summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/attrsets.nix14
-rw-r--r--maintainers/scripts/nix-generate-from-cpan.nix4
-rw-r--r--nixos/modules/config/pulseaudio.nix3
-rw-r--r--nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix4
-rw-r--r--nixos/modules/programs/mininet.nix2
-rw-r--r--nixos/modules/services/audio/mopidy.nix2
-rw-r--r--nixos/modules/services/backup/borgbackup.nix2
-rw-r--r--nixos/modules/services/continuous-integration/hydra/default.nix2
-rw-r--r--nixos/modules/services/misc/etebase-server.nix2
-rw-r--r--nixos/modules/services/misc/gitlab.nix4
-rw-r--r--nixos/modules/services/networking/knot.nix2
-rw-r--r--nixos/modules/services/networking/pptpd.nix2
-rw-r--r--nixos/modules/services/networking/tinc.nix2
-rw-r--r--nixos/modules/services/networking/xl2tpd.nix2
-rw-r--r--nixos/modules/services/web-apps/mediawiki.nix2
-rw-r--r--nixos/modules/virtualisation/azure-agent.nix2
-rw-r--r--nixos/tests/hydra/common.nix2
-rw-r--r--nixos/tests/kubernetes/base.nix2
-rw-r--r--nixos/tests/pulseaudio.nix25
-rw-r--r--pkgs/applications/audio/aumix/default.nix6
-rw-r--r--pkgs/applications/audio/calf/default.nix3
-rw-r--r--pkgs/applications/audio/flac/default.nix6
-rw-r--r--pkgs/applications/audio/grandorgue/default.nix2
-rw-r--r--pkgs/applications/audio/ltc-tools/default.nix3
-rw-r--r--pkgs/applications/audio/meterbridge/default.nix3
-rw-r--r--pkgs/applications/audio/mod-arpeggiator-lv2/default.nix3
-rw-r--r--pkgs/applications/audio/opusfile/default.nix1
-rw-r--r--pkgs/applications/audio/patchage/default.nix2
-rw-r--r--pkgs/applications/audio/transcode/default.nix3
-rw-r--r--pkgs/applications/audio/xsynth-dssi/default.nix4
-rw-r--r--pkgs/applications/blockchains/zcash/default.nix2
-rw-r--r--pkgs/applications/editors/leafpad/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix3
-rw-r--r--pkgs/applications/emulators/np2kai/default.nix2
-rw-r--r--pkgs/applications/file-managers/spacefm/default.nix4
-rw-r--r--pkgs/applications/file-managers/xfe/default.nix4
-rw-r--r--pkgs/applications/graphics/gpicview/default.nix4
-rw-r--r--pkgs/applications/graphics/synfigstudio/default.nix1
-rw-r--r--pkgs/applications/graphics/xaos/default.nix3
-rw-r--r--pkgs/applications/misc/gv/default.nix2
-rw-r--r--pkgs/applications/misc/gxmessage/default.nix4
-rw-r--r--pkgs/applications/misc/mdzk/default.nix9
-rw-r--r--pkgs/applications/misc/mdzk/update-mdbook-for-rust-1.64.patch246
-rw-r--r--pkgs/applications/misc/pcmanx-gtk2/default.nix4
-rw-r--r--pkgs/applications/misc/udevil/default.nix3
-rw-r--r--pkgs/applications/misc/xpad/default.nix4
-rw-r--r--pkgs/applications/misc/xxkb/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix2
-rw-r--r--pkgs/applications/networking/ids/snort/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix3
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix3
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin/default.nix4
-rw-r--r--pkgs/applications/networking/seahub/default.nix1
-rw-r--r--pkgs/applications/networking/sync/lsyncd/default.nix4
-rw-r--r--pkgs/applications/office/gnucash/default.nix2
-rw-r--r--pkgs/applications/office/grisbi/default.nix3
-rw-r--r--pkgs/applications/office/homebank/default.nix4
-rw-r--r--pkgs/applications/office/libreoffice/default.nix1
-rw-r--r--pkgs/applications/radio/rtl-ais/default.nix3
-rw-r--r--pkgs/applications/radio/unixcw/default.nix3
-rw-r--r--pkgs/applications/radio/xlog/default.nix3
-rwxr-xr-xpkgs/applications/science/biology/vcftools/default.nix3
-rw-r--r--pkgs/applications/science/geometry/drgeo/default.nix3
-rw-r--r--pkgs/applications/science/math/R/default.nix3
-rw-r--r--pkgs/applications/science/math/sage/sage-with-env.nix6
-rw-r--r--pkgs/applications/terminal-emulators/mrxvt/default.nix3
-rw-r--r--pkgs/applications/terminal-emulators/rxvt-unicode/default.nix3
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix6
-rw-r--r--pkgs/applications/video/byzanz/default.nix3
-rw-r--r--pkgs/applications/virtualization/xen/generic.nix4
-rw-r--r--pkgs/applications/window-managers/fbpanel/default.nix3
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh25
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix1
-rw-r--r--pkgs/build-support/rust/hooks/cargo-setup-hook.sh12
-rw-r--r--pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix6
-rw-r--r--pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix5
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix5
-rw-r--r--pkgs/build-support/trivial-builders.nix22
-rw-r--r--pkgs/data/icons/tango-icon-theme/default.nix4
-rw-r--r--pkgs/data/misc/cacert/default.nix4
-rw-r--r--pkgs/data/misc/ddccontrol-db/default.nix3
-rw-r--r--pkgs/data/misc/iana-etc/default.nix5
-rw-r--r--pkgs/data/misc/media-player-info/default.nix45
-rw-r--r--pkgs/data/misc/tzdata/default.nix6
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-common/default.nix2
-rw-r--r--pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix6
-rw-r--r--pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/gtkhtml/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/libgnome/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/libgnomecups/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix4
-rw-r--r--pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix3
-rw-r--r--pkgs/desktops/gnome/misc/gtkhtml/default.nix4
-rw-r--r--pkgs/desktops/lxde/core/lxmenu-data/default.nix2
-rw-r--r--pkgs/development/compilers/gerbil/gerbil-crypto.nix3
-rw-r--r--pkgs/development/compilers/gerbil/gerbil-support.nix3
-rw-r--r--pkgs/development/compilers/polyml/5.6.nix2
-rw-r--r--pkgs/development/compilers/rust/1_64.nix (renamed from pkgs/development/compilers/rust/1_63.nix)32
-rw-r--r--pkgs/development/compilers/rust/cargo.nix4
-rw-r--r--pkgs/development/compilers/rust/rustc.nix11
-rwxr-xr-xpkgs/development/embedded/blackmagic/helper.sh2
-rw-r--r--pkgs/development/interpreters/io/default.nix3
-rw-r--r--pkgs/development/interpreters/qnial/default.nix3
-rw-r--r--pkgs/development/libraries/SDL2/default.nix6
-rw-r--r--pkgs/development/libraries/SDL2/find-headers.patch26
-rw-r--r--pkgs/development/libraries/SDL2_mixer/default.nix2
-rw-r--r--pkgs/development/libraries/allegro/5.nix4
-rw-r--r--pkgs/development/libraries/apr-util/default.nix3
-rw-r--r--pkgs/development/libraries/dssi/default.nix4
-rw-r--r--pkgs/development/libraries/expat/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix9
-rw-r--r--pkgs/development/libraries/frame/default.nix3
-rw-r--r--pkgs/development/libraries/ggz_base_libs/default.nix3
-rw-r--r--pkgs/development/libraries/glew/1.10.nix6
-rw-r--r--pkgs/development/libraries/glib/default.nix2
-rw-r--r--pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch141
-rw-r--r--pkgs/development/libraries/glibc/default.nix2
-rw-r--r--pkgs/development/libraries/gnutls/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix12
-rw-r--r--pkgs/development/libraries/gstreamer/bad/fix-paths.patch48
-rw-r--r--pkgs/development/libraries/gtk-engines/default.nix4
-rw-r--r--pkgs/development/libraries/gtkspell/default.nix4
-rw-r--r--pkgs/development/libraries/imlib2/default.nix2
-rw-r--r--pkgs/development/libraries/kerberos/krb5.nix2
-rw-r--r--pkgs/development/libraries/libdrm/default.nix11
-rw-r--r--pkgs/development/libraries/liberfa/default.nix2
-rw-r--r--pkgs/development/libraries/libextractor/default.nix3
-rw-r--r--pkgs/development/libraries/libffi/default.nix5
-rw-r--r--pkgs/development/libraries/libffi/libffi-powerpc64.patch23
-rw-r--r--pkgs/development/libraries/libfido2/default.nix2
-rw-r--r--pkgs/development/libraries/libinklevel/default.nix2
-rw-r--r--pkgs/development/libraries/libmikmod/default.nix6
-rw-r--r--pkgs/development/libraries/libmx/default.nix3
-rw-r--r--pkgs/development/libraries/libpfm/default.nix4
-rw-r--r--pkgs/development/libraries/libpipeline/default.nix4
-rw-r--r--pkgs/development/libraries/libspectre/default.nix4
-rw-r--r--pkgs/development/libraries/libspng/default.nix2
-rw-r--r--pkgs/development/libraries/libtoxcore/new-api.nix2
-rw-r--r--pkgs/development/libraries/libwnck/2.nix4
-rw-r--r--pkgs/development/libraries/mlt/qt-5.nix3
-rw-r--r--pkgs/development/libraries/ogre/default.nix1
-rw-r--r--pkgs/development/libraries/openal-soft/default.nix8
-rw-r--r--pkgs/development/libraries/opencl-headers/default.nix4
-rw-r--r--pkgs/development/libraries/openh264/default.nix4
-rw-r--r--pkgs/development/libraries/openjpeg/default.nix68
-rw-r--r--pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch44
-rw-r--r--pkgs/development/libraries/science/math/cliquer/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix9
-rw-r--r--pkgs/development/libraries/sentry-native/default.nix4
-rw-r--r--pkgs/development/libraries/smpeg/default.nix8
-rw-r--r--pkgs/development/libraries/smpeg2/default.nix5
-rw-r--r--pkgs/development/libraries/srt/default.nix4
-rw-r--r--pkgs/development/libraries/unicap/default.nix3
-rw-r--r--pkgs/development/libraries/vapoursynth-mvtools/default.nix3
-rw-r--r--pkgs/development/libraries/volume-key/default.nix4
-rw-r--r--pkgs/development/libraries/vte/2.90.nix4
-rw-r--r--pkgs/development/libraries/xcb-util-cursor/HEAD.nix3
-rw-r--r--pkgs/development/lua-modules/overrides.nix3
-rw-r--r--pkgs/development/ocaml-modules/gsl/default.nix3
-rw-r--r--pkgs/development/perl-modules/Po4a/default.nix12
-rw-r--r--pkgs/development/python-modules/adal/default.nix4
-rw-r--r--pkgs/development/python-modules/apache-airflow/default.nix1
-rw-r--r--pkgs/development/python-modules/auth0-python/default.nix3
-rw-r--r--pkgs/development/python-modules/django-allauth/default.nix5
-rw-r--r--pkgs/development/python-modules/django/3.nix4
-rw-r--r--pkgs/development/python-modules/drf-jwt/default.nix3
-rw-r--r--pkgs/development/python-modules/eth-keys/default.nix1
-rw-r--r--pkgs/development/python-modules/flask-jwt-extended/default.nix8
-rw-r--r--pkgs/development/python-modules/gidgethub/default.nix3
-rw-r--r--pkgs/development/python-modules/github3_py/default.nix3
-rw-r--r--pkgs/development/python-modules/msal/default.nix8
-rw-r--r--pkgs/development/python-modules/psutil/default.nix7
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix2
-rw-r--r--pkgs/development/python-modules/pyjwt/default.nix31
-rw-r--r--pkgs/development/python-modules/setuptools-rust/default.nix4
-rw-r--r--pkgs/development/python-modules/social-auth-core/default.nix4
-rw-r--r--pkgs/development/python-modules/twilio/default.nix2
-rw-r--r--pkgs/development/ruby-modules/gem-config/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/setup-hook.sh2
-rw-r--r--pkgs/development/tools/build-managers/ninja/default.nix51
-rw-r--r--pkgs/development/tools/build-managers/ninja/setup-hook.sh50
-rw-r--r--pkgs/development/tools/mdk/default.nix4
-rw-r--r--pkgs/development/tools/memray/default.nix3
-rw-r--r--pkgs/development/tools/misc/distcc/default.nix4
-rw-r--r--pkgs/development/tools/misc/lttng-ust/generic.nix4
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/default.nix6
-rw-r--r--pkgs/games/asc/default.nix4
-rw-r--r--pkgs/games/eduke32/default.nix2
-rw-r--r--pkgs/games/extremetuxracer/default.nix3
-rw-r--r--pkgs/games/freedink/default.nix4
-rw-r--r--pkgs/games/iortcw/sp.nix2
-rw-r--r--pkgs/games/ivan/default.nix2
-rw-r--r--pkgs/games/srb2/default.nix4
-rw-r--r--pkgs/games/srb2kart/default.nix4
-rw-r--r--pkgs/games/uhexen2/default.nix2
-rw-r--r--pkgs/games/xboard/default.nix2
-rw-r--r--pkgs/games/xonotic/default.nix8
-rw-r--r--pkgs/misc/cups/drivers/canon/default.nix4
-rw-r--r--pkgs/misc/screensavers/alock/default.nix4
-rw-r--r--pkgs/misc/stabber/default.nix3
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix6
-rw-r--r--pkgs/os-specific/darwin/libtapi/default.nix3
-rw-r--r--pkgs/os-specific/linux/ell/default.nix4
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix1
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix4
-rw-r--r--pkgs/os-specific/linux/libpsm2/default.nix3
-rw-r--r--pkgs/os-specific/linux/lightum/default.nix3
-rw-r--r--pkgs/os-specific/linux/pam_usb/default.nix2
-rw-r--r--pkgs/os-specific/linux/pmount/default.nix3
-rw-r--r--pkgs/os-specific/linux/trace-cmd/default.nix2
-rw-r--r--pkgs/os-specific/linux/xf86-video-nested/default.nix6
-rw-r--r--pkgs/servers/matrix-conduit/default.nix2
-rw-r--r--pkgs/servers/pulseaudio/default.nix18
-rw-r--r--pkgs/servers/web-apps/lemmy/ui.nix4
-rw-r--r--pkgs/servers/web-apps/sogo/default.nix4
-rw-r--r--pkgs/servers/x11/quartz-wm/default.nix2
-rw-r--r--pkgs/stdenv/darwin/default.nix5
-rw-r--r--pkgs/stdenv/generic/setup.sh6
-rw-r--r--pkgs/tools/X11/xnee/default.nix3
-rw-r--r--pkgs/tools/admin/tigervnc/default.nix2
-rw-r--r--pkgs/tools/audio/midimonster/default.nix3
-rw-r--r--pkgs/tools/audio/mpdcron/default.nix3
-rw-r--r--pkgs/tools/backup/dump/default.nix3
-rw-r--r--pkgs/tools/compression/gzip/default.nix9
-rw-r--r--pkgs/tools/compression/lz4/default.nix10
-rw-r--r--pkgs/tools/filesystems/httpfs/default.nix3
-rw-r--r--pkgs/tools/graphics/s2png/default.nix3
-rw-r--r--pkgs/tools/inputmethods/m17n-lib/default.nix18
-rw-r--r--pkgs/tools/misc/cpuminer/default.nix3
-rw-r--r--pkgs/tools/misc/expect/default.nix6
-rw-r--r--pkgs/tools/misc/expect/fix-cross-compilation.patch11
-rw-r--r--pkgs/tools/misc/notify-desktop/default.nix3
-rw-r--r--pkgs/tools/misc/popsicle/default.nix2
-rw-r--r--pkgs/tools/misc/vector/default.nix24
-rw-r--r--pkgs/tools/networking/nss-mdns/default.nix2
-rw-r--r--pkgs/tools/networking/ofono/default.nix4
-rw-r--r--pkgs/tools/networking/sipsak/default.nix2
-rw-r--r--pkgs/tools/networking/unbound/default.nix8
-rw-r--r--pkgs/tools/security/chrome-token-signing/default.nix3
-rw-r--r--pkgs/tools/security/ecryptfs/default.nix4
-rw-r--r--pkgs/tools/security/fpm2/default.nix4
-rw-r--r--pkgs/tools/security/gnupg-pkcs11-scd/default.nix3
-rw-r--r--pkgs/tools/security/metasploit/shell.nix2
-rw-r--r--pkgs/tools/security/onioncircuits/default.nix2
-rw-r--r--pkgs/tools/security/tracee/default.nix2
-rw-r--r--pkgs/tools/system/gdmap/default.nix4
-rw-r--r--pkgs/tools/text/mdbook-admonish/default.nix21
-rw-r--r--pkgs/tools/text/mdbook-graphviz/default.nix11
-rw-r--r--pkgs/tools/text/mdbook-graphviz/update-mdbook-for-rust-1.64.patch369
-rw-r--r--pkgs/tools/text/mdbook-katex/default.nix9
-rw-r--r--pkgs/tools/text/mdbook-katex/update-mdbook-for-rust-1.64.patch1417
-rw-r--r--pkgs/tools/text/mdbook-man/default.nix8
-rw-r--r--pkgs/tools/text/mdbook-mermaid/default.nix15
-rw-r--r--pkgs/tools/text/mdbook-open-on-gh/default.nix15
-rw-r--r--pkgs/tools/text/mdbook-pdf/default.nix6
-rw-r--r--pkgs/tools/text/mdbook-plantuml/default.nix28
-rw-r--r--pkgs/tools/typesetting/asciidoc/default.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/bin.nix17
-rw-r--r--pkgs/top-level/all-packages.nix43
-rw-r--r--pkgs/top-level/emscripten-packages.nix6
-rw-r--r--pkgs/top-level/java-packages.nix6
-rw-r--r--pkgs/top-level/perl-packages.nix12
-rw-r--r--pkgs/top-level/python-packages.nix2
-rw-r--r--pkgs/top-level/release.nix25
270 files changed, 3211 insertions, 623 deletions
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 5575e957702..de88763854d 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -622,6 +622,20 @@ rec {
   dontRecurseIntoAttrs =
     attrs: attrs // { recurseForDerivations = false; };
 
+  /* `unionOfDisjoint x y` is equal to `x // y // z` where the
+     attrnames in `z` are the intersection of the attrnames in `x` and
+     `y`, and all values `assert` with an error message.  This
+      operator is commutative, unlike (//). */
+  unionOfDisjoint = x: y:
+    let
+      intersection = builtins.intersectAttrs x y;
+      collisions = lib.concatStringsSep " " (builtins.attrNames intersection);
+      mask = builtins.mapAttrs (name: value: builtins.throw
+        "unionOfDisjoint: collision on ${name}; complete list: ${collisions}")
+        intersection;
+    in
+      (x // y) // mask;
+
   /*** deprecated stuff ***/
 
   zipWithNames = zipAttrsWithNames;
diff --git a/maintainers/scripts/nix-generate-from-cpan.nix b/maintainers/scripts/nix-generate-from-cpan.nix
index fecca7f0c73..9f9833d4060 100644
--- a/maintainers/scripts/nix-generate-from-cpan.nix
+++ b/maintainers/scripts/nix-generate-from-cpan.nix
@@ -3,8 +3,10 @@
 stdenv.mkDerivation {
   name = "nix-generate-from-cpan-3";
 
+  nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = with perlPackages; [
-    makeWrapper perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
+    perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
   ];
 
   phases = [ "installPhase" ];
diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix
index 3e969991f8f..80ff6c1aabf 100644
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@@ -102,7 +102,7 @@ in {
           each user that tries to use the sound system. The server runs
           with user privileges. If true, one system-wide PulseAudio
           server is launched on boot, running as the user "pulse", and
-          only users in the "audio" group will have access to the server.
+          only users in the "pulse-access" group will have access to the server.
           Please read the PulseAudio documentation for more details.
 
           Don't enable this option unless you know what you are doing.
@@ -310,6 +310,7 @@ in {
       };
 
       users.groups.pulse.gid = gid;
+      users.groups.pulse-access = {};
 
       systemd.services.pulseaudio = {
         description = "PulseAudio System-Wide Server";
diff --git a/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix b/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
index a808429c999..8dadbd53b98 100644
--- a/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
+++ b/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
@@ -23,8 +23,10 @@ in
 runCommand "uvcdynctrl-udev-rules-${version}"
 {
   inherit dataPath;
-  buildInputs = [
+  nativeBuildInputs = [
     makeWrapper
+  ];
+  buildInputs = [
     libwebcam
   ];
   dontPatchELF = true;
diff --git a/nixos/modules/programs/mininet.nix b/nixos/modules/programs/mininet.nix
index 0b7e82cc5bd..02272729d23 100644
--- a/nixos/modules/programs/mininet.nix
+++ b/nixos/modules/programs/mininet.nix
@@ -14,7 +14,7 @@ let
   pyEnv = pkgs.python.withPackages(ps: [ ps.mininet-python ]);
 
   mnexecWrapped = pkgs.runCommand "mnexec-wrapper"
-    { buildInputs = [ pkgs.makeWrapper pkgs.pythonPackages.wrapPython ]; }
+    { nativeBuildInputs = [ pkgs.makeWrapper pkgs.pythonPackages.wrapPython ]; }
     ''
       makeWrapper ${pkgs.mininet}/bin/mnexec \
         $out/bin/mnexec \
diff --git a/nixos/modules/services/audio/mopidy.nix b/nixos/modules/services/audio/mopidy.nix
index 50ee9a82451..40e8679f53d 100644
--- a/nixos/modules/services/audio/mopidy.nix
+++ b/nixos/modules/services/audio/mopidy.nix
@@ -14,7 +14,7 @@ let
     name = "mopidy-with-extensions-${mopidy.version}";
     paths = closePropagation cfg.extensionPackages;
     pathsToLink = [ "/${mopidyPackages.python.sitePackages}" ];
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
     postBuild = ''
       makeWrapper ${mopidy}/bin/mopidy $out/bin/mopidy \
         --prefix PYTHONPATH : $out/${mopidyPackages.python.sitePackages}
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index f02e15f2b98..7b29eb41e72 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -116,7 +116,7 @@ let
       original, name, set ? {}
     }:
     pkgs.runCommand "${name}-wrapper" {
-      buildInputs = [ pkgs.makeWrapper ];
+      nativeBuildInputs = [ pkgs.makeWrapper ];
     } (with lib; ''
       makeWrapper "${original}" "$out/bin/${name}" \
         ${concatStringsSep " \\\n " (mapAttrsToList (name: value: ''--set ${name} "${value}"'') set)}
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 8b5c1228c52..71147957504 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -42,7 +42,7 @@ let
     makeWrapperArgs = concatStringsSep " " (mapAttrsToList (key: value: "--set \"${key}\" \"${value}\"") hydraEnv);
   in pkgs.buildEnv rec {
     name = "hydra-env";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     paths = [ cfg.package ];
 
     postBuild = ''
diff --git a/nixos/modules/services/misc/etebase-server.nix b/nixos/modules/services/misc/etebase-server.nix
index 76c7c6596c8..c3723d18814 100644
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@@ -162,7 +162,7 @@ in
 
     environment.systemPackages = with pkgs; [
       (runCommand "etebase-server" {
-        buildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeWrapper ];
       } ''
         makeWrapper ${pythonEnv}/bin/etebase-server \
           $out/bin/etebase-server \
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index e5de3a2b6ad..c41f2efeec4 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -190,7 +190,7 @@ let
 
   gitlab-rake = pkgs.stdenv.mkDerivation {
     name = "gitlab-rake";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     dontBuild = true;
     dontUnpack = true;
     installPhase = ''
@@ -205,7 +205,7 @@ let
 
   gitlab-rails = pkgs.stdenv.mkDerivation {
     name = "gitlab-rails";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     dontBuild = true;
     dontUnpack = true;
     installPhase = ''
diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index de238112826..ee7ea83456d 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -18,7 +18,7 @@ let
 
   knot-cli-wrappers = pkgs.stdenv.mkDerivation {
     name = "knot-cli-wrappers";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     buildCommand = ''
       mkdir -p $out/bin
       makeWrapper ${cfg.package}/bin/knotc "$out/bin/knotc" \
diff --git a/nixos/modules/services/networking/pptpd.nix b/nixos/modules/services/networking/pptpd.nix
index 2f206e813a5..703dda99803 100644
--- a/nixos/modules/services/networking/pptpd.nix
+++ b/nixos/modules/services/networking/pptpd.nix
@@ -82,7 +82,7 @@ with lib;
       ppp-pptpd-wrapped = pkgs.stdenv.mkDerivation {
         name         = "ppp-pptpd-wrapped";
         phases       = [ "installPhase" ];
-        buildInputs  = with pkgs; [ makeWrapper ];
+        nativeBuildInputs  = with pkgs; [ makeWrapper ];
         installPhase = ''
           mkdir -p $out/bin
           makeWrapper ${pkgs.ppp}/bin/pppd $out/bin/pppd \
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 1f93d82f96e..09b23a60a4a 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -410,7 +410,7 @@ in
     environment.systemPackages = let
       cli-wrappers = pkgs.stdenv.mkDerivation {
         name = "tinc-cli-wrappers";
-        buildInputs = [ pkgs.makeWrapper ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
         buildCommand = ''
           mkdir -p $out/bin
           ${concatStringsSep "\n" (mapAttrsToList (network: data:
diff --git a/nixos/modules/services/networking/xl2tpd.nix b/nixos/modules/services/networking/xl2tpd.nix
index 8f710bca322..7d259570761 100644
--- a/nixos/modules/services/networking/xl2tpd.nix
+++ b/nixos/modules/services/networking/xl2tpd.nix
@@ -84,7 +84,7 @@ with lib;
       xl2tpd-ppp-wrapped = pkgs.stdenv.mkDerivation {
         name         = "xl2tpd-ppp-wrapped";
         phases       = [ "installPhase" ];
-        buildInputs  = with pkgs; [ makeWrapper ];
+        nativeBuildInputs  = with pkgs; [ makeWrapper ];
         installPhase = ''
           mkdir -p $out/bin
 
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index a32db718848..e332847f5a2 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -35,7 +35,7 @@ let
   };
 
   mediawikiScripts = pkgs.runCommand "mediawiki-scripts" {
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     preferLocalBuild = true;
   } ''
     mkdir -p $out/bin
diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix
index 31047c4ddc0..abe6455a1a6 100644
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@@ -17,7 +17,7 @@ let
 
     patches = [ ./azure-agent-entropy.patch ];
 
-    buildInputs = [ makeWrapper python pythonPackages.wrapPython ];
+    nativeBuildInputs = [ makeWrapper python pythonPackages.wrapPython ];
     runtimeDeps = [ findutils gnugrep gawk coreutils openssl openssh
                     nettools # for hostname
                     procps # for pidof
diff --git a/nixos/tests/hydra/common.nix b/nixos/tests/hydra/common.nix
index fdf2b2c6f6d..2bce03418e1 100644
--- a/nixos/tests/hydra/common.nix
+++ b/nixos/tests/hydra/common.nix
@@ -16,7 +16,7 @@
     createTrivialProject = pkgs.stdenv.mkDerivation {
       name = "create-trivial-project";
       dontUnpack = true;
-      buildInputs = [ pkgs.makeWrapper ];
+      nativeBuildInputs = [ pkgs.makeWrapper ];
       installPhase = "install -m755 -D ${./create-trivial-project.sh} $out/bin/create-trivial-project.sh";
       postFixup = ''
         wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob}
diff --git a/nixos/tests/kubernetes/base.nix b/nixos/tests/kubernetes/base.nix
index d4410beb937..714ac3098c0 100644
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@@ -18,7 +18,7 @@ let
         ${master.ip}  api.${domain}
         ${concatMapStringsSep "\n" (machineName: "${machines.${machineName}.ip}  ${machineName}.${domain}") (attrNames machines)}
       '';
-      wrapKubectl = with pkgs; runCommand "wrap-kubectl" { buildInputs = [ makeWrapper ]; } ''
+      wrapKubectl = with pkgs; runCommand "wrap-kubectl" { nativeBuildInputs = [ makeWrapper ]; } ''
         mkdir -p $out/bin
         makeWrapper ${pkgs.kubernetes}/bin/kubectl $out/bin/kubectl --set KUBECONFIG "/etc/kubernetes/cluster-admin.kubeconfig"
       '';
diff --git a/nixos/tests/pulseaudio.nix b/nixos/tests/pulseaudio.nix
index cfdc61bc6c2..dc8e33ccd55 100644
--- a/nixos/tests/pulseaudio.nix
+++ b/nixos/tests/pulseaudio.nix
@@ -1,10 +1,10 @@
 let
-  mkTest = { systemWide ? false }:
+  mkTest = { systemWide ? false , fullVersion ? false }:
     import ./make-test-python.nix ({ pkgs, lib, ... }:
       let
         testFile = pkgs.fetchurl {
           url =
-            "https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3";
+            "https://file-examples.com/storage/fe5947fd2362fc197a3c2df/2017/11/file_example_MP3_700KB.mp3";
           hash = "sha256-+iggJW8s0/LfA/okfXsB550/55Q0Sq3OoIzuBrzOPJQ=";
         };
 
