summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml13
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md6
-rw-r--r--nixos/modules/security/pam.nix2
-rw-r--r--nixos/modules/system/activation/top-level.nix4
-rw-r--r--nixos/modules/system/boot/systemd.nix16
-rw-r--r--pkgs/applications/audio/mpc/default.nix9
-rw-r--r--pkgs/applications/audio/parlatype/default.nix2
-rw-r--r--pkgs/applications/audio/shortwave/default.nix1
-rw-r--r--pkgs/applications/audio/squishyball/default.nix2
-rw-r--r--pkgs/applications/audio/zrythm/default.nix9
-rw-r--r--pkgs/applications/editors/gnome-builder/default.nix14
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/graphics/gcolor3/default.nix8
-rw-r--r--pkgs/applications/graphics/graphicsmagick/default.nix4
-rw-r--r--pkgs/applications/kde/kamoso.nix2
-rw-r--r--pkgs/applications/misc/iptsd/default.nix2
-rw-r--r--pkgs/applications/misc/metadata-cleaner/default.nix4
-rw-r--r--pkgs/applications/misc/notejot/default.nix24
-rw-r--r--pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch20
-rw-r--r--pkgs/applications/misc/qt-video-wlr/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/nyxt/default.nix2
-rw-r--r--pkgs/applications/networking/irc/hexchat/default.nix2
-rw-r--r--pkgs/applications/office/gtg/default.nix8
-rw-r--r--pkgs/applications/version-management/commitizen/default.nix49
-rw-r--r--pkgs/applications/video/kooha/default.nix1
-rw-r--r--pkgs/applications/window-managers/sway/default.nix4
-rw-r--r--pkgs/build-support/bintools-wrapper/ld-wrapper.sh2
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh2
-rw-r--r--pkgs/build-support/libredirect/default.nix39
-rw-r--r--pkgs/build-support/libredirect/libredirect.c12
-rw-r--r--pkgs/build-support/rust/hooks/cargo-build-hook.sh3
-rw-r--r--pkgs/build-support/setup-hooks/make-wrapper.sh9
-rw-r--r--pkgs/build-support/trivial-builders.nix18
-rw-r--r--pkgs/build-support/trivial-builders/test-overriding.nix63
-rw-r--r--pkgs/data/misc/cacert/default.nix4
-rw-r--r--pkgs/data/misc/shared-mime-info/default.nix20
-rw-r--r--pkgs/desktops/arcan/xarcan/default.nix9
-rw-r--r--pkgs/desktops/gnome/apps/gnome-todo/default.nix23
-rw-r--r--pkgs/desktops/gnome/core/eog/default.nix14
-rw-r--r--pkgs/desktops/gnome/core/epiphany/default.nix11
-rw-r--r--pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix6
-rw-r--r--pkgs/desktops/gnome/core/nautilus/default.nix16
-rw-r--r--pkgs/development/compilers/llvm/10/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/10/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/10/llvm/default.nix78
-rw-r--r--pkgs/development/compilers/llvm/10/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/11/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/11/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/11/llvm/default.nix88
-rw-r--r--pkgs/development/compilers/llvm/11/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/12/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/12/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/12/llvm/default.nix90
-rw-r--r--pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch13
-rw-r--r--pkgs/development/compilers/llvm/12/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/13/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/13/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/13/llvm/default.nix60
-rw-r--r--pkgs/development/compilers/llvm/13/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/5/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/default.nix76
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/6/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/6/llvm/default.nix78
-rw-r--r--pkgs/development/compilers/llvm/6/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/7/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/7/llvm/default.nix80
-rw-r--r--pkgs/development/compilers/llvm/7/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/8/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/8/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/8/llvm/default.nix80
-rw-r--r--pkgs/development/compilers/llvm/8/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/9/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/9/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/default.nix78
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/git/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/git/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/default.nix60
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/outputs.patch16
-rw-r--r--pkgs/development/compilers/llvm/llvm-config-link-static.patch12
-rw-r--r--pkgs/development/compilers/orc/default.nix3
-rw-r--r--pkgs/development/compilers/rust/rustc.nix3
-rw-r--r--pkgs/development/compilers/vala/default.nix4
-rw-r--r--pkgs/development/interpreters/python/default.nix1
-rw-r--r--pkgs/development/interpreters/spidermonkey/78.nix13
-rw-r--r--pkgs/development/interpreters/spidermonkey/add-riscv64-support.patch123
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg-full/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix5
-rw-r--r--pkgs/development/libraries/glibc/2.33-master.patch.gzbin65714 -> 69704 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/grilo-plugins/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix13
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix10
-rw-r--r--pkgs/development/libraries/gstreamer/devtools/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ges/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/libav/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/rtsp-server/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ugly/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/vaapi/default.nix4
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix14
-rw-r--r--pkgs/development/libraries/gtk/4.x.nix14
-rw-r--r--pkgs/development/libraries/hunspell/default.nix10
-rw-r--r--pkgs/development/libraries/iso-codes/default.nix8
-rw-r--r--pkgs/development/libraries/libadwaita/default.nix10
-rw-r--r--pkgs/development/libraries/libepoxy/default.nix9
-rw-r--r--pkgs/development/libraries/libextractor/default.nix2
-rw-r--r--pkgs/development/libraries/libfabric/default.nix4
-rw-r--r--pkgs/development/libraries/libffi/default.nix6
-rw-r--r--pkgs/development/libraries/libfprint-tod/default.nix4
-rw-r--r--pkgs/development/libraries/libgda/default.nix4
-rw-r--r--pkgs/development/libraries/libhttpseverywhere/default.nix7
-rw-r--r--pkgs/development/libraries/libhwy/default.nix47
-rw-r--r--pkgs/development/libraries/libjxl/default.nix28
-rw-r--r--pkgs/development/libraries/libmodulemd/default.nix1
-rw-r--r--pkgs/development/libraries/libnice/default.nix2
-rw-r--r--pkgs/development/libraries/libportal/default.nix46
-rw-r--r--pkgs/development/libraries/libseccomp/default.nix12
-rw-r--r--pkgs/development/libraries/libsoup/3.x.nix4
-rw-r--r--pkgs/development/libraries/libthai/default.nix4
-rw-r--r--pkgs/development/libraries/libtiff/default.nix8
-rw-r--r--pkgs/development/libraries/libuv/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix12
-rw-r--r--pkgs/development/libraries/mesa/musl.patch59
-rw-r--r--pkgs/development/libraries/ncurses/default.nix4
-rw-r--r--pkgs/development/libraries/nss/default.nix4
-rw-r--r--pkgs/development/libraries/openexr/3.nix18
-rw-r--r--pkgs/development/libraries/openexr/default.nix7
-rw-r--r--pkgs/development/libraries/pango/default.nix4
-rw-r--r--pkgs/development/libraries/pangomm/2.48.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.12/default.nix2
-rw-r--r--pkgs/development/libraries/qt-5/5.14/default.nix2
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix2
-rw-r--r--pkgs/development/libraries/re2/default.nix12
-rw-r--r--pkgs/development/libraries/retro-gtk/default.nix6
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix7
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix7
-rw-r--r--pkgs/development/libraries/tracker/default.nix8
-rw-r--r--pkgs/development/libraries/wlroots/0.15.nix4
-rw-r--r--pkgs/development/libraries/xxHash/default.nix9
-rw-r--r--pkgs/development/ocaml-modules/ca-certs/default.nix3
-rw-r--r--pkgs/development/python-modules/adal/default.nix42
-rw-r--r--pkgs/development/python-modules/attrs/default.nix14
-rw-r--r--pkgs/development/python-modules/charset-normalizer/default.nix12
-rw-r--r--pkgs/development/python-modules/dbus/default.nix2
-rw-r--r--pkgs/development/python-modules/django-redis/default.nix9
-rw-r--r--pkgs/development/python-modules/django/2.nix4
-rw-r--r--pkgs/development/python-modules/django/3.nix4
-rw-r--r--pkgs/development/python-modules/flit-core/default.nix7
-rw-r--r--pkgs/development/python-modules/flit/default.nix14
-rw-r--r--pkgs/development/python-modules/hiredis/default.nix11
-rw-r--r--pkgs/development/python-modules/html-sanitizer/default.nix16
-rw-r--r--pkgs/development/python-modules/html5lib/default.nix10
-rw-r--r--pkgs/development/python-modules/importlib-metadata/default.nix6
-rw-r--r--pkgs/development/python-modules/lz4/default.nix69
-rw-r--r--pkgs/development/python-modules/matplotlib-inline/default.nix2
-rw-r--r--pkgs/development/python-modules/mypy/default.nix4
-rw-r--r--pkgs/development/python-modules/packaging/default.nix4
-rw-r--r--pkgs/development/python-modules/paramiko/default.nix47
-rw-r--r--pkgs/development/python-modules/platformdirs/default.nix12
-rw-r--r--pkgs/development/python-modules/poetry/default.nix7
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix4
-rw-r--r--pkgs/development/python-modules/pycryptodome-test-vectors/default.nix30
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix20
-rw-r--r--pkgs/development/python-modules/pycryptodomex/default.nix13
-rw-r--r--pkgs/development/python-modules/pytenable/default.nix12
-rw-r--r--pkgs/development/python-modules/redis/default.nix41
-rw-r--r--pkgs/development/python-modules/restfly/default.nix10
-rw-r--r--pkgs/development/python-modules/typing-extensions/default.nix46
-rw-r--r--pkgs/development/python-modules/tzdata/default.nix18
-rw-r--r--pkgs/development/python-modules/unicodedata2/default.nix17
-rw-r--r--pkgs/development/python-modules/wrapt/default.nix28
-rw-r--r--pkgs/development/python-modules/yapf/default.nix4
-rw-r--r--pkgs/development/tools/ashpd-demo/default.nix1
-rw-r--r--pkgs/development/tools/build-managers/gnumake/default.nix1
-rw-r--r--pkgs/development/tools/build-managers/meson/0.57/boost-Do-not-add-system-paths-on-nix.patch40
-rw-r--r--pkgs/development/tools/build-managers/meson/0.57/default.nix94
-rw-r--r--pkgs/development/tools/build-managers/meson/0.57/gir-fallback-path.patch16
-rw-r--r--pkgs/development/tools/build-managers/meson/0.57/more-env-vars.patch13
-rw-r--r--pkgs/development/tools/build-managers/meson/0.60/allow-dirs-outside-of-prefix.patch19
-rw-r--r--pkgs/development/tools/build-managers/meson/0.60/clear-old-rpath.patch20
-rw-r--r--pkgs/development/tools/build-managers/meson/0.60/fix-rpath.patch24
-rw-r--r--pkgs/development/tools/build-managers/meson/0.60/setup-hook.sh37
-rw-r--r--pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch (renamed from pkgs/development/tools/build-managers/meson/0.57/allow-dirs-outside-of-prefix.patch)0
-rw-r--r--pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch (renamed from pkgs/development/tools/build-managers/meson/0.60/boost-Do-not-add-system-paths-on-nix.patch)0
-rw-r--r--pkgs/development/tools/build-managers/meson/clear-old-rpath.patch (renamed from pkgs/development/tools/build-managers/meson/0.57/clear-old-rpath.patch)0
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix (renamed from pkgs/development/tools/build-managers/meson/0.60/default.nix)4
-rw-r--r--pkgs/development/tools/build-managers/meson/do-not-update-ldconfig-cache.patch12
-rw-r--r--pkgs/development/tools/build-managers/meson/fix-rpath.patch (renamed from pkgs/development/tools/build-managers/meson/0.57/fix-rpath.patch)0
-rw-r--r--pkgs/development/tools/build-managers/meson/gir-fallback-path.patch (renamed from pkgs/development/tools/build-managers/meson/0.60/gir-fallback-path.patch)0
-rw-r--r--pkgs/development/tools/build-managers/meson/more-env-vars.patch (renamed from pkgs/development/tools/build-managers/meson/0.60/more-env-vars.patch)0
-rw-r--r--pkgs/development/tools/build-managers/meson/setup-hook.sh (renamed from pkgs/development/tools/build-managers/meson/0.57/setup-hook.sh)0
-rw-r--r--pkgs/development/tools/misc/intel-gpu-tools/default.nix9
-rw-r--r--pkgs/development/tools/pandoc/default.nix2
-rw-r--r--pkgs/games/rogue/default.nix3
-rw-r--r--pkgs/games/vdrift/default.nix20
-rw-r--r--pkgs/misc/cups/default.nix4
-rw-r--r--pkgs/misc/ghostscript/default.nix15
-rw-r--r--pkgs/misc/scrcpy/default.nix1
-rw-r--r--pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh1
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix18
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/configd/default.nix15
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix6
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix2
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch232
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix14
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix2
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix14
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix10
-rw-r--r--pkgs/os-specific/linux/lvm2/common.nix39
-rw-r--r--pkgs/os-specific/linux/lvm2/no-shared.diff25
-rw-r--r--pkgs/os-specific/linux/pam/default.nix12
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix4
-rw-r--r--pkgs/servers/home-assistant/default.nix31
-rw-r--r--pkgs/servers/pulseaudio/default.nix6
-rw-r--r--pkgs/stdenv/booter.nix8
-rw-r--r--pkgs/stdenv/cross/default.nix2
-rw-r--r--pkgs/stdenv/darwin/default.nix5
-rw-r--r--pkgs/stdenv/generic/default.nix7
-rw-r--r--pkgs/stdenv/linux/bootstrap-files/aarch64.nix8
-rw-r--r--pkgs/tools/admin/azure-cli/python-packages.nix2
-rw-r--r--pkgs/tools/audio/yabridge/default.nix6
-rw-r--r--pkgs/tools/compression/zstd/default.nix17
-rw-r--r--pkgs/tools/compression/zstd/playtests-darwin.patch9
-rw-r--r--pkgs/tools/misc/wyrd/default.nix2
-rw-r--r--pkgs/tools/networking/curl/default.nix93
-rw-r--r--pkgs/tools/networking/gmrender-resurrect/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix38
-rw-r--r--pkgs/top-level/python-packages.nix2
236 files changed, 2214 insertions, 1440 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a836de2aa65..78833d144b3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -513,6 +513,12 @@
     githubId = 38869148;
     name = "Alex Eyre";
   };
+  algorith = {
+    email = "dries_van_daele@telenet.be";
+    github = "DriesVanDaele";
+    githubId = 1141488;
+    name = "Dries Van Daele";
+  };
   alibabzo = {
     email = "alistair.bill@gmail.com";
     github = "alibabzo";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index d1692c66a4b..436157515eb 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -358,6 +358,19 @@
       </listitem>
       <listitem>
         <para>
+          The iputils package, which is installed by default, no longer
+          provides the legacy tools <literal>tftpd</literal> and
+          <literal>traceroute6</literal>. More tools
+          (<literal>ninfod</literal>, <literal>rarpd</literal>, and
+          <literal>rdisc</literal>) are going to be removed in the next
+          release. See
+          <link xlink:href="https://github.com/iputils/iputils/releases/tag/20211215">upstream’s
+          release notes</link> for more details and available
+          replacements.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           <literal>services.thelounge.private</literal> was removed in
           favor of <literal>services.thelounge.public</literal>, to
           follow with upstream changes.
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index f2484c911e7..9d919711cb7 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -116,6 +116,12 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `idris2` now requires `--package` when using packages `contrib` and `network`, while previously these idris2 packages were automatically loaded.
 
+- The iputils package, which is installed by default, no longer provides the
+  legacy tools `tftpd` and `traceroute6`. More tools (`ninfod`, `rarpd`, and
+  `rdisc`) are going to be removed in the next release. See
+  [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20211215)
+  for more details and available replacements.
+
 - `services.thelounge.private` was removed in favor of `services.thelounge.public`, to follow with upstream changes.
 
 - `pkgs.docbookrx` was removed since it's unmaintained
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 21202c55fe2..964cfe7040c 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -1035,7 +1035,7 @@ in
         setuid = true;
         owner = "root";
         group = "root";
-        source = "${pkgs.pam}/sbin/unix_chkpwd.orig";
+        source = "${pkgs.pam}/bin/unix_chkpwd";
       };
     };
 
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index c9fef33c940..18ac717f5dd 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -55,8 +55,8 @@ let
       substituteInPlace $out/dry-activate --subst-var out
       chmod u+x $out/activate $out/dry-activate
       unset activationScript dryActivationScript
-      ${pkgs.stdenv.shell} -n $out/activate
-      ${pkgs.stdenv.shell} -n $out/dry-activate
+      ${pkgs.stdenv.shellDryRun} $out/activate
+      ${pkgs.stdenv.shellDryRun} $out/dry-activate
 
       cp ${config.system.build.bootStage2} $out/init
       substituteInPlace $out/init --subst-var-by systemConfig $out
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index ec5dea075bb..76c59c047e0 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -210,20 +210,14 @@ let
   makeJobScript = name: text:
     let
       scriptName = replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape name);
-      out = pkgs.writeTextFile {
+      out = (pkgs.writeShellScriptBin scriptName ''
+        set -e
+        ${text}
+      '').overrideAttrs (_: {
         # The derivation name is different from the script file name
         # to keep the script file name short to avoid cluttering logs.
         name = "unit-script-${scriptName}";
-        executable = true;
-        destination = "/bin/${scriptName}";
-        text = ''
-          #!${pkgs.runtimeShell} -e
-          ${text}
-        '';
-        checkPhase = ''
-          ${pkgs.stdenv.shell} -n "$out/bin/${scriptName}"
-        '';
-      };
+      });
     in "${out}/bin/${scriptName}";
 
   unitConfig = { config, options, ... }: {
diff --git a/pkgs/applications/audio/mpc/default.nix b/pkgs/applications/audio/mpc/default.nix
index 8fdd05776c9..cebf08f1908 100644
--- a/pkgs/applications/audio/mpc/default.nix
+++ b/pkgs/applications/audio/mpc/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , installShellFiles
 , libiconv
 , libmpdclient
@@ -21,6 +22,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
   };
 
+  patches = [
+    # fix the build with meson 0.60 (https://github.com/MusicPlayerDaemon/mpc/pull/76)
+    (fetchpatch {
+      url = "https://github.com/MusicPlayerDaemon/mpc/commit/b656ca4b6c2a0d5b6cebd7f7daa679352f664e0e.patch";
+      sha256 = "sha256-fjjSlCKxgkz7Em08CaK7+JAzl8YTzLcpGGMz2HJlsVw=";
+    })
+  ];
+
   buildInputs = [
     libmpdclient
   ]
diff --git a/pkgs/applications/audio/parlatype/default.nix b/pkgs/applications/audio/parlatype/default.nix
index 7b448cc69af..c1bb1102bf1 100644
--- a/pkgs/applications/audio/parlatype/default.nix
+++ b/pkgs/applications/audio/parlatype/default.nix
@@ -40,8 +40,6 @@ stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  mesonFlags = [ "-Dlibreoffice=false" ];
-
   postPatch = ''
     chmod +x data/meson_post_install.py
     patchShebangs data/meson_post_install.py
diff --git a/pkgs/applications/audio/shortwave/default.nix b/pkgs/applications/audio/shortwave/default.nix
index 0f4ffa14228..49492d05d15 100644
--- a/pkgs/applications/audio/shortwave/default.nix
+++ b/pkgs/applications/audio/shortwave/default.nix
@@ -80,6 +80,7 @@ stdenv.mkDerivation rec {
       desktop. It is the successor to the older Gradio application.
     '';
     maintainers = with maintainers; [ lasandell ];
+    broken = true; # incompatible with latest libadwaita
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/audio/squishyball/default.nix b/pkgs/applications/audio/squishyball/default.nix
index b44efc1534f..4a7f819e290 100644
--- a/pkgs/applications/audio/squishyball/default.nix
+++ b/pkgs/applications/audio/squishyball/default.nix
@@ -16,8 +16,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ flac libao libvorbis ncurses opusfile ];
 
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS";
-
   patches = [ ./gnu-screen.patch ];
 
   postInstall = ''
diff --git a/pkgs/applications/audio/zrythm/default.nix b/pkgs/applications/audio/zrythm/default.nix
index 8963cff4d12..70b7fbb745f 100644
--- a/pkgs/applications/audio/zrythm/default.nix
+++ b/pkgs/applications/audio/zrythm/default.nix
@@ -13,7 +13,6 @@
 , curl
 , dconf
 , libepoxy
-, ffmpeg
 , fftw
 , fftwFloat
 , flex
@@ -95,7 +94,6 @@ stdenv.mkDerivation rec {
     curl
     dconf
     libepoxy
-    ffmpeg
     fftw
     fftwFloat
     flex
@@ -133,10 +131,9 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Denable_ffmpeg=true"
-    "-Denable_rtmidi=true"
-    "-Denable_rtaudio=true"
-    "-Denable_sdl=true"
+    "-Drtmidi=enabled"
+    "-Drtaudio=enabled"
+    "-Dsdl=enabled"
     "-Dcarla=enabled"
     "-Dmanpage=true"
     # "-Duser_manual=true" # needs sphinx-intl
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index d9092b55011..0e2ffe46d20 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -5,6 +5,7 @@
 , appstream-glib
 , desktop-file-utils
 , fetchurl
+, fetchpatch
 , flatpak
 , gnome
 , libgit2-glib
@@ -18,7 +19,7 @@
 , jsonrpc-glib
 , libdazzle
 , libpeas
-, libportal
+, libportal-gtk3
 , libxml2
 , meson
 , ninja
@@ -48,6 +49,15 @@ stdenv.mkDerivation rec {
     sha256 = "4iUPyOnp8gAsRS5ZUNgmhXNNPESAs1Fnq1CKyHAlCeE=";
   };
 
+  patches = [
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/gnome-builder/-/merge_requests/486
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-builder/-/commit/b3bfa0df53a3749c3b73cb6c4bad5cab3fa549a1.patch";
+      sha256 = "B/uCcYavFvOAPhLHZ4MRNENDd6VytILiGYwDZRUSxTE=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream-glib
     desktop-file-utils
@@ -69,7 +79,7 @@ stdenv.mkDerivation rec {
     glade
     libgit2-glib
     libpeas
-    libportal
+    libportal-gtk3
     vte
     gspell
     gtk3
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 42cae799285..51a9b9af5bf 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.3877";
+  version = "8.2.4186";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-NqTO2TdhOs63eP7CdWY9U9nbR7No3hqPV5rGhYF9arA=";
+    sha256 = "0g276mbmq69z7c4kgj59r0azxmx9ih2sd8v83dx2gfph6wgw65ph";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/gcolor3/default.nix b/pkgs/applications/graphics/gcolor3/default.nix
index 2771559416b..63725b97431 100644
--- a/pkgs/applications/graphics/gcolor3/default.nix
+++ b/pkgs/applications/graphics/gcolor3/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , libxml2
 , gtk3
-, libportal
+, libportal-gtk3
 , wrapGAppsHook
 }:
 
@@ -33,12 +33,16 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gtk3
-    libportal
+    libportal-gtk3
   ];
 
   postPatch = ''
     chmod +x meson_install.sh # patchShebangs requires executable file
     patchShebangs meson_install.sh
+
+    # https://gitlab.gnome.org/World/gcolor3/merge_requests/151
+    substituteInPlace meson.build --replace "dependency(${"\n"}  'libportal'" "dependency(${"\n"}  'libportal-gtk3'"
+    substituteInPlace src/gcolor3-color-selection.c --replace "libportal/portal-gtk3.h" "libportal-gtk3/portal-gtk3.h"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/graphics/graphicsmagick/default.nix b/pkgs/applications/graphics/graphicsmagick/default.nix
index 268e59d910b..fe387ddc273 100644
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "graphicsmagick";
-  version = "1.3.36";
+  version = "1.3.37";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "0ilg6fkppb4avzais1dvi3qf6ln7v3mzj7gjm83w7pwwfpg3ynsx";
+    sha256 = "sha256-kNwi8ae9JA5MkGWpQJYr8T2kPJm8w2yxEcw8Gg10d9Q=";
   };
 
   patches = [
diff --git a/pkgs/applications/kde/kamoso.nix b/pkgs/applications/kde/kamoso.nix
index 9baa06275a7..c80ed0c511e 100644
--- a/pkgs/applications/kde/kamoso.nix
+++ b/pkgs/applications/kde/kamoso.nix
@@ -34,7 +34,7 @@ mkDerivation {
   ];
 
   qtWrapperArgs = [
-    "--prefix GST_PLUGIN_PATH : ${lib.makeSearchPath "lib/gstreamer-1.0" gst}"
+    "--prefix GST_PLUGIN_PATH : ${lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gst}"
   ];
 
   meta = {
diff --git a/pkgs/applications/misc/iptsd/default.nix b/pkgs/applications/misc/iptsd/default.nix
index 297ea6dc6a2..7347c4b7849 100644
--- a/pkgs/applications/misc/iptsd/default.nix
+++ b/pkgs/applications/misc/iptsd/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       --replace "install_dir: rulesdir" "install_dir: datadir" \
   '';
   mesonFlags = [
-    "-Dsystemd=true"
+    "-Dservice_manager=systemd"
     "-Dsample_config=false"
     "-Ddebug_tool=false"
   ];
diff --git a/pkgs/applications/misc/metadata-cleaner/default.nix b/pkgs/applications/misc/metadata-cleaner/default.nix
index f113eed155f..01c8ade58c4 100644
--- a/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/pkgs/applications/misc/metadata-cleaner/default.nix
@@ -9,7 +9,7 @@
 , itstool
 , libadwaita
 , librsvg
-, meson_0_60
+, meson
 , ninja
 , pkg-config
 , poppler_gi
@@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
     glib
     gtk4
     itstool
-    meson_0_60
+    meson
     ninja
     pkg-config
     wrapGAppsHook
diff --git a/pkgs/applications/misc/notejot/default.nix b/pkgs/applications/misc/notejot/default.nix
index aad182bd187..24525443935 100644
--- a/pkgs/applications/misc/notejot/default.nix
+++ b/pkgs/applications/misc/notejot/default.nix
@@ -17,21 +17,27 @@
 
 stdenv.mkDerivation rec {
   pname = "notejot";
-  version = "3.2.0";
+  version = "3.3.3"; # make sure to recheck src.rev
 
   src = fetchFromGitHub {
     owner = "lainsce";
     repo = pname;
-    rev = version;
-    hash = "sha256-WyW1tGhO3+OykNa8BRavi93cBMOSBJw0M+0bwQHJOjU=";
+    # Note from Fedora spec file:
+    # https://src.fedoraproject.org/rpms/notejot/blob/bbe621cef4d5a2c27eed029063b8e8cfd7c8d400/f/notejot.spec
+    # Upstream confusingly made several bugfix post-releases of version 3.3.3,
+    # tagged as 3.4.x, but with prominent notices like "This is still 3.3.3". We
+    # respect upstream’s wishes (and the version numbers inside the source tarball)
+    # by packaging these releases as 3.3.3 with appropriate snapshot info.
+    # https://github.com/lainsce/notejot/releases/tag/3.4.9
+    #
+    # Note that sometimes upstream don't update their version in meson.build
+    # (https://github.com/lainsce/notejot/issues/236), always follow the version
+    # from Fedora Rawhide.
+    # https://github.com/lainsce/notejot/blob/3.4.9/meson.build#L1
+    rev = "3.4.9";
+    hash = "sha256-42k9CAnXAb7Ic580SIa95MDCkCWtso1F+0eD69HX8WI=";
   };
 
