summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/python.section.md11
-rw-r--r--pkgs/applications/audio/whipper/default.nix7
-rw-r--r--pkgs/applications/editors/vim/common.nix6
-rw-r--r--pkgs/applications/misc/haxor-news/default.nix6
-rw-r--r--pkgs/applications/misc/pyditz/default.nix4
-rw-r--r--pkgs/applications/misc/topydo/default.nix9
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix1
-rw-r--r--pkgs/applications/networking/mailreaders/claws-mail/default.nix7
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix4
-rw-r--r--pkgs/applications/window-managers/gamescope/default.nix4
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix2
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix3
-rw-r--r--pkgs/build-support/rust/hooks/default.nix5
-rw-r--r--pkgs/build-support/setup-hooks/separate-debug-info.sh2
-rw-r--r--pkgs/build-support/setup-hooks/strip.sh23
-rw-r--r--pkgs/data/misc/tzdata/default.nix22
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/common/strip-attributes.nix37
-rw-r--r--pkgs/development/compilers/glslang/default.nix4
-rw-r--r--pkgs/development/compilers/rust/1_63.nix (renamed from pkgs/development/compilers/rust/1_62.nix)32
-rw-r--r--pkgs/development/compilers/rust/binary.nix34
-rw-r--r--pkgs/development/compilers/rust/cargo.nix2
-rw-r--r--pkgs/development/compilers/rust/rustc.nix7
-rw-r--r--pkgs/development/interpreters/evcxr/default.nix6
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix5
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix8
-rw-r--r--pkgs/development/interpreters/python/hooks/unittest-check-hook.sh29
-rw-r--r--pkgs/development/interpreters/ruby/default.nix10
-rw-r--r--pkgs/development/interpreters/ruby/patchsets.nix17
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix4
-rw-r--r--pkgs/development/interpreters/ruby/rvm-patchsets.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix21
-rw-r--r--pkgs/development/libraries/glibc/default.nix9
-rw-r--r--pkgs/development/libraries/gnu-efi/default.nix14
-rw-r--r--pkgs/development/libraries/gnutls/default.nix4
-rw-r--r--pkgs/development/libraries/gpgme/default.nix4
-rw-r--r--pkgs/development/libraries/gsm/default.nix4
-rw-r--r--pkgs/development/libraries/gsound/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/devtools/default.nix8
-rw-r--r--pkgs/development/libraries/gstreamer/ges/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/libav/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/rtsp-server/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ugly/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/vaapi/default.nix4
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix13
-rw-r--r--pkgs/development/libraries/libcanberra/default.nix22
-rw-r--r--pkgs/development/libraries/libevdev/default.nix4
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix20
-rw-r--r--pkgs/development/libraries/libgpg-error/fix-1.42-cross-compilation.patch142
-rw-r--r--pkgs/development/libraries/libidn/default.nix4
-rw-r--r--pkgs/development/libraries/libjpeg-turbo/default.nix4
-rw-r--r--pkgs/development/libraries/libjxl/default.nix2
-rw-r--r--pkgs/development/libraries/liblqr-1/default.nix2
-rw-r--r--pkgs/development/libraries/libnftnl/default.nix4
-rw-r--r--pkgs/development/libraries/libvpx/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix16
-rw-r--r--pkgs/development/libraries/mesa/drop-dri2.patch40
-rw-r--r--pkgs/development/libraries/polkit/default.nix9
-rw-r--r--pkgs/development/libraries/speexdsp/default.nix4
-rw-r--r--pkgs/development/libraries/spirv-headers/default.nix4
-rw-r--r--pkgs/development/libraries/ti-rpc/default.nix6
-rw-r--r--pkgs/development/libraries/vulkan-headers/default.nix4
-rw-r--r--pkgs/development/libraries/vulkan-loader/default.nix4
-rw-r--r--pkgs/development/libraries/zlib/CVE-2018-25032-1.patch346
-rw-r--r--pkgs/development/libraries/zlib/CVE-2018-25032-2.patch27
-rw-r--r--pkgs/development/libraries/zlib/CVE-2022-37434.patch62
-rw-r--r--pkgs/development/libraries/zlib/default.nix1
-rw-r--r--pkgs/development/python-modules/aioitertools/default.nix10
-rw-r--r--pkgs/development/python-modules/arxiv2bib/default.nix10
-rw-r--r--pkgs/development/python-modules/awesome-slugify/default.nix6
-rw-r--r--pkgs/development/python-modules/backports_abc/default.nix6
-rw-r--r--pkgs/development/python-modules/backports_tempfile/default.nix10
-rw-r--r--pkgs/development/python-modules/backports_weakref/default.nix8
-rw-r--r--pkgs/development/python-modules/bitstring/default.nix9
-rw-r--r--pkgs/development/python-modules/clevercsv/default.nix18
-rw-r--r--pkgs/development/python-modules/contextlib2/default.nix7
-rw-r--r--pkgs/development/python-modules/cvxopt/default.nix10
-rw-r--r--pkgs/development/python-modules/cyclonedx-python-lib/default.nix12
-rw-r--r--pkgs/development/python-modules/cymem/default.nix9
-rw-r--r--pkgs/development/python-modules/deprecation/default.nix7
-rw-r--r--pkgs/development/python-modules/emailthreads/default.nix8
-rw-r--r--pkgs/development/python-modules/enum34/default.nix6
-rw-r--r--pkgs/development/python-modules/fastimport/default.nix6
-rw-r--r--pkgs/development/python-modules/fido2/default.nix13
-rw-r--r--pkgs/development/python-modules/flask-babel/default.nix6
-rw-r--r--pkgs/development/python-modules/flask-bcrypt/default.nix8
-rw-r--r--pkgs/development/python-modules/flask-migrate/default.nix9
-rw-r--r--pkgs/development/python-modules/flask-seasurf/default.nix9
-rw-r--r--pkgs/development/python-modules/gb-io/default.nix5
-rw-r--r--pkgs/development/python-modules/greenlet/default.nix14
-rw-r--r--pkgs/development/python-modules/gruut-ipa/default.nix7
-rw-r--r--pkgs/development/python-modules/importlib-resources/default.nix8
-rw-r--r--pkgs/development/python-modules/isodate/default.nix8
-rw-r--r--pkgs/development/python-modules/jxmlease/default.nix10
-rw-r--r--pkgs/development/python-modules/karton-asciimagic/default.nix8
-rw-r--r--pkgs/development/python-modules/karton-core/default.nix8
-rw-r--r--pkgs/development/python-modules/karton-yaramatcher/default.nix8
-rw-r--r--pkgs/development/python-modules/kbcstorage/default.nix9
-rw-r--r--pkgs/development/python-modules/markdown/default.nix8
-rw-r--r--pkgs/development/python-modules/mat2/default.nix11
-rw-r--r--pkgs/development/python-modules/maxcube-api/default.nix10
-rw-r--r--pkgs/development/python-modules/mdutils/default.nix8
-rw-r--r--pkgs/development/python-modules/mkdocs/default.nix14
-rw-r--r--pkgs/development/python-modules/mock/default.nix6
-rw-r--r--pkgs/development/python-modules/mwdblib/default.nix8
-rw-r--r--pkgs/development/python-modules/mypy/extensions.nix8
-rw-r--r--pkgs/development/python-modules/nix-prefetch-github/default.nix6
-rw-r--r--pkgs/development/python-modules/pathlib/default.nix6
-rw-r--r--pkgs/development/python-modules/pgsanity/default.nix10
-rw-r--r--pkgs/development/python-modules/plac/default.nix9
-rw-r--r--pkgs/development/python-modules/pulsectl/default.nix7
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix8
-rw-r--r--pkgs/development/python-modules/pycparser/default.nix8
-rw-r--r--pkgs/development/python-modules/pyelftools/default.nix2
-rw-r--r--pkgs/development/python-modules/pypdf2/default.nix8
-rw-r--r--pkgs/development/python-modules/pyrad/default.nix10
-rw-r--r--pkgs/development/python-modules/pysensors/default.nix9
-rw-r--r--pkgs/development/python-modules/pyserial/default.nix10
-rw-r--r--pkgs/development/python-modules/pystache/default.nix8
-rw-r--r--pkgs/development/python-modules/python-keycloak/default.nix6
-rw-r--r--pkgs/development/python-modules/python-snappy/default.nix8
-rw-r--r--pkgs/development/python-modules/pytidylib/default.nix6
-rw-r--r--pkgs/development/python-modules/pytz/default.nix8
-rw-r--r--pkgs/development/python-modules/readlike/default.nix8
-rw-r--r--pkgs/development/python-modules/recursive-pth-loader/default.nix2
-rw-r--r--pkgs/development/python-modules/setuptools-rust/default.nix5
-rw-r--r--pkgs/development/python-modules/sjcl/default.nix8
-rw-r--r--pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx-testing/default.nix8
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix24
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix9
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/tabview/default.nix6
-rw-r--r--pkgs/development/python-modules/tomli/default.nix12
-rw-r--r--pkgs/development/python-modules/tornado/4.nix17
-rw-r--r--pkgs/development/python-modules/tornado/5.nix14
-rw-r--r--pkgs/development/python-modules/trytond/default.nix20
-rw-r--r--pkgs/development/python-modules/txrequests/default.nix6
-rw-r--r--pkgs/development/python-modules/u-msgpack-python/default.nix6
-rw-r--r--pkgs/development/python-modules/unidiff/default.nix8
-rw-r--r--pkgs/development/python-modules/unify/default.nix4
-rw-r--r--pkgs/development/python-modules/untangle/default.nix8
-rw-r--r--pkgs/development/python-modules/untokenize/default.nix4
-rw-r--r--pkgs/development/python-modules/vapoursynth/default.nix10
-rw-r--r--pkgs/development/python-modules/webcolors/default.nix8
-rw-r--r--pkgs/development/python-modules/websockets/default.nix8
-rw-r--r--pkgs/development/python-modules/zake/default.nix9
-rw-r--r--pkgs/development/python-modules/zope_copy/default.nix7
-rw-r--r--pkgs/development/python2-modules/mock/default.nix7
-rw-r--r--pkgs/development/python2-modules/typing/default.nix9
-rw-r--r--pkgs/development/tools/build-managers/cmake/001-search-path.diff40
-rw-r--r--pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch19
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix34
-rw-r--r--pkgs/development/tools/build-managers/meson/fix-gtkdoc-when-using-multiple-apple-frameworks.patch162
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammar.nix15
-rw-r--r--pkgs/development/tools/spirv-tools/default.nix16
-rw-r--r--pkgs/development/tools/vulkan-validation-layers/default.nix4
-rw-r--r--pkgs/development/tools/xcbuild/wrapper.nix30
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix1
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix4
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix18
-rw-r--r--pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch19
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/musl/default.nix8
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/xmpp-alerts.nix6
-rw-r--r--pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-15.patch (renamed from pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-when-gsettings-is-disabled.patch)0
-rw-r--r--pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-16.patch26
-rw-r--r--pkgs/servers/pulseaudio/0002-Ignore-SCM_CREDS-on-darwin.patch (renamed from pkgs/servers/pulseaudio/0002-Ignore-SCM_CREDS-on-macOS.patch)0
-rw-r--r--pkgs/servers/pulseaudio/0003-Disable-z-nodelete-on-darwin.patch26
-rw-r--r--pkgs/servers/pulseaudio/0003-Ignore-HAVE_CPUID_H-on-aarch64-darwin.patch26
-rw-r--r--pkgs/servers/pulseaudio/0004-Prefer-HAVE_CLOCK_GETTIME-on-darwin.patch13
-rw-r--r--pkgs/servers/pulseaudio/0004-Prefer-clock_gettime.patch57
-rw-r--r--pkgs/servers/pulseaudio/0005-Enable-CoreAudio-on-darwin.patch31
-rw-r--r--pkgs/servers/pulseaudio/0005-Include-poll-posix.c-on-darwin.patch24
-rw-r--r--pkgs/servers/pulseaudio/0006-Fix-libpulsecommon-sources-on-darwin.patch18
-rw-r--r--pkgs/servers/pulseaudio/0006-Only-use-version-script-on-GNU-ish-linkers.patch29
-rw-r--r--pkgs/servers/pulseaudio/0007-Adapt-undefined-link-args-per-linker.patch44
-rw-r--r--pkgs/servers/pulseaudio/0007-Fix-link-args-on-darwin.patch75
-rw-r--r--pkgs/servers/pulseaudio/0008-Use-correct-semaphore-on-darwin.patch31
-rw-r--r--pkgs/servers/pulseaudio/default.nix51
-rw-r--r--pkgs/servers/sql/postgresql/default.nix24
-rw-r--r--pkgs/tools/graphics/vulkan-extension-layer/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-tools-lunarg/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-tools/default.nix4
-rw-r--r--pkgs/tools/misc/man-db/default.nix4
-rw-r--r--pkgs/tools/networking/wifite2/default.nix3
-rw-r--r--pkgs/tools/system/pciutils/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix14
-rw-r--r--pkgs/top-level/python-packages.nix1
195 files changed, 1045 insertions, 1732 deletions
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 7fb8ba2e7c2..8de523e89df 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -734,6 +734,16 @@ work in any of the formats supported by `buildPythonPackage` currently,
 with the exception of `other` (see `format` in
 [`buildPythonPackage` parameters](#buildpythonpackage-parameters) for more details).
 
+### Using unittestCheckHook {#using-unittestcheckhook}
+
+`unittestCheckHook` is a hook which will substitute the setuptools `test` command for a `checkPhase` which runs `python -m unittest discover`:
+
+```
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlags = [ "-s" "tests" "-v" ];
+```
+
 ### Develop local package {#develop-local-package}
 
 As a Python developer you're likely aware of [development mode](http://setuptools.readthedocs.io/en/latest/setuptools.html#development-mode)
@@ -1270,6 +1280,7 @@ are used in `buildPythonPackage`.
   with the `pipInstallHook`.
 - `pythonRelaxDepsHook` will relax Python dependencies restrictions for the package.
   See [example usage](#using-pythonrelaxdepshook).
+- `unittestCheckHook` will run tests with `python -m unittest discover`. See [example usage](#using-unittestcheckhook).
 
 ### Development mode {#development-mode}
 
diff --git a/pkgs/applications/audio/whipper/default.nix b/pkgs/applications/audio/whipper/default.nix
index f06907ad32f..dfe540f04e6 100644
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@@ -37,6 +37,7 @@ in python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
     docutils
+    setuptoolsCheckHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -64,14 +65,12 @@ in python3.pkgs.buildPythonApplication rec {
     export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
   '';
 
-  checkPhase = ''
-    runHook preCheck
+  preCheck = ''
     # disable tests that require internet access
     # https://github.com/JoeLametta/whipper/issues/291
     substituteInPlace whipper/test/test_common_accurip.py \
       --replace "test_AccurateRipResponse" "dont_test_AccurateRipResponse"
-    HOME=$TMPDIR ${python3.interpreter} -m unittest discover
-    runHook postCheck
+    export HOME=$TMPDIR
   '';
 
   passthru.tests.version = testers.testVersion {
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index b8d4c0a9163..95799f09cf4 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.0135";
+  version = "9.0.0180";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-xAIfGNJIPO9XoSbAQTRa36Tjln3y+oWQk0lADCnL25g=";
+    hash = "sha256-38l97auTi6cue457bfRHme5fvsAmvk1MT2va1E/qguw=";
   };
 
   enableParallelBuilding = true;
@@ -24,7 +24,7 @@ rec {
     description = "The most popular clone of the VI editor";
     homepage    = "http://www.vim.org";
     license     = licenses.vim;
-    maintainers = with maintainers; [ lovek323 equirosa ];
+    maintainers = with maintainers; [ das_j equirosa ];
     platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/applications/misc/haxor-news/default.nix b/pkgs/applications/misc/haxor-news/default.nix
index 9170af04e61..2f6df287197 100644
--- a/pkgs/applications/misc/haxor-news/default.nix
+++ b/pkgs/applications/misc/haxor-news/default.nix
@@ -52,11 +52,9 @@ buildPythonApplication rec {
   # will fail without pre-seeded config files
   doCheck = false;
 
-  checkInputs = [ mock ];
+  checkInputs = [ unittestCheckHook mock ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests -v
-  '';
+  unittestFlagsArray = [ "-s" "tests" "-v" ];
 
   meta = with lib; {
     homepage = "https://github.com/donnemartin/haxor-news";
diff --git a/pkgs/applications/misc/pyditz/default.nix b/pkgs/applications/misc/pyditz/default.nix
index c5f3143bedc..d986c13b84b 100644
--- a/pkgs/applications/misc/pyditz/default.nix
+++ b/pkgs/applications/misc/pyditz/default.nix
@@ -15,9 +15,7 @@ in buildPythonApplication rec {
   nativeBuildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ pyyaml six jinja2 cerberus_1_1 ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     homepage = "https://pythonhosted.org/pyditz/";
diff --git a/pkgs/applications/misc/topydo/default.nix b/pkgs/applications/misc/topydo/default.nix
index 352d21361b0..e7ca1a935bb 100644
--- a/pkgs/applications/misc/topydo/default.nix
+++ b/pkgs/applications/misc/topydo/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3Packages, fetchFromGitHub, glibcLocales }:
+{ lib, python3Packages, fetchFromGitHub, glibcLocales, unittestCheckHook }:
 
 with python3Packages;
 
@@ -22,16 +22,15 @@ buildPythonApplication rec {
     watchdog
   ];
 
-  checkInputs = [ mock freezegun pylint ];
+  checkInputs = [ unittestCheckHook mock freezegun pylint ];
 
   # Skip test that has been reported multiple times upstream without result:
   # bram85/topydo#271, bram85/topydo#274.
-  checkPhase = ''
+  preCheck = ''
     substituteInPlace test/test_revert_command.py --replace 'test_revert_ls' 'dont_test_revert_ls'
-    python -m unittest discover
   '';
 
-  LC_ALL="en_US.UTF-8";
+  LC_ALL = "en_US.UTF-8";
 
   meta = with lib; {
     description = "A cli todo application compatible with the todo.txt format";
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index fb4c326be5b..f0fe6e1551b 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -531,7 +531,6 @@ buildStdenv.mkDerivation ({
             header "separating debug info from $i (build ID $id)"
             mkdir -p "$dst/''${id:0:2}"
             $OBJCOPY --only-keep-debug "$i" "$dst/''${id:0:2}/''${id:2}.debug"
-            $STRIP --strip-debug "$i"
 
             # Also a create a symlink <original-name>.debug.
             ln -sfn ".build-id/''${id:0:2}/''${id:2}.debug" "$dst/../$(basename "$i")"
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/default.nix b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
index 93160a6e7b5..660550f39d4 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchgit, wrapGAppsHook, autoreconfHook, bison, flex
+{ stdenv, lib, fetchgit, fetchurl, wrapGAppsHook, autoreconfHook, bison, flex
 , curl, gtk3, pkg-config, python3, shared-mime-info
 , glib-networking, gsettings-desktop-schemas
 
@@ -110,6 +110,11 @@ in stdenv.mkDerivation rec {
 
   patches = [
     ./mime.patch
+    # fix build with perl 5.36+
+    (fetchurl {
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/packages/claws-mail/trunk/20cope_with_fix_for_1009149.patch";
+      hash = "sha256-/WBslmoFvja2v2GEBntxvNtG0I3xtkUUqXO5gl5pqqs=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 3fd055e7148..20cc283af98 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.37.1";
+  version = "2.37.2";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-yBYsa4uPHF23BqsBtO4p4xBhGCE13CfEhgIkquwbNQA=";
+    sha256 = "sha256-HD2cghxFOOem2sMKSvi9jc/k9lH5VHTFJrUvg0BtsAM=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/applications/window-managers/gamescope/default.nix b/pkgs/applications/window-managers/gamescope/default.nix
index 2d271893b84..237a33d5ca3 100644
--- a/pkgs/applications/window-managers/gamescope/default.nix
+++ b/pkgs/applications/window-managers/gamescope/default.nix
@@ -15,7 +15,7 @@
 , udev
 , pixman
 , libinput
-, libseat
+, seatd
 , xwayland
 , glslang
 , stb
@@ -65,7 +65,7 @@ stdenv.mkDerivation {
     wayland-protocols
     wlroots
     xwayland
-    libseat
+    seatd
     libinput
     libxkbcommon
     udev
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index cdd07d6b2ef..b54983986db 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -365,7 +365,7 @@ stdenv.mkDerivation {
     ##
     + extraBuildCommands;
 
-  inherit dynamicLinker expand-response-params;
+  inherit dynamicLinker;
 
   # for substitution in utils.bash
   expandResponseParams = "${expand-response-params}/bin/expand-response-params";
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 047cdf6a491..b9dc9fc9a72 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -157,6 +157,8 @@ stdenv.mkDerivation {
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
 
+    inherit expand-response-params;
+
     inherit nixSupport;
   };
 
@@ -540,7 +542,6 @@ stdenv.mkDerivation {
         (name: value: "echo ${toString value} >> $out/nix-support/${name}")
         nixSupport);
 
-  inherit expand-response-params;
 
   # for substitution in utils.bash
   expandResponseParams = "${expand-response-params}/bin/expand-response-params";
diff --git a/pkgs/build-support/rust/hooks/default.nix b/pkgs/build-support/rust/hooks/default.nix
index d3369245707..652b074c302 100644
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@@ -75,11 +75,8 @@ in {
           ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
             [target."${shortTarget}"]
             "linker" = "${ccForHost}"
-            ${# https://github.com/rust-lang/rust/issues/46651#issuecomment-433611633
-            lib.optionalString (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isAarch64) ''
-              "rustflags" = [ "-C", "target-feature=+crt-static", "-C", "link-arg=-lgcc" ]
-            ''}
           ''}
+          "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
         '';
       };
     } ./cargo-setup-hook.sh) {};
diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index 593a5f64862..be94af545be 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -2,7 +2,6 @@ export NIX_SET_BUILD_ID=1
 export NIX_LDFLAGS+=" --compress-debug-sections=zlib"
 export NIX_CFLAGS_COMPILE+=" -ggdb -Wa,--compress-debug-sections"
 export RUSTFLAGS+=" -g"
-dontStrip=1
 
 fixupOutputHooks+=(_separateDebugInfo)
 
@@ -35,7 +34,6 @@ _separateDebugInfo() {
         # firmware blobs in QEMU.)
         (
             $OBJCOPY --only-keep-debug "$i" "$dst/${id:0:2}/${id:2}.debug"
-            $STRIP --strip-debug "$i"
 
             # Also a create a symlink <original-name>.debug.
             ln -sfn ".build-id/${id:0:2}/${id:2}.debug" "$dst/../$(basename "$i")"
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 80bc064ced7..9bd7b24cab5 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -38,26 +38,27 @@ _doStrip() {
 stripDirs() {
     local cmd="$1"
     local ranlibCmd="$2"
-    local dirs="$3"
+    local paths="$3"
     local stripFlags="$4"
-    local dirsNew=
+    local pathsNew=
 
-    local d
-    for d in ${dirs}; do
-        if [ -d "$prefix/$d" ]; then
-            dirsNew="${dirsNew} $prefix/$d "
+    local p
+    for p in ${paths}; do
+        if [ -e "$prefix/$p" ]; then
+            pathsNew="${pathsNew} $prefix/$p"
         fi
     done
-    dirs=${dirsNew}
+    paths=${pathsNew}
 
-    if [ -n "${dirs}" ]; then
-        echo "stripping (with command $cmd and flags $stripFlags) in$dirs"
-        find $dirs -type f -exec $cmd $stripFlags '{}' \; 2>/dev/null
+    if [ -n "${paths}" ]; then
+        echo "stripping (with command $cmd and flags $stripFlags) in $paths"
+        # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
+        find $paths -type f -a '!' -wholename "$prefix/lib/debug/*" -exec $cmd $stripFlags '{}' \; 2>/dev/null
         # 'strip' does not normally preserve archive index in .a files.
         # This usually causes linking failures against static libs like:
         #   ld: ...-i686-w64-mingw32-stage-final-gcc-13.0.0-lib/i686-w64-mingw32/lib/libstdc++.dll.a:
         #     error adding symbols: archive has no index; run ranlib to add one
         # Restore the index by running 'ranlib'.
-        find $dirs -name '*.a' -type f -exec $ranlibCmd '{}' \; 2>/dev/null
+        find $paths -name '*.a' -type f -exec $ranlibCmd '{}' \; 2>/dev/null
     fi
 }
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index b149f448da7..7cb13e0535e 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,18 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2022a";
+  version = "2022b";
 
-  srcs =
-    [ (fetchurl {
-        url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-        sha256 = "0r0nhwpk9nyxj5kkvjy58nr5d85568m04dcb69c4y3zmykczyzzg";
-      })
-      (fetchurl {
-        url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-        sha256 = "1iysv8fdkm79k8wh8jizmjmq075q4qjhk090vxjy57my6dz5wmzq";
-      })
-    ];
+  srcs = [
+    (fetchurl {
+      url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
+      hash = "sha256-9ZDq8Eo5UkVCbCvk+uccFDrqXOvBEIi3oKVwRGHfOX0=";
+    })
+    (fetchurl {
+      url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
+      hash = "sha256-urINlD5ZoyGENfSNhopOVS8Y1tfz3RKGYMVmDIC4oF8=";
+    })
+  ];
 
   sourceRoot = ".";
 
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index ca3a89af180..f5b68babb2e 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -74,8 +74,8 @@ let majorVersion = "11";
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
 
       ++ optional (stdenv.isDarwin && stdenv.isAarch64) (fetchpatch {
-        url = "https://github.com/fxcoudert/gcc/compare/releases/gcc-11.1.0...gcc-11.1.0-arm-20210504.diff";
-        sha256 = "sha256-JqCGJAfbOxSmkNyq49aFHteK/RFsCSLQrL9mzUCnaD0=";
+        url = "https://github.com/fxcoudert/gcc/compare/releases/gcc-11.2.0...gcc-11.2.0-arm-20211201.diff";
+        sha256 = "sha256-z62s/cXuH9Kgq/oD/OiiZ8LWnX1xl1D43sONnwaEW1w=";
       })
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
diff --git a/pkgs/development/compilers/gcc/common/strip-attributes.nix b/pkgs/development/compilers/gcc/common/strip-attributes.nix
index 997c068cba6..9756c468b71 100644
--- a/pkgs/development/compilers/gcc/common/strip-attributes.nix
+++ b/pkgs/development/compilers/gcc/common/strip-attributes.nix
@@ -8,7 +8,9 @@
   # Example ARM breakage by x86_64 strip: https://bugs.gentoo.org/697428
   #
   # Let's recap the file layout for directories with object files for a
-  # cross-compiler (host != target):
+  # cross-compiler:
+  #
+  # $out (host != target)
   # `- bin: HOST
   #    lib/*.{a,o}: HOST
   #      `- gcc/<TARGET>/<VERSION>/*.{a,o}: TARGET
@@ -17,10 +19,16 @@
   #  `- libexec/: HOST
   #  `- <TARGET>/: TARGET
   #
-  # (host == target) has identical directory layout.
+  # $out (host == target) has identical directory layout.
+  #
+  # $lib (host != target):
+  # `- <TARGET>/lib/*.{la,so}: TARGET
+  #
+  # $lib (host == target):
+  # `- lib/*.{la,so}: HOST
 
   # The rest of stripDebugList{Host,Target} will be populated in
-  # postInstall.
+  # postInstall to disambiguate lib/ object files.
   stripDebugList = [ "bin" "libexec" ];
   stripDebugListTarget = [ stdenv.targetPlatform.config ];
 
