Merge #216499: staging-next 2023-02-15

2023-02-26 10:11:50 +01:00 · 2023-02-26 10:11:50 +01:00 · 30e272bc04
commit 30e272bc04
parent 5d1eee6cf0 1af0d67ebe
186 changed files with 1851 additions and 1131 deletions
--- a/doc/builders/special.xml
+++ b/doc/builders/special.xml
@ -6,6 +6,7 @@
  This chapter describes several special builders.
 </para>
 <xi:include href="special/fhs-environments.section.xml" />
+ <xi:include href="special/makesetuphook.section.xml" />
 <xi:include href="special/mkshell.section.xml" />
 <xi:include href="special/darwin-builder.section.xml" />
 </chapter>
--- a/doc/builders/special/makesetuphook.section.md
+++ b/doc/builders/special/makesetuphook.section.md
@ -0,0 +1,37 @@
+# pkgs.makeSetupHook {#sec-pkgs.makeSetupHook}
+
+`pkgs.makeSetupHook` is a builder that produces hooks that go in to `nativeBuildInputs`
+
+## Usage {#sec-pkgs.makeSetupHook-usage}
+
+```nix
+pkgs.makeSetupHook {
+  name = "something-hook";
+  propagatedBuildInputs = [ pkgs.commandsomething ];
+  depsTargetTargetPropagated = [ pkgs.libsomething ];
+} ./script.sh
+```
+
+#### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash
+
+```nix
+pkgs.makeSetupHook {
+    name = "run-hello-hook";
+    propagatedBuildInputs = [ pkgs.hello ];
+    substitutions = { shell = "${pkgs.bash}/bin/bash"; };
+    passthru.tests.greeting = callPackage ./test { };
+    meta.platforms = lib.platforms.linux;
+} (writeScript "run-hello-hook.sh" ''
+    #!@shell@
+    hello
+'')
+```
+
+## Attributes
+
+* `name` Set the name of the hook.
+* `propagatedBuildInputs` Runtime dependencies (such as binaries) of the hook.
+* `depsTargetTargetPropagated` Non-binary dependencies.
+* `meta`
+* `passthru`
+* `substitutions` Variables for `substituteAll`
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@ -213,7 +213,14 @@ rec {
            outputSpecified = true;
            drvPath = assert condition; drv.${outputName}.drvPath;
            outPath = assert condition; drv.${outputName}.outPath;
-          };
+          } //
+            # TODO: give the derivation control over the outputs.
+            #       `overrideAttrs` may not be the only attribute that needs
+            #       updating when switching outputs.
+            lib.optionalAttrs (passthru?overrideAttrs) {
+              # TODO: also add overrideAttrs when overrideAttrs is not custom, e.g. when not splicing.
+              overrideAttrs = f: (passthru.overrideAttrs f).${outputName};
+            };
        };

      outputsList = map outputToAttrListElement outputs;
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -259,6 +259,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.

+- `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
+
 - [Xastir](https://xastir.org/index.php/Main_Page) can now access AX.25 interfaces via the `libax25` package.

 - `tvbrowser-bin` was removed, and now `tvbrowser` is built from source.
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json
@ -0,0 +1,38 @@
+{
+  "context.properties": {},
+  "context.modules": [
+    {
+      "name": "libpipewire-module-rt",
+      "args": {
+        "nice.level": -11
+      },
+      "flags": [
+        "ifexists",
+        "nofail"
+      ]
+    },
+    {
+      "name": "libpipewire-module-protocol-native"
+    },
+    {
+      "name": "libpipewire-module-client-node"
+    },
+    {
+      "name": "libpipewire-module-adapter"
+    },
+    {
+      "name": "libpipewire-module-rtp-source",
+      "args": {
+        "sap.ip": "239.255.255.255",
+        "sap.port": 9875,
+        "sess.latency.msec": 10,
+        "local.ifname": "eth0",
+        "stream.props": {
+          "media.class": "Audio/Source",
+          "node.virtual": false,
+          "device.api": "aes67"
+        }
+      }
+    }
+  ]
+}
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
@ -3,10 +3,10 @@
    "link.max-buffers": 16,
    "core.daemon": true,
    "core.name": "pipewire-0",
-    "default.clock.min-quantum": 16,
    "vm.overrides": {
      "default.clock.min-quantum": 1024
-    }
+    },
+    "module.x11.bell": true
  },
  "context.spa-libs": {
    "audio.convert.*": "audioconvert/libspa-audioconvert",
@ -77,6 +77,11 @@
      "flags": [
        "ifexists",
        "nofail"
+      ],
+      "condition": [
+        {
+          "module.x11.bell": true
+        }
      ]
    }
  ],
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.0609";
+  version = "9.0.1275";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-UBj3pXY6rdekKnCX/V/4o8LLBMZkNs1U4Z4KuvisIYQ=";
+    hash = "sha256-WDnlYi9o2Kv/f3Fh1MHcfTlBTe1fxw4UyKJlKY04fyA=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@ -363,7 +363,7 @@ rec {
  vimGenDocHook = callPackage ({ vim }:
    makeSetupHook {
      name = "vim-gen-doc-hook";
-      deps = [ vim ];
+      propagatedBuildInputs = [ vim ];
      substitutions = {
        vimBinary = "${vim}/bin/vim";
        inherit rtpPath;
@ -373,7 +373,7 @@ rec {
  vimCommandCheckHook = callPackage ({ neovim-unwrapped }:
    makeSetupHook {
      name = "vim-command-check-hook";
-      deps = [ neovim-unwrapped ];
+      propagatedBuildInputs = [ neovim-unwrapped ];
      substitutions = {
        vimBinary = "${neovim-unwrapped}/bin/nvim";
        inherit rtpPath;
@ -383,7 +383,7 @@ rec {
  neovimRequireCheckHook = callPackage ({ neovim-unwrapped }:
    makeSetupHook {
      name = "neovim-require-check-hook";
-      deps = [ neovim-unwrapped ];
+      propagatedBuildInputs = [ neovim-unwrapped ];
      substitutions = {
        nvimBinary = "${neovim-unwrapped}/bin/nvim";
        inherit rtpPath;
--- a/pkgs/applications/misc/genxword/default.nix
+++ b/pkgs/applications/misc/genxword/default.nix
@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
  ];

  buildInputs = [
-    gobject-introspection
    pango
    gtksourceview3
  ];
--- a/pkgs/applications/misc/udiskie/default.nix
+++ b/pkgs/applications/misc/udiskie/default.nix
@ -43,7 +43,6 @@ python3.pkgs.buildPythonApplication rec {
  dontWrapGApps = true;

  buildInputs = [
-    gobject-introspection
    gtk3
    libappindicator-gtk3
    libnotify
--- a/pkgs/applications/office/autokey/default.nix
+++ b/pkgs/applications/office/autokey/default.nix
@ -25,7 +25,6 @@ python3Packages.buildPythonApplication rec {
  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];

  buildInputs = [
-    gobject-introspection
    gtksourceview3
    libappindicator-gtk3
    libnotify
--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@ -33,7 +33,6 @@ python3.pkgs.buildPythonApplication rec {

  buildInputs = [
    gtk3
-    gobject-introspection # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
    keybinder3
    libnotify
    python3
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.39.1";
+  version = "2.39.2";
  svn = subversionClient.override { perlBindings = perlSupport; };
  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-QKOKCEezDDcbNYc7OvzxI4hd1B6j7Lv1EO+pfzzlwWE=";
+    sha256 = "R1918Tc7LNTkOHBhhRdZZtXBH2jE2x5IwmJXxD3c8tY=";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
@ -20,7 +20,7 @@ in
  dotnetConfigureHook = callPackage ({ }:
    makeSetupHook {
      name = "dotnet-configure-hook";
-      deps = [ dotnet-sdk nuget-source ];
+      propagatedBuildInputs = [ dotnet-sdk nuget-source ];
      substitutions = {
        nugetSource = nuget-source;
        inherit runtimeId;
@ -30,7 +30,7 @@ in
  dotnetBuildHook = callPackage ({ }:
    makeSetupHook {
      name = "dotnet-build-hook";
-      deps = [ dotnet-sdk ];
+      propagatedBuildInputs = [ dotnet-sdk ];
      substitutions = {
        inherit buildType runtimeId;
      };
@ -39,7 +39,7 @@ in
  dotnetCheckHook = callPackage ({ }:
    makeSetupHook {
      name = "dotnet-check-hook";
-      deps = [ dotnet-test-sdk ];
+      propagatedBuildInputs = [ dotnet-test-sdk ];
      substitutions = {
        inherit buildType libraryPath;
        disabledTests = lib.optionalString (disabledTests != [])
@ -54,7 +54,7 @@ in
  dotnetInstallHook = callPackage ({ }:
    makeSetupHook {
      name = "dotnet-install-hook";
-      deps = [ dotnet-sdk ];
+      propagatedBuildInputs = [ dotnet-sdk ];
      substitutions = {
        inherit buildType runtimeId;
      };
@ -63,7 +63,7 @@ in
  dotnetFixupHook = callPackage ({ }:
    makeSetupHook {
      name = "dotnet-fixup-hook";
-      deps = [ dotnet-runtime ];
+      propagatedBuildInputs = [ dotnet-runtime ];
      substitutions = {
        dotnetRuntime = dotnet-runtime;
        runtimeDeps = libraryPath;
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@ -193,6 +193,12 @@ let
      ''}
    '' + ''

+      # currently pie is only enabled by default in pkgsMusl
+      # this will respect the `hardening{Disable,Enable}` flags if set
+      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+        export GOFLAGS="-buildmode=pie $GOFLAGS"
+      fi
+
      runHook postConfigure
    '';

--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@ -134,6 +134,12 @@ let
      export GOPATH=$NIX_BUILD_TOP/go:$GOPATH
      export GOCACHE=$TMPDIR/go-cache

+      # currently pie is only enabled by default in pkgsMusl
+      # this will respect the `hardening{Disable,Enable}` flags if set
+      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+        export GOFLAGS="-buildmode=pie $GOFLAGS"
+      fi
+
      runHook postConfigure
    '';

--- a/pkgs/build-support/node/build-npm-package/hooks/default.nix
+++ b/pkgs/build-support/node/build-npm-package/hooks/default.nix
@ -26,7 +26,7 @@
  npmInstallHook = makeSetupHook
    {
      name = "npm-install-hook";
-      deps = [ buildPackages.makeWrapper ];
+      propagatedBuildInputs = [ buildPackages.makeWrapper ];
      substitutions = {
        hostNode = "${nodejs}/bin/node";
        jq = "${buildPackages.jq}/bin/jq";
--- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@ -61,14 +61,15 @@ cargoSetupPostPatchHook() {
      fi

      echo
-      echo "ERROR: cargoSha256 is out of date"
+      echo "ERROR: cargoHash or cargoSha256 is out of date"
      echo
      echo "Cargo.lock is not the same in $cargoDepsCopy"
      echo
      echo "To fix the issue:"
-      echo '1. Use "0000000000000000000000000000000000000000000000000000" as the cargoSha256 value'
-      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
-      echo "3. Copy the 'got: sha256:' value back into the cargoSha256 field"
+      echo '1. Set cargoHash/cargoSha256 to an empty string: `cargoHash = "";`'
+      echo '2. Build the derivation and wait for it to fail with a hash mismatch'
+      echo '3. Copy the "got: sha256-..." value back into the cargoHash field'
+      echo '   You should have: cargoHash = "sha256-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=";'
      echo

      exit 1
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@ -31,7 +31,7 @@ in {
  cargoBuildHook = callPackage ({ }:
    makeSetupHook {
      name = "cargo-build-hook.sh";
-      deps = [ cargo ];
+      propagatedBuildInputs = [ cargo ];
      substitutions = {
        inherit ccForBuild ccForHost cxxForBuild cxxForHost
          rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
@ -41,7 +41,7 @@ in {
  cargoCheckHook = callPackage ({ }:
    makeSetupHook {
      name = "cargo-check-hook.sh";
-      deps = [ cargo ];
+      propagatedBuildInputs = [ cargo ];
      substitutions = {
        inherit rustTargetPlatformSpec;
      };
@ -50,7 +50,7 @@ in {
  cargoInstallHook = callPackage ({ }:
    makeSetupHook {
      name = "cargo-install-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
      substitutions = {
        inherit shortTarget;
      };
@ -59,7 +59,7 @@ in {
  cargoNextestHook = callPackage ({ }:
    makeSetupHook {
      name = "cargo-nextest-hook.sh";
-      deps = [ cargo cargo-nextest ];
+      propagatedBuildInputs = [ cargo cargo-nextest ];
      substitutions = {
        inherit rustTargetPlatformSpec;
      };
@ -68,7 +68,7 @@ in {
  cargoSetupHook = callPackage ({ }:
    makeSetupHook {
      name = "cargo-setup-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
      substitutions = {
        defaultConfig = ../fetchcargo-default-config.toml;