-  patches = [
-    # build: use gtk4-update-icon-cache
-    # https://github.com/lainsce/notejot/pull/307
-    ./use-gtk4-update-icon-cache.patch
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch b/pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch
deleted file mode 100644
index 9431c43cef6..00000000000
--- a/pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/build-aux/post_install.py b/build-aux/post_install.py
-index 1278304..fface6d 100644
---- a/build-aux/post_install.py
-+++ b/build-aux/post_install.py
-@@ -2,11 +2,13 @@
- import os
- import subprocess
- 
--schemadir = os.path.join(os.environ['MESON_INSTALL_PREFIX'], 'share', 'glib-2.0', 'schemas')
-+install_prefix = os.environ['MESON_INSTALL_PREFIX']
-+icondir = os.path.join(install_prefix, 'share', 'icons', 'hicolor')
-+schemadir = os.path.join(install_prefix, 'share', 'glib-2.0', 'schemas')
- 
- if not os.environ.get('DESTDIR'):
-     print('Compiling gsettings schemas…')
-     subprocess.call(['glib-compile-schemas', schemadir], shell=False)
- 
-     print('Rebuilding desktop icons cache...')
--    subprocess.call(['gtk-update-icon-cache', '/usr/share/icons/hicolor/'], shell=False)
-+    subprocess.call(['gtk4-update-icon-cache', '-qtf', icondir], shell=False)
diff --git a/pkgs/applications/misc/qt-video-wlr/default.nix b/pkgs/applications/misc/qt-video-wlr/default.nix
index bdb434085da..ffd22be085e 100644
--- a/pkgs/applications/misc/qt-video-wlr/default.nix
+++ b/pkgs/applications/misc/qt-video-wlr/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, meson, ninja, wayland, pixman, cairo, librsvg, wayland-protocols, wlroots, libxkbcommon, gst_all_1, wrapQtAppsHook, qtbase, qtmultimedia }:
 let
- gstreamerPath = with gst_all_1; lib.makeSearchPath "lib/gstreamer-1.0" [
+ gstreamerPath = with gst_all_1; lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" [
      gstreamer
      gst-plugins-base
      gst-plugins-good
diff --git a/pkgs/applications/networking/browsers/nyxt/default.nix b/pkgs/applications/networking/browsers/nyxt/default.nix
index 59bb2adbf51..ccbc7a8dc8f 100644
--- a/pkgs/applications/networking/browsers/nyxt/default.nix
+++ b/pkgs/applications/networking/browsers/nyxt/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     xclip notify-osd enchant
   ] ++ gstBuildInputs;
 
-  GST_PLUGIN_SYSTEM_PATH_1_0 = lib.concatMapStringsSep ":" (p: "${p}/lib/gstreamer-1.0") gstBuildInputs;
+  GST_PLUGIN_SYSTEM_PATH_1_0 = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstBuildInputs;
 
   dontWrapGApps = true;
   installPhase = ''
diff --git a/pkgs/applications/networking/irc/hexchat/default.nix b/pkgs/applications/networking/irc/hexchat/default.nix
index 504481479ed..fbe9971f1d7 100644
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/applications/networking/irc/hexchat/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  mesonFlags = [ "-Dwith-lua=lua" "-Dwith-text=true" ];
+  mesonFlags = [ "-Dwith-lua=lua" "-Dtext-frontend=true" ];
 
   postInstall = ''
     wrapProgram $out/bin/hexchat --prefix PYTHONPATH : "$PYTHONPATH"
diff --git a/pkgs/applications/office/gtg/default.nix b/pkgs/applications/office/gtg/default.nix
index 4b9237d23ce..6d536ea60a3 100644
--- a/pkgs/applications/office/gtg/default.nix
+++ b/pkgs/applications/office/gtg/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , meson
 , python3Packages
 , ninja
@@ -25,6 +26,13 @@ python3Packages.buildPythonApplication rec {
     sha256 = "0b2slm7kjq6q8c7v4m7aqc8m1ynjxn3bl7445srpv1xc0dilq403";
   };
 
+  patches = [
+    # fix build with meson 0.60 (https://github.com/getting-things-gnome/gtg/pull/729)
+    (fetchpatch {
+      url = "https://github.com/getting-things-gnome/gtg/commit/1809d10663ae3d8f69c04138b66f9b4e66ee14f6.patch";
+      sha256 = "sha256-bYr5PAsuvcSqTf0vaJj2APtuBrwHdhXJxtXoAb7CfGk=";
+    })
+  ];
 
   nativeBuildInputs = [
     meson
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
new file mode 100644
index 00000000000..fddffe6d198
--- /dev/null
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -0,0 +1,49 @@
+{ buildPythonApplication
+, lib
+, fetchFromGitHub
+, poetry
+, termcolor
+, questionary
+, colorama
+, decli
+, tomlkit
+, jinja2
+, pyyaml
+, argcomplete
+, typing-extensions
+}:
+
+buildPythonApplication rec {
+  pname = "commitizen";
+  version = "2.20.3";
+
+  src = fetchFromGitHub {
+    owner = "commitizen-tools";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-rAm2GTRxZIHQmn/FM0IwwH/2h+oOvzGmeVr5xkvD/zA=";
+  };
+
+  format = "pyproject";
+
+  nativeBuildInputs = [ poetry ];
+
+  propagatedBuildInputs = [
+    termcolor
+    questionary
+    colorama
+    decli
+    tomlkit
+    jinja2
+    pyyaml
+    argcomplete
+    typing-extensions
+  ];
+
+  meta = with lib; {
+    description = "Tool to create committing rules for projects, auto bump versions, and generate changelogs";
+    homepage = "https://github.com/commitizen-tools/commitizen";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lovesegfault ];
+  };
+}
diff --git a/pkgs/applications/video/kooha/default.nix b/pkgs/applications/video/kooha/default.nix
index f5be8664739..667dfd83d2c 100644
--- a/pkgs/applications/video/kooha/default.nix
+++ b/pkgs/applications/video/kooha/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
   # Fixes https://github.com/NixOS/nixpkgs/issues/31168
   postPatch = ''
     patchShebangs build-aux/meson_post_install.py
+    substituteInPlace meson.build --replace '>= 1.0.0-alpha.1' '>= 1.0.0'
   '';
 
   installCheckPhase = ''
diff --git a/pkgs/applications/window-managers/sway/default.nix b/pkgs/applications/window-managers/sway/default.nix
index 72ca71d5896..194525dcffb 100644
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, substituteAll, swaybg
-, meson_0_60, ninja, pkg-config, wayland-scanner, scdoc
+, meson, ninja, pkg-config, wayland-scanner, scdoc
 , wayland, libxkbcommon, pcre, json_c, dbus, libevdev
 , pango, cairo, libinput, libcap, pam, gdk-pixbuf, librsvg
 , wlroots, wayland-protocols, libdrm
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    meson_0_60 ninja pkg-config wayland-scanner scdoc
+    meson ninja pkg-config wayland-scanner scdoc
   ];
 
   buildInputs = [
diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index 2f96480f80c..fb01c5096d5 100644
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -30,7 +30,7 @@ expandResponseParams "$@"
 if [[ -n "${NIX_LINK_TYPE_@suffixSalt@:-}" ]]; then
     linkType=$NIX_LINK_TYPE_@suffixSalt@
 else
-    linkType=$(checkLinkType "$@")
+    linkType=$(checkLinkType "${params[@]}")
 fi
 
 if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index aa25de33641..1220841162c 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -31,7 +31,7 @@ cxxLibrary=1
 cInclude=1
 
 expandResponseParams "$@"
-linkType=$(checkLinkType "$@")
+linkType=$(checkLinkType "${params[@]}")
 
 declare -i n=0
 nParams=${#params[@]}
diff --git a/pkgs/build-support/libredirect/default.nix b/pkgs/build-support/libredirect/default.nix
index 0c86ea9a793..9ed00c8a8f6 100644
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, runCommand, lib, coreutils }:
+{ lib, stdenv, bintools-unwrapped, llvmPackages_13, coreutils }:
 
 if stdenv.hostPlatform.isStatic
 then throw ''
@@ -25,17 +25,36 @@ else stdenv.mkDerivation rec {
     cp ${./test.c} test.c
   '';
 
-  libName = "libredirect" + stdenv.targetPlatform.extensions.sharedLibrary;
-
   outputs = ["out" "hook"];
 
+  libName = "libredirect" + stdenv.targetPlatform.extensions.sharedLibrary;
+
   buildPhase = ''
     runHook preBuild
 
-    $CC -Wall -std=c99 -O3 -fPIC -ldl -shared \
-      ${lib.optionalString stdenv.isDarwin "-Wl,-install_name,$out/lib/$libName"} \
-      -o "$libName" \
-      libredirect.c
+    ${if stdenv.isDarwin && stdenv.isAarch64 then ''
+    # We need the unwrapped binutils and clang:
+    # We also want to build a fat library with x86_64, arm64, arm64e in there.
+    # Because we use the unwrapped tools, we need to provide -isystem for headers
+    # and the library search directory for libdl.
+    # We can't build this on x86_64, because the libSystem we point to doesn't
+    # like arm64(e).
+    PATH=${bintools-unwrapped}/bin:${llvmPackages_13.clang-unwrapped}/bin:$PATH \
+      clang -arch x86_64 -arch arm64 -arch arm64e \
+      -isystem ${llvmPackages_13.clang.libc}/include \
+      -isystem ${llvmPackages_13.libclang.lib}/lib/clang/*/include \
+      -L${llvmPackages_13.clang.libc}/lib \
+      -Wl,-install_name,$libName \
+      -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -ldl -shared -o "$libName"
+    '' else if stdenv.isDarwin then ''
+    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -Wl,-install_name,$out/lib/$libName \
+      -ldl -shared -o "$libName"
+    '' else ''
+    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -ldl -shared -o "$libName"
+    ''}
 
     if [ -n "$doInstallCheck" ]; then
       $CC -Wall -std=c99 -O3 test.c -o test
@@ -54,6 +73,12 @@ else stdenv.mkDerivation rec {
 
     install -vD "$libName" "$out/lib/$libName"
 
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    # dylib will be rejected unless dylib rpath gets explictly set
+    install_name_tool \
+      -change $libName $out/lib/$libName \
+      $out/lib/$libName
+  '' + ''
     # Provide a setup hook that injects our library into every process.
     mkdir -p "$hook/nix-support"
     cat <<SETUP_HOOK > "$hook/nix-support/setup-hook"
diff --git a/pkgs/build-support/libredirect/libredirect.c b/pkgs/build-support/libredirect/libredirect.c
index 7dac4684722..0dc7feb382c 100644
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@@ -112,7 +112,8 @@ WRAPPER(int, open)(const char * path, int flags, ...)
 }
 WRAPPER_DEF(open)
 
-#ifndef __APPLE__
+// In musl libc, open64 is simply a macro for open
+#if !defined(__APPLE__) && !defined(open64)
 WRAPPER(int, open64)(const char * path, int flags, ...)
 {
     int (*open64_real) (const char *, int, mode_t) = LOOKUP_REAL(open64);
@@ -152,7 +153,7 @@ WRAPPER(FILE *, fopen)(const char * path, const char * mode)
 }
 WRAPPER_DEF(fopen)
 
-#ifndef __APPLE__
+#ifdef __GLIBC__
 WRAPPER(FILE *, __nss_files_fopen)(const char * path)
 {
     FILE * (*__nss_files_fopen_real) (const char *) = LOOKUP_REAL(__nss_files_fopen);
@@ -162,7 +163,8 @@ WRAPPER(FILE *, __nss_files_fopen)(const char * path)
 WRAPPER_DEF(__nss_files_fopen)
 #endif
 
-#ifndef __APPLE__
+// In musl libc, fopen64 is simply a macro for fopen
+#if !defined(__APPLE__) && !defined(fopen64)
 WRAPPER(FILE *, fopen64)(const char * path, const char * mode)
 {
     FILE * (*fopen64_real) (const char *, const char *) = LOOKUP_REAL(fopen64);
@@ -172,7 +174,7 @@ WRAPPER(FILE *, fopen64)(const char * path, const char * mode)
 WRAPPER_DEF(fopen64)
 #endif
 
-#ifndef __APPLE__
+#ifdef __linux__
 WRAPPER(int, __xstat)(int ver, const char * path, struct stat * st)
 {
     int (*__xstat_real) (int ver, const char *, struct stat *) = LOOKUP_REAL(__xstat);
@@ -182,7 +184,7 @@ WRAPPER(int, __xstat)(int ver, const char * path, struct stat * st)
 WRAPPER_DEF(__xstat)
 #endif
 
-#ifndef __APPLE__
+#ifdef __linux__
 WRAPPER(int, __xstat64)(int ver, const char * path, struct stat64 * st)
 {
     int (*__xstat64_real) (int ver, const char *, struct stat64 *) = LOOKUP_REAL(__xstat64);
diff --git a/pkgs/build-support/rust/hooks/cargo-build-hook.sh b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
index 54ed765012b..7503fae4cd7 100644
--- a/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@@ -6,6 +6,9 @@ cargoBuildHook() {
     runHook preBuild
 
     if [ ! -z "${buildAndTestSubdir-}" ]; then
+        # ensure the output doesn't end up in the subdirectory
+        export CARGO_TARGET_DIR="$(pwd)/target"
+
         pushd "${buildAndTestSubdir}"
     fi
 
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index 8b7012677cd..903e17c3b2e 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -23,6 +23,7 @@ assertExecutable() {
 
 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
+# --prefix-each     ENV SEP VALS  : like --prefix, but VALS is a list
 # --suffix-each     ENV SEP VALS  : like --suffix, but VALS is a list
 # --prefix-contents ENV SEP FILES : like --suffix-each, but contents of FILES
 #                                   are read first and used as VALS
@@ -73,6 +74,14 @@ makeWrapper() {
                     echo "export $varName=${value@Q}\${$varName:+${separator@Q}}\$$varName" >> "$wrapper"
                 fi
             fi
+        elif [[ "$p" == "--prefix-each" ]]; then
+            varName="${params[$((n + 1))]}"
+            separator="${params[$((n + 2))]}"
+            values="${params[$((n + 3))]}"
+            n=$((n + 3))
+            for value in $values; do
+                echo "export $varName=${value@Q}\${$varName:+${separator@Q}}\$$varName" >> "$wrapper"
+            done
         elif [[ "$p" == "--suffix-each" ]]; then
             varName="${params[$((n + 1))]}"
             separator="${params[$((n + 2))]}"
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index a7120e33433..68f0f1bc4dd 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -121,18 +121,18 @@ rec {
         allowSubstitutes = false;
       }
       ''
-        n=$out${destination}
-        mkdir -p "$(dirname "$n")"
+        target=$out${destination}
+        mkdir -p "$(dirname "$target")"
 
         if [ -e "$textPath" ]; then
-          mv "$textPath" "$n"
+          mv "$textPath" "$target"
         else
-          echo -n "$text" > "$n"
+          echo -n "$text" > "$target"
         fi
 
         eval "$checkPhase"
 
-        (test -n "$executable" && chmod +x "$n") || true
+        (test -n "$executable" && chmod +x "$target") || true
       '';
 
   /*
@@ -219,7 +219,7 @@ rec {
         ${text}
         '';
       checkPhase = ''
-        ${stdenv.shell} -n $out
+        ${stdenv.shellDryRun} "$target"
       '';
     };
 
@@ -246,7 +246,7 @@ rec {
         ${text}
         '';
       checkPhase = ''
-        ${stdenv.shell} -n $out/bin/${name}
+        ${stdenv.shellDryRun} "$target"
       '';
     };
 
@@ -295,8 +295,8 @@ rec {
       checkPhase =
         if checkPhase == null then ''
           runHook preCheck
-          ${stdenv.shell} -n $out/bin/${name}
-          ${shellcheck}/bin/shellcheck $out/bin/${name}
+          ${stdenv.shellDryRun} "$target"
+          ${shellcheck}/bin/shellcheck "$target"
           runHook postCheck
         ''
         else checkPhase;
diff --git a/pkgs/build-support/trivial-builders/test-overriding.nix b/pkgs/build-support/trivial-builders/test-overriding.nix
index ddd5dc05075..a16bbbee1b1 100644
--- a/pkgs/build-support/trivial-builders/test-overriding.nix
+++ b/pkgs/build-support/trivial-builders/test-overriding.nix
@@ -1,10 +1,11 @@
 # Check that overriding works for trivial-builders like
 # `writeShellScript` via `overrideAttrs`. This is useful
-# to override the `checkPhase`, e. g. when you want
-# to enable extglob in `writeShellScript`.
+# to override the `checkPhase`, e. g. if you want
+# to disable extglob in `writeShellScript`.
 #
-# Run using `nix-build -A tests.trivial-overriding`.
+# Run using `nix-build -A tests.trivial-builders.overriding`.
 { lib
+, stdenv
 , runtimeShell
 , runCommand
 , callPackage
@@ -21,33 +22,6 @@ let
     rm success
   '';
 
-  # Reuse the old `checkPhase` of `writeShellScript`, but enable extglob.
-  allowExtglob = old: {
-    checkPhase = ''
-      # make sure we don't change the settings for
-      # the rest of the derivation's build
-      (
-        export BASHOPTS
-        shopt -s extglob
-        ${old.checkPhase}
-      )
-    '';
-  };
-
-  # Run old checkPhase, but only succeed if it fails.
-  # This HACK is required because we can't introspect build failures
-  # in nix: With `assertFail` we want to make sure that the default
-  # `checkPhase` would fail if extglob was used in the script.
-  assertFail = old: {
-    # write old checkPhase into a shell script, so we can check for
-    # the phase to fail even though we have `set -e`.
-    checkPhase = ''
-      if source ${writeShellScript "old-check-phase" old.checkPhase} 2>/dev/null; then
-        exit 1
-      fi
-    '';
-  };
-
   simpleCase = case:
     writeShellScript "test-trivial-overriding-${case}" extglobScript;
 
@@ -70,16 +44,33 @@ let
     executable = true;
   };
 
-  mkCase = f: type: isBin:
+    disallowExtglob = x: x.overrideAttrs (_: {
+      checkPhase = ''
+        ${stdenv.shell} -n "$target"
+      '';
+    });
+
+    # Run old checkPhase, but only succeed if it fails.
+    # This HACK is required because we can't introspect build failures
+    # in nix: With `assertFail` we want to make sure that the default
+    # `checkPhase` would fail if extglob was used in the script.
+    assertFail = x: x.overrideAttrs (old: {
+      checkPhase = ''
+        if
+          ${old.checkPhase}
+        then exit 1; fi
+      '';
+    });
+
+  mkCase = case: outcome: isBin:
     let
-      drv = (f type).overrideAttrs
-        (if type == "succ" then allowExtglob else assertFail);
+      drv = lib.pipe outcome ([ case ] ++ lib.optionals (outcome == "fail") [ disallowExtglob assertFail ]);
     in if isBin then "${drv}/bin/${drv.name}" else drv;
 
   writeTextOverrides = {
-    # Enabling globbing in checkPhase
+    # Make sure extglob works by default
     simpleSucc = mkCase simpleCase "succ" false;
-    # Ensure it's possible to fail; in this case globbing is not enabled.
+    # Ensure it's possible to fail; in this case extglob is not enabled
     simpleFail = mkCase simpleCase "fail" false;
     # Do the same checks after wrapping with callPackage
     # to make sure callPackage doesn't mess with the override
@@ -103,7 +94,7 @@ let
       name = script.name or (builtins.baseNameOf script);
     in writeShellScript "run-${name}" ''
       if [ "$(${script})" != "success" ]; then
-        echo "Failed in ${script}"
+        echo "Failed in ${name}"
         exit 1
       fi
     '';
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index b6d8a4b6b60..4d79521c255 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.71";
+  srcVersion = "3.74";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -35,7 +35,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
+      sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
     };
 
     dontBuild = true;
diff --git a/pkgs/data/misc/shared-mime-info/default.nix b/pkgs/data/misc/shared-mime-info/default.nix
index 4c60895897f..2feb5e2f5a4 100644
--- a/pkgs/data/misc/shared-mime-info/default.nix
+++ b/pkgs/data/misc/shared-mime-info/default.nix
@@ -13,34 +13,24 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "shared-mime-info";
-  version = "2.1";
+  pname = "shared-mime-info-unstable";
+  version = "2021-12-03";
 
   outputs = [ "out" "dev" ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "xdg";
-    repo = pname;
-    rev = version;
-    sha256 = "07bxv44p43pqq4ymfnyy50yli7lwdqymhvclna42rkn1cazq3vb5";
+    repo = "shared-mime-info";
+    rev = "5a406b06792e26a83c7346b3c2443c0bd8d4cdb2";
+    sha256 = "1v7dx7mr0m4lcff1aasg9gxn280zn0ffn6fjg9xc44pnllg01n6s";
   };
 
-  patches = [
-    # xmlto is only used for building the docs, which are not installed anyways.
-    (fetchpatch {
-      name = "xmlto-optional.patch";
-      url = "https://gitlab.freedesktop.org/xdg/shared-mime-info/-/merge_requests/110.patch";
-      sha256 = "0p5gxlcmn8ji5bc7pd105s1halqwa1d28lfx9yj43rn6mav7allx";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     gettext
-    itstool
     libxml2
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) shared-mime-info;
 
diff --git a/pkgs/desktops/arcan/xarcan/default.nix b/pkgs/desktops/arcan/xarcan/default.nix
index 6245471a7ef..d72bf4ad5bb 100644
--- a/pkgs/desktops/arcan/xarcan/default.nix
+++ b/pkgs/desktops/arcan/xarcan/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , arcan
 , audit
 , dbus
@@ -46,6 +47,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-UTIVDKnYD/q0K6G7NJUKh1tHcqnsuiJ/cQxWuPMJ2G4=";
   };
 
+  patches = [
+    # fix build with meson 0.60
+    (fetchpatch {
+      url = "https://github.com/letoram/xarcan/commit/b67e514dbb59bffc23b75d47ca7f24e96c4aeb05.patch";
+      sha256 = "sha256-tSQmNy1Id6nDIN+03dc1+rEEF8fMq0yJBiscNM60xic=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/desktops/gnome/apps/gnome-todo/default.nix b/pkgs/desktops/gnome/apps/gnome-todo/default.nix
index f3dde6585ae..32eb07fbd62 100644
--- a/pkgs/desktops/gnome/apps/gnome-todo/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-todo/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
 , fetchpatch
 , meson
 , ninja
@@ -16,21 +16,25 @@
 , libpeas
 , gnome-online-accounts
 , gsettings-desktop-schemas
-, libportal
+, libportal-gtk4
 , evolution-data-server
 , libical
 , librest
 , json-glib
 , itstool
+, unstableGitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-todo";
-  version = "41.0";
+  version = "unstable-2022-01-01";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "1r94880d4khbjhhfnhaba3y3d4hv2bri82rzfzxn27s5iybpqras";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "gnome-todo";
+    rev = "4a6be8c38510d909a9f94ec34c4da1f31ac9f1ab";
+    sha256 = "5UGo9vMb8scPWK91gftYOjqkJs9tGMiH1lqyEqedF2A=";
   };
 
   patches = [
@@ -64,7 +68,7 @@ stdenv.mkDerivation rec {
     gnome.adwaita-icon-theme
 
     # Plug-ins
-    libportal # background
+    libportal-gtk4 # background
     evolution-data-server # eds
     libical
     librest # todoist
@@ -77,9 +81,8 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "gnome.${pname}";
+    updateScript = unstableGitUpdater {
+      url = "https://gitlab.gnome.org/GNOME/gnome-todo.git";
     };
   };
 
diff --git a/pkgs/desktops/gnome/core/eog/default.nix b/pkgs/desktops/gnome/core/eog/default.nix
index 620f7e7d9c1..cdde96ae43b 100644
--- a/pkgs/desktops/gnome/core/eog/default.nix
+++ b/pkgs/desktops/gnome/core/eog/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , meson
 , ninja
 , gettext
@@ -8,7 +9,7 @@
 , libxml2
 , libjpeg
 , libpeas
-, libportal
+, libportal-gtk3
 , gnome
 , gtk3
 , glib
@@ -35,6 +36,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-huG5ujnaz3QiavpFermDtBJTuJ9he/VBOcrQiS0C2Kk=";
   };
 
+  patches = [
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/eog/-/merge_requests/115
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/eog/-/commit/a06e6325907e136678b0bbe7058c25d688034afd.patch";
+      sha256 = "ttcsfHubfmIbxA51YLnxXDagLLNutXYmoQyMQ4sHRak=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -49,7 +59,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libjpeg
-    libportal
+    libportal-gtk3
     gtk3
     gdk-pixbuf
     glib
diff --git a/pkgs/desktops/gnome/core/epiphany/default.nix b/pkgs/desktops/gnome/core/epiphany/default.nix
index 0baab20acec..eb8caa4f1ef 100644
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@@ -12,7 +12,7 @@
 , wrapGAppsHook
 , gnome
 , pantheon
-, libportal
+, libportal-gtk3
 , libxml2
 , libxslt
 , itstool
@@ -65,6 +65,13 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/elementary/browser/cc17559a7ac6effe593712b4f3d0bbefde6e3b62/navigation-buttons.patch";
       sha256 = "sha256-G1/JUjn/8DyO9sgL/5Kq205KbTOs4EMi4Vf3cJ8FHXU=";
     })
+  ] ++ [
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1051
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/epiphany/-/commit/84474398f6e59266b73170838219aa896729ce93.patch";
+      sha256 = "SeiLTo3FcOxuml5sJX9GqyGdyGf1jm1A76SOI0JJvoo=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -100,7 +107,7 @@ stdenv.mkDerivation rec {
     json-glib
     libdazzle
     libhandy
-    libportal
+    libportal-gtk3
     libnotify
     libarchive
     libsecret
diff --git a/pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix b/pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix
index de48b72faca..aae01577a88 100644
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix
@@ -68,6 +68,12 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/commit/82d88014dfca2df7e081712870e1fb017c16b808.patch";
       sha256 = "H5k/v+M2bRaswt5nrDJFNn4gS4BdB0UfzdjUCT4yLKg=";
     })
+
+    # Fix build with new meson
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/commit/28e28e9e598342c897ae5ca350d0da6f4aea057b.diff";
+      sha256 = "U+suR7wYjLWPqmkJpHm6pPOWL7sjL6GhIFX8MHrBRAY=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/nautilus/default.nix b/pkgs/desktops/gnome/core/nautilus/default.nix
index 1b527bf49d6..3f61f55db1d 100644
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -10,7 +11,7 @@
 , wrapGAppsHook
 , gtk3
 , libhandy
-, libportal
+, libportal-gtk3
 , gnome
 , gnome-autoar
 , glib-networking
@@ -52,6 +53,17 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit tracker;
     })
+
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/749
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/nautilus/-/commit/55cfd66ccca391fc144f5863ff6bfc1f3b137e2d.patch";
+      sha256 = "xSb9l7xxEYpAwmdmeWT/t7Z9Ck3DPtsODzbReQW/Q70=";
+      excludes = [
+        "build-aux/flatpak/org.gnome.Nautilus.json"
+        "build-aux/flatpak/org.gnome.Nautilus.yml"
+      ];
+    })
   ];
 
   nativeBuildInputs = [
@@ -76,7 +88,7 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-base
     gtk3
     libhandy
-    libportal
+    libportal-gtk3
     libexif
     libnotify
     libseccomp
diff --git a/pkgs/development/compilers/llvm/10/clang/default.nix b/pkgs/development/compilers/llvm/10/clang/default.nix
index b42f40b9694..5336e4ea35a 100644
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -29,7 +29,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index 8bd7e937e7d..5cb6c278659 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -89,7 +89,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index b40d3070c05..bb1b90b36a9 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -93,11 +99,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -122,6 +123,32 @@ in stdenv.mkDerivation (rec {
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -130,18 +157,28 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -167,7 +204,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -197,7 +248,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/10/llvm/outputs.patch b/pkgs/development/compilers/llvm/10/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/10/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index f2236aee45e..58439f02a5c 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -31,7 +31,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index ebd0dc672aa..82a78af85ca 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -104,7 +104,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 8d14ee131bd..e8cfd23faa7 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -91,11 +97,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -120,6 +121,32 @@ in stdenv.mkDerivation (rec {
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -131,18 +158,38 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
+    # This is a Shared Library not tied to LLVM_ENABLE_PIC
+    "-DLLVM_TOOL_REMARKS_SHLIB_BUILD=OFF"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -168,7 +215,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -198,7 +259,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl) && (!stdenv.hostPlatform.isRiscV);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl) && (!stdenv.hostPlatform.isRiscV)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/11/llvm/outputs.patch b/pkgs/development/compilers/llvm/11/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/11/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index a4112349598..0f1e160bbce 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -32,7 +32,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index e68522faea0..4a2a7ee8789 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -92,7 +92,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index bb5676b9d48..2c035ee67a9 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -58,6 +58,15 @@ in stdenv.mkDerivation (rec {
     ++ [ zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+    # Fix llvm being miscompiled by some gccs. See llvm/llvm-project#49955
+    # Fix llvm being miscompiled by some gccs. See https://github.com/llvm/llvm-project/issues/49955
+    ./fix-llvm-issue-49955.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -72,11 +81,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -105,6 +109,33 @@ in stdenv.mkDerivation (rec {
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-O0-defaults.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -116,18 +147,36 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -153,7 +202,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -183,7 +246,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch b/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch
new file mode 100644
index 00000000000..b515583a0c4
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/CodeGen/AsmPrinter/CMakeLists.txt b/lib/CodeGen/AsmPrinter/CMakeLists.txt
+index eb924282..c77c140b 100644
+--- a/lib/CodeGen/AsmPrinter/CMakeLists.txt
++++ b/lib/CodeGen/AsmPrinter/CMakeLists.txt
+@@ -44,3 +44,8 @@ add_llvm_component_library(LLVMAsmPrinter
+   Support
+   Target
+   )
++
++if (CMAKE_COMPILER_IS_GNUCXX)
++  set_source_files_properties(DwarfCompileUnit.cpp PROPERTIES
++                              COMPILE_FLAGS -fno-strict-aliasing)
++endif()
diff --git a/pkgs/development/compilers/llvm/12/llvm/outputs.patch b/pkgs/development/compilers/llvm/12/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/12/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index 24299583974..6c227f1ae72 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -22,7 +22,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index a89c6dabe39..be5e9404cdd 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -93,7 +93,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 115b56396e8..abfb2b36d18 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -52,6 +52,12 @@ in stdenv.mkDerivation (rec {
   checkInputs = [ which ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix random compiler crashes: https://bugs.llvm.org/show_bug.cgi?id=50611
@@ -66,11 +72,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -109,18 +110,36 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -146,7 +165,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -176,7 +209,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/13/llvm/outputs.patch b/pkgs/development/compilers/llvm/13/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/13/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index 4593580b72f..ef9886fb5ea 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -65,7 +65,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index 339c7a36931..cf668cd566a 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -27,7 +27,7 @@ let
     imap (i: _: concatStringsSep "." (take i parts)) parts;
 in
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -65,6 +65,13 @@ stdenv.mkDerivation ({
     #  sha256 = "0injj1hqgrbcbihhwp2nbal88jfykad30r54f2cdcx7gws2fcy8i";
     #  stripLen = 1;
     #})
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix invalid std::string(nullptr) for GCC 12
@@ -80,11 +87,6 @@ stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -100,6 +102,27 @@ stdenv.mkDerivation ({
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -108,20 +131,30 @@ stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
 