@@ -22,7 +22,7 @@ let
           testPlay32 = { inherit (pkgs.pkgsi686Linux) sox alsa-utils; };
         };
       in {
-        name = "pulseaudio${lib.optionalString systemWide "-systemWide"}";
+        name = "pulseaudio${lib.optionalString fullVersion "Full"}${lib.optionalString systemWide "-systemWide"}";
         meta = with pkgs.lib.maintainers; {
           maintainers = [ synthetica ] ++ pkgs.pulseaudio.meta.maintainers;
         };
@@ -35,12 +35,14 @@ let
               enable = true;
               support32Bit = true;
               inherit systemWide;
+            } // lib.optionalAttrs fullVersion {
+              package = pkgs.pulseaudioFull;
             };
 
             environment.systemPackages = [ testers.testPlay pkgs.pavucontrol ]
               ++ lib.optional pkgs.stdenv.isx86_64 testers.testPlay32;
           } // lib.optionalAttrs systemWide {
-            users.users.alice.extraGroups = [ "audio" ];
+            users.users.alice.extraGroups = [ "pulse-access" ];
             systemd.services.pulseaudio.wantedBy = [ "multi-user.target" ];
           };
 
@@ -58,14 +60,21 @@ let
           ''}
           machine.screenshot("testPlay")
 
+          ${lib.optionalString (!systemWide) ''
+            machine.send_chars("pacmd info && touch /tmp/pacmd_success\n")
+            machine.wait_for_file("/tmp/pacmd_success")
+          ''}
+
           # Pavucontrol only loads when Pulseaudio is running. If it isn't, the
-          # text "Playback" (one of the tabs) will never show.
+          # text "Dummy Output" (sound device name) will never show.
           machine.send_chars("pavucontrol\n")
-          machine.wait_for_text("Playback")
+          machine.wait_for_text("Dummy Output")
           machine.screenshot("Pavucontrol")
         '';
       });
 in builtins.mapAttrs (key: val: mkTest val) {
-  user = { systemWide = false; };
-  system = { systemWide = true; };
+  user = { systemWide = false; fullVersion = false; };
+  system = { systemWide = true; fullVersion = false; };
+  userFull = { systemWide = false; fullVersion = true; };
+  systemFull = { systemWide = true; fullVersion = true; };
 }
diff --git a/pkgs/applications/audio/aumix/default.nix b/pkgs/applications/audio/aumix/default.nix
index 2603e88fcbd..6127cb7e692 100644
--- a/pkgs/applications/audio/aumix/default.nix
+++ b/pkgs/applications/audio/aumix/default.nix
@@ -28,8 +28,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = lib.optionals gtkGUI [ pkg-config ];
+
   buildInputs = [ gettext ncurses ]
-    ++ lib.optionals gtkGUI [ pkg-config gtk2 ];
+    ++ lib.optionals gtkGUI [ gtk2 ];
+
+  configureFlags = lib.optionals (!gtkGUI) ["--without-gtk"];
 
   meta = with lib; {
     description = "Audio mixer for X and the console";
diff --git a/pkgs/applications/audio/calf/default.nix b/pkgs/applications/audio/calf/default.nix
index bdcbf024e60..4ab651e3fb8 100644
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     cairo expat fftwSinglePrec fluidsynth glib gtk2 libjack2 ladspaH
-    libglade lv2 pkg-config
+    libglade lv2
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/flac/default.nix b/pkgs/applications/audio/flac/default.nix
index 621804840bf..c9e3b946dd1 100644
--- a/pkgs/applications/audio/flac/default.nix
+++ b/pkgs/applications/audio/flac/default.nix
@@ -2,11 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "flac";
-  version = "1.3.4";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
-    sha256 = "0dz7am8kbc97a6afml1h4yp085274prg8j7csryds8m3fmz61w4g";
+    # Official checksum is published at https://github.com/xiph/flac/releases/tag/${version}
+    sha256 = "91303c3e5dfde52c3e94e75976c0ab3ee14ced278ab8f60033a3a12db9209ae6";
   };
 
   buildInputs = [ libogg ];
@@ -20,5 +21,6 @@ stdenv.mkDerivation rec {
     description = "Library and tools for encoding and decoding the FLAC lossless audio file format";
     platforms = platforms.all;
     license = licenses.bsd3;
+    maintainers = with maintainers; [ ruuda ];
   };
 }
diff --git a/pkgs/applications/audio/grandorgue/default.nix b/pkgs/applications/audio/grandorgue/default.nix
index 30c6e57188a..954a2265312 100644
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ pkg-config fftwFloat alsa-lib zlib wavpack wxGTK31 udev ]
+  buildInputs = [ fftwFloat alsa-lib zlib wavpack wxGTK31 udev ]
     ++ lib.optional jackaudioSupport libjack2;
 
   cmakeFlags = lib.optional (!jackaudioSupport) [
diff --git a/pkgs/applications/audio/ltc-tools/default.nix b/pkgs/applications/audio/ltc-tools/default.nix
index c8c87959727..93558105074 100644
--- a/pkgs/applications/audio/ltc-tools/default.nix
+++ b/pkgs/applications/audio/ltc-tools/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vp25b970r1hv5ndzs4di63rgwnl31jfaj3jz5dka276kx34q4al";
   };
 
-  buildInputs = [ pkg-config libltc libsndfile jack2 ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libltc libsndfile jack2 ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/audio/meterbridge/default.nix b/pkgs/applications/audio/meterbridge/default.nix
index a825eaa4e38..675189f6d13 100644
--- a/pkgs/applications/audio/meterbridge/default.nix
+++ b/pkgs/applications/audio/meterbridge/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
 
   patches = [ ./buf_rect.patch ./fix_build_with_gcc-5.patch];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config SDL SDL_image libjack2
+    [ SDL SDL_image libjack2
     ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix b/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
index 3896545dc41..a628e38469f 100644
--- a/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
+++ b/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-1KiWMTVTTf1/iR4AzJ1Oe0mOrWN5edsZN0tQMidgnRA=";
   };
 
-  buildInputs = [ lv2 pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ lv2 ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/audio/opusfile/default.nix b/pkgs/applications/audio/opusfile/default.nix
index a6683904cb1..f86595361b6 100644
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl libogg ];
   propagatedBuildInputs = [ libopus ];
+  outputs = [ "out" "dev" ];
   patches = [ ./include-multistream.patch ]
     # fixes problem with openssl 1.1 dependency
     # see https://github.com/xiph/opusfile/issues/13
diff --git a/pkgs/applications/audio/patchage/default.nix b/pkgs/applications/audio/patchage/default.nix
index a8a5bed0e07..99bbdf693a9 100644
--- a/pkgs/applications/audio/patchage/default.nix
+++ b/pkgs/applications/audio/patchage/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     alsa-lib
     boost
@@ -33,7 +34,6 @@ stdenv.mkDerivation rec {
     glibmm
     gtkmm2
     libjack2
-    pkg-config
     python3
     wafHook
   ];
diff --git a/pkgs/applications/audio/transcode/default.nix b/pkgs/applications/audio/transcode/default.nix
index 112d84a08b1..da149db0753 100644
--- a/pkgs/applications/audio/transcode/default.nix
+++ b/pkgs/applications/audio/transcode/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1e4e72d8e0dd62a80b8dd90699f5ca64c9b0cb37a5c9325c184166a9654f0a92";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ flac lame zlib libjpeg libvorbis libtheora libxml2 lzo
-                  libdvdread pkg-config x264 libmpeg2 xvidcore ];
+                  libdvdread x264 libmpeg2 xvidcore ];
   configureFlags = [
     "--disable-ffmpeg" "--disable-libavcodec" "--disable-libavformat"
     "--enable-lzo" "--enable-ogg" "--enable-vorbis" "--enable-theora" "--enable-libxml2"
diff --git a/pkgs/applications/audio/xsynth-dssi/default.nix b/pkgs/applications/audio/xsynth-dssi/default.nix
index 61d49d110a9..87305027e4c 100644
--- a/pkgs/applications/audio/xsynth-dssi/default.nix
+++ b/pkgs/applications/audio/xsynth-dssi/default.nix
@@ -10,9 +10,9 @@ stdenv.mkDerivation  rec {
     sha256 = "00nwv2pqjbmxqdc6xdm0cljq6z05lv4y6bibmhz1kih9lm0lklnk";
   };
 
-  nativeBuildInputs = [ autoconf automake  ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [ alsa-lib dssi gtk2 libjack2 ladspaH
-    ladspaPlugins liblo pkg-config ];
+    ladspaPlugins liblo ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/blockchains/zcash/default.nix b/pkgs/applications/blockchains/zcash/default.nix
index 20520037a60..c4d007f2907 100644
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
   postPatch = ''
     # Have to do this here instead of in preConfigure because
     # cargoDepsCopy gets unset after postPatch.
-    configureFlagsArray+=("RUST_VENDORED_SOURCES=$NIX_BUILD_TOP/$cargoDepsCopy")
+    configureFlagsArray+=("RUST_VENDORED_SOURCES=$cargoDepsCopy")
   '';
 
   CXXFLAGS = [
diff --git a/pkgs/applications/editors/leafpad/default.nix b/pkgs/applications/editors/leafpad/default.nix
index 2f53df97d32..0376e3af6bf 100644
--- a/pkgs/applications/editors/leafpad/default.nix
+++ b/pkgs/applications/editors/leafpad/default.nix
@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0b0az2wvqgvam7w0ns1j8xp2llslm1rx6h7zcsy06a7j0yp257cm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk2 ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
index d5961f0c9eb..9eba40330b9 100644
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
@@ -45,7 +45,8 @@ let
     inherit (stdenv.hostPlatform) system;
   }).nodeDependencies.override (old: {
     inherit src version;
-    buildInputs = [pkg-config libsecret];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [libsecret];
     dontNpmInstall = true;
   }));
 
diff --git a/pkgs/applications/emulators/np2kai/default.nix b/pkgs/applications/emulators/np2kai/default.nix
index dd5e53967c0..cf55085b78a 100644
--- a/pkgs/applications/emulators/np2kai/default.nix
+++ b/pkgs/applications/emulators/np2kai/default.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation rec {
 
   configurePhase = ''
     export GIT_VERSION=${builtins.substring 0 7 src.rev}
-    buildFlags="$buildFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES -l$NIX_BUILD_CORES}"
+    buildFlags="$buildFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES"
   '' + optionalString enableX11 ''
     cd x11
     substituteInPlace Makefile.am \
diff --git a/pkgs/applications/file-managers/spacefm/default.nix b/pkgs/applications/file-managers/spacefm/default.nix
index 433109cd86a..334228f98ea 100644
--- a/pkgs/applications/file-managers/spacefm/default.nix
+++ b/pkgs/applications/file-managers/spacefm/default.nix
@@ -45,9 +45,9 @@ stdenv.mkDerivation rec {
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
   '';
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
-    gtk3 udev desktop-file-utils shared-mime-info intltool
+    gtk3 udev desktop-file-utils shared-mime-info
     wrapGAppsHook ffmpegthumbnailer jmtpfs lsof udisks2
   ] ++ (if ifuseSupport then [ ifuse ] else []);
   # Introduced because ifuse doesn't build due to CVEs in libplist
diff --git a/pkgs/applications/file-managers/xfe/default.nix b/pkgs/applications/file-managers/xfe/default.nix
index d59b936608c..c861c695598 100644
--- a/pkgs/applications/file-managers/xfe/default.nix
+++ b/pkgs/applications/file-managers/xfe/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1v1v0vcbnm30kpyd3rj8f56yh7lfnwy7nbs9785wi229b29fiqx1";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fox gettext xlibsWrapper gcc intltool file libpng ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ fox gettext xlibsWrapper gcc file libpng ];
 
   preConfigure = ''
     sed -i s,/usr/share/xfe,$out/share/xfe, src/xfedefs.h
diff --git a/pkgs/applications/graphics/gpicview/default.nix b/pkgs/applications/graphics/gpicview/default.nix
index ae1e64297bd..06c3b03ae53 100644
--- a/pkgs/applications/graphics/gpicview/default.nix
+++ b/pkgs/applications/graphics/gpicview/default.nix
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
 
-  buildInputs = [ intltool gtk2 ];
+  buildInputs = [ gtk2 ];
 
   meta = with lib; {
     description = "A simple and fast image viewer for X";
diff --git a/pkgs/applications/graphics/synfigstudio/default.nix b/pkgs/applications/graphics/synfigstudio/default.nix
index a77a0313223..c87a71fdf6c 100644
--- a/pkgs/applications/graphics/synfigstudio/default.nix
+++ b/pkgs/applications/graphics/synfigstudio/default.nix
@@ -114,7 +114,6 @@ stdenv.mkDerivation {
     gtk3
     gtkmm3
     imagemagick
-    intltool
     libjack2
     libsigcxx
     libxmlxx
diff --git a/pkgs/applications/graphics/xaos/default.nix b/pkgs/applications/graphics/xaos/default.nix
index 15c2d468fb4..2ba96fda3f0 100644
--- a/pkgs/applications/graphics/xaos/default.nix
+++ b/pkgs/applications/graphics/xaos/default.nix
@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  nativeBuildInputs = [ intltool ];
   buildInputs = [
     aalib gsl libpng libX11 xorgproto libXext
-    libXt zlib gettext intltool perl
+    libXt zlib gettext perl
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/misc/gv/default.nix b/pkgs/applications/misc/gv/default.nix
index 851f2d80c97..d5aa1ac8817 100644
--- a/pkgs/applications/misc/gv/default.nix
+++ b/pkgs/applications/misc/gv/default.nix
@@ -13,11 +13,11 @@ stdenv.mkDerivation rec {
     "--enable-SIGCHLD-fallback"
   ];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     Xaw3d
     ghostscriptX
     perl
-    pkg-config
   ] ++ lib.optionals stdenv.isDarwin [
     libiconv
   ];
diff --git a/pkgs/applications/misc/gxmessage/default.nix b/pkgs/applications/misc/gxmessage/default.nix
index f7c5714f126..fb172eb22b0 100644
--- a/pkgs/applications/misc/gxmessage/default.nix
+++ b/pkgs/applications/misc/gxmessage/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "db4e1655fc58f31e5770a17dfca4e6c89028ad8b2c8e043febc87a0beedeef05";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk3 texinfo ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk3 texinfo ];
 
   meta = {
     description = "A GTK enabled dropin replacement for xmessage";
diff --git a/pkgs/applications/misc/mdzk/default.nix b/pkgs/applications/misc/mdzk/default.nix
index 3144f59476b..98bcda9943f 100644
--- a/pkgs/applications/misc/mdzk/default.nix
+++ b/pkgs/applications/misc/mdzk/default.nix
@@ -8,10 +8,15 @@ rustPlatform.buildRustPackage rec {
     owner = "mdzk-rs";
     repo = "mdzk";
     rev = version;
-    sha256 = "sha256-V//tVcIzhCh03VjwMC+R2ynaOFm+dp6qxa0oqBfvGUs=";
+    hash = "sha256-V//tVcIzhCh03VjwMC+R2ynaOFm+dp6qxa0oqBfvGUs=";
   };
 
-  cargoSha256 = "sha256-2lPckUhnyfHaVWXzZXKliolDZiPtNl9UBZIKs6tUaNQ=";
+  cargoPatches = [
+    # Remove when new version of mdzk is released.
+    ./update-mdbook-for-rust-1.64.patch
+  ];
+
+  cargoHash = "sha256-5zGUBvmf68tCk5jGrNn+ukgYbiKzrlmZvWrYgoJf2zk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/applications/misc/mdzk/update-mdbook-for-rust-1.64.patch b/pkgs/applications/misc/mdzk/update-mdbook-for-rust-1.64.patch
new file mode 100644
index 00000000000..79b7240b96f
--- /dev/null
+++ b/pkgs/applications/misc/mdzk/update-mdbook-for-rust-1.64.patch
@@ -0,0 +1,246 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index ae63793..4068e02 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -162,12 +162,46 @@ dependencies = [
+  "ansi_term",
+  "atty",
+  "bitflags",
+- "strsim",
+- "textwrap",
++ "strsim 0.8.0",
++ "textwrap 0.11.0",
+  "unicode-width",
+  "vec_map",
+ ]
+ 
++[[package]]
++name = "clap"
++version = "3.2.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8e538f9ee5aa3b3963f09a997035f883677966ed50fce0292611927ce6f6d8c6"
++dependencies = [
++ "atty",
++ "bitflags",
++ "clap_lex",
++ "indexmap",
++ "lazy_static",
++ "strsim 0.10.0",
++ "termcolor",
++ "textwrap 0.15.1",
++]
++
++[[package]]
++name = "clap_complete"
++version = "3.2.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3f7a2e0a962c45ce25afce14220bc24f9dade0a1787f185cecf96bfba7847cd8"
++dependencies = [
++ "clap 3.2.2",
++]
++
++[[package]]
++name = "clap_lex"
++version = "0.2.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
++dependencies = [
++ "os_str_bytes",
++]
++
+ [[package]]
+ name = "cpufeatures"
+ version = "0.2.1"
+@@ -222,9 +256,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "env_logger"
+-version = "0.7.1"
++version = "0.9.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
++checksum = "c90bf5f19754d10198ccb95b70664fc925bd1fc090a0fd9a6ebc54acc8cd6272"
+ dependencies = [
+  "atty",
+  "humantime",
+@@ -385,15 +419,6 @@ dependencies = [
+  "version_check",
+ ]
+ 
+-[[package]]
+-name = "getopts"
+-version = "0.2.21"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
+-dependencies = [
+- "unicode-width",
+-]
+-
+ [[package]]
+ name = "getrandom"
+ version = "0.1.16"
+@@ -471,7 +496,7 @@ dependencies = [
+  "log",
+  "pest",
+  "pest_derive",
+- "quick-error 2.0.1",
++ "quick-error",
+  "serde",
+  "serde_json",
+ ]
+@@ -575,12 +600,9 @@ checksum = "6456b8a6c8f33fee7d958fcd1b60d55b11940a79e63ae87013e6d22e26034440"
+ 
+ [[package]]
+ name = "humantime"
+-version = "1.3.0"
++version = "2.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+-dependencies = [
+- "quick-error 1.2.3",
+-]
++checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+ 
+ [[package]]
+ name = "hyper"
+@@ -822,13 +844,14 @@ checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
+ 
+ [[package]]
+ name = "mdbook"
+-version = "0.4.15"
++version = "0.4.21"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "241f10687eb3b4e0634b3b4e423f97c5f1efbd69dc9522e24a8b94583eeec3c6"
++checksum = "23f3e133c6d515528745ffd3b9f0c7d975ae039f0b6abb099f2168daa2afb4f9"
+ dependencies = [
+  "anyhow",
+  "chrono",
+- "clap",
++ "clap 3.2.2",
++ "clap_complete",
+  "env_logger",
+  "handlebars",
+  "lazy_static",
+@@ -838,7 +861,6 @@ dependencies = [
+  "pulldown-cmark",
+  "regex",
+  "serde",
+- "serde_derive",
+  "serde_json",
+  "shlex",
+  "tempfile",
+@@ -1062,6 +1084,12 @@ dependencies = [
+  "winapi 0.3.9",
+ ]
+ 
++[[package]]
++name = "os_str_bytes"
++version = "6.3.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9ff7415e9ae3fff1225851df9e0d9e4e5479f947619774677a63572e55e80eff"
++
+ [[package]]
+ name = "parking_lot"
+ version = "0.11.2"
+@@ -1258,17 +1286,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "34f197a544b0c9ab3ae46c359a7ec9cbbb5c7bf97054266fecb7ead794a181d6"
+ dependencies = [
+  "bitflags",
+- "getopts",
+  "memchr",
+  "unicase",
+ ]
+ 
+-[[package]]
+-name = "quick-error"
+-version = "1.2.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+-
+ [[package]]
+ name = "quick-error"
+ version = "2.0.1"
+@@ -1386,9 +1407,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "regex"
+-version = "1.5.4"
++version = "1.6.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
++checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+ dependencies = [
+  "aho-corasick",
+  "memchr",
+@@ -1403,9 +1424,9 @@ checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+ 
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.25"
++version = "0.6.27"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
++checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+ 
+ [[package]]
+ name = "remove_dir_all"
+@@ -1577,13 +1598,19 @@ version = "0.8.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+ 
++[[package]]
++name = "strsim"
++version = "0.10.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
++
+ [[package]]
+ name = "structopt"
+ version = "0.3.26"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "0c6b5c64445ba8094a6ab0c3cd2ad323e07171012d9c98b0b15651daf1787a10"
+ dependencies = [
+- "clap",
++ "clap 2.33.3",
+  "lazy_static",
+  "structopt-derive",
+ ]
+@@ -1673,6 +1700,12 @@ dependencies = [
+  "unicode-width",
+ ]
+ 
++[[package]]
++name = "textwrap"
++version = "0.15.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "949517c0cf1bf4ee812e2e07e08ab448e3ae0d23472aee8a06c985f0c8815b16"
++
+ [[package]]
+ name = "thiserror"
+ version = "1.0.30"
+diff --git a/Cargo.toml b/Cargo.toml
+index dfeeb45..8b1e4e5 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -38,7 +38,7 @@ handlebars = "4.2.1"
+ ignore = "0.4.18"
+ lazy_static = "1.4.0"
+ lazy-regex = "2.2.2"
+-mdbook = { version = "0.4.15", default-features = false }
++mdbook = { version = "0.4.21", default-features = false }
+ notify = "4.0.17"
+ pest = "2.1.3"
+ pest_derive = "2.1.0"
+diff --git a/src/renderer/mdzk_renderer.rs b/src/renderer/mdzk_renderer.rs
+index 55b2423..f8480ca 100644
+--- a/src/renderer/mdzk_renderer.rs
++++ b/src/renderer/mdzk_renderer.rs
+@@ -92,7 +92,7 @@ impl Renderer for HtmlMdzk {
+             "description",
+             json!(ctx.config.book.description.clone().unwrap_or_default()),
+         );
+-        if let Some(ref livereload) = html_config.livereload_url {
++        if let Some(ref livereload) = html_config.live_reload_endpoint {
+             data.insert("livereload", json!(livereload));
+         }
+         data.insert("fold_enable", json!(html_config.fold.enable));
diff --git a/pkgs/applications/misc/pcmanx-gtk2/default.nix b/pkgs/applications/misc/pcmanx-gtk2/default.nix
index dffbd2079ae..2e75791e308 100644
--- a/pkgs/applications/misc/pcmanx-gtk2/default.nix
+++ b/pkgs/applications/misc/pcmanx-gtk2/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0fbwd149wny67rfhczz4cbh713a1qnswjiz7b6c2bxfcwh51f9rc";
   };
 
-  nativeBuildInputs = [ pkg-config automake autoconf ];
-  buildInputs = [ gtk2 libXft intltool libtool ];
+  nativeBuildInputs = [ pkg-config automake autoconf intltool ];
+  buildInputs = [ gtk2 libXft libtool ];
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/applications/misc/udevil/default.nix b/pkgs/applications/misc/udevil/default.nix
index 536d800001b..9c50b189cc1 100644
--- a/pkgs/applications/misc/udevil/default.nix
+++ b/pkgs/applications/misc/udevil/default.nix
@@ -20,11 +20,10 @@ stdenv.mkDerivation rec {
     sha256 = "0nd44r8rbxifx4x4m24z5aji1c6k1fhw8cmf5s43wd5qys0bcdad";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
 
   buildInputs = [
     glib
-    intltool
     udev
   ];
 
diff --git a/pkgs/applications/misc/xpad/default.nix b/pkgs/applications/misc/xpad/default.nix
index dbb5eb42e1d..2a14cbe24fb 100644
--- a/pkgs/applications/misc/xpad/default.nix
+++ b/pkgs/applications/misc/xpad/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "1qpmlwn0bcw1q73ag0l0fdnlzmwawfvsy4g9y5b0vyrc58lcp5d3";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook intltool ];
 
-  buildInputs = [ glib intltool gtk3 gtksourceview ];
+  buildInputs = [ glib gtk3 gtksourceview ];
 
   meta = with lib; {
     description = "A sticky note application for jotting down things to remember";
diff --git a/pkgs/applications/misc/xxkb/default.nix b/pkgs/applications/misc/xxkb/default.nix
index d6514e58517..5e76e3a14d5 100644
--- a/pkgs/applications/misc/xxkb/default.nix
+++ b/pkgs/applications/misc/xxkb/default.nix
@@ -23,14 +23,14 @@ stdenv.mkDerivation rec {
     sha256 = "0hl1i38z9xnbgfjkaz04vv1n8xbgfg88g5z8fyzyb2hxv2z37anf";
   };
 
-  nativeBuildInputs = [ imake gccmakedep ];
+  nativeBuildInputs = [ imake gccmakedep pkg-config ];
 
   buildInputs = [
     libX11
     libXt
     libXext
     libXpm
-  ] ++ lib.optionals svgSupport [ librsvg glib gdk-pixbuf pkg-config ];
+  ] ++ lib.optionals svgSupport [ librsvg glib gdk-pixbuf ];
 
   outputs = [ "out" "man" ];
 
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index b22a334b64f..afee9cf4f61 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -325,7 +325,7 @@ let
 
     buildPhase = let
       buildCommand = target: ''
-        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/pkgs/applications/networking/ids/snort/default.nix b/pkgs/applications/networking/ids/snort/default.nix
index 938626806ca..46394c107de 100644
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xrc7crchflfrk4x5dq5zx22zkmgcrbkww5r1pvkc3cyyr18cc6h";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pkg-config luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
+  nativeBuildInputs = [ makeWrapper pkg-config ];
+  buildInputs = [ luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
 
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
index 52204d5c79c..aa871df5e8a 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   postInstall = "ln -s \$out/lib/pidgin \$out/share/pidgin-otr";
 
-  buildInputs = [ libotr pidgin intltool ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ libotr pidgin ];
 
   meta = with lib; {
     homepage = "https://otr.cypherpunks.ca/";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
index 9afdee8cda1..70cb3a9028d 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-CdA/aUu+CmCRbVBKpJGydicqFQa/rEsLWS3MBKlH2/M=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ glib intltool libappindicator-gtk2 libtool pidgin ];
+  nativeBuildInputs = [ autoreconfHook intltool ];
+  buildInputs = [ glib libappindicator-gtk2 libtool pidgin ];
 
   meta = with lib; {
     description = "An AppIndicator and KStatusNotifierItem Plugin for Pidgin";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
index f393a17c1bc..7c076cb3724 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g5hmy7fwgjq59j52h9yps28jsjjrfkd4r18gyx6hfd3g3kzbg1b";
   };
 
-  buildInputs = [ pidgin intltool python2 ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ pidgin python2 ];
 
   meta = with lib; {
     homepage = "https://bitbucket.org/rekkanoryo/purple-plugin-pack";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index 84f8f327cad..15e830b7687 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -16,7 +16,7 @@ let unwrapped = stdenv.mkDerivation rec {
     sha256 = "sha256-RUsbkovGvLsYM1OvMPv95VlfIkWjQjoaRubJei3yKBA=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper intltool ];
 
   NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
@@ -27,7 +27,7 @@ let unwrapped = stdenv.mkDerivation rec {
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
     libxml2 nss nspr
     libXScrnSaver python-with-dbus
-    avahi dbus dbus-glib intltool libidn
+    avahi dbus dbus-glib libidn
     libICE libXext libSM cyrus_sasl
     libgnt ncurses # optional: build finch - the console UI
   ]
diff --git a/pkgs/applications/networking/seahub/default.nix b/pkgs/applications/networking/seahub/default.nix
index bf236e179cc..70cb96ed136 100644
--- a/pkgs/applications/networking/seahub/default.nix
+++ b/pkgs/applications/networking/seahub/default.nix
@@ -21,6 +21,7 @@ in
 python.pkgs.buildPythonApplication rec {
   pname = "seahub";
   version = "9.0.6";
+  format = "other";
 
   src = fetchFromGitHub {
     owner = "haiwen";
diff --git a/pkgs/applications/networking/sync/lsyncd/default.nix b/pkgs/applications/networking/sync/lsyncd/default.nix
index 7690bf6ee54..3e52d664d52 100644
--- a/pkgs/applications/networking/sync/lsyncd/default.nix
+++ b/pkgs/applications/networking/sync/lsyncd/default.nix
@@ -31,10 +31,10 @@ stdenv.mkDerivation rec {
 
   dontUseCmakeBuildDir = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     rsync
-    lua pkg-config
+    lua
     asciidoc libxml2 docbook_xml_dtd_45 docbook_xsl libxslt
   ];
 
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 251c7795132..9e5294c4b00 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
     gettext
     makeWrapper
     wrapGAppsHook
+    pkg-config
   ];
 
   buildInputs = [
@@ -55,7 +56,6 @@ stdenv.mkDerivation rec {
     libofx
     libxml2
     libxslt
-    pkg-config
     swig
     webkitgtk
   ]
diff --git a/pkgs/applications/office/grisbi/default.nix b/pkgs/applications/office/grisbi/default.nix
index ff0d75711cf..81f97b116b0 100644
--- a/pkgs/applications/office/grisbi/default.nix
+++ b/pkgs/applications/office/grisbi/default.nix
@@ -19,12 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vTrbq/xLTfwF7/YtKzZFiiSw8A0HzzWin2ry8gPHej8=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
   buildInputs = [
     gtk
     libgsf
     libofx
-    intltool
     libsoup
     gnome.adwaita-icon-theme
   ];
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index 2a00811a449..17a9cbb5924 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Rg6OjHLkwVIDnXqzqPXA8DxqSdrh2T6V/gLBND8vx9o=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
-  buildInputs = [ gtk libofx intltool libsoup gnome.adwaita-icon-theme ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
+  buildInputs = [ gtk libofx libsoup gnome.adwaita-icon-theme ];
 
   meta = with lib; {
     description = "Free, easy, personal accounting for everyone";
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index c4435ca6269..43a1571b46e 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -555,7 +555,6 @@ in
     openssl
     pam
     perl
-    pkg-config
     poppler
     python3
     sane-backends
diff --git a/pkgs/applications/radio/rtl-ais/default.nix b/pkgs/applications/radio/rtl-ais/default.nix
index c244868f65d..407c18c1a0a 100644
--- a/pkgs/applications/radio/rtl-ais/default.nix
+++ b/pkgs/applications/radio/rtl-ais/default.nix
@@ -3,7 +3,8 @@
 stdenv.mkDerivation {
   pname = "rtl-ais";
   version = "0.8.1";
-  buildInputs = [ pkg-config rtl-sdr libusb1 ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ rtl-sdr libusb1 ];
 
   src = fetchFromGitHub {
     owner = "dgiardini";
diff --git a/pkgs/applications/radio/unixcw/default.nix b/pkgs/applications/radio/unixcw/default.nix
index 0d352609cf0..3fd066ec7b7 100644
--- a/pkgs/applications/radio/unixcw/default.nix
+++ b/pkgs/applications/radio/unixcw/default.nix
@@ -10,7 +10,8 @@ mkDerivation rec {
   patches = [
     ./remove-use-of-dlopen.patch
   ];
-  buildInputs = [ libpulseaudio alsa-lib pkg-config qtbase ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libpulseaudio alsa-lib qtbase ];
   CFLAGS   ="-lasound -lpulse-simple";
 
   meta = with lib; {
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index 59af9a94d96..d47bd418f51 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
   # glib-2.62 deprecations
   NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
-  buildInputs = [ glib pkg-config gtk2 hamlib ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ glib gtk2 hamlib ];
 
   meta = with lib; {
     description = "An amateur radio logging program";
diff --git a/pkgs/applications/science/biology/vcftools/default.nix b/pkgs/applications/science/biology/vcftools/default.nix
index 9f88079627e..a4ec84d4d50 100755
--- a/pkgs/applications/science/biology/vcftools/default.nix
+++ b/pkgs/applications/science/biology/vcftools/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0msb09d2cnm8rlpg8bsc1lhjddvp3kf3i9dsj1qs4qgsdlzhxkyx";
   };
 
-  buildInputs = [ autoreconfHook pkg-config zlib perl ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  buildInputs = [ zlib perl ];
 
   meta = with lib; {
     description = "A set of tools written in Perl and C++ for working with VCF files, such as those generated by the 1000 Genomes Project";
diff --git a/pkgs/applications/science/geometry/drgeo/default.nix b/pkgs/applications/science/geometry/drgeo/default.nix
index 59d7315ef41..0cc8bcb0fb3 100644
--- a/pkgs/applications/science/geometry/drgeo/default.nix
+++ b/pkgs/applications/science/geometry/drgeo/default.nix
@@ -13,8 +13,9 @@ stdenv.mkDerivation rec {
   };
   patches = [ ./struct.patch ];
 
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [libglade gtk2 guile libxml2
-    perl intltool libtool pkg-config];
+    perl libtool ];
 
   prebuild = ''
     cp drgeo.desktop.in drgeo.desktop
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 74f27fa534e..1c8c565528e 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -23,10 +23,11 @@ stdenv.mkDerivation rec {
 
   dontUseImakeConfigure = true;
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     bzip2 gfortran libX11 libXmu libXt libXt libjpeg libpng libtiff ncurses
     pango pcre2 perl readline texLive xz zlib less texinfo graphviz icu
-    pkg-config bison imake which blas lapack curl tcl tk jdk
+    bison imake which blas lapack curl tcl tk jdk
   ] ++ lib.optionals stdenv.isDarwin [ Cocoa Foundation libobjc libcxx ];
 
   patches = [
diff --git a/pkgs/applications/science/math/sage/sage-with-env.nix b/pkgs/applications/science/math/sage/sage-with-env.nix
index 23069f335b8..7632b851773 100644
--- a/pkgs/applications/science/math/sage/sage-with-env.nix
+++ b/pkgs/applications/science/math/sage/sage-with-env.nix
@@ -28,9 +28,9 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 # executable sage. No tests are run yet and no documentation is built.
 
 let
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     pythonEnv # for patchShebangs
-    pkg-config
     blas lapack
     singular
     three
@@ -72,7 +72,7 @@ let
       []
     );
 
-  allInputs = lib.remove null (buildInputs ++ pythonEnv.extraLibs ++ [ makeWrapper ]);
+  allInputs = lib.remove null (nativeBuildInputs ++ buildInputs ++ pythonEnv.extraLibs ++ [ makeWrapper ]);
   transitiveDeps = lib.unique (builtins.concatLists (map transitiveClosure allInputs ));
   # fix differences between spkg and sage names
   # (could patch sage instead, but this is more lightweight and also works for packages depending on sage)
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
   pname = "sage-with-env";
   src = sage-env.lib.src;
 
-  inherit buildInputs;
+  inherit nativeBuildInputs buildInputs;
 
   configurePhase = "#do nothing";
 
diff --git a/pkgs/applications/terminal-emulators/mrxvt/default.nix b/pkgs/applications/terminal-emulators/mrxvt/default.nix
index 006616bd944..b05872b11e4 100644
--- a/pkgs/applications/terminal-emulators/mrxvt/default.nix
+++ b/pkgs/applications/terminal-emulators/mrxvt/default.nix
@@ -22,7 +22,8 @@ stdenv.mkDerivation rec {
     sha256 = "1mqhmnlz32lvld9rc6c1hyz7gjw4anwf39yhbsjkikcgj1das0zl";
   };
 
-  buildInputs = [ libX11 libXft libXi xorgproto libSM libICE freetype pkg-config which ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libX11 libXft libXi xorgproto libSM libICE freetype which ];
 
   configureFlags = [
     "--with-x"
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
index 0eccceb5a4f..ede0638e7a0 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@@ -44,9 +44,10 @@ stdenv.mkDerivation {
     sha256 = "0badnkjsn3zps24r5iggj8k5v4f00npc77wqg92pcn1q5z8r677y";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
     [ libX11 libXt libXft ncurses  # required to build the terminfo file
-      fontconfig freetype pkg-config libXrender
+      fontconfig freetype libXrender
       libptytty
     ] ++ optional perlSupport perl
       ++ optional gdkPixbufSupport gdk-pixbuf;
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 95327f31ddc..9b2c755b109 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '';
 
-  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
+  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper pkg-config ]
     ++ lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
          docbook_xsl docbook_xml_dtd_45 libxslt ];
   buildInputs = [ curl openssl zlib expat cpio libiconv bash ]
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
     ++ lib.optionals stdenv.isDarwin [ Security CoreServices ]
-    ++ lib.optionals withLibsecret [ pkg-config glib libsecret ];
+    ++ lib.optionals withLibsecret [ glib libsecret ];
 
   # required to support pthread_cancel()
   NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && stdenv.hostPlatform.libc == "glibc") "-lgcc_s"
@@ -252,7 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
       '')
 
    + lib.optionalString withManual ''# Install man pages
-       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
+       make -j $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
          -C Documentation ''
 
    + (if guiSupport then ''
diff --git a/pkgs/applications/video/byzanz/default.nix b/pkgs/applications/video/byzanz/default.nix
index 5e60bb7fd90..d7ad9846306 100644
--- a/pkgs/applications/video/byzanz/default.nix
+++ b/pkgs/applications/video/byzanz/default.nix
@@ -34,12 +34,11 @@ stdenv.mkDerivation {
     "-Wno-error=incompatible-pointer-types"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
     which
     gnome.gnome-common
     glib
-    intltool
     libtool
     cairo
     gtk3
diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix
index cde71d2b87f..234d72e4682 100644
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@@ -66,9 +66,9 @@ stdenv.mkDerivation (rec {
 
   hardeningDisable = [ "stackprotector" "fortify" "pic" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [
-    cmake which
+    which
 
     # Xen
     bison bzip2 checkpolicy dev86 figlet flex gettext glib acpica-tools libaio
diff --git a/pkgs/applications/window-managers/fbpanel/default.nix b/pkgs/applications/window-managers/fbpanel/default.nix
index 33a313eb8ee..6dc22a664d3 100644
--- a/pkgs/applications/window-managers/fbpanel/default.nix
+++ b/pkgs/applications/window-managers/fbpanel/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/fbpanel/${pname}-${version}.tbz2";
     sha256 = "e14542cc81ea06e64dd4708546f5fd3f5e01884c3e4617885c7ef22af8cf3965";
   };
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config libX11 libXmu libXpm gtk2 libpng libjpeg libtiff librsvg gdk-pixbuf gdk-pixbuf-xlib.dev ];
+    [ libX11 libXmu libXpm gtk2 libpng libjpeg libtiff librsvg gdk-pixbuf gdk-pixbuf-xlib.dev ];
 
   preConfigure = "patchShebangs .";
 
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 83b6817798f..78759f2cfbb 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -122,6 +122,31 @@ fi
 
 if [[ "$isCxx" = 1 ]]; then
     if [[ "$cxxInclude" = 1 ]]; then
+        #
+        # The motivation for this comment is to explain the reason for appending
+        # the C++ stdlib to NIX_CFLAGS_COMPILE, which I initially thought should
+        # change and later realized it shouldn't in:
+        #
+        #   https://github.com/NixOS/nixpkgs/pull/185569#issuecomment-1234959249
+        #
+        # NIX_CFLAGS_COMPILE contains dependencies added using "-isystem", and
+        # NIX_CXXSTDLIB_COMPILE adds the C++ stdlib using "-isystem". Appending
+        # NIX_CXXSTDLIB_COMPILE to NIX_CLAGS_COMPILE emulates this part of the
+        # include lookup order from GCC/Clang:
+        #
+        # > 4. Directories specified with -isystem options are scanned in
+        # >    left-to-right order.
+        # > 5. Standard system directories are scanned.
+        # > 6. Directories specified with -idirafter options are scanned
+        # >    in left-to-right order.
+        #
+        # NIX_CXX_STDLIB_COMPILE acts as the "standard system directories" that
+        # are otherwise missing from CC in nixpkgs, so should be added last.
+        #
+        # This means that the C standard library should never be present inside
+        # NIX_CFLAGS_COMPILE, because it MUST come after the C++ stdlib. It is
+        # added automatically by cc-wrapper later using "-idirafter".
+        #
         NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
     fi
     if [[ "$cxxLibrary" = 1 ]]; then
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 84700ff29af..812831c2959 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -124,7 +124,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
   ];
 
   buildInputs = buildInputs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ]
     ++ lib.optionals stdenv.hostPlatform.isMinGW [ windows.pthreads ];
 
   patches = cargoPatches ++ patches;
diff --git a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
index 842e66b5170..b85796e2a41 100644
--- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@@ -7,23 +7,23 @@ cargoSetupPostUnpackHook() {
     # this for us automatically.
     if [ -z $cargoVendorDir ]; then
         unpackFile "$cargoDeps"
-        export cargoDepsCopy=$(stripHash $cargoDeps)
+        export cargoDepsCopy="$(realpath "$(stripHash $cargoDeps)")"
     else
-      cargoDepsCopy="$sourceRoot/${cargoRoot:+$cargoRoot/}${cargoVendorDir}"
+        cargoDepsCopy="$(realpath "$(pwd)/$sourceRoot/${cargoRoot:+$cargoRoot/}${cargoVendorDir}")"
     fi
 
     if [ ! -d .cargo ]; then
         mkdir .cargo
     fi
 
-    config="$(pwd)/$cargoDepsCopy/.cargo/config";
+    config="$cargoDepsCopy/.cargo/config";
     if [[ ! -e $config ]]; then
       config=@defaultConfig@
     fi;
 
     tmp_config=$(mktemp)
     substitute $config $tmp_config \
-      --subst-var-by vendor "$(pwd)/$cargoDepsCopy"
+      --subst-var-by vendor "$cargoDepsCopy"
     cat ${tmp_config} >> .cargo/config
 
     cat >> .cargo/config <<'EOF'
@@ -39,8 +39,8 @@ EOF
 cargoSetupPostPatchHook() {
     echo "Executing cargoSetupPostPatchHook"
 
-    cargoDepsLockfile="$NIX_BUILD_TOP/$cargoDepsCopy/Cargo.lock"
-    srcLockfile="$NIX_BUILD_TOP/$sourceRoot/${cargoRoot:+$cargoRoot/}/Cargo.lock"
+    cargoDepsLockfile="$cargoDepsCopy/Cargo.lock"
+    srcLockfile="$(pwd)/${cargoRoot:+$cargoRoot/}Cargo.lock"
 
     echo "Validating consistency between $srcLockfile and $cargoDepsLockfile"
     if ! @diff@ $srcLockfile $cargoDepsLockfile; then
diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index 9f52a05f61c..c9b03b75cd0 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -16,12 +16,14 @@ makeSetupHook {
 
   substitutions = {
     cc = "${cc}/bin/${cc.targetPrefix}cc ${lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)}";
+  };
 
+  passthru = {
     # Extract the function call used to create a binary wrapper from its embedded docstring
-    passthru.extractCmd = writeShellScript "extract-binary-wrapper-cmd" ''
+    extractCmd = writeShellScript "extract-binary-wrapper-cmd" ''
       strings -dw "$1" | sed -n '/^makeCWrapper/,/^$/ p'
     '';
 
-    passthru.tests = tests.makeBinaryWrapper;
+    tests = tests.makeBinaryWrapper;
   };
 } ./make-binary-wrapper.sh
diff --git a/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix b/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
index d0031c93c10..e9e77b0bbe6 100644
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
@@ -1,9 +1,8 @@
 { callPackage, makeSetupHook }:
 
-(makeSetupHook {
+makeSetupHook {
   name = "postgresql-test-hook";
-} ./postgresql-test-hook.sh).overrideAttrs (o: {
   passthru.tests = {
     simple = callPackage ./test.nix { };
   };
-})
+} ./postgresql-test-hook.sh
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
index d7699b2557f..5ef61383885 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@@ -13,6 +13,7 @@
 }:
 
 makeSetupHook {
+  name = "wrap-gapps-hook";
   deps = lib.optionals (!stdenv.isDarwin) [
     # It is highly probable that a program will use GSettings,
     # at minimum through GTK file chooser dialogue.
@@ -36,8 +37,8 @@ makeSetupHook {
     # We use the wrapProgram function.
     makeWrapper
   ];
-  substitutions = {
-    passthru.tests = let
+  passthru = {
+    tests = let
       sample-project = ./tests/sample-project;
 
       testLib = callPackage ./tests/lib.nix { };
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index e73cb9c5dec..a8c291b8232 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -1,5 +1,12 @@
 { lib, stdenv, stdenvNoCC, lndir, runtimeShell, shellcheck }:
 
+let
+  inherit (lib)
+    optionalAttrs
+    warn
+    ;
+in
+
 rec {
 
   /* Run the shell command `buildCommand' to produce a store path named
@@ -525,12 +532,25 @@ rec {
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
    *                 meta.platforms = lib.platforms.linux;
    *               } ./myscript.sh;
+   *
+   * # setup hook with a package test
+   * myhellohookTested = makeSetupHook {
+   *                 deps = [ hello ];
+   *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
+   *                 meta.platforms = lib.platforms.linux;
+   *                 passthru.tests.greeting = callPackage ./test { };
+   *               } ./myscript.sh;
    */
-  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {} }: script:
+  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {}, passthru ? {} }: script:
     runCommand name
       (substitutions // {
         inherit meta;
         strictDeps = true;
+        # TODO 2023-01, no backport: simplify to inherit passthru;
+        passthru = passthru
+          // optionalAttrs (substitutions?passthru)
+            (warn "makeSetupHook (name = ${lib.strings.escapeNixString name}): `substitutions.passthru` is deprecated. Please set `passthru` directly."
+              substitutions.passthru);
       })
       (''
         mkdir -p $out/nix-support
diff --git a/pkgs/data/icons/tango-icon-theme/default.nix b/pkgs/data/icons/tango-icon-theme/default.nix
index 9e6b0666a11..18676018eff 100644
--- a/pkgs/data/icons/tango-icon-theme/default.nix
+++ b/pkgs/data/icons/tango-icon-theme/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./rsvg-convert.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool iconnamingutils imagemagick librsvg ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ iconnamingutils imagemagick librsvg ];
   propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
   # still missing parent icon themes: cristalsvg
 
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 0ed4f95f8cf..a4739edea12 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.80";
+  srcVersion = "3.83";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -35,7 +35,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "sha256-wL8f0sfimmsCswliK6r8RD7skMiTS7FV2ku5iYh4S2o=";
+      sha256 = "sha256-qyPqZ/lkCQuLc8gKZ0CCVxw25fTrqSBXrGSMnB3vASg=";
     };
 
     dontBuild = true;
diff --git a/pkgs/data/misc/ddccontrol-db/default.nix b/pkgs/data/misc/ddccontrol-db/default.nix
index efec5c73ba2..3d91a4e7e72 100644
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@@ -21,11 +21,10 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake intltool ];
   buildInputs =
     [
       libtool
-      intltool
     ];
 
   meta = with lib; {
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index 6f90669b819..19331f458de 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,10 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20220520";
+  version = "20220915";
+
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-LSrfNb4fUJEGSPJ+StlAbTE9LbOPDrRJLKTDSkuyoZQ=";
+    sha256 = "sha256-gBaM5YEK2XA42S7ELwjQChie/wYgo6n8dt2WEg3Pdns=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/misc/media-player-info/default.nix b/pkgs/data/misc/media-player-info/default.nix
index 56e4ace41f4..652298d1656 100644
--- a/pkgs/data/misc/media-player-info/default.nix
+++ b/pkgs/data/misc/media-player-info/default.nix
@@ -1,31 +1,28 @@
 { lib, stdenv, fetchurl, pkg-config, python3, udev, systemd }:
 
-let
-  name = "media-player-info-24";
-in
+stdenv.mkDerivation rec {
+  pname = "media-player-info";
+  version = "24";
 
-  stdenv.mkDerivation {
-    inherit name;
+  src = fetchurl {
+    url = "https://www.freedesktop.org/software/media-player-info/${pname}-${version}.tar.gz";
+    sha256 = "0d0i7av8v369hzvlynwlrbickv1brlzsmiky80lrjgjh1gdldkz6";
+  };
 
-    src = fetchurl {
-      url = "https://www.freedesktop.org/software/media-player-info/${name}.tar.gz";
-      sha256 = "0d0i7av8v369hzvlynwlrbickv1brlzsmiky80lrjgjh1gdldkz6";
-    };
+  buildInputs = [ udev systemd ];
+  nativeBuildInputs = [ pkg-config python3 ];
 
-    buildInputs = [ udev systemd ];
-    nativeBuildInputs = [ pkg-config python3 ];
+  postPatch = ''
+    patchShebangs ./tools
+  '';
 
-    postPatch = ''
-      patchShebangs ./tools
-    '';
+  configureFlags = [ "--with-udevdir=${placeholder "out"}/lib/udev" ];
 
-    configureFlags = [ "--with-udevdir=${placeholder "out"}/lib/udev" ];
-
-    meta = with lib; {
-      description = "A repository of data files describing media player capabilities";
-      homepage = "https://www.freedesktop.org/wiki/Software/media-player-info/";
-      license = licenses.bsd3;
-      maintainers = with maintainers; [ ttuegel ];
-      platforms = with platforms; linux;
-    };
-  }
+  meta = with lib; {
+    description = "A repository of data files describing media player capabilities";
+    homepage = "https://www.freedesktop.org/wiki/Software/media-player-info/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ttuegel ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 1a6cba44ef8..41004243a55 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2022c";
+  version = "2022d";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-aXT040i/IyMnS1bf+edQAkfjFZ6qS0hd+gzWbnXBS/4=";
+      hash = "sha256-bs2+4n+kPc+knz1P2Lsd/vVMkNoavNgsmrzy3E8yHeA=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-Pnzh82IMwEgZB8fgdNaZEHkyhb/+DKMx7xptGuPqkMw=";
+      hash = "sha256-1kS6D5OImTdOqMtVTjX7SvoPe9e3FsYXd80AUAuHWeA=";
     })
   ];
 
diff --git a/pkgs/desktops/cinnamon/cinnamon-common/default.nix b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
index 9f4e7f9468b..7ddcada83b5 100644
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -102,7 +102,6 @@ stdenv.mkDerivation rec {
     libXdamage
     muffin
     networkmanager
-    pkg-config
     polkit
     libxml2
     libgnomekbd
@@ -134,6 +133,7 @@ stdenv.mkDerivation rec {
     gtk-doc
     perl
     python3.pkgs.wrapPython
+    pkg-config
   ];
 
   # use locales from cinnamon-translations (not using --localedir because datadir is used)
diff --git a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
index 34dfaa85b2f..df63449c2f6 100644
--- a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
@@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ] ++ lib.optionals stdenv.isDarwin [ autoreconfHook ];
   buildInputs = [
     atk cairo glib gtk2
-    pango libxml2Python perl intltool
+    pango libxml2Python perl
     gettext
   ] ++ optionals stdenv.isDarwin [
-    autoreconfHook gnome-common gtk-mac-integration-gtk2
+    gnome-common gtk-mac-integration-gtk2
   ];
 
   preConfigure = optionalString stdenv.isDarwin ''
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
index 580d0a8cc82..72422cf41c3 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
@@ -25,6 +25,6 @@ stdenv.mkDerivation rec {
   ];
 
   propagatedBuildInputs = [ gsettings-desktop-schemas gtk3 gnome-icon-theme GConf ];
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool enchant isocodes autoreconfHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook intltool ];
+  buildInputs = [ enchant isocodes ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
index 4f4e0503f81..206494e7022 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
   #http://www.mail-archive.com/debian-bugs-rc@lists.debian.org/msg250091.html
   patches = [ ./01_remove-disable-deprecated.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 intltool GConf enchant isocodes gnome-icon-theme ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 GConf enchant isocodes gnome-icon-theme ];
 
   NIX_LDFLAGS = "-lgthread-2.0";
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnome/default.nix b/pkgs/desktops/gnome-2/platform/libgnome/default.nix
index 2c70338a900..56145980a5d 100644
--- a/pkgs/desktops/gnome-2/platform/libgnome/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnome/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ popt zlib intltool GConf gnome_vfs libcanberra-gtk2 libtool ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ popt zlib GConf gnome_vfs libcanberra-gtk2 libtool ];
   propagatedBuildInputs = [ glib libbonobo libogg ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix b/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
index 42de8c2471a..8d6bcce6020 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./glib.patch ./cups_1.6.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libart_lgpl ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libart_lgpl ];
 
   propagatedBuildInputs = [ libxml2 ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix b/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
index bb2e435f422..5f7a254c8fb 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libart_lgpl libgnomecups bison flex ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libart_lgpl libgnomecups bison flex ];
 
   propagatedBuildInputs = [ libxml2 ];
 
diff --git a/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix b/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
index a95ee70bca1..f8a647a5b5a 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
@@ -9,6 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "0spl8vinb5n6n1krnfnr61dwaxidg67h8j94z9p59k2xdsvfashm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libgnomecanvas libgnomeprint gnome-icon-theme];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libgnomecanvas libgnomeprint gnome-icon-theme];
 }
diff --git a/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix b/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
index ca9b8f7fb81..e2f556c4869 100644
--- a/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
+++ b/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript { packageName = "gnome-devel-docs"; attrPath = "gnome.gnome-devel-docs"; };
   };
 
-  buildInputs = [ intltool itstool libxml2 ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ itstool libxml2 ];
 
   meta = with lib; {
     homepage = "https://github.com/GNOME/gnome-devel-docs";
diff --git a/pkgs/desktops/gnome/misc/gtkhtml/default.nix b/pkgs/desktops/gnome/misc/gtkhtml/default.nix
index 88fb31c4333..f4454e15bb9 100644
--- a/pkgs/desktops/gnome/misc/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome/misc/gtkhtml/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript { packageName = "gtkhtml"; attrPath = "gnome.gtkhtml"; };
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk3 intltool gnome.adwaita-icon-theme
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk3 gnome.adwaita-icon-theme
                   gsettings-desktop-schemas ];
 
   propagatedBuildInputs = [ enchant isocodes ];
diff --git a/pkgs/desktops/lxde/core/lxmenu-data/default.nix b/pkgs/desktops/lxde/core/lxmenu-data/default.nix
index e52445aa0b0..fc00c4cdad1 100644
--- a/pkgs/desktops/lxde/core/lxmenu-data/default.nix
+++ b/pkgs/desktops/lxde/core/lxmenu-data/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "9fe3218d2ef50b91190162f4f923d6524c364849f87bcda8b4ed8eb59b80bab8";
   };
 