@ -117,7 +117,7 @@ in {
  maturinBuildHook = callPackage ({ }:
    makeSetupHook {
      name = "maturin-build-hook.sh";
-      deps = [ cargo maturin rustc ];
+      propagatedBuildInputs = [ cargo maturin rustc ];
      substitutions = {
        inherit ccForBuild ccForHost cxxForBuild cxxForHost
          rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@ -11,8 +11,7 @@

 makeSetupHook {
  name = "make-binary-wrapper-hook";
-
-  deps = [ dieHook ]
+  propagatedBuildInputs = [ dieHook ]
    # https://github.com/NixOS/nixpkgs/issues/148189
    ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;

--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@ -9,12 +9,15 @@
 , dconf
 , callPackage
 , wrapGAppsHook
-, writeTextFile
+, targetPackages
 }:

 makeSetupHook {
  name = "wrap-gapps-hook";
-  deps = lib.optionals (!stdenv.isDarwin) [
+  propagatedBuildInputs = [
+    # We use the wrapProgram function.
+    makeWrapper
+  ] ++ lib.optionals (!stdenv.isDarwin) [
    # It is highly probable that a program will use GSettings,
    # at minimum through GTK file chooser dialogue.
    # Let’s add a GIO module for “dconf” GSettings backend
@ -23,19 +26,22 @@ makeSetupHook {
    # Unfortunately, it also requires the user to have dconf
    # D-Bus service enabled globally (e.g. through a NixOS module).
    dconf.lib
+
  ] ++ lib.optionals isGraphical [
    # TODO: remove this, packages should depend on GTK explicitly.
    gtk3

+    librsvg
+  ];
+
+  # depsTargetTargetPropagated will essentially be buildInputs when wrapGAppsHook is placed into nativeBuildInputs
+  # the librsvg above should be removed but kept to not break anything that implicitly depended on its binaries
+  depsTargetTargetPropagated = assert (lib.assertMsg (!targetPackages ? raw) "wrapGAppsHook must be in nativeBuildInputs"); lib.optionals isGraphical [
    # librsvg provides a module for gdk-pixbuf to allow rendering
    # SVG icons. Most icon themes are SVG-based and so are some
    # graphics in GTK (e.g. cross for closing window in window title bar)
    # so it is pretty much required for applications using GTK.
    librsvg
-  ] ++ [
-
-    # We use the wrapProgram function.
-    makeWrapper
  ];
  passthru = {
    tests = let
@ -65,6 +71,15 @@ makeSetupHook {
        ''
      );

+      basic-contains-gdk-pixbuf = let
+        tested = basic;
+      in testLib.runTest "basic-contains-gdk-pixbuf" (
+        testLib.skip stdenv.isDarwin ''
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GDK_PIXBUF_MODULE_FILE" "${lib.getLib librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"}
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GDK_PIXBUF_MODULE_FILE" "${lib.getLib librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"}
+        ''
+      );
+
      # Simple derivation containing a gobject-introspection typelib.
      typelib-Mahjong = stdenv.mkDerivation {
        name = "typelib-Mahjong";
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
@ -1,7 +1,7 @@
 { lib, runCommand }:

 rec {
-  runTest = name: body: runCommand name { } ''
+  runTest = name: body: runCommand name { strictDeps = true; } ''
    set -o errexit
    ${body}
    touch $out
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -593,45 +593,28 @@ rec {
    in linkFarm name (map mkEntryFromDrv drvs);


-  /*
-    Make a package that just contains a setup hook with the given contents.
-    This setup hook will be invoked by any package that includes this package
-    as a buildInput. Optionally takes a list of substitutions that should be
-    applied to the resulting script.
-
-    Examples:
-    # setup hook that depends on the hello package and runs ./myscript.sh
-    myhellohook = makeSetupHook { deps = [ hello ]; } ./myscript.sh;
-
-    # writes a Linux-exclusive setup hook where @bash@ myscript.sh is substituted for the
-    # bash interpreter.
-    myhellohookSub = makeSetupHook {
-                   name = "myscript-hook";
-                   deps = [ hello ];
-                   substitutions = { bash = "${pkgs.bash}/bin/bash"; };
-                   meta.platforms = lib.platforms.linux;
-                 } ./myscript.sh;
-
-    # setup hook with a package test
-    myhellohookTested = makeSetupHook {
-                   name = "myscript-hook";
-                   deps = [ hello ];
-                   substitutions = { bash = "${pkgs.bash}/bin/bash"; };
-                   meta.platforms = lib.platforms.linux;
-                   passthru.tests.greeting = callPackage ./test { };
-                 } ./myscript.sh;
-   */
+  # docs in doc/builders/special/makesetuphook.section.md
  makeSetupHook =
    { name ? lib.warn "calling makeSetupHook without passing a name is deprecated." "hook"
-    , deps ? []
-    , substitutions ? {}
-    , meta ? {}
-    , passthru ? {}
+    , deps ? [ ]
+      # hooks go in nativeBuildInput so these will be nativeBuildInput
+    , propagatedBuildInputs ? [ ]
+      # these will be buildInputs
+    , depsTargetTargetPropagated ? [ ]
+    , meta ? { }
+    , passthru ? { }
+    , substitutions ? { }
    }:
    script:
    runCommand name
      (substitutions // {
        inherit meta;
+        inherit depsTargetTargetPropagated;
+        propagatedBuildInputs =
+          # remove list conditionals before 23.11
+          lib.warnIf (!lib.isList deps) "'deps' argument to makeSetupHook must be a list. content of deps: ${toString deps}"
+            (lib.warnIf (deps != [ ]) "'deps' argument to makeSetupHook is deprecated and will be removed in release 23.11., Please use propagatedBuildInputs instead. content of deps: ${toString deps}"
+              propagatedBuildInputs ++ (if lib.isList deps then deps else [ deps ]));
        strictDeps = true;
        # TODO 2023-01, no backport: simplify to inherit passthru;
        passthru = passthru
@ -642,8 +625,7 @@ rec {
      (''
        mkdir -p $out/nix-support
        cp ${script} $out/nix-support/setup-hook
-      '' + lib.optionalString (deps != []) ''
-        printWords ${toString deps} > $out/nix-support/propagated-build-inputs
+        recordPropagatedDependencies
      '' + lib.optionalString (substitutions != {}) ''
        substituteAll ${script} $out/nix-support/setup-hook
      '');
--- a/pkgs/development/compilers/chez-racket/default.nix
+++ b/pkgs/development/compilers/chez-racket/default.nix
@ -1,16 +1,23 @@
 { stdenv, buildPackages, callPackage }:

 let
-  chezSystemMap = {
-    # See `/workarea` of source code for list of systems
-    "aarch64-darwin" = "tarm64osx";
-    "aarch64-linux" = "tarm64le";
-    "armv7l-linux" = "tarm32le";
-    "x86_64-darwin" = "ta6osx";
-    "x86_64-linux" = "ta6le";
-  };
+  chezArch =
+    /**/ if stdenv.hostPlatform.isAarch then "arm${toString stdenv.hostPlatform.parsed.cpu.bits}"
+    else if stdenv.hostPlatform.isx86_32 then "i3"
+    else if stdenv.hostPlatform.isx86_64 then "a6"
+    else if stdenv.hostPlatform.isPower then "ppc${toString stdenv.hostPlatform.parsed.cpu.bits}"
+    else throw "Add ${stdenv.hostPlatform.parsed.cpu.arch} to chezArch to enable building chez-racket";
+
+  chezOs =
+    /**/ if stdenv.hostPlatform.isDarwin then "osx"
+    else if stdenv.hostPlatform.isFreeBSD then "fb"
+    else if stdenv.hostPlatform.isLinux then "le"
+    else if stdenv.hostPlatform.isNetBSD then "nb"
+    else if stdenv.hostPlatform.isOpenBSD then "ob"
+    else throw "Add ${stdenv.hostPlatform.uname.system} to chezOs to enable building chez-racket";
+
  inherit (stdenv.hostPlatform) system;
-  chezSystem = chezSystemMap.${system} or (throw "Add ${system} to chezSystemMap to enable building chez-racket");
+  chezSystem = "t${chezArch}${chezOs}";
  # Chez Scheme uses an ad-hoc `configure`, hence we don't use the usual
  # stdenv abstractions.
  forBoot = {
--- a/pkgs/development/compilers/chez-racket/shared.nix
+++ b/pkgs/development/compilers/chez-racket/shared.nix
@ -24,8 +24,7 @@ stdenv.mkDerivation (args // {
  '';

  nativeBuildInputs = lib.optionals stdenv.isDarwin (with darwin; [ cctools autoSignDarwinBinariesHook ]);
-  buildInputs = [ ncurses libX11 zlib lz4 ]
-    ++ lib.optional stdenv.isDarwin libiconv;
+  buildInputs = [ libiconv libX11 lz4 ncurses zlib ];

  enableParallelBuilding = true;

--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "glslang";
-  version = "1.3.236.0";
+  version = "1.3.239.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "glslang";
    rev = "sdk-${version}";
-    hash = "sha256-iVcx1j7OMJEU4cPydNwQSFufTUiqq7GKp69Y6pEt7Wc=";
+    hash = "sha256-P2HG/oJXdB5nvU3zVnj2vSLJGQuDcZiQBfBBvuR66Kk=";
  };

  # These get set at all-packages, keep onto them for child drvs
@ -33,6 +33,14 @@ stdenv.mkDerivation rec {
      url = "https://github.com/KhronosGroup/glslang/commit/7627bd89583c5aafb8b38c81c15494019271fabf.patch";
      hash = "sha256-1Dwhn78PG4gAGgEwTXpC+mkZRyvy8sTIsEvihXFeNaQ=";
    })
+    # Upstream tries to detect the Darwin linker by checking for AppleClang, but it’s just Clang in nixpkgs.
+    # Revert the commit to allow the build to work on Darwin with the nixpkg Darwin Clang toolchain.
+    (fetchpatch {
+      name = "Fix-Darwin-linker-error.patch";
+      url = "https://github.com/KhronosGroup/glslang/commit/586baa35a47b3aa6ad3fa829a27f0f4206400668.patch";
+      hash = "sha256-paAl4E8GzogcxDEzn/XuhNH6XObp+i7WfArqAiuH4Mk=";
+      revert = true;
+    })
  ];

  postPatch = ''
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.19.5";
+  version = "1.19.6";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-jkhujoWigfxc4/C+3FudLb9idtfbCyXT7ANPMT2gN18=";
+    hash = "sha256-1/ABP4Lm1/hizGy1yM20ju9fLiObNbqpfi8adGYEN2c=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@ -4,15 +4,15 @@
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

 let
  major = "11";
  minor = "0";
-  update = "17";
-  build = "8";
+  update = "18";
+  build = "10";

  openjdk = stdenv.mkDerivation rec {
    pname = "openjdk" + lib.optionalString headless "-headless";
@ -22,7 +22,7 @@ let
      owner = "openjdk";
      repo = "jdk${major}u";
      rev = "jdk-${version}";
-      sha256 = "sha256-kvgLYqQZPqyuigVyzbDHc3TMff0clvzM8IdzYLYcxPU=";
+      sha256 = "sha256-QGOpMIrWwOtIcUY/CLbTRDvcVTG2xioZu46v+n+IIQ4=";
    };

    nativeBuildInputs = [ pkg-config autoconf unzip ];
--- a/pkgs/development/compilers/openjdk/12.nix
+++ b/pkgs/development/compilers/openjdk/12.nix
@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11, fetchpatch
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

--- a/pkgs/development/compilers/openjdk/13.nix
+++ b/pkgs/development/compilers/openjdk/13.nix
@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk13-bootstrap, fetchpatch
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

--- a/pkgs/development/compilers/openjdk/14.nix
+++ b/pkgs/development/compilers/openjdk/14.nix
@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk14-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

--- a/pkgs/development/compilers/openjdk/15.nix
+++ b/pkgs/development/compilers/openjdk/15.nix
@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk15-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

