summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/modules/config/no-x-libs.nix1
-rw-r--r--pkgs/applications/misc/audio/soxr/default.nix2
-rw-r--r--pkgs/applications/misc/mupdf/default.nix4
-rw-r--r--pkgs/build-support/fetchurl/mirrors.nix2
-rw-r--r--pkgs/development/compilers/binaryen/default.nix4
-rw-r--r--pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch14
-rw-r--r--pkgs/development/compilers/emscripten/default.nix33
-rw-r--r--pkgs/development/compilers/gcc/12/default.nix20
-rw-r--r--pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch77
-rw-r--r--pkgs/development/interpreters/lua-5/default.nix23
-rw-r--r--pkgs/development/libraries/SDL2/default.nix2
-rw-r--r--pkgs/development/libraries/SDL2_ttf/default.nix3
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix12
-rw-r--r--pkgs/development/libraries/dbus/default.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix4
-rw-r--r--pkgs/development/libraries/gettext/default.nix12
-rw-r--r--pkgs/development/libraries/gnu-efi/default.nix21
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix16
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/rs/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/vaapi/default.nix5
-rw-r--r--pkgs/development/libraries/http-parser/default.nix2
-rw-r--r--pkgs/development/libraries/json-c/default.nix18
-rw-r--r--pkgs/development/libraries/libglvnd/default.nix5
-rw-r--r--pkgs/development/libraries/libssh/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/22.3.nix4
-rw-r--r--pkgs/development/libraries/mesa/23.0.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix (renamed from pkgs/development/libraries/mesa/generic.nix)25
-rw-r--r--pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch4
-rw-r--r--pkgs/development/libraries/openldap/default.nix2
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json24
-rw-r--r--pkgs/development/libraries/sord/default.nix2
-rw-r--r--pkgs/development/libraries/tracker/default.nix11
-rw-r--r--pkgs/development/python-modules/anyio/default.nix57
-rw-r--r--pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch51
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix4
-rw-r--r--pkgs/development/tools/misc/binutils/CVE-2023-1972.patch23
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix4
-rw-r--r--pkgs/os-specific/linux/ell/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch87
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix5
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix2
-rw-r--r--pkgs/tools/compression/lz4/default.nix1
-rw-r--r--pkgs/tools/graphics/graphviz/default.nix2
-rw-r--r--pkgs/tools/networking/openconnect/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix12
-rw-r--r--pkgs/top-level/emscripten-packages.nix5
-rw-r--r--pkgs/top-level/linux-kernels.nix4
-rw-r--r--pkgs/top-level/release-small.nix2
49 files changed, 366 insertions, 269 deletions
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index dac09bdf468..0dce3b91845 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -38,6 +38,7 @@ with lib;
       gpsd = super.gpsd.override { guiSupport = false; };
       graphviz = super.graphviz-nox;
       gst_all_1 = super.gst_all_1 // {
+        gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; };
         gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableX11 = false; };
       };
       imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
diff --git a/pkgs/applications/misc/audio/soxr/default.nix b/pkgs/applications/misc/audio/soxr/default.nix
index 45a5227404c..604057ba65c 100644
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     ./arm64-check.patch
   ];
 
-  outputs = [ "out" "doc" ]; # headers are just two and very small
+  outputs = [ "out" "dev" "doc" ];
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 812bc9a5d76..c9523581b0a 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -47,12 +47,12 @@ let
 
 in
 stdenv.mkDerivation rec {
-  version = "1.21.1";
+  version = "1.22.1";
   pname = "mupdf";
 
   src = fetchurl {
     url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "sha256-sk3b4SUGzILeCNXNSUYUugg0b4F12x2YvPk4/5SSWlQ=";
+    sha256 = "sha256-1i88DkVuu8QucfWkfw+M0SzsK/Co1yt541+jWmU4slo=";
   };
 
   patches = [ ./0001-Use-command-v-in-favor-of-which.patch
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index bd338473508..3c8cc48ec7d 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -57,8 +57,8 @@
 
   # GCC
   gcc = [
-    "https://bigsearcher.com/mirrors/gcc/"
     "https://mirror.koddos.net/gcc/"
+    "https://bigsearcher.com/mirrors/gcc/"
     "ftp://ftp.nluug.nl/mirror/languages/gcc/"
     "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
     "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 73f32af28e1..11716893e0f 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "binaryen";
-  version = "112";
+  version = "113";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "binaryen";
     rev = "version_${version}";
-    hash = "sha256-xVumVmiLMHJp3SItE8eL8OBPeq58HtOOiK9LL8SP4CQ=";
+    hash = "sha256-w93LIlLRn3PmVNytjFg6KI4CQ9zQUUM9kySiWAtPbOA=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
index 9cb3ca2bf9f..6a57e423bd7 100644
--- a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
+++ b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
@@ -1,4 +1,4 @@
-From 67f54fde2b1683aae3800f7a86a4e507c1125be8 Mon Sep 17 00:00:00 2001
+From 4bbbb640934aa653bcfec0335798b77a8935b815 Mon Sep 17 00:00:00 2001
 From: Yureka <yuka@yuka.dev>
 Date: Sat, 7 Aug 2021 09:16:46 +0200
 Subject: [PATCH] emulate clang 'sysroot + /include' logic
@@ -20,23 +20,23 @@ but it doesn't appear to work
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/emcc.py b/emcc.py
-index 999314afc..0e23c066c 100755
+index ba8d1b556..7d89644c5 100755
 --- a/emcc.py
 +++ b/emcc.py
-@@ -759,7 +759,12 @@ def emsdk_ldflags(user_args):
+@@ -883,7 +883,12 @@ def parse_s_args(args):
  
  
  def emsdk_cflags(user_args):
--  cflags = ['--sysroot=' + shared.Cache.get_sysroot(absolute=True)]
+-  cflags = ['--sysroot=' + cache.get_sysroot(absolute=True)]
 +  cflags = [
-+    '--sysroot=' + shared.Cache.get_sysroot(absolute=True),
++    '--sysroot=' + cache.get_sysroot(absolute=True),
 +    '-resource-dir=@resourceDir@',
-+    '-idirafter' + shared.Cache.get_sysroot(absolute=True) + os.path.join('/include'),
++    '-idirafter' + cache.get_sysroot(absolute=True) + os.path.join('/include'),
 +    '-iwithsysroot' + os.path.join('/include','c++','v1')
 +  ]
  
    def array_contains_any_of(hay, needles):
      for n in needles:
 -- 
-2.32.0
+2.40.0
 