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
   ]
-  ++ lib.optional enableSharedLibraries
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ++ lib.optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -148,7 +181,21 @@ stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -179,7 +226,8 @@ stdenv.mkDerivation ({
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isi686);
+  doCheck = stdenv.isLinux && (!stdenv.isi686)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/5/llvm/outputs.patch b/pkgs/development/compilers/llvm/5/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/5/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index 9b1caf410bc..4acfe6cd85d 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -66,7 +66,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 5847d50a6f9..61f9234274d 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -27,7 +27,7 @@ let
     imap (i: _: concatStringsSep "." (take i parts)) parts;
 in
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -63,6 +63,13 @@ stdenv.mkDerivation ({
       includes = [ "test/tools/gold/X86/common.ll" ];
       sha256 = "0fxgrxmfnjx17w3lcq19rk68b2xksh1bynz3ina784kma7hp4wdb";
     })
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix invalid std::string(nullptr) for GCC 12
@@ -78,11 +85,6 @@ stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -93,6 +95,29 @@ stdenv.mkDerivation ({
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -101,19 +126,29 @@ stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -139,7 +174,21 @@ stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -170,7 +219,8 @@ stdenv.mkDerivation ({
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isi686);
+  doCheck = stdenv.isLinux && (!stdenv.isi686)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/6/llvm/outputs.patch b/pkgs/development/compilers/llvm/6/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/6/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index d014c043a80..f0908f30775 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -96,7 +96,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index cfa4fdf7ac3..b324e1a0e4d 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -31,7 +31,7 @@ let
     let parts = splitVersion release_version; in
     imap (i: _: concatStringsSep "." (take i parts)) parts;
 
-in stdenv.mkDerivation ({
+in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -67,6 +67,13 @@ in stdenv.mkDerivation ({
       url = "https://github.com/llvm-mirror/llvm/commit/cc1f2a595ead516812a6c50398f0f3480ebe031f.patch";
       sha256 = "0k6k1p5yisgwx417a67s7sr9930rqh1n0zv5jvply8vjjy4b3kf8";
     })
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix invalid std::string(nullptr) for GCC 12
@@ -82,11 +89,6 @@ in stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -110,6 +112,31 @@ in stdenv.mkDerivation ({
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -118,19 +145,29 @@ in stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -156,7 +193,21 @@ in stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -187,7 +238,8 @@ in stdenv.mkDerivation ({
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/7/llvm/outputs.patch b/pkgs/development/compilers/llvm/7/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/7/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index 5cb7720d026..1d6a5b7d74d 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -30,7 +30,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++11"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 7252b75a339..43050a72b92 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -97,7 +97,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 902a379b7aa..efd1707eb33 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -30,7 +30,7 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitVersion release_version));
 
-in stdenv.mkDerivation ({
+in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -57,6 +57,12 @@ in stdenv.mkDerivation ({
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     # Fix missing includes for GCC 10
     (fetchpatch {
       url = "https://bugs.gentoo.org/attachment.cgi?id=612792";
@@ -85,11 +91,6 @@ in stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -104,6 +105,32 @@ in stdenv.mkDerivation ({
     rm test/CodeGen/AArch64/wineh4.mir
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -112,18 +139,28 @@ in stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -149,7 +186,21 @@ in stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -179,7 +230,8 @@ in stdenv.mkDerivation ({
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/8/llvm/outputs.patch b/pkgs/development/compilers/llvm/8/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/8/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index c98b4a830c4..ee124b43bfc 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -30,7 +30,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++11"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 9126a614b10..7efe8486a38 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -97,7 +97,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index ed21ac74a1a..1dd1455ed6d 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # Force a test to evaluate the saved benchmark for a CPU for which LLVM has
     # an execution model. See NixOS/nixpkgs#119673.
@@ -83,11 +89,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -119,6 +120,32 @@ in stdenv.mkDerivation (rec {
     # Fix x86 gold test on non-x86 platforms
     # (similar fix made to others in this directory previously, FWIW)
     patch -p1 -i  ${./fix-test-on-non-x86-like-others.patch}
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -127,18 +154,28 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -164,7 +201,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -194,7 +245,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isRiscV);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isRiscV)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/9/llvm/outputs.patch b/pkgs/development/compilers/llvm/9/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/9/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index de2eff9f3e3..3873bda2b6d 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -22,7 +22,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 666e9be3cd8..890270c851d 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -93,7 +93,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 4c895f81dbb..fc7030810c5 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -51,6 +51,12 @@ in stdenv.mkDerivation (rec {
   checkInputs = [ which ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
@@ -58,11 +64,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -101,18 +102,36 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -138,7 +157,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -168,7 +201,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/pkgs/development/compilers/llvm/git/llvm/outputs.patch b/pkgs/development/compilers/llvm/git/llvm/outputs.patch
deleted file mode 100644
index 878460e05b8..00000000000
--- a/pkgs/development/compilers/llvm/git/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/llvm-config-link-static.patch b/pkgs/development/compilers/llvm/llvm-config-link-static.patch
new file mode 100644
index 00000000000..3881cc5206e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/llvm-config-link-static.patch
@@ -0,0 +1,12 @@
+diff --git llvm/tools/llvm-config/CMakeLists.txt llvm/tools/llvm-config/CMakeLists.txt
+index 16ba54c0cf2f..20b017195e84 100644
+--- llvm/tools/llvm-config/CMakeLists.txt
++++ llvm/tools/llvm-config/CMakeLists.txt
+@@ -6,6 +6,7 @@ set(BUILDVARIABLES_OBJPATH ${CMAKE_CURRENT_BINARY_DIR}/BuildVariables.inc)
+ # Add the llvm-config tool.
+ add_llvm_tool(llvm-config
+   llvm-config.cpp
++  DISABLE_LLVM_LINK_LLVM_DYLIB
+   )
+ 
+ # Compute the substitution values for various items.
diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index 2d56d461627..fa4bf686a2a 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -15,6 +15,9 @@ in stdenv.mkDerivation rec {
   postPatch = lib.optionalString stdenv.isAarch32 ''
     # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/20
     sed -i '/exec_opcodes_sys/d' testsuite/meson.build
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    # This benchmark times out on Hydra.nixos.org
+    sed -i '/memcpy_speed/d' testsuite/meson.build
   '';
 
   outputs = [ "out" "dev" ]
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 187127cfbfb..1087ac05908 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -100,6 +100,9 @@ in stdenv.mkDerivation rec {
     "${setHost}.musl-root=${pkgsBuildHost.targetPackages.stdenv.cc.libc}"
   ] ++ optionals stdenv.targetPlatform.isMusl [
     "${setTarget}.musl-root=${pkgsBuildTarget.targetPackages.stdenv.cc.libc}"
+  ] ++ optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    # https://github.com/rust-lang/rust/issues/92173
+    "--set rust.jemalloc"
   ];
 
   # The bootstrap.py will generated a Makefile that then executes the build.
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 9a1365d0c96..17ba5b14214 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -97,8 +97,8 @@ in rec {
   };
 
   vala_0_54 = generic {
-    version = "0.54.3";
-    sha256 = "7R1f5MvAzShF0N5PH/77Fa+waJLSMMfMppV4FnLo+2A=";
+    version = "0.54.6";
+    sha256 = "SdYNlqP99sQoc5dEK8bW2Vv0CqffZ47kkSjEsRum5Gk=";
   };
 
   vala = vala_0_54;
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index b6d60ba8a80..5cdba9d3204 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -219,6 +219,7 @@ in {
     sqlite = null;
     configd = null;
     tzdata = null;
+    libffi = pkgs.libffiBoot; # without test suite
     stripConfig = true;
     stripIdlelib = true;
     stripTests = true;
diff --git a/pkgs/development/interpreters/spidermonkey/78.nix b/pkgs/development/interpreters/spidermonkey/78.nix
index b4ed171eb78..4f525c8f0a5 100644
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@@ -35,6 +35,15 @@ stdenv.mkDerivation rec {
       url = "https://salsa.debian.org/mozilla-team/firefox/commit/fd6847c9416f9eebde636e21d794d25d1be8791d.patch";
       sha256 = "02b7zwm6vxmk61aj79a6m32s1k5sr0hwm3q1j4v6np9jfyd10g1j";
     })
+
+    # Remove this when updating to 79 - The patches are already applied upstream
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1318905
+
+    # Combination of 3 changesets, modified to apply on 78:
+    # - https://hg.mozilla.org/mozilla-central/rev/06d7e1b6b7e7
+    # - https://hg.mozilla.org/mozilla-central/rev/ec48f15d085c
+    # - https://hg.mozilla.org/mozilla-central/rev/6803dda74d33
+    ./add-riscv64-support.patch
   ];
 
   outputs = [ "out" "dev" ];
@@ -98,6 +107,10 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
+  # cc-rs insists on using -mabi=lp64 (soft-float) for riscv64,
+  # while we have a double-float toolchain
+  NIX_CFLAGS_COMPILE = lib.optionalString (with stdenv.hostPlatform; isRiscV && is64bit) "-mabi=lp64d";
+
   # Remove unnecessary static lib
   preFixup = ''
     moveToOutput bin/js78-config "$dev"
diff --git a/pkgs/development/interpreters/spidermonkey/add-riscv64-support.patch b/pkgs/development/interpreters/spidermonkey/add-riscv64-support.patch
new file mode 100644
index 00000000000..9d5d7c5507d
--- /dev/null
+++ b/pkgs/development/interpreters/spidermonkey/add-riscv64-support.patch
@@ -0,0 +1,123 @@
+# HG changeset patch
+# User John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+# Date 1592464269 0
+#      Thu Jun 18 07:11:09 2020 +0000
+# Node ID 5de7d747a962df5f8aefc016a62d7270ac18879e
+# Parent  e4b11f027efc1f8c2710ae3f52487a8f10a8fb39
+Bug 1318905 - build: Add riscv64 as target architecture to mozbuild r=glandium
+
+Adds the basic definitions for riscv64 to mozbuild, allowing to build Spidermonkey.
+
+Differential Revision: https://phabricator.services.mozilla.com/D78623
+
+diff -r e4b11f027efc -r 5de7d747a962 build/moz.configure/init.configure
+--- a/build/moz.configure/init.configure	Sun May 31 17:11:57 2020 +0000
++++ b/build/moz.configure/init.configure	Thu Jun 18 07:11:09 2020 +0000
+@@ -741,6 +741,9 @@
+     elif cpu.startswith('aarch64'):
+         canonical_cpu = 'aarch64'
+         endianness = 'little'
++    elif cpu in ('riscv64', 'riscv64gc'):
++        canonical_cpu = 'riscv64'
++        endianness = 'little'
+     elif cpu == 'sh4':
+         canonical_cpu = 'sh4'
+         endianness = 'little'
+diff -r e4b11f027efc -r 5de7d747a962 python/mozbuild/mozbuild/configure/constants.py
+--- a/python/mozbuild/mozbuild/configure/constants.py	Sun May 31 17:11:57 2020 +0000
++++ b/python/mozbuild/mozbuild/configure/constants.py	Thu Jun 18 07:11:09 2020 +0000
+@@ -49,6 +49,7 @@
+     'mips64': 64,
+     'ppc': 32,
+     'ppc64': 64,
++    'riscv64': 64,
+     's390': 32,
+     's390x': 64,
+     'sh4': 32,
+@@ -87,6 +88,7 @@
+     ('sparc', '__sparc__'),
+     ('mips64', '__mips64'),
+     ('mips32', '__mips__'),
++    ('riscv64', '__riscv && __riscv_xlen == 64'),
+     ('sh4', '__sh__'),
+ ))
+ 
+diff -r e4b11f027efc -r 5de7d747a962 python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py
+--- a/python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py	Sun May 31 17:11:57 2020 +0000
++++ b/python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py	Thu Jun 18 07:11:09 2020 +0000
+@@ -1208,6 +1208,10 @@
+         'mips-unknown-linux-gnu': big_endian + {
+             '__mips__': 1,
+         },
++        'riscv64-unknown-linux-gnu': little_endian + {
++            '__riscv': 1,
++            '__riscv_xlen': 64,
++        },
+         'sh4-unknown-linux-gnu': little_endian + {
+             '__sh__': 1,
+         },
+# HG changeset patch
+# User John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+# Date 1592464269 0
+#      Thu Jun 18 07:11:09 2020 +0000
+# Node ID e3d924797cb2d508ff938414168e98ccf66f07fe
+# Parent  5de7d747a962df5f8aefc016a62d7270ac18879e
+Bug 1318905 - js:jit: Enable AtomicOperations-feeling-lucky.h on riscv64 r=lth
+
+This allows the build on riscv64 to use the atomic operations provided by GCC.
+
+Differential Revision: https://phabricator.services.mozilla.com/D78624
+
+diff -r 5de7d747a962 -r e3d924797cb2 js/src/jit/AtomicOperations.h
+--- a/js/src/jit/AtomicOperations.h	Thu Jun 18 07:11:09 2020 +0000
++++ b/js/src/jit/AtomicOperations.h	Thu Jun 18 07:11:09 2020 +0000
+@@ -391,7 +391,7 @@
+ #elif defined(__ppc__) || defined(__PPC__) || defined(__sparc__) ||     \
+     defined(__ppc64__) || defined(__PPC64__) || defined(__ppc64le__) || \
+     defined(__PPC64LE__) || defined(__alpha__) || defined(__hppa__) ||  \
+-    defined(__sh__) || defined(__s390__) || defined(__s390x__)
++    defined(__sh__) || defined(__s390__) || defined(__s390x__) || defined(__riscv)
+ #  include "jit/shared/AtomicOperations-feeling-lucky.h"
+ #else
+ #  error "No AtomicOperations support provided for this platform"
+diff -r 5de7d747a962 -r e3d924797cb2 js/src/jit/shared/AtomicOperations-feeling-lucky-gcc.h
+--- a/js/src/jit/shared/AtomicOperations-feeling-lucky-gcc.h	Thu Jun 18 07:11:09 2020 +0000
++++ b/js/src/jit/shared/AtomicOperations-feeling-lucky-gcc.h	Thu Jun 18 07:11:09 2020 +0000
+@@ -63,6 +63,11 @@
+ #  define HAS_64BIT_LOCKFREE
+ #endif
+ 
++#if defined(__riscv) && __riscv_xlen == 64
++#  define HAS_64BIT_ATOMICS
++#  define HAS_64BIT_LOCKFREE
++#endif
++
+ #ifdef __sparc__
+ #  ifdef __LP64__
+ #    define HAS_64BIT_ATOMICS
+# HG changeset patch
+# User John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+# Date 1592464269 0
+#      Thu Jun 18 07:11:09 2020 +0000
+# Node ID 3f652d12b8bc0bd213020d488ecb4d3710bb11fa
+# Parent  e3d924797cb2d508ff938414168e98ccf66f07fe
+Bug 1318905 - mfbt:tests: Define RETURN_INSTR for riscv64 in TestPoisonArea r=glandium
+
+Define RETURN_INSTR for riscv64 in TestPoisonArea, i.e. the riscv64 assembly
+opcodes for "ret ; ret".
+
+Differential Revision: https://phabricator.services.mozilla.com/D78625
+
+diff -r e3d924797cb2 -r 3f652d12b8bc mfbt/tests/TestPoisonArea.cpp
+--- a/mfbt/tests/TestPoisonArea.cpp	Thu Jun 18 07:11:09 2020 +0000
++++ b/mfbt/tests/TestPoisonArea.cpp	Thu Jun 18 07:11:09 2020 +0000
+@@ -132,6 +132,9 @@
+ #elif defined _ARCH_PPC || defined _ARCH_PWR || defined _ARCH_PWR2
+ #  define RETURN_INSTR 0x4E800020 /* blr */
+ 
++#elif defined __riscv
++#  define RETURN_INSTR 0x80828082 /* ret; ret */
++
+ #elif defined __sparc || defined __sparcv9
+ #  define RETURN_INSTR 0x81c3e008 /* retl */
+ 
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index c2ad242b47a..769cc2d3bd2 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -18,13 +18,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.9.121";
+  version = "1.9.150";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "sha256-VQpWauk0tdJ1QU0HmtdTwQdKbiAuTTXXsUo2cqpqmdU=";
+    sha256 = "sha256-fgLdXWQKHaCwulrw9KV3vpQ71DjnQAL4heIRW7Rk7UY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index 77bd473485b..e4a5d908d26 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -132,6 +132,7 @@
 , xavs ? null # AVS encoder
 , xvidcore ? null # Xvid encoder, native encoder exists
 , zeromq4 ? null # Message passing
+, zimg ? null
 , zlib ? null
 , vulkan-loader ? null
 , glslang ? null
@@ -403,6 +404,7 @@ stdenv.mkDerivation rec {
     (enableFeature (xavs != null && gplLicensing) "libxavs")
     (enableFeature (xvidcore != null && gplLicensing) "libxvid")
     (enableFeature (zeromq4 != null) "libzmq")
+    (enableFeature (zimg != null) "libzimg")
     (enableFeature (zlib != null) "zlib")
     (enableFeature (isLinux && vulkan-loader != null) "vulkan")
     (enableFeature (isLinux && vulkan-loader != null && glslang != null) "libglslang")
@@ -431,7 +433,7 @@ stdenv.mkDerivation rec {
     libogg libopus librsvg libssh libtheora libvdpau libvorbis libvpx libwebp libX11
     libxcb libXv libXext xz openal openjpeg libpulseaudio rav1e svt-av1 rtmpdump opencore-amr
     samba SDL2 soxr speex srt vid-stab vo-amrwbenc x264 x265 xavs xvidcore
-    zeromq4 zlib
+    zeromq4 zimg zlib
   ] ++ optionals openglExtlib [ libGL libGLU ]
     ++ optionals nonfreeLicensing [ fdk_aac openssl ]
     ++ optional ((isLinux || isFreeBSD) && libva != null) libva
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 8f74fbd5a3d..e3b0534d2af 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildPackages, fetchurl, pkg-config, addOpenGLRunpath, perl, texinfo, yasm
 , alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
 , libssh, libtheora, libva, libdrm, libvorbis, libvpx, xz, libpulseaudio, soxr
-, x264, x265, xvidcore, zlib, libopus, speex, nv-codec-headers, dav1d
+, x264, x265, xvidcore, zimg, zlib, libopus, speex, nv-codec-headers, dav1d
 , srt ? null
 , openglSupport ? false, libGLU ? null, libGL ? null
 , libmfxSupport ? false, intel-media-sdk ? null
@@ -154,6 +154,7 @@ stdenv.mkDerivation rec {
       (ifMinVer "1.2" "--enable-libsoxr")
       "--enable-libx264"
       "--enable-libxvid"
+      "--enable-libzimg"
       "--enable-zlib"
       (ifMinVer "2.8" "--enable-libopus")
       "--enable-libspeex"
@@ -176,7 +177,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zlib libopus speex srt nv-codec-headers
+    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex srt nv-codec-headers
   ] ++ optionals openglSupport [ libGL libGLU ]
     ++ optional libmfxSupport intel-media-sdk
     ++ optional libaomSupport libaom
diff --git a/pkgs/development/libraries/glibc/2.33-master.patch.gz b/pkgs/development/libraries/glibc/2.33-master.patch.gz
index 50f74b15822..aecf1550fef 100644
--- a/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.33-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 6fa46d6d6c1..1bc5bf08ee4 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -44,7 +44,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-59";
+  patchSuffix = "-62";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-59-gf9592d65f2
+          glibc-2.33-62-gc493f6a0e4
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/grilo-plugins/default.nix b/pkgs/development/libraries/grilo-plugins/default.nix
index ed8f8edd656..db968f4730f 100644
--- a/pkgs/development/libraries/grilo-plugins/default.nix
+++ b/pkgs/development/libraries/grilo-plugins/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     # * chromaprint (gst-plugins-bad)
     (substituteAll {
       src = ./chromaprint-gst-plugins.patch;
-      load_plugins = lib.concatMapStrings (plugin: ''gst_registry_scan_path(gst_registry_get(), "${plugin}/lib/gstreamer-1.0");'') (with gst_all_1; [
+      load_plugins = lib.concatMapStrings (plugin: ''gst_registry_scan_path(gst_registry_get(), "${lib.getLib plugin}/lib/gstreamer-1.0");'') (with gst_all_1; [
         gstreamer
         gst-plugins-base
         gst-plugins-bad
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 8c6a8b05678..016a7a992ed 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , gettext
@@ -93,26 +92,18 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.18.2";
+  version = "1.18.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "06ildd4rl6cynirv3p00d2ddf5is9svj4i7mkahldzhq24pq5mca";
+    sha256 = "sha256-oWSSO5Tw0IV4pvyuqsbgwF2niKRpA6EIaHDpykWtZ44=";
   };
 
   patches = [
     # Use pkgconfig to inject the includedirs
     ./fix_pkgconfig_includedir.patch
-    # Fix “error: cannot initialize a parameter of type 'unsigned long *' with an rvalue of type 'typename std::remove_reference<decltype(*(&opencv_dilate_erode_type))>::type *' (aka 'volatile unsigned long *')” on Darwin.
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/commit/640a65bf966df065d41a511e2d76d1f26a2e770c.patch";
-      sha256 = "E5pig+qEfR58Jticr6ydFxZOhM3ZJ8zgrf5K4BdiB/Y=";
-      includes = [
-        "ext/opencv/gstcvdilateerode.cpp"
-      ];
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 1edadf0a51b..8b6073cb958 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-base";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "08w3ivbc6n4vdds2ap6q7l8zdk9if8417nznyqidf0adm0lk5r99";
+    sha256 = "sha256-lgt69FhXANsP3VuENVThHiVk/tngYfWR+uiKe+ZEb6M=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 9cc1675de3a..268da017163 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -21,20 +21,20 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [
+    "bin"
     "out"
     "dev"
     # "devdoc" # disabled until `hotdoc` is packaged in nixpkgs, see:
     # - https://github.com/NixOS/nixpkgs/pull/98767
     # - https://github.com/NixOS/nixpkgs/issues/98769#issuecomment-702296551
   ];
-  outputBin = "dev";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1igv9l4hm21kp1jmlwlagzs7ly1vaxv1sbda29q8247372dwkvls";
+    sha256 = "sha256-VYYiMqY0Wbv1ar694whcqa7CEbR46JHazqTW34yv6Ao=";
   };
 
   patches = [
@@ -94,14 +94,14 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    for prog in "$dev/bin/"*; do
+    for prog in "$bin/bin/"*; do
         # We can't use --suffix here due to quoting so we craft the export command by hand
         wrapProgram "$prog" --run 'export GST_PLUGIN_SYSTEM_PATH_1_0=$GST_PLUGIN_SYSTEM_PATH_1_0''${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$(unset _tmp; for profile in $NIX_PROFILES; do _tmp="$profile/lib/gstreamer-1.0''${_tmp:+:}$_tmp"; done; printf '%s' "$_tmp")'
     done
   '';
 
   preFixup = ''
-    moveToOutput "share/bash-completion" "$dev"
+    moveToOutput "share/bash-completion" "$bin"
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 12cb6dac6f3..0b7be2bd03e 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1kvcabcfzm7wqih3lzgrg9xjbn4xpx43d1m2zkkvab4i8161kggz";
+    sha256 = "sha256-/s/8hkR9r1wqBoQ8dXqZHXRcqiBpRGoNdG6ZsT98sHk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 840b0f25285..0bfe6f3e0e2 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "010xg960qsh5dwmf0y9l1q13h0cymmrgapzla2zsw66ylxqbi1s6";
+    sha256 = "sha256-ivSoOU0FHz4YKAaG20mm76zMlcDFmhfw9WTjIABZDfU=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index bc1656c191a..a6ed248b663 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -48,13 +48,13 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch64);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1c1rpq709cy8maaykyn1n0kckj9c6fl3mhvixkk6xmdwkcx0xrdn";
+    sha256 = "sha256-Oq7up3Zfv4gBrM5KUDqbBfc/BOijU1Lp0AIyz9VVeWs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 009a1555f77..7f2828253c8 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "15n3x3vhshqa3icw93g4vqmqd46122anzqvfxwn6q8famlxlcjil";
+    sha256 = "sha256-gi4AipEOndE67b3Y3GP+3vQEDA7i6Se6sxEuneaTpUg=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index d66376b6499..a75af25224a 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "153c78klvzlmi86d0gmdf7w9crv11rkd4y82b14a0wdr83gbhsx4";
+    sha256 = "sha256-BNY79IgWxvQcc/beD5EqfO8KqznEQWKnvOzhkj38nR8=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 049e8a99f09..7c4b21f7c83 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0g6i4db1883q3j0l2gdv46fcqwiiaw63n6mhvsfcms1i1p7g1391";
+    sha256 = "sha256-3zKAPpj4qZeTc/osp+BeYvl3sQl1dtOoBhnZ9cafZtk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 19e65c5a75e..5de9a247a52 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1sia4l88z7kkxm2z9j20l43rqkrnsa47xccski10s5gkhsprinwj";
+    sha256 = "sha256-SkYPuVVZ9BRE6ySGStLZ43kitu6pQVEDEDGfw+C6cns=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 82bcad0b985..bb145159447 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -44,6 +44,7 @@
 , cups
 , AppKit
 , Cocoa
+, QuartzCore
 , broadwaySupport ? true
 }:
 