--- a/pkgs/development/compilers/openjdk/16.nix
+++ b/pkgs/development/compilers/openjdk/16.nix
@ -4,7 +4,7 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk16-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@ -4,15 +4,15 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk17-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

 let
  version = {
    feature = "17";
-    interim = ".0.5";
-    build = "8";
+    interim = ".0.6";
+    build = "10";
  };

  openjdk = stdenv.mkDerivation {
@ -23,7 +23,7 @@ let
      owner = "openjdk";
      repo = "jdk${version.feature}u";
      rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      sha256 = "sha256-2k1Mm36ds6MZheZVsLvXkoqQG4zYeIRWzbP1aZ72Vqs=";
+      sha256 = "sha256-zPpINi++3Ct0PCwlwlfhceh/ploMkclw+MgeI9dULdc=";
    };

    nativeBuildInputs = [ pkg-config autoconf unzip ];
--- a/pkgs/development/compilers/openjdk/18.nix
+++ b/pkgs/development/compilers/openjdk/18.nix
@ -4,7 +4,7 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk18-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

--- a/pkgs/development/compilers/openjdk/19.nix
+++ b/pkgs/development/compilers/openjdk/19.nix
@ -7,15 +7,15 @@
 # TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
 # which should be fixable, this is a no-rebuild workaround for GHC.
 , headless ? stdenv.targetPlatform.isGhcjs
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:

 let
  version = {
    feature = "19";
-    interim = ".0.1";
-    build = "10";
+    interim = ".0.2";
+    build = "7";
  };

  openjdk = stdenv.mkDerivation {
@ -26,7 +26,7 @@ let
      owner = "openjdk";
      repo = "jdk${version.feature}u";
      rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      hash = "sha256-IS6ABnVdW1qJ4gu4YSgMVFXBTNdtWFdbNNz+kMaiyk8=";
+      hash = "sha256-pBEHmBtIgG4Czou4C/zpBBYZEDImvXiLoA5CjOzpeyI=";
    };

    nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
@ -57,8 +57,8 @@ let
      # Patch borrowed from Alpine to fix build errors with musl libc and recent gcc.
      # This is applied anywhere to prevent patchrot.
      (fetchpatch {
-        url = "https://git.alpinelinux.org/aports/plain/testing/openjdk19/FixNullPtrCast.patch?id=b93d1fc37fcf106144958d957bb97c7db67bd41f";
-        hash = "sha256-cnpeYcVoRYjuDgrl2x27frv6KUAnu1+1MVPehPZy/Cg=";
+        url = "https://git.alpinelinux.org/aports/plain/testing/openjdk19/FixNullPtrCast.patch?id=93dc07f97ff716b647c5f57c6224901ea06da560";
+        hash = "sha256-H4X3Yip5bCpXMH7MSu9BgXIOYRVUBMZPZW8EvZSWI5k=";
      })
    ] ++ lib.optionals (!headless && enableGnome2) [
      ./swing-use-gtk-jdk13.patch
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@ -20,7 +20,7 @@ let
    powerpc64le-linux = "ppc64le";
  }.${stdenv.system} or (throw "Unsupported platform ${stdenv.system}");

-  update = "352";
+  update = "362";
  build = "ga";

  openjdk8 = stdenv.mkDerivation rec {
@ -31,7 +31,7 @@ let
      owner = "openjdk";
      repo = "jdk8u";
      rev = "jdk${version}";
-      sha256 = "sha256-xDiiALDjStD9IPhbBr997rm/v2Q/WdS10cILBCmdJIQ=";
+      sha256 = "sha256-C5dQwfIIpIrLeO3JWERyFCQHUSgG8gARuc3qXAeLkJ4=";
    };
    outputs = [ "out" "jre" ];

--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@ -1,26 +1,19 @@
 { stdenv, lib, fetchFromGitHub, writeText, gradle_7, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, icu68
-, openjdk11-bootstrap }:
+, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, icu68
+, openjdk11-bootstrap
+, withMedia ? true
+, withWebKit ? false
+}:

 let
  major = "11";
-  update = ".0.17";
+  update = ".0.18";
  build = "1";
  repover = "${major}${update}+${build}";
  gradle_ = (gradle_7.override {
    java = openjdk11-bootstrap;
  });

-  NIX_CFLAGS_COMPILE = [
-    # avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
-    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
-    # glib-2.62 deprecations
-    # -fcommon: gstreamer workaround for -fno-common toolchains:
-    #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
-    #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
-    "-fcommon"
-  ];
-
  makePackage = args: stdenv.mkDerivation ({
    version = "${major}${update}-${build}";

@ -28,10 +21,10 @@ let
      owner = "openjdk";
      repo = "jfx${major}u";
      rev = repover;
-      sha256 = "sha256-uKb6k+tIFdwy1BYiHWeGmKNz82X4CZjFlGYqLDpSFY0=";
+      sha256 = "sha256-46DjIzcBHkmp5vnhYnLu78CG72bIBRM4A6mgk2OLOko=";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
@ -81,8 +74,8 @@ in makePackage {
  pname = "openjfx-modular-sdk";

  gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@ -1,6 +1,9 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk11_headless, gradle_6
-, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4-headless, python3, ruby }:
+, pkg-config, perl, cmake, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib
+, ffmpeg_4-headless, python3, ruby
+, withMedia ? true
+, withWebKit ? false
+}:

 let
  major = "15";
@ -21,7 +24,7 @@ let
      sha256 = "019glq8rhn6amy3n5jc17vi2wpf1pxpmmywvyz1ga8n09w7xscq1";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
@ -76,8 +79,8 @@ in makePackage {
  pname = "openjfx-modular-sdk";

  gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/openjdk/openjfx/17.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/17.nix
@ -1,11 +1,14 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk17_headless, gradle_7
-, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4-headless, python3, ruby, icu68 }:
+, pkg-config, perl, cmake, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib
+, ffmpeg_4-headless, python3, ruby, icu68
+, withMedia ? true
+, withWebKit ? false
+}:

 let
  major = "17";
-  update = ".0.5";
-  build = "+1";
+  update = ".0.6";
+  build = "+3";
  repover = "${major}${update}${build}";
  gradle_ = (gradle_7.override {
    java = openjdk17_headless;
@ -18,10 +21,10 @@ let
      owner = "openjdk";
      repo = "jfx${major}u";
      rev = repover;
-      sha256 = "sha256-jzLOlWuhkUS0/4+nXtjd1/IYbAHHnJrusFRTh7aPt8U=";
+      sha256 = "sha256-9VfXk2EfMebMyVKPohPRP2QXRFf8XemUtfY0JtBCHyw=";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
@ -66,8 +69,8 @@ in makePackage {
  pname = "openjfx-modular-sdk";

  gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/openjdk/openjfx/19.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/19.nix
@ -1,11 +1,14 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, writeText, openjdk17_headless
-, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst
-, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68 }:
+, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk3, libXtst
+, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68
+, withMedia ? true
+, withWebKit ? false
+}:

 let
  major = "19";
-  update = "";
-  build = "+11";
+  update = ".0.2.1";
+  build = "+1";
  repover = "${major}${update}${build}";
  gradle_ = (gradle_7.override {
    # note: gradle does not yet support running on 19
@ -19,7 +22,7 @@ let
      owner = "openjdk";
      repo = "jfx";
      rev = repover;
-      hash = "sha256-UXTaXtJ8py83V7IQK9wACIEWDAMRUaYNgH9e/Aeyuzc=";
+      hash = "sha256-A08GhCGpzWlUG1+f6mcjvkJmMNaOReacQKPEmNpUvLs=";
    };

    patches = [
@ -35,7 +38,7 @@ let
      })
    ];

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
@ -83,8 +86,8 @@ in makePackage {
  pname = "openjfx-modular-sdk";

  gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/rust/1_67.nix
+++ b/pkgs/development/compilers/rust/1_67.nix
@ -21,8 +21,8 @@
 } @ args:

 import ./default.nix {
-  rustcVersion = "1.67.0";
-  rustcSha256 = "sha256-0CnxT85Foux6mmBdKgpAquRznLL9rinun3pukCWn/eQ=";
+  rustcVersion = "1.67.1";
+  rustcSha256 = "sha256-Rkg9Pl3oWjvUb456OuGDdJY5EGfb5xOiXTzwUbPZ/24=";

  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
  llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
@ -59,14 +59,6 @@ import ./default.nix {
  selectRustPackage = pkgs: pkgs.rust_1_67;

  rustcPatches = [
-    # fix thin archive reading
-    # https://github.com/rust-lang/rust/pull/107360
-    (fetchpatch {
-      name = "revert-back-to-llvmarchivebuilder-on-all-platforms.patch";
-      url = "https://github.com/rust-lang/rust/commit/de363d54c40a378717881240e719f5f7223ba376.patch";
-      hash = "sha256-3Xb803LZUZ1dldxGJ65Iw6gg1V1K827OB/0b32GqilU=";
-    })
-
    # Fixes ICE.
    # https://github.com/rust-lang/rust/pull/107688
    (fetchpatch {
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@ -129405,8 +129405,8 @@ self: {
     }:
     mkDerivation {
       pname = "haskell-gi";
-       version = "0.26.2";
-       sha256 = "05r84czb05n69g7p7jazljh95yzdh2lpzgjjypgpg75mh83igr2w";
+       version = "0.26.3";
+       sha256 = "sha256-jsAb3JCSHCmi2dp9bpi/J3NRO/EQFB8ar4GpxAuBGOo=";
       setupHaskellDepends = [ base Cabal cabal-doctest ];
       libraryHaskellDepends = [
         ansi-terminal attoparsec base bytestring Cabal containers directory
--- a/pkgs/development/interpreters/lua-5/hooks/default.nix
+++ b/pkgs/development/interpreters/lua-5/hooks/default.nix
@ -27,7 +27,7 @@ in {
  luarocksCheckHook = callPackage ({ luarocks }:
    makeSetupHook {
      name = "luarocks-check-hook";
-      deps = [ luarocks ];
+      propagatedBuildInputs = [ luarocks ];
    } ./luarocks-check-hook.sh) {};

  # luarocks installs data in a non-overridable location. Until a proper luarocks patch,
@ -35,6 +35,6 @@ in {
  luarocksMoveDataFolder = callPackage ({ }:
    makeSetupHook {
      name = "luarocks-move-rock";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
    } ./luarocks-move-data.sh) {};
 }
--- a/pkgs/development/interpreters/lua-5/wrap-lua.nix
+++ b/pkgs/development/interpreters/lua-5/wrap-lua.nix
@ -8,7 +8,7 @@
 # imported as wrapLua in lua-packages.nix and passed to build-lua-derivation to be used as buildInput
 makeSetupHook {
  name = "wrap-lua-hook";
-  deps = makeWrapper;
+  propagatedBuildInputs = [ makeWrapper ];
  substitutions.executable = lua.interpreter;
  substitutions.lua = lua;
  substitutions.LuaPathSearchPaths = lib.escapeShellArgs lua.LuaPathSearchPaths;
--- a/pkgs/development/interpreters/octave/wrap-octave.nix
+++ b/pkgs/development/interpreters/octave/wrap-octave.nix
@ -10,7 +10,7 @@
 # Each of the substitutions is available in the wrap.sh script as @thingSubstituted@
 makeSetupHook {
  name = "${octave.name}-pkgs-setup-hook";
-  deps = makeWrapper;
+  propagatedBuildInputs = [ makeWrapper ];
  substitutions.executable = octave.interpreter;
  substitutions.octave = octave;
 } ./wrap.sh
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -24,7 +24,7 @@
 , pkgsHostHost
 , pkgsTargetTarget
 , sourceVersion
-, sha256
+, hash
 , passthruFun
 , static ? stdenv.hostPlatform.isStatic
 , stripBytecode ? reproducibleBuild
@ -87,7 +87,7 @@ let
    owner = "ActiveState";
    repo = "cpython";
    rev = "v${version}";
-    inherit sha256;
+    inherit hash;
  };

  hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -30,7 +30,7 @@
 , pkgsHostHost
 , pkgsTargetTarget
 , sourceVersion
-, sha256
+, hash
 , passthruFun
 , bash
 , stripConfig ? false
@ -215,7 +215,7 @@ in with passthru; stdenv.mkDerivation {

  src = fetchurl {
    url = with sourceVersion; "https://www.python.org/ftp/python/${major}.${minor}.${patch}/Python-${version}.tar.xz";
-    inherit sha256;
+    inherit hash;
  };

  prePatch = optionalString stdenv.isDarwin ''
@ -235,7 +235,7 @@ in with passthru; stdenv.mkDerivation {
      url = "https://github.com/python/cpython/commit/3fae04b10e2655a20a3aadb5e0d63e87206d0c67.diff";
      revert = true;
      excludes = [ "Misc/NEWS.d/*" ];
-      sha256 = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
+      hash = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
    })
  ] ++ [
    # Disable the use of ldconfig in ctypes.util.find_library (since
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -117,23 +117,24 @@
  };

  sources = {
-    python39 = {
-      sourceVersion = {
-        major = "3";
-        minor = "9";
-        patch = "16";
-        suffix = "";
-      };
-      sha256 = "sha256-It3cCZJG3SdgZlVh6K23OU6gzEOnJoTGSA+TgPd4ZDk=";
-    };
    python310 = {
      sourceVersion = {
        major = "3";
        minor = "10";
-        patch = "9";
+        patch = "10";
        suffix = "";
      };
-      sha256 = "sha256-WuA+MIJgFkuro5kh/bTb+ObQPYI1qTnUWCsz8LXkaoM=";
+      hash = "sha256-BBnpCFv1G3pnIAmz9Q2/GFms3xi6cl0OwZqlyFA/DqM=";
+    };
+
+    python311 = {
+      sourceVersion = {
+        major = "3";
+        minor = "11";
+        patch = "2";
+        suffix = "";
+      };
+      hash = "sha256-KeS49fFlhUKowT4t0nc1jJxI8rL3MYZS7xZ15AK50q8=";
    };
  };