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 02b1f6f03b2..52aa8ff8fb7 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "emscripten";
-  version = "3.1.24";
+  version = "3.1.39";
 
   llvmEnv = symlinkJoin {
     name = "emscripten-llvm-${version}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     name = "emscripten-node-modules-${version}";
     inherit pname version src;
 
-    npmDepsHash = "sha256-ejuHR2BpAUStWjuvQuGE6ko4byF4GBl6FJBshxlknQk=";
+    npmDepsHash = "sha256-NSpVXssXwx+94E1qhM3tt2fN2G0EuvPZSN+Xep2IRs8=";
 
     dontBuild = true;
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "emscripten-core";
     repo = "emscripten";
-    sha256 = "sha256-1jW6ThxK6dThOO90l4Mc5yehVF3tI4HWipBWZAOztrk=";
+    sha256 = "sha256-hgndNMx+hvXyLzn6ip8Fhs+LAw98P3cqL8dJ+92jJmU=";
     rev = version;
   };
 
@@ -42,17 +42,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./0001-emulate-clang-sysroot-include-logic.patch;
-      resourceDir = "${llvmEnv}/lib/clang/${llvmPackages.release_version}/";
-    })
-    # https://github.com/emscripten-core/emscripten/pull/18219
-    (fetchpatch {
-      url = "https://github.com/emscripten-core/emscripten/commit/afbc14950f021513c59cbeaced8807ef8253530a.patch";
-      sha256 = "sha256-+gJNTQJng9rWcGN3GAcMBB0YopKPnRp/r8CN9RSTClU=";
-    })
-    # https://github.com/emscripten-core/emscripten/pull/18220
-    (fetchpatch {
-      url = "https://github.com/emscripten-core/emscripten/commit/852982318f9fb692ba1dd1173f62e1eb21ae61ca.patch";
-      sha256 = "sha256-hmIOtpRx3PD3sDAahUcreSydydqcdSqArYvyLGgUgd8=";
+      resourceDir = "${llvmEnv}/lib/clang/16/";
     })
   ];
 
@@ -108,17 +98,20 @@ stdenv.mkDerivation rec {
 
     # precompile libc (etc.) in all variants:
     pushd $TMPDIR
-    echo 'int __main_argc_argv() { return 42; }' >test.c
+    echo 'int __main_argc_argv( int a, int b ) { return 42; }' >test.c
     for LTO in -flto ""; do
       # wasm2c doesn't work with PIC
       $out/bin/emcc -s WASM2C -s STANDALONE_WASM $LTO test.c
 
       for BIND in "" "--bind"; do
-        for MT in "" "-s USE_PTHREADS"; do
-          for RELOCATABLE in "" "-s RELOCATABLE"; do
-            $out/bin/emcc $RELOCATABLE $BIND $MT $LTO test.c
-          done
-        done
+        # starting with emscripten 3.1.32+,
+        # if pthreads and relocatable are both used,
+        # _emscripten_thread_exit_joinable must be exported
+        # (see https://github.com/emscripten-core/emscripten/pull/18376)
+        # TODO: get library cache to build with both enabled and function exported
+        $out/bin/emcc $LTO $BIND test.c
+        $out/bin/emcc $LTO $BIND -s RELOCATABLE test.c
+        $out/bin/emcc $LTO $BIND -s USE_PTHREADS test.c
       done
     done
     popd
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 92bec39e721..f0886f862c9 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -55,7 +55,7 @@ with lib;
 with builtins;
 
 let majorVersion = "12";
-    version = "${majorVersion}.2.0";
+    version = "${majorVersion}.3.0";
     disableBootstrap = !stdenv.hostPlatform.isDarwin && !profiledCompiler;
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -69,15 +69,19 @@ let majorVersion = "12";
         ../gcc-12-gfortran-driving.patch
         ../ppc-musl.patch
         ../install-info-files-serially.patch
+
+        # backport ICE fix on ccache code
+        ./lambda-ICE-PR109241.patch
       ]
       # We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
       # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
-      ++ optional (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) (fetchpatch {
-        name = "gcc-12-darwin-aarch64-support.patch";
-        url = "https://github.com/Homebrew/formula-patches/raw/1d184289/gcc/gcc-12.2.0-arm.diff";
-        sha256 = "sha256-omclLslGi/2yCV4pNBMaIpPDMW3tcz/RXdupbNbeOHA=";
-      })
-      ++ optional langD ../libphobos.patch
+      ++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) [
+        (fetchurl {
+          name = "gcc-12-darwin-aarch64-support.patch";
+          url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
+          sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
+        })
+      ] ++ optional langD ../libphobos.patch
 
