fbd2q4kwlpg1jdy02z4w5ryhj3yr9051pdnf4kndz";
   };
 in
-gcc11Stdenv.mkDerivation {
+gcc12Stdenv.mkDerivation {
   pname = "rpcs3";
   version = rpcs3Version;
 
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 0ad5226133088..1d7863df05e87 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.0-61";
+  version = "7.1.0-62";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-g7WeqPpPd1gceU+s+vRDpb41IX1lzpiqh3cAYeFdUlg=";
+    hash = "sha256-K74BWxGTpkaE+KBrdOCVd+m/2MJP6YUkB2CFh/YEHyI=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/graphics/eyedropper/default.nix b/pkgs/applications/graphics/eyedropper/default.nix
index 8b4411ad04b36..d088f633c3f3b 100644
--- a/pkgs/applications/graphics/eyedropper/default.nix
+++ b/pkgs/applications/graphics/eyedropper/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "An easy-to-use color picker and editor";
+    description = "A powerful color picker and formatter";
     homepage = "https://github.com/FineFindus/eyedropper";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
diff --git a/pkgs/applications/graphics/foxotron/default.nix b/pkgs/applications/graphics/foxotron/default.nix
index e8fd0364808c2..ca2aa96bea141 100644
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@@ -46,6 +46,11 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [ libX11 libXrandr libXinerama libXcursor libXi libXext alsa-lib fontconfig libGLU ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ AVFoundation Carbon Cocoa CoreAudio Kernel OpenGL ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index 325d1bcf083dd..8f70d9273b7a8 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons pkg-config wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+  ];
+
   NIX_LDFLAGS = "-lpthread";
 
   buildPhase = ''
diff --git a/pkgs/applications/graphics/hdrmerge/default.nix b/pkgs/applications/graphics/hdrmerge/default.nix
index b0e346331bce8..d690f5e0671a9 100644
--- a/pkgs/applications/graphics/hdrmerge/default.nix
+++ b/pkgs/applications/graphics/hdrmerge/default.nix
@@ -46,6 +46,11 @@ mkDerivation rec {
       url = "https://github.com/mkroehnert/hdrmerge/commit/472b2dfe7d54856158aea3d5412a02d0bab1da4c.patch";
       sha256 = "0jc713ajr4w08pfbi6bva442prj878nxp1fpl9112i3xj34x9sdi";
     })
+    (fetchpatch {
+      name = "support-libraw-0.21.patch";
+      url = "https://github.com/jcelaya/hdrmerge/commit/779e566b3e2807280b78c79affda2cdfa64bde87.diff";
+      sha256 = "48sivCfJWEtGiBXTrO+SWTVlT9xyx92w2kkB8Wt/clk=";
+    })
   ];
 
   desktopItems = [
diff --git a/pkgs/applications/graphics/jpegoptim/default.nix b/pkgs/applications/graphics/jpegoptim/default.nix
index 951bb9d7d8943..ff00d565f47d3 100644
--- a/pkgs/applications/graphics/jpegoptim/default.nix
+++ b/pkgs/applications/graphics/jpegoptim/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "1.5.1";
+  version = "1.5.2";
   pname = "jpegoptim";
 
   src = fetchFromGitHub {
     owner = "tjko";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QPipwBk+BS/u3YxB8ACeFXQSuoW1aynEyG3tEMrhcaE=";
+    sha256 = "sha256-PROQvOqsis8we58OOZ/kuY+L/CoV7XfnY9wvrpsTJu8=";
   };
 
   # There are no checks, it seems.
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index cfb63e0e3f7cb..e8e6a2cc9f867 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -1,7 +1,7 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  version = "5.1.4";
+  version = "5.1.5";
   kde-channel = "stable";
-  sha256 = "sha256-wisCCGJZbrL92RHhsXnbvOewgb4RFFei6sr2rhzKLcs=";
+  sha256 = "1lx4x4affkbh47b7w5qvahkkr4db0vcw6h24nykak6gpy2z5wxqw";
 })
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index 7a05114a1e98c..54f956981ee96 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "5.10.0";
+  version = "5.11.0";
 
   docFiles = [
     (fetchurl {
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
     owner = "paraview";
     repo = "paraview";
     rev = "v${version}";
-    sha256 = "0ipx6zq44hpic7gvv0s2jvjncak6vlmrz5sp9ypc15b15bna0gs2";
+    sha256 = "sha256-WvkKGl5lG+apX6m4ULVZZVtDsSUjEVXe/seh95b+LmI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/tesseract/tesseract3.nix b/pkgs/applications/graphics/tesseract/tesseract3.nix
index 16365674706ed..bf19d0f77eb6f 100644
--- a/pkgs/applications/graphics/tesseract/tesseract3.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract3.nix
@@ -3,15 +3,23 @@
 
 stdenv.mkDerivation rec {
   pname = "tesseract";
-  version = "3.05.00";
+  version = "3.05.02";
 
   src = fetchFromGitHub {
     owner = "tesseract-ocr";
     repo = "tesseract";
     rev = version;
-    hash = "sha256-YHj00gG/3SW0ILTiQwphiCxuP9OCDya27hyFQB27mYc=";
+    hash = "sha256-28osuZnVwkJpNTYkU+5D5PI8xtViFzGCMScHzkS2H20=";
   };
 
+  # leptonica 1.83 made internal structures private. using internal headers isn't
+  # great, but tesseract3's days are numbered anyway
+  postPatch = ''
+    for f in textord/devanagari_processing.cpp cube/cube_line_object.h cube/cube_line_segmenter.h cube/cube_utils.h ; do
+      sed -i '/allheaders.h/a#include "pix_internal.h"' "$f"
+    done
+  '';
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/tesseract/tesseract4.nix b/pkgs/applications/graphics/tesseract/tesseract4.nix
index 36c4c694a16a8..aecdf58186d05 100644
--- a/pkgs/applications/graphics/tesseract/tesseract4.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract4.nix
@@ -3,26 +3,20 @@
 
 stdenv.mkDerivation rec {
   pname = "tesseract";
-  version = "4.1.1";
+  version = "4.1.3";
 
   src = fetchFromGitHub {
     owner = "tesseract-ocr";
     repo = "tesseract";
     rev = version;
-    hash = "sha256-lu/Y5mlCI8AajhiWaID0fGo5PghEQZdgt2X0K9c/QrE=";
+    hash = "sha256-sV3w53ky13ESc0dGPutMGQ4TcmOeWJkvUwBPIyzSTc8=";
   };
 
-  patches = [
-    # https://github.com/tesseract-ocr/tesseract/issues/3447
-    (fetchpatch {
-      url = "https://github.com/tesseract-ocr/tesseract/commit/dbc79b09d195490dfa3f7d338eadac07ad6683f7.patch";
-      sha256 = "sha256-lGlg0etuU4RXfdq1QH2bYObdeGrFHKf9O8zMUAbfNIQ=";
-    })
-    (fetchpatch {
-      url = "https://github.com/tesseract-ocr/tesseract/commit/6dc4b184b1ebf2e68461f6b63f63a033bc7245f7.patch";
-      sha256 = "sha256-DwIX3r5NmeajI6WgIVHDbkhLH/ygJIjPO5XrbzWQhSw=";
-    })
-  ];
+  # leptonica 1.83 made internal structures private. using internal headers isn't
+  # great, but tesseract4's days are numbered anyway
+  postPatch = ''
+    sed -i '/allheaders.h/a#include "pix_internal.h"' src/textord/devanagari_processing.cpp
+  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/misc/darkman/default.nix b/pkgs/applications/misc/darkman/default.nix
index 04b1af9bc2aea..a20b8ab72625b 100644
--- a/pkgs/applications/misc/darkman/default.nix
+++ b/pkgs/applications/misc/darkman/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "darkman";
-  version = "1.4.0";
+  version = "1.5.4";
 
   src = fetchFromGitLab {
     owner = "WhyNotHugo";
     repo = "darkman";
     rev = "v${version}";
-    sha256 = "sha256-Q/pjQmlyREl32C0LiwypEz1qBw2AeBOZbUIwNP392Sc=";
+    sha256 = "sha256-6SNXVe6EfVwcXH9O6BxNw+v4/uhKhCtVS3XE2GTc2Sc=";
   };
 
-  vendorSha256 = "09rjqw6v1jaf0mhmycw9mcay9q0y1fya2azj8216gdgkl48ics08";
+  vendorSha256 = "sha256-xEPmNnaDwFU4l2G4cMvtNeQ9KneF5g9ViQSFrDkrafY=";
 
   nativeBuildInputs = [ scdoc ];
 
diff --git a/pkgs/applications/misc/lyx/default.nix b/pkgs/applications/misc/lyx/default.nix
index d1a19eeccc5e3..921ae570bca0b 100644
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@@ -11,6 +11,12 @@ mkDerivation rec {
     sha256 = "sha256-xr7SYzQZiY4Bp8w1AxDX2TS/WRyrcln8JYGqTADq+ng=";
   };
 
+  # Needed with GCC 12
+  postPatch = ''
+    sed '1i#include <iterator>' -i src/lyxfind.cpp
+    sed '1i#include <cstring>'  -i src/insets/InsetListings.cpp
+  '';
+
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
   nativeBuildInputs = [ pkg-config makeWrapper ];
   buildInputs = [
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 935a9582fcaca..e5e0f92ed1da4 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -140,13 +140,16 @@ in stdenv.mkDerivation rec {
     patchShebangs tools/get_wb_version.sh
   '';
 
-  NIX_CFLAGS_COMPILE = toString ([
+  NIX_CFLAGS_COMPILE = [
     # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
     "-Wno-error=deprecated-declarations"
   ] ++ lib.optionals stdenv.isAarch64 [
     # error: narrowing conversion of '-1' from 'int' to 'char'
     "-Wno-error=narrowing"
-  ]);
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=maybe-uninitalized"
+  ];
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/misc/qt-box-editor/default.nix b/pkgs/applications/misc/qt-box-editor/default.nix
index 9480a32aae3d3..7987208b885a4 100644
--- a/pkgs/applications/misc/qt-box-editor/default.nix
+++ b/pkgs/applications/misc/qt-box-editor/default.nix
@@ -10,23 +10,25 @@
 
 mkDerivation {
   pname = "qt-box-editor";
-  version = "unstable-2019-07-12";
+  version = "unstable-2019-07-14";
 
   src = fetchFromGitHub {
     owner = "zdenop";
     repo = "qt-box-editor";
-    rev = "75a68b466868ba41ba2886caa796057403fe1901";
-    sha256 = "0zwsyy7cnbhy5aazwlkhd9y8bnzlgy1gffqa46abajn4809b95k3";
+    rev = "cba2929dabc6c715acd1a282ba161fee914c87f6";
+    hash = "sha256-3dWnAu0CLO3atjbC1zJEnL3vzsIEecDDDhW3INMfCv4=";
   };
 
   buildInputs = [ qtbase qtsvg leptonica tesseract ];
 
   nativeBuildInputs = [ qmake ];
 
-  # remove with next release
-  # https://github.com/zdenop/qt-box-editor/pull/78
+  # https://github.com/zdenop/qt-box-editor/issues/87
   postPatch = ''
-    printf "INSTALLS += target\ntarget.path = $out/bin" >>  qt-box-editor.pro
+    sed -i '/allheaders.h/a#include <leptonica/pix_internal.h>' src/TessTools.h
+
+    substituteInPlace qt-box-editor.pro \
+      --replace '-llept' '-lleptonica'
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/regextester/default.nix b/pkgs/applications/misc/regextester/default.nix
index 2a00cb92b9d1b..e5900a050efc5 100644
--- a/pkgs/applications/misc/regextester/default.nix
+++ b/pkgs/applications/misc/regextester/default.nix
@@ -11,18 +11,19 @@
 , ninja
 , gobject-introspection
 , gsettings-desktop-schemas
+, desktop-file-utils
 , pantheon
 , wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "regextester";
-  version = "1.0.1";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "artemanufrij";
     repo = "regextester";
     rev = version;
-    sha256 = "1xwwv1hccni1mrbl58f7ly4qfq6738vn24bcbl2q346633cd7kx3";
+    hash = "sha256-5+gU8DeB99w2h/4vMal2eHkR0305dmRYiY6fsLZzlnc=";
   };
 
   nativeBuildInputs = [
@@ -34,6 +35,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     wrapGAppsHook
+    desktop-file-utils
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/cluster/linkerd/edge.nix b/pkgs/applications/networking/cluster/linkerd/edge.nix
index 365016eb672d8..a124d633b37de 100644
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "23.1.2";
-  sha256 = "1c8l5zzy5pjilp1a84084g3dgdm0rxkx7hj7lqcn0iihfvhxc1xq";
-  vendorSha256 = "sha256-6dOX3SsKjpwC/dEUO2SnVna99lpav7kIEKrMUy4YfhA=";
+  version = "23.2.1";
+  sha256 = "0qjl6qxfg6bj22fwm2y01if5dqp2w79y45ibrg46r33pf6gbwjxj";
+  vendorSha256 = "sha256-YxWBjbE3aBFfCbQeSTfQv5QzP5n4IRHHqNrFwrJPQ7g=";
 }
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index c9af58b1a8a85..fc2aa83aa430d 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.12.0";
+  version = "5.13.3";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    sha256 = "sha256-WE/XWNBy5p8PEQ11s8nmW+HoVEkQB9cKoj5ZS8Suvs8=";
+    sha256 = "sha256-6kbfsqhALf7LFl0GS4VAMTVDFKP+CaEr6IPfpTZ33Fo=";
   };
 
-  vendorHash = "sha256-F5Vh9wPd53bifLStk6wEwidPZvOjN87jn4RxJbSuW4o=";
+  vendorHash = "sha256-lXW1yHrGLwZdhfkMLeu7zm0w2HxXk1DW+QEY+rfGZpE=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index 88319182a648f..2285a11bbf021 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "go-graft";
-  version = "0.2.16";
+  version = "0.2.17";
 
   src = fetchFromGitHub {
     owner = "mzz2017";
     repo = "gg";
     rev = "v${version}";
-    sha256 = "sha256-zdOcQ/+WXS7pDfnvYdb/FDjMT3yJdwnS8DoH2MIDcDs=";
+    sha256 = "sha256-UhRsgUz9au7e47cS6yrIJXc/8ZxVDpMHWBjoAcw+oCM=";
   };
 
   CGO_ENABLED = 0;
 
   ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
-  vendorHash = "sha256-kx94B1XIXWJOY9Y69lNb/sHWVjsuFuOXrdtJFJrUuAs=";
+  vendorHash = "sha256-EiBt2SxUQY05Wr7KJbK+fs3U3iSmqECJ0glS8B2Ox9Q=";
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index fdfb992192b33..87eb241686c65 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -3,7 +3,7 @@ let
   versions = if stdenv.isLinux then {
     stable = "0.0.24";
     ptb = "0.0.38";
-    canary = "0.0.146";
+    canary = "0.0.148";
   } else {
     stable = "0.0.264";
     ptb = "0.0.59";
@@ -22,7 +22,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-5GiG+RGqwHUdIeSVWpbaIw3sTuZbvIQeetXSEvSqTls=";
+        sha256 = "sha256-2ZrSDyPj3AHriCWZ/bb303H3J97TTun//WjmInNEmwk=";
       };
     };
     x86_64-darwin = {
diff --git a/pkgs/applications/networking/instant-messengers/jami/client.nix b/pkgs/applications/networking/instant-messengers/jami/client.nix
index f76d9ee9f12a2..80efff68e65f0 100644
--- a/pkgs/applications/networking/instant-messengers/jami/client.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/client.nix
@@ -9,7 +9,7 @@
 , python3
 , qttools # for translations
 , wrapQtAppsHook
-, ffmpeg-jami
+, ffmpeg_5
 , jami-daemon
 , libnotify
 , qt5compat
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
-    ffmpeg-jami
+    ffmpeg_5
     jami-daemon
     libnotify
     networkmanager
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common
deleted file mode 100644
index 0aac24e24bb67..0000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common
+++ /dev/null
@@ -1,156 +0,0 @@
---disable-everything
---enable-zlib
---enable-gpl
---enable-swscale
---enable-bsfs
---disable-filters
---disable-programs
---disable-postproc
---disable-protocols
---enable-protocol=crypto
---enable-protocol=file
---enable-protocol=rtp
---enable-protocol=srtp
---enable-protocol=tcp
---enable-protocol=udp
---enable-protocol=unix
---enable-protocol=pipe
---disable-demuxers
---disable-muxers
---enable-muxer=rtp
---enable-muxer=g722
---enable-muxer=g723_1
---enable-muxer=g726
---enable-muxer=g726le
---enable-muxer=h263
---enable-muxer=h264
---enable-muxer=hevc
---enable-muxer=matroska
---enable-muxer=webm
---enable-muxer=ogg
---enable-muxer=pcm_s16be
---enable-muxer=pcm_s16le
---enable-demuxer=rtp
---enable-demuxer=mjpeg
---enable-demuxer=mjpeg_2000
---enable-demuxer=mpegvideo
---enable-demuxer=gif
---enable-demuxer=image_jpeg_pipe
---enable-demuxer=image_png_pipe
---enable-demuxer=image_webp_pipe
---enable-demuxer=matroska
---enable-demuxer=m4v
---enable-demuxer=mp3
---enable-demuxer=ogg
---enable-demuxer=flac
---enable-demuxer=wav
---enable-demuxer=ac3
---enable-demuxer=g722
---enable-demuxer=g723_1
---enable-demuxer=g726
---enable-demuxer=g726le
---enable-demuxer=pcm_mulaw
---enable-demuxer=pcm_alaw
---enable-demuxer=pcm_s16be
---enable-demuxer=pcm_s16le
---enable-demuxer=h263
---enable-demuxer=h264
---enable-demuxer=hevc
---enable-parser=h263
---enable-parser=h264
---enable-parser=hevc
---enable-parser=mpeg4video
---enable-parser=vp8
---enable-parser=vp9
---enable-parser=opus
---enable-encoder=adpcm_g722
---enable-decoder=adpcm_g722
---enable-encoder=adpcm_g726
---enable-decoder=adpcm_g726
---enable-encoder=adpcm_g726le
---enable-decoder=adpcm_g726le
---enable-decoder=g729
---enable-encoder=g723_1
---enable-decoder=g723_1
---enable-encoder=rawvideo
---enable-decoder=rawvideo
---enable-encoder=libx264
---enable-decoder=h264
---enable-encoder=pcm_alaw
---enable-decoder=pcm_alaw
---enable-encoder=pcm_mulaw
---enable-decoder=pcm_mulaw
---enable-encoder=mpeg4
---enable-decoder=mpeg4
---enable-encoder=libvpx_vp8
---enable-decoder=vp8
---enable-decoder=vp9
---enable-encoder=h263
---enable-encoder=h263p
---enable-decoder=h263
---enable-encoder=mjpeg
---enable-decoder=mjpeg
---enable-decoder=mjpegb
---enable-libspeex
---enable-libopus
---enable-libvpx
---enable-libx264
---enable-encoder=libspeex
---enable-decoder=libspeex
---enable-encoder=libopus
---enable-decoder=libopus
---enable-decoder=flac
---enable-decoder=vorbis
---enable-decoder=aac
---enable-decoder=ac3
---enable-decoder=eac3
---enable-decoder=mp3
---enable-decoder=pcm_u24be
---enable-decoder=pcm_u24le
---enable-decoder=pcm_u32be
---enable-decoder=pcm_u32le
---enable-decoder=pcm_u8
---enable-decoder=pcm_f16le
---enable-decoder=pcm_f24le
---enable-decoder=pcm_f32be
---enable-decoder=pcm_f32le
---enable-decoder=pcm_f64be
---enable-decoder=pcm_f64le
---enable-decoder=pcm_s16be
---enable-decoder=pcm_s16be_planar
---enable-decoder=pcm_s16le
---enable-decoder=pcm_s16le_planar
---enable-decoder=pcm_s24be
---enable-decoder=pcm_s24le
---enable-decoder=pcm_s24le_planar
---enable-decoder=pcm_s32be
---enable-decoder=pcm_s32le
---enable-decoder=pcm_s32le_planar
---enable-decoder=pcm_s64be
---enable-decoder=pcm_s64le
---enable-decoder=pcm_s8
---enable-decoder=pcm_s8_planar
---enable-decoder=pcm_u16be
---enable-decoder=pcm_u16le
---enable-encoder=gif
---enable-decoder=gif
---enable-encoder=jpegls
---enable-decoder=jpegls
---enable-encoder=ljpeg
---enable-decoder=jpeg2000
---enable-encoder=png
---enable-decoder=png
---enable-encoder=bmp
---enable-decoder=bmp
---enable-encoder=tiff
---enable-decoder=tiff
---enable-filter=scale
---enable-filter=overlay
---enable-filter=amix
---enable-filter=amerge
---enable-filter=aresample
---enable-filter=format
---enable-filter=aformat
---enable-filter=fps
---enable-filter=transpose
---enable-filter=pad
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux
deleted file mode 100644
index 6c40e8d2ea994..0000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux
+++ /dev/null
@@ -1,18 +0,0 @@
---enable-pic
---target-os=linux
---enable-indev=v4l2
---enable-indev=xcbgrab
---enable-vdpau
---enable-hwaccel=h264_vdpau
---enable-hwaccel=mpeg4_vdpau
---enable-vaapi
---enable-hwaccel=h264_vaapi
---enable-hwaccel=mpeg4_vaapi
---enable-hwaccel=h263_vaapi
---enable-hwaccel=vp8_vaapi
---enable-hwaccel=mjpeg_vaapi
---enable-hwaccel=hevc_vaapi
---enable-encoder=h264_vaapi
---enable-encoder=vp8_vaapi
---enable-encoder=mjpeg_vaapi
---enable-encoder=hevc_vaapi
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86 b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86
deleted file mode 100644
index 2043aa3ee2d3c..0000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86
+++ /dev/null
@@ -1,10 +0,0 @@
---enable-cuvid
---enable-ffnvcodec
---enable-nvdec
---enable-nvenc
---enable-hwaccel=h264_nvdec
---enable-hwaccel=hevc_nvdec
---enable-hwaccel=vp8_nvdec
---enable-hwaccel=mjpeg_nvdec
---enable-encoder=h264_nvenc
---enable-encoder=hevc_nvenc
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches
deleted file mode 100644
index 28f884e66769d..0000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches
+++ /dev/null
@@ -1,7 +0,0 @@
-remove-mjpeg-log.patch
-change-RTCP-ratio.patch
-rtp_ext_abs_send_time.patch
-libopusdec-enable-FEC.patch
-libopusenc-reload-packet-loss-at-encode.patch
-ios-disable-b-frames.patch
-screen-sharing-x11-fix.patch
diff --git a/pkgs/applications/networking/instant-messengers/jami/daemon.nix b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
index 715560c6e128f..bf2392f631535 100644
--- a/pkgs/applications/networking/instant-messengers/jami/daemon.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
@@ -9,7 +9,7 @@
 , asio
 , dbus
 , dbus_cplusplus
-, ffmpeg-jami
+, ffmpeg_5
 , fmt
 , gmp
 , gnutls
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     dbus
     dbus_cplusplus
     fmt
-    ffmpeg-jami
+    ffmpeg_5
     gmp
     gnutls
     http-parser
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index ea898c0da8c9d..497616a6c0388 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -4,7 +4,6 @@
 , fetchFromGitHub
 , fetchzip
 , fetchpatch
-, ffmpeg_5
 , pjsip
 , opendht
 , jack
@@ -41,31 +40,6 @@ let
   readLinesToList = with builtins; file: filter (s: isString s && stringLength s > 0) (split "\n" (readFile file));
 in
 rec {
-  ffmpeg-jami = (ffmpeg_5.override rec {
-    version = "5.0.1";
-    branch = version;
-    sha256 = "sha256-KN8z1AChwcGyDQepkZeAmjuI73ZfXwfcH/Bn+sZMWdY=";
-    doCheck = false;
-  }).overrideAttrs (old:
-    let
-      patch-src = src + "/daemon/contrib/src/ffmpeg/";
-    in
-    {
-      patches = old.patches ++ (map (x: patch-src + x) (readLinesToList ./config/ffmpeg_patches)) ++
-        # SDL2 recently changed their versioning
-        [
-          (fetchpatch {
-            url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
-            hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
-          })
-        ];
-      configureFlags = old.configureFlags
-        ++ (readLinesToList ./config/ffmpeg_args_common)
-        ++ lib.optionals stdenv.isLinux (readLinesToList ./config/ffmpeg_args_linux)
-        ++ lib.optionals (stdenv.isx86_32 || stdenv.isx86_64) (readLinesToList ./config/ffmpeg_args_x86);
-      outputs = [ "out" "doc" ];
-    });
-
   pjsip-jami = pjsip.overrideAttrs (old:
     let
       patch-src = src + "/daemon/contrib/src/pjproject/";
@@ -105,10 +79,10 @@ rec {
   };
 
   jami-daemon = callPackage ./daemon.nix {
-    inherit version src udev jack jami-meta ffmpeg-jami pjsip-jami opendht-jami;
+    inherit version src udev jack jami-meta pjsip-jami opendht-jami;
   };
 
   jami-client = qt6Packages.callPackage ./client.nix {
-    inherit version src ffmpeg-jami jami-meta;
+    inherit version src jami-meta;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
index e80ccd2105aa5..9feb5ff10a077 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config, cmake, ninja, yasm
 , libjpeg, openssl_1_1, libopus, ffmpeg, alsa-lib, libpulseaudio, protobuf
 , openh264, usrsctp, libevent, libvpx
@@ -31,6 +31,14 @@ stdenv.mkDerivation {
     mesa libepoxy libglvnd
   ];
 
+  patches = [
+    # GCC 12 Fix
+    (fetchpatch {
+      url = "https://github.com/desktop-app/tg_owt/pull/101/commits/86d2bcd7afb8706663d29e30f65863de5a626142.patch";
+      hash = "sha256-iWS0mB8R0vqPU/0qf6Ax54UCAKYDVCPac2mi/VHbFm0=";
+    })
+  ];
+
   cmakeFlags = [
     # Building as a shared library isn't officially supported and may break at any time.
     "-DBUILD_SHARED_LIBS=OFF"
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index dfa92fc42c98e..91a424d9eb12e 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -18,6 +18,8 @@
 , gssSupport   ? true
 , writeScript
 }:
+assert smimeSupport -> sslSupport;
+assert gpgmeSupport -> sslSupport;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index e74084e14c524..3b171070a5735 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,13 +4,13 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.23.0";
+      version = "1.23.1";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-Z4YVU45na4BgIbN/IlORpTCuf2EuSuOyppDRzswn3EI=";
+        hash = "sha256-Jbg56Nn+5ZjIv1KZrThkqWY+P13MglLE78E6jc0rbY0=";
       };
 
       vendorHash = "sha256-q63iaRxJRvPY0Np20O6JmdMEjSg/kxRneBfs8fRTwXk=";
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 700a94429964d..f9e9ec57704c3 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -80,6 +80,11 @@ stdenv.mkDerivation rec {
   # guile warning
   GUILE_AUTO_COMPILE="0";
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=use-after-free"
+  ];
+
   # `make check` target does not define its prerequisites but expects them to
   # have already been built.  The list of targets below was built through trial
   # and error based on failing tests.
diff --git a/pkgs/applications/office/paperwork/paperwork-shell.nix b/pkgs/applications/office/paperwork/paperwork-shell.nix
index ee621df4d8379..ca6cab2c1e4f8 100644
--- a/pkgs/applications/office/paperwork/paperwork-shell.nix
+++ b/pkgs/applications/office/paperwork/paperwork-shell.nix
@@ -11,6 +11,7 @@
 , fabulous
 , getkey
 , psutil
+, shared-mime-info
 
 , pkgs
 }:
@@ -39,6 +40,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    shared-mime-info
     openpaperwork-gtk
   ];
 
diff --git a/pkgs/applications/office/paperwork/src.nix b/pkgs/applications/office/paperwork/src.nix
index 980a4aabf7ab5..6323c2c417b85 100644
--- a/pkgs/applications/office/paperwork/src.nix
+++ b/pkgs/applications/office/paperwork/src.nix
@@ -1,13 +1,13 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.1.1";
+  version = "2.1.2";
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     repo = "paperwork";
     group = "World";
     owner = "OpenPaperwork";
     rev = version;
-    sha256 = "2M2eMP54F3RRDMBuAZ1gBiBoMmTRJaHTUwtTjj4ZU+4=";
+    sha256 = "/5k+zUtTE+Dr879xbHDCAYrqlEJLsbkcRSG3GbA/PCg=";
   };
   sample_documents = fetchFromGitLab {
     domain = "gitlab.gnome.org";
diff --git a/pkgs/applications/plasma-mobile/angelfish.nix b/pkgs/applications/plasma-mobile/angelfish.nix
index 1e1800fad4518..7a7e48d736d0c 100644
--- a/pkgs/applications/plasma-mobile/angelfish.nix
+++ b/pkgs/applications/plasma-mobile/angelfish.nix
@@ -3,7 +3,7 @@
 , cmake
 , corrosion
 , extra-cmake-modules
-, gcc11
+, gcc12
 , kconfig
 , kcoreaddons
 , kdbusaddons
@@ -46,7 +46,7 @@ mkDerivation rec {
     cmake
     corrosion
     extra-cmake-modules
-    gcc11 # doesn't build with GCC 9 from stdenv on aarch64
+    gcc12 # doesn't build with GCC 9 from stdenv on aarch64
   ] ++ (with rustPlatform; [
     cargoSetupHook
     rust.cargo
diff --git a/pkgs/applications/plasma-mobile/audiotube.nix b/pkgs/applications/plasma-mobile/audiotube.nix
index cb87fe0ed24db..14bfc6d18917e 100644
--- a/pkgs/applications/plasma-mobile/audiotube.nix
+++ b/pkgs/applications/plasma-mobile/audiotube.nix
@@ -2,7 +2,7 @@
 , mkDerivation
 
 , extra-cmake-modules
-, gcc11
+, gcc12
 , wrapGAppsHook
 
 , gst_all_1
@@ -22,7 +22,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     extra-cmake-modules
     wrapGAppsHook
-    gcc11 # doesn't build with GCC 9 from stdenv on aarch64
+    gcc12 # doesn't build with GCC 9 from stdenv on aarch64
     python3Packages.wrapPython
     python3Packages.pybind11
   ];
diff --git a/pkgs/applications/plasma-mobile/neochat.nix b/pkgs/applications/plasma-mobile/neochat.nix
index 2f655d5a9e09c..8b3da82b8b885 100644
--- a/pkgs/applications/plasma-mobile/neochat.nix
+++ b/pkgs/applications/plasma-mobile/neochat.nix
@@ -1,4 +1,4 @@
-{ gcc11Stdenv
+{ gcc12Stdenv
 , lib
 , srcs
 
@@ -31,7 +31,7 @@
 }:
 
 # Workaround for AArch64 not using GCC11 yet.
-gcc11Stdenv.mkDerivation rec {
+gcc12Stdenv.mkDerivation rec {
   pname = "neochat";
   inherit (srcs.neochat) version src;
 
diff --git a/pkgs/applications/plasma-mobile/spacebar.nix b/pkgs/applications/plasma-mobile/spacebar.nix
index 7a2a3c0af8fbb..c120851e5b2e0 100644
--- a/pkgs/applications/plasma-mobile/spacebar.nix
+++ b/pkgs/applications/plasma-mobile/spacebar.nix
@@ -1,6 +1,6 @@
 { lib
 , mkDerivation
-, gcc11Stdenv
+, gcc12Stdenv
 , srcs
 
 , cmake
@@ -24,8 +24,8 @@
 , qtquickcontrols2
 }:
 
-# Workaround for AArch64 not using GCC11 yet.
-gcc11Stdenv.mkDerivation rec {
+# Workaround for AArch64 still using GCC9.
+gcc12Stdenv.mkDerivation rec {
   pname = "spacebar";
   inherit (srcs.spacebar) version src;
 
diff --git a/pkgs/applications/science/biology/last/default.nix b/pkgs/applications/science/biology/last/default.nix
index 7a101e6e19dc4..0104a5506bc6a 100644
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1445";
+  version = "1447";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-E3D9KmCIVcwXblwJ0wePk0wKoXwKA2UsSGqfMmRsw2A=";
+    hash = "sha256-zts1F2tFeBP7CQifpc2M4i6duK8FA7hQXTOizv8/kWM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/octopus/default.nix b/pkgs/applications/science/biology/octopus/default.nix
index 659b1e97f200f..b7c8c138cb82b 100644
--- a/pkgs/applications/science/biology/octopus/default.nix
+++ b/pkgs/applications/science/biology/octopus/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VaUr63v7mzhh4VBghH7a7qrqOYwl6vucmmKzTi9yAjY=";
   }) ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
   postInstall = ''
     mkdir $out/bin
     mv $out/octopus $out/bin
diff --git a/pkgs/applications/science/chemistry/octopus/default.nix b/pkgs/applications/science/chemistry/octopus/default.nix
index d0058c8650d81..cc145baef037a 100644
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@@ -41,12 +41,12 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = with lib; [
-    "--with-yaml-prefix=${libyaml}"
+    "--with-yaml-prefix=${lib.getDev libyaml}"
     "--with-blas=-lblas"
     "--with-lapack=-llapack"
-    "--with-fftw-prefix=${fftw.dev}"
-    "--with-gsl-prefix=${gsl}"
-    "--with-libxc-prefix=${libxc}"
+    "--with-fftw-prefix=${lib.getDev fftw}"
+    "--with-gsl-prefix=${lib.getDev gsl}"
+    "--with-libxc-prefix=${lib.getDev libxc}"
     "--enable-openmp"
   ] ++ optional enableFma "--enable-fma3"
     ++ optional enableFma4 "--enable-fma4"
diff --git a/pkgs/applications/science/logic/cbmc/default.nix b/pkgs/applications/science/logic/cbmc/default.nix
index ba5719012ed65..d61a9893942f8 100644
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@@ -60,9 +60,13 @@ stdenv.mkDerivation rec {
       --prefix PATH : "$out/share/cbmc" \
   '';
 
-  # fix "argument unused during compilation"
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
-    "-Wno-unused-command-line-argument";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    # fix "argument unused during compilation"
+    "-Wno-unused-command-line-argument"
+  ];
 
   # TODO: add jbmc support
   cmakeFlags = [ "-DWITH_JBMC=OFF" "-Dsat_impl=cadical" "-Dcadical_INCLUDE_DIR=${cadical.dev}/include" ];
diff --git a/pkgs/applications/science/math/gap/default.nix b/pkgs/applications/science/math/gap/default.nix
index 677e7d9a0d96c..7a466f8c000c5 100644
--- a/pkgs/applications/science/math/gap/default.nix
+++ b/pkgs/applications/science/math/gap/default.nix
@@ -134,8 +134,6 @@ stdenv.mkDerivation rec {
     # https://github.com/NixOS/nixpkgs/pull/192548#discussion_r992824942
     rm -r "$out/share/gap/pkg"
     cp -ar pkg tst "$out/share/gap"
-
-    makeWrapper "$out/lib/gap/gap" "$out/bin/gap" --add-flags "-l $out/share/gap"
   '';
 
   preFixup = ''
diff --git a/pkgs/applications/science/math/mxnet/default.nix b/pkgs/applications/science/math/mxnet/default.nix
index dcba888ce2fb1..021593124a37d 100644
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@@ -54,6 +54,12 @@ stdenv.mkDerivation rec {
     ] else [ "-DUSE_CUDA=OFF" ])
     ++ lib.optional (!cudnnSupport) "-DUSE_CUDNN=OFF";
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
   postPatch = ''
     substituteInPlace 3rdparty/mkldnn/tests/CMakeLists.txt \
       --replace "/bin/bash" "${bash}/bin/bash"
diff --git a/pkgs/applications/science/math/pari/default.nix b/pkgs/applications/science/math/pari/default.nix
index 4c0032e6c8b38..41dff3adede5a 100644
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , gmp
 , libX11
 , libpthreadstubs
@@ -25,6 +26,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-sEYoER7iKHZRmksc2vsy/rqjTq+iT56B9Y+NBX++4N0=";
   };
 
+  patches = [
+    # https://pari.math.u-bordeaux.fr/cgi-bin/bugreport.cgi?bug=2441
+    (fetchpatch {
+      name = "fix-find_isogenous_from_Atkin.patch";
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/pari/patches/bug2441.patch?id=9.8.rc0";
+      hash = "sha256-DvOUFlFDnopN+MJY6GYRPNabuoHPFch/nNn+49ygznc=";
+    })
+  ];
+
   buildInputs = [
     gmp
     libX11
diff --git a/pkgs/applications/science/math/sage/README.md b/pkgs/applications/science/math/sage/README.md
index c3a81c2109ee4..c4de5da45dbf0 100644
--- a/pkgs/applications/science/math/sage/README.md
+++ b/pkgs/applications/science/math/sage/README.md
@@ -10,7 +10,7 @@ First you should find out which change to nixpkgs is at fault (if you don't alre
 
 If the build broke as a result of a package update, try those solutions in order:
 
-- search the [sage trac](https://trac.sagemath.org/) for keywords like "Upgrade <package>". Maybe somebody has already proposed a patch that fixes the issue. You can then add a `fetchpatch` to `sage-src.nix`.
+- search the [sage GitHub repo](https://github.com/sagemath/sage) for keywords like "Upgrade <package>". Maybe somebody has already proposed a patch that fixes the issue. You can then add a `fetchpatch` to `sage-src.nix`.
 
 - check if [gentoo](https://github.com/cschwan/sage-on-gentoo/tree/master/sci-mathematics/sage), [debian](https://salsa.debian.org/science-team/sagemath/tree/master/debian) or [arch linux](https://git.archlinux.org/svntogit/community.git/tree/trunk?h=packages/sagemath) already solved the problem. You can then again add a `fetchpatch` to `sage-src.nix`. If applicable you should also [propose the patch upstream](#proposing-a-sage-patch).
 
@@ -19,7 +19,7 @@ If the build broke as a result of a package update, try those solutions in order
 ```
 [user@localhost ~]$ git clone https://github.com/sagemath/sage.git
 [user@localhost ~]$ cd sage
-[user@localhost sage]$ git checkout 8.2 # substitute the relevant version here
+[user@localhost sage]$ git checkout 9.8 # substitute the relevant version here
 ```
 