@ -147,7 +148,7 @@ in {
      patch = "18";
      suffix = ".6"; # ActiveState's Python 2 extended support
    };
-    sha256 = "sha256-+I0QOBkuTHMIQz71lgNn1X1vjPsjJMtFbgC0xcGTwWY=";
+    hash = "sha256-+I0QOBkuTHMIQz71lgNn1X1vjPsjJMtFbgC0xcGTwWY=";
    inherit (darwin) configd;
    inherit passthruFun;
  };
@ -160,16 +161,23 @@ in {
      patch = "16";
      suffix = "";
    };
-    sha256 = "sha256-2F27N3QTJHPYCB3LFY80oQzK16kLlsflDqS7YfXORWI=";
+    hash = "sha256-2F27N3QTJHPYCB3LFY80oQzK16kLlsflDqS7YfXORWI=";
    inherit (darwin) configd;
    inherit passthruFun;
  };

-  python39 = callPackage ./cpython ({
+  python39 = callPackage ./cpython {
    self = __splicedPackages.python39;
+    sourceVersion = {
+      major = "3";
+      minor = "9";
+      patch = "16";
+      suffix = "";
+    };
+    hash = "sha256-It3cCZJG3SdgZlVh6K23OU6gzEOnJoTGSA+TgPd4ZDk=";
    inherit (darwin) configd;
    inherit passthruFun;
-  } // sources.python39);
+  };

  python310 = callPackage ./cpython ({
    self = __splicedPackages.python310;
@ -177,18 +185,11 @@ in {
    inherit passthruFun;
  } // sources.python310);

-  python311 = callPackage ./cpython {
+  python311 = callPackage ./cpython ({
    self = __splicedPackages.python311;
-    sourceVersion = {
-      major = "3";
-      minor = "11";
-      patch = "1";
-      suffix = "";
-    };
-    sha256 = "sha256-hYeRkvLP/VbLFsCSkFlJ6/Pl45S392RyNSljeQHftY8=";
    inherit (darwin) configd;
    inherit passthruFun;
-  };
+  } // sources.python311);

  python312 = callPackage ./cpython {
    self = __splicedPackages.python312;
@ -198,7 +199,7 @@ in {
      patch = "0";
      suffix = "a5";
    };
-    sha256 = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
+    hash = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
    inherit (darwin) configd;
    inherit passthruFun;
  };
@ -241,7 +242,7 @@ in {
      patch = "11";
    };

-    sha256 = "sha256-ERevtmgx2k6m852NIIR4enRon9AineC+MB+e2bJVCTw=";
+    hash = "sha256-ERevtmgx2k6m852NIIR4enRon9AineC+MB+e2bJVCTw=";
    pythonVersion = "2.7";
    db = db.override { dbmSupport = !stdenv.isDarwin; };
    python = __splicedPackages.pythonInterpreters.pypy27_prebuilt;
@ -258,7 +259,7 @@ in {
      patch = "11";
    };

-    sha256 = "sha256-sPMWb7Klqt/VzrnbXN1feSmg7MygK0omwNrgSS98qOo=";
+    hash = "sha256-sPMWb7Klqt/VzrnbXN1feSmg7MygK0omwNrgSS98qOo=";
    pythonVersion = "3.9";
    db = db.override { dbmSupport = !stdenv.isDarwin; };
    python = __splicedPackages.pypy27;
@ -270,7 +271,7 @@ in {
  pypy38 = __splicedPackages.pypy39.override {
    self = __splicedPackages.pythonInterpreters.pypy38;
    pythonVersion = "3.8";
-    sha256 = "sha256-TWdpv8pzc06GZv1wUDt86wam4lkRDmFzMbs4mcpOYFg=";
+    hash = "sha256-TWdpv8pzc06GZv1wUDt86wam4lkRDmFzMbs4mcpOYFg=";
  };

  pypy37 = throw "pypy37 has been removed from nixpkgs since it is no longer supported upstream"; # Added 2023-01-04
@ -284,7 +285,7 @@ in {
      patch = "11";
    };

-    sha256 = {
+    hash = {
      aarch64-linux = "sha256-6pJNod7+kyXvdg4oiwT5hGFOQFWA9TIetqXI9Tm9QVo=";
      x86_64-linux = "sha256-uo7ZWKkFwHNaTP/yh1wlCJlU3AIOCH2YKw/6W52jFs0=";
      aarch64-darwin = "sha256-zFaWq0+TzTSBweSZC13t17pgrAYC+hiQ02iImmxb93E=";
@ -302,7 +303,7 @@ in {
      minor = "3";
      patch = "11";
    };
-    sha256 = {
+    hash = {
      aarch64-linux = "sha256-CRddxlLtiV2Y6a1j0haBK/PufjmNkAqb+espBrqDArk=";
      x86_64-linux = "sha256-1QYXLKEQcSdBdddOnFgcMWZDLQF5sDZHDjuejSDq5YE=";
      aarch64-darwin = "sha256-ka11APGjlTHb76CzRaPc/5J/+ZcWVOjS6e98WuMR9X4=";
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@ -11,7 +11,7 @@ in {
  condaInstallHook = callPackage ({ makePythonHook, gnutar, lbzip2 }:
    makePythonHook {
      name = "conda-install-hook";
-      deps = [ gnutar lbzip2 ];
+      propagatedBuildInputs = [ gnutar lbzip2 ];
      substitutions = {
        inherit pythonSitePackages;
      };
@ -20,19 +20,19 @@ in {
  condaUnpackHook = callPackage ({ makePythonHook }:
    makePythonHook {
      name = "conda-unpack-hook";
-      deps = [];
+      propagatedBuildInputs = [];
    } ./conda-unpack-hook.sh) {};

  eggBuildHook = callPackage ({ makePythonHook }:
    makePythonHook {
      name = "egg-build-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
    } ./egg-build-hook.sh) {};

  eggInstallHook = callPackage ({ makePythonHook, setuptools }:
    makePythonHook {
      name = "egg-install-hook.sh";
-      deps = [ setuptools ];
+      propagatedBuildInputs = [ setuptools ];
      substitutions = {
        inherit pythonInterpreter pythonSitePackages;
      };
@ -41,13 +41,13 @@ in {
  eggUnpackHook = callPackage ({ makePythonHook, }:
    makePythonHook {
      name = "egg-unpack-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
    } ./egg-unpack-hook.sh) {};

  flitBuildHook = callPackage ({ makePythonHook, flit }:
    makePythonHook {
      name = "flit-build-hook";
-      deps = [ flit ];
+      propagatedBuildInputs = [ flit ];
      substitutions = {
        inherit pythonInterpreter;
      };
@ -56,7 +56,7 @@ in {
  pipBuildHook = callPackage ({ makePythonHook, pip, wheel }:
    makePythonHook {
      name = "pip-build-hook.sh";
-      deps = [ pip wheel ];
+      propagatedBuildInputs = [ pip wheel ];
      substitutions = {
        inherit pythonInterpreter pythonSitePackages;
      };
@ -65,7 +65,7 @@ in {
  pipInstallHook = callPackage ({ makePythonHook, pip }:
    makePythonHook {
      name = "pip-install-hook";
-      deps = [ pip ];
+      propagatedBuildInputs = [ pip ];
      substitutions = {
        inherit pythonInterpreter pythonSitePackages;
      };
@ -74,7 +74,7 @@ in {
  pytestCheckHook = callPackage ({ makePythonHook, pytest }:
    makePythonHook {
      name = "pytest-check-hook";
-      deps = [ pytest ];
+      propagatedBuildInputs = [ pytest ];
      substitutions = {
        inherit pythonCheckInterpreter;
      };
@ -123,7 +123,7 @@ in {
  pythonRelaxDepsHook = callPackage ({ makePythonHook, wheel }:
    makePythonHook {
      name = "python-relax-deps-hook";
-      deps = [ wheel ];
+      propagatedBuildInputs = [ wheel ];
      substitutions = {
        inherit pythonInterpreter;
      };
@ -145,7 +145,7 @@ in {
  setuptoolsBuildHook = callPackage ({ makePythonHook, setuptools, wheel }:
    makePythonHook {
      name = "setuptools-setup-hook";
-      deps = [ setuptools wheel ];
+      propagatedBuildInputs = [ setuptools wheel ];
      substitutions = {
        inherit pythonInterpreter pythonSitePackages setuppy;
      };
@ -154,7 +154,7 @@ in {
  setuptoolsCheckHook = callPackage ({ makePythonHook, setuptools }:
    makePythonHook {
      name = "setuptools-check-hook";
-      deps = [ setuptools ];
+      propagatedBuildInputs = [ setuptools ];
      substitutions = {
        inherit pythonCheckInterpreter setuppy;
      };
@ -171,7 +171,7 @@ in {
  venvShellHook = disabledIf (!isPy3k) (callPackage ({ makePythonHook, ensureNewerSourcesForZipFilesHook }:
    makePythonHook {
      name = "venv-shell-hook";
-      deps = [ ensureNewerSourcesForZipFilesHook ];
+      propagatedBuildInputs = [ ensureNewerSourcesForZipFilesHook ];
      substitutions = {
        inherit pythonInterpreter;
      };
@ -180,7 +180,7 @@ in {
  wheelUnpackHook = callPackage ({ makePythonHook, wheel }:
    makePythonHook {
      name = "wheel-unpack-hook.sh";
-      deps = [ wheel ];
+      propagatedBuildInputs = [ wheel ];
    } ./wheel-unpack-hook.sh) {};

  wrapPython = callPackage ../wrap-python.nix {
@ -190,6 +190,6 @@ in {
  sphinxHook = callPackage ({ makePythonHook, sphinx, installShellFiles }:
    makePythonHook {
      name = "python${python.pythonVersion}-sphinx-hook";
-      deps = [ sphinx installShellFiles ];
+      propagatedBuildInputs = [ sphinx installShellFiles ];
    } ./sphinx-hook.sh) {};
 }
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@ -16,17 +16,22 @@ let
  # This function introduces `overridePythonAttrs` and it overrides the call to `buildPythonPackage`.
  makeOverridablePythonPackage = f: origArgs:
    let
-      ff = f origArgs;
-      overrideWith = newArgs: origArgs // (if pkgs.lib.isFunction newArgs then newArgs origArgs else newArgs);
+      args = lib.fix (lib.extends
+        (_: previousAttrs: {
+          passthru = (previousAttrs.passthru or { }) // {
+            overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
+          };
+        })
+        (_: origArgs));
+      result = f args;
+      overrideWith = newArgs: args // (if pkgs.lib.isFunction newArgs then newArgs args else newArgs);
    in
-      if builtins.isAttrs ff then (ff // {
+      if builtins.isAttrs result then result
+      else if builtins.isFunction result then {
        overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
-      })
-      else if builtins.isFunction ff then {
-        overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
-        __functor = self: ff;
+        __functor = self: result;
      }
-      else ff;
+      else result;

  buildPythonPackage = makeOverridablePythonPackage (lib.makeOverridable (callPackage ./mk-python-derivation.nix {
    inherit namePrefix;     # We want Python libraries to be named like e.g. "python3.6-${name}"
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@ -43,7 +43,8 @@ let
      # Use virtualenv from a Nix env.
      nixenv-virtualenv = rec {
        env = runCommand "${python.name}-virtualenv" {} ''
-          ${pythonVirtualEnv.interpreter} -m virtualenv $out
+          ${pythonVirtualEnv.interpreter} -m virtualenv venv
+          mv venv $out
        '';
        interpreter = "${env}/bin/${python.executable}";
        is_venv = "False";
@ -173,7 +174,7 @@ let
      }
    ) {};
    pythonWithRequests = requests.pythonModule.withPackages (ps: [ requests ]);
-    in
+    in lib.optionalAttrs stdenv.isLinux
    {
      condaExamplePackage = runCommand "import-requests" {} ''
        ${pythonWithRequests.interpreter} -c "import requests" > $out
--- a/pkgs/development/interpreters/python/wrap-python.nix
+++ b/pkgs/development/interpreters/python/wrap-python.nix
@ -5,7 +5,7 @@

 makePythonHook {
      name = "wrap-python-hook";
-      deps = makeWrapper;
+      propagatedBuildInputs = [ makeWrapper ];
      substitutions.sitePackages = python.sitePackages;
      substitutions.executable = python.interpreter;
      substitutions.python = python.pythonForBuild;
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -97,6 +97,13 @@ let
          }).${ver.majMinTiny}
          ++ op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
          ++ op (atLeast30 && useBaseRuby) ./do-not-update-gems-baseruby.patch
+          ++ ops (ver.majMin == "3.0") [
+            # Ruby 3.0 adds `-fdeclspec` to $CC instead of $CFLAGS. Fixed in later versions.
+            (fetchpatch {
+              url = "https://github.com/ruby/ruby/commit/0acc05caf7518cd0d63ab02bfa036455add02346.patch";
+              sha256 = "sha256-43hI9L6bXfeujgmgKFVmiWhg7OXvshPCCtQ4TxqK1zk=";
+            })
+          ]
          ++ ops (!atLeast30 && rubygemsSupport) [
            # We upgrade rubygems to a version that isn't compatible with the
            # ruby 2.7 installer. Backport the upstream fix.
@ -190,14 +197,7 @@ let