@@ -32,21 +40,28 @@
       shopt -s nullglob
 
       pushd $out
-
-      local -ar hostFiles=(
-        lib{,32,64}/*.{a.o}
+      local -ar outHostFiles=(
+        lib{,32,64}/*.{a,o,so*}
         lib{,32,64}/gcc/${stdenv.targetPlatform.config}/*/plugin
       )
-      local -ar targetFiles=(
-        lib{,32,64}/gcc/${stdenv.targetPlatform.config}/*/*.{a.o}
+      local -ar outTargetFiles=(
+        lib{,32,64}/gcc/${stdenv.targetPlatform.config}/*/*.{a,o,so*}
       )
+      popd
 
-      stripDebugList="$stripDebugList ''${hostFiles[*]}"
-      stripDebugListTarget="$stripDebugListTarget ''${targetFiles[*]}"
-
+      pushd $lib
+      local -ar libHostFiles=(
+        lib{,32,64}/*.{a,o,so*}
+      )
+      local -ar libTargetFiles=(
+        lib{,32,64}/${stdenv.targetPlatform.config}/*.{a,o,so*}
+      )
       popd
 
       eval "$oldOpts"
+
+      stripDebugList="$stripDebugList ''${outHostFiles[*]} ''${libHostFiles[*]}"
+      stripDebugListTarget="$stripDebugListTarget ''${outTargetFiles[*]} ''${libTargetFiles[*]}"
     }
     updateDebugListPaths
   '';
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index b1f12304a06..c3716c1556a 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = "sdk-${version}";
-    sha256 = "sha256-YLn/Mxuk6mXPGtBBgfwky5Nl1TCAW6i2g+AZLzqVz+A=";
+    hash = "sha256-sjidkiPtRADhyOEKDb2cHCBXnFjLwk2F5Lppv5/fwNQ=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
diff --git a/pkgs/development/compilers/rust/1_62.nix b/pkgs/development/compilers/rust/1_63.nix
index 6a68c0e14d6..a33576f9426 100644
--- a/pkgs/development/compilers/rust/1_62.nix
+++ b/pkgs/development/compilers/rust/1_63.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.62.1";
-  rustcSha256 = "sha256-cqy+b/zZT1mDgqdDCw2F7o9nnm0LJ/P1Zu0cFsl4Ez8=";
+  rustcVersion = "1.63.0";
+  rustcSha256 = "1l4rrbzhxv88pnfq94nbyb9m6lfnjwixma3mwjkmvvs2aqlq158z";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
@@ -37,25 +37,25 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.61.0";
+  bootstrapVersion = "1.62.1";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "b15eb0ad44b7253e0b5b1a8cd285feb10e9fb0402840dba9a13112c3349a4b39";
-    x86_64-unknown-linux-gnu = "066b324239d30787ce64142d7e04912f2e1850c07db3b2354d8654e02ff8b23a";
-    x86_64-unknown-linux-musl = "0904f6b769ae28c259e0e25a41e99290a4ae2a36bca63ae153790b2ebbc427bf";
-    arm-unknown-linux-gnueabihf = "cc32705cd1b583aaac74e6663f71392131dc0355a0f484cb56f0378b71ea7ebc";
-    armv7-unknown-linux-gnueabihf = "2782ec75ea4abb402513e2e57becc6c14e67b492d57228cddedef6db0853b165";
-    aarch64-unknown-linux-gnu = "261cd47bc3c98c9f97b601d1ad2a7d9b33c9ea63c9a351119c2f6d4e82f5d436";
-    aarch64-unknown-linux-musl = "feb79985cb161a10b252236852df8db3bf3593c78905b84c7e94cd4454327e47";
-    x86_64-apple-darwin = "d851f1a473926a5d8f111ed08002047a5dc4ad944a5b7f8d5d2f1f266b51e66a";
-    aarch64-apple-darwin = "2dbafd13d007543aada47179fa273f9a3865f27e0a07bd69be61801232a0819e";
-    powerpc64le-unknown-linux-gnu = "6d5cd579b68a2adc20384406c69a92beaaf4941056e126ff0ed1ec2f3a4e721f";
-    riscv64gc-unknown-linux-gnu = "3d0f3b1a8522e09fffdf920a061794ac3107410eb1fe8f5d62a7aae3c6dcb81e";
-    mips64el-unknown-linux-gnuabi64 = "6ed5b6492e68f45488108abd06dbcd4b89c46cdbd4715331bb11e88f18500815";
+    i686-unknown-linux-gnu = "1669163ffe01e252ffb62da7d84949378fc274931a65ac827d54059a5ffc542c";
+    x86_64-unknown-linux-gnu = "dd7d82b8fa8eae59729e1c31fe59a9de6ee61d08ab40ce016185653beebe04d2";
+    x86_64-unknown-linux-musl = "32bee487074b105e2582cddce35934a6019eec74bae3f9300fdc3edfcf5b66d4";
+    arm-unknown-linux-gnueabihf = "5c735e8174d394936d7b499c2d147ddadf3c4d77e652d1e0b0a72d9d09f81ea4";
+    armv7-unknown-linux-gnueabihf = "26fa731385f1a71211ba8e3c94f3bb3b1a82bde89f8d4dcf75b4b463b57b0f88";
+    aarch64-unknown-linux-gnu = "1311fa8204f895d054c23a3481de3b158a5cd3b3a6338761fee9cdf4dbf075a5";
+    aarch64-unknown-linux-musl = "73bbab4d8a9e3c416035d40406e656ab37e785df35fa069a33af52e931a24b12";
+    x86_64-apple-darwin = "0a04dcf2b521239826f3eaa66d77169d91e68087ccc3107b54e8aba7c02c9adf";
+    aarch64-apple-darwin = "6d1671ea31b05cab5e2587cc2b295b3e7232b0135f0977355618e2a01933ff0a";
+    powerpc64le-unknown-linux-gnu = "1d3248e1a673cda87cf443cd4334ff5fb53e6f87c72d3587b07e5c0cb507f3ae";
+    riscv64gc-unknown-linux-gnu = "fd378d0bf866689e8111aba0e2b020da87f32f70fb11d98a575d42dc05978c2a";
+    mips64el-unknown-linux-gnuabi64 = "b7c47dd94728161aa96762fb7bc51b6ab0feba7c5215d06eaea5b78649815a96";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_62;
+  selectRustPackage = pkgs: pkgs.rust_1_63;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index 1145f4da8f6..6c3751cbb57 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, makeWrapper, bash, curl, darwin, zlib
+, autoPatchelfHook, gcc
 , version
 , src
 , platform
@@ -31,7 +32,9 @@ rec {
       license = [ licenses.mit licenses.asl20 ];
     };
 
+    nativeBuildInputs = lib.optional (!stdenv.isDarwin) autoPatchelfHook;
     buildInputs = [ bash ]
+      ++ lib.optionals (!stdenv.isDarwin) [ gcc.cc.lib zlib ]
       ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
@@ -42,24 +45,6 @@ rec {
       ./install.sh --prefix=$out \
         --components=${installComponents}
 
-      ${optionalString (stdenv.isLinux && bootstrapping) (''
-        patchelf \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-          "$out/bin/rustc"
-        '' + optionalString (lib.versionAtLeast version "1.46")
-        # rustc bootstrap needs libz starting from 1.46
-        ''
-          ln -s ${zlib}/lib/libz.so.1 $out/lib/libz.so.1
-          ln -s ${zlib}/lib/libz.so $out/lib/libz.so
-        '' + ''
-        patchelf \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-          "$out/bin/rustdoc"
-        patchelf \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-          "$out/bin/cargo"
-      '')}
-
       # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
       # (or similar) here. It causes strange effects where rustc loads
       # the wrong libraries in a bootstrap-build causing failures that
@@ -83,8 +68,11 @@ rec {
       license = [ licenses.mit licenses.asl20 ];
     };
 
-    nativeBuildInputs = [ makeWrapper ];
-    buildInputs = [ bash ] ++ lib.optional stdenv.isDarwin Security;
+    nativeBuildInputs = [ makeWrapper ]
+      ++ lib.optional (!stdenv.isDarwin) autoPatchelfHook;
+    buildInputs = [ bash ]
+      ++ lib.optional (!stdenv.isDarwin) gcc.cc.lib
+      ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
       patchShebangs .
@@ -95,12 +83,6 @@ rec {
       ./install.sh --prefix=$out \
         --components=cargo
 
-      ${optionalString (stdenv.isLinux && bootstrapping) ''
-        patchelf \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-          "$out/bin/cargo"
-      ''}
-
       wrapProgram "$out/bin/cargo" \
         --suffix PATH : "${rustc}/bin"
     '';
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index b50f36f0d9b..2d8361eb2a4 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -72,5 +72,7 @@ rustPlatform.buildRustPackage {
     maintainers = with maintainers; [ retrry ];
     license = [ licenses.mit licenses.asl20 ];
     platforms = platforms.unix;
+    # weird segfault in a build script
+    broken = stdenv.targetPlatform.isMusl && !stdenv.targetPlatform.isStatic;
   };
 }
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index a996f987bed..cfed71f0e80 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -87,6 +87,10 @@ in stdenv.mkDerivation rec {
     "${setBuild}.cxx=${cxxForBuild}"
     "${setHost}.cxx=${cxxForHost}"
     "${setTarget}.cxx=${cxxForTarget}"
+
+    "${setBuild}.crt-static=${lib.boolToString stdenv.buildPlatform.isStatic}"
+    "${setHost}.crt-static=${lib.boolToString stdenv.hostPlatform.isStatic}"
+    "${setTarget}.crt-static=${lib.boolToString stdenv.targetPlatform.isStatic}"
   ] ++ optionals (!withBundledLLVM) [
     "--enable-llvm-link-shared"
     "${setBuild}.llvm-config=${llvmSharedForBuild.dev}/bin/llvm-config"
@@ -188,8 +192,5 @@ in stdenv.mkDerivation rec {
     maintainers = with maintainers; [ madjar cstrahan globin havvy ];
     license = [ licenses.mit licenses.asl20 ];
     platforms = platforms.linux ++ platforms.darwin;
-    # rustc can't generate binaries for dynamically linked Musl.
-    # https://github.com/NixOS/nixpkgs/issues/179242
-    broken = stdenv.targetPlatform.isMusl && !stdenv.targetPlatform.isStatic;
   };
 }
diff --git a/pkgs/development/interpreters/evcxr/default.nix b/pkgs/development/interpreters/evcxr/default.nix
index 97cae408925..1b76ecb6854 100644
--- a/pkgs/development/interpreters/evcxr/default.nix
+++ b/pkgs/development/interpreters/evcxr/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evcxr";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "evcxr";
     rev = "v${version}";
-    sha256 = "sha256-sD/eykXoeJq43o3xyFx2VIoH+xZrMmb6vZKVt4CO7B4=";
+    sha256 = "sha256-n9wDO4HIWLINbqGVxaZyAEFVDLLnSpQLKlFf20jLq6o=";
   };
 
-  cargoSha256 = "sha256-eySdhzavm9NGv2xjgdq/C2iv6lxdulhgYNs9ehnSzKQ=";
+  cargoSha256 = "sha256-zdIJb9fXRByyAJ32RL9lQh6oS1K78IlZfWdJyj+MMZM=";
 
   RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
 
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index dca7d9bb0db..44cf836fc9c 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -430,11 +430,6 @@ in with passthru; stdenv.mkDerivation {
     # This allows build Python to import host Python's sysconfigdata
     mkdir -p "$out/${sitePackages}"
     ln -s "$out/lib/${libPrefix}/"_sysconfigdata*.py "$out/${sitePackages}/"
-
-    # debug info can't be separated from a static library and would otherwise be
-    # left in place by a separateDebugInfo build. force its removal here to save
-    # space in output.
-    $STRIP -S $out/lib/${libPrefix}/config-*/libpython*.a || true
     '' + optionalString stripConfig ''
     rm -R $out/bin/python*-config $out/lib/python*/config-*
     '' + optionalString stripIdlelib ''
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 34c6a72662d..0f175c90920 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -164,6 +164,14 @@ in rec {
       };
     } ./setuptools-check-hook.sh) {};
 
+  unittestCheckHook = callPackage ({ }:
+    makeSetupHook {
+      name = "unittest-check-hook";
+      substitutions = {
+        inherit pythonCheckInterpreter;
+      };
+    } ./unittest-check-hook.sh) {};
+
   venvShellHook = disabledIf (!isPy3k) (callPackage ({ }:
     makeSetupHook {
       name = "venv-shell-hook";
diff --git a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
new file mode 100644
index 00000000000..3485fcc7945
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
@@ -0,0 +1,29 @@
+# Setup hook for unittest.
+echo "Sourcing unittest-check-hook"
+
+unittestCheckPhase() {
+    echo "Executing unittestCheckPhase"
+    runHook preCheck
+
+    eval "@pythonCheckInterpreter@ -m unittest discover $unittestFlagsArray"
+
+    runHook postCheck
+    echo "Finished executing unittestCheckPhase"
+}
+
+if [ -z "${dontUseUnittestCheck-}" ] && [ -z "${installCheckPhase-}" ]; then
+    echo "Using unittestCheckPhase"
+    preDistPhases+=" unittestCheckPhase"
+
+    # It's almost always the case that setuptoolsCheckPhase should not be ran
+    # when the unittestCheckHook is being ran
+    if [ -z "${useSetuptoolsCheck-}" ]; then
+        dontUseSetuptoolsCheck=1
+
+        # Remove command if already injected into preDistPhases
+        if [[ "$preDistPhases" =~ "setuptoolsCheckPhase" ]]; then
+            echo "Removing setuptoolsCheckPhase"
+            preDistPhases=${preDistPhases/setuptoolsCheckPhase/}
+        fi
+    fi
+fi
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index db611f66ad6..236508d6735 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -19,7 +19,6 @@ let
 
   generic = { version, sha256 }: let
     ver = version;
-    tag = ver.gitTag;
     atLeast30 = lib.versionAtLeast ver.majMin "3.0";
     self = lib.makeOverridable (
       { stdenv, buildPackages, lib
@@ -225,8 +224,8 @@ let
           ++ op useBaseRuby baseRuby;
 
         meta = with lib; {
-          description = "The Ruby language";
-          homepage    = "http://www.ruby-lang.org/en/";
+          description = "An object-oriented language for quick and easy programming";
+          homepage    = "https://www.ruby-lang.org/";
           license     = licenses.ruby;
           maintainers = with maintainers; [ vrthra manveru marsam ];
           platforms   = platforms.all;
@@ -248,11 +247,6 @@ let
             ruby = self;
           }) withPackages gems;
 
-          # deprecated 2016-09-21
-          majorVersion = ver.major;
-          minorVersion = ver.minor;
-          teenyVersion = ver.tiny;
-          patchLevel = ver.patchLevel;
         } // lib.optionalAttrs useBaseRuby {
           inherit baseRuby;
         };
diff --git a/pkgs/development/interpreters/ruby/patchsets.nix b/pkgs/development/interpreters/ruby/patchsets.nix
index a0e2b90b0f4..bdc4cf3690f 100644
--- a/pkgs/development/interpreters/ruby/patchsets.nix
+++ b/pkgs/development/interpreters/ruby/patchsets.nix
@@ -2,14 +2,19 @@
 
 {
   "2.7.6" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-more-detailed-stacktrace.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-with-openssl-dir-option.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-fix-broken-tests-caused-by-ad.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-more-detailed-stacktrace.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/05-malloc-trim.patch"
   ];
   "3.0.4" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-malloc-trim.patch"
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-fix-with-openssl-dir-option.patch"
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/03-malloc-trim.patch"
   ];
-  "3.1.2" = ops useRailsExpress [ # no patches yet (2021-12-25)
+  "3.1.2" = ops useRailsExpress [
+    "${patchSet}/patches/ruby/3.1/head/railsexpress/01-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/3.1/head/railsexpress/02-malloc-trim.patch"
   ];
 }
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 6a8e171ee6e..257d589df6c 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.2.26";
+  version = "3.3.20";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    sha256 = "sha256-9wa6lOWnua8zBblQKRgjjiTVPYp2TW0n7XOvgW7u1e8=";
+    sha256 = "sha256-VTUMZ2mqbszM7uXOYV6Grg7dkeGAGVXYjBX0hA/vOTg=";
   };
 
   patches = [
diff --git a/pkgs/development/interpreters/ruby/rvm-patchsets.nix b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
index 88b75a5aa06..51c0a9a7dfb 100644
--- a/pkgs/development/interpreters/ruby/rvm-patchsets.nix
+++ b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
@@ -3,6 +3,6 @@
 fetchFromGitHub {
   owner  = "skaes";
   repo   = "rvm-patchsets";
-  rev    = "0251817e2b9d5f73370bbbb12fdf7f7089bd1ac3";
-  sha256 = "1biiq5xzzdfb4hr1sgmx14i2nr05xa9w21pc7dl8c5n4f2ilg8ss";
+  rev    = "a6429bb1a7fb9b5798c22f43338739a6c192b42d";
+  sha256 = "sha256-NpSa+uGQA1rfHNcLzPNTK65J+Wk9ZlzhHFePDA4uuo0=";
 }
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 8fb12fc0203..0316deee7bc 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -1,5 +1,5 @@
 { config, lib, stdenv, fetchurl, gettext, meson, ninja, pkg-config, perl, python3
-, libiconv, zlib, libffi, pcre, libelf, gnome, libselinux, bash, gnum4, gtk-doc, docbook_xsl, docbook_xml_dtd_45
+, libiconv, zlib, libffi, pcre, libelf, gnome, libselinux, bash, gnum4, gtk-doc, docbook_xsl, docbook_xml_dtd_45, libxslt
 # use util-linuxMinimal to avoid circular dependency (util-linux, systemd, glib)
 , util-linuxMinimal ? null
 , buildPackages
@@ -124,7 +124,7 @@ stdenv.mkDerivation rec {
     (buildPackages.meson.override {
       withDarwinFrameworksGtkDocPatch = stdenv.isDarwin;
     })
-    ninja pkg-config perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 libxml2
+    ninja pkg-config perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 libxml2 libxslt
   ];
 
   propagatedBuildInputs = [ zlib libffi gettext libiconv ];
@@ -135,6 +135,8 @@ stdenv.mkDerivation rec {
     "-Dgtk_doc=${boolToString (stdenv.hostPlatform == stdenv.buildPlatform)}"
     "-Dnls=enabled"
     "-Ddevbindir=${placeholder "dev"}/bin"
+  ] ++ optionals (!stdenv.isDarwin) [
+    "-Dman=true"                # broken on Darwin
   ];
 
   NIX_CFLAGS_COMPILE = toString [
@@ -167,10 +169,25 @@ stdenv.mkDerivation rec {
     # This file is *included* in gtk3 and would introduce runtime reference via __FILE__.
     sed '1i#line 1 "${pname}-${version}/include/glib-2.0/gobject/gobjectnotifyqueue.c"' \
       -i "$dev"/include/glib-2.0/gobject/gobjectnotifyqueue.c
+    for i in $bin/bin/*; do
+      moveToOutput "share/bash-completion/completions/''${i##*/}" "$bin"
+    done
+    for i in $dev/bin/*; do
+      moveToOutput "share/bash-completion/completions/''${i##*/}" "$dev"
+    done
   '' + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     cp -r ${buildPackages.glib.devdoc} $devdoc
   '';
 
+  # Move man pages to the same output as their binaries (needs to be
+  # done after preFixupHooks which moves man pages too - in
+  # _multioutDocs)
+  postFixup = ''
+    for i in $dev/bin/*; do
+      moveToOutput "share/man/man1/''${i##*/}.1.*" "$dev"
+    done
+  '';
+
   checkInputs = [ tzdata desktop-file-utils shared-mime-info ];
 
   preCheck = optionalString doCheck ''
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index ba782321559..f815e1eaa47 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -127,15 +127,6 @@ callPackage ./common.nix { inherit stdenv; } {
       ln -sf $out/lib/libdl.so.2 $out/lib/libdl.so
       ln -sf $out/lib/libutil.so.1 $out/lib/libutil.so
       touch $out/lib/libpthread.a
-    ''
-      # For some reason these aren't stripped otherwise and retain reference
-      # to bootstrap-tools; on cross-arm this stripping would break objects.
-    + lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
-
-      for i in "$out"/lib/*.a; do
-          [ "$i" = "$out/lib/libm.a" ] || $STRIP -S "$i"
-      done
-    '' + ''
 
       # Put libraries for static linking in a separate output.  Note
       # that libc_nonshared.a and libpthread_nonshared.a are required
diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index a49e0fad215..d0e1399b6aa 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -5,23 +5,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "gnu-efi";
-  version = "3.0.14";
+  version = "3.0.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnu-efi/${pname}-${version}.tar.bz2";
-    sha256 = "tztkOg1Wl9HzltdDFEjoht2AVmh4lXjj4aKCd8lShDU=";
+    sha256 = "sha256-kxole5xcG6Zf9Rnxg3PEOKJoJfLbeGaxY+ltGxaPIOo=";
   };
 
-  patches = [
-    # Pull fix pending upstream inclusion for parallel builds
-    #  https://sourceforge.net/p/gnu-efi/patches/84/
-    (fetchurl {
-      name = "parallel-build.patch";
-      url = "https://sourceforge.net/p/gnu-efi/patches/84/attachment/0001-lib-Makefile-add-.o-file-dependency-on-libsubdirs-ta.patch";
-      sha256 = "sha256-+2UwV2lopdB/tazib1BLzO1E3GgB1L8dZsSQKWVoLwA=";
-    })
-  ];
-
   buildInputs = [ pciutils ];
 
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 21e818de867..226b91b0ce5 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -22,11 +22,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.7.6";
+  version = "3.7.7";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "1zv2097v9f6f4c66q7yn3c6gggjk9jz38095ma7v3gs5lccmf1kp";
+    sha256 = "sha256-vpFD0NWOq2TbqbdxFKqvrFKbbA1+gd5r3xybWQJ9IQY=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 079caf85da9..9b90f912912 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-cR6r9d1mG5sEvp7cms4qe8Ax9r2dN6do0C0O/e8Qj18=";
+    hash = "sha256-Nh1OrkfOkl26DqVpr0DntSxkXEri5l5WIb8bbN2LDp4=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gsm/default.nix b/pkgs/development/libraries/gsm/default.nix
index f70a748a20e..ecf2d0e5ba5 100644
--- a/pkgs/development/libraries/gsm/default.nix
+++ b/pkgs/development/libraries/gsm/default.nix
@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gsm";
-  version = "1.0.19";
+  version = "1.0.20";
 
   src = fetchurl {
     url = "http://www.quut.com/gsm/${pname}-${version}.tar.gz";
-    sha256 = "1xkha9ss5g5qnfaybi8il0mcvp8knwg9plgh8404vh58d0pna0s9";
+    sha256 = "sha256-YxXDhRi4HomcP8LtRjzGI68pxcIxpIwTeyQwIjSukL8=";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/gsound/default.nix b/pkgs/development/libraries/gsound/default.nix
index ddbfc307b2d..7dbe5cd2bbf 100644
--- a/pkgs/development/libraries/gsound/default.nix
+++ b/pkgs/development/libraries/gsound/default.nix
@@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
     description = "Small library for playing system sounds";
     maintainers = teams.gnome.members;
     license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 6d940362a21..0fbaca219de 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -98,13 +98,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.20.1";
+  version = "1.20.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0j1q89dl8369djibc5p27lyj8y8p4maplmdzlryvrw0ib77w5lq9";
+    sha256 = "sha256-ehHBO1XdHSOG3ZAiGeQcv83ajh4Ko+c4GGyVB0s12k8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index c9e9c7f3248..a53ffb4f1b3 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-base";
-  version = "1.20.1";
+  version = "1.20.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0162ly7pscymq6bsf1d5fva2k9s16zvfwyi1q6z4yfd97d0sdn4n";
+    sha256 = "sha256-fjCz3YGnA4D/dVT5mEcdaZb/drvm/FRHCW+FHiRHPJ8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 662c3281b03..41acd079583 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer";
-  version = "1.20.1";
+  version = "1.20.3";
 
   outputs = [
     "bin"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0cghi6n4nhdbajz3wqcgbh5xm94myvnqgsi9g2bz9n1s9904l2fy";
+    sha256 = "sha256-YH2vZLu9X7GK+dF+IcDSLE1wL//oOyPLItGxryyiOio=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index acb12b78341..a221231da68 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -6,6 +6,8 @@
 , pkg-config
 , gstreamer
 , gst-plugins-base
+, gst-plugins-bad
+, gst-rtsp-server
 , python3
 , gobject-introspection
 , json-glib
@@ -13,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.20.1";
+  version = "1.20.3";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0asbapgf485h2gqq0sn9c4qknwi0ccpraf1685ixp2sv23pwgwc1";
+    sha256 = "sha256-u71F6tcDNn6o9L6bPAgte2K+9HskCjkIPyeETih1jEc=";
   };
 
   outputs = [
@@ -50,6 +52,8 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [
     gstreamer
     gst-plugins-base
+    gst-plugins-bad
+    gst-rtsp-server
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 9d6f3c0f483..63d477d6f91 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.20.1";
+  version = "1.20.3";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1ps887yyj6jkj8a2613n43b4fbvynxwryinxvavi00cfnlhipkka";
+    sha256 = "sha256-X9iW3mn74kQh62sP+NL4tMPLo/MCXOrNMCFy85qKuqI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 18361f15ae8..e7b72fc34e0 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -49,13 +49,13 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch64);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.20.1";
+  version = "1.20.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1al4f35mx41cy2h6agvmsqkjfchsyfs0iyxzpv6pnl0xh9pqfriw";
+    sha256 = "sha256-+PPCBr9c2rwAlTkgtHs1da8O8V6fhxwLaWb20KpYaLc=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 31e127db083..94e4871622a 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.20.1";
+  version = "1.20.3";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1iwz7928yi48xia5kfkj54x5dfmhbj25g9125vainpmp6fv1z9wi";
+    sha256 = "sha256-P+3RBWD836obZGLL95o4xOe1fX85A1k5P8DO9tvyff4=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 8fe79bb7b8b..f32db821946 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.20.1";
+  version = "1.20.3";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "028maajlvfn96v3gqk2ws1k6w9hjfk7dsxnm84d73pnpi99bqia7";
+    sha256 = "sha256-7kAnGL6bEn8OXmbKTBtPQuSSbsk7owe3zMpdxsyXlMo=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index be8aaf5606e..c4d21c464f1 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.20.1";
+  version = "1.20.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "06fvgyjwcf4paqxgp1xmgd0d0glkxys7n818526k10wrw92m20s2";
+    sha256 = "sha256-jKogeJoJwwS0nPVj0zzKlCGxh1uE/MGH5KOF+gHWrv0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 80bcc43c587..75c8fa25e2e 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.20.1";
+  version = "1.20.3";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0dqiy8mhcpq3yla8dk69pkjid7hiv98ykvwskb4pk45g6z2zdyw7";
+    sha256 = "sha256-bumesxar3emtNwApFb2MOGeRj2/cdLfPKsTBrg1pC0U=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 8c67ef0a156..c9f8f83f0f8 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , pkg-config
 , glib
 , freetype
@@ -30,7 +31,7 @@
 }:
 
 let
-  version = "5.0.1";
+  version = "5.1.0";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -44,9 +45,17 @@ stdenv.mkDerivation {
     owner = "harfbuzz";
     repo = "harfbuzz";
     rev = version;
-    sha256 = "sha256-01hpSTesPpUO2T9v1sq3VvCSFEOMyaxbHhX0vS1ms/k=";
+    sha256 = "sha256-K6iScmg1vNfwb1UYqtXsnijLVpcC+am2ZL+W5bLFzsI=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "aarch64-test-narrowing.diff";
+      url = "https://github.com/harfbuzz/harfbuzz/commit/04d28d94e576aab099891e6736fd0088dfac3366.diff";
+      sha256 = "sha256-099GP8t1G0kyYl79A6xJhfyrs3WXYitvn+He7sEz+Oo=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs src/*.py test
   '' + lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/libcanberra/default.nix b/pkgs/development/libraries/libcanberra/default.nix
index 91b72030319..6cdadeac296 100644
--- a/pkgs/development/libraries/libcanberra/default.nix
+++ b/pkgs/development/libraries/libcanberra/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, fetchpatch, pkg-config, libtool
 , gtk2-x11, gtk3-x11 , gtkSupport ? null
 , libpulseaudio, gst_all_1, libvorbis, libcap
-, Carbon, CoreServices
+, Carbon, CoreServices, AppKit
 , withAlsa ? stdenv.isLinux, alsa-lib }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ] ++ (with gst_all_1; [ gstreamer gst-plugins-base ])
     ++ lib.optional (gtkSupport == "gtk2") gtk2-x11
     ++ lib.optional (gtkSupport == "gtk3") gtk3-x11
-    ++ lib.optionals stdenv.isDarwin [Carbon CoreServices]
+    ++ lib.optionals stdenv.isDarwin [ Carbon CoreServices AppKit ]
     ++ lib.optional stdenv.isLinux libcap
     ++ lib.optional withAlsa alsa-lib;
 