 Then make the needed changes and generate a patch with `git diff`:
@@ -29,42 +29,10 @@ Then make the needed changes and generate a patch with `git diff`:
 [user@localhost ~]$ git diff -u > /path/to/nixpkgs/pkgs/applications/science/math/sage/patches/name-of-patch.patch
 ```
 
-Now just add the patch to `sage-src.nix` and test your changes. If they fix the problem, [propose them upstream](#proposing-a-sage-patch) and add a link to the trac ticket.
+Now just add the patch to `sage-src.nix` and test your changes. If they fix the problem, submit a PR upstream (refer to sages [Developer's Guide](http://doc.sagemath.org/html/en/developer/index.html) for further details).
 
 - pin the package version in `default.nix` and add a note that explains why that is necessary.
 
-
-## Proposing a sage patch
-
-You can [login the sage trac using GitHub](https://trac.sagemath.org/login). Your username will then be `gh-<your-github-name>`. The only other way is to request a trac account via email. After that refer to [git the hard way](http://doc.sagemath.org/html/en/developer/manual_git.html#chapter-manual-git) in the sage documentation. The "easy way" requires a non-GitHub account (requested via email) and a special tool. The "hard way" is really not all that hard if you're a bit familiar with git.
-
-Here's the gist, assuming you want to use ssh key authentication. First, [add your public ssh key](https://trac.sagemath.org/prefs/sshkeys). Then:
-
-```
-[user@localhost ~]$ git clone https://github.com/sagemath/sage.git
-[user@localhost ~]$ cd sage
-[user@localhost sage]$ git remote add trac git@trac.sagemath.org:sage.git -t master
-[user@localhost sage]$ git checkout -b u/gh-<your-github-username>/<your-branch-name> develop
-[user@localhost sage]$ <make changes>
-[user@localhost sage]$ git add .
-[user@localhost sage]$ git commit
-[user@localhost sage]$ git show # review your changes
-[user@localhost sage]$ git push --set-upstream trac u/gh-<your-github-username>/<your-branch-name>
-```
-
-You now created a branch on the trac server (you *must* follow the naming scheme as you only have push access to branches with the `u/gh-<your-github-username>/` prefix).
-Now you can [create a new trac ticket](https://trac.sagemath.org/newticket).
-- Write a description of the change
-- set the type and component as appropriate
-- write your real name in the "Authors" field
-- write `u/gh-<your-github-username>/<your-branch-name>` in the "Branch" field
-- click "Create ticket"
-- click "Modify" on the top right of your ticket (for some reason you can only change the ticket status after you have created it)
-- set the ticket status from `new` to `needs_review`
-- click "Save changes"
-
-Refer to sages [Developer's Guide](http://doc.sagemath.org/html/en/developer/index.html) for further details.
-
 ## I want to update sage
 
 You'll need to change the `version` field in `sage-src.nix`. Afterwards just try to build and let nix tell you which patches no longer apply (hopefully because they were adopted upstream). Remove those.
@@ -74,5 +42,5 @@ If the problem is not obvious, you can try to first update sage to an intermedia
 
 ## Well, that didn't help!
 
-If you couldn't fix the problem, create a GitHub issue on the nixpkgs repo and ping @timokau (or whoever is listed in the `maintainers` list of the sage package).
+If you couldn't fix the problem, create a GitHub issue on the nixpkgs repo and ping the sage maintainers (as listed in the sage package).
 Describe what you did and why it didn't work. Afterwards it would be great if you help the next guy out and improve this documentation!
diff --git a/pkgs/applications/science/math/sage/env-locations.nix b/pkgs/applications/science/math/sage/env-locations.nix
index 1f8b33f687384..39d358a1f9a83 100644
--- a/pkgs/applications/science/math/sage/env-locations.nix
+++ b/pkgs/applications/science/math/sage/env-locations.nix
@@ -35,7 +35,8 @@ writeTextFile rec {
     export GRAPHS_DATA_DIR='${graphs}/share/graphs'
     export ELLCURVE_DATA_DIR='${elliptic_curves}/share/ellcurves'
     export POLYTOPE_DATA_DIR='${polytopes_db}/share/reflexive_polytopes'
-    export GAP_ROOT_DIR='${gap}/share/gap'
+    export GAP_LIB_DIR='${gap}/lib/gap'
+    export GAP_SHARE_DIR='${gap}/share/gap'
     export ECLDIR='${maxima.lisp-compiler}/lib/${maxima.lisp-compiler.pname}-${maxima.lisp-compiler.version}/'
     export COMBINATORIAL_DESIGN_DATA_DIR="${combinatorial_designs}/share/combinatorial_designs"
     export CREMONA_MINI_DATA_DIR="${elliptic_curves}/share/cremona"
diff --git a/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch b/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch
deleted file mode 100644
index 40bbbe23f1a3f..0000000000000
--- a/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/sage/geometry/polyhedron/backend_normaliz.py b/src/sage/geometry/polyhedron/backend_normaliz.py
-index 86b89632a5..ca8a43b248 100644
---- a/src/sage/geometry/polyhedron/backend_normaliz.py
-+++ b/src/sage/geometry/polyhedron/backend_normaliz.py
-@@ -53,7 +53,7 @@ def _number_field_elements_from_algebraics_list_of_lists_of_lists(listss, **kwds
-         1.732050807568878?
-         sage: from sage.geometry.polyhedron.backend_normaliz import _number_field_elements_from_algebraics_list_of_lists_of_lists
-         sage: K, results, hom = _number_field_elements_from_algebraics_list_of_lists_of_lists([[[rt2], [1]], [[rt3]], [[1], []]]); results  # optional - sage.rings.number_field
--        [[[-a^3 + 3*a], [1]], [[-a^2 + 2]], [[1], []]]
-+        [[[-a^3 + 3*a], [1]], [[a^2 - 2]], [[1], []]]
-     """
-     from sage.rings.qqbar import number_field_elements_from_algebraics
-     numbers = []
-diff --git a/src/sage/lfunctions/pari.py b/src/sage/lfunctions/pari.py
-index d2b20f1891..6c31efe239 100644
---- a/src/sage/lfunctions/pari.py
-+++ b/src/sage/lfunctions/pari.py
-@@ -339,7 +339,7 @@ def lfun_eta_quotient(scalings, exponents):
-         0.0374412812685155
- 
-         sage: lfun_eta_quotient([6],[4])
--        [[Vecsmall([7]), [Vecsmall([6]), Vecsmall([4])]], 0, [0, 1], 2, 36, 1]
-+        [[Vecsmall([7]), [Vecsmall([6]), Vecsmall([4]), 0]], 0, [0, 1], 2, 36, 1]
- 
-         sage: lfun_eta_quotient([2,1,4], [5,-2,-2])
-         Traceback (most recent call last):
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index d68a2c8a107ac..5e18b7415632e 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -57,14 +57,14 @@ let
   );
 in
 stdenv.mkDerivation rec {
-  version = "9.7";
+  version = "9.8";
   pname = "sage-src";
 
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "sage";
     rev = version;
-    sha256 = "sha256-MYpCp18wqKwCa+tcJ7He14p1FXDlVm1vubQqQS9g3LY=";
+    sha256 = "sha256-dDbrzJXsOBARYfJz0r7n3LbaoXHnx7Acz6HBa95NV9o=";
   };
 
   # Patches needed because of particularities of nix or the way this is packaged.
@@ -89,14 +89,6 @@ stdenv.mkDerivation rec {
     # To help debug the transient error in
     # https://trac.sagemath.org/ticket/23087 when it next occurs.
     ./patches/configurationpy-error-verbose.patch
-
-    # https://trac.sagemath.org/ticket/33907
-    (fetchSageDiff {
-      name = "interfaces-expectpy-intermittent.patch";
-      base = "9.8.beta6";
-      rev = "6f5c1c2fc8bcfb5e6555716d05ce70511795ffa1";
-      sha256 = "sha256-z8FQxtrk62MHzPjrUTad+fMAE6XV8GTsLWKgGOM3zBg=";
-    })
   ];
 
   # Patches needed because of package updates. We could just pin the versions of
@@ -119,28 +111,12 @@ stdenv.mkDerivation rec {
     # adapted from https://trac.sagemath.org/ticket/23712#comment:22
     ./patches/tachyon-renamed-focallength.patch
 
-    # https://trac.sagemath.org/ticket/34118
-    (fetchSageDiff {
-      name = "sympy-1.11-upgrade.patch";
-      base = "9.7";
-      rev = "52815744bde2b682245b6f985a112f7cb8666056";
-      sha256 = "sha256-gv6z6JkQ6S6oCJQNkVgcPVvzlplyvR1nC7pWmcUiSc0=";
-    })
-
-    # https://trac.sagemath.org/ticket/34460
-    (fetchSageDiff {
-      name = "ipywidgets-8-upgrade.patch";
-      base = "9.7";
-      rev = "2816dbacb342398a23bb3099e20c92c8020ab0fa";
-      sha256 = "sha256-tCOsMxXwPkRg3FJGVvTqDzlWdra78UfDY6nci0Nr9GI=";
-    })
-
     # https://trac.sagemath.org/ticket/34391
     (fetchSageDiff {
       name = "gap-4.12-upgrade.patch";
-      base = "9.8.beta2";
-      rev = "eb8cd42feb58963adba67599bf6e311e03424328";
-      sha256 = "sha256-0dKewOZe2n3PqSdxCJt18FkqwTdrD0VA5MXAMiTW8Tw=";
+      base = "9.8.beta7";
+      rev = "dd4a17281adcda74e11f998ef519b6bd0dafb043";
+      sha256 = "sha256-UQT9DO9xd5hh5RucvUkIm+rggPKu8bc1YaSI6LVYH98=";
     })
 
     # https://trac.sagemath.org/ticket/34701
@@ -151,46 +127,6 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-9BhQLFB3wUhiXRQsK9L+I62lSjvTfrqMNi7QUIQvH4U=";
     })
 
-    # https://trac.sagemath.org/ticket/34537
-    (fetchSageDiff {
-      name = "pari-2.15.1-upgrade.patch";
-      squashed = true;
-      base = "54cd6fe6de52aee5a433e0569e8c370618cb2047"; # 9.8.beta1
-      rev = "1e86aa26790d84bf066eca67f98a60a8aa3d4d3a";
-      sha256 = "sha256-LUgcMqrKXWb72Kxl0n6MV5unLXlQSeG8ncN41F7TRSc=";
-      excludes = ["build/*"
-                  "src/sage/geometry/polyhedron/base_number_field.py"
-                  "src/sage/geometry/polyhedron/backend_normaliz.py"
-                  "src/sage/lfunctions/pari.py"];
-    })
-    # Some files were excluded from the above patch due to
-    # conflicts. The patch below contains rebased versions.
-    ./patches/pari-2.15.1-upgrade-rebased.patch
-
-    # https://trac.sagemath.org/ticket/34668
-    (fetchSageDiff {
-      name = "matplotlib-3.6-upgrade.patch";
-      base = "9.8.beta2";
-      rev = "5501e0de0dca1cff0355326dd42bd8c7e5749568";
-      sha256 = "sha256-ceJkVaecIsZewN8v/3gPQXFbFjv5Akz6zEFg/ToXdek=";
-    })
-
-    # https://trac.sagemath.org/ticket/34693
-    (fetchSageDiff {
-      name = "matplotlib-3.6-docbuilding.patch";
-      base = "9.8.beta4";
-      rev = "64589686c261d33e6b5aff2589bcae8af004bcc6";
-      sha256 = "sha256-j5AMY1TmhP+HBBBYaFZSkABJ5vtwe6iP2LRfGEgSm8Q=";
-    })
-
-    # https://trac.sagemath.org/ticket/34615
-    (fetchSageDiff {
-      name = "sphinx-5.2-upgrade.patch";
-      base = "9.8.beta1";
-      rev = "8f8af65e54d3a9962cfab40f15dc23f4e955b43f";
-      sha256 = "sha256-yhDdyxnXSSkqLcuOPBWSEBc26rk1Od3gLcWW8S2p8bY=";
-    })
-
     # temporarily paper over https://github.com/jupyter-widgets/ipywidgets/issues/3669
     ./patches/ipywidgets-on_submit-deprecationwarning.patch
 
diff --git a/pkgs/applications/science/physics/nnpdf/default.nix b/pkgs/applications/science/physics/nnpdf/default.nix
index c3ac1f6e0a8d5..ec29c02054df2 100644
--- a/pkgs/applications/science/physics/nnpdf/default.nix
+++ b/pkgs/applications/science/physics/nnpdf/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , apfel
@@ -16,22 +15,15 @@
 
 stdenv.mkDerivation rec {
   pname = "nnpdf";
-  version = "4.0.4";
+  version = "4.0.6";
 
   src = fetchFromGitHub {
     owner = "NNPDF";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Alx4W0TkPzJBsnRXcKBrlEU6jWTnOjrji/IPk+dNCw0=";
+    hash = "sha256-mwOMNlYFhHZq/wakO1/HGwcxvKGKh5OyFa2D9d3Y3IA=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/NNPDF/nnpdf/commit/7943b62a91d3a41fd4f6366b18881d50695f4b45.diff";
-      hash = "sha256-UXhTO7vZgJiY8h3bgjg7SQC0gMUQsYQ/V/PgtCEQ7VU=";
-    })
-  ];
-
   postPatch = ''
     for file in CMakeLists.txt buildmaster/CMakeLists.txt; do
       substituteInPlace $file \
diff --git a/pkgs/applications/terminal-emulators/foot/default.nix b/pkgs/applications/terminal-emulators/foot/default.nix
index 7ae2825f175a7..bd80a15d0562a 100644
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@@ -18,7 +18,7 @@
 , wayland-scanner
 , pkg-config
 , utf8proc
-, allowPgo ? true
+, allowPgo ? !stdenv.hostPlatform.isMusl
 , python3  # for PGO
 # for clang stdenv check
 , foot
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index f53c6fb153b4a..04a810cf9e8c9 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -26,13 +26,13 @@
 
 buildPythonApplication rec {
   pname = "commitizen";
-  version = "2.41.0";
+  version = "2.42.0";
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dzAIRfUdyHSefDRDuPMsr8l2Dsiall2ZUDB6GufTbXE=";
+    hash = "sha256-13WEbF6in+zYZXWYqlYA98qJkKxjmcpQY9GuGS+DDtk=";
   };
 
   format = "pyproject";
diff --git a/pkgs/applications/version-management/fnc/default.nix b/pkgs/applications/version-management/fnc/default.nix
index a60aa27a8439c..7fd1b34d4560e 100644
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   preInstall = ''
     mkdir -p $out/bin
   '';
diff --git a/pkgs/applications/version-management/git-trim/default.nix b/pkgs/applications/version-management/git-trim/default.nix
index 0ef5a678ee8ef..a7dbf0c6ba4bc 100644
--- a/pkgs/applications/version-management/git-trim/default.nix
+++ b/pkgs/applications/version-management/git-trim/default.nix
@@ -1,4 +1,14 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, openssl, libiconv, Security }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, libgit2
+, IOKit
+, CoreFoundation
+, fetchpatch
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-trim";
@@ -11,11 +21,22 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-XAO3Qg5I2lYZVNx4+Z5jKHRIFdNwBJsUQwJXFb4CbvM=";
   };
 
-  cargoHash = "sha256-KCLMb8NXxjscrmKXkP/RbV+LsJqOG7zaClJGFiQ4o9k=";
+  cargoHash = "sha256-mS8kNkZs8jX99ryG4XkU+U/iWIIcmET2vOfG1YNNZFU=";
+
+  cargoPatches = [
+    # Update git2 https://github.com/foriequal0/git-trim/pull/202
+    (fetchpatch {
+      url = "https://github.com/foriequal0/git-trim/commit/4355cd1d6f605455087c4d7ad16bfb92ffee941f.patch";
+      sha256 = "sha256-C1pX4oe9ZCgvqYTBJeSjMdr0KFyjv2PNVMJDlwCAngY=";
+    })
+  ];
+
+  OPENSSL_NO_VENDOR = 1;
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
+  buildInputs = [ openssl libgit2 ]
+    ++ lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];
 
   postInstall = ''
     install -Dm644 -t $out/share/man/man1/ docs/git-trim.1
diff --git a/pkgs/applications/version-management/sapling/Cargo.lock b/pkgs/applications/version-management/sapling/Cargo.lock
index cd4fee2194559..ff91d07e87be2 100644
--- a/pkgs/applications/version-management/sapling/Cargo.lock
+++ b/pkgs/applications/version-management/sapling/Cargo.lock
@@ -4,9 +4,11 @@ version = 3
 
 [[package]]
 name = "abomonation"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e72913c99b1f927aa7bd59a41518fdd9995f63ffc8760f211609e0241c4fb2"
+version = "0.7.3+smallvec1"
+source = "git+https://github.com/markbt/abomonation?rev=0f43346d2afa2aedc64d61f3f4273e8d1e454642#0f43346d2afa2aedc64d61f3f4273e8d1e454642"
+dependencies = [
+ "smallvec",
+]
 
 [[package]]
 name = "abomonation_derive"
@@ -86,9 +88,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.68"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cb2f989d18dd141ab8ae82f64d1a8cdd37e0840f73a406896cf5e99502fab61"
+checksum = "224afbd727c3d6e4b90103ece64b8d1b67fbb1973b1046c2281eed3f3803f800"
 
 [[package]]
 name = "arc-swap"
@@ -148,7 +150,7 @@ dependencies = [
  "slab",
  "socket2",
  "waker-fn",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -165,7 +167,7 @@ dependencies = [
 name = "async-runtime"
 version = "0.1.0"
 dependencies = [
- "futures 0.3.25",
+ "futures 0.3.26",
  "num_cpus",
  "once_cell",
  "tokio",
@@ -173,9 +175,9 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.61"
+version = "0.1.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705339e0e4a9690e2908d2b3d049d85682cf19fbd5782494498fbf7003a6a282"
+checksum = "1cd7fce9ba8c3c042128ce72d8b2ddbf3a05747efb67ea0313c635e10bda47a2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -448,9 +450,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "2.3.2"
+version = "2.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ad2d4653bf5ca36ae797b1f4bb4dbddb60ce49ca4aed8a2ce4829f60425b80"
+checksum = "4b6561fd3f895a11e8f72af2cb7d22e08366bebc2b6b57f7744c4bda27034744"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -470,9 +472,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b45ea9b00a7b3f2988e9a65ad3917e62123c38dba709b666506207be96d1790b"
+checksum = "b7f0778972c64420fdedc63f09919c8a88bda7b25135357fd25a5d9f3257e832"
 dependencies = [
  "memchr",
  "serde",
@@ -484,14 +486,14 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ccc76d50a81d3a49665c71444ecefed1d1386477cb700c6fb7db517454fe1ff"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
 ]
 
 [[package]]
 name = "bumpalo"
-version = "3.11.1"
+version = "3.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "572f695136211188308f16ad2ca5c851a712c464060ae6974944458eb83880ba"
+checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
 
 [[package]]
 name = "byteorder"
@@ -511,9 +513,9 @@ dependencies = [
 
 [[package]]
 name = "bytes"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfb24e866b15a1af2a1b663f10c6b6b8f397a84aadb828f12e5b289ec23a3a3c"
+checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
 dependencies = [
  "serde",
 ]
@@ -540,6 +542,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "camino"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c77df041dc383319cc661b428b6961a005db4d6808d5e12536931b1ca9556055"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "cassowary"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -576,9 +587,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.78"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
 dependencies = [
  "jobserver",
 ]
@@ -604,7 +615,7 @@ dependencies = [
  "async-trait",
  "configmodel",
  "fail",
- "futures 0.3.25",
+ "futures 0.3.26",
  "io",
  "manifest",
  "manifest-tree",
@@ -688,7 +699,7 @@ version = "3.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea0c8bce528c4be4da13ea6fead8965e95b6073585a2f05204bd8f4119f82a65"
 dependencies = [
- "heck 0.4.0",
+ "heck 0.4.1",
  "proc-macro-error",
  "proc-macro2",
  "quote",
@@ -773,12 +784,12 @@ dependencies = [
 [[package]]
 name = "cloned"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 
 [[package]]
 name = "codegen_includer_proc_macro"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "quote",
 ]
@@ -822,6 +833,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "filetime",
+ "futures 0.3.26",
  "hostcaps",
  "identity",
  "lazy_static",
@@ -829,11 +841,13 @@ dependencies = [
  "mime",
  "regex",
  "reqwest",
+ "reqwest-eventsource",
  "rust-ini",
  "serde",
  "serde_json",
  "tempfile",
  "thiserror",
+ "tokio",
 ]
 
 [[package]]
@@ -854,9 +868,9 @@ dependencies = [
 
 [[package]]
 name = "concurrent-queue"
-version = "2.0.0"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd7bef69dc86e3c610e4e7aed41035e2a7ed12e72dd7530f61327a6579a4390b"
+checksum = "c278839b831783b70278b14df4d45e1beb1aad306c07bb796637de9a0e323e8e"
 dependencies = [
  "crossbeam-utils 0.8.14",
 ]
@@ -870,7 +884,7 @@ dependencies = [
  "codegen_includer_proc_macro",
  "const-cstr",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
  "ref-cast",
  "serde",
@@ -890,7 +904,7 @@ dependencies = [
  "codegen_includer_proc_macro",
  "const-cstr",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
  "ref-cast",
  "serde",
@@ -964,14 +978,14 @@ dependencies = [
 
 [[package]]
 name = "console"
-version = "0.15.4"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9b6515d269224923b26b5febea2ed42b2d5f2ce37284a4dd670fedd6cb8347a"
+checksum = "c3d79fbe8970a77e3e34151cc13d3b3e248aa0faaecb9f6091fa07ebefe5ad60"
 dependencies = [
  "encode_unicode",
  "lazy_static",
  "libc",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -1039,7 +1053,7 @@ dependencies = [
  "async-runtime",
  "cpython",
  "cpython_ext",
- "futures 0.3.25",
+ "futures 0.3.26",
  "itertools 0.10.5",
  "tokio",
 ]
@@ -1384,9 +1398,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d1075c37807dcf850c379432f0df05ba52cc30f279c5cfc43cc221ce7f8579"
+checksum = "bc831ee6a32dd495436e317595e639a587aa9907bef96fe6e6abc290ab6204e9"
 dependencies = [
  "cc",
  "cxxbridge-flags",
@@ -1396,9 +1410,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5044281f61b27bc598f2f6647d480aed48d2bf52d6eb0b627d84c0361b17aa70"
+checksum = "94331d54f1b1a8895cd81049f7eaaaef9d05a7dcb4d1fd08bf3ff0806246789d"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -1411,15 +1425,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61b50bc93ba22c27b0d31128d2d130a0a6b3d267ae27ef7e4fae2167dfe8781c"
+checksum = "48dcd35ba14ca9b40d6e4b4b39961f23d835dbb8eed74565ded361d93e1feb8a"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39e61fda7e62115119469c7b3591fd913ecca96fb766cfd3f2e2502ab7bc87a5"
+checksum = "81bbeb29798b407ccd82a3324ade1a7286e0d29851475990b612670f6f5124d2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1439,22 +1453,21 @@ dependencies = [
  "drawdag",
  "fail",
  "fs2",
- "futures 0.3.25",
+ "futures 0.3.26",
  "indexedlog",
  "indexmap",
- "itertools 0.10.5",
  "mincode",
  "minibytes",
  "nonblocking",
  "once_cell",
  "quickcheck",
  "rand 0.8.5",
+ "renderdag",
  "serde",
  "tempfile",
  "thiserror",
  "tokio",
  "tracing",
- "unicode-width",
  "vlqencoding",
 ]
 
@@ -1478,7 +1491,6 @@ dependencies = [
  "abomonation_derive",
  "minibytes",
  "quickcheck",
- "quickcheck_arbitrary_derive",
  "serde",
 ]
 
@@ -1492,7 +1504,7 @@ dependencies = [
  "hashbrown 0.12.3",
  "lock_api",
  "once_cell",
- "parking_lot_core 0.9.6",
+ "parking_lot_core 0.9.7",
  "rayon",
  "serde",
 ]
@@ -1624,7 +1636,7 @@ dependencies = [
  "dag",
  "edenapi_trait",
  "fail",
- "futures 0.3.25",
+ "futures 0.3.26",
  "http",
  "identity",
  "manifest-tree",
@@ -1663,12 +1675,12 @@ dependencies = [
  "async-runtime",
  "async-trait",
  "auth",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "chrono",
  "configmodel",
  "edenapi_trait",
  "edenapi_types",
- "futures 0.3.25",
+ "futures 0.3.26",
  "hg-http",
  "http-client",
  "itertools 0.10.5",
@@ -1701,7 +1713,7 @@ dependencies = [
  "crossbeam 0.8.2",
  "edenapi",
  "edenapi_types",
- "futures 0.3.25",
+ "futures 0.3.26",
  "itertools 0.10.5",
  "minibytes",
  "tokio",
@@ -1717,7 +1729,7 @@ dependencies = [
  "async-trait",
  "configmodel",
  "edenapi_types",
- "futures 0.3.25",
+ "futures 0.3.26",
  "http",
  "http-client",
  "minibytes",
@@ -1732,7 +1744,7 @@ name = "edenapi_types"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "dag-types",
  "insta_ext",
  "paste",
@@ -1773,9 +1785,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
 
 [[package]]
 name = "encode_unicode"
@@ -1794,9 +1806,9 @@ dependencies = [
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.31"
+version = "0.8.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9852635589dc9f9ea1b6fe9f05b50ef208c85c834a562f0c6abb1c475736ec2b"
+checksum = "071a31f4ee85403370b58aca746f01041ede6f0da2730960ad001edc2b71b394"
 dependencies = [
  "cfg-if 1.0.0",
 ]
@@ -1807,7 +1819,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21cdad81446a7f7dc43f6a77409efeb9733d2fa65553efef6018ef257c959b73"
 dependencies = [
- "heck 0.4.0",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "syn",
@@ -1876,6 +1888,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
 
 [[package]]
+name = "eventsource-stream"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74fef4569247a5f429d9156b9d0a2599914385dd189c539334c625d8099d90ab"
+dependencies = [
+ "futures-core",
+ "nom 7.1.3",
+ "pin-project-lite",
+]
+
+[[package]]
 name = "exchange"
 version = "0.1.0"
 dependencies = [
@@ -1931,14 +1954,14 @@ dependencies = [
 [[package]]
 name = "fb303_core"
 version = "0.0.0"
-source = "git+https://github.com/facebook/fb303.git?branch=main#0b9b58848f96c78f65513457c15292b81dc6b91e"
+source = "git+https://github.com/facebook/fb303.git?branch=main#d35b962b6f3dc787ed64c8d6b1b49a986e69f4d0"
 dependencies = [
  "anyhow",
  "async-trait",
  "codegen_includer_proc_macro",
  "const-cstr",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
  "ref-cast",
  "serde",
@@ -1952,7 +1975,7 @@ dependencies = [
 [[package]]
 name = "fbinit"
 version = "0.1.2"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "fbinit_macros",
  "quickcheck",
@@ -1961,7 +1984,7 @@ dependencies = [
 [[package]]
 name = "fbinit_macros"
 version = "0.1.2"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1971,14 +1994,15 @@ dependencies = [
 [[package]]
 name = "fbthrift"
 version = "0.0.1+unstable"
-source = "git+https://github.com/facebook/fbthrift.git?branch=main#46238c81c2c30ec8e9907203922218e4ecfd4cbb"
+source = "git+https://github.com/facebook/fbthrift.git?branch=main#f5641439382254134d192ca8fe3c9af23f87b5fa"
 dependencies = [
  "anyhow",
  "async-trait",
  "base64 0.11.0",
  "bufsize",
- "bytes 1.3.0",
- "futures 0.3.25",
+ "bytes 1.4.0",
+ "camino",
+ "futures 0.3.26",
  "ghost",
  "num-derive",
  "num-traits",
@@ -1991,24 +2015,24 @@ dependencies = [
 [[package]]
 name = "fbthrift_framed"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "byteorder",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "tokio-util 0.6.10",
 ]
 
 [[package]]
 name = "fbthrift_socket"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "anyhow",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "fbthrift",
  "fbthrift_framed",
  "fbthrift_util",
- "futures 0.3.25",
+ "futures 0.3.26",
  "tokio",
  "tokio-tower",
  "tokio-util 0.6.10",
@@ -2018,7 +2042,7 @@ dependencies = [
 [[package]]
 name = "fbthrift_util"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "tokio",
 ]
@@ -2043,7 +2067,7 @@ dependencies = [
  "cfg-if 1.0.0",
  "libc",
  "redox_syscall",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -2200,9 +2224,9 @@ checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"
 
 [[package]]
 name = "futures"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38390104763dc37a5145a53c29c63c1290b5d316d6086ec32c293f6736051bb0"
+checksum = "13e2792b0ff0340399d58445b88fd9770e3489eff258a4cbc1523418f12abf84"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2219,16 +2243,16 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f444c45a1cb86f2a7e301469fd50a82084a60dadc25d94529a8312276ecb71a"
 dependencies = [
- "futures 0.3.25",
+ "futures 0.3.26",
  "futures-timer",
  "pin-utils",
 ]
 
 [[package]]
 name = "futures-channel"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ba265a92256105f45b719605a571ffe2d1f0fea3807304b522c1d778f79eed"
+checksum = "2e5317663a9089767a1ec00a487df42e0ca174b61b4483213ac24448e4664df5"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -2236,15 +2260,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04909a7a7e4633ae6c4a9ab280aeb86da1236243a77b694a49eacd659a4bd3ac"
+checksum = "ec90ff4d0fe1f57d600049061dc6bb68ed03c7d2fbd697274c41805dcb3f8608"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7acc85df6714c176ab5edf386123fafe217be88c0840ec11f199441134a074e2"
+checksum = "e8de0a35a6ab97ec8869e32a2473f4b1324459e14c29275d14b10cb1fd19b50e"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -2253,9 +2277,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00f5fb52a06bdcadeb54e8d3671f8888a39697dcb0b81b23b55174030427f4eb"
+checksum = "bfb8371b6fb2aeb2d280374607aeabfc99d95c72edfe51692e42d3d7f0d08531"
 
 [[package]]
 name = "futures-lite"
@@ -2274,9 +2298,9 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdfb8ce053d86b91919aad980c220b1fb8401a9394410e1c289ed7e66b61835d"
+checksum = "95a73af87da33b5acf53acfebdc339fe592ecf5357ac7c0a7734ab9d8c876a70"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2285,15 +2309,15 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39c15cf1a4aa79df40f1bb462fb39676d0ad9e366c2a33b590d7c66f4f81fcf9"
+checksum = "f310820bb3e8cfd46c80db4d7fb8353e15dfff853a127158425f31e0be6c8364"
 
 [[package]]
 name = "futures-task"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ffb393ac5d9a6eaa9d3fdf37ae2776656b706e200c8e16b1bdb227f5198e6ea"
+checksum = "dcf79a1bf610b10f42aea489289c5a2c478a786509693b80cd39c44ccd936366"
 
 [[package]]
 name = "futures-timer"
@@ -2303,9 +2327,9 @@ checksum = "e64b03909df88034c26dc1547e8970b91f98bdb65165d6a4e9110d94263dbb2c"
 
 [[package]]
 name = "futures-util"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "197676987abd2f9cadff84926f410af1c183608d36641465df73ae8211dc65d6"
+checksum = "9c1d6de3acfef38d2be4b1f543f553131788603495be83da675e180c8d6b7bd1"
 dependencies = [
  "futures 0.1.31",
  "futures-channel",
@@ -2405,7 +2429,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "futures 0.3.25",
+ "futures 0.3.26",
  "git2",
  "minibytes",
  "storemodel",
@@ -2425,7 +2449,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "029d74589adefde59de1a0c4f4732695c32805624aec7b68d91503d4dba79afc"
 dependencies = [
  "aho-corasick",
- "bstr 1.1.0",
+ "bstr 1.2.0",
  "fnv",
  "log",
  "regex",
@@ -2437,7 +2461,7 @@ version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f9f29bc9dda355256b2916cf526ab02ce0aeaaaf2bad60d65ef3f12f11dd0f4"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "fnv",
  "futures-core",
  "futures-sink",
@@ -2485,9 +2509,9 @@ dependencies = [
 
 [[package]]
 name = "heck"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
@@ -2615,7 +2639,7 @@ dependencies = [
  "async-trait",
  "dag",
  "edenapi",
- "futures 0.3.25",
+ "futures 0.3.26",
  "gitdag",
  "metalog",
  "minibytes",
@@ -2669,7 +2693,7 @@ dependencies = [
 [[package]]
 name = "hostcaps"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "lazy_static",
 ]
@@ -2677,7 +2701,7 @@ dependencies = [
 [[package]]
 name = "hostname"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "anyhow",
  "hostname 0.3.1",
@@ -2700,7 +2724,7 @@ version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75f43d41e26995c17e71ee126451dd3941010b0514a81a9d11f3b341debc2399"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "fnv",
  "itoa 1.0.5",
 ]
@@ -2711,7 +2735,7 @@ version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "http",
  "pin-project-lite",
 ]
@@ -2728,7 +2752,7 @@ dependencies = [
  "curl",
  "curl-sys",
  "env_logger 0.7.1",
- "futures 0.3.25",
+ "futures 0.3.26",
  "http",
  "lru-cache",
  "maplit",
@@ -2780,11 +2804,11 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.23"
+version = "0.14.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "034711faac9d2166cb1baf1a2fb0b60b1f277f8492fd72176c17f3515e1abd3c"
+checksum = "5e011372fa0b68db8350aa7a248930ecc7839bf46d8485577d69f117a75f164c"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "futures-channel",
  "futures-core",
  "futures-util",
@@ -2821,7 +2845,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "hyper",
  "native-tls",
  "tokio",
@@ -2887,9 +2911,9 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a05705bc64e0b66a806c3740bd6578ea66051b157ec42dc219c785cbf185aef3"
+checksum = "dbe7873dab538a9a44ad79ede1faf5f30d49f9a5c883ddbab48bce81b64b7492"
 dependencies = [
  "globset",
  "lazy_static",
@@ -3004,12 +3028,12 @@ dependencies = [
 
 [[package]]
 name = "io-lifetimes"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7d6c6f8c91b4b9ed43484ad1a938e393caf35960fce7f82a040497207bd8e9e"
+checksum = "1abeb7a0dd0f8181267ff8adc397075586500b81b28a73e8a0208b00fc170fb3"
 dependencies = [
  "libc",
- "windows-sys",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -3080,9 +3104,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.60"
+version = "0.3.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+checksum = "445dde2150c55e483f3d8416706b97ec8e8237c307e5b7b4b8dd15e6af2a0730"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -3140,9 +3164,9 @@ checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
 
 [[package]]
 name = "libgit2-sys"
-version = "0.13.4+1.4.2"
+version = "0.13.5+1.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0fa6563431ede25f5cc7f6d803c6afbc1c5d3ad3d4925d12c882bf2b526f5d1"
+checksum = "51e5ea06c26926f1002dd553fded6cfcdc9784c1f60feeb58368b4d9b07b6dba"
 dependencies = [
  "cc",
  "libc",
@@ -3305,7 +3329,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-runtime",
- "futures 0.3.25",
+ "futures 0.3.26",
  "futures-batch",
  "manifest",
  "minibench",
@@ -3347,9 +3371,9 @@ dependencies = [
 
 [[package]]
 name = "matches"
-version = "0.1.9"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
+checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "maybe-uninit"
@@ -3441,7 +3465,7 @@ dependencies = [
 name = "metrics"
 version = "0.1.0"
 dependencies = [
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
 ]
 
@@ -3498,13 +3522,19 @@ version = "0.1.0"
 name = "minibytes"
 version = "0.1.0"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "memmap",
  "quickcheck",
  "serde",
 ]
 
 [[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
 name = "miniz_oxide"
 version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3555,7 +3585,7 @@ dependencies = [
  "libc",
  "log",
  "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -3645,11 +3675,10 @@ dependencies = [
  "bitflags",
  "dag",
  "drawdag",
- "futures 0.3.25",
+ "futures 0.3.26",
  "indexedlog",
  "rand 0.8.5",
  "rand_chacha 0.3.1",
- "renderdag",
  "tempdir",
  "types",
  "vlqencoding",
@@ -3735,10 +3764,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
 name = "nonblocking"
 version = "0.1.0"
 dependencies = [
- "futures 0.3.25",
+ "futures 0.3.26",
 ]
 
 [[package]]
@@ -3981,7 +4020,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
 dependencies = [
  "lock_api",
- "parking_lot_core 0.9.6",
+ "parking_lot_core 0.9.7",
 ]
 
 [[package]]
@@ -4000,15 +4039,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.6"
+version = "0.9.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba1ef8814b5c993410bb3adfad7a5ed269563e4a2f90c41f5d85be7fb47133bf"
+checksum = "9069cbb9f99e3a5083476ccb29ceb1de18b9118cafa53e90c9551235de2b9521"
 dependencies = [
  "cfg-if 1.0.0",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-sys",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -4070,9 +4109,9 @@ checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
 
 [[package]]
 name = "pest"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4257b4a04d91f7e9e6290be5d3da4804dd5784fafde3a497d73eb2b4a158c30a"
+checksum = "4ab62d2fa33726dbe6321cc97ef96d8cde531e3eeaf858a058de53a8a6d40d8f"
 dependencies = [
  "thiserror",
  "ucd-trie",
@@ -4080,9 +4119,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241cda393b0cdd65e62e07e12454f1f25d57017dcc514b1514cd3c4645e3a0a6"
+checksum = "8bf026e2d0581559db66d837fe5242320f525d85c76283c61f4d51a1238d65ea"
 dependencies = [
  "pest",
  "pest_generator",
@@ -4090,9 +4129,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46b53634d8c8196302953c74d5352f33d0c512a9499bd2ce468fc9f4128fa27c"
+checksum = "2b27bd18aa01d91c8ed2b61ea23406a676b42d82609c6e2581fba42f0c15f17f"
 dependencies = [
  "pest",
  "pest_meta",
@@ -4103,9 +4142,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ef4f1332a8d4678b41966bb4cc1d0676880e84183a1ecc3f4b69f03e99c7a51"
+checksum = "9f02b677c1859756359fc9983c2e56a0237f18624a3789528804406b7e915e5d"
 dependencies = [
  "once_cell",
  "pest",
@@ -4114,15 +4153,6 @@ dependencies = [
 
 [[package]]
 name = "phf"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dfb61232e34fcb633f43d12c58f83c1df82962dcdfa565a4e866ffc17dafe12"
-dependencies = [
- "phf_shared 0.8.0",
-]
-
-[[package]]
-name = "phf"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
@@ -4142,22 +4172,12 @@ dependencies = [
 
 [[package]]
 name = "phf_codegen"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbffee61585b0411840d3ece935cce9cb6321f01c45477d30066498cd5e1a815"
-dependencies = [
- "phf_generator 0.8.0",
- "phf_shared 0.8.0",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.8.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17367f0cc86f2d25802b2c26ee58a7b23faeccf78a396094c13dced0d0182526"
+checksum = "a56ac890c5e3ca598bbdeaa99964edb5b0258a583a9eb6ef4e89fc85d9224770"
 dependencies = [
- "phf_shared 0.8.0",
- "rand 0.7.3",
+ "phf_generator",
+ "phf_shared 0.11.1",
 ]
 
 [[package]]
@@ -4176,7 +4196,7 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92aacdc5f16768709a569e913f7451034034178b05bdc8acda226659a3dccc66"
 dependencies = [
- "phf_generator 0.11.1",
+ "phf_generator",
  "phf_shared 0.11.1",
  "proc-macro2",
  "quote",
@@ -4185,15 +4205,6 @@ dependencies = [
 
 [[package]]
 name = "phf_shared"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c00cf8b9eafe68dde5e9eaa2cef8ee84a9336a47d566ec55ca16589633b65af7"
-dependencies = [
- "siphasher",
-]
-
-[[package]]
-name = "phf_shared"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
@@ -4314,7 +4325,7 @@ dependencies = [
  "libc",
  "log",
  "wepoll-ffi",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -4369,9 +4380,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.49"
+version = "1.0.51"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57a8eca9f9c4ffde41714334dee777596264c7825420f521abc92b5b5deb63a5"
+checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
 dependencies = [
  "unicode-ident",
 ]
@@ -4524,13 +4535,12 @@ dependencies = [
  "cpython",
  "cpython_ext",
  "dag",
- "futures 0.3.25",
+ "futures 0.3.26",
  "hgcommits",
  "minibytes",
  "parking_lot 0.11.2",
  "pyedenapi",
  "pymetalog",
- "renderdag",
  "storemodel",
 ]
 
@@ -4599,7 +4609,7 @@ dependencies = [
  "edenapi",
  "edenapi_ext",
  "edenapi_types",
- "futures 0.3.25",
+ "futures 0.3.26",
  "minibytes",
  "progress-model",
  "pyconfigloader",
@@ -4896,7 +4906,7 @@ dependencies = [
  "configmodel",
  "cpython",
  "cpython_ext",
- "futures 0.3.25",
+ "futures 0.3.26",
  "io",
  "minibytes",
  "parking_lot 0.11.2",
@@ -5075,7 +5085,7 @@ dependencies = [
 [[package]]
 name = "quickcheck_arbitrary_derive"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "proc-macro2",
  "quickcheck",
@@ -5138,7 +5148,6 @@ dependencies = [
  "rand_chacha 0.2.2",
  "rand_core 0.5.1",
  "rand_hc",
- "rand_pcg",
 ]
 
 [[package]]
@@ -5215,15 +5224,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "rand_pcg"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16abd0c1b639e9eb4d7c50c0b8100b0d0f849be2349829c740fe8e6eb4816429"
-dependencies = [
- "rand_core 0.5.1",
-]
-
-[[package]]
 name = "rayon"
 version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5235,9 +5235,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.10.1"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cac410af5d00ab6884528b4ab69d1e8e146e8d471201800fa1b4524126de6ad3"
+checksum = "356a0625f1954f730c0201cdab48611198dc6ce21f4acff55089b5a78e6e835b"
 dependencies = [
  "crossbeam-channel 0.5.6",
  "crossbeam-deque 0.8.2",
@@ -5340,7 +5340,12 @@ dependencies = [
 name = "renderdag"
 version = "0.1.0"
 dependencies = [
+ "bitflags",
  "dag",
+ "itertools 0.10.5",
+ "nonblocking",
+ "serde",
+ "unicode-width",
 ]
 
 [[package]]
@@ -5401,7 +5406,7 @@ version = "0.11.11"
 source = "git+https://github.com/vmagro/reqwest?rev=f9490c06756a9d35ab874c44657db790a87af80b#f9490c06756a9d35ab874c44657db790a87af80b"
 dependencies = [
  "base64 0.13.1",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "encoding_rs",
  "futures-core",
  "futures-util",
@@ -5441,6 +5446,22 @@ dependencies = [
 ]
 
 [[package]]
+name = "reqwest-eventsource"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f03f570355882dd8d15acc3a313841e6e90eddbc76a93c748fd82cc13ba9f51"
+dependencies = [
+ "eventsource-stream",
+ "futures-core",
+ "futures-timer",
+ "mime",
+ "nom 7.1.3",
+ "pin-project-lite",
+ "reqwest",
+ "thiserror",
+]
+
+[[package]]
 name = "resolv-conf"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5466,7 +5487,7 @@ dependencies = [
  "edenapi",
  "edenapi_types",
  "fbinit",
- "futures 0.3.25",
+ "futures 0.3.26",
  "hex",
  "hg-http",
  "hg-metrics",
@@ -5613,16 +5634,16 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.36.6"
+version = "0.36.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4feacf7db682c6c329c4ede12649cd36ecab0f3be5b7d74e6a20304725db4549"
+checksum = "f43abb88211988493c1abb44a70efa56ff0ce98f233b7b276146f1f3f7ba9644"
 dependencies = [
  "bitflags",
  "errno",
  "io-lifetimes",
  "libc",
  "linux-raw-sys",
- "windows-sys",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -5685,7 +5706,7 @@ version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "713cfb06c7059f3588fb8044c0fad1d09e3c01d225e25b9220dbfdcf16dbb1b3"
 dependencies = [
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -5700,6 +5721,7 @@ dependencies = [
  "log",
  "serde",
  "thiserror",
+ "tokio",
  "toml",
 ]
 
@@ -5727,9 +5749,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.7.0"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bc1bb97804af6631813c55739f771071e0f2ed33ee20b68c86ec505d906356c"
+checksum = "a332be01508d814fed64bf28f798a146d73792121129962fdf335bb3c49a4254"
 dependencies = [
  "bitflags",
  "core-foundation",
@@ -5740,9 +5762,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.6.1"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0160a13a177a45bfb43ce71c01580998474f556ad854dcbca936dd2841a5c556"
+checksum = "31c9bb296072e961fcbd8853511dd39c2d8be2deb1e17c6860b1d30732b323b4"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -5788,20 +5810,20 @@ version = "0.1.0"
 [[package]]
 name = "serde_bser"
 version = "0.3.1"
-source = "git+https://github.com/facebook/watchman.git?branch=main#d21cc8bb48e1e03e7f0327b6ddbf28d76523ad1b"
+source = "git+https://github.com/facebook/watchman.git?branch=main#5cba53852d5970c5fa6c5ffe8f35afc908b77279"
 dependencies = [
  "anyhow",
  "byteorder",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "serde",
  "thiserror",
 ]
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.8"
+version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "718dc5fff5b36f99093fc49b280cfc96ce6fc824317783bff5a1fed0c7a64819"
+checksum = "416bda436f9aab92e02c8e10d49a15ddd339cea90b6e340fe51ed97abb548294"
 dependencies = [
  "serde",
 ]
@@ -5829,9 +5851,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.91"
+version = "1.0.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877c235533714907a8c2464236f5c4b2a17262ef1bd71f38f35ea592c8da6883"
+checksum = "7434af0dc1cbd59268aa98b4c22c131c0584d2232f6fb166efb993e2832e896a"
 dependencies = [
  "itoa 1.0.5",
  "ryu",
@@ -6037,7 +6059,7 @@ dependencies = [
 [[package]]
 name = "sorted_vector_map"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "itertools 0.10.5",
  "quickcheck",
@@ -6048,7 +6070,7 @@ name = "sparse"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "futures 0.3.25",
+ "futures 0.3.26",
  "globset",
  "once_cell",
  "pathmatcher",
@@ -6111,7 +6133,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "auto_impl",
- "futures 0.3.25",
+ "futures 0.3.26",
  "minibytes",
  "types",
 ]
@@ -6154,7 +6176,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "futures 0.3.25",
+ "futures 0.3.26",
  "pin-project 0.4.30",
  "tokio",
 ]
@@ -6284,9 +6306,9 @@ dependencies = [
 
 [[package]]
 name = "termcolor"
-version = "1.1.3"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
 dependencies = [
  "winapi-util",
 ]
@@ -6308,19 +6330,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb20089a8ba2b69debd491f8d2d023761cbf196e999218c591fa1e7e15a21907"
 dependencies = [
  "rustix",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
 name = "terminfo"
-version = "0.7.3"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76971977e6121664ec1b960d1313aacfa75642adc93b9d4d53b247bd4cb1747e"
+checksum = "da31aef70da0f6352dbcb462683eb4dd2bfad01cf3fc96cf204547b9a839a585"
 dependencies = [
- "dirs 2.0.2",
+ "dirs 4.0.0",
  "fnv",
- "nom",
- "phf 0.8.0",
+ "nom 5.1.2",
+ "phf 0.11.1",
  "phf_codegen",
 ]
 
@@ -6458,7 +6480,7 @@ dependencies = [
  "const-cstr",
  "fb303_core",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
  "ref-cast",
  "serde",
@@ -6479,7 +6501,7 @@ dependencies = [
  "config_thrift",
  "fb303_core",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "thiserror",
  "thrift",
 ]
@@ -6487,7 +6509,7 @@ dependencies = [
 [[package]]
 name = "thrift_compiler"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "anyhow",
  "clap 2.34.0",
@@ -6555,18 +6577,18 @@ dependencies = [
 
 [[package]]
 name = "tinyvec_macros"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.24.1"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d9f76183f91ecfb55e1d7d5602bd1d979e38a3a522fe900241cf195624d67ae"
+checksum = "c8e00990ebabbe4c14c08aca901caed183ecd5c09562a12c824bb53d3c3fd3af"
 dependencies = [
  "autocfg",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "libc",
  "memchr",
  "mio 0.8.5",
@@ -6577,7 +6599,7 @@ dependencies = [
  "socket2",
  "tokio-macros",
  "tracing",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -6655,10 +6677,10 @@ dependencies = [
 [[package]]
 name = "tokio-uds-compat"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "async-io",
- "futures 0.3.25",
+ "futures 0.3.26",
  "tokio",
  "tracing",
  "uds_windows",
@@ -6670,7 +6692,7 @@ version = "0.6.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "36943ee01a6d67977dd3f84a5a1d2efeb4ada3a1ae771cadfaa535d9d9fc6507"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "futures-core",
  "futures-io",
  "futures-sink",
@@ -6686,7 +6708,7 @@ version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bb2e075f03b3d66d8d8785356224ba688d2906a371015e225beeb65ca92c740"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
@@ -6881,6 +6903,7 @@ dependencies = [
  "anyhow",
  "bitflags",
  "byteorder",
+ "fs2",
  "identity",
  "itertools 0.10.5",
  "pretty_assertions",
@@ -6889,7 +6912,7 @@ dependencies = [
  "rand_chacha 0.3.1",
  "repolock",
  "sha2 0.10.6",
- "tempdir",
+ "tempfile",
  "thiserror",
  "tracing",
  "twox-hash",
@@ -7028,9 +7051,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.8"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "099b7128301d285f79ddd55b9a83d5e6b9e97c92e0ea0daebee7263e932de992"
+checksum = "d54675592c1dbefd78cbd98db9bacd89886e1ca50692a0692baefffdeb92dd58"
 
 [[package]]
 name = "unicode-ident"
@@ -7049,9 +7072,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fdbf052a0783de01e944a6ce7a8cb939e295b1e7be835a1112c3b9a7f047a5a"
+checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
 
 [[package]]
 name = "unicode-width"
@@ -7255,9 +7278,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+checksum = "31f8dcbc21f30d9b8f2ea926ecb58f6b91192c17e9d33594b3df58b2007ca53b"
 dependencies = [
  "cfg-if 1.0.0",
  "wasm-bindgen-macro",
@@ -7265,9 +7288,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+checksum = "95ce90fd5bcc06af55a641a86428ee4229e44e07033963a2290a8e241607ccb9"
 dependencies = [
  "bumpalo",
  "log",
@@ -7280,9 +7303,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23639446165ca5a5de86ae1d8896b737ae80319560fbaa4c2887b7da6e7ebd7d"
+checksum = "f219e0d211ba40266969f6dbdd90636da12f75bee4fc9d6c23d1260dadb51454"
 dependencies = [
  "cfg-if 1.0.0",
  "js-sys",
@@ -7292,9 +7315,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+checksum = "4c21f77c0bedc37fd5dc21f897894a5ca01e7bb159884559461862ae90c0b4c5"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -7302,9 +7325,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+checksum = "2aff81306fcac3c7515ad4e177f521b5c9a15f2b08f4e32d823066102f35a5f6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7315,18 +7338,18 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+checksum = "0046fef7e28c3804e5e38bfa31ea2a0f73905319b677e57ebe37e49358989b5d"
 
 [[package]]
 name = "watchman_client"
 version = "0.8.0"
-source = "git+https://github.com/facebook/watchman.git?branch=main#d21cc8bb48e1e03e7f0327b6ddbf28d76523ad1b"
+source = "git+https://github.com/facebook/watchman.git?branch=main#5cba53852d5970c5fa6c5ffe8f35afc908b77279"
 dependencies = [
  "anyhow",
- "bytes 1.3.0",
- "futures 0.3.25",
+ "bytes 1.4.0",
+ "futures 0.3.26",
  "maplit",
  "serde",
  "serde_bser",
@@ -7338,9 +7361,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.60"
+version = "0.3.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+checksum = "e33b99f4b23ba3eec1a53ac264e35a755f00e966e0065077d6027c0f575b0b97"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -7422,9 +7445,9 @@ dependencies = [
 
 [[package]]
 name = "which"
-version = "4.3.0"
+version = "4.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c831fbbee9e129a8cf93e7747a82da9d95ba8e16621cae60ec2cdc849bacb7b"
+checksum = "2441c784c52b289a054b7201fc93253e288f094e2f4be9058343127c4226a269"
 dependencies = [
  "either",
  "libc",
@@ -7496,6 +7519,30 @@ dependencies = [
 ]
 
 [[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2522491fbfcd58cc84d47aeb2958948c4b8982e9a2d8a2a35bbaed431390e7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -7556,7 +7603,7 @@ dependencies = [
  "configmodel",
  "crossbeam 0.8.2",
  "edenfs_client",
- "futures 0.3.25",
+ "futures 0.3.26",
  "identity",
  "io",
  "manifest",
@@ -7650,9 +7697,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.5+zstd.1.5.2"
+version = "2.0.6+zstd.1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edc50ffce891ad571e9f9afe5039c4837bede781ac4bb13052ed7ae695518596"
+checksum = "68a3f9792c0c3dc6c165840a75f47ae1f4da402c2d006881129579f6597e801b"
 dependencies = [
  "cc",
  "libc",
diff --git a/pkgs/applications/version-management/sapling/default.nix b/pkgs/applications/version-management/sapling/default.nix
index 8873e8c4718ee..80cc6bf9e9360 100644
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@@ -43,7 +43,7 @@ let
     owner = "facebook";
     repo = "sapling";
     rev = version;
-    hash = "sha256-zlvb+qn9SSBPZmlF8KwKTWyKj94FGOafSMRMNLsccOU";
+    hash = "sha256-WOvkw+vuU/9vWgxCx7ogawQWCr1O7E70uw/LhuLiSzE";
   };
 
   addonsSrc = "${src}/addons";
@@ -51,7 +51,7 @@ let
   # Fetches the Yarn modules in Nix to to be used as an offline cache
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${addonsSrc}/yarn.lock";
-    sha256 = "sha256-+29WAgSXVciHhLMN04yfKiWCpjM3Vo54nUdTP6owSLs";
+    sha256 = "sha256-haeVRO5JBStrO7fjI9WhC5xZwX0IlZR1wxh0Q+m/UQM";
   };
 
   # Builds the NodeJS server that runs with `sl web`
@@ -88,111 +88,94 @@ let
       runHook postInstall
     '';
   };
-
-  # Builds the main `sl` binary and its Python extensions
-  sapling = python3Packages.buildPythonPackage {
-    pname = "sapling-main";
-    inherit src version;
-
-    sourceRoot = "source/eden/scm";
-
-    # Upstream does not commit Cargo.lock
-    cargoDeps = rustPlatform.importCargoLock {
-      lockFile = ./Cargo.lock;
-      outputHashes = {
-        "cloned-0.1.0" = "sha256-DYQTK722wgeDUJtOVXHLt42G6gpe6A62rET+JH+bPKU=";
-        "deltae-0.3.0" = "sha256-a9Skaqs+tVTw8x83jga+INBr+TdaMmo35Bf2wbfR6zs=";
-        "fb303_core-0.0.0" = "sha256-YEFNTYvtgp8nc/1O7AbdyxCD3Xx2xCjbS17fTTEsUL0=";
-        "fbthrift-0.0.1+unstable" = "sha256-mDoYhXOzQIDqP7XdmiBbmq5VmAKAgggTNH/kW2kHv4k=";
-        "reqwest-0.11.11" = "sha256-uhc8XhkGW22XDNo0qreWdXeFF2cslOOZHfTRQ30IBcE=";
-        "serde_bser-0.3.1" = "sha256-/zn1NfXWytXvnalkgPsg9BdujVV97PGkXwmPtQGVeCc=";
-      };
-    };
-    postPatch = ''
-      cp ${./Cargo.lock} Cargo.lock
-    '';
-
-    # Since the derivation builder doesn't have network access to remain pure,
-    # fetch the artifacts manually and link them. Then replace the hardcoded URLs
-    # with filesystem paths for the curl calls.
-    postUnpack = ''
-      mkdir $sourceRoot/hack_pydeps
-      ${lib.concatStrings (map (li: "ln -s ${fetchurl li} $sourceRoot/hack_pydeps/${baseNameOf li.url}\n") links)}
-      sed -i "s|https://files.pythonhosted.org/packages/[[:alnum:]]*/[[:alnum:]]*/[[:alnum:]]*/|file://$NIX_BUILD_TOP/$sourceRoot/hack_pydeps/|g" $sourceRoot/setup.py
-    '';
-
-    # Now, copy the "sl web" (aka edenscm-isl) results into the output of this
-    # package, so that the command can actually work. NOTES:
-    #
-    # 1) This applies on all systems (so no conditional a la postFixup)
-    # 2) This doesn't require any kind of fixup itself, so we leave it out
-    #    of postFixup for that reason, too
-    # 3) If asked, we optionally patch in a hardcoded path to the 'nodejs' package,
-    #    so that 'sl web' always works
-    # 4) 'sl web' will still work if 'nodejs' is in $PATH, just not OOTB
-    preFixup = ''
-      sitepackages=$out/lib/${python3Packages.python.libPrefix}/site-packages
-      chmod +w $sitepackages
-      cp -r ${isl} $sitepackages/edenscm-isl
-    '' + lib.optionalString (!enableMinimal) ''
-      chmod +w $sitepackages/edenscm-isl/run-isl
-      substituteInPlace $sitepackages/edenscm-isl/run-isl \
-        --replace 'NODE=node' 'NODE=${nodejs}/bin/node'
-    '';
-
-    postFixup = lib.optionalString stdenv.isLinux ''
-      wrapProgram $out/bin/sl \
-        --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
-    '';
-
-    nativeBuildInputs = [
-      curl
-      pkg-config
-    ] ++ (with rustPlatform; [
-      myCargoSetupHook
-      rust.cargo
-      rust.rustc
-    ]);
-
-    buildInputs = [
-      openssl
-    ] ++ lib.optionals stdenv.isDarwin [
-      curl
-      libiconv
-      CoreFoundation
-      CoreServices
-      Security
-    ];
-
-    doCheck = false;
-
-    HGNAME = "sl";
-    SAPLING_OSS_BUILD = "true";
-    SAPLING_VERSION = version;
-    SAPLING_VERSION_HASH = versionHash;
-  };
 in
-stdenv.mkDerivation {
+# Builds the main `sl` binary and its Python extensions
+python3Packages.buildPythonApplication {
   pname = "sapling";
-  inherit version;
-
-  dontUnpack = true;
+  inherit src version;
+
+  sourceRoot = "source/eden/scm";
+
+  # Upstream does not commit Cargo.lock
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "abomonation-0.7.3+smallvec1" = "sha256-AxEXR6GC8gHjycIPOfoViP7KceM29p2ZISIt4iwJzvM=";
+      "cloned-0.1.0" = "sha256-ZWO3/+O3Oc2Zg99seJ40CInrW1+3rFvL5HjIxhjDW5I=";
+      "deltae-0.3.0" = "sha256-a9Skaqs+tVTw8x83jga+INBr+TdaMmo35Bf2wbfR6zs=";
+      "fb303_core-0.0.0" = "sha256-LEib4QL5sMCUyQ9yGWnsOmO6hmlDaE80nfmrTC8elu0=";
+      "fbthrift-0.0.1+unstable" = "sha256-4SjdZzG6UP8OY7/Qy7ebdKOg1WdZ2USG6wJ7YhA/PxU=";
+      "reqwest-0.11.11" = "sha256-uhc8XhkGW22XDNo0qreWdXeFF2cslOOZHfTRQ30IBcE=";
+      "serde_bser-0.3.1" = "sha256-uW7qXEn0p7m6uo5r+rD3TDH/Lf1cBMWml0TbhysgDH8=";
+    };
+  };
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';
 
-  installPhase = ''
-    runHook preInstall
+  # Since the derivation builder doesn't have network access to remain pure,
+  # fetch the artifacts manually and link them. Then replace the hardcoded URLs
+  # with filesystem paths for the curl calls.
+  postUnpack = ''
+    mkdir $sourceRoot/hack_pydeps
+    ${lib.concatStrings (map (li: "ln -s ${fetchurl li} $sourceRoot/hack_pydeps/${baseNameOf li.url}\n") links)}
+    sed -i "s|https://files.pythonhosted.org/packages/[[:alnum:]]*/[[:alnum:]]*/[[:alnum:]]*/|file://$NIX_BUILD_TOP/$sourceRoot/hack_pydeps/|g" $sourceRoot/setup.py
+  '';
 
-    mkdir -p $out
-    cp -r ${sapling}/* $out
+  # Now, copy the "sl web" (aka edenscm-isl) results into the output of this
+  # package, so that the command can actually work. NOTES:
+  #
+  # 1) This applies on all systems (so no conditional a la postFixup)
+  # 2) This doesn't require any kind of fixup itself, so we leave it out
+  #    of postFixup for that reason, too
+  # 3) If asked, we optionally patch in a hardcoded path to the 'nodejs' package,
+  #    so that 'sl web' always works
+  # 4) 'sl web' will still work if 'nodejs' is in $PATH, just not OOTB
+  preFixup = ''
+    sitepackages=$out/lib/${python3Packages.python.libPrefix}/site-packages
+    chmod +w $sitepackages
+    cp -r ${isl} $sitepackages/edenscm-isl
+  '' + lib.optionalString (!enableMinimal) ''
+    chmod +w $sitepackages/edenscm-isl/run-isl
+    substituteInPlace $sitepackages/edenscm-isl/run-isl \
+      --replace 'NODE=node' 'NODE=${nodejs}/bin/node'
+  '';
 
-    runHook postInstall
+  postFixup = lib.optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/sl \
+      --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
   '';
 
+  nativeBuildInputs = [
+    curl
+    pkg-config
+  ] ++ (with rustPlatform; [
+    myCargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    curl
+    libiconv
+    CoreFoundation
+    CoreServices
+    Security
+  ];
+
+  HGNAME = "sl";
+  SAPLING_OSS_BUILD = "true";
+  SAPLING_VERSION = version;
+  SAPLING_VERSION_HASH = versionHash;
+
   # just a simple check phase, until we have a running test suite. this should
   # help catch issues like lack of a LOCALE_ARCHIVE setting (see GH PR #202760)
   doCheck = true;
-  checkPhase = ''
+  installCheckPhase = ''
     echo -n "testing sapling version; should be \"${version}\"... "
-    ${sapling}/bin/sl version | grep -qw "${version}"
+    $out/bin/sl version | grep -qw "${version}"
     echo "OK!"
   '';
 
diff --git a/pkgs/applications/version-management/sapling/deps.json b/pkgs/applications/version-management/sapling/deps.json
index 9cbcd71cbcf7c..eeedd64b95063 100644
--- a/pkgs/applications/version-management/sapling/deps.json
+++ b/pkgs/applications/version-management/sapling/deps.json
@@ -73,6 +73,6 @@
       "url": "https://files.pythonhosted.org/packages/4c/76/1e41fbb365ad20b6efab2e61b0f4751518444c953b390f9b2d36cf97eea0/Cython-0.29.32.tar.gz"
     }
   ],
-  "version": "0.2.20221222-152408-ha6a66d09",
-  "versionHash": "14601963598499040874"
+  "version": "0.2.20230124-180750-hf8cd450a",
+  "versionHash": "5465836048527734544"
 }
diff --git a/pkgs/applications/video/ccextractor/default.nix b/pkgs/applications/video/ccextractor/default.nix
index 26954375aff5b..3d62384634707 100644
--- a/pkgs/applications/video/ccextractor/default.nix
+++ b/pkgs/applications/video/ccextractor/default.nix
@@ -23,7 +23,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-usVAKBkdd8uz9cD5eLd0hnwGonOJLscRdc+iWDlNXVc=";
   };
 
-  postPatch = lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    # https://github.com/CCExtractor/ccextractor/issues/1467
+    sed -i '/allheaders.h/a#include <leptonica/pix_internal.h>' src/lib_ccx/ocr.c
+  '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace src/CMakeLists.txt \
     --replace 'add_definitions(-DGPAC_CONFIG_LINUX)' 'add_definitions(-DGPAC_CONFIG_DARWIN)'
   '';
diff --git a/pkgs/applications/video/haruna/default.nix b/pkgs/applications/video/haruna/default.nix
index 3849acda9473e..25fac4fba61de 100644
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@@ -26,13 +26,13 @@
 
 mkDerivation rec {
   pname = "haruna";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitLab {
     owner = "multimedia";
     repo = "haruna";
     rev = "v${version}";
-    hash = "sha256-hhHWxmr2EzW9QqfV1bpJCiWOWsmGJmvxvtQcuXlMTc4=";
+    hash = "sha256-kXafPUcWWvadGbcN4PAtXlFmfll/mSpwu2Sbh6Gxx4w=";
     domain = "invent.kde.org";
   };
 
diff --git a/pkgs/applications/video/mirakurun/default.nix b/pkgs/applications/video/mirakurun/default.nix
index ce4d412b77f8e..bc36039224758 100644
--- a/pkgs/applications/video/mirakurun/default.nix
+++ b/pkgs/applications/video/mirakurun/default.nix
@@ -39,6 +39,9 @@ stdenvNoCC.mkDerivation rec {
     yarnLock = ./yarn.lock;
     packageJSON = ./package.json;
 
+    # workaround for https://github.com/webpack/webpack/issues/14532
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
     patches = [
       # NOTE: fixes for hardcoded paths and assumptions about filesystem
       # permissions
diff --git a/pkgs/applications/video/openshot-qt/default.nix b/pkgs/applications/video/openshot-qt/default.nix
index 02270cd75e06e..ec980f1bfd1be 100644
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -7,6 +7,7 @@
 , gtk3
 , libopenshot
 , python3
+, qtbase
 , qtsvg
 , wrapGAppsHook
 }:
@@ -55,7 +56,7 @@ mkDerivationWith python3.pkgs.buildPythonApplication rec {
   ''
   # Fix toolbar icons on Darwin
   + lib.optionalString stdenv.isDarwin ''
-    --suffix QT_PLUGIN_PATH : "${lib.getBin qtsvg}/lib/qt-5.12.7/plugins" \
+    --suffix QT_PLUGIN_PATH : "${lib.getBin qtsvg}/${qtbase.qtPluginPrefix}" \
   '' + ''
     "''${gappsWrapperArgs[@]}" \
     "''${qtWrapperArgs[@]}"
diff --git a/pkgs/applications/video/openshot-qt/libopenshot.nix b/pkgs/applications/video/openshot-qt/libopenshot.nix
index 4214bed7167f4..904f039758ca3 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot.nix
@@ -31,8 +31,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i 's/{UNITTEST++_INCLUDE_DIR}/ENV{UNITTEST++_INCLUDE_DIR}/g' tests/CMakeLists.txt
-    sed -i 's/{_REL_PYTHON_MODULE_PATH}/ENV{_REL_PYTHON_MODULE_PATH}/g' bindings/python/CMakeLists.txt
-    export _REL_PYTHON_MODULE_PATH=$(toPythonPath $out)
   '';
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
@@ -62,7 +60,10 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
-  cmakeFlags = [ "-DENABLE_RUBY=OFF" ];
+  cmakeFlags = [
+    "-DENABLE_RUBY=OFF"
+    "-DPYTHON_MODULE_PATH=${python3.sitePackages}"
+  ];
 
   meta = with lib; {
     homepage = "http://openshot.org/";
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index e68cf7048b56a..c20a2c53d6002 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, python3, zlib, pkg-config, glib, buildPackages
+{ lib, stdenv, fetchurl, fetchpatch, python3Packages, zlib, pkg-config, glib, buildPackages
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
 , makeWrapper, runtimeShell, removeReferencesTo
@@ -51,7 +51,13 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [ makeWrapper removeReferencesTo pkg-config flex bison meson ninja perl python3 python3.pkgs.sphinx python3.pkgs.sphinx-rtd-theme ]
+  nativeBuildInputs = [
+    makeWrapper removeReferencesTo
+    pkg-config flex bison meson ninja perl
+
+    # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
+    python3Packages.python python3Packages.sphinx python3Packages.sphinx-rtd-theme
+  ]
     ++ lib.optionals gtkSupport [ wrapGAppsHook ]
     ++ lib.optionals stdenv.isDarwin [ sigtool ];
 
@@ -143,7 +149,6 @@ stdenv.mkDerivation rec {
     # have our patches and will be subtly broken because of that.
     "--meson=meson"
     "--cross-prefix=${stdenv.cc.targetPrefix}"
-    "--cpu=${stdenv.hostPlatform.uname.processor}"
     (lib.enableFeature guestAgentSupport "guest-agent")
   ] ++ lib.optional numaSupport "--enable-numa"
     ++ lib.optional seccompSupport "--enable-seccomp"
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index 06c8c4fcc0da6..aa626443c538d 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -7,16 +7,14 @@ let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
-      # TODO: Upgrade to 1.1.4 only after https://github.com/apptainer/apptainer/pull/967 get merge
-      # and https://github.com/apptainer/apptainer/issues/958 get fixed
-      version = "1.1.3";
+      version = "1.1.5";
       projectName = "apptainer";
 
       src = fetchFromGitHub {
         owner = "apptainer";
         repo = "apptainer";
         rev = "v${version}";
-        hash = "sha256-QFg6RC77OE/a6Qlzn6Zi5I7Iaq/U3/m0eI9yLArzuNc=";
+        hash = "sha256-onJkpHJNsO0cQO2m+TmdMuMkuvH178mDhOeX41bYFic=";
       };
 
       # Update by running
diff --git a/pkgs/applications/window-managers/cardboard/default.nix b/pkgs/applications/window-managers/cardboard/default.nix
index 5347b0961a540..6e483a40ef51c 100644
--- a/pkgs/applications/window-managers/cardboard/default.nix
+++ b/pkgs/applications/window-managers/cardboard/default.nix
@@ -99,6 +99,8 @@ stdenv.mkDerivation rec {
      cp -r ${expected-wrap} ${expected-wrap.name}
      cp -r ${wlroots-wrap} ${wlroots-wrap.name}
     )
+
+    sed '1i#include <functional>' -i cardboard/ViewAnimation.h # gcc12
   '';
 
   # "Inherited" from Nixpkgs expression for wlroots
@@ -108,6 +110,8 @@ stdenv.mkDerivation rec {
     "-Dwlroots:libseat=disabled"
   ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ]; # gcc12
+
   meta = with lib; {
     homepage = "https://gitlab.com/cardboardwm/cardboard";
     description = "A scrollable, tiling Wayland compositor inspired on PaperWM";
diff --git a/pkgs/build-support/build-graalvm-native-image/default.nix b/pkgs/build-support/build-graalvm-native-image/default.nix
index 64c6568e1bc22..810ef52235e1c 100644
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, graalvm, glibcLocales }:
+{ lib, stdenv, graalvm-ce, glibcLocales }:
 
 { name ? "${args.pname}-${args.version}"
   # Final executable name
@@ -19,7 +19,7 @@
   # XMX size of GraalVM during build
 , graalvmXmx ? "-J-Xmx6g"
   # The GraalVM derivation to use
-, graalvmDrv ? graalvm
+, graalvmDrv ? graalvm-ce
   # Locale to be used by GraalVM compiler
 , LC_ALL ? "en_US.UTF-8"
 , meta ? { }
@@ -51,12 +51,14 @@ stdenv.mkDerivation (args // {
 
   disallowedReferences = [ graalvmDrv ];
 
+  passthru = { inherit graalvmDrv; };
+
   meta = {
     # default to graalvm's platforms
     platforms = graalvmDrv.meta.platforms;
     # default to executable name
     mainProgram = executable;
     # need to have native-image-installable-svm available
-    broken = !(builtins.elem "native-image-installable-svm" graalvmDrv.products);
+    broken = !(builtins.any (p: (p.product or "") == "native-image-installable-svm") graalvmDrv.products);
   } // meta;
 })
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 33df804d5efec..2f3b2d8e37886 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -343,18 +343,11 @@ stdenv.mkDerivation {
     # compile, because it uses "#include_next <limits.h>" to find the
     # limits.h file in ../includes-fixed. To remedy the problem,
     # another -idirafter is necessary to add that directory again.
-    #
-    # We use --sysroot=/nix/store/does/not/exist to drop embedded default
-    # path to glibc headers gcc was built against. Without it -idirafter
-    # only appends to the list and outdated glibc headers end up being
-    # used. 'cc-cflags-before' is used to allow user's --sysroot= option
-    # to override our default.
     + optionalString (libc != null) (''
       touch "$out/nix-support/libc-cflags"
       touch "$out/nix-support/libc-ldflags"
       echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
     '' + optionalString (!(cc.langD or false)) ''
-      echo "--sysroot=/nix/store/does/not/exist" >> $out/nix-support/cc-cflags-before
       echo "-idirafter ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
     '' + optionalString (isGNU && (!(cc.langD or false))) ''
       for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
diff --git a/pkgs/build-support/libredirect/default.nix b/pkgs/build-support/libredirect/default.nix
index b5eb21e5ba4b5..6e2de7fa11b05 100644
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@@ -46,14 +46,14 @@ else stdenv.mkDerivation rec {
       -L${llvmPackages_13.clang.libc}/lib \
       -Wl,-install_name,$libName \
       -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     '' else if stdenv.isDarwin then ''
     $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
       -Wl,-install_name,$out/lib/$libName \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     '' else ''
     $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     ''}
 
     if [ -n "$doInstallCheck" ]; then
diff --git a/pkgs/build-support/libredirect/libredirect.c b/pkgs/build-support/libredirect/libredirect.c
index 1222d2ee75c64..9ecc16450cc27 100644
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@@ -201,6 +201,37 @@ WRAPPER(int, __xstat64)(int ver, const char * path, struct stat64 * st)
 WRAPPER_DEF(__xstat64)
 #endif
 
+#if defined(__linux__) && defined(STATX_TYPE)
+WRAPPER(int, statx)(int dirfd, const char * restrict pathname, int flags,
+    unsigned int mask, struct statx * restrict statxbuf)
+{
+    int (*statx_real) (int, const char * restrict, int,
+        unsigned int, struct statx * restrict) = LOOKUP_REAL(statx);
+    char buf[PATH_MAX];
+    return statx_real(dirfd, rewrite(pathname, buf), flags, mask, statxbuf);
+}
+WRAPPER_DEF(statx)
+#endif
+
+WRAPPER(int, fstatat)(int dirfd, const char * pathname, struct stat * statbuf, int flags)
+{
+    int (*fstatat_real) (int, const char *, struct stat *, int) = LOOKUP_REAL(fstatat);
+    char buf[PATH_MAX];
+    return fstatat_real(dirfd, rewrite(pathname, buf), statbuf, flags);
+}
+WRAPPER_DEF(fstatat);
+
+// In musl libc, fstatat64 is simply a macro for fstatat
+#if !defined(__APPLE__) && !defined(fstatat64)
+WRAPPER(int, fstatat64)(int dirfd, const char * pathname, struct stat64 * statbuf, int flags)
+{
+    int (*fstatat64_real) (int, const char *, struct stat64 *, int) = LOOKUP_REAL(fstatat64);
+    char buf[PATH_MAX];
+    return fstatat64_real(dirfd, rewrite(pathname, buf), statbuf, flags);
+}
+WRAPPER_DEF(fstatat64);
+#endif
+
 WRAPPER(int, stat)(const char * path, struct stat * st)
 {
     int (*__stat_real) (const char *, struct stat *) = LOOKUP_REAL(stat);
@@ -209,6 +240,17 @@ WRAPPER(int, stat)(const char * path, struct stat * st)
 }
 WRAPPER_DEF(stat)
 
+// In musl libc, stat64 is simply a macro for stat
+#if !defined(__APPLE__) && !defined(stat64)
+WRAPPER(int, stat64)(const char * path, struct stat64 * st)
+{
+    int (*stat64_real) (const char *, struct stat64 *) = LOOKUP_REAL(stat64);
+    char buf[PATH_MAX];
+    return stat64_real(rewrite(path, buf), st);
+}
+WRAPPER_DEF(stat64)
+#endif
+
 WRAPPER(int, access)(const char * path, int mode)
 {
     int (*access_real) (const char *, int mode) = LOOKUP_REAL(access);
@@ -346,6 +388,14 @@ WRAPPER(int, system)(const char *command)
 }
 WRAPPER_DEF(system)
 
+WRAPPER(int, chdir)(const char *path)
+{
+    int (*chdir_real) (const char *) = LOOKUP_REAL(chdir);
+    char buf[PATH_MAX];
+    return chdir_real(rewrite(path, buf));
+}
+WRAPPER_DEF(chdir);
+
 WRAPPER(int, mkdir)(const char *path, mode_t mode)
 {
     int (*mkdir_real) (const char *path, mode_t mode) = LOOKUP_REAL(mkdir);
diff --git a/pkgs/build-support/libredirect/test.c b/pkgs/build-support/libredirect/test.c
index 144e6d3d66dd0..7dd384ae3ed7e 100644
--- a/pkgs/build-support/libredirect/test.c
+++ b/pkgs/build-support/libredirect/test.c
@@ -63,6 +63,12 @@ int main(int argc, char *argv[])
     FILE *testfp;
     int testfd;
     struct stat testsb;
+#ifndef __APPLE__
+    struct stat64 testsb64;
+#endif
+#if defined(__linux__) && defined(STATX_TYPE)
+    struct statx testsbx;
+#endif
     char buf[PATH_MAX];
 
     testfp = fopen(TESTPATH, "r");
@@ -76,6 +82,20 @@ int main(int argc, char *argv[])
     assert(access(TESTPATH, X_OK) == 0);
 
     assert(stat(TESTPATH, &testsb) != -1);
+#ifndef __APPLE__
+    assert(stat64(TESTPATH, &testsb64) != -1);
+#endif
+    assert(fstatat(123, TESTPATH, &testsb, 0) != -1);
+#ifndef __APPLE__
+    assert(fstatat64(123, TESTPATH, &testsb64, 0) != -1);
+#endif
+#if defined(__linux__) && defined(STATX_TYPE)
+    assert(statx(123, TESTPATH, 0, STATX_ALL, &testsbx) != -1);
+#endif
+
+    assert(getcwd(buf, PATH_MAX) != NULL);
+    assert(chdir(TESTDIR) == 0);
+    assert(chdir(buf) == 0);
 
     assert(mkdir(TESTDIR "/dir-mkdir", 0777) == 0);
     assert(unlink(TESTDIR "/dir-mkdir") == -1); // it's a directory!
diff --git a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
index 1aa14cfeb7cc7..1d43c8e162ab2 100644
--- a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@@ -12,7 +12,7 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-set -- "$@" @addFlags@
+set -- @addFlags@ "$@"
 
 if (( ${#role_suffixes[@]} > 0 )); then
     # replace env var with nix-modified one
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 69ee4f56b98f7..b057d1681b03b 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -4,7 +4,6 @@
 , rust
 , stdenv
 , callPackage
-, cacert
 , cargoBuildHook
 , cargoCheckHook
 , cargoInstallHook
@@ -124,7 +123,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
       inherit cargo cargo-auditable;
     })
   ] ++ [
-    cacert
     cargoBuildHook
     (if useNextest then cargoNextestHook else cargoCheckHook)
     cargoInstallHook
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
index 7ca306b613bcd..36ab931697410 100644
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@@ -73,6 +73,9 @@ in stdenv.mkDerivation ({
 
     ${cargoUpdateHook}
 
+    # Override the `http.cainfo` option usually specified in `.cargo/config`.
+    export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
+
     cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
 
     # Create an empty vendor directory when there is no dependency to vendor
diff --git a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
index f34353a7617b8..b07b0c5ae804c 100644
--- a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@@ -1,4 +1,6 @@
-postFixupHooks+=(_makeSymlinksRelative)
+# symlinks are often created in postFixup
+# don't use fixupOutputHooks, it is before postFixup
+postFixupHooks+=(_makeSymlinksRelativeInAllOutputs)
 
 # For every symlink in $output that refers to another file in $output
 # ensure that the symlink is relative. This removes references to the output
@@ -26,3 +28,10 @@ _makeSymlinksRelative() {
 
     done < <(find $prefix -type l -print0)
 }
+
+_makeSymlinksRelativeInAllOutputs() {
+  local output
+  for output in $(getAllOutputNames); do
+    prefix="${!output}" _makeSymlinksRelative
+  done
+}
diff --git a/pkgs/data/fonts/freefont-ttf/default.nix b/pkgs/data/fonts/freefont-ttf/default.nix
index 9d8c28681a9f1..4bf50d3385879 100644
--- a/pkgs/data/fonts/freefont-ttf/default.nix
+++ b/pkgs/data/fonts/freefont-ttf/default.nix
@@ -1,18 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "freefont-ttf";
   version = "20120503";
 
-  url = "mirror://gnu/freefont/freefont-ttf-${version}.zip";
+  src = fetchzip {
+    url = "mirror://gnu/freefont/freefont-ttf-${version}.zip";
+    hash = "sha256-K3kVHGcDTxQ7N7XqSdwRObriVkBoBYPKHbyYrYvm7VU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype
-    find $out -maxdepth 1 ! -type d -exec rm {} +
-  '';
+    mv *.ttf $out/share/fonts/truetype
 
-  sha256 = "sha256-bdMZg/mHYc0N6HiR8uNl0CjeOwBou+OYj3LPkyEUHUA=";
+    runHook postInstall
+  '';
 
   meta = {
     description = "GNU Free UCS Outline Fonts";
@@ -24,6 +28,6 @@ fetchzip rec {
     homepage = "https://www.gnu.org/software/freefont/";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
-    maintainers = [];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index 7e3a662fda809..5baa9374a5444 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "18.0.0";
+  version = "19.0.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index 6d387516e8a4f..7c5525c85d003 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "03f2rabj2w2l7jwqyl2awj42jhh0l3picqgyfcv3q067i34abfyn";
-  iosevka-aile = "0p1r5sysy6djfd1sx0pfxf42bv7ayqgk1nvil33jr925w96i2dp6";
-  iosevka-curly = "0r33wcgvh315avgkkic27qpf3bavrqwbig1kj4wm5rdr957ldk40";
-  iosevka-curly-slab = "0yd7grhnx7z27xmd3wr8x2xx2002hmfi1y3ndmqq1sc9gab5gcb7";
-  iosevka-etoile = "0jhd49vxxxaqi1rxfkmpc3v1q96ak1b5wyggchngqi3739pjgqy3";
-  iosevka-slab = "00wk15kj9b1nr3b0bmarx6gqx3jg8z1pm9qqf9x09s72b3ng8adm";
-  iosevka-ss01 = "1kp6zv8zyx50la7zrfz4fis68s41kplibagny61w5v3w36xpm3cs";
-  iosevka-ss02 = "1c0dl28a3wwa5g4793jyb4n4c8p5vjlyh1b8j2i5da31dqrqm9gj";
-  iosevka-ss03 = "0vs8x6l8gwqi47g1c5ainsk5fb2i6j4wv7mgdyw5j5l3blnba5yh";
-  iosevka-ss04 = "1caf4xqd1dywzbq06ip042rw88833yk9ws7y3vjvsp93g7a2r675";
-  iosevka-ss05 = "008aphj4w6ri3fgnydrxavvpm3bfywv4cym10fqi9xgd84jhm9m1";
-  iosevka-ss06 = "00dkagqiwzwzvv75zss82yx0gdcbmh9xvr8swhi5zk0y0bc3xk2y";
-  iosevka-ss07 = "1acnva081awp76xyspksq9jkvlyswh3q1jy9gnsc6kh4vyn17vjs";
-  iosevka-ss08 = "0lmkglcjlppvfd7k2pz57r476fa4c0q5l4gqzfy1mlklh0mc5hqb";
-  iosevka-ss09 = "04r2k2z54iszwfnif872p5br0dm4fvc5341cpbxv4almpzxjyqnr";
-  iosevka-ss10 = "1c6gs9g8dhywpd2ha7kx2l7g7bwj7i5a78645ipx8126f749y0y9";
-  iosevka-ss11 = "0286k56r12a2yjylxynvzd0idrcv4ykrmpkn3b5xv9f74qq6irmf";
-  iosevka-ss12 = "0ab4x5lh8spbg0djb092vcq1cnvjhazwkia8byq1q47iwiyh756l";
-  iosevka-ss13 = "0kva71mfkl9xzz8khjzgrj47zg2505rg0hv5hxflawxsqwi4iwvl";
-  iosevka-ss14 = "1gk7m3xh4v3jm6s5g2prd27w4p0r1blbxsxdy3b020bdwikxcaga";
-  iosevka-ss15 = "0frxjc3hhay8izsx4ywff4j39qxp9ljz6hvw0rjcya3vny515jq5";
-  iosevka-ss16 = "1g299yhn0kfc7vn8vbgwq4798w5lcl72j6hj91k90i1yq11lg13i";
-  iosevka-ss17 = "02z83x73bhpgf44kq0gw46bdnpqzr4vm37h78bh19vydzqaj8hg0";
-  iosevka-ss18 = "1b7vhhbspi98xzmk4hpiw08jmscm7f7nibqxhkfmppl6y0ymbm9d";
-  sgr-iosevka = "1n60dgprl2p22wwfhxpwy9v9xf6vyv3qwm2jdc0m9m0q9jwjashr";
-  sgr-iosevka-aile = "1k195vqv2wajhmyma43xgda3s2z86kl2gksgdrm95s9sx7ijns2s";
-  sgr-iosevka-curly = "15yq1fs7knp9gxgqjxslpmlx85c6kvpm31sf81llpf4k5f9dmlcp";
-  sgr-iosevka-curly-slab = "0fa68lm6iwlf2s5k8388dwgk015c55zg1wkhhhjmixwn7p8gifxz";
-  sgr-iosevka-etoile = "1ry1zc7cdx6g927d1752ipz39v4wsnfrnn8n9cfwamz8v458wld1";
-  sgr-iosevka-fixed = "173v09dx5pwsbh9jac5qxi7nk95dqyryg747hl58bchby6kmnc3k";
-  sgr-iosevka-fixed-curly = "11y8bj9vmdq48n370f1r4zsk72ci3cq7c9ff6y40hn5w40s8k379";
-  sgr-iosevka-fixed-curly-slab = "1a4gmz6sl67l23awkfl8f3xdr8hbb2mi1lsc0ain1wvvyx1bi56m";
-  sgr-iosevka-fixed-slab = "11xv18ykrfg2fdvbrlcx7k3qvp5yqbm278ks3gm0gbck1awvfckg";
-  sgr-iosevka-fixed-ss01 = "1yb96x53wjks537vs0gd7rss6piszs139k1kgb1swrpq7519awaz";
-  sgr-iosevka-fixed-ss02 = "10yy0yg2i9nm00lzpmrfbdh7jjcll37wql3fcsaxha57gcxf9nf0";
-  sgr-iosevka-fixed-ss03 = "1fpjfqlqq6lz3gya1q24nzy2xls6nxn567lhglj0ykjnh3prkll8";
-  sgr-iosevka-fixed-ss04 = "1kwa5mwd6ihsyj2y70hrrvgy41cs19i0f7nvl4khs3i69a1l58ag";
-  sgr-iosevka-fixed-ss05 = "08v8in8s8p2nayazq60w1kc1jpq48nwdwh6wbxv7ij7lfwii8xws";
-  sgr-iosevka-fixed-ss06 = "03jzylw99xa3b6hpy6bpwhyii6d9fggy9synfl54sn7smwqk08wr";
-  sgr-iosevka-fixed-ss07 = "13yzd6r51gka03fcl3bvx6d97b4m4px2cnsd724maqkqrcxkbxgb";
-  sgr-iosevka-fixed-ss08 = "1xghlj7drx9328jr1cb051nkwv47r5ykkyy6ydff1c4amc1xabsq";
-  sgr-iosevka-fixed-ss09 = "12l6lbz4m1lwyqqmv583777r9ymssy9x34rz72y3dch0mqhmjjzg";
-  sgr-iosevka-fixed-ss10 = "1flrh6a7m0dw7na30nhbxjld54517z77ff3s9fjrpmgyb9wz7i2j";
-  sgr-iosevka-fixed-ss11 = "1j4v4h6k505gkxyswcjf61kj9cfgkalxjg1arms9zb351p8rrkda";
-  sgr-iosevka-fixed-ss12 = "00qwnsxc08bm5cq3ljz2pjqsiw019ah4z0crqcwaysijicxmbckc";
-  sgr-iosevka-fixed-ss13 = "0jrw0amhfi28mc4i7a74qvgjamvymijlf3akskaw9qrmzvks8wn1";
-  sgr-iosevka-fixed-ss14 = "0rvh842zkxdrna9nh2ylsjs3q90sq39658l0mafi85b8z5asdwai";
-  sgr-iosevka-fixed-ss15 = "0j5yrr1biqfhgj6qg6359xg9rfv6qzqiqdqjgfjwbhijs6xfn8f1";
-  sgr-iosevka-fixed-ss16 = "06jrfhb257nmldnxxyc5rh869r5y62v2y034c0r9j7354s7gcq7a";
-  sgr-iosevka-fixed-ss17 = "0cgmsh0478963k1dgpkhy6j1b383gx2q09z3shr6j87knjjwqgp0";
-  sgr-iosevka-fixed-ss18 = "0r4nyd459aqgna7dyzvxnznclqihxdb888g949kdzhxykfchq53s";
-  sgr-iosevka-slab = "1bv8asz66hn80xvjxa7b0vgywha1bpmhd8q95cssc3085dprz1r6";
-  sgr-iosevka-ss01 = "0sv19w0adnddzarf8dlz0n73jzqnp0xfb2lgh4xcpjkhm66j3fhh";
-  sgr-iosevka-ss02 = "1ih10a666r77pvj57crdgyn7ll15giwxj0nis501r1fkp1bzkscn";
-  sgr-iosevka-ss03 = "180hkjzzgasf9a58vi0n0cishnbyjgbjmkh60awcpxwvh85qd4hf";
-  sgr-iosevka-ss04 = "1i4rpg9j967xaxg8h9dmachd3896f4jgwxa0mfjlizls2hfvnbsi";
-  sgr-iosevka-ss05 = "1ca2z4dincjk7jl16pa6d7dnnzq3w3il7fr2lphvrjvdrxbci615";
-  sgr-iosevka-ss06 = "08dj9dcq58grnp6lh16yvvzjqhzlm765v4ci1rys0wbjnp72xxda";
-  sgr-iosevka-ss07 = "13k6plhdgxhp5gjs8z98wb480hh5wy6p2zmc4xvhp88y93fy8kk7";
-  sgr-iosevka-ss08 = "1zfxamanq6a06fazn1jkaswh5g6iw22qnycg5dnxn4flk8nas1db";
-  sgr-iosevka-ss09 = "0qaxp4fsvl26il16h78y2l8013m49cbk2nzxcs1k9g5if11a49d3";
-  sgr-iosevka-ss10 = "1qvvm6rvhrbp83qjfb3dfsbam20f6aw52kg1i5ggfrqj35niv0hd";
-  sgr-iosevka-ss11 = "1v2b456qj8kyacm7308gsim5p25wnyg8qabyrfvdj00h81s31akl";
-  sgr-iosevka-ss12 = "1rsi6ir5vccar0n3ychisc40axiyhqj5yvcx450ppd33f3sd5rc7";
-  sgr-iosevka-ss13 = "12x4q5l1pdxi065zs913dqd7zb8qpi4bbgd43h3k5azsrwxwvixr";
-  sgr-iosevka-ss14 = "1snzdv23jqmbz25k9i2zl7px7yysk5hn74q1x251s07ghdx3nfdj";
-  sgr-iosevka-ss15 = "0hbmj6wij6cv9yh76npp4xrl7fdm8jjx03398anfcsa02gkvg8zz";
-  sgr-iosevka-ss16 = "0v6vhg0vp5ig6ngs96q5mxa2snfp08nk68a9772sm1ny61q3chrq";
-  sgr-iosevka-ss17 = "0268b85yhdfsbjyhi0vlxwrpwxa8h919np53s060z94094h6jd9x";
-  sgr-iosevka-ss18 = "13vnhh8181h36y6iz2p2x6rjgjv5w3d0gqbcdkwhgmvx7s03k122";
-  sgr-iosevka-term = "05c2sxb4aris90mhjxyfkw1b0ga0hplfas669076h7yjsimw647l";
-  sgr-iosevka-term-curly = "1j0b4fhcivkdgka9zyqf732hcxj8rchqxkwv2bwxib1a17fmwn6c";