@@ -59,7 +60,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.30";
+  version = "3.24.31";
 
   outputs = [ "out" "dev" ] ++ lib.optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -71,7 +72,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-unW//zIK0fTPvukrqBPsM2MizDxmDUBqrQFLBwh6O6k=";
+    sha256 = "sha256-Qjw+f9tMRZ7oieNf1Ncf0mI1YlQcEEGxHAflrR/xC/k=";
   };
 
   patches = [
@@ -83,6 +84,12 @@ stdenv.mkDerivation rec {
     # e.g. https://gitlab.gnome.org/GNOME/gtk/blob/3.24.4/gtk/gtk-launch.c#L31-33
     # https://gitlab.gnome.org/GNOME/gtk/merge_requests/536
     ./patches/3.0-darwin-x11.patch
+
+    # 3.24.31 does not declare QuartzCore dependency properly and fails to link
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/0ac61443694b477c41fc246cb387ef86aba441de.patch";
+      sha256 = "sha256-KaMeIdV/gfM4xzN9lIkY99E7bzAfTM6VETk5DEunB2w=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -104,7 +111,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libxkbcommon
-    libepoxy
+    (libepoxy.override { inherit x11Support; })
     isocodes
   ] ++ lib.optionals stdenv.isDarwin [
     AppKit
@@ -133,6 +140,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isDarwin [
     # explicitly propagated, always needed
     Cocoa
+    QuartzCore
   ] ++ lib.optionals waylandSupport [
     libGL
     wayland
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index d763c99882e..2b6dfc8fb52 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -23,6 +23,9 @@
 , xorg
 , libepoxy
 , libxkbcommon
+, libpng
+, libtiff
+, libjpeg
 , libxml2
 , gnome
 , gsettings-desktop-schemas
@@ -59,7 +62,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.4.1";
+  version = "4.6.0";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -71,7 +74,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "D6ramD3GsLxAnLNMFxPB8yZ+Z8CT+GseOxfbYQCj3fQ=";
+    sha256 = "eC1ZUfv9WF/J7HbAnQfijmAUxy2wAftWf/8hf7luTYw=";
   };
 
   nativeBuildInputs = [
@@ -89,7 +92,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libxkbcommon
-    libepoxy
+    libpng
+    libtiff
+    libjpeg
+    (libepoxy.override { inherit x11Support; })
     isocodes
   ] ++ lib.optionals vulkanSupport [
     vulkan-headers
@@ -130,6 +136,8 @@ stdenv.mkDerivation rec {
     glib
     graphene
     pango
+  ] ++ lib.optionals waylandSupport [
+    wayland
   ] ++ lib.optionals vulkanSupport [
     vulkan-loader
   ] ++ [
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index fe4fc1e6d33..44f49adbd3a 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, fetchpatch, ncurses, readline, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, ncurses, readline, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   version = "1.7.0";
   pname = "hunspell";
 
-  src = fetchurl {
-    url = "https://github.com/hunspell/hunspell/archive/v${version}.tar.gz";
-    sha256 = "12mwwqz6qkx7q1lg9vpjiiwh4fk4c8xs6g6g0xa2ia0hp5pbh9xv";
+  src = fetchFromGitHub {
+    owner = "hunspell";
+    repo = "hunspell";
+    rev = "v${version}";
+    sha256 = "sha256-YSJztik0QTZFNR8k8Xu1hakyE16NziDavYVkEUCbtGM=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/development/libraries/iso-codes/default.nix b/pkgs/development/libraries/iso-codes/default.nix
index 75ace8097c9..1b4396bfee0 100644
--- a/pkgs/development/libraries/iso-codes/default.nix
+++ b/pkgs/development/libraries/iso-codes/default.nix
@@ -1,12 +1,12 @@
-{lib, stdenv, fetchurl, gettext, python3}:
+{ lib, stdenv, fetchurl, gettext, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "iso-codes";
-  version = "4.6.0";
+  version = "4.9.0";
 
   src = fetchurl {
-    url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Ivd5538QpTFXP2r6ca/g12IZ0ZW1nduu0z4kiSb9Mxs=";
+    url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz";
+    sha256 = "02lq602ghws423w04jsyjr92p0nmrfp59n1m5hbbi1c6fhxryghc";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/libadwaita/default.nix b/pkgs/development/libraries/libadwaita/default.nix
index 6a519841d70..0e1a0036dd1 100644
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@@ -5,7 +5,7 @@
 , gi-docgen
 , gtk-doc
 , libxml2
-, meson_0_60
+, meson
 , ninja
 , pkg-config
 , sassc
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libadwaita";
-  version = "1.0.0.alpha.4";
+  version = "1.0.1";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "libadwaita";
     rev = version;
-    sha256 = "sha256-3aVeBaKSl6SaPQLodsyJHwnNOlXlWfIaLnbbl3+mlDA=";
+    sha256 = "sha256-2+elMEZwDPWkPDrmvLH5rxulh1tq6fgsMhbTdbrWe54=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     gi-docgen
     gtk-doc
     libxml2 # for xmllint
-    meson_0_60
+    meson
     ninja
     pkg-config
     sassc
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
     description = "Library to help with developing UI for mobile devices using GTK/GNOME";
     homepage = "https://gitlab.gnome.org/GNOME/libadwaita";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ dotlambda ];
+    maintainers = teams.gnome.members ++ (with maintainers; [ dotlambda ]);
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libepoxy/default.nix b/pkgs/development/libraries/libepoxy/default.nix
index bb6d6a14232..c54c3c86d23 100644
--- a/pkgs/development/libraries/libepoxy/default.nix
+++ b/pkgs/development/libraries/libepoxy/default.nix
@@ -10,6 +10,7 @@
 , libX11
 , Carbon
 , OpenGL
+, x11Support ? !stdenv.isDarwin
 }:
 
 let
@@ -40,7 +41,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja pkg-config utilmacros python3 ];
 
-  buildInputs = [
+  buildInputs = lib.optionals x11Support [
     libGL
     libX11
   ] ++ lib.optionals stdenv.isDarwin [
@@ -50,10 +51,10 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dtests=${if doCheck then "true" else "false"}"
-  ]
-  ++ optional stdenv.isDarwin "-Dglx=yes";
+    "-Dglx=${if x11Support then "yes" else "no"}"
+  ];
 
-  NIX_CFLAGS_COMPILE = ''-DLIBGL_PATH="${getLib libGL}/lib"'';
+  NIX_CFLAGS_COMPILE = lib.optionalString x11Support ''-DLIBGL_PATH="${getLib libGL}/lib"'';
 
   # cgl_epoxy_api fails in darwin sandbox and on Hydra (because it's headless?)
   preCheck = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix
index cef1fbc512a..7251e5b645b 100644
--- a/pkgs/development/libraries/libextractor/default.nix
+++ b/pkgs/development/libraries/libextractor/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     (substituteAll {
       src = ./gst-hardcode-plugins.patch;
       load_gst_plugins = lib.concatMapStrings
-        (plugin: ''gst_registry_scan_path(gst_registry_get(), "${plugin}/lib/gstreamer-1.0");'')
+        (plugin: ''gst_registry_scan_path(gst_registry_get(), "${lib.getLib plugin}/lib/gstreamer-1.0");'')
         (gstPlugins gst_all_1);
     })
   ];
diff --git a/pkgs/development/libraries/libfabric/default.nix b/pkgs/development/libraries/libfabric/default.nix
index c1c6ef7032a..38c88fe70f3 100644
--- a/pkgs/development/libraries/libfabric/default.nix
+++ b/pkgs/development/libraries/libfabric/default.nix
@@ -3,7 +3,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "1.13.2";
+  version = "1.14.0";
 
   enableParallelBuilding = true;
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ydMZP83keUGDYDw9i/SCa4U1KEgfuqkFklwRKbfLoK8=";
+    sha256 = "sha256-MmvJV3Pne+bJtC91rdpNMZovoqMgm3gHFJwGH3tchgI=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 4332f43c5af..6a22d585fbc 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -1,6 +1,8 @@
 { lib, stdenv, fetchurl, fetchpatch
 , autoreconfHook
 
+, doCheck ? true # test suite depends on dejagnu which cannot be used during bootstrapping
+, dejagnu
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -39,6 +41,10 @@ stdenv.mkDerivation rec {
 
   dontStrip = stdenv.hostPlatform != stdenv.buildPlatform; # Don't run the native `strip' when cross-compiling.
 
+  inherit doCheck;
+
+  checkInputs = [ dejagnu ];
+
   meta = with lib; {
     description = "A foreign function call interface library";
     longDescription = ''
diff --git a/pkgs/development/libraries/libfprint-tod/default.nix b/pkgs/development/libraries/libfprint-tod/default.nix
index 8d7df57896d..bffafc5e44f 100644
--- a/pkgs/development/libraries/libfprint-tod/default.nix
+++ b/pkgs/development/libraries/libfprint-tod/default.nix
@@ -19,7 +19,9 @@ in  {
     sha256 = "0cj7iy5799pchyzqqncpkhibkq012g3bdpn18pfb19nm43svhn4j";
   };
 
-  mesonFlags = mesonFlags ++ [
+  mesonFlags = [
+    # Include virtual drivers for fprintd tests
+    "-Ddrivers=all"
     "-Dudev_hwdb_dir=${placeholder "out"}/lib/udev/hwdb.d"
   ];
 
diff --git a/pkgs/development/libraries/libgda/default.nix b/pkgs/development/libraries/libgda/default.nix
index 63acabb320e..a9993b7255a 100644
--- a/pkgs/development/libraries/libgda/default.nix
+++ b/pkgs/development/libraries/libgda/default.nix
@@ -11,8 +11,6 @@
 , gobject-introspection
 , vala
 , libgee
-, overrideCC
-, gcc6
 , fetchpatch
 , autoreconfHook
 , gtk-doc
@@ -27,7 +25,7 @@
 assert mysqlSupport -> libmysqlclient != null;
 assert postgresSupport -> postgresql != null;
 
-(if stdenv.isAarch64 then overrideCC stdenv gcc6 else stdenv).mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "libgda";
   version = "5.2.10";
 
diff --git a/pkgs/development/libraries/libhttpseverywhere/default.nix b/pkgs/development/libraries/libhttpseverywhere/default.nix
index 975ad225813..80bc73e9a04 100644
--- a/pkgs/development/libraries/libhttpseverywhere/default.nix
+++ b/pkgs/development/libraries/libhttpseverywhere/default.nix
@@ -15,12 +15,17 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ vala gobject-introspection meson ninja pkg-config ];
   buildInputs = [ glib libgee json-glib libsoup libarchive ];
 
-  # Fixes build with vala >=0.42
   patches = [
+    # Fixes build with vala >=0.42
     (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/libhttpseverywhere/commit/6da08ef1ade9ea267cecf14dd5cb2c3e6e5e50cb.patch";
       sha256 = "1nwjlh8iqgjayccwdh0fbpq2g1h8bg1k1g9i324f2bhhvyhmpq8f";
     })
+    # fix build with meson 0.60
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/libhttpseverywhere/-/commit/4c38b2ca25802c464f3204a62815201d8cf549fd.patch";
+      sha256 = "sha256-1+fmR0bpvJ9ISN2Hr+BTIQz+Bf6VfY1RdVZ/OohUlWU=";
+    })
   ];
 
   mesonFlags = [ "-Denable_valadoc=true" ];
diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
new file mode 100644
index 00000000000..7656e063822
--- /dev/null
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -0,0 +1,47 @@
+{ lib, stdenv, cmake, ninja, gtest, fetchpatch, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "libhwy";
+  version = "0.15.0";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "highway";
+    rev = version;
+    sha256 = "sha256-v2HyyHtBydr7QiI83DW1yRv2kWjUOGxFT6mmdrN9XPo=";
+  };
+
+  patches = [
+    # Remove on next release
+    # https://github.com/google/highway/issues/460
+    (fetchpatch {
+      name = "hwy-add-missing-includes.patch";
+      url = "https://github.com/google/highway/commit/8ccab40c2f931aca6004d175eec342cc60f6baec.patch";
+      sha256 = "sha256-wlp5gIvK2+OlKtsZwxq/pXTbESkUtimHXaYDjcBzmQ0=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ninja ];
+
+  checkInputs = [ gtest ];
+
+  # Required for case-insensitive filesystems ("BUILD" exists)
+  dontUseCmakeBuildDir = true;
+
+  cmakeFlags = [
+    "-GNinja"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optional doCheck "-DHWY_SYSTEM_GTEST:BOOL=ON";
+
+  # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  meta = with lib; {
+    description = "Performance-portable, length-agnostic SIMD with runtime dispatch";
+    homepage = "https://github.com/google/highway";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ zhaofengli ];
+  };
+}
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 828090875e8..081ddaf4988 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -8,6 +8,7 @@
 , giflib
 , gperftools
 , gtest
+, libhwy
 , libjpeg
 , libpng
 , libwebp
@@ -37,14 +38,16 @@ stdenv.mkDerivation rec {
       url = "https://github.com/libjxl/libjxl/commit/88fe3fff3dc70c72405f57c69feffd9823930034.patch";
       sha256 = "1419fyiq4srpj72cynwyvqy8ldi7vn9asvkp5fsbmiqkyhb15jpk";
     })
-  ];
 
-  # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
-  # unless we disable highway's tests
-  postPatch = lib.optional stdenv.isDarwin ''
-    substituteInPlace third_party/highway/CMakeLists.txt \
-      --replace 'if(BUILD_TESTING)' 'if(false)'
-  '';
+    # "robust statistics" have been removed in upstream mainline as they are
+    # conidered to cause "interoperability problems". sure enough the tests
+    # fail with precision issues on aarch64.
+    (fetchpatch {
+      name = "remove-robust-and-descriptive-statistics.patch";
+      url = "https://github.com/libjxl/libjxl/commit/204f87a5e4d684544b13900109abf040dc0b402b.patch";
+      sha256 = "sha256-DoAaYWLmQ+R9GZbHMTYGe0gBL9ZesgtB+2WhmbARna8=";
+    })
+  ];
 
   nativeBuildInputs = [
     asciidoc # for docs
@@ -76,6 +79,7 @@ stdenv.mkDerivation rec {
     brotli
     giflib
     gperftools # provides `libtcmalloc`
+    libhwy
     libjpeg
     libpng
     libwebp
@@ -91,6 +95,9 @@ stdenv.mkDerivation rec {
     # using the vendorered ones is easier.
     "-DJPEGXL_FORCE_SYSTEM_BROTLI=ON"
 
+    # Use our version of highway, though it is still statically linked in
+    "-DJPEGXL_FORCE_SYSTEM_HWY=ON"
+
     # TODO: Update this package to enable this (overridably via an option):
     # Viewer tools for evaluation.
     # "-DJPEGXL_ENABLE_VIEWERS=ON"
@@ -102,13 +109,17 @@ stdenv.mkDerivation rec {
     # "-DJPEGXL_ENABLE_PLUGINS=ON"
   ];
 
+  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
+
   doCheck = true;
 
   # The test driver runs a test `LibraryCLinkageTest` which without
   # LD_LIBRARY_PATH setting errors with:
   #     /build/source/build/tools/tests/libjxl_test: error while loading shared libraries: libjxl.so.0
   # The required file is in the build directory (`$PWD`).
-  preCheck = ''
+  preCheck = if stdenv.isDarwin then ''
+    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD
+  '' else ''
     export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD
   '';
 
@@ -118,6 +129,5 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ nh2 ];
     platforms = platforms.all;
-    broken = stdenv.hostPlatform.isAarch64; # `internal compiler error`, see https://github.com/NixOS/nixpkgs/pull/103160#issuecomment-866388610
   };
 }
diff --git a/pkgs/development/libraries/libmodulemd/default.nix b/pkgs/development/libraries/libmodulemd/default.nix
index 79f590af5ff..8f59975a596 100644
--- a/pkgs/development/libraries/libmodulemd/default.nix
+++ b/pkgs/development/libraries/libmodulemd/default.nix
@@ -56,7 +56,6 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Ddeveloper_build=false"
     "-Dgobject_overrides_dir_py3=${placeholder "py"}/${python3.sitePackages}/gi/overrides"
   ];
 
diff --git a/pkgs/development/libraries/libnice/default.nix b/pkgs/development/libraries/libnice/default.nix
index 87f2d732712..42fb795d38e 100644
--- a/pkgs/development/libraries/libnice/default.nix
+++ b/pkgs/development/libraries/libnice/default.nix
@@ -13,6 +13,7 @@
 , gupnp-igd
 , gst_all_1
 , gnutls
+, graphviz
 }:
 
 stdenv.mkDerivation rec {
@@ -48,6 +49,7 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_412
+    graphviz
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libportal/default.nix b/pkgs/development/libraries/libportal/default.nix
index 97c5303eabe..b261c0395e6 100644
--- a/pkgs/development/libraries/libportal/default.nix
+++ b/pkgs/development/libraries/libportal/default.nix
@@ -4,42 +4,66 @@
 , meson
 , ninja
 , pkg-config
-, gtk-doc
-, docbook-xsl-nons
-, docbook_xml_dtd_45
+, gobject-introspection
+, vala
+, gi-docgen
 , glib
+, gtk3
+, gtk4
+, libsForQt5
+, variant ? null
 }:
 
+assert variant == null || variant == "gtk3" || variant == "gtk4" || variant == "qt5";
+
 stdenv.mkDerivation rec {
-  pname = "libportal";
-  version = "0.4";
+  pname = "libportal" + lib.optionalString (variant != null) "-${variant}";
+  version = "0.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchFromGitHub {
     owner = "flatpak";
-    repo = pname;
+    repo = "libportal";
     rev = version;
-    sha256 = "fuYZWGkdazq6H0rThqpF6KIcvwgc17o+CiISb1LjBso=";
+    sha256 = "oPPO2f6NNeok0SGh4jELkkOP6VUxXZiwPM/n6CUHm0Q=";
   };
 
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
-    gtk-doc
-    docbook-xsl-nons
-    docbook_xml_dtd_45
+    gi-docgen
+  ] ++ lib.optionals (variant != "qt5") [
+    gobject-introspection
+    vala
   ];
 
   propagatedBuildInputs = [
     glib
+  ] ++ lib.optionals (variant == "gtk3") [
+    gtk3
+  ] ++ lib.optionals (variant == "gtk4") [
+    gtk4
+  ] ++ lib.optionals (variant == "qt5") [
+    libsForQt5.qtbase
+  ];
+
+  mesonFlags = [
+    "-Dbackends=${lib.optionalString (variant != null) variant}"
+    "-Dvapi=${if variant != "qt5" then "true" else "false"}"
+    "-Dintrospection=${if variant != "qt5" then "true" else "false"}"
   ];
 
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
   meta = with lib; {
     description = "Flatpak portal library";
     homepage = "https://github.com/flatpak/libportal";
-    license = licenses.lgpl2Plus;
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ jtojnar ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index 0a76e59e5b7..d0e8bd163dd 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, getopt, util-linux, gperf }:
+{ lib, stdenv, fetchurl, getopt, util-linux, gperf, nix-update-script }:
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "sha256-F6ZS37SR2Wvok5YOm3kZFJNu4WwTt3ejyvVi/kjLh98=";
+    sha256 = "sha256-WQZchzM2RyXpchukjDqZu8Uq+SHa9I30seAS+8exCnY=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
@@ -31,6 +31,12 @@ stdenv.mkDerivation rec {
     tar -zcf $pythonsrc --mtime="@$SOURCE_DATE_EPOCH" --sort=name --transform s/tmp-pythonsrc/python-foundationdb/ ./tmp-pythonsrc/
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "High level library for the Linux Kernel seccomp filter";
     homepage = "https://github.com/seccomp/libseccomp";
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index ef87c5f2033..454a1cdf40a 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.0.3";
+  version = "3.0.4";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-UWWwTa2uMCfpoogthoaUtFhq/9d4wZSYKuTeI3PS4l4=";
+    sha256 = "sha256-W9OLXgkfcH/X+j7Xw3qsyj+OFsZXh/HMF9w40dzeVns=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libthai/default.nix b/pkgs/development/libraries/libthai/default.nix
index 97745813ef2..7755fffc7a9 100644
--- a/pkgs/development/libraries/libthai/default.nix
+++ b/pkgs/development/libraries/libthai/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libthai";
-  version = "0.1.28";
+  version = "0.1.29";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/tlwg/libthai/releases/download/v${version}/libthai-${version}.tar.xz";
-    sha256 = "04g93bgxrcnay9fglpq2lj9nr7x1xh06i60m7haip8as9dxs3q7z";
+    sha256 = "sha256-/IDMfctQ4RMCtBfOvSTy0wqLmHKS534AMme5EA0PS80=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 2fe6159556f..5f34a80d253 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -8,11 +8,6 @@
 , libjpeg
 , xz
 , zlib
-
-, Cocoa
-, GLUT
-, libGL
-, libGLU
 }:
 
 #FIXME: fix aarch64-darwin build and get rid of ./aarch64-darwin.nix
@@ -52,8 +47,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ libjpeg xz zlib ]; #TODO: opengl support (bogus configure detection)
 
-  buildInputs = [ libdeflate ] # TODO: move all propagatedBuildInputs to buildInputs.
-    ++ lib.optionals (stdenv.isDarwin) [ Cocoa GLUT libGL libGLU ];
+  buildInputs = [ libdeflate ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index a3de139fb44..1d9354d48e1 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.42.0";
+  version = "1.43.0";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0f6mfbg750q26fa85nhmw2m0gyp8jcp1kyx9zn6lgi8bha5b7kny";
+    sha256 = "sha256-AsXJb2AGNx+SARPmY8uRFRLfX5vqTPNjwL8njSw/e7o=";
   };
 
   postPatch = let
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index cb1d99aff2c..69f43d31da7 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -33,7 +33,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.3.3";
+  version = "21.3.4";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -47,18 +47,20 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "08c118j440xpfbjjxmwzm6dfnv4y35q540mmzkchhpbwx89lczxd";
+    sha256 = "0zd6skf9qcwlk1k1ljgwijwlyz5si3pgi0h97gd6kkivm7a4y43p";
   };
 
   # TODO:
   #  revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved
   #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
   patches = [
-    # fixes pkgsMusl.mesa build
+    # To fix flickering on Intel GPUs (iris), see https://github.com/NixOS/nixpkgs/issues/153377:
     (fetchpatch {
-      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl.patch";
-      sha256 = "sha256-Jyl7ILLhn8hBJG7afnEjE8H56Wz/1bxkvlqfrXK5U7I=";
+      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/07dc3d4238e57901ccf98e0b506d9aad2c86b9d9.diff";
+      sha256 = "sha256-3fa1qHJes3x1/iXsxfjgy9HnEGlOyFtJatSkU1a3XDI=";
     })
+    # fixes pkgsMusl.mesa build
+    ./musl.patch
     (fetchpatch {
       url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-endian.patch";
       sha256 = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk=";
diff --git a/pkgs/development/libraries/mesa/musl.patch b/pkgs/development/libraries/mesa/musl.patch
new file mode 100644
index 00000000000..687a159c178
--- /dev/null
+++ b/pkgs/development/libraries/mesa/musl.patch
@@ -0,0 +1,59 @@
+diff --git a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
+index 06ca90564f0..bb244f8f358 100644
+--- a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
++++ b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
+@@ -30,6 +30,7 @@
+ 
+ #include <amdgpu.h>
+ #include <pthread.h>
++#include <sys/types.h>
+ #include "util/list.h"
+ #include "util/rwlock.h"
+ #include "ac_gpu_info.h"
+diff --git a/src/gallium/drivers/freedreno/freedreno_util.h b/src/gallium/drivers/freedreno/freedreno_util.h
+index 22f99c41909..2f3195926be 100644
+--- a/src/gallium/drivers/freedreno/freedreno_util.h
++++ b/src/gallium/drivers/freedreno/freedreno_util.h
+@@ -108,6 +108,8 @@ extern bool fd_binning_enabled;
+ #include <sys/types.h>
+ #include <sys/syscall.h>
+ 
++#define gettid() ((pid_t)syscall(SYS_gettid))
++
+ #define DBG(fmt, ...)                                                          \
+    do {                                                                        \
+       if (FD_DBG(MSGS))                                                        \
+diff --git a/src/gallium/frontends/nine/nine_debug.c b/src/gallium/frontends/nine/nine_debug.c
+index f3a6a945025..f4a6c41a612 100644
+--- a/src/gallium/frontends/nine/nine_debug.c
++++ b/src/gallium/frontends/nine/nine_debug.c
+@@ -65,7 +65,7 @@ _nine_debug_printf( unsigned long flag,
+ {
+     static boolean first = TRUE;
+     static unsigned long dbg_flags = DBG_ERROR | DBG_WARN;
+-    unsigned long tid = 0;
++    pthread_t tid = 0;
+ 
+     if (first) {
+         first = FALSE;
+@@ -74,7 +74,7 @@ _nine_debug_printf( unsigned long flag,
+ 
+ #if defined(HAVE_PTHREAD)
+     if (dbg_flags & DBG_TID)
+-        tid = (unsigned long)pthread_self();
++        tid = pthread_self();
+ #endif
+ 
+     if (dbg_flags & flag) {
+diff --git a/src/util/rand_xor.c b/src/util/rand_xor.c
+index 81b64f1ea71..56ebd2eccdf 100644
+--- a/src/util/rand_xor.c
++++ b/src/util/rand_xor.c
+@@ -28,6 +28,7 @@
+ #if defined(HAVE_GETRANDOM)
+ #include <sys/random.h>
+ #endif
++#include <sys/types.h>         /* size_t, ssize_t */
+ #include <unistd.h>
+ #include <fcntl.h>
+ #endif
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index bdce5f48efd..6c97b37a25f 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   # Note the revision needs to be adjusted.
-  version = "6.2";
+  version = "6.3";
   name = "ncurses-${version}" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   # We cannot use fetchFromGitHub (which calls fetchzip)
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
   in fetchurl {
     url = "https://github.com/mirror/ncurses/archive/${rev}.tar.gz";
-    sha256 = "15r2456g0mlq2q7gh2z52vl6zv6y0z8sdchrs80kg4idqd8sm8fd";
+    sha256 = "1mawdjhzl2na2j0dylwc37f5w95rhgyvlwnfhww5rz2r7fgkvayv";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index e5819e1d75e..e92b3dec07b 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -27,7 +27,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.73.1";
+  version = "3.74";
 
 in
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "x2j5/jEp6LzC6WeUVtft2UU6IleEqPx9xFAYBvH+mr4=";
+    sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 24af4e429a0..3cfe173875c 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , zlib
 , cmake
 , imath
@@ -19,9 +20,26 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Bi6yTcZBWTsWWMm3A7FVYblvSXKLSkHmhGvpNYGiOzE=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-45942.patch";
+      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e.patch";
+      sha256 = "1qa8662ga5i0lyfi9mkj9s9bygdg7h1i6ahki28c664kxrlsakch";
+    })
+  ];
+
+  # tests are determined to use /var/tmp on unix
+  postPatch = ''
+    cat <(find . -name tmpDir.h) <(echo src/test/OpenEXRCoreTest/main.cpp) | while read -r f ; do
+      substituteInPlace $f --replace '/var/tmp' "$TMPDIR"
+    done
+  '';
+
   nativeBuildInputs = [ cmake ];
   propagatedBuildInputs = [ imath zlib ];
 