@@ -33,15 +33,19 @@ stdenv.mkDerivation rec {
       url = "http://git.0pointer.net/libcanberra.git/patch/?id=c0620e432650e81062c1967cc669829dbd29b310";
       sha256 = "0rc7zwn39yxzxp37qh329g7375r5ywcqcaak8ryd0dgvg8m5hcx9";
     })
+  ] ++ lib.optionals stdenv.isDarwin [
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/5a7965dfea7727d1ceedee46c7b0ccee9cb23468/audio/libcanberra/files/patch-configure.diff";
+      sha256 = "sha256-pEJy1krciUEg5BFIS8FJ4BubjfS/nt9aqi6BLnS1+4M=";
+      extraPrefix = "";
+    })
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/5a7965dfea7727d1ceedee46c7b0ccee9cb23468/audio/libcanberra/files/dynamic_lookup-11.patch";
+      sha256 = "sha256-nUjha2pKh5VZl0ZZzcr9NTo1TVuMqF4OcLiztxW+ofQ=";
+      extraPrefix = "";
+    })
   ];
 
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    patch -p0 < ${fetchpatch {
-      url = "https://raw.githubusercontent.com/macports/macports-ports/master/audio/libcanberra/files/patch-configure.diff";
-      sha256 = "1f7h7ifpqvbfhqygn1b7klvwi80zmpv3538vbmq7ql7bkf1q8h31";
-    }}
-  '';
-
   postInstall = ''
     for f in $out/lib/*.la; do
       sed 's|-lltdl|-L${libtool.lib}/lib -lltdl|' -i $f
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index b757e516573..6af1e5d8718 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
-  version = "1.12.1";
+  version = "1.13.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-HbukG8UW08p6vA2luGLv4+qKcBj6bpuXzp05QBsiQmw=";
+    sha256 = "sha256-nt8gBsyGpQVSeWR8OOySPRGoIe5NwsMDPo0g6O4jfNk=";
   };
 
   nativeBuildInputs = [ python3 ];
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index 181829156c9..4f687d41dd6 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -17,31 +17,15 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.42";
+  version = "1.45";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-/AfnD2xhX4xPWQqON6m43S4soelAj45gRZxnRSuSXiM=";
+    sha256 = "sha256-Vw+O5PtL/3t0lc/5IMJ1ACrqIUfpodIgwGghMmf4CiY=";
   };
 
-  # 1.42 breaks (some?) cross-compilation (e.g. x86_64 -> aarch64).
-  # Backporting this fix (merged in upstream master but no release cut) by David Michael <fedora.dm0@gmail.com> https://dev.gnupg.org/rE33593864cd54143db594c4237bba41e14179061c
-  patches = [ ./fix-1.42-cross-compilation.patch ];
-
   postPatch = ''
     sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
-  '' + lib.optionalString (stdenv.hostPlatform.isAarch32 && stdenv.buildPlatform != stdenv.hostPlatform) ''
-    ln -s lock-obj-pub.arm-unknown-linux-gnueabi.h src/syscfg/lock-obj-pub.linux-gnueabihf.h
-    ln -s lock-obj-pub.arm-unknown-linux-gnueabi.h src/syscfg/lock-obj-pub.linux-gnueabi.h
-  '' + lib.optionalString (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isMusl) ''
-    ln -s lock-obj-pub.x86_64-pc-linux-musl.h src/syscfg/lock-obj-pub.linux-musl.h
-  '' + lib.optionalString (stdenv.hostPlatform.isi686 && stdenv.hostPlatform.isMusl) ''
-    ln -s lock-obj-pub.i686-unknown-linux-gnu.h src/syscfg/lock-obj-pub.linux-musl.h
-  '' + lib.optionalString (stdenv.hostPlatform.isAarch32 && stdenv.hostPlatform.isMusl) ''
-    ln -s lock-obj-pub.arm-unknown-linux-gnueabi.h src/syscfg/lock-obj-pub.arm-unknown-linux-musleabihf.h
-    ln -s lock-obj-pub.arm-unknown-linux-gnueabi.h src/syscfg/lock-obj-pub.linux-musleabihf.h
-  '' + lib.optionalString (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isMusl) ''
-    ln -s lock-obj-pub.aarch64-unknown-linux-gnu.h src/syscfg/lock-obj-pub.linux-musl.h
   '';
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/libgpg-error/fix-1.42-cross-compilation.patch b/pkgs/development/libraries/libgpg-error/fix-1.42-cross-compilation.patch
deleted file mode 100644
index 6c3099f7214..00000000000
--- a/pkgs/development/libraries/libgpg-error/fix-1.42-cross-compilation.patch
+++ /dev/null
@@ -1,142 +0,0 @@
-diff --git a/src/gen-lock-obj.sh b/src/gen-lock-obj.sh
-index a710f0c..258eec6 100755
---- a/src/gen-lock-obj.sh
-+++ b/src/gen-lock-obj.sh
-@@ -1,136 +1,136 @@
- #! /bin/sh
- #
- # gen-lock-obj.sh - Build tool to construct the lock object.
- #
- # Copyright (C) 2020, 2021  g10 Code GmbH
- #
- # This file is part of libgpg-error.
- #
- # libgpg-error is free software; you can redistribute it and/or
- # modify it under the terms of the GNU Lesser General Public License
- # as published by the Free Software Foundation; either version 2.1 of
- # the License, or (at your option) any later version.
- #
- # libgpg-error is distributed in the hope that it will be useful, but
- # WITHOUT ANY WARRANTY; without even the implied warranty of
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- # Lesser General Public License for more details.
- #
- # You should have received a copy of the GNU Lesser General Public
- # License along with this program; if not, see <https://www.gnu.org/licenses/>.
- #
- 
- #
- # Following variables should be defined to invoke this script
- #
- #   CC
- #   OBJDUMP
- #   AWK
- #   ac_ext
- #   ac_object
- #   host
- #   LOCK_ABI_VERSION
- #
- # An example:
- #
- # LOCK_ABI_VERSION=1 host=x86_64-pc-linux-gnu host_alias=x86_64-linux-gnu \
- #     CC=$host_alias-gcc OBJDUMP=$host_alias-objdump ac_ext=c ac_objext=o \
- #     AWK=gawk ./gen-lock-obj.sh
- #
- 
--if test -n `echo -n`; then
-+if test -n "`echo -n`"; then
-     ECHO_C='\c'
-     ECHO_N=''
- else
-     ECHO_C=''
-     ECHO_N='-n'
- fi
- 
- if test "$1" = --disable-threads; then
-     cat <<EOF
- ## lock-obj-pub.$host.h - NO LOCK SUPPORT
- ## File created by gen-lock-obj.sh - DO NOT EDIT
- ## To be included by mkheader into gpg-error.h
- 
- /* Dummy object - no locking available.  */
- typedef struct
- {
-   long _vers;
- } gpgrt_lock_t;
- 
- #define GPGRT_LOCK_INITIALIZER {-1}
- EOF
- else
- AWK_VERSION_OUTPUT=$($AWK 'BEGIN { print PROCINFO["version"] }')
- if test -n "$AWK_VERSION_OUTPUT"; then
-     # It's GNU awk, which supports PROCINFO.
-     AWK_OPTION=--non-decimal-data
- fi
- 
- cat <<'EOF' >conftest.$ac_ext
- #include <pthread.h>
- pthread_mutex_t mtx = PTHREAD_MUTEX_INITIALIZER;
- EOF
- 
- if $CC -c conftest.$ac_ext; then :
-   ac_mtx_size=$($OBJDUMP -j .bss -t conftest.$ac_objext \
-          | $AWK $AWK_OPTION '
- /mtx$/ { mtx_size = int("0x" $5) }
- END { print mtx_size }')
- else
-     echo "Can't determine mutex size"
-     exit 1
- fi
- rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- 
- cat <<EOF
- ## lock-obj-pub.$host.h
- ## File created by gen-lock-obj.sh - DO NOT EDIT
- ## To be included by mkheader into gpg-error.h
- 
- typedef struct
- {
-   long _vers;
-   union {
-     volatile char _priv[$ac_mtx_size];
-     long _x_align;
-     long *_xp_align;
-   } u;
- } gpgrt_lock_t;
- 
- EOF
- 
- # FIXME: Support different alignment conditions of:
- #
- #     USE_16BYTE_ALIGNMENT
- #     USE_DOUBLE_FOR_ALIGNMENT
- #     USE_LONG_DOUBLE_FOR_ALIGNMENT
- #
- 
- echo ${ECHO_N} "#define GPGRT_LOCK_INITIALIZER {$LOCK_ABI_VERSION,{{${ECHO_C}"
- 
- i=0
- while test "$i" -lt $ac_mtx_size; do
-     if test "$i" -ne 0 -a "$(( $i % 8 ))" -eq 0; then
-         echo ' \'
-         echo ${ECHO_N} "                                    ${ECHO_C}"
-     fi
-     echo ${ECHO_N} "0${ECHO_C}"
-     if test "$i" -lt $(($ac_mtx_size - 1)); then
-         echo ${ECHO_N} ",${ECHO_C}"
-     fi
-     i=$(( i + 1 ))
- done
- fi
- 
- cat <<'EOF'
- }}}
- ##
- ## Local Variables:
- ## mode: c
- ## buffer-read-only: t
- ## End:
- ##
- EOF
- 
- exit 0
diff --git a/pkgs/development/libraries/libidn/default.nix b/pkgs/development/libraries/libidn/default.nix
index a84b617e4c0..83f69cfaa02 100644
--- a/pkgs/development/libraries/libidn/default.nix
+++ b/pkgs/development/libraries/libidn/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libidn";
-  version = "1.38";
+  version = "1.41";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/${pname}-${version}.tar.gz";
-    sha256 = "sha256-3gC4QPdXzTuxTdmiDVk2RzI13cugbUvC2oBGVLi78PY=";
+    sha256 = "sha256-iE1wY2S4Gr3Re+6Whtj/KudDHFoUZRBHxorfizH9iUU=";
   };
 
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];
diff --git a/pkgs/development/libraries/libjpeg-turbo/default.nix b/pkgs/development/libraries/libjpeg-turbo/default.nix
index c9a5197a6b9..ab08435721f 100644
--- a/pkgs/development/libraries/libjpeg-turbo/default.nix
+++ b/pkgs/development/libraries/libjpeg-turbo/default.nix
@@ -31,13 +31,13 @@ assert !(enableJpeg7 && enableJpeg8);  # pick only one or none, not both
 stdenv.mkDerivation rec {
 
   pname = "libjpeg-turbo";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "libjpeg-turbo";
     repo = "libjpeg-turbo";
     rev = version;
-    sha256 = "sha256-GbOYoCNAsOESXrEsBb6OHVB4TKhPUEU04PBp8qXVMug=";
+    sha256 = "sha256-1NRoVIL3zXX1D6iOf2FCrwBEcDW7TYFbdIbCTjY1m8Q=";
   };
 
   # This is needed by freeimage
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index be0a4fb9154..6eba2d0112e 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
   pname = "libjxl";
   version = "0.6.1";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "libjxl";
     repo = "libjxl";
diff --git a/pkgs/development/libraries/liblqr-1/default.nix b/pkgs/development/libraries/liblqr-1/default.nix
index 914cc0c2ab6..b9e6eeba0f3 100644
--- a/pkgs/development/libraries/liblqr-1/default.nix
+++ b/pkgs/development/libraries/liblqr-1/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "liblqr-1";
   version = "0.4.2";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "carlobaldassi";
     repo = "liblqr";
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index e136fc1a558..4df7ddaffb2 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.2";
+  version = "1.2.3";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-nvwAT50VkY1o+emOGU1V4DAWjzO7Z8PnpUW3QMntbQo=";
+    hash = "sha256-6Rbqm3n5UYVguaGHJRp8BCRCqey85/Nr55CIiGBdAlU=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index 9f916e28329..d78a0885252 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -56,13 +56,13 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00f1jrclai2b6ys78dpsg6r1mvcyxlna93vxcz8zjyia24c2pjsb";
+    sha256 = "sha256-9SFFE2GfYYMgxp1dpmL3STTU2ea1R5vFKA1L0pZwIvQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 48df1b0149c..c851c196f18 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -34,8 +34,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  # 22.1 on darwin won't build: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6519
-  version = if stdenv.isDarwin then "22.0.4" else "22.1.4";
+  version = "22.1.6";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -49,10 +48,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = {
-      "22.1.4" = "0xhbcjqy3g5dfxhr4flmqncmsjnwljfqm9idx92jm43jifz8q3b7";
-      "22.0.4" = "1m0y8wgy48hmcidsr7sbk5hcw3v0qr8359fd2x34fvl2z9c1z5y7";
-    }.${version};
+    sha256 = "22ced061eb9adab8ea35368246c1995c09723f3f71653cd5050c5cec376e671a";
   };
 
   # TODO:
@@ -63,11 +59,11 @@ self = stdenv.mkDerivation {
     ./musl.patch
     (fetchpatch {
       url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-endian.patch";
-      sha256 = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk=";
+      hash = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk=";
     })
     (fetchpatch {
       url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-stacksize.patch";
-      sha256 = "sha256-bEp0AWddsw1Pc3rxdKN8fsrX4x2TQEzMUa5afhLXGsg=";
+      hash = "sha256-bEp0AWddsw1Pc3rxdKN8fsrX4x2TQEzMUa5afhLXGsg=";
     })
 
     ./opencl.patch
@@ -76,6 +72,10 @@ self = stdenv.mkDerivation {
     # Fix aarch64-darwin build, remove when upstreaam supports it out of the box.
     # See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/1020
     ./aarch64-darwin.patch
+  ] ++ optionals stdenv.isDarwin [
+    # 22.1 on darwin won't build: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6519
+    # (already in-tree for 22.2)
+    ./drop-dri2.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/mesa/drop-dri2.patch b/pkgs/development/libraries/mesa/drop-dri2.patch
new file mode 100644
index 00000000000..8c2b85a55aa
--- /dev/null
+++ b/pkgs/development/libraries/mesa/drop-dri2.patch
@@ -0,0 +1,40 @@
+diff --git a/a/src/gallium/frontends/dri/dri_util.c b/b/src/gallium/frontends/dri/dri_util.c
+index 8d60526..782360d 100644
+--- a/src/gallium/frontends/dri/dri_util.c
++++ b/src/gallium/frontends/dri/dri_util.c
+@@ -808,35 +808,6 @@ const __DRIcoreExtension driCoreExtension = {
+     .unbindContext              = driUnbindContext
+ };
+ 
+-/** DRI2 interface */
+-const __DRIdri2Extension driDRI2Extension = {
+-    .base = { __DRI_DRI2, 4 },
+-
+-    .createNewScreen            = dri2CreateNewScreen,
+-    .createNewDrawable          = driCreateNewDrawable,
+-    .createNewContext           = driCreateNewContext,
+-    .getAPIMask                 = driGetAPIMask,
+-    .createNewContextForAPI     = driCreateNewContextForAPI,
+-    .allocateBuffer             = dri2AllocateBuffer,
+-    .releaseBuffer              = dri2ReleaseBuffer,
+-    .createContextAttribs       = driCreateContextAttribs,
+-    .createNewScreen2           = driCreateNewScreen2,
+-};
+-
+-const __DRIdri2Extension swkmsDRI2Extension = {
+-    .base = { __DRI_DRI2, 4 },
+-
+-    .createNewScreen            = swkmsCreateNewScreen,
+-    .createNewDrawable          = driCreateNewDrawable,
+-    .createNewContext           = driCreateNewContext,
+-    .getAPIMask                 = driGetAPIMask,
+-    .createNewContextForAPI     = driCreateNewContextForAPI,
+-    .allocateBuffer             = dri2AllocateBuffer,
+-    .releaseBuffer              = dri2ReleaseBuffer,
+-    .createContextAttribs       = driCreateContextAttribs,
+-    .createNewScreen2           = driCreateNewScreen2,
+-};
+-
+ const __DRIswrastExtension driSWRastExtension = {
+     .base = { __DRI_SWRAST, 4 },
+ 
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 163e3bb9965..b035df88e66 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -57,14 +57,13 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/7ba07551dfcd4ef9a87b8f0d9eb8b91fabcb41b3.patch";
       sha256 = "ebbLILncq1hAZTBMsLm+vDGw6j0iQ0crGyhzyLZQgKA=";
     })
-  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     # Make netgroup support optional (musl does not have it)
     # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10
-    # We use the version of the patch that Alpine uses successfully.
+    # NOTE: Remove after the next release
     (fetchpatch {
       name = "make-innetgr-optional.patch";
-      url = "https://git.alpinelinux.org/aports/plain/community/polkit/make-innetgr-optional.patch?id=424ecbb6e9e3a215c978b58c05e5c112d88dddfc";
-      sha256 = "0iyiksqk29sizwaa4623bv683px1fny67639qpb1him89hza00wy";
+      url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/b57deee8178190a7ecc75290fa13cf7daabc2c66.patch";
+      sha256 = "8te6gatT9Fp+fIT05fQBym5mEwHeHfaUNUNEMfSbtLc=";
     })
   ];
 
@@ -153,7 +152,7 @@ stdenv.mkDerivation rec {
       --replace   /bin/false ${coreutils}/bin/false
   '';
 
-  postConfigure = ''
+  postConfigure = lib.optionalString (!stdenv.hostPlatform.isMusl) ''
     # Unpacked by meson
     chmod +x subprojects/mocklibc-1.0/bin/mocklibc
     patchShebangs subprojects/mocklibc-1.0/bin/mocklibc
diff --git a/pkgs/development/libraries/speexdsp/default.nix b/pkgs/development/libraries/speexdsp/default.nix
index 643a83c4700..5e6f27f434a 100644
--- a/pkgs/development/libraries/speexdsp/default.nix
+++ b/pkgs/development/libraries/speexdsp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "speexdsp";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://downloads.xiph.org/releases/speex/${pname}-${version}.tar.gz";
-    sha256 = "0wa7sqpk3x61zz99m7lwkgr6yv62ml6lfgs5xja65vlvdzy44838";
+    sha256 = "sha256-jHdzQ+SmOZVpxyq8OKlbJNtWiCyD29tsZCSl9K61TT0=";
   };
 
   patches = [ ./build-fix.patch ];
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 379b6b7c1bb..21117c7d80b 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "sdk-${version}";
-    sha256 = "sha256-LkIrTFWYvZffLVJJW3152um5LTEsMJEDEsIhBAdhBlk=";
+    hash = "sha256-qYhFoRrQOlvYvVXhIFsa3dZuORDpZyVC5peeYmGNimw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/ti-rpc/default.nix b/pkgs/development/libraries/ti-rpc/default.nix
index 044c09a5bc4..fa4782b5524 100644
--- a/pkgs/development/libraries/ti-rpc/default.nix
+++ b/pkgs/development/libraries/ti-rpc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libtirpc";
-  version = "1.2.7-rc4";
+  version = "1.3.3";
 
   src = fetchurl {
-    url = "http://git.linux-nfs.org/?p=steved/libtirpc.git;a=snapshot;h=5ca4ca92f629d9d83e83544b9239abaaacf0a527;sf=tgz";
-    sha256 = "0w26yf9bwkpqj52sqd3n250dg9jlqnr8bjv0kc4fl5hkrv8akj8i";
+    url = "http://git.linux-nfs.org/?p=steved/libtirpc.git;a=snapshot;h=0fb94eef5062d2657d75eee686fa47238fafa312;sf=tgz";
+    sha256 = "sha256-3P3xYKeAmLbBI4TdsG1VZBO7py9ktiwhXNtGsnryGNI=";
     name = "${pname}-${version}.tar.gz";
   };
 