-  sgr-iosevka-term-curly-slab = "0dvv2n3plfxm8z2xi1ihzn4rncyk1kz8xbgyprnb0lvqiyf18igy";
-  sgr-iosevka-term-slab = "0i7wrvq6c96q8v6zw9iym42b6sbm0vc04ysljghpblnnfymq5yv9";
-  sgr-iosevka-term-ss01 = "1n23qp50pr466blpn2h9dhjbn0wnbbxyzb0sz751bk8db41lpyqb";
-  sgr-iosevka-term-ss02 = "0ghvfhkdsfsjb8yjwvwlwhn66lmy8dx34126ccnvj0g77ww2nwa9";
-  sgr-iosevka-term-ss03 = "03hnmy9wijqwsc36cg5b3pxj7mb1cbyacii00pcvrpcns2w1ssbw";
-  sgr-iosevka-term-ss04 = "0fv9xhhii0h5ii4yxsdnywn45254494mgq1n5aajasq494cgxhp4";
-  sgr-iosevka-term-ss05 = "0qa4l77sjpxd9l4nb555bhgzm0f1c74w6014md2rpljjvyy2mzwg";
-  sgr-iosevka-term-ss06 = "05y7rmghvhmzw3spn7b3v6hmpcqg5p32flm437a1aljdr46sbxli";
-  sgr-iosevka-term-ss07 = "1lzqgpr1vchi4ricqp1v49nv62rl3anbdvzpvddby81wr5jcyd1y";
-  sgr-iosevka-term-ss08 = "1sxicv2gspc39fyja370dpiq12xd1bgndiw5r6cqfkkd8x8dgpdv";
-  sgr-iosevka-term-ss09 = "0ax9pgm3d171kksrqd2z8xpr68kdxkqg9h344an55gjk01q7dzay";
-  sgr-iosevka-term-ss10 = "1rgvadmvdldcaqa0r76kzmrck814qwksdqficaxcd7wk8bx64n81";
-  sgr-iosevka-term-ss11 = "02if14ff5kax4p1aa2wkbidhwlzgyxi7lxir2ildahwfkvkp971y";
-  sgr-iosevka-term-ss12 = "0sj8n12is4094nbj67wkk88953jp9235kvvr4230abql1g6s263r";
-  sgr-iosevka-term-ss13 = "006sdcj8qw247b63d647ykm8razyb0apsfd0cjmlikj9hdmyzrr2";
-  sgr-iosevka-term-ss14 = "0i7d3ldp9rj1f4kwdk8hkxq0s38df6i25qfx6hwfjj1c5bl3a843";
-  sgr-iosevka-term-ss15 = "15gjqz7zc6wwy1l61pgpnz7wwyyaij43dcrwcwyi6h10jhm8b3ia";
-  sgr-iosevka-term-ss16 = "1c1i1iyqzgh3pz4fzjp26d71lphmcgqbjp2s91yyqg3nfhwbzvyc";
-  sgr-iosevka-term-ss17 = "0kr58576vlx81nb2ia5z9226m6h0ybd5vzfj5li9b721l4q0rpky";
-  sgr-iosevka-term-ss18 = "1zjs40i4dmw2l45k8wydngl4g3a88nhbmmjwd5lsz8a40pq4bw15";
+  iosevka = "0m8z67daj1gwb3yiw8qw3n1nxp96xb11fvb5183bh02r7ncym0da";
+  iosevka-aile = "02jhyzk3bpsjng3b1jfffwvr2inhhjsm4jdahzj05j381fp717c4";
+  iosevka-curly = "1si2kzv7qhlpyaaa954vnjmfk1c5rjxjimvckinpkjz30cnvg1bl";
+  iosevka-curly-slab = "1ngk3r6kdqngksga3s3m615jkqrxdcplj8srvlb6642vcc38w6vh";
+  iosevka-etoile = "1yg38x8dk5nyyjyy71v5j4x2x701hmp8gjwvphf5scf6vn52lvxz";
+  iosevka-slab = "1bw6lyy8lg4vpalnrsrnkrm9dlyl6vm6faigy2y9bfvh7nxrd8qa";
+  iosevka-ss01 = "1p02d8mdqx6mbnycs9d2r0qwqsxjrlgbl7skf8y66dsmjn6xxd0y";
+  iosevka-ss02 = "0ds8ad38h7h8250hdm89v2imya6jdzgk1h5jgsf983ls1gqjikhc";
+  iosevka-ss03 = "1s6rc4qhlfgvr7g8ywmlmsl58hfrqx0w24ivx5zz4jr5zqj70j7l";
+  iosevka-ss04 = "1lc8kx0p8m8nm4ql6ylcw9g4iq0j65hv6x48273cclqqcmqdn4qj";
+  iosevka-ss05 = "1wx02ysbj0rpr623jp1jy64ywrj8rm3n2fqzq05f4qv996bij11k";
+  iosevka-ss06 = "1bf0qnpvbq94d42gvbzikfkk20d788cicsyk8kz1vsf5xbg37kla";
+  iosevka-ss07 = "1ybl5gfyz4dnarimamshf002p9k6148wbbrbarpswb85kab502hd";
+  iosevka-ss08 = "1llp8iryr5dixdarwls9iw8mmnhzhlr7q8fzq969p64ygk76rkn4";
+  iosevka-ss09 = "14b49k0zv49xybdwrbf0p1krrga3jjviwzy0alxrwn0zf7vlbnbi";
+  iosevka-ss10 = "1xs1dkq62pml17dii2lhsianhzr22059i17sw2b334wbszc00j7y";
+  iosevka-ss11 = "0mrjzmk74vlq69ih4gm2iza4qdzyznn42bk3jwlvpd67z5vq36ag";
+  iosevka-ss12 = "0z16a8wrydi0ch9zj0lcz6cxbvawkr0ck03bzdbb81waggk4fxin";
+  iosevka-ss13 = "1rv8n3vbhwqv7bks6v86v4w13fr4a015xpvprzfz76xp98hb9dmc";
+  iosevka-ss14 = "0m7kpvy8bknmrfsql9b24w7n15hybnkisjxzzmrxkf8a60jrydni";
+  iosevka-ss15 = "006jkgww0hdb0c1wgby0y5535xapjpk1w8vm51d3yyrp04pwr1r1";
+  iosevka-ss16 = "1mmc7cyyk64lcavb2gib64b64zcr7qcn0m3cmlwnr1zgm6nb3w64";
+  iosevka-ss17 = "0wanv1h8qg5jyx7w380h7jkbc22slg9566pzw7dv7dg1nw0h2v3k";
+  iosevka-ss18 = "1y1daxghw3jbfn785935906j76l0230yixdmwlrzyra2svyaql3w";
+  sgr-iosevka = "182nzxxrxfz8xc3w8g9bsr0can71671w4xplyvyi7b1v9f62g9f5";
+  sgr-iosevka-aile = "1arjiwx5qf8j6pzb8mpd1g46z0kn80341wvcmsnx42d97b2m64jx";
+  sgr-iosevka-curly = "1lyh0rh2pswbaxsqyxicyknhla4gm2h0jb2rg0wx9vib9h53lazn";
+  sgr-iosevka-curly-slab = "0h2j7dwcyd5v1acpwjsz9li5g4r1ssx715x5pj4gdvskq4calff4";
+  sgr-iosevka-etoile = "15ag0w6sv24rc91mxh4c89gq6jwnq37bxml6a41rvn54fy0h1jnd";
+  sgr-iosevka-fixed = "0935zbk5x0mk06al11nig74b2rv1x8zc3waxs8hvbri0ryzykzk4";
+  sgr-iosevka-fixed-curly = "1i8cqfwcdsaxdlh87kaya8bp33fwlyz984r757122qnqbywcfm30";
+  sgr-iosevka-fixed-curly-slab = "0ba77jxn8n5dssjpwj4iyvwxw3mxqizrvsz5jyv9a4f3gfvwi18k";
+  sgr-iosevka-fixed-slab = "0qfhc7pg30ashpx504lln4h2w36icrbgij7fga07z2a715qxmfq9";
+  sgr-iosevka-fixed-ss01 = "1597hn4vzh0r8j22k7866blj3kw2bhp70z7msfr2hbszpscwxwqg";
+  sgr-iosevka-fixed-ss02 = "1ygrsvamgp6f26zg5qysk6dn4fa1im02dzsrlpgpv3sl4gh0cv44";
+  sgr-iosevka-fixed-ss03 = "0936ggnzaavqn4d7fsmmf54bwp0v31sz0n1w15ky7c5bsqp9h8ja";
+  sgr-iosevka-fixed-ss04 = "1xjslygh3f5nv0k8fiby0cgg22wr0a9jh79fbzallx3zh4d60a2a";
+  sgr-iosevka-fixed-ss05 = "0vnm398zdvkzymhw41gljpf9jq52wq3vawiyw5xsdr75d4n63fpb";
+  sgr-iosevka-fixed-ss06 = "1pnk8ijb193h85sk702ar0m0wk03xz1xcnvx8iq4k52q3a3vdd40";
+  sgr-iosevka-fixed-ss07 = "0qfcf6r2gzc5zwjfrcq1hjp9c5s13fc34lwwmxkj8224d42543jn";
+  sgr-iosevka-fixed-ss08 = "1ram9wm14k2sncfqpak23vss3pyqbwd1ndhm1i4ib7bpq8skd3wi";
+  sgr-iosevka-fixed-ss09 = "0r8zy1fwih42clxm2rsjqks5rxgy1qxirz396r25gvwxng2503y4";
+  sgr-iosevka-fixed-ss10 = "1v44s7n1gwz7mcybjsi1amv6xc8z47k20miycngjcy1cccrds2da";
+  sgr-iosevka-fixed-ss11 = "1fdclqvzq45shpj97awc7636ymgrnfd69iaizwxy49y2krpa7dx9";
+  sgr-iosevka-fixed-ss12 = "07f7i0qh9z6hlgy0ak3myxmiy4rbrixcap52lhk8wwapbnf21r7l";
+  sgr-iosevka-fixed-ss13 = "07z3hfi5vynwl15dqfsldwjj5i9fldmm6i1nypm28cxbya3izj60";
+  sgr-iosevka-fixed-ss14 = "1r001yna7ydf24bkgygld2kh47pvsz1yr9s57ssvdql37q24wzf1";
+  sgr-iosevka-fixed-ss15 = "1757lzbp9payykcdywdbfilhgm1yij8gsnazc7bywpc4sv806vhz";
+  sgr-iosevka-fixed-ss16 = "18mr7wvz5q60kgz0h2k05ahd0krz3ng7wgg1amd3292cji61vxvw";
+  sgr-iosevka-fixed-ss17 = "1bykqwspssv1vbx2nns8dfckijqmd633g57glmlhjmxlavv5gxnw";
+  sgr-iosevka-fixed-ss18 = "034w2yv2ihybkz03zalcsixrmjs7as62v8jhk8xkyckqc3bk0kc7";
+  sgr-iosevka-slab = "04b1w9ij6dgy5gyvi7d47g9xadpb230mlgbdrk36fyhvfyw048y1";
+  sgr-iosevka-ss01 = "077d4dan7f41ydi64xv0z0784j5vcj98vmqagmy1c1xyr0p68dac";
+  sgr-iosevka-ss02 = "1hmy2cwnsb3f60yp66lznas78432518xkj2jmpqy8ad05d2zmmc8";
+  sgr-iosevka-ss03 = "1bs1hb6magmbc2zh4fzx7h6j6bdllbvv85fv5krs3b888w3fzjw1";
+  sgr-iosevka-ss04 = "1c3wb8nz0xz57crwn151b5sgzm320jkirsajyjf0srdaid1gkjkx";
+  sgr-iosevka-ss05 = "1dx33y8rk3nzgdfikz262javq4v3n76hvv5b7rx7kxlkxycpy8ya";
+  sgr-iosevka-ss06 = "1s54xx4w3zvbz2w7f5sl5vlqazwsm033jsq8ljrdh4c2l88mpcq3";
+  sgr-iosevka-ss07 = "03zfq3jib2df6dhj1pbmw8hq57i0fx98gkawxzk13sfgrzz1zv47";
+  sgr-iosevka-ss08 = "09k220gha919lv18bs6y2zlcjqa5j7jsq8mfqx8xddcwq1v9v094";
+  sgr-iosevka-ss09 = "0plvxhqwkr52sich4kwzqs3xq5s5x61hq7n423ar2zaskx007sjv";
+  sgr-iosevka-ss10 = "0c42h417sir120cp6fbnbhv3s1ys8pxky56v6f44h50w7p6qhlx1";
+  sgr-iosevka-ss11 = "03sp7z0s5sb9bnhxb9liainpiqmq1r0lpmigscl6wr1rpaxq2l7i";
+  sgr-iosevka-ss12 = "0y2xs0qv3b1k4s4my9c69j94ql2kwmqmm3f626vjj8rar8r0wab0";
+  sgr-iosevka-ss13 = "1pyv3i1972n5gxr16fl68gydjsxndh7kbba3d15bmkankahgll6c";
+  sgr-iosevka-ss14 = "1c7y8h8jv937wnlxkgdswb0ixa5v747z598pd0yhvwid3ksxb1px";
+  sgr-iosevka-ss15 = "08wzzkr0l0xz4l7qk9kbhvybr4favl0qz0cjr7raw0hibqkw17sp";
+  sgr-iosevka-ss16 = "0q63x71mq19gqqiaqbqsp0lvf3knhckx5d17caq6ipv5gs3xxmzr";
+  sgr-iosevka-ss17 = "04054qbvyfvp1aqs3likyh85kqyckkg2ac83s65lvkj3f46r50sg";
+  sgr-iosevka-ss18 = "1ckrfx3f4mncm1hbc2bcsbk97kkzsi524wfgvhz10jw1yk5yyd60";
+  sgr-iosevka-term = "1ygfsc86fihkxpwm2q3j2y3ibpb7lkrjwrld7dg9ymb83hah29xm";
+  sgr-iosevka-term-curly = "1qz8x2z23m5yvdpf0055a7xb5z77dabwbf3hkmh4r77rp1h6idv4";
+  sgr-iosevka-term-curly-slab = "011n7qpcx2abvp5i9z6picy5bcjvvfx7pjqy8m7sf02fdm14s2jl";
+  sgr-iosevka-term-slab = "1iwgcqnxbjf25k6bbx3iwcqy2ghwnnxvfinjp5slwr7bhjjjbl9y";
+  sgr-iosevka-term-ss01 = "09s813a8ywqpncmq0iqkjjnh1sb5zn267fzp2dz92cmw5929627s";
+  sgr-iosevka-term-ss02 = "1yyvnxdwi6caq6b6pgviad5l7b7znx4xkxdg1np23a7imr94vb1c";
+  sgr-iosevka-term-ss03 = "1hrdipmf54z2hrl7g8m8z17aq3lp5v66xy24f58qsm4c1pfab3i7";
+  sgr-iosevka-term-ss04 = "1h54glwrzblg61y4f1sxm78mci47wjry4h4gdrbpx96snf31ynbb";
+  sgr-iosevka-term-ss05 = "1xzzj36817nsw15s3a1f740d89gc4634dnczjjj6vrddli8ilann";
+  sgr-iosevka-term-ss06 = "0c07i831bmfz6y7jqaip6il4cvqzc51d0w17s2dnjrnj4x3ndgmx";
+  sgr-iosevka-term-ss07 = "0x9wzf0w4pzjmzzbmzj56nkhhz5834chvxqn9519fbq1md4pfl3b";
+  sgr-iosevka-term-ss08 = "1gf1l17d8hrf1aq4pq9ai05kan8m86z8s2d7masjkvg1zaw2lb4s";
+  sgr-iosevka-term-ss09 = "1nnhciib413ll2h7ps3vyghiayz9iwniwr7byyn9pdimm0j5vq07";
+  sgr-iosevka-term-ss10 = "0qvficwhpya5sy5myxsjjfmrn9z2d9lpzyi88l8dhz3dfvyr1yzs";
+  sgr-iosevka-term-ss11 = "0ml6swvyddhz2nvq14skfh1d9d98c3d6ir0qgf97pc0qxyqbcfp2";
+  sgr-iosevka-term-ss12 = "01nxs1m2iif6lswx22h58i45zxab0nbqpf0rzlp6v3wnb8ylpbi5";
+  sgr-iosevka-term-ss13 = "0zadj9fakpqmibnxz883hwbcgqfssjvsi6kcvzik5cnamlk2jz8c";
+  sgr-iosevka-term-ss14 = "1dwfm8lcbgf8rfw11i2alrv98f9332cqyk9zvzfrjrdp9camr7j0";
+  sgr-iosevka-term-ss15 = "0z7ad7vy2faq33kpbl1x2w6i3s4af8v8fzj05rdyadws35ra3idd";
+  sgr-iosevka-term-ss16 = "1fzzkmk7ppcbmg7s50nknc7nwavfpqsja12af8qidzba9z535w2g";
+  sgr-iosevka-term-ss17 = "1rcpfgf5blg3nbf6prw9h2ylc2ji8vl6cxqlck482kncz8ph9swk";
+  sgr-iosevka-term-ss18 = "1nksii5xyi97lsrf1hxl06m0pdlk8rnsbg1s81amkzz8fxlyhzlc";
 }
diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index e99dfde411dcb..6054066465c37 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "JuliaMono-ttf";
-  version = "0.047";
+  version = "0.048";
 
   src = fetchzip {
     url = "https://github.com/cormullion/juliamono/releases/download/v${version}/${pname}.tar.gz";
     stripRoot = false;
-    hash = "sha256-tCZo48SBGdhcsP1wgaWkfWr3L3Yz+p/iqesLmarSWbk=";
+    hash = "sha256-KSyJMlQclEj2CR+5uSYLmPtseWiDIUuahaPDx7Tn/bw=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/icons/capitaine-cursors-themed/default.nix b/pkgs/data/icons/capitaine-cursors-themed/default.nix
index d86ce3f8161ae..bd0147fecde31 100644
--- a/pkgs/data/icons/capitaine-cursors-themed/default.nix
+++ b/pkgs/data/icons/capitaine-cursors-themed/default.nix
@@ -1,14 +1,22 @@
-{ lib, fetchzip }:
-fetchzip rec {
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
   pname = "capitaine-cursors-themed";
   version = "5";
-  stripRoot = false;
-  url = "https://github.com/sainnhe/capitaine-cursors/releases/download/r${version}/Linux.zip";
-  sha256 = "jQNAXuR/OtvohWziGYgb5Ni2/tEIGaY9HIyUUW793EY=";
 
-  postFetch = ''
+  src = fetchzip {
+    url = "https://github.com/sainnhe/capitaine-cursors/releases/download/r${version}/Linux.zip";
+    stripRoot = false;
+    hash = "sha256-ipPpmZKU/xLA45fdOvxVbtFDCUsCYIvzeps/DjhFkNg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/icons
     cp -r ./ $out/share/icons
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/misc/cldr-annotations/default.nix b/pkgs/data/misc/cldr-annotations/default.nix
index f19b666abeabf..729d3cdbb7b89 100644
--- a/pkgs/data/misc/cldr-annotations/default.nix
+++ b/pkgs/data/misc/cldr-annotations/default.nix
@@ -1,23 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "cldr-annotations";
   version = "42.0";
 
-  url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
+  src = fetchzip {
+    url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-paRon3ecGXNp3ZDnN1DU9RVU2NDWTBiKjy0OP3vcPLE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  stripRoot = false;
-  postFetch = ''
     mkdir -p $out/share/unicode/cldr/common
-    mv $out/common/annotations{,Derived} -t $out/share/unicode/cldr/common
+    mv common/annotations{,Derived} -t $out/share/unicode/cldr/common
 
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+    runHook postInstall
   '';
 
-  hash = "sha256-9OOd69nBaDSt+ilL3PTGpcQgC60PnHqd8/CYa2LgeI0=";
-
   meta = with lib; {
     description = "Names and keywords for Unicode characters from the Common Locale Data Repository";
     homepage = "https://cldr.unicode.org";
diff --git a/pkgs/data/misc/papirus-folders/default.nix b/pkgs/data/misc/papirus-folders/default.nix
index 92bfe362bcda5..24fbeb0b0e23d 100644
--- a/pkgs/data/misc/papirus-folders/default.nix
+++ b/pkgs/data/misc/papirus-folders/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-folders";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "papirus-folders";
     rev = "v${version}";
-    sha256 = "sha256-ZZMEZCWO+qW76eqa+TgxWGVz69VkSCPcttLoCrH7ppY=";
+    sha256 = "sha256-Dus9f2m5Wj46Url7N3UYEvBAankppzGzdJHGPH3CT3g=";
   };
 
   buildInputs = [
diff --git a/pkgs/data/misc/publicsuffix-list/default.nix b/pkgs/data/misc/publicsuffix-list/default.nix
index 063e120d3c4b1..02b0ba0b439b5 100644
--- a/pkgs/data/misc/publicsuffix-list/default.nix
+++ b/pkgs/data/misc/publicsuffix-list/default.nix
@@ -1,20 +1,24 @@
-{ lib, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-let
+stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "2021-09-03";
-in fetchFromGitHub {
-  name = "${pname}-${version}";
-  owner = "publicsuffix";
-  repo = "list";
-  rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
-  sha256 = "sha256-Q8uIXM1CMu8dlWcVoL17M1XRGu3kG7Y7jpx0oHQh+2I=";
+  version = "unstable-2021-09-03";
 
-  postFetch = ''
-    install -Dm0444 $out/public_suffix_list.dat $out/tests/test_psl.txt -t $out/share/publicsuffix
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  src = fetchFromGitHub {
+    owner = "publicsuffix";
+    repo = "list";
+    rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
+    hash = "sha256-moibTN9KovABcg+ubKUgMXg4b8sMrTVo6Itmiati/Vk=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm0444 public_suffix_list.dat tests/test_psl.txt -t $out/share/publicsuffix
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/misc/unicode-emoji/default.nix b/pkgs/data/misc/unicode-emoji/default.nix
index bf27cb03e2852..ae14a27c8b7f4 100644
--- a/pkgs/data/misc/unicode-emoji/default.nix
+++ b/pkgs/data/misc/unicode-emoji/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenvNoCC
 , fetchurl
 , symlinkJoin
 }:
@@ -6,30 +7,40 @@
 let
   version = "15.0";
 
-  fetchData = { file, sha256 }: fetchurl {
-    url = "https://www.unicode.org/Public/emoji/${version}/${file}";
-    inherit sha256;
-    downloadToTemp = true;
-    recursiveHash = true;
-    postFetch = ''
+  fetchData = { suffix, hash }: stdenvNoCC.mkDerivation {
+    pname = "unicode-emoji-${suffix}";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://www.unicode.org/Public/emoji/${version}/emoji-${suffix}.txt";
+      inherit hash;
+    };
+
+    dontUnpack = true;
+
+    installPhase = ''
+      runHook preInstall
+
       installDir="$out/share/unicode/emoji"
       mkdir -p "$installDir"
-      mv "$downloadedFile" "$installDir/${file}"
+      cp "$src" "$installDir/emoji-${suffix}.txt"
+
+      runHook postInstall
     '';
   };
 
   srcs = {
     emoji-sequences = fetchData {
-      file = "emoji-sequences.txt";
-      sha256 = "sha256-vRpXHAcdY3arTnFwBH3WUW3DOh8B3L9+sRcecLHZ2lg=";
+      suffix = "sequences";
+      hash = "sha256-XCIi2KQy2JagMaaML1SwT79HsPzi5phT8euKPpRetW0=";
     };
     emoji-test = fetchData {
-      file = "emoji-test.txt";
-      sha256 = "sha256-3Rega6+ZJ5jXRhLFL/i/12V5IypEo5FaGG6Wf9Bj0UU=";
+      suffix = "test";
+      hash = "sha256-hEXyOsg4jglr4Z0CYuFPzv+Fb/Ugk/I1bciUhfGoU9s=";
     };
     emoji-zwj-sequences = fetchData {
-      file = "emoji-zwj-sequences.txt";
-      sha256 = "sha256-9AqrpyUCiBcR/fafa4VaH0pT5o1YzEZDVySsX4ja1u8=";
+      suffix = "zwj-sequences";
+      hash = "sha256-/jV/kRe3dGZ2Bjdl1YcTft+bJZA6eSvVSTW/CFZ5EYI=";
     };
   };
 in
diff --git a/pkgs/desktops/gnome/apps/seahorse/default.nix b/pkgs/desktops/gnome/apps/seahorse/default.nix
index 60de418f1e440..bbab612b9c8d8 100644
--- a/pkgs/desktops/gnome/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome/apps/seahorse/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch
 , fetchurl
 , vala
 , meson
@@ -36,6 +37,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-Wx0b+6dPNlgifzyC4pbzMN0PzR70Y2tqIYIo/uXqgy0=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "gpg-2.4.patch";
+      url = "https://gitlab.gnome.org/GNOME/seahorse/-/commit/9260c74779be3d7a378db0671af862ffa3573d42.patch";
+      hash = "sha256-4QiFgH4jC1ucmA9fFozUQZ3Mat76SgpYkMpRz80RH64=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/desktops/gnome/core/gnome-contacts/default.nix b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
index 760af24880c4d..560d40ddc115e 100644
--- a/pkgs/desktops/gnome/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-contacts";
-  version = "43.0";
+  version = "43.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "VbYd9+k/Cr4f+kZeGOPF3k9JqQ8mjqnRHtyGrwbQceE=";
+    sha256 = "Ug3IjJAce4/n4SoBOhQlz+2R8vhAhIWitJ+SxnWZACA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/rox/rox-filer/default.nix b/pkgs/desktops/rox/rox-filer/default.nix
index e26c90592252f..b05be287a89d4 100644
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
   buildInputs = [ libxml2 gtk shared-mime-info libSM ];
-  NIX_LDFLAGS = "-ldl -lm";
+  NIX_LDFLAGS = "-lm";
 
   patches = [
     ./rox-filer-2.11-in-source-build.patch
diff --git a/pkgs/development/compilers/dmd/generic.nix b/pkgs/development/compilers/dmd/generic.nix
index c1fb9abf77d7e..3f8871df4f96d 100644
--- a/pkgs/development/compilers/dmd/generic.nix
+++ b/pkgs/development/compilers/dmd/generic.nix
@@ -151,13 +151,6 @@ stdenv.mkDerivation rec {
     git
   ];
 
-  # Workaround cc-wrapper's --sysroot= value for `staging-next`: it
-  # breaks library lookup via RUNPATH:
-  #   ld: warning: libm.so.6, needed by ./generated/linux/release/64/lib.so, not found (try using -rpath or -rpath-link)
-  #   ld: /build/druntime/generated/linux/release/64/libdruntime.so: undefined reference to `log10@GLIBC_2.2.5'
-  # TODO(trofi): remove the workaround once cc-wrapper is fixed.
-  NIX_CFLAGS_COMPILE = [ "--sysroot=/" ];
-
   buildInputs = [
     curl
     tzdata
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 97ed0ee9b058a..abe6d92cd0a69 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -222,7 +222,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
     ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
@@ -235,7 +235,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index f29da83bb5704..1c6b7326c0746 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -82,7 +82,10 @@ let majorVersion = "11";
       ++ optional (stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      # openjdk build fails without this on -march=opteron; is upstream in gcc12
+      ++ [ ./gcc-issue-103910.patch ];
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@@ -228,7 +231,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
     ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
@@ -241,7 +244,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch b/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch
new file mode 100644
index 0000000000000..c3edd960f0973
--- /dev/null
+++ b/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch
@@ -0,0 +1,41 @@
+From d243f4009d8071b734df16cd70f4c5d09a373769 Mon Sep 17 00:00:00 2001
+From: Andrew Pinski <apinski@marvell.com>
+Date: Wed, 5 Jan 2022 22:00:07 +0000
+Subject: [PATCH] Fix target/103910: missing GTY on x86_mfence causing PCH
+ usage to ICE
+
+With -O3 -march=opteron, a mfence builtin is added after the loop
+to say the nontemporal stores are no longer needed. This all good
+without precompiled headers as the function decl that is referneced
+by x86_mfence is referenced in another variable but with precompiled
+headers, x86_mfence is all messed up and the decl was GC'ed away.
+This fixes the problem by marking x86_mfence as GTY to save/restore
+during precompiled headers just like most other variables in
+the header file.
+
+Committed as obvious after a bootstrap/test on x86_64-linux-gnu.
+
+gcc/ChangeLog:
+
+	PR target/103910
+	* config/i386/i386.h (x86_mfence): Mark with GTY.
+---
+ gcc/config/i386/i386.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gcc/config/i386/i386.h b/gcc/config/i386/i386.h
+index f027608eefa..3ac0f698ae2 100644
+--- a/gcc/config/i386/i386.h
++++ b/gcc/config/i386/i386.h
+@@ -486,7 +486,7 @@ extern unsigned char ix86_prefetch_sse;
+ 
+ /* Fence to use after loop using storent.  */
+ 
+-extern tree x86_mfence;
++extern GTY(()) tree x86_mfence;
+ #define FENCE_FOLLOWING_MOVNT x86_mfence
+ 
+ /* Once GDB has been enhanced to deal with functions without frame
+-- 
+2.31.1
+
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 3a8af389469b3..f0bdafd8c208f 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -261,7 +261,7 @@ stdenv.mkDerivation ({
 
   inherit (callFile ../common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
@@ -275,7 +275,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index cee54a0921785..7e6d4eb12239e 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -246,7 +246,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index e1ae025cd272a..4ea63d7c12e1a 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -266,7 +266,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index c3410a72fc7dc..039293dd86e4e 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -276,7 +276,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -287,7 +287,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 4d8d1f51ff67c..a02d1b6d27953 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -226,7 +226,7 @@ stdenv.mkDerivation ({
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
   NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -240,7 +240,6 @@ stdenv.mkDerivation ({
   ;
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index e19d0888f00b9..b7e70f39471e2 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -207,7 +207,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -218,7 +218,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index ae26908a10aac..484c89c0e9021 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -221,7 +221,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -232,7 +232,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index dd5a8de76e2a8..2d7a058fa015c 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -203,17 +203,6 @@ preInstall() {
         ln -s lib "$out/${targetConfig}/lib32"
         ln -s lib "${!outputLib}/${targetConfig}/lib32"
     fi
-
-    # cc-wrappers uses --sysroot=/nix/store/does/not/exist as a way to
-    # drop default sysheaders search path. Unfortunately that switches
-    # clang++ into searching libraries in gcc in cross-compiler paths:
-    #   from ${!outputLib}/lib (native)
-    #   to ${!outputLib}/${targetPlatformConfig}/lib
-    # We create the symlink to make both native and cross paths
-    # available even if the toolchain is not the cross-compiler.
-    if [ ! -e ${!outputLib}/${targetPlatformConfig} ] ; then
-        ln -s . ${!outputLib}/${targetPlatformConfig}
-    fi
 }
 
 
diff --git a/pkgs/development/compilers/gnu-cim/default.nix b/pkgs/development/compilers/gnu-cim/default.nix
new file mode 100644
index 0000000000000..b1cb9f08597e0
--- /dev/null
+++ b/pkgs/development/compilers/gnu-cim/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnu-cim";
+  version = "5.1";
+
+  outputs = ["out" "lib" "man" "info"];
+
+  src = fetchurl {
+    url = "mirror://gnu/cim/cim-${version}.tar.gz";
+    hash = "sha256-uQcXtm7EAFA73WnlN+i38+ip0QbDupoIoErlc2mgaak=";
+  };
+
+  postPatch = ''
+    for fname in lib/{simulation,simset}.c; do
+      substituteInPlace "$fname" \
+        --replace \
+          '#include "../../lib/cim.h"' \
+          '#include "../lib/cim.h"'
+    done
+  '';
+
+  CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-return-type";
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "A GNU compiler for the programming language Simula";
+    longDescription = ''
+      GNU Cim is a compiler for the programming language Simula.
+      It offers a class concept, separate compilation with full type checking,
+      interface to external C routines, an application package for process
+      simulation and a coroutine concept. Commonly used with the Demos for
+      discrete event modelling.
+    '';
+    homepage = "https://www.gnu.org/software/cim/";
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    badPlatforms = [ "aarch64-darwin" ];
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 3c089f02920a1..b19fe44c13170 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , substituteAll
@@ -87,6 +88,12 @@ stdenv.mkDerivation rec {
     })
     ./remove-tools-1.11.patch
     ./go_no_vendor_checks-1.16.patch
+
+    # runtime: support riscv64 SV57 mode
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
+      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
+    })
   ];
 
   GOOS = stdenv.targetPlatform.parsed.kernel.name;
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 84a6059581e73..13cf14c77fa5a 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , substituteAll
@@ -87,6 +88,12 @@ stdenv.mkDerivation rec {
     })
     ./remove-tools-1.11.patch
     ./go_no_vendor_checks-1.16.patch
+
+    # runtime: support riscv64 SV57 mode
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
+      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
+    })
   ];
 
   GOOS = stdenv.targetPlatform.parsed.kernel.name;
diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
new file mode 100644
index 0000000000000..f8a1e515db3bd
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@@ -0,0 +1,148 @@
+{ lib
+, stdenv
+, alsa-lib
+, autoPatchelfHook
+, cairo
+, cups
+, fontconfig
+, Foundation
+, glib
+, gtk3
+, gtkSupport ? stdenv.isLinux
+, makeWrapper
+, setJavaClassPath
+, unzip
+, xorg
+, zlib
+}:
+{ javaVersion
+, meta ? { }
+, products ? [ ]
+, ... } @ args:
+
+let
+  runtimeLibraryPath = lib.makeLibraryPath
+    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
+  mapProducts = key: default: (map (p: p.${key} or default) products);
+  concatProducts = key: lib.concatStringsSep "\n" (mapProducts key "");
+
+  graalvmXXX-ce = stdenv.mkDerivation (args // {
+    pname = "graalvm${javaVersion}-ce";
+
+    unpackPhase = ''
+      runHook preUnpack
+
+      mkdir -p "$out"
+
+      # The tarball on Linux has the following directory structure:
+      #
+      #   graalvm-ce-java11-20.3.0/*
+      #
+      # while on Darwin it looks like this:
+      #
+      #   graalvm-ce-java11-20.3.0/Contents/Home/*
+      #
+      # We therefor use --strip-components=1 vs 3 depending on the platform.
+      tar xf "$src" -C "$out" --strip-components=${
+        if stdenv.isLinux then "1" else "3"
+      }
+
+      # Sanity check
+      if [ ! -d "$out/bin" ]; then
+          echo "The `bin` is directory missing after extracting the graalvm"
+          echo "tarball, please compare the directory structure of the"
+          echo "tarball with what happens in the unpackPhase (in particular"
+          echo "with regards to the `--strip-components` flag)."
+          exit 1
+      fi
+
+      runHook postUnpack
+    '';
+
+    postUnpack = ''
+      for product in ${toString products}; do
+        cp -Rv $product/* $out
+      done
+    '';
+
+    dontStrip = true;
+
+    nativeBuildInputs = [ unzip makeWrapper ]
+      ++ lib.optional stdenv.isLinux autoPatchelfHook;
+
+    propagatedBuildInputs = [ setJavaClassPath zlib ]
+      ++ lib.optional stdenv.isDarwin Foundation;
+
+    buildInputs = lib.optionals stdenv.isLinux [
+      alsa-lib # libasound.so wanted by lib/libjsound.so
+      fontconfig
+      stdenv.cc.cc.lib # libstdc++.so.6
+      xorg.libX11
+      xorg.libXext
+      xorg.libXi
+      xorg.libXrender
+      xorg.libXtst
+    ];
+
+    preInstall = concatProducts "preInstall";
+    postInstall = ''
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -sf $out/include/linux/*_md.h $out/include/
+
+      # copy-paste openjdk's preFixup
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat > $out/nix-support/setup-hook << EOF
+        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '' + concatProducts "postInstall";
+
+    preFixup = lib.optionalString (stdenv.isLinux) ''
+      # Find all executables in any directory that contains '/bin/'
+      for bin in $(find "$out" -executable -type f -wholename '*/bin/*'); do
+        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+      done
+    '' + concatProducts "preFixup";
+    postFixup = concatProducts "postFixup";
+
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+
+      echo ${
+        lib.escapeShellArg ''
+          public class HelloWorld {
+            public static void main(String[] args) {
+              System.out.println("Hello World");
+            }
+          }
+        ''
+      } > HelloWorld.java
+      $out/bin/javac HelloWorld.java
+
+      # run on JVM with Graal Compiler
+      echo "Testing GraalVM"
+      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+
+      ${concatProducts "installCheckPhase"}
+
+      runHook postInstallCheck
+    '';
+
+    passthru = {
+      inherit products;
+      home = graalvmXXX-ce;
+      updateScript = ./update.sh;
+    };
+
+    meta = with lib; ({
+      inherit platforms;
+      homepage = "https://www.graalvm.org/";
+      description = "High-Performance Polyglot VM";
+      license = with licenses; [ upl gpl2Classpath bsd3 ];
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+      mainProgram = "java";
+      maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
+    } // meta);
+  });
+in graalvmXXX-ce
diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
new file mode 100644
index 0000000000000..e4b55cc756b79
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, autoPatchelfHook
+, makeWrapper
+, perl
+, unzip
+, zlib
+}:
+{ product
+, javaVersion
+, extraNativeBuildInputs ? [ ]
+, extraBuildInputs ? [ ]
+, meta ? { }
+, passthru ? { }
+, ... } @ args:
+
+stdenv.mkDerivation (args // {
+  pname = "${product}-java${javaVersion}";
+
+  nativeBuildInputs = [ perl unzip makeWrapper ]
+    ++ lib.optional stdenv.isLinux autoPatchelfHook
+    ++ extraNativeBuildInputs;
+
+  buildInputs = [
+    stdenv.cc.cc.lib # libstdc++.so.6
+    zlib
+  ] ++ extraBuildInputs;
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    unpack_jar() {
+      local jar="$1"
+      unzip -q -o "$jar" -d "$out"
+      perl -ne 'use File::Path qw(make_path);
+                use File::Basename qw(dirname);
+                if (/^(.+) = (.+)$/) {
+                  make_path dirname("$ENV{out}/$1");
+                  symlink $2, "$ENV{out}/$1";
+                }' "$out/META-INF/symlinks"
+      perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
+                  my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
+                              ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
+                              ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
+                  chmod $mode, "$ENV{out}/$1";
+                }' "$out/META-INF/permissions"
+      rm -rf "$out/META-INF"
+    }
+
+    unpack_jar "$src"
+
+    runHook postUnpack
+  '';
+
+  dontInstall = true;
+  dontBuild = true;
+  dontStrip = true;
+  # installCheckPhase is going to run in GraalVM main derivation (see buildGraalvm.nix)
+  # to make sure that it has everything it needs to run correctly.
+  # Other hooks like fixupPhase/installPhase are also going to run there for the
+  # same reason.
+  doInstallCheck = false;
+
+  passthru = { inherit product; } // passthru;
+
+  meta = with lib; ({
+    homepage = "https://www.graalvm.org/";
+    description = "High-Performance Polyglot VM (Product: ${product})";
+    license = with licenses; [ upl gpl2Classpath bsd3 ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
+  } // meta);
+})
diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index 17ecd5060ba29..0f9cec44f18f8 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -1,75 +1,52 @@
-{ callPackage, Foundation }:
-/*
-  Add new graal versions and products here and then see update.nix on how to
-  generate the sources.
-*/
+{ lib
+, stdenv
+, callPackage
+, fetchurl
+, Foundation
+}:
 
 let
-  mkGraal = opts: callPackage (import ./mkGraal.nix opts) {
-    inherit Foundation;
+  buildGraalvm = callPackage ./buildGraalvm.nix { inherit Foundation; };
+  buildGraalvmProduct = callPackage ./buildGraalvmProduct.nix { };
+  javaPlatform = {
+    "aarch64-linux" = "linux-aarch64";
+    "x86_64-linux" = "linux-amd64";
+    "aarch64-darwin" = "darwin-aarch64";
+    "x86_64-darwin" = "darwin-amd64";
   };
-
-  /*
-    Looks a bit ugly but makes version update in the update script using sed
-    much easier
-
-    Don't change these values! They will be updated by the update script, see ./update.nix.
-  */
-  graalvm11-ce-release-version = "22.3.0";
-  graalvm17-ce-release-version = "22.3.0";
-
-  products = [
-    "graalvm-ce"
-    "native-image-installable-svm"
-  ];
+  javaPlatformVersion = javaVersion:
+    "${javaVersion}-${javaPlatform.${stdenv.system} or (throw "Unsupported platform: ${stdenv.system}")}";
+  source = product: javaVersion: (import ./hashes.nix).${product}.${javaPlatformVersion javaVersion};
 
 in
-{
-  inherit mkGraal;
+rec {
+  inherit buildGraalvm buildGraalvmProduct;
 
-  graalvm11-ce = mkGraal rec {
-    config = {
-      x86_64-darwin = {
-        inherit products;
-        arch = "darwin-amd64";
-      };
-      x86_64-linux = {
-        inherit products;
-        arch = "linux-amd64";
-      };
-      aarch64-darwin = {
-        inherit products;
-        arch = "darwin-aarch64";
-      };
-      aarch64-linux = {
-        inherit products;
-        arch = "linux-aarch64";
-      };
-    };
-    defaultVersion = graalvm11-ce-release-version;
+  graalvm11-ce = buildGraalvm rec {
+    version = "22.3.1";
     javaVersion = "11";
+    src = fetchurl (source "graalvm-ce" javaVersion);
+    meta.platforms = builtins.attrNames javaPlatform;
+    products = [ native-image-installable-svm-java11 ];
+  };
+
+  native-image-installable-svm-java11 = callPackage ./native-image-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "native-image-installable-svm" javaVersion);
+  };
+
+  graalvm17-ce = buildGraalvm rec {
+    version = "22.3.1";
+    javaVersion = "17";
+    src = fetchurl (source "graalvm-ce" javaVersion);
+    meta.platforms = builtins.attrNames javaPlatform;
+    products = [ native-image-installable-svm-java17 ];
   };
 
-  graalvm17-ce = mkGraal rec {
-    config = {
-      x86_64-darwin = {
-        inherit products;
-        arch = "darwin-amd64";
-      };
-      x86_64-linux = {
-        inherit products;
-        arch = "linux-amd64";
-      };
-      aarch64-darwin = {
-        inherit products;
-        arch = "darwin-aarch64";
-      };
-      aarch64-linux = {
-        inherit products;
-        arch = "linux-aarch64";
-      };
-    };
-    defaultVersion = graalvm17-ce-release-version;
+  native-image-installable-svm-java17 = callPackage ./native-image-installable-svm.nix rec {
     javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "native-image-installable-svm" javaVersion);
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
deleted file mode 100644
index c9145e9654f83..0000000000000
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "darwin-aarch64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "c9657e902c2ba674931c3cf233a38c4de3d5186ae5d70452f9df75ac0c4cacff",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-darwin-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "dd9f91a970c7270b3f7fe8e711ba1ae081d34ed433c75f2bb0459aaf19e0fbe7",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-darwin-aarch64-22.3.0.jar"
-    }
-  },
-  "darwin-amd64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "b8b39d6a3e3a9ed6348c2776ff071fc64ca90f98999ee846e6ca7e5fdc746a8b",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-darwin-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "00fe13c42813f581955eb35370bb8409ba17c7fdc83971d000baf695be2a0cb5",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-darwin-amd64-22.3.0.jar"
-    }
-  },
-  "linux-aarch64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "c6646149dad486a0b02c5fc10649786240f275efda65aa14a25d01d2f5bafe15",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-linux-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "0886e214f03f8a44962ecab459a94afb5c6a0f20910cb128d9ff775f4a9e4162",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-linux-aarch64-22.3.0.jar"
-    }
-  },
-  "linux-amd64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "d4200bcc43e5ad4e6949c1b1edc1e59f63066e3a2280d5bd82d0c9b1d67c3f2c",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-linux-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "17843f92dc9de74b161a63c52cc2a4597e5472cf3f6f6d71930fb655b35f9208",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-linux-amd64-22.3.0.jar"
-    }
-  }
-}
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
deleted file mode 100644
index dc2da450b6996..0000000000000
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "darwin-aarch64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "dfc0c8998b8d00fcca87ef1c866c6e4985fd20b0beba3021f9677f9b166dfaf8",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-darwin-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "b6e44cb03f560bb43db1fd0aa862af36ba1df6717765920d91c18519712adfe9",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-darwin-aarch64-22.3.0.jar"
-    }
-  },
-  "darwin-amd64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "422cd6abecfb8b40238460c09c42c5a018cb92fab4165de9691be2e3c3d0e8d1",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-darwin-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "9ce13874e62877d3bbe3faa4a57fbbffc766fdc8191971e7b25de0226fe86598",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-darwin-amd64-22.3.0.jar"
-    }
-  },
-  "linux-aarch64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "e27249d9eef4504deb005cf14c6a028aad1adfa37209e12e9d7407710c08ed90",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-linux-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "d5b833c44d37fbe4df75906f73144e2db01e683bca3386fe185f4abbc8fbc798",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-linux-aarch64-22.3.0.jar"
-    }
-  },
-  "linux-amd64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "3473d8b3b1bc682e95adfb3ac1d9a59b51b0f43e2b752f2a5b550e4ebfa2fd17",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-linux-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "d1f5c58b65c57ad8a0c7da0c4569ce815ebf1ae503b0741ba1facf27b816d398",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-linux-amd64-22.3.0.jar"
-    }
-  }
-}
diff --git a/pkgs/development/compilers/graalvm/community-edition/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
new file mode 100644
index 0000000000000..c0353e033ae22
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@@ -0,0 +1,71 @@
+# Generated by pkgs/development/compilers/graalvm/community-edition/update.sh script
+{
+  "native-image-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "0z9rbmci6yz7f7mqd3xzsxc5ih4hq72lyzqfchan7fr6mh38d6gw";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "03v20fc9famlnbrznpasnd5gdl5k9nl4dlj3pp6bad4y6l7rqnx5";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "1yb7kpbs7hrzlysvrqjzgfz678p1hbg6237jzb35zmwdaczav51n";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "00fbyqsj4xj9ay8bki1190lf59bgrzvla8lzzq51p53a1bdrhhmv";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "1kaqvkbhj3iifq6asyrpy225a89y7klzbh7an1ycnvc2hvqkv4nz";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "09l7x4x8yanq55v6y6wpfx94mvsq1bpbnihknjc6dnq3vcrci77n";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "036w9dmdcs46kmjqr3086mg389fgr3h1zysavfq8cbh199x0ibia";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "1hvjfvcn878bzvi944v3x23sby72hbfvg5s3zzspyc37l5cdpqi3";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "graalvm-ce" = {
+    "11-linux-aarch64" = {
+      sha256 = "1g4a3z9993pq52j3jf25pbcq9rvl8jz1yar8c859jw5chaf3ysml";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-linux-aarch64-22.3.1.tar.gz";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "06288dwbql943nii74i9mngzb38h2nzrxzzgs346mgk2965gwm59";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-linux-aarch64-22.3.1.tar.gz";
+    };
+    "11-linux-amd64" = {
+      sha256 = "1f6xkdnxn6xsm24sqw24rsca72wm7v6q96m23l5fng5ym0jpfm2m";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-linux-amd64-22.3.1.tar.gz";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0aci9i28rq5nk2qya9dcg5hxr3sgsbv7f5x8679hrjrqmrclmkrs";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-linux-amd64-22.3.1.tar.gz";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "0cbcm9d211m4b6g1bkpfksma917lzqkl4kx38vm1nrwjkll357y5";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-darwin-aarch64-22.3.1.tar.gz";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "1qbw3hlmqcrmd70xk56463scdxr50n66z2n3c24h68qlwwlpqc73";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-darwin-aarch64-22.3.1.tar.gz";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "0a12rzf99x5l29f6bwm6myk18dgnrx2c9rwmii2pm864y7azlnij";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-darwin-amd64-22.3.1.tar.gz";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "02lclv2j3v850izh84wdvksi3d3xmgpfl7x85vzifhgsvagm6sz4";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-darwin-amd64-22.3.1.tar.gz";
+    };
+  };
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
deleted file mode 100644
index 023fc81474ef6..0000000000000
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ /dev/null
@@ -1,346 +0,0 @@
-{
-  # An attrset describing each platform configuration. All values are extract
-  # from the GraalVM releases available on
-  # https://github.com/graalvm/graalvm-ce-builds/releases
-  # Example:
-  # config = {
-  #   x86_64-linux = {
-  #     # List of products that will be included in the GraalVM derivation
-  #     # See `with{NativeImage,Ruby,Python,WASM,*}Svm` variables for the
-  #     # available values
-  #     products = [ "graalvm-ce" "native-image-installable-svm" ];
-  #     # GraalVM arch, not to be confused with the nix platform
-  #     arch = "linux-amd64";
-  #     # GraalVM version
-  #     version = "22.0.0.2";
-  #   };
-  # }
-  config
-  # GraalVM version that will be used unless overridden by `config.<platform>.version`
-, defaultVersion
-  # Java version used by GraalVM
-, javaVersion
-  # Platforms were GraalVM will be allowed to build (i.e. `meta.platforms`)
-, platforms ? builtins.attrNames config
-  # If set to true, update script will (re-)generate the sources file even if
-  # there are no updates available
-, forceUpdate ? false
-  # Path for the sources file that will be used
-  # See `update.nix` file for a description on how this file works
-, sourcesPath ? ./. + "/graalvm${javaVersion}-ce-sources.json"
-}:
-
-{ stdenv
-, lib
-, autoPatchelfHook
-, fetchurl
-, makeWrapper
-, setJavaClassPath
-, writeShellScriptBin
-  # minimum dependencies
-, alsa-lib
-, fontconfig
-, Foundation
-, freetype
-, glibc
-, openssl
-, perl
-, unzip
-, xorg
-, zlib
-  # runtime dependencies
-, binutils
-, cups
-, gcc
-, musl
-  # runtime dependencies for GTK+ Look and Feel
-, gtkSupport ? stdenv.isLinux
-, cairo
-, glib
-  # updateScript deps
-, gnused
-, gtk3
-, jq
-, writeShellScript
-  # Use musl instead of glibc to allow true static builds in GraalVM's
-  # Native Image (i.e.: `--static --libc=musl`). This will cause glibc static
-  # builds to fail, so it should be used with care
-, useMusl ? false
-  # Extra libraries to be included in native-image using '-H:CLibraryPath' flag
-, extraCLibs ? [ ]
-}:
-
-assert useMusl -> stdenv.isLinux;
-
-let
-  platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  version = platform.version or defaultVersion;
-  name = "graalvm${javaVersion}-ce";
-  sources = builtins.fromJSON (builtins.readFile sourcesPath);
-
-  cLibs = [ glibc zlib.static ]
-    ++ lib.optionals (!useMusl) [ glibc.static ]
-    ++ lib.optionals useMusl [ musl ]
-    ++ extraCLibs;
-
-  runtimeLibraryPath = lib.makeLibraryPath
-    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
-
-  runtimeDependencies = lib.makeBinPath ([
-    binutils
-    stdenv.cc
-  ] ++ lib.optionals useMusl [
-    (lib.getDev musl)
-    # GraalVM 21.3.0+ expects musl-gcc as <system>-musl-gcc
-    (writeShellScriptBin "${stdenv.hostPlatform.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'')
-  ]);
-
-  withNativeImageSvm = builtins.elem "native-image-installable-svm" platform.products;
-  withRubySvm = builtins.elem "ruby-installable-svm" platform.products;
-  withPythonSvm = builtins.elem "python-installable-svm" platform.products;
-  withWasmSvm = builtins.elem "wasm-installable-svm" platform.products;
-
-  graalvmXXX-ce = stdenv.mkDerivation rec {
-    inherit version;
-    pname = name;
-
-    srcs = map fetchurl (builtins.attrValues sources.${platform.arch});
-
-    buildInputs = lib.optionals stdenv.isLinux [
-      alsa-lib # libasound.so wanted by lib/libjsound.so
-      fontconfig
-      freetype
-      stdenv.cc.cc.lib # libstdc++.so.6
-      xorg.libX11
-      xorg.libXext
-      xorg.libXi
-      xorg.libXrender
-      xorg.libXtst
-      zlib
-    ] ++ lib.optionals withRubySvm [
-      openssl # libssl.so wanted by languages/ruby/lib/mri/openssl.so
-    ];
-
-    nativeBuildInputs = [ unzip perl makeWrapper ]
-      ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
-
-    unpackPhase = ''
-      runHook preUnpack
-
-      unpack_jar() {
-        jar=$1
-        unzip -q -o $jar -d $out
-        perl -ne 'use File::Path qw(make_path);
-                  use File::Basename qw(dirname);
-                  if (/^(.+) = (.+)$/) {
-                    make_path dirname("$ENV{out}/$1");
-                    system "ln -s $2 $ENV{out}/$1";
-                  }' $out/META-INF/symlinks
-        perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
-                    my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
-                               ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
-                               ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
-                    chmod $mode, "$ENV{out}/$1";
-                  }' $out/META-INF/permissions
-        rm -rf $out/META-INF
-      }
-
-      mkdir -p $out
-      arr=($srcs)
-
-      # The tarball on Linux has the following directory structure:
-      #
-      #   graalvm-ce-java11-20.3.0/*
-      #
-      # while on Darwin it looks like this:
-      #
-      #   graalvm-ce-java11-20.3.0/Contents/Home/*
-      #
-      # We therefor use --strip-components=1 vs 3 depending on the platform.
-      tar xf ''${arr[0]} -C $out --strip-components=${
-        if stdenv.isLinux then "1" else "3"
-      }
-
-      # Sanity check
-      if [ ! -d $out/bin ]; then
-         echo "The `bin` is directory missing after extracting the graalvm"
-         echo "tarball, please compare the directory structure of the"
-         echo "tarball with what happens in the unpackPhase (in particular"
-         echo "with regards to the `--strip-components` flag)."
-         exit 1
-      fi
-
-      for jar in "''${arr[@]:1}"; do
-        unpack_jar "$jar"
-      done
-
-      runHook postUnpack
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/linux/*_md.h $out/include/
-
-      # copy-paste openjdk's preFixup
-      # Set JAVA_HOME automatically.
-      mkdir -p $out/nix-support
-      cat > $out/nix-support/setup-hook << EOF
-        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-      ${
-        # Wrap native-image binary to pass -H:CLibraryPath flag and find glibc
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux) ''
-          wrapProgram $out/bin/native-image \
-            ${lib.concatStringsSep " "
-              (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
-        ''
-      }
-
-      runHook postInstall
-    '';
-
-    dontStrip = true;
-
-    # Workaround for libssl.so.10 wanted by TruffleRuby
-    # Resulting TruffleRuby cannot use `openssl` library.
-    autoPatchelfIgnoreMissingDeps = withRubySvm && stdenv.isDarwin;
-
-    preFixup = lib.optionalString (stdenv.isLinux) ''
-      # Find all executables in any directory that contains '/bin/'
-      for bin in $(find "$out" -executable -type f -wholename '*/bin/*'); do
-        wrapProgram "$bin" \
-          --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}" \
-          --prefix PATH : "${runtimeDependencies}"
-      done
-
-      find "$out" -name libfontmanager.so -exec \
-        patchelf --add-needed libfontconfig.so {} \;
-
-      ${
-        lib.optionalString withRubySvm ''
-          # Workaround for libssl.so.10/libcrypto.so.10 wanted by TruffleRuby
-          patchelf $out/languages/ruby/lib/mri/openssl.so \
-            --replace-needed libssl.so.10 libssl.so \
-            --replace-needed libcrypto.so.10 libcrypto.so
-        ''
-      }
-    '';
-
-    # $out/bin/native-image needs zlib to build native executables.
-    propagatedBuildInputs = [ setJavaClassPath zlib ] ++
-      # On Darwin native-image calls clang and it
-      # tries to include <Foundation/Foundation.h>,
-      # and Interactive Ruby (irb) requires OpenSSL
-      # headers.
-      lib.optionals stdenv.hostPlatform.isDarwin [ Foundation openssl ];
-
-    doInstallCheck = true;
-    installCheckPhase = ''
-      runHook preInstallCheck
-
-      echo ${
-        lib.escapeShellArg ''
-          public class HelloWorld {
-            public static void main(String[] args) {
-              System.out.println("Hello World");
-            }
-          }
-        ''
-      } > HelloWorld.java
-      $out/bin/javac HelloWorld.java
-
-      # run on JVM with Graal Compiler
-      echo "Testing GraalVM"
-      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
-
-      ${
-        lib.optionalString withNativeImageSvm ''
-          echo "Ahead-Of-Time compilation"
-          $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${# --static flag doesn't work for darwin
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux && !useMusl) ''
-          echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
-          $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
-          ./helloworld | fgrep 'Hello World'
-
-          echo "Ahead-Of-Time compilation with --static"
-          $out/bin/native-image --static HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${# --static flag doesn't work for darwin
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux && useMusl) ''
-          echo "Ahead-Of-Time compilation with --static and --libc=musl"
-          $out/bin/native-image --libc=musl --static HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${
-        lib.optionalString withWasmSvm ''
-          echo "Testing Jshell"
-          echo '1 + 1' | $out/bin/jshell
-        ''
-      }
-
-      ${
-        lib.optionalString withPythonSvm ''
-          echo "Testing GraalPython"
-          $out/bin/graalpython -c 'print(1 + 1)'
-          echo '1 + 1' | $out/bin/graalpython
-        ''
-      }
-
-      ${
-        lib.optionalString withRubySvm ''
-          echo "Testing TruffleRuby"
-          # Hide warnings about wrong locale
-          export LANG=C
-          export LC_ALL=C
-          $out/bin/ruby -e 'puts(1 + 1)'
-        ''
-        # FIXME: irb is broken in all platforms
-        + lib.optionalString false ''
-          echo '1 + 1' | $out/bin/irb
-        ''
-      }
-
-      runHook postInstallCheck
-    '';
-
-    passthru = {
-      inherit (platform) products;
-      home = graalvmXXX-ce;
-      updateScript = import ./update.nix {
-        inherit config defaultVersion forceUpdate gnused jq lib name sourcesPath writeShellScript;
-        graalVersion = version;
-        javaVersion = "java${javaVersion}";
-      };
-    };
-
-    meta = with lib; {
-      inherit platforms;
-      homepage = "https://www.graalvm.org/";
-      description = "High-Performance Polyglot VM";
-      license = with licenses; [ upl gpl2Classpath bsd3 ];
-      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-      mainProgram = "java";
-      maintainers = with maintainers; [
-        bandresen
-        hlolli
-        glittershark
-        babariviere
-        ericdallo
-        thiagokokada
-      ];
-    };
-  };
-in
-graalvmXXX-ce
diff --git a/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix b/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
new file mode 100644
index 0000000000000..393a226df19ce
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, gcc
+, glibc
+, javaVersion
+, musl
+, src
+, version
+, writeShellScriptBin
+, zlib
+, useMusl ? false
+, extraCLibs ? [ ]
+}:
+
+assert useMusl -> stdenv.isLinux;
+let
+  cLibs = [ glibc zlib.static ]
+    ++ lib.optionals (!useMusl) [ glibc.static ]
+    ++ lib.optionals useMusl [ musl ]
+    ++ extraCLibs;
+  # GraalVM 21.3.0+ expects musl-gcc as <system>-musl-gcc
+  musl-gcc = (writeShellScriptBin "${stdenv.hostPlatform.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'');
+  binPath = lib.makeBinPath ([ gcc ] ++ lib.optionals useMusl [ musl-gcc ]);
+in
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "native-image-installable-svm";
+
+  postInstall = lib.optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/native-image \
+      --prefix PATH : ${binPath} \
+      ${lib.concatStringsSep " "
+        (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
+  '';
+
+  installCheckPhase = ''
+    echo "Ahead-Of-Time compilation"
+    $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
+    ./helloworld | fgrep 'Hello World'
+
+    ${lib.optionalString (stdenv.isLinux && !useMusl) ''
+      echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
+      $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
+      ./helloworld | fgrep 'Hello World'
+
+      echo "Ahead-Of-Time compilation with --static"
+      $out/bin/native-image --static HelloWorld
+      ./helloworld | fgrep 'Hello World'
+    ''}
+
+    ${lib.optionalString (stdenv.isLinux && useMusl) ''
+      echo "Ahead-Of-Time compilation with --static and --libc=musl"
+      $out/bin/native-image --static HelloWorld --libc=musl
+      ./helloworld | fgrep 'Hello World'
+    ''}
+  '';
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
deleted file mode 100644
index 8bb31c792ddae..0000000000000
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ /dev/null
@@ -1,227 +0,0 @@
-{ config
-, defaultVersion
-, forceUpdate
-, gnused
-, graalVersion
-, javaVersion
-, jq
-, lib
-, name
-, sourcesPath
-, writeShellScript
-}:
-
-/*
-  How to  use:
-  run `nix-shell maintainers/scripts/update.nix --argstr package graalvmXX-ce`
-  to update the graalvmXX-ce-sources.json file.
-  E.g: nix-shell maintainers/scripts/update.nix --argstr package graalvm17-ce
-
-  Basic idea:
-  If we know the platform, product, javaVersion and graalVersion
-  we can create the url. This leads to the following json structure:
-  {
-  "platform/arch1": {
-  "product1|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
-  "product2|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
-  ...
-  },
-  "platform/arch2": {
-  ...
-  }
-  }
-*/
-
-let
-  separator = "|";
-
-  # isDev :: String -> Boolean
-  isDev = version:
-    lib.hasInfix "dev" version;
-
-  # getLatestVersion :: String -> String
-  getLatestVersion = currentVersion:
-    let
-      dev = if isDev currentVersion then "dev-" else "";
-      url = "https://api.github.com/repos/graalvm/graalvm-ce-${dev}builds/releases/latest";
-      file = builtins.fetchurl url;
-      json = builtins.fromJSON (builtins.readFile file);
-    in
-    lib.removePrefix "vm-" json.tag_name;
-
-  # getArchString :: String -> String
-  getArchString = nixArchString:
-    {
-      "aarch64-linux" = "linux-aarch64";
-      "aarch64-darwin" = "darwin-aarch64";
-      "x86_64-linux" = "linux-amd64";
-      "x86_64-darwin" = "darwin-amd64";
-    }.${nixArchString};
-
-
-  # getProductSuffix :: String -> String
-  getProductSuffix = productName:
-    {
-      "graalvm-ce" = ".tar.gz";
-      "native-image-installable-svm" = ".jar";
-      "ruby-installable-svm" = ".jar";
-      "wasm-installable-svm" = ".jar";
-      "python-installable-svm" = ".jar";
-      "js-installable-svm" = ".jar";
-    }.${productName};
-
-  # getProductSuffix :: String -> String
-  getProductBaseUrl = productName:
-    {
-      "graalvm-ce" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "native-image-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "ruby-installable-svm" = "https://github.com/oracle/truffleruby/releases/download";
-      "wasm-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "python-installable-svm" = "https://github.com/graalvm/graalpython/releases/download";
-      "js-installable-svm" = "https://github.com/oracle/graaljs/releases/download";
-    }.${productName};
-
-  # getDevUrl :: String
-  getDevUrl = { arch, graalVersion, product, javaVersion }:
-    let
-      baseUrl = https://github.com/graalvm/graalvm-ce-dev-builds/releases/download;
-    in
-    "${baseUrl}/${graalVersion}/${product}-${javaVersion}-${arch}-dev${getProductSuffix product}";
-
-  # getReleaseUrl :: AttrSet -> String
-  getReleaseUrl = { arch, graalVersion, product, javaVersion }:
-    let baseUrl = getProductBaseUrl product;
-    in
-    "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
-
-  # getUrl :: AttrSet -> String
-  getUrl = args@{ arch, graalVersion, product, javaVersion }:
-    if isDev graalVersion
-    then getDevUrl args
-    else getReleaseUrl args;
-
-  # computeSha256 :: String -> String
-  computeSha256 = url:
-    builtins.hashFile "sha256" (builtins.fetchurl url);
-
-  # downloadSha256 :: String -> String
-  downloadSha256 = url:
-    let sha256Url = url + ".sha256";
-    in
-    builtins.readFile (builtins.fetchurl sha256Url);
-
-  # getSha256 :: String -> String -> String
-  getSha256 = graalVersion: url:
-    if isDev graalVersion
-    then computeSha256 url
-    else downloadSha256 url;
-
-  # cartesianZipListsWith :: (a -> b -> c) -> [a] -> [b] -> [c]
-  cartesianZipListsWith = f: fst: snd:
-    let
-      cartesianProduct = lib.cartesianProductOfSets { a = fst; b = snd; };
-      fst' = builtins.catAttrs "a" cartesianProduct;
-      snd' = builtins.catAttrs "b" cartesianProduct;
-    in
-    lib.zipListsWith f fst' snd';
-
-  # zipListsToAttrs :: [a] -> [b] -> AttrSet
-  zipListsToAttrs = names: values:
-    lib.listToAttrs (
-      lib.zipListsWith (name: value: { inherit name value; }) names values
-    );
-
-  # genProductJavaVersionGraalVersionAttrSet :: String -> AttrSet
-  genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
-    let
-      attrNames = [ "product" "javaVersion" "graalVersion" ];
-      attrValues = lib.splitString separator product_javaVersion_graalVersion;
-    in
-    zipListsToAttrs attrNames attrValues;
-
-  # genUrlAndSha256 :: String -> String -> AttrSet
-  genUrlAndSha256 = arch: product_javaVersion_graalVersion:
-    let
-      productJavaVersionGraalVersion =
-        (genProductJavaVersionGraalVersionAttrSet product_javaVersion_graalVersion)
-        // { inherit arch; };
-      url = getUrl productJavaVersionGraalVersion;
-      sha256 = getSha256 productJavaVersionGraalVersion.graalVersion url;
-    in
-    {
-      ${arch} = {
-        ${product_javaVersion_graalVersion} = {
-          inherit sha256 url;
-        };
-      };
-    };
-
-  # genArchProductVersionPairs :: String -> -> String -> AttrSet -> [AttrSet]
-  genArchProductVersionList = javaVersion: graalVersion: archProducts:
-    let
-      arch = archProducts.arch;
-      products = archProducts.products;
-      javaGraalVersion = javaVersion + separator + (getLatestVersion (archProducts.version or graalVersion));
-      productJavaGraalVersionList =
-        cartesianZipListsWith (a: b: a + separator + b)
-          products [ javaGraalVersion ];
-    in
-    cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
-
-
-  # genSources :: String -> String -> AttrSet -> Path String
-  genSources = javaVersion: defaultVersion: config:
-    let
-      archProducts = builtins.attrValues config;
-      sourcesList = builtins.concatMap (genArchProductVersionList javaVersion defaultVersion) archProducts;
-      sourcesAttr = builtins.foldl' (lib.recursiveUpdate) { } sourcesList;
-    in
-    builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
-
-  # isNew :: String -> String -> Boolean
-  isNew = newVersion: currentVersion:
-    {
-      "-1" = false;
-      "0" = false;
-      "1" = true;
-    }.${builtins.toString (builtins.compareVersions newVersion currentVersion)};
-
-  newVersion = getLatestVersion graalVersion;
-  sourcesJson = genSources javaVersion defaultVersion config;
-  sourcesJsonPath = lib.strings.escapeShellArg sourcesPath;
-
-  # versionKeyInDefaultNix String -> String
-  versionKeyInDefaultNix = graalVersion:
-    if isDev graalVersion
-    then "${name}-dev-version"
-    else "${name}-release-version";
-
-  /*
-    updateScriptText :: String -> String -> String
-    Writes the json file and updates the version in default.nix using sed
-    because update-source-version does not work srcs.
-  */
-  updateScriptText = newVersion: currentVersion:
-
-    if (forceUpdate || (isNew newVersion currentVersion))
-    then
-      let
-        versionKey = versionKeyInDefaultNix currentVersion;
-      in
-      ''
-        echo "New version found. Updating ${currentVersion} -> ${newVersion}".
-        export PATH="${lib.makeBinPath [ jq gnused ]}:$PATH"
-        jq . ${sourcesJson} > ${sourcesJsonPath}
-        sed -i 's|${versionKey} = "${currentVersion}";|${versionKey} = "${newVersion}";|' \
-          ${lib.strings.escapeShellArg ./default.nix}
-      ''
-    else ''echo "No new version found. Skip updating."'';
-
-in
-writeShellScript "update-graal.sh" ''
-  set -o errexit
-  set -o nounset
-  set -o pipefail
-
-  ${updateScriptText newVersion graalVersion}
-''
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.sh b/pkgs/development/compilers/graalvm/community-edition/update.sh
new file mode 100755
index 0000000000000..476bd754ad50a
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p coreutils curl.out nix jq gnused -i bash
+
+set -eou pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+tmpfile="$(mktemp --suffix=.nix)"
+
+info() { echo "[INFO] $*"; }
+
+echo_file() { echo "$@" >> "$tmpfile"; }
+
+verlte() {
+    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
+}
+
+readonly nixpkgs=../../../../..
+
+readonly current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm-ce.version | tr -d \")"
+
+if [[ -z "${1:-}" ]]; then
+  readonly gh_version="$(curl \
+      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | \
+      jq --raw-output .tag_name)"
+  readonly new_version="${gh_version//vm-/}"
+else
+  readonly new_version="$1"
+fi
+
+info "Current version: $current_version"
+info "New version: $new_version"
+if verlte "$new_version" "$current_version"; then
+  info "graalvm-ce $current_version is up-to-date."
+  [[ -z "${FORCE:-}" ]]  && exit 0
+else
+  info "graalvm-ce $current_version is out-of-date. Updating..."
+fi
+
+declare -r -A products_urls=(
+  [graalvm-ce]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/graalvm-ce-java@platform@-${new_version}.tar.gz"
+  [native-image-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/native-image-installable-svm-java@platform@-${new_version}.jar"
+  # [ruby-installable-svm]="https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
+  # [wasm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
+  # [python-installable-svm]="https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
+)
+
+readonly platforms=(
+  "11-linux-aarch64"
+  "17-linux-aarch64"
+  "11-linux-amd64"
+  "17-linux-amd64"
+  "11-darwin-aarch64"
+  "17-darwin-aarch64"
+  "11-darwin-amd64"
+  "17-darwin-amd64"
+)
+
+info "Generating hashes.nix file for 'graalvm-ce' $new_version. This will take a while..."
+
+# Indentation of `echo_file` function is on purpose to make it easier to visualize the output
+echo_file "# Generated by $0 script"
+echo_file "{"
+for product in "${!products_urls[@]}"; do
+  url="${products_urls["${product}"]}"
+echo_file "  \"$product\" = {"
+  for platform in "${platforms[@]}"; do
+    if hash="$(nix-prefetch-url "${url//@platform@/$platform}")"; then
+echo_file "    \"$platform\" = {"
+echo_file "      sha256 = \"$hash\";"
+echo_file "      url = \"${url//@platform@/${platform}}\";"
+echo_file "    };"
+    fi
+  done
+echo_file "  };"
+done
+echo_file "}"
+
+info "Updating graalvm-ce version..."
+# update-source-version does not work here since it expects src attribute
+sed "s|$current_version|$new_version|" -i default.nix
+
+info "Moving the temporary file to hashes.nix"
+mv "$tmpfile" hashes.nix
+
+info "Done!"
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 95eba5d7fb36e..41c20ac47ebfd 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -191,7 +192,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 2123efdf23519..93cf2757c6522 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -203,7 +204,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index b04eeb3c72693..3d5592e19ee59 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -191,7 +192,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 32e96212fa575..e2d6da816f32c 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -153,7 +154,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 5437735f78fed..d8010ecf893d2 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -165,7 +166,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
index e0b79a9acfefc..de98c43615314 100644
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -9,6 +9,7 @@
 , python3
 , python3Packages
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -327,7 +328,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index a4d04f0618c7e..31b88098c83a8 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libxml2
 , ncurses
@@ -168,10 +169,9 @@ stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ]
-  ++ lib.optional (!isDarwin)
+  ] ++ lib.optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ++ lib.optionals (isDarwin) [
+  ] ++ lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index d18bf2149e1d7..954887cd23680 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -4,6 +4,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libxml2
 , ncurses
@@ -162,7 +163,7 @@ stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index da72bb8b35ae3..eaeef3c2ef505 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -180,7 +181,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 5c381a896e152..aa76fc0c3cf7e 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -173,7 +174,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index f8b6a8170f85a..89bc014f5c65a 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -188,7 +189,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index b4e2757f20ca1..9a0d375df9c37 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? (!stdenv.isDarwin && !stdenv.targetPlatform.isWasi)
 , libbfd
 , libpfm
 , libxml2
@@ -151,7 +152,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/mit-scheme/default.nix b/pkgs/development/compilers/mit-scheme/default.nix
index 5a96242da7b13..da668b51e2785 100644
--- a/pkgs/development/compilers/mit-scheme/default.nix
+++ b/pkgs/development/compilers/mit-scheme/default.nix
@@ -49,6 +49,12 @@ stdenv.mkDerivation {
     runHook postConfigure
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-parameter"
+    "-Wno-error=use-after-free"
+  ];
+
   buildPhase = ''
     runHook preBuild
     cd src
diff --git a/pkgs/development/compilers/rust/1_66.nix b/pkgs/development/compilers/rust/1_66.nix
deleted file mode 100644
index 6aee98bdba063..0000000000000
--- a/pkgs/development/compilers/rust/1_66.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_14, llvm_14
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.66.1";
-  rustcSha256 = "sha256-WzyTOpTHIYdwXU7ikxmLq/3QlEL1k3+9aF2zqB9JWbo=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_14.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_14;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.65.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "b29869f8e2c7029150a929b2c4e26843f363846ad99253a25be6abcfa8e84f46";
-    x86_64-unknown-linux-gnu = "8f754fdd5af783fe9020978c64e414cb45f3ad0a6f44d045219bbf2210ca3cb9";
-    x86_64-unknown-linux-musl = "716984def5509a844c2dde1c7be42bfadeb179f751d5c1a30c9c7198c8c089cd";
-    arm-unknown-linux-gnueabihf = "e27f835c16bfcb66ad022a17d5c4602899e021e483a432ca4cc2cb4ecd39e938";
-    armv7-unknown-linux-gnueabihf = "5376d467a29b32cacb771e0c76dc280bd623852709e7ffd92caabab076d5475f";
-    aarch64-unknown-linux-gnu = "f406136010e6a1cdce3fb6573506f00d23858af49dd20a46723c3fa5257b7796";
-    aarch64-unknown-linux-musl = "4b701dc3cbac04ebf0e336cff2f4ce5fc1a1984c183226863c9ed911eb00b07e";
-    x86_64-apple-darwin = "139087a3937799415fd829e5a88162a69a32c23725a44457f9c96b98e4d64a7c";
-    aarch64-apple-darwin = "7ddc335bd10fc32d3039ef36248a5d0c4865db2437c8aad20a2428a6cf41df09";
-    powerpc64le-unknown-linux-gnu = "3f1d0d5bb13213348dc65e373f8c412fc0a12ee55abc1c864f7e0300932fc687";
-    riscv64gc-unknown-linux-gnu = "aac7067348d218faa452b4bdc735778a51570a310ad645313ec767b5d7c88492";
-    mips64el-unknown-linux-gnuabi64 = "d91ed3857c5256720da890f6533684b684e880bf9006dc4e4f4181213a5c4a09";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_66;
-
-  rustcPatches = [
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_14" "llvm_14"])
diff --git a/pkgs/development/compilers/rust/1_67.nix b/pkgs/development/compilers/rust/1_67.nix
new file mode 100644
index 0000000000000..a0a43f31386db
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_67.nix
@@ -0,0 +1,81 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_15, llvm_15
+, fetchpatch
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.67.0";
+  rustcSha256 = "sha256-0CnxT85Foux6mmBdKgpAquRznLL9rinun3pukCWn/eQ=";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_15.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackages = llvmPackages_15;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.66.1";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "823128f64e902ee8aff61488c552c983e17ccca10c3f46dd93fde924d5100eb3";
+    x86_64-unknown-linux-gnu = "7ecf79e9ea23d05917b0172f9f81fb1e47011d261a719998f8d5620a1e835023";
+    x86_64-unknown-linux-musl = "70b660148238b8a137c6f165b0bc7bdcb50204c22a314bed6174ecd672f02e57";
+    arm-unknown-linux-gnueabihf = "12c93efe71f3334ef6e718786f6a60b9566f097d23a7f1e8f38ed9add209126f";
+    armv7-unknown-linux-gnueabihf = "f43c8cd3fd7d1c1e08bd6317220b2ec9b25891f464604f80bb17985b09bbf62a";
+    aarch64-unknown-linux-gnu = "84b8a79803c1b91386460fe6a7d04c54002344452ff8e5c5631d5fa275ed0c9c";
+    aarch64-unknown-linux-musl = "b2665da33efd328cff192a67ad026ea84f9deab8d1971892f4bbc22647606163";
+    x86_64-apple-darwin = "0fcf341db2579aa6eb61a3430cd1dbc79b042dfe89686b93cc887d818d086c30";
+    aarch64-apple-darwin = "03469fcaa0d8c505e6db03c18ded73cfbb6a2ce159292f8cf06c042bfc9f7cf9";
+    powerpc64le-unknown-linux-gnu = "ccf915a0137bb83a9d9b133a234ae53cc099f2ba26e3cb09d209b47bbee2ade7";
+    riscv64gc-unknown-linux-gnu = "525cb05edaf3ed0560753b413c72dd1b06492df28bf3c427a66fda683fdca3fc";
+    mips64el-unknown-linux-gnuabi64 = "3c241cc80410fe389e8b04beda62c42496c225fe8776db9d55a498c53244f7a6";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_67;
+
+  rustcPatches = [
+    # fix thin archive reading
+    # https://github.com/rust-lang/rust/pull/107360
+    (fetchpatch {
+      name = "revert-back-to-llvmarchivebuilder-on-all-platforms.patch";
+      url = "https://github.com/rust-lang/rust/commit/de363d54c40a378717881240e719f5f7223ba376.patch";
+      hash = "sha256-3Xb803LZUZ1dldxGJ65Iw6gg1V1K827OB/0b32GqilU=";
+    })
+
+    # Fixes ICE.
+    # https://github.com/rust-lang/rust/pull/107688
+    (fetchpatch {
+      name = "re-erased-regions-are-local.patch";
+      url = "https://github.com/rust-lang/rust/commit/9d110847ab7f6aef56a8cd20cb6cea4fbcc51cd9.patch";
+      excludes = [ "*tests/*" ];
+      hash = "sha256-EZH5K1BEOOfi97xZr1xEHFP4jjvJ1+xqtRMvxBoL8pU=";
+    })
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_15" "llvm_15"])
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index d04eebe7eadf4..481b4195891ca 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
-, installShellFiles, makeWrapper, cacert, rustPlatform, rustc
+, installShellFiles, makeWrapper, rustPlatform, rustc
 , CoreFoundation, Security
 , auditable ? false # TODO: change to true when this is the default
 }:
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage {
     (lib.getDev pkgsHostHost.curl)
     zlib
   ];
-  buildInputs = [ cacert file curl python3 openssl zlib ]
+  buildInputs = [ file curl python3 openssl zlib ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
 
   # cargo uses git-rs which is made for a version of libgit2 from recent master that
@@ -39,14 +39,7 @@ rustPlatform.buildRustPackage {
   RUSTC_BOOTSTRAP = 1;
 
   postInstall = ''
-    # NOTE: We override the `http.cainfo` option usually specified in
-    # `.cargo/config`. This is an issue when users want to specify
-    # their own certificate chain as environment variables take
-    # precedence
-    wrapProgram "$out/bin/cargo" \
-      --suffix PATH : "${rustc}/bin" \
-      --set CARGO_HTTP_CAINFO "${cacert}/etc/ssl/certs/ca-bundle.crt" \
-      --set SSL_CERT_FILE "${cacert}/etc/ssl/certs/ca-bundle.crt"
+    wrapProgram "$out/bin/cargo" --suffix PATH : "${rustc}/bin"
 
     installManPage src/tools/cargo/src/etc/man/*
 
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 426f137788389..60f07a64299ab 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -165,7 +165,6 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openssl ]
-    # TODO: remove libiconv once 1.66 is used to bootstrap
     ++ optionals stdenv.isDarwin [ libiconv Security ]
     ++ optional (!withBundledLLVM) llvmShared;
 
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index 159b1827fc8fd..ed1d7fc57a64f 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
         "-L${variables.libdir}"
         "-Wl,--rpath ${variables.libdir}"
         "-ltcc"
-        "-ldl"
       ];
       variables = rec {
         prefix = "${placeholder "out"}";
diff --git a/pkgs/development/compilers/urweb/default.nix b/pkgs/development/compilers/urweb/default.nix
index 67ebaa04699e3..a881b2f1badb1 100644
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@@ -33,6 +33,11 @@ stdenv.mkDerivation rec {
                    -L${sqlite.out}/lib";
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=use-after-free"
+  ];
+
   # Be sure to keep the statically linked libraries
   dontDisableStatic = true;
 
diff --git a/pkgs/development/compilers/zig/0.10.nix b/pkgs/development/compilers/zig/0.10.nix
index 89f23b9ca25d5..6d41b63f03b2e 100644
--- a/pkgs/development/compilers/zig/0.10.nix
+++ b/pkgs/development/compilers/zig/0.10.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     # file RPATH_CHANGE could not write new RPATH
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    "-DZIG_TARGET_MCPU=baseline"
   ];
 
   doCheck = true;
diff --git a/pkgs/development/interpreters/gnu-apl/default.nix b/pkgs/development/interpreters/gnu-apl/default.nix
index 3bcada9aa8f04..e413914aa39cd 100644
--- a/pkgs/development/interpreters/gnu-apl/default.nix
+++ b/pkgs/development/interpreters/gnu-apl/default.nix
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
     "-Wno-error=maybe-uninitialized"
     # Needed with GCC 11
     "-Wno-error=misleading-indentation"
+    # Needed with GCC 12
+    "-Wno-error=nonnull"
+    "-Wno-error=stringop-overflow"
+    "-Wno-error=use-after-free"
    ]) ++ optional stdenv.cc.isClang "-Wno-error=null-dereference");
 
   patchPhase = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 57d1e6d84fe1e..4461bd08365ea 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -273,13 +273,13 @@ in {
   mkRuby = generic;
 
   ruby_2_7 = generic {
-    version = rubyVersion "2" "7" "6" "";
-    sha256 = "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877";
+    version = rubyVersion "2" "7" "7" "";
+    sha256 = "sha256-4QEn22kdf/NkAs/oj0GMjQJaPx7qkgRLFi3XLwuMe5A=";
   };
 
   ruby_3_0 = generic {
-    version = rubyVersion "3" "0" "4" "";
-    sha256 = "0avj4g3s2839b2y4m6pk8kid74r8nj7k0qm2rsdcwjzhg8h7rd3h";
+    version = rubyVersion "3" "0" "5" "";
+    sha256 = "sha256-mvxjgKAnpP4a4aPi7MtrSXucWsBjHBLKVvm3vrSEh3Y=";
   };
 
   ruby_3_1 = generic {
diff --git a/pkgs/development/interpreters/ruby/patchsets.nix b/pkgs/development/interpreters/ruby/patchsets.nix
index bdc4cf3690fee..2bf5bc7296c6a 100644
--- a/pkgs/development/interpreters/ruby/patchsets.nix
+++ b/pkgs/development/interpreters/ruby/patchsets.nix
@@ -1,17 +1,15 @@
 { patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:
 
 {
-  "2.7.6" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-with-openssl-dir-option.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-fix-broken-tests-caused-by-ad.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-more-detailed-stacktrace.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/05-malloc-trim.patch"
+  "2.7.7" = ops useRailsExpress [
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-more-detailed-stacktrace.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-malloc-trim.patch"
   ];
-  "3.0.4" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-fix-with-openssl-dir-option.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/03-malloc-trim.patch"
+  "3.0.5" = ops useRailsExpress [
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-malloc-trim.patch"
   ];
   "3.1.2" = ops useRailsExpress [
     "${patchSet}/patches/ruby/3.1/head/railsexpress/01-improve-gc-stats.patch"
diff --git a/pkgs/development/interpreters/ruby/rvm-patchsets.nix b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
index 51c0a9a7dfb3d..fbbfd4c973027 100644
--- a/pkgs/development/interpreters/ruby/rvm-patchsets.nix
+++ b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
@@ -3,6 +3,6 @@
 fetchFromGitHub {
   owner  = "skaes";
   repo   = "rvm-patchsets";
-  rev    = "a6429bb1a7fb9b5798c22f43338739a6c192b42d";
-  sha256 = "sha256-NpSa+uGQA1rfHNcLzPNTK65J+Wk9ZlzhHFePDA4uuo0=";
+  rev    = "e6574c54a34fe6e4d45aa1433872a22ddfe14cf3";
+  hash   = "sha256-x2KvhgRVJ4Nc5v1j4DggKO1u3otG8HVMxhq4yuUKnds=";
 }
diff --git a/pkgs/development/interpreters/tcl/tcl-package-hook.sh b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
index 41603037931ff..8548ac66402f0 100644
--- a/pkgs/development/interpreters/tcl/tcl-package-hook.sh
+++ b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
@@ -41,6 +41,8 @@ findInstalledTclPkgs() {
 
 # Wrap any freshly-installed binaries and set up their TCLLIBPATH
 wrapTclBins() {
+    if [ "$dontWrapTclBinaries" ]; then return; fi
+
     if [[ -z "${TCLLIBPATH-}" ]]; then
         echo "skipping automatic Tcl binary wrapping (nothing to do)"
         return
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 5c60723309b74..76e117e57ce9b 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -43,7 +43,7 @@
   # non-existent in older versions
   # see https://github.com/boostorg/process/issues/55
 , enableS3 ? (!stdenv.isDarwin) || (lib.versionOlder boost.version "1.69" || lib.versionAtLeast boost.version "1.70")
-, enableGcs ? !stdenv.isDarwin # google-cloud-cpp is not supported on darwin
+, enableGcs ? (!stdenv.isDarwin) && (lib.versionAtLeast grpc.cxxStandard "17") # google-cloud-cpp is not supported on darwin, needs to support C++17
 }:
 
 assert lib.asserts.assertMsg
@@ -52,17 +52,19 @@ assert lib.asserts.assertMsg
 
 let
   arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
     owner = "apache";