+  doCheck = true;
+
   meta = with lib; {
     description = "A high dynamic-range (HDR) image file format";
     homepage = "https://www.openexr.com/";
diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index d60b7b7fc43..31ca4855275 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
       url = "https://github.com/AcademySoftwareFoundation/openexr/commit/2f19a01923885fda75ec9d19332de080ec7102bd.patch";
       sha256 = "1yxmrdzq1x1911wdzwnzr29jmg2r4wd4yx3vhjn0y5dpny0ri5y5";
     })
+    (fetchpatch {
+      name = "CVE-2021-45942.patch";
+      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e.patch";
+      stripLen = 4;
+      extraPrefix = "OpenEXR/IlmImf/";
+      sha256 = "1wa2jn6sa0n3phaqvklnlbgk1bz60y756ad4jk4d757pzpnannsy";
+    })
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index a70a19e9314..964a3640871 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pango";
-  version = "1.50.0";
+  version = "1.50.3";
 
   outputs = [ "bin" "out" "dev" ]
     ++ lib.optionals withDocs [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "26i2Ld+G4Q9z+Tw9Ila3MjiyvK+HA3yiKbQL3AQOs/M=";
+    sha256 = "St0F7fUcH7N1oczedJiRQSDiPLKA3XOVsa60QfGDikw=";
   };
 
   strictDeps = !withIntrospection;
diff --git a/pkgs/development/libraries/pangomm/2.48.nix b/pkgs/development/libraries/pangomm/2.48.nix
index f3fa6acec73..cdc644ec9cd 100644
--- a/pkgs/development/libraries/pangomm/2.48.nix
+++ b/pkgs/development/libraries/pangomm/2.48.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pangomm";
-  version= "2.48.2";
+  version= "2.50.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-4ddVIsU/RieZh1zSR/m0nJHO1LGr5oOHrDWycTktTqU=";
+    sha256 = "sha256-onqnfgF7mvzp51HYW9HPiQq7s6WL9Z0PrJF+74LbO1s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index 6b213567ad4..ef053eba9cb 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -148,7 +148,7 @@ let
         inherit (srcs.qtbase) src version;
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
-        withGtk3 = true; inherit dconf gtk3;
+        withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit debug developerBuild decryptSslTraffic;
         inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
diff --git a/pkgs/development/libraries/qt-5/5.14/default.nix b/pkgs/development/libraries/qt-5/5.14/default.nix
index f12aadea738..1f893fb0519 100644
--- a/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/pkgs/development/libraries/qt-5/5.14/default.nix
@@ -149,7 +149,7 @@ let
         inherit (srcs.qtbase) src version;
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
-        withGtk3 = true; inherit dconf gtk3;
+        withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit debug developerBuild decryptSslTraffic;
         inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 19cca4237f9..2a76409ce4b 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -111,7 +111,7 @@ let
         inherit (srcs.qtbase) src version;
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
-        withGtk3 = true; inherit dconf gtk3;
+        withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit developerBuild decryptSslTraffic;
         inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index a70ad0f69e0..22d803c17be 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, nix-update-script }:
 
 stdenv.mkDerivation rec {
   pname = "re2";
-  version = "2021-09-01";
+  version = "2021-11-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = version;
-    sha256 = "1fyhypw345xz8zdh53gz6j1fwgrx0gszk1d349ja37dpxh4jp2jh";
+    sha256 = "sha256-q8u7xNp6n17F6twPoVkix8iCKPWUN+qg6rhSR4Dv+bI=";
   };
 
   patches = [
@@ -39,6 +39,12 @@ stdenv.mkDerivation rec {
   doInstallCheck = true;
   installCheckTarget = "testinstall";
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = {
     homepage = "https://github.com/google/re2";
     description = "An efficient, principled regular expression library";
diff --git a/pkgs/development/libraries/retro-gtk/default.nix b/pkgs/development/libraries/retro-gtk/default.nix
index e1385f7a3ef..113143311ed 100644
--- a/pkgs/development/libraries/retro-gtk/default.nix
+++ b/pkgs/development/libraries/retro-gtk/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , cmake
 , meson
 , ninja
@@ -27,6 +28,11 @@ stdenv.mkDerivation rec {
   patches = [
     # https://gitlab.gnome.org/GNOME/retro-gtk/-/merge_requests/150
     ./gio-unix.patch
+    # fix build with meson 0.60 (https://gitlab.gnome.org/GNOME/retro-gtk/-/merge_requests/167)
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/retro-gtk/-/commit/8016c10e7216394bc66281f2d9be740140b6fad6.patch";
+      sha256 = "sha256-HcQnqadK5sJM5mMqi4KERkJM3H+MUl8AJAorpFDsJ68=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 964cadbb619..d61b6ee3acb 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -129,7 +129,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.18";
+  version = "0.3.19";
 
   outputs = [ "out" "dev" ];
 
@@ -137,7 +137,7 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-b5i52rjsH65qAIlYGXQrzVxChi8/fwbD4eJTrxVq7Z8=";
+    sha256 = "sha256-EqA6oFM2theuvvuDOWeOx0Bv6AEFffmpWHJBzp23br0=";
   };
 
   inherit blas64;
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index de433ba5008..6704d894f5a 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -11,12 +11,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.37.0";
+  version = "3.37.2";
 
+  # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
-    url = "https://sqlite.org/2021/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-cxpGUdTUs2/H0h21hrLeTdAK8x/VT7WppLf0kgV0efc=";
+    url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
+    sha256 = "sha256-QImo2bRnU3s/JG8he4TNduALHRqXH+WsoeMOIw5Gstg=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 7309e1de0b6..d8d3735fe3d 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,11 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.37.0";
+    version = "3.37.2";
 
+    # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
-      url = "https://sqlite.org/2021/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-cJd/s5Qhh9RidBOv3pqUkvoCuVSFCBK1OXS2ox7Oj68=";
+      url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
+      sha256 = "sha256-SGdwtNX4i1uw26VA3W7hdjBn11Od/uGKfGb+m7A9Ftk=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 7dbe0d410f7..727634a9fd5 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@@ -44,6 +45,13 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit asciidoc;
     })
+
+    # Filter out hidden (wrapped) subcommands
+    # https://gitlab.gnome.org/GNOME/tracker/-/merge_requests/481
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/tracker/-/commit/8c28c24e447f13da8cf804cd7a00f9b909c5d3f9.patch";
+      sha256 = "EYo1nOtEr4semaPC5wk6A7bliRXu8qsBHaltd0DEI6Y=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/wlroots/0.15.nix b/pkgs/development/libraries/wlroots/0.15.nix
index e7cf7bc9b4c..7b7ff1816d7 100644
--- a/pkgs/development/libraries/wlroots/0.15.nix
+++ b/pkgs/development/libraries/wlroots/0.15.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, meson_0_60, ninja, pkg-config, wayland-scanner
+{ lib, stdenv, fetchFromGitLab, meson, ninja, pkg-config, wayland-scanner
 , libGL, wayland, wayland-protocols, libinput, libxkbcommon, pixman
 , xcbutilwm, libX11, libcap, xcbutilimage, xcbutilerrors, mesa
 , libpng, ffmpeg, xcbutilrenderutil, seatd, vulkan-loader, glslang
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ pkg-config ];
 
-  nativeBuildInputs = [ meson_0_60 ninja pkg-config wayland-scanner ];
+  nativeBuildInputs = [ meson ninja pkg-config wayland-scanner ];
 
   buildInputs = [
     libGL wayland wayland-protocols libinput libxkbcommon pixman
diff --git a/pkgs/development/libraries/xxHash/default.nix b/pkgs/development/libraries/xxHash/default.nix
index fbeadc2b353..f4fa0611281 100644
--- a/pkgs/development/libraries/xxHash/default.nix
+++ b/pkgs/development/libraries/xxHash/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xxHash";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "Cyan4973";
     repo = "xxHash";
     rev = "v${version}";
-    sha256 = "0hpbzdd6kfki5f61g103vp7pfczqkdj0js63avl0ss552jfb8h96";
+    sha256 = "sha256-2WoYCO6QRHWrbGP2mK04/sLNTyQLOuL3urVktilAwMA=";
   };
 
   # Upstream Makefile does not anticipate that user may not want to
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(dev)" "EXEC_PREFIX=$(out)" ];
 
+  # pkgs/build-support/setup-hooks/compress-man-pages.sh hook fails
+  # to compress symlinked manpages. Avoid compressing manpages until
+  # it's fixed.
+  dontGzipMan = true;
+
   meta = with lib; {
     description = "Extremely fast hash algorithm";
     longDescription = ''
diff --git a/pkgs/development/ocaml-modules/ca-certs/default.nix b/pkgs/development/ocaml-modules/ca-certs/default.nix
index acf869dbd27..ce8993b465e 100644
--- a/pkgs/development/ocaml-modules/ca-certs/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -18,7 +18,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ bos fpath rresult ptime mirage-crypto x509 astring logs ];
 
-  doCheck = true;
+  # Assumes nss-cacert < 3.74 https://github.com/mirage/ca-certs/issues/21
+  doCheck = false;
   checkInputs = [
     cacert    # for /etc/ssl/certs/ca-bundle.crt
     alcotest
diff --git a/pkgs/development/python-modules/adal/default.nix b/pkgs/development/python-modules/adal/default.nix
index d3826013c8e..45c256b6647 100644
--- a/pkgs/development/python-modules/adal/default.nix
+++ b/pkgs/development/python-modules/adal/default.nix
@@ -1,19 +1,47 @@
-{ lib, buildPythonPackage, fetchPypi
-, requests, pyjwt, python-dateutil }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, httpretty
+, pyjwt
+, pytestCheckHook
+, python-dateutil
+, requests
+}:
 
 buildPythonPackage rec {
   pname = "adal";
   version = "1.2.7";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "d74f45b81317454d96e982fd1c50e6fb5c99ac2223728aea8764433a39f566f1";
+  src = fetchFromGitHub {
+    owner = "AzureAD";
+    repo = "azure-activedirectory-library-for-python";
+    rev = version;
+    hash = "sha256-HE8/P0aohoZNeMdcQVKdz6M31FMrjsd7oVytiaD0idI=";
   };
 
-  propagatedBuildInputs =  [ requests pyjwt python-dateutil ];
+  propagatedBuildInputs = [
+    pyjwt
+    python-dateutil
+    requests
+  ];
+
+  checkInputs = [
+    httpretty
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # AssertionError: 'Mex [23 chars]tp error:...
+    "test_failed_request"
+  ];
+
+  pythonImportsCheck = [
+    "adal"
+  ];
 
   meta = with lib; {
-    description = "Library to make it easy for python application to authenticate to Azure Active Directory (AAD) in order to access AAD protected web resources";
+    description = "Python module to authenticate to Azure Active Directory (AAD) in order to access AAD protected web resources";
     homepage = "https://github.com/AzureAD/azure-activedirectory-library-for-python";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/attrs/default.nix b/pkgs/development/python-modules/attrs/default.nix
index 08730e3d689..4b10f4203e8 100644
--- a/pkgs/development/python-modules/attrs/default.nix
+++ b/pkgs/development/python-modules/attrs/default.nix
@@ -6,14 +6,17 @@
 
 buildPythonPackage rec {
   pname = "attrs";
-  version = "21.2.0";
+  version = "21.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb";
+    hash = "sha256-YmuoI0IR25joad92IwoTfExAoS1yRFxF1fW3FvB24v0=";
   };
 
-  outputs = [ "out" "testout" ];
+  outputs = [
+    "out"
+    "testout"
+  ];
 
   postInstall = ''
     # Install tests as the tests output.
@@ -21,7 +24,9 @@ buildPythonPackage rec {
     cp -R tests $testout/tests
   '';
 
-  pythonImportsCheck = [ "attr" ];
+  pythonImportsCheck = [
+    "attr"
+  ];
 
   # pytest depends on attrs, so we can't do this out-of-the-box.
   # Instead, we do this as a passthru.tests test.
@@ -35,5 +40,6 @@ buildPythonPackage rec {
     description = "Python attributes without boilerplate";
     homepage = "https://github.com/hynek/attrs";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index 7f7f54b73d9..ba7dd1db3b9 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -2,17 +2,21 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "charset-normalizer";
-  version = "2.0.8";
+  version = "2.0.10";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "Ousret";
     repo = "charset_normalizer";
     rev = version;
-    sha256 = "sha256-+acnzdDcujnMa0FYlWaAX7Ga9APMRlvBLKoogIyY8YM=";
+    hash = "sha256-QsUqrC2oycvyCbOzGmHahgNi40YZ0sujb3Cj8EnsGS8=";
   };
 
   checkInputs = [
@@ -24,7 +28,9 @@ buildPythonPackage rec {
       --replace " --cov=charset_normalizer --cov-report=term-missing" ""
   '';
 
-  pythonImportsCheck = [ "charset_normalizer" ];
+  pythonImportsCheck = [
+    "charset_normalizer"
+  ];
 
   meta = with lib; {
     description = "Python module for encoding and language detection";
diff --git a/pkgs/development/python-modules/dbus/default.nix b/pkgs/development/python-modules/dbus/default.nix
index 599c911b999..0685ca6fcca 100644
--- a/pkgs/development/python-modules/dbus/default.nix
+++ b/pkgs/development/python-modules/dbus/default.nix
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   '' else null;
 
   configureFlags = [
-    "PYTHON_VERSION=${lib.versions.major python.version}"
+    "PYTHON=${python.pythonForBuild.interpreter}"
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/django-redis/default.nix b/pkgs/development/python-modules/django-redis/default.nix
index b088876b3e4..1ad52e22d0f 100644
--- a/pkgs/development/python-modules/django-redis/default.nix
+++ b/pkgs/development/python-modules/django-redis/default.nix
@@ -19,7 +19,7 @@
 
 let
   pname = "django-redis";
-  version = "5.1.0";
+  version = "5.2.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -30,7 +30,7 @@ buildPythonPackage {
     owner = "jazzband";
     repo = "django-redis";
     rev = version;
-    sha256 = "sha256-S94qH2W5e65yzGfPxpwBUKhvvVS0Uc/zSyo66bnvzf4=";
+    sha256 = "sha256-e8wCgfxBT+WKFY4H83CTMirTpQym3QAoeWnXbRCDO90=";
   };
 
   postPatch = ''
@@ -53,6 +53,11 @@ buildPythonPackage {
 
   preCheck = ''
     ${pkgs.redis}/bin/redis-server &
+    REDIS_PID=$!
+  '';
+
+  postCheck = ''
+    kill $REDIS_PID
   '';
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/django/2.nix b/pkgs/development/python-modules/django/2.nix
index 9a0d98034c6..f20eb49c023 100644
--- a/pkgs/development/python-modules/django/2.nix
+++ b/pkgs/development/python-modules/django/2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.25";
+  version = "2.2.26";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-seZerzcTR9SxPrfgYbCXhslzBh3pU5DDJ8hcHiqiNJw=";
+    sha256 = "sha256-36U3Jn1SxiQ6YrMoVadEyoPDfHBgCqz/v9mLxdbYUY8=";
   };
 
   patches = lib.optional withGdal
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index fdcb8129f27..a7bafcfb270 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "3.2.10";
+  version = "3.2.11";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-B06IGLS0Cs3CNp5n3NZVXVWDKXhUCNzSU0DumPHx1cQ=";
+    sha256 = "sha256-aclKvl1rGwiL9HXgm3t0QD+UPjTaEH55hGXSBF2ifnU=";
   };
 
   patches = lib.optional withGdal
diff --git a/pkgs/development/python-modules/flit-core/default.nix b/pkgs/development/python-modules/flit-core/default.nix
index 7cb9ed2c6c4..35bba06f1f3 100644
--- a/pkgs/development/python-modules/flit-core/default.nix
+++ b/pkgs/development/python-modules/flit-core/default.nix
@@ -2,12 +2,11 @@
 , buildPythonPackage
 , callPackage
 , flit
-, toml
 }:
 
 buildPythonPackage rec {
   pname = "flit-core";
-  version = "3.2.0";
+  version = "3.6.0";
   format = "pyproject";
 
   outputs = [
@@ -21,10 +20,6 @@ buildPythonPackage rec {
     cd flit_core
   '';
 
-  propagatedBuildInputs = [
-    toml
-  ];
-
   postInstall = ''
     mkdir $testsout
     cp -R ../tests $testsout/tests
diff --git a/pkgs/development/python-modules/flit/default.nix b/pkgs/development/python-modules/flit/default.nix
index 0a6d1ba3158..830ed2702b8 100644
--- a/pkgs/development/python-modules/flit/default.nix
+++ b/pkgs/development/python-modules/flit/default.nix
@@ -3,13 +3,12 @@
 , fetchFromGitHub
 , docutils
 , requests
-, requests_download
-, zipfile36
-, pythonOlder
 , pytest
 , testpath
 , responses
 , flit-core
+, tomli
+, tomli-w
 }:
 
 # Flit is actually an application to build universal wheels.
@@ -19,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "flit";
-  version = "3.2.0";
+  version = "3.6.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "takluyver";
     repo = "flit";
     rev = version;
-    sha256 = "sha256-zN+/oAyXBo6Ho7n/xhOQ2mjtPGKA1anCvl3sVf7t+Do=";
+    sha256 = "sha256-D3q/1g6njrrmizooGmzNd9g2nKs00dMGj9jrrv3Y6HQ=";
   };
 
   nativeBuildInputs = [
@@ -36,10 +35,9 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     docutils
     requests
-    requests_download
     flit-core
-  ] ++ lib.optionals (pythonOlder "3.6") [
-    zipfile36
+    tomli
+    tomli-w
   ];
 
   checkInputs = [ pytest testpath responses ];
diff --git a/pkgs/development/python-modules/hiredis/default.nix b/pkgs/development/python-modules/hiredis/default.nix
index 00ce786b005..eea5e5bf804 100644
--- a/pkgs/development/python-modules/hiredis/default.nix
+++ b/pkgs/development/python-modules/hiredis/default.nix
@@ -1,25 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, redis
+, pythonOlder
+
+# tested using
 , python
 }:
 
 buildPythonPackage rec {
   pname = "hiredis";
   version = "2.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "81d6d8e39695f2c37954d1011c0480ef7cf444d4e3ae24bc5e89ee5de360139a";
   };
-  propagatedBuildInputs = [ redis ];
+
+  pythonImportsCheck = [ "hiredis" ];
 
   checkPhase = ''
     mv hiredis _hiredis
     ${python.interpreter} test.py
   '';
-  pythonImportsCheck = [ "hiredis" ];
 
   meta = with lib; {
     description = "Wraps protocol parsing code in hiredis, speeds up parsing of multi bulk replies";
diff --git a/pkgs/development/python-modules/html-sanitizer/default.nix b/pkgs/development/python-modules/html-sanitizer/default.nix
index 546f1acad09..ef029586beb 100644
--- a/pkgs/development/python-modules/html-sanitizer/default.nix
+++ b/pkgs/development/python-modules/html-sanitizer/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "html-sanitizer";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "matthiask";
     repo = pname;
     rev = version;
-    sha256 = "0nnv34924r0yn01rwlk749j5ijy7yxyj302s1i57yjrkqr3zlvas";
+    sha256 = "sha256-ZPyGF7N+EZHfgqZfRQx4x1r83BMur+Zg2kdtVISn3I8=";
   };
 
   propagatedBuildInputs = [
@@ -26,9 +26,17 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [ "html_sanitizer/tests.py" ];
+  pytestFlagsArray = [
+    "html_sanitizer/tests.py"
+  ];
+
+  disabledTests = [
+    "test_billion_laughs"
+  ];
 
-  pythonImportsCheck = [ "html_sanitizer" ];
+  pythonImportsCheck = [
+    "html_sanitizer"
+  ];
 
   meta = with lib; {
     description = "Allowlist-based and very opinionated HTML sanitizer";
diff --git a/pkgs/development/python-modules/html5lib/default.nix b/pkgs/development/python-modules/html5lib/default.nix
index 08ea5a2b3e9..58da63d02ed 100644
--- a/pkgs/development/python-modules/html5lib/default.nix
+++ b/pkgs/development/python-modules/html5lib/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , six
 , webencodings
 , mock
@@ -17,6 +18,15 @@ buildPythonPackage rec {
     sha256 = "b2e5b40261e20f354d198eae92afc10d750afb487ed5e50f9c4eaf07c184146f";
   };
 
+  patches = [
+    # Fix compatibility with pytest 6.
+    # Will be included in the next release after 1.1.
+    (fetchpatch {
+      url = "https://github.com/html5lib/html5lib-python/commit/2c19b9899ab3a3e8bd0ca35e5d78544334204169.patch";
+      sha256 = "sha256-VGCeB6o2QO/skeCZs8XLPfgEYVOSRL8cCpG7ajbZWEs=";
+    })
+  ];
+
   propagatedBuildInputs = [
     six
     webencodings
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index e13f7361677..a607de5eb11 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -10,15 +10,15 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "4.8.2";
+  version = "4.10.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "sha256-db3sFMOX9ShyTBv9lwnWYLM6TS53OHozWPILhIu15fs=";
+    hash = "sha256-kqi1jOc0sqRJSHjg7PfXnM16EotfxgFMQB4LYfAG8PY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/lz4/default.nix b/pkgs/development/python-modules/lz4/default.nix
index cc84fa75c69..9e2cc9b31e1 100644
--- a/pkgs/development/python-modules/lz4/default.nix
+++ b/pkgs/development/python-modules/lz4/default.nix
@@ -1,41 +1,68 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, future
-, isPy3k
+, pythonOlder
+
+# native inputs
 , pkgconfig
-, psutil
-, pytest
-, pytest-cov
-, pytest-runner
 , setuptools-scm
+
+# tests
+, psutil
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "python-lz4";
-  version = "3.1.10";
+  version = "3.1.12";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.5";
 
-  # get full repository inorder to run tests
+  # get full repository in order to run tests
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    sha256 = "0a4gic8xh3simkk5k8302rxwf765pr6y63k3js79mkl983vpxcim";
+    rev = "v${version}";
+    sha256 = "sha256-fqt9aJGqZpfbiYtU8cmm7UQaixZwbTKFBwRfR1B/qic=";
   };
 
-  nativeBuildInputs = [ setuptools-scm pkgconfig pytest-runner ];
-  checkInputs = [ pytest pytest-cov psutil ];
-  propagatedBuildInputs = lib.optionals (!isPy3k) [ future ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  postPatch = ''
+    sed -i '/pytest-cov/d' setup.py
+  '';
+
+  nativeBuildInputs = [
+    setuptools-scm
+    pkgconfig
+  ];
+
+  pythonImportsCheck = [
+    "lz4"
+    "lz4.block"
+    "lz4.frame"
+    "lz4.stream"
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    psutil
+  ];
+
+  # leave build directory, so the installed library gets imported
+  preCheck = ''
+    pushd tests
+  '';
 
-  # give a hint to setuptools-scm on package version
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="v${version}"
+  postCheck = ''
+    popd
   '';
 
-  meta = {
-     description = "LZ4 Bindings for Python";
-     homepage = "https://github.com/python-lz4/python-lz4";
-     license = lib.licenses.bsd3;
-     maintainers = with lib.maintainers; [ costrouc ];
+  meta = with lib; {
+    description = "LZ4 Bindings for Python";
+    homepage = "https://github.com/python-lz4/python-lz4";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/pkgs/development/python-modules/matplotlib-inline/default.nix b/pkgs/development/python-modules/matplotlib-inline/default.nix
index 9ee23b87ee8..d863239430d 100644
--- a/pkgs/development/python-modules/matplotlib-inline/default.nix
+++ b/pkgs/development/python-modules/matplotlib-inline/default.nix
@@ -1,5 +1,4 @@
 { lib, buildPythonPackage, fetchPypi
-, matplotlib
 , traitlets
 
 # tests
@@ -16,7 +15,6 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    matplotlib # not documented, but required
     traitlets
   ];
 
diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index 149aefb9a57..5c5e985641f 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "mypy";
-  version = "0.930";
+  version = "0.931";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "python";
     repo = "mypy";
     rev = "v${version}";
-    sha256 = "sha256-0yo6f9hRYFfwdfukOGNNTgPCIFO2MZdfMvzbci7FWRs=";
+    sha256 = "1v83flrdxh8grcp40qw04q4hzjflih9xwib64078vsxv2w36f817";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index d76b5b1723e..648a548e521 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "packaging";
-  version = "20.9";
+  version = "21.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-WzJ6wTINyGPcpy9FFOzAhvMRhnRLhKIwN0zB/Xdv6uU=";
+    sha256 = "sha256-3UfEKSfYmrkR5gZRiQfMLTofOLvQJjhZcGQ/nFuOz+s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 86154554b69..d271111d58f 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -1,48 +1,65 @@
-{ pkgs
+{ lib
+, bcrypt
 , buildPythonPackage
-, fetchPypi
 , cryptography
-, bcrypt
+, fetchPypi
 , invoke
-, pynacl
+, mock
 , pyasn1
-, pytestCheckHook
+, pynacl
 , pytest-relaxed
-, mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "paramiko";
-  version = "2.8.1";
+  version = "2.9.1";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "85b1245054e5d7592b9088cc6d08da22445417912d3a3e48138675c7a8616438";
+    hash = "sha256-of3e07VfYdIzieT+UtmuQolgrJWNLt9QNz+qXYkm7dA=";
   };
 
-  propagatedBuildInputs = [ bcrypt cryptography pynacl pyasn1 ];
+  propagatedBuildInputs = [
+    bcrypt
+    cryptography
+    pyasn1
+    pynacl
+  ];
+
+  checkInputs = [
+    invoke
+    mock
+    pytest-relaxed
+    pytestCheckHook
+  ];
 
   # with python 3.9.6+, the deprecation warnings will fail the test suite
   # see: https://github.com/pyinvoke/invoke/issues/829
   doCheck = false;
-  checkInputs = [ invoke pytestCheckHook pytest-relaxed mock ];
 
   disabledTestPaths = [
     "tests/test_sftp.py"
     "tests/test_config.py"
   ];
 
+  pythonImportsCheck = [
+    "paramiko"
+  ];
+
   __darwinAllowLocalNetworking = true;
 
-  meta = with pkgs.lib; {
+  meta = with lib; {
     homepage = "https://github.com/paramiko/paramiko/";
     description = "Native Python SSHv2 protocol library";
     license = licenses.lgpl21Plus;
     longDescription = ''
-      This is a library for making SSH2 connections (client or server).
-      Emphasis is on using SSH2 as an alternative to SSL for making secure
-      connections between python scripts. All major ciphers and hash methods
-      are supported. SFTP client and server mode are both supported too.
+      Library for making SSH2 connections (client or server). Emphasis is
+      on using SSH2 as an alternative to SSL for making secure connections
+      between python scripts. All major ciphers and hash methods are
+      supported. SFTP client and server mode are both supported too.
     '';
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index 062295a4ead..f2e86599148 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,14 +11,16 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.4.0";
-  disabled = pythonOlder "3.6";
+  version = "2.4.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ox1CVq2M2eddZtpuZx0IfvuOm6RPsAs27WkMdZSeh0E=";
+    sha256 = "sha256-Ce1dwE2g/7o91NPkmlM0uv0eMB7WzFCExV/8ZCAn22Y=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -33,7 +35,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
- pythonImportsCheck = [ "platformdirs" ];
+  pythonImportsCheck = [
+    "platformdirs"
+  ];
 
   meta = with lib; {
     description = "Python module for determining appropriate platform-specific directories";
diff --git a/pkgs/development/python-modules/poetry/default.nix b/pkgs/development/python-modules/poetry/default.nix
index 2375800e3a7..5efbe56ac5b 100644
--- a/pkgs/development/python-modules/poetry/default.nix
+++ b/pkgs/development/python-modules/poetry/default.nix
@@ -15,6 +15,7 @@
 , intreehooks
 , keyring
 , lockfile
+, packaging
 , pexpect
 , pkginfo
 , poetry-core
@@ -45,9 +46,10 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-     --replace 'importlib-metadata = {version = "^1.6.0", python = "<3.8"}' \
+      --replace 'importlib-metadata = {version = "^1.6.0", python = "<3.8"}' \
        'importlib-metadata = {version = ">=1.6", python = "<3.8"}' \
-     --replace 'version = "^21.2.0"' 'version = ">=21.2"'
+      --replace 'version = "^21.2.0"' 'version = ">=21.2"' \
+      --replace 'packaging = "^20.4"' 'packaging = "*"'
   '';
 
   nativeBuildInputs = [
@@ -64,6 +66,7 @@ buildPythonPackage rec {
     html5lib
     keyring
     lockfile
+    packaging
     pexpect
     pkginfo
     poetry-core
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index d33d9ffc575..d93bfe149cb 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.8.1";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Gk4ZN/g6SRWFm0ALCvyald/9zq3wBd48mGdqdGCeGYI=";
+    hash = "sha256-zYDgXXpn8Z1Zti8Eje8qxDvbQV70/LmezG3AtxzDG+o=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/pycryptodome-test-vectors/default.nix b/pkgs/development/python-modules/pycryptodome-test-vectors/default.nix
new file mode 100644
index 00000000000..4fbc259c188
--- /dev/null
+++ b/pkgs/development/python-modules/pycryptodome-test-vectors/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "pycryptodome-test-vectors";
+  version = "1.0.4";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-2+ZL8snmaB0tNxGZRbUM6SdfXZf4CM0nh3/wTOu9R50=";
+    extension = "zip";
+  };
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pycryptodome_test_vectors"
+  ];
+
+  meta = with lib; {
+    description = "Test vectors for PyCryptodome cryptographic library";
+    homepage = "https://www.pycryptodome.org/";
+    license = with licenses; [ bsd2 /* and */ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 19b2447acb1..44e7ed0ad4a 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -1,17 +1,29 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pycryptodome-test-vectors
+}:
 
 buildPythonPackage rec {
-  version = "3.11.0";
   pname = "pycryptodome";
+  version = "3.12.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "428096bbf7a77e207f418dfd4d7c284df8ade81d2dc80f010e92753a3e406ad0";
+    hash = "sha256-Esc0OuxaOz31xHJlKBsSthHybsk2e2EpGZ1n2lS3aME=";
+    extension = "zip";
   };
 