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index 4fead1a1180..a4424db6894 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "sdk-${version}";
-    sha256 = "sha256-FqrcFHsUS8e4ZgZpxVc8nNZWdNltniFmMjyyWVoNc7w=";
+    hash = "sha256-jHzW3m9smuzEGbZrSyBI74K9rFozxiG3M5Xql/WOw7U=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 067e47b3a2f..928a7a16e69 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,14 +3,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Loader";
       rev = "sdk-${version}";
-      sha256 = "sha256-NQu98wA7UK231rpoKDs1yQ6pEyB4wZg7MjFC3JwS2BY=";
+      hash = "sha256-EcsJzY/R9rreWvYTgoxHNloR5n2xaR/0rouDJVAGaxs=";
     });
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch b/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch
deleted file mode 100644
index 1ade02654e5..00000000000
--- a/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch
+++ /dev/null
@@ -1,346 +0,0 @@
-From 5c44459c3b28a9bd3283aaceab7c615f8020c531 Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Tue, 17 Apr 2018 22:09:22 -0700
-Subject: [PATCH 1/2] Fix a bug that can crash deflate on some input when using
- Z_FIXED.
-
-This bug was reported by Danilo Ramos of Eideticom, Inc. It has
-lain in wait 13 years before being found! The bug was introduced
-in zlib 1.2.2.2, with the addition of the Z_FIXED option. That
-option forces the use of fixed Huffman codes. For rare inputs with
-a large number of distant matches, the pending buffer into which
-the compressed data is written can overwrite the distance symbol
-table which it overlays. That results in corrupted output due to
-invalid distances, and can result in out-of-bound accesses,
-crashing the application.
-
-The fix here combines the distance buffer and literal/length
-buffers into a single symbol buffer. Now three bytes of pending
-buffer space are opened up for each literal or length/distance
-pair consumed, instead of the previous two bytes. This assures
-that the pending buffer cannot overwrite the symbol table, since
-the maximum fixed code compressed length/distance is 31 bits, and
-since there are four bytes of pending space for every three bytes
-of symbol space.
----
- deflate.c | 74 ++++++++++++++++++++++++++++++++++++++++---------------
- deflate.h | 25 +++++++++----------
- trees.c   | 50 +++++++++++--------------------------
- 3 files changed, 79 insertions(+), 70 deletions(-)
-
-diff --git a/deflate.c b/deflate.c
-index 425babc..19cba87 100644
---- a/deflate.c
-+++ b/deflate.c
-@@ -255,11 +255,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
-     int wrap = 1;
-     static const char my_version[] = ZLIB_VERSION;
- 
--    ushf *overlay;
--    /* We overlay pending_buf and d_buf+l_buf. This works since the average
--     * output size for (length,distance) codes is <= 24 bits.
--     */
--
-     if (version == Z_NULL || version[0] != my_version[0] ||
-         stream_size != sizeof(z_stream)) {
-         return Z_VERSION_ERROR;
-@@ -329,9 +324,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
- 
-     s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */
- 
--    overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2);
--    s->pending_buf = (uchf *) overlay;
--    s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L);
-+    /* We overlay pending_buf and sym_buf. This works since the average size
-+     * for length/distance pairs over any compressed block is assured to be 31
-+     * bits or less.
-+     *
-+     * Analysis: The longest fixed codes are a length code of 8 bits plus 5
-+     * extra bits, for lengths 131 to 257. The longest fixed distance codes are
-+     * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
-+     * possible fixed-codes length/distance pair is then 31 bits total.
-+     *
-+     * sym_buf starts one-fourth of the way into pending_buf. So there are
-+     * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
-+     * in sym_buf is three bytes -- two for the distance and one for the
-+     * literal/length. As each symbol is consumed, the pointer to the next
-+     * sym_buf value to read moves forward three bytes. From that symbol, up to
-+     * 31 bits are written to pending_buf. The closest the written pending_buf
-+     * bits gets to the next sym_buf symbol to read is just before the last
-+     * code is written. At that time, 31*(n-2) bits have been written, just
-+     * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
-+     * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
-+     * symbols are written.) The closest the writing gets to what is unread is
-+     * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
-+     * can range from 128 to 32768.
-+     *
-+     * Therefore, at a minimum, there are 142 bits of space between what is
-+     * written and what is read in the overlain buffers, so the symbols cannot
-+     * be overwritten by the compressed data. That space is actually 139 bits,
-+     * due to the three-bit fixed-code block header.
-+     *
-+     * That covers the case where either Z_FIXED is specified, forcing fixed
-+     * codes, or when the use of fixed codes is chosen, because that choice
-+     * results in a smaller compressed block than dynamic codes. That latter
-+     * condition then assures that the above analysis also covers all dynamic
-+     * blocks. A dynamic-code block will only be chosen to be emitted if it has
-+     * fewer bits than a fixed-code block would for the same set of symbols.
-+     * Therefore its average symbol length is assured to be less than 31. So
-+     * the compressed data for a dynamic block also cannot overwrite the
-+     * symbols from which it is being constructed.
-+     */
-+
-+    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
-+    s->pending_buf_size = (ulg)s->lit_bufsize * 4;
- 
-     if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
-         s->pending_buf == Z_NULL) {
-@@ -340,8 +373,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
-         deflateEnd (strm);
-         return Z_MEM_ERROR;
-     }
--    s->d_buf = overlay + s->lit_bufsize/sizeof(ush);
--    s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize;
-+    s->sym_buf = s->pending_buf + s->lit_bufsize;
-+    s->sym_end = (s->lit_bufsize - 1) * 3;
-+    /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
-+     * on 16 bit machines and because stored blocks are restricted to
-+     * 64K-1 bytes.
-+     */
- 
-     s->level = level;
-     s->strategy = strategy;
-@@ -552,7 +589,7 @@ int ZEXPORT deflatePrime (strm, bits, value)
- 
-     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
-     s = strm->state;
--    if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3))
-+    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
-         return Z_BUF_ERROR;
-     do {
-         put = Buf_size - s->bi_valid;
-@@ -1113,7 +1150,6 @@ int ZEXPORT deflateCopy (dest, source)
- #else
-     deflate_state *ds;
-     deflate_state *ss;
--    ushf *overlay;
- 
- 
-     if (deflateStateCheck(source) || dest == Z_NULL) {
-@@ -1133,8 +1169,7 @@ int ZEXPORT deflateCopy (dest, source)
-     ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
-     ds->prev   = (Posf *)  ZALLOC(dest, ds->w_size, sizeof(Pos));
-     ds->head   = (Posf *)  ZALLOC(dest, ds->hash_size, sizeof(Pos));
--    overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2);
--    ds->pending_buf = (uchf *) overlay;
-+    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
- 
-     if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
-         ds->pending_buf == Z_NULL) {
-@@ -1148,8 +1183,7 @@ int ZEXPORT deflateCopy (dest, source)
-     zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
- 
-     ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
--    ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush);
--    ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize;
-+    ds->sym_buf = ds->pending_buf + ds->lit_bufsize;
- 
-     ds->l_desc.dyn_tree = ds->dyn_ltree;
-     ds->d_desc.dyn_tree = ds->dyn_dtree;
-@@ -1925,7 +1959,7 @@ local block_state deflate_fast(s, flush)
-         FLUSH_BLOCK(s, 1);
-         return finish_done;
-     }
--    if (s->last_lit)
-+    if (s->sym_next)
-         FLUSH_BLOCK(s, 0);
-     return block_done;
- }
-@@ -2056,7 +2090,7 @@ local block_state deflate_slow(s, flush)
-         FLUSH_BLOCK(s, 1);
-         return finish_done;
-     }
--    if (s->last_lit)
-+    if (s->sym_next)
-         FLUSH_BLOCK(s, 0);
-     return block_done;
- }
-@@ -2131,7 +2165,7 @@ local block_state deflate_rle(s, flush)
-         FLUSH_BLOCK(s, 1);
-         return finish_done;
-     }
--    if (s->last_lit)
-+    if (s->sym_next)
-         FLUSH_BLOCK(s, 0);
-     return block_done;
- }
-@@ -2170,7 +2204,7 @@ local block_state deflate_huff(s, flush)
-         FLUSH_BLOCK(s, 1);
-         return finish_done;
-     }
--    if (s->last_lit)
-+    if (s->sym_next)
-         FLUSH_BLOCK(s, 0);
-     return block_done;
- }
-diff --git a/deflate.h b/deflate.h
-index 23ecdd3..d4cf1a9 100644
---- a/deflate.h
-+++ b/deflate.h
-@@ -217,7 +217,7 @@ typedef struct internal_state {
-     /* Depth of each subtree used as tie breaker for trees of equal frequency
-      */
- 
--    uchf *l_buf;          /* buffer for literals or lengths */
-+    uchf *sym_buf;        /* buffer for distances and literals/lengths */
- 
-     uInt  lit_bufsize;
-     /* Size of match buffer for literals/lengths.  There are 4 reasons for
-@@ -239,13 +239,8 @@ typedef struct internal_state {
-      *   - I can't count above 4
-      */
- 
--    uInt last_lit;      /* running index in l_buf */
--
--    ushf *d_buf;
--    /* Buffer for distances. To simplify the code, d_buf and l_buf have
--     * the same number of elements. To use different lengths, an extra flag
--     * array would be necessary.
--     */
-+    uInt sym_next;      /* running index in sym_buf */
-+    uInt sym_end;       /* symbol table full when sym_next reaches this */
- 
-     ulg opt_len;        /* bit length of current block with optimal trees */
-     ulg static_len;     /* bit length of current block with static trees */
-@@ -325,20 +320,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
- 
- # define _tr_tally_lit(s, c, flush) \
-   { uch cc = (c); \
--    s->d_buf[s->last_lit] = 0; \
--    s->l_buf[s->last_lit++] = cc; \
-+    s->sym_buf[s->sym_next++] = 0; \
-+    s->sym_buf[s->sym_next++] = 0; \
-+    s->sym_buf[s->sym_next++] = cc; \
-     s->dyn_ltree[cc].Freq++; \
--    flush = (s->last_lit == s->lit_bufsize-1); \
-+    flush = (s->sym_next == s->sym_end); \
-    }
- # define _tr_tally_dist(s, distance, length, flush) \
-   { uch len = (uch)(length); \
-     ush dist = (ush)(distance); \
--    s->d_buf[s->last_lit] = dist; \
--    s->l_buf[s->last_lit++] = len; \
-+    s->sym_buf[s->sym_next++] = dist; \
-+    s->sym_buf[s->sym_next++] = dist >> 8; \
-+    s->sym_buf[s->sym_next++] = len; \
-     dist--; \
-     s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \
-     s->dyn_dtree[d_code(dist)].Freq++; \
--    flush = (s->last_lit == s->lit_bufsize-1); \
-+    flush = (s->sym_next == s->sym_end); \
-   }
- #else
- # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c)
-diff --git a/trees.c b/trees.c
-index 4f4a650..decaeb7 100644
---- a/trees.c
-+++ b/trees.c
-@@ -416,7 +416,7 @@ local void init_block(s)
- 
-     s->dyn_ltree[END_BLOCK].Freq = 1;
-     s->opt_len = s->static_len = 0L;
--    s->last_lit = s->matches = 0;
-+    s->sym_next = s->matches = 0;
- }
- 
- #define SMALLEST 1
-@@ -948,7 +948,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last)
- 
-         Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ",
-                 opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len,
--                s->last_lit));
-+                s->sym_next / 3));
- 
-         if (static_lenb <= opt_lenb) opt_lenb = static_lenb;
- 
-@@ -1017,8 +1017,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
-     unsigned dist;  /* distance of matched string */
-     unsigned lc;    /* match length-MIN_MATCH or unmatched char (if dist==0) */
- {
--    s->d_buf[s->last_lit] = (ush)dist;
--    s->l_buf[s->last_lit++] = (uch)lc;
-+    s->sym_buf[s->sym_next++] = dist;
-+    s->sym_buf[s->sym_next++] = dist >> 8;
-+    s->sym_buf[s->sym_next++] = lc;
-     if (dist == 0) {
-         /* lc is the unmatched char */
-         s->dyn_ltree[lc].Freq++;
-@@ -1033,30 +1034,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
-         s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++;
-         s->dyn_dtree[d_code(dist)].Freq++;
-     }
--
--#ifdef TRUNCATE_BLOCK
--    /* Try to guess if it is profitable to stop the current block here */
--    if ((s->last_lit & 0x1fff) == 0 && s->level > 2) {
--        /* Compute an upper bound for the compressed length */
--        ulg out_length = (ulg)s->last_lit*8L;
--        ulg in_length = (ulg)((long)s->strstart - s->block_start);
--        int dcode;
--        for (dcode = 0; dcode < D_CODES; dcode++) {
--            out_length += (ulg)s->dyn_dtree[dcode].Freq *
--                (5L+extra_dbits[dcode]);
--        }
--        out_length >>= 3;
--        Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ",
--               s->last_lit, in_length, out_length,
--               100L - out_length*100L/in_length));
--        if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1;
--    }
--#endif
--    return (s->last_lit == s->lit_bufsize-1);
--    /* We avoid equality with lit_bufsize because of wraparound at 64K
--     * on 16 bit machines and because stored blocks are restricted to
--     * 64K-1 bytes.
--     */
-+    return (s->sym_next == s->sym_end);
- }
- 
- /* ===========================================================================
-@@ -1069,13 +1047,14 @@ local void compress_block(s, ltree, dtree)
- {
-     unsigned dist;      /* distance of matched string */
-     int lc;             /* match length or unmatched char (if dist == 0) */
--    unsigned lx = 0;    /* running index in l_buf */
-+    unsigned sx = 0;    /* running index in sym_buf */
-     unsigned code;      /* the code to send */
-     int extra;          /* number of extra bits to send */
- 
--    if (s->last_lit != 0) do {
--        dist = s->d_buf[lx];
--        lc = s->l_buf[lx++];
-+    if (s->sym_next != 0) do {
-+        dist = s->sym_buf[sx++] & 0xff;
-+        dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8;
-+        lc = s->sym_buf[sx++];
-         if (dist == 0) {
-             send_code(s, lc, ltree); /* send a literal byte */
-             Tracecv(isgraph(lc), (stderr," '%c' ", lc));
-@@ -1100,11 +1079,10 @@ local void compress_block(s, ltree, dtree)
-             }
-         } /* literal or match pair ? */
- 
--        /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */
--        Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx,
--               "pendingBuf overflow");
-+        /* Check that the overlay between pending_buf and sym_buf is ok: */
-+        Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
- 
--    } while (lx < s->last_lit);
-+    } while (sx < s->sym_next);
- 
-     send_code(s, END_BLOCK, ltree);
- }
--- 
-2.33.1
-
diff --git a/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch b/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch
deleted file mode 100644
index dadc904a07f..00000000000
--- a/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 4346a16853e19b45787ce933666026903fb8f3f8 Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Tue, 17 Apr 2018 22:44:41 -0700
-Subject: [PATCH 2/2] Assure that the number of bits for deflatePrime() is
- valid.
-
----
- deflate.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/deflate.c b/deflate.c
-index 19cba87..23aef18 100644
---- a/deflate.c
-+++ b/deflate.c
-@@ -589,7 +589,8 @@ int ZEXPORT deflatePrime (strm, bits, value)
- 
-     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
-     s = strm->state;
--    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
-+    if (bits < 0 || bits > 16 ||
-+        s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
-         return Z_BUF_ERROR;
-     do {
-         put = Buf_size - s->bi_valid;
--- 
-2.33.1
-
diff --git a/pkgs/development/libraries/zlib/CVE-2022-37434.patch b/pkgs/development/libraries/zlib/CVE-2022-37434.patch
new file mode 100644
index 00000000000..ad2a849d3b8
--- /dev/null
+++ b/pkgs/development/libraries/zlib/CVE-2022-37434.patch
@@ -0,0 +1,62 @@
+From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
+From: Mark Adler <fork@madler.net>
+Date: Sat, 30 Jul 2022 15:51:11 -0700
+Subject: [PATCH] Fix a bug when getting a gzip header extra field with
+ inflate().
+
+If the extra field was larger than the space the user provided with
+inflateGetHeader(), and if multiple calls of inflate() delivered
+the extra header data, then there could be a buffer overflow of the
+provided space. This commit assures that provided space is not
+exceeded.
+---
+ inflate.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/inflate.c b/inflate.c
+index 7be8c6366..7a7289749 100644
+--- a/inflate.c
++++ b/inflate.c
+@@ -763,9 +763,10 @@ int flush;
+                 copy = state->length;
+                 if (copy > have) copy = have;
+                 if (copy) {
++                    len = state->head->extra_len - state->length;
+                     if (state->head != Z_NULL &&
+-                        state->head->extra != Z_NULL) {
+-                        len = state->head->extra_len - state->length;
++                        state->head->extra != Z_NULL &&
++                        len < state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);
+
+From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001
+From: Mark Adler <fork@madler.net>
+Date: Mon, 8 Aug 2022 10:50:09 -0700
+Subject: [PATCH] Fix extra field processing bug that dereferences NULL
+ state->head.
+
+The recent commit to fix a gzip header extra field processing bug
+introduced the new bug fixed here.
+---
+ inflate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/inflate.c b/inflate.c
+index 7a7289749..2a3c4fe98 100644
+--- a/inflate.c
++++ b/inflate.c
+@@ -763,10 +763,10 @@ int flush;
+                 copy = state->length;
+                 if (copy > have) copy = have;
+                 if (copy) {
+-                    len = state->head->extra_len - state->length;
+                     if (state->head != Z_NULL &&
+                         state->head->extra != Z_NULL &&
+-                        len < state->head->extra_max) {
++                        (len = state->head->extra_len - state->length) <
++                            state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 1527be44f7a..a51fec31c14 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation (rec {
     # TODO: remove the patch if upstream releases https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2
     # see https://github.com/NixOS/nixpkgs/issues/170539 for history.
     ./comprehensive-crc-validation-for-wrong-implementations.patch
+    ./CVE-2022-37434.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/aioitertools/default.nix b/pkgs/development/python-modules/aioitertools/default.nix
index 451fb9e7fa1..4db5cde15f6 100644
--- a/pkgs/development/python-modules/aioitertools/default.nix
+++ b/pkgs/development/python-modules/aioitertools/default.nix
@@ -12,7 +12,7 @@
 , typing-extensions
 
 # tests
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -35,14 +35,14 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
+  checkInputs = [
+    unittestCheckHook
+  ];
+
   pythonImportsCheck = [
     "aioitertools"
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
-
   meta = with lib; {
     description = "Implementation of itertools, builtins, and more for AsyncIO and mixed-type iterables";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/arxiv2bib/default.nix b/pkgs/development/python-modules/arxiv2bib/default.nix
index 4dec50bbc67..54a6280017a 100644
--- a/pkgs/development/python-modules/arxiv2bib/default.nix
+++ b/pkgs/development/python-modules/arxiv2bib/default.nix
@@ -1,5 +1,8 @@
-{ buildPythonPackage, python, lib, fetchFromGitHub
+{ buildPythonPackage
+, lib
+, fetchFromGitHub
 , mock
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -14,9 +17,8 @@ buildPythonPackage rec {
     sha256 = "1kp2iyx20lpc9dv4qg5fgwf83a1wx6f7hj1ldqyncg0kn9xcrhbg";
   };
 
-  checkInputs = [ mock ];
-
-  checkPhase = "${python.interpreter} -m unittest discover -s tests";
+  checkInputs = [ unittestCheckHook mock ];
+  unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
     description = "Get a BibTeX entry from an arXiv id number, using the arxiv.org API";
diff --git a/pkgs/development/python-modules/awesome-slugify/default.nix b/pkgs/development/python-modules/awesome-slugify/default.nix
index 47ca9859b5e..884dcd4bc61 100644
--- a/pkgs/development/python-modules/awesome-slugify/default.nix
+++ b/pkgs/development/python-modules/awesome-slugify/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, unidecode, regex, python }:
+{ lib, buildPythonPackage, fetchPypi, unidecode, regex, unittestCheckHook }:
 
 buildPythonPackage rec {
   pname = "awesome-slugify";
@@ -20,9 +20,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ unidecode regex ];
 
-  checkPhase = ''
-      ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     homepage = "https://github.com/dimka665/awesome-slugify";
diff --git a/pkgs/development/python-modules/backports_abc/default.nix b/pkgs/development/python-modules/backports_abc/default.nix
index d67117613d7..684626c0780 100644
--- a/pkgs/development/python-modules/backports_abc/default.nix
+++ b/pkgs/development/python-modules/backports_abc/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -13,9 +13,7 @@ buildPythonPackage rec {
     sha256 = "033be54514a03e255df75c5aee8f9e672f663f93abb723444caec8fe43437bde";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = {
     homepage = "https://github.com/cython/backports_abc";
diff --git a/pkgs/development/python-modules/backports_tempfile/default.nix b/pkgs/development/python-modules/backports_tempfile/default.nix
index 0d1203d28be..ef4f64def3a 100644
--- a/pkgs/development/python-modules/backports_tempfile/default.nix
+++ b/pkgs/development/python-modules/backports_tempfile/default.nix
@@ -1,5 +1,5 @@
 { lib
-, python
+, unittestCheckHook
 , buildPythonPackage
 , fetchPypi
 , setuptools-scm
@@ -19,13 +19,13 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ backports_weakref ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
-
   # requires https://pypi.org/project/backports.test.support
   doCheck = false;
 
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
+
   meta = {
     description = "Backport of new features in Python's tempfile module";
     license = lib.licenses.psfl;
diff --git a/pkgs/development/python-modules/backports_weakref/default.nix b/pkgs/development/python-modules/backports_weakref/default.nix
index 4db504ac330..a0cbe6d4b84 100644
--- a/pkgs/development/python-modules/backports_weakref/default.nix
+++ b/pkgs/development/python-modules/backports_weakref/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 , setuptools-scm
 # , backports
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -20,9 +20,9 @@ buildPythonPackage rec {
   # Requires backports package
   doCheck = false;
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "tests" ];
 
   meta = with lib; {
     description = "Backports of new features in Python’s weakref module";
diff --git a/pkgs/development/python-modules/bitstring/default.nix b/pkgs/development/python-modules/bitstring/default.nix
index 52bc9bae865..2b3fdef896b 100644
--- a/pkgs/development/python-modules/bitstring/default.nix
+++ b/pkgs/development/python-modules/bitstring/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -15,10 +15,9 @@ buildPythonPackage rec {
     sha256 = "0y2kcq58psvl038r6dhahhlhp1wjgr5zsms45wyz1naq6ri8x9qa";
   };
 
-  checkPhase = ''
-    cd test
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "test" ];
 
   pythonImportsCheck = [ "bitstring" ];
 
diff --git a/pkgs/development/python-modules/clevercsv/default.nix b/pkgs/development/python-modules/clevercsv/default.nix
index 21993af3eb5..5384fb01c5c 100644
--- a/pkgs/development/python-modules/clevercsv/default.nix
+++ b/pkgs/development/python-modules/clevercsv/default.nix
@@ -9,6 +9,7 @@
 , regex
 , tabview
 , python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -33,26 +34,29 @@ buildPythonPackage rec {
     tabview
   ];
 
+  checkInputs = [ unittestCheckHook ];
+
   pythonImportsCheck = [
     "clevercsv"
     "clevercsv.cparser"
   ];
 
-  checkPhase = ''
+  preCheck = ''
     # by linking the installed version the tests also have access to compiled native libraries
     rm -r clevercsv
     ln -s $out/${python.sitePackages}/clevercsv/ clevercsv
-    # their ci only runs unit tests, there are also integration and fuzzing tests
-    ${python.interpreter} -m unittest discover -v -f -s ./tests/test_unit
   '';
 
+  # their ci only runs unit tests, there are also integration and fuzzing tests
+  unittestFlagsArray = [ "-v" "-f" "-s" "./tests/test_unit" ];
+
   meta = with lib; {
     description = "CleverCSV is a Python package for handling messy CSV files";
     longDescription = ''
-       CleverCSV is a Python package for handling messy CSV files. It provides
-       a drop-in replacement for the builtin CSV module with improved dialect
-       detection, and comes with a handy command line application for working
-       with CSV files.
+      CleverCSV is a Python package for handling messy CSV files. It provides
+      a drop-in replacement for the builtin CSV module with improved dialect
+      detection, and comes with a handy command line application for working
+      with CSV files.
     '';
     homepage = "https://github.com/alan-turing-institute/CleverCSV";
     changelog = "https://github.com/alan-turing-institute/CleverCSV/blob/master/CHANGELOG.md";
diff --git a/pkgs/development/python-modules/contextlib2/default.nix b/pkgs/development/python-modules/contextlib2/default.nix
index 6aea2570cb8..456999679fc 100644
--- a/pkgs/development/python-modules/contextlib2/default.nix
+++ b/pkgs/development/python-modules/contextlib2/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , python
 , pythonOlder
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -17,11 +18,7 @@ buildPythonPackage rec {
     hash = "sha256-qx4r/h0B2Wjht+jZAjvFHvNQm7ohe7cwzuOCfh7oKGk=";
   };
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [
     "contextlib2"
diff --git a/pkgs/development/python-modules/cvxopt/default.nix b/pkgs/development/python-modules/cvxopt/default.nix
index dfae672f95e..31772c26935 100644
--- a/pkgs/development/python-modules/cvxopt/default.nix
+++ b/pkgs/development/python-modules/cvxopt/default.nix
@@ -3,8 +3,10 @@
 , fetchPypi
 , isPyPy
 , python
-, blas, lapack # build segfaults with 64-bit blas
+, blas
+, lapack # build segfaults with 64-bit blas
 , suitesparse
+, unittestCheckHook
 , glpk ? null
 , gsl ? null
 , fftw ? null
@@ -49,9 +51,9 @@ buildPythonPackage rec {
     export CVXOPT_FFTW_INC_DIR=${fftw.dev}/include
   '';
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
     homepage = "http://cvxopt.org/";
diff --git a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
index cd69d5b1b5e..731aef1c647 100644
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@@ -14,6 +14,7 @@
 , toml
 , types-setuptools
 , types-toml
+, unittestCheckHook
 , xmldiff
 }:
 
@@ -47,6 +48,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    unittestCheckHook
     jsonschema
     lxml
     xmldiff
@@ -56,13 +58,9 @@ buildPythonPackage rec {
     "cyclonedx"
   ];
 
- checkPhase = ''
-   runHook preCheck
-   # Tests require network access
-   rm tests/test_output_json.py
-   ${python.interpreter} -m unittest discover -s tests -v
-   runHook postCheck
- '';
+  preCheck = ''
+    rm tests/test_output_json.py
+  '';
 
   meta = with lib; {
     description = "Python library for generating CycloneDX SBOMs";
diff --git a/pkgs/development/python-modules/cymem/default.nix b/pkgs/development/python-modules/cymem/default.nix
index d2d010e9b12..3e5d497dbfa 100644
--- a/pkgs/development/python-modules/cymem/default.nix
+++ b/pkgs/development/python-modules/cymem/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , cython
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -25,10 +25,9 @@ buildPythonPackage rec {
       --replace "wheel>=0.32.0,<0.33.0" "wheel>=0.31.0"
   '';
 
-  checkPhase = ''
-    cd cymem/tests
-    ${python.interpreter} -m unittest discover -p "*test*"
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "cymem/tests" "-p" "*test*" ];
 
   meta = with lib; {
     description = "Cython memory pool for RAII-style memory management";
diff --git a/pkgs/development/python-modules/deprecation/default.nix b/pkgs/development/python-modules/deprecation/default.nix
index d77554c79ab..441971fa6e7 100644
--- a/pkgs/development/python-modules/deprecation/default.nix
+++ b/pkgs/development/python-modules/deprecation/default.nix
@@ -5,6 +5,7 @@
 , pythonAtLeast
 , pythonOlder
 , unittest2
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -29,14 +30,10 @@ buildPythonPackage rec {
 
   # avoiding mass rebuilds for python3.9, but no longer
   # needed with patch
-  checkInputs = lib.optional (pythonOlder "3.10") [
+  checkInputs = [ unittestCheckHook ] ++ lib.optional (pythonOlder "3.10") [
     unittest2
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
-
   meta = with lib; {
     description = "A library to handle automated deprecations";
     homepage = "https://deprecation.readthedocs.io/";
diff --git a/pkgs/development/python-modules/emailthreads/default.nix b/pkgs/development/python-modules/emailthreads/default.nix
index c57e58368ff..3daaf1577e6 100644
--- a/pkgs/development/python-modules/emailthreads/default.nix
+++ b/pkgs/development/python-modules/emailthreads/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, buildPythonPackage
-, python, isPy3k }:
+, python, isPy3k, unittestCheckHook }:
 
 buildPythonPackage rec {
   pname = "emailthreads";
@@ -14,11 +14,9 @@ buildPythonPackage rec {
     sha256 = "sha256-7BhYS1DQCW9QpG31asPCq5qPyJy+WW2onZpvEHhwQCs=";
   };
 
-  PKGVER = version;
+  checkInputs = [ unittestCheckHook ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover test
-  '';
+  PKGVER = version;
 
   meta = with lib; {
     homepage = "https://github.com/emersion/python-emailthreads";
diff --git a/pkgs/development/python-modules/enum34/default.nix b/pkgs/development/python-modules/enum34/default.nix
index 91f54dc99cb..746e4dd314e 100644
--- a/pkgs/development/python-modules/enum34/default.nix
+++ b/pkgs/development/python-modules/enum34/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonAtLeast
-, python
+, unittestCheckHook
 }:
 
 if pythonAtLeast "3.4" then null else buildPythonPackage rec {
@@ -14,9 +14,7 @@ if pythonAtLeast "3.4" then null else buildPythonPackage rec {
     sha256 = "cce6a7477ed816bd2542d03d53db9f0db935dd013b70f336a95c73979289f248";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     homepage = "https://pypi.python.org/pypi/enum34";
diff --git a/pkgs/development/python-modules/fastimport/default.nix b/pkgs/development/python-modules/fastimport/default.nix
index bd5c270d686..d05037ca9ef 100644
--- a/pkgs/development/python-modules/fastimport/default.nix
+++ b/pkgs/development/python-modules/fastimport/default.nix
@@ -2,7 +2,7 @@
 , pythonOlder
 , buildPythonPackage
 , fetchPypi
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -16,9 +16,7 @@ buildPythonPackage rec {
     sha256 = "6ac99dda4e7b0b3ae831507b6d0094802e6dd95891feafde8cc5c405b6c149ca";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [ "fastimport" ];
 
diff --git a/pkgs/development/python-modules/fido2/default.nix b/pkgs/development/python-modules/fido2/default.nix
index 129d1863923..26ccd95054c 100644
--- a/pkgs/development/python-modules/fido2/default.nix
+++ b/pkgs/development/python-modules/fido2/default.nix
@@ -5,6 +5,7 @@
 , cryptography
 , mock
 , pyfakefs
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -18,17 +19,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ six cryptography ];
 
-  checkInputs = [ mock pyfakefs ];
+  checkInputs = [ unittestCheckHook mock pyfakefs ];
 
-  # Testing with `python setup.py test` doesn't work:
-  # https://github.com/Yubico/python-fido2/issues/108#issuecomment-763513576
-  checkPhase = ''
-    runHook preCheck
-
-    python -m unittest discover -v
-
-    runHook postCheck
-  '';
+  unittestFlagsArray = [ "-v" ];
 
   pythonImportsCheck = [ "fido2" ];
 
diff --git a/pkgs/development/python-modules/flask-babel/default.nix b/pkgs/development/python-modules/flask-babel/default.nix
index a538327650b..9a2aef0570e 100644
--- a/pkgs/development/python-modules/flask-babel/default.nix
+++ b/pkgs/development/python-modules/flask-babel/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, python
+, unittestCheckHook
 , fetchPypi
 , flask
 , babel
@@ -26,9 +26,7 @@ buildPythonPackage rec {
     speaklater
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
+  unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
     description = "Adds i18n/l10n support to Flask applications";
diff --git a/pkgs/development/python-modules/flask-bcrypt/default.nix b/pkgs/development/python-modules/flask-bcrypt/default.nix
index 1c09b6d809c..fc80c501904 100644
--- a/pkgs/development/python-modules/flask-bcrypt/default.nix
+++ b/pkgs/development/python-modules/flask-bcrypt/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , flask
 , bcrypt
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -22,11 +22,7 @@ buildPythonPackage rec {
     bcrypt
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [
     "flask_bcrypt"
diff --git a/pkgs/development/python-modules/flask-migrate/default.nix b/pkgs/development/python-modules/flask-migrate/default.nix
index 04532032038..63047c98fdf 100644
--- a/pkgs/development/python-modules/flask-migrate/default.nix
+++ b/pkgs/development/python-modules/flask-migrate/default.nix
@@ -6,7 +6,7 @@
 , flask
 , flask_script
 , flask-sqlalchemy
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -33,15 +33,10 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    unittestCheckHook
     flask_script
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
-
   meta = with lib; {
     description = "SQLAlchemy database migrations for Flask applications using Alembic";
     homepage = "https://github.com/miguelgrinberg/Flask-Migrate";
diff --git a/pkgs/development/python-modules/flask-seasurf/default.nix b/pkgs/development/python-modules/flask-seasurf/default.nix
index 6d09d7ec45c..cebc4bfa89a 100644
--- a/pkgs/development/python-modules/flask-seasurf/default.nix
+++ b/pkgs/development/python-modules/flask-seasurf/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildPythonPackage, isPy3k, flask, mock, python }:
+{ lib, fetchFromGitHub, buildPythonPackage, isPy3k, flask, mock, unittestCheckHook }:
 
 buildPythonPackage rec {
   pname = "Flask-SeaSurf";
@@ -15,15 +15,10 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ flask ];
 
   checkInputs = [
+    unittestCheckHook
     mock
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
-
   pythonImportsCheck = [ "flask_seasurf" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/gb-io/default.nix b/pkgs/development/python-modules/gb-io/default.nix
index 4aab9d1bc6f..6a44b758d29 100644
--- a/pkgs/development/python-modules/gb-io/default.nix
+++ b/pkgs/development/python-modules/gb-io/default.nix
@@ -4,6 +4,7 @@
 , buildPythonPackage
 , rustPlatform
 , setuptools-rust
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -31,9 +32,7 @@ buildPythonPackage rec {
     rust.rustc
   ]);
 