-  buildInputs = [ intltool ];
+  nativeBuildInputs = [ intltool ];
 
   meta = {
     homepage = "https://lxde.org/";
diff --git a/pkgs/development/compilers/gerbil/gerbil-crypto.nix b/pkgs/development/compilers/gerbil/gerbil-crypto.nix
index 12f4726f1c6..38943471a37 100644
--- a/pkgs/development/compilers/gerbil/gerbil-crypto.nix
+++ b/pkgs/development/compilers/gerbil/gerbil-crypto.nix
@@ -7,7 +7,8 @@ gerbil-support.gerbilPackage {
   gerbil-package = "clan/crypto";
   gerbil = gerbil-unstable;
   gerbilInputs = [gerbil-support.gerbilPackages-unstable.gerbil-utils];
-  buildInputs = [pkgs.secp256k1 pkgs.pkg-config];
+  nativeBuildInputs = [ pkgs.pkg-config ];
+  buildInputs = [pkgs.secp256k1 ];
   gambit-params = gambit-support.unstable-params;
   version-path = "version";
   softwareName = "Gerbil-crypto";
diff --git a/pkgs/development/compilers/gerbil/gerbil-support.nix b/pkgs/development/compilers/gerbil/gerbil-support.nix
index 9cb9954544c..f51076fd5d4 100644
--- a/pkgs/development/compilers/gerbil/gerbil-support.nix
+++ b/pkgs/development/compilers/gerbil/gerbil-support.nix
@@ -24,12 +24,13 @@ rec {
     gerbil ? pkgs.gerbil-unstable,
     gambit-params ? pkgs.gambit-support.stable-params,
     gerbilInputs ? [],
+    nativeBuildInputs ? [],
     buildInputs ? [],
     buildScript ? "./build.ss",
     softwareName ? ""} :
     let buildInputs_ = buildInputs; in
     gccStdenv.mkDerivation rec {
-      inherit src meta pname version;
+      inherit src meta pname version nativeBuildInputs;
       passthru = { inherit gerbil-package version-path ;};
       buildInputs = [ gerbil ] ++ gerbilInputs ++ buildInputs_;
       postPatch = ''
diff --git a/pkgs/development/compilers/polyml/5.6.nix b/pkgs/development/compilers/polyml/5.6.nix
index 4354ce7e2d6..bcd52380701 100644
--- a/pkgs/development/compilers/polyml/5.6.nix
+++ b/pkgs/development/compilers/polyml/5.6.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  buildInputs = lib.optional stdenv.isDarwin autoreconfHook;
+  nativeBuildInputs = lib.optional stdenv.isDarwin autoreconfHook;
 
   src = fetchurl {
     url = "mirror://sourceforge/polyml/polyml.${version}.tar.gz";
diff --git a/pkgs/development/compilers/rust/1_63.nix b/pkgs/development/compilers/rust/1_64.nix
index a33576f9426..f93123fcd70 100644
--- a/pkgs/development/compilers/rust/1_63.nix
+++ b/pkgs/development/compilers/rust/1_64.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.63.0";
-  rustcSha256 = "1l4rrbzhxv88pnfq94nbyb9m6lfnjwixma3mwjkmvvs2aqlq158z";
+  rustcVersion = "1.64.0";
+  rustcSha256 = "sha256-s82fSB4aKQG/bzgI0wxpzE6oDZPEzE4u1SJYsYA4EgU=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
@@ -37,25 +37,25 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.62.1";
+  bootstrapVersion = "1.63.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "1669163ffe01e252ffb62da7d84949378fc274931a65ac827d54059a5ffc542c";
-    x86_64-unknown-linux-gnu = "dd7d82b8fa8eae59729e1c31fe59a9de6ee61d08ab40ce016185653beebe04d2";
-    x86_64-unknown-linux-musl = "32bee487074b105e2582cddce35934a6019eec74bae3f9300fdc3edfcf5b66d4";
-    arm-unknown-linux-gnueabihf = "5c735e8174d394936d7b499c2d147ddadf3c4d77e652d1e0b0a72d9d09f81ea4";
-    armv7-unknown-linux-gnueabihf = "26fa731385f1a71211ba8e3c94f3bb3b1a82bde89f8d4dcf75b4b463b57b0f88";
-    aarch64-unknown-linux-gnu = "1311fa8204f895d054c23a3481de3b158a5cd3b3a6338761fee9cdf4dbf075a5";
-    aarch64-unknown-linux-musl = "73bbab4d8a9e3c416035d40406e656ab37e785df35fa069a33af52e931a24b12";
-    x86_64-apple-darwin = "0a04dcf2b521239826f3eaa66d77169d91e68087ccc3107b54e8aba7c02c9adf";
-    aarch64-apple-darwin = "6d1671ea31b05cab5e2587cc2b295b3e7232b0135f0977355618e2a01933ff0a";
-    powerpc64le-unknown-linux-gnu = "1d3248e1a673cda87cf443cd4334ff5fb53e6f87c72d3587b07e5c0cb507f3ae";
-    riscv64gc-unknown-linux-gnu = "fd378d0bf866689e8111aba0e2b020da87f32f70fb11d98a575d42dc05978c2a";
-    mips64el-unknown-linux-gnuabi64 = "b7c47dd94728161aa96762fb7bc51b6ab0feba7c5215d06eaea5b78649815a96";
+    i686-unknown-linux-gnu = "6ac6ca18f119e099749d67c6dc25ce3f70542b43cc05062d5138fc1052e44c54";
+    x86_64-unknown-linux-gnu = "536bcf16807a4ff49b7b29af6e573a2f1821055bfad72c275c60e56edc693984";
+    x86_64-unknown-linux-musl = "4516f1fa2a0d9ec9176cc734e5faaa0a3d439bd49f75553a484b6c3c6d7905ab";
+    arm-unknown-linux-gnueabihf = "8847d8482e1d5ec962e092a63c95618dc7e17a079a9bf58bec1da39cac0ba4ce";
+    armv7-unknown-linux-gnueabihf = "d9227bf6d93f49889c698d35adc7ab3e042988740b9d9d9c81fb54fc0f854474";
+    aarch64-unknown-linux-gnu = "26745b57500da293a8147122a5998926301350a610c164f053107cbe026d3a51";
+    aarch64-unknown-linux-musl = "8fee65f2bd7e010259763939cbef8ed0794773ec8959c5ef90273cf39dcba180";
+    x86_64-apple-darwin = "37f76a45b8616e764c2663850758ce822c730e96af60168a46b818f528c1467d";
+    aarch64-apple-darwin = "25c3f43459da9b8683292999c3522d88980b0ca3244fe830f5a87a8092aac5a6";
+    powerpc64le-unknown-linux-gnu = "781662048caa48b78540c2fb22f0aa7c06d6d8e81aede0f6ef900c11428056cf";
+    riscv64gc-unknown-linux-gnu = "a7f398b45229c5cca833f75421c32897174e365fbbdf78e19b87612736c918aa";
+    mips64el-unknown-linux-gnuabi64 = "19f04c576c9d6b171acba65cfe44edcbcf6134a75a853d2f1538fdb2128ec654";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_63;
+  selectRustPackage = pkgs: pkgs.rust_1_64;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 01b21971438..6a4d01de5ef 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, cacert, rustPlatform, rustc
-, CoreFoundation, Security
+, libiconv, CoreFoundation, Security
 }:
 
 rustPlatform.buildRustPackage {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage {
     (lib.getDev pkgsHostHost.curl)
   ];
   buildInputs = [ cacert file curl python3 openssl zlib ]
-    ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
+    ++ lib.optionals stdenv.isDarwin [ libiconv CoreFoundation Security ];
 
   # cargo uses git-rs which is made for a version of libgit2 from recent master that
   # is not compatible with the current version in nixpkgs.
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 94b7171c02d..e3c20bebd49 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -109,6 +109,9 @@ in stdenv.mkDerivation rec {
     "${setTarget}.musl-root=${pkgsBuildTarget.targetPackages.stdenv.cc.libc}"
   ] ++ optionals (rust.IsNoStdTarget stdenv.targetPlatform) [
     "--disable-docs"
+  ] ++ optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    # https://github.com/rust-lang/rust/issues/92173
+    "--set rust.jemalloc"
   ];
 
   # The bootstrap.py will generated a Makefile that then executes the build.
@@ -135,6 +138,10 @@ in stdenv.mkDerivation rec {
 
     # Useful debugging parameter
     # export VERBOSE=1
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    # See https://github.com/jemalloc/jemalloc/issues/1997
+    # Using a value of 48 should work on both emulated and native x86_64-darwin.
+    export JEMALLOC_SYS_WITH_LG_VADDR=48
   '';
 
   # rustc unfortunately needs cmake to compile llvm-rt but doesn't
@@ -147,9 +154,11 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openssl ]
-    ++ optionals stdenv.isDarwin [ libiconv Security ]
+    ++ optionals stdenv.isDarwin [ Security ]
     ++ optional (!withBundledLLVM) llvmShared;
 
+  depsTargetTargetPropagated = optionals stdenv.isDarwin [ libiconv ];
+
   outputs = [ "out" "man" "doc" ];
   setOutputFlags = false;
 
diff --git a/pkgs/development/embedded/blackmagic/helper.sh b/pkgs/development/embedded/blackmagic/helper.sh
index bae57f633cf..9185253b39d 100755
--- a/pkgs/development/embedded/blackmagic/helper.sh
+++ b/pkgs/development/embedded/blackmagic/helper.sh
@@ -11,7 +11,7 @@ out=${out:-/tmp}
 ################################################################################
 export CFLAGS=$NIX_CFLAGS_COMPILE
 export MAKEFLAGS="\
-  ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}"
+  ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}"
 
 ################################################################################
 PRODUCTS="blackmagic.bin blackmagic.hex blackmagic_dfu.bin blackmagic_dfu.hex"
diff --git a/pkgs/development/interpreters/io/default.nix b/pkgs/development/interpreters/io/default.nix
index 9f6ecb2516e..0777fb8d48b 100644
--- a/pkgs/development/interpreters/io/default.nix
+++ b/pkgs/development/interpreters/io/default.nix
@@ -24,13 +24,14 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
+    pkg-config
   ];
 
   buildInputs = [
     zlib sqlite gmp libffi cairo ncurses freetype
     libGLU libGL libpng libtiff libjpeg readline libsndfile libxml2
     freeglut libsamplerate pcre libevent libedit yajl
-    pkg-config glfw openssl libpthreadstubs libXdmcp
+    glfw openssl libpthreadstubs libXdmcp
     libmemcached python3
   ];
 
diff --git a/pkgs/development/interpreters/qnial/default.nix b/pkgs/development/interpreters/qnial/default.nix
index 1173315192e..74360daa876 100644
--- a/pkgs/development/interpreters/qnial/default.nix
+++ b/pkgs/development/interpreters/qnial/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     owner = "vrthra";
   };
 
-  nativeBuildInputs = [ makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper unzip pkg-config ];
 
   preConfigure = ''
     cd build;
@@ -25,7 +25,6 @@ stdenv.mkDerivation {
   '';
 
   buildInputs = [
-     pkg-config
      ncurses
   ];
 
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index f73c5746cb7..9900d8874b2 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -59,13 +59,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.0.22";
+  version = "2.24.0";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-/ny/MSeILj/HJZp1oMtYViAnLFF0XThSq53YeWBpfy4=";
+    sha256 = "sha256-keTDSxdo+S05mweOFxRIxq8Yyv2nQ5h+0gZKKJVNbZc=";
   };
-  dontDisableStatic = withStatic;
+  dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
   outputBin = "dev"; # sdl-config
 
diff --git a/pkgs/development/libraries/SDL2/find-headers.patch b/pkgs/development/libraries/SDL2/find-headers.patch
index 4792679deb1..8739da91eac 100644
--- a/pkgs/development/libraries/SDL2/find-headers.patch
+++ b/pkgs/development/libraries/SDL2/find-headers.patch
@@ -1,22 +1,23 @@
 diff --git a/sdl2-config.cmake.in b/sdl2-config.cmake.in
-index c570511fa..ca694f595 100644
+index db864aab9..b94e16043 100644
 --- a/sdl2-config.cmake.in
 +++ b/sdl2-config.cmake.in
-@@ -7,7 +7,8 @@ set(includedir "@includedir@")
- set(SDL2_PREFIX "${prefix}")
- set(SDL2_EXEC_PREFIX "${exec_prefix}")
- set(SDL2_LIBDIR "${libdir}")
--set(SDL2_INCLUDE_DIRS "${includedir}/SDL2")
-+set(SDL2_INCLUDE_DIRS "${includedir}/SDL2" $ENV{SDL2_PATH})
+@@ -26,7 +26,9 @@ set_and_check(SDL2_EXEC_PREFIX    "${exec_prefix}")
+ set_and_check(SDL2_BINDIR         "${bindir}")
+ set_and_check(SDL2_INCLUDE_DIR    "${includedir}/SDL2")
+ set_and_check(SDL2_LIBDIR         "${libdir}")
+-set(SDL2_INCLUDE_DIRS             "${includedir};${SDL2_INCLUDE_DIR}")
++
++set(SDL2_INCLUDE_DIRS "${includedir};${SDL2_INCLUDE_DIR}" $ENV{SDL2_PATH})
 +separate_arguments(SDL2_INCLUDE_DIRS)
- set(SDL2_LIBRARIES "-L${SDL2_LIBDIR} @SDL_RLD_FLAGS@ @SDL_LIBS@")
- string(STRIP "${SDL2_LIBRARIES}" SDL2_LIBRARIES)
  
+ set(SDL2_LIBRARIES SDL2::SDL2)
+ set(SDL2_STATIC_LIBRARIES SDL2::SDL2-static)
 diff --git a/sdl2-config.in b/sdl2-config.in
-index 5a2aed292..7c55f0a28 100644
+index f6eca7668..c0cd94590 100644
 --- a/sdl2-config.in
 +++ b/sdl2-config.in
-@@ -42,7 +42,11 @@ while test $# -gt 0; do
+@@ -46,7 +46,11 @@ while test $# -gt 0; do
        echo @SDL_VERSION@
        ;;
      --cflags)
@@ -29,6 +30,3 @@ index 5a2aed292..7c55f0a28 100644
        ;;
  @ENABLE_SHARED_TRUE@    --libs)
  @ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@
--- 
-2.33.1
-
diff --git a/pkgs/development/libraries/SDL2_mixer/default.nix b/pkgs/development/libraries/SDL2_mixer/default.nix
index 2d1ef985381..7e562dddf0f 100644
--- a/pkgs/development/libraries/SDL2_mixer/default.nix
+++ b/pkgs/development/libraries/SDL2_mixer/default.nix
@@ -47,6 +47,8 @@ stdenv.mkDerivation rec {
     timidity
   ];
 
+  outputs = [ "out" "dev" ];
+
   # fix default path to timidity.cfg so MIDI files could be played
   postPatch = ''
     substituteInPlace timidity/options.h \
diff --git a/pkgs/development/libraries/allegro/5.nix b/pkgs/development/libraries/allegro/5.nix
index 6bb1a70b865..0ff8f0ea7fc 100644
--- a/pkgs/development/libraries/allegro/5.nix
+++ b/pkgs/development/libraries/allegro/5.nix
@@ -18,14 +18,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-uNcaeTelFNfg+YjPYc7nK4TrFDxJsEuPhsF8x1cvIYQ=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     texinfo libXext xorgproto libX11 libXpm libXt libXcursor
     alsa-lib zlib libpng libvorbis libXxf86dga libXxf86misc
     libXxf86vm openal libGLU libGL
     libjpeg flac
     libXi libXfixes
-    enet libtheora freetype physfs libopus pkg-config gtk3 pcre libXdmcp
+    enet libtheora freetype physfs libopus gtk3 pcre libXdmcp
     libpulseaudio libpthreadstubs
   ];
 
diff --git a/pkgs/development/libraries/apr-util/default.nix b/pkgs/development/libraries/apr-util/default.nix
index b9756e0e1a1..6f38bfa0d07 100644
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@@ -26,8 +26,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = optional stdenv.isFreeBSD autoreconfHook;
+  nativeBuildInputs = [ makeWrapper ] ++ optional stdenv.isFreeBSD autoreconfHook;
 
   configureFlags = [ "--with-apr=${apr.dev}" "--with-expat=${expat.dev}" ]
     ++ optional (!stdenv.isCygwin) "--with-crypto"
diff --git a/pkgs/development/libraries/dssi/default.nix b/pkgs/development/libraries/dssi/default.nix
index 4f7891910a7..697ff1a857b 100644
--- a/pkgs/development/libraries/dssi/default.nix
+++ b/pkgs/development/libraries/dssi/default.nix
@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "0kl1hzhb7cykzkrqcqgq1dk4xcgrcxv0jja251aq4z4l783jpj7j";
   };
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs =
     [ ladspaH libjack2 liblo alsa-lib qt4 libX11 libsndfile libSM
-      libsamplerate libtool xorgproto libICE pkg-config
+      libsamplerate libtool xorgproto libICE
     ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index f20abe0bfc3..71841e0cfbc 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "expat";
-  version = "2.4.8";
+  version = "2.4.9";
 
   src = fetchurl {
     url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-95uPkEt0nj4NIK/q3s+CScVbLjLU67CJrjeN9HncryU=";
+    sha256 = "sha256-bowHKP5cfNP5OmrM5DBGxeRzbHtLaOAy6TUNqg78A1Q=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 9e7dcfd751c..b518b7527ac 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,4 +1,4 @@
-{ callPackage
+{ callPackage, fetchpatch
 # Darwin frameworks
 , Cocoa, CoreMedia, VideoToolbox
 , stdenv, lib
@@ -10,4 +10,11 @@ callPackage ./generic.nix (rec {
   branch = version;
   sha256 = "sha256-+YpIJSDEdQdSGpB5FNqp77wThOBZG1r8PaGKqJfeKUg=";
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
+  patches = [
+    #  sdl2 recently changed their versioning
+    (fetchpatch {
+      url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
+      hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
+    })
+  ];
 } // args)
diff --git a/pkgs/development/libraries/frame/default.nix b/pkgs/development/libraries/frame/default.nix
index e96aa9394da..f0b37b7e633 100644
--- a/pkgs/development/libraries/frame/default.nix
+++ b/pkgs/development/libraries/frame/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "bc2a20cd3ac1e61fe0461bd3ee8cb250dbcc1fa511fad0686d267744e9c78f3a";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    stdenv pkg-config
+    stdenv
   ] ++ lib.optionals enableX11 [xorg.xorgserver xorg.libX11 xorg.libXext xorg.libXi];
 
   configureFlags = lib.optional enableX11 "--with-x11";
diff --git a/pkgs/development/libraries/ggz_base_libs/default.nix b/pkgs/development/libraries/ggz_base_libs/default.nix
index 687b74fdb3a..162a64eeb5d 100644
--- a/pkgs/development/libraries/ggz_base_libs/default.nix
+++ b/pkgs/development/libraries/ggz_base_libs/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1cw1vg0fbj36zyggnzidx9cbjwfc1yr4zqmsipxnvns7xa2awbdk";
   };
 
-  buildInputs = [ intltool openssl expat libgcrypt ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ openssl expat libgcrypt ];
 
   patchPhase = ''
     substituteInPlace configure \
diff --git a/pkgs/development/libraries/glew/1.10.nix b/pkgs/development/libraries/glew/1.10.nix
index ab2e740cd86..dadab6e610f 100644
--- a/pkgs/development/libraries/glew/1.10.nix
+++ b/pkgs/development/libraries/glew/1.10.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
   buildInputs = if stdenv.isDarwin then [ AGL ] else [ xlibsWrapper libXmu libXi ];
   propagatedBuildInputs = if stdenv.isDarwin then [ OpenGL ] else [ libGLU ]; # GL/glew.h includes GL/glu.h
 
+  outputs = [ "out" "dev" ];
+
   patchPhase = ''
     sed -i 's|lib64|lib|' config/Makefile.linux
     ${optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@@ -32,8 +34,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     mkdir -pv $out/share/doc/glew
-    mkdir -p $out/lib/pkgconfig
-    cp glew*.pc $out/lib/pkgconfig
+    mkdir -p $dev/lib/pkgconfig
+    cp glew*.pc $dev/lib/pkgconfig
     cp -r README.txt LICENSE.txt doc $out/share/doc/glew
   '';
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 942231ebb3e..c6da42738c6 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -96,6 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://gitlab.gnome.org/qyliss/glib/-/commit/339a06d66685107280ca6bdca5da5d96b8222fb5.patch";
       sha256 = "sha256-/NdFkuiJvyass3jTDEJPeciA2Lwe53IUd3kAnKAvTaw=";
     })
+    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
+    ./tests-skip-shared-libs-if-default_library-static.patch
 
     ./skip-timer-test.patch
   ];
diff --git a/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch b/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
new file mode 100644
index 00000000000..681e361896e
--- /dev/null
+++ b/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
@@ -0,0 +1,141 @@
+From b804e4b82cd8e85631112d935543c62ef56783e5 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Tue, 23 Aug 2022 13:13:44 +0000
+Subject: [PATCH] tests: skip shared libs if default_library=static
+
+Otherwise, the build will fail when the toolchain is static-only, even
+with -Ddefault_library=static.  I talked to a Meson developer in their
+IRC channel, who told me that the correct fix was to ensure that
+shared_library is only used if default_library != static.
+
+Part-of: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
+[Backported to 2.72.3]
+---
+ gio/tests/meson.build  | 43 +++++++++++++++++++++++-------------------
+ glib/tests/meson.build |  2 +-
+ tests/meson.build      | 30 +++++++++++++++--------------
+ 3 files changed, 41 insertions(+), 34 deletions(-)
+
+diff --git a/gio/tests/meson.build b/gio/tests/meson.build
+index 3ed23a5f2..7b1aba80d 100644
+--- a/gio/tests/meson.build
++++ b/gio/tests/meson.build
+@@ -203,7 +203,7 @@ if host_machine.system() != 'windows'
+   }
+ 
+   # LD_PRELOAD modules don't work so well with AddressSanitizer
+-  if have_rtld_next and get_option('b_sanitize') == 'none'
++  if have_rtld_next and get_option('default_library') != 'static' and get_option('b_sanitize') == 'none'
+     gio_tests += {
+       'gsocketclient-slow' : {
+         'depends' : [
+@@ -607,24 +607,26 @@ if not meson.is_cross_build() or meson.has_exe_wrapper()
+ 
+   compiler_type = '--compiler=@0@'.format(cc.get_id())
+ 
+-  plugin_resources_c = custom_target('plugin-resources.c',
+-    input : 'test4.gresource.xml',
+-    output : 'plugin-resources.c',
+-    command : [glib_compile_resources,
+-               compiler_type,
+-               '--target=@OUTPUT@',
+-               '--sourcedir=' + meson.current_source_dir(),
+-               '--internal',
+-               '--generate-source',
+-               '--c-name', '_g_plugin',
+-               '@INPUT@'])
++  if get_option('default_library') != 'static'
++    plugin_resources_c = custom_target('plugin-resources.c',
++      input : 'test4.gresource.xml',
++      output : 'plugin-resources.c',
++      command : [glib_compile_resources,
++                 compiler_type,
++                 '--target=@OUTPUT@',
++                 '--sourcedir=' + meson.current_source_dir(),
++                 '--internal',
++                 '--generate-source',
++                 '--c-name', '_g_plugin',
++                 '@INPUT@'])
+ 
+-  shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
+-    link_args : export_dynamic_ldflags,
+-    dependencies : common_gio_tests_deps,
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled
+-  )
++    shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
++      link_args : export_dynamic_ldflags,
++      dependencies : common_gio_tests_deps,
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled
++    )
++  endif
+ 
+   # referenced by test2.gresource.xml
+   big_test_resource = custom_target(
+@@ -917,4 +919,7 @@ if installed_tests_enabled
+ endif
+ 
+ subdir('services')
+-subdir('modules')
++
++if get_option('default_library') != 'static'
++  subdir('modules')
++endif
+diff --git a/glib/tests/meson.build b/glib/tests/meson.build
+index 301158e0f..6203ff45e 100644
+--- a/glib/tests/meson.build
++++ b/glib/tests/meson.build
+@@ -172,7 +172,7 @@ else
+     'include' : {},
+     'unix' : {},
+   }
+-  if have_rtld_next
++  if have_rtld_next and get_option('default_library') != 'static'
+     glib_tests += {
+       'gutils-user-database' : {
+         'depends' : [
+diff --git a/tests/meson.build b/tests/meson.build
+index c95fa1d00..25144c941 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -72,20 +72,22 @@ if ['darwin', 'ios'].contains(host_machine.system())
+   module_suffix = 'so'
+ endif
+ 
+-foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
+-  shared_module(module + '_plugin', 'lib@0@.c'.format(module),
+-    dependencies : [libglib_dep, libgmodule_dep],
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled,
+-    name_suffix : module_suffix
+-  )
+-  shared_library(module + '_library', 'lib@0@.c'.format(module),
+-    dependencies : [libglib_dep, libgmodule_dep],
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled,
+-    name_suffix : module_suffix
+-  )
+-endforeach
++if get_option('default_library') != 'static'
++  foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
++    shared_module(module + '_plugin', 'lib@0@.c'.format(module),
++      dependencies : [libglib_dep, libgmodule_dep],
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled,
++      name_suffix : module_suffix
++    )
++    shared_library(module + '_library', 'lib@0@.c'.format(module),
++      dependencies : [libglib_dep, libgmodule_dep],
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled,
++      name_suffix : module_suffix
++    )
++  endforeach
++endif
+ 
+ common_c_args = test_cargs + ['-DGLIB_DISABLE_DEPRECATION_WARNINGS']
+ common_deps = [libm, thread_dep, libglib_dep]
+-- 
+2.37.1
+
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index ec57ef27e94..728b97d2f5f 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -81,7 +81,7 @@ callPackage ./common.nix { inherit stdenv; } {
 
     postInstall = (if stdenv.hostPlatform == stdenv.buildPlatform then ''
       echo SUPPORTED-LOCALES=C.UTF-8/UTF-8 > ../glibc-2*/localedata/SUPPORTED
-      make -j''${NIX_BUILD_CORES:-1} -l''${NIX_BUILD_CORES:-1} localedata/install-locales
+      make -j''${NIX_BUILD_CORES:-1} localedata/install-locales
     '' else lib.optionalString stdenv.buildPlatform.isLinux ''
       # This is based on http://www.linuxfromscratch.org/lfs/view/development/chapter06/glibc.html
       # Instead of using their patch to build a build-native localedef,
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 226b91b0ce5..d04fda98c7f 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -22,11 +22,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.7.7";
+  version = "3.7.8";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "sha256-vpFD0NWOq2TbqbdxFKqvrFKbbA1+gd5r3xybWQJ9IQY=";
+    sha256 = "sha256-xYrTmvBnDv5qiu5eOosjMaEgBBi2S3xRl3+zltRhcRQ=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index b378c81c89f..e9f324b2453 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, substituteAll
 , meson
 , ninja
 , gettext
@@ -19,6 +20,7 @@
 , libkate
 , lrdf
 , ladspaH
+, lcms2
 , libnice
 , webrtc-audio-processing
 , webrtc-audio-processing_1
@@ -77,6 +79,7 @@
 , mjpegtools
 , libGLU
 , libGL
+, addOpenGLRunpath
 , libintl
 , game-music-emu
 , openssl
@@ -108,6 +111,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ehHBO1XdHSOG3ZAiGeQcv83ajh4Ko+c4GGyVB0s12k8=";
   };
 