     repo = "arrow-testing";
-    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
-    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
+    rev = "ecab1162cbec872e17d949ecc86181670aee045c";
+    hash = "sha256-w6rEuxfLTEO8DyXV44G6JOMeTfYtskFCOj9rHXNmj2Y=";
   };
 
   parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
     owner = "apache";
     repo = "parquet-testing";
-    rev = "aafd3fc9df431c2625a514fb46626e5614f1d199";
-    hash = "sha256-cO5t/mgsbBhbSefx8EMGTyxmgTjhZ8mFujkFQ3p/JS0=";
+    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
+    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
   };
 
   aws-sdk-cpp-arrow = aws-sdk-cpp.override {
@@ -79,11 +81,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "arrow-cpp";
-  version = "9.0.0";
+  version = "11.0.0";
 
   src = fetchurl {
     url = "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    hash = "sha256-qaAz8KNJAomZj0WGgNGVec8HkRcXumWv3my4AHD3qbU=";
+    hash = "sha256-Ldjw6ghIpYeFYo7jpXZ1VI1QnhchOi9dcrDZALQ/VDA=";
   };
   sourceRoot = "apache-arrow-${version}/cpp";
 
@@ -108,15 +110,15 @@ stdenv.mkDerivation rec {
   ARROW_XSIMD_URL = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
-    rev = "8.1.0";
-    hash = "sha256-Aqs6XJkGjAjGAp0PprabSM4m+32M/UXpSHppCHdzaZk=";
+    rev = "9.0.1";
+    hash = "sha256-onALN6agtrHWigtFlCeefD9CiRZI4Y690XTzy2UDnrk=";
   };
 
   ARROW_SUBSTRAIT_URL = fetchFromGitHub {
     owner = "substrait-io";
     repo = "substrait";
-    rev = "v0.6.0";
-    hash = "sha256-hxCBomL4Qg9cHLRg9ZiO9k+JVOZXn6f4ikPtK+V9tno=";
+    rev = "v0.20.0";
+    hash = "sha256-71hAwJ0cGvpwK/ibeeQt82e9uqxcu9sM1rPtPENMPfs=";
   };
 
   patches = [
@@ -148,18 +150,17 @@ stdenv.mkDerivation rec {
     utf8proc
     zlib
     zstd
-  ] ++ lib.optionals enableShared [
-    python3.pkgs.python
-    python3.pkgs.numpy
   ] ++ lib.optionals enableFlight [
     grpc
     openssl
     protobuf
+    sqlite
   ] ++ lib.optionals enableS3 [ aws-sdk-cpp-arrow openssl ]
   ++ lib.optionals enableGcs [
     crc32c
     curl
-    google-cloud-cpp grpc
+    google-cloud-cpp
+    grpc
     nlohmann_json
   ];
 
@@ -183,16 +184,12 @@ stdenv.mkDerivation rec {
     "-DARROW_COMPUTE=ON"
     "-DARROW_CSV=ON"
     "-DARROW_DATASET=ON"
-    "-DARROW_ENGINE=ON"
     "-DARROW_FILESYSTEM=ON"
     "-DARROW_FLIGHT_SQL=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_HDFS=ON"
     "-DARROW_IPC=ON"
     "-DARROW_JEMALLOC=${if enableJemalloc then "ON" else "OFF"}"
     "-DARROW_JSON=ON"
-    "-DARROW_PLASMA=ON"
-    # Disable Python for static mode because openblas is currently broken there.
-    "-DARROW_PYTHON=${if enableShared then "ON" else "OFF"}"
     "-DARROW_USE_GLOG=ON"
     "-DARROW_WITH_BACKTRACE=ON"
     "-DARROW_WITH_BROTLI=ON"
@@ -203,21 +200,21 @@ stdenv.mkDerivation rec {
     "-DARROW_WITH_ZLIB=ON"
     "-DARROW_WITH_ZSTD=ON"
     "-DARROW_MIMALLOC=ON"
-    # Parquet options:
-    "-DARROW_PARQUET=ON"
     "-DARROW_SUBSTRAIT=ON"
-    "-DPARQUET_BUILD_EXECUTABLES=ON"
     "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_FLIGHT_TESTING=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
     "-DARROW_GCS=${if enableGcs then "ON" else "OFF"}"
+    # Parquet options:
+    "-DARROW_PARQUET=ON"
+    "-DPARQUET_BUILD_EXECUTABLES=ON"
+    "-DPARQUET_REQUIRE_ENCRYPTION=ON"
   ] ++ lib.optionals (!enableShared) [
     "-DARROW_TEST_LINKAGE=static"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
-  ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF"
-  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h"
-  ++ lib.optionals enableGcs [ "-DCMAKE_CXX_STANDARD=${grpc.cxxStandard}" ];
+  ] ++ lib.optionals (!stdenv.isx86_64) [ "-DARROW_USE_SIMD=OFF" ]
+  ++ lib.optionals enableS3 [ "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h" ];
 
   doInstallCheck = true;
   ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
@@ -239,31 +236,33 @@ stdenv.mkDerivation rec {
         "TestS3FSGeneric.*"
       ];
     in
-    lib.optionalString doInstallCheck "-${builtins.concatStringsSep ":" filteredTests}";
+    lib.optionalString doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+
   __darwinAllowLocalNetworking = true;
-  nativeInstallCheckInputs = [ perl which sqlite ] ++ lib.optional enableS3 minio;
-  installCheckPhase =
-    let
-      excludedTests = lib.optionals stdenv.isDarwin [
-        # Some plasma tests need to be patched to use a shorter AF_UNIX socket
-        # path on Darwin. See https://github.com/NixOS/nix/pull/1085
-        "plasma-external-store-tests"
-        "plasma-client-tests"
-      ] ++ [ "arrow-gcsfs-test" ];
-    in
-    ''
-      runHook preInstallCheck
 
-      ctest -L unittest \
-        --exclude-regex '^(${builtins.concatStringsSep "|" excludedTests})$'
+  nativeInstallCheckInputs = [ perl which sqlite ]
+    ++ lib.optionals enableS3 [ minio ]
+    ++ lib.optionals enableFlight [ python3 ];
+
+  disabledTests = [
+    # requires networking
+    "arrow-gcsfs-test"
+    "arrow-flight-integration-test"
+  ];
 
-      runHook postInstallCheck
-    '';
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
+
+    runHook postInstallCheck
+  '';
 
   meta = with lib; {
     description = "A cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/docs/cpp/";
     license = licenses.asl20;
+    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin; # waiting on gtest changes in staging
     platforms = platforms.unix;
     maintainers = with maintainers; [ tobim veprbl cpcloud ];
   };
diff --git a/pkgs/development/libraries/assimp/default.nix b/pkgs/development/libraries/assimp/default.nix
index 81d9e54de435d..ed0476fea642c 100644
--- a/pkgs/development/libraries/assimp/default.nix
+++ b/pkgs/development/libraries/assimp/default.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DASSIMP_BUILD_ASSIMP_TOOLS=ON" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   meta = with lib; {
     description = "A library to import various 3D model formats";
     homepage = "https://www.assimp.org/";
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 152572c6b16a5..a760685481226 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -29,11 +29,14 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  NIX_CFLAGS_COMPILE = [
     "-Wno-error=cast-function-type"
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-overflow"
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs and probably clang
+    "-Wno-error=use-after-free"
   ];
 
   propagatedBuildInputs = [ libantlr3c mbedtls_2 bctoolbox belr ];
diff --git a/pkgs/development/libraries/boringssl/default.nix b/pkgs/development/libraries/boringssl/default.nix
index 61c2a27f3d857..955157d055a2f 100644
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@@ -30,6 +30,11 @@ buildGoModule {
     export GOARCH=$(go env GOHOSTARCH)
   '';
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-Wno-error=stringop-overflow"
+  ];
+
   buildPhase = ''
     ninjaBuildPhase
   '';
diff --git a/pkgs/development/libraries/bzrtp/default.nix b/pkgs/development/libraries/bzrtp/default.nix
index 4bccc0c5cf2fa..5791924ad14a9 100644
--- a/pkgs/development/libraries/bzrtp/default.nix
+++ b/pkgs/development/libraries/bzrtp/default.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" "-DCMAKE_C_FLAGS=-Wno-error=cast-function-type" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   meta = with lib; {
     description = "An opensource implementation of ZRTP keys exchange protocol. Part of the Linphone project.";
     homepage = "https://gitlab.linphone.org/BC/public/bzrtp";
diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 861e9179e0948..d928b814e826f 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -30,11 +30,14 @@ stdenv.mkDerivation rec {
     "-DLUCENE_STATIC_CONSTANT_SYNTAX_EXITCODE__TRYRUN_OUTPUT="
   ];
 
-  patches = # From debian
-    [ ./Fix-pkgconfig-file-by-adding-clucene-shared-library.patch
-      ./Fixing_ZLIB_configuration_in_shared_CMakeLists.patch
-      ./Install-contribs-lib.patch
-    ] ++ lib.optionals stdenv.isDarwin [ ./fix-darwin.patch ];
+  patches = [
+    # From debian
+    ./Fix-pkgconfig-file-by-adding-clucene-shared-library.patch
+    ./Fixing_ZLIB_configuration_in_shared_CMakeLists.patch
+    ./Install-contribs-lib.patch
+    # From arch
+    ./fix-missing-include-time.patch
+  ] ++ lib.optionals stdenv.isDarwin [ ./fix-darwin.patch ];
 
   # fails with "Unable to find executable:
   # /build/clucene-core-2.3.3.4/build/bin/cl_test"
diff --git a/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch b/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch
new file mode 100644
index 0000000000000..0ac26f76929ac
--- /dev/null
+++ b/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch
@@ -0,0 +1,49 @@
+From c1c2000c35ff39b09cb70fbdf66a107d3b17a674 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 12 Oct 2022 08:40:49 +0200
+Subject: [PATCH] Fix missing #include <time.h>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+At least on recent Fedora 37 beta, building now failed with
+
+> CLucene/document/DateTools.cpp:26:19: error: ‘gmtime’ was not declared in this scope
+>    26 |         tm *ptm = gmtime(&secs);
+>       |                   ^~~~~~
+
+etc.
+
+As it turns out, after 22f9d40320e3deeaa8d6aaa7a770077c20a21dae "git-svn-id:
+https://clucene.svn.sourceforge.net/svnroot/clucene/branches/lucene2_3_2@2672
+20ef185c-fe11-0410-a618-ba9304b01011" on 2008-06-26 had commented out
+_CL_TIME_WITH_SYS_TIME in clucene-config.h.cmake as "not actually used for
+anything", then cceccfb52917b5f4da447f1cf20c135952d41442 "Presenting DateTools
+and deprecating DateField. DateTools still requires some testing and its own
+unit testing" on 2008-06-29 had introduced this use of it (into then
+src/CLucene/document/DateTools.H).  And apparently most build environments have
+silently been happy ever since when the dead leading check for
+_CL_TIME_WITH_SYS_TIME didn't include both <sys/time.h> and <time.h>, but the
+following check for _CL_HAVE_SYS_TIME_H only included <sys/time.h> but not
+<time.h>.
+---
+ src/shared/CLucene/clucene-config.h.cmake | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/shared/CLucene/clucene-config.h.cmake b/src/shared/CLucene/clucene-config.h.cmake
+index bd8683a5..6fe0f92b 100644
+--- a/src/shared/CLucene/clucene-config.h.cmake
++++ b/src/shared/CLucene/clucene-config.h.cmake
+@@ -100,8 +100,7 @@ ${SYMBOL__T}
+ //#cmakedefine _CL_STAT_MACROS_BROKEN
+ 
+ /* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
+-//not actually used for anything...
+-//#cmakedefine _CL_TIME_WITH_SYS_TIME  1 
++#cmakedefine _CL_TIME_WITH_SYS_TIME  1 
+ 
+ /* Define that we will be using -fvisibility=hidden, and 
+  * make public classes visible using __attribute__ ((visibility("default")))
+-- 
+2.37.3
+
diff --git a/pkgs/development/libraries/cosmopolitan/default.nix b/pkgs/development/libraries/cosmopolitan/default.nix
index 88e5bcf5d9d7b..6f4cdb1cf6878 100644
--- a/pkgs/development/libraries/cosmopolitan/default.nix
+++ b/pkgs/development/libraries/cosmopolitan/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cosmopolitan";
-  version = "2.1.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "jart";
     repo = pname;
     rev = version;
-    sha256 = "sha256-2Q4lutSIQ6tBwTy01lPSMepNAww9Kb7BwNyEcsSdWZ0=";
+    sha256 = "sha256-DTL1dXH+LhaxWpiCrsNjV74Bw5+kPbhEAA2Z1NKiPDk=";
   };
 
   patches = [
@@ -34,6 +34,9 @@ stdenv.mkDerivation rec {
     rm test/libc/calls/sched_setscheduler_test.c
     rm test/libc/thread/pthread_create_test.c
     rm test/libc/calls/getgroups_test.c
+
+    # fails
+    rm test/libc/stdio/posix_spawn_test.c
   '';
 
   installPhase = ''
diff --git a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
index 44fcbe5463cb0..38acb5def4a3a 100644
--- a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
+++ b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation {
 
   NIX_CFLAGS_COMPILE = [
     "-Wno-error=range-loop-construct"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/dbus-cplusplus/default.nix b/pkgs/development/libraries/dbus-cplusplus/default.nix
index 005f1ac0302cb..1e38ddf44e196 100644
--- a/pkgs/development/libraries/dbus-cplusplus/default.nix
+++ b/pkgs/development/libraries/dbus-cplusplus/default.nix
@@ -29,6 +29,12 @@ stdenv.mkDerivation rec {
           + "dbus-c++-threading.patch?id=7f371172f5c";
       sha256 = "1h362anx3wyxm5lq0v8girmip1jmkdbijrmbrq7k5pp47zkhwwrq";
     })
+    (fetchurl {
+      name = "template-operators.patch"; # since gcc12
+      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
+          + "dbus-c++-template-operators.patch?id=d3f0d8bb519c0af";
+      sha256 = "N25Y7jXDbr0qb7MfRr2yz3zRySppgGOe+oCfNQhRvVc=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/example-robot-data/default.nix b/pkgs/development/libraries/example-robot-data/default.nix
index 08a650dbca003..5fbb03a9fa2b5 100644
--- a/pkgs/development/libraries/example-robot-data/default.nix
+++ b/pkgs/development/libraries/example-robot-data/default.nix
@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "example-robot-data";
-  version = "4.0.3";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner = "Gepetto";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-rxVyka8tcF/CmGTVNyh3FPR1LVa6JOAN+9zjElgqCak=";
+    sha256 = "sha256-5FqMRChv/YGeoZq/jLSEJI5iQazQIDwslT78fbERVfs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
deleted file mode 100644
index a8acf7a7ce61d..0000000000000
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ /dev/null
@@ -1,511 +0,0 @@
-{ lib, stdenv, buildPackages, ffmpeg, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
-/*
- *  Licensing options (yes some are listed twice, filters and such are not listed)
- */
-, gplLicensing ? true # GPL: fdkaac,openssl,frei0r,cdio,samba,utvideo,vidstab,x265,x265,xavs,avid,zvbi,x11grab
-, version3Licensing ? true # (L)GPL3: libvmaf,opencore-amrnb,opencore-amrwb,samba,vo-aacenc,vo-amrwbenc
-, nonfreeLicensing ? false # NONFREE: openssl,fdkaac,blackmagic-design-desktop-video
-/*
- *  Build options
- */
-, smallBuild ? false # Optimize for size instead of speed
-, runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime (disable to compile natively)
-, grayBuild ? true # Full grayscale support
-, swscaleAlphaBuild ? true # Alpha channel support in swscale
-, hardcodedTablesBuild ? true # Hardcode decode tables instead of runtime generation
-, safeBitstreamReaderBuild ? true # Buffer boundary checking in bitreaders
-, multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, networkBuild ? true # Network support
-, pixelutilsBuild ? true # Pixel utils in libavutil
-, enableLto ? false # build with link-time optimization
-/*
- *  Program options
- */
-, ffmpegProgram ? true # Build ffmpeg executable
-, ffplayProgram ? true # Build ffplay executable
-, ffprobeProgram ? true # Build ffprobe executable
-, qtFaststartProgram ? true # Build qt-faststart executable
-/*
- *  Library options
- */
-, avcodecLibrary ? true # Build avcodec library
-, avdeviceLibrary ? true # Build avdevice library
-, avfilterLibrary ? true # Build avfilter library
-, avformatLibrary ? true # Build avformat library
-, avutilLibrary ? true # Build avutil library
-, postprocLibrary ? true # Build postproc library
-, swresampleLibrary ? true # Build swresample library
-, swscaleLibrary ? true # Build swscale library
-/*
- *  Documentation options
- */
-, htmlpagesDocumentation ? false # HTML documentation pages
-, manpagesDocumentation ? true # Man documentation pages
-, podpagesDocumentation ? false # POD documentation pages
-, txtpagesDocumentation ? false # Text documentation pages
-/*
- *  External libraries options
- */
-, alsa-lib ? null # Alsa in/output support
-#, avisynth ? null # Support for reading AviSynth scripts
-, bzip2 ? null
-, clang ? null
-, celt ? null # CELT decoder
-#, crystalhd ? null # Broadcom CrystalHD hardware acceleration
-, cuda ? !stdenv.isDarwin && !stdenv.isAarch64 # Dynamically linked CUDA
-, cuda-llvm ? !stdenv.isDarwin && !stdenv.isAarch64 # LLVM-based CUDA compilation
-, dav1d ? null # AV1 decoder (focused on speed and correctness)
-#, decklinkExtlib ? false, blackmagic-design-desktop-video ? null # Blackmagic Design DeckLink I/O support
-, fdkaacExtlib ? false, fdk_aac ? null # Fraunhofer FDK AAC de/encoder
-#, flite ? null # Flite (voice synthesis) support
-, fontconfig ? null # Needed for drawtext filter
-, freetype ? null # Needed for drawtext filter
-, frei0r ? null # frei0r video filtering
-, fribidi ? null # Needed for drawtext filter
-, game-music-emu ? null # Game Music Emulator
-, gnutls ? null
-, gsm ? null # GSM de/encoder
-#, ilbc ? null # iLBC de/encoder
-, libjack2 ? null # Jack audio (only version 2 is supported in this build)
-, ladspaH ? null # LADSPA audio filtering
-, lame ? null # LAME MP3 encoder
-, libass ? null # (Advanced) SubStation Alpha subtitle rendering
-, libaom ? null # AV1 encoder
-, libbluray ? null # BluRay reading
-, libbs2b ? null # bs2b DSP library
-, libcaca ? null # Textual display (ASCII art)
-#, libcdio-paranoia ? null # Audio CD grabbing
-, libdc1394 ? null, libraw1394 ? null # IIDC-1394 grabbing (ieee 1394)
-, libdrm ? null # libdrm support
-, libiconv ? null
-#, libiec61883 ? null, libavc1394 ? null # iec61883 (also uses libraw1394)
-, libmfx ? null # Hardware acceleration vis libmfx
-, libmodplug ? null # ModPlug support
-, libmysofa ? null # HRTF support via SOFAlizer
-#, libnut ? null # NUT (de)muxer, native (de)muser exists
-, libogg ? null # Ogg container used by vorbis & theora
-, libopenmpt ? null # Tracked music files decoder
-, libopus ? null # Opus de/encoder
-, librsvg ? null # SVG protocol
-, libssh ? null # SFTP protocol
-, libtheora ? null # Theora encoder
-, libv4l ? null # Video 4 Linux support
-, libva ? null # Vaapi hardware acceleration
-, libvdpau ? null # Vdpau hardware acceleration
-, libvmaf ? null # Netflix's VMAF (Video Multi-Method Assessment Fusion)
-, libvorbis ? null # Vorbis de/encoding, native encoder exists
-, libvpx ? null # VP8 & VP9 de/encoding
-, libwebp ? null # WebP encoder
-, libX11 ? null # Xlib support
-, libxcb ? null # X11 grabbing using XCB
-, libxcbshmExtlib ? true # X11 grabbing shm communication
-, libxcbxfixesExtlib ? true # X11 grabbing mouse rendering
-, libxcbshapeExtlib ? true # X11 grabbing shape rendering
-, libXv ? null # Xlib support
-, libXext ? null # Xlib support
-, libxml2 ? null # libxml2 support, for IMF and DASH demuxers
-, xz ? null # xz-utils
-, nv-codec-headers ? null
-, nvdec ? !stdenv.isDarwin && !stdenv.isAarch64 # NVIDIA NVDEC support
-, nvenc ? !stdenv.isDarwin && !stdenv.isAarch64 # NVIDIA NVENC support
-, openal ? null # OpenAL 1.1 capture support
-, ocl-icd ? null # OpenCL ICD
-, opencl-headers ? null # OpenCL headers
-, opencore-amr ? null # AMR-NB de/encoder & AMR-WB decoder
-#, opencv ? null # Video filtering
-, openglExtlib ? false, libGL ? null, libGLU ? null # OpenGL rendering
-, openh264 ? null # H.264/AVC encoder
-, openjpeg ? null # JPEG 2000 de/encoder
-, opensslExtlib ? false, openssl ? null
-, libpulseaudio ? null # Pulseaudio input support
-, rav1e ? null # AV1 encoder (focused on speed and safety)
-, svt-av1 ? null # AV1 encoder/decoder (focused on speed and correctness)
-, rtmpdump ? null # RTMP[E] support
-#, libquvi ? null # Quvi input support
-, samba ? null # Samba protocol
-#, schroedinger ? null # Dirac de/encoder
-, SDL2 ? null
-#, shine ? null # Fixed-point MP3 encoder
-, soxr ? null # Resampling via soxr
-, speex ? null # Speex de/encoder
-, srt ? null # Secure Reliable Transport (SRT) protocol
-#, twolame ? null # MP2 encoder
-#, utvideo ? null # Ut Video de/encoder
-, vid-stab ? null # Video stabilization
-#, vo-aacenc ? null # AAC encoder
-, vo-amrwbenc ? null # AMR-WB encoder
-, x264 ? null # H.264/AVC encoder
-, x265 ? null # H.265/HEVC encoder
-, xavs ? null # AVS encoder
-, xvidcore ? null # Xvid encoder, native encoder exists
-, zeromq4 ? null # Message passing
-, zimg ? null
-, zlib ? null
-, vulkan-loader ? null
-, glslang ? null
-#, zvbi ? null # Teletext support
-/*
- *  Developer options
- */
-, debugDeveloper ? false
-, optimizationsDeveloper ? true
-, extraWarningsDeveloper ? false
-, strippingDeveloper ? false
-/*
- *  Darwin frameworks
- */
-, Cocoa, CoreAudio, CoreServices, AVFoundation, MediaToolbox
-, VideoDecodeAcceleration, VideoToolbox
-}:
-
-/* Maintainer notes:
- *
- * Version bumps:
- * It should always be safe to bump patch releases (e.g. 2.1.x, x being a patch release)
- * If adding a new branch, note any configure flags that were added, changed, or deprecated/removed
- *   and make the necessary changes.
- *
- * Packages with errors:
- *   flite ilbc schroedinger
- *   opencv - circular dependency issue
- *
- * Not packaged:
- *   aacplus avisynth cdio-paranoia crystalhd libavc1394 libiec61883
- *   libnut libquvi nvenc oss shine twolame
- *   utvideo vo-aacenc vo-amrwbenc xvmc zvbi blackmagic-design-desktop-video
- *
- * Need fixes to support Darwin:
- *   gsm libjack2 libmodplug libmfx(intel-media-sdk) nvenc pulseaudio samba
- *   vid-stab
- *
- * Need fixes to support AArch64:
- *   libmfx(intel-media-sdk) nvenc
- *
- * Not supported:
- *   stagefright-h264(android only)
- *
- * Known issues:
- * flite: configure fails to find library
- *   Tried modifying ffmpeg's configure script and flite to use pkg-config
- * Cross-compiling will disable features not present on host OS
- *   (e.g. dxva2 support [DirectX] will not be enabled unless natively compiled on Cygwin)
- *
- */
-
-let
-  inherit (stdenv) isCygwin isDarwin isFreeBSD isLinux isAarch64;
-  inherit (lib) optional optionals optionalString enableFeature;
-in
-
-/*
- *  Licensing dependencies
- */
-assert version3Licensing -> gplLicensing;
-assert nonfreeLicensing -> gplLicensing && version3Licensing;
-/*
- *  Build dependencies
- */
-assert networkBuild -> gnutls != null || opensslExtlib;
-assert pixelutilsBuild -> avutilLibrary;
-/*
- *  Platform dependencies
- */
-assert isDarwin -> !nvenc;
-/*
- *  Program dependencies
- */
-assert ffmpegProgram -> avcodecLibrary
-                     && avfilterLibrary
-                     && avformatLibrary
-                     && swresampleLibrary;
-assert ffplayProgram -> avcodecLibrary
-                     && avformatLibrary
-                     && swscaleLibrary
-                     && swresampleLibrary
-                     && SDL2 != null;
-assert ffprobeProgram -> avcodecLibrary && avformatLibrary;
-/*
- *  Library dependencies
- */
-assert avcodecLibrary -> avutilLibrary; # configure flag since 0.6
-assert avdeviceLibrary -> avformatLibrary
-                       && avcodecLibrary
-                       && avutilLibrary; # configure flag since 0.6
-assert avformatLibrary -> avcodecLibrary && avutilLibrary; # configure flag since 0.6
-assert postprocLibrary -> avutilLibrary;
-assert swresampleLibrary -> soxr != null;
-assert swscaleLibrary -> avutilLibrary;
-/*
- *  External libraries
- */
-#assert decklinkExtlib -> blackmagic-design-desktop-video != null
-#                                       && !isCygwin && multithreadBuild # POSIX threads required
-#                                       && nonfreeLicensing;
-assert fdkaacExtlib -> fdk_aac != null && nonfreeLicensing;
-assert gnutls != null -> !opensslExtlib;
-assert libxcbshmExtlib -> libxcb != null;
-assert libxcbxfixesExtlib -> libxcb != null;
-assert libxcbshapeExtlib -> libxcb != null;
-assert openglExtlib -> libGL != null && libGLU != null;
-assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;
-
-stdenv.mkDerivation rec {
-  pname = "ffmpeg-full";
-  inherit (ffmpeg) src version patches;
-
-  prePatch = ''
-    patchShebangs .
-  '' + lib.optionalString stdenv.isDarwin ''
-    sed -i 's/#ifndef __MAC_10_11/#if 1/' ./libavcodec/audiotoolboxdec.c
-  '' + lib.optionalString (frei0r != null) ''
-    substituteInPlace libavfilter/vf_frei0r.c \
-      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-    substituteInPlace doc/filters.texi \
-      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-  '';
-
-  configurePlatforms = [];
-  configureFlags = [
-    "--target_os=${if stdenv.hostPlatform.isMinGW then "mingw64" else stdenv.hostPlatform.parsed.kernel.name}" #mingw32 and mingw64 doesn't have a difference here, it is internally rewritten as mingw32
-    "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-    /*
-     *  Licensing flags
-     */
-    (enableFeature gplLicensing "gpl")
-    (enableFeature version3Licensing "version3")
-    (enableFeature nonfreeLicensing "nonfree")
-    /*
-     *  Build flags
-     */
-    # On some ARM platforms --enable-thumb
-    "--enable-shared"
-    (enableFeature true "pic")
-    (enableFeature smallBuild "small")
-    (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
-    (enableFeature enableLto "lto")
-    (enableFeature grayBuild "gray")
-    (enableFeature swscaleAlphaBuild "swscale-alpha")
-    (enableFeature hardcodedTablesBuild "hardcoded-tables")
-    (enableFeature safeBitstreamReaderBuild "safe-bitstream-reader")
-    (if multithreadBuild then (
-       if stdenv.hostPlatform.isWindows then
-         "--disable-pthreads --enable-w32threads"
-       else # Use POSIX threads by default
-         "--enable-pthreads --disable-w32threads")
-     else
-       "--disable-pthreads --disable-w32threads")
-    "--disable-os2threads" # We don't support OS/2
-    (enableFeature networkBuild "network")
-    (enableFeature pixelutilsBuild "pixelutils")
-    /*
-     *  Program flags
-     */
-    (enableFeature ffmpegProgram "ffmpeg")
-    (enableFeature ffplayProgram "ffplay")
-    (enableFeature ffprobeProgram "ffprobe")
-    /*
-     *  Library flags
-     */
-    (enableFeature avcodecLibrary "avcodec")
-    (enableFeature avdeviceLibrary "avdevice")
-    (enableFeature avfilterLibrary "avfilter")
-    (enableFeature avformatLibrary "avformat")
-    (enableFeature avutilLibrary "avutil")
-    (enableFeature (postprocLibrary && gplLicensing) "postproc")
-    (enableFeature swresampleLibrary "swresample")
-    (enableFeature swscaleLibrary "swscale")
-    /*
-     *  Documentation flags
-     */
-    (enableFeature (htmlpagesDocumentation
-          || manpagesDocumentation
-          || podpagesDocumentation
-          || txtpagesDocumentation) "doc")
-    (enableFeature htmlpagesDocumentation "htmlpages")
-    (enableFeature manpagesDocumentation "manpages")
-    (enableFeature podpagesDocumentation "podpages")
-    (enableFeature txtpagesDocumentation "txtpages")
-    /*
-     *  External libraries
-     */
-    #(enableFeature avisynth "avisynth")
-    (enableFeature (bzip2 != null) "bzlib")
-    (enableFeature (celt != null) "libcelt")
-    (enableFeature cuda "cuda")
-    (enableFeature (clang != null && cuda-llvm) "cuda-llvm")
-    #(enableFeature crystalhd "crystalhd")
-    (enableFeature (dav1d != null) "libdav1d")
-    #(enableFeature decklinkExtlib "decklink")
-    (enableFeature (fdkaacExtlib && gplLicensing) "libfdk-aac")
-    #(enableFeature (flite != null) "libflite")
-    "--disable-libflite" # Force disable until a solution is found
-    (enableFeature (fontconfig != null) "fontconfig")
-    (enableFeature (freetype != null) "libfreetype")
-    (enableFeature (frei0r != null && gplLicensing) "frei0r")
-    (enableFeature (fribidi != null) "libfribidi")
-    (enableFeature (game-music-emu != null) "libgme")
-    (enableFeature (gnutls != null) "gnutls")
-    (enableFeature (gsm != null) "libgsm")
-    #(enableFeature (ilbc != null) "libilbc")
-    (enableFeature (ladspaH !=null) "ladspa")
-    (enableFeature (lame != null) "libmp3lame")
-    (enableFeature (libaom != null) "libaom")
-    (enableFeature (libass != null) "libass")
-    #(enableFeature (libavc1394 != null) null null)
-    (enableFeature (libbluray != null) "libbluray")
-    (enableFeature (libbs2b != null) "libbs2b")
-    #(enableFeature (libcaca != null) "libcaca")
-    #(enableFeature (cdio-paranoia != null && gplLicensing) "libcdio")
-    (enableFeature (if isLinux then libdc1394 != null && libraw1394 != null else false) "libdc1394")
-    (enableFeature ((isLinux || isFreeBSD) && libdrm != null) "libdrm")
-    (enableFeature (libiconv != null) "iconv")
-    (enableFeature (libjack2 != null) "libjack")
-    #(enableFeature (if isLinux then libiec61883 != null && libavc1394 != null && libraw1394 != null else false) "libiec61883")
-    (enableFeature (if isLinux && !isAarch64 then libmfx != null else false) "libmfx")
-    (enableFeature (libmodplug != null) "libmodplug")
-    (enableFeature (libmysofa != null) "libmysofa")
-    #(enableFeature (libnut != null) "libnut")
-    (enableFeature (libopenmpt != null) "libopenmpt")
-    (enableFeature (libopus != null) "libopus")
-    (enableFeature (librsvg != null) "librsvg")
-    (enableFeature (srt != null) "libsrt")
-    (enableFeature (libssh != null) "libssh")
-    (enableFeature (libtheora != null) "libtheora")
-    (enableFeature (if isLinux then libv4l != null else false) "libv4l2")
-    (enableFeature ((isLinux || isFreeBSD) && libva != null) "vaapi")
-    (enableFeature (libvdpau != null) "vdpau")
-    (enableFeature (libvorbis != null) "libvorbis")
-    (enableFeature (!isAarch64 && libvmaf != null && version3Licensing) "libvmaf")
-    (enableFeature (libvpx != null) "libvpx")
-    (enableFeature (libwebp != null) "libwebp")
-    (enableFeature (libX11 != null && libXv != null && libXext != null) "xlib")
-    (enableFeature (libxcb != null) "libxcb")
-    (enableFeature libxcbshmExtlib "libxcb-shm")
-    (enableFeature libxcbxfixesExtlib "libxcb-xfixes")
-    (enableFeature libxcbshapeExtlib "libxcb-shape")
-    (enableFeature (libxml2 != null) "libxml2")
-    (enableFeature (xz != null) "lzma")
-    (enableFeature nvdec "cuvid")
-    (enableFeature nvdec "nvdec")
-    (enableFeature nvenc "nvenc")
-    (enableFeature (openal != null) "openal")
-    (enableFeature (ocl-icd != null && opencl-headers != null) "opencl")
-    (enableFeature (opencore-amr != null && version3Licensing) "libopencore-amrnb")
-    #(enableFeature (opencv != null) "libopencv")
-    (enableFeature openglExtlib "opengl")
-    (enableFeature (openh264 != null) "libopenh264")
-    (enableFeature (openjpeg != null) "libopenjpeg")
-    (enableFeature (opensslExtlib && gplLicensing) "openssl")
-    (enableFeature (libpulseaudio != null) "libpulse")
-    #(enableFeature quvi "libquvi")
-    (enableFeature (rav1e != null) "librav1e")
-    (enableFeature (svt-av1 != null) "libsvtav1")
-    (enableFeature (rtmpdump != null) "librtmp")
-    #(enableFeature (schroedinger != null) "libschroedinger")
-    (enableFeature (SDL2 != null) "sdl2")
-    (enableFeature (soxr != null) "libsoxr")
-    (enableFeature (speex != null) "libspeex")
-    #(enableFeature (twolame != null) "libtwolame")
-    #(enableFeature (utvideo != null && gplLicensing) "libutvideo")
-    (enableFeature (vid-stab != null && gplLicensing) "libvidstab") # Actual min. version 2.0
-    #(enableFeature (vo-aacenc != null && version3Licensing) "libvo-aacenc")
-    (enableFeature (vo-amrwbenc != null && version3Licensing) "libvo-amrwbenc")
-    (enableFeature (x264 != null && gplLicensing) "libx264")
-    (enableFeature (x265 != null && gplLicensing) "libx265")
-    (enableFeature (xavs != null && gplLicensing) "libxavs")
-    (enableFeature (xvidcore != null && gplLicensing) "libxvid")
-    (enableFeature (zeromq4 != null) "libzmq")
-    (enableFeature (zimg != null) "libzimg")
-    (enableFeature (zlib != null) "zlib")
-    (enableFeature (isLinux && vulkan-loader != null) "vulkan")
-    (enableFeature (isLinux && vulkan-loader != null && glslang != null) "libglslang")
-    (enableFeature (samba != null && gplLicensing && version3Licensing) "libsmbclient")
-    #(enableFeature (zvbi != null && gplLicensing) "libzvbi")
-    /*
-     * Developer flags
-     */
-    (enableFeature debugDeveloper "debug")
-    (enableFeature optimizationsDeveloper "optimizations")
-    (enableFeature extraWarningsDeveloper "extra-warnings")
-    (enableFeature strippingDeveloper "stripping")
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--cross-prefix=${stdenv.cc.targetPrefix}"
-    "--enable-cross-compile"
-    "--host-cc=${buildPackages.stdenv.cc}/bin/cc"
-  ] ++ optionals stdenv.cc.isClang [
-    "--cc=clang"
-    "--cxx=clang++"
-  ];
-
-  nativeBuildInputs = [ addOpenGLRunpath perl pkg-config texinfo yasm ];
-
-  buildInputs = [
-    bzip2 celt dav1d fontconfig freetype frei0r fribidi game-music-emu gnutls gsm
-    libjack2 ladspaH lame libaom libass libbluray libbs2b libcaca libdc1394 libmodplug libmysofa
-    libogg libopenmpt libopus librsvg libssh libtheora libvdpau libvorbis libvpx libwebp libX11
-    libxcb libXv libXext libxml2 xz openal ocl-icd opencl-headers openjpeg libpulseaudio rav1e svt-av1 rtmpdump opencore-amr
-    samba SDL2 soxr speex srt vid-stab vo-amrwbenc x264 x265 xavs xvidcore
-    zeromq4 zimg zlib openh264
-  ] ++ optionals openglExtlib [ libGL libGLU ]
-    ++ optionals nonfreeLicensing [ fdk_aac openssl ]
-    ++ optional ((isLinux || isFreeBSD) && libva != null) libva
-    ++ optional ((isLinux || isFreeBSD) && libdrm != null) libdrm
-    ++ optional (!isAarch64 && libvmaf != null && version3Licensing) libvmaf
-    ++ optionals isLinux [ alsa-lib libraw1394 libv4l vulkan-loader glslang ]
-    ++ optional (isLinux && !isAarch64 && libmfx != null) libmfx
-    ++ optional (nvdec || nvenc) nv-codec-headers
-    ++ optional cuda-llvm clang
-    ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
-                                   MediaToolbox VideoDecodeAcceleration VideoToolbox
-                                   libiconv ];
-
-  buildFlags = [ "all" ]
-    ++ optional qtFaststartProgram "tools/qt-faststart"; # Build qt-faststart executable
-
-  doCheck = true;
-  checkPhase = let
-    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
-  in ''
-    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
-      make check -j$NIX_BUILD_CORES
-  '';
-
-  # Hacky framework patching technique borrowed from the phantomjs2 package
-  postInstall = optionalString qtFaststartProgram ''
-    cp -a tools/qt-faststart $out/bin/
-  '';
-
-  postFixup = optionalString stdenv.isLinux ''
-    # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
-    # See the explanation in addOpenGLRunpath.
-    addOpenGLRunpath $out/lib/libavcodec.so
-    addOpenGLRunpath $out/lib/libavutil.so
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "A complete, cross-platform solution to record, convert and stream audio and video";
-    homepage = "https://www.ffmpeg.org/";
-    changelog = "https://github.com/FFmpeg/FFmpeg/blob/n${version}/Changelog";
-    longDescription = ''
-      FFmpeg is the leading multimedia framework, able to decode, encode, transcode,
-      mux, demux, stream, filter and play pretty much anything that humans and machines
-      have created. It supports the most obscure ancient formats up to the cutting edge.
-      No matter if they were designed by some standards committee, the community or
-      a corporation.
-    '';
-    license = (
-      if nonfreeLicensing then
-        licenses.unfreeRedistributable
-      else if version3Licensing then
-        licenses.gpl3
-      else if gplLicensing then
-        licenses.gpl2Plus
-      else
-        licenses.lgpl21Plus
-    );
-    platforms = platforms.all;
-    maintainers = with maintainers; [ codyopel ];
-  };
-}
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index ac88df930768a..7882c19da8f3f 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,8 +1,4 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (rec {
+import ./generic.nix rec {
   version = "4.4.3";
-  branch = version;
-  sha256 = "sha256-M7jC281TD+HbVxBBU0Vgm0yiJ70NoeOpMy27DxH9Jzo=";
-
-} // args)
+  sha256 = "sha256-zZDzG1hD+0AHqElzeGR6OVm+H5wqtdktloSPmEUzT/c=";
+}
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index b19c22a55f3a8..7ff9b1fc2e4cb 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,7 +1,4 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (rec {
+import ./generic.nix rec {
   version = "5.1.2";
-  branch = version;
-  sha256 = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
-} // args)
+  sha256 = "sha256-4jcfwIE0/DgP7ibwkrSm/aPiHIMFn34JNcXkCMx4ceI=";
+}
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 01995e9237b15..dceada0f7f8f4 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,205 +1,660 @@
-{ lib, stdenv, buildPackages, fetchurl, pkg-config, addOpenGLRunpath, perl, texinfo, yasm
-, alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
-, libssh, libtheora, libva, libdrm, libvorbis, xz, soxr
-, x264, x265, xvidcore, zimg, zlib, libopus, speex, nv-codec-headers, dav1d
-, vpxSupport ? !stdenv.isAarch32, libvpx
-, srtSupport ? true, srt
-, vaapiSupport ? ((stdenv.isLinux || stdenv.isFreeBSD) && !stdenv.isAarch32)
-, openglSupport ? false, libGLU, libGL
-, libmfxSupport ? false, intel-media-sdk
-, libaomSupport ? false, libaom
-# Build options
-, runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime
-, multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, sdlSupport ? !stdenv.isAarch32, SDL2
-, vdpauSupport ? !stdenv.isAarch32, libvdpau
-# Developer options
-, debugDeveloper ? false
-, optimizationsDeveloper ? true
-, extraWarningsDeveloper ? false
-, Cocoa, CoreMedia, VideoToolbox
-# Inherit generics
-, branch, sha256, version, patches ? [], knownVulnerabilities ? []
-, doCheck ? true
-, pulseaudioSupport ? stdenv.isLinux
+{ version, sha256, extraPatches ? [], knownVulnerabilities ? [] }:
+
+{ lib, stdenv, buildPackages, removeReferencesTo, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
+
+, ffmpegVariant ? "small" # Decides which dependencies are enabled by default
+
+  # Build with headless deps; excludes dependencies that are only necessary for
+  # GUI applications. To be used for purposes that don't generally need such
+  # components and i.e. only depend on libav
+, withHeadlessDeps ? ffmpegVariant == "headless" || withSmallDeps
+
+  # Dependencies a user might customarily expect from a regular ffmpeg build.
+  # /All/ packages that depend on ffmpeg and some of its feaures should depend
+  # on the small variant. Small means the minimal set of features that satisfies
+  # all dependants in Nixpkgs
+, withSmallDeps ? ffmpegVariant == "small" || withFullDeps
+
+  # Everything enabled; only guarded behind platform exclusivity or brokeness.
+  # If you need to depend on ffmpeg-full because ffmpeg is missing some feature
+  # your package needs, you should enable that feature in regular ffmpeg
+  # instead.
+, withFullDeps ? ffmpegVariant == "full"
+
+, fetchgit
+, fetchpatch
+
+  # Feature flags
+, withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
+, withAom ? withFullDeps # AV1 reference encoder
+, withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
+, withBluray ? withFullDeps # BluRay reading
+, withBs2b ? withFullDeps # bs2b DSP library
+, withBzlib ? withHeadlessDeps
+, withCaca ? withFullDeps # Textual display (ASCII art)
+, withCelt ? withFullDeps # CELT decoder
+, withCrystalhd ? withFullDeps
+, withCuda ? withFullDeps && (with stdenv; (!isDarwin && !isAarch64))
+, withCudaLLVM ? withFullDeps
+, withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
+, withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
+, withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
+, withFdkAac ? withFullDeps && withUnfree # Fraunhofer FDK AAC de/encoder
+, withFontconfig ? withHeadlessDeps # Needed for drawtext filter
+, withFreetype ? withHeadlessDeps # Needed for drawtext filter
+, withFrei0r ? withFullDeps # frei0r video filtering
+, withFribidi ? withFullDeps # Needed for drawtext filter
+, withGlslang ? withFullDeps && !stdenv.isDarwin
+, withGme ? withFullDeps # Game Music Emulator
+, withGnutls ? withHeadlessDeps
+, withGsm ? withFullDeps # GSM de/encoder
+, withIconv ? withHeadlessDeps
+, withIlbc ? withFullDeps
+, withJack ? withFullDeps && !stdenv.isDarwin # Jack audio
+, withLadspa ? withFullDeps # LADSPA audio filtering
+, withLzma ? withHeadlessDeps # xz-utils
+, withMfx ? withFullDeps && (with stdenv.targetPlatform; isLinux && !isAarch) # Hardware acceleration via intel-media-sdk/libmfx
+, withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
+, withMp3lame ? withHeadlessDeps # LAME MP3 encoder
+, withMysofa ? withFullDeps # HRTF support via SOFAlizer
+, withNvdec ? withHeadlessDeps && !stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform
+, withNvenc ? withHeadlessDeps && !stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform
+, withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
+, withOpenal ? withFullDeps # OpenAL 1.1 capture support
+, withOpencl ? withFullDeps
+, withOpencoreAmrnb ? withFullDeps # AMR-NB de/encoder & AMR-WB decoder
+, withOpengl ? false # OpenGL rendering
+, withOpenh264 ? withFullDeps # H.264/AVC encoder
+, withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
+, withOpenmpt ? withFullDeps # Tracked music files decoder
+, withOpus ? withHeadlessDeps # Opus de/encoder
+, withPulse ? withSmallDeps && !stdenv.isDarwin # Pulseaudio input support
+, withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
+, withRtmp ? false # RTMP[E] support
+, withSamba ? withFullDeps && !stdenv.isDarwin # Samba protocol
+, withSdl2 ? withSmallDeps
+, withSoxr ? withHeadlessDeps # Resampling via soxr
+, withSpeex ? withHeadlessDeps # Speex de/encoder
+, withSrt ? withHeadlessDeps # Secure Reliable Transport (SRT) protocol
+, withSsh ? withHeadlessDeps # SFTP protocol
+, withSvg ? withFullDeps # SVG protocol
+, withSvtav1 ? withFullDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
+, withTheora ? withHeadlessDeps # Theora encoder
+, withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
+, withV4l2M2m ? withV4l2
+, withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
+, withVdpau ? withSmallDeps # Vdpau hardware acceleration
+, withVidStab ? withFullDeps # Video stabilization
+, withVmaf ? withFullDeps && withGPLv3 && !stdenv.isAarch64 # Netflix's VMAF (Video Multi-Method Assessment Fusion)
+, withVoAmrwbenc ? withFullDeps # AMR-WB encoder
+, withVorbis ? withHeadlessDeps # Vorbis de/encoding, native encoder exists
+, withVpx ? withHeadlessDeps && stdenv.buildPlatform == stdenv.hostPlatform # VP8 & VP9 de/encoding
+, withVulkan ? withFullDeps && !stdenv.isDarwin
+, withWebp ? withFullDeps # WebP encoder
+, withX264 ? withHeadlessDeps # H.264/AVC encoder
+, withX265 ? withHeadlessDeps # H.265/HEVC encoder
+, withXavs ? withFullDeps # AVS encoder
+, withXcb ? withXcbShm || withXcbxfixes || withXcbShape # X11 grabbing using XCB
+, withXcbShape ? withFullDeps # X11 grabbing shape rendering
+, withXcbShm ? withFullDeps # X11 grabbing shm communication
+, withXcbxfixes ? withFullDeps # X11 grabbing mouse rendering
+, withXlib ? withFullDeps # Xlib support
+, withXml2 ? withFullDeps # libxml2 support, for IMF and DASH demuxers
+, withXvid ? withHeadlessDeps # Xvid encoder, native encoder exists
+, withZimg ? withHeadlessDeps
+, withZlib ? withHeadlessDeps
+, withZmq ? withFullDeps # Message passing
+
+/*
+ *  Licensing options (yes some are listed twice, filters and such are not listed)
+ */
+, withGPL ? true
+, withGPLv3 ? true
+, withUnfree ? false
+
+/*
+ *  Build options
+ */
+, withSmallBuild ? false # Optimize for size instead of speed
+, withRuntimeCPUDetection ? true # Detect CPU capabilities at runtime (disable to compile natively)
+, withGrayscale ? withFullDeps # Full grayscale support
+, withSwscaleAlpha ? buildSwscale # Alpha channel support in swscale. You probably want this when buildSwscale.
+, withHardcodedTables ? withHeadlessDeps # Hardcode decode tables instead of runtime generation
+, withSafeBitstreamReader ? withHeadlessDeps # Buffer boundary checking in bitreaders
+, withMultithread ? true # Multithreading via pthreads/win32 threads
+, withNetwork ? withHeadlessDeps # Network support
+, withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
+, withLTO ? false # build with link-time optimization
+/*
+ *  Program options
+ */
+, buildFfmpeg ? withHeadlessDeps # Build ffmpeg executable
+, buildFfplay ? withFullDeps # Build ffplay executable
+, buildFfprobe ? withHeadlessDeps # Build ffprobe executable
+, buildQtFaststart ? withFullDeps # Build qt-faststart executable
+, withBin ? buildFfmpeg || buildFfplay || buildFfprobe || buildQtFaststart
+/*
+ *  Library options
+ */
+, buildAvcodec ? withHeadlessDeps # Build avcodec library
+, buildAvdevice ? withHeadlessDeps # Build avdevice library
+, buildAvfilter ? withHeadlessDeps # Build avfilter library
+, buildAvformat ? withHeadlessDeps # Build avformat library
+# Deprecated but depended upon by some packages.
+# https://github.com/NixOS/nixpkgs/pull/211834#issuecomment-1417435991)
+, buildAvresample ? withHeadlessDeps && lib.versionOlder version "5" # Build avresample library
+, buildAvutil ? withHeadlessDeps # Build avutil library
+, buildPostproc ? withHeadlessDeps # Build postproc library
+, buildSwresample ? withHeadlessDeps # Build swresample library
+, buildSwscale ? withHeadlessDeps # Build swscale library
+, withLib ? buildAvcodec
+  || buildAvdevice
+  || buildAvfilter
+  || buildAvformat
+  || buildAvutil
+  || buildPostproc
+  || buildSwresample
+  || buildSwscale
+/*
+ *  Documentation options
+ */
+, withDocumentation ? withHtmlDoc || withManPages || withPodDoc || withTxtDoc
+, withHtmlDoc ? withHeadlessDeps # HTML documentation pages
+, withManPages ? withHeadlessDeps # Man documentation pages
+, withPodDoc ? withHeadlessDeps # POD documentation pages
+, withTxtDoc ? withHeadlessDeps # Text documentation pages
+# Whether a "doc" output will be produced. Note that withManPages does not produce
+# a "doc" output because its files go to "man".
+, withDoc ? withDocumentation && (withHtmlDoc || withPodDoc || withTxtDoc)
+
+/*
+ *  Developer options
+ */
+, withDebug ? false
+, withOptimisations ? true
+, withExtraWarnings ? false
+, withStripping ? false
+
+/*
+ *  External libraries options
+ */
+, alsa-lib
+, bzip2
+, clang
+, celt
+, dav1d
+, fdk_aac
+, fontconfig
+, freetype
+, frei0r
+, fribidi
+, game-music-emu
+, gnutls
+, gsm
+, libjack2
+, ladspaH
+, lame
+, libass
+, libaom
+, libbluray
+, libbs2b
+, libcaca
+, libdc1394
+, libraw1394
+, libdrm
+, libiconv
+, intel-media-sdk
+, libmodplug
+, libmysofa
+, libogg
+, libopenmpt
+, libopus
+, librsvg
+, libssh
+, libtheora
+, libv4l
+, libva
+, libva-minimal
+, libvdpau
+, libvmaf
+, libvorbis
+, libvpx
+, libwebp
+, libX11
+, libxcb
+, libXv
+, libXext
+, libxml2
+, xz
+, nv-codec-headers
+, openal
+, ocl-icd # OpenCL ICD
+, opencl-headers  # OpenCL headers
+, opencore-amr
+, libGL
+, libGLU
+, openh264
+, openjpeg
 , libpulseaudio
-, ...
+, rav1e
+, svt-av1
+, rtmpdump
+, samba
+, SDL2
+, soxr
+, speex
+, srt
+, vid-stab
+, vo-amrwbenc
+, x264
+, x265
+, xavs
+, xvidcore
+, zeromq4
+, zimg
+, zlib
+, vulkan-loader
+, glslang
+/*
+ *  Darwin frameworks
+ */
+, AVFoundation
+, Cocoa
+, CoreAudio
+, CoreMedia
+, CoreServices
+, MediaToolbox
+, VideoDecodeAcceleration
+, VideoToolbox
 }:
 
 /* Maintainer notes:
  *
- * THIS IS A MINIMAL BUILD OF FFMPEG, do not include dependencies unless
- * a build that depends on ffmpeg requires them to be compiled into ffmpeg,
- * see `ffmpeg-full' for an ffmpeg build with all features included.
- *
- * Need fixes to support Darwin:
- *   pulseaudio
+ * Version bumps:
+ * It should always be safe to bump patch releases (e.g. 2.1.x, x being a patch release)
+ * If adding a new branch, note any configure flags that were added, changed, or deprecated/removed
+ *   and make the necessary changes.
  *
  * Known issues:
- * ALL     - Cross-compiling will disable features not present on host OS
- *           (e.g. dxva2 support [DirectX] will not be enabled unless natively
- *           compiled on Cygwin)
+ * Cross-compiling will disable features not present on host OS
+ *   (e.g. dxva2 support [DirectX] will not be enabled unless natively compiled on Cygwin)
  *
  */
 
 let
-  inherit (lib) optional optionals optionalString enableFeature filter;
+  inherit (stdenv) isCygwin isDarwin isFreeBSD isLinux isAarch64;
+  inherit (lib) optional optionals optionalString enableFeature;
+in
 
-  reqMin = requiredVersion: (builtins.compareVersions requiredVersion branch != 1);
 
-  ifMinVer = minVer: flag: if reqMin minVer then flag else null;
+assert lib.elem ffmpegVariant [ "headless" "small" "full" ];
 
-  ifVerOlder = maxVer: flag: if (lib.versionOlder branch maxVer) then flag else null;
-in
+/*
+ *  Licensing dependencies
+ */
+assert withGPLv3 -> withGPL;
+assert withUnfree -> withGPL && withGPLv3;
+/*
+ *  Build dependencies
+ */
+assert withPixelutils -> buildAvutil;
+/*
+ *  Program dependencies
+ */
+assert buildFfmpeg -> buildAvcodec
+                     && buildAvfilter
+                     && buildAvformat
+                     && (buildSwresample || buildAvresample);
+assert buildFfplay -> buildAvcodec
+                     && buildAvformat
+                     && buildSwscale
+                     && (buildSwresample || buildAvresample);
+assert buildFfprobe -> buildAvcodec && buildAvformat;
+/*
+ *  Library dependencies
+ */
+assert buildAvcodec -> buildAvutil; # configure flag since 0.6
+assert buildAvdevice -> buildAvformat
+                       && buildAvcodec
+                       && buildAvutil; # configure flag since 0.6
+assert buildAvformat -> buildAvcodec && buildAvutil; # configure flag since 0.6
+assert buildPostproc -> buildAvutil;
+assert buildSwscale -> buildAvutil;
 
 stdenv.mkDerivation rec {
-  pname = "ffmpeg";
+  pname = "ffmpeg" + (if ffmpegVariant == "small" then "" else "-${ffmpegVariant}");
   inherit version;
 
-  src = fetchurl {
-    url = "https://www.ffmpeg.org/releases/${pname}-${version}.tar.bz2";
+  src = fetchgit {
+    url = "https://git.ffmpeg.org/ffmpeg.git";
+    rev = "n${version}";
     inherit sha256;
   };
 
-  postPatch = "patchShebangs .";
-  inherit patches;
+  postPatch = ''
+    patchShebangs .
+  '' + lib.optionalString withFrei0r ''
+    substituteInPlace libavfilter/vf_frei0r.c \
+      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
+    substituteInPlace doc/filters.texi \
+      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
+  '';
 
-  outputs = [ "bin" "dev" "out" "man" "doc" ];
-  setOutputFlags = false; # doesn't accept all and stores configureFlags in libs!
+  patches = map (patch: fetchpatch patch) extraPatches;
 
   configurePlatforms = [];
-  configureFlags = filter (v: v != null) ([
-      "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-      "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
-      "--pkg-config=${buildPackages.pkg-config.targetPrefix}pkg-config"
-    # License
-      "--enable-gpl"
-      "--enable-version3"
-    # Build flags
-      "--enable-shared"
-      "--enable-pic"
-      (ifMinVer "4.0" (enableFeature srtSupport "libsrt"))
-      (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
-      "--enable-hardcoded-tables"
-    ] ++
-      (if multithreadBuild then (
-         if stdenv.isCygwin then
-           ["--disable-pthreads" "--enable-w32threads"]
-         else # Use POSIX threads by default
-           ["--enable-pthreads" "--disable-w32threads"])
-       else
-         ["--disable-pthreads" "--disable-w32threads"])
-    ++ [
-      "--disable-os2threads" # We don't support OS/2
-      "--enable-network"
-      "--enable-pixelutils"
-    # Executables
-      "--enable-ffmpeg"
-      "--disable-ffplay"
-      "--enable-ffprobe"
-      (ifVerOlder "4" "--disable-ffserver")
-    # Libraries
-      "--enable-avcodec"
-      "--enable-avdevice"
-      "--enable-avfilter"
-      "--enable-avformat"
-      (ifVerOlder "5.0" "--enable-avresample")
-      "--enable-avutil"
-      "--enable-postproc"
-      "--enable-swresample"
-      "--enable-swscale"
-    # Docs
-      "--disable-doc"
-    # External Libraries
-      "--enable-libass"
-      "--enable-bzlib"
-      "--enable-gnutls"
-      "--enable-fontconfig"
-      "--enable-libfreetype"
-      "--enable-libmp3lame"
-      "--enable-iconv"
-      "--enable-libtheora"
-      "--enable-libssh"
-      (enableFeature vaapiSupport "vaapi")
-      (enableFeature vaapiSupport "libdrm")
-      (enableFeature vdpauSupport "vdpau")
-      "--enable-libvorbis"
-      (enableFeature vpxSupport "libvpx")
-      "--enable-lzma"
-      (enableFeature openglSupport "opengl")
-      (ifMinVer "4.2" (enableFeature libmfxSupport "libmfx"))
-      (ifMinVer "4.2" (enableFeature libaomSupport "libaom"))
-      (lib.optionalString pulseaudioSupport "--enable-libpulse")
-      (enableFeature sdlSupport "sdl2")
-      "--enable-libsoxr"
-      "--enable-libx264"
-      "--enable-libxvid"
-      "--enable-libzimg"
-      "--enable-zlib"
-      "--enable-libopus"
-      "--enable-libspeex"
-      "--enable-libx265"
-      (ifMinVer "4.2" (enableFeature (reqMin "4.2") "libdav1d"))
-    # Developer flags
-      (enableFeature debugDeveloper "debug")
-      (enableFeature optimizationsDeveloper "optimizations")
-      (enableFeature extraWarningsDeveloper "extra-warnings")
-      "--disable-stripping"
+  setOutputFlags = false; # Only accepts some of them
+  configureFlags = [
+    #mingw64 is internally treated as mingw32, so 32 and 64 make no difference here
+    "--target_os=${if stdenv.hostPlatform.isMinGW then "mingw64" else stdenv.hostPlatform.parsed.kernel.name}"
+    "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
+    "--pkg-config=${buildPackages.pkg-config.targetPrefix}pkg-config"
+    /*
+     *  Licensing flags
+     */
+    (enableFeature withGPL "gpl")
+    (enableFeature withGPLv3 "version3")
+    (enableFeature withUnfree "nonfree")
+    /*
+     *  Build flags
+     */
+    # On some ARM platforms --enable-thumb
+    "--enable-shared"
+    "--enable-pic"
+
+    (enableFeature withSmallBuild "small")
+    (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
+    (enableFeature withLTO "lto")
+    (enableFeature withGrayscale "gray")
+    (enableFeature withSwscaleAlpha "swscale-alpha")
+    (enableFeature withHardcodedTables "hardcoded-tables")
+    (enableFeature withSafeBitstreamReader "safe-bitstream-reader")
+
+    (enableFeature (withMultithread && stdenv.targetPlatform.isUnix) "pthreads")
+    (enableFeature (withMultithread && stdenv.targetPlatform.isWindows) "w32threads")
+    "--disable-os2threads" # We don't support OS/2
+
+    (enableFeature withNetwork "network")
+    (enableFeature withPixelutils "pixelutils")
+
+    "--datadir=${placeholder "data"}/share/ffmpeg"
+
+    /*
+     *  Program flags
+     */
+    (enableFeature buildFfmpeg "ffmpeg")
+    (enableFeature buildFfplay "ffplay")
+    (enableFeature buildFfprobe "ffprobe")
+  ] ++ optionals withBin [
+    "--bindir=${placeholder "bin"}/bin"
+  ] ++ [
+    /*
+     *  Library flags
+     */
+    (enableFeature buildAvcodec "avcodec")
+    (enableFeature buildAvdevice "avdevice")
+    (enableFeature buildAvfilter "avfilter")
+    (enableFeature buildAvformat "avformat")
+  ] ++ optionals (lib.versionOlder version "5") [
+    # Ffmpeg > 4 doesn't know about the flag anymore
+    (enableFeature buildAvresample "avresample")
+  ] ++ [
+    (enableFeature buildAvutil "avutil")
+    (enableFeature (buildPostproc && withGPL) "postproc")
+    (enableFeature buildSwresample "swresample")
+    (enableFeature buildSwscale "swscale")
+  ] ++ optionals withLib [
+    "--libdir=${placeholder "lib"}/lib"
+    "--incdir=${placeholder "dev"}/include"
+  ] ++ [
+    /*
+     *  Documentation flags
+     */
+    (enableFeature withDocumentation "doc")
+    (enableFeature withHtmlDoc "htmlpages")
+    (enableFeature withManPages "manpages")
+  ] ++ optionals withManPages [
+    "--mandir=${placeholder "man"}/share/man"
+  ] ++ [
+    (enableFeature withPodDoc "podpages")
+    (enableFeature withTxtDoc "txtpages")
+  ] ++ optionals withDoc [
+    "--docdir=${placeholder "doc"}/share/doc/ffmpeg"
+  ] ++ [
+    /*
+     *  External libraries
+     */
+    (enableFeature withAlsa "alsa")
+    (enableFeature withBzlib "bzlib")
+    (enableFeature withCelt "libcelt")
+    (enableFeature withCuda "cuda")
+    (enableFeature withCudaLLVM "cuda-llvm")
+    (enableFeature withDav1d "libdav1d")
+    (enableFeature withFdkAac "libfdk-aac")
+    "--disable-libflite" # Force disable until a solution is found
+    (enableFeature withFontconfig "fontconfig")
+    (enableFeature withFreetype "libfreetype")
+    (enableFeature withFrei0r "frei0r")
+    (enableFeature withFribidi "libfribidi")
+    (enableFeature withGme "libgme")
+    (enableFeature withGnutls "gnutls")
+    (enableFeature withGsm "libgsm")
+    (enableFeature withLadspa "ladspa")
+    (enableFeature withMp3lame "libmp3lame")
+    (enableFeature withAom "libaom")
+    (enableFeature withAss "libass")
+    (enableFeature withBluray "libbluray")
+    (enableFeature withBs2b "libbs2b")
+    (enableFeature withDc1394 "libdc1394")
+    (enableFeature withDrm "libdrm")
+    (enableFeature withIconv "iconv")
+    (enableFeature withJack "libjack")
+    (enableFeature withMfx "libmfx")
+    (enableFeature withModplug "libmodplug")
+    (enableFeature withMysofa "libmysofa")
+    (enableFeature withOpus "libopus")
+    (enableFeature withSvg "librsvg")
+    (enableFeature withSrt "libsrt")
+    (enableFeature withSsh "libssh")
+    (enableFeature withTheora "libtheora")
+    (enableFeature withV4l2 "libv4l2")
+    (enableFeature withV4l2M2m "v4l2-m2m")
+    (enableFeature withVaapi "vaapi")
+    (enableFeature withVdpau "vdpau")
+    (enableFeature withVorbis "libvorbis")
+    (enableFeature withVmaf "libvmaf")
+    (enableFeature withVpx "libvpx")
+    (enableFeature withWebp "libwebp")
+    (enableFeature withXlib "xlib")
+    (enableFeature withXcb "libxcb")
+    (enableFeature withXcbShm "libxcb-shm")
+    (enableFeature withXcbxfixes "libxcb-xfixes")
+    (enableFeature withXcbShape "libxcb-shape")
+    (enableFeature withXml2 "libxml2")
+    (enableFeature withLzma "lzma")
+    (enableFeature withNvdec "cuvid")
+    (enableFeature withNvdec "nvdec")
+    (enableFeature withNvenc "nvenc")
+    (enableFeature withOpenal "openal")
+    (enableFeature withOpencl "opencl")
+    (enableFeature withOpencoreAmrnb "libopencore-amrnb")
+    (enableFeature withOpengl "opengl")
+    (enableFeature withOpenh264 "libopenh264")
+    (enableFeature withOpenjpeg "libopenjpeg")
+    (enableFeature withOpenmpt "libopenmpt")
+    (enableFeature withPulse "libpulse")
+    (enableFeature withRav1e "librav1e")
+    (enableFeature withSvtav1 "libsvtav1")
+    (enableFeature withRtmp "librtmp")
+    (enableFeature withSdl2 "sdl2")
+    (enableFeature withSoxr "libsoxr")
+    (enableFeature withSpeex "libspeex")
+    (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
+    (enableFeature withVoAmrwbenc "libvo-amrwbenc")
+    (enableFeature withX264 "libx264")
+    (enableFeature withX265 "libx265")
+    (enableFeature withXavs "libxavs")
+    (enableFeature withXvid "libxvid")
+    (enableFeature withZmq "libzmq")
+    (enableFeature withZimg "libzimg")
+    (enableFeature withZlib "zlib")
+    (enableFeature withVulkan "vulkan")
+    (enableFeature withGlslang "libglslang")
+    (enableFeature withSamba "libsmbclient")
+    /*
+     * Developer flags
+     */
+    (enableFeature withDebug "debug")
+    (enableFeature withOptimisations "optimizations")
+    (enableFeature withExtraWarnings "extra-warnings")
+    (enableFeature withStripping "stripping")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "--cross-prefix=${stdenv.cc.targetPrefix}"
-      "--enable-cross-compile"
-  ] ++ optional stdenv.cc.isClang "--cc=clang");
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ addOpenGLRunpath perl pkg-config texinfo yasm ];
-
-  buildInputs = [
-    bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex nv-codec-headers
-  ] ++ optionals openglSupport [ libGL libGLU ]
-    ++ optional libmfxSupport intel-media-sdk
-    ++ optional libaomSupport libaom
-    ++ optional vpxSupport libvpx
-    ++ optionals (!stdenv.isDarwin && pulseaudioSupport) [ libpulseaudio ] # Need to be fixed on Darwin
-    ++ optionals vaapiSupport [ libva libdrm ]
-    ++ optional stdenv.isLinux alsa-lib
-    ++ optionals stdenv.isDarwin [ Cocoa CoreMedia VideoToolbox ]
-    ++ optional vdpauSupport libvdpau
-    ++ optional sdlSupport SDL2
-    ++ optional srtSupport srt
-    ++ optional (reqMin "4.2") dav1d;
+    "--cross-prefix=${stdenv.cc.targetPrefix}"
+    "--enable-cross-compile"
+    "--host-cc=${buildPackages.stdenv.cc}/bin/cc"
+  ] ++ optionals stdenv.cc.isClang [
+    "--cc=clang"
+    "--cxx=clang++"
+  ];
 
-  enableParallelBuilding = true;
+  # ffmpeg embeds the configureFlags verbatim in its binaries and because we
+  # configure binary, include, library dir etc., this causes references in
+  # outputs where we don't want them. Patch the generated config.h to remove all
+  # such references except for data.
+  postConfigure = let
+    toStrip = lib.remove "data" outputs; # We want to keep references to the data dir.
+  in
+    "remove-references-to ${lib.concatStringsSep " " (map (o: "-t ${placeholder o}") toStrip)} config.h";
 
-  inherit doCheck;
+  nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ];
+
+  # TODO This was always in buildInputs before, why?
+  buildInputs = optionals withFullDeps [ libdc1394 ]
+  ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
+  ++ optionals (withNvdec || withNvenc) [ nv-codec-headers ]
+  ++ optionals withAlsa [ alsa-lib ]
+  ++ optionals withAom [ libaom ]
+  ++ optionals withAss [ libass ]
+  ++ optionals withBluray [ libbluray ]
+  ++ optionals withBs2b [ libbs2b ]
+  ++ optionals withBzlib [ bzip2 ]
+  ++ optionals withCaca [ libcaca ]
+  ++ optionals withCelt [ celt ]
+  ++ optionals withCudaLLVM [ clang ]
+  ++ optionals withDav1d [ dav1d ]
+  ++ optionals withDrm [ libdrm ]
+  ++ optionals withFdkAac [ fdk_aac ]
+  ++ optionals withFontconfig [ fontconfig ]
+  ++ optionals withFreetype [ freetype ]
+  ++ optionals withFrei0r [ frei0r ]
+  ++ optionals withFribidi [ fribidi ]
+  ++ optionals withGlslang [ glslang ]
+  ++ optionals withGme [ game-music-emu ]
+  ++ optionals withGnutls [ gnutls ]
+  ++ optionals withGsm [ gsm ]
+  ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
+  ++ optionals withJack [ libjack2 ]
+  ++ optionals withLadspa [ ladspaH ]
+  ++ optionals withLzma [ xz ]
+  ++ optionals withMfx [ intel-media-sdk ]
+  ++ optionals withModplug [ libmodplug ]
+  ++ optionals withMp3lame [ lame ]
+  ++ optionals withMysofa [ libmysofa ]
+  ++ optionals withOgg [ libogg ]
+  ++ optionals withOpenal [ openal ]
+  ++ optionals withOpencl [ ocl-icd opencl-headers ]
+  ++ optionals withOpencoreAmrnb [ opencore-amr ]
+  ++ optionals withOpengl [ libGL libGLU ]
+  ++ optionals withOpenh264 [ openh264 ]
+  ++ optionals withOpenjpeg [ openjpeg ]
+  ++ optionals withOpenmpt [ libopenmpt ]
+  ++ optionals withOpus [ libopus ]
+  ++ optionals withPulse [ libpulseaudio ]
+  ++ optionals withRav1e [ rav1e ]
+  ++ optionals withRtmp [ rtmpdump ]
+  ++ optionals withSamba [ samba ]
+  ++ optionals withSdl2 [ SDL2 ]
+  ++ optionals withSoxr [ soxr ]
+  ++ optionals withSpeex [ speex ]
+  ++ optionals withSrt [ srt ]
+  ++ optionals withSsh [ libssh ]
+  ++ optionals withSvg [ librsvg ]
+  ++ optionals withSvtav1 [ svt-av1 ]
+  ++ optionals withTheora [ libtheora ]
+  ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
+  ++ optionals withVdpau [ libvdpau ]
+  ++ optionals withVidStab [ vid-stab ]
+  ++ optionals withVmaf [ libvmaf ]
+  ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
+  ++ optionals withVorbis [ libvorbis ]
+  ++ optionals withVpx [ libvpx ]
+  ++ optionals withV4l2 [ libv4l ]
+  ++ optionals withVulkan [ vulkan-loader ]
+  ++ optionals withWebp [ libwebp ]
+  ++ optionals withX264 [ x264 ]
+  ++ optionals withX265 [ x265 ]
+  ++ optionals withXavs [ xavs ]
+  ++ optionals withXcb [ libxcb ]
+  ++ optionals withXlib [ libX11 libXv libXext ]
+  ++ optionals withXml2 [ libxml2 ]
+  ++ optionals withXvid [ xvidcore ]
+  ++ optionals withZimg [ zimg ]
+  ++ optionals withZlib [ zlib ]
+  ++ optionals withZmq [ zeromq4 ]
+  ++ optionals stdenv.isDarwin [
+    # TODO fine-grained flags
+    AVFoundation
+    Cocoa
+    CoreAudio
+    CoreMedia
+    CoreServices
+    MediaToolbox
+    VideoDecodeAcceleration
+    VideoToolbox
+  ];
+
+  buildFlags = [ "all" ]
+    ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
+
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+
+  # Fails with SIGABRT otherwise FIXME: Why?
   checkPhase = let
     ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+    libsToLink = [ ]
+      ++ optional buildAvcodec "libavcodec"
+      ++ optional buildAvdevice "libavdevice"
+      ++ optional buildAvfilter "libavfilter"
+      ++ optional buildAvformat "libavformat"
+      ++ optional buildAvresample "libavresample"
+      ++ optional buildAvutil "libavutil"
+      ++ optional buildPostproc "libpostproc"
+      ++ optional buildSwresample "libswresample"
+      ++ optional buildSwscale "libswscale"
+    ;
   in ''
-    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavresample:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
-      make check -j$NIX_BUILD_CORES
+    ${ldLibraryPathEnv}="${lib.concatStringsSep ":" libsToLink}" make check -j$NIX_BUILD_CORES
+  '';
+
+  outputs = optionals withBin [ "bin" ] # The first output is the one that gets symlinked by default!
+    ++ optionals withLib [ "lib" "dev" ]
+    ++ optionals withDoc [ "doc" ]
+    ++ optionals withManPages [ "man" ]
+    ++ [ "data" "out" ] # We need an "out" output because we get an error otherwise. It's just an empty dir.
+  ;
+
+  postInstall = optionalString buildQtFaststart ''
+    install -D tools/qt-faststart -t $bin/bin
   '';
 
-  # ffmpeg 3+ generates pkg-config (.pc) files that don't have the
-  # form automatically handled by the multiple-outputs hooks.
-  postFixup = ''
-    moveToOutput bin "$bin"
-    moveToOutput share/ffmpeg/examples "$doc"
-    for pc in ''${!outputDev}/lib/pkgconfig/*.pc; do
-      substituteInPlace $pc \
-        --replace "includedir=$out" "includedir=''${!outputInclude}"
-    done
-  '' + optionalString stdenv.isLinux ''
-    # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
-    # See the explanation in addOpenGLRunpath.
+  # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
+  # See the explanation in addOpenGLRunpath.
+  postFixup = optionalString stdenv.isLinux ''
     addOpenGLRunpath $out/lib/libavcodec.so
     addOpenGLRunpath $out/lib/libavutil.so
   '';
 
-  installFlags = [ "install-man" ];
-
-  passthru = {
-    inherit vaapiSupport vdpauSupport;
-  };
+  enableParallelBuilding = true;
 
   meta = with lib; {
     description = "A complete, cross-platform solution to record, convert and stream audio and video";
@@ -212,9 +667,11 @@ stdenv.mkDerivation rec {
       No matter if they were designed by some standards committee, the community or
       a corporation.
     '';
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ ];
+    license = with licenses; [ lgpl21Plus ]
+      ++ optional withGPL gpl2Plus
+      ++ optional withGPLv3 gpl3Plus
+      ++ optional withUnfree unfreeRedistributable;
     platforms = platforms.all;
-    inherit branch knownVulnerabilities;
+    maintainers = with maintainers; [ atemu ];
   };
 }
diff --git a/pkgs/development/libraries/fizz/default.nix b/pkgs/development/libraries/fizz/default.nix
index 2addb5748263a..f00980cdd9be5 100644
--- a/pkgs/development/libraries/fizz/default.nix
+++ b/pkgs/development/libraries/fizz/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fizz";
-  version = "2023.01.30.00";
+  version = "2023.02.06.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "fizz";
     rev = "v${version}";
-    sha256 = "sha256-WyqDVoByBP91qGohNadr3iGpKEwZrURjr9mEaAdbfvs=";
+    sha256 = "sha256-JwRoIiSumT1jw5/VX/TkxpTJbrmLLke27xH8UHtrs2c=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index 61106d7f620e4..5400c1de59274 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -47,6 +47,15 @@ stdenv.mkDerivation rec {
     sha256 = "zd6A0VpJ2rmmFO+Y+ATIzm5M/hM5o8JAw08/tFQ2uF0=";
   };
 
+  patches = [
+    (fetchurl {
+      name = "libraw.patch";
+      url = "https://src.fedoraproject.org/cgit/rpms/gegl04.git/plain/"
+          + "libraw.patch?id=5efd0c16a7b0e73abcaecc48af544ef027f4531b";
+      hash = "sha256-ZgVigN1T7JmeBMwSdBsMsmXx0h7UW4Ft9HlSqeB0se8=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     gettext
diff --git a/pkgs/development/libraries/gloox/default.nix b/pkgs/development/libraries/gloox/default.nix
index 8fc57d865fd74..69243a13ef300 100644
--- a/pkgs/development/libraries/gloox/default.nix
+++ b/pkgs/development/libraries/gloox/default.nix
@@ -14,6 +14,13 @@ stdenv.mkDerivation rec{
     sha256 = "1jgrd07qr9jvbb5hcmhrqz4w4lvwc51m30jls1fgxf1f5az6455f";
   };
 
+  # needed since gcc12
+  postPatch = ''
+    sed '1i#include <ctime>' -i \
+      src/tests/{tag/tag_perf.cpp,zlib/zlib_perf.cpp} \
+      src/examples/*.cpp
+  '';
+
   buildInputs = [ ]
     ++ lib.optional zlibSupport zlib
     ++ lib.optional sslSupport openssl
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index 0d14630bda3b0..590a4508c9b91 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "gsl";
   version = "2.7.1";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnu/gsl/${pname}-${version}.tar.gz";
     sha256 = "sha256-3LD71DBIgyt1f/mUJpGo3XACbV2g/4VgHlJof23us0s=";
@@ -13,6 +15,10 @@ stdenv.mkDerivation rec {
     MACOSX_DEPLOYMENT_TARGET=10.16
   '' else null;
 
+  postInstall = ''
+    moveToOutput bin/gsl-config "$dev"
+  '';
+
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isx86_64 "-mno-fma";
 
diff --git a/pkgs/development/libraries/gsmlib/default.nix b/pkgs/development/libraries/gsmlib/default.nix
index ec6646d98f572..f993eeedc33b9 100644
--- a/pkgs/development/libraries/gsmlib/default.nix
+++ b/pkgs/development/libraries/gsmlib/default.nix
@@ -2,13 +2,21 @@
 stdenv.mkDerivation rec {
   pname = "gsmlib";
   version = "unstable-2017-10-06";
+
   src = fetchFromGitHub {
     owner = "x-logLT";
     repo = "gsmlib";
     rev = "4f794b14450132f81673f7d3570c5a859aecf7ae";
     sha256 = "16v8aj914ac1ipf14a867ljib3gy7fhzd9ypxnsg9l0zi8mm3ml5";
   };
+
   nativeBuildInputs = [ autoreconfHook ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   meta = with lib; {
     description = "Library to access GSM mobile phones through GSM modems";
     homepage = "https://github.com/x-logLT/gsmlib";
diff --git a/pkgs/development/libraries/gtest/default.nix b/pkgs/development/libraries/gtest/default.nix
index 049d202a71ec0..8e60c08d36009 100644
--- a/pkgs/development/libraries/gtest/default.nix
+++ b/pkgs/development/libraries/gtest/default.nix
@@ -19,7 +19,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ninja ];
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+  ] ++ lib.optionals (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0")) [
+    # Enable C++17 support
+    # https://github.com/google/googletest/issues/3081
+    "-DCMAKE_CXX_STANDARD=17"
+  ];
 
   meta = with lib; {
     description = "Google's framework for writing C++ tests";
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 782823cd67483..7a9904f31dab4 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -90,7 +90,6 @@ stdenv.mkDerivation rec {
   # Slightly hacky; some pkgs expect them in a single directory.
   postFixup = lib.optionalString withIcu ''
     rm "$out"/lib/libharfbuzz.* "$dev/lib/pkgconfig/harfbuzz.pc"
-    ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.la
     ln -s {'${harfbuzz.dev}',"$dev"}/lib/pkgconfig/harfbuzz.pc
     ${lib.optionalString stdenv.isDarwin ''
       ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.dylib
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index 66441a911607d..324b4337c874c 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, ncurses, readline, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "1.7.1";
+  version = "1.7.2";
   pname = "hunspell";
 
   src = fetchFromGitHub {
     owner = "hunspell";
     repo = "hunspell";
     rev = "v${version}";
-    sha256 = "sha256-J1kgNUElRO63mtU62qU7asf7hht9oyplMIO9I/E6BPU=";
+    sha256 = "sha256-x2FXxnVIqsf5/UEQcvchAndXBv/3mW8Z55djQAFgNA8=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/development/libraries/iqueue/default.nix b/pkgs/development/libraries/iqueue/default.nix
index 04fd7202d1d16..ab873f82c579a 100644
--- a/pkgs/development/libraries/iqueue/default.nix
+++ b/pkgs/development/libraries/iqueue/default.nix
@@ -12,6 +12,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libbsd microsoft_gsl ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-parameter"
+    "-Wno-error=misleading-indentation"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/twosigma/iqueue";
     description = "Indexed queue";
diff --git a/pkgs/development/libraries/irr1/default.nix b/pkgs/development/libraries/irr1/default.nix
index 8740919ce3ae2..ba4a99b2bb802 100644
--- a/pkgs/development/libraries/irr1/default.nix
+++ b/pkgs/development/libraries/irr1/default.nix
@@ -4,25 +4,25 @@
 , cmake
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
   pname = "irr1";
   version = "1.9.4";
 
   src = fetchFromGitHub {
     owner = "berndporr";
     repo = "iir1";
-    rev = version;
+    rev = self.version;
     hash = "sha256-T8gl51IkZIGq+6D5ge4Kb3wm5aw7Rhphmnf6TTGwHbs=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   meta = {
-    description = "A DSP IIR realtime filter library written in C++";
-    downloadPage = "https://github.com/berndporr/iir1";
     homepage = "http://berndporr.github.io/iir1/";
+    description = "A DSP IIR realtime filter library written in C++";
+    changelog = "https://github.com/berndporr/iir1/releases/tag/${self.version}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.AndersonTorres ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/jbig2enc/default.nix b/pkgs/development/libraries/jbig2enc/default.nix
new file mode 100644
index 0000000000000..26b21aa7c957f
--- /dev/null
+++ b/pkgs/development/libraries/jbig2enc/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, leptonica
+, zlib
+, libwebp
+, giflib
+, libjpeg
+, libpng
+, libtiff
+, autoreconfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "jbig2enc";
+  version = "0.29";
+
+  src = fetchFromGitHub {
+    owner = "agl";
+    repo = "jbig2enc";
+    rev = version;
+    hash = "sha256-IAL4egXgaGmCilzcryjuvOoHhahyrfGWY68GBfXXgAM=";
+  };
+
+  buildInputs = [ autoreconfHook ];
+  propagatedBuildInputs = [
+    leptonica
+    zlib
+    libwebp
+    giflib
+    libjpeg
+    libpng
+    libtiff
+  ];
+
+  patches = [
+    (fetchpatch {
+      name = "fix-build-leptonica-1.83.patch";
+      url = "https://github.com/agl/jbig2enc/commit/ea050190466f5336c69c6a11baa1cb686677fcab.patch";
+      hash = "sha256-+kScjFgDEU9F7VOUNAhm2XBjGm49fzAH8hYhmTm8xv8=";
+    })
+  ];
+
+  # This is necessary, because the resulting library has
+  # /tmp/nix-build-jbig2enc/src/.libs before /nix/store/jbig2enc/lib
+  # in its rpath, which means that patchelf --shrink-rpath removes
+  # the /nix/store one.  By cleaning up before fixup, we ensure that
+  # the /tmp/nix-build-jbig2enc/src/.libs directory is gone.
+  preFixup = ''
+    make clean
+  '';
+
+  meta = {
+    description = "Encoder for the JBIG2 image compression format";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    homepage = "https://github.com/agl/jbig2enc";
+  };
+}
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 22b29151caa5b..4caea890e7051 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "krb5-${version}/src";
 
+  postPatch = ''
+    substituteInPlace config/shlib.conf \
+        --replace "'ld " "'${stdenv.cc.targetPrefix}ld "
+  '';
+
   libFolders = [ "util" "include" "lib" "build-tools" ];
 
   buildPhase = lib.optionalString libOnly ''
diff --git a/pkgs/development/libraries/leptonica/default.nix b/pkgs/development/libraries/leptonica/default.nix
index 448a22f54997d..fd020603b523a 100644
--- a/pkgs/development/libraries/leptonica/default.nix
+++ b/pkgs/development/libraries/leptonica/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "leptonica";
-  version = "1.82.0";
+  version = "1.83.0";
 
   src = fetchurl {
     url = "http://www.leptonica.org/source/${pname}-${version}.tar.gz";
-    sha256 = "sha256-FVMC7pFGaMJ7b+PKn/LaY7JF9tYvMGHI8nVjd0uK4tY=";
+    sha256 = "sha256-IGWR3VjPhO84CDba0TO1jJ0a+SSR9amCXDRqFiBEvP4=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/libraries/libassuan/default.nix b/pkgs/development/libraries/libassuan/default.nix
index 3a00ca498cbe3..e2fbb3f9287cf 100644
--- a/pkgs/development/libraries/libassuan/default.nix
+++ b/pkgs/development/libraries/libassuan/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ npth gettext ];
 
   configureFlags = [
+    # Required for cross-compilation.
     "--with-libgpg-error-prefix=${libgpg-error.dev}"
   ];
 
diff --git a/pkgs/development/libraries/libbladeRF/default.nix b/pkgs/development/libraries/libbladeRF/default.nix
index 4b2c48824fb7c..e5e51a447b484 100644
--- a/pkgs/development/libraries/libbladeRF/default.nix
+++ b/pkgs/development/libraries/libbladeRF/default.nix
@@ -46,6 +46,11 @@ in stdenv.mkDerivation rec {
     "-DBLADERF_GROUP=bladerf"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   hardeningDisable = [ "fortify" ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index d03783f2fd903..11c8ce9e097ee 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-0/wvH07bJRKFwYnOARRJNzH8enIX3TNnWQnJdfpfvgE=";
   };
 
+  outputs = [ "out" "dev" "doc" ];
+
   postPatch = ''
     patchShebangs utils/
   '';
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 7abbd944ed014..8f8e33cbeab4d 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -13,28 +13,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "0.10.0";
+  version = "unstable-2023-01-29"; # Musl fix hasn't been released yet.
 
   src = fetchFromGitHub {
     owner = "PJK";
-    repo = finalAttrs.pname;
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-YJSIZ7o191/0QJf1fH6LUYykS2pvP17knSeRO2WcDeM=";
+    repo = "libcbor";
+    rev = "cb4162f40d94751141b4d43b07c4add83e738a68";
+    sha256 = "sha256-ZTa+wG1g9KsVoqJG/yqxo2fJ7OhPnaI9QcfOmpOT3pg=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-    "-DBUILD_SHARED_LIBS=on"
-  ] ++ lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON";
+  cmakeFlags = lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON"
+    ++ lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS=ON";
 
-  # 2 tests are not 32-bit clean: overflow size_t:
-  #   https://github.com/PJK/libcbor/issues/263
-  doCheck =
-    !stdenv.hostPlatform.is32bit
-    && (!stdenv.hostPlatform.isStatic)
+  # Tests are restricted while pkgsStatic.cmocka is broken. Tracked at:
+  # https://github.com/NixOS/nixpkgs/issues/213623
+  doCheck = !stdenv.hostPlatform.isStatic
     && stdenv.hostPlatform == stdenv.buildPlatform;
+
   nativeCheckInputs = [ cmocka ];
 
   passthru.tests = {
diff --git a/pkgs/development/libraries/libcli/default.nix b/pkgs/development/libraries/libcli/default.nix
index da076a590e19a..6e38c1ab84f13 100644
--- a/pkgs/development/libraries/libcli/default.nix
+++ b/pkgs/development/libraries/libcli/default.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "AR=${stdenv.cc.targetPrefix}ar" "PREFIX=$(out)" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+  ];