       # backport fixes to build gccgo with musl libc
       ++ optionals (langGo && stdenv.hostPlatform.isMusl) [
@@ -206,7 +210,7 @@ lib.pipe (stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-5UnPnPNZSgDie2WJ1DItcOByDN0hPzm+tBgeBpJiMP8=";
+    sha256 = "sha256-lJpdT5nnhkIak7Uysi/6tVeN5zITaZdbka7Jet/ajDs=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch b/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
new file mode 100644
index 00000000000..a27a8a08d9d
--- /dev/null
+++ b/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
@@ -0,0 +1,77 @@
+https://gcc.gnu.org/PR109241
+
+Fix ICE on ccache.
+
+From 396a4e76afec30d2461638f569cae18955eb4ad2 Mon Sep 17 00:00:00 2001
+From: Jason Merrill <jason@redhat.com>
+Date: Wed, 22 Mar 2023 16:11:47 -0400
+Subject: [PATCH] c++: local class in nested generic lambda [PR109241]
+
+In this testcase, the tree walk to look for bare parameter packs was
+confused by finding a type with no TREE_BINFO.  But it should be fine that
+it's unset; we already checked for unexpanded packs at parse time.
+
+I also tried doing the partial instantiation of the local class, which is
+probably the long-term direction we want to go, but for stage 4 let's go
+with this safer change.
+
+	PR c++/109241
+
+gcc/cp/ChangeLog:
+
+	* pt.cc (find_parameter_packs_r): Handle null TREE_BINFO.
+
+gcc/testsuite/ChangeLog:
+
+	* g++.dg/cpp1y/lambda-generic-local-class2.C: New test.
+---
+ gcc/cp/pt.cc                                        | 12 ++++++++----
+ .../g++.dg/cpp1y/lambda-generic-local-class2.C      | 13 +++++++++++++
+ 2 files changed, 21 insertions(+), 4 deletions(-)
+ create mode 100644 gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+
+diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
+index c7f4a95a723..79bc9c014c8 100644
+--- a/gcc/cp/pt.cc
++++ b/gcc/cp/pt.cc
+@@ -4106,10 +4106,14 @@ find_parameter_packs_r (tree *tp, int *walk_subtrees, void* data)
+     case TAG_DEFN:
+       t = TREE_TYPE (t);
+       if (CLASS_TYPE_P (t))
+-	/* Local class, need to look through the whole definition.  */
+-	for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
+-	  cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
+-			ppd, ppd->visited);
++	{
++	  /* Local class, need to look through the whole definition.
++	     TYPE_BINFO might be unset for a partial instantiation.  */
++	  if (TYPE_BINFO (t))
++	    for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
++	      cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
++			    ppd, ppd->visited);
++	}
+       else
+ 	/* Enum, look at the values.  */
+ 	for (tree l = TYPE_VALUES (t); l; l = TREE_CHAIN (l))
+diff --git a/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+new file mode 100644
+index 00000000000..83856de1f41
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+@@ -0,0 +1,13 @@
++// PR c++/109241
++// { dg-do compile { target c++14 } }
++// { dg-options "" } no pedantic
++
++void g() {
++  [](auto) {
++    [](auto) {
++      ({
++        struct A {};
++      });
++    };
++  }(1);
++}
+-- 
+2.40.1
+
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 139dd09e72a..f4c622515d7 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -77,29 +77,12 @@ in
 rec {
   lua5_4 = callPackage ./interpreter.nix {
     self = lua5_4;
-    version = "5.4.4";
-    hash = "sha256-Fkx4SWU7gK5nvsS3RzuIS/XMjS3KBWU0dewu0nuev2E=";
+    version = "5.4.6";
+    hash = "sha256-fV6huctqoLWco93hxq3LV++DobqOVDLA7NBr9DmzrYg=";
     makeWrapper = makeBinaryWrapper;
     inherit passthruFun;
 
-    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch
-      ++ [
-        (fetchpatch {
-          name = "CVE-2022-28805.patch";
-          url = "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa.patch";
-          sha256 = "sha256-YTwoolSnRNJIHFPVijSO6ZDw35BG5oWYralZ8qOb9y8=";
-          stripLen = 1;
-          extraPrefix = "src/";
-          excludes = [ "src/testes/*" ];
-        })
-        (fetchpatch {
-          name = "CVE-2022-33099.patch";
-          url = "https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf.patch";
-          sha256 = "sha256-qj1Dq1ojVoknALSa67jhgH3G3Kk4GtJP6ROFElVF+D0=";
-          stripLen = 1;
-          extraPrefix = "src/";
-        })
-      ];
+    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
   };
 
   lua5_4_compat = lua5_4.override({
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 8160554a060..7fe3fb38a1f 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
 
   dlopenPropagatedBuildInputs = [ ]
     # Propagated for #include <GLES/gl.h> in SDL_opengles.h.
-    ++ lib.optional openglSupport libGL
+    ++ lib.optional (openglSupport && !stdenv.isDarwin) libGL
     # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
     ++ lib.optionals x11Support [ libX11 ];
 
diff --git a/pkgs/development/libraries/SDL2_ttf/default.nix b/pkgs/development/libraries/SDL2_ttf/default.nix
index 06793ee5e55..66f53949c24 100644
--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ SDL2 freetype libGL ]
+  buildInputs = [ SDL2 freetype ]
+    ++ lib.optional (!stdenv.isDarwin) libGL
     ++ lib.optional stdenv.isDarwin darwin.libobjc;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 9b5839d1d12..f058be4b645 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.10";
+  version = "0.7.1";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "wlvo3A2sI87AJUh+WPGV5NFPfZSu3dX+RrIcBPHOJ3Q=";
+    hash = "sha256-vxddJkSLsTP3RxTzqIWecAC5NSL7NXdVnf/ANxYZEPk=";
   };
 
   enableParallelBuilding = true;
@@ -39,9 +39,13 @@ stdenv.mkDerivation rec {
     portaudio
     libsndfile
     flac
-  ] ++ lib.optional usePulseAudio libpulseaudio;
+  ] ++ lib.optionals usePulseAudio [
+    libpulseaudio
+  ];
 
-  configureFlags = lib.optional (!usePulseAudio) "--without-pulseaudio";
+  configureFlags = [
+    (lib.strings.withFeature usePulseAudio "pulseaudio")
+  ];
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index f984f331030..52928e1005f 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -67,6 +67,8 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux [ audit libapparmor ];
   # ToDo: optional selinux?
 
+  __darwinAllowLocalNetworking = true;
+
   configureFlags = [
     "--enable-user-session"
     "--enable-xml-docs"
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 24b7aedb3ec..905e93de7a7 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,6 +1,6 @@
 import ./generic.nix rec {
-  version = "4.4.3";
-  sha256 = "sha256-zZDzG1hD+0AHqElzeGR6OVm+H5wqtdktloSPmEUzT/c=";
+  version = "4.4.4";
+  sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
   extraPatches = [
     {
       name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 5443f1eeac0..a8e8fde96f6 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gettext";
-  version = "0.21";
+  version = "0.21.1";
 
   src = fetchurl {
     url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
-    sha256 = "04kbg1sx0ncfrsbr85ggjslqkzzb243fcw9nyh3rrv1a22ihszf7";
+    sha256 = "sha256-6MNlDh2M7odcTzVWQjgsHfgwWL1aEe6FVcDPJ21kbUU=";
   };
   patches = [
     ./absolute-paths.diff
@@ -47,14 +47,6 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.hostPlatform.isCygwin ''
     sed -i -e "s/\(cldr_plurals_LDADD = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
     sed -i -e "s/\(libgettextsrc_la_LDFLAGS = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
-  '' +
-  # This change to gettext's vendored copy of gnulib is already
-  # merged upstream; we can drop this patch on the next version
-  # bump.  It must be applied twice because gettext vendors gnulib
-  # not once, but twice!
-  ''
-    patch -p2 -d gettext-tools/gnulib-lib/ < ${gnulib.passthru.longdouble-redirect-patch}
-    patch -p2 -d gettext-tools/libgrep/    < ${gnulib.passthru.longdouble-redirect-patch}
   '';
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 4da4eec7858..340bc7d7dcd 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -1,5 +1,11 @@
-{ lib, stdenv, buildPackages, fetchurl, pciutils
-, gitUpdater }:
+{ lib
+, stdenv
+, buildPackages
+, fetchurl
+, fetchpatch
+, pciutils
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "gnu-efi";
@@ -10,6 +16,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-eAfpAzSTQ6ehQuu5NHA6KHIjXolojPWGwDKwoQh7yvQ=";
   };
 