-  checkPhase = ''
-    python -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [ "gb_io" ];
 
diff --git a/pkgs/development/python-modules/greenlet/default.nix b/pkgs/development/python-modules/greenlet/default.nix
index 78ac1668b6f..4264a825261 100644
--- a/pkgs/development/python-modules/greenlet/default.nix
+++ b/pkgs/development/python-modules/greenlet/default.nix
@@ -2,31 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , isPyPy
-, python
+, unittestCheckHook
 }:
 
 
 buildPythonPackage rec {
   pname = "greenlet";
   version = "1.1.2";
-  disabled = isPyPy;  # builtin for pypy
+  disabled = isPyPy; # builtin for pypy
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "e30f5ea4ae2346e62cedde8794a56858a67b878dd79f7df76a0767e356b1744a";
   };
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover -v greenlet.tests
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-v" "greenlet.tests" ];
 
   meta = with lib; {
     homepage = "https://github.com/python-greenlet/greenlet";
     description = "Module for lightweight in-process concurrent programming";
     license = with licenses; [
-      psfl  # src/greenlet/slp_platformselect.h & files in src/greenlet/platform/ directory
+      psfl # src/greenlet/slp_platformselect.h & files in src/greenlet/platform/ directory
       mit
     ];
   };
diff --git a/pkgs/development/python-modules/gruut-ipa/default.nix b/pkgs/development/python-modules/gruut-ipa/default.nix
index f0824670731..2b8ed6709ac 100644
--- a/pkgs/development/python-modules/gruut-ipa/default.nix
+++ b/pkgs/development/python-modules/gruut-ipa/default.nix
@@ -4,6 +4,7 @@
 , espeak
 , numpy
 , python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -29,11 +30,7 @@ buildPythonPackage rec {
     numpy
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [
     "gruut_ipa"
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 2eb41c4c504..89537a8dfa2 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -6,7 +6,7 @@
 , importlib-metadata
 , typing ? null
 , pythonOlder
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -31,9 +31,9 @@ buildPythonPackage rec {
     typing
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [
+    unittestCheckHook
+  ];
 
   pythonImportsCheck = [
     "importlib_resources"
diff --git a/pkgs/development/python-modules/isodate/default.nix b/pkgs/development/python-modules/isodate/default.nix
index 21bcc3ed90a..ba507f168db 100644
--- a/pkgs/development/python-modules/isodate/default.nix
+++ b/pkgs/development/python-modules/isodate/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
+, unittestCheckHook
 , six
 }:
 
@@ -16,9 +16,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ six ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s src/isodate/tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "src/isodate/tests" ];
 
   meta = with lib; {
     description = "ISO 8601 date/time parser";
diff --git a/pkgs/development/python-modules/jxmlease/default.nix b/pkgs/development/python-modules/jxmlease/default.nix
index 5036ede5e5e..19b29bf7639 100644
--- a/pkgs/development/python-modules/jxmlease/default.nix
+++ b/pkgs/development/python-modules/jxmlease/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , lxml
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -22,11 +22,9 @@ buildPythonPackage rec {
   # https://github.com/Juniper/jxmlease/issues/26
   doCheck = false;
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover -v
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-v" ];
 
   meta = with lib; {
     description = "Converts between XML and intelligent Python data structures";
diff --git a/pkgs/development/python-modules/karton-asciimagic/default.nix b/pkgs/development/python-modules/karton-asciimagic/default.nix
index 3ebba4202b3..74cfa7f8b53 100644
--- a/pkgs/development/python-modules/karton-asciimagic/default.nix
+++ b/pkgs/development/python-modules/karton-asciimagic/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , karton-core
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -20,11 +20,7 @@ buildPythonPackage rec {
     karton-core
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [ "karton.asciimagic" ];
 
diff --git a/pkgs/development/python-modules/karton-core/default.nix b/pkgs/development/python-modules/karton-core/default.nix
index d4e95481327..9a25f3cf123 100644
--- a/pkgs/development/python-modules/karton-core/default.nix
+++ b/pkgs/development/python-modules/karton-core/default.nix
@@ -2,7 +2,7 @@
 , boto3
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, unittestCheckHook
 , redis
 }:
 
@@ -22,11 +22,7 @@ buildPythonPackage rec {
     redis
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [
     "karton.core"
diff --git a/pkgs/development/python-modules/karton-yaramatcher/default.nix b/pkgs/development/python-modules/karton-yaramatcher/default.nix
index 16b4036c90c..67f99af39d9 100644
--- a/pkgs/development/python-modules/karton-yaramatcher/default.nix
+++ b/pkgs/development/python-modules/karton-yaramatcher/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , karton-core
-, python
+, unittestCheckHook
 , yara-python
 }:
 
@@ -22,11 +22,7 @@ buildPythonPackage rec {
     yara-python
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [ "karton.yaramatcher" ];
 
diff --git a/pkgs/development/python-modules/kbcstorage/default.nix b/pkgs/development/python-modules/kbcstorage/default.nix
index 913b7981edd..d84ee1994b5 100644
--- a/pkgs/development/python-modules/kbcstorage/default.nix
+++ b/pkgs/development/python-modules/kbcstorage/default.nix
@@ -12,7 +12,7 @@
 
 # tests
 , responses
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -44,15 +44,10 @@ buildPythonPackage rec {
     doCheck = false;
 
     checkInputs = [
+      unittestCheckHook
       responses
     ];
 
-    checkPhase = ''
-      runHook preCheck
-      ${python.interpreter} -m unittest discover
-      runHook postCheck
-    '';
-
     pythonImportsCheck = [
       "kbcstorage"
       "kbcstorage.buckets"
diff --git a/pkgs/development/python-modules/markdown/default.nix b/pkgs/development/python-modules/markdown/default.nix
index 7207edb5815..999fe2682b8 100644
--- a/pkgs/development/python-modules/markdown/default.nix
+++ b/pkgs/development/python-modules/markdown/default.nix
@@ -4,7 +4,7 @@
 , fetchPypi
 , importlib-metadata
 , pyyaml
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -25,11 +25,7 @@ buildPythonPackage rec {
     importlib-metadata
   ];
 
-  checkInputs = [ pyyaml ];
-
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook pyyaml ];
 
   pythonImportsCheck = [ "markdown" ];
 
diff --git a/pkgs/development/python-modules/mat2/default.nix b/pkgs/development/python-modules/mat2/default.nix
index cd11b56ac26..59a1dddc22b 100644
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
-, python
+, unittestCheckHook
 , pythonOlder
 , fetchFromGitLab
 , substituteAll
@@ -17,7 +17,8 @@
 , mutagen
 , pygobject3
 , pycairo
-, dolphinIntegration ? false, plasma5Packages
+, dolphinIntegration ? false
+, plasma5Packages
 }:
 
 buildPythonPackage rec {
@@ -92,9 +93,9 @@ buildPythonPackage rec {
     install -Dm 444 dolphin/mat2.desktop -t "$out/share/kservices5/ServiceMenus"
   '';
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -v
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-v" ];
 
   meta = with lib; {
     description = "A handy tool to trash your metadata";
diff --git a/pkgs/development/python-modules/maxcube-api/default.nix b/pkgs/development/python-modules/maxcube-api/default.nix
index 36bcc35fc03..0627667a4e5 100644
--- a/pkgs/development/python-modules/maxcube-api/default.nix
+++ b/pkgs/development/python-modules/maxcube-api/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -22,17 +22,13 @@ buildPythonPackage rec {
     substituteInPlace setup.py --replace "license=license" "license='MIT'"
   '';
 
+  checkInputs = [ unittestCheckHook ];
+
   pythonImportsCheck = [
     "maxcube"
     "maxcube.cube"
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
-
   meta = with lib; {
     description = "eQ-3/ELV MAX! Cube Python API";
     homepage = "https://github.com/hackercowboy/python-maxcube-api";
diff --git a/pkgs/development/python-modules/mdutils/default.nix b/pkgs/development/python-modules/mdutils/default.nix
index 08ea5eb8b6f..f2b14258931 100644
--- a/pkgs/development/python-modules/mdutils/default.nix
+++ b/pkgs/development/python-modules/mdutils/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -15,11 +15,7 @@ buildPythonPackage rec {
     sha256 = "sha256-regIrMWbGmW574dfojxZFJoivpaqOpN1I6YsqLEp8BM=";
   };
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     description = "Set of basic tools that can help to create Markdown files";
diff --git a/pkgs/development/python-modules/mkdocs/default.nix b/pkgs/development/python-modules/mkdocs/default.nix
index 2345ca93f94..0fb61bd8a59 100644
--- a/pkgs/development/python-modules/mkdocs/default.nix
+++ b/pkgs/development/python-modules/mkdocs/default.nix
@@ -18,7 +18,7 @@
   # testing deps
 , babel
 , mock
-, pytestCheckHook
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -47,20 +47,12 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    unittestCheckHook
     babel
     mock
   ];
 
-
-  checkPhase = ''
-    set -euo pipefail
-
-    runHook preCheck
-
-    python -m unittest discover -v -p '*tests.py' mkdocs --top-level-directory .
-
-    runHook postCheck
-  '';
+  unittestFlagsArray = [ "-v" "-p" "'*tests.py'" "mkdocs" ];
 
   pythonImportsCheck = [ "mkdocs" ];
 
diff --git a/pkgs/development/python-modules/mock/default.nix b/pkgs/development/python-modules/mock/default.nix
index 464a6ae969d..d23ae8d30c9 100644
--- a/pkgs/development/python-modules/mock/default.nix
+++ b/pkgs/development/python-modules/mock/default.nix
@@ -5,6 +5,7 @@
 , python
 , pythonOlder
 , pytest
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -26,11 +27,8 @@ buildPythonPackage rec {
     })
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
-
   checkInputs = [
+    unittestCheckHook
     pytest
   ];
 
diff --git a/pkgs/development/python-modules/mwdblib/default.nix b/pkgs/development/python-modules/mwdblib/default.nix
index db81e951cf2..69a191f16f9 100644
--- a/pkgs/development/python-modules/mwdblib/default.nix
+++ b/pkgs/development/python-modules/mwdblib/default.nix
@@ -6,7 +6,7 @@
 , fetchFromGitHub
 , humanize
 , keyring
-, python
+, unittestCheckHook
 , python-dateutil
 , pythonOlder
 , requests
@@ -36,11 +36,7 @@ buildPythonPackage rec {
     requests
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [
     "mwdblib"
diff --git a/pkgs/development/python-modules/mypy/extensions.nix b/pkgs/development/python-modules/mypy/extensions.nix
index 04b22e2c543..37257efe5ed 100644
--- a/pkgs/development/python-modules/mypy/extensions.nix
+++ b/pkgs/development/python-modules/mypy/extensions.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , buildPythonPackage
 , typing
-, python
+, unittestCheckHook
 , pythonOlder
 }:
 
@@ -19,9 +19,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = lib.optional (pythonOlder "3.5") typing;
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "tests" ];
 
   pythonImportsCheck = [ "mypy_extensions" ];
 
diff --git a/pkgs/development/python-modules/nix-prefetch-github/default.nix b/pkgs/development/python-modules/nix-prefetch-github/default.nix
index 7ef63348dfb..d6cc7419085 100644
--- a/pkgs/development/python-modules/nix-prefetch-github/default.nix
+++ b/pkgs/development/python-modules/nix-prefetch-github/default.nix
@@ -4,6 +4,7 @@
 , git
 , which
 , pythonOlder
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -19,11 +20,8 @@ buildPythonPackage rec {
     sha256 = "GHUH3Oog800qrdgXs5AEa4O6ovZ1LT0k3P4YwEHfwlY=";
   };
 
-  checkInputs = [ git which ];
+  checkInputs = [ unittestCheckHook git which ];
 
-  checkPhase = ''
-    python -m unittest discover
-  '';
   # ignore tests which are impure
   DISABLED_TESTS = "network requires_nix_build";
 
diff --git a/pkgs/development/python-modules/pathlib/default.nix b/pkgs/development/python-modules/pathlib/default.nix
index cf4dd0999d4..b29a5bae8ed 100644
--- a/pkgs/development/python-modules/pathlib/default.nix
+++ b/pkgs/development/python-modules/pathlib/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
+, unittestCheckHook
 , pythonAtLeast
 }:
 
@@ -15,9 +15,7 @@ buildPythonPackage rec {
     sha256 = "17zajiw4mjbkkv6ahp3xf025qglkj0805m9s41c45zryzj6p2h39";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = {
     description = "Object-oriented filesystem paths";
diff --git a/pkgs/development/python-modules/pgsanity/default.nix b/pkgs/development/python-modules/pgsanity/default.nix
index 26e5eb2bd6a..82d636979e1 100644
--- a/pkgs/development/python-modules/pgsanity/default.nix
+++ b/pkgs/development/python-modules/pgsanity/default.nix
@@ -2,7 +2,9 @@
 , python
 , fetchPypi
 , buildPythonPackage
-, postgresql }:
+, postgresql
+, unittestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pgsanity";
@@ -13,11 +15,7 @@ buildPythonPackage rec {
     sha256 = "de0bbd6fe4f98bf5139cb5f466eac2e2abaf5a7b050b9e4867b87bf360873173";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s test
-  '';
-
-  checkInputs = [ postgresql ];
+  checkInputs = [ unittestCheckHook postgresql ];
   propagatedBuildInputs = [ postgresql ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/plac/default.nix b/pkgs/development/python-modules/plac/default.nix
index 4c353ab7a4e..f9d373e68db 100644
--- a/pkgs/development/python-modules/plac/default.nix
+++ b/pkgs/development/python-modules/plac/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
+, unittestCheckHook
 , pythonOlder
 }:
 
@@ -17,10 +17,9 @@ buildPythonPackage rec {
     hash = "sha256-OL3YZNBFD7dIGTqoF7nEWKj1MZ+/l7ImEVHPwKWBIJA=";
   };
 
-  checkPhase = ''
-    cd doc
-    ${python.interpreter} -m unittest discover -p "*test_plac*"
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "doc" "-p" "*test_plac*" ];
 
   pythonImportsCheck = [
     "plac"
diff --git a/pkgs/development/python-modules/pulsectl/default.nix b/pkgs/development/python-modules/pulsectl/default.nix
index 1990915eef4..e895a0920e5 100644
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, libpulseaudio, glibc, substituteAll, stdenv, pulseaudio, python }:
+{ lib, buildPythonPackage, fetchPypi, libpulseaudio, glibc, substituteAll, stdenv, pulseaudio, unittestCheckHook }:
 
 buildPythonPackage rec {
   pname = "pulsectl";
@@ -22,11 +22,10 @@ buildPythonPackage rec {
     "pulsectl"
   ];
 
-  checkInputs = [ pulseaudio ];
+  checkInputs = [ unittestCheckHook pulseaudio ];
 
-  checkPhase = ''
+  preCheck = ''
     export HOME=$TMPDIR
-    ${python.interpreter} -m unittest discover
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 9333055ccdc..8f01ddd49ad 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -13,15 +13,19 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.9.2";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-O3bkexUBa+gfiJEM6KSR8y/iVqHqlCFmz/9EghxdIpw=";
+    hash = "sha256-/X8DZPFsNrKGbhjZ1GFOj17/NU6p4R+saCW3pLKVNeA=";
   };
 
+  postPatch = ''
+    sed -i "/^timeout/d" pyproject.toml
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   dontUseCmakeBuildDir = true;
diff --git a/pkgs/development/python-modules/pycparser/default.nix b/pkgs/development/python-modules/pycparser/default.nix
index c8283f93c51..47f1a20fbb2 100644
--- a/pkgs/development/python-modules/pycparser/default.nix
+++ b/pkgs/development/python-modules/pycparser/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, python }:
+{ lib, buildPythonPackage, fetchPypi, unittestCheckHook }:
 
 buildPythonPackage rec {
   pname = "pycparser";
@@ -9,9 +9,9 @@ buildPythonPackage rec {
     sha256 = "e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
     description = "C parser in Python";
diff --git a/pkgs/development/python-modules/pyelftools/default.nix b/pkgs/development/python-modules/pyelftools/default.nix
index cec999bf999..1f0bcc15b3e 100644
--- a/pkgs/development/python-modules/pyelftools/default.nix
+++ b/pkgs/development/python-modules/pyelftools/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     hash = "sha256-+T5C0ah2oj5E8fWaQbuzYRVgD5bSiUbaArrlxNLojvw=";
   };
 
-  doCheck = stdenv.hostPlatform.system == "x86_64-linux";
+  doCheck = stdenv.hostPlatform.system == "x86_64-linux" && stdenv.hostPlatform.isGnu;
 
   checkPhase = ''
     patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" test/external_tools/readelf
diff --git a/pkgs/development/python-modules/pypdf2/default.nix b/pkgs/development/python-modules/pypdf2/default.nix
index b87e5d568fa..037c0437ffc 100644
--- a/pkgs/development/python-modules/pypdf2/default.nix
+++ b/pkgs/development/python-modules/pypdf2/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 , glibcLocales
 , typing-extensions
-, python
+, unittestCheckHook
 , isPy3k
 }:
 
@@ -24,13 +24,11 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
-
   # Tests broken on Python 3.x
   #doCheck = !(isPy3k);
 
+  checkInputs = [ unittestCheckHook ];
+
   meta = with lib; {
     description = "A Pure-Python library built as a PDF toolkit";
     homepage = "http://mstamy2.github.com/PyPDF2/";
diff --git a/pkgs/development/python-modules/pyrad/default.nix b/pkgs/development/python-modules/pyrad/default.nix
index c8fb0310548..97c8b6895c3 100644
--- a/pkgs/development/python-modules/pyrad/default.nix
+++ b/pkgs/development/python-modules/pyrad/default.nix
@@ -5,7 +5,7 @@
 , poetry-core
 , netaddr
 , six
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -43,11 +43,9 @@ buildPythonPackage rec {
       --replace "def testBindv6(self):" "def dontTestBindv6(self):"
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [
+    unittestCheckHook
+  ];
 
   pythonImportsCheck = [
     "pyrad"
diff --git a/pkgs/development/python-modules/pysensors/default.nix b/pkgs/development/python-modules/pysensors/default.nix
index 8cff62b89c1..e7d3697da0f 100644
--- a/pkgs/development/python-modules/pysensors/default.nix
+++ b/pkgs/development/python-modules/pysensors/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, python, fetchFromGitHub, lm_sensors }:
+{ lib, buildPythonPackage, unittestCheckHook, fetchFromGitHub, lm_sensors }:
 buildPythonPackage {
   version = "2017-07-13";
   pname = "pysensors";
@@ -17,10 +17,9 @@ buildPythonPackage {
   # due to sandboxing
   doCheck = false;
 
-  checkPhase = ''
-    cd tests
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
     maintainers = with maintainers; [ guibou ];
diff --git a/pkgs/development/python-modules/pyserial/default.nix b/pkgs/development/python-modules/pyserial/default.nix
index e6b8edb784a..7eed44d0fbb 100644
--- a/pkgs/development/python-modules/pyserial/default.nix
+++ b/pkgs/development/python-modules/pyserial/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, python
+, unittestCheckHook
 , pythonOlder
 , isPy3k
 }:
@@ -27,11 +27,9 @@ buildPythonPackage rec {
 
   doCheck = !stdenv.hostPlatform.isDarwin; # broken on darwin
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover -s test
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "test" ];
 
   pythonImportsCheck = [
     "serial"
diff --git a/pkgs/development/python-modules/pystache/default.nix b/pkgs/development/python-modules/pystache/default.nix
index 67ee0063827..b3270c5e733 100644
--- a/pkgs/development/python-modules/pystache/default.nix
+++ b/pkgs/development/python-modules/pystache/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, python, fetchPypi, isPy3k, glibcLocales }:
+{ lib, buildPythonPackage, unittestCheckHook, fetchPypi, isPy3k, glibcLocales }:
 
 buildPythonPackage rec {
   pname = "pystache";
@@ -13,14 +13,12 @@ buildPythonPackage rec {
 
   buildInputs = [ glibcLocales ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
-
   # SyntaxError Python 3
   # https://github.com/defunkt/pystache/issues/181
   doCheck = !isPy3k;
 
+  checkInputs = [ unittestCheckHook ];
+
   meta = with lib; {
     description = "A framework-agnostic, logic-free templating system inspired by ctemplate and et";
     homepage = "https://github.com/defunkt/pystache";
diff --git a/pkgs/development/python-modules/python-keycloak/default.nix b/pkgs/development/python-modules/python-keycloak/default.nix
index 6425869243e..0d2be6a4d14 100644
--- a/pkgs/development/python-modules/python-keycloak/default.nix
+++ b/pkgs/development/python-modules/python-keycloak/default.nix
@@ -4,6 +4,7 @@
 , requests
 , python-jose
 , httmock
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -23,13 +24,10 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    unittestCheckHook
     httmock
   ];
 
-  checkPhase = ''
-    python -m unittest discover
-  '';
-
   pythonImportsCheck = [ "keycloak" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/python-snappy/default.nix b/pkgs/development/python-modules/python-snappy/default.nix
index 397fcaa3dd0..d75c80d5e41 100644
--- a/pkgs/development/python-modules/python-snappy/default.nix
+++ b/pkgs/development/python-modules/python-snappy/default.nix
@@ -4,7 +4,7 @@
 , isPyPy
 , snappy
 , cffi
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -21,11 +21,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = lib.optional isPyPy cffi;
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     description = "Python library for the snappy compression library from Google";
diff --git a/pkgs/development/python-modules/pytidylib/default.nix b/pkgs/development/python-modules/pytidylib/default.nix
index 16f6e4232b3..15280fff4b0 100644
--- a/pkgs/development/python-modules/pytidylib/default.nix
+++ b/pkgs/development/python-modules/pytidylib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, python, html-tidy }:
+{ lib, stdenv, buildPythonPackage, fetchPypi, unittestCheckHook, html-tidy }:
 
 buildPythonPackage rec {
   pname = "pytidylib";
@@ -21,9 +21,7 @@ buildPythonPackage rec {
         $'    @unittest.skip("")\n    def test_large_document(self):'
   '';
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     description = "Python wrapper for HTML Tidy (tidylib) on Python 2 and 3";
diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index 27b18845804..58ac098c17c 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, python }:
+{ lib, buildPythonPackage, fetchPypi, unittestCheckHook }:
 
 buildPythonPackage rec {
   pname = "pytz";
@@ -9,9 +9,9 @@ buildPythonPackage rec {
     sha256 = "sha256-HnYOL+aoFjvAs9mhnE+ENCr6Cir/6/qoSwG5eKAuyqc=";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s pytz/tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "pytz/tests" ];
 
   pythonImportsCheck = [ "pytz" ];
 
diff --git a/pkgs/development/python-modules/readlike/default.nix b/pkgs/development/python-modules/readlike/default.nix
index f2e3d11e7ed..fae5b1a7872 100644
--- a/pkgs/development/python-modules/readlike/default.nix
+++ b/pkgs/development/python-modules/readlike/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -15,9 +15,9 @@ buildPythonPackage rec {
     sha256 = "1mw8j8ads8hqdbz42siwpffi4wi5s33z9g14a5c2i7vxp8m68qc1";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
     description = "GNU Readline-like line editing module";
diff --git a/pkgs/development/python-modules/recursive-pth-loader/default.nix b/pkgs/development/python-modules/recursive-pth-loader/default.nix
index c49f891ec1d..23e7f0f80b6 100644
--- a/pkgs/development/python-modules/recursive-pth-loader/default.nix
+++ b/pkgs/development/python-modules/recursive-pth-loader/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   patchPhase = "cat ${./sitecustomize.py} > sitecustomize.py";
 
-  buildPhase = "${python}/bin/${python.executable} -m compileall .";
+  buildPhase = "${python.pythonForBuild}/bin/${python.pythonForBuild.executable} -m compileall .";
 
   installPhase =
     ''
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index 04284a703b3..2f331bace58 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -7,17 +7,16 @@
 , setuptools
 , setuptools-scm
 , typing-extensions
-, toml
 }:
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.4.1";
+  version = "1.5.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-GP+FCDH1juIdV4OCXJn61jLaIeR2RelCf9fewEgCnnY=";
+    sha256 = "sha256-C4rrgUr+Dp18MVaewJNtH1IBmTUwY5JE+pc+F0IAVnE=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/sjcl/default.nix b/pkgs/development/python-modules/sjcl/default.nix
index 41da6669b54..0ef52c65713 100644
--- a/pkgs/development/python-modules/sjcl/default.nix
+++ b/pkgs/development/python-modules/sjcl/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , pythonOlder
 , pycryptodome
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -23,11 +23,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pycryptodome ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [
     "sjcl"
diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index 199788976ef..85f6366f0f0 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "sphinx-autodoc-typehints";
-  version = "1.19.1";
+  version = "1.19.2";
 in
 
 buildPythonPackage {
@@ -20,7 +20,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "sphinx_autodoc_typehints";
     inherit version;
-    hash = "sha256-bIQdtV4Om+BIP/OWKiFStg55MG9CiNjE5+hqyESGpeo=";
+    hash = "sha256-hy+y17PXlIJsKONu32c56TVJSRRH3KvrB8WIVen5FN4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-testing/default.nix b/pkgs/development/python-modules/sphinx-testing/default.nix
index 1a8521bf438..daf90bb3b50 100644
--- a/pkgs/development/python-modules/sphinx-testing/default.nix
+++ b/pkgs/development/python-modules/sphinx-testing/default.nix
@@ -4,7 +4,7 @@
 , mock
 , sphinx
 , six
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -16,12 +16,10 @@ buildPythonPackage rec {
     sha256 = "ef661775b5722d7b00f67fc229104317d35637a4fb4434bf2c005afdf1da4d09";
   };
 
-  checkInputs = [ mock ];
+  checkInputs = [ unittestCheckHook mock ];
   propagatedBuildInputs = [ sphinx six ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
+  unittestFlagsArray = [ "-s" "tests" ];
 
   # Test failures https://github.com/sphinx-doc/sphinx-testing/issues/5
   doCheck = false;
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 166f9347d71..0983fb7e7a7 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -4,6 +4,7 @@
 , pythonOlder
 , fetchFromGitHub
 , fetchpatch
+
 # propagatedBuildInputs
 , babel
 , alabaster
@@ -23,7 +24,9 @@
 , sphinxcontrib-qthelp
 , sphinxcontrib-serializinghtml
 , sphinxcontrib-websupport
+
 # check phase
+, cython
 , html5lib
 , pytestCheckHook
 , typed-ast
@@ -31,7 +34,7 @@
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "5.0.2";
+  version = "5.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -40,7 +43,7 @@ buildPythonPackage rec {
     owner = "sphinx-doc";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kdwznYvs4szhC+qoL2Zsib9cU69fag1KhCXl8qIGkZU=";
+    hash = "sha256-dTgQNMRIn7ETm+1HgviOkWWOCmLX7Ez6DM9ChlI32mY=";
     postFetch = ''
       cd $out
       mv tests/roots/test-images/testimäge.png \
@@ -49,19 +52,7 @@ buildPythonPackage rec {
     '';
   };
 