          # Allow to override compiler. This is important for cross compiling as
          # we need to set a compiler that is different from the build one.
-          awk -i inplace -F' = ' \
-            ' # operate on the line starting with
-              /^  CONFIG\["CC"\]/ {
-                # replace the right hand side
-                sub($2, "ENV[\"CC\"] || \"1\"")
-              }; { print }' "$rbConfig"
-          # test that the line isn't mangled in case upstream made the above unnecessary
-          grep -qx '  CONFIG\["CC"\] = ENV\["CC"\] || "1"' "$rbConfig"
+          sed -i 's/CONFIG\["CC"\] = "\(.*\)"/CONFIG["CC"] = if ENV["CC"].nil? || ENV["CC"].empty? then "\1" else ENV["CC"] end/'  "$rbConfig"

          # Remove unnecessary external intermediate files created by gems
          extMakefiles=$(find $out/${passthru.gemPath} -name Makefile)
@ -235,6 +235,21 @@ let
            $rbConfig $out/lib/libruby*
        '';

+        installCheckPhase = ''
+          overriden_cc=$(CC=foo $out/bin/ruby -rrbconfig -e 'puts RbConfig::CONFIG["CC"]')
+          if [[ "$overriden_cc" != "foo" ]]; then
+             echo "CC cannot be overwritten: $overriden_cc != foo" >&2
+             false
+          fi
+
+          fallback_cc=$(unset CC; $out/bin/ruby -rrbconfig -e 'puts RbConfig::CONFIG["CC"]')
+          if [[ "$fallback_cc" != "$CC" ]]; then
+             echo "CC='$fallback_cc' should be '$CC' by default" >&2
+             false
+          fi
+        '';
+        doInstallCheck = true;
+
        disallowedRequisites = op (!jitSupport) stdenv.cc.cc
          ++ op useBaseRuby baseRuby;

--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@ -53,7 +53,7 @@ let
        libdir = "lib/${libPrefix}";
        tclPackageHook = callPackage ({ buildPackages }: makeSetupHook {
          name = "tcl-package-hook";
-          deps = [ buildPackages.makeWrapper ];
+          propagatedBuildInputs = [ buildPackages.makeWrapper ];
        } ./tcl-package-hook.sh) {};
      };
    };
--- a/pkgs/development/libraries/accountsservice/default.nix
+++ b/pkgs/development/libraries/accountsservice/default.nix
@ -62,8 +62,8 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    gobject-introspection
    dbus
+    gettext
    glib
    polkit
    systemd
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "libopenmpt";
-  version = "0.6.6";
+  version = "0.6.8";

  outputs = [ "out" "dev" "bin" ];

  src = fetchurl {
    url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "bdueJqQwYglEiReW/vsbuzi9kUj2z8VYgQwNPyaYdsc=";
+    sha256 = "HGGLPf8afLaiT0MXVZIPokN1YmgTj/ox09t8YHwsLWk=";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
  pname = "roc-toolkit";
  version = "0.2.1";

+  outputs = [ "out" "dev" ];
+
  src = fetchFromGitHub {
    owner = "roc-streaming";
    repo = "roc-toolkit";
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv, libxcrypt
+{ lib, stdenv, icu, expat, zlib, bzip2, zstd, xz, python ? null, fixDarwinDylibNames, libiconv, libxcrypt
 , boost-build
 , fetchpatch
 , which
@ -226,6 +226,8 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ which boost-build ]
    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
  buildInputs = [ expat zlib bzip2 libiconv ]
+    ++ lib.optional (lib.versionAtLeast version "1.69") zstd
+    ++ lib.optional (lib.versionAtLeast version "1.65") xz
    ++ lib.optional enableIcu icu
    ++ lib.optionals enablePython [ libxcrypt python ]
    ++ lib.optional enableNumpy python.pkgs.numpy;
--- a/pkgs/development/libraries/cmocka/default.nix
+++ b/pkgs/development/libraries/cmocka/default.nix
@ -1,16 +1,21 @@
 { fetchurl, fetchpatch, lib, stdenv, cmake }:
-
+let
+  # Temporary split to save rebuilds; see PR #217469
+  isUpdated = with stdenv; isDarwin && isAarch64;
+in
 stdenv.mkDerivation rec {
  pname = "cmocka";
  majorVersion = "1.1";
-  version = "${majorVersion}.5";
+  version = "${majorVersion}." + (if isUpdated then "6" else "5");

  src = fetchurl {
    url = "https://cmocka.org/files/${majorVersion}/cmocka-${version}.tar.xz";
-    sha256 = "1dm8pdvkyfa8dsbz9bpq7wwgixjij4sii9bbn5sgvqjm5ljdik7h";
+    sha256 = if isUpdated
+      then "0xksffx1w3pzm18ynf28cx8scrhylcbz43s1rgkkdqnyil1q6cjv"
+      else "1dm8pdvkyfa8dsbz9bpq7wwgixjij4sii9bbn5sgvqjm5ljdik7h";
  };

-  patches = [
+  patches = lib.optionals (!isUpdated) [
    (fetchpatch {
      name = "musl-uintptr.patch";
      url = "https://git.alpinelinux.org/aports/plain/main/cmocka/musl_uintptr.patch?id=6a15dd0d0ba9cc354a621fb359ca5e315ff2eabd";
@ -20,38 +25,42 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];

+  cmakeFlags = lib.optional doCheck "-DUNIT_TESTING=ON"
+    ++ lib.optional stdenv.hostPlatform.isStatic "-DBUILD_SHARED_LIBS=OFF";
+
+  doCheck = true;
+
  meta = with lib; {
    description = "Lightweight library to simplify and generalize unit tests for C";
+    longDescription = ''
+      There are a variety of C unit testing frameworks available however
+      many of them are fairly complex and require the latest compiler
+      technology.  Some development requires the use of old compilers which
+      makes it difficult to use some unit testing frameworks. In addition
+      many unit testing frameworks assume the code being tested is an
+      application or module that is targeted to the same platform that will
+      ultimately execute the test.  Because of this assumption many
+      frameworks require the inclusion of standard C library headers in the
+      code module being tested which may collide with the custom or
+      incomplete implementation of the C library utilized by the code under
+      test.

-    longDescription =
-      ''There are a variety of C unit testing frameworks available however
-        many of them are fairly complex and require the latest compiler
-        technology.  Some development requires the use of old compilers which
-        makes it difficult to use some unit testing frameworks. In addition
-        many unit testing frameworks assume the code being tested is an
-        application or module that is targeted to the same platform that will
-        ultimately execute the test.  Because of this assumption many
-        frameworks require the inclusion of standard C library headers in the
-        code module being tested which may collide with the custom or
-        incomplete implementation of the C library utilized by the code under
-        test.
+      Cmocka only requires a test application is linked with the standard C
+      library which minimizes conflicts with standard C library headers.
+      Also, CMocka tries to avoid the use of some of the newer features of
+      C compilers.

-        Cmocka only requires a test application is linked with the standard C
-        library which minimizes conflicts with standard C library headers.
-        Also, CMocka tries to avoid the use of some of the newer features of
-        C compilers.
-
-        This results in CMocka being a relatively small library that can be
-        used to test a variety of exotic code. If a developer wishes to
-        simply test an application with the latest compiler then other unit
-        testing frameworks may be preferable.
-
-        This is the successor of Google's Cmockery.'';
+      This results in CMocka being a relatively small library that can be
+      used to test a variety of exotic code. If a developer wishes to
+      simply test an application with the latest compiler then other unit
+      testing frameworks may be preferable.

+      This is the successor of Google's Cmockery.
+    '';
    homepage = "https://cmocka.org/";
-
    license = licenses.asl20;
    platforms = platforms.all;
    maintainers = with maintainers; [ kragniz rasendubi ];
+    broken = stdenv.hostPlatform.isStatic; # See https://github.com/NixOS/nixpkgs/issues/213623
  };
 }
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -253,6 +253,7 @@
 , zeromq4
 , zimg
 , zlib
+, vulkan-headers
 , vulkan-loader
 , glslang
 /*
@ -286,7 +287,6 @@
 */

 let
-  inherit (stdenv) isCygwin isDarwin isFreeBSD isLinux isAarch64;
  inherit (lib) optional optionals optionalString enableFeature;
 in

@ -342,6 +342,10 @@ stdenv.mkDerivation (finalAttrs: {
      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
    substituteInPlace doc/filters.texi \
      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
+  '' + lib.optionalString withVulkan ''
+    # FIXME: horrible hack, remove for next release
+    substituteInPlace libavutil/hwcontext_vulkan.c \
+      --replace VK_EXT_VIDEO_DECODE VK_KHR_VIDEO_DECODE
  '';

  patches = map (patch: fetchpatch patch) extraPatches;
@ -593,7 +597,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optionals withVorbis [ libvorbis ]
  ++ optionals withVpx [ libvpx ]
  ++ optionals withV4l2 [ libv4l ]
-  ++ optionals withVulkan [ vulkan-loader ]
+  ++ optionals withVulkan [ vulkan-headers vulkan-loader ]
  ++ optionals withWebp [ libwebp ]
  ++ optionals withX264 [ x264 ]
  ++ optionals withX265 [ x265 ]
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@ -27,7 +27,6 @@

 let
  testDeps = [
-    gobject-introspection # for Gio and cairo typelibs
    gtk3 atk pango.out gdk-pixbuf harfbuzz
  ];
 in stdenv.mkDerivation rec {
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -56,11 +56,11 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glib";
-  version = "2.74.3";
+  version = "2.74.5";

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "6bxB7NlpDZvGqXDMc4ARm4KOW2pLFsOTxjiz3CuHy8s=";
+    sha256 = "zrqDpZmc6zGkxPyZISB8uf//0qsdbsA8Fi0/YIpcFMg=";
  };

  patches = lib.optionals stdenv.isDarwin [
@ -118,20 +118,6 @@ stdenv.mkDerivation (finalAttrs: {
    # Disable flaky test.
    # https://gitlab.gnome.org/GNOME/glib/-/issues/820
    ./skip-timer-test.patch
-
-    # GVariant security fixes
-    # https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126.patch";
-      sha256 = "CNCxouYy8xNHt4eJtPZ2eOi9b0SxzI2DkklNfQMk3d8=";
-    })
-
-    # Menu model security fix
-    # https://discourse.gnome.org/t/fixes-for-gdbusmenumodel-crashes-in-glib/12846
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/4f4d770a1e40f719d5a310cffdac29cbb4e20c11.patch";
-      sha256 = "+S44AnC86HfbMwkRe1ll54IK9pLxaFD3LqiVhPelnXI=";
-    })
  ];

  outputs = [ "bin" "out" "dev" "devdoc" ];
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@ -5,7 +5,7 @@
 , guileBindings ? config.gnutls.guile or false, guile
 , tpmSupport ? false, trousers, which, nettools, libunistring
 , withP11-kit ? !stdenv.hostPlatform.isStatic, p11-kit
-, withSecurity ? true, Security  # darwin Security.framework
+, Security  # darwin Security.framework
 # certificate compression - only zlib now, more possible: zstd, brotli