+  patches = [
+    # riscv64: fix efibind.h missing/duplicate types
+    # https://sourceforge.net/p/gnu-efi/patches/88
+    (fetchpatch {
+      url = "https://sourceforge.net/p/gnu-efi/patches/88/attachment/riscv64-fix-efibind.h-missing-duplicate-types.patch";
+      hash = "sha256-fUAxj1/U9J2A1zMEdnh62+WnVmQ9hrrYwMFppBz1Y1g=";
+    })
+  ];
+
   buildInputs = [ pciutils ];
 
   hardeningDisable = [ "stackprotector" ];
@@ -30,6 +45,6 @@ stdenv.mkDerivation rec {
     homepage = "https://sourceforge.net/projects/gnu-efi/";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ nickcao ];
   };
 }
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 63c5b92e07c..ccfbd892a97 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -38,7 +38,6 @@
 , bluez
 , chromaprint
 , curl
-, directfb
 , fdk_aac
 , flite
 , gsm
@@ -104,6 +103,7 @@
 , microdnsSupport ? false
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
+, guiSupport ? true, directfb
 }:
 
 stdenv.mkDerivation rec {
@@ -183,9 +183,6 @@ stdenv.mkDerivation rec {
     libwebp
     xvidcore
     gnutls
-    libGL
-    libGLU
-    gtk3
     game-music-emu
     openssl
     libxml2
@@ -220,7 +217,6 @@ stdenv.mkDerivation rec {
     mjpegtools
 
     chromaprint
-    directfb
     flite
     libdrm
     libgudev
@@ -237,6 +233,13 @@ stdenv.mkDerivation rec {
     serd
     sord
     sratom
+
+    libGL
+    libGLU
+  ] ++ lib.optionals guiSupport [
+    gtk3
+  ] ++ lib.optionals (stdenv.isLinux && guiSupport) [
+    directfb
   ] ++ lib.optionals stdenv.isDarwin [
     # For unknown reasons the order is important, e.g. if
     # VideoToolbox is last, we get:
@@ -297,10 +300,11 @@ stdenv.mkDerivation rec {
     "-Ddoc=disabled" # needs gstcuda to be enabled which is Linux-only
     "-Dnvcodec=disabled" # Linux-only
     "-Dva=disabled" # see comment on `libva` in `buildInputs`
+  ] ++ lib.optionals (!stdenv.isLinux || !guiSupport) [
+    "-Ddirectfb=disabled"
   ]
   ++ lib.optionals stdenv.isDarwin [
     "-Dchromaprint=disabled"
-    "-Ddirectfb=disabled"
     "-Dflite=disabled"
     "-Dkms=disabled" # renders to libdrm output
     "-Dlv2=disabled"
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 370d868ec2c..5c70b225e52 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -87,9 +87,9 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     libjpeg
     tremor
-    libGL
     pango
   ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
     libvisual
   ] ++ lib.optionals stdenv.isDarwin [
     OpenGL
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index b50d7d45180..084433c4045 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -101,7 +101,7 @@ let
       "reqwest" # tests hang on darwin
       "threadshare" # tests cannot bind to localhost on darwin
       "webp" # not supported on darwin (upstream crate issue)
-    ] ++ lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
+    ] ++ lib.optionals (!gst-plugins-base.glEnabled) [
       # these require gstreamer-gl which requires darwin sdk bump
       "gtk4"
       "livesync"
@@ -205,7 +205,7 @@ stdenv.mkDerivation rec {
     export CSOUND_LIB_DIR=${lib.getLib csound}/lib
   '' + lib.optionalString (lib.mutuallyExclusive [ "webrtc" "webrtchttp" ] selectedPlugins) ''
     sed -i "/\['gstreamer-webrtc-1\.0', 'gst-plugins-bad', 'gstwebrtc_dep', 'gstwebrtc'\]/d" meson.build
-  '' + lib.optionalString (stdenv.isDarwin && !stdenv.isAarch64) ''
+  '' + lib.optionalString (!gst-plugins-base.glEnabled) ''
     sed -i "/\['gstreamer-gl-1\.0', 'gst-plugins-base', 'gst_gl_dep', 'gstgl'\]/d" meson.build
   '';
 
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 0662cdd8e42..c25aa55557a 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -62,10 +62,11 @@ stdenv.mkDerivation rec {
     xorg.libXrandr
     xorg.libSM
     xorg.libICE
-    libGL
-    libGLU
     nasm
     libvpx
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
+    libGLU
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/http-parser/default.nix b/pkgs/development/libraries/http-parser/default.nix
index dd1ea3559d7..327121dc6b1 100644
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkTarget = "test";
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "An HTTP message parser written in C";
     homepage = "https://github.com/nodejs/http-parser";
diff --git a/pkgs/development/libraries/json-c/default.nix b/pkgs/development/libraries/json-c/default.nix
index d6aac7161d4..785548c211a 100644
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@@ -1,14 +1,24 @@
-{ lib, stdenv, fetchurl, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "json-c";
   version = "0.16";
 
-  src = fetchurl {
-    url    = "https://s3.amazonaws.com/json-c_releases/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-jkWsj5bsd5Hq87t+5Q6cIQC7vIe40PHQMMW6igKI2Ws=";
+  src = fetchFromGitHub {
+    owner = "json-c";
+    repo = "json-c";
+    rev = "json-c-0.16-20220414";
+    sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
   };
 