-  patches = [
-    # https://github.com/sphinx-doc/sphinx/pull/10624
-    (fetchpatch {
-      name = "avoid-deprecated-docutils-0.19-api.patch";
-      sha256 = "sha256-QIrLkxnexNcfuI00UOeCpAamMLqqt4wxoVY1VA72jIw=";
-      url = "https://github.com/sphinx-doc/sphinx/commit/8d99168794ab8be0de1e6281d1b76af8177acd3d.patch";
-    })
-  ];
-
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace "docutils>=0.14,<0.19" "docutils>=0.14"
-
     # remove impurity caused by date inclusion
     # https://github.com/sphinx-doc/sphinx/blob/master/setup.cfg#L4-L6
     substituteInPlace setup.cfg \
@@ -95,12 +86,17 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    cython
     html5lib
     pytestCheckHook
   ] ++ lib.optionals (pythonOlder "3.8") [
     typed-ast
   ];
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
   disabledTests = [
     # requires network access
     "test_anchors_ignored"
diff --git a/pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix b/pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix
index 0b26c24319f..61b44aa2b70 100644
--- a/pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
+, unittestCheckHook
 , mock
 , sphinx-testing
 , sphinx
@@ -22,9 +22,10 @@ buildPythonPackage rec {
 
   # Seems to look for files in the wrong dir
   doCheck = false;
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
+
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
     description = "Sphinx blockdiag extension";
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 5c467e2f905..25e5b000661 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.4.39";
+  version = "1.4.40";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gZSJYDh1O0awigsK6JpdgMiX+2Ad1R4kPtVyDx8VXSc=";
+    hash = "sha256-RKZgUGCAzJdeHfpXdv5fYxXdxiane1C/Du4YsDieomU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tabview/default.nix b/pkgs/development/python-modules/tabview/default.nix
index 35a7f7d8a7d..6123dc8a056 100644
--- a/pkgs/development/python-modules/tabview/default.nix
+++ b/pkgs/development/python-modules/tabview/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -17,9 +17,7 @@ buildPythonPackage rec {
     sha256 = "1d1l8fhdn3w2zg7wakvlmjmgjh9lh9h5fal1clgyiqmhfix4cn4m";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     description = "Python curses command line CSV and tabular data viewer";
diff --git a/pkgs/development/python-modules/tomli/default.nix b/pkgs/development/python-modules/tomli/default.nix
index c9c9cb46b2c..24a3b2f51f0 100644
--- a/pkgs/development/python-modules/tomli/default.nix
+++ b/pkgs/development/python-modules/tomli/default.nix
@@ -3,9 +3,9 @@
 , callPackage
 , fetchFromGitHub
 , flit-core
-, python
+, unittestCheckHook
 
-# important downstream dependencies
+  # important downstream dependencies
 , flit
 , black
 , mypy
@@ -26,13 +26,9 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ flit-core ];
 
-  pythonImportsCheck = [ "tomli" ];
+  checkInputs = [ unittestCheckHook ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  pythonImportsCheck = [ "tomli" ];
 
   passthru.tests = {
     # test downstream dependencies
diff --git a/pkgs/development/python-modules/tornado/4.nix b/pkgs/development/python-modules/tornado/4.nix
index 3be82e40a29..5765dee4415 100644
--- a/pkgs/development/python-modules/tornado/4.nix
+++ b/pkgs/development/python-modules/tornado/4.nix
@@ -1,26 +1,27 @@
 { lib
-, python
+, unittestCheckHook
 , buildPythonPackage
 , fetchPypi
 , isPy27
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
   pname = "tornado";
   version = "4.5.3";
-  disabled = isPy27 || python.pythonAtLeast "3.10";
-
-  # We specify the name of the test files to prevent
-  # https://github.com/NixOS/nixpkgs/issues/14634
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover *_test.py
-  '';
+  disabled = isPy27 || pythonAtLeast "3.10";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d";
   };
 
+  checkInputs = [ unittestCheckHook ];
+
+  # We specify the name of the test files to prevent
+  # https://github.com/NixOS/nixpkgs/issues/14634
+  unittestFlagsArray = [ "*_test.py" ];
+
   __darwinAllowLocalNetworking = true;
 
   meta = {
diff --git a/pkgs/development/python-modules/tornado/5.nix b/pkgs/development/python-modules/tornado/5.nix
index f0dc14b5fa2..5dfb4f80542 100644
--- a/pkgs/development/python-modules/tornado/5.nix
+++ b/pkgs/development/python-modules/tornado/5.nix
@@ -1,5 +1,5 @@
 { lib
-, python
+, unittestCheckHook
 , buildPythonPackage
 , fetchPypi
 , isPy27
@@ -11,17 +11,17 @@ buildPythonPackage rec {
   version = "5.1.1";
   disabled = isPy27 || pythonAtLeast "3.10";
 
-  # We specify the name of the test files to prevent
-  # https://github.com/NixOS/nixpkgs/issues/14634
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover *_test.py
-  '';
-
   src = fetchPypi {
     inherit pname version;
     sha256 = "4e5158d97583502a7e2739951553cbd88a72076f152b4b11b64b9a10c4c49409";
   };
 
+  checkInputs = [ unittestCheckHook ];
+
+  # We specify the name of the test files to prevent
+  # https://github.com/NixOS/nixpkgs/issues/14634
+  unittestFlagsArray = [ "*_test.py" ];
+
   __darwinAllowLocalNetworking = true;
 
   meta = {
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index df877a2e702..4d0fc2908e6 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -18,8 +18,9 @@
 , weasyprint
 , gevent
 , pillow
-, withPostgresql ? true, psycopg2
-, python
+, withPostgresql ? true
+, psycopg2
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -54,21 +55,20 @@ buildPythonPackage rec {
     gevent
     pillow
   ] ++ relatorio.optional-dependencies.fodt
-    ++ passlib.optional-dependencies.bcrypt
-    ++ passlib.optional-dependencies.argon2
-    ++ lib.optional withPostgresql psycopg2;
+  ++ passlib.optional-dependencies.bcrypt
+  ++ passlib.optional-dependencies.argon2
+  ++ lib.optional withPostgresql psycopg2;
 
-  checkPhase = ''
-    runHook preCheck
+  checkInputs = [ unittestCheckHook ];
 
+  preCheck = ''
     export HOME=$(mktemp -d)
     export TRYTOND_DATABASE_URI="sqlite://"
     export DB_NAME=":memory:";
-    ${python.interpreter} -m unittest discover -s trytond.tests
-
-    runHook postCheck
   '';
 
+  unittestFlagsArray = [ "-s" "trytond.tests" ];
+
   meta = with lib; {
     description = "The server of the Tryton application platform";
     longDescription = ''
diff --git a/pkgs/development/python-modules/txrequests/default.nix b/pkgs/development/python-modules/txrequests/default.nix
index cf3bee52c59..eaf94e21ee3 100644
--- a/pkgs/development/python-modules/txrequests/default.nix
+++ b/pkgs/development/python-modules/txrequests/default.nix
@@ -4,7 +4,7 @@
 , twisted
 , requests
 , cryptography
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -21,9 +21,7 @@ buildPythonPackage rec {
   # Require network access
   doCheck = false;
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     description = "Asynchronous Python HTTP for Humans.";
diff --git a/pkgs/development/python-modules/u-msgpack-python/default.nix b/pkgs/development/python-modules/u-msgpack-python/default.nix
index f44b7db455b..1a82fe4b70a 100644
--- a/pkgs/development/python-modules/u-msgpack-python/default.nix
+++ b/pkgs/development/python-modules/u-msgpack-python/default.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchPypi
 , glibcLocales
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -18,9 +18,7 @@ buildPythonPackage rec {
 
   buildInputs = [ glibcLocales ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   meta = {
     description = "A portable, lightweight MessagePack serializer and deserializer written in pure Python";
diff --git a/pkgs/development/python-modules/unidiff/default.nix b/pkgs/development/python-modules/unidiff/default.nix
index 8fe8a760cf0..2fea8dca66f 100644
--- a/pkgs/development/python-modules/unidiff/default.nix
+++ b/pkgs/development/python-modules/unidiff/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, python }:
+{ lib, buildPythonPackage, fetchPypi, unittestCheckHook }:
 
 buildPythonPackage rec {
   pname = "unidiff";
@@ -9,9 +9,9 @@ buildPythonPackage rec {
     sha256 = "2bbcbc986e1fb97f04b1d7b864aa6002ab02f4d8a996bf03aa6e5a81447d1fc5";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests/
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
 
   pythonImportsCheck = [ "unidiff" ];
 
diff --git a/pkgs/development/python-modules/unify/default.nix b/pkgs/development/python-modules/unify/default.nix
index a1061ad9df9..45b75571170 100644
--- a/pkgs/development/python-modules/unify/default.nix
+++ b/pkgs/development/python-modules/unify/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , untokenize
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ untokenize ];
 
-  checkPhase = "${python.interpreter} -m unittest discover";
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     description = "Modifies strings to all use the same quote where possible";
diff --git a/pkgs/development/python-modules/untangle/default.nix b/pkgs/development/python-modules/untangle/default.nix
index 6582f5080bd..22472549e6c 100644
--- a/pkgs/development/python-modules/untangle/default.nix
+++ b/pkgs/development/python-modules/untangle/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, python, defusedxml }:
+{ lib, buildPythonPackage, fetchFromGitHub, unittestCheckHook, defusedxml }:
 
 buildPythonPackage rec {
   pname = "untangle";
@@ -16,9 +16,9 @@ buildPythonPackage rec {
     defusedxml
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
     description = "Convert XML documents into Python objects";
diff --git a/pkgs/development/python-modules/untokenize/default.nix b/pkgs/development/python-modules/untokenize/default.nix
index 55becfeac4e..2977ffd76e5 100644
--- a/pkgs/development/python-modules/untokenize/default.nix
+++ b/pkgs/development/python-modules/untokenize/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -13,7 +13,7 @@ buildPythonPackage rec {
     sha256 = "3865dbbbb8efb4bb5eaa72f1be7f3e0be00ea8b7f125c69cbd1f5fda926f37a2";
   };
 
-  checkPhase = "${python.interpreter} -m unittest discover";
+  checkInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     description = "Transforms tokens into original source code while preserving whitespace";
diff --git a/pkgs/development/python-modules/vapoursynth/default.nix b/pkgs/development/python-modules/vapoursynth/default.nix
index bfd5e1ca8b2..ec88f244aee 100644
--- a/pkgs/development/python-modules/vapoursynth/default.nix
+++ b/pkgs/development/python-modules/vapoursynth/default.nix
@@ -1,4 +1,4 @@
-{ vapoursynth, cython, buildPythonPackage, python }:
+{ vapoursynth, cython, buildPythonPackage, unittestCheckHook }:
 
 buildPythonPackage {
   pname = "vapoursynth";
@@ -13,9 +13,11 @@ buildPythonPackage {
     vapoursynth
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s $src/test -p "*test.py"
-  '';
+  checkInputs = [
+    unittestCheckHook
+  ];
+
+  unittestFlagsArray = [ "-s" "$src/test" "-p" "'*test.py'" ];
 
   inherit (vapoursynth) meta;
 }
diff --git a/pkgs/development/python-modules/webcolors/default.nix b/pkgs/development/python-modules/webcolors/default.nix
index ccd4163492f..46498b5950a 100644
--- a/pkgs/development/python-modules/webcolors/default.nix
+++ b/pkgs/development/python-modules/webcolors/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -17,9 +17,9 @@ buildPythonPackage rec {
     hash = "sha256-FtBD06CP1qGxt+Pp5iZA0JeQ3OgNK91HkqF1s1/nlKk=";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover -s tests
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
 
   pythonImportsCheck = [
     "webcolors"
diff --git a/pkgs/development/python-modules/websockets/default.nix b/pkgs/development/python-modules/websockets/default.nix
index 538055b9890..ba8ee074664 100644
--- a/pkgs/development/python-modules/websockets/default.nix
+++ b/pkgs/development/python-modules/websockets/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, unittestCheckHook
 , pythonOlder
 }:
 
@@ -44,11 +44,7 @@ buildPythonPackage rec {
     done
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
+  checkInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [
     "websockets"
diff --git a/pkgs/development/python-modules/zake/default.nix b/pkgs/development/python-modules/zake/default.nix
index 89635a88f35..f144bc9d2c4 100644
--- a/pkgs/development/python-modules/zake/default.nix
+++ b/pkgs/development/python-modules/zake/default.nix
@@ -4,7 +4,7 @@
 , kazoo
 , six
 , testtools
-, python
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -18,14 +18,15 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ kazoo six ];
   buildInputs = [ testtools ];
-  checkPhase = ''
+  checkInputs = [ unittestCheckHook ];
+  preCheck = ''
     # Skip test - fails with our new kazoo version
     substituteInPlace zake/tests/test_client.py \
       --replace "test_child_watch_no_create" "_test_child_watch_no_create"
-
-    ${python.interpreter} -m unittest discover zake/tests
   '';
 
+  unittestFlagsArray = [ "zake/tests" ];
+
   meta = with lib; {
     homepage = "https://github.com/yahoo/Zake";
     description = "A python package that works to provide a nice set of testing utilities for the kazoo library";
diff --git a/pkgs/development/python-modules/zope_copy/default.nix b/pkgs/development/python-modules/zope_copy/default.nix
index 0d1ae412262..be4cdca72b6 100644
--- a/pkgs/development/python-modules/zope_copy/default.nix
+++ b/pkgs/development/python-modules/zope_copy/default.nix
@@ -5,6 +5,7 @@
 , zope_interface
 , zope_location
 , zope_schema
+, unittestCheckHook
 }:
 
 
@@ -20,11 +21,9 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ zope_interface ];
 
   doCheck = !isPy27; # namespace conflicts
-  checkInputs = [ zope_location zope_schema ];
+  checkInputs = [ unittestCheckHook zope_location zope_schema ];
 
-  checkPhase = ''
-    python -m unittest discover -s src/zope/copy
-  '';
+  unittestFlagsArray = [ "-s" "src/zope/copy" ];
 
   meta = {
     maintainers = with lib.maintainers; [ domenkozar ];
diff --git a/pkgs/development/python2-modules/mock/default.nix b/pkgs/development/python2-modules/mock/default.nix
index 190297b41a2..f30c407e6f5 100644
--- a/pkgs/development/python2-modules/mock/default.nix
+++ b/pkgs/development/python2-modules/mock/default.nix
@@ -5,7 +5,7 @@
 , funcsigs
 , six
 , pbr
-, python
+, unittestCheckHook
 , pytest
 }:
 
@@ -27,11 +27,8 @@ buildPythonPackage rec {
   #doCheck = !(python.isPyPy && python.isPy27);
   doCheck = false; # Infinite recursion pytest
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover
-  '';
-
   checkInputs = [
+    unittestCheckHook
     pytest
   ];
 
diff --git a/pkgs/development/python2-modules/typing/default.nix b/pkgs/development/python2-modules/typing/default.nix
index b3dcea20323..a835be985ff 100644
--- a/pkgs/development/python2-modules/typing/default.nix
+++ b/pkgs/development/python2-modules/typing/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy3k, isPyPy, python
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy3k, isPyPy, unittestCheckHook
 , pythonAtLeast }:
 
 let
@@ -20,10 +20,9 @@ in buildPythonPackage rec {
   # Also, don't bother on PyPy: AssertionError: TypeError not raised
   doCheck = pythonOlder "3.6" && !isPyPy;
 
-  checkPhase = ''
-    cd ${testDir}
-    ${python.interpreter} -m unittest discover
-  '';
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" testDir ];
 
   meta = with lib; {
     description = "Backport of typing module to Python versions older than 3.5";
diff --git a/pkgs/development/tools/build-managers/cmake/001-search-path.diff b/pkgs/development/tools/build-managers/cmake/001-search-path.diff
index b71c2dd4441..c059bf5bffc 100644
--- a/pkgs/development/tools/build-managers/cmake/001-search-path.diff
+++ b/pkgs/development/tools/build-managers/cmake/001-search-path.diff
@@ -1,5 +1,5 @@
 diff --git a/Modules/Platform/UnixPaths.cmake b/Modules/Platform/UnixPaths.cmake
-index b9381c3d7d..cecc40a89e 100644
+index b9381c3d7d..5e944640b5 100644
 --- a/Modules/Platform/UnixPaths.cmake
 +++ b/Modules/Platform/UnixPaths.cmake
 @@ -26,9 +26,6 @@ get_filename_component(_CMAKE_INSTALL_DIR "${_CMAKE_INSTALL_DIR}" PATH)
@@ -12,7 +12,7 @@ index b9381c3d7d..cecc40a89e 100644
    # CMake install location
    "${_CMAKE_INSTALL_DIR}"
    )
-@@ -47,24 +44,19 @@ endif()
+@@ -47,48 +44,46 @@ endif()
  
  # Non "standard" but common install prefixes
  list(APPEND CMAKE_SYSTEM_PREFIX_PATH
@@ -22,43 +22,61 @@ index b9381c3d7d..cecc40a89e 100644
    )
  
  # List common include file locations not under the common prefixes.
++if(IS_DIRECTORY $ENV{NIX_CC})
++  file(STRINGS "$ENV{NIX_CC}/nix-support/orig-libc" _nix_cmake_libc)
++  file(STRINGS "$ENV{NIX_CC}/nix-support/orig-libc-dev" _nix_cmake_libc_dev)
++else()
++  set(_nix_cmake_libc @libc_lib@)
++  set(_nix_cmake_libc_dev @libc_dev@)
++endif()
++
  list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
 -  # X11
 -  /usr/include/X11
-+  @libc_dev@/include
++  "${_nix_cmake_libc_dev}/include"
    )
  
  list(APPEND CMAKE_SYSTEM_LIBRARY_PATH
 -  # X11
 -  /usr/lib/X11
-+  @libc_lib@/lib
++  "${_nix_cmake_libc}/lib"
    )
  
  list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
 -  /lib /lib32 /lib64 /usr/lib /usr/lib32 /usr/lib64
-+  @libc_lib@/lib
++  "${_nix_cmake_libc}/lib"
    )
  
- if(CMAKE_SYSROOT_COMPILE)
-@@ -77,15 +69,15 @@ endif()
+-if(CMAKE_SYSROOT_COMPILE)
+-  set(_cmake_sysroot_compile "${CMAKE_SYSROOT_COMPILE}")
+-else()
+-  set(_cmake_sysroot_compile "${CMAKE_SYSROOT}")
+-endif()
+-
+ # Default per-language values.  These may be later replaced after
  # parsing the implicit directory information from compiler output.
  set(_CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES_INIT
    ${CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES}
 -  "${_cmake_sysroot_compile}/usr/include"
-+  @libc_dev@/include
++  "${_nix_cmake_libc_dev}/include"
    )
  set(_CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES_INIT
    ${CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES}
 -  "${_cmake_sysroot_compile}/usr/include"
-+  @libc_dev@/include
++  "${_nix_cmake_libc_dev}/include"
    )
  set(_CMAKE_CUDA_IMPLICIT_INCLUDE_DIRECTORIES_INIT
    ${CMAKE_CUDA_IMPLICIT_INCLUDE_DIRECTORIES}
 -  "${_cmake_sysroot_compile}/usr/include"
-+  @libc_dev@/include
++  "${_nix_cmake_libc_dev}/include"
    )
  
- unset(_cmake_sysroot_compile)
+-unset(_cmake_sysroot_compile)
++unset(_nix_cmake_libc)
++unset(_nix_cmake_libc_dev)
+ 
+ # Reminder when adding new locations computed from environment variables
+ # please make sure to keep Help/variable/CMAKE_SYSTEM_PREFIX_PATH.rst
 diff --git a/Modules/Platform/WindowsPaths.cmake b/Modules/Platform/WindowsPaths.cmake
 index b9e2f17979..ab517cd4a7 100644
 --- a/Modules/Platform/WindowsPaths.cmake
diff --git a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
deleted file mode 100644
index 4eb292a2e52..00000000000
--- a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/mesonbuild/coredata.py
-+++ b/mesonbuild/coredata.py
-@@ -506,7 +506,6 @@ class CoreData:
-             return value
-         if option.name.endswith('dir') and value.is_absolute() and \
-            option not in BULITIN_DIR_NOPREFIX_OPTIONS:
--            # Value must be a subdir of the prefix
-             # commonpath will always return a path in the native format, so we
-             # must use pathlib.PurePath to do the same conversion before
-             # comparing.
-@@ -518,7 +517,7 @@ class CoreData:
-             try:
-                 value = value.relative_to(prefix)
-             except ValueError:
--                raise MesonException(msg.format(option, value, prefix))
-+                pass
-             if '..' in str(value):
-                 raise MesonException(msg.format(option, value, prefix))
-         return value.as_posix()
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 5a9164d426a..b28c3a64cc2 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -10,20 +10,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "0.61.2";
+  version = "0.63.0";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    hash = "sha256-AjOn+NlZB5MY9gUrCTnCf2il3oa6YB8lye5oaftfWIk=";
+    sha256 = "sha256-O1HUUXRMK8cYOFJOyNls1PjEeT1bjV0NCpyKT3yUzW8=";
   };
 
   patches = [
-    # Upstream insists on not allowing bindir and other dir options
-    # outside of prefix for some reason:
-    # https://github.com/mesonbuild/meson/issues/2561
-    # We remove the check so multiple outputs can work sanely.
-    ./allow-dirs-outside-of-prefix.patch
-
     # Meson is currently inspecting fewer variables than autoconf does, which
     # makes it harder for us to use setup hooks, etc.  Taken from
     # https://github.com/mesonbuild/meson/pull/6827
@@ -67,16 +61,24 @@ python3.pkgs.buildPythonApplication rec {
     # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
     ./boost-Do-not-add-system-paths-on-nix.patch
 