 # for passthru.tests
@ -35,11 +35,11 @@ in

 stdenv.mkDerivation rec {
  pname = "gnutls";
-  version = "3.7.8";
+  version = "3.8.0";

  src = fetchurl {
    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "sha256-xYrTmvBnDv5qiu5eOosjMaEgBBi2S3xRl3+zltRhcRQ=";
+    sha256 = "sha256-DqDRGhZgoeY/lg8Vexl6vm0MjLMlW+JOH7OBWTC5vcU=";
  };

  outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@ -47,11 +47,7 @@ stdenv.mkDerivation rec {
  outputInfo = "devdoc";
  outputDoc  = "devdoc";

-  patches = [ ./nix-ssl-cert-file.patch ]
-    # Disable native add_system_trust.
-    # FIXME: apparently it's not enough to drop the framework anymore; maybe related to
-    # https://gitlab.com/gnutls/gnutls/-/commit/c19cb93d492e45141bfef9b926dfeba36003261c
-    ++ lib.optional (isDarwin && !withSecurity) ./no-security-framework.patch;
+  patches = [ ./nix-ssl-cert-file.patch ];

  # Skip some tests:
  #  - pkg-config: building against the result won't work before installing (3.5.11)
@ -93,12 +89,11 @@ stdenv.mkDerivation rec {
    ++ lib.optional guileBindings guile;

  nativeBuildInputs = [ perl pkg-config ]
-    ++ lib.optionals (isDarwin && !withSecurity) [ autoconf automake ]
    ++ lib.optionals doCheck [ which nettools util-linux ];

  propagatedBuildInputs = [ nettle ]
    # Builds dynamically linking against gnutls seem to need the framework now.
-    ++ lib.optional (isDarwin && withSecurity) Security;
+    ++ lib.optional isDarwin Security;

  inherit doCheck;
  # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
--- a/pkgs/development/libraries/gnutls/nix-ssl-cert-file.patch
+++ b/pkgs/development/libraries/gnutls/nix-ssl-cert-file.patch
@ -1,14 +1,13 @@
 allow overriding system trust store location via $NIX_SSL_CERT_FILE

-diff --git a/lib/system/certs.c b/lib/system/certs.c
-index 611c645..6ef6edb 100644
 --- a/lib/system/certs.c
 +++ b/lib/system/certs.c
-@@ -369,6 +369,11 @@ gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
+@@ -404,6 +404,10 @@ gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
 					unsigned int tl_flags,
 					unsigned int tl_vflags)
 {
-	return add_system_trust(list, tl_flags|GNUTLS_TL_NO_DUPLICATES, tl_vflags);
+-	return add_system_trust(list, tl_flags | GNUTLS_TL_NO_DUPLICATES,
+-				tl_vflags);
 +	tl_flags = tl_flags|GNUTLS_TL_NO_DUPLICATES;
 +	const char *file = secure_getenv("NIX_SSL_CERT_FILE");
 +	return file
@ -16,4 +15,3 @@ index 611c645..6ef6edb 100644
 +			list, file, NULL/*CRL*/, GNUTLS_X509_FMT_PEM, tl_flags, tl_vflags)
 +		: add_system_trust(list, tl_flags, tl_vflags);
 }
- 
--- a/pkgs/development/libraries/gnutls/no-security-framework.patch
+++ b/pkgs/development/libraries/gnutls/no-security-framework.patch
@ -1,126 +0,0 @@
-commit 9bcdde1ab9cdff6a4471f9a926dd488ab70c7247
-Author: Daiderd Jordan <daiderd@gmail.com>
-Date:   Mon Apr 22 16:38:27 2019 +0200
-
-    Revert "gnutls_x509_trust_list_add_system_trust: Add macOS keychain support"
-    
-    This reverts commit c0eb46d3463cd21b3f822ac377ff37f067f66b8d.
-
-diff --git a/configure.ac b/configure.ac
-index 8ad597bfd..8d14f26cd 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -781,7 +781,7 @@ dnl auto detect https://lists.gnu.org/archive/html/help-gnutls/2012-05/msg00004.
- AC_ARG_WITH([default-trust-store-file],
-   [AS_HELP_STRING([--with-default-trust-store-file=FILE],
-     [use the given file default trust store])], with_default_trust_store_file="$withval",
-  [if test "$build" = "$host" && test x$with_default_trust_store_pkcs11 = x && test x$with_default_trust_store_dir = x && test x$have_macosx = x;then
-+  [if test "$build" = "$host" && test x$with_default_trust_store_pkcs11 = x && test x$with_default_trust_store_dir = x;then
-   for i in \
-     /etc/ssl/ca-bundle.pem \
-     /etc/ssl/certs/ca-certificates.crt \
-diff --git a/lib/Makefile.am b/lib/Makefile.am
-index fe9cf63a2..745695f7e 100644
--- a/lib/Makefile.am
-+++ b/lib/Makefile.am
-@@ -203,10 +203,6 @@ if WINDOWS
- thirdparty_libadd += -lcrypt32
- endif
- 
-if MACOSX
-libgnutls_la_LDFLAGS += -framework Security -framework CoreFoundation
-endif
-
- libgnutls_la_LIBADD += $(thirdparty_libadd)
- 
- # C++ library
-diff --git a/lib/system/certs.c b/lib/system/certs.c
-index 611c645e0..912b0aa5e 100644
--- a/lib/system/certs.c
-+++ b/lib/system/certs.c
-@@ -44,12 +44,6 @@
- # endif
- #endif
- 
-#ifdef __APPLE__
-# include <CoreFoundation/CoreFoundation.h>
-# include <Security/Security.h>
-# include <Availability.h>
-#endif
-
- /* System specific function wrappers for certificate stores.
-  */
- 
-@@ -276,72 +270,6 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
- 
- 	return r;
- }
-#elif defined(__APPLE__) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-static
-int osstatus_error(status)
-{
-	CFStringRef err_str = SecCopyErrorMessageString(status, NULL);
-	_gnutls_debug_log("Error loading system root certificates: %s\n",
-			  CFStringGetCStringPtr(err_str, kCFStringEncodingUTF8));
-	CFRelease(err_str);
-	return GNUTLS_E_FILE_ERROR;
-}
-
-static
-int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
-		     unsigned int tl_vflags)
-{
-	int r=0;
-
-	SecTrustSettingsDomain domain[] = { kSecTrustSettingsDomainUser,
-					    kSecTrustSettingsDomainAdmin,
-					    kSecTrustSettingsDomainSystem };
-	for (size_t d=0; d<sizeof(domain)/sizeof(*domain); d++) {
-		CFArrayRef certs = NULL;
-		OSStatus status = SecTrustSettingsCopyCertificates(domain[d],
-								   &certs);
-		if (status == errSecNoTrustSettings)
-			continue;
-		if (status != errSecSuccess)
-			return osstatus_error(status);
-
-		int cert_count = CFArrayGetCount(certs);
-		for (int i=0; i<cert_count; i++) {
-			SecCertificateRef cert =
-				(void*)CFArrayGetValueAtIndex(certs, i);
-			CFDataRef der;
-			status = SecItemExport(cert, kSecFormatX509Cert, 0,
-					       NULL, &der);
-			if (status != errSecSuccess) {
-				CFRelease(der);
-				CFRelease(certs);
-				return osstatus_error(status);
-			}
-
-			if (gnutls_x509_trust_list_add_trust_mem(list,
-								 &(gnutls_datum_t) {
-									.data = (void*)CFDataGetBytePtr(der),
-									.size = CFDataGetLength(der),
-								 },
-								 NULL,
-			                                         GNUTLS_X509_FMT_DER,
-								 tl_flags,
-								 tl_vflags) > 0)
-				r++;
-			CFRelease(der);
-		}
-		CFRelease(certs);
-	}
-
-#ifdef DEFAULT_BLACKLIST_FILE
-	ret = gnutls_x509_trust_list_remove_trust_file(list, DEFAULT_BLACKLIST_FILE, GNUTLS_X509_FMT_PEM);
-	if (ret < 0) {
-		_gnutls_debug_log("Could not load blacklist file '%s'\n", DEFAULT_BLACKLIST_FILE);
-	}
-#endif
-
-	return r;
-}
- #else
- 
- #define add_system_trust(x,y,z) GNUTLS_E_UNIMPLEMENTED_FEATURE
--- a/pkgs/development/libraries/gtest/default.nix
+++ b/pkgs/development/libraries/gtest/default.nix
@ -27,7 +27,10 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
-  ] ++ lib.optionals (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0")) [
+  ] ++ lib.optionals (
+    (stdenv.cc.isGNU && (lib.versionOlder stdenv.cc.version "11.0"))
+    || (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0"))
+  ) [
    # Enable C++17 support
    # https://github.com/google/googletest/issues/3081
    "-DCMAKE_CXX_STANDARD=17"
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@ -10,6 +10,8 @@
 , meson
 , ninja
 , gobject-introspection
+, buildPackages
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , icu
 , graphite2
 , harfbuzz # The icu variant uses and propagates the non-icu one.
@ -32,11 +34,11 @@

 stdenv.mkDerivation rec {
  pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "6.0.0";
+  version = "7.0.0";

  src = fetchurl {
    url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
-    sha256 = "HRAQoXUdB21SkeQzwThQKnlNZ5p0mNEmjuIeLUoUDrQ=";
+    hash = "sha256-e0aFtwZsXGuNxs17AvY8VU+4zBxN3PxEvChO+jwgzyg=";
  };

  postPatch = ''
@ -61,6 +63,7 @@ stdenv.mkDerivation rec {
    (lib.mesonEnable "coretext" withCoreText)
    (lib.mesonEnable "graphite" withGraphite2)
    (lib.mesonEnable "icu" withIcu)
+    (lib.mesonEnable "introspection" withIntrospection)
  ];

  depsBuildBuild = [
@ -70,14 +73,14 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    meson
    ninja
-    gobject-introspection
    libintl
    pkg-config
    python3
+    glib
    gtk-doc
    docbook-xsl-nons
    docbook_xml_dtd_43
-  ];
+  ] ++ lib.optional withIntrospection gobject-introspection;

  buildInputs = [ glib freetype ]
    ++ lib.optionals withCoreText [ ApplicationServices CoreText ];
@ -107,6 +110,6 @@ stdenv.mkDerivation rec {
    homepage = "https://harfbuzz.github.io/";
    maintainers = [ maintainers.eelco ];
    license = licenses.mit;
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/hidapi/default.nix
+++ b/pkgs/development/libraries/hidapi/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hidapi";
-  version = "0.12.0";
+  version = "0.13.1";

  src = fetchFromGitHub {
    owner = "libusb";
    repo = "hidapi";
    rev = "${finalAttrs.pname}-${finalAttrs.version}";
-    sha256 = "sha256-SMhlcB7LcViC6UFVYACjunxsGkvSOKC3mbLBH4XQSzM=";
+    sha256 = "sha256-CEZP5n8qEAzsqn8dz3u1nG0YoT7J1P+WfN7urkRTuVg=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/iso-codes/default.nix
+++ b/pkgs/development/libraries/iso-codes/default.nix
@ -9,15 +9,10 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-QI95nfQTVGj6fKNetrBcQAS+pEPYHKWLibLkgkAagrs=";
  };

-  patchPhase = ''
-    for i in `find . -name \*.py`
-    do
-        sed -i -e "s|#!/usr/bin/env python|#!${python3}/bin/python|" $i
-    done
-  '';
-
  nativeBuildInputs = [ gettext python3 ];

+  enableParallelBuilding = true;
+
  meta = with lib; {
    homepage = "https://salsa.debian.org/iso-codes-team/iso-codes";
    description = "Various ISO codes packaged as XML files";
--- a/pkgs/development/libraries/libbsd/default.nix
+++ b/pkgs/development/libraries/libbsd/default.nix
@ -1,12 +1,18 @@
-{ lib, stdenv, fetchurl, autoreconfHook, libmd }:
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, libmd
+, gitUpdater
+}:

 stdenv.mkDerivation rec {
  pname = "libbsd";
-  version = "0.11.6";
+  version = "0.11.7";

  src = fetchurl {
    url = "https://libbsd.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-GbOPMXLq9pPm4caHFGNhkMfkiFHkUiTXILO1vASZtd8=";
+    hash = "sha256-m6oYYFnrvyXAYwjp+ZH9ox9xg8DySTGCbYOqar2KAmE=";
  };

  outputs = [ "out" "dev" "man" ];
@ -18,6 +24,11 @@ stdenv.mkDerivation rec {

  patches = [ ./darwin.patch ];