+  pythonImportsCheck = [
+    "Crypto"
+  ];
+
   meta = with lib; {
-    homepage = "https://www.pycryptodome.org/";
     description = "Python Cryptography Toolkit";
+    homepage = "https://www.pycryptodome.org/";
+    license = with licenses; [ bsd2 /* and */ asl20 ];
+    maintainers = with maintainers; [ fab ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/pycryptodomex/default.nix b/pkgs/development/python-modules/pycryptodomex/default.nix
index eab3a6b0bbd..c9f622d6c69 100644
--- a/pkgs/development/python-modules/pycryptodomex/default.nix
+++ b/pkgs/development/python-modules/pycryptodomex/default.nix
@@ -1,23 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pycryptodome-test-vectors
 }:
 
 buildPythonPackage rec {
   pname = "pycryptodomex";
-  version = "3.11.0";
+  version = "3.12.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0398366656bb55ebdb1d1d493a7175fc48ade449283086db254ac44c7d318d6d";
+    hash = "sha256-ki6drAFm5GF+XHmA0s/2kSputctcE+fs4iJDhlC9f2Y=";
+    extension = "zip";
   };
 
-  pythonImportsCheck = [ "Cryptodome" ];
+  pythonImportsCheck = [
+    "Cryptodome"
+  ];
 
   meta = with lib; {
     description = "A self-contained cryptographic library for Python";
     homepage = "https://www.pycryptodome.org";
-    license = licenses.bsd2;
+    license = with licenses; [ bsd2 /* and */ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index af3c2c9b651..e4417139bfa 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -9,6 +9,7 @@
 , pytestCheckHook
 , python-box
 , python-dateutil
+, pythonOlder
 , requests
 , requests-pkcs12
 , responses
@@ -19,13 +20,16 @@
 
 buildPythonPackage rec {
   pname = "pytenable";
-  version = "1.4.2";
+  version = "1.4.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "tenable";
     repo = "pyTenable";
     rev = version;
-    sha256 = "sha256-qljoJ+nYFVS5VHr/M4mITtO9Czuyb4HLzVjhprhyJIs=";
+    hash = "sha256-p9d3wZkOMhNQWJN6tCNUlW15A3irU8QN/nm7PLGTE/M=";
   };
 
   propagatedBuildInputs = [
@@ -59,7 +63,9 @@ buildPythonPackage rec {
     "test_uploads_docker_push_cs_tag_typeerror"
   ];
 
-  pythonImportsCheck = [ "tenable" ];
+  pythonImportsCheck = [
+    "tenable"
+  ];
 
   meta = with lib; {
     description = "Python library for the Tenable.io and TenableSC API";
diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 35109e836fa..0731487575b 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -1,14 +1,49 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pythonOlder
+
+# propagates
+, cryptography
+, deprecated
+, hiredis
+, importlib-metadata
+, packaging
+, requests
+}:
 
 buildPythonPackage rec {
   pname = "redis";
-  version = "3.5.3";
+  version = "4.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0e7e0cfca8660dea8b7d5cd8c4f6c5e29e11f31158c0b0ae91a397f00e5a05a2";
+    sha256 = "sha256-IfCiO85weQkHbmuizgdsulm/9g0qsily4GR/32IP/kc=";
   };
 
+  propagatedBuildInputs = [
+    cryptography
+    deprecated
+    hiredis
+    packaging
+    requests
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
+
+  pythonImportsCheck = [
+    "redis"
+    "redis.client"
+    "redis.cluster"
+    "redis.connection"
+    "redis.exceptions"
+    "redis.sentinel"
+    "redis.utils"
+  ];
+
   # tests require a running redis
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/restfly/default.nix b/pkgs/development/python-modules/restfly/default.nix
index 83d50cf1346..d153a5f3c75 100644
--- a/pkgs/development/python-modules/restfly/default.nix
+++ b/pkgs/development/python-modules/restfly/default.nix
@@ -6,18 +6,22 @@
 , pytest-vcr
 , pytestCheckHook
 , python-box
+, pythonOlder
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "restfly";
   version = "1.4.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "stevemcgrath";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wWFf8LFZkwzbHX545tA5w2sB3ClL7eFuF+jGX0fSiSc=";
+    hash = "sha256-wWFf8LFZkwzbHX545tA5w2sB3ClL7eFuF+jGX0fSiSc=";
   };
 
   propagatedBuildInputs = [
@@ -37,7 +41,9 @@ buildPythonPackage rec {
     "test_session_ssl_error"
   ];
 
-  pythonImportsCheck = [ "restfly" ];
+  pythonImportsCheck = [
+    "restfly"
+  ];
 
   meta = with lib; {
     description = "Python RESTfly API Library Framework";
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index 939ca25eb1a..1e29bc9a616 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -1,27 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy3k, python, typing }:
-let
-  testDir = if isPy3k then "src_py3" else "src_py2";
+{ lib
+, buildPythonPackage
+, fetchPypi
+, flit-core
+, python
+, pythonOlder
+}:
 
-in buildPythonPackage rec {
-  pname = "typing_extensions";
-  version = "3.10.0.2";
+buildPythonPackage rec {
+  pname = "typing-extensions";
+  version = "4.0.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "49f75d16ff11f1cd258e1b988ccff82a3ca5570217d7ad8c5f48205dd99a677e";
+    pname = "typing_extensions";
+    inherit version;
+    hash = "sha256-TKCR3qFJ+UXsVq+0ja5xTyHoaS7yKjlSI7zTKJYbag4=";
   };
 
-  checkInputs = lib.optional (pythonOlder "3.5") typing;
-
-  # Error for Python3.6: ImportError: cannot import name 'ann_module'
-  # See https://github.com/python/typing/pull/280
-  doCheck = pythonOlder "3.6";
+  nativeBuildInputs = [
+    flit-core
+  ];
 
-  checkPhase = ''
-    cd ${testDir}
-    ${python.interpreter} -m unittest discover
+  postPatch = ''
+    # Remove metadata for README which are outdated
+    sed -i -e '11,24d' pyproject.toml
   '';
 
+  # Tests are not part of PyPI releases. GitHub source can't be used
+  # as it ends with an infinite recursion
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "typing_extensions"
+  ];
+
   meta = with lib; {
     description = "Backported and Experimental Type Hints for Python 3.5+";
     homepage = "https://github.com/python/typing";
diff --git a/pkgs/development/python-modules/tzdata/default.nix b/pkgs/development/python-modules/tzdata/default.nix
index 7f1803d12c6..cfc46a658d3 100644
--- a/pkgs/development/python-modules/tzdata/default.nix
+++ b/pkgs/development/python-modules/tzdata/default.nix
@@ -1,28 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
-, pytestCheckHook
-, pytest-subtests
 , importlib-resources
+, pytest-subtests
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "tzdata";
-  version = "2021.1";
+  version = "2021.5";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4ZxzUfiHUioaxznSEEHlkt3ebdG3ZP3vqPeys1UdPTg=";
+    hash = "sha256-aNvkGv0BuGeJS739VPoD9GjPpPAIa/tK3NjejyTz7iE=";
   };
 
   checkInputs = [
     pytestCheckHook
     pytest-subtests
-  ] ++ lib.optional (pythonOlder "3.7") importlib-resources;
+  ] ++ lib.optional (pythonOlder "3.7") [
+    importlib-resources
+  ];
 
-  pythonImportsCheck = [ "tzdata" ];
+  pythonImportsCheck = [
+    "tzdata"
+  ];
 
   meta = with lib; {
     description = "Provider of IANA time zone data";
diff --git a/pkgs/development/python-modules/unicodedata2/default.nix b/pkgs/development/python-modules/unicodedata2/default.nix
index 565f0f55720..a14895fa799 100644
--- a/pkgs/development/python-modules/unicodedata2/default.nix
+++ b/pkgs/development/python-modules/unicodedata2/default.nix
@@ -1,18 +1,17 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pytest }:
+{ lib, buildPythonPackage, fetchPypi, pytestCheckHook, isPy27 }:
 
 buildPythonPackage rec {
   pname = "unicodedata2";
-  version = "13.0.0-2";
+  version = "14.0.0";
 
-  src = fetchFromGitHub {
-    owner  = "mikekap";
-    repo   = pname;
-    rev    = version;
-    sha256 = "0p9brbiwyg98q52y0gfyps52xv57fwqfpq0mn18p1xc1imip3h2b";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit version pname;
+    sha256 = "110nnvh02ssp92xbmswy39aa186jrmb7m41x4220wigl8c0dzxs1";
   };
 
-  checkInputs = [ pytest ];
-  checkPhase = "pytest tests";
+  checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Backport and updates for the unicodedata module";
diff --git a/pkgs/development/python-modules/wrapt/default.nix b/pkgs/development/python-modules/wrapt/default.nix
index e567a8a672e..b53c52d6098 100644
--- a/pkgs/development/python-modules/wrapt/default.nix
+++ b/pkgs/development/python-modules/wrapt/default.nix
@@ -1,23 +1,33 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "wrapt";
   version = "1.13.3";
+  format = "setuptools";
 
-  # No tests in archive
-  doCheck = false;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1fea9cd438686e6682271d36f3481a9f3636195578bab9ca3382e2f5f01fc185";
+  src = fetchFromGitHub {
+    owner = "GrahamDumpleton";
+    repo = pname;
+    rev = version;
+    hash = "sha256-kq3Ujkn4HzonzjuQfVnPNnQV+2Rnbr3ZfYmrnY3upxU=";
   };
 
-  meta = {
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "wrapt"
+  ];
+
+  meta = with lib; {
     description = "Module for decorators, wrappers and monkey patching";
-    license = lib.licenses.bsd2;
     homepage = "https://github.com/GrahamDumpleton/wrapt";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/yapf/default.nix b/pkgs/development/python-modules/yapf/default.nix
index 9c759f3a2b7..2d6fc9520cc 100644
--- a/pkgs/development/python-modules/yapf/default.nix
+++ b/pkgs/development/python-modules/yapf/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "yapf";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QI+5orJUwwL0nbg8WfmqC0sP0OwlvjpcURgTJ5Iv9j0=";
+    hash = "sha256-o/UIXTfvfj4ATEup+bPkDFT/GQHNER8FFFrjE6fGfRs=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/tools/ashpd-demo/default.nix b/pkgs/development/tools/ashpd-demo/default.nix
index 9e24309d984..a52a6ca8179 100644
--- a/pkgs/development/tools/ashpd-demo/default.nix
+++ b/pkgs/development/tools/ashpd-demo/default.nix
@@ -86,6 +86,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Tool for playing with XDG desktop portals";
     homepage = "https://github.com/bilelmoussaoui/ashpd/tree/master/ashpd-demo";
+    broken = true; # requires older libadwaita
     license = licenses.mit;
     maintainers = with maintainers; [ jtojnar ];
     platforms = platforms.linux;
diff --git a/pkgs/development/tools/build-managers/gnumake/default.nix b/pkgs/development/tools/build-managers/gnumake/default.nix
index 3b9f0add879..183548f5e31 100644
--- a/pkgs/development/tools/build-managers/gnumake/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isDarwin "ac_cv_struct_st_mtim_nsec=no";
 
   outputs = [ "out" "man" "info" ];
+  separateDebugInfo = true;
 
   meta = with lib; {
     homepage = "https://www.gnu.org/software/make/";
diff --git a/pkgs/development/tools/build-managers/meson/0.57/boost-Do-not-add-system-paths-on-nix.patch b/pkgs/development/tools/build-managers/meson/0.57/boost-Do-not-add-system-paths-on-nix.patch
deleted file mode 100644
index 5b9020b3d54..00000000000
--- a/pkgs/development/tools/build-managers/meson/0.57/boost-Do-not-add-system-paths-on-nix.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 536108b10271f2f42d41c7d9ddb4ce2ea1851f4f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
-Date: Sat, 17 Oct 2020 19:27:08 +0200
-Subject: [PATCH] boost: Do not add system paths on nix
-
----
- mesonbuild/dependencies/boost.py | 17 +----------------
- 1 file changed, 1 insertion(+), 16 deletions(-)
-
-diff --git a/mesonbuild/dependencies/boost.py b/mesonbuild/dependencies/boost.py
-index 907c0c275..ecaf11b18 100644
---- a/mesonbuild/dependencies/boost.py
-+++ b/mesonbuild/dependencies/boost.py
-@@ -643,22 +643,7 @@ class BoostDependency(ExternalDependency):
-             roots += [x for x in candidates if x.name.lower().startswith('boost') and x.is_dir()]
-         else:
-             tmp = []  # type: T.List[Path]
--
--            # Homebrew
--            brew_boost = Path('/usr/local/Cellar/boost')
--            if brew_boost.is_dir():
--                tmp += [x for x in brew_boost.iterdir()]
--
--            # Add some default system paths
--            tmp += [Path('/opt/local')]
--            tmp += [Path('/usr/local/opt/boost')]
--            tmp += [Path('/usr/local')]
--            tmp += [Path('/usr')]
--
--            # Cleanup paths
--            tmp = [x for x in tmp if x.is_dir()]
--            tmp = [x.resolve() for x in tmp]
--            roots += tmp
-+            # Do not add any non-explicit paths on nix
- 
-         return roots
- 
--- 
-2.25.4
-
diff --git a/pkgs/development/tools/build-managers/meson/0.57/default.nix b/pkgs/development/tools/build-managers/meson/0.57/default.nix
deleted file mode 100644
index 6fd93e8f86b..00000000000
--- a/pkgs/development/tools/build-managers/meson/0.57/default.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{ lib
-, python3
-, writeTextDir
-, substituteAll
-, fetchpatch
-, installShellFiles
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "meson";
-  version = "0.57.1";
-
-  src = python3.pkgs.fetchPypi {
-    inherit pname version;
-    sha256 = "19n8alcpzv6npgp27iqljkmvdmr7s2c7zm8y997j1nlvpa1cgqbj";
-  };
-
-  patches = [
-    # Upstream insists on not allowing bindir and other dir options
-    # outside of prefix for some reason:
-    # https://github.com/mesonbuild/meson/issues/2561
-    # We remove the check so multiple outputs can work sanely.
-    ./allow-dirs-outside-of-prefix.patch
-
-    # Meson is currently inspecting fewer variables than autoconf does, which
-    # makes it harder for us to use setup hooks, etc.  Taken from
-    # https://github.com/mesonbuild/meson/pull/6827
-    ./more-env-vars.patch
-
-    # Unlike libtool, vanilla Meson does not pass any information
-    # about the path library will be installed to to g-ir-scanner,
-    # breaking the GIR when path other than ${!outputLib}/lib is used.
-    # We patch Meson to add a --fallback-library-path argument with
-    # library install_dir to g-ir-scanner.
-    ./gir-fallback-path.patch
-
-    # In common distributions, RPATH is only needed for internal libraries so
-    # meson removes everything else. With Nix, the locations of libraries
-    # are not as predictable, therefore we need to keep them in the RPATH.
-    # At the moment we are keeping the paths starting with /nix/store.
-    # https://github.com/NixOS/nixpkgs/issues/31222#issuecomment-365811634
-    (substituteAll {
-      src = ./fix-rpath.patch;
-      inherit (builtins) storeDir;
-    })
-
-    # When Meson removes build_rpath from DT_RUNPATH entry, it just writes
-    # the shorter NUL-terminated new rpath over the old one to reduce
-    # the risk of potentially breaking the ELF files.
-    # But this can cause much bigger problem for Nix as it can produce
-    # cut-in-half-by-\0 store path references.
-    # Let’s just clear the whole rpath and hope for the best.
-    ./clear-old-rpath.patch
-
-    # Patch out default boost search paths to avoid impure builds on
-    # unsandboxed non-NixOS builds, see:
-    # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
-    ./boost-Do-not-add-system-paths-on-nix.patch
-  ];
-
-  setupHook = ./setup-hook.sh;
-
-  # 0.45 update enabled tests but they are failing
-  doCheck = false;
-  # checkInputs = [ ninja pkg-config ];
-  # checkPhase = "python ./run_project_tests.py";
-
-  postFixup = ''
-    pushd $out/bin
-    # undo shell wrapper as meson tools are called with python
-    for i in *; do
-      mv ".$i-wrapped" "$i"
-    done
-    popd
-
-    # Do not propagate Python
-    rm $out/nix-support/propagated-build-inputs
-  '';
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = ''
-    installShellCompletion --zsh data/shell-completions/zsh/_meson
-    installShellCompletion --bash data/shell-completions/bash/meson
-  '';
-
-  meta = with lib; {
-    homepage = "https://mesonbuild.com";
-    description = "SCons-like build system that use python as a front-end language and Ninja as a building backend";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jtojnar mbe ];
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/development/tools/build-managers/meson/0.57/gir-fallback-path.patch b/pkgs/development/tools/build-managers/meson/0.57/gir-fallback-path.patch
deleted file mode 100644
index 0c924bacf73..00000000000
--- a/pkgs/development/tools/build-managers/meson/0.57/gir-fallback-path.patch
+++ /dev/null
@@ -1,16 +0,0 @@
---- a/mesonbuild/modules/gnome.py
-+++ b/mesonbuild/modules/gnome.py
-@@ -807,6 +807,13 @@ class GnomeModule(ExtensionModule):
-         if fatal_warnings:
-             scan_command.append('--warn-error')
- 
-+        if len(set([girtarget.get_custom_install_dir()[0] for girtarget in girtargets])) > 1:
-+            raise MesonException('generate_gir tries to build multiple libraries with different install_dir at once: {}'.format(','.join([str(girtarget) for girtarget in girtargets])))
-+
-+        fallback_libpath = girtargets[0].get_custom_install_dir()[0]
-+        if fallback_libpath is not None and isinstance(fallback_libpath, str) and len(fallback_libpath) > 0 and fallback_libpath[0] == "/":
-+            scan_command += ['--fallback-library-path=' + fallback_libpath]
-+
-         scan_target = self._make_gir_target(state, girfile, scan_command, depends, kwargs)
- 
-         typelib_output = '%s-%s.typelib' % (ns, nsversion)
diff --git a/pkgs/development/tools/build-managers/meson/0.57/more-env-vars.patch b/pkgs/development/tools/build-managers/meson/0.57/more-env-vars.patch
deleted file mode 100644
index 4b2606e2d69..00000000000
--- a/pkgs/development/tools/build-managers/meson/0.57/more-env-vars.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/mesonbuild/environment.py b/mesonbuild/environment.py
-index 756dd8193..a5cc6ef8b 100644
---- a/mesonbuild/environment.py
-+++ b/mesonbuild/environment.py
-@@ -151,7 +151,7 @@ def _get_env_var(for_machine: MachineChoice, is_cross: bool, var_name: str) -> T
-         # compiling we fall back on the unprefixed host version. This
-         # allows native builds to never need to worry about the 'BUILD_*'
-         # ones.
--        ([var_name + '_FOR_BUILD'] if is_cross else [var_name]),
-+        [var_name + '_FOR_BUILD'] + ([] if is_cross else [var_name]),
-         # Always just the unprefixed host verions
-         [var_name]
-     )[for_machine]
diff --git a/pkgs/development/tools/build-managers/meson/0.60/allow-dirs-outside-of-prefix.patch b/pkgs/development/tools/build-managers/meson/0.60/allow-dirs-outside-of-prefix.patch
deleted file mode 100644
index 4eb292a2e52..00000000000
--- a/pkgs/development/tools/build-managers/meson/0.60/allow-dirs-outside-of-prefix.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/mesonbuild/coredata.py
-+++ b/mesonbuild/coredata.py
-@@ -506,7 +506,6 @@ class CoreData:
-             return value
-         if option.name.endswith('dir') and value.is_absolute() and \
-            option not in BULITIN_DIR_NOPREFIX_OPTIONS:
--            # Value must be a subdir of the prefix
-             # commonpath will always return a path in the native format, so we
-             # must use pathlib.PurePath to do the same conversion before
-             # comparing.
-@@ -518,7 +517,7 @@ class CoreData:
-             try:
-                 value = value.relative_to(prefix)
-             except ValueError:
--                raise MesonException(msg.format(option, value, prefix))
-+                pass
-             if '..' in str(value):
-                 raise MesonException(msg.format(option, value, prefix))
-         return value.as_posix()
diff --git a/pkgs/development/tools/build-managers/meson/0.60/clear-old-rpath.patch b/pkgs/development/tools/build-managers/meson/0.60/clear-old-rpath.patch
deleted file mode 100644
index f1e3c76e8b5..00000000000
--- a/pkgs/development/tools/build-managers/meson/0.60/clear-old-rpath.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/mesonbuild/scripts/depfixer.py b/mesonbuild/scripts/depfixer.py
-index 4176b9a03..faaabf616 100644
---- a/mesonbuild/scripts/depfixer.py
-+++ b/mesonbuild/scripts/depfixer.py
-@@ -336,6 +336,15 @@ class Elf(DataSizes):
-         if not new_rpath:
-             self.remove_rpath_entry(entrynum)
-         else:
-+            # Clear old rpath to avoid stale references,
-+            # not heeding the warning above about de-duplication
-+            # since it does not seem to cause issues for us
-+            # and not doing so trips up Nix’s reference checker.
-+            # See https://github.com/NixOS/nixpkgs/pull/46020
-+            # and https://github.com/NixOS/nixpkgs/issues/95163
-+            self.bf.seek(rp_off)
-+            self.bf.write(b'\0'*len(old_rpath))
-+
-             self.bf.seek(rp_off)
-             self.bf.write(new_rpath)
-             self.bf.write(b'\0')
diff --git a/pkgs/development/tools/build-managers/meson/0.60/fix-rpath.patch b/pkgs/development/tools/build-managers/meson/0.60/fix-rpath.patch
deleted file mode 100644
index d34b6c4c434..00000000000
--- a/pkgs/development/tools/build-managers/meson/0.60/fix-rpath.patch
+++ /dev/null
@@ -1,24 +0,0 @@
---- a/mesonbuild/backend/backends.py
-+++ b/mesonbuild/backend/backends.py
-@@ -456,6 +456,21 @@ class Backend:
-                 args.extend(self.environment.coredata.get_external_link_args(target.for_machine, lang))
-             except Exception:
-                 pass
-+
-+        nix_ldflags = os.environ.get('NIX_LDFLAGS', '').split()
-+        next_is_path = False
-+        # Try to add rpaths set by user or ld-wrapper so that they are not removed.
-+        # Based on https://github.com/NixOS/nixpkgs/blob/69711a2f5ffe8cda208163be5258266172ff527f/pkgs/build-support/bintools-wrapper/ld-wrapper.sh#L148-L177
-+        for flag in nix_ldflags:
-+            if flag == '-rpath' or flag == '-L':
-+                next_is_path = True
-+            elif next_is_path or flag.startswith('-L/'):
-+                if flag.startswith('-L/'):
-+                    flag = flag[2:]
-+                if flag.startswith('@storeDir@'):
-+                    dirs.add(flag)
-+                next_is_path = False
-+
-         # Match rpath formats:
-         # -Wl,-rpath=
-         # -Wl,-rpath,
diff --git a/pkgs/development/tools/build-managers/meson/0.60/setup-hook.sh b/pkgs/development/tools/build-managers/meson/0.60/setup-hook.sh
deleted file mode 100644
index 3d946fcffd5..00000000000
--- a/pkgs/development/tools/build-managers/meson/0.60/setup-hook.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-mesonConfigurePhase() {
-    runHook preConfigure
-
-    if [ -z "${dontAddPrefix-}" ]; then
-        mesonFlags="--prefix=$prefix $mesonFlags"
-    fi
-
-    # See multiple-outputs.sh and meson’s coredata.py
-    mesonFlags="\
-        --libdir=${!outputLib}/lib --libexecdir=${!outputLib}/libexec \
-        --bindir=${!outputBin}/bin --sbindir=${!outputBin}/sbin \
-        --includedir=${!outputInclude}/include \
-        --mandir=${!outputMan}/share/man --infodir=${!outputInfo}/share/info \
-        --localedir=${!outputLib}/share/locale \
-        -Dauto_features=${mesonAutoFeatures:-enabled} \
-        -Dwrap_mode=${mesonWrapMode:-nodownload} \
-        $mesonFlags"
-
-    mesonFlags="${crossMesonFlags+$crossMesonFlags }--buildtype=${mesonBuildType:-plain} $mesonFlags"
-
-    echo "meson flags: $mesonFlags ${mesonFlagsArray[@]}"
-
-    meson build $mesonFlags "${mesonFlagsArray[@]}"
-    cd build
-
-    if ! [[ -v enableParallelBuilding ]]; then
-        enableParallelBuilding=1
-        echo "meson: enabled parallel building"
-    fi
-
-    runHook postConfigure
-}
-
-if [ -z "${dontUseMesonConfigure-}" -a -z "${configurePhase-}" ]; then
-    setOutputFlags=
-    configurePhase=mesonConfigurePhase
-fi
diff --git a/pkgs/development/tools/build-managers/meson/0.57/allow-dirs-outside-of-prefix.patch b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
index 4eb292a2e52..4eb292a2e52 100644
--- a/pkgs/development/tools/build-managers/meson/0.57/allow-dirs-outside-of-prefix.patch
+++ b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
diff --git a/pkgs/development/tools/build-managers/meson/0.60/boost-Do-not-add-system-paths-on-nix.patch b/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
index 0a2eda9de9a..0a2eda9de9a 100644
--- a/pkgs/development/tools/build-managers/meson/0.60/boost-Do-not-add-system-paths-on-nix.patch
+++ b/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
diff --git a/pkgs/development/tools/build-managers/meson/0.57/clear-old-rpath.patch b/pkgs/development/tools/build-managers/meson/clear-old-rpath.patch
index f1e3c76e8b5..f1e3c76e8b5 100644
--- a/pkgs/development/tools/build-managers/meson/0.57/clear-old-rpath.patch
+++ b/pkgs/development/tools/build-managers/meson/clear-old-rpath.patch
diff --git a/pkgs/development/tools/build-managers/meson/0.60/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index a5efccfac9c..aeddf457f48 100644
--- a/pkgs/development/tools/build-managers/meson/0.60/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -57,6 +57,10 @@ python3.pkgs.buildPythonApplication rec {
     # unsandboxed non-NixOS builds, see:
     # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
     ./boost-Do-not-add-system-paths-on-nix.patch
+
+    # Meson tries to update ld.so.cache which breaks when the target architecture
+    # differs from the build host's.
+    ./do-not-update-ldconfig-cache.patch
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/build-managers/meson/do-not-update-ldconfig-cache.patch b/pkgs/development/tools/build-managers/meson/do-not-update-ldconfig-cache.patch
new file mode 100644
index 00000000000..884023aaa7e
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/do-not-update-ldconfig-cache.patch
@@ -0,0 +1,12 @@
+diff --git a/mesonbuild/minstall.py b/mesonbuild/minstall.py
+index cb87faf5c..878ec4cd6 100644
+--- a/mesonbuild/minstall.py
++++ b/mesonbuild/minstall.py
+@@ -551,7 +551,6 @@ class Installer:
+                 self.install_emptydir(d, dm, destdir, fullprefix)
+                 self.install_data(d, dm, destdir, fullprefix)
+                 self.restore_selinux_contexts(destdir)
+-                self.apply_ldconfig(dm, destdir)
+                 self.run_install_script(d, destdir, fullprefix)
+                 if not self.did_install_something:
+                     self.log('Nothing to install.')
diff --git a/pkgs/development/tools/build-managers/meson/0.57/fix-rpath.patch b/pkgs/development/tools/build-managers/meson/fix-rpath.patch
index d34b6c4c434..d34b6c4c434 100644
--- a/pkgs/development/tools/build-managers/meson/0.57/fix-rpath.patch
+++ b/pkgs/development/tools/build-managers/meson/fix-rpath.patch
diff --git a/pkgs/development/tools/build-managers/meson/0.60/gir-fallback-path.patch b/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
index e6d74026527..e6d74026527 100644
--- a/pkgs/development/tools/build-managers/meson/0.60/gir-fallback-path.patch
+++ b/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
diff --git a/pkgs/development/tools/build-managers/meson/0.60/more-env-vars.patch b/pkgs/development/tools/build-managers/meson/more-env-vars.patch
index e4ad4355042..e4ad4355042 100644
--- a/pkgs/development/tools/build-managers/meson/0.60/more-env-vars.patch
+++ b/pkgs/development/tools/build-managers/meson/more-env-vars.patch
diff --git a/pkgs/development/tools/build-managers/meson/0.57/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 3d946fcffd5..3d946fcffd5 100644
--- a/pkgs/development/tools/build-managers/meson/0.57/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
diff --git a/pkgs/development/tools/misc/intel-gpu-tools/default.nix b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
index eca59819ba0..40cf1e14e94 100644
--- a/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , libdrm
 , libpciaccess
@@ -45,6 +46,14 @@ stdenv.mkDerivation rec {
     sha256 = "1dwvxh1yplsh1a7h3gpp40g91v12cfxy6yy99s1v9yr2kwxikm1n";
   };
 