+
   meta = with lib; {
     description = "Emulate a Cisco-style telnet command-line interface";
     homepage = "http://sites.dparrish.com/libcli";
diff --git a/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch b/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
index e12b584d16ebe..19aa27b549c26 100644
--- a/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
+++ b/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
@@ -17,7 +17,7 @@ index 4486e7b2..be5b28b4 100644
  
  if test	"$DO_CHECK" = "yes"; then
 -	accepted_versions="1.2 1.4 2.0"
-+	accepted_versions="1.2 1.4 2.0 2.2 2.3"
++	accepted_versions="1.2 1.4 2.0 2.2 2.3 2.4"
  	AC_PATH_PROGS(GNUPG, [gpg gpg2], no)
  	AC_DEFINE_UNQUOTED(GNUPG, "$GNUPG", [Path to gpg executable.])
  	ok="no"
diff --git a/pkgs/development/libraries/libdatrie/default.nix b/pkgs/development/libraries/libdatrie/default.nix
index 257673b1a96d2..57d30124a6fd1 100644
--- a/pkgs/development/libraries/libdatrie/default.nix
+++ b/pkgs/development/libraries/libdatrie/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  buildInputs = [ libiconv ];
 
   preAutoreconf = let
     reports = "https://github.com/tlwg/libdatrie/issues";
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 18b8d6ba5d6fe..7cbcbe238ea16 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 
@@ -12,16 +13,25 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.9";
+  version = "1.0.10";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "sha256-OpiQapppuKCR27tIG5OW+KiNMP9ysv7CaobiBOW6VUI=";
+    sha256 = "sha256-d2TJKPvOAqLe+ZO1+Rd/yRIn3W1u1q62ZH20/9N2Shw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "revert-cmake-change-pkg-config.patch";
+      url = "https://github.com/strukturag/libde265/commit/388b61459c2abe2b949114ab54e83fb4dbfa8ba0.patch";
+      sha256 = "sha256-b6wwSvZpK7lIu0uD1SqK2zGBUjb/25+JW1Pf1fvHc0I=";
+      revert = true;
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libdynd/default.nix b/pkgs/development/libraries/libdynd/default.nix
index b418279e477b8..6018e00f944ec 100644
--- a/pkgs/development/libraries/libdynd/default.nix
+++ b/pkgs/development/libraries/libdynd/default.nix
@@ -15,14 +15,17 @@ stdenv.mkDerivation rec {
     "-DDYND_BUILD_BENCHMARKS=OFF"
   ];
 
-  # added to fix build with gcc7+
   NIX_CFLAGS_COMPILE = builtins.toString [
+    # added to fix build with gcc7+
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=nonnull"
     "-Wno-error=tautological-compare"
     "-Wno-error=class-memaccess"
     "-Wno-error=parentheses"
     "-Wno-error=deprecated-copy"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=maybe-uninitialized"
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libepoxy/default.nix b/pkgs/development/libraries/libepoxy/default.nix
index 196ac1afaae53..8b35097778de9 100644
--- a/pkgs/development/libraries/libepoxy/default.nix
+++ b/pkgs/development/libraries/libepoxy/default.nix
@@ -50,8 +50,10 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dtests=${if doCheck then "true" else "false"}"
+    "-Degl=${if x11Support then "yes" else "no"}"
     "-Dglx=${if x11Support then "yes" else "no"}"
+    "-Dtests=${lib.boolToString doCheck}"
+    "-Dx11=${lib.boolToString x11Support}"
   ];
 
   NIX_CFLAGS_COMPILE = lib.optionalString x11Support ''-DLIBGL_PATH="${getLib libGL}/lib"'';
diff --git a/pkgs/development/libraries/libfaketime/default.nix b/pkgs/development/libraries/libfaketime/default.nix
index ac501c660b02a..e58c74f2c6756 100644
--- a/pkgs/development/libraries/libfaketime/default.nix
+++ b/pkgs/development/libraries/libfaketime/default.nix
@@ -1,19 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, perl, coreutils }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "libfaketime";
-  version = "0.9.9";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "wolfcw";
     repo = "libfaketime";
     rev = "v${version}";
-    sha256 = "sha256-P1guVggteGtoq8+eeE966hDPkRwsn0m7oLCohyPrIb4=";
+    sha256 = "sha256-DYRuQmIhQu0CNEboBAtHOr/NnWxoXecuPMSR/UQ/VIQ=";
   };
 
   patches = [
-    ./no-date-in-gzip-man-page.patch
     ./nix-store-date.patch
+    (fetchpatch {
+      name = "0001-libfaketime.c-wrap-timespec_get-in-TIME_UTC-macro.patch";
+      url = "https://github.com/wolfcw/libfaketime/commit/e0e6b79568d36a8fd2b3c41f7214769221182128.patch";
+      sha256 = "sha256-KwwP76v0DXNW73p/YBvwUOPdKMAcVdbQSKexD/uFOYo=";
+    })
   ] ++ (lib.optionals stdenv.cc.isClang [
     # https://github.com/wolfcw/libfaketime/issues/277
     ./0001-Remove-unsupported-clang-flags.patch
diff --git a/pkgs/development/libraries/libfaketime/nix-store-date.patch b/pkgs/development/libraries/libfaketime/nix-store-date.patch
index b88245dfe8fbf..e93a7ec765070 100644
--- a/pkgs/development/libraries/libfaketime/nix-store-date.patch
+++ b/pkgs/development/libraries/libfaketime/nix-store-date.patch
@@ -13,9 +13,9 @@ index af618f2..48e47da 100644
 +++ b/src/faketime.c
 @@ -50,11 +50,7 @@
  
- const char version[] = "0.9.9";
+ const char version[] = "0.9.10";
  
--#ifdef __APPLE__
+-#if (defined __APPLE__) || (defined __sun)
 -static const char *date_cmd = "gdate";
 -#else
 -static const char *date_cmd = "date";
diff --git a/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch b/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch
deleted file mode 100644
index 7b7e362fbf0f8..0000000000000
--- a/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -ur libfaketime-0.9.5.orig/man/Makefile libfaketime-0.9.5/man/Makefile
---- libfaketime-0.9.5.orig/man/Makefile	2013-10-13 11:19:30.000000000 +0200
-+++ libfaketime-0.9.5/man/Makefile	2014-04-13 01:22:14.362296519 +0200
-@@ -6,7 +6,7 @@
- 
- install:
- 	$(INSTALL) -Dm0644 faketime.1 "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
--	gzip -f "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
-+	gzip -9nf "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
- 
- uninstall:
- 	rm -f "${DESTDIR}${PREFIX}/share/man/man1/faketime.1.gz"
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index bf43bb1b50e43..0b983e6edf41f 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "glvnd";
     repo = "libglvnd";
     rev = "v${version}";
-    sha256 = "sha256-yXSuG8UwD5KZbn4ysDStTdOGD4uHigjOhazlHT9ndNs=";
+    sha256 = "sha256-p/vLxagN9nCYw1JpUmZetgctQbrp3Wo33OVFrtvmnjQ=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config python3 addOpenGLRunpath ];
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index fcd7946a1351f..d8c5d87b16565 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -17,17 +17,22 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.45";
+  version = "1.46";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Vw+O5PtL/3t0lc/5IMJ1ACrqIUfpodIgwGghMmf4CiY=";
+    sha256 = "sha256-t+EaZCRrvl7zd0jeQ7JFq9cs/NU8muXn/FylnxyBJo0=";
   };
 
   postPatch = ''
     sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
   '';
 
+  configureFlags = [
+    # See https://dev.gnupg.org/T6257#164567
+    "--enable-install-gpg-error-config"
+  ];
+
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev"; # deps want just the lib, most likely
 
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index 3dddc02aeabdc..10a12dbfa7713 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -25,11 +25,11 @@ let
   ;
 in stdenv.mkDerivation rec {
   pname = "libpsl";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchurl {
     url = "https://github.com/rockdaboot/libpsl/releases/download/${version}/libpsl-${version}.tar.lz";
-    sha256 = "1a9kp2rj71jb9q030lmp3zhy33rqxscawbfzhp288fxvazapahv4";
+    sha256 = "sha256-qj1wbEUnhtE0XglNriAc022B8Dz4HWNtXPwQ02WQfxc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libraw/default.nix b/pkgs/development/libraries/libraw/default.nix
index 758b00febf5fc..26d7616ba8f00 100644
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, lcms2, pkg-config }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "libraw";
-  version = "0.20.2.p2";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "LibRaw";
     repo = "LibRaw";
-    rev = "fedad11e87daad7b7d389a3ef84ccf10b5e84710"; # current 0.20-stable branch
-    sha256 = "1mklf8lzybzyg75ja34822xlv6h9nw93griyrjjna7darl1dyvja";
+    rev = version;
+    sha256 = "sha256-K9mULf6V/TCl5Vu4iuIdSGF9HzQlgNQLRFHIpNbmAlY";
   };
 
   outputs = [ "out" "lib" "dev" "doc" ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others)";
     homepage = "https://www.libraw.org/";
-    license = licenses.gpl2Plus;
+    license = with licenses; [ cddl lgpl2Plus ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libraw/unstable.nix b/pkgs/development/libraries/libraw/unstable.nix
deleted file mode 100644
index 3f19bb53c4e64..0000000000000
--- a/pkgs/development/libraries/libraw/unstable.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ libraw, fetchFromGitHub }:
-
-libraw.overrideAttrs (_: rec {
-  version = "unstable-2021-12-03";
-
-  src = fetchFromGitHub {
-    owner = "LibRaw";
-    repo = "LibRaw";
-    rev = "52b2fc52e93a566e7e05eaa44cada58e3360b6ad";
-    sha256 = "kW0R4iPuqnFuWYDrl46ok3kaPcGgY2MqZT7mqVX+BDQ=";
-  };
-})
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index dd202d4a2954d..b1cb2fc4570c2 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh";
-  version = "0.10.0";
+  version = "0.10.4";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-DcFYxTTNg4rQt4WoLexYbeQNp+CWUjrmwIybe9KvC1c=";
+    sha256 = "sha256-BzksVKthR2KI0cHwp8VXtQIReXrQDDTDryu8TbxL2X0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 892ed71583d32..f2147632eb7c8 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitLab
+, fetchpatch
 , nix-update-script
 
 , autoreconfHook
@@ -38,6 +39,11 @@ stdenv.mkDerivation rec {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2022-48281.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5.diff";
+      sha256 = "sha256-FWUlyJyHXac6fuM5f9PG33kcF5Bm4fyFmYnaDal46iM=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libubox/default.nix b/pkgs/development/libraries/libubox/default.nix
index bb49ad4472cf4..cd8790c0e88e9 100644
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, lib, fetchgit, cmake, pkg-config, json_c }:
+{ stdenv, lib, fetchgit, cmake, pkg-config, json_c, with_lua ? false, lua5_1 }:
 
 stdenv.mkDerivation {
   pname = "libubox";
-  version = "unstable-2021-03-09";
+  version = "unstable-2023-01-03";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libubox.git";
-    rev = "551d75b5662cccd0466b990d58136bdf799a804d";
-    sha256 = "05cnjjqjv9nvrs1d8pg4xxxf27jryiv6xk8plmdpmm7r2wkvwn3r";
+    rev = "eac92a4d5d82eb31e712157e7eb425af728b2c43";
+    sha256 = "0w6mmwmd3ljhkqfk0qswq28dp63k30s3brlgf8lyi7vj7mrhvn3c";
   };
 
-  cmakeFlags = [ "-DBUILD_LUA=OFF" "-DBUILD_EXAMPLES=OFF" ];
+  cmakeFlags = [ "-DBUILD_EXAMPLES=OFF" (if with_lua then "-DLUAPATH=${placeholder "out"}/lib/lua" else "-DBUILD_LUA=OFF") ];
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ json_c ];
+  buildInputs = [ json_c ] ++ lib.optional with_lua lua5_1;
 
   meta = with lib; {
     description = "C utility functions for OpenWrt";
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 7da2c46fafe23..8c899268f7d1c 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -37,7 +37,8 @@ stdenv.mkDerivation rec {
         ./unistdio/test-u16-vasnprintf3.sh: line 16: ./test-u16-vasnprintf1: No such file or directory
         FAIL unistdio/test-u16-vasnprintf3.sh (exit status: 1)
   */
-  enableParallelBuilding = false;
+  enableParallelChecking = false;
+  enableParallelBuilding = true;
 
   meta = {
     homepage = "https://www.gnu.org/software/libunistring/";
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index a350cd378bce9..8a86bc46d4da2 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices, pkgsStatic }:
 
 stdenv.mkDerivation rec {
   version = "1.44.2";
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-K6v+00basjI32ON27ZjC5spQi/zWCcslDwQwyosq2iY=";
   };
 
+  patches = [
+    # Fix tests for statically linked variant upstream PR is
+    # https://github.com/libuv/libuv/pull/3735
+    (fetchpatch {
+      url = "https://github.com/libuv/libuv/commit/9d898acc564351dde74e9ed9865144e5c41f5beb.patch";
+      sha256 = "sha256-6XsjrseD8a+ny887EKOX0NmHocLMXGf2YL13vkNHUZ0=";
+    })
+  ];
+
   postPatch = let
     toDisable = [
       "getnameinfo_basic" "udp_send_hang_loop" # probably network-dependent
@@ -21,6 +30,10 @@ stdenv.mkDerivation rec {
       "get_passwd" # passed on NixOS but failed on other Linuxes
       "tcp_writealot" "udp_multicast_join" "udp_multicast_join6" # times out sometimes
       "fs_fstat" # https://github.com/libuv/libuv/issues/2235#issuecomment-1012086927
+
+      # Assertion failed in test/test-tcp-bind6-error.c on line 60: r == UV_EADDRINUSE
+      # Assertion failed in test/test-tcp-bind-error.c on line 99: r == UV_EADDRINUSE
+      "tcp_bind6_error_addrinuse" "tcp_bind_error_addrinuse_listen"
     ] ++ lib.optionals stdenv.isDarwin [
         # Sometimes: timeout (no output), failed uv_listen. Someone
         # should report these failures to libuv team. There tests should
@@ -66,6 +79,8 @@ stdenv.mkDerivation rec {
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
 
+  passthru.tests.static = pkgsStatic.libuv;
+
   meta = with lib; {
     description = "A multi-platform support library with a focus on asynchronous I/O";
     homepage    = "https://libuv.org/";
diff --git a/pkgs/development/libraries/libvisual/default.nix b/pkgs/development/libraries/libvisual/default.nix
index 3e61ee8a6a134..f32ee433694c4 100644
--- a/pkgs/development/libraries/libvisual/default.nix
+++ b/pkgs/development/libraries/libvisual/default.nix
@@ -1,18 +1,22 @@
-{ lib, stdenv, fetchurl, pkg-config, glib }:
+{ lib
+, stdenv
+, fetchurl
+, SDL
+, glib
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
   pname = "libvisual";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/libvisual/${pname}-${version}.tar.gz";
-    sha256 = "1my1ipd5k1ixag96kwgf07bgxkjlicy9w22jfxb2kq95f6wgsk8b";
+    hash = "sha256-qhKHdBf3bTZC2fTHIzAjgNgzF1Y51jpVZB0Bkopd230=";
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib ];
-
-  hardeningDisable = [ "format" ];
+  buildInputs = [ SDL glib ];
 
   configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index ca16063cca6b9..bbbceab3ab78a 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -8,11 +8,11 @@
 stdenv.mkDerivation rec {
   pname = "libvterm-neovim";
   # Releases are not tagged, look at commit history to find latest release
-  version = "0.3";
+  version = "0.3.1";
 
   src = fetchurl {
     url = "https://www.leonerd.org.uk/code/libvterm/libvterm-${version}.tar.gz";
-    sha256 = "sha256-YesNZijFK98CkA39RGiqhqGnElIourimcyiYGIdIM1g=";
+    sha256 = "sha256-JaitnBVIU2jf0Kip3KGuyP6lwn2j+nTsUY1dN4fww5c=";
   };
 
   nativeBuildInputs = [ perl libtool ];
diff --git a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
index 6578a86e35b1b..3997ceb623f38 100644
--- a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
+++ b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     "--with-x-locale-root=${libX11.out}/share/X11/locale"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   preBuild = lib.optionalString stdenv.isDarwin ''
     sed -i 's/,--version-script=.*$//' Makefile
   '';
diff --git a/pkgs/development/libraries/maplibre-gl-native/default.nix b/pkgs/development/libraries/maplibre-gl-native/default.nix
index 568f3fbe64e2f..8d6c0664ca131 100644
--- a/pkgs/development/libraries/maplibre-gl-native/default.nix
+++ b/pkgs/development/libraries/maplibre-gl-native/default.nix
@@ -9,6 +9,7 @@
 , libuv
 , glfw3
 , rapidjson
+, stdenv
 }:
 
 mkDerivation rec {
@@ -55,6 +56,11 @@ mkDerivation rec {
     "-DMBGL_WITH_QT_HEADLESS=OFF"
   ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=use-after-free"
+  ];
+
   meta = with lib; {
     description = "Open-source alternative to Mapbox GL Native";
     homepage = "https://maplibre.org/";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 56fa74e5c0c51..52633a6d21649 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -28,9 +28,9 @@
       "tegra" # Nvidia Tegra SoCs
       "v3d" # Broadcom VC5 (Raspberry Pi 4)
       "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
-    ] ++ lib.optionals stdenv.isx86_64 [
-      "iris" # new Intel, could work on non-x86_64 with PCIe cards, but doesn't build as of 22.3.4
-      "crocus" # Intel legacy, x86_64 only
+    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+      "iris" # new Intel, could work on non-x86 with PCIe cards, but doesn't build as of 22.3.4
+      "crocus" # Intel legacy, x86 only
     ]
   else [ "auto" ]
 , vulkanDrivers ?
@@ -326,10 +326,6 @@ self = stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [ "-fno-common" ] ++ lib.optionals enableOpenCL [
     "-UPIPE_SEARCH_DIR"
     "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
-
-    # Work around regression from https://github.com/NixOS/nixpkgs/pull/210004
-    # TODO(trofi): remove
-    "--sysroot=/"
   ];
 
   passthru = {
diff --git a/pkgs/development/libraries/newt/default.nix b/pkgs/development/libraries/newt/default.nix
index 6114c4c70d0f7..3ba07c7b5be9a 100644
--- a/pkgs/development/libraries/newt/default.nix
+++ b/pkgs/development/libraries/newt/default.nix
@@ -5,11 +5,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "newt";
-  version = "0.52.21";
+  version = "0.52.23";
 
   src = fetchurl {
     url = "https://releases.pagure.org/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0cdvbancr7y4nrj8257y5n45hmhizr8isynagy4fpsnpammv8pi6";
+    sha256 = "sha256-yqNykHsU7Oz+KY8NUSpi9B0zspBhAkSliu0Hu8WtoSo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/nss_wrapper/default.nix b/pkgs/development/libraries/nss_wrapper/default.nix
index a6974295690ec..324c5269dfbc2 100644
--- a/pkgs/development/libraries/nss_wrapper/default.nix
+++ b/pkgs/development/libraries/nss_wrapper/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nss_wrapper";
-  version = "1.1.12";
+  version = "1.1.15";
 
   src = fetchurl {
     url = "mirror://samba/cwrap/nss_wrapper-${version}.tar.gz";
-    sha256 = "sha256-zdBg/wnAO32i0wsMta00dSNNQ4rqJ5A9slwvFvVwIYY=";
+    sha256 = "sha256-Nvh0gypPIVjgT2mqd+VRXhbPbjv4GWjV3YSW231pBq0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/octomap/default.nix b/pkgs/development/libraries/octomap/default.nix
index 9b1635511ec62..5a2064eb595dc 100644
--- a/pkgs/development/libraries/octomap/default.nix
+++ b/pkgs/development/libraries/octomap/default.nix
@@ -10,10 +10,16 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     hash = "sha256-qE5i4dGugm7tR5tgDCpbla/R7hYR/PI8BzrZQ4y6Yz8=";
   };
+
   sourceRoot = "source/octomap";
 
   nativeBuildInputs = [ cmake ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
   meta = with lib; {
     description = "A probabilistic, flexible, and compact 3D mapping library for robotic systems";
     homepage = "https://octomap.github.io/";
diff --git a/pkgs/development/libraries/openbabel/2.nix b/pkgs/development/libraries/openbabel/2.nix
index 3e989561470c6..0cc752d993fb2 100644
--- a/pkgs/development/libraries/openbabel/2.nix
+++ b/pkgs/development/libraries/openbabel/2.nix
@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i include/openbabel/obutil.h # gcc12
+  '';
+
   buildInputs = [ zlib libxml2 eigen python3 cairo pcre ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/openbabel/default.nix b/pkgs/development/libraries/openbabel/default.nix
index a23382d3f892b..fe12bbffa531d 100644
--- a/pkgs/development/libraries/openbabel/default.nix
+++ b/pkgs/development/libraries/openbabel/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wQpgdfCyBAoh4pmj9j7wPTlMtraJ62w/EShxi/olVMY=";
   };
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i include/openbabel/obutil.h # gcc12
+  '';
+
   buildInputs = [ zlib libxml2 eigen python cairo pcre swig rapidjson ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 2c676e008f00d..4a9af9a5388fb 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -15,6 +15,7 @@
 , ocl-icd
 , buildPackages
 , qimgv
+, opencv4
 
 , enableJPEG ? true
 , libjpeg
@@ -31,8 +32,8 @@
 , openjpeg
 , enableEigen ? true
 , eigen
-, enableOpenblas ? true
-, openblas
+, enableBlas ? true
+, blas
 , enableContrib ? true
 
 , enableCuda ? (config.cudaSupport or false) && stdenv.hostPlatform.isx86_64
@@ -74,6 +75,7 @@
 , CoreMedia
 , MediaToolbox
 , bzip2
+, callPackage
 }:
 
 let
@@ -93,6 +95,13 @@ let
     sha256 = "sha256-meya0J3RdOIeMM46e/6IOVwrKn3t/c0rhwP2WQaybkE=";
   };
 
+  testDataSrc = fetchFromGitHub {
+    owner = "opencv";
+    repo = "opencv_extra";
+    rev = version;
+    sha256 = "sha256-6hAdJdaUgtRGQanQKuY/q6fcXWXFZ3K/oLbGxvksry0=";
+  };
+
   # Contrib must be built in order to enable Tesseract support:
   buildContrib = enableContrib || enableTesseract || enableOvis;
 
@@ -171,10 +180,10 @@ let
   ade = rec {
     src = fetchurl {
       url = "https://github.com/opencv/ade/archive/${name}";
-      sha256 = "04n9na2bph706bdxnnqfcbga4cyj8kd9s9ni7qyvnpj5v98jwvlm";
+      sha256 = "sha256-TjLRbFbC7MDY9PxIy560ryviBI58cbQwqgc7A7uOHkg=";
     };
-    name = "v0.1.1f.zip";
-    md5 = "b624b995ec9c439cbc2e9e6ee940d3a2";
+    name = "v0.1.2a.zip";
+    md5 = "fa4b3e25167319cb0fa9432ef8281945";
     dst = ".cache/ade";
   };
 
@@ -208,13 +217,24 @@ let
 
   opencvFlag = name: enabled: "-DWITH_${name}=${printEnabled enabled}";
 
+  runAccuracyTests = true;
+  runPerformanceTests = false;
   printEnabled = enabled: if enabled then "ON" else "OFF";
+  withOpenblas = (enableBlas && blas.provider.pname == "openblas");
+  #multithreaded openblas conflicts with opencv multithreading, which manifest itself in hung tests
+  #https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+  openblas_ = blas.provider.override { singleThreaded = true; };
 in
 
 stdenv.mkDerivation {
   pname = "opencv";
   inherit version src;
 
+  outputs = [
+    "out"
+    "package_tests"
+  ];
+
   postUnpack = lib.optionalString buildContrib ''
     cp --no-preserve=mode -r "${contribSrc}/modules" "$NIX_BUILD_TOP/source/opencv_contrib"
   '';
@@ -263,12 +283,12 @@ stdenv.mkDerivation {
     ++ lib.optional enableFfmpeg ffmpeg
     ++ lib.optionals (enableFfmpeg && stdenv.isDarwin)
       [ VideoDecodeAcceleration bzip2 ]
-    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base ])
+    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ])
     ++ lib.optional enableOvis ogre
     ++ lib.optional enableGPhoto2 libgphoto2
     ++ lib.optional enableDC1394 libdc1394
     ++ lib.optional enableEigen eigen
-    ++ lib.optional enableOpenblas openblas
+    ++ lib.optional enableBlas blas.provider
     # There is seemingly no compile-time flag for Tesseract.  It's
     # simply enabled automatically if contrib is built, and it detects
     # tesseract & leptonica.
@@ -290,7 +310,8 @@ stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
-  OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
+  OpenBLAS_HOME = lib.optionalString withOpenblas openblas_.dev;
+  OpenBLAS = lib.optionalString withOpenblas openblas_;
 
   cmakeFlags = [
     "-DOPENCV_GENERATE_PKGCONFIG=ON"
@@ -299,8 +320,9 @@ stdenv.mkDerivation {
     "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf}"
     "-DPROTOBUF_UPDATE_FILES=ON"
     "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
-    "-DBUILD_TESTS=OFF"
-    "-DBUILD_PERF_TESTS=OFF"
+    "-DBUILD_TESTS=${printEnabled runAccuracyTests}"
+    "-DBUILD_PERF_TESTS=${printEnabled runPerformanceTests}"
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
     "-DBUILD_DOCS=${printEnabled enableDocs}"
     # "OpenCV disables pkg-config to avoid using of host libraries. Consider using PKG_CONFIG_LIBDIR to specify target SYSROOT"
     # but we have proper separation of build and host libs :), fixes cross
@@ -334,6 +356,14 @@ stdenv.mkDerivation {
     make doxygen
   '';
 
+  preInstall =
+    lib.optionalString (runAccuracyTests || runPerformanceTests) ''
+    mkdir $package_tests
+    cp -R $src/samples $package_tests/
+    ''
+    + lib.optionalString runAccuracyTests "mv ./bin/*test* $package_tests/ \n"
+    + lib.optionalString runPerformanceTests "mv ./bin/*perf* $package_tests/";
+
   # By default $out/lib/pkgconfig/opencv4.pc looks something like this:
   #
   #   prefix=/nix/store/g0wnfyjjh4rikkvp22cpkh41naa43i4i-opencv-4.0.0
@@ -368,16 +398,23 @@ stdenv.mkDerivation {
 
   passthru = {
     tests = {
-      inherit qimgv;
       inherit (gst_all_1) gst-plugins-bad;
-    } // lib.optionalAttrs (!enablePython) { pythonEnabled = pythonPackages.opencv4; };
+    }
+    // lib.optionalAttrs (!stdenv.isDarwin) { inherit qimgv; }
+    // lib.optionalAttrs (!enablePython) { pythonEnabled = pythonPackages.opencv4; }
+    // lib.optionalAttrs (stdenv.buildPlatform != "x86_64-darwin") {
+      opencv4-tests = callPackage ./tests.nix {
+        inherit enableGStreamer enableGtk2 enableGtk3 runAccuracyTests runPerformanceTests testDataSrc;
+        inherit opencv4;
+        };
+      };
   } // lib.optionalAttrs enablePython { pythonPath = [ ]; };
 
   meta = with lib; {
     description = "Open Computer Vision Library with more than 500 algorithms";
     homepage = "https://opencv.org/";
     license = with licenses; if enableUnfree then unfree else bsd3;
-    maintainers = with maintainers; [ mdaiter basvandijk ];
+    maintainers = with maintainers; [ basvandijk ];
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/libraries/opencv/tests.nix b/pkgs/development/libraries/opencv/tests.nix
new file mode 100644
index 0000000000000..5a155a9119b05
--- /dev/null
+++ b/pkgs/development/libraries/opencv/tests.nix
@@ -0,0 +1,70 @@
+{ opencv4
+, testDataSrc
+, stdenv
+, lib
+, runCommand
+, gst_all_1
+, runAccuracyTests
+, runPerformanceTests
+, enableGStreamer
+, enableGtk2
+, enableGtk3
+, xvfb-run
+}:
+let
+  testNames = [
+    "calib3d"
+    "core"
+    "features2d"
+    "flann"
+    "imgcodecs"
+    "imgproc"
+    "ml"
+    "objdetect"
+    "photo"
+    "stitching"
+    "video"
+    #"videoio" # - a lot of GStreamer warnings and failed tests
+    #"dnn" #- some caffe tests failed, probably because github workflow also downloads additional models
+  ] ++ lib.optionals (!stdenv.isAarch64 && enableGStreamer) [ "gapi" ]
+  ++ lib.optionals (enableGtk2 || enableGtk3) [ "highgui" ];
+  perfTestNames = [
+    "calib3d"
+    "core"
+    "features2d"
+    "imgcodecs"
+    "imgproc"
+    "objdetect"
+    "photo"
+    "stitching"
+    "video"
+  ] ++ lib.optionals (!stdenv.isAarch64 && enableGStreamer) [ "gapi" ];
+  testRunner = if stdenv.isDarwin then "" else "${lib.getExe xvfb-run} -a ";
+  testsPreparation = ''
+    touch $out
+    # several tests want a write access, so we have to copy files
+    tmpPath="$(mktemp -d "/tmp/opencv_extra_XXXXXX")"
+    cp -R ${testDataSrc} $tmpPath/opencv_extra
+    chmod -R +w $tmpPath/opencv_extra
+    export OPENCV_TEST_DATA_PATH="$tmpPath/opencv_extra/testdata"
+    export OPENCV_SAMPLES_DATA_PATH="${opencv4.package_tests}/samples/data"
+
+    #ignored tests because of gtest error - "Test code is not available due to compilation error with GCC 11"
+    export GTEST_FILTER="-AsyncAPICancelation/cancel*"
+  '';
+  accuracyTests = lib.optionalString runAccuracyTests ''
+    ${ builtins.concatStringsSep "\n"
+      (map (test: "${testRunner}${opencv4.package_tests}/opencv_test_${test} --test_threads=$NIX_BUILD_CORES --gtest_filter=$GTEST_FILTER" ) testNames)
+    }
+  '';
+  perfomanceTests = lib.optionalString runPerformanceTests ''
+    ${ builtins.concatStringsSep "\n"
+      (map (test: "${testRunner}${opencv4.package_tests}/opencv_perf_${test} --perf_impl=plain --perf_min_samples=10 --perf_force_samples=10 --perf_verify_sanity --skip_unstable=1 --gtest_filter=$GTEST_FILTER") perfTestNames)
+    }
+  '';
+in
+runCommand "opencv4-tests"
+{
+  nativeBuildInputs = lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ]);
+}
+  (testsPreparation + accuracyTests + perfomanceTests)
diff --git a/pkgs/development/libraries/opendbx/default.nix b/pkgs/development/libraries/opendbx/default.nix
index 0460f012424c3..ce8064cdc1eb9 100644
--- a/pkgs/development/libraries/opendbx/default.nix
+++ b/pkgs/development/libraries/opendbx/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline libmysqlclient postgresql sqlite ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "Extremely lightweight but extensible database access library written in C";
diff --git a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch b/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
deleted file mode 100644
index 2acedda0e3a49..0000000000000
--- a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001
-From: Pauli <pauli@openssl.org>
-Date: Fri, 11 Nov 2022 09:40:19 +1100
-Subject: [PATCH] x509: fix double locking problem
-
-This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the
-redundant flag setting.
-
-Fixes #19643
-
-Fixes LOW CVE-2022-3996
-
-Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/19652)
-
-(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5)
----
- crypto/x509/pcy_map.c | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c
-index 05406c6493fc..60dfd1e3203b 100644
---- a/crypto/x509/pcy_map.c
-+++ b/crypto/x509/pcy_map.c
-@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
- 
-     ret = 1;
-  bad_mapping:
--    if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) {
--        x->ex_flags |= EXFLAG_INVALID_POLICY;
--        CRYPTO_THREAD_unlock(x->lock);
--    }
-     sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
-     return ret;
- 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 4c322997963a6..488613fd489ae 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -216,8 +216,8 @@ in {
 
 
   openssl_1_1 = common {
-    version = "1.1.1s";
-    sha256 = "sha256-xawB52Dub/Dath1rK70wFGck0GPrMiGAxvGKb3Tktqo=";
+    version = "1.1.1t";
+    sha256 = "sha256-je6bJL2x3L8MPR6bAvuPa/IhZegH9Fret8lndTaFnTs=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -229,8 +229,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.7";
-    sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4=";
+    version = "3.0.8";
+    sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
@@ -241,9 +241,6 @@ in {
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
-
-       # Remove with 3.0.8 release
-       ./3.0/CVE-2022-3996.patch
     ];
 
     withDocs = true;
diff --git a/pkgs/development/libraries/physics/clhep/default.nix b/pkgs/development/libraries/physics/clhep/default.nix
index a8d853a23b044..b3ba508220f50 100644
--- a/pkgs/development/libraries/physics/clhep/default.nix
+++ b/pkgs/development/libraries/physics/clhep/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clhep";
-  version = "2.4.6.3";
+  version = "2.4.6.4";
 
   src = fetchurl {
     url = "https://proj-clhep.web.cern.ch/proj-clhep/dist1/clhep-${version}.tgz";
-    hash = "sha256-/NAH8RsQukryjQJyIrYxSNDrRP96CC7uNTvfkh+caEo=";
+    hash = "sha256-SciTMPGQPvcH08XXnBanxabyyQ/CkOIDTuODSAlInlc=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/libraries/pico-sdk/default.nix b/pkgs/development/libraries/pico-sdk/default.nix
index 991d2e661f144..8b5f33599cd2c 100644
--- a/pkgs/development/libraries/pico-sdk/default.nix
+++ b/pkgs/development/libraries/pico-sdk/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pico-sdk";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = pname;
     rev = version;
-    sha256 = "sha256-i3IAaNcd0EfKNvU104a776O1poDAChlx1m+nP8iFn8E=";
+    sha256 = "sha256-p69go8KXQR21szPb+R1xuonyFj+ZJDunNeoU7M3zIsE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 8da35364e2b83..53d465542b2bd 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -109,8 +109,16 @@ let
         url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/fba7083f8ceb210c7c20aceafeb5c9a8767cf705.patch";
         hash = "sha256-aZQ4OzK0B5YPq+jQNygxPE0coG2qB0ukbYzyI8E24XM=";
       })
+
+      # backport a fix for rust-cbindgen errors in downstream packages
+      # See https://github.com/NixOS/nixpkgs/pull/211872#issuecomment-1415981135 for details.
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/caf58ecffb4dc8e2bfa7898d0ed910cf0a82d65f.patch";
+        hash = "sha256-kCQNG0j3lwT01WNfGsdUmKvDHg8tvMfS2eunPyXBV1E=";
+      })
     ];
 
+    strictDeps = true;
     nativeBuildInputs = [
       docutils
       doxygen
@@ -119,6 +127,7 @@ let
       ninja
       pkg-config
       python3
+      glib
     ];
 
     buildInputs = [
diff --git a/pkgs/development/libraries/qcoro/default.nix b/pkgs/development/libraries/qcoro/default.nix
index 4a288702e2f29..fb5c7570b75ba 100644
--- a/pkgs/development/libraries/qcoro/default.nix
+++ b/pkgs/development/libraries/qcoro/default.nix
@@ -1,5 +1,5 @@
 { stdenv
-, gcc11Stdenv
+, gcc12Stdenv
 , lib
 , fetchFromGitHub
 , cmake
@@ -9,7 +9,7 @@
 , wrapQtAppsHook
 }:
 
-gcc11Stdenv.mkDerivation rec {
+gcc12Stdenv.mkDerivation rec {
   pname = "qcoro";
   version = "0.7.0";
 
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 2829bb0be0278..7d876d884b374 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -64,6 +64,12 @@ let
         extraPrefix = "src/3rdparty/";
         hash = "sha256-MZGYeMdGzwypfKoSUaa56K3inbcGRx7he/+AFyk5ekA=";
       })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/Homebrew/formula-patches/7ae178a617d1e0eceb742557e63721af949bd28a/qt5/qt5-webengine-gcc12.patch";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/";
+        hash = "sha256-s4GsGMJTBNWw2gTJuIEP3tqT82AmTsR2mbj59m2p6rM=";
+      })
     ] ++ lib.optionals stdenv.isDarwin [
       ./qtwebengine-darwin-no-platform-check.patch
       ./qtwebengine-mac-dont-set-dsymutil-path.patch
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 19f36c337e5c0..0603ae077e478 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -42,7 +42,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
   qtwebengine =
     let
-      branchName = "5.15.11";
+      branchName = "5.15.12";
       rev = "v${branchName}-lts";
     in
     {
@@ -50,7 +50,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
       src = fetchgit {
         url = "https://github.com/qt/qtwebengine.git";
-        sha256 = "sha256-yrKPof18G10VjrwCn/4E/ywlpATJQZjvmVeM+9hLY0U=";
+        sha256 = "sha256-8EQqSvxw9rqf+64CIbcCb1VXhNx1GNC8eDIgLyYDyvk=";
         inherit rev branchName;
         fetchSubmodules = true;
         leaveDotGit = true;
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 40b927ff0b8f5..79cd1b86fadb7 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -40,8 +40,16 @@ stdenv.mkDerivation rec {
     "tools"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move"
-    + lib.optionalString stdenv.cc.isClang "-Wno-error=unused-private-field -faligned-allocation";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    "-Wno-error=deprecated-copy"
+    "-Wno-error=pessimizing-move"
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=unused-private-field"
+    "-faligned-allocation"
+  ];
 
   cmakeFlags = [
     "-DPORTABLE=1"
diff --git a/pkgs/development/libraries/rocm-device-libs/default.nix b/pkgs/development/libraries/rocm-device-libs/default.nix
index 3fba6da7f537e..fa60a4d3f9e46 100644
--- a/pkgs/development/libraries/rocm-device-libs/default.nix
+++ b/pkgs/development/libraries/rocm-device-libs/default.nix
@@ -14,7 +14,7 @@ let
     else throw "Unsupported ROCm LLVM platform";
 in stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-device-libs";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/libraries/roctracer/default.nix b/pkgs/development/libraries/roctracer/default.nix
index ee844bb417ba9..87cf7d0819ad1 100644
--- a/pkgs/development/libraries/roctracer/default.nix
+++ b/pkgs/development/libraries/roctracer/default.nix
@@ -62,6 +62,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   postPatch = ''
     export HIP_DEVICE_LIB_PATH=${rocm-device-libs}/amdgcn/bitcode
   '' + lib.optionalString (!buildTests) ''
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index f9a12322c47bf..afb8722874131 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.34";
+  version = "1.3.36";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CaVo2OxfB7ImMOgPuyvKQFbTeEm3PqD8CV96jUEZ8U0=";
+    sha256 = "sha256-IL7+f+7Igvm7KeBpDwnIoIB8IUqg3JDEtLFQslBIENE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
index c4faadd2a5eb9..7144a17c18b40 100644
--- a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
@@ -48,6 +48,8 @@ stdenv.mkDerivation rec {
         --replace "/etc/udev/rules.d" "lib/udev/rules.d" \
         --replace "/lib/firmware" "lib/firmware"
     done
+
+    sed '1i#include <ctime>' -i indi-duino/libfirmata/src/firmata.cpp # gcc12
   '';
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/science/math/sympow/default.nix b/pkgs/development/libraries/science/math/sympow/default.nix
index c31c705d39d0a..09ca356ccdc5b 100644
--- a/pkgs/development/libraries/science/math/sympow/default.nix
+++ b/pkgs/development/libraries/science/math/sympow/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitLab
+, fetchpatch
 , makeWrapper
 , which
 , autoconf
@@ -20,7 +21,14 @@ stdenv.mkDerivation rec {
     sha256 = "132l0xv00ld1svvv9wh99wfra4zzjv2885h2sq0dsl98wiyvi5zl";
   };
 
-  patches = [ ./clean-extra-logfile-output-from-pari.patch ];
+  patches = [
+    ./clean-extra-logfile-output-from-pari.patch
+    (fetchpatch {
+      name = "null-terminate-dupdirname.patch";
+      url = "https://gitlab.com/rezozer/forks/sympow/-/merge_requests/5.diff";
+      sha256 = "sha256-yKjio+qN9teL8L+mb7WOBN/iv545vRIxW20FJU37oO4=";
+    })
+  ];
 
   postUnpack = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/stfl/default.nix b/pkgs/development/libraries/stfl/default.nix
index 1ed1a05004b68..845e815be5902 100644
--- a/pkgs/development/libraries/stfl/default.nix
+++ b/pkgs/development/libraries/stfl/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1460d5lc780p3q38l3wc9jfr2a7zlyrcra0li65aynj738cam9yl";
   };
 
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
   buildInputs = [ ncurses libiconv ];
 
   preBuild = ''
@@ -16,12 +18,22 @@ stdenv.mkDerivation rec {
     sed -i s%ncursesw/ncurses.h%ncurses.h% stfl_internals.h
   '' + lib.optionalString stdenv.isDarwin ''
     sed -i s/-soname/-install_name/ Makefile
-  '';
+  ''
+  # upstream builds shared library unconditionally. Also, it has no
+  # support for cross-compilation.
+  + lib.optionalString stdenv.hostPlatform.isStatic ''
+    sed -i 's/all:.*/all: libstfl.a stfl.pc/' Makefile
+    sed -i 's/\tar /\t${stdenv.cc.targetPrefix}ar /' Makefile
+    sed -i 's/\tranlib /\t${stdenv.cc.targetPrefix}ranlib /' Makefile
+    sed -i '/install -m 644 libstfl.so./d' Makefile
+    sed -i '/ln -fs libstfl.so./d' Makefile
+  '' ;
 
   installPhase = ''
     DESTDIR=$out prefix=\"\" make install
-
-    # some programs rely on libstfl.so.0 to be present, so link it
+  ''
+  # some programs rely on libstfl.so.0 to be present, so link it
+  + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
     ln -s $out/lib/libstfl.so.0.24 $out/lib/libstfl.so.0
   '';
 
diff --git a/pkgs/development/libraries/swiftshader/default.nix b/pkgs/development/libraries/swiftshader/default.nix
index 2c508a3735f96..28aabc03682be 100644
--- a/pkgs/development/libraries/swiftshader/default.nix
+++ b/pkgs/development/libraries/swiftshader/default.nix
@@ -13,6 +13,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 jq ];
   buildInputs = [ libX11 libXext zlib ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=uninitialized"
+  ];
+
   # Make sure we include the drivers and icd files in the output as the cmake
   # generated install command only puts in the spirv-tools stuff.
   installPhase = ''
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index 21fddb1656270..e0c48bc6dcefb 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
   pname = "tbb";
   version = "2020.3";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneTBB";
diff --git a/pkgs/development/libraries/thrift/default.nix b/pkgs/development/libraries/thrift/default.nix
index 76d8cc2ff54e8..92063eb1400ae 100644
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@@ -36,11 +36,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     boost
+  ] ++ lib.optionals (!static) [
+    (python3.withPackages (ps: [ps.twisted]))
+  ];
+
+  propagatedBuildInputs = [
     libevent
     openssl
     zlib
-  ] ++ lib.optionals (!static) [
-    (python3.withPackages (ps: [ps.twisted]))
   ];
 
   postPatch = ''
@@ -66,6 +69,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/apache/thrift/commit/c41ad9d5119e9bdae1746167e77e224f390f2c42.diff";
       hash = "sha256-FkErrg/6vXTomS4AsCsld7t+Iccc55ZiDaNjJ3W1km0=";
     })
+    (fetchpatch {
+      name = "thrift-install-FindLibevent.patch"; # https://github.com/apache/thrift/pull/2726
+      url = "https://github.com/apache/thrift/commit/2ab850824f75d448f2ba14a468fb77d2594998df.diff";
+      hash = "sha256-ejMKFG/cJgoPlAFzVDPI4vIIL7URqaG06/IWdQ2NkhY=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/unittest-cpp/default.nix b/pkgs/development/libraries/unittest-cpp/default.nix
index 6f27a71b3ee46..e9f67a74f9a3e 100644
--- a/pkgs/development/libraries/unittest-cpp/default.nix
+++ b/pkgs/development/libraries/unittest-cpp/default.nix
@@ -1,4 +1,9 @@
-{lib, stdenv, fetchFromGitHub, cmake}:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+}:
 
 stdenv.mkDerivation rec {
   pname = "unittest-cpp";
@@ -11,6 +16,14 @@ stdenv.mkDerivation rec {
     sha256 = "0sxb3835nly1jxn071f59fwbdzmqi74j040r81fanxyw3s1azw0i";
   };
 
+  patches = [
+    # GCC12 Patch
+    (fetchpatch {
+      url = "https://github.com/unittest-cpp/unittest-cpp/pull/185/commits/f361c2a1034c02ba8059648f9a04662d6e2b5553.patch";
+      hash = "sha256-xyhV2VBelw/uktUXSZ3JBxgG+8/Mout/JiXEZVV2+2Y=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = false;
diff --git a/pkgs/development/libraries/uri/default.nix b/pkgs/development/libraries/uri/default.nix
index 980d073f1281e..6189fcf016de2 100644
--- a/pkgs/development/libraries/uri/default.nix
+++ b/pkgs/development/libraries/uri/default.nix
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "148361pixrm94q6v04k13s1msa04bx9yc3djb0lxpa7dlw19vhcd";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=parentheses"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=nonnull"
+  ];
 
   nativeBuildInputs = [ cmake doxygen ];
 
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 7cdad40d97019..4b2117503bdab 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -110,6 +110,7 @@ stdenv.mkDerivation rec {
         --replace "-Wl,-fatal_warnings" ""
     ''}
     touch build/config/gclient_args.gni
+    sed '1i#include <utility>' -i src/heap/cppgc/prefinalizer-handler.h # gcc12
   '';
 
   llvmCcAndBintools = symlinkJoin { name = "llvmCcAndBintools"; paths = [ stdenv.cc llvmPackages.llvm ]; };
diff --git a/pkgs/development/libraries/wildmidi/default.nix b/pkgs/development/libraries/wildmidi/default.nix
index 5e8adaf0c4258..8877365e1dd6a 100644
--- a/pkgs/development/libraries/wildmidi/default.nix
+++ b/pkgs/development/libraries/wildmidi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wildmidi";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "Mindwerks";
     repo = "wildmidi";
     rev = "${pname}-${version}";
-    sha256 = "08fbbsvw6pkwwqarjwcvdp8mq4zn5sgahf025hynwc6rvf4sp167";
+    sha256 = "sha256-5El8aDpAgjrW0/4lphZEF+Hfv9Xr7J4DMk1b/Tb+0TU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK32.nix b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
index 543c6fb4e0552..83154c50d3e3e 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK32.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
@@ -53,13 +53,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wxwidgets";
-  version = "3.2.1";
+  version = "3.2.2.1";
 
   src = fetchFromGitHub {
     owner = "wxWidgets";
     repo = "wxWidgets";
     rev = "v${version}";
-    hash = "sha256-k6td/8pF7ad7+gVm7L0jX79fHKwR7/qrOBpSFggyaI0=";
+    hash = "sha256-u+INjo9EkW433OYoCDZpw5pcW1DyF/t/J5ntLZX+6aA=";
   };
 
   # Workaround for pkgsMusl.wxGTK32 failing as:
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index 00aef53cc1b29..5366fb078678c 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -24,12 +24,12 @@ let
 
 in buildPythonPackage rec {
   pname = "cython";
-  version = "0.29.32";
+  version = "0.29.33";
 
   src = fetchPypi {
     pname = "Cython";
     inherit version;
-    hash = "sha256-hzPPR1i3kwTypOOev6xekjQbzke8zrJsElQ5iy+MGvc=";
+    hash = "sha256-UEB2TEpNLOlko5XaJPDRrlgUSZXauSxrlvRMP01yKGo=";
   };
 
   nativeBuildInputs = [
@@ -46,11 +46,7 @@ in buildPythonPackage rec {
     # backport Cython 3.0 trashcan support (https://github.com/cython/cython/pull/2842) to 0.X series.
     # it does not affect Python code unless the code explicitly uses the feature.
     # trashcan support is needed to avoid stack overflows during object deallocation in sage (https://trac.sagemath.org/ticket/27267)
-    (fetchpatch {
-      name = "trashcan.patch";
-      url = "https://github.com/cython/cython/commit/f781880b6780117660b2026caadf4a6d7905722f.patch";
-      sha256 = "sha256-SnjaJdBZxm3O5gJ5Dxut6+eeVtZv+ygUUNwAwgoiFxg=";
-    })
+    ./trashcan.patch
     # The above commit introduces custom trashcan macros, as well as
     # compiler changes to use them in Cython-emitted code. The latter
     # change is still useful, but the former has been upstreamed as of
@@ -79,6 +75,7 @@ in buildPythonPackage rec {
   # doCheck = !stdenv.isDarwin;
 
   meta = {
+    changelog = "https://github.com/cython/cython/blob/${version}/CHANGES.rst";
     description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
     homepage = "https://cython.org";
     license = lib.licenses.asl20;
diff --git a/pkgs/development/python-modules/Cython/trashcan.patch b/pkgs/development/python-modules/Cython/trashcan.patch
new file mode 100644
index 0000000000000..398422e76f395
--- /dev/null
+++ b/pkgs/development/python-modules/Cython/trashcan.patch
@@ -0,0 +1,354 @@
+From 1b77e35d848340f2c5f4c9b82965c25a0572d48f Mon Sep 17 00:00:00 2001
+From: Jeroen Demeyer <J.Demeyer@UGent.be>
+Date: Thu, 14 Feb 2019 10:02:41 +0100
+Subject: [PATCH] @cython.trashcan directive to enable the Python trashcan for
+ deallocations
+
+---
+ Cython/Compiler/ModuleNode.py   |  10 +++
+ Cython/Compiler/Options.py      |   2 +
+ Cython/Compiler/PyrexTypes.py   |   8 +-
+ Cython/Compiler/Symtab.py       |  18 +++-
+ Cython/Utility/ExtensionTypes.c |  43 ++++++++++
+ tests/run/trashcan.pyx          | 148 ++++++++++++++++++++++++++++++++
+ 6 files changed, 227 insertions(+), 2 deletions(-)
+ create mode 100644 tests/run/trashcan.pyx
+
+diff --git a/Cython/Compiler/ModuleNode.py b/Cython/Compiler/ModuleNode.py
+index 56845330d..3a3e8a956 100644
+--- a/Cython/Compiler/ModuleNode.py
++++ b/Cython/Compiler/ModuleNode.py
+@@ -1443,6 +1443,7 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+ 
+         is_final_type = scope.parent_type.is_final_type
+         needs_gc = scope.needs_gc()
++        needs_trashcan = scope.needs_trashcan()
+ 
+         weakref_slot = scope.lookup_here("__weakref__") if not scope.is_closure_class_scope else None
+         if weakref_slot not in scope.var_entries:
+@@ -1481,6 +1482,11 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+             # running this destructor.
+             code.putln("PyObject_GC_UnTrack(o);")
+ 
++        if needs_trashcan:
++            code.globalstate.use_utility_code(
++                UtilityCode.load_cached("PyTrashcan", "ExtensionTypes.c"))
++            code.putln("__Pyx_TRASHCAN_BEGIN(o, %s)" % slot_func_cname)
++
+         # call the user's __dealloc__
+         self.generate_usr_dealloc_call(scope, code)
+ 
+@@ -1554,6 +1560,10 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+             code.putln("(*Py_TYPE(o)->tp_free)(o);")
+             if freelist_size:
+                 code.putln("}")
++
++        if needs_trashcan:
++            code.putln("__Pyx_TRASHCAN_END")
++
+         code.putln(
+             "}")
+ 
+diff --git a/Cython/Compiler/Options.py b/Cython/Compiler/Options.py
+index d03119fca..05a728135 100644
+--- a/Cython/Compiler/Options.py
++++ b/Cython/Compiler/Options.py
+@@ -319,6 +319,7 @@ directive_types = {
+     'freelist': int,
+     'c_string_type': one_of('bytes', 'bytearray', 'str', 'unicode'),
+     'c_string_encoding': normalise_encoding_name,
++    'trashcan': bool,
+     'cpow': bool
+ }
+ 
+@@ -362,6 +363,7 @@ directive_scopes = {  # defaults to available everywhere
+     'np_pythran': ('module',),
+     'fast_gil': ('module',),
+     'iterable_coroutine': ('module', 'function'),
++    'trashcan' : ('cclass',),
+ }
+ 
+ 
+diff --git a/Cython/Compiler/PyrexTypes.py b/Cython/Compiler/PyrexTypes.py
+index c309bd04b..9231130b5 100644
+--- a/Cython/Compiler/PyrexTypes.py
++++ b/Cython/Compiler/PyrexTypes.py
+@@ -1129,6 +1129,7 @@ class PyObjectType(PyrexType):
+     is_extern = False
+     is_subclassed = False
+     is_gc_simple = False
++    builtin_trashcan = False  # builtin type using trashcan
+ 
+     def __str__(self):
+         return "Python object"
+@@ -1183,10 +1184,14 @@ class PyObjectType(PyrexType):
+ 
+ 
+ builtin_types_that_cannot_create_refcycles = set([
+-    'bool', 'int', 'long', 'float', 'complex',
++    'object', 'bool', 'int', 'long', 'float', 'complex',
+     'bytearray', 'bytes', 'unicode', 'str', 'basestring'
+ ])
+ 
++builtin_types_with_trashcan = set([
++    'dict', 'list', 'set', 'frozenset', 'tuple', 'type',
++])
++
+ 
+ class BuiltinObjectType(PyObjectType):
+     #  objstruct_cname  string           Name of PyObject struct
+@@ -1211,6 +1216,7 @@ class BuiltinObjectType(PyObjectType):
+         self.typeptr_cname = "(&%s)" % cname
+         self.objstruct_cname = objstruct_cname
+         self.is_gc_simple = name in builtin_types_that_cannot_create_refcycles
++        self.builtin_trashcan = name in builtin_types_with_trashcan
+         if name == 'type':
+             # Special case the type type, as many C API calls (and other
+             # libraries) actually expect a PyTypeObject* for type arguments.
+diff --git a/Cython/Compiler/Symtab.py b/Cython/Compiler/Symtab.py
+index 7361a55ae..f0c311ba6 100644
+--- a/Cython/Compiler/Symtab.py
++++ b/Cython/Compiler/Symtab.py
+@@ -2043,7 +2043,7 @@ class PyClassScope(ClassScope):
+ class CClassScope(ClassScope):
+     #  Namespace of an extension type.
+     #
+-    #  parent_type           CClassType
++    #  parent_type           PyExtensionType
+     #  #typeobj_cname        string or None
+     #  #objstruct_cname      string
+     #  method_table_cname    string
+@@ -2087,6 +2087,22 @@ class CClassScope(ClassScope):
+             return not self.parent_type.is_gc_simple
+         return False
+ 
++    def needs_trashcan(self):
++        # If the trashcan directive is explicitly set to False,
++        # unconditionally disable the trashcan.
++        directive = self.directives.get('trashcan')
++        if directive is False:
++            return False
++        # If the directive is set to True and the class has Python-valued
++        # C attributes, then it should use the trashcan in tp_dealloc.
++        if directive and self.has_cyclic_pyobject_attrs:
++            return True
++        # Use the trashcan if the base class uses it
++        base_type = self.parent_type.base_type
++        if base_type and base_type.scope is not None:
++            return base_type.scope.needs_trashcan()
++        return self.parent_type.builtin_trashcan
++
+     def needs_tp_clear(self):
+         """
+         Do we need to generate an implementation for the tp_clear slot? Can
+diff --git a/Cython/Utility/ExtensionTypes.c b/Cython/Utility/ExtensionTypes.c
+index dc187ab49..f359165df 100644
+--- a/Cython/Utility/ExtensionTypes.c
++++ b/Cython/Utility/ExtensionTypes.c
+@@ -119,6 +119,49 @@ static int __Pyx_PyType_Ready(PyTypeObject *t) {
+     return r;
+ }
+ 
++/////////////// PyTrashcan.proto ///////////////
++
++// These macros are taken from https://github.com/python/cpython/pull/11841
++// Unlike the Py_TRASHCAN_SAFE_BEGIN/Py_TRASHCAN_SAFE_END macros, they
++// allow dealing correctly with subclasses.
++
++// This requires CPython version >= 2.7.4
++// (or >= 3.2.4 but we don't support such old Python 3 versions anyway)
++#if CYTHON_COMPILING_IN_CPYTHON && PY_VERSION_HEX >= 0x02070400
++#define __Pyx_TRASHCAN_BEGIN_CONDITION(op, cond) \
++    do { \
++        PyThreadState *_tstate = NULL; \
++        // If "cond" is false, then _tstate remains NULL and the deallocator
++        // is run normally without involving the trashcan
++        if (cond) { \
++            _tstate = PyThreadState_GET(); \
++            if (_tstate->trash_delete_nesting >= PyTrash_UNWIND_LEVEL) { \
++                // Store the object (to be deallocated later) and jump past
++                // Py_TRASHCAN_END, skipping the body of the deallocator
++                _PyTrash_thread_deposit_object((PyObject*)(op)); \
++                break; \
++            } \
++            ++_tstate->trash_delete_nesting; \
++        }
++        // The body of the deallocator is here.
++#define __Pyx_TRASHCAN_END \
++        if (_tstate) { \
++            --_tstate->trash_delete_nesting; \
++            if (_tstate->trash_delete_later && _tstate->trash_delete_nesting <= 0) \
++                _PyTrash_thread_destroy_chain(); \
++        } \
++    } while (0);
++
++#define __Pyx_TRASHCAN_BEGIN(op, dealloc) __Pyx_TRASHCAN_BEGIN_CONDITION(op, \
++        Py_TYPE(op)->tp_dealloc == (destructor)(dealloc))
++
++#else
++// The trashcan is a no-op on other Python implementations
++// or old CPython versions
++#define __Pyx_TRASHCAN_BEGIN(op, dealloc)
++#define __Pyx_TRASHCAN_END
++#endif
++
+ /////////////// CallNextTpDealloc.proto ///////////////
+ 
+ static void __Pyx_call_next_tp_dealloc(PyObject* obj, destructor current_tp_dealloc);
+diff --git a/tests/run/trashcan.pyx b/tests/run/trashcan.pyx
+new file mode 100644
+index 000000000..93a501ff8
+--- /dev/null
++++ b/tests/run/trashcan.pyx
+@@ -0,0 +1,148 @@
++# mode: run
++
++cimport cython
++
++
++# Count number of times an object was deallocated twice. This should remain 0.
++cdef int double_deallocations = 0
++def assert_no_double_deallocations():
++    global double_deallocations
++    err = double_deallocations
++    double_deallocations = 0
++    assert not err
++
++
++# Compute x = f(f(f(...(None)...))) nested n times and throw away the result.
++# The real test happens when exiting this function: then a big recursive
++# deallocation of x happens. We are testing two things in the tests below:
++# that Python does not crash and that no double deallocation happens.
++# See also https://github.com/python/cpython/pull/11841
++def recursion_test(f, int n=2**20):
++    x = None
++    cdef int i
++    for i in range(n):
++        x = f(x)
++
++
++@cython.trashcan(True)
++cdef class Recurse:
++    """
++    >>> recursion_test(Recurse)
++    >>> assert_no_double_deallocations()
++    """
++    cdef public attr
++    cdef int deallocated
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.deallocated
++        self.deallocated = 1
++
++
++cdef class RecurseSub(Recurse):
++    """
++    >>> recursion_test(RecurseSub)
++    >>> assert_no_double_deallocations()
++    """
++    cdef int subdeallocated
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.subdeallocated
++        self.subdeallocated = 1
++
++
++@cython.freelist(4)
++@cython.trashcan(True)
++cdef class RecurseFreelist:
++    """
++    >>> recursion_test(RecurseFreelist)
++    >>> recursion_test(RecurseFreelist, 1000)
++    >>> assert_no_double_deallocations()
++    """
++    cdef public attr
++    cdef int deallocated
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.deallocated
++        self.deallocated = 1
++
++
++# Subclass of list => uses trashcan by default
++# As long as https://github.com/python/cpython/pull/11841 is not fixed,
++# this does lead to double deallocations, so we skip that check.
++cdef class RecurseList(list):
++    """
++    >>> RecurseList(42)
++    [42]
++    >>> recursion_test(RecurseList)
++    """
++    def __init__(self, x):
++        super().__init__((x,))
++
++
++# Some tests where the trashcan is NOT used. When the trashcan is not used
++# in a big recursive deallocation, the __dealloc__s of the base classs are
++# only run after the __dealloc__s of the subclasses.
++# We use this to detect trashcan usage.
++cdef int base_deallocated = 0
++cdef int trashcan_used = 0
++def assert_no_trashcan_used():
++    global base_deallocated, trashcan_used
++    err = trashcan_used
++    trashcan_used = base_deallocated = 0
++    assert not err
++
++
++cdef class Base:
++    def __dealloc__(self):
++        global base_deallocated
++        base_deallocated = 1
++
++
++# Trashcan disabled by default
++cdef class Sub1(Base):
++    """
++    >>> recursion_test(Sub1, 100)
++    >>> assert_no_trashcan_used()
++    """
++    cdef public attr
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        global base_deallocated, trashcan_used
++        trashcan_used += base_deallocated
++
++
++@cython.trashcan(True)
++cdef class Middle(Base):
++    cdef public foo
++
++
++# Trashcan disabled explicitly
++@cython.trashcan(False)
++cdef class Sub2(Middle):
++    """
++    >>> recursion_test(Sub2, 1000)
++    >>> assert_no_trashcan_used()
++    """
++    cdef public attr
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        global base_deallocated, trashcan_used
++        trashcan_used += base_deallocated
+-- 
+2.39.0
+
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 12bdd985abbe5..c0d21eec563aa 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "13.2.0";
+  version = "13.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ACO5vp5ZMxzfY4RBvZ+vbk+fsj43Q896bar0+HNYHwE=";
+    hash = "sha256-Pca+SMuUL3XyQpLAL6SOYPnztc95WF2o0v4+5Nc5Nxg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/airthings-ble/default.nix b/pkgs/development/python-modules/airthings-ble/default.nix
index 6351fea9bd802..eda8e77e43b75 100644
--- a/pkgs/development/python-modules/airthings-ble/default.nix
+++ b/pkgs/development/python-modules/airthings-ble/default.nix
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Airthings BLE devices";
     homepage = "https://github.com/vincegio/airthings-ble";
+    changelog = "https://github.com/vincegio/airthings-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ansible-doctor/default.nix b/pkgs/development/python-modules/ansible-doctor/default.nix
index d05d730a467ad..0ddd26b7ffb42 100644
--- a/pkgs/development/python-modules/ansible-doctor/default.nix
+++ b/pkgs/development/python-modules/ansible-doctor/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-doctor";
-  version = "1.4.8";
+  version = "2.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     rev = "refs/tags/v${version}";
-    hash = "sha256-A4SqDEArnRG9SJTqU/C9TOQO2vjot+hfj2/PKB/JMfw=";
+    hash = "sha256-P2PC90coR+FpQkO+SUon72bDLTYJhZ5qbcOdCKuFFwE=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/asf-search/default.nix b/pkgs/development/python-modules/asf-search/default.nix
index b0d2b1f723866..686a9e92cebfe 100644
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@@ -1,17 +1,19 @@
 { lib
 , buildPythonPackage
-, dateparser
 , fetchFromGitHub
+, pythonOlder
+, requests
+, shapely
+, python-dateutil
+, pytz
 , importlib-metadata
 , numpy
+, dateparser
+, jinja2
+, remotezip
 , pytestCheckHook
-, python-dateutil
-, pythonOlder
-, pytz
-, requests
 , requests-mock
-, shapely
-, wktutils
+, defusedxml
 }:
 
 buildPythonPackage rec {
@@ -29,25 +31,25 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    dateparser
-    importlib-metadata
-    numpy
-    python-dateutil
-    pytz
     requests
     shapely
-    wktutils
+    python-dateutil
+    pytz
+    importlib-metadata
+    numpy
+    dateparser
+    jinja2
+    remotezip
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    requests-mock
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "WKTUtils==" "WKTUtils>="
-  '';
+  checkInputs = [
+    requests-mock
+    defusedxml
+  ];
 
   pythonImportsCheck = [
     "asf_search"
diff --git a/pkgs/development/python-modules/atc-ble/default.nix b/pkgs/development/python-modules/atc-ble/default.nix
index 947f5db4b3179..187aaeeb99ac8 100644
--- a/pkgs/development/python-modules/atc-ble/default.nix
+++ b/pkgs/development/python-modules/atc-ble/default.nix
@@ -19,10 +19,15 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-rwOFKxUlbbNIDJRdCmZpHstXwxcTnvlExgcVDdGbIVY=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=atc_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -37,11 +42,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=atc_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   pythonImportsCheck = [
     "atc_ble"
   ];
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for ATC devices with custom firmware";
     homepage = "https://github.com/Bluetooth-Devices/atc-ble";
+    changelog = "https://github.com/Bluetooth-Devices/atc-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/awswrangler/default.nix b/pkgs/development/python-modules/awswrangler/default.nix
new file mode 100644
index 0000000000000..f1b937f3ecdcf
--- /dev/null
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@@ -0,0 +1,88 @@
+{ backoff
+, sparqlwrapper
+, boto3
+, buildPythonPackage
+, fetchFromGitHub
+, gremlinpython
+, jsonpath-ng
+, lib
+, moto
+, openpyxl
+, opensearch-py
+, pandas
+, pg8000
+, poetry-core
+, progressbar2
+, pyarrow
+, pymysql
+, pyodbc
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, redshift-connector
+, requests-aws4auth
+}:
+
+buildPythonPackage rec {
+  pname = "awswrangler";
+  version = "2.19.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7.1";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-sdk-pandas";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xUEytEgr/djfnoOowLxAZmbPkMS+vU0fuPY7JxZXEe0=";
+  };
+
+  nativeBuildInputs = [ poetry-core pythonRelaxDepsHook ];
+
+  propagatedBuildInputs = [
+    backoff
+    boto3
+    gremlinpython
+    jsonpath-ng
+    openpyxl
+    opensearch-py
+    pandas
+    pg8000
+    progressbar2
+    pyarrow
+    pymysql
+    redshift-connector
+    requests-aws4auth
+  ];
+
+  pythonRelaxDeps = [
+    "gremlinpython"
+    "numpy"
+    "pandas"
+    "pg8000"
+  ];
+
+  nativeCheckInputs = [ moto pytestCheckHook ];
+
+  pytestFlagsArray = [
+    # Subset of tests that run in upstream CI (many others require credentials)
+    # https://github.com/aws/aws-sdk-pandas/blob/2b7c62ac0762b1303149bb3c03979791479ba4f9/.github/workflows/minimal-tests.yml
+    "tests/test_metadata.py"
+    "tests/test_session.py"
+    "tests/test_utils.py"
+    "tests/test_moto.py"
+  ];
+
+  passthru.optional-dependencies = {
+    sqlserver = [ pyodbc ];
+    sparql = [ sparqlwrapper ];
+  };
+
+  meta = {
+    description = "Pandas on AWS";
+    homepage = "https://github.com/aws/aws-sdk-pandas";
+    changelog = "https://github.com/aws/aws-sdk-pandas/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mcwitt ];
+  };
+}
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 44d6e6f978335..bcdd7614ecd56 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -56,6 +56,8 @@ buildPythonPackage rec {
     "ignore::DeprecationWarning"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTests = [
     # Tests often fail with StopIteration
     "test_isolat"
diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index 8c5be6384f359..1a0ef99e74934 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools ];
   propagatedBuildInputs = [
-    cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
+    setuptools cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
   ] ++ lib.optionals (pythonOlder "3.11") [ rtoml ];
 
   pythonImportsCheck = [ "bundlewrap" ];
diff --git a/pkgs/development/python-modules/certomancer/default.nix b/pkgs/development/python-modules/certomancer/default.nix
index 4fbe2ecd37923..767071a75ef2f 100644
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "certomancer";
-  version = "0.8.2";
+  version = "0.9.1";
   format = "setuptools";
   disabled = pythonOlder "3.7";
 
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "MatthiasValvekens";
     repo = "certomancer";
     rev = version;
-    sha256 = "sha256-H43NlFNTwZtedHsB7c62MocwQVOi5JjVJxRcZY+Wn7Y=";
+    sha256 = "4v2e46ZrzhKXpMULj0vmDRoLOypi030eaADAYjLMg5M=";
   };
 
   propagatedBuildInputs = [
@@ -43,9 +43,7 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace ", 'pytest-runner'" "" \
-      --replace "pyhanko-certvalidator==0.19.2" "pyhanko-certvalidator==0.19.5"
+    substituteInPlace setup.py --replace ", 'pytest-runner'" ""
   '';
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/chart-studio/default.nix b/pkgs/development/python-modules/chart-studio/default.nix
index 966daaf1ea1ec..c988ab49a75bb 100644
--- a/pkgs/development/python-modules/chart-studio/default.nix
+++ b/pkgs/development/python-modules/chart-studio/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "chart-studio";
-  version = "5.11.0";
+  version = "5.13.0";
 
   # chart-studio was split from plotly
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-Reti8tvBpBxpfNjnZs8wWuS76oEWIKPCxzSdTEO+ykA=";
+    sha256 = "sha256-j4n5goW2Iu5Z1+Gta1Ar34WXaF8ryUKs5P+6Onhmyh0=";
   };
 
   sourceRoot = "source/packages/python/chart-studio";
diff --git a/pkgs/development/python-modules/clustershell/default.nix b/pkgs/development/python-modules/clustershell/default.nix
index b38d61f6fa014..e1bd8e4f8b7bb 100644
--- a/pkgs/development/python-modules/clustershell/default.nix
+++ b/pkgs/development/python-modules/clustershell/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "ClusterShell";
-  version = "1.9";
+  version = "1.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-A0arNKF9jPRj3GnnOBHG8xDD2YEPpMrPRbZEaKg8FHQ=";
+    sha256 = "sha256-bwqzyhQbUI2gPOGb1S8eXo0pdz/DBi1782RQqCIH7Bs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/coconut/default.nix b/pkgs/development/python-modules/coconut/default.nix
index c51dd9ecc95ef..0dc799d7ea236 100644
--- a/pkgs/development/python-modules/coconut/default.nix
+++ b/pkgs/development/python-modules/coconut/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "coconut";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "evhub";
     repo = "coconut";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-zDMcQPAYlxid3fcMT8kRzE+LN1dxUVWjkg8pdVtmwZg=";
+    sha256 = "sha256-+OrVNtre7kAfU5L7/6DadZxFNWVt5raF6HLGXHHpOvE=";
   };
 
   propagatedBuildInputs = [ cpyparsing ipykernel mypy pygments prompt-toolkit watchdog ];
diff --git a/pkgs/development/python-modules/collections-extended/default.nix b/pkgs/development/python-modules/collections-extended/default.nix
index c4d20c23d3f28..d1545d36b3764 100644
--- a/pkgs/development/python-modules/collections-extended/default.nix
+++ b/pkgs/development/python-modules/collections-extended/default.nix
@@ -5,6 +5,7 @@
 , poetry-core
 , pytestCheckHook
 , pythonOlder
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
@@ -12,7 +13,8 @@ buildPythonPackage rec {
   version = "2.0.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  # https://github.com/mlenzen/collections-extended/issues/198
+  disabled = pythonOlder "3.6" || pythonAtLeast "3.11";
 
   src = fetchFromGitHub {
     owner = "mlenzen";
diff --git a/pkgs/development/python-modules/cvxopt/default.nix b/pkgs/development/python-modules/cvxopt/default.nix
index c546d11ec3f63..d47debe407e93 100644
--- a/pkgs/development/python-modules/cvxopt/default.nix
+++ b/pkgs/development/python-modules/cvxopt/default.nix
@@ -51,16 +51,16 @@ buildPythonPackage rec {
     export CVXOPT_SUITESPARSE_INC_DIR=${lib.getDev suitesparse}/include
   '' + lib.optionalString withGsl ''
     export CVXOPT_BUILD_GSL=1
-    export CVXOPT_GSL_LIB_DIR=${gsl}/lib
-    export CVXOPT_GSL_INC_DIR=${gsl}/include
+    export CVXOPT_GSL_LIB_DIR=${lib.getLib gsl}/lib
+    export CVXOPT_GSL_INC_DIR=${lib.getDev gsl}/include
   '' + lib.optionalString withGlpk ''
     export CVXOPT_BUILD_GLPK=1
-    export CVXOPT_GLPK_LIB_DIR=${glpk}/lib
-    export CVXOPT_GLPK_INC_DIR=${glpk}/include
+    export CVXOPT_GLPK_LIB_DIR=${lib.getLib glpk}/lib
+    export CVXOPT_GLPK_INC_DIR=${lib.getDev glpk}/include
   '' + lib.optionalString withFftw ''
     export CVXOPT_BUILD_FFTW=1
-    export CVXOPT_FFTW_LIB_DIR=${fftw}/lib
-    export CVXOPT_FFTW_INC_DIR=${fftw.dev}/include
+    export CVXOPT_FFTW_LIB_DIR=${lib.getLib fftw}/lib
+    export CVXOPT_FFTW_INC_DIR=${lib.getDev fftw}/include
   '';
 
   nativeCheckInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index f859a43bd1e20..a43f1a5afb570 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, arrow-cpp
 , bokeh
 , buildPythonPackage
 , click
@@ -70,13 +71,14 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    fastparquet
-    pyarrow
     pytestCheckHook
     pytest-rerunfailures
     pytest-xdist
     scipy
     zarr
+  ] ++ lib.optionals (!arrow-cpp.meta.broken) [ # support is sparse on aarch64
+    fastparquet
+    pyarrow
   ];
 
   dontUseSetuptoolsCheck = true;
diff --git a/pkgs/development/python-modules/datafusion/Cargo.lock.patch b/pkgs/development/python-modules/datafusion/Cargo.lock.patch
deleted file mode 100644
index e4e5eca8af4c8..0000000000000
--- a/pkgs/development/python-modules/datafusion/Cargo.lock.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index fa84a54c..3d790e1c 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -57,9 +57,9 @@ checksum = "be4dc07131ffa69b8072d35f5007352af944213cde02545e2103680baed38fcd"
- 
- [[package]]
- name = "arrow"
--version = "6.0.0"
-+version = "6.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "337e668497751234149fd607f5cb41a6ae7b286b6329589126fe67f0ac55d637"
-+checksum = "216c6846a292bdd93c2b93c1baab58c32ff50e2ab5e8d50db333ab518535dd8b"
- dependencies = [
-  "bitflags",
-  "chrono",
-@@ -212,9 +212,9 @@ dependencies = [
- 
- [[package]]
- name = "comfy-table"
--version = "4.1.1"
-+version = "5.0.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "11e95a3e867422fd8d04049041f5671f94d53c32a9dcd82e2be268714942f3f3"
-+checksum = "c42350b81f044f576ff88ac750419f914abb46a03831bb1747134344ee7a4e64"
- dependencies = [
-  "strum",
-  "strum_macros",
-@@ -279,7 +279,7 @@ dependencies = [
- 
- [[package]]
- name = "datafusion"
--version = "5.1.0"
-+version = "6.0.0"
- dependencies = [
-  "ahash",
-  "arrow",
-@@ -310,7 +310,7 @@ dependencies = [
- 
- [[package]]
- name = "datafusion-python"
--version = "0.3.0"
-+version = "0.4.0"
- dependencies = [
-  "datafusion",
-  "pyo3",
-@@ -877,9 +877,9 @@ dependencies = [
- 
- [[package]]
- name = "parquet"
--version = "6.0.0"
-+version = "6.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d263b9b59ba260518de9e57bd65931c3f765fea0fabacfe84f40d6fde38e841a"
-+checksum = "788d9953f4cfbe9db1beff7bebd54299d105e34680d78b82b1ddc85d432cac9d"
- dependencies = [
-  "arrow",
-  "base64",
-@@ -1228,15 +1228,15 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
- 
- [[package]]
- name = "strum"
--version = "0.21.0"
-+version = "0.22.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "aaf86bbcfd1fa9670b7a129f64fc0c9fcbbfe4f1bc4210e9e98fe71ffc12cde2"
-+checksum = "f7ac893c7d471c8a21f31cfe213ec4f6d9afeed25537c772e08ef3f005f8729e"
- 
- [[package]]
- name = "strum_macros"
--version = "0.21.1"
-+version = "0.22.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d06aaeeee809dbc59eb4556183dd927df67db1540de5be8d3ec0b6636358a5ec"
-+checksum = "339f799d8b549e3744c7ac7feb216383e4005d94bdb22561b3ab8f3b808ae9fb"
- dependencies = [
-  "heck",
-  "proc-macro2",
diff --git a/pkgs/development/python-modules/datafusion/default.nix b/pkgs/development/python-modules/datafusion/default.nix
index fb991dabf3d20..84afbfc3a1c10 100644
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -5,54 +5,42 @@
 , fetchPypi
 , fetchFromGitHub
 , rustPlatform
-, maturin
 , pytestCheckHook
 , libiconv
 , numpy
 , pandas
 , pyarrow
-, pytest
 }:
+
 let
-  # le sigh, the perils of unrelated versions of software living in the same
-  # repo: there's no obvious way to map the top level source repo
-  # (arrow-datafusion) version to the version of contained repo
-  # (arrow-datafusion/python)
-  #
-  # A commit hash will do in a pinch, and ultimately the sha256 has the final
-  # say of what the content is when building
-  cargoLock = fetchurl {
-    url = "https://raw.githubusercontent.com/apache/arrow-datafusion/6.0.0/python/Cargo.lock";
-    sha256 = "sha256-xiv3drEU5jOGsEIh0U01ZQ1NBKobxO2ctp4mxy9iigw=";
+  arrow-testing = fetchFromGitHub {
+    owner = "apache";
+    repo = "arrow-testing";
+    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
+    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
   };
 
-  postUnpack = ''
-    cp "${cargoLock}" $sourceRoot/Cargo.lock
-    chmod u+w $sourceRoot/Cargo.lock
-  '';
+  parquet-testing = fetchFromGitHub {
+    owner = "apache";
+    repo = "parquet-testing";
+    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
+    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
+  };
 in
+
 buildPythonPackage rec {
   pname = "datafusion";
-  version = "0.4.0";
+  version = "0.7.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-+YqogteKfNhtI2QbVXv/5CIWm3PcOH653dwONm5ZcL8=";
+    sha256 = "sha256-XYXZMorPs2Ue7E38DASd4rmxvX0wlx8A6sCpAbYUh4I=";
   };
 
-  inherit postUnpack;
-
-  # TODO: remove the patch hacking and postUnpack hooks after
-  # https://github.com/apache/arrow-datafusion/pull/1508 is merged
-  #
-  # the lock file isn't up to date as of 6.0.0 so we need to patch the source
-  # lockfile and the vendored cargo deps lockfile
-  patches = [ ./Cargo.lock.patch ];
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src pname version postUnpack;
-    sha256 = "sha256-JGyDxpfBXzduJaMF1sbmRm7KJajHYdVSj+WbiSETiY0=";
-    patches = [ ./Cargo.lock.patch ];
+    inherit src pname version;
+    sha256 = "sha256-6mPdKwsEN09Gf4eNsd/v3EBHVezHmff/KYB2lsXgzcA=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -68,13 +56,18 @@ buildPythonPackage rec {
     pyarrow
   ];
 
-  nativeCheckInputs = [ pytest ];
+  nativeCheckInputs = [ pytestCheckHook ];
   pythonImportsCheck = [ "datafusion" ];
+  pytestFlagsArray = [ "--pyargs" pname ];
+
+  preCheck = ''
+    pushd $TMPDIR
+    ln -s ${arrow-testing} ./testing
+    ln -s ${parquet-testing} ./parquet
+  '';
 
-  checkPhase = ''
-    runHook preCheck
-    pytest --pyargs "${pname}"
-    runHook postCheck
+  postCheck = ''
+    popd
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index f881ed5221aeb..f54562742b15a 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "3.2.16";
+  version = "3.2.17";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Django";
     inherit version;
-    hash = "sha256-OtwoUSQkRySjlPqbmDnMjNEW+vfRWVVMQ+zaqM3wuU0=";
+    hash = "sha256-ZEKINB8G6+STjuxoAba9WaZTSnjkrt3ioVMHXREUOJQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/drf-yasg/default.nix b/pkgs/development/python-modules/drf-yasg/default.nix
index eca45373fab72..4853e7eb08254 100644
--- a/pkgs/development/python-modules/drf-yasg/default.nix
+++ b/pkgs/development/python-modules/drf-yasg/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "drf-yasg";
-  version = "1.21.4";
+  version = "1.21.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iHyfeeZPRqpIl0I05hApsb6msS6mKKj8ijaXWJrdHT4=";
+    sha256 = "sha256-zu8MO13EOJeBr9eG5tw2l68qL+DYck7h9jfCPXW7xbI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/effect/default.nix b/pkgs/development/python-modules/effect/default.nix
index 739ace442b956..b9c49e30a560e 100644
--- a/pkgs/development/python-modules/effect/default.nix
+++ b/pkgs/development/python-modules/effect/default.nix
@@ -1,40 +1,52 @@
-{ buildPythonPackage
+{ lib
+, attrs
+, buildPythonPackage
 , fetchPypi
-, lib
-, isPy3k
+, pytestCheckHook
+, pythonOlder
 , six
-, attrs
-, pytest
 , testtools
 }:
 
 buildPythonPackage rec {
-  version = "1.1.0";
   pname = "effect";
-  disabled = (!isPy3k);
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7affb603707c648b07b11781ebb793a4b9aee8acf1ac5764c3ed2112adf0c9ea";
+    hash = "sha256-ev+2A3B8ZIsHsReB67eTpLmu6KzxrFdkw+0hEq3wyeo=";
   };
 
-  nativeCheckInputs = [
-    pytest
-    testtools
-  ];
+  postPatch = ''
+    substituteInPlace effect/test_do.py \
+      --replace "py.test" "pytest"
+  '';
 
   propagatedBuildInputs = [
-    six
     attrs
+    six
   ];
 
-  checkPhase = ''
-    pytest
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    testtools
+  ];
+
+  pythonImportsCheck = [
+    "effect"
+  ];
 
   meta = with lib; {
     description = "Pure effects for Python";
-    homepage = "https://github.com/python-effect/effect";
+    homepage = "https://effect.readthedocs.io/";
+    changelog = "https://github.com/python-effect/effect/releases/tag/${version}";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index fec7fac990cd9..3e9430ef318b2 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -1,29 +1,46 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder, cython
-, attrs, click, cligj, click-plugins, six, munch, enum34
-, pytestCheckHook, boto3, mock, giflib, pytz
-, gdal, certifi
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, cython
+, gdal
+, setuptools
+, attrs
+, certifi
+, click
+, click-plugins
+, cligj
+, munch
+, shapely
+, boto3
+, pytestCheckHook
+, pytz
 }:
 
 buildPythonPackage rec {
   pname = "fiona";
-  version = "1.9.0";
+  version = "1.9.1";
 
-  src = fetchPypi {
-    pname = "Fiona";
-    inherit version;
-    hash = "sha256-bkh8v7pahJ+98G5FFp/X4fFmL0Tz1xerS5RgRrJFfq4=";
-  };
+  disabled = pythonOlder "3.7";
+
+  format = "pyproject";
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+  src = fetchFromGitHub {
+    owner = "Toblerity";
+    repo = "Fiona";
+    rev = "refs/tags/${version}";
+    hash = "sha256-2CGLkgnpCAh9G+ILol5tmRj9S6/XeKk8eLzGEODiyP8=";
+  };
 
   nativeBuildInputs = [
     cython
     gdal # for gdal-config
+    setuptools
   ];
 
   buildInputs = [
     gdal
-  ] ++ lib.optionals stdenv.cc.isClang [ giflib ];
+  ];
 
   propagatedBuildInputs = [
     attrs
@@ -31,32 +48,33 @@ buildPythonPackage rec {
     click
     cligj
     click-plugins
-    six
     munch
-    pytz
-  ] ++ lib.optional (!isPy3k) enum34;
+    setuptools
+  ];
+
+  passthru.optional-dependencies = {
+    calc = [ shapely ];
+    s3 = [ boto3 ];
+  };
 
   nativeCheckInputs = [
     pytestCheckHook
-    boto3
-  ] ++ lib.optional (pythonOlder "3.4") mock;
+    pytz
+  ] ++ passthru.optional-dependencies.s3;
 
   preCheck = ''
     rm -r fiona # prevent importing local fiona
-    # disable gdal deprecation warnings
-    export GDAL_ENABLE_DEPRECATED_DRIVER_GTM=YES
   '';
 
   disabledTests = [
     # Some tests access network, others test packaging
     "http" "https" "wheel"
-    # https://github.com/Toblerity/Fiona/issues/1164
-    "test_no_append_driver_cannot_append"
   ];
 
   pythonImportsCheck = [ "fiona" ];
 
   meta = with lib; {
+    changelog = "https://github.com/Toblerity/Fiona/blob/${src.rev}/CHANGES.txt";
     description = "OGR's neat, nimble, no-nonsense API for Python";
     homepage = "https://fiona.readthedocs.io/";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/fpylll/default.nix b/pkgs/development/python-modules/fpylll/default.nix
index fb2d0b1668896..e1c22cd57885f 100644
--- a/pkgs/development/python-modules/fpylll/default.nix
+++ b/pkgs/development/python-modules/fpylll/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , buildPythonPackage
 , pkgconfig
 , gmp
@@ -16,23 +15,15 @@
 
 buildPythonPackage rec {