+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "https://gitlab.freedesktop.org/libbsd/libbsd.git";
+  };
+
  meta = with lib; {
    description = "Common functions found on BSD systems";
    homepage = "https://libbsd.freedesktop.org/";
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , pkg-config

@ -13,25 +12,16 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.0.10";
+  version = "1.0.11";
  pname = "libde265";

  src = fetchFromGitHub {
    owner = "strukturag";
    repo = "libde265";
    rev = "v${version}";
-    sha256 = "sha256-d2TJKPvOAqLe+ZO1+Rd/yRIn3W1u1q62ZH20/9N2Shw=";
+    sha256 = "sha256-0aRUh5h49fnjBjy42A5fWYHnhnQ4CFoeSIXZilZewW8=";
  };

-  patches = [
-    (fetchpatch {
-      name = "revert-cmake-change-pkg-config.patch";
-      url = "https://github.com/strukturag/libde265/commit/388b61459c2abe2b949114ab54e83fb4dbfa8ba0.patch";
-      sha256 = "sha256-b6wwSvZpK7lIu0uD1SqK2zGBUjb/25+JW1Pf1fvHc0I=";
-      revert = true;
-    })
-  ];
-
  nativeBuildInputs = [ autoreconfHook pkg-config ];

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@ -1,38 +1,28 @@
-{ stdenv, lib, fetchpatch, fetchFromGitHub, fixDarwinDylibNames, pkgsStatic }:
-
+{ lib
+, stdenv
+, fetchFromGitHub
+, fixDarwinDylibNames
+, pkgsStatic
+, cmake
+}:
 stdenv.mkDerivation rec {
  pname = "libdeflate";
-  version = "1.8";
+  version = "1.17";

  src = fetchFromGitHub {
    owner = "ebiggers";
    repo = "libdeflate";
    rev = "v${version}";
-    sha256 = "sha256-P7YbuhP2/zJCpE9dxZev1yy5oda8WKAHY84ZLTL8gVs=";
+    sha256 = "sha256-tKs8feGbeodOID8FPIUc/1LfBz1p0oN1Jfkv2OnA2qc=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/ebiggers/libdeflate/commit/ee4d18872bfe09a32cfd031c716b9069a04a50a0.diff";
-      sha256 = "0d2lllg60zbbbch0w0qrcqijrgski8xlsy5llg3i684d66ci538a";
-    })
-  ];
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "-DLIBDEFLATE_BUILD_SHARED_LIB=OFF" ];

-  postPatch = ''
-    substituteInPlace Makefile --replace /usr/local $out
-  '';
-
-  makeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "DISABLE_SHARED=1"];
-
-  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-
-  configurePhase = ''
-    make programs/config.h
-  '';
-
-  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

  passthru.tests.static = pkgsStatic.libdeflate;
+
  meta = with lib; {
    description = "Fast DEFLATE/zlib/gzip compressor and decompressor";
    license = licenses.mit;
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@ -20,12 +20,13 @@ stdenv.mkDerivation rec {

  mesonFlags = [
    "-Dinstall-test-programs=true"
-    "-Domap=enabled"
    "-Dcairo-tests=disabled"
-    "-Dvalgrind=${if withValgrind then "enabled" else "disabled"}"
+    (lib.mesonEnable "omap" stdenv.hostPlatform.isLinux)
+    (lib.mesonEnable "valgrind" withValgrind)
  ] ++ lib.optionals stdenv.hostPlatform.isAarch [
    "-Dtegra=enabled"
-    "-Detnaviv=enabled"
+  ] ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
+    "-Detnaviv=disabled"
  ];

  meta = with lib; {
--- a/pkgs/development/libraries/libgudev/default.nix
+++ b/pkgs/development/libraries/libgudev/default.nix
@ -55,7 +55,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    gobject-introspection
    udev
    glib
  ];
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@ -59,7 +59,6 @@ stdenv.mkDerivation rec {
    glib
    libxml2
    icu
-    gobject-introspection
  ];

  cmakeFlags = [
--- a/pkgs/development/libraries/libimagequant/Cargo.lock
+++ b/pkgs/development/libraries/libimagequant/Cargo.lock
@ -0,0 +1,322 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "ahash"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+dependencies = [
+ "getrandom",
+ "once_cell",
+ "version_check",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bytemuck"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c041d3eab048880cb0b86b256447da3f18859a163c3b8d8893f4e6368abe6393"
+
+[[package]]
+name = "c_test"
+version = "0.1.0"
+dependencies = [
+ "cc",
+ "imagequant-sys",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2dd04ddaf88237dc3b8d8f9a3c1004b506b54b3313403944054d23c0870c521"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "715e8152b692bba2d374b53d4875445368fdf21a94751410af607a5ac677d1fc"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a9af1f4c2ef74bb8aa1f7e19706bc72d03598c8a570bb5de72243c7a9d9d5a"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "either"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+
+[[package]]
+name = "fallible_collections"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f57ccc32870366ae684be48b32a1a2e196f98a42a9b4361fe77e13fd4a34755"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8a2db397cb1c8772f31494cb8917e48cd1e64f0fa7efac59fbd741a0a8ce841"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "imagequant"
+version = "4.1.0"
+dependencies = [
+ "arrayvec",
+ "lodepng",
+ "noisy_float",
+ "num_cpus",
+ "once_cell",
+ "rayon",
+ "rgb",
+ "thread_local",
+]
+
+[[package]]
+name = "imagequant-sys"
+version = "4.0.1"
+dependencies = [
+ "bitflags",
+ "imagequant",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
+
+[[package]]
+name = "lodepng"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0ad39f75bbaa4b10bb6f2316543632a8046a5bcf9c785488d79720b21f044f8"
+dependencies = [
+ "crc32fast",
+ "fallible_collections",
+ "flate2",
+ "libc",
+ "rgb",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "noisy_float"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978fe6e6ebc0bf53de533cd456ca2d9de13de13856eda1518a285d7705a213af"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+
+[[package]]
+name = "rayon"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db3a213adf02b3bcfd2d3846bb41cb22857d131789e01df434fb7e7bc0759b7"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "356a0625f1954f730c0201cdab48611198dc6ce21f4acff55089b5a78e6e835b"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
+
+[[package]]
+name = "rgb"
+version = "0.8.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3603b7d71ca82644f79b5a06d1220e9a58ede60bd32255f698cb1af8838b8db3"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "thread_local"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5516c27b78311c50bf42c071425c560ac799b11c30b31f87e3081965fe5e0180"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@ -1,21 +1,48 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, rust, rustPlatform, cargo-c, python3 }:

-stdenv.mkDerivation rec {
+let
+  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
+in
+rustPlatform.buildRustPackage rec {
  pname = "libimagequant";
-  version = "2.17.0";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "ImageOptim";
    repo = pname;
    rev = version;
-    sha256 = "sha256-ZoBCZsoUO66X4sDbMO89g4IX5+jqGMLGR7aC2UwD2tE=";
+    hash = "sha256-W9Q81AbFhWUe6c3csAnm8L5wLqURizrjwqcurWhPISI=";
  };

-  preConfigure = ''
-    patchShebangs ./configure
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
  '';

-  configureFlags = lib.optionals (!stdenv.hostPlatform.isx86) [ "--disable-sse" ];
+  cargoHash = "sha256-0HOmItooNsGq6iTIb9M5IPXMwYh2nQ03qfjomkg0d00=";
+
+  auditable = true; # TODO: remove when this is the default
+
+  nativeBuildInputs = [ cargo-c ];
+
+  postBuild = ''
+    pushd imagequant-sys
+    cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    popd
+  '';
+
+  postInstall = ''
+    pushd imagequant-sys
+    cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    popd
+  '';
+
+  passthru.tests = {
+    inherit (python3.pkgs) pillow;
+  };

  meta = with lib; {
    homepage = "https://pngquant.org/lib/";
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@ -45,7 +45,7 @@ in

 stdenv.mkDerivation rec {
  pname = "libinput";
-  version = "1.21.0";
+  version = "1.22.1";

  outputs = [ "bin" "out" "dev" ];

@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    owner = "libinput";
    repo = "libinput";
    rev = version;
-    sha256 = "R94BdrjI4szNbVtQ+ydRNUg9clR8mkRL7+GE9b2FcDs=";
+    sha256 = "RgwEp60Anr+CpJws6srIv/Qzk2r9NoekeNQ0UT3FRZ0=";
  };

  patches = [
@ -113,8 +113,8 @@ stdenv.mkDerivation rec {
      test/check-leftover-udev-rules.sh \
      test/helper-copy-and-exec-from-tmp.sh

-    # Don't create an empty /etc directory.
-    sed -i "/install_subdir('libinput', install_dir : dir_etc)/d" meson.build
+    # Don't create an empty directory under /etc.
+    sed -i "/install_emptydir(dir_etc \/ 'libinput')/d" meson.build
  '';

  passthru = {
--- a/pkgs/development/libraries/libisds/default.nix
+++ b/pkgs/development/libraries/libisds/default.nix
@ -24,6 +24,8 @@ stdenv.mkDerivation rec {

  buildInputs = [ expat gpgme libgcrypt libxml2 libxslt curl docbook_xsl ];

+  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+
  meta = with lib; {
    description = "Client library for accessing SOAP services of Czech government-provided Databox infomation system";
    homepage = "http://xpisar.wz.cz/libisds/";
--- a/pkgs/development/libraries/libmanette/default.nix
+++ b/pkgs/development/libraries/libmanette/default.nix
@ -40,7 +40,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    gobject-introspection
    glib
    libgudev
    libevdev
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@ -1,46 +1,63 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, meson
+, ninja
 , pkg-config
 , glib
 , python3
+, help2man
 , systemd
+, bash-completion
 , withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 }:

 stdenv.mkDerivation rec {
  pname = "libmbim";
-  version = "1.26.4";
+  version = "1.28.2";

  outputs = [ "out" "dev" "man" ];

-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "sha256-9ojOxMRYahdXX14ydEjOYvIADvagfJ5FiYc9SmhWitk=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mobile-broadband";
+    repo = "libmbim";
+    rev = version;
+    hash = "sha256-EtjUaSNBT1e/eeTX4oHzQolGrisbsGKBK8Cfl3rRQTQ=";
  };

-  configureFlags = [
-    "--with-udev-base-dir=${placeholder "out"}/lib/udev"
-    (lib.enableFeature withIntrospection "introspection")
+  mesonFlags = [
+    "-Dudevdir=${placeholder "out"}/lib/udev"
+    (lib.mesonBool "introspection" withIntrospection)
  ];

  nativeBuildInputs = [
+    meson
+    ninja
    pkg-config
    python3
+    help2man
    gobject-introspection
  ];

  buildInputs = [
    glib
    systemd
+    bash-completion
  ];

  doCheck = true;

+  postPatch = ''
+    patchShebangs \
+      build-aux/mbim-codegen/mbim-codegen
+  '';
+
  meta = with lib; {
    homepage = "https://www.freedesktop.org/wiki/Software/libmbim/";
    description = "Library for talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
+    maintainers = teams.freedesktop.members;
    platforms = platforms.linux;
    license = licenses.gpl2Plus;
  };
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@ -44,10 +44,6 @@ stdenv.mkDerivation rec {
    gobject-introspection
  ];

-  buildInputs = lib.optionals withIntrospection [
-    gobject-introspection
-  ];
-
  propagatedBuildInputs = [
    gdk-pixbuf
    glib
--- a/pkgs/development/libraries/libptytty/default.nix
+++ b/pkgs/development/libraries/libptytty/default.nix
@ -4,6 +4,12 @@
 , cmake
 }:

+let
+  isCross = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  isStatic = stdenv.hostPlatform.isStatic;
+  isMusl = stdenv.hostPlatform.isMusl;
+in
+
 stdenv.mkDerivation rec {
  pname = "libptytty";
  version = "2.0";
@ -15,12 +21,24 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];

+  cmakeFlags = lib.optional isStatic "-DBUILD_SHARED_LIBS=OFF"
+    ++ lib.optional (isCross || isStatic) "-DTTY_GID_SUPPORT=OFF"
+    # Musl lacks UTMP/WTMP built-in support
+    ++ lib.optionals isMusl [
+      "-DUTMP_SUPPORT=OFF"
+      "-DWTMP_SUPPORT=OFF"
+      "-DLASTLOG_SUPPORT=OFF"
+    ];
+
  meta = with lib; {
    description = "OS independent and secure pty/tty and utmp/wtmp/lastlog";
    homepage = "http://dist.schmorp.de/libptytty";
    maintainers = with maintainers; [ rnhmjoj ];
    platforms = platforms.unix;
    license = licenses.gpl2;
+    # pkgsMusl.pkgsStatic errors as:
+    #   ln: failed to create symbolic link './include': File exists
+    broken = isStatic && isMusl;
  };