+  patches = [
+    # Add fallback paths for nvidia userspace libraries
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit (addOpenGLRunpath) driverLink;
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -126,6 +137,7 @@ stdenv.mkDerivation rec {
     gst-plugins-base
     orc
     json-glib
+    lcms2
     ldacbt
     libass
     libkate
diff --git a/pkgs/development/libraries/gstreamer/bad/fix-paths.patch b/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
new file mode 100644
index 00000000000..dfb8f5462c4
--- /dev/null
+++ b/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
@@ -0,0 +1,48 @@
+diff --git a/sys/nvcodec/gstcudaloader.c b/sys/nvcodec/gstcudaloader.c
+index 4223ba1fbd..ca8bb5ceb1 100644
+--- a/sys/nvcodec/gstcudaloader.c
++++ b/sys/nvcodec/gstcudaloader.c
+@@ -135,6 +135,11 @@ gst_cuda_load_library (void)
+     return TRUE;
+ 
+   module = g_module_open (filename, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open("@driverLink@/lib/" CUDA_LIBNAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s", filename, g_module_error ());
+     return FALSE;
+diff --git a/sys/nvcodec/gstcuvidloader.c b/sys/nvcodec/gstcuvidloader.c
+index 3c7505ca36..eeb376fa80 100644
+--- a/sys/nvcodec/gstcuvidloader.c
++++ b/sys/nvcodec/gstcuvidloader.c
+@@ -85,6 +85,11 @@ gst_cuvid_load_library (guint api_major_ver, guint api_minor_ver)
+     return TRUE;
+ 
+   module = g_module_open (filename, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open ("@driverLink@/lib/" NVCUVID_LIBNAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s", filename, g_module_error ());
+     return FALSE;
+diff --git a/sys/nvcodec/gstnvenc.c b/sys/nvcodec/gstnvenc.c
+index 19637671ad..39858ccdee 100644
+--- a/sys/nvcodec/gstnvenc.c
++++ b/sys/nvcodec/gstnvenc.c
+@@ -874,6 +874,11 @@ gst_nvenc_load_library (guint * api_major_ver, guint * api_minor_ver)
+   };
+ 
+   module = g_module_open (NVENC_LIBRARY_NAME, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open ("@driverLink@/lib/" NVENC_LIBRARY_NAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s",
+         NVENC_LIBRARY_NAME, g_module_error ());
diff --git a/pkgs/development/libraries/gtk-engines/default.nix b/pkgs/development/libraries/gtk-engines/default.nix
index e553efa5f25..d722143b210 100644
--- a/pkgs/development/libraries/gtk-engines/default.nix
+++ b/pkgs/development/libraries/gtk-engines/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1db65pb0j0mijmswrvpgkdabilqd23x22d95hp5kwxvcramq1dhm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk2 ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 ];
 
   meta = {
     description = "Theme engines for GTK 2";
diff --git a/pkgs/development/libraries/gtkspell/default.nix b/pkgs/development/libraries/gtkspell/default.nix
index aca6ccdcccb..6f48ba4e266 100644
--- a/pkgs/development/libraries/gtkspell/default.nix
+++ b/pkgs/development/libraries/gtkspell/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "00hdv28bp72kg1mq2jdz1sdw2b8mb9iclsp7jdqwpck705bdriwg";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [aspell gtk2 enchant intltool];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [aspell gtk2 enchant];
 
   meta = with lib; {
     description = "Word-processor-style highlighting and replacement of misspelled words";
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 38370814b5a..66092f43650 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -6,9 +6,9 @@
 , libid3tag, librsvg, libheif
 , freetype , bzip2, pkg-config
 , x11Support ? true
+, webpSupport ? true
 , svgSupport ? false
 , heifSupport ? false
-, webpSupport ? false
 , jxlSupport ? false
 , psSupport ? false
 
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 7397824f9a7..a7197f9ff98 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   buildPhase = lib.optionalString libOnly ''
     runHook preBuild
 
-    MAKE="make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES"
+    MAKE="make -j $NIX_BUILD_CORES"
     for folder in $libFolders; do
       $MAKE -C $folder
     done
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index e49a903730b..72ecdc51ab1 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.112";
+  version = "2.4.113";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1zr0hi7k5s7my4q9hyj6ryzg89zyjx24zbqfv3c5rcq9pl87gc00";
+    sha256 = "sha256-f9frKWf2O+tGBvItUOJ32ZNIDQXvdd2Iqb2OZ3Mj5eE=";
   };
 
   outputs = [ "out" "dev" "bin" ];
@@ -20,10 +20,11 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dinstall-test-programs=true"
-    "-Domap=true"
+    "-Domap=enabled"
+    "-Dcairo-tests=disabled"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch [
-    "-Dtegra=true"
-    "-Detnaviv=true"
+    "-Dtegra=enabled"
+    "-Detnaviv=enabled"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/liberfa/default.nix b/pkgs/development/libraries/liberfa/default.nix
index 8edc3d7b5a5..b59d3aab4a3 100644
--- a/pkgs/development/libraries/liberfa/default.nix
+++ b/pkgs/development/libraries/liberfa/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "erfa";
   version = "2.0.0";
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
 
   src = fetchFromGitHub {
     owner = "liberfa";
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix
index 7251e5b645b..29762e231f2 100644
--- a/pkgs/development/libraries/libextractor/default.nix
+++ b/pkgs/development/libraries/libextractor/default.nix
@@ -45,10 +45,11 @@ stdenv.mkDerivation rec {
            -e "s|pexe[[:blank:]]*=.*$|pexe = strdup(\"$out/lib/\");|g"
     '';
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs =
    [ libtool gettext zlib bzip2 flac libvorbis exiv2
      libgsf rpm
-     pkg-config
    ] ++ lib.optionals gstreamerSupport
           ([ gst_all_1.gstreamer ] ++ gstPlugins gst_all_1)
      ++ lib.optionals gtkSupport [ glib gtk3 ]
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 4c3e00150ab..2904e6e4567 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libffi";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchurl {
     url = "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "081nx7wpzds168jbr59m34n6s3lyiq6r8zggvqxvlslsc4hvf3sl";
+    sha256 = "sha256-RBbdkrauj8tbEEIecRxNPLMSA9d1Iad9hdAQIxHmw7g=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
   # cgit) that are needed here should be included directly in Nixpkgs as
   # files.
   patches = [
-    ./libffi-powerpc64.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libffi/libffi-powerpc64.patch b/pkgs/development/libraries/libffi/libffi-powerpc64.patch
deleted file mode 100644
index 5748ac08498..00000000000
--- a/pkgs/development/libraries/libffi/libffi-powerpc64.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-https://github.com/libffi/libffi/issues/668
---- a/src/powerpc/linux64.S
-+++ b/src/powerpc/linux64.S
-@@ -29,6 +29,8 @@
- #include <fficonfig.h>
- #include <ffi.h>
- 
-+	.machine altivec
-+
- #ifdef POWERPC64
- 	.hidden	ffi_call_LINUX64
- 	.globl	ffi_call_LINUX64
---- a/src/powerpc/linux64_closure.S
-+++ b/src/powerpc/linux64_closure.S
-@@ -30,6 +30,8 @@
- 
- 	.file	"linux64_closure.S"
- 
-+	.machine altivec
-+
- #ifdef POWERPC64
- 	FFI_HIDDEN (ffi_closure_LINUX64)
- 	.globl  ffi_closure_LINUX64
diff --git a/pkgs/development/libraries/libfido2/default.nix b/pkgs/development/libraries/libfido2/default.nix
index d7c034b9e98..bd4d21fe1b9 100644
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ openssl ];
 
+  outputs = [ "out" "dev" "man" ];
+
   cmakeFlags = [
     "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
     "-DCMAKE_INSTALL_LIBDIR=lib"
diff --git a/pkgs/development/libraries/libinklevel/default.nix b/pkgs/development/libraries/libinklevel/default.nix
index dffbcdd69d1..f9c711df704 100644
--- a/pkgs/development/libraries/libinklevel/default.nix
+++ b/pkgs/development/libraries/libinklevel/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-J0cEaC5v4naO4GGUzdfV55kB7KzA+q+v64i5y5Xbp9Q=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    pkg-config
     libusb1
   ];
 
diff --git a/pkgs/development/libraries/libmikmod/default.nix b/pkgs/development/libraries/libmikmod/default.nix
index c7a00e7372d..29f64116b7a 100644
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -18,8 +18,14 @@ in stdenv.mkDerivation rec {
   propagatedBuildInputs =
     optional stdenv.isLinux libpulseaudio;
 
+  outputs = [ "out" "dev" "man" ];
+
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lasound";
 
+  postInstall = ''
+    moveToOutput bin/libmikmod-config "$dev"
+  '';
+
   meta = with lib; {
     description = "A library for playing tracker music module files";
     homepage    = "https://mikmod.shlomifish.org/";
diff --git a/pkgs/development/libraries/libmx/default.nix b/pkgs/development/libraries/libmx/default.nix
index be4cdd62f6e..6cff9e3f03a 100644
--- a/pkgs/development/libraries/libmx/default.nix
+++ b/pkgs/development/libraries/libmx/default.nix
@@ -33,10 +33,9 @@ stdenv.mkDerivation rec {
 
   configureScript = "sh autogen.sh";
 
-  nativeBuildInputs = [ pkg-config automake autoconf ];
+  nativeBuildInputs = [ pkg-config automake autoconf intltool ];
   buildInputs = [
     libtool
-    intltool
     gobject-introspection glib
     gtk2 gtk-doc clutter clutter-gtk
   ];
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 20c4c0a1c6e..3006efe9b29 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation (rec {
-  version = "4.11.0";
+  version = "4.12.0";
   pname = "libpfm";
 
   src = fetchurl {
     url = "mirror://sourceforge/perfmon2/libpfm4/${pname}-${version}.tar.gz";
-    sha256 = "1k7yp6xfsglp2b6271r622sjinlbys0dk24n9iiv656y5f3zi9ax";
+    sha256 = "sha256-SwwfU/OaYVJbab6/UyxoBAwbmE11RKiuCESxPNkeHuQ=";
   };
 
   makeFlags = [
diff --git a/pkgs/development/libraries/libpipeline/default.nix b/pkgs/development/libraries/libpipeline/default.nix
index 9e2c8342776..f682d394c15 100644
--- a/pkgs/development/libraries/libpipeline/default.nix
+++ b/pkgs/development/libraries/libpipeline/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libpipeline";
-  version = "1.5.4";
+  version = "1.5.6";
 
   src = fetchurl {
     url = "mirror://savannah/libpipeline/libpipeline-${version}.tar.gz";
-    sha256 = "sha256-23hb3boKN+8UtO+Cri0YuIJOaYPfuZEDGTheKN8/Gpw=";
+    sha256 = "sha256-YPu559w5hSjl86d2r1e7KMo/5dnwzYqWGsbOv+bpt5c=";
   };
 
   patches = lib.optionals stdenv.isDarwin [ ./fix-on-osx.patch ];
diff --git a/pkgs/development/libraries/libspectre/default.nix b/pkgs/development/libraries/libspectre/default.nix
index 81e661a9421..2d916fa9a93 100644
--- a/pkgs/development/libraries/libspectre/default.nix
+++ b/pkgs/development/libraries/libspectre/default.nix
@@ -11,9 +11,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./libspectre-0.2.7-gs918.patch ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     # Need `libgs.so'.
-    pkg-config ghostscript cairo /*for tests*/
+    ghostscript cairo /*for tests*/
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libspng/default.nix b/pkgs/development/libraries/libspng/default.nix
index dba098b4468..077b414a665 100644
--- a/pkgs/development/libraries/libspng/default.nix
+++ b/pkgs/development/libraries/libspng/default.nix
@@ -38,13 +38,13 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    pkg-config
     zlib
   ];
 
   nativeBuildInputs = [
     ninja
     meson
+    pkg-config
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libtoxcore/new-api.nix b/pkgs/development/libraries/libtoxcore/new-api.nix
index 831ff2447a2..e726f07a7d8 100644
--- a/pkgs/development/libraries/libtoxcore/new-api.nix
+++ b/pkgs/development/libraries/libtoxcore/new-api.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [
-    autoreconfHook libsodium ncurses check libconfig
+    libsodium ncurses check libconfig
   ] ++ lib.optionals (!stdenv.isAarch32) [
     libopus
   ];
diff --git a/pkgs/development/libraries/libwnck/2.nix b/pkgs/development/libraries/libwnck/2.nix
index fd7d80574a7..a1f54006beb 100644
--- a/pkgs/development/libraries/libwnck/2.nix
+++ b/pkgs/development/libraries/libwnck/2.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 intltool xorg.libX11 xorg.libXres ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 xorg.libX11 xorg.libXres ];
   # ?another optional: startup-notification
 
   configureFlags = [ "--disable-introspection" ]; # not needed anywhere AFAIK
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index 9b312a2d5ef..dad94c29d72 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -45,7 +45,6 @@ mkDerivation rec {
     libvorbis
     libxml2
     movit
-    pkg-config
     qtbase
     qtsvg
     sox
@@ -56,7 +55,7 @@ mkDerivation rec {
     ladspaPlugins
   ];
 
-  nativeBuildInputs = [ cmake which ];
+  nativeBuildInputs = [ cmake which pkg-config ];
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index e93dfdfb144..2017d5435ea 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -57,7 +57,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake unzip pkg-config ];
   buildInputs =
     [
-      cmake
       libGLU
       libGL
       freetype
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index b9471d68193..8164a4264e6 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, removeReferencesTo
 , alsaSupport ? !stdenv.isDarwin, alsa-lib
 , dbusSupport ? !stdenv.isDarwin, dbus
 , pipewireSupport ? !stdenv.isDarwin, pipewire
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config removeReferencesTo ];
 
   buildInputs = lib.optional alsaSupport alsa-lib
     ++ lib.optional dbusSupport dbus
@@ -46,6 +46,10 @@ stdenv.mkDerivation rec {
     "-DOSS_INCLUDE_DIR=${stdenv.cc.libc}/include"
   ];
 
+  postInstall = lib.optional pipewireSupport ''
+    remove-references-to -t ${pipewire.dev} $(readlink -f $out/lib/*.so)
+  '';
+
   meta = with lib; {
     description = "OpenAL alternative";
     homepage = "https://openal-soft.org/";
diff --git a/pkgs/development/libraries/opencl-headers/default.nix b/pkgs/development/libraries/opencl-headers/default.nix
index 879a916d3ea..273cdea6f8c 100644
--- a/pkgs/development/libraries/opencl-headers/default.nix
+++ b/pkgs/development/libraries/opencl-headers/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opencl-headers";
-  version = "2021.06.30";
+  version = "2022.09.23";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-Headers";
     rev = "v${version}";
-    sha256 = "sha256-MdKC48f1zhVAcHrqzrgT9iaYrHXurV8vDt+GnDroO9s=";
+    sha256 = "sha256-kBXkevcapVfpFmI5C77DwULrC8zjcoto+veb49Ksixk=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index e85589af0c1..479ffbc78ee 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OSTsU2E4UWiwBqq3NqD0lj8uqVXeyd3MJ/gre6W2Jvs=";
+    sha256 = "sha256-L5u0xkoza3G1ZHdtJH7ayVOgcVbPWYp7MC3lJd7LsSY=";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/openjpeg/default.nix b/pkgs/development/libraries/openjpeg/default.nix
index b26738c9ea1..8dd2415433a 100644
--- a/pkgs/development/libraries/openjpeg/default.nix
+++ b/pkgs/development/libraries/openjpeg/default.nix
@@ -1,75 +1,64 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config
-, libpng, libtiff, lcms2, jpylyzer
-, mj2Support ? true # MJ2 executables
-, jpwlLibSupport ? true # JPWL library & executables
+, libdeflate, libpng, libtiff, zlib, lcms2, jpylyzer
 , jpipLibSupport ? false # JPIP library & executables
-, jpipServerSupport ? false, curl ? null, fcgi ? null # JPIP Server
-#, opjViewerSupport ? false, wxGTK ? null # OPJViewer executable
+, jpipServerSupport ? false, curl, fcgi # JPIP Server
+, opjViewerSupport ? false, wxGTK # OPJViewer executable
 , openjpegJarSupport ? false # Openjpeg jar (Java)
-, jp3dSupport ? true # # JP3D comp
-, thirdPartySupport ? false # Third party libraries - OFF: only build when found, ON: always build
-, testsSupport ? true
-, jdk ? null
+, jdk
+, poppler
 }:
 
-assert jpipServerSupport -> jpipLibSupport && curl != null && fcgi != null;
-#assert opjViewerSupport -> (wxGTK != null);
-assert (openjpegJarSupport || jpipLibSupport) -> jdk != null;
-
 let
-  inherit (lib) optional optionals;
   mkFlag = optSet: flag: "-D${flag}=${if optSet then "ON" else "OFF"}";
 in
 
 stdenv.mkDerivation rec {
   pname = "openjpeg";
-  version = "2.4.0"; # don't forget to change passthru.incDir
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "uclouvain";
     repo = "openjpeg";
     rev = "v${version}";
-    sha256 = "143dvy5g6v6129lzvl0r8mrgva2fppkn0zl099qmi9yi9l9h7yyf";
+    sha256 = "sha256-/0o3Fl6/jx5zu854TCqMyOz/8mnEyEC9lpZ6ij/tbHc=";
   };
 
+  outputs = [ "out" "dev" ];
+
   patches = [
-    ./fix-cmake-config-includedir.patch
+    # modernise cmake files, also fixes them for multiple outputs
     (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/uclouvain/openjpeg/pull/1321.patch";
-      sha256 = "1cjpr76nf9g65nqkfnxnjzi3bv7ifbxpc74kxxibh58pzjlp6al8";
+      url = "https://github.com/uclouvain/openjpeg/pull/1424.patch";
+      sha256 = "sha256-CxVRt1u4HVOMUjWiZ2plmZC29t/zshCpSY+N4Wlrlvg=";
+    })
+    # fix cmake files cross compilation
+    (fetchpatch {
+      url = "https://github.com/uclouvain/openjpeg/commit/c6ceb84c221b5094f1e8a4c0c247dee3fb5074e8.patch";
+      sha256 = "sha256-gBUtmO/7RwSWEl7rc8HGr8gNtvNFdhjEwm0Dd51p5O8=";
     })
   ];
 
-  outputs = [ "out" "dev" ];
-
   cmakeFlags = [
     "-DCMAKE_INSTALL_NAME_DIR=\${CMAKE_INSTALL_PREFIX}/lib"
     "-DBUILD_SHARED_LIBS=ON"
     "-DBUILD_CODEC=ON"
-    (mkFlag mj2Support "BUILD_MJ2")
-    (mkFlag jpwlLibSupport "BUILD_JPWL")
+    "-DBUILD_THIRDPARTY=OFF"
     (mkFlag jpipLibSupport "BUILD_JPIP")
     (mkFlag jpipServerSupport "BUILD_JPIP_SERVER")
-    #(mkFlag opjViewerSupport "BUILD_VIEWER")
-    "-DBUILD_VIEWER=OFF"
+    (mkFlag opjViewerSupport "BUILD_VIEWER")
     (mkFlag openjpegJarSupport "BUILD_JAVA")
-    (mkFlag jp3dSupport "BUILD_JP3D")
-    (mkFlag thirdPartySupport "BUILD_THIRDPARTY")
-    (mkFlag testsSupport "BUILD_TESTING")
-    "-DOPENJPEG_INSTALL_INCLUDE_DIR=${placeholder "dev"}/include/${passthru.incDir}"
-    "-DOPENJPEG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/${passthru.incDir}"
+    (mkFlag doCheck "BUILD_TESTING")
   ];
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ ]
-    ++ optionals jpipServerSupport [ curl fcgi ]
-    #++ optional opjViewerSupport wxGTK
-    ++ optional (openjpegJarSupport || jpipLibSupport) jdk;
+  buildInputs = [ libdeflate libpng libtiff zlib lcms2 ]
+    ++ lib.optionals jpipServerSupport [ curl fcgi ]
+    ++ lib.optional opjViewerSupport wxGTK
+    ++ lib.optional (openjpegJarSupport || jpipLibSupport) jdk;
 
-  propagatedBuildInputs = [ libpng libtiff lcms2 ];
+  doCheck = (!stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
 
-  doCheck = (testsSupport && !stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
   checkPhase = ''
     substituteInPlace ../tools/ctest_scripts/travis-ci.cmake \
       --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"${jpylyzer}/bin/jpylyzer\" # "
@@ -77,7 +66,10 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    incDir = "openjpeg-2.4";
+    incDir = "openjpeg-${lib.versions.majorMinor version}";
+    tests = {
+      inherit poppler;
+    };
   };
 
   meta = with lib; {
@@ -86,5 +78,7 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ codyopel ];
     platforms = platforms.all;
+    # opj viewer fails to compile with lots of errors, jar requires openjpeg library already compiled and installed
+    broken = (opjViewerSupport || openjpegJarSupport);
   };
 }
diff --git a/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch b/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
deleted file mode 100644
index 21306400dd4..00000000000
--- a/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
+++ /dev/null
@@ -1,44 +0,0 @@
---- a/src/lib/openjp2/libopenjp2.pc.cmake.in
-+++ b/src/lib/openjp2/libopenjp2.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjp2
- Description: JPEG2000 library (Part 1 and 2)
---- a/src/lib/openjp3d/libopenjp3d.pc.cmake.in
-+++ b/src/lib/openjp3d/libopenjp3d.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjp3d
- Description: JPEG2000 Extensions for three-dimensional data (Part 10)
---- a/src/lib/openjpip/libopenjpip.pc.cmake.in
-+++ b/src/lib/openjpip/libopenjpip.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjpip
- Description: JPEG2000 Interactivity tools, APIs and protocols (Part 9)
---- a/src/lib/openjpwl/libopenjpwl.pc.cmake.in
-+++ b/src/lib/openjpwl/libopenjpwl.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjpwl
- Description: JPEG2000 Wireless library (Part 11)
diff --git a/pkgs/development/libraries/science/math/cliquer/default.nix b/pkgs/development/libraries/science/math/cliquer/default.nix
index fd89ede1efb..55a1b9dcb4c 100644
--- a/pkgs/development/libraries/science/math/cliquer/default.nix
+++ b/pkgs/development/libraries/science/math/cliquer/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs = [
+  nativeBuildInputs = [
     autoreconfHook
   ];
 
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 6718262c2a3..69e529234f0 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -136,7 +136,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.20";
+  version = "0.3.21";
 
   outputs = [ "out" "dev" ];
 
@@ -144,9 +144,14 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-FLPVcepf7tv/es+4kur9Op7o3iVAAayuYN4hY/P4mmQ=";
+    sha256 = "sha256-F6cXPqQai4kA5zrsa8E0Q7dD9zZHlwZ+B16EOGNXoXs=";
   };
 
+  postPatch = ''
+    # cc1: error: invalid feature modifier 'sve2' in '-march=armv8.5-a+sve+sve2+bf16'
+    substituteInPlace Makefile.arm64 --replace "+sve2+bf16" ""
+  '';
+
   inherit blas64;
 
   # Some hardening features are disabled due to sporadic failures in
diff --git a/pkgs/development/libraries/sentry-native/default.nix b/pkgs/development/libraries/sentry-native/default.nix
index eafc773ef20..83f84d4d4fd 100644
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-whbzoKIYLwj4yoFaT3frghJd/WzfpolSAuZzQRtnP5E=";
   };
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ curl breakpad pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ curl breakpad ];
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
     "-DSENTRY_BREAKPAD_SYSTEM=On"
diff --git a/pkgs/development/libraries/smpeg/default.nix b/pkgs/development/libraries/smpeg/default.nix
index 8b54cb37a32..5c72d653278 100644
--- a/pkgs/development/libraries/smpeg/default.nix
+++ b/pkgs/development/libraries/smpeg/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL gtk2 libGLU libGL ];
 
+  outputs = [ "out" "dev" ];
+
   preConfigure = ''
     touch NEWS AUTHORS ChangeLog
     sh autogen.sh
@@ -35,9 +37,11 @@ stdenv.mkDerivation rec {
     -e 's,"SDL_audio.h",<SDL/SDL_audio.h>,' \
     -e 's,"SDL_thread.h",<SDL/SDL_thread.h>,' \
     -e 's,"SDL_types.h",<SDL/SDL_types.h>,' \
-      $out/include/smpeg/*.h
+      $dev/include/smpeg/*.h
+
+    moveToOutput bin/smpeg-config "$dev"
 
-    wrapProgram $out/bin/smpeg-config \
+    wrapProgram $dev/bin/smpeg-config \
       --prefix PATH ":" "${pkg-config}/bin" \
       --prefix PKG_CONFIG_PATH ":" "${lib.getDev SDL}/lib/pkgconfig"
   '';
diff --git a/pkgs/development/libraries/smpeg2/default.nix b/pkgs/development/libraries/smpeg2/default.nix
index 48281ba04ec..24dd9c9dc40 100644
--- a/pkgs/development/libraries/smpeg2/default.nix
+++ b/pkgs/development/libraries/smpeg2/default.nix
@@ -24,12 +24,15 @@ stdenv.mkDerivation rec {
   buildInputs = [ SDL2 ]
     ++ lib.optional stdenv.isDarwin darwin.libobjc;
 
+  outputs = [ "out" "dev" "man" ];
+
   preConfigure = ''
     sh autogen.sh
   '';
 
   postInstall = ''
-    wrapProgram $out/bin/smpeg2-config \
+    moveToOutput bin/smpeg2-config "$dev"
+    wrapProgram $dev/bin/smpeg2-config \
       --prefix PATH ":" "${pkg-config}/bin" \
       --prefix PKG_CONFIG_PATH ":" "${SDL2.dev}/lib/pkgconfig"
   '';
diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index c74780148a1..2e1a96eebbd 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -4,13 +4,13 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = "srt";
-  version = "1.4.4";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${version}";
-    sha256 = "sha256-OfcMHH+MSOGY9pxpXt19EIGdP4FJFssSv/lENX+iIf8=";
+    sha256 = "sha256-qVvoHtROtJjrUd+YpjN/0I6KmiH7c24+pQ4xYTUGPXk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/unicap/default.nix b/pkgs/development/libraries/unicap/default.nix
index 17e91f7e236..f26365fa8e6 100644
--- a/pkgs/development/libraries/unicap/default.nix
+++ b/pkgs/development/libraries/unicap/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05zcnnm4dfc6idihfi0fq5xka6x86zi89wip2ca19yz768sd33s9";
   };
 
-  buildInputs = [ libusb-compat-0_1 libraw1394 dcraw intltool perl v4l-utils ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ libusb-compat-0_1 libraw1394 dcraw perl v4l-utils ];
 
   patches = [
     # Debian has a patch that fixes the build.
diff --git a/pkgs/development/libraries/vapoursynth-mvtools/default.nix b/pkgs/development/libraries/vapoursynth-mvtools/default.nix
index 76ce9a36c71..54d9bad1644 100644
--- a/pkgs/development/libraries/vapoursynth-mvtools/default.nix
+++ b/pkgs/development/libraries/vapoursynth-mvtools/default.nix
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0lngkvxnzn82rz558nvl96rvclrck07ja1pny7wcfixp9b68ppkn";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
-    autoreconfHook
     nasm vapoursynth fftwFloat
   ];
 
diff --git a/pkgs/development/libraries/volume-key/default.nix b/pkgs/development/libraries/volume-key/default.nix
index ce2f7c20d3c..cc0049ef756 100644
--- a/pkgs/development/libraries/volume-key/default.nix
+++ b/pkgs/development/libraries/volume-key/default.nix
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "dev" "py" ];
 
-  nativeBuildInputs = [ autoconf automake libtool pkg-config gettext swig ];
+  nativeBuildInputs = [ autoconf automake libtool pkg-config gettext swig autoreconfHook ];
 
-  buildInputs = [ autoreconfHook glib cryptsetup nss util-linux gpgme ncurses ];
+  buildInputs = [ glib cryptsetup nss util-linux gpgme ncurses ];
 
   configureFlags = [
     "--with-gpgme-prefix=${gpgme.dev}"
diff --git a/pkgs/development/libraries/vte/2.90.nix b/pkgs/development/libraries/vte/2.90.nix
index dfb76069c3b..59f1a2cd673 100644
--- a/pkgs/development/libraries/vte/2.90.nix
+++ b/pkgs/development/libraries/vte/2.90.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "54e5b07be3c0f7b158302f54ee79d4de1cb002f4259b6642b79b1e0e314a959c";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gobject-introspection intltool glib gtk3 ncurses ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gobject-introspection glib gtk3 ncurses ];
 
   configureFlags = [ "--enable-introspection" ];
 
diff --git a/pkgs/development/libraries/xcb-util-cursor/HEAD.nix b/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
index 92796b4116c..4ac58c3f3d0 100644
--- a/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
+++ b/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
@@ -21,13 +21,12 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [
     gnum4
     gperf
     libtool
     libxcb
-    pkg-config
     xorg.utilmacros
     xorg.xcbutilimage
     xorg.xcbutilrenderutil
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index e5d5e111855..1ff2101b146 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -427,7 +427,8 @@ with prev;
 
   luv = prev.luaLib.overrideLuarocks prev.luv (drv: {
 
-    buildInputs = [ pkg-config libuv ];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libuv ];
 
     # Use system libuv instead of building local and statically linking
     extraVariables = {
diff --git a/pkgs/development/ocaml-modules/gsl/default.nix b/pkgs/development/ocaml-modules/gsl/default.nix
index eacdda27f43..4588d0c04b0 100644
--- a/pkgs/development/ocaml-modules/gsl/default.nix
+++ b/pkgs/development/ocaml-modules/gsl/default.nix
@@ -13,7 +13,8 @@ buildDunePackage rec {
     sha256 = "1mpzcgbrha2l8iikqbmn32668v2mnnsykxg5n5jgs0qnskn2nvrn";
   };
 