   pname = "fpylll";
-  version = "0.5.7";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "fplll";
     repo = "fpylll";
     rev = version;
-    sha256 = "sha256-iUPreJ8BSB8LDisbJis0xn8ld6+Nf9Z4AP8SWJlCfZg=";
+    sha256 = "sha256-T6l6hKzRDevlLyLu5H+bnEdl0OhsPer1coCDiftbPAk=";
   };
 
-  patches = [
-   (fetchpatch {
-     name = "remove-strategies-doctest.patch";
-     url = "https://github.com/fplll/fpylll/commit/3edffcd189e9d827a322d83b0f84d32e5f067442.patch";
-     sha256 = "sha256-U7qOIbVzUNwYmjOPryjnE3J+MX/vMwm3T0UyOZ5ylLc=";
-   })
-  ];
-
   buildInputs = [
     gmp
     pari
diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index a8578492fb235..64cdac603e0b8 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.17.2";
+  version = "2.17.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VDhWYfAdU2PPzjSIhh0XMEnt9krogXV1fNTAFk6R3WM=";
+    hash = "sha256-sYF6yV/VENn11V74vWU2p/pSkPAfYPtW2l1TdHTSR2g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hatch-requirements-txt/default.nix b/pkgs/development/python-modules/hatch-requirements-txt/default.nix
index b68506ecd3529..af74b15b02148 100644
--- a/pkgs/development/python-modules/hatch-requirements-txt/default.nix
+++ b/pkgs/development/python-modules/hatch-requirements-txt/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, hatch
 , hatchling
 , packaging
 , pytestCheckHook
@@ -20,7 +19,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    hatch
+    hatchling
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hist/default.nix b/pkgs/development/python-modules/hist/default.nix
new file mode 100644
index 0000000000000..df7f447a0444f
--- /dev/null
+++ b/pkgs/development/python-modules/hist/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, boost-histogram
+, histoprint
+, hatchling
+, hatch-vcs
+, numpy
+, pytestCheckHook
+, pytest-mpl
+}:
+
+buildPythonPackage rec {
+  pname = "hist";
+  version = "2.6.3";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "dede097733d50b273af9f67386e6dcccaab77e900ae702e1a9408a856e217ce9";
+  };
+
+  buildInputs = [
+    hatchling
+    hatch-vcs
+  ];
+
+  propagatedBuildInputs = [
+    boost-histogram
+    histoprint
+    numpy
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-mpl
+  ];
+
+  meta = with lib; {
+    description = "Histogramming for analysis powered by boost-histogram";
+    homepage = "https://hist.readthedocs.io/en/latest/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/histoprint/default.nix b/pkgs/development/python-modules/histoprint/default.nix
new file mode 100644
index 0000000000000..3c65fbf0eb801
--- /dev/null
+++ b/pkgs/development/python-modules/histoprint/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, click
+, numpy
+, setuptools
+, setuptools-scm
+, uhi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "histoprint";
+  version = "2.4.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "328f789d186e3bd76882d57b5aad3fa08c7870a856cc83bcdbad9f4aefbda94d";
+  };
+
+  buildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    click
+    numpy
+    uhi
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Pretty print histograms to the console";
+    homepage = "https://github.com/scikit-hep/histoprint";
+    license = licenses.mit;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/holoviews/default.nix b/pkgs/development/python-modules/holoviews/default.nix
index 8f109053b5e9b..b60343dfc68a0 100644
--- a/pkgs/development/python-modules/holoviews/default.nix
+++ b/pkgs/development/python-modules/holoviews/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "holoviews";
-  version = "1.15.3";
+  version = "1.15.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pFiRzSuPzUCHQs//81HJKPv0zx730fBEQsfYeG7o6ZQ=";
+    hash = "sha256-StwTN1DmDnNiZ+3iF2NW5qMDFDiwkTZ8tPKzhN6ZrgM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ibeacon-ble/default.nix b/pkgs/development/python-modules/ibeacon-ble/default.nix
index 7b9910559b4d8..1f0f799d587f2 100644
--- a/pkgs/development/python-modules/ibeacon-ble/default.nix
+++ b/pkgs/development/python-modules/ibeacon-ble/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-iYgGflM0IpSIMNgPpJAFAl9FYoMfRinM3sP6VRcBSMc=";
   };
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for iBeacon BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/ibeacon-ble";
+    changelog = "https://github.com/Bluetooth-Devices/ibeacon-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index a49f7c684aab7..173991f04df62 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -16,6 +16,7 @@
 , geoalchemy2
 , geopandas
 , graphviz-nox
+, hypothesis
 , lz4
 , multipledispatch
 , numpy
@@ -30,8 +31,9 @@
 , pymysql
 , pyspark
 , pytest-benchmark
-, pytest-randomly
 , pytest-mock
+, pytest-randomly
+, pytest-snapshot
 , pytest-xdist
 , python
 , pytz
@@ -62,7 +64,7 @@ in
 
 buildPythonPackage rec {
   pname = "ibis-framework";
-  version = "3.2.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -71,10 +73,12 @@ buildPythonPackage rec {
     repo = "ibis";
     owner = "ibis-project";
     rev = version;
-    hash = "sha256-YRP1nGJs4btqXQirm0GfEDKNPCVXexVrwQ6sE8JtD2o=";
+    hash = "sha256-G3kMd6Jyib7ZXHFP6t2CEPlDD5n5zHE2jq/0he3U4Nk=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   propagatedBuildInputs = [
     atpublic
@@ -95,29 +99,31 @@ buildPythonPackage rec {
     pytestCheckHook
     click
     filelock
+    hypothesis
     pytest-benchmark
     pytest-mock
     pytest-randomly
+    pytest-snapshot
     pytest-xdist
     rsync
   ] ++ lib.concatMap (name: passthru.optional-dependencies.${name}) testBackends;
 
-  preBuild = ''
-    # setup.py exists only for developer convenience and is automatically generated
-    # it gets in the way in nixpkgs so we remove it
-    rm setup.py
-  '';
-
   pytestFlagsArray = [
     "--dist=loadgroup"
     "-m"
     "'${lib.concatStringsSep " or " testBackends} or core'"
-    # this test fails on nixpkgs datafusion version (0.4.0), but works on
-    # datafusion 0.6.0
-    "-k"
-    "'not datafusion-no_op'"
   ];
 
+  # remove when sqlalchemy backend no longer uses deprecated methods
+  SQLALCHEMY_SILENCE_UBER_WARNING = 1;
+
+  # patch out tests that check formatting with black
+  postPatch = ''
+    find ibis/tests -type f -name '*.py' -exec sed -i \
+      -e '/^ *assert_decompile_roundtrip/d' \
+      -e 's/^\( *\)code = ibis.decompile(expr, format=True)/\1code = ibis.decompile(expr)/g' {} +
+  '';
+
   preCheck = ''
     set -eo pipefail
 
diff --git a/pkgs/development/python-modules/iminuit/default.nix b/pkgs/development/python-modules/iminuit/default.nix
index eebeb17bb7e76..97c224a39ac85 100644
--- a/pkgs/development/python-modules/iminuit/default.nix
+++ b/pkgs/development/python-modules/iminuit/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "iminuit";
-  version = "2.18.0";
+  version = "2.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fuLGoLzaxYGzj66NDzQ/3uVfkfH2psyWQ/z7zGwtw+Y=";
+    hash = "sha256-9NHLrM8RXNxIZpaPZJ8qN3lKXA3gGN6BVqp0VWNQpUw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/inkbird-ble/default.nix b/pkgs/development/python-modules/inkbird-ble/default.nix
index 4c39d264ce75c..fc5eb2d12ba4d 100644
--- a/pkgs/development/python-modules/inkbird-ble/default.nix
+++ b/pkgs/development/python-modules/inkbird-ble/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-re5HjPtssFkpcltCr0HEJmJyHbXJdkr2wDgaAHfy2Tk=";
   };
 
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Inkbird BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/inkbird-ble";
+    changelog = "https://github.com/Bluetooth-Devices/inkbird-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/inquirer/default.nix b/pkgs/development/python-modules/inquirer/default.nix
index a0a37ce92f807..3ea584fbc03da 100644
--- a/pkgs/development/python-modules/inquirer/default.nix
+++ b/pkgs/development/python-modules/inquirer/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 
 # native
 , poetry-core
@@ -18,14 +19,16 @@
 
 buildPythonPackage rec {
   pname = "inquirer";
-  version = "3.1.1";
+  version = "3.1.2";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub rec {
     owner = "magmax";
     repo = "python-inquirer";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-gDJqD0IHshyGw9MmMtYjkkpvYklRLgPd6EtLVqi2I/o=";
+    hash = "sha256-7kq0sZzPeCX7TA5Cl2rg6Uw+9jLz335a+tOrO0+Cyas=";
   };
 
   nativeBuildInputs = [
@@ -44,10 +47,16 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+
+  pythonImportsCheck = [
+    "inquirer"
+  ];
+
   meta = with lib; {
-    homepage = "https://github.com/magmax/python-inquirer";
     description = "A collection of common interactive command line user interfaces, based on Inquirer.js";
+    homepage = "https://github.com/magmax/python-inquirer";
+    changelog = "https://github.com/magmax/python-inquirer/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = [ maintainers.mmahut ];
+    maintainers = with maintainers; [ mmahut ];
   };
 }
diff --git a/pkgs/development/python-modules/kegtron-ble/default.nix b/pkgs/development/python-modules/kegtron-ble/default.nix
index 315054b10de9e..e5ddcf01be1c8 100644
--- a/pkgs/development/python-modules/kegtron-ble/default.nix
+++ b/pkgs/development/python-modules/kegtron-ble/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-O5I5shW8nL2RAQptS2Bp/GI/4L6o0xXXmwYvRq0MM8o=";
   };
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Kegtron BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/kegtron-ble";
+    changelog = "https://github.com/Bluetooth-Devices/kegtron-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/led-ble/default.nix b/pkgs/development/python-modules/led-ble/default.nix
index 53ae154857aa1..a75bc1f59ab9c 100644
--- a/pkgs/development/python-modules/led-ble/default.nix
+++ b/pkgs/development/python-modules/led-ble/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-XAb/tJPUe/sNvcU7t63inMPBIz+AREioWXBuQa/c9T0=";
   };
 
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for LED BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/led-ble";
+    changelog = "https://github.com/Bluetooth-Devices/led-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/lightning/default.nix b/pkgs/development/python-modules/lightning/default.nix
deleted file mode 100644
index f6d21f95dbfc1..0000000000000
--- a/pkgs/development/python-modules/lightning/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pytest
-, jinja2
-, matplotlib
-, numpy
-, requests
-, six
-}:
-
-buildPythonPackage rec {
-  version = "1.2.1";
-  pname = "lightning-python";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "3987d7d4a634bdb6db9bcf212cf4d2f72bab5bc039f4f6cbc02c9d01c4ade792";
-  };
-
-  buildInputs = [ pytest ];
-  propagatedBuildInputs = [ jinja2 matplotlib numpy requests six ];
-
-  meta = with lib; {
-    description = "A Python client library for the Lightning data visualization server";
-    homepage = "http://lightning-viz.org";
-    license = licenses.mit;
-  };
-
-}
diff --git a/pkgs/development/python-modules/limnoria/default.nix b/pkgs/development/python-modules/limnoria/default.nix
index 428b199294ccd..6f07c8854862e 100644
--- a/pkgs/development/python-modules/limnoria/default.nix
+++ b/pkgs/development/python-modules/limnoria/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "limnoria";
-  version = "2023.1.12";
+  version = "2023.1.28";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-V3DkIsnVv/HekWuOnIKnMHhccDGWun7mF7AcBSEsy6o=";
+    hash = "sha256-yIKJAW5hb7EOUiS7G+Q4QAESfG4dbfqHScaQBKLMkeM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mediapy/default.nix b/pkgs/development/python-modules/mediapy/default.nix
index 44190b11e5995..333f55ce42281 100644
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ ipython matplotlib numpy pillow ];
 
+  format = "flit";
+
   pythonImportsCheck = [ "mediapy" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/moat-ble/default.nix b/pkgs/development/python-modules/moat-ble/default.nix
index 5131fd048603f..2e55edd7aedb0 100644
--- a/pkgs/development/python-modules/moat-ble/default.nix
+++ b/pkgs/development/python-modules/moat-ble/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-dy1Fm0Z1PUsPY8QTiXUcWSi+csFnTUsobSkA92m06QI=";
   };
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Moat BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/moat-ble";
+    changelog = "https://github.com/Bluetooth-Devices/moat-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/n3fit/default.nix b/pkgs/development/python-modules/n3fit/default.nix
new file mode 100644
index 0000000000000..5c8b06b74a658
--- /dev/null
+++ b/pkgs/development/python-modules/n3fit/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, hyperopt
+, keras
+, nnpdf
+, psutil
+, tensorflow
+, validphys2
+}:
+
+buildPythonPackage rec {
+  pname = "n3fit";
+  version = "4.0";
+  format = "setuptools";
+
+  inherit (nnpdf) src;
+
+  prePatch = ''
+    cd n3fit
+  '';
+
+  postPatch = ''
+    substituteInPlace src/n3fit/version.py \
+      --replace '= __give_git()' '= "'$version'"'
+  '';
+
+  propagatedBuildInputs = [
+    hyperopt
+    keras
+    psutil
+    tensorflow
+    validphys2
+  ];
+
+  postInstall = ''
+    for prog in "$out"/bin/*; do
+      wrapProgram "$prog" --set PYTHONPATH "$PYTHONPATH:$(toPythonPath "$out")"
+    done
+  '';
+
+  doCheck = false; # no tests
+  pythonImportsCheck = [ "n3fit" ];
+
+  meta = with lib; {
+    description = "NNPDF fitting framework";
+    homepage = "https://docs.nnpdf.science";
+    inherit (nnpdf.meta) license;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/oralb-ble/default.nix b/pkgs/development/python-modules/oralb-ble/default.nix
index c0f2840763ead..689cd79033688 100644
--- a/pkgs/development/python-modules/oralb-ble/default.nix
+++ b/pkgs/development/python-modules/oralb-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "oralb-ble";
-  version = "0.17.4";
+  version = "0.17.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-KvvcyeYXBtV/sUKMv+1xoXH9ALUX46EWS/STFZkCnUQ=";
+    hash = "sha256-Lwrr5XzU2pbx3cYkvYtHgXFhGnz3cMBnNFWCpuY3ltg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oslo-log/default.nix b/pkgs/development/python-modules/oslo-log/default.nix
index d981114b7301f..7d8443a14b3b5 100644
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "oslo-log";
-  version = "5.0.2";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "oslo.log";
     inherit version;
-    hash = "sha256-5F5zEqpxUooWc2zkUVK+PxrxI/XvYqqB2gRoBVhPzKM=";
+    hash = "sha256-9qw3r5WRjgXXod19CwVSuosisuQwhi6zNt5ZLSXITyk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pc-ble-driver-py/default.nix b/pkgs/development/python-modules/pc-ble-driver-py/default.nix
index b9f8486aa5d64..61072507e2943 100644
--- a/pkgs/development/python-modules/pc-ble-driver-py/default.nix
+++ b/pkgs/development/python-modules/pc-ble-driver-py/default.nix
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "NordicSemiconductor";
     repo = "pc-ble-driver-py";
-    rev = "v${version}";
-    sha256 = "sha256-brC33ar2Jq3R2xdrklvVsQKf6pcnKwD25PO4TIvXgTg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-brC33ar2Jq3R2xdrklvVsQKf6pcnKwD25PO4TIvXgTg=";
   };
 
   nativeBuildInputs = [
@@ -57,8 +57,9 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Bluetooth Low Energy nRF5 SoftDevice serialization";
     homepage = "https://github.com/NordicSemiconductor/pc-ble-driver-py";
+    changelog = "https://github.com/NordicSemiconductor/pc-ble-driver-py/releases/tag/v${version}";
     license = licenses.unfreeRedistributable;
-    platforms = platforms.unix;
     maintainers = with maintainers; [ gebner ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/primer3/default.nix b/pkgs/development/python-modules/primer3/default.nix
index 14c96e5734abd..d3d44259fefbf 100644
--- a/pkgs/development/python-modules/primer3/default.nix
+++ b/pkgs/development/python-modules/primer3/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "primer3";
-  version = "0.6.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "libnano";
     repo = "primer3-py";
-    rev = version;
-    sha256 = "1glybwp9w2m1ydvaphr41gj31d8fvlh40s35galfbjqa563si72g";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-o9B8TN3mOchOO7dz34mI3NDtIhHSlA9+lMNsYcxhTE0=";
   };
 
   nativeBuildInputs = [ cython ]
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index a862fa69a9a2f..a330a93928768 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , python
+, pythonAtLeast
 , pythonOlder
 , arrow-cpp
 , cffi
@@ -17,18 +18,15 @@
 , pkg-config
 , scipy
 , setuptools-scm
-, six
 }:
 
 let
   zero_or_one = cond: if cond then 1 else 0;
-
-  _arrow-cpp = arrow-cpp.override { python3 = python; };
 in
 
 buildPythonPackage rec {
   pname = "pyarrow";
-  inherit (_arrow-cpp) version src;
+  inherit (arrow-cpp) version src;
 
   disabled = pythonOlder "3.7";
 
@@ -41,13 +39,14 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  buildInputs = [ arrow-cpp ];
+
   propagatedBuildInputs = [
     cffi
     cloudpickle
     fsspec
     numpy
     scipy
-    six
   ];
 
   nativeCheckInputs = [
@@ -60,20 +59,24 @@ buildPythonPackage rec {
   PYARROW_BUILD_TYPE = "release";
 
   PYARROW_WITH_DATASET = zero_or_one true;
-  PYARROW_WITH_FLIGHT = zero_or_one _arrow-cpp.enableFlight;
+  PYARROW_WITH_FLIGHT = zero_or_one arrow-cpp.enableFlight;
   PYARROW_WITH_HDFS = zero_or_one true;
   PYARROW_WITH_PARQUET = zero_or_one true;
-  PYARROW_WITH_PLASMA = zero_or_one (!stdenv.isDarwin);
-  PYARROW_WITH_S3 = zero_or_one _arrow-cpp.enableS3;
+  PYARROW_WITH_PARQUET_ENCRYPTION = zero_or_one true;
+  # Plasma is deprecated since arrow 10.0.0
+  PYARROW_WITH_PLASMA = zero_or_one false;
+  PYARROW_WITH_S3 = zero_or_one arrow-cpp.enableS3;
+  PYARROW_WITH_GCS = zero_or_one arrow-cpp.enableGcs;
+  PYARROW_BUNDLE_ARROW_CPP_HEADERS = zero_or_one false;
 
   PYARROW_CMAKE_OPTIONS = [
     "-DCMAKE_INSTALL_RPATH=${ARROW_HOME}/lib"
   ];
 
-  ARROW_HOME = _arrow-cpp;
-  PARQUET_HOME = _arrow-cpp;
+  ARROW_HOME = arrow-cpp;
+  PARQUET_HOME = arrow-cpp;
 
-  ARROW_TEST_DATA = lib.optionalString doCheck _arrow-cpp.ARROW_TEST_DATA;
+  ARROW_TEST_DATA = lib.optionalString doCheck arrow-cpp.ARROW_TEST_DATA;
 
   doCheck = true;
 
@@ -85,6 +88,13 @@ buildPythonPackage rec {
     export PYARROW_PARALLEL=$NIX_BUILD_CORES
   '';
 
+  postInstall = ''
+    # copy the pyarrow C++ header files to the appropriate location
+    pyarrow_include="$out/${python.sitePackages}/pyarrow/include"
+    mkdir -p "$pyarrow_include/arrow/python"
+    find "$PWD/pyarrow/src/arrow" -type f -name '*.h' -exec cp {} "$pyarrow_include/arrow/python" \;
+  '';
+
   pytestFlagsArray = [
     # Deselect a single test because pyarrow prints a 2-line error message where
     # only a single line is expected. The additional line of output comes from
@@ -102,6 +112,8 @@ buildPythonPackage rec {
     "--deselect=pyarrow/tests/test_pandas.py::test_threaded_pandas_import"
     # Flaky test, works locally but not on Hydra
     "--deselect=pyarrow/tests/test_csv.py::TestThreadedCSVTableRead::test_cancellation"
+    # expects arrow-cpp headers to be bundled
+    "--deselect=pyarrow/tests/test_cpp_internals.py::test_pyarrow_include"
   ] ++ lib.optionals stdenv.isDarwin [
     # Requires loopback networking
     "--deselect=pyarrow/tests/test_ipc.py::test_socket_"
@@ -109,8 +121,18 @@ buildPythonPackage rec {
     "--deselect=pyarrow/tests/test_flight.py::test_large_descriptor"
     "--deselect=pyarrow/tests/test_flight.py::test_large_metadata_client"
     "--deselect=pyarrow/tests/test_flight.py::test_none_action_side_effect"
+    # fails to compile
+    "--deselect=pyarrow/tests/test_cython.py::test_cython_api"
+  ] ++ lib.optionals (pythonAtLeast "3.11") [
+    # Repr output is printing number instead of enum name so these tests fail
+    "--deselect=pyarrow/tests/test_fs.py::test_get_file_info"
+  ] ++ lib.optionals stdenv.isLinux [
+    # this test requires local networking
+    "--deselect=pyarrow/tests/test_fs.py::test_filesystem_from_uri_gcs"
   ];
 
+  disabledTests = [ "GcsFileSystem" ];
+
   dontUseSetuptoolsCheck = true;
 
   preCheck = ''
@@ -125,7 +147,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [
     "pyarrow"
-  ] ++ map (module: "pyarrow.${module}") ([
+  ] ++ map (module: "pyarrow.${module}") [
     "compute"
     "csv"
     "dataset"
@@ -135,9 +157,7 @@ buildPythonPackage rec {
     "hdfs"
     "json"
     "parquet"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "plasma"
-  ]);
+  ];
 
   meta = with lib; {
     description = "A cross-language development platform for in-memory data";
diff --git a/pkgs/development/python-modules/pyipma/default.nix b/pkgs/development/python-modules/pyipma/default.nix
index 9befc34acbb62..8d2d153ebb9ce 100644
--- a/pkgs/development/python-modules/pyipma/default.nix
+++ b/pkgs/development/python-modules/pyipma/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pyipma";
-  version = "3.0.5";
+  version = "3.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "dgomes";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-KyXHNkP/XJlTdVFdP91x3udMquQju8G2VUHLPvZymtk=";
+    hash = "sha256-BwW8gUFeinZ9Z/v1orJKRTqt2WxVMD+hQj+A3gU1LDI=";
   };
 
   propagatedBuildInputs = [
@@ -52,6 +52,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to retrieve information from Instituto Português do Mar e Atmosfera";
     homepage = "https://github.com/dgomes/pyipma";
+    changelog = "https://github.com/dgomes/pyipma/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyflunearyou/default.nix b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
index cd04d00ee32e5..ff2a4a4323c1d 100644
--- a/pkgs/development/python-modules/pyflunearyou/default.nix
+++ b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
@@ -1,7 +1,6 @@
 { lib
 , aiohttp
 , aresponses
-, aiocache
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
@@ -9,39 +8,29 @@
 , pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
-, pythonRelaxDepsHook
-, msgpack
 , ujson
 }:
 
 buildPythonPackage rec {
-  pname = "pyflunearyou";
-  version = "2021.10.0";
+  pname = "pyoutbreaksnearme";
+  version = "2022.10.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-Q65OSE4qckpvaIvZULBR434i7hwuVM97eSq1Blb1oIU=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-D7oXkKDSg+yF+j1WyG/VVY12hLU6oyhEtxLrF6IkMSA=";
   };
 
-  pythonRelaxDeps = [
-    "aiocache"
-    "ujson"
-  ];
-
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
     aiohttp
-    aiocache
-    msgpack
     ujson
   ];
 
@@ -58,12 +47,13 @@ buildPythonPackage rec {
   ];
 
   pythonImportsCheck = [
-    "pyflunearyou"
+    "pyoutbreaksnearme"
   ];
 
   meta = with lib; {
-    description = "Python library for retrieving UV-related information from Flu Near You";
-    homepage = "https://github.com/bachya/pyflunearyou";
+    description = "Library for retrieving data from for Outbreaks Near Me";
+    homepage = "https://github.com/bachya/pyoutbreaksnearme";
+    changelog = "https://github.com/bachya/pyoutbreaksnearme/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index 1c69f426b1695..feae849013045 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -37,6 +37,12 @@ buildPythonPackage rec {
     toml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
+  disabledTests = [
+    "test_wait_raise_assertion_false" # racy
+  ];
+
   pythonImportsCheck = [
     "pytest_httpserver"
   ];
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index a0e9bb1fb2a6b..c6e8b7e915d6c 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -1,23 +1,31 @@
-{ lib, buildPythonPackage, pythonOlder, fetchPypi, pytest, mock }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, setuptools
+, packaging
+, pytest
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "10.3";
+  version = "11.0";
+  format = "pyproject";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2CRNeZ+Jpu215XMB3a6ztvENZpFjjVHoCzcTEVkuKMY=";
+    hash = "sha256-zuWeTm8Nc65j+6CZhlMUupuRW3GTSVQREPoBL/tu+xM=";
   };
 
-  buildInputs = [ pytest ];
+  nativeBuildInputs = [ setuptools ];
 
-  nativeCheckInputs = [ mock pytest ];
+  buildInputs = [ pytest ];
+  propagatedBuildInputs = [ packaging ];
 
-  checkPhase = ''
-    py.test test_pytest_rerunfailures.py
-  '';
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Pytest plugin to re-run tests to eliminate flaky failures";
diff --git a/pkgs/development/python-modules/python-magic/default.nix b/pkgs/development/python-modules/python-magic/default.nix
index 725849fee078f..358a647d52d94 100644
--- a/pkgs/development/python-modules/python-magic/default.nix
+++ b/pkgs/development/python-modules/python-magic/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , file
 , pytestCheckHook
@@ -23,6 +24,11 @@ buildPythonPackage rec {
       src = ./libmagic-path.patch;
       libmagic = "${file}/lib/libmagic${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
+    (fetchpatch {
+      name = "update-test-for-upstream-added-gzip-extensions.patch";
+      url = "https://github.com/ahupp/python-magic/commit/4ffcd59113fa26d7c2e9d5897b1eef919fd4b457.patch";
+      hash = "sha256-67GpjlGiR4/os/iZ69V+ZziVLpjmid+7t+gQ2aQy9I0=";
+    })
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index e162a4a6cb615..b8594e51f8391 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2022.7";
+  version = "2022.7.1";
 
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fM+ue0ssBnRkpnM8YmFnP9uP0b6QVGA5a5egc+n6aDo=";
+    hash = "sha256-AaBoHEuWhKKDBGFeulXRqzGuAL9o7BV+w3CKgYLbvNA=";
   };
 
   nativeCheckInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/pyweatherflowrest/default.nix b/pkgs/development/python-modules/pyweatherflowrest/default.nix
index b1384496325b0..c03a4d01b170b 100644
--- a/pkgs/development/python-modules/pyweatherflowrest/default.nix
+++ b/pkgs/development/python-modules/pyweatherflowrest/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyweatherflowrest";
-  version = "1.0.8";
+  version = "1.0.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "briis";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1swyqdnvhwaigqhjn5a22gi8if4bl8alfrigln4qa0jl9z03kg09";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LFA1GJCYFIWl7/YblRrYgAB4lbELpzhCJyjB8aCkJ/E=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to get data from WeatherFlow Weather Stations";
     homepage = "https://github.com/briis/pyweatherflowrest";
+    changelog = "https://github.com/briis/pyweatherflowrest/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/qingping-ble/default.nix b/pkgs/development/python-modules/qingping-ble/default.nix
index 21053b8c75bcb..8140226b4dd95 100644
--- a/pkgs/development/python-modules/qingping-ble/default.nix
+++ b/pkgs/development/python-modules/qingping-ble/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-vfezalq3x9KAMtwixUkIVQIwBO2zd+BDl+JwdRqBn7w=";
   };
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Qingping BLE devices";
     homepage = "https://github.com/bluetooth-devices/qingping-ble";
+    changelog = "https://github.com/Bluetooth-Devices/qingping-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/quantiphy/default.nix b/pkgs/development/python-modules/quantiphy/default.nix
index 38ff4bc434ff9..b05a0428f976f 100644
--- a/pkgs/development/python-modules/quantiphy/default.nix
+++ b/pkgs/development/python-modules/quantiphy/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "quantiphy";
-  version = "2.18";
+  version = "2.19";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "KenKundert";
     repo = "quantiphy";
     rev = "v${version}";
-    hash = "sha256-KXZQTal5EQDrMNV9QKeuLeYYDaMfAJlEDEagq2XG9/Q=";
+    hash = "sha256-oSWq/D1EX6mxUDElfujyOSEtql0csAm72u2B5RuQddE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/raincloudy/default.nix b/pkgs/development/python-modules/raincloudy/default.nix
index da4a3846a95fb..6a223bb4fb762 100644
--- a/pkgs/development/python-modules/raincloudy/default.nix
+++ b/pkgs/development/python-modules/raincloudy/default.nix
@@ -1,12 +1,18 @@
 { lib
+, aiohttp
+, aioresponses
 , beautifulsoup4
 , buildPythonPackage
 , fetchFromGitHub
 , html5lib
+, pytest-asyncio
+, pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
 , requests
 , requests-mock
+, setuptools
+, setuptools-scm
 , urllib3
 }:
 
@@ -24,7 +30,25 @@ buildPythonPackage rec {
     hash = "sha256-qCkBVirM09iA1sXiOB9FJns8bHjQq7rRk8XbRWrtBDI=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  postPatch = ''
+    # https://github.com/vanstinator/raincloudy/pull/60
+    substituteInPlace setup.py \
+      --replace "bs4" "beautifulsoup4" \
+
+    # fix raincloudy.aio package discovery, by relying on
+    # autodiscovery instead.
+    sed -i '/packages=/d' setup.py
+  '';
+
   propagatedBuildInputs = [
+    aiohttp
     requests
     beautifulsoup4
     urllib3
@@ -32,19 +56,16 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    aioresponses
+    pytest-asyncio
+    pytest-aiohttp
     pytestCheckHook
     requests-mock
   ];
 
-  postPatch = ''
-    # https://github.com/vanstinator/raincloudy/pull/60
-    substituteInPlace setup.py \
-      --replace "bs4" "beautifulsoup4" \
-      --replace "html5lib==1.0.1" "html5lib"
-  '';
-
   pythonImportsCheck = [
     "raincloudy"
+    "raincloudy.aio"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/rapt-ble/default.nix b/pkgs/development/python-modules/rapt-ble/default.nix
new file mode 100644
index 0000000000000..7c4f104c8cde1
--- /dev/null
+++ b/pkgs/development/python-modules/rapt-ble/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, bluetooth-data-tools
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "rapt-ble";
+  version = "0.1.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "sairon";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-upTtVqxVHrqLSGTSGCiCVlDa2NEuuqe+0W2DM+UhTnc=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=rapt_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-data-tools
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "rapt_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for RAPT Pill hydrometer BLE devices";
+    homepage = "https://github.com/sairon/rapt-ble";
+    changelog = "https://github.com/sairon/rapt-ble/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/remotezip/default.nix b/pkgs/development/python-modules/remotezip/default.nix
new file mode 100644
index 0000000000000..5a79b68e6b851
--- /dev/null
+++ b/pkgs/development/python-modules/remotezip/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, requests
+, tabulate
+, pytestCheckHook
+, requests-mock
+}:
+
+buildPythonPackage {
+  pname = "remotezip";
+  version = "0.12.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "gtsystem";
+    repo = "python-remotezip";
+    # upstream does not tag releases, determined with git blame
+    # pypi archive lacks files for tests
+    rev = "da62e115bdb2071ad08a8c91f7ae48f2c1827e0c";
+    hash = "sha256-su4dlV8KZuewf/yGdTnGHK9hNLHwGe10ditmFcne4Us=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    tabulate
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    requests-mock
+  ];
+
+  pythonImportsCheck = [
+    "remotezip"
+  ];
+
+  meta = with lib; {
+    description = "Python module to access single members of a zip archive without downloading the full content";
+    homepage = "https://github.com/gtsystem/python-remotezip";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 7f9091d87f144..13bc07faed3a8 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -67,6 +67,8 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
+  requiredSystemFeatures = [ "big-parallel" ]; # the tests need lots of CPU time
+
   passthru = {
     blas = numpy.blas;
   };
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index 0f2ffa7138e69..c2129a38bc796 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -11,11 +11,12 @@
 , pygtrie
 , pythonOlder
 , setuptools
+, shortuuid
 }:
 
 buildPythonPackage rec {
   pname = "scmrepo";
-  version = "0.1.7";
+  version = "0.1.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-F+t/3Nfcw+LG9Kh0Je2JwPWUWBNsZXTEaQOKaTT5ig0=";
+    hash = "sha256-WXePQMHCAmcGUHNNHBaqNQisewMUR87iJC0K2ltYVBE=";
   };
 
   postPatch = ''
@@ -46,6 +47,7 @@ buildPythonPackage rec {
     pathspec
     pygit2
     pygtrie
+    shortuuid
   ];
 
   # Requires a running Docker instance
diff --git a/pkgs/development/python-modules/sensorpro-ble/default.nix b/pkgs/development/python-modules/sensorpro-ble/default.nix
index df3be2b3fe4e2..4c8412e7f9363 100644
--- a/pkgs/development/python-modules/sensorpro-ble/default.nix
+++ b/pkgs/development/python-modules/sensorpro-ble/default.nix
@@ -19,10 +19,15 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-Zqa6qa0Jw79Iu4VEw6KN0GsZcC1X7OpiYUiyT4zwKyY=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=sensorpro_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -37,11 +42,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=sensorpro_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   pythonImportsCheck = [
     "sensorpro_ble"
   ];
diff --git a/pkgs/development/python-modules/shortuuid/default.nix b/pkgs/development/python-modules/shortuuid/default.nix
index 34ad5aa939088..fda1e1896a504 100644
--- a/pkgs/development/python-modules/shortuuid/default.nix
+++ b/pkgs/development/python-modules/shortuuid/default.nix
@@ -28,6 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to generate concise, unambiguous and URL-safe UUIDs";
     homepage = "https://github.com/stochastic-technologies/shortuuid/";
+    changelog = "https://github.com/skorokithakis/shortuuid/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ zagy ];
   };
diff --git a/pkgs/development/python-modules/sqlglot/default.nix b/pkgs/development/python-modules/sqlglot/default.nix
index 05dfba9497293..3d12618b8e45c 100644
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@@ -5,10 +5,11 @@
 , pytestCheckHook
 , python-dateutil
 , duckdb
+, pyspark
 }:
 buildPythonPackage rec {
   pname = "sqlglot";
-  version = "6.0.7";
+  version = "10.5.2";
 
   disabled = pythonOlder "3.8";
 
@@ -16,12 +17,15 @@ buildPythonPackage rec {
     repo = "sqlglot";
     owner = "tobymao";
     rev = "v${version}";
-    hash = "sha256-7PBhf9NN/mCi92xSkB9ygfmfxTyOYaEyrNvL309sG5Y=";
+    hash = "sha256-ZFc2aOhCTRFlrzgnYDSdIZxRqKZ8FvkYSZRU0OMHI34=";
   };
 
   propagatedBuildInputs = [ python-dateutil ];
 
-  nativeCheckInputs = [ pytestCheckHook duckdb ];
+  nativeCheckInputs = [ pytestCheckHook duckdb pyspark ];
+
+  # these integration tests assume a running Spark instance
+  disabledTestPaths = [ "tests/dataframe/integration" ];
 
   pythonImportsCheck = [ "sqlglot" ];
 
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index 73b5a5727a38f..9e3e1560c2083 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -24,6 +24,11 @@ buildPythonPackage rec {
     sha256 = "1bmj76gi8401lcqdaaznfmz9yf11myy1bzivqwwq08z3dwzxswck";
   };
 
+  # https://github.com/sirfz/tesserocr/issues/314
+  postPatch = ''
+    sed -i '/allheaders.h/a\    pass\n\ncdef extern from "leptonica/pix_internal.h" nogil:' tesseract.pxd
+  '';
+
   nativeBuildInputs = [
     cython
     pkg-config
diff --git a/pkgs/development/python-modules/thermopro-ble/default.nix b/pkgs/development/python-modules/thermopro-ble/default.nix
index ad934e71e364a..1a07edc441d48 100644
--- a/pkgs/development/python-modules/thermopro-ble/default.nix
+++ b/pkgs/development/python-modules/thermopro-ble/default.nix
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Thermopro BLE devices";
     homepage = "https://github.com/bluetooth-devices/thermopro-ble";
+    changelog = "https://github.com/Bluetooth-Devices/thermopro-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index c64f36c8df321..f1a8e72a591db 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -111,6 +111,15 @@ in buildPythonPackage rec {
     # base is 10.12. Until we upgrade, we can fall back on the older
     # pthread support.
     ./pthreadpool-disable-gcd.diff
+  ] ++ [
+    # PyTorch fails to build on gcc 12 due to gloo
+    # https://github.com/pytorch/pytorch/issues/77614
+    (fetchpatch {
+      url = "https://github.com/facebookincubator/gloo/commit/4a5e339b764261d20fc409071dc7a8b8989aa195.patch";
+      stripLen = 1;
+      extraPrefix = "third_party/gloo/";
+      hash = "sha256-UxR1r7F6g76BWj3GBIrSy5t+YZDCWy6mMddwx+hon5w=";
+    })
   ];
 
   postPatch = lib.optionalString rocmSupport ''
@@ -204,7 +213,11 @@ in buildPythonPackage rec {
   #
   # Also of interest: pytorch ignores CXXFLAGS uses CFLAGS for both C and C++:
   # https://github.com/pytorch/pytorch/blob/v1.11.0/setup.py#L17
-  NIX_CFLAGS_COMPILE = lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ];
+  NIX_CFLAGS_COMPILE = lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ]
+  # Suppress gcc regression: avx512 math function raises uninitialized variable warning
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105593
+  # See also: Fails to compile with GCC 12.1.0 https://github.com/pytorch/pytorch/issues/77939
+  ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=maybe-uninitialized" "-Wno-error=uninitialized" ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/python-modules/types-protobuf/default.nix b/pkgs/development/python-modules/types-protobuf/default.nix
index 862b8ff805c29..967d08fc0d7a9 100644
--- a/pkgs/development/python-modules/types-protobuf/default.nix
+++ b/pkgs/development/python-modules/types-protobuf/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-protobuf";
-  version = "4.21.0.2";
+  version = "4.21.0.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ffSD00rT/LH6f/8Qc1YNWWyawfQZz6hRsiDJqTOGyZg=";
+    sha256 = "sha256-gZp8Z+aUduOcPwyYcbu57oIxNkXTF7ba62CslaMJ29M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/uhi/default.nix b/pkgs/development/python-modules/uhi/default.nix
new file mode 100644
index 0000000000000..948f2108d2610
--- /dev/null
+++ b/pkgs/development/python-modules/uhi/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, hatchling
+, hatch-vcs
+, numpy
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "uhi";
+  version = "0.3.3";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "800caf3a5f1273b08bcc3bb4b49228fe003942e23423812b0110546aad9a24be";
+  };
+
+  buildInputs = [
+    hatchling
+    hatch-vcs
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Universal Histogram Interface";
+    homepage = "https://uhi.readthedocs.io/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/validphys2/default.nix b/pkgs/development/python-modules/validphys2/default.nix
index c417cb47e2d31..38debb91be11b 100644
--- a/pkgs/development/python-modules/validphys2/default.nix
+++ b/pkgs/development/python-modules/validphys2/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace src/validphys/version.py \
-      --replace '= __give_git()' '= "${version}"'
+      --replace '= __give_git()' '= "'$version'"'
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/vowpalwabbit/default.nix b/pkgs/development/python-modules/vowpalwabbit/default.nix
index 40303c29f9c99..e50a91c060394 100644
--- a/pkgs/development/python-modules/vowpalwabbit/default.nix
+++ b/pkgs/development/python-modules/vowpalwabbit/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonPackage rec {
   pname = "vowpalwabbit";
-  version = "9.6.0";
+  version = "9.7.0";
 
   src = fetchPypi{
     inherit pname version;
-    sha256 = "sha256-LHs98lccPjub5GDPB3dxtkOYCDxri04CVpSSsypa4xI=";
+    sha256 = "sha256-O3WnG3JQ7CEHMPYTmE9pgnS8YZs717P6wBKBnXIvvFI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch b/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
index 93db54b0c6e6c..8e70f0069d654 100644
--- a/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
+++ b/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
@@ -20,18 +20,15 @@ name that has the same encoding in each normal form.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
-index 651c034..9b94ac8 100644
+index 5a6db16..42cf121 100644
 --- a/tests/test_bdist_wheel.py
 +++ b/tests/test_bdist_wheel.py
-@@ -58,7 +58,7 @@ def test_unicode_record(wheel_paths):
+@@ -69,7 +69,7 @@ def test_unicode_record(wheel_paths):
      with ZipFile(path) as zf:
-         record = zf.read('unicode.dist-0.1.dist-info/RECORD')
+         record = zf.read("unicode.dist-0.1.dist-info/RECORD")
  
--    assert u'åäö_日本語.py'.encode('utf-8') in record
-+    assert u'æɐø_日本價.py'.encode('utf-8') in record
+-    assert "åäö_日本語.py".encode() in record
++    assert "æɐø_日本價.py".encode() in record
  
  
- def test_licenses_default(dummy_dist, monkeypatch, tmpdir):
--- 
-2.17.2 (Apple Git-113)
-
+ UTF8_PKG_INFO = """\
diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 8735a37b21ff7..3be508a0ec590 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.37.1";
+  version = "0.38.4";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-JlTmUPY3yo/uROyd3nW1dJa23zbLhgQTwcmqZkPOrHs=";
+    hash = "sha256-yZLU0t/nz6kfnnoLL15bybOxN4+SJUaTJsCpGffl1QU=";
     name = "${pname}-${version}-source";
     postFetch = ''
       cd $out
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 7815a36396beb..8dfbd418157a7 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.16.1";
+  version = "0.16.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-JsrOt6LmmhJZ4MBwLVKKt3IMbvAnxJx70AZROhb9gbc=";
+    hash = "sha256-yk3rEOcHIEZLz3qKxeGzHuVUWWxG3GhSt9vc0pXcanQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/xmlschema/default.nix b/pkgs/development/python-modules/xmlschema/default.nix
index 00df9fc517c85..d306f83220e8c 100644
--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "xmlschema";
-  version = "2.2.0";
+  version = "2.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "xmlschema";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KK1F8OVK+19ZWwu+2UtTMiVNyPPoPOv3V1qJFZAu2h4=";
+    hash = "sha256-yF2L5VxUkqJjen5JeCQis4Q1o1KCJtRJ+S52wnS5VQg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index 3e2de3d2afcd7..46f1904faf236 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "1.12.8";
+  version = "1.12.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-04Xl2TBs9RL+KWmJgUY+PDoYN4AAvrcWP7TJBEu5lNU=";
+    hash = "sha256-CO+plbsZzQkxtvz8N3QP71P2V1wPdyp1oeW/424mZks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch b/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
new file mode 100644
index 0000000000000..93db54b0c6e6c
--- /dev/null
+++ b/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
@@ -0,0 +1,37 @@
+From 5879a4bbc34d1eb25e160b15b2f5a4f10eac6bd2 Mon Sep 17 00:00:00 2001
+From: toonn <toonn@toonn.io>
+Date: Mon, 13 Sep 2021 18:07:26 +0200
+Subject: [PATCH] =?UTF-8?q?tests:=20Rename=20a=CC=8Aa=CC=88o=CC=88=5F?=
+ =?UTF-8?q?=E6=97=A5=E6=9C=AC=E8=AA=9E.py=20=3D>=20=C3=A6=C9=90=C3=B8=5F?=
+ =?UTF-8?q?=E6=97=A5=E6=9C=AC=E5=83=B9.py?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+`åäö_日本語.py` normalizes differently in NFC and NFD normal forms. This
+means a hash generated for the source directory can differ depending on
+whether or not the filesystem is normalizing and which normal form it
+uses.
+
+By renaming the file to `æɐø_日本價.py` we avoid this issue by using a
+name that has the same encoding in each normal form.
+---
+ tests/test_bdist_wheel.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
+index 651c034..9b94ac8 100644
+--- a/tests/test_bdist_wheel.py
++++ b/tests/test_bdist_wheel.py
+@@ -58,7 +58,7 @@ def test_unicode_record(wheel_paths):
+     with ZipFile(path) as zf:
+         record = zf.read('unicode.dist-0.1.dist-info/RECORD')
+ 
+-    assert u'åäö_日本語.py'.encode('utf-8') in record
++    assert u'æɐø_日本價.py'.encode('utf-8') in record
+ 
+ 
+ def test_licenses_default(dummy_dist, monkeypatch, tmpdir):
+-- 
+2.17.2 (Apple Git-113)
+
diff --git a/pkgs/development/python2-modules/wheel/default.nix b/pkgs/development/python2-modules/wheel/default.nix
new file mode 100644
index 0000000000000..8735a37b21ff7
--- /dev/null
+++ b/pkgs/development/python2-modules/wheel/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, bootstrapped-pip
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "wheel";
+  version = "0.37.1";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-JlTmUPY3yo/uROyd3nW1dJa23zbLhgQTwcmqZkPOrHs=";
+    name = "${pname}-${version}-source";
+    postFetch = ''
+      cd $out
+      mv tests/testdata/unicode.dist/unicodedist/åäö_日本語.py \
+        tests/testdata/unicode.dist/unicodedist/æɐø_日本價.py
+      patch -p1 < ${./0001-tests-Rename-a-a-o-_-.py-_-.py.patch}
+    '';
+  };
+
+  nativeBuildInputs = [
+    bootstrapped-pip
+    setuptools
+  ];
+
+  # No tests in archive
+  doCheck = false;
+  pythonImportsCheck = [ "wheel" ];
+
+  # We add this flag to ignore the copy installed by bootstrapped-pip
+  pipInstallFlags = [ "--ignore-installed" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pypa/wheel";
+    description = "A built-package format for Python";
+    longDescription = ''
+      This library is the reference implementation of the Python wheel packaging standard,
+      as defined in PEP 427.
+
+      It has two different roles:
+
+      - A setuptools extension for building wheels that provides the bdist_wheel setuptools command
+      - A command line tool for working with wheel files
+
+      It should be noted that wheel is not intended to be used as a library,
+      and as such there is no stable, public API.
+    '';
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ siriobalmelli ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/rr/default.nix b/pkgs/development/tools/analysis/rr/default.nix
index e9437d718cf7a..40a7909f34a12 100644
--- a/pkgs/development/tools/analysis/rr/default.nix
+++ b/pkgs/development/tools/analysis/rr/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace src/Command.cc --replace '_BSD_SOURCE' '_DEFAULT_SOURCE'
     sed '7i#include <math.h>' -i src/Scheduler.cc
+    sed '1i#include <ctime>' -i src/test-monitor/test-monitor.cc
     patchShebangs .
   '';
 
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index bb3d37f4f8769..df6a7976de3e4 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.44.1";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-O758CU70NqRFlbtiy5cmfIHiHdQLxH88BHNZLQVvZ+M=";
+    sha256 = "sha256-tsnW6KoLHEWd/uDZrK2cnVZ2IWftoxZ5zGdYhRdUp9Q=";
   };
 
-  vendorSha256 = "sha256-4ODf6Er7V5KsVUdWjqjv+dfH84PPR+5T29V1AJluoJA=";
+  vendorSha256 = "sha256-crGs7j9hAnGCCFjhigIJVpTM0rr9WgvBq3/ZGt6hwqQ=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 3bec558803b4e..9949ec7ec7c70 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Fix build on ELFv2 powerpc64
+    # https://bugs.kde.org/show_bug.cgi?id=398883
+    (fetchurl {
+      url = "https://github.com/void-linux/void-packages/raw/3e16b4606235885463fc9ab45b4c120f1a51aa28/srcpkgs/valgrind/patches/elfv2-ppc64-be.patch";
+      sha256 = "NV/F+5aqFZz7+OF5oN5MUTpThv4H5PEY9sBgnnWohQY=";
+    })
     # Fix checks on Musl.
     # https://bugs.kde.org/show_bug.cgi?id=453929
     (fetchpatch {
diff --git a/pkgs/development/tools/bbin/default.nix b/pkgs/development/tools/bbin/default.nix
index 606633fd3a1a0..d0956845092f8 100644
--- a/pkgs/development/tools/bbin/default.nix
+++ b/pkgs/development/tools/bbin/default.nix
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation rec {
     mkdir -p $out/share
     cp -r docs $out/share/docs
     wrapProgram $out/bin/bbin \
-      --prefix PATH : "${lib.makeBinPath [ babashka graalvm17-ce ]}"
+      --prefix PATH : "${lib.makeBinPath [ babashka babashka.graalvmDrv ]}"
 
     runHook postInstall
   '';
diff --git a/pkgs/development/tools/bpf-linker/default.nix b/pkgs/development/tools/bpf-linker/default.nix
index d1839eb86fabb..49780a7772e43 100644
--- a/pkgs/development/tools/bpf-linker/default.nix
+++ b/pkgs/development/tools/bpf-linker/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , rustPlatform
 , fetchFromGitHub
-, llvmPackages_14
+, llvmPackages_15
 , zlib
 , ncurses
 , libxml2
@@ -10,21 +10,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bpf-linker";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "aya-rs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jYuBk78aGQLUeNF6d6kjGPuMxEF22XJquHcs23WVGm0=";
+    hash = "sha256-LEZ2to1bzJ/H/XYytuh/7NT7+04aI8chpKIFxxVzM+4=";
   };
 
-  cargoHash = "sha256-X8EVpOxDHwE/wj/gly/wdZ6tsrMrz3kkDe9gEPbk6iw=";
+  cargoHash = "sha256-s8cW7lXtvgemuQueTtAywewnDVJ/WDcz8SBqsC/tO80=";
 
   buildNoDefaultFeatures = true;
   buildFeatures = [ "system-llvm" ];
 
-  nativeBuildInputs = [ llvmPackages_14.llvm ];
+  nativeBuildInputs = [ llvmPackages_15.llvm ];
   buildInputs = [ zlib ncurses libxml2 ];
 
   # fails with: couldn't find crate `core` with expected target triple bpfel-unknown-none
diff --git a/pkgs/development/tools/build-managers/cmake/002-application-services.diff b/pkgs/development/tools/build-managers/cmake/002-application-services.diff
index 7c77336b41be6..56f7cd266b7af 100644
--- a/pkgs/development/tools/build-managers/cmake/002-application-services.diff
+++ b/pkgs/development/tools/build-managers/cmake/002-application-services.diff
@@ -1,20 +1,18 @@
-diff --git a/Source/CMakeLists.txt b/Source/CMakeLists.txt
-index 9a18184fd3..278d146dd1 100644
---- a/Source/CMakeLists.txt
-+++ b/Source/CMakeLists.txt
-@@ -933,7 +933,6 @@ endif()
+diff -Naur cmake-3.25.1-old/Source/CMakeLists.txt cmake-3.25.1-new/Source/CMakeLists.txt
+--- cmake-3.25.1-old/Source/CMakeLists.txt	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Source/CMakeLists.txt	2022-12-19 01:00:08.412064304 -0300
+@@ -916,7 +916,6 @@
  # On Apple we need CoreFoundation and CoreServices
  if(APPLE)
-   target_link_libraries(CMakeLib "-framework CoreFoundation")
--  target_link_libraries(CMakeLib "-framework CoreServices")
+   target_link_libraries(CMakeLib PUBLIC "-framework CoreFoundation")
+-  target_link_libraries(CMakeLib PUBLIC "-framework CoreServices")
  endif()
  
  if(WIN32 AND NOT UNIX)
-diff --git a/Source/cmGlobalXCodeGenerator.cxx b/Source/cmGlobalXCodeGenerator.cxx
-index 77403b076a..d5aac95e1e 100644
---- a/Source/cmGlobalXCodeGenerator.cxx
-+++ b/Source/cmGlobalXCodeGenerator.cxx
-@@ -49,10 +49,6 @@ struct cmLinkImplementation;
+diff -Naur cmake-3.25.1-old/Source/cmGlobalXCodeGenerator.cxx cmake-3.25.1-new/Source/cmGlobalXCodeGenerator.cxx
+--- cmake-3.25.1-old/Source/cmGlobalXCodeGenerator.cxx	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Source/cmGlobalXCodeGenerator.cxx	2022-12-19 01:00:56.065135169 -0300
+@@ -56,10 +56,6 @@
  
  #if !defined(CMAKE_BOOTSTRAP) && defined(__APPLE__)
  #  include <CoreFoundation/CoreFoundation.h>
@@ -25,19 +23,17 @@ index 77403b076a..d5aac95e1e 100644
  #endif
  
  #if !defined(CMAKE_BOOTSTRAP)
-diff --git a/Utilities/cmlibarchive/CMakeLists.txt b/Utilities/cmlibarchive/CMakeLists.txt
-index 79452ffff6..a848731b7e 100644
---- a/Utilities/cmlibarchive/CMakeLists.txt
-+++ b/Utilities/cmlibarchive/CMakeLists.txt
-@@ -2013,11 +2013,6 @@ IF(ENABLE_TEST)
+diff -Naur cmake-3.25.1-old/Utilities/cmlibarchive/CMakeLists.txt cmake-3.25.1-new/Utilities/cmlibarchive/CMakeLists.txt
+--- cmake-3.25.1-old/Utilities/cmlibarchive/CMakeLists.txt	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Utilities/cmlibarchive/CMakeLists.txt	2022-12-19 01:01:43.392205981 -0300
+@@ -2041,10 +2041,6 @@
+   ADD_CUSTOM_TARGET(run_all_tests)
  ENDIF(ENABLE_TEST)
- ENDIF()
  
 -# We need CoreServices on Mac OS.
 -IF(APPLE)
 -  LIST(APPEND ADDITIONAL_LIBS "-framework CoreServices")
 -ENDIF(APPLE)
--
+ 
  add_subdirectory(libarchive)
  IF(0) # CMake does not build libarchive's command-line tools.
- add_subdirectory(cat)
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 0a1e191ba360c..2aff749ebcb0c 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -40,11 +40,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.24.3";
+  version = "3.25.1";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-tTqhD6gr/4TM21kGWSe3LTvuSfTYYmEkn8CYSzs2cpE=";
+    sha256 = "sha256-HFEdCVFq9JNpTtm68TxVlHo2OJZ01lei1eDM7caykdg=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 5591b1634236c..d0306dd33a492 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,19 +1,26 @@
 { lib
+, stdenv
 , fetchpatch
 , installShellFiles
 , ninja
 , pkg-config
 , python3
+, zlib
+, coreutils
 , substituteAll
+, Foundation
+, OpenGL
+, AppKit
+, Cocoa
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "0.64.1";
+  version = "1.0.0";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Oo4DDCM094IIX4FicGLMbUpnce3zHgVf/jdPnmsImrk=";
+    hash = "sha256-qlCkukVXwl59SERqv96FeVfc31g4X/++Zwug6O+szgU=";
   };
 
   patches = [
@@ -61,17 +68,38 @@ python3.pkgs.buildPythonApplication rec {
         "docs/yaml/objects/dep.yaml"
       ];
     })
-  ];
+
+    # tests: avoid unexpected failure when cmake is not installed
+    # https://github.com/mesonbuild/meson/pull/11321
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/a38ad3039d0680f3ac34a6dc487776c79c48acf3.patch";
+      hash = "sha256-9YaXwc+F3Pw4BjuOXqva4MD6DAxX1k5WLbn0xzwuEmw=";
+    })
+  ]
+    # Nixpkgs cctools does not have bitcode support.
+    ++ lib.optional stdenv.isDarwin ./disable-bitcode.patch;
+
+  postPatch = if stdenv.isDarwin then ''
+    rm -r 'test cases/osx/7 bitcode'
+  '' else null;
 
   setupHook = ./setup-hook.sh;
 
-  # Meson included tests since 0.45, however they fail in Nixpkgs because they
-  # require a typical building environment (including C compiler and stuff).
-  # Just for the sake of documentation, the next lines are maintained here.
-  doCheck = false;
   nativeCheckInputs = [ ninja pkg-config ];
+  checkInputs = [ zlib ]
+    ++ lib.optionals stdenv.isDarwin [ Foundation OpenGL AppKit Cocoa ];
   checkPhase = ''
-    python ./run_project_tests.py
+    patchShebangs "test cases"
+    substituteInPlace "test cases/native/8 external program shebang parsing/script.int.in" \
+      --replace /usr/bin/env ${coreutils}/bin/env
+    # requires git, creating cyclic dependency
+    rm -r "test cases/common/66 vcstag"
+    # requires glib, creating cyclic dependency
+    rm -r "test cases/linuxlike/6 subdir include order"
+    rm -r "test cases/linuxlike/9 compiler checks with dependencies"
+    # requires static zlib, see #66461
+    rm -r "test cases/linuxlike/14 static dynamic linkage"
+    HOME="$TMPDIR" python ./run_project_tests.py
   '';
 
   postFixup = ''
@@ -84,6 +112,9 @@ python3.pkgs.buildPythonApplication rec {
 
     # Do not propagate Python
     rm $out/nix-support/propagated-build-inputs
+
+    substituteInPlace "$out/share/bash-completion/completions/meson" \
+      --replace "python3 -c " "${python3.interpreter} -c "
   '';
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/build-managers/meson/disable-bitcode.patch b/pkgs/development/tools/build-managers/meson/disable-bitcode.patch
new file mode 100644
index 0000000000000..a72997c104399
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/disable-bitcode.patch
@@ -0,0 +1,24 @@
+--- a/mesonbuild/compilers/mixins/clang.py
++++ b/mesonbuild/compilers/mixins/clang.py
+@@ -56,10 +56,6 @@ class ClangCompiler(GnuLikeCompiler):
+             {OptionKey('b_colorout'), OptionKey('b_lto_threads'), OptionKey('b_lto_mode'), OptionKey('b_thinlto_cache'),
+              OptionKey('b_thinlto_cache_dir')})
+ 
+-        # TODO: this really should be part of the linker base_options, but
+-        # linkers don't have base_options.
+-        if isinstance(self.linker, AppleDynamicLinker):
+-            self.base_options.add(OptionKey('b_bitcode'))
+         # All Clang backends can also do LLVM IR
+         self.can_compile_suffixes.add('ll')
+ 
+--- a/mesonbuild/linkers/linkers.py
++++ b/mesonbuild/linkers/linkers.py
+@@ -785,7 +785,7 @@ class AppleDynamicLinker(PosixDynamicLinkerMixin, DynamicLinker):
+         return self._apply_prefix('-headerpad_max_install_names')
+ 
+     def bitcode_args(self) -> T.List[str]:
+-        return self._apply_prefix('-bitcode_bundle')
++        raise MesonException('Nixpkgs cctools does not support bitcode bundles')
+ 
+     def fatal_warnings(self) -> T.List[str]:
+         return self._apply_prefix('-fatal_warnings')
diff --git a/pkgs/development/tools/build-managers/waf/default.nix b/pkgs/development/tools/build-managers/waf/default.nix
index 8fcb5f2dbac15..4e42927d0293a 100644
--- a/pkgs/development/tools/build-managers/waf/default.nix
+++ b/pkgs/development/tools/build-managers/waf/default.nix
@@ -8,13 +8,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "waf";
-  version = "2.0.24";
+  version = "2.0.25";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "${pname}-${version}";
-    sha256 = "sha256-nunPDYAy0yfDJpsc+E8SyyFLny19wwrVzxeUOhh7nc4=";
+    sha256 = "sha256-wqZEAfGRHhcd7Xm2pQ0FTjZGfuPafRrZAUdpc7ACoEA=";
   };
 
   nativeBuildInputs = [ python3 ensureNewerSourcesForZipFilesHook ];
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 30d22bc183dc2..e5f017de1e1ef 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -5,19 +5,19 @@
 }:
 buildGoModule rec {
   pname = "coder";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3rGpyJzGkZYUEvKKDzj2I5sqrUImmmX7cXWM9UClPLY=";
+    hash = "sha256-FHBaefwSGZXwn1jdU7zK8WhwjarknvyeUJTlhmk/hPM=";
   };
 
   # integration tests require network access
   doCheck = false;
 
-  vendorHash = "sha256-bb9jBno7elO6qKGjacpX3rxgrpJpGpTxMQtdBYjBzMk=";
+  vendorHash = "sha256-+AvmJkZCFovE2+5Lg98tUvA7f2kBHUMzhl5IyrEGuy8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 20ba407e3d03c..fbdcbcde7c454 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.9.0";
+  version = "7.9.1";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "sha256-YatN0VG3oEUK+vzJzthRnX+EkvUgKq2uIunAoPMoRag=";
+    sha256 = "sha256-ySyarky92+VSo/KzQFrWeh35KDMTQDV34F5iFrARHJs=";
   };
 
-  vendorSha256 = "sha256-nX0r/7V+rgJb3/9O91QskYzBpWXIca7m3Do1QtGuHgg=";
+  vendorHash = "sha256-Oy1wP82ZhdpGHs/gpfdveOK/jI9yuo0D3JtxjLg+W/w=";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/development/tools/cosmoc/default.nix b/pkgs/development/tools/cosmoc/default.nix
deleted file mode 100644
index e64cf02e9f7e9..0000000000000
--- a/pkgs/development/tools/cosmoc/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ stdenv, lib, cosmopolitan }:
-
-stdenv.mkDerivation {
-  pname = "cosmoc";
-  inherit (cosmopolitan) version;
-
-  doInstallCheck = true;
-  dontUnpack = true;
-  dontBuild = true;
-
-  # compiler arguments based on upstream README.md
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    cat <<EOF >$out/bin/cosmoc
-    #!${stdenv.shell}
-    exec ${stdenv.cc}/bin/${stdenv.cc.targetPrefix}gcc \
-      -Os -static -nostdlib -nostdinc -fno-pie -no-pie -mno-red-zone \
-      -fno-omit-frame-pointer -pg -mnop-mcount -mno-tls-direct-seg-refs \
-      "\$@" \
-      -fuse-ld=bfd -Wl,-T,${cosmopolitan}/lib/ape.lds -Wl,--gc-sections \
-      -include ${cosmopolitan}/include/cosmopolitan.h \
-      ${cosmopolitan}/lib/{crt.o,ape-no-modify-self.o,cosmopolitan.a}
-    EOF
-    chmod +x $out/bin/cosmoc
-    runHook postInstall
-  '';
-
-  installCheckPhase = ''
-    printf 'main() { printf("hello world\\n"); }\n' >hello.c
-    $out/bin/cosmoc hello.c
-    ./a.out
-  '';
-
-  meta = with lib; {
-    homepage = "https://justine.lol/cosmopolitan/";
-    description = "compiler for Cosmopolitan C programs";
-    license = licenses.mit;
-    maintainers = teams.cosmopolitan.members;
-  };
-}
diff --git a/pkgs/development/tools/cosmocc/default.nix b/pkgs/development/tools/cosmocc/default.nix
new file mode 100644
index 0000000000000..71028d1a1968f
--- /dev/null
+++ b/pkgs/development/tools/cosmocc/default.nix
@@ -0,0 +1,35 @@
+{ runCommand, lib, cosmopolitan }:
+
+let
+  cosmocc =
+    runCommand "cosmocc"
+      {
+        pname = "cosmocc";
+        inherit (cosmopolitan) version;
+
+        meta = with lib; {
+          homepage = "https://justine.lol/cosmopolitan/";
+          description = "compilers for Cosmopolitan C/C++ programs";
+          license = licenses.mit;
+          maintainers = teams.cosmopolitan.members;
+        };
+        passthru.tests = {
+          cc = runCommand "c-test" { } ''
+            cat > hello.c << END
+            #include <stdio.h>
+            int main() {
+              printf("Hello world!\n");
+              return 0;
+            }
+            END
+            ${cosmocc}/bin/cosmocc hello.c
+            ./a.out > $out
+          '';
+        };
+      } ''
+      mkdir -p $out/bin
+      install ${cosmopolitan.dist}/tool/scripts/{cosmocc,cosmoc++} $out/bin
+      sed 's|/opt/cosmo\([ /]\)|${cosmopolitan.dist}\1|g' -i $out/bin/*
+    '';
+in
+cosmocc
diff --git a/pkgs/development/tools/gci/default.nix b/pkgs/development/tools/gci/default.nix
index 170b9c41dc9fd..0dfd153e2199e 100644
--- a/pkgs/development/tools/gci/default.nix
+++ b/pkgs/development/tools/gci/default.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "gci";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "daixiang0";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qWEEcIbTgYmGVnnTW+hM8e8nw5VLWN1TwzdUIZrxF3s=";
+    sha256 = "sha256-VbN4lRK+6stOApMEdtX32JhKGkCSrafMJbizpWmHRXA=";
   };
 
-  vendorSha256 = "sha256-dlt+i/pEP3RzW4JwndKTU7my2Nn7/2rLFlk8n1sFR60=";
+  vendorHash = "sha256-dlt+i/pEP3RzW4JwndKTU7my2Nn7/2rLFlk8n1sFR60=";
 
   meta = with lib; {
     description = "Controls golang package import order and makes it always deterministic";
diff --git a/pkgs/development/tools/glslviewer/default.nix b/pkgs/development/tools/glslviewer/default.nix
index fcebe93aaa2df..06016bec25b56 100644
--- a/pkgs/development/tools/glslviewer/default.nix
+++ b/pkgs/development/tools/glslviewer/default.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
     sha256 = "0v7x93b61ama0gmzlx1zc56jgi7bvzsfvbkfl82xzwf2h5g1zni7";
   };
 
+  postPatch = ''
+    sed '1i#include <cstring>' -i src/tools/text.cpp # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config ensureNewerSourcesForZipFilesHook python3Packages.six ];
   buildInputs = [
     glfw libGLU glfw libXrandr libXdamage
diff --git a/pkgs/development/tools/jbang/default.nix b/pkgs/development/tools/jbang/default.nix
index 2a1197cae0c8e..0eeeba6fa7675 100644
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:
 
 stdenv.mkDerivation rec {
-  version = "0.102.0";
+  version = "0.103.0";
   pname = "jbang";
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-5T0MQ1b1kA7MVm2drNbUdK6CitTjT76ORPN/BJmsmsM=";
+    sha256 = "sha256-81Le1xVftyQkt5Jm2JXRxID/ySNS1Tcl+BRIsDYeg1k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/kustomize/kustomize-sops.nix b/pkgs/development/tools/kustomize/kustomize-sops.nix
index 28c80444650d2..6136c5b6cb22a 100644
--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kustomize-sops";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "viaduct-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8CZcPZLainc7iRZ5Ul27QxW3oK7sikCjzCBEkfCeNUc=";
+    sha256 = "sha256-piCsae2B+FC+wi/vCCtPY76O4eMXJeNufFo31QkHCAU=";
   };
 
-  vendorHash = "sha256-GBjMN6pyB+48e5LNqLBbh6a5fC9P0T53CZUPGNcbBDc=";
+  vendorHash = "sha256-vTP2wM7MqiSfP+3Gd0Ab5t0al5xL8rw3kl7bOT19zU4=";
 
   installPhase = ''
     mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
diff --git a/pkgs/development/tools/misc/binutils/build-components-separately.patch b/pkgs/development/tools/misc/binutils/build-components-separately.patch
deleted file mode 100644
index 0b4162d848803..0000000000000
--- a/pkgs/development/tools/misc/binutils/build-components-separately.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-diff --git a/bfd/configure.ac b/bfd/configure.ac
-index fec067b2135..377e1f5443f 100644
---- a/bfd/configure.ac
-+++ b/bfd/configure.ac
-@@ -292,30 +292,16 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
- 
- LT_LIB_M
- 
--# When building a shared libbfd, link against the pic version of libiberty
--# so that apps that use libbfd won't need libiberty just to satisfy any
--# libbfd references.
--# We can't do that if a pic libiberty is unavailable since including non-pic
--# code would insert text relocations into libbfd.
- SHARED_LIBADD=
--SHARED_LDFLAGS=
-+SHARED_LDFLAGS=-liberty
- if test "$enable_shared" = "yes"; then
--changequote(,)dnl
--  x=`sed -n -e 's/^[ 	]*PICFLAG[ 	]*=[ 	]*//p' < ../libiberty/Makefile | sed -n '$p'`
--changequote([,])dnl
--  if test -n "$x"; then
--    SHARED_LIBADD="-L`pwd`/../libiberty/pic -liberty"
--  fi
--fi
--
- SHARED_LIBADD="$SHARED_LIBADD $LIBINTL"
- 
--if test "$enable_shared" = "yes"; then
-   case "${host}" in
-   # More hacks to build DLLs on Windows.
-   *-*-cygwin*)
-     SHARED_LDFLAGS="-no-undefined"
--    SHARED_LIBADD="-L`pwd`/../libiberty -liberty $SHARED_LIBADD -lcygwin -lkernel32"
-+    SHARED_LIBADD="-liberty $SHARED_LIBADD -lcygwin -lkernel32"
-   ;;
-   esac
- 
-diff --git a/opcodes/Makefile.am b/opcodes/Makefile.am
-index 0e04b4c05c4..848a02662e7 100644
---- a/opcodes/Makefile.am
-+++ b/opcodes/Makefile.am
-@@ -51,7 +51,7 @@ libopcodes_la_LDFLAGS += -rpath $(rpath_bfdlibdir)
- endif
- 
- # This is where bfd.h lives.
--BFD_H = ../bfd/bfd.h
-+BFD_H = $(BFDDIR)/bfd.h
- 
- BUILD_LIBS = @BUILD_LIBS@
- BUILD_LIB_DEPS = @BUILD_LIB_DEPS@
-@@ -303,7 +303,7 @@ OFILES = @BFD_MACHINES@
- # development.sh is used to determine -Werror default.
- CONFIG_STATUS_DEPENDENCIES = $(BFDDIR)/development.sh
- 
--AM_CPPFLAGS = -I. -I$(srcdir) -I../bfd -I$(INCDIR) -I$(BFDDIR) @HDEFINES@ @INCINTL@
-+AM_CPPFLAGS = -I. -I$(srcdir) -I$(INCDIR) -I$(BFDDIR) @HDEFINES@ @INCINTL@
- 
- disassemble.lo: disassemble.c
- if am__fastdepCC
-@@ -327,9 +327,18 @@ libopcodes_la_SOURCES =  dis-buf.c disassemble.c dis-init.c
--libopcodes_la_DEPENDENCIES = $(OFILES) @SHARED_DEPENDENCIES@
-+libopcodes_la_DEPENDENCIES = $(OFILES) @SHARED_DEPENDENCIES@ libtool-soversion
- libopcodes_la_LIBADD = $(OFILES) @SHARED_LIBADD@
--libopcodes_la_LDFLAGS += -release `cat ../bfd/libtool-soversion` @SHARED_LDFLAGS@
-+libopcodes_la_LDFLAGS += -release `cat libtool-soversion` @SHARED_LDFLAGS@
- # Allow dependency tracking to work on all the source files.
- EXTRA_libopcodes_la_SOURCES = $(LIBOPCODES_CFILES)
- 
-+libtool-soversion:
-+	@echo "creating $@"
-+	bfd_soversion="$(VERSION)" ;\
-+	. $(BFDDIR)/development.sh ;\
-+	if test "$$development" = true ; then \
-+	  bfd_soversion="$(VERSION).$${bfd_version_date}" ;\
-+	fi ;\
-+	echo "$${bfd_soversion}" > $@
-+
- # libtool will build .libs/libopcodes.a.  We create libopcodes.a in
- # the build directory so that we don't have to convert all the
- # programs that use libopcodes.a simultaneously.  This is a hack which
-diff --git a/opcodes/configure.ac b/opcodes/configure.ac
-index e564f067334..5da62a3d58b 100644
---- a/opcodes/configure.ac
-+++ b/opcodes/configure.ac
-@@ -98,6 +98,8 @@ BFD_64_BIT
- AC_SUBST(HDEFINES)
- AC_PROG_INSTALL
- 
-+GCC_HEADER_STDINT(bfd_stdint.h)
-+
- AC_CHECK_DECLS([basename, stpcpy])
- 
- # Check if sigsetjmp is available.  Using AC_CHECK_FUNCS won't do
-@@ -148,44 +150,21 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
- 
- LT_LIB_M
- 
--#Libs for generator progs
--if test "x$cross_compiling" = "xno"; then
--  BUILD_LIBS=../libiberty/libiberty.a
--  BUILD_LIB_DEPS=$BUILD_LIBS
--else
--  # if cross-compiling, assume that the system provides -liberty
--  # and that the version is compatible with new headers.
--  BUILD_LIBS=-liberty
--  BUILD_LIB_DEPS=
--fi
--BUILD_LIBS="$BUILD_LIBS $LIBINTL"
--BUILD_LIB_DEPS="$BUILD_LIB_DEPS $LIBINTL_DEP"
-+BUILD_LIBS="-liberty $LIBINTL"
-+BUILD_LIB_DEPS="$LIBINTL_DEP"
- 
- AC_SUBST(BUILD_LIBS)
- AC_SUBST(BUILD_LIB_DEPS)
- 
- # Horrible hacks to build DLLs on Windows and a shared library elsewhere.
- SHARED_LDFLAGS=
--SHARED_LIBADD=
-+SHARED_LIBADD=-liberty
- SHARED_DEPENDENCIES=
--if test "$enable_shared" = "yes"; then
--# When building a shared libopcodes, link against the pic version of libiberty
--# so that apps that use libopcodes won't need libiberty just to satisfy any
--# libopcodes references.
--# We can't do that if a pic libiberty is unavailable since including non-pic
--# code would insert text relocations into libopcodes.
- # Note that linking against libbfd as we do here, which is itself linked
- # against libiberty, may not satisfy all the libopcodes libiberty references
- # since libbfd may not pull in the entirety of libiberty.
- # Also, jam libintl into the right place in all of this: after libiberty,
- # which uses it, but before -lcygwin, which it uses.
--changequote(,)dnl
--  x=`sed -n -e 's/^[ 	]*PICFLAG[ 	]*=[ 	]*//p' < ../libiberty/Makefile | sed -n '$p'`
--changequote([,])dnl
--  if test -n "$x"; then
--    SHARED_LIBADD="-L`pwd`/../libiberty/pic -liberty"
--  fi
--fi
- 
- SHARED_LIBADD="$SHARED_LIBADD $LIBINTL"
- 
-@@ -193,11 +172,10 @@ if test "$enable_shared" = "yes"; then
-   case "${host}" in
-     *-*-cygwin*)
-       SHARED_LDFLAGS="-no-undefined"
--      SHARED_LIBADD="-L`pwd`/../bfd -lbfd -L`pwd`/../libiberty -liberty $SHARED_LIBADD"
-+      SHARED_LIBADD="-lbfd -liberty $SHARED_LIBADD"
-       ;;
-     *)
--      SHARED_LIBADD="../bfd/libbfd.la ${SHARED_LIBADD}"
--      SHARED_DEPENDENCIES="../bfd/libbfd.la"
-+      SHARED_LIBADD="-lbfd ${SHARED_LIBADD}"
-       ;;
-   esac
- 
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 39e852a60bbba..208b404f1eadc 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -31,12 +31,12 @@ assert enableGold -> withGold stdenv.targetPlatform;
 let
   inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-  version = "2.39";
+  version = "2.40";
 
   srcs = {
     normal = fetchurl {
       url = "mirror://gnu/binutils/binutils-${version}.tar.bz2";
-      sha256 = "sha256-2iSoT+8iAQLdJAQt8G/eqFHCYUpTd/hu/6KPM7exYUg=";
+      hash = "sha256-+CmOsVOks30RLpRapcsoUAQLzyaj6mW1pxXIOv4F5Io=";
     };
     vc4-none = fetchFromGitHub {
       owner = "itszor";
@@ -84,12 +84,10 @@ stdenv.mkDerivation (finalAttrs: {
     # cross-compiling.
     ./always-search-rpath.patch
 
-    # Upstream backport of https://sourceware.org/PR29451:
-    # Don't emit 0-sized debug entries for objects without size.
-    # Without the change elfutils on i686-linux fail dwarf validity test:
-    #    https://sourceware.org/PR29450
-    # Remove once 2.40 releases.
-    ./gas-dwarf-zero-PR29451.patch
+    # Avoid `lib -> out -> lib` reference. Normally `bfd-plugins` does
+    # not need to know binutils' BINDIR at all. It's an absolute path
+    # where libraries are stored.
+    ./plugins-no-BINDIR.patch
   ]
   ++ lib.optional targetPlatform.isiOS ./support-ios.patch
   # Adds AVR-specific options to "size" for compatibility with Atmel's downstream distribution
@@ -105,7 +103,15 @@ stdenv.mkDerivation (finalAttrs: {
       else ./mips64-default-n64.patch)
   ;
 
-  outputs = [ "out" "info" "man" ];
+  outputs = [ "out" "info" "man" "dev" ]
+  # Ideally we would like to always install 'lib' into a separate
+  # target. Unfortunately cross-compiled binutils installs libraries
+  # across both `$lib/lib/` and `$out/$target/lib` with a reference
+  # from $out to $lib. Probably a binutils bug: all libraries should go
+  # to $lib as binutils does not build target libraries. Let's make our
+  # life slightly simpler by installing everything into $out for
+  # cross-binutils.
+  ++ lib.optionals (targetPlatform == hostPlatform) [ "lib" ];
 
   strictDeps = true;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -196,8 +202,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Unconditionally disable:
     # - musl target needs porting: https://sourceware.org/PR29477
-    # - all targets rely on javac: https://sourceware.org/PR29479
     "--disable-gprofng"
+
+    # By default binutils searches $libdir for libraries. This brings in
+    # libbfd and libopcodes into a default visibility. Drop default lib
+    # path to force users to declare their use of these libraries.
+    "--with-lib-path=:"
   ]
   ++ lib.optionals withAllTargets [ "--enable-targets=all" ]
   ++ lib.optionals enableGold [ "--enable-gold" "--enable-plugins" ]
@@ -218,10 +228,26 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  # For the same reason we don't split "lib" output we undo the $target/
+  # prefix for installed headers and libraries we link:
+  #   $out/$host/$target/lib/*     to $out/lib/
+  #   $out/$host/$target/include/* to $dev/include/*
+  # TODO(trofi): fix installation paths upstream so we could remove this
+  # code and have "lib" output unconditionally.
+  postInstall = lib.optionalString (hostPlatform.config != targetPlatform.config) ''
+    ln -s $out/${hostPlatform.config}/${targetPlatform.config}/lib/*     $out/lib/
+    ln -s $out/${hostPlatform.config}/${targetPlatform.config}/include/* $dev/include/
+  '';
+
   passthru = {
     inherit targetPrefix;
     hasGold = enableGold;
     isGNU = true;
+    # Having --enable-plugins is not enough, system has to support
+    # dlopen() or equivalent. See config/plugins.m4 and configure.ac
+    # (around PLUGINS) for cases that support or not support plugins.
+    # No platform specific filters yet here.
+    hasPluginAPI = enableGold;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch b/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch
deleted file mode 100644
index 5f1293f8f7320..0000000000000
--- a/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=d7abcbcea5ddd40a3bf28758b62f35933c59f996
-
-Don't emit 0-sized debug entries for objects without size.
-Without the change elfutils on i686-linux fail dwarf validity test:
-    https://sourceware.org/PR29450
---- a/gas/dwarf2dbg.c
-+++ b/gas/dwarf2dbg.c
-@@ -2882,6 +2882,7 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	{
- 	  const char *name;
- 	  size_t len;
-+	  expressionS size = { .X_op = O_constant };
- 
- 	  /* Skip warning constructs (see above).  */
- 	  if (symbol_get_bfdsym (symp)->flags & BSF_WARNING)
-@@ -2895,6 +2896,18 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	  if (!S_IS_DEFINED (symp) || !S_IS_FUNCTION (symp))
- 	    continue;
- 
-+#if defined (OBJ_ELF) /* || defined (OBJ_MAYBE_ELF) */
-+	  size.X_add_number = S_GET_SIZE (symp);
-+	  if (size.X_add_number == 0 && IS_ELF
-+	      && symbol_get_obj (symp)->size != NULL)
-+	    {
-+	      size.X_op = O_add;
-+	      size.X_op_symbol = make_expr_symbol (symbol_get_obj (symp)->size);
-+	    }
-+#endif
-+	  if (size.X_op == O_constant && size.X_add_number == 0)
-+	    continue;
-+
- 	  subseg_set (str_seg, 0);
- 	  name_sym = symbol_temp_new_now_octets ();
- 	  name = S_GET_NAME (symp);
-@@ -2920,29 +2933,17 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	  emit_expr (&exp, sizeof_address);
- 
- 	  /* DW_AT_high_pc */
--	  exp.X_op = O_constant;
--#if defined (OBJ_ELF) /* || defined (OBJ_MAYBE_ELF) */
--	  exp.X_add_number = S_GET_SIZE (symp);
--	  if (exp.X_add_number == 0 && IS_ELF
--	      && symbol_get_obj (symp)->size != NULL)
--	    {
--	      exp.X_op = O_add;
--	      exp.X_op_symbol = make_expr_symbol (symbol_get_obj (symp)->size);
--	    }
--#else
--	  exp.X_add_number = 0;
--#endif
- 	  if (DWARF2_VERSION < 4)
- 	    {
--	      if (exp.X_op == O_constant)
--		exp.X_op = O_symbol;
--	      exp.X_add_symbol = symp;
--	      emit_expr (&exp, sizeof_address);
-+	      if (size.X_op == O_constant)
-+		size.X_op = O_symbol;
-+	      size.X_add_symbol = symp;
-+	      emit_expr (&size, sizeof_address);
- 	    }
--	  else if (exp.X_op == O_constant)
--	    out_uleb128 (exp.X_add_number);
-+	  else if (size.X_op == O_constant)
-+	    out_uleb128 (size.X_add_number);
- 	  else
--	    emit_leb128_expr (symbol_get_value_expression (exp.X_op_symbol), 0);
-+	    emit_leb128_expr (symbol_get_value_expression (size.X_op_symbol), 0);
- 	}
- 
-       /* End of children.  */
diff --git a/pkgs/development/tools/misc/binutils/libbfd.nix b/pkgs/development/tools/misc/binutils/libbfd.nix
index 16737a7b5ee84..dca62b82eead0 100644
--- a/pkgs/development/tools/misc/binutils/libbfd.nix
+++ b/pkgs/development/tools/misc/binutils/libbfd.nix
@@ -1,45 +1,22 @@
 { lib, stdenv
-, buildPackages
-, gnu-config, autoreconfHook, bison, binutils-unwrapped, texinfo
-, libiberty, libintl, zlib
+, binutils-unwrapped-all-targets
 }:
 
 stdenv.mkDerivation {
   pname = "libbfd";
-  inherit (binutils-unwrapped) version src;
-
-  outputs = [ "out" "dev" ];
-
-  patches = binutils-unwrapped.patches ++ [
-    ./build-components-separately.patch
+  inherit (binutils-unwrapped-all-targets) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontInstall = true;
+  propagatedBuildInputs = [
+    binutils-unwrapped-all-targets.dev
+    binutils-unwrapped-all-targets.lib
   ];
 
-  # We just want to build libbfd
-  postPatch = ''
-    cd bfd
-  '';
-
-  postAutoreconf = ''
-    echo "Updating config.guess and config.sub from ${gnu-config}"
-    cp -f ${gnu-config}/config.{guess,sub} ../
-  '';
-
-  # We update these ourselves
-  dontUpdateAutotoolsGnuConfigScripts = true;
-
-  strictDeps = true;
-  nativeBuildInputs = [ autoreconfHook bison texinfo ];
-  buildInputs = [ libiberty zlib ] ++ lib.optionals stdenv.isDarwin [ libintl ];
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  configurePlatforms = [ "build" "host" ];
-  configureFlags = [
-    "--enable-targets=all" "--enable-64-bit-bfd"
-    "--enable-install-libbfd"
-    "--with-system-zlib"
-  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared";
-
-  enableParallelBuilding = true;
+  passthru = {
+    inherit (binutils-unwrapped-all-targets) dev hasPluginAPI;
+  };
 
   meta = with lib; {
     description = "A library for manipulating containers of machine code";
diff --git a/pkgs/development/tools/misc/binutils/libopcodes.nix b/pkgs/development/tools/misc/binutils/libopcodes.nix
index e4b6cec41b4f0..e067282a0e5e1 100644
--- a/pkgs/development/tools/misc/binutils/libopcodes.nix
+++ b/pkgs/development/tools/misc/binutils/libopcodes.nix
@@ -1,38 +1,22 @@
-{ lib, stdenv, buildPackages
-, autoreconfHook, bison, binutils-unwrapped
-, libiberty, libbfd
+{ lib, stdenv
+, binutils-unwrapped-all-targets
 }:
 
 stdenv.mkDerivation {
   pname = "libopcodes";
-  inherit (binutils-unwrapped) version src;
-
-  outputs = [ "out" "dev" ];
-
-  patches = binutils-unwrapped.patches ++ [
-    ./build-components-separately.patch
+  inherit (binutils-unwrapped-all-targets) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontInstall = true;
+  propagatedBuildInputs = [
+    binutils-unwrapped-all-targets.dev
+    binutils-unwrapped-all-targets.lib
   ];
 
-  # We just want to build libopcodes
-  postPatch = ''
-    cd opcodes
-    find . ../include/opcode -type f -exec sed {} -i -e 's/"bfd.h"/<bfd.h>/' \;
-  '';
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ autoreconfHook bison ];
-  buildInputs = [ libiberty ];
-  # dis-asm.h includes bfd.h
-  propagatedBuildInputs = [ libbfd ];
-
-  configurePlatforms = [ "build" "host" ];
-  configureFlags = [
-    "--enable-targets=all" "--enable-64-bit-bfd"
-    "--enable-install-libbfd"
-    "--enable-shared"
-  ];
-
-  enableParallelBuilding = true;
+  passthru = {
+    inherit (binutils-unwrapped-all-targets) dev hasPluginAPI;
+  };
 
   meta = with lib; {
     description = "A library from binutils for manipulating machine code";
diff --git a/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch b/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch
new file mode 100644
index 0000000000000..562aad33eccd4
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch
@@ -0,0 +1,25 @@
+Avoid `lib -> out -> lib` reference. Normally `bfd-plugins` does not
+need to know binutils' BINDIR at all. It's an absolute path where
+libraries are stored.
+--- a/bfd/plugin.c
++++ b/bfd/plugin.c
+@@ -493,7 +493,7 @@ build_plugin_list (bfd *abfd)
+      when configuring binutils using --libdir.  Search in the proper
+      path first, then the old one for backwards compatibility.  */
+   static const char *path[]