+  patches = [
+    # needed for emscripten, which uses LLVM 15+
+    (fetchpatch {
+      url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
+      sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 4047c7bbefd..fa9562947f8 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -33,7 +33,10 @@ stdenv.mkDerivation rec {
     "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${addOpenGLRunpath.driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""
 
     "-Wno-error=array-bounds"
-  ] ++ lib.optional stdenv.cc.isClang "-Wno-error");
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error"
+    "-Wno-int-conversion"
+  ]);
 
   configureFlags  = []
     # Indirectly: https://bugs.freedesktop.org/show_bug.cgi?id=35268
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index 737ee55d41a..00cb7e042c9 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -33,6 +33,10 @@ stdenv.mkDerivation rec {
     sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
   '';
 
+  # Don’t build examples, which are not installed and require additional dependencies not
+  # included in `buildInputs` such as libX11.
+  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
+
   # single output, otherwise cmake and .pc files point to the wrong directory
   # outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/mesa/22.3.nix b/pkgs/development/libraries/mesa/22.3.nix
deleted file mode 100644
index 1a1127dae50..00000000000
--- a/pkgs/development/libraries/mesa/22.3.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "22.3.7";
-  hash = "sha256-iUzi9KHC52F3zdIoRiAZLQ2jBmskPuwvux18838TBCw=";
-}
diff --git a/pkgs/development/libraries/mesa/23.0.nix b/pkgs/development/libraries/mesa/23.0.nix
deleted file mode 100644
index 323e0019618..00000000000
--- a/pkgs/development/libraries/mesa/23.0.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "23.0.3";
-  hash = "sha256-OGNipdgN87CWY2tn80Dhzme3BbRHZ9W90R0u0QNxktU=";
-}
diff --git a/pkgs/development/libraries/mesa/generic.nix b/pkgs/development/libraries/mesa/default.nix
index ea7c1cb8b7b..38afcd174db 100644
--- a/pkgs/development/libraries/mesa/generic.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,12 +1,10 @@
-{ version, hash }:
-
 { stdenv, lib, fetchurl, fetchpatch
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages_15, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
-, libglvnd, libunwind
+, libglvnd, libunwind, lm_sensors
 , vulkan-loader, glslang
 , galliumDrivers ?
   if stdenv.isLinux then
@@ -87,6 +85,9 @@
 */
 
 let
+  version = "23.1.1";
+  hash = "sha256-omeQMe1bc7KcTwQqxk2W+DsM/khYYX3jLi78GWxlOkA=";
+
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
   branch = lib.versions.major version;
@@ -145,11 +146,6 @@ self = stdenv.mkDerivation {
       "get_option('datadir')" "'${placeholder "out"}/share'"
     substituteInPlace src/amd/vulkan/meson.build --replace \
       "get_option('datadir')" "'${placeholder "out"}/share'"
-  ''
-  # TODO: can be removed >= 23.0.4 (most likely)
-  # https://gitlab.freedesktop.org/mesa/mesa/-/commit/035aa34ed5eb418339c0e2d2
-  + ''
-    sed '/--size_t-is-usize/d' -i src/gallium/frontends/rusticl/meson.build
   '';
 
   outputs = [ "out" "dev" "drivers" ]
@@ -197,6 +193,10 @@ self = stdenv.mkDerivation {
 
     # To enable non-mesa gbm backends to be found (e.g. Nvidia)
     "-Dgbm-backends-path=${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm"
+
+    # meson auto_features enables these features, but we do not want them
+    "-Dandroid-libbacktrace=disabled"
+
   ] ++ lib.optionals stdenv.isLinux [
     "-Dglvnd=true"
 
@@ -219,10 +219,9 @@ self = stdenv.mkDerivation {
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
     libffi libvdpau libelf libXvMC
     libpthreadstubs openssl /*or another sha1 provider*/
-    zstd
+    zstd libunwind
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev ]
-    ++ lib.optionals stdenv.isDarwin [ libunwind ]
+    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
     ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator' ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader
@@ -253,6 +252,7 @@ self = stdenv.mkDerivation {
     if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
       # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
       mv -t $drivers/lib       \
+        $out/lib/libpowervr_rogue* \
         $out/lib/libxatracker* \
         $out/lib/libvulkan_*
     fi
@@ -371,6 +371,9 @@ self = stdenv.mkDerivation {
     license = licenses.mit; # X11 variant, in most files
     platforms = platforms.mesaPlatforms;
     maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
+
+    # https://gitlab.freedesktop.org/mesa/mesa/-/issues/8634
+    broken = stdenv.isDarwin;
   };
 };
 