-  buildInputs = [ dune-configurator gsl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dune-configurator gsl ];
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Accelerate ];
 
   meta = with lib; {
diff --git a/pkgs/development/perl-modules/Po4a/default.nix b/pkgs/development/perl-modules/Po4a/default.nix
index 11941490785..3689122805e 100644
--- a/pkgs/development/perl-modules/Po4a/default.nix
+++ b/pkgs/development/perl-modules/Po4a/default.nix
@@ -1,5 +1,7 @@
 { stdenv, lib, fetchurl, docbook_xsl, docbook_xsl_ns, gettext, libxslt, glibcLocales, docbook_xml_dtd_412, docbook_sgml_dtd_41, texlive, opensp
-, perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny }:
+, perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny
+, fetchpatch
+}:
 
 buildPerlPackage rec {
   pname = "po4a";
@@ -8,6 +10,14 @@ buildPerlPackage rec {
     url = "https://github.com/mquinson/po4a/releases/download/v${version}/po4a-${version}.tar.gz";
     sha256 = "0eb510a66f59de68cf7a205342036cc9fc08b39334b91f1456421a5f3359e68b";
   };
+  patches = [
+    (fetchpatch {
+      # make devdoc output reproducible
+      # https://github.com/mquinson/po4a/pull/387
+      url = "https://github.com/mquinson/po4a/commit/df7433b58f6570558d44b6aac885c2a8f7862e51.patch";
+      sha256 = "9MVkYiItR2P3PBCUc4OhEOUHQuLqTWUYtYlZ3L8miC8=";
+    })
+  ];
   nativeBuildInputs = [ docbook_xsl docbook_xsl_ns ModuleBuild ];
   propagatedBuildInputs = lib.optional (!stdenv.hostPlatform.isMusl) TextWrapI18N ++ [ LocaleGettext SGMLSpm UnicodeLineBreak PodParser YAMLTiny ];
   # TODO: TermReadKey was temporarily removed from propagatedBuildInputs to unfreeze the build
diff --git a/pkgs/development/python-modules/adal/default.nix b/pkgs/development/python-modules/adal/default.nix
index 45c256b6647..e944248db17 100644
--- a/pkgs/development/python-modules/adal/default.nix
+++ b/pkgs/development/python-modules/adal/default.nix
@@ -20,6 +20,10 @@ buildPythonPackage rec {
     hash = "sha256-HE8/P0aohoZNeMdcQVKdz6M31FMrjsd7oVytiaD0idI=";
   };
 
+  postPatch = ''
+    sed -i '/cryptography/d' setup.py
+  '';
+
   propagatedBuildInputs = [
     pyjwt
     python-dateutil
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
index 8b752f39e62..091020c7632 100644
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -225,6 +225,7 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "colorlog>=4.0.2, <5.0" "colorlog" \
+      --replace "flask-login>=0.6.2" "flask-login" \
       --replace "pathspec~=0.9.0" "pathspec"
   '' + lib.optionalString stdenv.isDarwin ''
     # Fix failing test on Hydra
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index fe52973c2cd..caa24743d3a 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -26,7 +26,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     requests
     pyjwt
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   checkInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index 6db3cbefedb..0cc201169d8 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -6,6 +6,7 @@
 , pythonOlder
 , requests
 , requests-oauthlib
+, pyjwt
 }:
 
 buildPythonPackage rec {
@@ -30,9 +31,11 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     django
     python3-openid
+    pyjwt
     requests
     requests-oauthlib
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   checkPhase = ''
     # test is out of date
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index d9027796180..f881ed5221a 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "3.2.15";
+  version = "3.2.16";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Django";
     inherit version;
-    hash = "sha256-9xk0sagi8UqGyayWNAU2iSec0ErmnLat5KWUcbiGWCs=";
+    hash = "sha256-OtwoUSQkRySjlPqbmDnMjNEW+vfRWVVMQ+zaqM3wuU0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/drf-jwt/default.nix b/pkgs/development/python-modules/drf-jwt/default.nix
index 1b2292b46b7..6ae583c98e0 100644
--- a/pkgs/development/python-modules/drf-jwt/default.nix
+++ b/pkgs/development/python-modules/drf-jwt/default.nix
@@ -19,7 +19,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     pyjwt
     djangorestframework
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   # requires setting up a django instance
   doCheck = false;
diff --git a/pkgs/development/python-modules/eth-keys/default.nix b/pkgs/development/python-modules/eth-keys/default.nix
index 903d9bf9501..00029b7df05 100644
--- a/pkgs/development/python-modules/eth-keys/default.nix
+++ b/pkgs/development/python-modules/eth-keys/default.nix
@@ -49,6 +49,7 @@ buildPythonPackage rec {
     "test_native_to_coincurve_recover"
     "test_public_key_compression_is_equal"
     "test_public_key_decompression_is_equal"
+    "test_signatures_with_high_s"
   ];
 
   pythonImportsCheck = [ "eth_keys" ];
diff --git a/pkgs/development/python-modules/flask-jwt-extended/default.nix b/pkgs/development/python-modules/flask-jwt-extended/default.nix
index 3764cc36cb0..464894e9cfd 100644
--- a/pkgs/development/python-modules/flask-jwt-extended/default.nix
+++ b/pkgs/development/python-modules/flask-jwt-extended/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, cryptography
 , flask
 , pyjwt
 , pytestCheckHook
@@ -29,9 +30,14 @@ buildPythonPackage rec {
     werkzeug
   ];
 
+  passthru.optional-dependencies.asymmetric_crypto = [
+    cryptography
+  ];
+
   checkInputs = [
     pytestCheckHook
-  ];
+  ]
+  ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "flask_jwt_extended"
diff --git a/pkgs/development/python-modules/gidgethub/default.nix b/pkgs/development/python-modules/gidgethub/default.nix
index 5b8e4b23976..dfe1c186f49 100644
--- a/pkgs/development/python-modules/gidgethub/default.nix
+++ b/pkgs/development/python-modules/gidgethub/default.nix
@@ -27,7 +27,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     uritemplate
     pyjwt
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   checkInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/github3_py/default.nix b/pkgs/development/python-modules/github3_py/default.nix
index 08786916bd9..a5c930ba9eb 100644
--- a/pkgs/development/python-modules/github3_py/default.nix
+++ b/pkgs/development/python-modules/github3_py/default.nix
@@ -28,7 +28,8 @@ buildPythonPackage rec {
     uritemplate
     python-dateutil
     pyjwt
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   checkInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index f50818f5587..55db1388428 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -21,12 +21,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     pyjwt
     requests
-  ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "PyJWT[crypto]>=1.0.0,<3" "PyJWT"
-  '';
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   # Tests assume Network Connectivity:
   # https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/e2958961e8ec16d0af4199f60c36c3f913497e48/tests/test_authority.py#L73
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 3815a64eec6..088541552ec 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPythonPackage, fetchPypi, isPy27, python
-, IOKit
+, CoreFoundation, IOKit
 , pytestCheckHook
 , mock
 , unittest2
@@ -41,7 +41,10 @@ buildPythonPackage rec {
     "cpu_freq"
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ IOKit ];
+  buildInputs =
+    # workaround for https://github.com/NixOS/nixpkgs/issues/146760
+    lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ CoreFoundation ] ++
+    lib.optionals stdenv.isDarwin [ IOKit ];
 
   pythonImportsCheck = [ "psutil" ];
 
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 327a44690da..241953cda3e 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage rec {
 
   postBuild = ''
     # build tests
-    make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES
+    make -j $NIX_BUILD_CORES
   '';
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 500f46b0240..54df7457a35 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -2,28 +2,49 @@
 , buildPythonPackage
 , fetchPypi
 , cryptography
+, types-cryptography
 , pytestCheckHook
 , pythonOlder
+, sphinxHook
+, sphinx-rtd-theme
+, zope_interface
 }:
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.4.0";
-  disabled = pythonOlder "3.6";
+  version = "2.5.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "PyJWT";
     inherit version;
-    sha256 = "sha256-1CkIIIxpmzuXPL6wGpabpqlsgh7vscW/5MOQwB1nq7o=";
+    sha256 = "sha256-53q4lICQXYaZhEKsV4jzUzP6hfZQR6U0rcOO3zyI/Ds=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    sed -i '/types-cryptography/d' setup.cfg
+  '';
+
+  outputs = [
+    "out"
+    "doc"
+  ];
+
+  nativeBuildInputs = [
+    sphinxHook
+    sphinx-rtd-theme
+    zope_interface
+  ];
+
+  passthru.optional-dependencies.crypto = [
     cryptography
   ];
 
   checkInputs = [
     pytestCheckHook
-  ];
+  ] ++ (lib.flatten (lib.attrValues passthru.optional-dependencies));
 
   pythonImportsCheck = [ "jwt" ];
 
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index 0afa482960c..1ad0095e009 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.5.1";
+  version = "1.5.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-DgXkVmRdWUKcsQITcK7ec8B2DpNgu/2q77W87VMOudc=";
+    sha256 = "sha256-2NrMsU3A6uG2tus+zveWdb03tAZTafecNTk91cVWUsc=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/social-auth-core/default.nix b/pkgs/development/python-modules/social-auth-core/default.nix
index b00e5044c64..6427208420f 100644
--- a/pkgs/development/python-modules/social-auth-core/default.nix
+++ b/pkgs/development/python-modules/social-auth-core/default.nix
@@ -56,9 +56,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
     httpretty
-  ] ++ passthru.optional-dependencies.openidconnect
-  ++ passthru.optional-dependencies.saml
-  ++ passthru.optional-dependencies.azuread;
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   # Disable checking the code coverage
   prePatch = ''
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 619daa6ae9b..5e07b694e6d 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, cryptography
 , django
 , fetchFromGitHub
 , mock
@@ -32,6 +33,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    cryptography
     django
     mock
     multidict
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 9d8f5045c7f..12c24cd99a9 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -604,7 +604,8 @@ in
   };
 
   ruby-libvirt = attrs: {
-    buildInputs = [ libvirt pkg-config ];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libvirt ];
     buildFlags = [
       "--with-libvirt-include=${libvirt}/include"
       "--with-libvirt-lib=${libvirt}/lib"
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 722c8b63034..d64b3bbe1a8 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.24.1";
+  version = "3.24.2";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-STHid6TbGoBfE7qnATp3V6DL/lt5MogpJccGHZ0fqCs=";
+    sha256 = "sha256-DZAg8G893xf7U33CKOGlbJJ+5Qa0hvVf4twZ9pvwyNs=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 3d946fcffd5..ded9c3c63b8 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -20,7 +20,7 @@ mesonConfigurePhase() {
 
     echo "meson flags: $mesonFlags ${mesonFlagsArray[@]}"
 
-    meson build $mesonFlags "${mesonFlagsArray[@]}"
+    meson setup build $mesonFlags "${mesonFlagsArray[@]}"
     cd build
 
     if ! [[ -v enableParallelBuilding ]]; then
diff --git a/pkgs/development/tools/build-managers/ninja/default.nix b/pkgs/development/tools/build-managers/ninja/default.nix
index ffa582b5618..f80f0289dbe 100644
--- a/pkgs/development/tools/build-managers/ninja/default.nix
+++ b/pkgs/development/tools/build-managers/ninja/default.nix
@@ -1,6 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python3, buildDocs ? true, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, re2c }:
-
-with lib;
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, asciidoc
+, docbook_xml_dtd_45
+, docbook_xsl
+, installShellFiles
+, libxslt
+, python3
+, re2c
+, buildDocs ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "ninja";
@@ -10,30 +20,51 @@ stdenv.mkDerivation rec {
     owner = "ninja-build";
     repo = "ninja";
     rev = "v${version}";
-    sha256 = "sha256-LvV/Fi2ARXBkfyA1paCRmLUwCh/rTyz+tGMg2/qEepI=";
+    hash = "sha256-LvV/Fi2ARXBkfyA1paCRmLUwCh/rTyz+tGMg2/qEepI=";
   };
 
-  nativeBuildInputs = [ python3 re2c ] ++ optionals buildDocs [ asciidoc docbook_xml_dtd_45 docbook_xsl libxslt.bin ];
+  nativeBuildInputs = [
+    python3
+    re2c
+    installShellFiles
+  ]
+  ++ lib.optionals buildDocs [
+    asciidoc
+    docbook_xml_dtd_45
+    docbook_xsl
+    libxslt.bin
+  ];
 
   buildPhase = ''
+    runHook preBuild
+
     python configure.py --bootstrap
-  '' + optionalString buildDocs ''
+  '' + lib.optionalString buildDocs ''
     # "./ninja -vn manual" output copied here to support cross compilation.
     asciidoc -b docbook -d book -o build/manual.xml doc/manual.asciidoc
     xsltproc --nonet doc/docbook.xsl build/manual.xml > doc/manual.html
+  '' + ''
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm555 -t $out/bin ninja
-    install -Dm444 misc/bash-completion $out/share/bash-completion/completions/ninja
-    install -Dm444 misc/zsh-completion $out/share/zsh/site-functions/_ninja
-  '' + optionalString buildDocs ''
+    installShellCompletion --name ninja \
+      --bash misc/bash-completion \
+      --zsh misc/zsh-completion
+  '' + lib.optionalString buildDocs ''
     install -Dm444 -t $out/share/doc/ninja doc/manual.asciidoc doc/manual.html
+  '' + ''
+
+    runHook postInstall
   '';
 
   setupHook = ./setup-hook.sh;
 
-  meta = {
+  meta = with lib; {
     description = "Small build system with a focus on speed";
     longDescription = ''
       Ninja is a small build system with a focus on speed. It differs from
diff --git a/pkgs/development/tools/build-managers/ninja/setup-hook.sh b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
index 63fa7d8f16f..ecaa8b88c1a 100644
--- a/pkgs/development/tools/build-managers/ninja/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
@@ -9,7 +9,7 @@ ninjaBuildPhase() {
     fi
 
     local flagsArray=(
-        -j$buildCores -l$NIX_BUILD_CORES
+        -j$buildCores
         $ninjaFlags "${ninjaFlagsArray[@]}"
     )
 
@@ -19,29 +19,6 @@ ninjaBuildPhase() {
     runHook postBuild
 }
 
-if [ -z "${dontUseNinjaBuild-}" -a -z "${buildPhase-}" ]; then
-    buildPhase=ninjaBuildPhase
-fi
-
-ninjaInstallPhase() {
-    runHook preInstall
-
-    # shellcheck disable=SC2086
-    local flagsArray=(
-        $ninjaFlags "${ninjaFlagsArray[@]}"
-        ${installTargets:-install}
-    )
-
-    echoCmd 'install flags' "${flagsArray[@]}"
-    TERM=dumb ninja "${flagsArray[@]}"
-
-    runHook postInstall
-}
-
-if [ -z "${dontUseNinjaInstall-}" -a -z "${installPhase-}" ]; then
-    installPhase=ninjaInstallPhase
-fi
-
 ninjaCheckPhase() {
     runHook preCheck
 
@@ -61,7 +38,7 @@ ninjaCheckPhase() {
         fi
 
         local flagsArray=(
-            -j$buildCores -l$NIX_BUILD_CORES
+            -j$buildCores
             $ninjaFlags "${ninjaFlagsArray[@]}"
             $checkTarget
         )
@@ -73,6 +50,29 @@ ninjaCheckPhase() {
     runHook postCheck
 }
 
+ninjaInstallPhase() {
+    runHook preInstall
+
+    # shellcheck disable=SC2086
+    local flagsArray=(
+        $ninjaFlags "${ninjaFlagsArray[@]}"
+        ${installTargets:-install}
+    )
+
+    echoCmd 'install flags' "${flagsArray[@]}"
+    TERM=dumb ninja "${flagsArray[@]}"
+
+    runHook postInstall
+}
+
+if [ -z "${dontUseNinjaBuild-}" -a -z "${buildPhase-}" ]; then
+    buildPhase=ninjaBuildPhase
+fi
+
 if [ -z "${dontUseNinjaCheck-}" -a -z "${checkPhase-}" ]; then
     checkPhase=ninjaCheckPhase
 fi
+
+if [ -z "${dontUseNinjaInstall-}" -a -z "${installPhase-}" ]; then
+    installPhase=ninjaInstallPhase
+fi
diff --git a/pkgs/development/tools/mdk/default.nix b/pkgs/development/tools/mdk/default.nix
index 9c92764fdaf..30ae23e85a8 100644
--- a/pkgs/development/tools/mdk/default.nix
+++ b/pkgs/development/tools/mdk/default.nix
@@ -7,8 +7,8 @@ stdenv.mkDerivation rec {
     url = "mirror://gnu/gnu/mdk/v${version}/mdk-${version}.tar.gz";
     sha256 = "0bhk3c82kyp8167h71vdpbcr852h5blpnwggcswqqwvvykbms7lb";
   };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool glib ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ glib ];
   postInstall = ''
     mkdir -p $out/share/emacs/site-lisp/
     cp -v ./misc/*.el $out/share/emacs/site-lisp
diff --git a/pkgs/development/tools/memray/default.nix b/pkgs/development/tools/memray/default.nix
index 405e7e7b9b0..4dc94dcf5d5 100644
--- a/pkgs/development/tools/memray/default.nix
+++ b/pkgs/development/tools/memray/default.nix
@@ -18,10 +18,11 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-zHdgVpe92OiwLC4jHVtT3oC+WnB30e5U3ZOHnmuo+Ao=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     libunwind
     lz4
-    pkg-config
   ] ++ (with python3.pkgs; [
     cython
   ]);
diff --git a/pkgs/development/tools/misc/distcc/default.nix b/pkgs/development/tools/misc/distcc/default.nix
index b20d172a403..27ff1b5e69d 100644
--- a/pkgs/development/tools/misc/distcc/default.nix
+++ b/pkgs/development/tools/misc/distcc/default.nix
@@ -17,8 +17,8 @@ let
       sha256 = "0zjba1090awxkmgifr9jnjkxf41zhzc4f6mrnbayn3v6s77ca9x4";
     };
 
-  nativeBuildInputs = [ pkg-config autoconf automake ];
-    buildInputs = [popt avahi pkg-config python3 gtk3 which procps libiberty_static];
+    nativeBuildInputs = [ pkg-config autoconf automake ];
+    buildInputs = [popt avahi python3 gtk3 which procps libiberty_static];
     preConfigure =
     ''
       export CPATH=$(ls -d ${gcc.cc}/lib/gcc/*/${gcc.cc.version}/plugin/include)
diff --git a/pkgs/development/tools/misc/lttng-ust/generic.nix b/pkgs/development/tools/misc/lttng-ust/generic.nix
index e6e67352c85..56ad3b19e52 100644
--- a/pkgs/development/tools/misc/lttng-ust/generic.nix
+++ b/pkgs/development/tools/misc/lttng-ust/generic.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     inherit sha256;
   };
 
+  outputs = [ "bin" "out" "dev" "devdoc" ];
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ numactl python3 ];
 
@@ -29,6 +31,8 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
+  configureFlags = [ "--disable-examples" ];
+
   propagatedBuildInputs = [ liburcu ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 0db37008ae7..11af21a6e48 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -30,9 +30,9 @@ let
   # 2) nix-build -A tree-sitter.updater.update-all-grammars
   # 3) OPTIONAL: Set GITHUB_TOKEN env variable to avoid api rate limit
   # 4) run the ./result script that is output by that (it updates ./grammars)
-  version = "0.20.6";
-  sha256 = "sha256-zaxy8VCfJKK8NtfuFFojmmP5a19FP1zO/eB5q1EoQPw=";
-  cargoSha256 = "sha256-sOOhzm2nz+HC6dvT+8hj/wh19o+OB2zQ6Uz+H89txSA=";
+  version = "0.20.7";
+  sha256 = "sha256-5ILiN5EfJ7WpeYBiXynfcLucdp8zmxVOj4gLkaFQYts=";
+  cargoSha256 = "sha256-V4frCaU5QzTx3ujdaplw7vNkosbzyXHQvE+T7ntVOtU=";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
diff --git a/pkgs/games/asc/default.nix b/pkgs/games/asc/default.nix
index a6a1129acad..46f8231680b 100644
--- a/pkgs/games/asc/default.nix
+++ b/pkgs/games/asc/default.nix
@@ -16,9 +16,11 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = "-fpermissive -Wno-error=narrowing -std=c++11"; # I'm too lazy to catch all gcc47-related problems
   hardeningDisable = [ "format" ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     SDL SDL_image SDL_mixer SDL_sound libsigcxx physfs boost expat
-    freetype libjpeg wxGTK lua perl pkg-config zlib zip bzip2 libpng
+    freetype libjpeg wxGTK lua perl zlib zip bzip2 libpng
     libtiff fluidsynth libmikmod flac libvorbis libogg
   ];
 
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index 4eb46e0ac15..ec65db97ce4 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -58,7 +58,7 @@ in stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
+  NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2}/include/SDL2 -I${lib.getDev SDL2_mixer}/include/SDL2";
 
   makeFlags = [
     "SDLCONFIG=${SDL2}/bin/sdl2-config"
diff --git a/pkgs/games/extremetuxracer/default.nix b/pkgs/games/extremetuxracer/default.nix
index 416a3ac913e..71887c8b47d 100644
--- a/pkgs/games/extremetuxracer/default.nix
+++ b/pkgs/games/extremetuxracer/default.nix
@@ -13,11 +13,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-HIdJZeniSVM78VwI2rxh5gwFuz/VeJF4gBF/+KkQzU4=";
   };
 
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
     libGLU libGL libX11 xorgproto tcl freeglut freetype
     sfml libXi
     libXmu libXext libXt libSM libICE
-    libpng pkg-config gettext intltool
+    libpng gettext
   ];
 
   configureFlags = [ "--with-tcl=${tcl}/lib" ];
diff --git a/pkgs/games/freedink/default.nix b/pkgs/games/freedink/default.nix
index b48d7e52cf3..ecdcbb7dce6 100644
--- a/pkgs/games/freedink/default.nix
+++ b/pkgs/games/freedink/default.nix
@@ -25,9 +25,11 @@ in stdenv.mkDerivation rec {
     sha256 = "19xximbcm6506kvpf3s0q96697kmzca3yrjdr6dgphklp33zqsqr";
   };
 
+  nativeBuildInputs = [ pkg-config intltool ];
+
   buildInputs = [
     SDL SDL_mixer SDL_image SDL_ttf SDL_gfx
-    pkg-config intltool fontconfig libzip zip zlib
+    fontconfig libzip zip zlib
   ];
 
   preConfigure = ''
diff --git a/pkgs/games/iortcw/sp.nix b/pkgs/games/iortcw/sp.nix
index d9faa177c17..ba8a4dd10bd 100644
--- a/pkgs/games/iortcw/sp.nix
+++ b/pkgs/games/iortcw/sp.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = [
     "-I${SDL2.dev}/include/SDL2"
-    "-I${opusfile}/include/opus"
+    "-I${opusfile.dev}/include/opus"
   ];
   NIX_CFLAGS_LINK = [ "-lSDL2" ];
 
diff --git a/pkgs/games/ivan/default.nix b/pkgs/games/ivan/default.nix
index 53e1b3cf00e..80dc182127d 100644
--- a/pkgs/games/ivan/default.nix
+++ b/pkgs/games/ivan/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = ["-DCMAKE_CXX_FLAGS=-DWIZARD"];
 
   # Help CMake find SDL_mixer.h
-  NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";
+  NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2_mixer}/include/SDL2";
 
   # Create "ivan.desktop" file
   ivanDesktop = makeDesktopItem {
diff --git a/pkgs/games/srb2/default.nix b/pkgs/games/srb2/default.nix
index 57488bdb8b1..26bc4eae96c 100644
--- a/pkgs/games/srb2/default.nix
+++ b/pkgs/games/srb2/default.nix
@@ -60,8 +60,8 @@ in stdenv.mkDerivation rec {
     "-DSRB2_ASSET_DIRECTORY=/build/source/assets"
     "-DGME_INCLUDE_DIR=${game-music-emu}/include"
     "-DOPENMPT_INCLUDE_DIR=${libopenmpt.dev}/include"
-    "-DSDL2_MIXER_INCLUDE_DIR=${SDL2_mixer}/include/SDL2"
-    "-DSDL2_INCLUDE_DIR=${SDL2.dev}/include/SDL2"
+    "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
+    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2}/include/SDL2"
   ];
 
   patches = [
diff --git a/pkgs/games/srb2kart/default.nix b/pkgs/games/srb2kart/default.nix
index e5a29aa5654..cb68125adda 100644
--- a/pkgs/games/srb2kart/default.nix
+++ b/pkgs/games/srb2kart/default.nix
@@ -52,8 +52,8 @@ in stdenv.mkDerivation rec {
   cmakeFlags = [
     #"-DSRB2_ASSET_DIRECTORY=/build/source/assets"
     "-DGME_INCLUDE_DIR=${game-music-emu}/include"
-    "-DSDL2_MIXER_INCLUDE_DIR=${SDL2_mixer}/include/SDL2"
-    "-DSDL2_INCLUDE_DIR=${SDL2.dev}/include/SDL2"
+    "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
+    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2}/include/SDL2"
   ];
 
   patches = [
diff --git a/pkgs/games/uhexen2/default.nix b/pkgs/games/uhexen2/default.nix
index c76dd9ec252..b9bde8d3e43 100644
--- a/pkgs/games/uhexen2/default.nix
+++ b/pkgs/games/uhexen2/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     runHook preBuild
     for makefile in "''${makeFiles[@]}"; do
           local flagsArray=(
-            -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+            -j$NIX_BUILD_CORES
             SHELL=$SHELL
             $makeFlags "''${makeFlagsArray[@]}"
             $buildFlags "''${buildFlagsArray[@]}"
diff --git a/pkgs/games/xboard/default.nix b/pkgs/games/xboard/default.nix
index eefbb90114f..af75ec79e73 100644
--- a/pkgs/games/xboard/default.nix
+++ b/pkgs/games/xboard/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libX11
     xorgproto
@@ -51,7 +52,6 @@ stdenv.mkDerivation rec {
     gnuchess
     texinfo
     libXpm
-    pkg-config
     librsvg
     cairo
     pango
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index 8865e8f992d..d29e43850fb 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -83,14 +83,14 @@ let
     '';
 
     buildPhase = (lib.optionalString withDedicated ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES sv-${target}
+      make -j $NIX_BUILD_CORES sv-${target}
     '' + lib.optionalString withGLX ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES cl-${target}
+      make -j $NIX_BUILD_CORES cl-${target}
     '' + lib.optionalString withSDL ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES sdl-${target}
+      make -j $NIX_BUILD_CORES sdl-${target}
     '') + ''
       pushd ../d0_blind_id
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES
+      make -j $NIX_BUILD_CORES
       popd
     '';
 
diff --git a/pkgs/misc/cups/drivers/canon/default.nix b/pkgs/misc/cups/drivers/canon/default.nix
index 07b81ce9bc2..12e4f5cac96 100644
--- a/pkgs/misc/cups/drivers/canon/default.nix
+++ b/pkgs/misc/cups/drivers/canon/default.nix
@@ -44,7 +44,7 @@ let
     sha256 = "sha256:069z6ijmql62mcdyxnzc9mf0dxa6z1107cd0ab4i1adk8kr3d75k";
   };
 
-  buildInputs = [ cups zlib jbigkit glib gtk3 pkg-config gnome2.libglade libxml2 gdk-pixbuf pango cairo atk ];
+  buildInputs = [ cups zlib jbigkit glib gtk3 gnome2.libglade libxml2 gdk-pixbuf pango cairo atk ];
 in
 stdenv.mkDerivation rec {
   pname = "canon-cups-ufr2";
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  nativeBuildInputs = [ makeWrapper unzip autoconf automake libtool_1_5 ];
+  nativeBuildInputs = [ makeWrapper unzip autoconf automake libtool_1_5 pkg-config ];
 
   inherit buildInputs;
 
diff --git a/pkgs/misc/screensavers/alock/default.nix b/pkgs/misc/screensavers/alock/default.nix
index 87c81531122..74155f43c2b 100644
--- a/pkgs/misc/screensavers/alock/default.nix
+++ b/pkgs/misc/screensavers/alock/default.nix
@@ -21,9 +21,9 @@ stdenv.mkDerivation rec {
     "--enable-imlib2"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
-    autoreconfHook libX11
+    libX11
     pam libgcrypt libXrender imlib2
   ];
 
diff --git a/pkgs/misc/stabber/default.nix b/pkgs/misc/stabber/default.nix
index eb0d6a4109d..478cbda3dc0 100644
--- a/pkgs/misc/stabber/default.nix
+++ b/pkgs/misc/stabber/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation {
     mkdir m4
   '';
 