+-    = { LIBDIR "/bfd-plugins", BINDIR "/../lib/bfd-plugins" };
++    = { LIBDIR "/bfd-plugins", };
+   struct stat last_st;
+   unsigned int i;
+ 
+@@ -508,9 +508,7 @@ build_plugin_list (bfd *abfd)
+   last_st.st_ino = 0;
+   for (i = 0; i < sizeof (path) / sizeof (path[0]); i++)
+     {
+-      char *plugin_dir = make_relative_prefix (plugin_program_name,
+-					       BINDIR,
+-					       path[i]);
++      char *plugin_dir = xstrdup (path[i]);
+       if (plugin_dir)
+ 	{
+ 	  struct stat st;
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index b657a9ded93e6..741edcc748719 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.23334";
+  version = "0.1.23391";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1+PcjameB9/1MoyM0RAxrhuE649INyLlhgxA5xJQ9Pw=";
+    sha256 = "sha256-mTqrckoYbxtlwonXp6mtbXSpmVB3WfSXaOkyycBVjx0=";
   };
 
-  vendorHash = "sha256-E24b8PUA1Hy+OepQe2n6TecCMKKicdr5KUdiJ663Td0=";
+  vendorHash = "sha256-7k5jmXvNtxezialavNz8NM7esl2vpXcjRW2n/9GAycs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index 6c2799cfadf78..5c7720a2024b4 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -36,8 +36,11 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    wrapProgram "$out/bin/runtest" \
-      --prefix PATH ":" "${expect}/bin"
+    # 'runtest' and 'dejagnu' look up 'expect' in their 'bin' path
+    # first. We avoid use of 'wrapProgram' here because  wrapping
+    # of shell scripts does not preserve argv[0] for schell scripts:
+    #   https://sourceware.org/PR30052#c5
+    ln -s ${expect}/bin/expect $out/bin/expect
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/edb/default.nix b/pkgs/development/tools/misc/edb/default.nix
index ec65ca62fa30b..2203863264f34 100644
--- a/pkgs/development/tools/misc/edb/default.nix
+++ b/pkgs/development/tools/misc/edb/default.nix
@@ -30,6 +30,8 @@ mkDerivation rec {
 
     # Change default optional terminal program path to one that is more likely to work on NixOS.
     substituteInPlace ./src/Configuration.cpp --replace "/usr/bin/xterm" "xterm";
+
+    sed '1i#include <memory>' -i include/{RegisterViewModelBase,State,IState}.h # gcc12
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/gperf/default.nix b/pkgs/development/tools/misc/gperf/default.nix
index 71b0bbd0b0d69..d836e5a973aef 100644
--- a/pkgs/development/tools/misc/gperf/default.nix
+++ b/pkgs/development/tools/misc/gperf/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qispg6i508rq8pkajh26cznwimbnj06wq9sd85vg95v8nwld1aq";
   };
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "Perfect hash function generator";
 
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 1d25dc8c6e0d5..5c54941b90775 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "help2man";
-  version = "1.49.2";
+  version = "1.49.3";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ni4OITp+CjYkTu1iBNkCtlBGAqV4tuzRUmixRU3q3TY=";
+    url = "mirror://gnu/help2man/help2man-${version}.tar.xz";
+    sha256 = "sha256-TX5P3vLspq/geiaCFRzqeHgeCk6PliIULZ9wwIOi/U8=";
   };
 
   strictDeps = true;
@@ -25,9 +25,9 @@ stdenv.mkDerivation rec {
     "--enable-nls"
   ];
 
-  doCheck = false;                                # target `check' is missing
+  doCheck = false; # target `check' is missing
 
-  patches = if stdenv.hostPlatform.isCygwin then [ ./1.40.4-cygwin-nls.patch ] else null;
+  patches = lib.optional stdenv.hostPlatform.isCygwin ./1.40.4-cygwin-nls.patch;
 
   # We don't use makeWrapper here because it uses substitutions our
   # bootstrap shell can't handle.
@@ -36,8 +36,7 @@ stdenv.mkDerivation rec {
     cat > $out/bin/help2man <<EOF
     #! $SHELL -e
     export PERL5LIB=\''${PERL5LIB:+:}${perlPackages.LocaleGettext}/${perlPackages.perl.libPrefix}
-    ${lib.optionalString stdenv.hostPlatform.isCygwin
-        ''export PATH=\''${PATH:+:}${gettext}/bin''}
+    ${lib.optionalString stdenv.hostPlatform.isCygwin ''export PATH=\''${PATH:+:}${gettext}/bin''}
     exec -a \$0 $out/bin/.help2man-wrapped "\$@"
     EOF
     chmod +x $out/bin/help2man
@@ -45,14 +44,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Generate man pages from `--help' output";
-
-    longDescription =
-      '' help2man produces simple manual pages from the ‘--help’ and
-         ‘--version’ output of other commands.
-      '';
-
+    longDescription = ''
+      help2man produces simple manual pages from the ‘--help’ and ‘--version’ output of other commands.
+    '';
     homepage = "https://www.gnu.org/software/help2man/";
-
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = with maintainers; [ pSub ];
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index 017367e90ba61..2faefedd66563 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -6,13 +6,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.96.5";
+  version = "4.98.0";
 
   src = fetchFromGitHub {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    hash = "sha256-3ZEGCKc7inbqcE4LuhfKON3C8LebVOlZPEhOHVgx8Lo=";
+    sha256 = "sha256-DQLY0a0sOCZFEJA4Y4b18OcWZw47RyqKZ0mVG0CDVTI=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/misc/lsof/no-build-info.patch b/pkgs/development/tools/misc/lsof/no-build-info.patch
index c433fd6e08f89..3c518896b0452 100644
--- a/pkgs/development/tools/misc/lsof/no-build-info.patch
+++ b/pkgs/development/tools/misc/lsof/no-build-info.patch
@@ -1,6 +1,6 @@
---- a/usage.c	2018-02-14 15:20:32.000000000 +0100
-+++ b/usage.c	2018-10-08 21:57:45.718560869 +0200
-@@ -930,24 +930,6 @@
+--- a/usage.c
++++ b/usage.c
+@@ -931,24 +931,6 @@ usage(err, fh, version)
  		(void) fprintf(stderr, "    configuration info: %s\n", cp);
  #endif	/* defined(LSOF_CINFO) */
  
@@ -19,22 +19,22 @@
 -		    cp1 ? cp1 : "",
 -		    (cp && cp1) ? "@" : "",
 -		    cp  ? cp  : ""
--		);
+-		    );
 -	    }
 -
  #if	defined(LSOF_BLDCMT)
  	    if ((cp = isnullstr(LSOF_BLDCMT)))
  		(void) fprintf(stderr, "    builder's comment: %s\n", cp);
-@@ -959,12 +939,8 @@
+@@ -958,12 +940,6 @@ usage(err, fh, version)
  		(void) fprintf(stderr, "    compiler: %s\n", cp);
  	    if ((cp = isnullstr(LSOF_CCV)))
  		(void) fprintf(stderr, "    compiler version: %s\n", cp);
 -	    if ((cp = isnullstr(LSOF_CCFLAGS)))
 -		(void) fprintf(stderr, "    compiler flags: %s\n", cp);
- 	    if ((cp = isnullstr(LSOF_LDFLAGS)))
- 		(void) fprintf(stderr, "    loader flags: %s\n", cp);
+-	    if ((cp = isnullstr(LSOF_LDFLAGS)))
+-		(void) fprintf(stderr, "    loader flags: %s\n", cp);
 -	    if ((cp = isnullstr(LSOF_SYSINFO)))
 -		(void) fprintf(stderr, "    system info: %s\n", cp);
- 	    (void) report_SECURITY("    ", ".\n");
- 	    (void) report_WARNDEVACCESS("    ", "are", ".\n");
- 	    (void) report_HASKERNIDCK("    K", "is");
+ 	    // display configurations that might affect output
+ 	    char *features[] = {
+ #if	defined(HASEFFNLINK)
diff --git a/pkgs/development/tools/misc/pahole/default.nix b/pkgs/development/tools/misc/pahole/default.nix
index ec9fb436f7648..39b6baabc836a 100644
--- a/pkgs/development/tools/misc/pahole/default.nix
+++ b/pkgs/development/tools/misc/pahole/default.nix
@@ -2,11 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pahole";
-  version = "1.24";
+  # Need a revision that supports DW_TAG_unspecified_type(0x3b).
+  # Was added after 1.24 release in a series of changes.
+  # Can switch back to release tags once 1.25 is cut.
+  version = "1.24-unstable-2022-11-24";
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/devel/pahole/pahole.git";
-    rev = "v${version}";
-    sha256 = "sha256-OPseVKt5kIKgK096+ufKrWMS1E/7Z0uxNqCMN6wKfKg=";
+    rev = "02d67c51765dfbd5893087da63744c864c7cc9e0";
+    hash = "sha256-hKc8UKxPtEM2zlYmolSt1pXJKNRt4wC/Uf+dP/Sb7+s=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/tools/misc/saleae-logic-2/default.nix b/pkgs/development/tools/misc/saleae-logic-2/default.nix
index 1c049eac7aa32..6eeb47df10ab4 100644
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools }:
 let
   name = "saleae-logic-2";
-  version = "2.4.3";
+  version = "2.4.6";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    hash = "sha256-xF87Q1K25/9pUYt660RY2RCIC6u2m2ArBQb2nWhiKvw=";
+    hash = "sha256-FYLjg4lzr8M22r4yoKfMIAx2HKGi2fcD28AaV1ChkLk=";
   };
   desktopItem = makeDesktopItem {
     inherit name;
diff --git a/pkgs/development/tools/ocaml/ocaml-top/default.nix b/pkgs/development/tools/ocaml/ocaml-top/default.nix
index 095af7769140e..18ea26ca22a8d 100644
--- a/pkgs/development/tools/ocaml/ocaml-top/default.nix
+++ b/pkgs/development/tools/ocaml/ocaml-top/default.nix
@@ -2,13 +2,13 @@
 
 with ocamlPackages; buildDunePackage rec {
   pname = "ocaml-top";
-  version = "1.2.0-rc";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "OCamlPro";
     repo = "ocaml-top";
     rev = version;
-    sha256 = "sha256-ZXnPnPvJmHshkTwYWeBojrgJYAF/R6vUo0XkvVMFSeQ=";
+    hash = "sha256-xmPGGB/zUpfeAxUIhR1PhfoESAJq7sTpqHuf++EH3Lw=";
   };
 
   nativeBuildInputs = [ ocp-build ];
@@ -19,11 +19,6 @@ with ocamlPackages; buildDunePackage rec {
     ocp-build -init
   '';
 
-  postPatch = ''
-    substituteInPlace src/completion.ml \
-      --replace 'LibIndex.load ' 'LibIndex.load ~qualify:false '
-  '';
-
   meta = {
     homepage = "https://www.typerex.org/ocaml-top.html";
     license = lib.licenses.gpl3;
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 13ba669bb4f21..8fcb696ac7f27 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -60,7 +60,7 @@ let
         buildGrammar {
           language = grammar.language or name;
           inherit version;
-          src = grammar.src or fetchGrammar grammar;
+          src = grammar.src or (fetchGrammar grammar);
           location = grammar.location or null;
         };
       grammars' = import ./grammars { inherit lib; } // extraGrammars;
diff --git a/pkgs/development/tools/picotool/default.nix b/pkgs/development/tools/picotool/default.nix
index f76e0287b564a..ecd80d6260496 100644
--- a/pkgs/development/tools/picotool/default.nix
+++ b/pkgs/development/tools/picotool/default.nix
@@ -2,25 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "picotool";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = pname;
     rev = version;
-    sha256 = "sha256-YjDHoRcDoezyli42bJ0bnfjdNNY8l6ZilrxhOudqvwE=";
+    sha256 = "sha256-KP5Cq6pYKQI5dV6S4lLapu9EcwAgLgYpK0qreNDZink=";
   };
 
   buildInputs = [ libusb1 pico-sdk ];
   nativeBuildInputs = [ cmake pkg-config ];
   cmakeFlags = [ "-DPICO_SDK_PATH=${pico-sdk}/lib/pico-sdk" ];
 
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 ./picotool -t $out/bin
-    runHook postInstall
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/raspberrypi/picotool";
     description = "Tool for interacting with a RP2040 device in BOOTSEL mode, or with a RP2040 binary";
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index 84f1670e6dff0..8799fbd62d39a 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -19,6 +19,7 @@ let
     nativeBuildInputs = [ pkg-config cpio python3 python3.pkgs.setuptools ];
     buildInputs = [ elfutils gettext ];
     enableParallelBuilding = true;
+    NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ]; # Needed with GCC 12
   };
 
   ## a kernel build dir as expected by systemtap
diff --git a/pkgs/development/tools/wlcs/default.nix b/pkgs/development/tools/wlcs/default.nix
index 7a5470a33423d..4ec4403987a3c 100644
--- a/pkgs/development/tools/wlcs/default.nix
+++ b/pkgs/development/tools/wlcs/default.nix
@@ -42,6 +42,11 @@ stdenv.mkDerivation rec {
     wayland
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
   };
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index fa6dcbf28a778..86accf5977b31 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
diff --git a/pkgs/games/cataclysm-dda/stable.nix b/pkgs/games/cataclysm-dda/stable.nix
index 3bf2f884ab36a..da84422308cc7 100644
--- a/pkgs/games/cataclysm-dda/stable.nix
+++ b/pkgs/games/cataclysm-dda/stable.nix
@@ -44,6 +44,11 @@ let
       "VERSION=${version}"
     ];
 
+    NIX_CFLAGS_COMPILE = [
+      # Needed with GCC 12
+      "-Wno-error=array-bounds"
+    ];
+
     meta = common.meta // {
       maintainers = with lib.maintainers;
         common.meta.maintainers ++ [ skeidel ];
diff --git a/pkgs/games/cdogs-sdl/default.nix b/pkgs/games/cdogs-sdl/default.nix
index 23eb6e96dcb8e..a4943187dd694 100644
--- a/pkgs/games/cdogs-sdl/default.nix
+++ b/pkgs/games/cdogs-sdl/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
     "-DCMAKE_C_FLAGS=-Wno-error=array-bounds"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake
diff --git a/pkgs/games/eboard/default.nix b/pkgs/games/eboard/default.nix
index 293811e9b0403..81bc6d365a0c9 100644
--- a/pkgs/games/eboard/default.nix
+++ b/pkgs/games/eboard/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
   '';
 
   NIX_CFLAGS_COMPILE = "-fpermissive";
-  NIX_LDFLAGS = "-ldl";
 
   meta = {
     homepage = "http://www.bergo.eng.br/eboard/";
diff --git a/pkgs/games/gimx/default.nix b/pkgs/games/gimx/default.nix
index 785d38a759a02..410228c4f02fb 100644
--- a/pkgs/games/gimx/default.nix
+++ b/pkgs/games/gimx/default.nix
@@ -38,6 +38,14 @@ in stdenv.mkDerivation rec {
   '';
 
   makeFlags = [ "build-core" ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=use-after-free"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/games/liquidwar/default.nix b/pkgs/games/liquidwar/default.nix
index e012886c884d3..9d9e4243452c7 100644
--- a/pkgs/games/liquidwar/default.nix
+++ b/pkgs/games/liquidwar/default.nix
@@ -30,11 +30,15 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE =
-    "-Wno-error=deprecated-declarations" +
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ] ++ [
+    "-Wno-error=deprecated-declarations"
     # Avoid GL_GLEXT_VERSION double definition
     " -DNO_SDL_GLEXT"
-  ;
+  ];
 
   # To avoid problems finding SDL_types.h.
   configureFlags = [ "CFLAGS=-I${lib.getDev SDL}/include/SDL" ];
diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
index 389f59f91a6ad..8df88c92ff1c4 100644
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@@ -63,6 +63,10 @@ mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    sed '1i#include <memory>' -i components/myguiplatform/myguidatamanager.cpp # gcc12
+  '';
+
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
 
   buildInputs = [
diff --git a/pkgs/games/openrct2/default.nix b/pkgs/games/openrct2/default.nix
index d474b0eae92ac..10914d4107748 100644
--- a/pkgs/games/openrct2/default.nix
+++ b/pkgs/games/openrct2/default.nix
@@ -94,6 +94,11 @@ stdenv.mkDerivation {
     "-DDOWNLOAD_TITLE_SEQUENCES=OFF"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   postUnpack = ''
     cp -r ${objects-src}         $sourceRoot/data/object
     cp -r ${title-sequences-src} $sourceRoot/data/sequence
diff --git a/pkgs/games/stepmania/default.nix b/pkgs/games/stepmania/default.nix
index 2445ee9096c99..6cb7a23dff5ff 100644
--- a/pkgs/games/stepmania/default.nix
+++ b/pkgs/games/stepmania/default.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
     ./0001-fix-build-with-ffmpeg-4.patch
   ];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i src/arch/ArchHooks/ArchHooks.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake nasm ];
 
   buildInputs = [
diff --git a/pkgs/games/supertux/default.nix b/pkgs/games/supertux/default.nix
index 679500f974c33..857617bc4bfa4 100644
--- a/pkgs/games/supertux/default.nix
+++ b/pkgs/games/supertux/default.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
     sha256 = "1xkr3ka2sxp5s0spp84iv294i29s1vxqzazb6kmjc0n415h0x57p";
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i external/partio_zip/zip_manager.hpp # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config cmake ];
 
   buildInputs = [
diff --git a/pkgs/games/zod/default.nix b/pkgs/games/zod/default.nix
index 737fed1e7f64d..e0c2031dde250 100644
--- a/pkgs/games/zod/default.nix
+++ b/pkgs/games/zod/default.nix
@@ -22,6 +22,9 @@ let
     url = "mirror://sourceforge/zod/linux_releases/zod_linux-${version}.tar.gz";
     sha256 = "017v96aflrv07g8j8zk9mq8f8rqxl5228rjff5blq8dxpsv1sx7h";
   };
+  postPatch = ''
+    sed '1i#include <ctime>' -i zod_src/common.cpp # gcc12
+  '';
   nativeBuildInputs = [
     makeWrapper
   ];
@@ -37,7 +40,7 @@ let
   hardeningDisable = [ "format" ];
   NIX_LDFLAGS = "-L${libmysqlclient}/lib/mysql";
   zod_engine = stdenv.mkDerivation {
-    inherit version src nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
+    inherit version src postPatch nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
     pname = "${name}-engine";
     enableParallelBuilding = true;
     preBuild = "cd zod_src";
@@ -48,7 +51,7 @@ let
     '';
   };
   zod_map_editor = stdenv.mkDerivation {
-    inherit version src nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
+    inherit version src postPatch nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
     pname = "${name}-map_editor";
     enableParallelBuilding = true;
     preBuild = "cd zod_src";
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 42d7021f3452b..a360058725006 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -92,16 +92,6 @@ let
 
     passAsFile = [ "extraConfig" ];
 
-    # Workaround '-idirafter' ordering bug in staging-next:
-    #   https://github.com/NixOS/nixpkgs/pull/210004
-    # where libc '-idirafter' gets added after user's idirafter and
-    # breaks.
-    # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-    preConfigure = ''
-      export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] buildPackages.stdenv.hostPlatform.config}=$(< ${buildPackages.stdenv.cc}/nix-support/libc-cflags)
-      export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"]               stdenv.hostPlatform.config}=$(<               ${stdenv.cc}/nix-support/libc-cflags)
-    '';
-
     configurePhase = ''
       runHook preConfigure
 
diff --git a/pkgs/os-specific/darwin/xcode/default.nix b/pkgs/os-specific/darwin/xcode/default.nix
index 6d1929ef982ce..ec98a0b1cfb6c 100644
--- a/pkgs/os-specific/darwin/xcode/default.nix
+++ b/pkgs/os-specific/darwin/xcode/default.nix
@@ -41,31 +41,44 @@ let requireXcode = version: sha256:
   in app.overrideAttrs ( oldAttrs: oldAttrs // { inherit meta; });
 
 in lib.makeExtensible (self: {
-  xcode_8_1 = requireXcode "8.1" "18xjvfipwzia66gm3r9p770xdd4r375vak7chw5vgqnv9yyjiq2n";
-  xcode_8_2 = requireXcode "8.2" "13nd1zsfqcp9hwp15hndr0rsbb8rgprrz7zr2ablj4697qca06m2";
-  xcode_9_1 = requireXcode "9.1" "0ab1403wy84ys3yn26fj78cazhpnslmh3nzzp1wxib3mr1afjvic";
-  xcode_9_2 = requireXcode "9.2" "1bgfgdp266cbbqf2axcflz92frzvhi0qw0jdkcw6r85kdpc8dj4c";
-  xcode_9_3 = requireXcode "9.3" "12m9kb4759s2ky42b1vf7y38qqxn2j99s99adzc6ljnmy26ii12w";
-  xcode_9_4 = requireXcode "9.4" "00az1cf9pm8zmvzs6yq04prdmxp8xi3ymxw94jjh4mh7hlbkhcb7";
-  xcode_9_4_1 = requireXcode "9.4.1" "0y9kphj86c14jl6aibv57sd7ln0w06vdhzm8ysp0s98rfgyq2lbw";
-  xcode_10_1 = requireXcode "10.1" "1ssdbg4v8r11fjf4jl38pwyry2aia1qihbxyxapz0v0n5gfnp05v";
-  xcode_10_2 = requireXcode "10.2" "1xzybl1gvb3q5qwlwchanzpws4sb70i3plf0vrzvlfdp2hsb3pg7";
-  xcode_10_2_1 = requireXcode "10.2.1" "11sdb54nr0x7kp987qq839x6k5gdx7vqdxjiy5xm5279n1n47bmg";
-  xcode_10_3 = requireXcode "10.3" "1i628vfn6zad81fsz3zpc6z15chhskvyp8qnajp2wnpzvrwl6ngb";
-  xcode_11 = requireXcode "11" "1r03j3kkp4blfp2kqpn538w3dx57ms930fj8apjkq6dk7fv3jcqh";
-  xcode_11_1 = requireXcode "11.1" "1c2gzc4jhhx5a7ncg19sh1r99izhipybaqxl1ll52x5y8689awc1";
-  xcode_11_2 = requireXcode "11.2" "1lm3q8zpvm184246h5j9mw4c1y9kk9sxnr3j98kfm0312n0l98gj";
-  xcode_11_3 = requireXcode "11.3" "04rv6xlywy8xqfx9ma8ygsdw4yhckk2mq0qnklxnfly899iw4wza";
-  xcode_11_3_1 = requireXcode "11.3.1" "1p6nicj91kr6ad3rmycahd1i7z4hj7ccjs93ixsiximjzaahx3q4";
-  xcode_11_4 = requireXcode "11.4" "065rpb3rdk19nv3rwyf9bk32ccbd0lld12gj12l89cyg65mhpyy7";
-  xcode_11_5 = requireXcode "11.5" "1dizazq9nz1vjkc5gy7dd4x760mkfjiifk1hf6d9mscchdq8rfkw";
-  xcode_11_6 = requireXcode "11.6" "1y4fhw1kiphzxdb4wpv697z5r0algvaldwq5iqv266797rnfql4x";
-  xcode_11_7 = requireXcode "11.7" "0422rdc4j5qwyk59anbybxyfv0p26x0xryszm0wd8i44g66smlmj";
-  xcode_12 = requireXcode "12" "1w3xm268pyn5m04wv22invd5kr2k4jqllgrzapv6n1sxxynxrh8z";
-  xcode_12_0_1 = requireXcode "12.0.1" "1p6vd5ai0hh3cq6aflh4h21ar0shxnz8wlkaxwq7liwsdmkwzbl0";
-  xcode_12_1 = requireXcode "12.1" "1widy74dk43wx8iqgd7arzf6q4kzdmaz8pfwymzs8chnq9dqr3wp";
-  xcode_12_2 = requireXcode "12.2" "17i0wf4pwrxwfgjw7rpw9mcd59nkmys1k5h2rqsw81snzyxy9j0v";
-  xcode_12_3 = requireXcode "12.3" "0kwf1y4llysf1p0nsbqyzccn7d77my0ldagr5fi3by4k0xy3d189";
+  xcode_8_1 = requireXcode "8.1" "sha256-VuAovU/b4rcLh+xMtcsZmbTWwTk35VGfMSp+fqPbsqM=";
+  xcode_8_2 = requireXcode "8.2" "sha256-ohqgGD7JEEmXEvmfn/N9Ga2lM8jNwhIuh+ky7PQPzY4=";
+  xcode_9_1 = requireXcode "9.1" "sha256-LG7pVMh1rNh5uP/bASvV9sKvGDrSGWH90J4gzwcgYSk=";
+  xcode_9_2 = requireXcode "9.2" "sha256-jMiG2G2zoGw4m00CjkGE+2cn0qeOdSUcXosZI2577q0=";
+  xcode_9_3 = requireXcode "9.3" "sha256-XIQYjfDVSmrYbyolnZIUtmOMhj9uhyWIn0KncsiaqYo=";
+  xcode_9_4 = requireXcode "9.4" "sha256-ZzE4F4UHVgKlJIn36kfs6Pba8iUAe6P/rh/VmxwLXwE=";
+  xcode_9_4_1 = requireXcode "9.4.1" "sha256-fFGB/XMZJQ2u9qh+2LYBHFh6mj5lr6gMlSQwgyS8M3k=";
+  xcode_10_1 = requireXcode "10.1" "sha256-u4Br3SsWbPCv6r4vGHFQUQmfPb9oUEmcdCFktMlbTes=";
+  xcode_10_2 = requireXcode "10.2" "sha256-592xNBS3Obp/3sDROyI4SxPN77cKMk45Lnis/QJd/vc=";
+  xcode_10_2_1 = requireXcode "10.2.1" "sha256-r65DbLDpiFJ78VH2hvfp7ZVpehoI44PSnaeDbElZTYc=";
+  xcode_10_3 = requireXcode "10.3" "sha256-61lDed7/Wi6uVBaj6/fUELISvmH3j69dQE19Y91GwsQ=";
+  xcode_11 = requireXcode "11" "sha256-EDM5tjuzGTzlVUg6MJKup/Q2OBrFXjzFdXSRO+eQA+Q=";
+  xcode_11_1 = requireXcode "11.1" "sha256-gXGVkEG+dFEoDbRjtfyN8MeUcoA6hcfsUaVDKAn7T7A=";
+  xcode_11_2 = requireXcode "11.2" "sha256-8qFEgRVhgOomSnJk23WaM/nACK9JFmiIICjUfT/Co9I=";
+  xcode_11_3 = requireXcode "11.3" "sha256-6nPCY0rIU2c7nRYDXMWcDHrCm34eqZq6wx157mk3OxM=";
+  xcode_11_3_1 = requireXcode "11.3.1" "sha256-BI8Olfqyxh51jyNpydiRkPwTQ4OK+ZpHUybPkCSL1tw=";
+  xcode_11_4 = requireXcode "11.4" "sha256-x/sLazHPs4SoCPKJ0CgFbTEmxlzJeZ7HtinMlse6uRg=";
+  xcode_11_5 = requireXcode "11.5" "sha256-fLqMcIOM6ZqacTBMF6N0swJzOmnt+FfYlDt8m/BXP7Y=";
+  xcode_11_6 = requireXcode "11.6" "sha256-nVDsbD7pGCM2jgXzRtV+VIFc/klmX05W6x/eOAOHjvg=";
+  xcode_11_7 = requireXcode "11.7" "sha256-stKqjXmERNQ4qF/73EE34oLtfF9+WZXK9BwXSVjLQhA=";
+  xcode_12 = requireXcode "12" "sha256-H8Hcre9dB2v2VT8/SrEkU+RZ2rZRiM0JqMX6i4yoffA=";
+  xcode_12_0_1 = requireXcode "12.0.1" "sha256-gK7PZ22aR3ow72pSjr7tUIOsgoAEUqcMZgNCEFVp29w=";
+  xcode_12_1 = requireXcode "12.1" "sha256-l4+MW8IWMqR/9dxd9FVtfxJs3M/qtIcj6nyQ2cjxLfI=";
+  xcode_12_2 = requireXcode "12.2" "sha256-G8jku/9WB8Q1zgKWGbSv06bSWE385sPlc7xnfonjIJ4=";
+  xcode_12_3 = requireXcode "12.3" "sha256-CYU2fAeT+DWiK/mpRoGv57RjGfseL23BDU57SokPjk8=";
+  xcode_12_4 = requireXcode "12.4" "sha256-Qw4j+XFry85/AviHQVhjjjKLAfmRNNwMGN5G8FheJwQ=";
+  xcode_12_5 = requireXcode "12.5" "sha256-xiGffnV0P9Ojd6IrJSXILUX4oznPif7zm00WAksn3qU=";
+  xcode_12_5_1 = requireXcode "12.5.1" "sha256-zL0kS86ZzBkIrKLPKvWguDvXj9Tqbr7uR/VZaT/uZ9A=";
+  xcode_13 = requireXcode "13" "sha256-uTY6d5DBu4OOQLkxs3ExDfLXh50rE2LLlqtCbk3Qn6E=";
+  xcode_13_1 = requireXcode "13.1" "sha256-vd+4eFVaAyvXsdaExcfbDZSXOwkpt+rEbkBYSMjdUEA=";
+  xcode_13_2 = requireXcode "13.2" "sha256-guJXm/QnMfvUZwAcJwoy0QeO+DpDcUhs8AxVKvm9tYQ=";
+  xcode_13_2_1 = requireXcode "13.2.1" "sha256-r832Uu+Q8utK4zN0CtwiMCvMYT5HstWInyq4cNIaZJM=";
+  xcode_13_3 = requireXcode "13.3" "sha256-p2zaWMpmUeNHQtYOOaVdhCt3cgapvzL3l73/J+UwzCE=";
+  xcode_13_3_1 = requireXcode "13.3.1" "sha256-j71vpJVJpyj/IOlL+4+5lYgOlhf/zn+7ExIHbxL51cQ=";
+  xcode_13_4 = requireXcode "13.4" "sha256-IY1coss90GlBeJg/HQPMU8v2rOOxsqlY5q+2Qxe8nnY=";
+  xcode_13_4_1 = requireXcode "13.4.1" "sha256-Jk8fLgvnODoIhuVJqfV0KrpBBL40fRrHJbFmm44NRKE=";
+  xcode_14 = requireXcode "14" "sha256-E+wjPgQx/lbYAsauksdmGsygL5VPBA8R9pHB93eA7T0=";
+  xcode_14_1 = requireXcode "14.1" "sha256-QJGAUVIhuDYyzDNttBPv5lIGOfvkYqdOFSUAr5tlkfs=";
   xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "12.3")}";
 })
 
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
index d8fc4648029a6..560f2bf301474 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.7.2";
+  version = "1.2.8";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ijW3IY5Q8qLHk0LQ3pje2BQ5zhnhKAk4Xsm+lZbefC8=";
+    hash = "sha256-GrAbdOM0JcqZwuNsCET9aIgnMZO9iYJA/o+TrMvL80c=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
index 512fe605b6e51..4568ecf1e7a8b 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-ucm-conf";
-  version = "1.2.7.1";
+  version = "1.2.8";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    hash = "sha256-rFsqEnV4Pv8H4cs0w2xsWYd0JnmjQAN1B8BKncHSLKw=";
+    hash = "sha256-/uSnN4MP0l+WnYPaRqKyMb6whu/ZZvzAfSJeeCMmCug=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index 2a98aa82ebbd5..9c41a217badc9 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -85,6 +85,11 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
+  # Flag needed by GCC 12 but unrecognized by GCC 9 (aarch64-linux default now)
+  NIX_CFLAGS_COMPILE = lib.optionals (with stdenv; cc.isGNU && lib.versionAtLeast cc.version "12") [
+    "-Wno-error=mismatched-new-delete"
+  ];
+
   patchPhase = ''
     patchShebangs scripts
 
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index 886bf3e6fee8c..8312d64acddc6 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -31,7 +31,6 @@ stdenv.mkDerivation {
 
   preBuild = ''
     substituteInPlace Makefile \
-      --replace "\$(shell uname -r)" "${kernel.modDirVersion}" \
       --replace "/lib/modules" "${kernel.dev}/lib/modules"
   '';
 
diff --git a/pkgs/os-specific/linux/dracut/default.nix b/pkgs/os-specific/linux/dracut/default.nix
index 583bd4115ac5d..c6bf684f7fc88 100644
--- a/pkgs/os-specific/linux/dracut/default.nix
+++ b/pkgs/os-specific/linux/dracut/default.nix
@@ -10,24 +10,17 @@
 , bash
 , kmod
 , binutils
-, busybox
 , bzip2
 , coreutils
 , cpio
 , findutils
-, glibc
 , gnugrep
 , gnused
 , gnutar
 , gzip
-, kbd
-, lvm2
 , lz4
 , lzop
-, procps
-, rng-tools
 , squashfsTools
-, systemd
 , util-linux
 , xz
 , zstd
@@ -76,23 +69,16 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/dracut --prefix PATH : ${lib.makeBinPath [
       coreutils
       util-linux
-    ]} --prefix DRACUT_PATH : ${lib.makeBinPath [
+    ]} --suffix DRACUT_PATH : ${lib.makeBinPath [
       bash
       binutils
       coreutils
       findutils
-      glibc
       gnugrep
       gnused
       gnutar
-      kbd
-      lvm2
-      procps
-      rng-tools
-      squashfsTools
-      systemd
+      stdenv.cc.libc  # for ldd command
       util-linux
-      busybox
     ]}
     wrapProgram $out/bin/dracut-catimages --set PATH ${lib.makeBinPath [
       coreutils
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 8fb826833704d..d7a13faf4a0b3 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.364";
+  version = "0.366";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-9fGYoyj7vN3j72H+6jv/R0MaWPZ+4UNQhCSWnZRZZS4=";
+    sha256 = "sha256-Qn5fx4EiE4bGmPaMcB3ne0wS5ZRRgZC+cYEH5HCRQ7g=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index a116aef7920a8..6aa369e4eb4a3 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ipset";
-  version = "7.15";
+  version = "7.17";
 
   src = fetchurl {
     url = "https://ipset.netfilter.org/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ClVFqq22QBQsH4iNNmp43fhyR5mWf6IGhqcAU71iF1E=";
+    sha256 = "sha256-vknJ/0id1mEMrWVB50PDOE6slunyRwfaezkp2PKsZNg=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index 198cd86816466..efc64e81af551 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -65,8 +65,8 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
   GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
   GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 310178b9a1fd3..18c32930f3689 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -57,8 +57,12 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [ perl libelf ]
-    ++ optional (lib.versionAtLeast version "5.13") zstd;
+  moduleBuildDependencies = [
+    perl
+    libelf
+    # module makefiles often run uname commands to find out the kernel version
+    (buildPackages.deterministic-uname.override { inherit modDirVersion; })
+  ] ++ optional (lib.versionAtLeast version "5.13") zstd;
 
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
     let
diff --git a/pkgs/os-specific/linux/mxu11x0/default.nix b/pkgs/os-specific/linux/mxu11x0/default.nix
index ee29180a8d9d8..17d0c69382069 100644
--- a/pkgs/os-specific/linux/mxu11x0/default.nix
+++ b/pkgs/os-specific/linux/mxu11x0/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
 
   version = mxu_version + "-${kernel.version}";
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   preBuild = ''
-    sed -i -e "s/\$(uname -r).*/${kernel.modDirVersion}/g" driver/mxconf
-    sed -i -e "s/\$(shell uname -r).*/${kernel.modDirVersion}/g" driver/Makefile
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/mxconf
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/Makefile
   '';
diff --git a/pkgs/os-specific/linux/ocf-resource-agents/default.nix b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
index 8d7f2b527144a..976c5f1779d78 100644
--- a/pkgs/os-specific/linux/ocf-resource-agents/default.nix
+++ b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
@@ -42,6 +42,11 @@ let
       python3
     ];
 
+    NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+      # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+      "-Wno-error=maybe-uninitialized"
+    ];
+
     meta = with lib; {
       homepage = "https://github.com/ClusterLabs/resource-agents";
       description = "Combined repository of OCF agents from the RHCS and Linux-HA projects";
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index 3aeef46255628..7cb364597bb61 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -25,6 +25,7 @@ in stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
     dpdk_19_11
     libconfig
@@ -38,6 +39,12 @@ in stdenv.mkDerivation rec {
     libbpf
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
   # binaries will segfault otherwise
   dontStrip = true;
 
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 20db1cdd74f94..60a55096b446e 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -46,6 +46,12 @@ stdenv.mkDerivation rec {
   RTE_SDK = dpdk;
   GUI = lib.optionalString withGtk "true";
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ];
+
   # requires symbols from this file
   NIX_LDFLAGS = "-lrte_net_bond";
 
diff --git a/pkgs/os-specific/linux/projecteur/default.nix b/pkgs/os-specific/linux/projecteur/default.nix
index 63de7453935ce..ecb0fe535d356 100644
--- a/pkgs/os-specific/linux/projecteur/default.nix
+++ b/pkgs/os-specific/linux/projecteur/default.nix
@@ -13,6 +13,10 @@ mkDerivation rec {
     sha256 = "sha256-kg6oYtJ4H5A6RNATBg+XvMfCb9FlhEBFjfxamGosMQg=";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i src/device.h # gcc12
+  '';
+
   buildInputs = [ qtbase qtgraphicaleffects ];
   nativeBuildInputs = [ wrapQtAppsHook cmake pkg-config ];
 
diff --git a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
index 0f2e00c8382f5..ecfd6a87e6b47 100644
--- a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
@@ -14,7 +14,6 @@ stdenv.mkDerivation {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -30,9 +29,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ bc ];
-
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
 
   preInstall = ''
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index e50129f1e2b93..a89eb3702e8b8 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation rec {
 
   prePatch = ''
     substituteInPlace ./Makefile --replace /lib/modules/ "${kernel.dev}/lib/modules/"
-    substituteInPlace ./Makefile --replace '$(shell uname -r)' "${kernel.modDirVersion}"
     substituteInPlace ./Makefile --replace /sbin/depmod \#
     substituteInPlace ./Makefile --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8723ds/default.nix b/pkgs/os-specific/linux/rtl8723ds/default.nix
index 4aa408eec4147..be4b954c1b618 100644
--- a/pkgs/os-specific/linux/rtl8723ds/default.nix
+++ b/pkgs/os-specific/linux/rtl8723ds/default.nix
@@ -13,8 +13,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
@@ -25,7 +24,6 @@ stdenv.mkDerivation {
   postPatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace "/sbin/depmod" "#" \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index 84ad6a314e153..bd682ec5933da 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -11,21 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-25NaMQq9H6mqVynNQJXpqISAslxfEVSt3ELzG7s4mV4=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" "format" ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index dd0b32c538018..d8825f018979c 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821au/default.nix b/pkgs/os-specific/linux/rtl8821au/default.nix
index 6a0da0c5e19b6..7ba338d37859b 100644
--- a/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -11,8 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wx7xQBCfLu3UWB7ghp8dZ7OB2MFd5i8X0/ygyvW2K50=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
 
@@ -20,7 +19,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
@@ -30,7 +28,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
index 674af264c39cf..476bce22fb112 100644
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -24,7 +24,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index edc2d5bc44c0e..35b068fd8d088 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl88x2bu/default.nix b/pkgs/os-specific/linux/rtl88x2bu/default.nix
index 38ded6041f598..d3560aca91ad3 100644
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
index 80c14a0b38345..a2f7ca0e815dd 100644
--- a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
@@ -14,14 +14,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-JUyUOqLMD9nSo6i87K/6Ljp+pWSqSBz/IZiFWu03rQw=";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index e871d6618c34a..b03f3c3c16c65 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -131,7 +131,7 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "252.4";
+  version = "252.5";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -148,7 +148,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-8ejSEt3QyCSARGGVbXWac2dB9jdUpC4eX2rN0iENQX0=";
+    hash = "sha256-cNZRTuYFMR1z6KpELeQoJahMhRl4fKuRuc3xXH3KzlM=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
diff --git a/pkgs/os-specific/linux/vmware/default.nix b/pkgs/os-specific/linux/vmware/default.nix
index 162ae766a845d..73c579288bca0 100644
--- a/pkgs/os-specific/linux/vmware/default.nix
+++ b/pkgs/os-specific/linux/vmware/default.nix
@@ -20,14 +20,12 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace Makefile \
       --replace '/lib/modules/$(VM_UNAME)/misc' "$out/lib/modules/${kernel.modDirVersion}/misc" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/modinfo "${kmod}/bin/modinfo" \
       --replace 'test -z "$(DESTDIR)"' "0"
 
     for module in "vmmon-only" "vmnet-only"; do
       substituteInPlace "./$module/Makefile" \
         --replace '/lib/modules/' "${kernel.dev}/lib/modules/" \
-        --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
         --replace /bin/grep "${gnugrep}/bin/grep"
     done
   '';
diff --git a/pkgs/servers/foundationdb/cmake.nix b/pkgs/servers/foundationdb/cmake.nix
index 9d65198c8cef3..436f0a7fc4d17 100644
--- a/pkgs/servers/foundationdb/cmake.nix
+++ b/pkgs/servers/foundationdb/cmake.nix
@@ -60,6 +60,11 @@ let
             (lib.optionalString (!useClang) "-DUSE_LD=GOLD")
           ];
 
+        NIX_CFLAGS_COMPILE = [
+          # Needed with GCC 12
+          "-Wno-error=missing-template-keyword"
+        ];
+
         inherit patches;
 
         # fix up the use of the very weird and custom 'fdb_install' command by just
diff --git a/pkgs/servers/gemini/molly-brown/default.nix b/pkgs/servers/gemini/molly-brown/default.nix
index 354412a4b73f0..351f54f21d498 100644
--- a/pkgs/servers/gemini/molly-brown/default.nix
+++ b/pkgs/servers/gemini/molly-brown/default.nix
@@ -1,19 +1,18 @@
-{ lib, buildGoPackage, fetchgit, nixosTests }:
+{ lib, buildGoModule, fetchgit, nixosTests }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "molly-brown";
-  version = "unstable-2020-08-19";
-  rev = "48f9a206c03c0470e1c132b9667c6daa3583dada";
-
-  goPackagePath = "tildegit.org/solderpunk/molly-brown";
+  version = "unstable-2023-02-10";
 
   src = fetchgit {
-    inherit rev;
     url = "https://tildegit.org/solderpunk/molly-brown.git";
-    sha256 = "1w79a25mbgav95p78fkdm9j62chwwpkqv0m2wmh5my03yq398gya";
+    rev = "56d8dde14abc90b784b7844602f12100af9756e0";
+    hash = "sha256-kfopRyCrDaiVjKYseyWacIT9MJ8PzB8LAs6YMgYqCrs=";
   };
 
-  goDeps = ./deps.nix;
+  vendorHash = "sha256-czfHnXS9tf5vQQNXhWH7DStmhsorSc4Di/yZuv4LHRk=";
+
+  ldflags = [ "-s" "-w" ];
 
   passthru.tests.basic = nixosTests.molly-brown;
 
diff --git a/pkgs/servers/gemini/molly-brown/deps.nix b/pkgs/servers/gemini/molly-brown/deps.nix
deleted file mode 100644
index 95427e8f79079..0000000000000
--- a/pkgs/servers/gemini/molly-brown/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-]
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 8abe197bee7db..3a171c41725a4 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.2.3";
+  version = "2023.2.4";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 921a6dccbc1b7..9811d52a8db98 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -270,7 +270,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.2.3";
+  hassVersion = "2023.2.4";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -288,7 +288,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-cRdxlmlgkKTnrtqGQPbSpBLHf+vfI9T6sdETcGshN9M=";
+    hash = "sha256-Lt/t4S6To0MvdvmdKir7VytrNXPGhC7sMfjQmgox5XY=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 971e04dcd365b..d09c98ef2a20c 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -351,8 +351,8 @@ let self = {
     name = "njs";
     src = fetchhg {
       url = "https://hg.nginx.org/njs";
-      rev = "0.7.8";
-      sha256 = "sha256-jsR8EOeW8tAo2utKznuUaCG4hK0oU0ZJSnnGmI5HUDk=";
+      rev = "0.7.10";
+      sha256 = "sha256-/yKzY+BUFxLk8bWo+mqKfRVRsC2moe+WvhaRYIGdr6Y=";
       name = "nginx-njs";
     };
 
diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 508a3319d6323..c4a3a918d3047 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "libreddit";
-  version = "0.29.1";
+  version = "0.29.2";
 
   src = fetchFromGitHub {
     owner = "libreddit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-W/vUOioZpA2UYPyJOVTGC1mek574m48NKQXG2o7emjU=";
+    hash = "sha256-YCjH0K84sPgQ9MtA5IUHoGCxrAzRSu4KIuk2qPyhaM4=";
   };
 
-  cargoHash = "sha256-WrkUW9fV69RswS3qBMqBGxNBq6W4eJmJaTrEDp9byrM=";
+  cargoHash = "sha256-VsQckZm8ySmbpn1uSgxWqZ+cc+NnUDNBmSsj4MHdQtk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
diff --git a/pkgs/servers/mail/exim/default.nix b/pkgs/servers/mail/exim/default.nix
index cd407ef37ec7f..1a911668a5401 100644
--- a/pkgs/servers/mail/exim/default.nix
+++ b/pkgs/servers/mail/exim/default.nix
@@ -64,8 +64,8 @@ stdenv.mkDerivation rec {
       ${lib.optionalString enableMySQL ''
         s:^# \(LOOKUP_MYSQL=yes\)$:\1:
         s:^# \(LOOKUP_MYSQL_PC=libmysqlclient\)$:\1:
-        s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -ldl -lm -lpthread -lz:
-        s:^# \(LOOKUP_LIBS\)=.*:\1=-lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -ldl -lm -lpthread -lz:
+        s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -lm -lpthread -lz:
+        s:^# \(LOOKUP_LIBS\)=.*:\1=-lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -lm -lpthread -lz:
         s:^# \(LOOKUP_INCLUDE\)=.*:\1=-I${libmysqlclient.dev}/include/mysql/:
       ''}
       ${lib.optionalString enableAuthDovecot ''
diff --git a/pkgs/servers/monitoring/nagios/default.nix b/pkgs/servers/monitoring/nagios/default.nix
index a58ec2bf7b299..edf82742bc53e 100644
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--localstatedir=/var/lib/nagios" ];
   buildFlags = [ "all" ];
-  CFLAGS = "-ldl";
 
   # Do not create /var directories
   preInstall = ''
diff --git a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
index 5f951f308ddc7..17775b491c64b 100644
--- a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "artifactory_exporter";
-  version = "1.11.0";
+  version = "1.12.0";
   rev = "v${version}";
 
   src = fetchFromGitHub {
     owner = "peimanja";
     repo = pname;
     rev = rev;
-    hash = "sha256-dUAIPS2o+uvCGX32AgknynT0Mzzbq/7SeNmKN0Xc69o=";
+    hash = "sha256-EFjWDoWPePbPX9j4vuI41TAlGcFRlUyPpSvJriZdR0U=";
   };
 
   vendorHash = "sha256-5yzBKgjJCv4tgdBS6XmZUq1ebbka0LOuv6BARWO7kQg=";
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index 41a5d6bca7ce2..c89d3f789e15f 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ferretdb";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    sha256 = "sha256-+tmClWkW3uhBXuQzuSMJnzeA1rrkpLV0QLCzcKhbThw=";
+    sha256 = "sha256-iqoz7axU5U6MdRl8I2vS3Nh37XZZPI4bRb3oFxpQs6M=";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ buildGoModule rec {
     echo nixpkgs     > build/version/package.txt
   '';
 
-  vendorSha256 = "sha256-43FxDRcif8FDHyXdNL/FJEt5ZnCQ8r7d5Red3l9442Q=";
+  vendorSha256 = "sha256-qtxR1vk/EZZmCRP1Z+EFObfMbQXKiRaSiI1Dsv268b8=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/servers/nosql/influxdb/default.nix b/pkgs/servers/nosql/influxdb/default.nix
index 185c246e6fac1..a80975926e8db 100644
--- a/pkgs/servers/nosql/influxdb/default.nix
+++ b/pkgs/servers/nosql/influxdb/default.nix
@@ -33,7 +33,7 @@ let
       Version: ${libflux_version}
       Description: Library for the InfluxData Flux engine
       Cflags: -I/out/include
-      Libs: -L/out/lib -lflux -ldl -lpthread
+      Libs: -L/out/lib -lflux -lpthread
     '';
     passAsFile = [ "pkgcfg" ];
     postInstall = ''
diff --git a/pkgs/servers/nosql/influxdb2/default.nix b/pkgs/servers/nosql/influxdb2/default.nix
index 41bba89996bf2..4f86cc4da5309 100644
--- a/pkgs/servers/nosql/influxdb2/default.nix
+++ b/pkgs/servers/nosql/influxdb2/default.nix
@@ -51,7 +51,7 @@ let
       Version: ${libflux_version}
       Description: Library for the InfluxData Flux engine
       Cflags: -I/out/include
-      Libs: -L/out/lib -lflux -ldl -lpthread
+      Libs: -L/out/lib -lflux -lpthread
     '';
     passAsFile = [ "pkgcfg" ];
     postInstall = ''
diff --git a/pkgs/servers/openafs/1.8/default.nix b/pkgs/servers/openafs/1.8/default.nix
index d6e2f20ecdbef..8ebed1c274643 100644
--- a/pkgs/servers/openafs/1.8/default.nix
+++ b/pkgs/servers/openafs/1.8/default.nix
@@ -89,7 +89,6 @@ stdenv.mkDerivation {
     )
   '' + optionalString withTsm ''
     export XBSA_CFLAGS="-Dxbsa -DNEW_XBSA -I${tsm-client}/lib64/sample -DXBSA_TSMLIB=\\\"${tsm-client}/lib64/libApiTSM64.so\\\""
-    export XBSA_XLIBS="-ldl"
   '';
 
   buildFlags = [ "all_nolibafs" ];
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index ed163f2547df1..cddda5d399f2f 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bzip2 libxml2 libzip boost lua luabind tbb expat ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+    "-Wno-error=uninitialized"
+  ];
+
   postInstall = "mkdir -p $out/share/osrm-backend && cp -r ../profiles $out/share/osrm-backend/profiles";
 
   meta = {
diff --git a/pkgs/servers/pounce/default.nix b/pkgs/servers/pounce/default.nix
index e03d6e6827a15..7ad43825b1516 100644
--- a/pkgs/servers/pounce/default.nix
+++ b/pkgs/servers/pounce/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pounce";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchzip {
     url = "https://git.causal.agency/pounce/snapshot/pounce-${version}.tar.gz";
-    sha256 = "17vmbfr7ika6kmq9jqa3rpd4cr71arapav7hlmggnj7a9yw5b9mg";
+    sha256 = "sha256-6PGiaU5sOwqO4V2PKJgIi3kI2jXsBOldEH51D7Sx9tg=";
   };
 
   buildInputs = [ libressl libxcrypt ];
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 93df798c8bcb6..c5e08b8279a3a 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -207,45 +207,45 @@ let
 in self: {
 
   postgresql_11 = self.callPackage generic {
-    version = "11.18";
+    version = "11.19";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    hash = "sha256-0k8g78UukYrPvMoh6c6ijg4mO4RqDECPz6w7PEoPdQQ=";
+    hash = "sha256-ExCeK3HxE5QFwnIB2jczphrOcu4cIo2cnwMg4GruFMI=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.13";
+    version = "12.14";
     psqlSchema = "12";
-    hash = "sha256-tsYjBGr0VI8RqEtAeTTWddEe0HDHk9FbBGg79fMi4C0=";
+    hash = "sha256-eFYQI304LIQtNW40cTjljAb/6uJA5swLUqxevMMNBD4=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.9";
+    version = "13.10";
     psqlSchema = "13";
-    hash = "sha256-7xlmwKXkn77TNwrSgkkoy2sRZGF67q4WBtooP38zpBU=";
+    hash = "sha256-W7z1pW2FxE86iwWPtGhi/0nLyRg00H4pXQLm3jwhbfI=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.6";
+    version = "14.7";
     psqlSchema = "14";
-    hash = "sha256-UIhA/BgJ05q3InTV8Tfau5/X+0+TPaQWiu67IAae3yI=";
+    hash = "sha256-zvYPAJj6gQHBVG9CVORbcir1QxM3lFs3ryBwB2MNszE=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
   };
 
   postgresql_15 = self.callPackage generic {
-    version = "15.1";
+    version = "15.2";
     psqlSchema = "15";
-    hash = "sha256-ZP3yPXNK+tDf5Ad9rKlqxR3NaX5ori09TKbEXLFOIa4=";
+    hash = "sha256-maIXH8PWtbX1a3V6ejy4XVCaOOQnOAXe8jlB7SuEaMc=";
     this = self.postgresql_15;
     thisAttr = "postgresql_15";
     inherit self;
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 833d31de40131..325632da48ce0 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -78,6 +78,9 @@ in stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = [
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-truncation"
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but unrecognized with GCC 9
+    "-Wno-error=use-after-free"
   ];
 
   configureFlags = [
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 0907d814171f9..e46d8e750a030 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -22,18 +22,18 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  bdftopcf = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
+  bdftopcf = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
     pname = "bdftopcf";
-    version = "1.1";
+    version = "1.1.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/bdftopcf-1.1.tar.bz2";
-      sha256 = "18hiscgljrz10zjcws25bis32nyrg3hzgmiq6scrh7izqmgz0kab";
+      url = "https://xorg.freedesktop.org/archive/individual/util/bdftopcf-1.1.1.tar.xz";
+      sha256 = "026rzs92h9jsc7r0kvvyvwhm22q0805gp38rs14x6ghg7kam7j8i";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ ];
+    buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
@@ -178,11 +178,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontalias = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
     pname = "font-alias";
-    version = "1.0.3";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/font/font-alias-1.0.3.tar.bz2";
-      sha256 = "16ic8wfwwr3jicaml7b5a0sk6plcgc1kg84w02881yhwmqm3nicb";
+      url = "mirror://xorg/individual/font/font-alias-1.0.4.tar.bz2";
+      sha256 = "0xjjjindczv3g7m1597l0x19zz75xy70wh5garghz61fpzl1l4gk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -890,18 +890,18 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libxcb, xtrans }: stdenv.mkDerivation {
+  libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpthreadstubs, libxcb, xtrans }: stdenv.mkDerivation {
     pname = "libX11";
-    version = "1.8.1";
+    version = "1.8.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.8.1.tar.xz";
-      sha256 = "1xyry8i7zqmlkvpbyyqwi18rrdw6ycczlvfp63rh2570pfhimi0v";
+      url = "mirror://xorg/individual/lib/libX11-1.8.3.tar.xz";
+      sha256 = "1gc5cnfys48m1y9y1cidph89fww5c209qff93phbidh68346a5g3";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ xorgproto libxcb xtrans ];
+    buildInputs = [ xorgproto libpthreadstubs libxcb xtrans ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
@@ -1516,11 +1516,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   lndir = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
     pname = "lndir";
-    version = "1.0.3";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/util/lndir-1.0.3.tar.bz2";
-      sha256 = "0pdngiy8zdhsiqx2am75yfcl36l7kd7d7nl0rss8shcdvsqgmx29";
+      url = "mirror://xorg/individual/util/lndir-1.0.4.tar.xz";
+      sha256 = "11syg5hx3f7m1d2p7zw717lryk819h6wk8h4vmapfdxvsflkfd1y";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3436,11 +3436,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xset = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, libXmu, xorgproto, libXxf86misc }: stdenv.mkDerivation {
     pname = "xset";
-    version = "1.2.4";
+    version = "1.2.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xset-1.2.4.tar.bz2";
-      sha256 = "0my987wjvra7l92ry6q44ky383yg3phzxhdbn3lqhapm1ll9bzg4";
+      url = "mirror://xorg/individual/app/xset-1.2.5.tar.xz";
+      sha256 = "0bsyyx3k32k9vpb8x3ks7hlfr03nm0i14fv3cg6n4f2vcdajsscz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index b0530977f7e24..d0a2ec881219c 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -184,6 +184,7 @@ self: super:
     propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ xorg.libSM ];
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     CPP = if stdenv.isDarwin then "clang -E -" else "${stdenv.cc.targetPrefix}cc -E -";
+    outputDoc = "devdoc";
     outputs = [ "out" "dev" "devdoc" ];
   });
 
@@ -591,6 +592,7 @@ self: super:
 
   xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
     buildInputs =  attrs.buildInputs ++ [ mesa mesa.driversdev llvm ]; # for libxatracker
+    NIX_CFLAGS_COMPILE = [ "-Wno-error=address" ]; # gcc12
     meta = attrs.meta // {
       platforms = ["i686-linux" "x86_64-linux"];
     };
@@ -861,6 +863,11 @@ self: super:
             url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/ccdd431cd8f1cabae9d744f0514b6533c438908c.diff";
             sha256 = "sha256-IGPsjS7KgRPLrs1ImBXvIFCa8Iu5ZiAHRZvHlBYP8KQ=";
           })
+          (fetchpatch {
+            name = "CVE-2023-0494.diff";
+            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec.diff";
+            sha256 = "sha256-/+IuGk09OYVEIB/Y+DTKf7kfHyukEFX/6u1FDIGJieY=";
+          })
         ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
         propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
@@ -886,6 +893,11 @@ self: super:
           "--disable-tls"
         ];
 
+        NIX_CFLAGS_COMPILE = [
+          # Needed with GCC 12
+          "-Wno-error=array-bounds"
+        ];
+
         postInstall = ''
           rm -fr $out/share/X11/xkb/compiled # otherwise X will try to write in it
           ( # assert() keeps runtime reference xorgserver-dev in xf86-video-intel and others
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 9a82416d30508..dd09fbba34f52 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -8,7 +8,7 @@ https://xcb.freedesktop.org/dist/xcb-util-keysyms-0.4.0.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-renderutil-0.3.9.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-wm-0.4.1.tar.bz2
 mirror://xorg/individual/app/appres-1.0.5.tar.bz2
-mirror://xorg/individual/app/bdftopcf-1.1.tar.bz2
+https://xorg.freedesktop.org/archive/individual/util/bdftopcf-1.1.1.tar.xz
 mirror://xorg/individual/app/bitmap-1.0.9.tar.gz
 mirror://xorg/individual/app/editres-1.0.7.tar.bz2
 mirror://xorg/individual/app/fonttosfnt-1.2.2.tar.bz2
@@ -64,7 +64,7 @@ mirror://xorg/individual/app/xprop-1.2.6.tar.xz
 mirror://xorg/individual/app/xrandr-1.5.1.tar.xz
 mirror://xorg/individual/app/xrdb-1.2.1.tar.bz2
 mirror://xorg/individual/app/xrefresh-1.0.6.tar.bz2
-mirror://xorg/individual/app/xset-1.2.4.tar.bz2
+mirror://xorg/individual/app/xset-1.2.5.tar.xz
 mirror://xorg/individual/app/xsetroot-1.1.2.tar.bz2
 mirror://xorg/individual/app/xsm-1.0.4.tar.bz2
 mirror://xorg/individual/app/xstdcmap-1.0.4.tar.bz2
@@ -135,7 +135,7 @@ mirror://xorg/individual/font/font-adobe-75dpi-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.4.tar.bz2
-mirror://xorg/individual/font/font-alias-1.0.3.tar.bz2
+mirror://xorg/individual/font/font-alias-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-arabic-misc-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-bh-100dpi-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-bh-75dpi-1.0.3.tar.bz2
@@ -174,7 +174,7 @@ mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.8.1.tar.xz
+mirror://xorg/individual/lib/libX11-1.8.3.tar.xz
 mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2
 mirror://xorg/individual/lib/libxcb-1.14.tar.xz
@@ -213,7 +213,7 @@ mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
 mirror://xorg/individual/proto/xorgproto-2021.5.tar.bz2
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
 mirror://xorg/individual/util/imake-1.0.8.tar.bz2
-mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
+mirror://xorg/individual/util/lndir-1.0.4.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2
 mirror://xorg/individual/util/util-macros-1.19.3.tar.bz2
 mirror://xorg/individual/util/xorg-cf-files-1.0.7.tar.bz2
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 1b787e56076b6..932e81a5177e1 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
+  separateDebugInfo = true;
+
   NIX_CFLAGS_COMPILE = ''
     -DSYS_BASHRC="/etc/bashrc"
     -DSYS_BASH_LOGOUT="/etc/bash_logout"
@@ -52,13 +54,14 @@ stdenv.mkDerivation rec {
 
   patchFlags = [ "-p0" ];
 
-  patches = upstreamPatches
-    ++ [ ./pgrp-pipe-5.patch ]
-    ++ lib.optional stdenv.hostPlatform.isStatic (fetchurl {
+  patches = upstreamPatches ++ [
+    ./pgrp-pipe-5.patch
+    (fetchurl {
       name = "fix-static.patch";
       url = "https://cgit.freebsd.org/ports/plain/shells/bash/files/patch-configure?id=3e147a1f594751a68fea00a28090d0792bee0b51";
       sha256 = "XHFMQ6eXTReNoywdETyrfQEv1rKF8+XFbQZP4YoVKFk=";
-    });
+    })
+  ];
 
   configureFlags = [
     (if interactive then "--with-installed-readline" else "--disable-readline")
diff --git a/pkgs/shells/hilbish/default.nix b/pkgs/shells/hilbish/default.nix
index c1980309e1f18..20e1331dbcb9e 100644
--- a/pkgs/shells/hilbish/default.nix
+++ b/pkgs/shells/hilbish/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "hilbish";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "Rosettea";
     repo = "Hilbish";
     rev = "v${version}";
-    sha256 = "sha256-5GPJVusF3/WbEE5VH45Wyxq40wbNxgjO8QI2cLMpdN0=";
+    sha256 = "sha256-iXDBo3bcmjsDy+iUREpg+sDTFN2LeF7jA+mg62LKeIs=";
     fetchSubmodules = true;
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-Kiy1JR3X++naY2XNLpnGujrNQt7qlL0zxv8E96cHmHo=";
+  vendorHash = "sha256-Kiy1JR3X++naY2XNLpnGujrNQt7qlL0zxv8E96cHmHo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 46929315f07af..6cc6271eedbe6 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -736,6 +736,7 @@ rec {
         pcre.out
         gettext
         binutils.bintools
+        binutils.bintools.lib
         darwin.binutils
         darwin.binutils.bintools
         curl.out
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 08bd836e10e7b..3d60934557c6a 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -173,6 +173,13 @@ let
   separateDebugInfo' = separateDebugInfo && stdenv.hostPlatform.isLinux && !(stdenv.hostPlatform.useLLVM or false);
   outputs' = outputs ++ lib.optional separateDebugInfo' "debug";
 
+  # Turn a derivation into its outPath without a string context attached.
+  # See the comment at the usage site.
+  unsafeDerivationToUntrackedOutpath = drv:
+    if lib.isDerivation drv
+    then builtins.unsafeDiscardStringContext drv.outPath
+    else drv;
+
   noNonNativeDeps = builtins.length (depsBuildTarget ++ depsBuildTargetPropagated
                                   ++ depsHostHost ++ depsHostHostPropagated
                                   ++ buildInputs ++ propagatedBuildInputs
@@ -444,6 +451,40 @@ else let
         "/bin/sh"
       ];
       __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
+    } //
+    # If we use derivations directly here, they end up as build-time dependencies.
+    # This is especially problematic in the case of disallowed*, since the disallowed
+    # derivations will be built by nix as build-time dependencies, while those
+    # derivations might take a very long time to build, or might not even build
+    # successfully on the platform used.
+    # We can improve on this situation by instead passing only the outPath,
+    # without an attached string context, to nix. The out path will be a placeholder
+    # which will be replaced by the actual out path if the derivation in question
+    # is part of the final closure (and thus needs to be built). If it is not
+    # part of the final closure, then the placeholder will be passed along,
+    # but in that case we know for a fact that the derivation is not part of the closure.
+    # This means that passing the out path to nix does the right thing in either
+    # case, both for disallowed and allowed references/requisites, and we won't
+    # build the derivation if it wouldn't be part of the closure, saving time and resources.
+    # While the problem is less severe for allowed*, since we want the derivation
+    # to be built eventually, we would still like to get the error early and without
+    # having to wait while nix builds a derivation that might not be used.
+    # See also https://github.com/NixOS/nix/issues/4629
+    lib.optionalAttrs (attrs ? disallowedReferences) {
+      disallowedReferences =
+        map unsafeDerivationToUntrackedOutpath attrs.disallowedReferences;
+    } //
+    lib.optionalAttrs (attrs ? disallowedRequisites) {
+      disallowedRequisites =
+        map unsafeDerivationToUntrackedOutpath attrs.disallowedRequisites;
+    } //
+    lib.optionalAttrs (attrs ? allowedReferences) {
+      allowedReferences =
+        lib.mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedReferences;
+    } //
+    lib.optionalAttrs (attrs ? allowedRequisites) {
+      allowedRequisites =
+        lib.mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedRequisites;
     };
 
   validity = checkMeta { inherit meta attrs; };
@@ -528,6 +569,12 @@ lib.extendDerivation
        # them as runtime dependencies (since Nix greps for store paths
        # through $out to find them)
        args = [ "-c" "export > $out" ];
+
+       # inputDerivation produces the inputs; not the outputs, so any
+       # restrictions on what used to be the outputs don't serve a purpose
+       # anymore.
+       disallowedReferences = [ ];
+       disallowedRequisites = [ ];
      });
 
      inherit meta passthru overrideAttrs;
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index b1b982ecdffc1..cbf2a2ceb8dee 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -992,13 +992,22 @@ stripHash() {
 unpackCmdHooks+=(_defaultUnpack)
 _defaultUnpack() {
     local fn="$1"
+    local destination
 
     if [ -d "$fn" ]; then
 
+        destination="$(stripHash "$fn")"
+
+        if [ -e "$destination" ]; then
+            echo "Cannot copy $fn to $destination: destination already exists!"
+            echo "Did you specify two \"srcs\" with the same \"name\"?"
+            return 1
+        fi
+
         # We can't preserve hardlinks because they may have been
         # introduced by store optimization, which might break things
         # in the build.
-        cp -pr --reflink=auto -- "$fn" "$(stripHash "$fn")"
+        cp -pr --reflink=auto -- "$fn" "$destination"
 
     else
 
diff --git a/pkgs/test/stdenv/hooks.nix b/pkgs/test/stdenv/hooks.nix
index 7f25d7dbd2db0..3d72efae6c479 100644
--- a/pkgs/test/stdenv/hooks.nix
+++ b/pkgs/test/stdenv/hooks.nix
@@ -23,19 +23,29 @@
     };
   make-symlinks-relative = stdenv.mkDerivation {
     name = "test-make-symlinks-relative";
+    outputs = [ "out" "man" ];
     buildCommand = ''
       mkdir -p $out/{bar,baz}
+      mkdir -p $man/share/{x,y}
       source1="$out/bar/foo"
       destination1="$out/baz/foo"
+      source2="$man/share/x/file1"
+      destination2="$man/share/y/file2"
       echo foo > $source1
+      echo foo > $source2
       ln -s $source1 $destination1
+      ln -s $source2 $destination2
       echo "symlink before patching: $(readlink $destination1)"
+      echo "symlink before patching: $(readlink $destination2)"
 
-      _makeSymlinksRelative
+      _makeSymlinksRelativeInAllOutputs
 
       echo "symlink after patching: $(readlink $destination1)"
       ([[ -e $destination1 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
       ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
+      echo "symlink after patching: $(readlink $destination2)"
+      ([[ -e $destination2 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      ([[ $(readlink $destination2) == "../x/file1" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
     '';
   };
   move-docs = stdenv.mkDerivation {
diff --git a/pkgs/tools/X11/sunpaper/default.nix b/pkgs/tools/X11/sunpaper/default.nix
index 419aa046909fe..9f760bb4a93fb 100644
--- a/pkgs/tools/X11/sunpaper/default.nix
+++ b/pkgs/tools/X11/sunpaper/default.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sunpaper";
-  version = "unstable-2022-04-01";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "hexive";
     repo = "sunpaper";
-    rev = "8d518dfddb5e80215ef3b884ff009df1d4bb74c2";
-    sha256 = "sCG7igD2ZwfHoRpR3Kw7dAded4hG2RbMLR/9nH+nZh8=";
+    rev = "v${version}";
+    sha256 = "sha256-8s7SS79wCS0nRR7IpkshP5QWJqqKEeBu6EtFPDM+2cM=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 33cb045a4ae59..8009118be6b3c 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -25,14 +25,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.9.21"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.9.23"; # N.B: if you change this, check if overrides are still up-to-date
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     rev = version;
-    hash = "sha256-/CMV6eCNm2gF9HhdoTo2TUUy7I4NF9Fb+6l2biGIbkE=";
+    hash = "sha256-OaZ8Eax8XE4xGs5yHh+1P8mwEfHkFNEtY6ZGLQc8Thk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index ed9d9007a936d..433b4240640de 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.128.0";
+  version = "0.129.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CKtDj9Ht81i8EcpjHqluWfwkEU15a/TZd6N+jCSzIc8=";
+    sha256 = "sha256-p9haEozDc1ZTGar89Clm7eEFFLJCYcw+gBN40Zg5vi8=";
   };
 
-  vendorHash = "sha256-aSXj21JNqX/cc62oFqyedmvczmudcV7RhLyWrKsdOMQ=";
+  vendorHash = "sha256-Vb0sgOOIQI0rTJDITFoMbXJcnN7BondbFTm3AF1JTLo=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index e4933986176e8..2c282514d330c 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-77X+AvHFWfYYIio3c+EYf11jg/1IbYhNUweRIDHMOZw=";
   };
 
-
   patches = [
     (fetchpatch {
       url = "https://patch-diff.githubusercontent.com/raw/TigerVNC/tigervnc/pull/1383.patch";
@@ -65,6 +64,10 @@ stdenv.mkDerivation rec {
     "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "out"}/bin"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=array-bounds"
+  ];
+
   postBuild = lib.optionalString stdenv.isLinux ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=int-to-pointer-cast -Wno-error=pointer-to-int-cast"
     export CXXFLAGS="$CXXFLAGS -fpermissive"
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index e68b565d05813..ca0f9a961a15f 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.37.1";
+  version = "0.37.2";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4kjsNaiXnmJk88ivVnpTemOOc/asKrcZLGpO8gtV0J8=";
+    sha256 = "sha256-k5S0ttOhI+vjiGJpIPVi9ro6n3f2Cxe7HiADvs14Zuo=";
   };
   # hash missmatch on across linux and darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-qI29Qb8im9Xii83ayG1jZtZsrsAT0JQOcuKOM7VYro0=";
+  vendorSha256 = "sha256-EJw5DxiBF+gw5X+vqrnZsNCm2umOHEq6GeQ5V/Z0DrE=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/archivers/arc_unpacker/default.nix b/pkgs/tools/archivers/arc_unpacker/default.nix
index ab018fde3d64e..2ade0f88a8d0d 100644
--- a/pkgs/tools/archivers/arc_unpacker/default.nix
+++ b/pkgs/tools/archivers/arc_unpacker/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp tests/test_support/catch.h
+    sed '1i#include <limits>' -i src/dec/eagls/pak_archive_decoder.cc # gcc12
   '';
 
   checkPhase = ''
diff --git a/pkgs/tools/audio/mpris-scrobbler/default.nix b/pkgs/tools/audio/mpris-scrobbler/default.nix
index 35685fd5fb2f5..0c051047c0fc3 100644
--- a/pkgs/tools/audio/mpris-scrobbler/default.nix
+++ b/pkgs/tools/audio/mpris-scrobbler/default.nix
@@ -53,14 +53,17 @@ stdenv.mkDerivation rec {
     "-Dversion=${version}"
   ];
 
-  NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+  ] ++ lib.optionals stdenv.isDarwin [
     "-Wno-sometimes-uninitialized"
     "-Wno-tautological-pointer-compare"
   ] ++ lib.optionals stdenv.isLinux [
     "-Wno-array-bounds"
     "-Wno-free-nonheap-object"
     "-Wno-stringop-truncation"
-  ]);
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/tools/cd-dvd/vobsub2srt/default.nix b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
index 2d764d2f7da0d..612f4ebf04d84 100644
--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-i6V2Owb8GcTcWowgb/BmdupOSFsYiCF2SbC9hXa26uY=";
   };
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-std=c++11" ];
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libtiff ];
   propagatedBuildInputs = [ tesseract ];
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 6a489779cb02f..40df92b4d538c 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -8,6 +8,15 @@
 , buildContrib ? stdenv.hostPlatform == stdenv.buildPlatform
 , doCheck ? stdenv.hostPlatform == stdenv.buildPlatform
 , nix-update-script
+
+# for passthru.tests
+, libarchive
+, rocksdb
+, arrow-cpp
+, libzip
+, curl
+, python3Packages
+, haskellPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -91,6 +100,14 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = nix-update-script { };
+    tests = {
+      inherit libarchive rocksdb arrow-cpp;
+      libzip = libzip.override { withZstd = true; };
+      curl = curl.override { zstdSupport = true; };
+      python-zstd = python3Packages.zstd;
+      haskell-zstd = haskellPackages.zstd;
+      haskell-hs-zstd = haskellPackages.hs-zstd;
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index a620a07d4753e..b9bed9cc20c06 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -24,7 +24,11 @@ in stdenv.mkDerivation rec {
   pname = "blobfuse";
   inherit version src;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=catch-value"
+  ];
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse boost cpplite ];
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index d9ec176220baf..e2677957e9cdf 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, runCommand, fetchurl
+{ lib, stdenv, runCommand, fetchurl, fetchpatch
 , ensureNewerSourcesHook
 , cmake, pkg-config
 , which, git
@@ -152,6 +152,21 @@ in rec {
 
     patches = [
       ./0000-fix-SPDK-build-env.patch
+      # pacific: include/buffer: include <memory>
+      # fixes build with gcc 12
+      # https://github.com/ceph/ceph/pull/47295
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/df88789a38c053513d3b2a9b7d12a952fc0c9042.patch";
+        hash = "sha256-je65kBfa5hR0ZKo6ZI10XmD5ZUbKj5rxlGxxI9ZJVfo=";
+      })
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/2abcbe4e47705e6e0fcc7d9d9b75625f563199af.patch";
+        hash = "sha256-8sWQKoZNHuGuhzX/F+3fY4+kjsrwsfoMdVpfVSj2x5w=";
+      })
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/13dc077cf6c65a3b8c4f13d896847b9964b3fcbb.patch";
+        hash = "sha256-byfiZh9OJrux/y5m3QCPg0LET6q33ZDXmp/CN+yOSQQ=";
+      })
     ];
 
     nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
index 5a917602c43be..e1edac0c61049 100644
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "httm";
-  version = "0.20.5";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "kimono-koans";
     repo = pname;
     rev = version;
-    sha256 = "sha256-8SizRNjA+lvp8ZD14SoRcymhYmJXlwoeZQjrekIbdL4=";
+    sha256 = "sha256-uSCFm6aWNPFPcja+KB6TU7iVVYkDdD82pFjA9dOpSs8=";
   };
 
-  cargoHash = "sha256-tXV1G0qWN0jLOKlnZfHHlOZw+wUItLzQtSg4o2f96u0=";
+  cargoHash = "sha256-uxtZ+aUUhfWGCLysOcWi5En1eRui8Ja+nyD3S2WEWQM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/filesystems/idsk/default.nix b/pkgs/tools/filesystems/idsk/default.nix
index 39052ecba9356..34a32c4a6dfe7 100644
--- a/pkgs/tools/filesystems/idsk/default.nix
+++ b/pkgs/tools/filesystems/idsk/default.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-std=c++14"
+  ];
+
   installPhase = ''
     mkdir -p $out/bin
     cp iDSK $out/bin
diff --git a/pkgs/tools/filesystems/rmfuse/default.nix b/pkgs/tools/filesystems/rmfuse/default.nix
index 78bc6bd55c46b..ace05d0616652 100644
--- a/pkgs/tools/filesystems/rmfuse/default.nix
+++ b/pkgs/tools/filesystems/rmfuse/default.nix
@@ -1,44 +1,49 @@
-{ poetry2nix, pkgs, lib }:
+{ lib
+, python3
+, fetchFromGitHub
+}:
 
-let
-  pythonPackages = (poetry2nix.mkPoetryPackages {
-    projectDir = ./.;
-    overrides = [
-      poetry2nix.defaultPoetryOverrides
-      (import ./poetry-git-overlay.nix { inherit pkgs; })
-      (self: super: {
+python3.pkgs.buildPythonApplication rec {
+  pname = "rmfuse";
+  version = "unstable-2021-06-06";
 
-        rmfuse = super.rmfuse.overridePythonAttrs(old: {
-          meta = old.meta // {
-            description = "RMfuse provides access to your reMarkable Cloud files in the form of a FUSE filesystem.";
-            longDescription = ''
-              RMfuse provides access to your reMarkable Cloud files in the form of a FUSE filesystem. These files are exposed either in their original format, or as PDF files that contain your annotations. This lets you manage files in the reMarkable Cloud using the same tools you use on your local system.
-            '';
-            license = lib.licenses.mit;
-            homepage = "https://github.com/rschroll/rmfuse";
-            maintainers = [ lib.maintainers.adisbladis ];
-          };
-        });
+  format = "pyproject";
 
-        reportlab = let
-          ft = pkgs.freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; });
-        in super.reportlab.overridePythonAttrs(old: {
-          postPatch = ''
-            substituteInPlace setup.py \
-              --replace "mif = findFile(d,'ft2build.h')" "mif = findFile('${lib.getDev ft}','ft2build.h')"
-          '';
+  src = fetchFromGitHub {
+    owner = "rschroll";
+    repo = "rmfuse";
+    rev = "3796b8610c8a965a60a417fc0bf8ea5200b71fd2";
+    hash = "sha256-W3kS6Kkmp8iWMOYFL7r1GyjSQvFotBXQCuTMK0vyHQ8=";
+  };
 
-          NIX_CFLAGS_COMPILE = "-I${pkgs.freetype}/include/freetype2";
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'bidict = "^' 'bidict = ">='
+  '';
 
-          nativeBuildInputs = old.nativeBuildInputs ++ [
-            pkgs.pkg-config
-          ];
-          buildInputs = old.buildInputs ++ [
-            pkgs.freetype
-          ];
-        });
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
 
-      })
-    ];
-  }).python.pkgs;
-in pythonPackages.rmfuse
+  propagatedBuildInputs = with python3.pkgs; [
+    bidict
+    rmrl
+    rmcl
+    pyfuse3
+    xdg
+  ];
+
+  meta = {
+    description = "FUSE access to the reMarkable Cloud";
+    homepage = "https://github.com/rschroll/rmfuse";
+    license = lib.licenses.mit;
+    longDescription = ''
+      RMfuse provides access to your reMarkable Cloud files in the form of a
+      FUSE filesystem. These files are exposed either in their original format,
+      or as PDF files that contain your annotations. This lets you manage files
+      in the reMarkable Cloud using the same tools you use on your local
+      system.
+    '';
+    maintainers = with lib.maintainers; [ adisbladis ];
+  };
+}
diff --git a/pkgs/tools/filesystems/rmfuse/poetry-git-overlay.nix b/pkgs/tools/filesystems/rmfuse/poetry-git-overlay.nix
deleted file mode 100644
index 2ee4f805fb2d1..0000000000000
--- a/pkgs/tools/filesystems/rmfuse/poetry-git-overlay.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ pkgs }:
-self: super: {
-
-  rmfuse = super.rmfuse.overridePythonAttrs (
-    _: {
-      src = pkgs.fetchgit {
-        url = "https://github.com/rschroll/rmfuse.git";
-        rev = "3796b8610c8a965a60a417fc0bf8ea5200b71fd2";
-        sha256 = "03qxy95jpk741b81bd38y51d4a0vynx2y1g662bci9r6m7l14yav";
-      };
-    }
-  );
-
-}
diff --git a/pkgs/tools/filesystems/rmfuse/poetry.lock b/pkgs/tools/filesystems/rmfuse/poetry.lock
deleted file mode 100644
index 4c588fc99e9f3..0000000000000
--- a/pkgs/tools/filesystems/rmfuse/poetry.lock
+++ /dev/null
@@ -1,596 +0,0 @@
-[[package]]
-name = "anyio"
-version = "2.2.0"
-description = "High level compatibility layer for multiple asynchronous event loop implementations"
-category = "main"
-optional = false
-python-versions = ">=3.6.2"
-
-[package.dependencies]
-idna = ">=2.8"
-sniffio = ">=1.1"
-
-[package.extras]
-curio = ["curio (>=1.4)"]
-doc = ["sphinx-rtd-theme", "sphinx-autodoc-typehints (>=1.2.0)"]
-test = ["coverage[toml] (>=4.5)", "hypothesis (>=4.0)", "pytest (>=6.0)", "trustme", "uvloop (<0.15)", "uvloop (>=0.15)"]
-trio = ["trio (>=0.16)"]
-
-[[package]]
-name = "asks"
-version = "2.4.12"
-description = "asks - async http"
-category = "main"
-optional = false
-python-versions = ">= 3.6.2"
-
-[package.dependencies]
-anyio = ">=2.0,<3.0"
-async_generator = "*"
-h11 = "*"
-
-[[package]]
-name = "async-generator"
-version = "1.10"
-description = "Async generators and context managers for Python 3.5+"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[[package]]
-name = "attrs"
-version = "21.4.0"
-description = "Classes Without Boilerplate"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-
-[package.extras]
-dev = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface", "furo", "sphinx", "sphinx-notfound-page", "pre-commit", "cloudpickle"]
-docs = ["furo", "sphinx", "zope.interface", "sphinx-notfound-page"]
-tests = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface", "cloudpickle"]
-tests_no_zope = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "cloudpickle"]
-
-[[package]]
-name = "bidict"
-version = "0.21.4"
-description = "The bidirectional mapping library for Python."
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[[package]]
-name = "cffi"
-version = "1.15.0"
-description = "Foreign Function Interface for Python calling C code."
-category = "main"
-optional = false
-python-versions = "*"
-
-[package.dependencies]
-pycparser = "*"
-
-[[package]]
-name = "cssselect2"
-version = "0.6.0"
-description = "CSS selectors for Python ElementTree"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.dependencies]
-tinycss2 = "*"
-webencodings = "*"
-
-[package.extras]
-doc = ["sphinx", "sphinx-rtd-theme"]
-test = ["pytest", "pytest-cov", "pytest-flake8", "pytest-isort", "coverage"]
-
-[[package]]
-name = "h11"
-version = "0.13.0"
-description = "A pure-Python, bring-your-own-I/O implementation of HTTP/1.1"
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[[package]]
-name = "idna"
-version = "3.3"
-description = "Internationalized Domain Names in Applications (IDNA)"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[[package]]
-name = "lxml"
-version = "4.9.0"
-description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
-
-[package.extras]
-cssselect = ["cssselect (>=0.7)"]
-html5 = ["html5lib"]
-htmlsoup = ["beautifulsoup4"]
-source = ["Cython (>=0.29.7)"]
-
-[[package]]
-name = "outcome"
-version = "1.1.0"
-description = "Capture the outcome of Python function calls."
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[package.dependencies]
-attrs = ">=19.2.0"
-
-[[package]]
-name = "pdfrw"
-version = "0.4"
-description = "PDF file reader/writer library"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "pillow"
-version = "9.1.1"
-description = "Python Imaging Library (Fork)"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.extras]
-docs = ["olefile", "sphinx (>=2.4)", "sphinx-copybutton", "sphinx-issues (>=3.0.1)", "sphinx-removed-in", "sphinx-rtd-theme (>=1.0)", "sphinxext-opengraph"]
-tests = ["check-manifest", "coverage", "defusedxml", "markdown2", "olefile", "packaging", "pyroma", "pytest", "pytest-cov", "pytest-timeout"]
-
-[[package]]
-name = "pycparser"
-version = "2.21"
-description = "C parser in Python"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
-
-[[package]]
-name = "pyfuse3"
-version = "3.2.1"
-description = "Python 3 bindings for libfuse 3 with async I/O support"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[package.dependencies]
-trio = ">=0.15"
-
-[[package]]
-name = "reportlab"
-version = "3.6.9"
-description = "The Reportlab Toolkit"
-category = "main"
-optional = false
-python-versions = ">=3.7, <4"
-
-[package.dependencies]
-pillow = ">=4.0.0"
-
-[package.extras]
-rlpycairo = ["rlPyCairo (>=0.0.5)"]
-
-[[package]]
-name = "rmcl"
-version = "0.4.2"
-description = "reMarkable Cloud Library"
-category = "main"
-optional = false
-python-versions = ">=3.7,<4.0"
-
-[package.dependencies]
-asks = ">=2.4.12,<3.0.0"
-trio = ">=0.18.0,<0.19.0"
-xdg = ">=5.0.1,<6.0.0"
-
-[[package]]
-name = "rmfuse"
-version = "0.2.3"
-description = ""
-category = "main"
-optional = false
-python-versions = "^3.7"
-develop = false
-
-[package.dependencies]
-bidict = "^0.21.2"
-pyfuse3 = {version = "^3.2.0", optional = true}
-rmcl = "^0.4.2"
-rmrl = "^0.2.1"
-xdg = "^5.0.1"
-
-[package.extras]
-pyfuse3 = ["pyfuse3 (>=3.2.0,<4.0.0)"]
-llfuse = ["llfuse (>=1.4.1,<2.0.0)"]
-
-[package.source]
-type = "git"
-url = "https://github.com/rschroll/rmfuse.git"
-reference = "master"
-resolved_reference = "3796b8610c8a965a60a417fc0bf8ea5200b71fd2"
-
-[[package]]
-name = "rmrl"
-version = "0.2.1"
-description = "Render reMarkable documents to PDF"
-category = "main"
-optional = false
-python-versions = ">=3.7,<4.0"
-
-[package.dependencies]
-pdfrw = ">=0.4,<0.5"
-reportlab = ">=3.5.59,<4.0.0"
-svglib = ">=1.0.1,<2.0.0"
-xdg = ">=5.0.1,<6.0.0"
-
-[[package]]
-name = "sniffio"
-version = "1.2.0"
-description = "Sniff out which async library your code is running under"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[[package]]
-name = "sortedcontainers"
-version = "2.4.0"
-description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "svglib"
-version = "1.3.0"
-description = "A pure-Python library for reading and converting SVG"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.dependencies]
-cssselect2 = ">=0.2.0"
-lxml = "*"
-reportlab = "*"
-tinycss2 = ">=0.6.0"
-
-[[package]]
-name = "tinycss2"
-version = "1.1.1"
-description = "A tiny CSS parser"
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[package.dependencies]
-webencodings = ">=0.4"
-
-[package.extras]
-doc = ["sphinx", "sphinx-rtd-theme"]
-test = ["pytest", "pytest-cov", "pytest-flake8", "pytest-isort", "coverage"]
-
-[[package]]
-name = "trio"
-version = "0.18.0"
-description = "A friendly Python library for async concurrency and I/O"
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[package.dependencies]
-async-generator = ">=1.9"
-attrs = ">=19.2.0"
-cffi = {version = ">=1.14", markers = "os_name == \"nt\" and implementation_name != \"pypy\""}
-idna = "*"
-outcome = "*"
-sniffio = "*"
-sortedcontainers = "*"
-
-[[package]]
-name = "webencodings"
-version = "0.5.1"
-description = "Character encoding aliases for legacy web content"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "xdg"
-version = "5.1.1"
-description = "Variables defined by the XDG Base Directory Specification"
-category = "main"
-optional = false
-python-versions = ">=3.6,<4.0"
-
-[metadata]
-lock-version = "1.1"
-python-versions = "^3.8"