+  patches = [
+    # fix build with meson 0.60
+    (fetchpatch {
+      url = "https://github.com/freedesktop/xorg-intel-gpu-tools/commit/963917a3565466832a3b2fc22e9285d34a0bf944.patch";
+      sha256 = "sha256-goO2N7aK2dJYMhFGS1DlvjEYMSijN6stV6Q5z/RP8Ko=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config utilmacros meson ninja flex bison gtk-doc docutils docbook_xsl ];
   buildInputs = [
     libdrm
diff --git a/pkgs/development/tools/pandoc/default.nix b/pkgs/development/tools/pandoc/default.nix
index 475fa6a93e4..a61f39c15b6 100644
--- a/pkgs/development/tools/pandoc/default.nix
+++ b/pkgs/development/tools/pandoc/default.nix
@@ -26,7 +26,7 @@ in
     # This should ideally be fixed in haskellPackages (or even Cabal),
     # but a minimal pandoc is important enough to patch it manually.
     disallowedReferences = [ haskellPackages.pandoc-types haskellPackages.HTTP ];
-    postInstall = ''
+    postInstall = drv.postInstall or "" + ''
       remove-references-to \
         -t ${haskellPackages.pandoc-types} \
         $out/bin/pandoc
diff --git a/pkgs/games/rogue/default.nix b/pkgs/games/rogue/default.nix
index 127d65ff362..4865b85bbe3 100644
--- a/pkgs/games/rogue/default.nix
+++ b/pkgs/games/rogue/default.nix
@@ -15,9 +15,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
-  # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
-
   meta = with lib; {
     homepage = "http://rogue.rogueforge.net/rogue-5-4/";
     description = "The final version of the original Rogue game developed for the UNIX operating system";
diff --git a/pkgs/games/vdrift/default.nix b/pkgs/games/vdrift/default.nix
index 04f65cf7937..19397794649 100644
--- a/pkgs/games/vdrift/default.nix
+++ b/pkgs/games/vdrift/default.nix
@@ -12,7 +12,7 @@
 , bullet
 , curl
 , gettext
-, writeTextFile
+, writeShellScriptBin
 
 , data ? fetchsvn {
     url = "svn://svn.code.sf.net/p/vdrift/code/vdrift-data";
@@ -54,21 +54,15 @@ let
     };
   };
   wrappedName = "vdrift-${version}-with-data-${toString data.rev}";
-in writeTextFile {
+in
+(writeShellScriptBin "vdrift"  ''
+  export VDRIFT_DATA_DIRECTORY="${data}"
+  exec ${bin}/bin/vdrift "$@"
+'').overrideAttrs (_: {
   name = wrappedName;
-  text = ''
-    export VDRIFT_DATA_DIRECTORY="${data}"
-    exec ${bin}/bin/vdrift "$@"
-  '';
-  destination = "/bin/vdrift";
-  executable = true;
-  checkPhase = ''
-    ${stdenv.shell} -n $out/bin/vdrift
-  '';
-} // {
   meta = bin.meta // {
     hydraPlatforms = [ ];
   };
   unwrapped = bin;
   inherit bin data;
-}
+})
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index bbada33054d..0e9977f564b 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -28,14 +28,14 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.3.3op2";
+  version = if stdenv.isDarwin then "2.2.6" else "2.4.0";
 
   src = fetchurl (if stdenv.isDarwin then {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
   } else {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "1pwndz4gwkm7311wkhhzlw2diy7wbck7yy026jbaxh3rprdmgcyy";
+    sha256 = "1pm6lf08z8vgs62g5b5rjw32qy3vr0q3sgidpg2lfs6a530wxgls";
   });
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 5e27e5573c5..e80ad8a839f 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -30,22 +30,18 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ghostscript";
-  version = "9.53.3";
+  version = "9.55.0";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs9${lib.versions.minor version}${lib.versions.patch version}/${pname}-${version}.tar.xz";
-    sha512 = "2vif3vgxa5wma16yxvhhkymk4p309y5204yykarq94r5rk890556d2lj5w7acnaa2ymkym6y0zd4vq9sy9ca2346igg2c6dxqkjr0zb";
+    sha512 = "27g72152mlwlalg232jxdhaf3ykgmqwi2pccbkwfygql1h9iz40plfbwbs1n0fkvm4zwzg5r9cr8g7w2dxih4jldiidv7rflxdy1is2";
   };
 
   patches = [
     (fetchpatch {
-      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/41ef9a0bc36b9db7115fbe9623f989bfb47bbade.patch";
-      sha256 = "1qpc6q1fpxshqc0mqgg36kng47kgljk50bmr8p7wn21jgfkh7m8w";
-    })
-    (fetchpatch {
-      url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=a9bd3dec9fde";
-      name = "CVE-2021-3781.patch";
-      sha256 = "FvbH7cb3ZDCbNRz9DF0kDmLdF7OWNYk90wv44pimU58=";
+      name = "fix-non-vendored-lcms2-typo.patch";
+      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/830afae5454dea3bff903869d82022306890a96c.patch";
+      sha256 = "1w9yspsgxyabvrw9ld6pv6pb7708c44ihjqvag7qqh9v1lhm48j0";
     })
     ./urw-font-files.patch
     ./doc-no-ref.diff
@@ -88,6 +84,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-system-libtiff"
     "--enable-dynamic"
+    "--without-tesseract"
   ]
   ++ lib.optional x11Support "--with-x"
   ++ lib.optionals cupsSupport [
diff --git a/pkgs/misc/scrcpy/default.nix b/pkgs/misc/scrcpy/default.nix
index 871e5bff6c9..594561593e5 100644
--- a/pkgs/misc/scrcpy/default.nix
+++ b/pkgs/misc/scrcpy/default.nix
@@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
     echo -n > server/meson.build
   '';
 
-  mesonFlags = [ "-Doverride_server_path=${prebuilt_server}" ];
   postInstall = ''
     mkdir -p "$out/share/scrcpy"
     ln -s "${prebuilt_server}" "$out/share/scrcpy/scrcpy-server"
diff --git a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
index 3c49337a937..acd90b7aa2f 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
@@ -3,4 +3,3 @@ getHostRole
 
 export NIX_LDFLAGS${role_post}+=" -lnbcompat"
 export NIX_CFLAGS_COMPILE${role_post}+=" -DHAVE_NBTOOL_CONFIG_H"
-export NIX_CFLAGS_COMPILE${role_post}+=" -include nbtool_config.h"
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index beaa176dae1..25ac9ce451c 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -120,7 +120,17 @@ in lib.makeScopeWithSplicing
   } // lib.optionalAttrs (attrs.headersOnly or false) {
     installPhase = "includesPhase";
     dontBuild = true;
-  } // attrs));
+  } // attrs // {
+    postPatch = lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
+      # Files that use NetBSD-specific macros need to have nbtool_config.h
+      # included ahead of them on non-NetBSD platforms.
+      set +e
+      grep -Zlr "^__RCSID
+      ^__BEGIN_DECLS" | xargs -0r grep -FLZ nbtool_config.h |
+          xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
+      set -e
+    '' + attrs.postPatch or "";
+  }));
 
   ##
   ## START BOOTSTRAPPING
@@ -182,6 +192,12 @@ in lib.makeScopeWithSplicing
     configurePlatforms = [ "build" "host" ];
     configureFlags = [
       "--cache-file=config.cache"
+    ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+      # We include this header in our musl package only for legacy
+      # compatibility, and compat works fine without it (and having it
+      # know about sys/cdefs.h breaks packages like glib when built
+      # statically).
+      "ac_cv_header_sys_cdefs_h=no"
     ];
 
     nativeBuildInputs = with buildPackages.netbsd; commonDeps ++ [
diff --git a/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
index 879d3a7b5f7..37830c0665e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
@@ -1,14 +1,15 @@
-{ stdenv, appleDerivation', launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security }:
+{ lib, stdenv, appleDerivation', launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security
+, headersOnly ? false }:
 
 appleDerivation' stdenv {
   meta.broken = stdenv.cc.nativeLibc;
 
-  nativeBuildInputs = [ bootstrap_cmds ];
-  buildInputs = [ launchd ppp IOKit eap8021x ];
+  nativeBuildInputs = lib.optionals (!headersOnly) [ bootstrap_cmds ];
+  buildInputs = lib.optionals (!headersOnly) [ launchd ppp IOKit eap8021x ];
 
-  propagatedBuildInputs = [ Security ];
+  propagatedBuildInputs = lib.optionals (!headersOnly) [ Security ];
 
-  patchPhase = ''
+  patchPhase = lib.optionalString (!headersOnly) ''
     HACK=$PWD/hack
     mkdir $HACK
     cp -r ${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders/net $HACK
@@ -63,6 +64,8 @@ appleDerivation' stdenv {
     EOF
   '';
 
+  dontBuild = headersOnly;
+
   buildPhase = ''
     pushd SystemConfiguration.fproj >/dev/null
 
@@ -206,7 +209,7 @@ appleDerivation' stdenv {
   installPhase = ''
     mkdir -p $out/include
     cp dnsinfo/*.h $out/include/
-
+  '' + lib.optionalString (!headersOnly) ''
     mkdir -p $out/Library/Frameworks/
     mv SystemConfiguration.fproj/SystemConfiguration.framework $out/Library/Frameworks
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 5e098926d29..90cb4a99bfc 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -297,6 +297,12 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
     PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "1llimhvp0gjffd47322lnjq7cqwinx0c5z7ikli04ad5srpa68mh" {};
 
+    # `configdHeaders` can’t use an override because `pkgs.darwin.configd` on aarch64-darwin will
+    # be replaced by SystemConfiguration.framework from the macOS SDK.
+    configdHeaders  = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
+      headersOnly = true;
+      Security    = null;
+    };
     libutilHeaders  = pkgs.darwin.libutil.override { headersOnly = true; };
     hfsHeaders      = pkgs.darwin.hfs.override { headersOnly = true; };
     libresolvHeaders= pkgs.darwin.libresolv.override { headersOnly = true; };
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
index 53fc019768d..2a8a609472a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
@@ -1,9 +1,9 @@
-{ lib, appleDerivation', stdenv, stdenvNoCC, Libinfo, configd, mDNSResponder
+{ lib, appleDerivation', stdenv, stdenvNoCC, Libinfo, configdHeaders, mDNSResponder
 , headersOnly ? false
 }:
 
 appleDerivation' (if headersOnly then stdenvNoCC else stdenv) {
-  buildInputs = lib.optionals (!headersOnly) [ Libinfo configd mDNSResponder ];
+  buildInputs = lib.optionals (!headersOnly) [ Libinfo configdHeaders mDNSResponder ];
 
   buildPhase = lib.optionalString (!headersOnly) ''
     $CC -I. -c dns_util.c
diff --git a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
index 9e3d6e49204..672bb443242 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
@@ -20,6 +20,8 @@ appleDerivation {
     done
   '';
 
+  NIX_CFLAGS_COMPILE=[ "-Wno-error=format-security" ]; # hardeningDisable doesn't cut it
+
   meta = {
     platforms = lib.platforms.darwin;
     maintainers = with lib.maintainers; [ matthewbauer ];
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch b/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch
deleted file mode 100644
index b17df9a492e..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch
+++ /dev/null
@@ -1,232 +0,0 @@
-diff --git a/src/control/control.c b/src/control/control.c
-index d66ed75..42cecad 100644
---- a/src/control/control.c
-+++ b/src/control/control.c
-@@ -838,6 +838,10 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- #ifndef PIC
- 	extern void *snd_control_open_symbols(void);
- #endif
-+
-+	snd_config_t *libs = NULL;
-+	const char *libs_lib = NULL;
-+
- 	if (snd_config_get_type(ctl_conf) != SND_CONFIG_TYPE_COMPOUND) {
- 		if (name)
- 			SNDERR("Invalid type for CTL %s definition", name);
-@@ -879,6 +883,19 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 					SNDERR("Invalid type for %s", id);
- 					goto _err;
- 				}
-+
-+				continue;
-+			}
-+			// Handle an array of extra libs.
-+			if (strcmp(id, "libs") == 0) {
-+				if (snd_config_get_type(n) != SND_CONFIG_TYPE_COMPOUND) {
-+					SNDERR("Invalid type for libs definition in CTL %s definition",
-+						str);
-+					goto _err;
-+				}
-+
-+				libs = n;
-+
- 				continue;
- 			}
- 			if (strcmp(id, "open") == 0) {
-@@ -903,7 +920,62 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 		open_name = buf;
- 		sprintf(buf, "_snd_ctl_%s_open", str);
- 	}
--	if (!lib) {
-+
-+#ifndef PIC
-+	snd_control_open_symbols();
-+#endif
-+
-+	// Normal alsa behaviour when there is no libs array.
-+	if (!libs) {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 1);
-+		}
-+	}
-+	// Handle libs array.
-+	// Suppresses error messages if any function is loaded successfully.
-+	else {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 0);
-+		}
-+
-+		if (!open_func) {
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				err = snd_config_get_string(n, &libs_lib);
-+				if (err < 0) {
-+					SNDERR("Invalid entry in CTL %s libs definition", str);
-+					goto _err;
-+				}
-+
-+				if (!open_func) {
-+					open_func = snd_dlobj_cache_get(libs_lib, open_name,
-+						SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 0);
-+				}
-+			}
-+		}
-+
-+		// Print error messages.
-+		if (!open_func) {
-+			if (lib) {
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					lib, open_name);
-+			}
-+
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				snd_config_get_string(n, &libs_lib);
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					libs_lib, open_name);
-+			}
-+		}
-+	}
-+
-+	// Look in ALSA_PLUGIN_DIR iff we found nowhere else to look.
-+	if (!lib && (!libs || !libs_lib)) {
- 		const char *const *build_in = build_in_ctls;
- 		while (*build_in) {
- 			if (!strcmp(*build_in, str))
-@@ -919,12 +991,11 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 			lib = buf1;
- 			sprintf(buf1, "%s/libasound_module_ctl_%s.so", ALSA_PLUGIN_DIR, str);
- 		}
--	}
--#ifndef PIC
--	snd_control_open_symbols();
--#endif
--	open_func = snd_dlobj_cache_get(lib, open_name,
-+
-+		open_func = snd_dlobj_cache_get(lib, open_name,
- 			SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 1);
-+	}
-+
- 	if (open_func) {
- 		err = open_func(ctlp, name, ctl_root, ctl_conf, mode);
- 		if (err >= 0) {
-diff --git a/src/pcm/pcm.c b/src/pcm/pcm.c
-index 2e24338..7f489f4 100644
---- a/src/pcm/pcm.c
-+++ b/src/pcm/pcm.c
-@@ -2116,6 +2116,10 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- #ifndef PIC
- 	extern void *snd_pcm_open_symbols(void);
- #endif
-+
-+	snd_config_t *libs = NULL;
-+	const char *libs_lib = NULL;
-+
- 	if (snd_config_get_type(pcm_conf) != SND_CONFIG_TYPE_COMPOUND) {
- 		char *val;
- 		id = NULL;
-@@ -2160,6 +2164,19 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 					SNDERR("Invalid type for %s", id);
- 					goto _err;
- 				}
-+
-+				continue;
-+			}
-+			// Handle an array of extra libs.
-+			if (strcmp(id, "libs") == 0) {
-+				if (snd_config_get_type(n) != SND_CONFIG_TYPE_COMPOUND) {
-+					SNDERR("Invalid type for libs definition in PCM %s definition",
-+						str);
-+					goto _err;
-+				}
-+
-+				libs = n;
-+
- 				continue;
- 			}
- 			if (strcmp(id, "open") == 0) {
-@@ -2184,7 +2201,62 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 		open_name = buf;
- 		sprintf(buf, "_snd_pcm_%s_open", str);
- 	}
--	if (!lib) {
-+
-+#ifndef PIC
-+	snd_pcm_open_symbols();	/* this call is for static linking only */
-+#endif
-+
-+	// Normal alsa behaviour when there is no libs array.
-+	if (!libs) {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 1);
-+		}
-+	}
-+	// Handle libs array.
-+	// Suppresses error messages if any function is loaded successfully.
-+	else {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 0);
-+		}
-+
-+		if (!open_func) {
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				err = snd_config_get_string(n, &libs_lib);
-+				if (err < 0) {
-+					SNDERR("Invalid entry in PCM %s libs definition", str);
-+					goto _err;
-+				}
-+
-+				if (!open_func) {
-+					open_func = snd_dlobj_cache_get(libs_lib, open_name,
-+						SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 0);
-+				}
-+			}
-+		}
-+
-+		// Print error messages.
-+		if (!open_func) {
-+			if (lib) {
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					lib, open_name);
-+			}
-+
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				snd_config_get_string(n, &libs_lib);
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					libs_lib, open_name);
-+			}
-+		}
-+	}
-+
-+	// Look in ALSA_PLUGIN_DIR iff we found nowhere else to look.
-+	if (!lib && (!libs || !libs_lib)) {
- 		const char *const *build_in = build_in_pcms;
- 		while (*build_in) {
- 			if (!strcmp(*build_in, str))
-@@ -2200,12 +2272,11 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 			lib = buf1;
- 			sprintf(buf1, "%s/libasound_module_pcm_%s.so", ALSA_PLUGIN_DIR, str);
- 		}
--	}
--#ifndef PIC
--	snd_pcm_open_symbols();	/* this call is for static linking only */
--#endif
--	open_func = snd_dlobj_cache_get(lib, open_name,
-+
-+		open_func = snd_dlobj_cache_get(lib, open_name,
- 			SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 1);
-+	}
-+
- 	if (open_func) {
- 		err = open_func(pcmp, name, pcm_root, pcm_conf, stream, mode);
- 		if (err >= 0) {
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
index a2350271482..445d171d31f 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
@@ -7,24 +7,15 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-lib";
-  version = "1.2.5.1";
+  version = "1.2.6.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-YoQh2VDOyvI03j+JnVIMCmkjMTyWStdR/6wIHfMxQ44=";
+    hash = "sha256-rVgpk9Us21+xWaC+q2CmrFfqsMwb34XcTbbWGX8CMz8=";
   };
 
-  patches = [
-    ./alsa-plugin-conf-multilib.patch
-  ];
-
   enableParallelBuilding = true;
 
-  # Fix pcm.h file in order to prevent some compilation bugs
-  postPatch = ''
-    sed -i -e 's|//int snd_pcm_mixer_element(snd_pcm_t \*pcm, snd_mixer_t \*mixer, snd_mixer_elem_t \*\*elem);|/\*int snd_pcm_mixer_element(snd_pcm_t \*pcm, snd_mixer_t \*mixer, snd_mixer_elem_t \*\*elem);\*/|' include/pcm.h
-  '';
-
   postInstall = ''
     ln -s ${alsa-ucm-conf}/share/alsa/{ucm,ucm2} $out/share/alsa
     ln -s ${alsa-topology-conf}/share/alsa/topology $out/share/alsa
@@ -43,5 +34,6 @@ stdenv.mkDerivation rec {
 
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ l-as ];
   };
 }
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 9bbd6ddafed..939a7115e89 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -24,12 +24,14 @@ stdenv.mkDerivation rec {
     substituteInPlace tests/unit-utils-io.c --replace "| O_DIRECT" ""
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && !stdenv.hostPlatform.isStatic) "-lgcc_s";
 
   configureFlags = [
     "--enable-cryptsetup-reencrypt"
     "--with-crypto_backend=openssl"
     "--disable-ssh-token"
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "--enable-static-cryptsetup"
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 71f6da0d13b..077c37a72cb 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -214,7 +214,7 @@ let
       "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
     ] ++ lib.optionals (!haveDell) [
       "-Dplugin_dell=false"
-      "-Dplugin_synaptics=false"
+      "-Dplugin_synaptics_mst=false"
     ] ++ lib.optionals (!haveRedfish) [
       "-Dplugin_redfish=false"
     ] ++ lib.optionals haveFlashrom [
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index c949069885d..0ca6d8aa187 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "20210722";
+  version = "20211215";
   sunAsIsLicense = {
     fullName = "AS-IS, SUN MICROSYSTEMS license";
     url = "https://github.com/iputils/iputils/blob/s${version}/rdisc.c";
@@ -19,14 +19,9 @@ in stdenv.mkDerivation rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "139fyifsjm0i012rhcx3ra3pxx2wxh77dfd551d8lgiv2mqd742j";
+    sha256 = "1vzdch1xi2x2j8mvnsr4wwwh7kdkgf926xafw5kkb74yy1wac5qv";
   };
 
-  postPatch = lib.optionalString (!doCheck) ''
-    # There isn't a Meson option for this yet:
-    sed -i '/##### TESTS #####/q' ping/meson.build
-  '';
-
   outputs = ["out" "apparmor"];
 
   # We don't have the required permissions inside the build sandbox:
@@ -35,11 +30,10 @@ in stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-DBUILD_RARPD=true"
-    "-DBUILD_TRACEROUTE6=true"
-    "-DBUILD_TFTPD=true"
     "-DNO_SETCAP_OR_SUID=true"
     "-Dsystemdunitdir=etc/systemd/system"
     "-DINSTALL_SYSTEMD_UNITS=true"
+    "-DSKIP_TESTS=${lib.boolToString (!doCheck)}"
   ]
     # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
     ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
@@ -87,9 +81,7 @@ in stdenv.mkDerivation rec {
       ping
       rarpd
       rdisc
-      tftpd
       tracepath
-      traceroute6
     '';
   };
 }
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index daee83e61db..81e86fe77ef 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -21,12 +21,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/MLPflnfooe7Wjy8M3CTowAi5oYpscruSkDsaVzhmYQ=";
   };
 
+  patches = [(fetchpatch {
+    url = "https://github.com/libbpf/libbpf/pull/41.diff";
+    sha256 = "sha256-pg5WARqh6z0nkTHMBhftxwdV2SyswC2lfaCXCpez0VA=";
+  })];
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libelf zlib ];
 
-  sourceRoot = "source/src";
   enableParallelBuilding = true;
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=$(out)" "-C src" ];
 
   passthru.tests = {
     bpf = nixosTests.bpf;
@@ -34,7 +38,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # install linux's libbpf-compatible linux/btf.h
-    install -Dm444 ../include/uapi/linux/btf.h -t $out/include/linux
+    install -Dm444 include/uapi/linux/btf.h -t $out/include/linux
   '';
 
   # FIXME: Multi-output requires some fixes to the way the pkg-config file is
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 2c8014d700a..0749292531b 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -9,7 +9,8 @@
 , libaio
 , enableCmdlib ? false
 , enableDmeventd ? false
-, udev ? null
+, udevSupport ? !stdenv.targetPlatform.isStatic, udev ? null
+, onlyLib ? stdenv.targetPlatform.isStatic
 , nixosTests
 }:
 
@@ -26,7 +27,13 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ udev libuuid libaio ];
+  buildInputs = [
+    libaio
+  ] ++ lib.optionals udevSupport [
+    udev
+  ] ++ lib.optionals (!onlyLib) [
+    libuuid
+  ];
 
   configureFlags = [
     "--disable-readline"
@@ -46,10 +53,11 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
     "ac_cv_func_realloc_0_nonnull=yes"
-  ] ++
-  lib.optionals (udev != null) [
+  ] ++ lib.optionals udevSupport [
     "--enable-udev_rules"
     "--enable-udev_sync"
+  ] ++ lib.optionals stdenv.targetPlatform.isStatic [
+    "--enable-static_link"
   ];
 
   preConfigure = ''
@@ -58,9 +66,13 @@ stdenv.mkDerivation rec {
     substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
       --replace /usr/bin/udevadm /run/current-system/systemd/bin/udevadm
     # https://github.com/lvmteam/lvm2/issues/36
+  '' + lib.optionalString (lib.versionOlder version "2.03.14") ''
+    substituteInPlace udev/69-dm-lvm-metad.rules.in \
+      --replace "(BINDIR)/systemd-run" /run/current-system/systemd/bin/systemd-run
+  '' + lib.optionalString (lib.versionAtLeast version "2.03.14") ''
     substituteInPlace udev/69-dm-lvm.rules.in \
       --replace "/usr/bin/systemd-run" /run/current-system/systemd/bin/systemd-run
-
+  '' + ''
     substituteInPlace make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
   '' + lib.optionalString (lib.versionAtLeast version "2.03") ''
     substituteInPlace libdm/make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
@@ -78,30 +90,41 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/lvm2/mallinfo.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
       sha256 = "0g6wlqi215i5s30bnbkn8w7axrs27y3bnygbpbnf64wwx7rxxlj0";
     })
+  ] ++ lib.optionals stdenv.targetPlatform.isStatic [
+    ./no-shared.diff
   ];
 
   doCheck = false; # requires root
 
-  makeFlags = lib.optionals (udev != null) [
+  makeFlags = lib.optionals udevSupport [
     "SYSTEMD_GENERATOR_DIR=$(out)/lib/systemd/system-generators"
+  ] ++ lib.optionals onlyLib [
+    "libdm.device-mapper"
   ];
 
   # To prevent make install from failing.
   installFlags = [ "OWNER=" "GROUP=" "confdir=$(out)/etc" ];
 
   # Install systemd stuff.
-  installTargets = [ "install" ] ++ lib.optionals (udev != null) [
+  installTargets = [ "install" ] ++ lib.optionals udevSupport [
     "install_systemd_generators"
     "install_systemd_units"
     "install_tmpfiles_configuration"
   ];
 