-    # https://github.com/mesonbuild/meson/pull/9841
-    # cross-compilation fix
+    # Prevent Meson from passing -O0 in buildtype=plain.
+    # Nixpkgs enables fortifications which do not work without optimizations.
+    # https://github.com/mesonbuild/meson/pull/10593
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/f9bfeb2add70973113ab4a98454a5c5d7e3a26ae.patch";
+      revert = true;
+      sha256 = "VKXUwdS+zMp1y+5GrV2inESUpUUp+OL3aI4wOXHxOeo=";
+    })
+
+    # Fix passing multiple --define-variable arguments to pkg-config.
+    # https://github.com/mesonbuild/meson/pull/10670
     (fetchpatch {
-      url = "https://github.com/mesonbuild/meson/commit/266e8acb5807b38a550cb5145cea0e19545a21d7.patch";
-      sha256 = "sha256-1GdKsm2xvq2GxTNeTyBH5O73hxboL0YI+w2BCoUeWXM=";
+      url = "https://github.com/mesonbuild/meson/commit/d5252c5d4cf1c1931fef0c1c98dd66c000891d21.patch";
+      sha256 = "GiUNVul1N5Fl8mfqM7vA/r1FdKqImiDYLXMVDt77gvw=";
+      excludes = [
+        "docs/yaml/objects/dep.yaml"
+      ];
     })
-  ] ++ lib.optionals withDarwinFrameworksGtkDocPatch [
-    # Fix building gtkdoc for GLib
-    # https://github.com/mesonbuild/meson/pull/10186
-    ./fix-gtkdoc-when-using-multiple-apple-frameworks.patch
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/build-managers/meson/fix-gtkdoc-when-using-multiple-apple-frameworks.patch b/pkgs/development/tools/build-managers/meson/fix-gtkdoc-when-using-multiple-apple-frameworks.patch
deleted file mode 100644
index 6c237e92dd1..00000000000
--- a/pkgs/development/tools/build-managers/meson/fix-gtkdoc-when-using-multiple-apple-frameworks.patch
+++ /dev/null
@@ -1,162 +0,0 @@
-From b8ba462ae72e0818898357464263ec84722f6d4c Mon Sep 17 00:00:00 2001
-From: Jan Tojnar <jtojnar@gmail.com>
-Date: Sat, 26 Mar 2022 02:26:27 +0100
-Subject: [PATCH] gnome: Fix gtkdoc when using multiple Apple frameworks
-
-The `-framework Foundation -framework CoreFoundation` ended up
-de-duplicated by OrderedSet into `-framework Foundation CoreFoundation`.
-
-Picked from https://github.com/mesonbuild/meson/pull/10186
-
-Also pick https://github.com/mesonbuild/meson/commit/68e684d51f1e469e0d9f4b499ffda15146cad98a when resolving conflict.
-
-diff --git a/mesonbuild/modules/gnome.py b/mesonbuild/modules/gnome.py
-index 214f97ac3..0521b2605 100644
---- a/mesonbuild/modules/gnome.py
-+++ b/mesonbuild/modules/gnome.py
-@@ -593,15 +593,16 @@ class GnomeModule(ExtensionModule):
-                        lib: T.Union[build.SharedLibrary, build.StaticLibrary],
-                        depends: T.List[build.BuildTarget],
-                        include_rpath: bool = False,
--                       use_gir_args: bool = False) -> T.List[str]:
-+                       use_gir_args: bool = False) -> T.Tuple[T.List[str], T.List[T.Union[build.BuildTarget, 'build.GeneratedTypes', 'FileOrString']]]:
-         link_command: T.List[str] = []
-+        new_depends = list(depends)
-         # Construct link args
-         if isinstance(lib, build.SharedLibrary):
-             libdir = os.path.join(state.environment.get_build_dir(), state.backend.get_target_dir(lib))
-             link_command.append('-L' + libdir)
-             if include_rpath:
-                 link_command.append('-Wl,-rpath,' + libdir)
--            depends.append(lib)
-+            new_depends.append(lib)
-             # Needed for the following binutils bug:
-             # https://github.com/mesonbuild/meson/issues/1911
-             # However, g-ir-scanner does not understand -Wl,-rpath
-@@ -615,19 +616,19 @@ class GnomeModule(ExtensionModule):
-             link_command.append('--extra-library=' + lib.name)
-         else:
-             link_command.append('-l' + lib.name)
--        return link_command
-+        return link_command, new_depends
- 
--    def _get_dependencies_flags(
-+    def _get_dependencies_flags_raw(
-             self, deps: T.Sequence[T.Union['Dependency', build.SharedLibrary, build.StaticLibrary]],
--            state: 'ModuleState', depends: T.List[build.BuildTarget], include_rpath: bool = False,
--            use_gir_args: bool = False, separate_nodedup: bool = False
--            ) -> T.Tuple[OrderedSet[str], OrderedSet[str], OrderedSet[str], T.Optional[T.List[str]], OrderedSet[str]]:
-+            state: 'ModuleState', depends: T.List[build.BuildTarget], include_rpath: bool,
-+            use_gir_args: bool
-+            ) -> T.Tuple[OrderedSet[str], OrderedSet[T.Union[str, T.Tuple[str, str]]], OrderedSet[T.Union[str, T.Tuple[str, str]]], T.Optional[T.List[str]], OrderedSet[str],
-+                         T.List[T.Union[build.BuildTarget, 'build.GeneratedTypes', 'FileOrString']]]:
-         cflags: OrderedSet[str] = OrderedSet()
--        internal_ldflags: OrderedSet[str] = OrderedSet()
--        external_ldflags: OrderedSet[str] = OrderedSet()
-         # External linker flags that can't be de-duped reliably because they
--        # require two args in order, such as -framework AVFoundation
--        external_ldflags_nodedup: T.List[str] = []
-+        # require two args in order, such as -framework AVFoundation will be stored as a tuple.
-+        internal_ldflags: OrderedSet[T.Union[str, T.Tuple[str, str]]] = OrderedSet()
-+        external_ldflags: OrderedSet[T.Union[str, T.Tuple[str, str]]] = OrderedSet()
-         gi_includes: OrderedSet[str] = OrderedSet()
-         deps = mesonlib.listify(deps)
- 
-@@ -642,21 +643,20 @@ class GnomeModule(ExtensionModule):
-                 cflags.update(state.get_include_args(dep.include_directories))
-                 for lib in dep.libraries:
-                     if isinstance(lib, build.SharedLibrary):
--                        internal_ldflags.update(self._get_link_args(state, lib, depends, include_rpath))
--                        libdepflags = self._get_dependencies_flags(lib.get_external_deps(), state, depends, include_rpath,
--                                                                   use_gir_args, True)
-+                        _ld, depends = self._get_link_args(state, lib, depends, include_rpath)
-+                        internal_ldflags.update(_ld)
-+                        libdepflags = self._get_dependencies_flags_raw(lib.get_external_deps(), state, depends, include_rpath,
-+                                                                   use_gir_args)
-                         cflags.update(libdepflags[0])
-                         internal_ldflags.update(libdepflags[1])
-                         external_ldflags.update(libdepflags[2])
--                        external_ldflags_nodedup += libdepflags[3]
--                        gi_includes.update(libdepflags[4])
--                extdepflags = self._get_dependencies_flags(dep.ext_deps, state, depends, include_rpath,
--                                                           use_gir_args, True)
-+                        gi_includes.update(libdepflags[3])
-+                extdepflags = self._get_dependencies_flags_raw(dep.ext_deps, state, depends, include_rpath,
-+                                                           use_gir_args)
-                 cflags.update(extdepflags[0])
-                 internal_ldflags.update(extdepflags[1])
-                 external_ldflags.update(extdepflags[2])
--                external_ldflags_nodedup += extdepflags[3]
--                gi_includes.update(extdepflags[4])
-+                gi_includes.update(extdepflags[3])
-                 for source in dep.sources:
-                     if isinstance(source, GirTarget):
-                         gi_includes.update([os.path.join(state.environment.get_build_dir(),
-@@ -684,7 +684,7 @@ class GnomeModule(ExtensionModule):
-                     # If it's a framework arg, slurp the framework name too
-                     # to preserve the order of arguments
-                     if flag == '-framework':
--                        external_ldflags_nodedup += [flag, next(ldflags)]
-+                        external_ldflags.update([(flag, next(ldflags))])
-                     else:
-                         external_ldflags.update([flag])
-             elif isinstance(dep, (build.StaticLibrary, build.SharedLibrary)):
-@@ -695,21 +695,41 @@ class GnomeModule(ExtensionModule):
-                 continue
- 
-         if use_gir_args and self._gir_has_option('--extra-library'):
--            def fix_ldflags(ldflags: T.Iterable[str]) -> OrderedSet[str]:
--                fixed_ldflags: OrderedSet[str] = OrderedSet()
-+            def fix_ldflags(ldflags: T.Iterable[T.Union[str, T.Tuple[str, str]]]) -> OrderedSet[T.Union[str, T.Tuple[str, str]]]:
-+                fixed_ldflags: OrderedSet[T.Union[str, T.Tuple[str, str]]] = OrderedSet()
-                 for ldflag in ldflags:
--                    if ldflag.startswith("-l"):
-+                    if isinstance(ldflag, str) and ldflag.startswith("-l"):
-                         ldflag = ldflag.replace('-l', '--extra-library=', 1)
-                     fixed_ldflags.add(ldflag)
-                 return fixed_ldflags
-             internal_ldflags = fix_ldflags(internal_ldflags)
-             external_ldflags = fix_ldflags(external_ldflags)
--        if not separate_nodedup:
--            external_ldflags.update(external_ldflags_nodedup)
--            return cflags, internal_ldflags, external_ldflags, None, gi_includes
--        else:
--            return cflags, internal_ldflags, external_ldflags, external_ldflags_nodedup, gi_includes
-+        return cflags, internal_ldflags, external_ldflags, gi_includes, depends
-+
-+    def _get_dependencies_flags(
-+            self, deps: T.Sequence[T.Union['Dependency', build.SharedLibrary, build.StaticLibrary]],
-+            state: 'ModuleState', depends: T.List[build.BuildTarget], include_rpath: bool = False,
-+            use_gir_args: bool = False
-+            ) -> T.Tuple[OrderedSet[str], T.List[str], T.List[str], OrderedSet[str],
-+                         T.List[T.Union[build.BuildTarget, 'build.GeneratedTypes', 'FileOrString']]]:
-+
-+        cflags, internal_ldflags_raw, external_ldflags_raw, gi_includes, depends = self._get_dependencies_flags_raw(deps, state, depends, include_rpath, use_gir_args)
-+        internal_ldflags: T.List[str] = []
-+        external_ldflags: T.List[str] = []
-+
-+        # Extract non-deduplicable argument groups out of the tuples.
-+        for ldflag in internal_ldflags_raw:
-+            if isinstance(ldflag, str):
-+                internal_ldflags.append(ldflag)
-+            else:
-+                internal_ldflags.extend(ldflag)
-+        for ldflag in external_ldflags_raw:
-+            if isinstance(ldflag, str):
-+                external_ldflags.append(ldflag)
-+            else:
-+                external_ldflags.extend(ldflag)
- 
-+        return cflags, internal_ldflags, external_ldflags, gi_includes, depends
-     def _unwrap_gir_target(self, girtarget: T.Union[build.Executable, build.StaticLibrary, build.SharedLibrary], state: 'ModuleState'
-                            ) -> T.Union[build.Executable, build.StaticLibrary, build.SharedLibrary]:
-         if not isinstance(girtarget, (build.Executable, build.SharedLibrary,
-@@ -1056,7 +1076,7 @@ class GnomeModule(ExtensionModule):
-         # ldflags will be misinterpreted by gir scanner (showing
-         # spurious dependencies) but building GStreamer fails if they
-         # are not used here.
--        dep_cflags, dep_internal_ldflags, dep_external_ldflags, _, gi_includes = \
-+        dep_cflags, dep_internal_ldflags, dep_external_ldflags, gi_includes, depends = \
-             self._get_dependencies_flags(deps, state, depends, use_gir_args=True)
-         scan_cflags = []
-         scan_cflags += list(self._get_scanner_cflags(cflags))
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammar.nix b/pkgs/development/tools/parsing/tree-sitter/grammar.nix
index 96486c0c2b5..110f37a5aa8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammar.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammar.nix
@@ -30,16 +30,18 @@ stdenv.mkDerivation rec {
   CFLAGS = [ "-I${src}/src" "-O2" ];
   CXXFLAGS = [ "-I${src}/src" "-O2" ];
 
+  stripDebugList = [ "parser" ];
+
   # When both scanner.{c,cc} exist, we should not link both since they may be the same but in
   # different languages. Just randomly prefer C++ if that happens.
   buildPhase = ''
     runHook preBuild
     if [[ -e "$src/src/scanner.cc" ]]; then
-      $CXX -c "$src/src/scanner.cc" -o scanner.o $CXXFLAGS
+      $CXX -fPIC -c "$src/src/scanner.cc" -o scanner.o $CXXFLAGS
     elif [[ -e "$src/src/scanner.c" ]]; then
-      $CC -c "$src/src/scanner.c" -o scanner.o $CFLAGS
+      $CC -fPIC -c "$src/src/scanner.c" -o scanner.o $CFLAGS
     fi
-    $CC -c "$src/src/parser.c" -o parser.o $CFLAGS
+    $CC -fPIC -c "$src/src/parser.c" -o parser.o $CFLAGS
     $CXX -shared -o parser *.o
     runHook postBuild
   '';
@@ -50,11 +52,4 @@ stdenv.mkDerivation rec {
     mv parser $out/
     runHook postInstall
   '';
-
-  # Strip failed on darwin: strip: error: symbols referenced by indirect symbol table entries that can't be stripped
-  fixupPhase = lib.optionalString stdenv.isLinux ''
-    runHook preFixup
-    $STRIP $out/parser
-    runHook postFixup
-  '';
 }
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 948da2773ec..7abd150c275 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,14 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
-  src = fetchFromGitHub {
-    owner = "KhronosGroup";
-    repo = "SPIRV-Tools";
-    rev = "sdk-${version}";
-    sha256 = "sha256-DoE+UCJOTB8JidC208wgfV1trZC4r9uFvwRPUhJVaII=";
-  };
+  src = (assert version == spirv-headers.version;
+    fetchFromGitHub {
+      owner = "KhronosGroup";
+      repo = "SPIRV-Tools";
+      rev = "sdk-${version}";
+      hash = "sha256-NWpFSRoxtYWi+hLUt9gpw0YScM3shcUwv9yUmbivRb0=";
+    }
+  );
 
   nativeBuildInputs = [ cmake python3 ];
 
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 17ef58be4bc..28b47bb9982 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -22,7 +22,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
   # If we were to use "dev" here instead of headers, the setupHook would be
   # placed in that output instead of "out".
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       owner = "KhronosGroup";
       repo = "Vulkan-ValidationLayers";
       rev = "sdk-${version}";
-      sha256 = "sha256-NGpFfekZtB0rvnGxYVDo808xzgBuo8ZC4bjXjQnTpxU=";
+      hash = "sha256-ri6ImAuskbvYL/ZM8kaVDZRP2v1qfSaafVacwwRF424=";
     });
 
   # Include absolute paths to layer libraries in their associated
diff --git a/pkgs/development/tools/xcbuild/wrapper.nix b/pkgs/development/tools/xcbuild/wrapper.nix
index ca69bbe907d..cefda47cb5b 100644
--- a/pkgs/development/tools/xcbuild/wrapper.nix
+++ b/pkgs/development/tools/xcbuild/wrapper.nix
@@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, writeText, runCommand
+{ lib, stdenv, makeWrapper, writeText, writeShellScriptBin, runCommand
 , CoreServices, ImageIO, CoreGraphics
 , runtimeShell, callPackage
 , xcodePlatform ? stdenv.targetPlatform.xcodePlatform or "MacOSX"
@@ -9,6 +9,7 @@ let
 
   toolchainName = "com.apple.dt.toolchain.XcodeDefault";
   sdkName = "${xcodePlatform}${sdkVer}";
+  xcrunSdkName = lib.toLower xcodePlatform;
 
   # TODO: expose MACOSX_DEPLOYMENT_TARGET in nix so we can use it here.
   sdkBuildVersion = "17E189";
@@ -50,12 +51,27 @@ while [ $# -gt 0 ]; do
 done
   '';
 
-  xcrun = writeText "xcrun" ''
-#!${runtimeShell}
+  xcrun = writeShellScriptBin "xcrun" ''
+args=( "$@" )
+
+# If an SDK was requested, check that it matches.
+for ((i = 0; i < ''${#args[@]}; i++)); do
+  case "''${args[i]}" in
+    --sdk | -sdk)
+      i=$((i + 1))
+      if [[ "''${args[i]}" != '${xcrunSdkName}' ]]; then
+        echo >&2 "xcodebuild: error: SDK \"''${args[i]}\" cannot be located."
+        exit 1
+      fi
+      ;;
+  esac
+done
+
 while [ $# -gt 0 ]; do
    case "$1" in
          --sdk | -sdk) shift ;;
-         --find | -find)
+         --toolchain | -toolchain) shift ;;
+         --find | -find | -f)
            shift
            command -v $1 ;;
          --log | -log) ;; # noop
@@ -74,6 +90,7 @@ while [ $# -gt 0 ]; do
     esac
     shift
 done
+
 if ! [[ -z "$@" ]]; then
    exec "$@"
 fi
@@ -89,7 +106,7 @@ runCommand "xcodebuild-${xcbuild.version}" {
   propagatedBuildInputs = [ "${toolchains}/XcodeDefault.xctoolchain" ];
 
   passthru = {
-    inherit xcbuild;
+    inherit xcbuild xcrun;
     toolchain = "${toolchains}/XcodeDefault.xctoolchain";
     sdk = "${sdks}/${sdkName}";
     platform = "${platforms}/${xcodePlatform}.platform";
@@ -126,8 +143,7 @@ runCommand "xcodebuild-${xcbuild.version}" {
     --subst-var-by DEVELOPER_DIR $out/Applications/Xcode.app/Contents/Developer
   chmod +x $out/bin/xcode-select
 
-  substitute ${xcrun} $out/bin/xcrun
-  chmod +x $out/bin/xcrun
+  cp ${xcrun}/bin/xcrun $out/bin/xcrun
 
   for bin in PlistBuddy actool builtin-copy builtin-copyPlist \
              builtin-copyStrings builtin-copyTiff \
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
index f04b964f755..0297f8897f1 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
@@ -39,6 +39,7 @@ stdenvNoCC.mkDerivation {
 
     cp -d \
       ${MacOSX-SDK}/usr/include/*.h \
+      ${MacOSX-SDK}/usr/include/*.modulemap \
       $out/include
 
     rm $out/include/tk*.h $out/include/tcl*.h
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index f7a2c0c52a9..0a74554d6c6 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -21,7 +21,7 @@
 }:
 
 let
-  apparmor-version = "3.0.4";
+  apparmor-version = "3.0.7";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -35,7 +35,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    sha256 = "1a217j28rgfq4lsmpn0wv1xgmdr9ba8iysv9i6q477kj6z77zrb9";
+    hash = "sha256-iLZY0wZQr+YvR8JCwTeECDuqFb1sQCQtkiUksiYCvWs=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index be819802394..62f3f0c4db1 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -1,21 +1,18 @@
-{ lib, stdenv, fetchurl, lvm2, json_c
+{ lib, stdenv, fetchurl, lvm2, json_c, asciidoctor
 , openssl, libuuid, pkg-config, popt }:
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.4.3";
+  version = "2.5.0";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/cryptsetup/v2.4/${pname}-${version}.tar.xz";
-    sha256 = "sha256-/A35RRiBciZOxb8dC9oIJk+tyKP4VtR+upHzH+NUtQc=";
+    url = "mirror://kernel/linux/utils/cryptsetup/v2.5/${pname}-${version}.tar.xz";
+    sha256 = "sha256-kYSm672c5+shEVLn90GmyC8tHMDiSoTsnFKTnu4PBUI=";
   };
 
-  # Disable 4 test cases that fail in a sandbox
-  patches = [ ./disable-failing-tests.patch ];
-
   postPatch = ''
     patchShebangs tests
 
@@ -39,10 +36,13 @@ stdenv.mkDerivation rec {
     "--with-luks2-external-tokens-path=/"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config asciidoctor ];
   buildInputs = [ lvm2 json_c openssl libuuid popt ];
 
-  doCheck = true;
+  # The test [7] header backup in compat-test fails with a mysterious
+  # "out of memory" error, even though tons of memory is available.
+  # Issue filed upstream: https://gitlab.com/cryptsetup/cryptsetup/-/issues/763
+  doCheck = !stdenv.hostPlatform.isMusl;
 
   meta = {
     homepage = "https://gitlab.com/cryptsetup/cryptsetup/";
diff --git a/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch b/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
deleted file mode 100644
index 1504bf3e151..00000000000
--- a/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff -ur a/tests/blockwise-compat b/tests/blockwise-compat
---- a/tests/blockwise-compat	2018-09-08 12:23:11.706555098 +0200
-+++ b/tests/blockwise-compat	2018-09-08 12:24:24.444393460 +0200
-@@ -148,15 +148,11 @@
- 	# device/file fn_name length
- 	RUN "P" $1 read_buffer $BSIZE
- 	RUN "P" $1 read_buffer $((2*BSIZE))
--	RUN "F" $1 read_buffer $((BSIZE-1))
--	RUN "F" $1 read_buffer $((BSIZE+1))
- 	RUN "P" $1 read_buffer 0
- 
- 	RUN "P" $1 write_buffer $BSIZE
- 	RUN "P" $1 write_buffer $((2*BSIZE))
- 
--	RUN "F" $1 write_buffer $((BSIZE-1))
--	RUN "F" $1 write_buffer $((BSIZE+1))
- 	RUN "F" $1 write_buffer 0
- 
- 	# basic blockwise functions
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 4d06e82fcae..0cc8ee3cf3f 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.18.0";
+  version = "5.19.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "W6PUZNUcjCg1UNUH/6w9EPeuxYe3xmsMy2lQZDZGOJ4=";
+    sha256 = "JrejTWp/0vekLis5xakMthusUi0QlgZ//rGV5Wk9d5E=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index fb0d19115da..b73c0ae04cd 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -102,15 +102,11 @@ stdenv.mkDerivation rec {
     # Apparently glibc provides scsi itself?
     (cd $dev/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
 
-    # Strip debug out of the static library
-    $STRIP -S $out/lib/libc.a
     mkdir -p $out/bin
 
 
-    ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
-      "install -D libssp_nonshared.a $out/lib/libssp_nonshared.a
-      $STRIP -S $out/lib/libssp_nonshared.a"
-      else ""
+    ${lib.optionalString (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32)
+      "install -D libssp_nonshared.a $out/lib/libssp_nonshared.a"
     }
 
     # Create 'ldd' symlink, builtin
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 8339eabb495..12c5b40ea4a 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -9,12 +9,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.4";
+  version = "1.0.5";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-kn+x/qH2haMowQz3ketlXX4e1J0xDupcsxAd/Y1sujU=";
+    hash = "sha256-jRtLGDk69DaY0QuqJdK5tjl5ab7srHgWw13QcU5N5Qo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 348f0e11342..d2d6146c5d6 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -89,7 +89,7 @@
 , withMachined ? true
 , withNetworkd ? true
 , withNss ? !stdenv.hostPlatform.isMusl
-, withOomd ? false
+, withOomd ? true
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? false
@@ -127,7 +127,7 @@ assert withCryptsetup -> (cryptsetup != null);
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "251.3";
+  version = "251.4";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -144,7 +144,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    sha256 = "sha256-vcj+k/duRID2R+wGQIyq+dVRrFYNQTsjHya6k0hmZxk=";
+    sha256 = "sha256-lfG6flT1k8LZBAdDK+cF9RjmJMkHMJquMjQK3MINFd8=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
diff --git a/pkgs/servers/monitoring/prometheus/xmpp-alerts.nix b/pkgs/servers/monitoring/prometheus/xmpp-alerts.nix
index e38466df6e6..437856c0350 100644
--- a/pkgs/servers/monitoring/prometheus/xmpp-alerts.nix
+++ b/pkgs/servers/monitoring/prometheus/xmpp-alerts.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , python3Packages
 , prometheus-alertmanager
+, unittestCheckHook
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -25,13 +26,10 @@ python3Packages.buildPythonApplication rec {
   ]);
 
   checkInputs = with python3Packages; [
+    unittestCheckHook
     pytz
   ];
 