-  buildInputs = [ autoreconfHook pkg-config glib expat libmicrohttpd ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  buildInputs = [ glib expat libmicrohttpd ];
 
   meta = {
     description = "Stubbed XMPP Server";
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index 05340642f8d..b7666fe31cd 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -168,7 +168,7 @@ in rec {
   bareFrameworks = (
     lib.mapAttrs framework (import ./frameworks.nix {
       inherit frameworks libs;
-      inherit (pkgs.darwin.apple_sdk_11_0) libnetwork Libsystem;
+      inherit (pkgs.darwin.apple_sdk_11_0) libnetwork;
       libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
     })
   ) // (
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index b29a36177a8..4565f698d26 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -50,7 +50,9 @@ let
     libcharset = callPackage ./libcharset.nix {};
     libunwind = callPackage ./libunwind.nix {};
     libnetwork = callPackage ./libnetwork.nix {};
-    objc4 = callPackage ./libobjc.nix {};
+    # Avoid introducing a new objc4 if stdenv already has one, to prevent
+    # conflicting LLVM modules.
+    objc4 = if stdenv ? objc4 then stdenv.objc4 else callPackage ./libobjc.nix {};
 
     # questionable aliases
     configd = pkgs.darwin.apple_sdk.frameworks.SystemConfiguration;
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
index e9121b02116..dc4ab1955b5 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -1,4 +1,4 @@
-{ frameworks, libs, libobjc, Libsystem, libnetwork }: with frameworks; with libs;
+{ frameworks, libs, libobjc, libnetwork }: with frameworks; with libs;
 {
   AGL                              = { inherit Carbon OpenGL; };
   AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics simd UniformTypeIdentifiers; };
@@ -89,9 +89,7 @@
   IOBluetooth                      = { inherit CoreBluetooth IOKit; };
   IOBluetoothUI                    = { inherit IOBluetooth; };
   IOKit                            = {};
-  # `IOSurface` should depend on `Libsystem` (in place of `xpc`) but this currently causes build
-  # issues due to incompatibility issues between `Libsystem` and `libcxx`.
-  IOSurface                        = { inherit IOKit xpc; };
+  IOSurface                        = { inherit IOKit; };
   IOUSBHost                        = {};
   IdentityLookup                   = {};
   ImageCaptureCore                 = {};
diff --git a/pkgs/os-specific/darwin/libtapi/default.nix b/pkgs/os-specific/darwin/libtapi/default.nix
index da071074097..eba61a15ccb 100644
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@@ -40,12 +40,15 @@ stdenv.mkDerivation {
         let
           nativeCC = pkgsBuildBuild.stdenv.cc;
           nativeBintools = nativeCC.bintools.bintools;
+          nativeLibcxxabi = lib.getLib pkgsBuildBuild.libcxxabi;
           nativeToolchainFlags = [
             "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
             "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
             "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
             "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
             "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+            "-DCMAKE_EXE_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
+            "-DCMAKE_SHARED_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
           ];
         in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
       )
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 67d8f107ce3..2fce9d6f0d7 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.52";
+  version = "0.53";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-JnkNWWdr0CSlwME619BBWkvelFZoZpzmAR53nm2bSqM=";
+    sha256 = "sha256-txtXPWmLfZLBsK3s94W5LyA81mTHStpP3nkq6KW33Mk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index dfd5f5724ef..b62b6946e42 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.29";
+  version = "1.30";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-W2MOK6aIa1whkj13OeuibNjL/2LWt7TO8h4JeoUrZnQ=";
+    sha256 = "sha256-9uyYXxnxRqWvzrw3QXCOT/ZubQ8/nrB+b60jKn1hAJk=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 97bf388d46a..3a71563593e 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -481,6 +481,7 @@ let
       DEBUG_LIST                       = yes;
       # Detect writes to read-only module pages
       DEBUG_SET_MODULE_RONX            = whenOlder "4.11" (option yes);
+      HARDENED_USERCOPY                = yes;
       RANDOMIZE_BASE                   = option yes;
       STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
       IO_STRICT_DEVMEM                 = mkDefault yes;
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 0577107fd02..75ba8710449 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -7,11 +7,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.65";
+  version = "2.66";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-c+NQAgzDH+FTYIedGThP+jOVqCXwZfz2vaOlzfllvr0=";
+    sha256 = "sha256-FcQO3tswA9cKKD/lh6NrfRnIs7VU4z+GEpwFmku0ZrI=";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/libpsm2/default.nix b/pkgs/os-specific/linux/libpsm2/default.nix
index ebfe492f736..43c9bf74e3f 100644
--- a/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/pkgs/os-specific/linux/libpsm2/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ numactl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ numactl ];
 
   makeFlags = [
     # Disable blanket -Werror to avoid build failures
diff --git a/pkgs/os-specific/linux/lightum/default.nix b/pkgs/os-specific/linux/lightum/default.nix
index 95b766aec05..e9925b95bcd 100644
--- a/pkgs/os-specific/linux/lightum/default.nix
+++ b/pkgs/os-specific/linux/lightum/default.nix
@@ -11,13 +11,14 @@ stdenv.mkDerivation {
     sha256 = "sha256-dzWUVY2srgk6BM6jZ7FF+snxnPopz3fx9nq+mVkmogc=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     dbus
     glib
     libX11
     libXScrnSaver
     libXext
-    pkg-config
     systemd
   ];
 
diff --git a/pkgs/os-specific/linux/pam_usb/default.nix b/pkgs/os-specific/linux/pam_usb/default.nix
index ebd45246ae8..1264894ad0c 100644
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     # pam_usb dependencies
-    dbus libxml2 pam pmount pkg-config
+    dbus libxml2 pam pmount
     # pam_usb's tools dependencies
     python
     # cElementTree is included with python 2.5 and later.
diff --git a/pkgs/os-specific/linux/pmount/default.nix b/pkgs/os-specific/linux/pmount/default.nix
index 0f65e0278ca..8267a2d4a7f 100644
--- a/pkgs/os-specific/linux/pmount/default.nix
+++ b/pkgs/os-specific/linux/pmount/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "db38fc290b710e8e9e9d442da2fb627d41e13b3ee80326c15cc2595ba00ea036";
   };
 
-  buildInputs = [ intltool util-linux ];
+  nativeBuildInputs = [ intltool util-linux ];
+  buildInputs = [ util-linux ];
 
   configureFlags = [
     "--with-media-dir=${mediaDir}"
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index d27aaa1f137..0aff1bdd789 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   # because the Makefile would not print warnings about too old
   # libraries (see "warning:" in the Makefile)
   postBuild = ''
-    make libs doc -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+    make libs doc -j$NIX_BUILD_CORES
   '';
 
   installTargets = [
diff --git a/pkgs/os-specific/linux/xf86-video-nested/default.nix b/pkgs/os-specific/linux/xf86-video-nested/default.nix
index bba646e583b..4092e3797c2 100644
--- a/pkgs/os-specific/linux/xf86-video-nested/default.nix
+++ b/pkgs/os-specific/linux/xf86-video-nested/default.nix
@@ -12,9 +12,11 @@ stdenv.mkDerivation {
     sha256 = "133rd2kvr2q2wmwpx82bb93qbi8wm8qp1vlmbhgc7aslz0j4cqqv";
   };
 
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+
   buildInputs =
-    [ autoreconfHook xorgproto libX11 libXext pixman
-      pkg-config utilmacros xorgserver
+    [ xorgproto libX11 libXext pixman
+      utilmacros xorgserver
     ];
 
   hardeningDisable = [ "fortify" ];
diff --git a/pkgs/servers/matrix-conduit/default.nix b/pkgs/servers/matrix-conduit/default.nix
index 4eced54bc72..d328a8d5c23 100644
--- a/pkgs/servers/matrix-conduit/default.nix
+++ b/pkgs/servers/matrix-conduit/default.nix
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = with pkgs; [
     rustPlatform.bindgenHook
+    pkg-config
   ];
 
   buildInputs = with pkgs; [
-    pkg-config
     rocksdb
   ];
 
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index c54cba96d10..6b09105ef20 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -116,6 +116,11 @@ stdenv.mkDerivation rec {
     "-Dsysconfdir=/etc"
     "-Dsysconfdir_install=${placeholder "out"}/etc"
     "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
+
+    # pulseaudio complains if its binary is moved after installation;
+    # this is needed so that wrapGApp can operate *without*
+    # renaming the unwrapped binaries (see below)
+    "--bindir=${placeholder "out"}/.bin-unwrapped"
   ]
   ++ lib.optional (stdenv.isLinux && useSystemd) "-Dsystemduserunitdir=${placeholder "out"}/lib/systemd/user"
   ++ lib.optionals stdenv.isDarwin [
@@ -133,11 +138,11 @@ stdenv.mkDerivation rec {
   postInstall = lib.optionalString libOnly ''
     find $out/share -maxdepth 1 -mindepth 1 ! -name "vala" -prune -exec rm -r {} \;
     find $out/share/vala -maxdepth 1 -mindepth 1 ! -name "vapi" -prune -exec rm -r {} \;
-    rm -r $out/{bin,etc,lib/pulse-*}
+    rm -r $out/{.bin-unwrapped,etc,lib/pulse-*}
   ''
     + ''
     moveToOutput lib/cmake "$dev"
-    rm -f $out/bin/qpaeq # this is packaged by the "qpaeq" package now, because of missing deps
+    rm -f $out/.bin-unwrapped/qpaeq # this is packaged by the "qpaeq" package now, because of missing deps
   '';
 
   preFixup = lib.optionalString (stdenv.isLinux  && (stdenv.hostPlatform == stdenv.buildPlatform)) ''
@@ -151,6 +156,15 @@ stdenv.mkDerivation rec {
       ln -s "''$file" "''${file%.dylib}.so"
       ln -s "''$file" "$out/lib/pulseaudio/''$(basename ''$file .dylib).so"
     done
+  ''
+  # put symlinks to binaries in `$prefix/bin`;
+  # then wrapGApp will *rename these symlinks* instead of
+  # the original binaries in `$prefix/.bin-unwrapped` (see above);
+  # when pulseaudio is looking for its own binary (it does!),
+  # it will be happy to find it in its original installation location
+  + lib.optionalString (!libOnly) ''
+    mkdir -p $out/bin
+    ln -st $out/bin $out/.bin-unwrapped/*
   '';
 
   meta = {
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index 82aa67a45d4..24e7b87f5c7 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -14,8 +14,8 @@ let
 
   pkgConfig = {
     node-sass = {
-      nativeBuildInputs = [ ];
-      buildInputs = [ libsass pkg-config python3 ];
+      nativeBuildInputs = [ pkg-config ];
+      buildInputs = [ libsass python3 ];
       postInstall = ''
         LIBSASS_EXT=auto yarn --offline run build
         rm build/config.gypi
diff --git a/pkgs/servers/web-apps/sogo/default.nix b/pkgs/servers/web-apps/sogo/default.nix
index 94672ffe6f1..286883722f6 100644
--- a/pkgs/servers/web-apps/sogo/default.nix
+++ b/pkgs/servers/web-apps/sogo/default.nix
@@ -14,8 +14,8 @@ gnustep.stdenv.mkDerivation rec {
     hash = "sha256-3Xy0y1sdixy4gXhzhP9mfWeaDmOVJty+X95xCyxayPE=";
   };
 
-  nativeBuildInputs = [ gnustep.make makeWrapper python3 ];
-  buildInputs = [ gnustep.base sope openssl libmemcached curl libsodium libytnef libzip pkg-config openldap oath-toolkit ]
+  nativeBuildInputs = [ gnustep.make makeWrapper python3 pkg-config ];
+  buildInputs = [ gnustep.base sope openssl libmemcached curl libsodium libytnef libzip openldap oath-toolkit ]
     ++ lib.optional enableActiveSync libwbxml;
 
   patches = lib.optional enableActiveSync ./enable-activesync.patch;
diff --git a/pkgs/servers/x11/quartz-wm/default.nix b/pkgs/servers/x11/quartz-wm/default.nix
index 9beb0553395..2d132b389be 100644
--- a/pkgs/servers/x11/quartz-wm/default.nix
+++ b/pkgs/servers/x11/quartz-wm/default.nix
@@ -12,6 +12,7 @@ in stdenv.mkDerivation {
     ./no_title_crash.patch
     ./extern-patch.patch
   ];
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     xorg.libXinerama
     xorg.libAppleWM
@@ -19,7 +20,6 @@ in stdenv.mkDerivation {
     xorg.libXrandr
     xorg.libXext
     pixman
-    pkg-config
     AppKit Xplugin Foundation
   ];
   meta = with lib; {
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index ff56f1de022..9a7cd9aa9de 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -698,6 +698,11 @@ rec {
         libc = pkgs.darwin.Libsystem;
         shellPackage = pkgs.bash;
         inherit bootstrapTools;
+      } // lib.optionalAttrs useAppleSDKLibs {
+        # This objc4 will be propagated to all builds using the final stdenv,
+        # and we shouldn't mix different builds, because they would be
+        # conflicting LLVM modules. Export it here so we can grab it later.
+        inherit (pkgs.darwin) objc4;
       };
 
       allowedRequisites = (with pkgs; [
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index f0fcb30451d..62f9121d73d 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1100,7 +1100,7 @@ buildPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             $buildFlags "${buildFlagsArray[@]}"
@@ -1139,7 +1139,7 @@ checkPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelChecking:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             ${checkFlags:-VERBOSE=y} "${checkFlagsArray[@]}"
@@ -1273,7 +1273,7 @@ installCheckPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelChecking:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             $installCheckFlags "${installCheckFlagsArray[@]}"
diff --git a/pkgs/tools/X11/xnee/default.nix b/pkgs/tools/X11/xnee/default.nix
index d2236dfe354..c16da204f2f 100644
--- a/pkgs/tools/X11/xnee/default.nix
+++ b/pkgs/tools/X11/xnee/default.nix
@@ -33,9 +33,10 @@ stdenv.mkDerivation rec {
         --replace 'LIBSEMA="CCC"' 'LIBSEMA=""'
     '';
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
     [ libX11 xorgproto libXext libXtst gtk2
-      libXi pkg-config
+      libXi
       texinfo
     ];
 
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 549096ec0e4..724301854b4 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
         --with-xkb-path=${xkeyboard_config}/share/X11/xkb \
         --with-xkb-bin-directory=${xorg.xkbcomp}/bin \
         --with-xkb-output=$out/share/X11/xkb/compiled
-    make TIGERVNC_SRC=$src TIGERVNC_BUILDDIR=`pwd`/../.. -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+    make TIGERVNC_SRC=$src TIGERVNC_BUILDDIR=`pwd`/../.. -j$NIX_BUILD_CORES
     popd
   '' + lib.optionalString stdenv.isDarwin ''
     make dmg
diff --git a/pkgs/tools/audio/midimonster/default.nix b/pkgs/tools/audio/midimonster/default.nix
index 3792d997aa0..841704427c2 100644
--- a/pkgs/tools/audio/midimonster/default.nix
+++ b/pkgs/tools/audio/midimonster/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
   pname = "midimonster";
   version = "0.6.0";
 
-  buildInputs = [pkg-config gnumake gcc lua5_4 openssl jack1 python3 alsa-lib ncurses libevdev];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [gnumake gcc lua5_4 openssl jack1 python3 alsa-lib ncurses libevdev];
 
   src = fetchFromGitHub {
     repo = "midimonster";
diff --git a/pkgs/tools/audio/mpdcron/default.nix b/pkgs/tools/audio/mpdcron/default.nix
index 94ba5a56d03..924181608af 100644
--- a/pkgs/tools/audio/mpdcron/default.nix
+++ b/pkgs/tools/audio/mpdcron/default.nix
@@ -31,10 +31,9 @@ in stdenv.mkDerivation {
     sha256 = "0vdksf6lcgmizqr5mqp0bbci259k0dj7gpmhx32md41jlmw5skaw";
   };
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [
     libtool
-    pkg-config
     glib
     libdaemon
     pandoc
diff --git a/pkgs/tools/backup/dump/default.nix b/pkgs/tools/backup/dump/default.nix
index 75a449a1276..f9e1b68ac39 100644
--- a/pkgs/tools/backup/dump/default.nix
+++ b/pkgs/tools/backup/dump/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0CGs3k+77T2T662YFCL2cfSNZrKeyI196DZC7Pv/T9A=";
   };
 
-  buildInputs = [ e2fsprogs pkg-config ncurses readline ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ e2fsprogs ncurses readline ];
 
   meta = with lib; {
     homepage = "https://dump.sourceforge.io/";
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index bd28ca63e80..771188a98cd 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -24,7 +24,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ xz.bin ];
 
-  makeFlags = [ "SHELL=/bin/sh" "GREP=grep" ];
+  makeFlags = [
+    "SHELL=/bin/sh"
+    "GREP=grep"
+    # gzip 1.12 doesn't build `zless` unless it can find `less`, but we
+    # can avoid having `less` as a build input if we just override these.
+    "ZLESS_MAN=zless.1"
+    "ZLESS_PROG=zless"
+  ];
 
   # Many gzip executables are shell scripts that depend upon other gzip
   # executables being in $PATH.  Rather than try to re-write all the
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index 579ee9b2094..584b000a3e2 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -14,12 +14,10 @@ stdenv.mkDerivation rec {
     owner = pname;
   };
 
-  patches = lib.optionals (!enableShared) [
-    # This patch is already part of the `dev` branch.
-    # Remove when upgrading to the next version.
-    (fetchpatch {
-      name = "lz4-fix-BUILD_SHARED=no.patch";
-      url = "https://github.com/lz4/lz4/commit/5ccbd38277989ae6a728171d59ae03bad6f2f4d5.patch";
+  patches = [
+    (fetchpatch { # https://github.com/lz4/lz4/pull/1162
+      name = "build-shared-no.patch";
+      url = "https://github.com/lz4/lz4/commit/851ef4b23c7cbf4ceb2ba1099666a8b5ec4fa195.patch";
       sha256 = "sha256-P+/uz3m7EAmHgXF/1Vncc0uKKxNVq6HNIsElx0rGxpw=";
     })
   ];
diff --git a/pkgs/tools/filesystems/httpfs/default.nix b/pkgs/tools/filesystems/httpfs/default.nix
index 61843e4c65b..24233a8441d 100644
--- a/pkgs/tools/filesystems/httpfs/default.nix
+++ b/pkgs/tools/filesystems/httpfs/default.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "1h8ggvhw30n2r6w11n1s458ypggdqx6ldwd61ma4yd7binrlpjq1";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config fuse openssl
+    [ fuse openssl
       asciidoc docbook_xml_dtd_45 docbook_xsl libxml2 libxslt
     ];
 
diff --git a/pkgs/tools/graphics/s2png/default.nix b/pkgs/tools/graphics/s2png/default.nix
index c1124880944..d3f8b74512a 100644
--- a/pkgs/tools/graphics/s2png/default.nix
+++ b/pkgs/tools/graphics/s2png/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y3crfm0jqprgxamlly713cka2x1bp6z63p1lw9wh4wc37kpira6";
   };
 
-  buildInputs = [ diffutils gd pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ diffutils gd ];
   installFlags = [ "prefix=" "DESTDIR=$(out)" ];
 
   meta = {
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index cc290ab0eca..ff3b0afad25 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m17n_db, autoreconfHook, pkg-config }:
+{ lib, stdenv, fetchurl, fetchpatch, m17n_db, autoreconfHook, pkg-config }:
 stdenv.mkDerivation rec {
   pname = "m17n-lib";
   version = "1.8.0";
@@ -8,6 +8,17 @@ stdenv.mkDerivation rec {
     sha256 = "0jp61y09xqj10mclpip48qlfhniw8gwy8b28cbzxy8hq8pkwmfkq";
   };
 
+  patches = [
+    (fetchpatch {
+      # Patch pending upstream inclusion:
+      #   https://savannah.nongnu.org/bugs/index.php?61377
+      name = "parallel-build.patch";
+      url = "https://savannah.nongnu.org/bugs/download.php?file_id=53704";
+      hash = "sha256-1smKSIFVRJZSwCv0NiUsnndxKcPnJ/wqzH8+ka6nfNM=";
+      excludes = [ "src/ChangeLog" ];
+    })
+  ];
+
   strictDeps = true;
 
   # reconf needed to sucesfully cross-compile
@@ -17,10 +28,7 @@ stdenv.mkDerivation rec {
     m17n_db
   ];
 
-  # Fails parallel build due to missing intra-package depends:
-  #   https://savannah.nongnu.org/bugs/index.php?61377
-  #     make[2]: *** No rule to make target '../src/libm17n-core.la', needed by 'libm17n.la'.  Stop.
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;
 
   meta = {
     homepage = "https://www.nongnu.org/m17n/";
diff --git a/pkgs/tools/misc/cpuminer/default.nix b/pkgs/tools/misc/cpuminer/default.nix
index 27bf0ec5374..eb7a73e469c 100644
--- a/pkgs/tools/misc/cpuminer/default.nix
+++ b/pkgs/tools/misc/cpuminer/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
 
   patchPhase = if stdenv.cc.isClang then "${perl}/bin/perl ./nomacro.pl" else null;
 
-  buildInputs = [ curl jansson autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ curl jansson ];
 
   configureFlags = [ "CFLAGS=-O3" ];
 
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 5a792c040b3..45f45e89e82 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, tcl, makeWrapper, autoreconfHook, fetchpatch }:
+{ lib, stdenv, buildPackages, fetchurl, tcl, makeWrapper, autoreconfHook, fetchpatch, substituteAll }:
 
 tcl.mkTclDerivation rec {
   pname = "expect";
@@ -14,6 +14,10 @@ tcl.mkTclDerivation rec {
       url = "https://raw.githubusercontent.com/buildroot/buildroot/c05e6aa361a4049eabd8b21eb64a34899ef83fc7/package/expect/0001-enable-cross-compilation.patch";
       sha256 = "1jwx2l1slidvcpahxbyqs942l81jd62rzbxliyd9lwysk38c8b6b";
     })
+    (substituteAll {
+      src = ./fix-cross-compilation.patch;
+      tcl = "${buildPackages.tcl}/bin/tclsh";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/expect/fix-cross-compilation.patch b/pkgs/tools/misc/expect/fix-cross-compilation.patch
new file mode 100644
index 00000000000..8edc4bea39d
--- /dev/null
+++ b/pkgs/tools/misc/expect/fix-cross-compilation.patch
@@ -0,0 +1,11 @@
+--- a/Makefile.in	2022-09-07 21:46:37.090519258 +0200
++++ b/Makefile.in	2022-09-07 21:46:21.462592279 +0200
+@@ -380,7 +380,7 @@
+ 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
+ 
+ $(SCRIPTS):
+-	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
++	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
+ 
+ ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
+ ## expansion references the contents of LIBS, which contains linker
diff --git a/pkgs/tools/misc/notify-desktop/default.nix b/pkgs/tools/misc/notify-desktop/default.nix
index c906443b07c..22b5035da51 100644
--- a/pkgs/tools/misc/notify-desktop/default.nix
+++ b/pkgs/tools/misc/notify-desktop/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1brcvl2fx0yzxj9mc8hzfl32zdka1f1bxpzsclcsjplyakyinr1a";
   };
 
-  buildInputs = [ dbus pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dbus ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/popsicle/default.nix b/pkgs/tools/misc/popsicle/default.nix
index e9369270fcd..bae9465c7cb 100644
--- a/pkgs/tools/misc/popsicle/default.nix
+++ b/pkgs/tools/misc/popsicle/default.nix
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
   postPatch = ''
     # Have to do this here instead of in preConfigure because
     # cargoDepsCopy gets unset after postPatch.
-    configureFlagsArray+=("RUST_VENDORED_SOURCES=$NIX_BUILD_TOP/$cargoDepsCopy")
+    configureFlagsArray+=("RUST_VENDORED_SOURCES=$cargoDepsCopy")
   '';
 
   makeFlags = [
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index 76736912301..ebf2f082db0 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , pkg-config
 , llvmPackages
@@ -40,10 +41,28 @@ rustPlatform.buildRustPackage {
     owner = "vectordotdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RfKg14r3B5Jx2vIa4gpJs5vXRqSXKOXKRFmmQmzQorQ=";
+    hash = "sha256-RfKg14r3B5Jx2vIa4gpJs5vXRqSXKOXKRFmmQmzQorQ=";
   };
 
-  cargoSha256 = "sha256-l2rrT2SeeH4bYYlzSiFASNBxtg4TBm1dRA4cFRfvpkk=";
+  patches = [
+    (fetchpatch {
+      name = "rust-1.64-part1.patch";
+      url = "https://github.com/vectordotdev/vector/commit/e7437df97711b6a660a3532fe5026244472a900f.patch";
+      hash = "sha256-EyheI3nngt72+ZZNNsjp3KV1CuRb9CZ7wUCHt0twFVs=";
+    })
+    (fetchpatch {
+      name = "rust-1.64-part2.patch";
+      url = "https://github.com/vectordotdev/vector/commit/e80c7afaf7601cf936c7c3468bd7b4b230ef6149.patch";
+      hash = "sha256-pHcq7XLn+9PKs0DnBTK5FawN5KSF8BuJf7sBO9u5Gb8=";
+      excludes = [
+        # There are too many conflicts to easily resolve patching this file, but
+        # the changes here do not block compilation.
+        "lib/lookup/src/lookup_v2/owned.rs"
+      ];
+    })
+  ];
+
+  cargoHash = "sha256-l2rrT2SeeH4bYYlzSiFASNBxtg4TBm1dRA4cFRfvpkk=";
   nativeBuildInputs = [ pkg-config cmake perl ];
   buildInputs = [ oniguruma openssl protobuf rdkafka zstd ]
     ++ lib.optionals stdenv.isDarwin [ Security libiconv coreutils CoreServices ];
@@ -111,3 +130,4 @@ rustPlatform.buildRustPackage {
     platforms = with platforms; all;
   };
 }
+
diff --git a/pkgs/tools/networking/nss-mdns/default.nix b/pkgs/tools/networking/nss-mdns/default.nix
index 238c0c364f9..f2af99a922f 100644
--- a/pkgs/tools/networking/nss-mdns/default.nix
+++ b/pkgs/tools/networking/nss-mdns/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-iRaf9/gu9VkGi1VbGpxvC5q+0M8ivezCz/oAKEg5V1M=";
   };
 
-  buildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   # Note: Although `nss-mdns' works by talking to `avahi-daemon', it
   # doesn't depend on the Avahi libraries.  Instead, it contains
   # hand-written D-Bus code to talk to the Avahi daemon.
diff --git a/pkgs/tools/networking/ofono/default.nix b/pkgs/tools/networking/ofono/default.nix
index 80e37782154..3733998c10b 100644
--- a/pkgs/tools/networking/ofono/default.nix
+++ b/pkgs/tools/networking/ofono/default.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ofono";
-  version = "1.34";
+  version = "2.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/network/ofono/ofono.git";
     rev = version;
-    sha256 = "sha256-mqltc+/RmQO8awP+J7p9fCVhNsEYA3SgxeV5Gkr1srg=";
+    sha256 = "sha256-T8rfReruvHGQCN9IDGIrFCoNjFKKMnUGPKzxo2HTZFQ=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/sipsak/default.nix b/pkgs/tools/networking/sipsak/default.nix
index 668dc18f8ac..89a7d706ccd 100644
--- a/pkgs/tools/networking/sipsak/default.nix
+++ b/pkgs/tools/networking/sipsak/default.nix
@@ -4,8 +4,8 @@ stdenv.mkDerivation rec {
   pname = "sipsak";
   version = "4.1.2.1";
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [
-    autoreconfHook
     openssl
     c-ares
   ];
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 189cc14ff1b..25fcc1bcc39 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,20 +48,20 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.16.2";
+  version = "1.16.3";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-LjLyg4IMJMUcod2K/s/bdHxzhaE3q+hlyZ20sldANYE=";
+    hash = "sha256-6gxmZeLDMlt2nqwd/M1g/hgo1fz2YmUAOezLP2ftso4=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
 