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index 445f26c6bd1..fe51c79d7a0 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -10,16 +10,18 @@ diff --git a/meson_options.txt b/meson_options.txt
 index b8f753e2e1a..70d9071c8be 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -452,6 +452,12 @@ option(
+@@ -452,7 +452,14 @@ option(
    value : true,
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
+ 
 +option(
 +  'disk-cache-key',
 +  type : 'string',
 +  value : '',
 +  description : 'Mesa cache key.'
 +)
++
  option('egl-lib-suffix',
    type : 'string',
    value : '',
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 69c33169866..0f659654e24 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     "devdoc"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 03c409a3819..20649c6f83a 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "d3b21bc8b70eaa1af848371dc1d34c4617c1f73c",
-    "sha256": "11yww09fgcqsxv4sk4cflxdsdpdqc0x9b3qw63asfpwrnv9qry0a"
+    "rev": "a196623892558623e467f20b67edb78794252a09",
+    "sha256": "0yna2k1w595xwh9bk268h31fjl2ff8cm185dmm0v5gr4w8h9yr4g"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -26,8 +26,8 @@
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "0f9e49cde3b7ca40cd94e63d2f5d29f5b586d3d6",
-    "sha256": "1iwqa98ihzqqpqgwsj0lm4zkfwgag9k634sxjnx6gxvfq0h6d4nx"
+    "rev": "e6d37133affc71451129d84790c6c22227e64aff",
+    "sha256": "1bc1d0h2f1q0xfvr8p5fq1580bl8cs0qhdncm600v590z56cyika"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "0e1bed3c3e27d44d86d6f68a8b93b96a4821575c",
-    "sha256": "0v4c3pls67ww6ffiscbp05yb2vv583zrxj8p4jcy3yxa06khniy5"
+    "rev": "039ce261b0f8061f8485f9c2eaf497a4d4395baa",
+    "sha256": "1kp2pnwfcwsxhy2w1sdg722d0kb1i6kx3a9r42gl1i9d73k8afi2"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -61,8 +61,8 @@
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "2a8a48e9101236f118c2c4f0d79fae9c9d7b3f2a",
-    "sha256": "0ajvlqkm2641ahms34kg6a2hykvql1hxlm5nsaba7233hnfv3nsy"
+    "rev": "30fb93cf8521f2c0b3803903153d9034b7d7bcc2",
+    "sha256": "1b027hfc1m2nz0v906w08srmpyci3362arxc18cin334yhgghbx1"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
@@ -101,8 +101,8 @@
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "86a84eaa74c4071e5750f23b6e9911762880d391",
-    "sha256": "1zywq3ll49bzzvl6rzn4zpp96a4mdx0b9l5ic0x6zc4dr8c8jk5m"
+    "rev": "68a48018e34322edaf611639710b3edbe389e8c2",
+    "sha256": "04hswsamjmwgn63gs3rhxygvwjfqx5f0qifzp3gp6q4fw8lkgwpf"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@@ -146,8 +146,8 @@
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "9b5ab29cbba1908fd4928e2bda2b93e418e36187",
-    "sha256": "0vnwhbkk40wj9rfy3fhjm9slra3y3j1mk67n3vnrzvmzrmpl4443"
+    "rev": "837b5163e17edbd3a9f098e9a1ab73febab419b4",
+    "sha256": "082i9q36d44g5a3jbw3ahvmmxikfai50wd2yq8xvkh8kr8xr7n5z"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
diff --git a/pkgs/development/libraries/sord/default.nix b/pkgs/development/libraries/sord/default.nix
index efb8bf0b895..54ae9261f81 100644
--- a/pkgs/development/libraries/sord/default.nix
+++ b/pkgs/development/libraries/sord/default.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-S22Szpg6iXeana5t6EpbOtRstthgrJ4Z2cBrf7a9ZBk=";
   };
 
+  outputs = [ "out" "dev" "doc" "man" ];
+
   nativeBuildInputs = [
     doxygen
     meson
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 4ba70506b71..1df7553e6c6 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@@ -40,6 +41,16 @@ stdenv.mkDerivation rec {
     sha256 = "+XLVCse6/czxE7HrmdyuNUBGhameVb/vFvOsg7Tel00=";
   };
 
+  patches = [
+    # Backport sqlite-3.42.0 compatibility:
+    #   https://gitlab.gnome.org/GNOME/tracker/-/merge_requests/600
+    (fetchpatch {
+      name = "sqlite-3.42.0.patch";
+      url = "https://gitlab.gnome.org/GNOME/tracker/-/commit/4cbbd1773a7367492fa3b3e3804839654e18a12a.patch";
+      hash = "sha256-w5D9I0P1DdyILhpjslh6ifojmlUiBoeFnxHPIr0rO3s=";
+    })
+  ];
+
   strictDeps = true;
 
   depsBuildBuild = [
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 5153a2b4d26..82874b9a313 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -3,38 +3,44 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+
+# build-system
 , setuptools
 , setuptools-scm
+
+# dependencies
+, exceptiongroup
 , idna
 , sniffio
-, typing-extensions
-, curio
+
+# optionals
+, trio
+
+# tests
 , hypothesis
-, mock
+, psutil
 , pytest-mock
 , pytest-xdist
 , pytestCheckHook
-, trio
 , trustme
 , uvloop
 }:
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "3.6.2";
+  version = "3.7.0";
   format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "agronholm";
     repo = pname;
     rev = version;
-    hash = "sha256-bootaulvx9zmobQGDirsMz5uxuLeCD9ggAvYkPaKnWo=";
+    hash = "sha256-uXPp2ycYl3T/ybZihDchImC/Yi4qgHI37ZeA+I6dg4c=";
   };
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION=${version}
-  '';
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     setuptools
@@ -44,51 +50,52 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     idna
     sniffio
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    exceptiongroup
   ];
 
+  passthru.optional-dependencies = {
+    trio = [
+      trio
+    ];
+  };
+
   # trustme uses pyopenssl
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
 
   nativeCheckInputs = [
-    curio
     hypothesis
+    psutil
     pytest-mock
     pytest-xdist
     pytestCheckHook
-    trio
     trustme
+  ] ++ lib.optionals (pythonOlder "3.12") [
     uvloop
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    mock
-  ];
+  ] ++ passthru.optional-dependencies.trio;
 
   pytestFlagsArray = [
     "-W" "ignore::trio.TrioDeprecationWarning"
+    "-m" "'not network'"
   ];
 
   disabledTests = [
-    # block devices access
-    "test_is_block_device"
     # INTERNALERROR> AttributeError: 'NonBaseMultiError' object has no attribute '_exceptions'. Did you mean: 'exceptions'?
     "test_exception_group_children"
     "test_exception_group_host"
     "test_exception_group_filtering"
-    # regression in python 3.11.3 and 3.10.11
-    # https://github.com/agronholm/anyio/issues/550
-    "TestTLSStream"
-    "TestTLSListener"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # PermissionError: [Errno 1] Operation not permitted: '/dev/console'
+    "test_is_block_device"
   ];
 