 }
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@ -1,40 +1,61 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, fetchpatch2
+, meson
+, ninja
 , pkg-config
 , gobject-introspection
 , gtk-doc
 , docbook-xsl-nons
 , docbook_xml_dtd_43
+, help2man
 , glib
 , python3
 , libgudev
+, bash-completion
 , libmbim
 , libqrtr-glib
 }:

 stdenv.mkDerivation rec {
  pname = "libqmi";
-  version = "1.30.8";
+  version = "1.32.2";

  outputs = [ "out" "dev" "devdoc" ];

-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hiSCzp460L1l0mQzTuMRzblLnfKGO1txNjCbQbisGZA=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mobile-broadband";
+    repo = "libqmi";
+    rev = version;
+    hash = "sha256-XIbeWgkPiJL8hN8Rb6KFt5Q5sG3KsiEQr0EnhwmI6h8=";
  };

+  patches = [
+    # Fix pkg-config file missing qrtr in Requires.
+    # https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/99
+    (fetchpatch2 {
+      url = "https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/commit/7d08150910974c6bd2c29f887c2c6d4a3526e085.patch";
+      hash = "sha256-LFrlm2ZqLqewLGO2FxL5kFYbZ7HaxdxvVHsFHYSgZ4Y=";
+    })
+  ];
+
  nativeBuildInputs = [
+    meson
+    ninja
    pkg-config
    gobject-introspection
    python3
    gtk-doc
    docbook-xsl-nons
    docbook_xml_dtd_43
+    help2man
  ];

  buildInputs = [
    libgudev
+    bash-completion
    libmbim
  ];

@ -43,16 +64,19 @@ stdenv.mkDerivation rec {
    libqrtr-glib
  ];

-  configureFlags = [
-    "--with-udev-base-dir=${placeholder "out"}/lib/udev"
-    "--enable-gtk-doc=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "yes" else "no"}"
-    "--enable-introspection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "yes" else "no"}"
+  mesonFlags = [
+    "-Dudevdir=${placeholder "out"}/lib/udev"
+    (lib.mesonBool "gtk_doc" (stdenv.buildPlatform == stdenv.hostPlatform))
+    (lib.mesonBool "introspection" (stdenv.buildPlatform == stdenv.hostPlatform))
  ];

-  enableParallelBuilding = true;
-
  doCheck = true;

+  postPatch = ''
+    patchShebangs \
+      build-aux/qmi-codegen/qmi-codegen
+  '';
+
  meta = with lib; {
    homepage = "https://www.freedesktop.org/wiki/Software/libqmi/";
    description = "Modem protocol helper library";
--- a/pkgs/development/libraries/libqrtr-glib/default.nix
+++ b/pkgs/development/libraries/libqrtr-glib/default.nix
@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    gobject-introspection
    glib
  ];

--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@ -71,8 +71,6 @@ stdenv.mkDerivation rec {
    bzip2
    pango
    libintl
-  ] ++ lib.optionals withIntrospection [
-    gobject-introspection
  ] ++ lib.optionals stdenv.isDarwin [
    ApplicationServices
    Foundation
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@ -52,7 +52,6 @@ stdenv.mkDerivation rec {

  buildInputs = [
    libgcrypt
-    gobject-introspection
  ];

  propagatedBuildInputs = [
@ -88,7 +87,7 @@ stdenv.mkDerivation rec {

    dbus-run-session \
      --config-file=${dbus}/share/dbus-1/session.conf \
-      meson test --print-errorlogs
+      meson test --print-errorlogs --timeout-multiplier 0

    runHook postCheck
  '';
--- a/pkgs/development/libraries/libvirt-glib/default.nix
+++ b/pkgs/development/libraries/libvirt-glib/default.nix
@ -55,8 +55,6 @@ stdenv.mkDerivation rec {
    libxml2
  ] ++ lib.optionals stdenv.isLinux [
    libcap_ng
-  ] ++ lib.optionals withIntrospection [
-    gobject-introspection
  ];

  strictDeps = true;
--- a/pkgs/development/libraries/libvisual/default.nix
+++ b/pkgs/development/libraries/libvisual/default.nix
@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , SDL
+, autoreconfHook
 , glib
 , pkg-config
-  # sdl-config is not available when crossing
-, withExamples ? stdenv.buildPlatform == stdenv.hostPlatform
 }:

 stdenv.mkDerivation rec {
@ -17,10 +17,35 @@ stdenv.mkDerivation rec {
    hash = "sha256-qhKHdBf3bTZC2fTHIzAjgNgzF1Y51jpVZB0Bkopd230=";
  };

-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = lib.optional withExamples SDL ++ [ glib ];
+  patches = [
+    # pull upstream fix for SDL1 cross-compilation.
+    #   https://github.com/Libvisual/libvisual/pull/238
+    (fetchpatch {
+      name = "sdl-cross-prereq.patch";
+      url = "https://github.com/Libvisual/libvisual/commit/7902d24aa1a552619a5738339b3823e90dd3b865.patch";
+      hash = "sha256-84u8klHDAw/q4d+9L4ROAr7XsbXItHrhaEKkTEMSPcc=";
+      # remove extra libvisual prefix
+      stripLen = 1;
+      # pull in only useful configure.ac changes.
+      excludes = [ "Makefile.am" ];
+    })
+    (fetchpatch {
+      name = "sdl-cross-pc.patch";
+      url = "https://github.com/Libvisual/libvisual/commit/f79a2e8d21ad1d7fe26e2aa83cea4c9f48f9e392.patch";
+      hash = "sha256-8c7SdLxXC8K9BAwj7DzozsZAcbs5l1xuBqky9LJ1MfM=";
+      # remove extra libvisual prefix
+      stripLen = 1;
+    })
+  ];

-  configureFlags = lib.optional (!withExamples) "--disable-examples";
+  strictDeps = true;
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ SDL glib ];
+
+  configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # Remove once "sdl-cross-prereq.patch" patch above is removed.
+    "--disable-lv-tool"
+  ];

  meta = {
    description = "An abstraction library for audio visualisations";
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, nasm }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm }:

 stdenv.mkDerivation rec {
  pname = "libvmaf";
@ -13,6 +13,15 @@ stdenv.mkDerivation rec {

  sourceRoot = "source/libvmaf";

+  patches = [
+    # Backport fix for non-Linux, non-Darwin platforms.
+    (fetchpatch {
+      url = "https://github.com/Netflix/vmaf/commit/f47640f9ffee9494571bd7c9622e353660c93fc4.patch";
+      stripLen = 1;
+      sha256 = "rsTKuqp8VJG5DBDpixPke3LrdfjKzUO945i+iL0n7CY=";
+    })
+  ];
+
  nativeBuildInputs = [ meson ninja nasm ];

  mesonFlags = [ "-Denable_avx512=true" ];
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@ -12,7 +12,7 @@

 stdenv.mkDerivation rec {
  pname = "libwacom";
-  version = "2.4.0";
+  version = "2.6.0";

  outputs = [ "out" "dev" ];

@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
    owner = "linuxwacom";
    repo = "libwacom";
    rev = "libwacom-${version}";
-    sha256 = "sha256-9uhnO+MqB7tAnSXjBcJWCzHGiz9izun4nVjFb17G8Gg=";
+    sha256 = "sha256-9zqW6zPrFcxv/yAAtFgdVavKVMXeDBoMP3E/XriUcT0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@ -11,7 +11,10 @@
 , ncurses
 , findXMLCatalogs
 , libiconv
-, pythonSupport ? enableShared
+# Python limits cross-compilation to an allowlist of host OSes.
+# https://github.com/python/cpython/blob/dfad678d7024ab86d265d84ed45999e031a03691/configure.ac#L534-L562
+, pythonSupport ? enableShared &&
+    (stdenv.hostPlatform == stdenv.buildPlatform || stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isWasi)
 , icuSupport ? false
 , icu
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -88,7 +88,7 @@
 let
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.3.4";
+  version = "22.3.5";
  branch  = lib.versions.major version;

  withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
@ -120,7 +120,7 @@ self = stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "37a1ddaf03f41919ee3c89c97cff41e87de96e00e9d3247959cc8279d8294593";
+    sha256 = "3eed2ecae2bc674494566faab9fcc9beb21cd804c7ba2b59a1694f3d7236e6a9";
  };

  # TODO:
--- a/pkgs/development/libraries/neon/darwin-fix-configure.patch
+++ b/pkgs/development/libraries/neon/darwin-fix-configure.patch
@ -2,9 +2,9 @@ diff -Nuar neon-0.29.6/configure neon-0.29.6-darwin-fix-configure/configure
 --- neon-0.29.6/configure	2011-05-03 14:25:31.000000000 +0200
 +++ neon-0.29.6-darwin-fix-configure/configure	2012-06-06 23:32:21.000000000 +0200
@@ -4184,7 +4184,7 @@
- $as_echo "$ne_cv_os_uname" >&6; }
+ case x"$ne_cv_os_uname" in #(
+   x"Darwin") :
 
- if test "$ne_cv_os_uname" = "Darwin"; then
 -  CPPFLAGS="$CPPFLAGS -no-cpp-precomp"
 +  CPPFLAGS="$CPPFLAGS"
   LDFLAGS="$LDFLAGS -flat_namespace"
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@ -15,12 +15,12 @@ let
 in

 stdenv.mkDerivation rec {
-  version = "0.32.3";
+  version = "0.32.5";
  pname = "neon";

  src = fetchurl {
    url = "https://notroj.github.io/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-lMuHXcbb/N7ljwObdjxnSwIyiGzf16Xekb5c36K3WWo=";
+    sha256 = "sha256-SHLhL4Alct7dSwL4cAZYFLLVFB99va9wju2rgmtRpYo=";
  };

  patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.3";
-  hash = "sha256-8fhrlMe832xWYTYVMnZE7MV20W8sMX+5hHDcAcWYSA4=";
+  version = "3.79.4";
+  hash = "sha256-Skcdv6Wzo7fsB4U8b8CijNBmn2mEEp4k9VQeLOFdcdU=";
 }
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@ -96,6 +96,7 @@ stdenv.mkDerivation rec {
        -Dhost_arch=${host} \
        -Duse_system_zlib=1 \
        --enable-libpkix \
+        -j $NIX_BUILD_CORES \
        ${lib.optionalString enableFIPS "--enable-fips"} \
        ${lib.optionalString stdenv.isDarwin "--clang"} \
        ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
--- a/pkgs/development/libraries/openjpeg/default.nix
+++ b/pkgs/development/libraries/openjpeg/default.nix
@ -55,10 +55,10 @@ stdenv.mkDerivation rec {
    ++ lib.optional (jpipLibSupport) jdk;

  doCheck = (!stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
-
+  nativeCheckInputs = [ jpylyzer ];
  checkPhase = ''
    substituteInPlace ../tools/ctest_scripts/travis-ci.cmake \
-      --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"${jpylyzer}/bin/jpylyzer\" # "
+      --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"$(command -v jpylyzer)\" # "
    OPJ_SOURCE_DIR=.. ctest -S ../tools/ctest_scripts/travis-ci.cmake
  '';

--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@ -16,15 +16,16 @@
 , ninja
 , glib
 , python3
-, gobject-introspection
 , x11Support? !stdenv.isDarwin, libXft
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, buildPackages, gobject-introspection
 }:

 stdenv.mkDerivation rec {
  pname = "pango";
  version = "1.50.12";

-  outputs = [ "bin" "out" "dev" "devdoc" ];
+  outputs = [ "bin" "out" "dev" ] ++ lib.optional withIntrospection "devdoc";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
@ -39,9 +40,10 @@ stdenv.mkDerivation rec {
    meson ninja
    glib # for glib-mkenum
    pkg-config
-    gobject-introspection
-    gi-docgen
    python3
+  ] ++ lib.optionals withIntrospection [
+    gi-docgen
+    gobject-introspection
  ];

  buildInputs = [
@ -64,9 +66,9 @@ stdenv.mkDerivation rec {
  ];

  mesonFlags = [
-    "-Dgtk_doc=true"
-  ] ++ lib.optionals (!x11Support) [
-    "-Dxft=disabled" # only works with x11
+    (lib.mesonBool "gtk_doc" withIntrospection)
+    (lib.mesonEnable "introspection" withIntrospection)
+    (lib.mesonEnable "xft" x11Support)
  ];

  # Fontconfig error: Cannot load default config file
@ -116,6 +118,6 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl2Plus;

    maintainers = with maintainers; [ raskin ] ++ teams.gnome.members;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
  };
 }
--- a/Show More
+++ b/Show More