+  installPhase = lib.optionalString onlyLib ''
+    install -D -t $out/lib libdm/ioctl/libdevmapper.${if stdenv.targetPlatform.isStatic then "a" else "so"}
+    make -C libdm install_include
+    make -C libdm install_pkgconfig
+  '';
+
   # only split bin and lib out from out if cmdlib isn't enabled
   outputs = [
     "out"
+  ] ++ lib.optionals (!onlyLib) [
     "dev"
     "man"
-  ] ++ lib.optionals (enableCmdlib != true) [
+  ] ++ lib.optionals (!onlyLib && !enableCmdlib) [
     "bin"
     "lib"
   ];
diff --git a/pkgs/os-specific/linux/lvm2/no-shared.diff b/pkgs/os-specific/linux/lvm2/no-shared.diff
new file mode 100644
index 00000000000..d40dd85dfc6
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/no-shared.diff
@@ -0,0 +1,25 @@
+diff --git a/libdm/Makefile.in b/libdm/Makefile.in
+index 66ec39513..ab7123dae 100644
+--- a/libdm/Makefile.in
++++ b/libdm/Makefile.in
+@@ -44,7 +44,6 @@ endif
+ 
+ LIB_SHARED = $(interface)/libdevmapper.$(LIB_SUFFIX)
+ LIB_VERSION = $(LIB_VERSION_DM)
+-TARGETS = libdevmapper.$(LIB_SUFFIX) libdevmapper.$(LIB_SUFFIX).$(LIB_VERSION)
+ 
+ CFLOW_LIST = $(SOURCES)
+ CFLOW_LIST_TARGET = libdevmapper.cflow
+diff --git a/make.tmpl.in b/make.tmpl.in
+index e7780e8d4..ca4aa9fdd 100644
+--- a/make.tmpl.in
++++ b/make.tmpl.in
+@@ -346,7 +346,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
+ SUBDIRS.clean := $(SUBDIRS:=.clean)
+ SUBDIRS.distclean := $(SUBDIRS:=.distclean)
+ 
+-TARGETS += $(LIB_SHARED) $(LIB_STATIC)
++TARGETS += $(LIB_STATIC)
+ 
+ all: $(SUBDIRS) $(TARGETS)
+ 
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 12ff9f493a3..33ab4f784fc 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -23,18 +23,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    mv -v $out/sbin/unix_chkpwd{,.orig}
-    ln -sv /run/wrappers/bin/unix_chkpwd $out/sbin/unix_chkpwd
-  ''; /*
-    rm -rf $out/etc
-    mkdir -p $modules/lib
-    mv $out/lib/security $modules/lib/
-  '';*/
-  # don't move modules, because libpam needs to (be able to) find them,
-  # which is done by dlopening $out/lib/security/pam_foo.so
-  # $out/etc was also missed: pam_env(login:session): Unable to open config file
-
   preConfigure = lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
       # export ac_cv_search_crypt=no
       # (taken from Alpine linux, apparently insecure but also doesn't build O:))
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 3c11c03dfdc..f17dd02e7c0 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -415,7 +415,7 @@ stdenv.mkDerivation {
     "-Dnetworkd=${lib.boolToString withNetworkd}"
     "-Doomd=${lib.boolToString withOomd}"
     "-Dpolkit=${lib.boolToString withPolkit}"
-    "-Dcryptsetup=${lib.boolToString withCryptsetup}"
+    "-Dlibcryptsetup=${lib.boolToString withCryptsetup}"
     "-Dportabled=${lib.boolToString withPortabled}"
     "-Dhwdb=${lib.boolToString withHwdb}"
     "-Dremote=${lib.boolToString withRemote}"
@@ -453,7 +453,6 @@ stdenv.mkDerivation {
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
 
-    "-Dkill-path=${coreutils}/bin/kill"
     "-Dkmod-path=${kmod}/bin/kmod"
     "-Dsulogin-path=${util-linux}/bin/sulogin"
     "-Dmount-path=${util-linux}/bin/mount"
@@ -471,7 +470,6 @@ stdenv.mkDerivation {
   ] ++ lib.optionals withEfi [
     "-Defi-libdir=${toString gnu-efi}/lib"
     "-Defi-includedir=${toString gnu-efi}/include/efi"
-    "-Defi-ldsdir=${toString gnu-efi}/lib"
   ] ++ lib.optionals (withShellCompletions == false) [
     "-Dbashcompletiondir=no"
     "-Dzshcompletiondir=no"
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 0cb5e13fbd2..e26c38bc87f 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -206,17 +206,26 @@ in python.pkgs.buildPythonApplication rec {
     ./patches/tests-ignore-OSErrors-in-hass-fixture.patch
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "aiohttp==3.8.1" "aiohttp" \
-      --replace "async_timeout==4.0.0" "async_timeout" \
-      --replace "bcrypt==3.1.7" "bcrypt" \
-      --replace "cryptography==35.0.0" "cryptography" \
-      --replace "httpx==0.21.0" "httpx" \
-      --replace "pip>=8.0.3,<20.3" "pip" \
-      --replace "PyJWT==2.1.0" "PyJWT" \
-      --replace "pyyaml==6.0" "pyyaml" \
-      --replace "yarl==1.6.3" "yarl"
+  postPatch = let
+    relaxedConstraints = [
+      "aiohttp"
+      "async_timeout"
+      "attrs"
+      "awesomeversion"
+      "bcrypt"
+      "cryptography"
+      "httpx"
+      "pip"
+      "PyJWT"
+      "requests"
+      "yarl"
+    ];
+  in ''
+    sed -r -i \
+      ${lib.concatStringsSep "\n" (map (package:
+        ''-e 's@${package}[<>=]+.*@${package}",@g' \''
+      ) relaxedConstraints)}
+    setup.py
     substituteInPlace tests/test_config.py --replace '"/usr"' '"/build/media"'
   '';
 
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index f8eecf49169..664d9ef9f75 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -26,7 +26,7 @@
 , # Whether to build only the library.
   libOnly ? false
 
-, AudioUnit, Cocoa, CoreServices, Libc
+, AudioUnit, Cocoa, CoreServices
 }:
 
 stdenv.mkDerivation rec {
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ libtool libsndfile soxr speexdsp fftwFloat ]
     ++ lib.optionals stdenv.isLinux [ glib dbus ]
-    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreServices Libc ]
+    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreServices ]
     ++ lib.optionals (!libOnly) (
       [ libasyncns webrtc-audio-processing ]
       ++ lib.optional jackaudioSupport libjack2
@@ -101,8 +101,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${Libc}";
-
   installFlags =
     [ "sysconfdir=${placeholder "out"}/etc"
       "pulseconfdir=${placeholder "out"}/etc/pulse"
diff --git a/pkgs/stdenv/booter.nix b/pkgs/stdenv/booter.nix
index 51d617354e8..f1d07e6461a 100644
--- a/pkgs/stdenv/booter.nix
+++ b/pkgs/stdenv/booter.nix
@@ -124,7 +124,13 @@ stageFuns: let
       if buildPackages.stdenv.hasCC
       then
         if buildPackages.stdenv.cc.isClang or false
-        then buildPackages.clang
+        # buildPackages.clang checks targetPackages.stdenv.cc (i. e. this
+        # attribute) to get a sense of the its set's default compiler and
+        # chooses between libc++ and libstdc++ based on that. If we hit this
+        # code here, we'll cause an infinite recursion. Since a set with
+        # clang as its default compiler always means libc++, we can infer this
+        # decision statically.
+        then buildPackages.llvmPackages.libcxxClang
         else buildPackages.gcc
       else
         # This will blow up if anything uses it, but that's OK. The `if
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index 613b8d5304c..e01ac74599a 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -70,7 +70,7 @@ in lib.init bootStages ++ [
              # when there is a C compiler and everything should be fine.
              then throw "no C compiler provided for this platform"
            else if crossSystem.isDarwin
-             then buildPackages.llvmPackages.clang
+             then buildPackages.llvmPackages.libcxxClang
            else if crossSystem.useLLVM or false
              then buildPackages.llvmPackages.clangUseLLVM
            else buildPackages.gcc;
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 24ad0cb6959..a6f927c287d 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -399,6 +399,8 @@ rec {
       persistent = self: super: with prevStage; {
         cmake = super.cmakeMinimal;
 
+        curl = super.curlMinimal;
+
         inherit pbzx cpio;
 
         python3 = super.python3Minimal;
@@ -755,6 +757,9 @@ rec {
         darwin.binutils
         darwin.binutils.bintools
         curl.out
+        zstd.out
+        libidn2.out
+        libunistring.out
         openssl.out
         libssh2.out
         nghttp2.lib
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 49ebc67f854..4fb98e5e801 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -112,7 +112,7 @@ let
       # are absolute unless we go out of our way to make them relative (like with CF)
       # TODO: This really wants to be in stdenv/darwin but we don't have hostPlatform
       # there (yet?) so it goes here until then.
-      preHook = preHook+ lib.optionalString buildPlatform.isDarwin ''
+      preHook = preHook + lib.optionalString buildPlatform.isDarwin ''
         export NIX_DONT_SET_RPATH_FOR_BUILD=1
       '' + lib.optionalString (hostPlatform.isDarwin || (hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.elf && hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.macho)) ''
         export NIX_DONT_SET_RPATH=1
@@ -168,6 +168,11 @@ let
       inherit overrides;
 
       inherit cc hasCC;
+
+      # Convenience for doing some very basic shell syntax checking by parsing a script
+      # without running any commands. Because this will also skip `shopt -s extglob`
+      # commands and extglob affects the Bash parser, we enable extglob always.
+      shellDryRun = "${stdenv.shell} -n -O extglob";
     }
 
     # Propagate any extra attributes.  For instance, we use this to
diff --git a/pkgs/stdenv/linux/bootstrap-files/aarch64.nix b/pkgs/stdenv/linux/bootstrap-files/aarch64.nix
index 592f8ee6bef..aa81cbd84af 100644
--- a/pkgs/stdenv/linux/bootstrap-files/aarch64.nix
+++ b/pkgs/stdenv/linux/bootstrap-files/aarch64.nix
@@ -1,11 +1,11 @@
 {
   busybox = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-linux/aarch64/bb3ef8a95c9659596b8a34d27881cd30ffea2f9f/busybox";
-    sha256 = "12qcml1l67skpjhfjwy7gr10nc86gqcwjmz9ggp7knss8gq8pv7f";
+    url = "http://tarballs.nixos.org/stdenv-linux/aarch64/c7c997a0662bf88264db52cbc41e67884eb7a1ff/busybox";
+    sha256 = "sha256-4EN2vLvXUkelZZR2eKaAQA5kCEuHNvRZN6dcohxVY+c=";
     executable = true;
   };
   bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-linux/aarch64/c5aabb0d603e2c1ea05f5a93b3be82437f5ebf31/bootstrap-tools.tar.xz";
-    sha256 = "d3f1bf2a1495b97f45359d5623bdb1f8eb75db43d3bf2059fc127b210f059358";
+    url = "http://tarballs.nixos.org/stdenv-linux/aarch64/c7c997a0662bf88264db52cbc41e67884eb7a1ff/bootstrap-tools.tar.xz";
+    sha256 = "sha256-AjOvmaW8JFVZaBSRUMKufr9kJozg/tsZr7PvUEBQyi4=";
   };
 }
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index a917112cc5f..0339caa72ce 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -466,6 +466,8 @@ let
           inherit version;
           sha256 = "sha256-109FuBMXRU2W6YL9HFDm+1yZrCIjcorqh2RDOjn1ZvE=";
         };
+        # sdist lacks tests
+        doCheck = false;
       });
 
       semver = super.semver.overridePythonAttrs(oldAttrs: rec {
diff --git a/pkgs/tools/audio/yabridge/default.nix b/pkgs/tools/audio/yabridge/default.nix
index c468a845a1a..688906e684d 100644
--- a/pkgs/tools/audio/yabridge/default.nix
+++ b/pkgs/tools/audio/yabridge/default.nix
@@ -105,11 +105,7 @@ in multiStdenv.mkDerivation rec {
     "-Dwith-bitbridge=true"
 
     # Requires CMake and is unnecessary
-    "-Dtomlplusplus:GENERATE_CMAKE_CONFIG=disabled"
-
-    # tomlplusplus examples and tests don't build with winegcc
-    "-Dtomlplusplus:BUILD_EXAMPLES=disabled"
-    "-Dtomlplusplus:BUILD_TESTS=disabled"
+    "-Dtomlplusplus:generate_cmake_config=false"
   ];
 
   installPhase = ''
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 1f9b4a505ac..a3184f6d1ed 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -7,17 +7,18 @@
 # these need to be ran on the host, thus disable when cross-compiling
 , buildContrib ? stdenv.hostPlatform == stdenv.buildPlatform
 , doCheck ? stdenv.hostPlatform == stdenv.buildPlatform
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "zstd";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "zstd";
     rev = "v${version}";
-    sha256 = "0icc0x89c35rq5bxd4d241vqxnz2i1qj2wwy01xls63p0z93brj7";
+    sha256 = "sha256-D9+kuIjPYnmg5ht/ezIeYCpyiLkrtdiH3fwpmemIPGM=";
   };
 
   nativeBuildInputs = [ cmake ]
@@ -28,12 +29,6 @@ stdenv.mkDerivation rec {
     # This patches makes sure we do not attempt to use the MD5 implementation
     # of the host platform when running the tests
     ./playtests-darwin.patch
-
-    # Fixes linking for static builds
-    (fetchpatch {
-      url = "https://github.com/facebook/zstd/pull/2724/commits/e1f85dbca3a0ed5ef06c8396912a0914db8dea6a.patch";
-      sha256 = "sha256-PuYAqnJWAE+L9bsroOnnBGJhERW8LHrGSLtIEkKU9vg=";
-    })
   ];
 
   postPatch = lib.optionalString (!static) ''
@@ -90,6 +85,12 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.hostPlatform.isUnix "man"
     ++ [ "out" ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''
diff --git a/pkgs/tools/compression/zstd/playtests-darwin.patch b/pkgs/tools/compression/zstd/playtests-darwin.patch
index bcb895a697c..454489a24a1 100644
--- a/pkgs/tools/compression/zstd/playtests-darwin.patch
+++ b/pkgs/tools/compression/zstd/playtests-darwin.patch
@@ -1,6 +1,6 @@
 --- a/tests/playTests.sh
 +++ b/tests/playTests.sh
-@@ -112,22 +112,12 @@ case "$OS" in
+@@ -112,29 +112,19 @@ case "$OS" in
  esac
  
  case "$UNAME" in
@@ -16,6 +16,13 @@
 -    Darwin | FreeBSD | OpenBSD | NetBSD) MTIME="stat -f %m" ;;
 -esac
  
+ assertSameMTime() {
+     MT1=$($MTIME "$1")
+     MT2=$($MTIME "$2")
+     echo MTIME $MT1 $MT2
+     [ "$MT1" = "$MT2" ] || die "mtime on $1 doesn't match mtime on $2 ($MT1 != $MT2)"
+ }
+ 
  GET_PERMS="stat -c %a"
 -case "$UNAME" in
 -    Darwin | FreeBSD | OpenBSD | NetBSD) GET_PERMS="stat -f %Lp" ;;
diff --git a/pkgs/tools/misc/wyrd/default.nix b/pkgs/tools/misc/wyrd/default.nix
index 491c362eed4..d1244cc73c4 100644
--- a/pkgs/tools/misc/wyrd/default.nix
+++ b/pkgs/tools/misc/wyrd/default.nix
@@ -9,8 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "0zlrg602q781q8dij62lwdprpfliyy9j1rqfqcz8p2wgndpivddj";
   };
 
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
-
   preConfigure = ''
     substituteInPlace curses/curses.ml --replace 'pp gcc' "pp $CC"
   '';
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index a5abbc26a74..bfd48893165 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -1,12 +1,8 @@
-{ stdenv, lib, fetchurl, pkg-config, perl
-, http2Support ? true, nghttp2
-, idnSupport ? false, libidn ? null
-, ldapSupport ? false, openldap ? null
-, zlibSupport ? true, zlib ? null
-, opensslSupport ? zlibSupport, openssl ? null
+{ lib, stdenv, fetchurl, pkg-config, perl
+, brotliSupport ? false, brotli ? null
+, c-aresSupport ? false, c-ares ? null
 , gnutlsSupport ? false, gnutls ? null
-, wolfsslSupport ? false, wolfssl ? null
-, scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
+, gsaslSupport ? false, gsasl ? null
 , gssSupport ? with stdenv.hostPlatform; (
     !isWindows &&
     # disable gss becuase of: undefined reference to `k5_bcmp'
@@ -17,8 +13,17 @@
     # not worth the effort.
     !(isDarwin && (stdenv.buildPlatform != stdenv.hostPlatform))
   ), libkrb5 ? null
-, c-aresSupport ? false, c-ares ? null
-, brotliSupport ? false, brotli ? null
+, http2Support ? true, nghttp2 ? null
+, http3Support ? false, nghttp3, ngtcp2 ? null
+, idnSupport ? false, libidn2 ? null
+, ldapSupport ? false, openldap ? null
+, opensslSupport ? zlibSupport, openssl ? null
+, pslSupport ? false, libpsl ? null
+, rtmpSupport ? false, rtmpdump ? null
+, scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
+, wolfsslSupport ? false, wolfssl ? null
+, zlibSupport ? true, zlib ? null
+, zstdSupport ? false, zstd ? null
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -26,31 +31,37 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-assert http2Support -> nghttp2 != null;
-assert idnSupport -> libidn != null;
-assert ldapSupport -> openldap != null;
-assert zlibSupport -> zlib != null;
-assert opensslSupport -> openssl != null;
 assert !(gnutlsSupport && opensslSupport);
 assert !(gnutlsSupport && wolfsslSupport);
 assert !(opensslSupport && wolfsslSupport);
-assert gnutlsSupport -> gnutls != null;
-assert wolfsslSupport -> wolfssl != null;
-assert scpSupport -> libssh2 != null;
-assert c-aresSupport -> c-ares != null;
 assert brotliSupport -> brotli != null;
+assert c-aresSupport -> c-ares != null;
+assert gnutlsSupport -> gnutls != null;
+assert gsaslSupport -> gsasl != null;
 assert gssSupport -> libkrb5 != null;
+assert http2Support -> nghttp2 != null;
+assert http3Support -> nghttp3 != null;
+assert http3Support -> ngtcp2 != null;
+assert idnSupport -> libidn2 != null;
+assert ldapSupport -> openldap != null;
+assert opensslSupport -> openssl != null;
+assert pslSupport -> libpsl !=null;
+assert rtmpSupport -> rtmpdump !=null;
+assert scpSupport -> libssh2 != null;
+assert wolfsslSupport -> wolfssl != null;
+assert zlibSupport -> zlib != null;
+assert zstdSupport -> zstd != null;
 
 stdenv.mkDerivation rec {
   pname = "curl";
-  version = "7.80.0";
+  version = "7.81.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
     ];
-    sha256 = "170qb2w2p5fga0vqhhnzi417z4h4vy764sz16pzhm5fd9471a3fx";
+    sha256 = "sha256-Hno41wGOwGDx8W34OYVPCInpThIsTPpdOjfC3Fbx4lg=";
   };
 
   patches = [
@@ -70,17 +81,22 @@ stdenv.mkDerivation rec {
   # "-lz -lssl", which aren't necessary direct build inputs of
   # applications that use Curl.
   propagatedBuildInputs = with lib;
+    optional brotliSupport brotli ++
+    optional c-aresSupport c-ares ++
+    optional gnutlsSupport gnutls ++
+    optional gsaslSupport gsasl ++
+    optional gssSupport libkrb5 ++
     optional http2Support nghttp2 ++
-    optional idnSupport libidn ++
+    optionals http3Support [ nghttp3 ngtcp2 ] ++
+    optional idnSupport libidn2 ++
     optional ldapSupport openldap ++
-    optional zlibSupport zlib ++
-    optional gssSupport libkrb5 ++
-    optional c-aresSupport c-ares ++
     optional opensslSupport openssl ++
-    optional gnutlsSupport gnutls ++
-    optional wolfsslSupport wolfssl ++
+    optional pslSupport libpsl ++
+    optional rtmpSupport rtmpdump ++
     optional scpSupport libssh2 ++
-    optional brotliSupport brotli;
+    optional wolfsslSupport wolfssl ++
+    optional zlibSupport zlib ++
+    optional zstdSupport zstd;
 
   # for the second line see https://curl.haxx.se/mail/tracker-2014-03/0087.html
   preConfigure = ''
@@ -89,23 +105,28 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags = [
+      # Build without manual
+      "--disable-manual"
       # Disable default CA bundle, use NIX_SSL_CERT_FILE or fallback
       # to nss-cacert from the default profile.
       "--without-ca-bundle"
       "--without-ca-path"
+      (lib.enableFeature c-aresSupport "ares")
+      (lib.enableFeature ldapSupport "ldap")
+      (lib.enableFeature ldapSupport "ldaps")
       # The build fails when using wolfssl with --with-ca-fallback
       (lib.withFeature (!wolfsslSupport) "ca-fallback")
-      "--disable-manual"
-      (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl))
+      (lib.withFeature http3Support "nghttp3")
+      (lib.withFeature http3Support "ngtcp2")
+      (lib.withFeature rtmpSupport "librtmp")
+      (lib.withFeature zstdSupport "zstd")
+      (lib.withFeatureAs brotliSupport "brotli" (lib.getDev brotli))
       (lib.withFeatureAs gnutlsSupport "gnutls" (lib.getDev gnutls))
+      (lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2))
+      (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl))
       (lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2))
-      (lib.enableFeature ldapSupport "ldap")
-      (lib.enableFeature ldapSupport "ldaps")
-      (lib.withFeatureAs idnSupport "libidn" (lib.getDev libidn))
-      (lib.withFeature brotliSupport "brotli")
+      (lib.withFeatureAs wolfsslSupport "wolfssl" (lib.getDev wolfssl))
     ]
-    ++ lib.optional wolfsslSupport "--with-wolfssl=${lib.getDev wolfssl}"
-    ++ lib.optional c-aresSupport "--enable-ares=${c-ares}"
     ++ lib.optional gssSupport "--with-gssapi=${lib.getDev libkrb5}"
        # For the 'urandom', maybe it should be a cross-system option
     ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
diff --git a/pkgs/tools/networking/gmrender-resurrect/default.nix b/pkgs/tools/networking/gmrender-resurrect/default.nix
index d4fc1b22e8f..28125ce113d 100644
--- a/pkgs/tools/networking/gmrender-resurrect/default.nix
+++ b/pkgs/tools/networking/gmrender-resurrect/default.nix
@@ -4,9 +4,7 @@
 let
   version = "0.0.9";
 
-  makePluginPath = plugins: builtins.concatStringsSep ":" (map (p: p + "/lib/gstreamer-1.0") plugins);
-
-  pluginPath = makePluginPath [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ];
+  pluginPath = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ];
 in
   stdenv.mkDerivation {
     pname = "gmrender-resurrect";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a6206a90681..d7c8a61c257 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2549,6 +2549,8 @@ with pkgs;
 
   comma = callPackage ../tools/package-management/comma { };
 
+  commitizen = python3Packages.callPackage ../applications/version-management/commitizen { };
+
   common-licenses = callPackage ../data/misc/common-licenses {};
 
   compactor = callPackage ../applications/networking/compactor { };
@@ -3392,9 +3394,7 @@ with pkgs;
 
   merriweather-sans = callPackage ../data/fonts/merriweather-sans { };
 
-  # TODO: call a sprintable to deprecate Meson 0.57 as soon as possible
-  meson = callPackage ../development/tools/build-managers/meson/0.57 { };
-  meson_0_60 = callPackage ../development/tools/build-managers/meson/0.60 { };
+  meson = callPackage ../development/tools/build-managers/meson { };
 
   meson-tools = callPackage ../misc/meson-tools { };
 
@@ -4483,10 +4483,19 @@ with pkgs;
 
   curlFull = curl.override {
     ldapSupport = true;
+    gsaslSupport = true;
+    rtmpSupport = true;
+    pslSupport = true;
+  };
+
+  curlHTTP3 = curl.override {
+    openssl = quictls;
+    http3Support = true;
   };
 
   curl = curlMinimal.override ({
     idnSupport = true;
+    zstdSupport = true;
   } // lib.optionalAttrs (!stdenv.hostPlatform.isStatic) {
     gssSupport = true;
     brotliSupport = true;
@@ -7433,6 +7442,9 @@ with pkgs;
   libpointmatcher = callPackage ../development/libraries/libpointmatcher { };
 
   libportal = callPackage ../development/libraries/libportal { };
+  libportal-gtk3 = libportal.override { variant = "gtk3"; };
+  libportal-gtk4 = libportal.override { variant = "gtk4"; };
+  libportal-qt5 = libportal.override { variant = "qt5"; };
 
   libmicrodns = callPackage ../development/libraries/libmicrodns { };
 
@@ -13300,7 +13312,11 @@ with pkgs;
       # Others should instead delegate to the next stage's choice with
       # `targetPackages.stdenv.cc.bintools`. This one is different just to
       # provide the default choice, avoiding infinite recursion.
-      bintools ? if stdenv.targetPlatform.isDarwin then darwin.binutils else binutils
+      # See the bintools attribute for the logic and reasoning. We need to provide
+      # a default here, since eval will hit this function when bootstrapping
+      # stdenv where the bintools attribute doesn't exist, but will never actually
+      # be evaluated -- callPackage ends up being too eager.
+      bintools ? pkgs.bintools
     , libc ? bintools.libc
     , # libc++ from the default LLVM version is bound at the top level, but we
       # want the C++ library to be explicitly chosen by the caller, and null by
@@ -17012,7 +17028,7 @@ with pkgs;
   gtkextra = callPackage ../development/libraries/gtkextra { };
 
   gtk3 = callPackage ../development/libraries/gtk/3.x.nix {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa QuartzCore;
   };
 
   gtk4 = callPackage ../development/libraries/gtk/4.x.nix {
@@ -17930,6 +17946,9 @@ with pkgs;
   libffcall = callPackage ../development/libraries/libffcall { };
 
   libffi = callPackage ../development/libraries/libffi { };
+  libffiBoot = libffi.override {
+    doCheck = false;
+  };
 
   libfreeaptx = callPackage ../development/libraries/libfreeaptx { };
 
@@ -17996,6 +18015,8 @@ with pkgs;
 
   libhugetlbfs = callPackage ../development/libraries/libhugetlbfs { };
 
+  libhwy = callPackage ../development/libraries/libhwy { };
+
   libHX = callPackage ../development/libraries/libHX { };
 
   libibmad = callPackage ../development/libraries/libibmad { };
@@ -18522,9 +18543,7 @@ with pkgs;
 
   libtiff = if stdenv.isDarwin && stdenv.isAarch64
     then callPackage ../development/libraries/libtiff/aarch64-darwin.nix { }
-    else callPackage ../development/libraries/libtiff {
-      inherit (darwin.apple_sdk.frameworks) Cocoa GLUT;
-    };
+    else callPackage ../development/libraries/libtiff { };
 
   libtiger = callPackage ../development/libraries/libtiger { };
 
@@ -21414,7 +21433,6 @@ with pkgs;
   };
 
   pulseaudio = callPackage ../servers/pulseaudio ({
-    inherit (darwin) Libc;
     inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit Cocoa;
   } // lib.optionalAttrs stdenv.isDarwin {
     # Default autoreconfHook (2.70) fails on darwin,
@@ -22364,7 +22382,7 @@ with pkgs;
   iproute_mptcp = callPackage ../os-specific/linux/iproute/mptcp.nix { };
 
   iputils = hiPrio (callPackage ../os-specific/linux/iputils { });
-  # hiPrio for collisions with inetutils (ping and tftpd.8.gz)
+  # hiPrio for collisions with inetutils (ping)
 
   iptables = callPackage ../os-specific/linux/iptables { };
   iptables-legacy = callPackage ../os-specific/linux/iptables { nftablesCompat = false; };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 148e3946f9d..5244fb8caf1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6630,6 +6630,8 @@ in {
 
   pycryptodome = callPackage ../development/python-modules/pycryptodome { };
 
+  pycryptodome-test-vectors = callPackage ../development/python-modules/pycryptodome-test-vectors { };
+
   pycryptodomex = callPackage ../development/python-modules/pycryptodomex { };
 
   pyct = callPackage ../development/python-modules/pyct { };