   disabledTestPaths = [
     # lots of DNS lookups
     "tests/test_sockets.py"
-  ] ++ lib.optionals stdenv.isDarwin [
-    # darwin sandboxing limitations
-    "tests/streams/test_tls.py"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "anyio" ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
new file mode 100644
index 00000000000..2de9484226b
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
@@ -0,0 +1,51 @@
+From 1643ed0d8a9201732905bee51b096605d26aaaac Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Fri, 26 May 2023 00:10:45 -0400
+Subject: [PATCH] Fix test failures on Darwin on a case-sensitive fs
+
+This issue was encounetered while working on a contribution to nixpkgs.
+Nix allows the store to be installed on a separate, case-sensitive APFS
+volume. When the store is on a case-sensitive volume, these tests fail
+because they try to use `foundation` instead of `Foundation`.
+---
+ .../failing/78 framework dependency with version/meson.build    | 2 +-
+ test cases/objc/2 nsstring/meson.build                          | 2 +-
+ test cases/osx/6 multiframework/meson.build                     | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/test cases/failing/78 framework dependency with version/meson.build b/test cases/failing/78 framework dependency with version/meson.build
+index b7e04bab446..ee315ebcbd7 100644
+--- a/test cases/failing/78 framework dependency with version/meson.build	
++++ b/test cases/failing/78 framework dependency with version/meson.build	
+@@ -5,4 +5,4 @@ if host_machine.system() != 'darwin'
+ endif
+ 
+ # do individual frameworks have a meaningful version to test?  And multiple frameworks might be listed...
+-dep = dependency('appleframeworks', modules: 'foundation', version: '>0')
++dep = dependency('appleframeworks', modules: 'Foundation', version: '>0')
+diff --git a/test cases/objc/2 nsstring/meson.build b/test cases/objc/2 nsstring/meson.build
+index 94d2cf18ab4..2c483d50d68 100644
+--- a/test cases/objc/2 nsstring/meson.build	
++++ b/test cases/objc/2 nsstring/meson.build	
+@@ -1,7 +1,7 @@
+ project('nsstring', 'objc')
+ 
+ if host_machine.system() == 'darwin'
+-  dep = dependency('appleframeworks', modules : 'foundation')
++  dep = dependency('appleframeworks', modules : 'Foundation')
+ elif host_machine.system() == 'cygwin'
+   error('MESON_SKIP_TEST GNUstep is not packaged for Cygwin.')
+ else
+diff --git a/test cases/osx/6 multiframework/meson.build b/test cases/osx/6 multiframework/meson.build
+index 28846243b21..57e5d61560b 100644
+--- a/test cases/osx/6 multiframework/meson.build	
++++ b/test cases/osx/6 multiframework/meson.build	
+@@ -4,7 +4,7 @@ project('multiframework', 'objc')
+ # that causes a build failure when defining two modules. The
+ # arguments for the latter module overwrote the arguments for
+ # the first one rather than adding to them.
+-cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'foundation'])
++cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'Foundation'])
+ 
+ executable('deptester',
+   'main.m',
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index f6004285ddb..3914f658409 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -26,6 +26,10 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   patches = [
+    # Fix Meson tests that fail when the Nix store is case-sensitive APFS.
+    # https://github.com/mesonbuild/meson/pull/11820
+    ./darwin-case-sensitive-fs.patch
+
     # Meson is currently inspecting fewer variables than autoconf does, which
     # makes it harder for us to use setup hooks, etc.  Taken from
     # https://github.com/mesonbuild/meson/pull/6827
diff --git a/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch b/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch
new file mode 100644
index 00000000000..838fbf72276
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch
@@ -0,0 +1,23 @@
+diff --git a/bfd/elf.c b/bfd/elf.c
+index 027d0143735..185028cbd97 100644
+--- a/bfd/elf.c
++++ b/bfd/elf.c
+@@ -9030,6 +9030,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return_verdef;
+ 	}
++
++      if (amt == 0)
++	goto error_return_verdef;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return_verdef;
+@@ -9133,6 +9136,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return;
+ 	}
++      if (amt == 0)
++	goto error_return;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return;
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 0db491f225c..0a2610ffd2e 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -88,6 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
     # not need to know binutils' BINDIR at all. It's an absolute path
     # where libraries are stored.
     ./plugins-no-BINDIR.patch
+
+    # CVE-2023-1972 fix to bfd/elf.c from:
+    # https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57
+    ./CVE-2023-1972.patch
   ]
   ++ lib.optional targetPlatform.isiOS ./support-ios.patch
   # Adds AVR-specific options to "size" for compatibility with Atmel's downstream distribution
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 0dd9fcb45bf..bde39a41b52 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.56";
+  version = "0.57";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-aCQ7I4XgxswQRfzzZG3MYe+W3dPWWex5MErMc0ZilSA=";
+    sha256 = "sha256-9d9WMCByQ1TKWpzWe5msts1LG+BKKqwCgaMBbD74/+4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch b/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch
deleted file mode 100644
index 2b59a508fda..00000000000
--- a/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 1640688018f329559c61352646f283f98938af31 Mon Sep 17 00:00:00 2001
-From: Cole Helbling <cole.helbling@determinate.systems>
-Date: Thu, 16 Feb 2023 09:30:21 -0800
-Subject: [PATCH] Revert "RDMA/irdma: Report the correct link speed"
-
-This reverts commit 425c9bd06b7a70796d880828d15c11321bdfb76d.
-
-Some Equinix Metal instances, such as a3.large.x86, m3.large.x86
-(specific hardware revisions), and n3.large.x86, use the `ice` kernel
-driver for their network cards, in conjunction with bonded devices.
-However, this commit caused a regression where these bonded devices
-would deadlock. This was initially reported by Jaroslav Pulchart on
-the netdev mailing list[1], and there were follow-up patches from Dave
-Ertman[2][3] that attempted to fix this but were not up to snuff for
-various reasons[4].
-
-Specifically, v2 of the patch ([3]) appears to fix the issue on some
-devices (tested with 8086:159B network cards), while it is still broken
-on others (such as an 8086:1593 network card).
-
-We revert the patch exposing the issue until upstream has a working
-solution in order to make Equinix Metal instances work reliably again.
-
-[1]: https://lore.kernel.org/netdev/CAK8fFZ6A_Gphw_3-QMGKEFQk=sfCw1Qmq0TVZK3rtAi7vb621A@mail.gmail.com/
-[2]: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230111183145.1497367-1-david.m.ertman@intel.com/
-[3]: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230215191757.1826508-1-david.m.ertman@intel.com/
-[4]: https://lore.kernel.org/netdev/cb31a911-ba80-e2dc-231f-851757cfd0b8@intel.com/T/#m6e53f8c43093693c10268140126abe99e082dc1c
----
- drivers/infiniband/hw/irdma/verbs.c | 35 ++++++++++++++++++++++++++---
- 1 file changed, 32 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
-index c5971a840b87..911902d2b93e 100644
---- a/drivers/infiniband/hw/irdma/verbs.c
-+++ b/drivers/infiniband/hw/irdma/verbs.c
-@@ -60,6 +60,36 @@ static int irdma_query_device(struct ib_device *ibdev,
- 	return 0;
- }
- 
-+/**
-+ * irdma_get_eth_speed_and_width - Get IB port speed and width from netdev speed
-+ * @link_speed: netdev phy link speed
-+ * @active_speed: IB port speed
-+ * @active_width: IB port width
-+ */
-+static void irdma_get_eth_speed_and_width(u32 link_speed, u16 *active_speed,
-+					  u8 *active_width)
-+{
-+	if (link_speed <= SPEED_1000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_SDR;
-+	} else if (link_speed <= SPEED_10000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_FDR10;
-+	} else if (link_speed <= SPEED_20000) {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_DDR;
-+	} else if (link_speed <= SPEED_25000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_EDR;
-+	} else if (link_speed <= SPEED_40000) {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_FDR10;
-+	} else {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_EDR;
-+	}
-+}
-+
- /**
-  * irdma_query_port - get port attributes
-  * @ibdev: device pointer from stack
-@@ -87,9 +117,8 @@ static int irdma_query_port(struct ib_device *ibdev, u32 port,
- 		props->state = IB_PORT_DOWN;
- 		props->phys_state = IB_PORT_PHYS_STATE_DISABLED;
- 	}
--
--	ib_get_eth_speed(ibdev, port, &props->active_speed,
--			 &props->active_width);
-+	irdma_get_eth_speed_and_width(SPEED_100000, &props->active_speed,
-+				      &props->active_width);
- 
- 	if (rdma_protocol_roce(ibdev, 1)) {
- 		props->gid_tbl_len = 32;
--- 
-2.39.0
-
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index f2225096dd5..972235c7f85 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -58,11 +58,6 @@
     patch = ./export-rt-sched-migrate.patch;
   };
 