-content-hash = "3da90f3013f1220c9081c0a11dac7d8cd05c5a47ebda40fbb4357e44503e99a3"
-
-[metadata.files]
-anyio = [
-    {file = "anyio-2.2.0-py3-none-any.whl", hash = "sha256:aa3da546ed17f097ca876c78024dea380a3b7fa80759abfdda59f12176a3dac8"},
-    {file = "anyio-2.2.0.tar.gz", hash = "sha256:4a41c5b3a65ed92e469d51b6fba3779301850ea2e352afcf9e36c46f21ee14a9"},
-]
-asks = [
-    {file = "asks-2.4.12.tar.gz", hash = "sha256:38de944eb350e7e4e3a918055fa8ff033da5f7b5ff385c1160a2d6b9d84783b0"},
-]
-async-generator = [
-    {file = "async_generator-1.10-py3-none-any.whl", hash = "sha256:01c7bf666359b4967d2cda0000cc2e4af16a0ae098cbffcb8472fb9e8ad6585b"},
-    {file = "async_generator-1.10.tar.gz", hash = "sha256:6ebb3d106c12920aaae42ccb6f787ef5eefdcdd166ea3d628fa8476abe712144"},
-]
-attrs = [
-    {file = "attrs-21.4.0-py2.py3-none-any.whl", hash = "sha256:2d27e3784d7a565d36ab851fe94887c5eccd6a463168875832a1be79c82828b4"},
-    {file = "attrs-21.4.0.tar.gz", hash = "sha256:626ba8234211db98e869df76230a137c4c40a12d72445c45d5f5b716f076e2fd"},
-]
-bidict = [
-    {file = "bidict-0.21.4-py3-none-any.whl", hash = "sha256:3ac67daa353ecf853a1df9d3e924f005e729227a60a8dbada31a4c31aba7f654"},
-    {file = "bidict-0.21.4.tar.gz", hash = "sha256:42c84ffbe6f8de898af6073b4be9ea7ccedcd78d3474aa844c54e49d5a079f6f"},
-]
-cffi = [
-    {file = "cffi-1.15.0-cp27-cp27m-macosx_10_9_x86_64.whl", hash = "sha256:c2502a1a03b6312837279c8c1bd3ebedf6c12c4228ddbad40912d671ccc8a962"},
-    {file = "cffi-1.15.0-cp27-cp27m-manylinux1_i686.whl", hash = "sha256:23cfe892bd5dd8941608f93348c0737e369e51c100d03718f108bf1add7bd6d0"},
-    {file = "cffi-1.15.0-cp27-cp27m-manylinux1_x86_64.whl", hash = "sha256:41d45de54cd277a7878919867c0f08b0cf817605e4eb94093e7516505d3c8d14"},
-    {file = "cffi-1.15.0-cp27-cp27m-win32.whl", hash = "sha256:4a306fa632e8f0928956a41fa8e1d6243c71e7eb59ffbd165fc0b41e316b2474"},
-    {file = "cffi-1.15.0-cp27-cp27m-win_amd64.whl", hash = "sha256:e7022a66d9b55e93e1a845d8c9eba2a1bebd4966cd8bfc25d9cd07d515b33fa6"},
-    {file = "cffi-1.15.0-cp27-cp27mu-manylinux1_i686.whl", hash = "sha256:14cd121ea63ecdae71efa69c15c5543a4b5fbcd0bbe2aad864baca0063cecf27"},
-    {file = "cffi-1.15.0-cp27-cp27mu-manylinux1_x86_64.whl", hash = "sha256:d4d692a89c5cf08a8557fdeb329b82e7bf609aadfaed6c0d79f5a449a3c7c023"},
-    {file = "cffi-1.15.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0104fb5ae2391d46a4cb082abdd5c69ea4eab79d8d44eaaf79f1b1fd806ee4c2"},
-    {file = "cffi-1.15.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:91ec59c33514b7c7559a6acda53bbfe1b283949c34fe7440bcf917f96ac0723e"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:f5c7150ad32ba43a07c4479f40241756145a1f03b43480e058cfd862bf5041c7"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:00c878c90cb53ccfaae6b8bc18ad05d2036553e6d9d1d9dbcf323bbe83854ca3"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:abb9a20a72ac4e0fdb50dae135ba5e77880518e742077ced47eb1499e29a443c"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a5263e363c27b653a90078143adb3d076c1a748ec9ecc78ea2fb916f9b861962"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f54a64f8b0c8ff0b64d18aa76675262e1700f3995182267998c31ae974fbc382"},
-    {file = "cffi-1.15.0-cp310-cp310-win32.whl", hash = "sha256:c21c9e3896c23007803a875460fb786118f0cdd4434359577ea25eb556e34c55"},
-    {file = "cffi-1.15.0-cp310-cp310-win_amd64.whl", hash = "sha256:5e069f72d497312b24fcc02073d70cb989045d1c91cbd53979366077959933e0"},
-    {file = "cffi-1.15.0-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:64d4ec9f448dfe041705426000cc13e34e6e5bb13736e9fd62e34a0b0c41566e"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2756c88cbb94231c7a147402476be2c4df2f6078099a6f4a480d239a8817ae39"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3b96a311ac60a3f6be21d2572e46ce67f09abcf4d09344c49274eb9e0bf345fc"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:75e4024375654472cc27e91cbe9eaa08567f7fbdf822638be2814ce059f58032"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:59888172256cac5629e60e72e86598027aca6bf01fa2465bdb676d37636573e8"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:27c219baf94952ae9d50ec19651a687b826792055353d07648a5695413e0c605"},
-    {file = "cffi-1.15.0-cp36-cp36m-win32.whl", hash = "sha256:4958391dbd6249d7ad855b9ca88fae690783a6be9e86df65865058ed81fc860e"},
-    {file = "cffi-1.15.0-cp36-cp36m-win_amd64.whl", hash = "sha256:f6f824dc3bce0edab5f427efcfb1d63ee75b6fcb7282900ccaf925be84efb0fc"},
-    {file = "cffi-1.15.0-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:06c48159c1abed75c2e721b1715c379fa3200c7784271b3c46df01383b593636"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:c2051981a968d7de9dd2d7b87bcb9c939c74a34626a6e2f8181455dd49ed69e4"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:fd8a250edc26254fe5b33be00402e6d287f562b6a5b2152dec302fa15bb3e997"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:91d77d2a782be4274da750752bb1650a97bfd8f291022b379bb8e01c66b4e96b"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:45db3a33139e9c8f7c09234b5784a5e33d31fd6907800b316decad50af323ff2"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:263cc3d821c4ab2213cbe8cd8b355a7f72a8324577dc865ef98487c1aeee2bc7"},
-    {file = "cffi-1.15.0-cp37-cp37m-win32.whl", hash = "sha256:17771976e82e9f94976180f76468546834d22a7cc404b17c22df2a2c81db0c66"},
-    {file = "cffi-1.15.0-cp37-cp37m-win_amd64.whl", hash = "sha256:3415c89f9204ee60cd09b235810be700e993e343a408693e80ce7f6a40108029"},
-    {file = "cffi-1.15.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:4238e6dab5d6a8ba812de994bbb0a79bddbdf80994e4ce802b6f6f3142fcc880"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:0808014eb713677ec1292301ea4c81ad277b6cdf2fdd90fd540af98c0b101d20"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:57e9ac9ccc3101fac9d6014fba037473e4358ef4e89f8e181f8951a2c0162024"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8b6c2ea03845c9f501ed1313e78de148cd3f6cad741a75d43a29b43da27f2e1e"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:10dffb601ccfb65262a27233ac273d552ddc4d8ae1bf93b21c94b8511bffe728"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:786902fb9ba7433aae840e0ed609f45c7bcd4e225ebb9c753aa39725bb3e6ad6"},
-    {file = "cffi-1.15.0-cp38-cp38-win32.whl", hash = "sha256:da5db4e883f1ce37f55c667e5c0de439df76ac4cb55964655906306918e7363c"},
-    {file = "cffi-1.15.0-cp38-cp38-win_amd64.whl", hash = "sha256:181dee03b1170ff1969489acf1c26533710231c58f95534e3edac87fff06c443"},
-    {file = "cffi-1.15.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:45e8636704eacc432a206ac7345a5d3d2c62d95a507ec70d62f23cd91770482a"},
-    {file = "cffi-1.15.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:31fb708d9d7c3f49a60f04cf5b119aeefe5644daba1cd2a0fe389b674fd1de37"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:6dc2737a3674b3e344847c8686cf29e500584ccad76204efea14f451d4cc669a"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:74fdfdbfdc48d3f47148976f49fab3251e550a8720bebc99bf1483f5bfb5db3e"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ffaa5c925128e29efbde7301d8ecaf35c8c60ffbcd6a1ffd3a552177c8e5e796"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3f7d084648d77af029acb79a0ff49a0ad7e9d09057a9bf46596dac9514dc07df"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ef1f279350da2c586a69d32fc8733092fd32cc8ac95139a00377841f59a3f8d8"},
-    {file = "cffi-1.15.0-cp39-cp39-win32.whl", hash = "sha256:2a23af14f408d53d5e6cd4e3d9a24ff9e05906ad574822a10563efcef137979a"},
-    {file = "cffi-1.15.0-cp39-cp39-win_amd64.whl", hash = "sha256:3773c4d81e6e818df2efbc7dd77325ca0dcb688116050fb2b3011218eda36139"},
-    {file = "cffi-1.15.0.tar.gz", hash = "sha256:920f0d66a896c2d99f0adbb391f990a84091179542c205fa53ce5787aff87954"},
-]
-cssselect2 = [
-    {file = "cssselect2-0.6.0-py3-none-any.whl", hash = "sha256:3a83b2a68370c69c9cd3fcb88bbfaebe9d22edeef2c22d1ff3e1ed9c7fa45ed8"},
-    {file = "cssselect2-0.6.0.tar.gz", hash = "sha256:5b5d6dea81a5eb0c9ca39f116c8578dd413778060c94c1f51196371618909325"},
-]
-h11 = [
-    {file = "h11-0.13.0-py3-none-any.whl", hash = "sha256:8ddd78563b633ca55346c8cd41ec0af27d3c79931828beffb46ce70a379e7442"},
-    {file = "h11-0.13.0.tar.gz", hash = "sha256:70813c1135087a248a4d38cc0e1a0181ffab2188141a93eaf567940c3957ff06"},
-]
-idna = [
-    {file = "idna-3.3-py3-none-any.whl", hash = "sha256:84d9dd047ffa80596e0f246e2eab0b391788b0503584e8945f2368256d2735ff"},
-    {file = "idna-3.3.tar.gz", hash = "sha256:9d643ff0a55b762d5cdb124b8eaa99c66322e2157b69160bc32796e824360e6d"},
-]
-lxml = [
-    {file = "lxml-4.9.0-cp27-cp27m-macosx_10_15_x86_64.whl", hash = "sha256:b5031d151d6147eac53366d6ec87da84cd4d8c5e80b1d9948a667a7164116e39"},
-    {file = "lxml-4.9.0-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:5d52e1173f52020392f593f87a6af2d4055dd800574a5cb0af4ea3878801d307"},
-    {file = "lxml-4.9.0-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:3af00ee88376022589ceeb8170eb67dacf5f7cd625ea59fa0977d719777d4ae8"},
-    {file = "lxml-4.9.0-cp27-cp27m-win32.whl", hash = "sha256:1057356b808d149bc14eb8f37bb89129f237df488661c1e0fc0376ca90e1d2c3"},
-    {file = "lxml-4.9.0-cp27-cp27m-win_amd64.whl", hash = "sha256:f6d23a01921b741774f35e924d418a43cf03eca1444f3fdfd7978d35a5aaab8b"},
-    {file = "lxml-4.9.0-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:56e19fb6e4b8bd07fb20028d03d3bc67bcc0621347fbde64f248e44839771756"},
-    {file = "lxml-4.9.0-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:4cd69bca464e892ea4ed544ba6a7850aaff6f8d792f8055a10638db60acbac18"},
-    {file = "lxml-4.9.0-cp310-cp310-macosx_10_15_x86_64.whl", hash = "sha256:94b181dd2777890139e49a5336bf3a9a3378ce66132c665fe8db4e8b7683cde2"},
-    {file = "lxml-4.9.0-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:607224ffae9a0cf0a2f6e14f5f6bce43e83a6fbdaa647891729c103bdd6a5593"},
-    {file = "lxml-4.9.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:11d62c97ceff9bab94b6b29c010ea5fb6831743459bb759c917f49ba75601cd0"},
-    {file = "lxml-4.9.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:70a198030d26f5e569367f0f04509b63256faa76a22886280eea69a4f535dd40"},
-    {file = "lxml-4.9.0-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:3cf816aed8125cfc9e6e5c6c31ff94278320d591bd7970c4a0233bee0d1c8790"},
-    {file = "lxml-4.9.0-cp310-cp310-win32.whl", hash = "sha256:65b3b5f12c6fb5611e79157214f3cd533083f9b058bf2fc8a1c5cc5ee40fdc5a"},
-    {file = "lxml-4.9.0-cp310-cp310-win_amd64.whl", hash = "sha256:0aa4cce579512c33373ca4c5e23c21e40c1aa1a33533a75e51b654834fd0e4f2"},
-    {file = "lxml-4.9.0-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:63419db39df8dc5564f6f103102c4665f7e4d9cb64030e98cf7a74eae5d5760d"},
-    {file = "lxml-4.9.0-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:d8e5021e770b0a3084c30dda5901d5fce6d4474feaf0ced8f8e5a82702502fbb"},
-    {file = "lxml-4.9.0-cp35-cp35m-win32.whl", hash = "sha256:f17b9df97c5ecdfb56c5e85b3c9df9831246df698f8581c6e111ac664c7c656e"},
-    {file = "lxml-4.9.0-cp35-cp35m-win_amd64.whl", hash = "sha256:75da29a0752c8f2395df0115ac1681cefbdd4418676015be8178b733704cbff2"},
-    {file = "lxml-4.9.0-cp36-cp36m-macosx_10_15_x86_64.whl", hash = "sha256:e4d020ecf3740b7312bacab2cb966bb720fd4d3490562d373b4ad91dd1857c0d"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:b71c52d69b91af7d18c13aef1b0cc3baee36b78607c711eb14a52bf3aa7c815e"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:28cf04a1a38e961d4a764d2940af9b941b66263ed5584392ef875ee9c1e360a3"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:915ecf7d486df17cc65aeefdb680d5ad4390cc8c857cf8db3fe241ed234f856a"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e564d5a771b4015f34166a05ea2165b7e283635c41b1347696117f780084b46d"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:c2a57755e366e0ac7ebdb3e9207f159c3bf1afed02392ab18453ce81f5ee92ee"},
-    {file = "lxml-4.9.0-cp36-cp36m-musllinux_1_1_x86_64.whl", hash = "sha256:00f3a6f88fd5f4357844dd91a1abac5f466c6799f1b7f1da2df6665253845b11"},
-    {file = "lxml-4.9.0-cp36-cp36m-win32.whl", hash = "sha256:9093a359a86650a3dbd6532c3e4d21a6f58ba2cb60d0e72db0848115d24c10ba"},
-    {file = "lxml-4.9.0-cp36-cp36m-win_amd64.whl", hash = "sha256:d1690c4d37674a5f0cdafbc5ed7e360800afcf06928c2a024c779c046891bf09"},
-    {file = "lxml-4.9.0-cp37-cp37m-macosx_10_15_x86_64.whl", hash = "sha256:6af7f51a6010748fc1bb71917318d953c9673e4ae3f6d285aaf93ef5b2eb11c1"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:eabdbe04ee0a7e760fa6cd9e799d2b020d098c580ba99107d52e1e5e538b1ecb"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:b1e22f3ee4d75ca261b6bffbf64f6f178cb194b1be3191065a09f8d98828daa9"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:53b0410b220766321759f7f9066da67b1d0d4a7f6636a477984cbb1d98483955"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:d76da27f5e3e9bc40eba6ed7a9e985f57547e98cf20521d91215707f2fb57e0f"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:686565ac77ff94a8965c11829af253d9e2ce3bf0d9225b1d2eb5c4d4666d0dca"},
-    {file = "lxml-4.9.0-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:b62d1431b4c40cda43cc986f19b8c86b1d2ae8918cfc00f4776fdf070b65c0c4"},
-    {file = "lxml-4.9.0-cp37-cp37m-win32.whl", hash = "sha256:4becd16750ca5c2a1b1588269322b2cebd10c07738f336c922b658dbab96a61c"},
-    {file = "lxml-4.9.0-cp37-cp37m-win_amd64.whl", hash = "sha256:e35a298691b9e10e5a5631f8f0ba605b30ebe19208dc8f58b670462f53753641"},
-    {file = "lxml-4.9.0-cp38-cp38-macosx_10_15_x86_64.whl", hash = "sha256:aa7447bf7c1a15ef24e2b86a277b585dd3f055e8890ac7f97374d170187daa97"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:612ef8f2795a89ba3a1d4c8c1af84d8453fd53ee611aa5ad460fdd2cab426fc2"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:1bfb791a8fcdbf55d1d41b8be940393687bec0e9b12733f0796668086d1a23ff"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:024684e0c5cfa121c22140d3a0898a3a9b2ea0f0fd2c229b6658af4bdf1155e5"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:81c29c8741fa07ecec8ec7417c3d8d1e2f18cf5a10a280f4e1c3f8c3590228b2"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:6467626fa74f96f4d80fc6ec2555799e97fff8f36e0bfc7f67769f83e59cff40"},
-    {file = "lxml-4.9.0-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:9cae837b988f44925d14d048fa6a8c54f197c8b1223fd9ee9c27084f84606143"},
-    {file = "lxml-4.9.0-cp38-cp38-win32.whl", hash = "sha256:5a49ad78543925e1a4196e20c9c54492afa4f1502c2a563f73097e2044c75190"},
-    {file = "lxml-4.9.0-cp38-cp38-win_amd64.whl", hash = "sha256:bb7c1b029e54e26e01b1d1d912fc21abb65650d16ea9a191d026def4ed0859ed"},
-    {file = "lxml-4.9.0-cp39-cp39-macosx_10_15_x86_64.whl", hash = "sha256:d0d03b9636f1326772e6854459728676354d4c7731dae9902b180e2065ba3da6"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:9af19eb789d674b59a9bee5005779757aab857c40bf9cc313cb01eafac55ce55"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:dd00d28d1ab5fa7627f5abc957f29a6338a7395b724571a8cbff8fbed83aaa82"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:754a1dd04bff8a509a31146bd8f3a5dc8191a8694d582dd5fb71ff09f0722c22"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b7679344f2270840dc5babc9ccbedbc04f7473c1f66d4676bb01680c0db85bcc"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:d882c2f3345261e898b9f604be76b61c901fbfa4ac32e3f51d5dc1edc89da3cb"},
-    {file = "lxml-4.9.0-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:4e97c8fc761ad63909198acc892f34c20f37f3baa2c50a62d5ec5d7f1efc68a1"},
-    {file = "lxml-4.9.0-cp39-cp39-win32.whl", hash = "sha256:cf9ec915857d260511399ab87e1e70fa13d6b2972258f8e620a3959468edfc32"},
-    {file = "lxml-4.9.0-cp39-cp39-win_amd64.whl", hash = "sha256:1254a79f8a67a3908de725caf59eae62d86738f6387b0a34b32e02abd6ae73db"},
-    {file = "lxml-4.9.0-pp37-pypy37_pp73-macosx_10_15_x86_64.whl", hash = "sha256:03370ec37fe562238d385e2c53089076dee53aabf8325cab964fdb04a9130fa0"},
-    {file = "lxml-4.9.0-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:f386def57742aacc3d864169dfce644a8c396f95aa35b41b69df53f558d56dd0"},
-    {file = "lxml-4.9.0-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:ea3f2e9eb41f973f73619e88bf7bd950b16b4c2ce73d15f24a11800ce1eaf276"},
-    {file = "lxml-4.9.0-pp38-pypy38_pp73-macosx_10_15_x86_64.whl", hash = "sha256:2d10659e6e5c53298e6d718fd126e793285bff904bb71d7239a17218f6a197b7"},
-    {file = "lxml-4.9.0-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:fcdf70191f0d1761d190a436db06a46f05af60e1410e1507935f0332280c9268"},
-    {file = "lxml-4.9.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:2b9c2341d96926b0d0e132e5c49ef85eb53fa92ae1c3a70f9072f3db0d32bc07"},
-    {file = "lxml-4.9.0-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:615886ee84b6f42f1bdf1852a9669b5fe3b96b6ff27f1a7a330b67ad9911200a"},
-    {file = "lxml-4.9.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:94f2e45b054dd759bed137b6e14ae8625495f7d90ddd23cf62c7a68f72b62656"},
-    {file = "lxml-4.9.0.tar.gz", hash = "sha256:520461c36727268a989790aef08884347cd41f2d8ae855489ccf40b50321d8d7"},
-]
-outcome = [
-    {file = "outcome-1.1.0-py2.py3-none-any.whl", hash = "sha256:c7dd9375cfd3c12db9801d080a3b63d4b0a261aa996c4c13152380587288d958"},
-    {file = "outcome-1.1.0.tar.gz", hash = "sha256:e862f01d4e626e63e8f92c38d1f8d5546d3f9cce989263c521b2e7990d186967"},
-]
-pdfrw = [
-    {file = "pdfrw-0.4-py2.py3-none-any.whl", hash = "sha256:758289edaa3b672e9a1a67504be73c18ec668d4e5b9d5ac9cbc0dc753d8d196b"},
-    {file = "pdfrw-0.4.tar.gz", hash = "sha256:0dc0494a0e6561b268542b28ede2280387c2728114f117d3bb5d8e4787b93ef4"},
-]
-pillow = [
-    {file = "Pillow-9.1.1-cp310-cp310-macosx_10_10_x86_64.whl", hash = "sha256:42dfefbef90eb67c10c45a73a9bc1599d4dac920f7dfcbf4ec6b80cb620757fe"},
-    {file = "Pillow-9.1.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:ffde4c6fabb52891d81606411cbfaf77756e3b561b566efd270b3ed3791fde4e"},
-    {file = "Pillow-9.1.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9c857532c719fb30fafabd2371ce9b7031812ff3889d75273827633bca0c4602"},
-    {file = "Pillow-9.1.1-cp310-cp310-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:59789a7d06c742e9d13b883d5e3569188c16acb02eeed2510fd3bfdbc1bd1530"},
-    {file = "Pillow-9.1.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4d45dbe4b21a9679c3e8b3f7f4f42a45a7d3ddff8a4a16109dff0e1da30a35b2"},
-    {file = "Pillow-9.1.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:e9ed59d1b6ee837f4515b9584f3d26cf0388b742a11ecdae0d9237a94505d03a"},
-    {file = "Pillow-9.1.1-cp310-cp310-win32.whl", hash = "sha256:b3fe2ff1e1715d4475d7e2c3e8dabd7c025f4410f79513b4ff2de3d51ce0fa9c"},
-    {file = "Pillow-9.1.1-cp310-cp310-win_amd64.whl", hash = "sha256:5b650dbbc0969a4e226d98a0b440c2f07a850896aed9266b6fedc0f7e7834108"},
-    {file = "Pillow-9.1.1-cp37-cp37m-macosx_10_10_x86_64.whl", hash = "sha256:0b4d5ad2cd3a1f0d1df882d926b37dbb2ab6c823ae21d041b46910c8f8cd844b"},
-    {file = "Pillow-9.1.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9370d6744d379f2de5d7fa95cdbd3a4d92f0b0ef29609b4b1687f16bc197063d"},
-    {file = "Pillow-9.1.1-cp37-cp37m-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b761727ed7d593e49671d1827044b942dd2f4caae6e51bab144d4accf8244a84"},
-    {file = "Pillow-9.1.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8a66fe50386162df2da701b3722781cbe90ce043e7d53c1fd6bd801bca6b48d4"},
-    {file = "Pillow-9.1.1-cp37-cp37m-win32.whl", hash = "sha256:2b291cab8a888658d72b575a03e340509b6b050b62db1f5539dd5cd18fd50578"},
-    {file = "Pillow-9.1.1-cp37-cp37m-win_amd64.whl", hash = "sha256:1d4331aeb12f6b3791911a6da82de72257a99ad99726ed6b63f481c0184b6fb9"},
-    {file = "Pillow-9.1.1-cp38-cp38-macosx_10_10_x86_64.whl", hash = "sha256:8844217cdf66eabe39567118f229e275f0727e9195635a15e0e4b9227458daaf"},
-    {file = "Pillow-9.1.1-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:b6617221ff08fbd3b7a811950b5c3f9367f6e941b86259843eab77c8e3d2b56b"},
-    {file = "Pillow-9.1.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:20d514c989fa28e73a5adbddd7a171afa5824710d0ab06d4e1234195d2a2e546"},
-    {file = "Pillow-9.1.1-cp38-cp38-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:088df396b047477dd1bbc7de6e22f58400dae2f21310d9e2ec2933b2ef7dfa4f"},
-    {file = "Pillow-9.1.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:53c27bd452e0f1bc4bfed07ceb235663a1df7c74df08e37fd6b03eb89454946a"},
-    {file = "Pillow-9.1.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:3f6c1716c473ebd1649663bf3b42702d0d53e27af8b64642be0dd3598c761fb1"},
-    {file = "Pillow-9.1.1-cp38-cp38-win32.whl", hash = "sha256:c67db410508b9de9c4694c57ed754b65a460e4812126e87f5052ecf23a011a54"},
-    {file = "Pillow-9.1.1-cp38-cp38-win_amd64.whl", hash = "sha256:f054b020c4d7e9786ae0404278ea318768eb123403b18453e28e47cdb7a0a4bf"},
-    {file = "Pillow-9.1.1-cp39-cp39-macosx_10_10_x86_64.whl", hash = "sha256:c17770a62a71718a74b7548098a74cd6880be16bcfff5f937f900ead90ca8e92"},
-    {file = "Pillow-9.1.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:f3f6a6034140e9e17e9abc175fc7a266a6e63652028e157750bd98e804a8ed9a"},
-    {file = "Pillow-9.1.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f372d0f08eff1475ef426344efe42493f71f377ec52237bf153c5713de987251"},
-    {file = "Pillow-9.1.1-cp39-cp39-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:09e67ef6e430f90caa093528bd758b0616f8165e57ed8d8ce014ae32df6a831d"},
-    {file = "Pillow-9.1.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:66daa16952d5bf0c9d5389c5e9df562922a59bd16d77e2a276e575d32e38afd1"},
-    {file = "Pillow-9.1.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:d78ca526a559fb84faaaf84da2dd4addef5edb109db8b81677c0bb1aad342601"},
-    {file = "Pillow-9.1.1-cp39-cp39-win32.whl", hash = "sha256:55e74faf8359ddda43fee01bffbc5bd99d96ea508d8a08c527099e84eb708f45"},
-    {file = "Pillow-9.1.1-cp39-cp39-win_amd64.whl", hash = "sha256:7c150dbbb4a94ea4825d1e5f2c5501af7141ea95825fadd7829f9b11c97aaf6c"},
-    {file = "Pillow-9.1.1-pp37-pypy37_pp73-macosx_10_10_x86_64.whl", hash = "sha256:769a7f131a2f43752455cc72f9f7a093c3ff3856bf976c5fb53a59d0ccc704f6"},
-    {file = "Pillow-9.1.1-pp37-pypy37_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:488f3383cf5159907d48d32957ac6f9ea85ccdcc296c14eca1a4e396ecc32098"},
-    {file = "Pillow-9.1.1-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0b525a356680022b0af53385944026d3486fc8c013638cf9900eb87c866afb4c"},
-    {file = "Pillow-9.1.1-pp38-pypy38_pp73-macosx_10_10_x86_64.whl", hash = "sha256:6e760cf01259a1c0a50f3c845f9cad1af30577fd8b670339b1659c6d0e7a41dd"},
-    {file = "Pillow-9.1.1-pp38-pypy38_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:a4165205a13b16a29e1ac57efeee6be2dfd5b5408122d59ef2145bc3239fa340"},
-    {file = "Pillow-9.1.1-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:937a54e5694684f74dcbf6e24cc453bfc5b33940216ddd8f4cd8f0f79167f765"},
-    {file = "Pillow-9.1.1-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:baf3be0b9446a4083cc0c5bb9f9c964034be5374b5bc09757be89f5d2fa247b8"},
-    {file = "Pillow-9.1.1.tar.gz", hash = "sha256:7502539939b53d7565f3d11d87c78e7ec900d3c72945d4ee0e2f250d598309a0"},
-]
-pycparser = [
-    {file = "pycparser-2.21-py2.py3-none-any.whl", hash = "sha256:8ee45429555515e1f6b185e78100aea234072576aa43ab53aefcae078162fca9"},
-    {file = "pycparser-2.21.tar.gz", hash = "sha256:e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206"},
-]
-pyfuse3 = [
-    {file = "pyfuse3-3.2.1.tar.gz", hash = "sha256:22d146dac59a8429115e9a93317975ea54b35e0278044a94d3fac5b4ad5f7e33"},
-]
-reportlab = [
-    {file = "reportlab-3.6.9-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:4ba8eebfa4383e4680d6e7e6dba9c45c1fe19bbc0a754db4d84823f1a9511e56"},
-    {file = "reportlab-3.6.9-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:37dda88dbe16dd3f4f9039464637cce66e462c0b95e5763dbd45ac5799136d3a"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:10681d89a0ca37bb4036283fb8c0efac9ac1b22265dbdf350bda0448be33e00c"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cebd0b28a0e875a9ce789514700f80659269ecf2a8fcef0aa10b8ae52b40474a"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1ec84055cf2c83783958b74eadf0e577eb0cd9088c8b5d536e9ddc0f4a9f8c70"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:90f74627cafecf3924741ab8b0690a19df4214eb56b1cfce2dc74a15c9744034"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b2c2fd861f10b2cd49ccf29a31da9ad5c3b95aa437804e4fd0351ed4eb695f74"},
-    {file = "reportlab-3.6.9-cp310-cp310-win32.whl", hash = "sha256:e492e87886423192af1fafde23907bcd9d2fdccfc22f67e18aa5c73db3a380a3"},
-    {file = "reportlab-3.6.9-cp310-cp310-win_amd64.whl", hash = "sha256:d1bf9455aff37beb421a4447d89d6dd77bb46f677c0bab4eb0272cdb79faad2f"},
-    {file = "reportlab-3.6.9-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:0a7f2b7232c3ffb451b649d55c51a6dd0c8104ad7bbcfe355addf7619705e7fa"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1967dbc9930917d75c39784712a137d432dbc2e5ca9e132a2453319c2619ccff"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:32a5c5cd9625a40feec956f460355b4813bc3187c4f8dc9efd9f1a7f8f854e34"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8cb82b6d14ad4bd915acacc8f114c6a7bab8b9b1503cabb930e433ebd320f90c"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0e767cf4507ca8eed7dde8511f0889b0f19f160a2bdf9ef07742b2aaeceed9f2"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6a114761ad3ba6e0cdfacf14a8fb2cb8f5713b115ca1f0c17f3cd638d0a5b4bd"},
-    {file = "reportlab-3.6.9-cp37-cp37m-win32.whl", hash = "sha256:bbaab798991863952c593c0459dcb82e0aade837675593310e13cba2ce7fb45a"},
-    {file = "reportlab-3.6.9-cp37-cp37m-win_amd64.whl", hash = "sha256:ab1ffe4ec7be99ad348791116d436610afdc7a9a02a968997f31eaa62eaadad8"},
-    {file = "reportlab-3.6.9-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:496f42840604255ce06777bc129048b3bab966213bbac4f07fbe4ceb6a2e0482"},
-    {file = "reportlab-3.6.9-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:a441afdfe31870b964bccde042d7172ed3c0077f519bbf3ed7d9d34c406b6b91"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4fbe23ac870adf90544d2014c572dba6ec4d772afad6505bb91f171ddad12839"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:de724c78f4eb1363b1195dce85a2a8806e7509b69ac5c842a714d942ea534d63"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:713574da534b6ce73d884f1574c35a565e438af4888fcc75e752f1de02e356a7"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:193671445b4885128d8800d3e416eb2fa4fd89bafae08cc9889c0752fe5ad8c2"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ff0e014a3a3fe286c642ef51213c41684a156b9ed293ef205e8890bc1dbbfdc7"},
-    {file = "reportlab-3.6.9-cp38-cp38-win32.whl", hash = "sha256:23f5aed2d212096f2fe95d56f868d63f839a08bf7e389237e644d93981274222"},
-    {file = "reportlab-3.6.9-cp38-cp38-win_amd64.whl", hash = "sha256:09b2ca175129a34292399fc4c6a8b1739f6c5946368fcaa6f931d69385b2f720"},
-    {file = "reportlab-3.6.9-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:cb21666fc9edec9716553bfcfe0c30d1bbbe2731910a96f07ec65652974e5f83"},
-    {file = "reportlab-3.6.9-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:d927bf802bf53c1b5a3878a22e9be310900877984e7c436a3a99bdd19cfec4c3"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ce3a3aad287c8532f62223f5720b5504e31abe3dce52a27bd2a25f508c0d846e"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c9a5f63bc381c0f945402ef4c1bccc74a8eed28f6be6596704b1db7d82ec89fe"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:50f8e30f5410efc69b0217261b1f21912888da392a4549e79c7aaaac85f01bfa"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:15294435f786968bcdf1a7a67bcc23a136470b6ea26919497f5c76ff0f653041"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e9b5e9115363545a727d8ebe7e4b94f7cf6f26113261a269d50d88b8db4eb726"},
-    {file = "reportlab-3.6.9-cp39-cp39-win32.whl", hash = "sha256:e1fc1b1f5d9d1c2e18b5e60602dfa7854b2330ba0efc312ef605abf588abea9c"},
-    {file = "reportlab-3.6.9-cp39-cp39-win_amd64.whl", hash = "sha256:92a6613af9877e3ad2a1c5a16a122514a4f9f8d9b91b1f22e7fa0fa796617b36"},
-    {file = "reportlab-3.6.9.tar.gz", hash = "sha256:5d0cc3682456ad213150f6dbffe7d47eab737d809e517c316103376be548fb84"},
-]
-rmcl = [
-    {file = "rmcl-0.4.2-py3-none-any.whl", hash = "sha256:09534999cd233e5e8db531e51aab87eee7d72aa5a2592bcf100e2d015110cf52"},
-    {file = "rmcl-0.4.2.tar.gz", hash = "sha256:58de4758e7e3cb7acbf28fcfa80f4155252afdfb191beb4ba4aa36961f66cc67"},
-]
-rmfuse = []
-rmrl = [
-    {file = "rmrl-0.2.1-py3-none-any.whl", hash = "sha256:c35b9f20494a6034a16e916d7351575efb3e3f77acabe9094453a7f6013eaa86"},
-    {file = "rmrl-0.2.1.tar.gz", hash = "sha256:c532bef4168350e6ab17cf37c6481dc12b6a78e007c073503f082f36215b71c9"},
-]
-sniffio = [
-    {file = "sniffio-1.2.0-py3-none-any.whl", hash = "sha256:471b71698eac1c2112a40ce2752bb2f4a4814c22a54a3eed3676bc0f5ca9f663"},
-    {file = "sniffio-1.2.0.tar.gz", hash = "sha256:c4666eecec1d3f50960c6bdf61ab7bc350648da6c126e3cf6898d8cd4ddcd3de"},
-]
-sortedcontainers = [
-    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
-    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
-]
-svglib = [
-    {file = "svglib-1.3.0.tar.gz", hash = "sha256:a38998b95d1bb99564dc9dffaf15e4e9453761f2790d2dd4147a4ad5fbac1078"},
-]
-tinycss2 = [
-    {file = "tinycss2-1.1.1-py3-none-any.whl", hash = "sha256:fe794ceaadfe3cf3e686b22155d0da5780dd0e273471a51846d0a02bc204fec8"},
-    {file = "tinycss2-1.1.1.tar.gz", hash = "sha256:b2e44dd8883c360c35dd0d1b5aad0b610e5156c2cb3b33434634e539ead9d8bf"},
-]
-trio = [
-    {file = "trio-0.18.0-py3-none-any.whl", hash = "sha256:a42af0634ba729cbfe8578be058750c6471dac19fbc7167ec6a3ca3f966fb424"},
-    {file = "trio-0.18.0.tar.gz", hash = "sha256:87a66ae61f27fe500c9024926a9ba482c07e1e0f56380b70a264d19c435ba076"},
-]
-webencodings = [
-    {file = "webencodings-0.5.1-py2.py3-none-any.whl", hash = "sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78"},
-    {file = "webencodings-0.5.1.tar.gz", hash = "sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923"},
-]
-xdg = [
-    {file = "xdg-5.1.1-py3-none-any.whl", hash = "sha256:865a7b56ed1d4cd2fce2ead1eddf97360843619757f473cd90b75f1817ca541d"},
-    {file = "xdg-5.1.1.tar.gz", hash = "sha256:aa619f26ccec6088b2a6018721d4ee86e602099b24644a90a8d3308a25acd06c"},
-]
diff --git a/pkgs/tools/filesystems/rmfuse/pyproject.toml b/pkgs/tools/filesystems/rmfuse/pyproject.toml
deleted file mode 100644
index e3f1767b4cfa9..0000000000000
--- a/pkgs/tools/filesystems/rmfuse/pyproject.toml
+++ /dev/null
@@ -1,15 +0,0 @@
-[tool.poetry]
-name = "rmfuse-env"
-version = "0.1.0"
-description = ""
-authors = []
-
-[tool.poetry.dependencies]
-python = "^3.8"
-rmfuse = {git = "https://github.com/rschroll/rmfuse.git", extras = ["pyfuse3"]}
-
-[tool.poetry.dev-dependencies]
-
-[build-system]
-requires = ["poetry-core>=1.0.0"]
-build-backend = "poetry.core.masonry.api"
diff --git a/pkgs/tools/filesystems/rmfuse/update b/pkgs/tools/filesystems/rmfuse/update
deleted file mode 100755
index 77cfe9ff86d9c..0000000000000
--- a/pkgs/tools/filesystems/rmfuse/update
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p poetry poetry2nix.cli
-set -eu
-poetry lock
-poetry2nix lock
diff --git a/pkgs/tools/graphics/argyllcms/default.nix b/pkgs/tools/graphics/argyllcms/default.nix
index 2b17fa796e845..f060216935047 100644
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
 
       LINKFLAGS +=
         ${lib.concatStringsSep " " (map (x: "-L${x}/lib") buildInputs)}
-        -ldl -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
+        -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
         -ljpeg -ltiff -lpng -lssl ;
     '';
   in ''
diff --git a/pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch b/pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
deleted file mode 100644
index 13e18fd04476b..0000000000000
--- a/pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 53ce5fe7e73d7ed95c9e12b52dd4984723f865fa Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zdenko=20Podobn=C3=BD?= <zdenop@gmail.com>
-Date: Sun, 6 Apr 2014 21:25:27 +0200
-Subject: [PATCH] fix build with leptonica 1.70
-
----
- configure.ac |  1 +
- src/jbig2.cc | 13 +++++++++----
- 2 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index fe37c22..753a607 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -55,6 +55,7 @@ AC_CHECK_LIB([lept], [findFileFormatStream], [], [
-			echo "Error! Leptonica not detected."
-			exit -1
-			])
-+AC_CHECK_FUNCS(expandBinaryPower2Low,,)
- # test for function - it should detect leptonica dependecies
-
- # Check for possible dependancies of leptonica.
-diff --git a/src/jbig2.cc b/src/jbig2.cc
-index e10f042..515c1ef 100644
---- a/src/jbig2.cc
-+++ b/src/jbig2.cc
-@@ -130,11 +130,16 @@ segment_image(PIX *pixb, PIX *piximg) {
-   // input color image, so we have to do it this way...
-   // is there a better way?
-   // PIX *pixd = pixExpandBinary(pixd4, 4);
--  PIX *pixd = pixCreate(piximg->w, piximg->h, 1);
--  pixCopyResolution(pixd, piximg);
--  if (verbose) pixInfo(pixd, "mask image: ");
--  expandBinaryPower2Low(pixd->data, pixd->w, pixd->h, pixd->wpl,
-+  PIX *pixd;
-+#ifdef HAVE_EXPANDBINARYPOWER2LOW
-+    pixd = pixCreate(piximg->w, piximg->h, 1);
-+    pixCopyResolution(pixd, piximg);
-+    expandBinaryPower2Low(pixd->data, pixd->w, pixd->h, pixd->wpl,
-                         pixd4->data, pixd4->w, pixd4->h, pixd4->wpl, 4);
-+#else
-+    pixd = pixExpandBinaryPower2(pixd4, 4);
-+#endif
-+  if (verbose) pixInfo(pixd, "mask image: ");
-
-   pixDestroy(&pixd4);
-   pixDestroy(&pixsf4);
diff --git a/pkgs/tools/graphics/jbig2enc/default.nix b/pkgs/tools/graphics/jbig2enc/default.nix
deleted file mode 100644
index ea5008dcf5cba..0000000000000
--- a/pkgs/tools/graphics/jbig2enc/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, leptonica, zlib, libwebp, giflib, libjpeg, libpng, libtiff }:
-
-stdenv.mkDerivation rec {
-  pname = "jbig2enc";
-  version = "0.28";
-
-  src = fetchFromGitHub {
-    owner = "agl";
-    repo = "jbig2enc";
-    rev = "${version}-dist";
-    hash = "sha256-Y3IVTjvO5tqn/O076y/llnTyenKpbx1WyT/JFZ/s0VY=";
-  };
-
-  propagatedBuildInputs = [ leptonica zlib libwebp giflib libjpeg libpng libtiff ];
-
-  patches = [
-    # https://github.com/agl/jbig2enc/commit/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa
-    ./53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
-  ];
-
-  # This is necessary, because the resulting library has
-  # /tmp/nix-build-jbig2enc/src/.libs before /nix/store/jbig2enc/lib
-  # in its rpath, which means that patchelf --shrink-rpath removes
-  # the /nix/store one.  By cleaning up before fixup, we ensure that
-  # the /tmp/nix-build-jbig2enc/src/.libs directory is gone.
-  preFixup = ''
-    make clean
-  '';
-
-  meta = {
-    description = "Encoder for the JBIG2 image compression format";
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/tools/graphics/libyafaray/default.nix b/pkgs/tools/graphics/libyafaray/default.nix
index db48aa678cc55..22bbfddbcf5d4 100644
--- a/pkgs/tools/graphics/libyafaray/default.nix
+++ b/pkgs/tools/graphics/libyafaray/default.nix
@@ -26,6 +26,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-UVBA1vXOuLg4RT+BdF4rhbZ6I9ySeZX0N81gh3MH84I=";
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i \
+      include/geometry/poly_double.h include/noise/noise_generator.h # gcc12
+  '';
+
   preConfigure = ''
     NIX_CFLAGS_COMPILE+=" -isystem ${ilmbase.dev}/include/OpenEXR"
   '';
diff --git a/pkgs/tools/graphics/pikchr/default.nix b/pkgs/tools/graphics/pikchr/default.nix
index aed3d485c4ad2..d750d243fc36c 100644
--- a/pkgs/tools/graphics/pikchr/default.nix
+++ b/pkgs/tools/graphics/pikchr/default.nix
@@ -1,6 +1,9 @@
 { lib
 , stdenv
 , fetchfossil
+, tcl
+
+, enableTcl ? true
 }:
 
 stdenv.mkDerivation {
@@ -19,14 +22,27 @@ stdenv.mkDerivation {
     substituteInPlace Makefile --replace open "test -f"
   '';
 
+  nativeBuildInputs = lib.optional enableTcl tcl.tclPackageHook;
+
+  buildInputs = lib.optional enableTcl tcl;
+
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
+  buildFlags = [ "pikchr" ] ++ lib.optional enableTcl "piktcl";
+
   installPhase = ''
+    runHook preInstall
     install -Dm755 pikchr $out/bin/pikchr
     install -Dm755 pikchr.out $out/lib/pikchr.o
     install -Dm644 pikchr.h $out/include/pikchr.h
+  '' + lib.optionalString enableTcl ''
+    cp -r piktcl $out/lib/piktcl
+  '' + ''
+    runHook postInstall
   '';
 
+  dontWrapTclBinaries = true;
+
   doCheck = true;
   checkTarget = "test";
 
diff --git a/pkgs/tools/graphics/wgpu-utils/default.nix b/pkgs/tools/graphics/wgpu-utils/default.nix
index 745640bfa228b..ce445ce6a00fd 100644
--- a/pkgs/tools/graphics/wgpu-utils/default.nix
+++ b/pkgs/tools/graphics/wgpu-utils/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wgpu-utils";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "gfx-rs";
     repo = "wgpu";
     rev = "v${version}";
-    hash = "sha256-Yfq85stS1FWahrwv+8hEFSAGr2eZHJ+/cuNYfIFRi3c=";
+    hash = "sha256-MdomiE/qHpyVFlgH5wGsFDiXIp6p1wHXsAtmlo/XfEg=";
   };
 
-  cargoHash = "sha256-R8x3QfVWyEyz7o9Jzh+XgQKYF8HZMAPwbq847j2LfqY=";
+  cargoHash = "sha256-83iQ/YcItRsTfp73xi5LZF8AyvyAXJCHuNWXgc1wHkM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/misc/boxxy/default.nix b/pkgs/tools/misc/boxxy/default.nix
new file mode 100644
index 0000000000000..faadff736577f
--- /dev/null
+++ b/pkgs/tools/misc/boxxy/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "boxxy";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "queer";
+    repo = "boxxy";
+    rev = "v${version}";
+    hash = "sha256-mvSarA0rZuOQvgf2NJXWIWoeZtvb+D/GofAHPKQDH6U=";
+  };
+
+  cargoHash = "sha256-Psc9qErqi3aangNowXxhkEXphFCR7pp+DKTKtk6tMo0=";
+
+  meta = with lib; {
+    description = "Puts bad Linux applications in a box with only their files";
+    homepage = "https://github.com/queer/boxxy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index 5ebbbe1e118b4..5850fada2a70f 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , libmnl
 , pkg-config
 , writeScript
@@ -8,13 +9,23 @@
 
 stdenv.mkDerivation rec {
   pname = "ethtool";
-  version = "6.0";
+  version = "6.1";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-1URsk95XDOaPOx6mnb+hL8/Wf8GYl/ZV0/GCMeK4GNY=";
+    sha256 = "sha256-xB/Igf+lpAQy0t2CnrRMZKSd7kgucWuqz5Jixk2qj5A=";
   };
 
+  patches = [
+    # Patch that fixes build with musl libc
+    # NOTE remove on next release, since it is applied in upstream
+    (fetchpatch {
+      name = "Fix-build-with-musl-libc.patch";
+      url = "https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/patch/marvell.c?id=41be533331fc3c6b711dbe532405782d3b8be5d1";
+      sha256 = "sha256-CItvt/eeNJkr1sOzaaHZhAnaybDutL9cT2O6XwQll+M=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 03be0c8b3be38..806d1bc24bdc1 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "file";
-  version = "5.43";
+  version = "5.44";
 
   src = fetchurl {
     urls = [
       "https://astron.com/pub/file/${pname}-${version}.tar.gz"
       "https://distfiles.macports.org/file/${pname}-${version}.tar.gz"
     ];
-    sha256 = "sha256-jIAV6Rrg6NAyHZTHgjmJLvnbxwxK3gAIwOlYlKv7GZE=";
+    sha256 = "sha256-N1HH+6jbyDHLjXzIr/IQNUWbjOUVXviwiAon0ChHXzs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 65c88eac4e880..c3a0c5aa906d4 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -48,16 +48,6 @@ stdenv.mkDerivation rec {
     substituteInPlace src/util/genfsimg --replace "	syslinux " "	true "
   ''; # calling syslinux on a FAT image isn't going to work
 
-  # Workaround '-idirafter' ordering bug in staging-next:
-  #   https://github.com/NixOS/nixpkgs/pull/210004
-  # where libc '-idirafter' gets added after user's idirafter and
-  # breaks.
-  # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-  preConfigure = ''
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] buildPackages.stdenv.hostPlatform.config}=$(< ${buildPackages.stdenv.cc}/nix-support/libc-cflags)
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"]               stdenv.hostPlatform.config}=$(<               ${stdenv.cc}/nix-support/libc-cflags)
-  '';
-
   # not possible due to assembler code
   hardeningDisable = [ "pic" "stackprotector" ];
 
diff --git a/pkgs/tools/misc/lockfile-progs/default.nix b/pkgs/tools/misc/lockfile-progs/default.nix
index e245a05182dad..8fdee47befbf7 100644
--- a/pkgs/tools/misc/lockfile-progs/default.nix
+++ b/pkgs/tools/misc/lockfile-progs/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ liblockfile ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-overflow"
+  ];
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin $out/man/man1
diff --git a/pkgs/tools/misc/mpdscribble/default.nix b/pkgs/tools/misc/mpdscribble/default.nix
index dc446d3f0a199..46bf31ed667ed 100644
--- a/pkgs/tools/misc/mpdscribble/default.nix
+++ b/pkgs/tools/misc/mpdscribble/default.nix
@@ -28,6 +28,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3wLfQvbwx+OFrCl5vMV7Zps4e4iEYFhqPiVCo5hDqgw=";
   })];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i src/Log.cxx # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config meson ninja ];
   buildInputs = [
     libmpdclient
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index 7ef202202c19e..6d9ff83d75ff2 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.18.4";
+  version = "0.18.5";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-sCnKnBxZuueH8XgXPqCLrJvS4zUbraz3mZr/2Xn+7YU=";
+    sha256 = "sha256-Y/Nn2jAkz135HxRNpeotoPRvyexG9QgtvIcTdXsj034=";
   };
 
   vendorHash = "sha256-W30f7QYgm+QyLDJICpjMn7mtUIziTR1igThEbv+Aa7M=";
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index 12c411f3ef438..267272b0b664a 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -13,18 +13,14 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/src";
 
-  # Workaround '-idirafter' ordering bug in staging-next:
-  #   https://github.com/NixOS/nixpkgs/pull/210004
-  # where libc '-idirafter' gets added after user's idirafter and
-  # breaks.
-  # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-  preConfigure = ''
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] stdenv.hostPlatform.config}=$(< ${stdenv.cc}/nix-support/libc-cflags)
-  '';
-
   buildInputs = [ libbfd zlib libiberty ];
   makeFlags = [ "wimboot.x86_64.efi" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   installPhase = ''
     mkdir -p $out/share/wimboot/
     cp wimboot.x86_64.efi $out/share/wimboot
diff --git a/pkgs/tools/misc/yafetch/default.nix b/pkgs/tools/misc/yafetch/default.nix
index f55926d0ae39a..4ebaea963c29e 100644
--- a/pkgs/tools/misc/yafetch/default.nix
+++ b/pkgs/tools/misc/yafetch/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./config.h --replace \
       "#include \"ascii/gnu.h\"" "#include \"ascii/nixos.h\""
+
+    sed '1i#include <array>' -i config.h # gcc12
   '';
 
   # Fixes installation path
diff --git a/pkgs/tools/networking/dsniff/default.nix b/pkgs/tools/networking/dsniff/default.nix
index 8e641ec83e73e..5d0c92f2bfb58 100644
--- a/pkgs/tools/networking/dsniff/default.nix
+++ b/pkgs/tools/networking/dsniff/default.nix
@@ -60,7 +60,7 @@ in gcc9Stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook rpcsvc-proto ];
   buildInputs = [ glib pcap libtirpc libnsl ];
-  NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ldl -ltirpc";
+  NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ltirpc";
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
   postPatch = ''
     for patch in debian/patches/*.patch; do
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 4d6c54564bb27..030de9840fe30 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.46.1";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/itziNmIDIuj3sKpB+SEiiwvJqdH5nmTkpFdMSY5L0g=";
+    sha256 = "sha256-S2qccDzS+Kj1tEAUR4a0G/4Eu3DAF7lY7ffxU6aykVU=";
   };
 
-  vendorHash = "sha256-dU9rhYgYgP1qTPR3ykUgyg+B1bBVJwizWooyCpdpnm0=";
+  vendorHash = "sha256-ffkXNE3LkgdCGfO6K9lGxEMxT/9Q1o0m3BMtu6tDHdk=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/grpc_cli/default.nix b/pkgs/tools/networking/grpc_cli/default.nix
new file mode 100644
index 0000000000000..b68ff100b70bb
--- /dev/null
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, automake, cmake, autoconf, curl, numactl }:
+
+stdenv.mkDerivation rec {
+  pname = "grpc_cli";
+  version = "1.46.6";
+  src = fetchFromGitHub {
+    owner = "grpc";
+    repo = "grpc";
+    rev = "v${version}";
+    hash = "sha256-UPenQh6+FBryQiOoeijsXkCZjlMzYljkg2aUtSFJFL4=";
+    fetchSubmodules = true;
+  };
+  nativeBuildInputs = [ automake cmake autoconf ];
+  buildInputs = [ curl numactl ];
+  cmakeFlags = [ "-DgRPC_BUILD_TESTS=ON" ];
+  makeFlags = [ "grpc_cli" ];
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 grpc_cli "$out/bin/grpc_cli"
+
+    runHook postInstall
+  '';
+  meta = with lib; {
+    description = "The command line tool for interacting with grpc services.";
+    homepage = "https://github.com/grpc/grpc";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ doriath ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/networking/ip2unix/default.nix b/pkgs/tools/networking/ip2unix/default.nix
index c4c03cae3a7f2..fabbbb40e7a70 100644
--- a/pkgs/tools/networking/ip2unix/default.nix
+++ b/pkgs/tools/networking/ip2unix/default.nix
@@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "1pl8ayadxb0zzh5s26yschkjhr1xffbzzv347m88f9y0jv34d24r";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i src/dynports/dynports.cc # gcc12
+  '';
+
   nativeBuildInputs = [
     meson ninja pkg-config asciidoc libxslt.bin docbook_xml_dtd_45 docbook_xsl
     libxml2.bin docbook5 python3Packages.pytest python3Packages.pytest-timeout
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index be50397bf1d0a..4238391fdaea0 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -53,6 +53,14 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lcrypt";
 
+  # This can probably be removed if version > 2.4.9, as IPX support
+  # has been removed upstream[1].  Just check whether pkgsMusl.ppp
+  # still builds.
+  #
+  # [1]: https://github.com/ppp-project/ppp/commit/c2881a6b71a36d28a89166e82820dc5e711fd775
+  NIX_CFLAGS_COMPILE =
+    lib.optionalString stdenv.hostPlatform.isMusl "-UIPX_CHANGE";
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
diff --git a/pkgs/tools/networking/snowflake/default.nix b/pkgs/tools/networking/snowflake/default.nix
index 999d30bd92933..908166bb15422 100644
--- a/pkgs/tools/networking/snowflake/default.nix
+++ b/pkgs/tools/networking/snowflake/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "snowflake";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "anti-censorship/pluggable-transports";
     repo = "snowflake";
     rev = "v${version}";
-    sha256 = "sha256-7iwRbik3hUj6Zv3tqLKqhGUIag6OnWRhpWqW6NTI+FU=";
+    sha256 = "sha256-r2NRIb6qbA1B5HlVNRqa9ongQpyiyPskhembPHX3Lgc=";
   };
 
-  vendorHash = "sha256-wHLYVf8QurMbmdLNkTFGgmncOJlJHZF8PwYTUniXOGY=";
+  vendorHash = "sha256-dnfm4KiVD89bnHV7bfw5aXWHGdcH9JBdrtvuS6s8N5w=";
 
   meta = with lib; {
     description = "System to defeat internet censorship";
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 73ccdb43fef86..9ccf68aa54370 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tcpdump";
-  version = "4.99.1";
+  version = "4.99.3";
 
   src = fetchurl {
-    url = "http://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ebNphfsnAxRmGNh8Ss3j4Gi5HFU/uT8CGjN/F1/RDr4=";
+    url = "http://www.tcpdump.org/release/tcpdump-${version}.tar.gz";
+    sha256 = "sha256-rXWm7T3A2XMpRbLlSDy0Hci0tSihaTFeSZxoYZUuc7M=";
   };
 
   postPatch = ''
@@ -17,9 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libpcap ];
 
-  configureFlags = lib.optional
-    (stdenv.hostPlatform != stdenv.buildPlatform)
-    "ac_cv_linux_vers=2";
+  configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "ac_cv_linux_vers=2";
 
   meta = with lib; {
     description = "Network sniffer";
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 3d67bbb079322..bf2587d8c6589 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
     "SD_NOTIFY=1"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   installFlags = [
     "sysconfdir=${placeholder "out"}/etc"
   ];
diff --git a/pkgs/tools/networking/uqmi/default.nix b/pkgs/tools/networking/uqmi/default.nix
index 17a55d86b9a37..067bc51854ada 100644
--- a/pkgs/tools/networking/uqmi/default.nix
+++ b/pkgs/tools/networking/uqmi/default.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ libubox json_c ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=dangling-pointer"
+  ];
+
   meta = with lib; {
     description = "Tiny QMI command line utility";
     homepage = "https://git.openwrt.org/?p=project/uqmi.git;a=summary";
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index e59715e61f383..f250d6de13f20 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -20,16 +20,16 @@ let
 in
 buildGoModule rec {
   pname = "xray";
-  version = "1.7.2";
+  version = "1.7.5";
 
   src = fetchFromGitHub {
     owner = "XTLS";
     repo = "Xray-core";
     rev = "v${version}";
-    sha256 = "sha256-jwCvo6+YXC471VqGWzcrnrLWOSJW2tBKa5SoynQg0Lo=";
+    sha256 = "sha256-WCku/7eczcsGiIuTy0sSQKUKXlH14TpdVg2/ZPdaiHQ=";
   };
 
-  vendorSha256 = "sha256-P2g0MqlBScm6yTnpvL5T6l9ntsb4tK9k3Civ7rTevrE=";
+  vendorSha256 = "sha256-2P7fI7fUnShsAl95mPiJgtr/eobt+DMmaoxZcox0eu8=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index 2d028a0e631e4..5dc3859de56f5 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.25.0";
+  version = "2.25.1";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Mu0/mWkdrhaybI0iAB/MuD7UTbDDC73ZMxr8kU7R23I=";
+    sha256 = "sha256-J5vAvF22NKMvvaftfVugWYAP6uM6pcyKEPqRDf+J9A4=";
   };
 
-  vendorHash = "sha256-YDV816jTLAqbSjiKXvbkwPbPCLPplH+NFN1SCVjWcbk=";
+  vendorHash = "sha256-GaESwr7rvDvjQ7zi/LbndiB2lQGmIELTx7wAJitj5kw=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/package-management/repro-get/default.nix b/pkgs/tools/package-management/repro-get/default.nix
index 18eb021d3efb1..42b000658c886 100644
--- a/pkgs/tools/package-management/repro-get/default.nix
+++ b/pkgs/tools/package-management/repro-get/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "repro-get";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "reproducible-containers";
     repo = "repro-get";
     rev = "v${version}";
-    sha256 = "sha256-3cvKHwAyPYwR5VlhpPJH+3BK9Kw7dTGOPN1q2RnwsG0=";
+    sha256 = "sha256-2B4jNP58t+cfeHi5pICtB9+NwujRzkhl1d/cPkWlNrk=";
   };
 
-  vendorSha256 = "sha256-ebvtPc0QiP7fNiWYjd7iLG/4iH4DqWV/eaDHvmV/H3Y=";
+  vendorHash = "sha256-GM8sKIZb2G9dBj2RoRO80hQrv8D+hHYo0O9FbBuK780=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix
index c25db9e2d3987..7817329f06de8 100644
--- a/pkgs/tools/security/aflplusplus/default.nix
+++ b/pkgs/tools/security/aflplusplus/default.nix
@@ -51,6 +51,11 @@ let
         --replace '"clang++"' '"clang++-UNSUPPORTED"'
     '';
 
+    NIX_CFLAGS_COMPILE = [
+      # Needed with GCC 12
+      "-Wno-error=use-after-free"
+    ];
+
     makeFlags = [ "PREFIX=$(out)" ];
     buildPhase = ''
       common="$makeFlags -j$NIX_BUILD_CORES"
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index edb10f384bdf7..b897fe6187101 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -40,6 +40,11 @@ python3.pkgs.buildPythonApplication rec {
     mkdir -p $CHIPSEC_BUILD_LIB/chipsec/helper/linux
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=dangling-pointer"
+  ];
+
   preInstall = lib.optionalString withDriver ''
     mkdir -p $out/${python3.pkgs.python.sitePackages}/drivers/linux
     mv $CHIPSEC_BUILD_LIB/chipsec/helper/linux/chipsec.ko \
diff --git a/pkgs/tools/security/erosmb/default.nix b/pkgs/tools/security/erosmb/default.nix
index 90165b6581648..b7984feac5136 100644
--- a/pkgs/tools/security/erosmb/default.nix
+++ b/pkgs/tools/security/erosmb/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "erosmb";
-  version = "0.1.4";
+  version = "0.1.5";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "viktor02";
     repo = "EroSmb";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ThJwBKpxoTwHP84OlVKH62gQ3kfv83J8HNs5Mizi8Ck=";
+    hash = "sha256-9Zs5Z+3JiBiJkV9Ixl5pPmLv0dUT59CT0UkQDsmneWc=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/24.nix
index 0f56c4a8c15b7..c1f2825e8e93c 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -12,11 +12,11 @@ assert guiSupport -> enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.3.7";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-7hY6X7nsmf/BsY5l+u+NCGgAxXE9FaZyq1fTeZ2oNmk=";
+    sha256 = "sha256-HXkVjdAdmSQx3S4/rLif2slxJ/iXhOosthDGAPsMFIM=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -30,19 +30,13 @@ stdenv.mkDerivation rec {
   patches = [
     ./fix-libusb-include-path.patch
     ./tests-add-test-cases-for-import-without-uid.patch
-    ./allow-import-of-previously-known-keys-even-without-UI.patch
+    # TODO: Refresh patch? Doesn't apply on 2.4.0
+    #./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
 
     # Patch for DoS vuln from https://seclists.org/oss-sec/2022/q3/27
     ./v3-0001-Disallow-compressed-signatures-and-certificates.patch
 
-    # Fix regression when using YubiKey devices as smart cards.
-    # See https://dev.gnupg.org/T6070 for details.
-    # Committed upstream, remove this patch when updating to the next release.
-    (fetchpatch {
-      url = "https://dev.gnupg.org/rGf34b9147eb3070bce80d53febaa564164cd6c977?diff=1";
-      sha256 = "sha256-J/PLSz8yiEgtGv+r3BTGTHrikV70AbbHQPo9xbjaHFE=";
-    })
   ];
   postPatch = ''
     sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 88f39e8a63e45..98ac2254fb6ea 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -29,7 +29,11 @@ stdenv.mkDerivation rec {
     "iasl"
   ];
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  NIX_CFLAGS_COMPILE = [
+    "-O3"
+    # Needed with GCC 12
+    "-Wno-dangling-pointer"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/system/ddrescue/default.nix b/pkgs/tools/system/ddrescue/default.nix
index 829d249da5b04..d18225a93b9bc 100644
--- a/pkgs/tools/system/ddrescue/default.nix
+++ b/pkgs/tools/system/ddrescue/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ddrescue";
-  version = "1.26";
+  version = "1.27";
 
   src = fetchurl {
     url = "mirror://gnu/ddrescue/ddrescue-${version}.tar.lz";
-    sha256 = "sha256-5RPNOpDZgQ392RGX1AqkD23wFZe/tez9+yBd4RJ8VR8=";
+    sha256 = "sha256-OMgMmMWkTxXlNmPkUQCX/WjW7CB1jv3zqSUDfBgyMus=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index de4acffa63e4d..0e746b0d07a44 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i lib/src/facts/glib/load_average_resolver.cc # gcc12
+  '';
+
   CXXFLAGS = lib.optionalString stdenv.cc.isGNU "-fpermissive -Wno-error=catch-value";
   NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lblkid";
 
diff --git a/pkgs/tools/system/kanata/default.nix b/pkgs/tools/system/kanata/default.nix
index 2ef4d13c366b5..d9b1bc06b2059 100644
--- a/pkgs/tools/system/kanata/default.nix
+++ b/pkgs/tools/system/kanata/default.nix
@@ -1,4 +1,5 @@
 { fetchFromGitHub
+, fetchpatch
 , lib
 , rustPlatform
 , withCmd ? false
@@ -6,16 +7,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kanata";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "jtroo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/v3P5C0F/FVPJqJ38dzSnAc7ua2fOs3BeX9BDoQ8bDw=";
+    sha256 = "sha256-mQSbsJ+3mKoDMg0ewwR7UvXUq+5WA9aTPKWCaTz8nDE=";
   };
 
-  cargoHash = "sha256-KXsW0fgbBy0tf/He0vH9Xq8yGuz77H/jeIabgw3ppy8=";
+  cargoHash = "sha256-Pu96OGfnXNaIse/IcwFJWxGMlKOVhZ6DtvgXJkHh+Ao=";
+
+  cargoPatches = [
+    (fetchpatch {
+      name = "serialize-cfg-parsing-tests-for-1.2.0.patch";
+      url = "https://github.com/jtroo/kanata/commit/9ef1e80fbcb40402262e08bd9196d000f73f686d.patch";
+      hash = "sha256-/FhyaYx4usDjGoVfRktf9dtwjY4oXdMQKqxLz00/NPY=";
+    })
+  ];
 
   buildFeatures = lib.optional withCmd "cmd";
 
diff --git a/pkgs/tools/system/rocm-smi/default.nix b/pkgs/tools/system/rocm-smi/default.nix
index 47542d25370d1..d7e23a9acb017 100644
--- a/pkgs/tools/system/rocm-smi/default.nix
+++ b/pkgs/tools/system/rocm-smi/default.nix
@@ -17,6 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-nkidiDNNU6MGhne9EbYClkODJZw/zZu3LWzlniJKyJE=";
   };
 
+  postPatch = ''
+    sed '1i#include <cstring>' -i src/rocm_smi{,_gpu_metrics}.cc # since gcc12 probably
+  '';
+
   nativeBuildInputs = [ cmake wrapPython ];
 
   patches = [ ./cmake.patch ];
diff --git a/pkgs/tools/text/dos2unix/default.nix b/pkgs/tools/text/dos2unix/default.nix
index 6a0c5fc57ee93..c6c92b876ffad 100644
--- a/pkgs/tools/text/dos2unix/default.nix
+++ b/pkgs/tools/text/dos2unix/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dos2unix";
-  version = "7.4.3";
+  version = "7.4.4";
 
   src = fetchurl {
     url = "https://waterlan.home.xs4all.nl/dos2unix/${pname}-${version}.tar.gz";
-    sha256 = "sha256-to20GVba+TOChCOqMFEOAMEtKe9ZFucV6NTmlP5mynI=";
+    sha256 = "sha256-KKhB2wvVgn1kXKup2AFeOnGYPcbjmAcLUofuE3rkQ24=";
   };
 
   nativeBuildInputs = [ perl gettext ];
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index a38251557c090..215f7e7d25b83 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -5,6 +5,7 @@
 , autoreconfHook
 , pkg-config
 , texinfo
+, bison
 , bash
 }:
 
@@ -51,7 +52,9 @@ stdenv.mkDerivation rec {
   '';
 
   strictDeps = true;
-  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
+  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ]
+    # Required due to the patch that changes .ypp files.
+    ++ lib.optional (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "9") bison;
   buildInputs = [ perl bash ]
     ++ lib.optionals enableGhostscript [ ghostscript ]
     ++ lib.optionals enableHtml [ psutils netpbm ];
diff --git a/pkgs/tools/text/justify/default.nix b/pkgs/tools/text/justify/default.nix
index 1e18e22db8e25..86de7365663e1 100644
--- a/pkgs/tools/text/justify/default.nix
+++ b/pkgs/tools/text/justify/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-406OhJt2Ila/LIhfqJXhbFqFxJJiRyMVI4/VK8Y43kc=";
   };
 
+  postPatch = ''
+    sed '1i#include <algorithm>' -i src/stringHelper.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   installPhase = ''
diff --git a/pkgs/tools/text/qgrep/default.nix b/pkgs/tools/text/qgrep/default.nix
index 032e9474128ae..4145ec656d20b 100644
--- a/pkgs/tools/text/qgrep/default.nix
+++ b/pkgs/tools/text/qgrep/default.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices CoreFoundation ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=mismatched-new-delete"
+  ];
+
   postPatch = lib.optionalString stdenv.isAarch64 ''
     substituteInPlace Makefile \
       --replace "-msse2" "" --replace "-DUSE_SSE2" ""
diff --git a/pkgs/tools/text/tab/default.nix b/pkgs/tools/text/tab/default.nix
index 0802f7b983612..0ddd7509c9f1e 100644
--- a/pkgs/tools/text/tab/default.nix
+++ b/pkgs/tools/text/tab/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AhgWeV/ojB8jM16A5ggrOD1YjWfRVcoQbkd3S2bgdyE=";
   };
 
+  # gcc12; see https://github.com/ivan-tkatchev/tab/commit/673bdac998
+  postPatch = ''
+    sed '1i#include <cstring>' -i deps.h
+  '';
+
   nativeCheckInputs = [ python3 ];
 
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e21c14874964a..e37d309a21460 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -380,6 +380,7 @@ mapAliases ({
   docker_compose = throw "'docker_compose' has been renamed to/replaced by 'docker-compose'"; # Converted to throw 2022-02-22
   docker-compose_2 = throw "'docker-compose_2' has been renamed to 'docker-compose'"; # Added 2022-06-05
   docker-edge = throw "'docker-edge' has been removed, it was an alias for 'docker'"; # Added 2022-06-05
+  dolphin-emu-beta = dolphin-emu; # Added 2023-02-11
   dolphinEmu = dolphin-emu; # Added 2021-11-10
   dolphinEmuMaster = dolphin-emu-beta; # Added 2021-11-10
   dot-http = throw "'dot-http' has been removed: abandoned by upstream. Use hurl instead."; # Added 2023-01-16
@@ -806,6 +807,7 @@ mapAliases ({
   libpulseaudio-vanilla = libpulseaudio; # Added 2022-04-20
   libqmatrixclient = throw "libqmatrixclient was renamed to libquotient"; # Added 2020-04-09
   libqrencode = throw "'libqrencode' has been renamed to/replaced by 'qrencode'"; # Converted to throw 2022-02-22
+  libraw_unstable = throw "'libraw_unstable' has been removed, please use libraw"; # Added 2023-01-30
   librdf = lrdf; # Added 2020-03-22
   librecad2 = throw "'librecad2' has been renamed to/replaced by 'librecad'"; # Converted to throw 2022-02-22
   libressl_3_2 = throw "'libressl_3_2' has reached end-of-life "; # Added 2022-03-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 725f0e1f2422b..0ee84cd2bbd16 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1252,7 +1252,6 @@ with pkgs;
 
   arc_unpacker = callPackage ../tools/archivers/arc_unpacker {
     boost = boost16x; # checkPhase fails with Boost 1.77
-    stdenv = gcc10StdenvCompat;
   };
 
   adminer = callPackage ../servers/adminer { };
@@ -1912,7 +1911,7 @@ with pkgs;
   git-town = callPackage ../applications/version-management/git-town { };
 
   git-trim = callPackage ../applications/version-management/git-trim {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk_11_0.frameworks) IOKit CoreFoundation;
   };
 
   git-up = callPackage ../applications/version-management/git-up {
@@ -2279,9 +2278,7 @@ with pkgs;
 
   ### APPLICATIONS/EMULATORS/DOLPHIN-EMU
 
-  dolphin-emu = callPackage ../applications/emulators/dolphin-emu { };
-
-  dolphin-emu-beta = qt6Packages.callPackage ../applications/emulators/dolphin-emu/master.nix {
+  dolphin-emu = qt6Packages.callPackage ../applications/emulators/dolphin-emu {
     inherit (darwin.apple_sdk_11_0.frameworks) CoreBluetooth ForceFeedback IOKit OpenGL VideoToolbox;
     inherit (darwin) moltenvk;
     stdenv =
@@ -2550,7 +2547,7 @@ with pkgs;
 
   writefreely = callPackage ../applications/misc/writefreely { };
 
-  iqueue = callPackage ../development/libraries/iqueue { stdenv = gcc10StdenvCompat; };
+  iqueue = callPackage ../development/libraries/iqueue { };
 
   lifecycled = callPackage ../tools/misc/lifecycled { };
 
@@ -2859,6 +2856,8 @@ with pkgs;
 
   boxes = callPackage ../tools/text/boxes { };
 
+  boxxy = callPackage ../tools/misc/boxxy { };
+
   boundary = callPackage ../tools/networking/boundary { };
 
   chamber = callPackage ../tools/admin/chamber {  };
@@ -4922,11 +4921,11 @@ with pkgs;
   };
 
   hyprland = callPackage ../applications/window-managers/hyprwm/hyprland {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   hyprpaper = callPackage ../applications/window-managers/hyprwm/hyprpaper {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   hysteria = callPackage ../tools/networking/hysteria { };
@@ -5146,7 +5145,9 @@ with pkgs;
 
   merriweather-sans = callPackage ../data/fonts/merriweather-sans { };
 
-  meson = callPackage ../development/tools/build-managers/meson { };
+  meson = callPackage ../development/tools/build-managers/meson {
+    inherit (darwin.apple_sdk.frameworks) Foundation OpenGL AppKit Cocoa;
+  };
 
   # while building documentation meson may want to run binaries for host
   # which needs an emulator
@@ -7730,6 +7731,8 @@ with pkgs;
 
   gnucap = callPackage ../applications/science/electronics/gnucap { };
 
+  gnu-cim = callPackage ../development/compilers/gnu-cim { };
+
   gnu-cobol = callPackage ../development/compilers/gnu-cobol { };
 
   gnuclad = callPackage ../applications/graphics/gnuclad { };
@@ -7747,11 +7750,11 @@ with pkgs;
   gnupg1orig = callPackage ../tools/security/gnupg/1.nix { };
   gnupg1compat = callPackage ../tools/security/gnupg/1compat.nix { };
   gnupg1 = gnupg1compat;    # use config.packageOverrides if you prefer original gnupg1
-  gnupg23 = callPackage ../tools/security/gnupg/23.nix {
+  gnupg24 = callPackage ../tools/security/gnupg/24.nix {
     guiSupport = stdenv.isDarwin;
     pinentry = if stdenv.isDarwin then pinentry_mac else pinentry-gtk2;
   };
-  gnupg = gnupg23;
+  gnupg = gnupg24;
 
   gnupg-pkcs11-scd = callPackage ../tools/security/gnupg-pkcs11-scd { };
 
@@ -7938,6 +7941,8 @@ with pkgs;
 
   grpcurl = callPackage ../tools/networking/grpcurl { };
 
+  grpc_cli = callPackage ../tools/networking/grpc_cli { };
+
   grpc-gateway = callPackage ../development/tools/grpc-gateway { };
 
   grpcui = callPackage ../tools/networking/grpcui { };
@@ -9780,7 +9785,13 @@ with pkgs;
     pythonPackages = python3Packages;
   };
 
-  mirakurun = callPackage ../applications/video/mirakurun { };
+  mirakurun = callPackage ../applications/video/mirakurun {
+    yarn = yarn.override { nodejs = nodejs-16_x; };
+    inherit (callPackage ../development/tools/yarn2nix-moretea/yarn2nix {
+      nodejs = nodejs-16_x;
+      yarn = yarn.override { nodejs = nodejs-16_x; };
+    }) mkYarnPackage;
+  };
 
   miredo = callPackage ../tools/networking/miredo { };
 
@@ -10792,8 +10803,6 @@ with pkgs;
 
   pdf-quench = callPackage ../applications/misc/pdf-quench { };
 
-  jbig2enc = callPackage ../tools/graphics/jbig2enc { };
-
   pdfarranger = callPackage ../applications/misc/pdfarranger { };
 
   briss = callPackage ../tools/graphics/briss { };
@@ -14312,7 +14321,7 @@ with pkgs;
       num =
         if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
         else if (stdenv.targetPlatform.isAarch64 && stdenv.isLinux) then 9
-        else 11;
+        else 12;
       numS = toString num;
     in {
       gcc = pkgs.${"gcc${numS}"};
@@ -14350,7 +14359,8 @@ with pkgs;
   gcc11Stdenv = overrideCC gccStdenv buildPackages.gcc11;
   gcc12Stdenv = overrideCC gccStdenv buildPackages.gcc12;
 
-  gcc10StdenvCompat = if stdenv.cc.isGNU && lib.versions.major stdenv.cc.version == "11" then gcc10Stdenv else stdenv;
+  # Meant for packages that fail with newer than gcc10.
+  gcc10StdenvCompat = if stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11" then gcc10Stdenv else stdenv;
 
   # This is not intended for use in nixpkgs but for providing a faster-running
   # compiler to nixpkgs users by building gcc with reproducibility-breaking
@@ -15005,11 +15015,10 @@ with pkgs;
     recurseIntoAttrs (callPackage ../development/compilers/graalvm/community-edition {
       inherit (darwin.apple_sdk.frameworks) Foundation;
     });
+  graalvm-ce = graalvm11-ce;
   graalvm11-ce = graalvmCEPackages.graalvm11-ce;
   graalvm17-ce = graalvmCEPackages.graalvm17-ce;
-  buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image {
-    graalvm = graalvm11-ce;
-  };
+  buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image { };
 
   openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt { };
 
@@ -15278,7 +15287,7 @@ with pkgs;
   mitama-cpp-result = callPackage ../development/libraries/mitama-cpp-result { };
 
   mitscheme = callPackage ../development/compilers/mit-scheme
-    { stdenv = gcc10StdenvCompat; texLive = texlive.combine { inherit (texlive) scheme-small epsf texinfo; }; };
+    { texLive = texlive.combine { inherit (texlive) scheme-small epsf texinfo; }; };
 
   mitschemeX11 = mitscheme.override {
     enableX11 = true;
@@ -15658,13 +15667,13 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_66 = callPackage ../development/compilers/rust/1_66.nix {
+  rust_1_67 = callPackage ../development/compilers/rust/1_67.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
-    llvm_14 = llvmPackages_14.libllvm;
+    llvm_15 = llvmPackages_15.libllvm;
     # https://github.com/NixOS/nixpkgs/issues/201254
     stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;
   };
-  rust = rust_1_66;
+  rust = rust_1_67;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -15673,8 +15682,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_66 = rust_1_66.packages.stable;
-  rustPackages = rustPackages_1_66;
+  rustPackages_1_67 = rust_1_67.packages.stable;
+  rustPackages = rustPackages_1_67;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -17203,13 +17212,9 @@ with pkgs;
     libc = preLibcCrossHeaders;
   };
 
-  libbfd = callPackage ../development/tools/misc/binutils/libbfd.nix {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  libbfd = callPackage ../development/tools/misc/binutils/libbfd.nix { };
 
-  libopcodes = callPackage ../development/tools/misc/binutils/libopcodes.nix {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  libopcodes = callPackage ../development/tools/misc/binutils/libopcodes.nix { };
 
   # Held back 2.38 release. Remove once all dependencies are ported to 2.39.
   binutils-unwrapped_2_38 = callPackage ../development/tools/misc/binutils/2.38 {
@@ -17541,6 +17546,7 @@ with pkgs;
 
   libgcc = callPackage ../development/libraries/gcc/libgcc {
     stdenvNoLibs = gccStdenvNoLibs; # cannot be built with clang it seems
+    gcc = gcc11; # fails to build with gcc12
   };
 
   # This is for e.g. LLVM libraries on linux.
@@ -19285,7 +19291,7 @@ with pkgs;
 
   cog = callPackage ../development/web/cog { };
 
-  cosmoc = callPackage ../development/tools/cosmoc { };
+  cosmocc = callPackage ../development/tools/cosmocc { };
 
   cosmopolitan = callPackage ../development/libraries/cosmopolitan { };
 
@@ -19560,30 +19566,28 @@ with pkgs;
 
   linbox = callPackage ../development/libraries/linbox { };
 
-  ffmpeg_4-headless = callPackage ../development/libraries/ffmpeg/4.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
-
-    sdlSupport = false;
-    vdpauSupport = false;
-    pulseaudioSupport = false;
-    libva = libva-minimal;
-  };
-
   ffmpeg_4 = callPackage ../development/libraries/ffmpeg/4.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
+    inherit (darwin.apple_sdk.frameworks)
+      Cocoa CoreServices CoreAudio CoreMedia AVFoundation MediaToolbox
+      VideoDecodeAcceleration VideoToolbox;
   };
-
-  ffmpeg_5-headless = callPackage ../development/libraries/ffmpeg/5.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
-
-    sdlSupport = false;
-    vdpauSupport = false;
-    pulseaudioSupport = false;
-    libva = libva-minimal;
+  ffmpeg_4-headless = ffmpeg_4.override {
+    ffmpegVariant = "headless";
+  };
+  ffmpeg_4-full = ffmpeg.override {
+    ffmpegVariant = "full";
   };
 
   ffmpeg_5 = callPackage ../development/libraries/ffmpeg/5.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
+    inherit (darwin.apple_sdk.frameworks)
+      Cocoa CoreServices CoreAudio CoreMedia AVFoundation MediaToolbox
+      VideoDecodeAcceleration VideoToolbox;
+  };
+  ffmpeg_5-headless = ffmpeg_5.override {
+    ffmpegVariant = "headless";
+  };
+  ffmpeg_5-full = ffmpeg_5.override {
+    ffmpegVariant = "full";
   };
 
   # Aliases
@@ -19592,26 +19596,8 @@ with pkgs;
   # Packages which use ffmpeg as a library, should pin to the relevant major
   # version number which the upstream support.
   ffmpeg = ffmpeg_4;
-
   ffmpeg-headless = ffmpeg_4-headless;
-
-  ffmpeg-full = callPackage ../development/libraries/ffmpeg-full {
-    svt-av1 = if stdenv.isAarch64 then null else svt-av1;
-    rtmpdump = null; # Prefer the built-in RTMP implementation
-    # The following need to be fixed on Darwin
-    libjack2 = if stdenv.isDarwin then null else libjack2;
-    libmodplug = if stdenv.isDarwin then null else libmodplug;
-    libmfx = if stdenv.isDarwin then null else intel-media-sdk;
-    libpulseaudio = if stdenv.isDarwin then null else libpulseaudio;
-    samba = if stdenv.isDarwin then null else samba;
-    inherit (darwin.apple_sdk.frameworks)
-      Cocoa CoreServices CoreAudio AVFoundation MediaToolbox
-      VideoDecodeAcceleration VideoToolbox;
-  };
-
-  ffmpeg_5-full = ffmpeg-full.override {
-    ffmpeg = ffmpeg_5;
-  };
+  ffmpeg-full = ffmpeg_4-full;
 
   ffmpegthumbnailer = callPackage ../development/libraries/ffmpegthumbnailer { };
 
@@ -19674,7 +19660,6 @@ with pkgs;
 
   freeimage = callPackage ../development/libraries/freeimage {
     inherit (darwin) autoSignDarwinBinariesHook;
-    libraw = libraw_unstable;
   };
 
   freetts = callPackage ../development/libraries/freetts {
@@ -20523,6 +20508,8 @@ with pkgs;
 
   jbig2dec = callPackage ../development/libraries/jbig2dec { };
 
+  jbig2enc = callPackage ../development/libraries/jbig2enc { };
+
   jcal = callPackage ../development/libraries/jcal { };
 
   jbigkit = callPackage ../development/libraries/jbigkit { };
@@ -20624,7 +20611,7 @@ with pkgs;
   lmdbxx = callPackage ../development/libraries/lmdbxx { };
 
   lemon-graph = callPackage ../development/libraries/lemon-graph {
-    stdenv = if stdenv.isLinux then gcc11Stdenv else stdenv;
+    stdenv = if stdenv.isLinux then gcc12Stdenv else stdenv;
   };
 
   levmar = callPackage ../development/libraries/levmar { };
@@ -23635,7 +23622,10 @@ with pkgs;
 
   vte = callPackage ../development/libraries/vte {
     # Needs GCC ≥10 but aarch64 defaults to GCC 9.
-    stdenv = clangStdenv;
+    stdenv =
+      if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU
+      then clangStdenv
+      else stdenv;
   };
 
   vte-gtk4 = vte.override {
@@ -25840,7 +25830,7 @@ with pkgs;
   };
 
   btop = callPackage ../tools/system/btop {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   nmon = callPackage ../os-specific/linux/nmon { };
@@ -26109,7 +26099,6 @@ with pkgs;
   };
 
   libraw = callPackage ../development/libraries/libraw { };
-  libraw_unstable = callPackage ../development/libraries/libraw/unstable.nix { };
 
   libraw1394 = callPackage ../development/libraries/libraw1394 { };
 
@@ -26443,7 +26432,7 @@ with pkgs;
 
   pipework = callPackage ../os-specific/linux/pipework { };
 
-  pktgen = callPackage ../os-specific/linux/pktgen { stdenv = gcc10StdenvCompat; };
+  pktgen = callPackage ../os-specific/linux/pktgen { };
 
   plymouth = callPackage ../os-specific/linux/plymouth { };
 
@@ -26619,7 +26608,7 @@ with pkgs;
     # break some cyclic dependencies
     util-linux = util-linuxMinimal;
     # provide a super minimal gnupg used for systemd-machined
-    gnupg = callPackage ../tools/security/gnupg/23.nix {
+    gnupg = gnupg.override {
       enableMinimal = true;
       guiSupport = false;
     };
@@ -32110,9 +32099,7 @@ with pkgs;
 
   pavucontrol = callPackage ../applications/audio/pavucontrol { };
 
-  paraview = libsForQt5.callPackage ../applications/graphics/paraview {
-    python3 = python39;
-  };
+  paraview = libsForQt5.callPackage ../applications/graphics/paraview { };
 
   parlatype = callPackage ../applications/audio/parlatype { };
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index b067f5cbbc1e6..f9aa50a01d717 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -182,9 +182,12 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   inherit (pkgs.callPackages ../os-specific/darwin/xcode { })
     xcode_8_1 xcode_8_2
-    xcode_9_1 xcode_9_2 xcode_9_4 xcode_9_4_1
-    xcode_10_2 xcode_10_2_1 xcode_10_3
-    xcode_11
+    xcode_9_1 xcode_9_2 xcode_9_3 xcode_9_4 xcode_9_4_1
+    xcode_10_1 xcode_10_2 xcode_10_2_1 xcode_10_3
+    xcode_11 xcode_11_1 xcode_11_2 xcode_11_3_1 xcode_11_4 xcode_11_5 xcode_11_6 xcode_11_7
+    xcode_12 xcode_12_0_1 xcode_12_1 xcode_12_2 xcode_12_3 xcode_12_4 xcode_12_5 xcode_12_5_1
+    xcode_13 xcode_13_1 xcode_13_2 xcode_13_3 xcode_13_3_1 xcode_13_4 xcode_13_4_1
+    xcode_14 xcode_14_1
     xcode;
 
   CoreSymbolication = callPackage ../os-specific/darwin/CoreSymbolication { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 04da6d141ee98..542d8414f9121 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -156,6 +156,7 @@ mapAliases ({
   pycallgraph = throw "pycallgraph has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-01-18
   pychef = throw "pychef has been removed because it's been archived upstream and abandoned since 2017."; # added 2022-11-14
   pycryptodome-test-vectors = throw "pycryptodome-test-vectors has been removed because it is an internal package to pycryptodome"; # added 2022-05-28
+  pyflunearyou = pyoutbreaksnearme; # added 2023-02-11
   pyialarmxr = pyialarmxr-homeassistant; # added 2022-06-07
   pyialarmxr-homeassistant = throw "The package was removed together with the component support in home-assistant 2022.7.0"; # added 2022-07-07
   PyICU = pyicu; # Added 2022-12-22
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3710c88a2f6a0..beec1b459dc7e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -853,6 +853,8 @@ self: super: with self; {
 
   awslambdaric = callPackage ../development/python-modules/awslambdaric { };
 
+  awswrangler = callPackage ../development/python-modules/awswrangler { };
+
   axis = callPackage ../development/python-modules/axis { };
 
   azure-appconfiguration = callPackage ../development/python-modules/azure-appconfiguration { };
@@ -4336,6 +4338,10 @@ self: super: with self; {
 
   hiro = callPackage ../development/python-modules/hiro { };
 
+  hist = callPackage ../development/python-modules/hist { };
+
+  histoprint = callPackage ../development/python-modules/histoprint { };
+
   hiyapyco = callPackage ../development/python-modules/hiyapyco { };
 
   hjson = callPackage ../development/python-modules/hjson { };
@@ -5458,8 +5464,6 @@ self: super: with self; {
 
   lightgbm = callPackage ../development/python-modules/lightgbm { };
 
-  lightning = callPackage ../development/python-modules/lightning { };
-
   lightning-utilities  = callPackage ../development/python-modules/lightning-utilities { };
 
   lightparam = callPackage ../development/python-modules/lightparam { };
@@ -6192,6 +6196,8 @@ self: super: with self; {
 
   myst-parser = callPackage ../development/python-modules/myst-parser { };
 
+  n3fit = callPackage ../development/python-modules/n3fit { };
+
   nad-receiver = callPackage ../development/python-modules/nad-receiver { };
 
   nagiosplugin = callPackage ../development/python-modules/nagiosplugin { };
@@ -7267,6 +7273,8 @@ self: super: with self; {
 
   pyorthanc = callPackage ../development/python-modules/pyorthanc { };
 
+  pyoutbreaksnearme = callPackage ../development/python-modules/pyoutbreaksnearme { };
+
   pyoverkiz = callPackage ../development/python-modules/pyoverkiz { };
 
   pyownet = callPackage ../development/python-modules/pyownet { };
@@ -8059,8 +8067,6 @@ self: super: with self; {
 
   pyflume = callPackage ../development/python-modules/pyflume { };
 
-  pyflunearyou = callPackage ../development/python-modules/pyflunearyou { };
-
   pyfma = callPackage ../development/python-modules/pyfma { };
 
   pyfribidi = callPackage ../development/python-modules/pyfribidi { };
@@ -9853,6 +9859,8 @@ self: super: with self; {
 
   rapidfuzz-capi = callPackage ../development/python-modules/rapidfuzz-capi { };
 
+  rapt-ble = callPackage ../development/python-modules/rapt-ble { };
+
   rarfile = callPackage ../development/python-modules/rarfile {
     inherit (pkgs) libarchive;
   };
@@ -9943,6 +9951,8 @@ self: super: with self; {
 
   remote-pdb = callPackage ../development/python-modules/remote-pdb { };
 
+  remotezip = callPackage ../development/python-modules/remotezip { };
+
   renault-api = callPackage ../development/python-modules/renault-api { };
 
   rencode = callPackage ../development/python-modules/rencode { };
@@ -11897,6 +11907,8 @@ self: super: with self; {
     inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices;
   };
 
+  uhi = callPackage ../development/python-modules/uhi { };
+
   ujson = callPackage ../development/python-modules/ujson { };
 
   ukkonen = callPackage ../development/python-modules/ukkonen { };
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 83a90a2a5e6d9..a79dc31ed9dd9 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -83,6 +83,8 @@ with self; with super; {
     doCheck = false;  # circular dependency with pytest
   });
 
+  wheel = callPackage ../development/python2-modules/wheel { };
+
   zeek = disabled super.zeek;
 
   zipp = callPackage ../development/python2-modules/zipp { };