-  checkPhase = ''
-    ${python3Packages.python.interpreter} -m unittest discover
-  '';
-
   meta = {
     description = "XMPP Web hook for Prometheus";
     homepage = "https://github.com/jelmer/prometheus-xmpp-alerts";
diff --git a/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-when-gsettings-is-disabled.patch b/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-15.patch
index c087dcd7e7d..c087dcd7e7d 100644
--- a/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-when-gsettings-is-disabled.patch
+++ b/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-15.patch
diff --git a/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-16.patch b/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-16.patch
new file mode 100644
index 00000000000..2a5ae040d9d
--- /dev/null
+++ b/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-16.patch
@@ -0,0 +1,26 @@
+From 72f3fe059f031f24c5ad026cb2fc16318f227c09 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 16:29:58 +0900
+Subject: [PATCH 1/8] Make gio-2.0 optional when gsettings is disabled
+
+Derived from https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/654
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index c5135330f..340f58e17 100644
+--- a/meson.build
++++ b/meson.build
+@@ -683,7 +683,7 @@ if get_option('daemon')
+     cdata.set('HAVE_ALSA_UCM', 1)
+   endif
+ 
+-  gio_dep = dependency('gio-2.0', version : '>= 2.26.0')
++  gio_dep = dependency('gio-2.0', version : '>= 2.26.0', required : false)
+   if get_option('gsettings').enabled()
+     assert(gio_dep.found(), 'GSettings support needs glib I/O library (GIO)')
+     cdata.set('HAVE_GSETTINGS', 1)
+-- 
+2.35.1
+
diff --git a/pkgs/servers/pulseaudio/0002-Ignore-SCM_CREDS-on-macOS.patch b/pkgs/servers/pulseaudio/0002-Ignore-SCM_CREDS-on-darwin.patch
index 9196e205dc0..9196e205dc0 100644
--- a/pkgs/servers/pulseaudio/0002-Ignore-SCM_CREDS-on-macOS.patch
+++ b/pkgs/servers/pulseaudio/0002-Ignore-SCM_CREDS-on-darwin.patch
diff --git a/pkgs/servers/pulseaudio/0003-Disable-z-nodelete-on-darwin.patch b/pkgs/servers/pulseaudio/0003-Disable-z-nodelete-on-darwin.patch
deleted file mode 100644
index 81b3ab92733..00000000000
--- a/pkgs/servers/pulseaudio/0003-Disable-z-nodelete-on-darwin.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 3f1abb55f4eb985fd0715b2b2ca45dcce3a56824 Mon Sep 17 00:00:00 2001
-From: Andrew Childs <andrew.childs@bibo.com.ph>
-Date: Tue, 19 Apr 2022 17:06:50 +0900
-Subject: [PATCH 3/8] Disable `-z nodelete` on darwin
-
-Not supported[citation needed].
----
- meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index f7adf1413..d4bece11a 100644
---- a/meson.build
-+++ b/meson.build
-@@ -404,7 +404,7 @@ cdata.set('MESON_BUILD', 1)
- # so we request the nodelete flag to be enabled.
- # On other systems, we don't really know how to do that, but it's welcome if somebody can tell.
- # Windows doesn't support this flag.
--if host_machine.system() != 'windows'
-+if host_machine.system() != 'windows' and host_machine.system() != 'darwin'
-   nodelete_link_args = ['-Wl,-z,nodelete']
- else
-   nodelete_link_args = []
--- 
-2.35.1
-
diff --git a/pkgs/servers/pulseaudio/0003-Ignore-HAVE_CPUID_H-on-aarch64-darwin.patch b/pkgs/servers/pulseaudio/0003-Ignore-HAVE_CPUID_H-on-aarch64-darwin.patch
new file mode 100644
index 00000000000..ce0df74f877
--- /dev/null
+++ b/pkgs/servers/pulseaudio/0003-Ignore-HAVE_CPUID_H-on-aarch64-darwin.patch
@@ -0,0 +1,26 @@
+diff --git a/src/pulsecore/core-util.c b/src/pulsecore/core-util.c
+index c383a61c0..3d0a68c2e 100644
+--- a/src/pulsecore/core-util.c
++++ b/src/pulsecore/core-util.c
+@@ -110,7 +110,7 @@
+ #include <sys/personality.h>
+ #endif
+ 
+-#ifdef HAVE_CPUID_H
++#if defined(HAVE_CPUID_H) && !(defined(__APPLE__) && defined(__aarch64__))
+ #include <cpuid.h>
+ #endif
+ 
+diff --git a/src/pulsecore/cpu-x86.c b/src/pulsecore/cpu-x86.c
+index 317a0101e..d1eb95d2b 100644
+--- a/src/pulsecore/cpu-x86.c
++++ b/src/pulsecore/cpu-x86.c
+@@ -24,7 +24,7 @@
+ 
+ #include <stdint.h>
+ 
+-#ifdef HAVE_CPUID_H
++#if defined(HAVE_CPUID_H) && !(defined(__APPLE__) && defined(__aarch64__))
+ #include <cpuid.h>
+ #endif
+ 
diff --git a/pkgs/servers/pulseaudio/0004-Prefer-HAVE_CLOCK_GETTIME-on-darwin.patch b/pkgs/servers/pulseaudio/0004-Prefer-HAVE_CLOCK_GETTIME-on-darwin.patch
new file mode 100644
index 00000000000..0eeaf2a03a1
--- /dev/null
+++ b/pkgs/servers/pulseaudio/0004-Prefer-HAVE_CLOCK_GETTIME-on-darwin.patch
@@ -0,0 +1,13 @@
+diff --git a/src/pulsecore/core-rtclock.c b/src/pulsecore/core-rtclock.c
+index 2c2e28631..b946a3fb1 100644
+--- a/src/pulsecore/core-rtclock.c
++++ b/src/pulsecore/core-rtclock.c
+@@ -65,7 +65,7 @@ pa_usec_t pa_rtclock_age(const struct timeval *tv) {
+ 
+ struct timeval *pa_rtclock_get(struct timeval *tv) {
+ 
+-#if defined(OS_IS_DARWIN)
++#if defined(OS_IS_DARWIN) && !defined(HAVE_CLOCK_GETTIME)
+     uint64_t val, abs_time = mach_absolute_time();
+     Nanoseconds nanos;
+ 
diff --git a/pkgs/servers/pulseaudio/0004-Prefer-clock_gettime.patch b/pkgs/servers/pulseaudio/0004-Prefer-clock_gettime.patch
deleted file mode 100644
index eb7bd1c6270..00000000000
--- a/pkgs/servers/pulseaudio/0004-Prefer-clock_gettime.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 0bd3b613ac3bf16a73b3223fa1b961da3a0db1b2 Mon Sep 17 00:00:00 2001
-From: Andrew Childs <andrew.childs@bibo.com.ph>
-Date: Tue, 19 Apr 2022 17:12:52 +0900
-Subject: [PATCH 4/8] Prefer clock_gettime
-
-Available in darwin since 10.12 (released in 2016).
----
- src/pulsecore/core-rtclock.c | 26 +++++++++++++-------------
- 1 file changed, 13 insertions(+), 13 deletions(-)
-
-diff --git a/src/pulsecore/core-rtclock.c b/src/pulsecore/core-rtclock.c
-index 2c2e28631..a08d4b391 100644
---- a/src/pulsecore/core-rtclock.c
-+++ b/src/pulsecore/core-rtclock.c
-@@ -65,19 +65,7 @@ pa_usec_t pa_rtclock_age(const struct timeval *tv) {
- 
- struct timeval *pa_rtclock_get(struct timeval *tv) {
- 
--#if defined(OS_IS_DARWIN)
--    uint64_t val, abs_time = mach_absolute_time();
--    Nanoseconds nanos;
--
--    nanos = AbsoluteToNanoseconds(*(AbsoluteTime *) &abs_time);
--    val = *(uint64_t *) &nanos;
--
--    tv->tv_sec = val / PA_NSEC_PER_SEC;
--    tv->tv_usec = (val % PA_NSEC_PER_SEC) / PA_NSEC_PER_USEC;
--
--    return tv;
--
--#elif defined(HAVE_CLOCK_GETTIME)
-+#if defined(HAVE_CLOCK_GETTIME)
-     struct timespec ts;
- 
- #ifdef CLOCK_MONOTONIC
-@@ -109,6 +97,18 @@ struct timeval *pa_rtclock_get(struct timeval *tv) {
- 
-         return tv;
-     }
-+#elif defined(OS_IS_DARWIN)
-+    uint64_t val, abs_time = mach_absolute_time();
-+    Nanoseconds nanos;
-+
-+    nanos = AbsoluteToNanoseconds(*(AbsoluteTime *) &abs_time);
-+    val = *(uint64_t *) &nanos;
-+
-+    tv->tv_sec = val / PA_NSEC_PER_SEC;
-+    tv->tv_usec = (val % PA_NSEC_PER_SEC) / PA_NSEC_PER_USEC;
-+
-+    return tv;
-+
- #endif /* HAVE_CLOCK_GETTIME */
- 
-     return pa_gettimeofday(tv);
--- 
-2.35.1
-
diff --git a/pkgs/servers/pulseaudio/0005-Enable-CoreAudio-on-darwin.patch b/pkgs/servers/pulseaudio/0005-Enable-CoreAudio-on-darwin.patch
new file mode 100644
index 00000000000..bdf5ff2b9ca
--- /dev/null
+++ b/pkgs/servers/pulseaudio/0005-Enable-CoreAudio-on-darwin.patch
@@ -0,0 +1,31 @@
+diff --git a/meson.build b/meson.build
+index c5135330f..055567479 100644
+--- a/meson.build
++++ b/meson.build
+@@ -185,6 +185,7 @@ endif
+ # rather than ending up in the config.h file?
+ if host_machine.system() == 'darwin'
+   cdata.set('OS_IS_DARWIN', 1)
++  cdata.set('HAVE_COREAUDIO', 1)
+   cdata.set('_DARWIN_C_SOURCE', '200112L') # Needed to get NSIG on Mac OS
+ elif host_machine.system() == 'windows'
+   cdata.set('OS_IS_WIN32', 1)
+diff --git a/src/modules/meson.build b/src/modules/meson.build
+index 1e12569dc..53a800927 100644
+--- a/src/modules/meson.build
++++ b/src/modules/meson.build
+@@ -63,6 +63,14 @@ all_modules = [
+   [ 'module-volume-restore', 'module-volume-restore.c' ],
+ ]
+ 
++if host_machine.system() == 'darwin'
++  coreaudio_dep = dependency('appleframeworks', modules : ['AudioUnit', 'Cocoa', 'CoreServices', 'CoreAudio'])
++  all_modules += [
++    [ 'module-coreaudio-detect', 'macosx/module-coreaudio-detect.c', [], [], [coreaudio_dep] ],
++    [ 'module-coreaudio-device', 'macosx/module-coreaudio-device.c', [], [], [coreaudio_dep] ],
++  ]
++endif
++
+ if host_machine.system() == 'windows'
+   winmm_dep = meson.get_compiler('c').find_library('winmm')
+   ksuser_dep = meson.get_compiler('c').find_library('ksuser')
diff --git a/pkgs/servers/pulseaudio/0005-Include-poll-posix.c-on-darwin.patch b/pkgs/servers/pulseaudio/0005-Include-poll-posix.c-on-darwin.patch
deleted file mode 100644
index 4779fce2afd..00000000000
--- a/pkgs/servers/pulseaudio/0005-Include-poll-posix.c-on-darwin.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 8dee473920d3a331b73a415b37e7e0b01f014110 Mon Sep 17 00:00:00 2001
-From: Andrew Childs <andrew.childs@bibo.com.ph>
-Date: Tue, 19 Apr 2022 17:22:23 +0900
-Subject: [PATCH 5/8] Include poll-posix.c on darwin
-
----
- src/meson.build | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/meson.build b/src/meson.build
-index e2860811b..5bd68cb12 100644
---- a/src/meson.build
-+++ b/src/meson.build
-@@ -182,6 +182,7 @@ if host_machine.system() == 'windows'
- else
-   libpulsecommon_sources += [
-     'pulsecore/mutex-posix.c',
-+    'pulsecore/poll-posix.c',
-     'pulsecore/semaphore-posix.c',
-     'pulsecore/thread-posix.c'
-   ]
--- 
-2.35.1
-
diff --git a/pkgs/servers/pulseaudio/0006-Fix-libpulsecommon-sources-on-darwin.patch b/pkgs/servers/pulseaudio/0006-Fix-libpulsecommon-sources-on-darwin.patch
new file mode 100644
index 00000000000..67a21af4679
--- /dev/null
+++ b/pkgs/servers/pulseaudio/0006-Fix-libpulsecommon-sources-on-darwin.patch
@@ -0,0 +1,18 @@
+diff --git a/src/meson.build b/src/meson.build
+index 9efb561d8..d181f4867 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -179,6 +179,13 @@ if host_machine.system() == 'windows'
+     'pulsecore/semaphore-win32.c',
+     'pulsecore/thread-win32.c',
+   ]
++elif host_machine.system() == 'darwin'
++  libpulsecommon_sources += [
++    'pulsecore/mutex-posix.c',
++    'pulsecore/poll-posix.c',
++    'pulsecore/semaphore-osx.c',
++    'pulsecore/thread-posix.c'
++  ]
+ else
+   libpulsecommon_sources += [
+     'pulsecore/mutex-posix.c',
diff --git a/pkgs/servers/pulseaudio/0006-Only-use-version-script-on-GNU-ish-linkers.patch b/pkgs/servers/pulseaudio/0006-Only-use-version-script-on-GNU-ish-linkers.patch
deleted file mode 100644
index 8b27b3e5ab7..00000000000
--- a/pkgs/servers/pulseaudio/0006-Only-use-version-script-on-GNU-ish-linkers.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 419258112b9d90d149ebbd5c657a36d8532b78a2 Mon Sep 17 00:00:00 2001
-From: Andrew Childs <andrew.childs@bibo.com.ph>
-Date: Tue, 19 Apr 2022 17:31:36 +0900
-Subject: [PATCH 6/8] Only use version-script on GNU-ish linkers
-
----
- src/pulse/meson.build | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/src/pulse/meson.build b/src/pulse/meson.build
-index c2128e087..a5e47867e 100644
---- a/src/pulse/meson.build
-+++ b/src/pulse/meson.build
-@@ -74,7 +74,11 @@ run_target('update-map-file',
-   command : [ join_paths(meson.source_root(), 'scripts/generate-map-file.sh'), 'map-file',
-               [ libpulse_headers, 'simple.h', join_paths(meson.build_root(), 'src', 'pulse', 'version.h') ] ])
- 
--versioning_link_args = '-Wl,-version-script=' + join_paths(meson.source_root(), 'src', 'pulse', 'map-file')
-+if meson.get_compiler('c').get_linker_id().startswith('ld.')
-+  versioning_link_args = '-Wl,-version-script=' + join_paths(meson.source_root(), 'src', 'pulse', 'map-file')
-+else
-+  versioning_link_args = []
-+endif
- 
- libpulse = shared_library('pulse',
-   libpulse_sources,
--- 
-2.35.1
-
diff --git a/pkgs/servers/pulseaudio/0007-Adapt-undefined-link-args-per-linker.patch b/pkgs/servers/pulseaudio/0007-Adapt-undefined-link-args-per-linker.patch
deleted file mode 100644
index 6893df8a7e2..00000000000
--- a/pkgs/servers/pulseaudio/0007-Adapt-undefined-link-args-per-linker.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 6f132be835d5acb5db4301ea1818601504e47fae Mon Sep 17 00:00:00 2001
-From: Andrew Childs <andrew.childs@bibo.com.ph>
-Date: Tue, 19 Apr 2022 17:41:34 +0900
-Subject: [PATCH 7/8] Adapt undefined link args per linker
-
-TODO: Why is this required? Isn't it default?
----
- src/modules/meson.build | 13 ++++++++++++-
- 1 file changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/src/modules/meson.build b/src/modules/meson.build
-index be72c3b9b..0163b583f 100644
---- a/src/modules/meson.build
-+++ b/src/modules/meson.build
-@@ -293,6 +293,17 @@ all_modules += [
- # FIXME: meson doesn't support multiple RPATH arguments currently
- rpath_dirs = join_paths(privlibdir) + ':' + join_paths(modlibexecdir)
- 
-+if meson.get_compiler('c').get_linker_id().startswith('ld.')
-+  no_undefined_link_args = [ '-Wl,--no-undefined' ]
-+elif meson.get_compiler('c').get_linker_id() == 'ld64'
-+  # TODO: is this required? is this not default?
-+  no_undefined_link_args = [ '-Wl,-undefined,error' ]
-+else
-+  # TODO: what platforms is this? what flag do they use?
-+  no_undefined_link_args = []
-+endif
-+
-+
- foreach m : all_modules
-   name = m[0]
-   sources = m[1]
-@@ -310,7 +321,7 @@ foreach m : all_modules
-     install_rpath : rpath_dirs,
-     install_dir : modlibexecdir,
-     dependencies : [thread_dep, libpulse_dep, libpulsecommon_dep, libpulsecore_dep, libintl_dep, platform_dep, platform_socket_dep] + extra_deps,
--    link_args : [nodelete_link_args, '-Wl,--no-undefined' ],
-+    link_args : [nodelete_link_args, no_undefined_link_args ],
-     link_with : extra_libs,
-     name_prefix : '',
-     implicit_include_directories : false)
--- 
-2.35.1
-
diff --git a/pkgs/servers/pulseaudio/0007-Fix-link-args-on-darwin.patch b/pkgs/servers/pulseaudio/0007-Fix-link-args-on-darwin.patch
new file mode 100644
index 00000000000..30a11adca08
--- /dev/null
+++ b/pkgs/servers/pulseaudio/0007-Fix-link-args-on-darwin.patch
@@ -0,0 +1,75 @@
+diff --git a/meson.build b/meson.build
+index c5135330f..1b66a1fc4 100644
+--- a/meson.build
++++ b/meson.build
+@@ -424,7 +424,7 @@ cdata.set('MESON_BUILD', 1)
+ # so we request the nodelete flag to be enabled.
+ # On other systems, we don't really know how to do that, but it's welcome if somebody can tell.
+ # Windows doesn't support this flag.
+-if host_machine.system() != 'windows'
++if host_machine.system() not in ['windows', 'darwin']
+   nodelete_link_args = ['-Wl,-z,nodelete']
+ else
+   nodelete_link_args = []
+diff --git a/src/modules/echo-cancel/meson.build b/src/modules/echo-cancel/meson.build
+index 641cd35e7..523bffac4 100644
+--- a/src/modules/echo-cancel/meson.build
++++ b/src/modules/echo-cancel/meson.build
+@@ -10,12 +10,17 @@ libwebrtc_util_sources = [
+   'webrtc.cc'
+ ]
+ 
++ignore_unresolved_symbols_link_args = ['-Wl,--unresolved-symbols=ignore-in-object-files']
++if meson.get_compiler('c').get_linker_id() == 'ld64'
++  ignore_unresolved_symbols_link_args = [ '-Wl,-undefined,dynamic_lookup' ]
++endif
++
+ libwebrtc_util = shared_library('webrtc-util',
+   libwebrtc_util_sources,
+   cpp_args : [pa_c_args, server_c_args],
+   include_directories : [configinc, topinc],
+   dependencies : [libpulse_dep, libpulsecommon_dep, libpulsecore_dep, libatomic_ops_dep, webrtc_dep, libintl_dep],
+-  link_args : [nodelete_link_args, '-Wl,--unresolved-symbols=ignore-in-object-files'],
++  link_args : [nodelete_link_args, ignore_unresolved_symbols_link_args],
+   install : true,
+   install_rpath : privlibdir,
+   install_dir : modlibexecdir,
+diff --git a/src/modules/meson.build b/src/modules/meson.build
+index 1e12569dc..66f3e46a4 100644
+--- a/src/modules/meson.build
++++ b/src/modules/meson.build
+@@ -298,6 +298,11 @@ all_modules += [
+ # FIXME: meson doesn't support multiple RPATH arguments currently
+ rpath_dirs = join_paths(privlibdir) + ':' + join_paths(modlibexecdir)
+ 
++no_undefined_link_args = ['-Wl,--no-undefined']
++if meson.get_compiler('c').get_linker_id() == 'ld64'
++  no_undefined_link_args = [ '-Wl,-undefined,error' ]
++endif
++
+ foreach m : all_modules
+   name = m[0]
+   sources = m[1]
+@@ -315,7 +320,7 @@ foreach m : all_modules
+     install_rpath : rpath_dirs,
+     install_dir : modlibexecdir,
+     dependencies : [thread_dep, libpulse_dep, libpulsecommon_dep, libpulsecore_dep, libintl_dep, platform_dep, platform_socket_dep] + extra_deps,
+-    link_args : [nodelete_link_args, '-Wl,--no-undefined' ],
++    link_args : [nodelete_link_args, no_undefined_link_args ],
+     link_with : extra_libs,
+     name_prefix : '',
+     implicit_include_directories : false)
+diff --git a/src/pulse/meson.build b/src/pulse/meson.build
+index 1b82c807c..938e4addd 100644
+--- a/src/pulse/meson.build
++++ b/src/pulse/meson.build
+@@ -75,6 +75,9 @@ run_target('update-map-file',
+               [ libpulse_headers, 'simple.h', join_paths(meson.build_root(), 'src', 'pulse', 'version.h') ] ])
+ 
+ versioning_link_args = '-Wl,-version-script=' + join_paths(meson.source_root(), 'src', 'pulse', 'map-file')
++if meson.get_compiler('c').get_linker_id() == 'ld64'
++  versioning_link_args = []
++endif
+ 
+ libpulse = shared_library('pulse',
+   libpulse_sources,
diff --git a/pkgs/servers/pulseaudio/0008-Use-correct-semaphore-on-darwin.patch b/pkgs/servers/pulseaudio/0008-Use-correct-semaphore-on-darwin.patch
deleted file mode 100644
index 27453466562..00000000000
--- a/pkgs/servers/pulseaudio/0008-Use-correct-semaphore-on-darwin.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 1a840b6e517004c902dfbea3d358b344c9588978 Mon Sep 17 00:00:00 2001
-From: Andrew Childs <andrew.childs@bibo.com.ph>
-Date: Tue, 19 Apr 2022 17:49:08 +0900
-Subject: [PATCH 8/8] Use correct semaphore on darwin
-
----
- src/meson.build | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/src/meson.build b/src/meson.build
-index 5bd68cb12..041e2fab4 100644
---- a/src/meson.build
-+++ b/src/meson.build
-@@ -183,9 +183,13 @@ else
-   libpulsecommon_sources += [
-     'pulsecore/mutex-posix.c',
-     'pulsecore/poll-posix.c',
--    'pulsecore/semaphore-posix.c',
-     'pulsecore/thread-posix.c'
-   ]
-+  if host_machine.system() == 'darwin'
-+    libpulsecommon_sources += [ 'pulsecore/semaphore-osx.c' ]
-+  else
-+    libpulsecommon_sources += [ 'pulsecore/semaphore-posix.c' ]
-+  endif
- endif
- # FIXME: Do SIMD things
- 
--- 
-2.35.1
-
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 95ee97ef6c8..ee2c0e0bd1c 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -9,7 +9,7 @@
 
 , x11Support ? false
 
-, useSystemd ? true
+, useSystemd ? stdenv.isLinux
 
 , # Whether to support the JACK sound system as a backend.
   jackaudioSupport ? false
@@ -19,44 +19,44 @@
 
 , airtunesSupport ? false
 
-, bluetoothSupport ? true
+, bluetoothSupport ? stdenv.isLinux
 , advancedBluetoothCodecs ? false
 
 , remoteControlSupport ? false
 
 , zeroconfSupport ? false
 
+, alsaSupport ? stdenv.isLinux
+, udevSupport ? stdenv.isLinux
+
 , # Whether to build only the library.
   libOnly ? false
 
-, AudioUnit, Cocoa, CoreServices
+, AudioUnit, Cocoa, CoreServices, CoreAudio
 }:
 
 stdenv.mkDerivation rec {
   pname = "${if libOnly then "lib" else ""}pulseaudio";
-  version = "15.0";
+  version = "16.1";
 
   src = fetchurl {
     url = "http://freedesktop.org/software/pulseaudio/releases/pulseaudio-${version}.tar.xz";
-    sha256 = "pAuIejupjMJpdusRvbZhOYjxRbGQJNG2VVxqA8nLoaA=";
+    sha256 = "sha256-ju8yzpHUeXn5X9mpNec4zX63RjQw2rxyhjJRdR5QSuQ=";
   };
 
   patches = [
     # Install sysconfdir files inside of the nix store,
     # but use a conventional runtime sysconfdir outside the store
     ./add-option-for-installation-sysconfdir.patch
-  ] ++ lib.optionals stdenv.isDarwin [
     # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/654
-    ./0001-Make-gio-2.0-optional-when-gsettings-is-disabled.patch
-
+    (./0001-Make-gio-2.0-optional-${lib.versions.major version}.patch)
     # TODO (not sent upstream)
-    ./0002-Ignore-SCM_CREDS-on-macOS.patch
-    ./0003-Disable-z-nodelete-on-darwin.patch
-    ./0004-Prefer-clock_gettime.patch
-    ./0005-Include-poll-posix.c-on-darwin.patch
-    ./0006-Only-use-version-script-on-GNU-ish-linkers.patch
-    ./0007-Adapt-undefined-link-args-per-linker.patch
-    ./0008-Use-correct-semaphore-on-darwin.patch
+    ./0002-Ignore-SCM_CREDS-on-darwin.patch
+    ./0003-Ignore-HAVE_CPUID_H-on-aarch64-darwin.patch
+    ./0004-Prefer-HAVE_CLOCK_GETTIME-on-darwin.patch
+    ./0005-Enable-CoreAudio-on-darwin.patch
+    ./0006-Fix-libpulsecommon-sources-on-darwin.patch
+    ./0007-Fix-link-args-on-darwin.patch
   ];
 
   outputs = [ "out" "dev" ];
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ libtool libsndfile soxr speexdsp fftwFloat check ]
     ++ lib.optionals stdenv.isLinux [ glib dbus ]
-    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreServices libintl ]
+    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreServices CoreAudio libintl ]
     ++ lib.optionals (!libOnly) (
       [ libasyncns webrtc-audio-processing ]
       ++ lib.optional jackaudioSupport libjack2
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
   );
 
   mesonFlags = [
-    "-Dalsa=${if !libOnly then "enabled" else "disabled"}"
+    "-Dalsa=${if !libOnly && alsaSupport then "enabled" else "disabled"}"
     "-Dasyncns=${if !libOnly then "enabled" else "disabled"}"
     "-Davahi=${if zeroconfSupport then "enabled" else "disabled"}"
     "-Dbluez5=${if !libOnly && bluetoothSupport then "enabled" else "disabled"}"
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
     "-Dorc=disabled"
     "-Dsystemd=${if useSystemd && !libOnly then "enabled" else "disabled"}"
     "-Dtcpwrap=disabled"
-    "-Dudev=${if !libOnly then "enabled" else "disabled"}"
+    "-Dudev=${if !libOnly && udevSupport then "enabled" else "disabled"}"
     "-Dvalgrind=disabled"
     "-Dwebrtc-aec=${if !libOnly then "enabled" else "disabled"}"
     "-Dx11=${if x11Support then "enabled" else "disabled"}"
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
     "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
   ]
   ++ lib.optional (stdenv.isLinux && useSystemd) "-Dsystemduserunitdir=${placeholder "out"}/lib/systemd/user"
-  ++ lib.optionals (stdenv.isDarwin) [
+  ++ lib.optionals stdenv.isDarwin [
     "-Ddbus=disabled"
     "-Dglib=disabled"
     "-Doss-output=disabled"
@@ -144,10 +144,21 @@ stdenv.mkDerivation rec {
     wrapProgram $out/libexec/pulse/gsettings-helper \
      --prefix XDG_DATA_DIRS : "$out/share/gsettings-schemas/${pname}-${version}" \
      --prefix GIO_EXTRA_MODULES : "${lib.getLib dconf}/lib/gio/modules"
+  ''
+  # add .so symlinks for modules to be found under macOS
+  + lib.optionalString stdenv.isDarwin ''
+    for file in $out/${passthru.pulseDir}/modules/*.dylib; do
+      ln -s "''$file" "''${file%.dylib}.so"
+      ln -s "''$file" "$out/lib/pulseaudio/''$(basename ''$file .dylib).so"
+    done
   '';
 
   passthru = {
-    pulseDir = "lib/pulse-" + lib.versions.majorMinor version;
+    pulseDir =
+      if (lib.versionAtLeast version "16.0") then
+        "lib/pulseaudio"
+      else
+        "lib/pulse-" + lib.versions.majorMinor version;
   };
 
   meta = {
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 83bdcec7397..364f574250b 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -14,7 +14,7 @@ let
       , this, self, newScope, buildEnv
 
       # source specification
-      , version, sha256, psqlSchema,
+      , version, hash, psqlSchema,
 
       # for tests
       nixosTests, thisAttr
@@ -30,7 +30,7 @@ let
 
     src = fetchurl {
       url = "mirror://postgresql/source/v${version}/${pname}-${version}.tar.bz2";
-      inherit sha256;
+      inherit hash;
     };
 
     hardeningEnable = lib.optionals (!stdenv.cc.isClang) [ "pie" ];
@@ -201,9 +201,9 @@ let
 in self: {
 
   postgresql_10 = self.callPackage generic {
-    version = "10.21";
+    version = "10.22";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "sha256-0yGYhW1Sqab11QZC74ZoesBYvW78pcntV754CElvRdE=";
+    hash = "sha256-lVl3VVxp3xpk9EuB1KGYfrdKu9GHBXn1rZ2UYTPdjk0=";
     this = self.postgresql_10;
     thisAttr = "postgresql_10";
     inherit self;
@@ -211,36 +211,36 @@ in self: {
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.16";
+    version = "11.17";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "sha256-LdnhEfCllJ7nyswGXOoPshCSkpuuMQzgW/AbT/xRA6U=";
+    hash = "sha256-bphJY64HZeYVd5lRA6fmWU2w8L0BUorBI+DeSmpMtMQ=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.11";
+    version = "12.12";
     psqlSchema = "12";
-    sha256 = "sha256-ECYkil/Svur0PkxyNqyBflbVi2gaM1hWRl37x1s+gwI=";
+    hash = "sha256-NLPxxpQI4iBowMcbGCdpHxyJFTsK1XbBpE+JIKhYA5w=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.7";
+    version = "13.8";
     psqlSchema = "13";
-    sha256 = "sha256-G5Bb9PPYNhSjk7PFH9NFkQ/SYeT1Ekpo2aH906KkY5k=";
+    hash = "sha256-c4dv3TpRcIc0BFjcpM4VuNKk286zNMBEFCRVGubEze0=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.4";
+    version = "14.5";
     psqlSchema = "14";
-    sha256 = "sha256-wjtiN8UjHHkVEb3HkJhhfWhS6eO982Dv2LXRWho9j2o=";
+    hash = "sha256-1PcstfuFfJqfdeyM8JGhdxJygC8hePCy5lt7b/ZPSjA=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index ea1acfb4edf..466f2937853 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-ExtensionLayer";
       rev = "sdk-${version}";
-      sha256 = "sha256-ixCfHnp6YAOuR4NMTGjhhqkfm0H7ZcO/8xKFJqw16YE=";
+      hash = "sha256-h38LxV8G72Xxh44212IoGKQ0tKXwBnSpBjTB2gsr1zA=";
     });
 
   nativeBuildInputs = [ cmake jq ];
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 7bdfafad13f..df0e9398eb7 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -23,14 +23,14 @@
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
   # The version must match that in vulkan-headers
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "LunarG";
       repo = "VulkanTools";
       rev = "sdk-${version}";
-      sha256 = "sha256-Pkz2FV0AnTKm/4jVmkQNkYzpxpKJaSoy2fRAhVh5OKU=";
+      hash = "sha256-NhYQSL5iU7iSO5Q6lp1iwhbi5GEfD11MDmBn9Uk1jm0=";
       fetchSubmodules = true;
     });
 
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 7944a4036b6..3660632e16e 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.211.0";
+  version = "1.3.216.0";
 
   # It's not strictly necessary to have matching versions here, however
   # since we're using the SDK version we may as well be consistent with
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
       owner = "KhronosGroup";
       repo = "Vulkan-Tools";
       rev = "sdk-${version}";
-      sha256 = "sha256-iXsWTKNllPZy1Kpo3JHzEEus3Hu9LofvMB3c4Gn6/DM=";
+      hash = "sha256-VEMeURNboiOwPGrtFGUt9ZyChj8pV0xcpydrarcwtF0=";
     });
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 8992e9ff0da..3e34a81cd4f 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -2,6 +2,7 @@
 , db
 , fetchurl
 , groff
+, gzip
 , lib
 , libiconv
 , libpipeline
@@ -68,8 +69,7 @@ stdenv.mkDerivation rec {
     # make sure that we don't wrap symlinks (since that changes argv[0] to the -wrapped name)
     find "$out/bin" -type f | while read file; do
       wrapProgram "$file" \
-        --prefix PATH : "${lib.getBin groff}/bin" \
-        --prefix PATH : "${lib.getBin zstd}/bin"
+        --prefix PATH : "${lib.makeBinPath [ groff gzip zstd ]}"
     done
   '';
 
diff --git a/pkgs/tools/networking/wifite2/default.nix b/pkgs/tools/networking/wifite2/default.nix
index 98ca976fd3e..cfae235f4cb 100644
--- a/pkgs/tools/networking/wifite2/default.nix
+++ b/pkgs/tools/networking/wifite2/default.nix
@@ -42,8 +42,7 @@ python3.pkgs.buildPythonApplication rec {
     pixiewps
   ];
 
-  checkInputs = propagatedBuildInputs;
-  checkPhase = "python -m unittest discover tests -v";
+  checkInputs = propagatedBuildInputs ++ [ python3.pkgs.unittestCheckHook ];
 
   meta = with lib; {
     homepage = "https://github.com/kimocoder/wifite2";
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index b7cfde58070..66bcde73714 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pciutils";
-  version = "3.7.0"; # with release-date database
+  version = "3.8.0"; # with release-date database
 
   src = fetchurl {
     url = "mirror://kernel/software/utils/pciutils/pciutils-${version}.tar.xz";
-    sha256 = "1ss0rnfsx8gvqjxaji4mvbhf9xyih4cadmgadbwwv8mnx1xvjh4x";
+    sha256 = "sha256-ke29BCmoRwXJrRVtT/OMzHJNQepUxMW4jjjplvijTwU=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9ab098a0056..9d6136d78cc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13980,7 +13980,7 @@ with pkgs;
     stdenv = gcc7Stdenv;
   }));
 
-  llvmPackages_latest = llvmPackages_13;
+  llvmPackages_latest = llvmPackages_14;
 
   llvmPackages_rocm = recurseIntoAttrs (callPackage ../development/compilers/llvm/rocm { });
 
@@ -14186,18 +14186,18 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_62 = callPackage ../development/compilers/rust/1_62.nix {
+  rust_1_63 = callPackage ../development/compilers/rust/1_63.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_14 = llvmPackages_14.libllvm;
   };
-  rust = rust_1_62;
+  rust = rust_1_63;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
   mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix { stdenv = gcc10StdenvCompat; };
 
-  rustPackages_1_62 = rust_1_62.packages.stable;
-  rustPackages = rustPackages_1_62;
+  rustPackages_1_63 = rust_1_63.packages.stable;
+  rustPackages = rustPackages_1_63;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -18866,7 +18866,7 @@ with pkgs;
   libcamera = callPackage ../development/libraries/libcamera { };
 
   libcanberra = callPackage ../development/libraries/libcanberra {
-    inherit (darwin.apple_sdk.frameworks) Carbon CoreServices;
+    inherit (darwin.apple_sdk.frameworks) Carbon CoreServices AppKit;
   };
   libcanberra-gtk2 = pkgs.libcanberra.override {
     gtkSupport = "gtk2";
@@ -22839,7 +22839,7 @@ with pkgs;
   hsphfpd = callPackage ../servers/pulseaudio/hsphfpd.nix { };
 
   pulseaudio = callPackage ../servers/pulseaudio {
-    inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit Cocoa;
+    inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit Cocoa CoreAudio;
   };
 
   qpaeq = libsForQt5.callPackage ../servers/pulseaudio/qpaeq.nix { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e07c8e0a1bd..556a05cf99d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -125,6 +125,7 @@ in {
     pythonRemoveTestsDirHook
     setuptoolsBuildHook
     setuptoolsCheckHook
+    unittestCheckHook
     venvShellHook
     wheelUnpackHook;