-  fix-em-ice-bonding = {
-    name = "fix-em-ice-bonding";
-    patch = ./fix-em-ice-bonding.patch;
-  };
-
   CVE-2023-32233 = rec {
     name = "CVE-2023-32233";
     patch = fetchpatch {
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 1ba14c5f471..0f60a8655ce 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   configureFlags = [
     "--without-python"
   ];
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index 584b000a3e2..f745f4f091a 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
   ]
     # TODO make full dictionary
     ++ lib.optional stdenv.hostPlatform.isMinGW "TARGET_OS=MINGW"
+    ++ lib.optional stdenv.hostPlatform.isLinux "TARGET_OS=Linux"
     ;
 
   doCheck = false; # tests take a very long time
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index ee7350fbc9d..5ecb8642c5b 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -10,7 +10,6 @@
 , fontconfig
 , gd
 , gts
-, libdevil
 , libjpeg
 , libpng
 , libtool
@@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
     fontconfig
     gd
     gts
-    libdevil
     pango
     bash
   ] ++ optionals withXorg (with xorg; [ libXrender libXaw libXpm ])
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 1ea893948dc..8cce7012f02 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -5,10 +5,10 @@ let
   };
 in rec {
   openconnect = common rec {
-    version = "9.01";
+    version = "9.12";
     src = fetchurl {
       url = "ftp://ftp.infradead.org/pub/openconnect/openconnect-${version}.tar.gz";
-      sha256 = "sha256-s9f6+DDpeTKZ1qQegdhM1KPieJwUjJ5ZjkWFAQCQ5Mc=";
+      sha256 = "sha256-or7c46pN/nXjbkB+SOjovJHUbe9TNayVZPv5G9SyQT4=";
     };
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3ad42009810..482a961c9be 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7295,7 +7295,7 @@ with pkgs;
   easeprobe = callPackage ../tools/misc/easeprobe { };
 
   emscripten = callPackage ../development/compilers/emscripten {
-    llvmPackages = llvmPackages_14;
+    llvmPackages = llvmPackages_16;
   };
 
   emscriptenPackages = recurseIntoAttrs (callPackage ./emscripten-packages.nix { });
@@ -8222,7 +8222,6 @@ with pkgs;
   graphviz-nox = callPackage ../tools/graphics/graphviz {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
     withXorg = false;
-    libdevil = libdevil-nox;
   };
 
   grass-sass = callPackage ../tools/misc/grass-sass { };
@@ -23014,17 +23013,10 @@ with pkgs;
   # Default libGLU
   libGLU = mesa_glu;
 
-  # Keep Mesa 22.3 for now because 23.0 does not build on Darwin.
-  # FIXME: remove, also investigate why we even need Mesa on Darwin.
-  mesa_22_3 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/22.3.nix {
-    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
-    inherit (darwin.apple_sdk_11_0.libs) Xplugin;
-  };
-  mesa_23_0 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/23.0.nix {
+  mesa = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa {
     inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
     inherit (darwin.apple_sdk_11_0.libs) Xplugin;
   };
-  mesa = if stdenv.isDarwin then mesa_22_3 else mesa_23_0;
 
   mesa_glu =  callPackage ../development/libraries/mesa-glu {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index 15baf5ba729..f4d2fd06a90 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -66,7 +66,10 @@ rec {
         echo "Compiling a custom test"
         set -x
         emcc -O2 -s EMULATE_FUNCTION_POINTER_CASTS=1 xmllint.o \
-        ./.libs/libxml2.a `pkg-config zlib --cflags` `pkg-config zlib --libs` -o ./xmllint.test.js \
+        ./.libs/''
+      + pkgs.lib.optionalString pkgs.stdenv.isDarwin "libxml2.dylib "
+      + pkgs.lib.optionalString (!pkgs.stdenv.isDarwin) "libxml2.a "
+      + '' `pkg-config zlib --cflags` `pkg-config zlib --libs` -o ./xmllint.test.js \
         --embed-file ./test/xmlid/id_err1.xml
 
         echo "Using node to execute the test which basically outputs an error on stderr which we grep for"
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index a602c2447fb..f2fad5895ed 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -154,7 +154,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
@@ -170,7 +169,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
@@ -178,7 +176,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
         kernelPatches.export-rt-sched-migrate
       ];
     };
@@ -187,7 +184,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix
index 333e285cef0..f2cc7ae471a 100644
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@@ -89,7 +89,7 @@ with import ./release-lib.nix { inherit supportedSystems nixpkgsArgs; };
   man-pages = linux;
   mc = all;
   mdadm = linux;
-  mesa = mesaPlatforms;
+  mesa = linux;
   mingetty = linux;
   mktemp = all;
   monotone = linux;