-  nativeBuildInputs = [ makeWrapper ]
+  nativeBuildInputs = [ makeWrapper pkg-config ]
     ++ lib.optionals withPythonModule [ swig ];
 
   buildInputs = [ openssl nettle expat libevent ]
-    ++ lib.optionals withSystemd [ pkg-config systemd ]
+    ++ lib.optionals withSystemd [ systemd ]
     ++ lib.optionals withDoH [ libnghttp2 ]
     ++ lib.optionals withPythonModule [ python ];
 
diff --git a/pkgs/tools/security/chrome-token-signing/default.nix b/pkgs/tools/security/chrome-token-signing/default.nix
index 18104aa7710..8081c7ef6eb 100644
--- a/pkgs/tools/security/chrome-token-signing/default.nix
+++ b/pkgs/tools/security/chrome-token-signing/default.nix
@@ -11,7 +11,8 @@ mkDerivation rec {
     sha256 = "sha256-wKy/RVR7jx5AkMJgHXsuV+jlzyfH5nDRggcIUgh2ML4=";
   };
 
-  buildInputs = [ qmake pcsclite pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ qmake pcsclite ];
   dontUseQmakeConfigure = true;
 
   patchPhase = ''
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index cd90342738e..777aaea41ec 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -35,11 +35,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optionals (!enablePython) [ "--disable-pywrap" ];
 
-  nativeBuildInputs = [ pkg-config makeWrapper ]
+  nativeBuildInputs = [ pkg-config makeWrapper intltool ]
   # if python2 support is requested, it is needed at builtime as well as runtime.
   ++ lib.optionals (enablePython) [ python2 ]
   ;
-  buildInputs = [ perl nss nspr pam intltool ]
+  buildInputs = [ perl nss nspr pam ]
   ++ lib.optionals (enablePython) [ python2 ]
   ;
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
diff --git a/pkgs/tools/security/fpm2/default.nix b/pkgs/tools/security/fpm2/default.nix
index 15d5a5adcff..69e6c7f0281 100644
--- a/pkgs/tools/security/fpm2/default.nix
+++ b/pkgs/tools/security/fpm2/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lfzja3vzd6l6hfvw8gvg4qkl5iy6gra5pa8gjlps9l63k2bjfhz";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gnupg gtk3 libxml2 intltool nettle ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gnupg gtk3 libxml2 nettle ];
 
   meta = with lib; {
     description = "GTK2 port from Figaro's Password Manager originally developed by John Conneely, with some new enhancements";
diff --git a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
index 1e46df40f85..22c11b3f2b1 100644
--- a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
+++ b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Kb8p53gPkhxtOhH2COKwSDwbtRDFr6hHMJAkndV8Ukk=";
   };
 
-  buildInputs = [ pkcs11helper pkg-config openssl ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pkcs11helper openssl ];
 
   configureFlags = [
     "--with-libgpg-error-prefix=${libgpg-error.dev}"
diff --git a/pkgs/tools/security/metasploit/shell.nix b/pkgs/tools/security/metasploit/shell.nix
index e4bae57b686..ccd510f63af 100644
--- a/pkgs/tools/security/metasploit/shell.nix
+++ b/pkgs/tools/security/metasploit/shell.nix
@@ -2,6 +2,7 @@
 with import <nixpkgs> {};
 stdenv.mkDerivation {
   name = "env";
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     bundix
     git
@@ -9,7 +10,6 @@ stdenv.mkDerivation {
     libpcap
     libxml2
     libxslt
-    pkg-config
     postgresql
     ruby.devEnv
     sqlite
diff --git a/pkgs/tools/security/onioncircuits/default.nix b/pkgs/tools/security/onioncircuits/default.nix
index 329de10ff6b..249762781e7 100644
--- a/pkgs/tools/security/onioncircuits/default.nix
+++ b/pkgs/tools/security/onioncircuits/default.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [ intltool ];
-  buildInputs = [ intltool gtk3 gobject-introspection ];
+  buildInputs = [ gtk3 gobject-introspection ];
   propagatedBuildInputs =  with python3.pkgs; [ stem distutils_extra pygobject3 ];
 
   postFixup = ''
diff --git a/pkgs/tools/security/tracee/default.nix b/pkgs/tools/security/tracee/default.nix
index 48d102e619d..7d93e6d76f7 100644
--- a/pkgs/tools/security/tracee/default.nix
+++ b/pkgs/tools/security/tracee/default.nix
@@ -63,7 +63,7 @@ buildGoModule rec {
 
   buildPhase = ''
     runHook preBuild
-    make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES -l$NIX_BUILD_CORES}
+    make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES
     runHook postBuild
   '';
 
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index 5fc242d533b..eedb0f07d13 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nr8l88cg19zj585hczj8v73yh21k7j13xivhlzl8jdk0j0cj052";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 libxml2 intltool gettext ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 libxml2 gettext ];
 
   patches = [ ./get_sensitive.patch ./set_flags.patch ];
 
diff --git a/pkgs/tools/text/mdbook-admonish/default.nix b/pkgs/tools/text/mdbook-admonish/default.nix
index 2809eee1fb4..c7303fc2fd8 100644
--- a/pkgs/tools/text/mdbook-admonish/default.nix
+++ b/pkgs/tools/text/mdbook-admonish/default.nix
@@ -1,15 +1,26 @@
-{ lib, stdenv, fetchCrate, rustPlatform, CoreServices }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, CoreServices }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-admonish";
   version = "1.7.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-QvFHpAsQ+S7q/Ye0YEf0phZcVvAs1a80Hd3eIGZBsrI=";
+  src = fetchFromGitHub {
+    owner = "tommilligan";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-AGOq05NevkRU8qHsJIWd2WfZ4i7w/wexf6c0fUAaoLg=";
   };
 
-  cargoSha256 = "sha256-v7MGJlDm5nvydjFAZZS94afZY2OVUjJQ9eXYaY9JxBs=";
+  cargoPatches = [
+    # https://github.com/tommilligan/mdbook-admonish/pull/33
+    (fetchpatch {
+      name = "update-mdbook-for-rust-1.64.patch";
+      url = "https://github.com/tommilligan/mdbook-admonish/commit/650123645b18a3f8ed170738c7c1813315095ed9.patch";
+      hash = "sha256-8LMk+Dgz9k0g9fbGGC0X2byyJtfDDgvdGxO06mD6GDI=";
+    })
+  ];
+
+  cargoHash = "sha256-5PWfze00/mWmzYqP5M1pAPt+SuknpU9dc0B7RSikuTE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/mdbook-graphviz/default.nix b/pkgs/tools/text/mdbook-graphviz/default.nix
index 353c2b99ee9..ec683072e1a 100644
--- a/pkgs/tools/text/mdbook-graphviz/default.nix
+++ b/pkgs/tools/text/mdbook-graphviz/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, CoreServices, graphviz }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, CoreServices, graphviz }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-graphviz";
@@ -8,10 +8,15 @@ rustPlatform.buildRustPackage rec {
     owner = "dylanowen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HTHGb23wc10iAWXX/TNMXjTLWm+OSf1WWW1+/aQRcsk=";
+    hash = "sha256-HTHGb23wc10iAWXX/TNMXjTLWm+OSf1WWW1+/aQRcsk=";
   };
 
-  cargoSha256 = "sha256-7z/4brKY9vpic8mv1b4P/8DE+VyColYnPPoPmY9891M=";
+  cargoPatches = [
+    # Remove when updating mdbook-graphviz past 0.1.4.
+    ./update-mdbook-for-rust-1.64.patch
+  ];
+
+  cargoHash = "sha256-keDyfXooPU/GOx56OTq5psDohfZ0E478bnWn0bbC29o=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/mdbook-graphviz/update-mdbook-for-rust-1.64.patch b/pkgs/tools/text/mdbook-graphviz/update-mdbook-for-rust-1.64.patch
new file mode 100644
index 00000000000..58f52cf00dc
--- /dev/null
+++ b/pkgs/tools/text/mdbook-graphviz/update-mdbook-for-rust-1.64.patch
@@ -0,0 +1,369 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 292fb1f..ce66190 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -26,15 +26,6 @@ dependencies = [
+  "url",
+ ]
+ 
+-[[package]]
+-name = "ansi_term"
+-version = "0.12.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
+-dependencies = [
+- "winapi 0.3.9",
+-]
+-
+ [[package]]
+ name = "anyhow"
+ version = "1.0.52"
+@@ -156,32 +147,36 @@ dependencies = [
+ 
+ [[package]]
+ name = "clap"
+-version = "2.34.0"
++version = "3.2.22"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
++checksum = "86447ad904c7fb335a790c9d7fe3d0d971dc523b8ccd1561a520de9a85302750"
+ dependencies = [
+- "ansi_term",
+  "atty",
+  "bitflags",
+- "strsim 0.8.0",
+- "textwrap 0.11.0",
+- "unicode-width",
+- "vec_map",
++ "clap_lex",
++ "indexmap",
++ "once_cell",
++ "strsim",
++ "termcolor",
++ "textwrap",
+ ]
+ 
+ [[package]]
+-name = "clap"
+-version = "3.0.4"
++name = "clap_complete"
++version = "3.2.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d01c9347757e131122b19cd19a05c85805b68c2352a97b623efdc3c295290299"
++checksum = "3f7a2e0a962c45ce25afce14220bc24f9dade0a1787f185cecf96bfba7847cd8"
++dependencies = [
++ "clap",
++]
++
++[[package]]
++name = "clap_lex"
++version = "0.2.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+ dependencies = [
+- "atty",
+- "bitflags",
+- "indexmap",
+  "os_str_bytes",
+- "strsim 0.10.0",
+- "termcolor",
+- "textwrap 0.14.2",
+ ]
+ 
+ [[package]]
+@@ -213,24 +208,21 @@ dependencies = [
+ 
+ [[package]]
+ name = "elasticlunr-rs"
+-version = "2.3.14"
++version = "3.0.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "60eee99ae400fb1c4521ea3bd678994cb66572754d240449368e8ecd40281569"
++checksum = "b94d9c8df0fe6879ca12e7633fdfe467c503722cc981fc463703472d2b876448"
+ dependencies = [
+- "lazy_static",
+  "regex",
+  "serde",
+  "serde_derive",
+  "serde_json",
+- "strum",
+- "strum_macros",
+ ]
+ 
+ [[package]]
+ name = "env_logger"
+-version = "0.7.1"
++version = "0.9.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
++checksum = "c90bf5f19754d10198ccb95b70664fc925bd1fc090a0fd9a6ebc54acc8cd6272"
+ dependencies = [
+  "atty",
+  "humantime",
+@@ -465,7 +457,7 @@ dependencies = [
+  "log",
+  "pest",
+  "pest_derive",
+- "quick-error 2.0.1",
++ "quick-error",
+  "serde",
+  "serde_json",
+ ]
+@@ -501,15 +493,6 @@ dependencies = [
+  "http",
+ ]
+ 
+-[[package]]
+-name = "heck"
+-version = "0.3.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+-dependencies = [
+- "unicode-segmentation",
+-]
+-
+ [[package]]
+ name = "hermit-abi"
+ version = "0.1.19"
+@@ -569,12 +552,9 @@ checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+ 
+ [[package]]
+ name = "humantime"
+-version = "1.3.0"
++version = "2.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+-dependencies = [
+- "quick-error 1.2.3",
+-]
++checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+ 
+ [[package]]
+ name = "hyper"
+@@ -763,14 +743,15 @@ checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
+ 
+ [[package]]
+ name = "mdbook"
+-version = "0.4.15"
++version = "0.4.21"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "241f10687eb3b4e0634b3b4e423f97c5f1efbd69dc9522e24a8b94583eeec3c6"
++checksum = "23f3e133c6d515528745ffd3b9f0c7d975ae039f0b6abb099f2168daa2afb4f9"
+ dependencies = [
+  "ammonia",
+  "anyhow",
+  "chrono",
+- "clap 2.34.0",
++ "clap",
++ "clap_complete",
+  "elasticlunr-rs",
+  "env_logger",
+  "futures-util",
+@@ -784,7 +765,6 @@ dependencies = [
+  "pulldown-cmark",
+  "regex",
+  "serde",
+- "serde_derive",
+  "serde_json",
+  "shlex",
+  "tempfile",
+@@ -798,7 +778,7 @@ dependencies = [
+ name = "mdbook-graphviz"
+ version = "0.1.4"
+ dependencies = [
+- "clap 3.0.4",
++ "clap",
+  "lazy_static",
+  "mdbook",
+  "pulldown-cmark",
+@@ -810,9 +790,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "memchr"
+-version = "2.4.1"
++version = "2.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
++checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+ 
+ [[package]]
+ name = "mime"
+@@ -968,6 +948,12 @@ dependencies = [
+  "libc",
+ ]
+ 
++[[package]]
++name = "once_cell"
++version = "1.15.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e82dad04139b71a90c080c8463fe0dc7902db5192d939bd0950f074d014339e1"
++
+ [[package]]
+ name = "opaque-debug"
+ version = "0.2.3"
+@@ -995,9 +981,6 @@ name = "os_str_bytes"
+ version = "6.0.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8e22443d1643a904602595ba1cd8f7d896afe56d26712531c5ff73a15b2fbf64"
+-dependencies = [
+- "memchr",
+-]
+ 
+ [[package]]
+ name = "parking_lot"
+@@ -1166,9 +1149,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pulldown-cmark"
+-version = "0.9.0"
++version = "0.9.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "acd16514d1af5f7a71f909a44ef253cdb712a376d7ebc8ae4a471a9be9743548"
++checksum = "2d9cc634bc78768157b5cbfe988ffcd1dcba95cd2b2f03a88316c08c6d00ed63"
+ dependencies = [
+  "bitflags",
+  "getopts",
+@@ -1185,12 +1168,6 @@ dependencies = [
+  "pulldown-cmark",
+ ]
+ 
+-[[package]]
+-name = "quick-error"
+-version = "1.2.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+-
+ [[package]]
+ name = "quick-error"
+ version = "2.0.1"
+@@ -1308,9 +1285,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "regex"
+-version = "1.5.4"
++version = "1.6.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
++checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+ dependencies = [
+  "aho-corasick",
+  "memchr",
+@@ -1325,9 +1302,9 @@ checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+ 
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.25"
++version = "0.6.27"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
++checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+ 
+ [[package]]
+ name = "remove_dir_all"
+@@ -1370,6 +1347,9 @@ name = "serde"
+ version = "1.0.133"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "97565067517b60e2d1ea8b268e59ce036de907ac523ad83a0475da04e818989a"
++dependencies = [
++ "serde_derive",
++]
+ 
+ [[package]]
+ name = "serde_derive"
+@@ -1490,36 +1470,12 @@ dependencies = [
+  "quote",
+ ]
+ 
+-[[package]]
+-name = "strsim"
+-version = "0.8.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+-
+ [[package]]
+ name = "strsim"
+ version = "0.10.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+ 
+-[[package]]
+-name = "strum"
+-version = "0.21.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "aaf86bbcfd1fa9670b7a129f64fc0c9fcbbfe4f1bc4210e9e98fe71ffc12cde2"
+-
+-[[package]]
+-name = "strum_macros"
+-version = "0.21.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d06aaeeee809dbc59eb4556183dd927df67db1540de5be8d3ec0b6636358a5ec"
+-dependencies = [
+- "heck",
+- "proc-macro2",
+- "quote",
+- "syn",
+-]
+-
+ [[package]]
+ name = "syn"
+ version = "1.0.84"
+@@ -1567,18 +1523,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "textwrap"
+-version = "0.11.0"
++version = "0.15.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+-dependencies = [
+- "unicode-width",
+-]
+-
+-[[package]]
+-name = "textwrap"
+-version = "0.14.2"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "0066c8d12af8b5acd21e00547c3797fde4e8677254a7ee429176ccebbe93dd80"
++checksum = "949517c0cf1bf4ee812e2e07e08ab448e3ae0d23472aee8a06c985f0c8815b16"
+ 
+ [[package]]
+ name = "thiserror"
+@@ -1793,12 +1740,6 @@ dependencies = [
+  "tinyvec",
+ ]
+ 
+-[[package]]
+-name = "unicode-segmentation"
+-version = "1.8.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+-
+ [[package]]
+ name = "unicode-width"
+ version = "0.1.9"
+@@ -1829,12 +1770,6 @@ version = "0.7.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+ 
+-[[package]]
+-name = "vec_map"
+-version = "0.8.2"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+-
+ [[package]]
+ name = "version_check"
+ version = "0.9.4"
+diff --git a/Cargo.toml b/Cargo.toml
+index 18b4b0e..3a88235 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -12,7 +12,7 @@ edition = "2018"
+ # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+ 
+ [dependencies]
+-mdbook = "^0.4.15"
++mdbook = "^0.4.21"
+ clap = "3.0"
+ serde_json = "1.0"
+ pulldown-cmark = "0.9"
diff --git a/pkgs/tools/text/mdbook-katex/default.nix b/pkgs/tools/text/mdbook-katex/default.nix
index a97e7ca8948..5291b9e9f82 100644
--- a/pkgs/tools/text/mdbook-katex/default.nix
+++ b/pkgs/tools/text/mdbook-katex/default.nix
@@ -8,10 +8,15 @@ rustPlatform.buildRustPackage rec {
     owner = "lzanini";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5PzXX7icRxcHpzjp3x/9ssn2o0444uHrzBn1Ds1DEPM=";
+    hash = "sha256-5PzXX7icRxcHpzjp3x/9ssn2o0444uHrzBn1Ds1DEPM=";
   };
 
-  cargoSha256 = "sha256-tqdpIBlKiyYSWFPYTnzVeDML2GM+mukbOHS3sNYUgdc=";
+  cargoPatches = [
+    # Remove when https://github.com/lzanini/mdbook-katex/pull/35 is in a new release.
+    ./update-mdbook-for-rust-1.64.patch
+  ];
+
+  cargoHash = "sha256-lrEirKkGf9/8yLyLSON54UaeQ3Xtl7g7ezUc7e1KVHw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/mdbook-katex/update-mdbook-for-rust-1.64.patch b/pkgs/tools/text/mdbook-katex/update-mdbook-for-rust-1.64.patch
new file mode 100644
index 00000000000..ee90a307670
--- /dev/null
+++ b/pkgs/tools/text/mdbook-katex/update-mdbook-for-rust-1.64.patch
@@ -0,0 +1,1417 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 3ff0894..ffef44f 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1,10 +1,12 @@
+ # This file is automatically @generated by Cargo.
+ # It is not intended for manual editing.
++version = 3
++
+ [[package]]
+ name = "aho-corasick"
+-version = "0.7.15"
++version = "0.7.19"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7404febffaa47dac81aa44dba71523c9d069b1bdc50a77db41195149e17f68e5"
++checksum = "b4f55bd91a0978cbfd91c457a164bab8b4001c833b7f323132c0a4e1922dd44e"
+ dependencies = [
+  "memchr",
+ ]
+@@ -52,9 +54,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "autocfg"
+-version = "1.0.1"
++version = "1.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
++checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+ 
+ [[package]]
+ name = "base64"
+@@ -62,11 +64,17 @@ version = "0.12.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3441f0f7b02788e948e47f457ca01f1d7e6d92c693bc132c22b087d3141c03ff"
+ 
++[[package]]
++name = "base64"
++version = "0.13.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "904dfeac50f3cdaba28fc6f57fdcddb75f49ed61346676a78c4ffe55877802fd"
++
+ [[package]]
+ name = "bitflags"
+-version = "1.2.1"
++version = "1.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
++checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+ 
+ [[package]]
+ name = "block-buffer"
+@@ -82,9 +90,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "block-buffer"
+-version = "0.9.0"
++version = "0.10.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
++checksum = "69cce20737498f97b993470a6e536b8523f0af7892a4f928cceb1ac5e52ebe7e"
+ dependencies = [
+  "generic-array 0.14.4",
+ ]
+@@ -98,6 +106,17 @@ dependencies = [
+  "byte-tools",
+ ]
+ 
++[[package]]
++name = "bstr"
++version = "0.2.17"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ba3569f383e8f1598449f1a423e72e99569137b47740b1da11ef19af3d5c3223"
++dependencies = [
++ "lazy_static",
++ "memchr",
++ "regex-automata",
++]
++
+ [[package]]
+ name = "byte-tools"
+ version = "0.3.1"
+@@ -116,6 +135,12 @@ version = "0.5.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "0e4cec68f03f32e44924783795810fa50a7035d8c8ebe78580ad7e6c703fba38"
+ 
++[[package]]
++name = "bytes"
++version = "1.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ec8a7b6a70fde80372154c65702f00a0f56f3e1c36abbc6c440484be248856db"
++
+ [[package]]
+ name = "cc"
+ version = "1.0.62"
+@@ -157,11 +182,45 @@ dependencies = [
+  "atty",
+  "bitflags",
+  "strsim 0.8.0",
+- "textwrap",
++ "textwrap 0.11.0",
+  "unicode-width",
+  "vec_map",
+ ]
+ 
++[[package]]
++name = "clap"
++version = "3.2.22"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "86447ad904c7fb335a790c9d7fe3d0d971dc523b8ccd1561a520de9a85302750"
++dependencies = [
++ "atty",
++ "bitflags",
++ "clap_lex",
++ "indexmap",
++ "once_cell",
++ "strsim 0.10.0",
++ "termcolor",
++ "textwrap 0.15.1",
++]
++
++[[package]]
++name = "clap_complete"
++version = "3.2.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3f7a2e0a962c45ce25afce14220bc24f9dade0a1787f185cecf96bfba7847cd8"
++dependencies = [
++ "clap 3.2.22",
++]
++
++[[package]]
++name = "clap_lex"
++version = "0.2.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
++dependencies = [
++ "os_str_bytes",
++]
++
+ [[package]]
+ name = "copy_dir"
+ version = "0.1.2"
+@@ -172,10 +231,23 @@ dependencies = [
+ ]
+ 
+ [[package]]
+-name = "cpuid-bool"
+-version = "0.1.2"
++name = "cpufeatures"
++version = "0.2.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
++dependencies = [
++ "libc",
++]
++
++[[package]]
++name = "crypto-common"
++version = "0.1.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8aebca1129a03dc6dc2b127edd729435bbc4a37e1d5f4d7513165089ceb02634"
++checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
++dependencies = [
++ "generic-array 0.14.4",
++ "typenum",
++]
+ 
+ [[package]]
+ name = "darling"
+@@ -248,39 +320,31 @@ dependencies = [
+ 
+ [[package]]
+ name = "digest"
+-version = "0.9.0"
++version = "0.10.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
++checksum = "adfbc57365a37acbd2ebf2b64d7e69bb766e2fea813521ed536f5d0520dcf86c"
+ dependencies = [
+- "generic-array 0.14.4",
++ "block-buffer 0.10.3",
++ "crypto-common",
+ ]
+ 
+-[[package]]
+-name = "dtoa"
+-version = "0.4.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "134951f4028bdadb9b84baf4232681efbf277da25144b9b0ad65df75946c422b"
+-
+ [[package]]
+ name = "elasticlunr-rs"
+-version = "2.3.9"
++version = "3.0.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "35622eb004c8f0c5e7e2032815f3314a93df0db30a1ce5c94e62c1ecc81e22b9"
++checksum = "b94d9c8df0fe6879ca12e7633fdfe467c503722cc981fc463703472d2b876448"
+ dependencies = [
+- "lazy_static",
+  "regex",
+  "serde",
+  "serde_derive",
+  "serde_json",
+- "strum",
+- "strum_macros",
+ ]
+ 
+ [[package]]
+ name = "env_logger"
+-version = "0.7.1"
++version = "0.9.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
++checksum = "c90bf5f19754d10198ccb95b70664fc925bd1fc090a0fd9a6ebc54acc8cd6272"
+ dependencies = [
+  "atty",
+  "humantime",
+@@ -368,25 +432,11 @@ dependencies = [
+  "new_debug_unreachable",
+ ]
+ 
+-[[package]]
+-name = "futures"
+-version = "0.3.8"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9b3b0c040a1fe6529d30b3c5944b280c7f0dcb2930d2c3062bca967b602583d0"
+-dependencies = [
+- "futures-channel",
+- "futures-core",
+- "futures-io",
+- "futures-sink",
+- "futures-task",
+- "futures-util",
+-]
+-
+ [[package]]
+ name = "futures-channel"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4b7109687aa4e177ef6fe84553af6280ef2778bdb7783ba44c9dc3399110fe64"
++checksum = "30bdd20c28fadd505d0fd6712cdfcb0d4b5648baf45faef7f852afb2399bb050"
+ dependencies = [
+  "futures-core",
+  "futures-sink",
+@@ -394,23 +444,16 @@ dependencies = [
+ 
+ [[package]]
+ name = "futures-core"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "847ce131b72ffb13b6109a221da9ad97a64cbe48feb1028356b836b47b8f1748"
+-
+-[[package]]
+-name = "futures-io"
+-version = "0.3.8"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "611834ce18aaa1bd13c4b374f5d653e1027cf99b6b502584ff8c9a64413b30bb"
++checksum = "4e5aa3de05362c3fb88de6531e6296e85cde7739cccad4b9dfeeb7f6ebce56bf"
+ 
+ [[package]]
+ name = "futures-macro"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "77408a692f1f97bcc61dc001d752e00643408fbc922e4d634c655df50d595556"
++checksum = "42cd15d1c7456c04dbdf7e88bcd69760d74f3a798d6444e16974b505b0e62f17"
+ dependencies = [
+- "proc-macro-hack",
+  "proc-macro2",
+  "quote",
+  "syn",
+@@ -418,33 +461,28 @@ dependencies = [
+ 
+ [[package]]
+ name = "futures-sink"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f878195a49cee50e006b02b93cf7e0a95a38ac7b776b4c4d9cc1207cd20fcb3d"
++checksum = "21b20ba5a92e727ba30e72834706623d94ac93a725410b6a6b6fbc1b07f7ba56"
+ 
+ [[package]]
+ name = "futures-task"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7c554eb5bf48b2426c4771ab68c6b14468b6e76cc90996f528c3338d761a4d0d"
+-dependencies = [
+- "once_cell",
+-]
++checksum = "a6508c467c73851293f390476d4491cf4d227dbabcd4170f3bb6044959b294f1"
+ 
+ [[package]]
+ name = "futures-util"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d304cff4a7b99cfb7986f7d43fbe93d175e72e704a8860787cc95e9ffd85cbd2"
++checksum = "44fb6cb1be61cc1d2e43b262516aafcf63b241cffdb1d3fa115f91d9c7b09c90"
+ dependencies = [
+  "futures-core",
+  "futures-macro",
+  "futures-sink",
+  "futures-task",
+- "pin-project 1.0.1",
++ "pin-project-lite",
+  "pin-utils",
+- "proc-macro-hack",
+- "proc-macro-nested",
+  "slab",
+ ]
+ 
+@@ -468,23 +506,25 @@ dependencies = [
+ ]
+ 
+ [[package]]
+-name = "getopts"
+-version = "0.2.21"
++name = "getrandom"
++version = "0.1.15"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
++checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
+ dependencies = [
+- "unicode-width",
++ "cfg-if 0.1.10",
++ "libc",
++ "wasi 0.9.0+wasi-snapshot-preview1",
+ ]
+ 
+ [[package]]
+ name = "getrandom"
+-version = "0.1.15"
++version = "0.2.7"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
++checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
+ dependencies = [
+- "cfg-if 0.1.10",
++ "cfg-if 1.0.0",
+  "libc",
+- "wasi 0.9.0+wasi-snapshot-preview1",
++ "wasi 0.11.0+wasi-snapshot-preview1",
+ ]
+ 
+ [[package]]
+@@ -504,11 +544,11 @@ checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
+ 
+ [[package]]
+ name = "h2"
+-version = "0.2.7"
++version = "0.3.14"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "5e4728fd124914ad25e99e3d15a9361a879f6620f63cb56bbb08f95abb97a535"
++checksum = "5ca32592cf21ac7ccab1825cd87f6c9b3d9022c44d086172ed0966bec8af30be"
+ dependencies = [
+- "bytes",
++ "bytes 1.2.1",
+  "fnv",
+  "futures-core",
+  "futures-sink",
+@@ -519,21 +559,20 @@ dependencies = [
+  "tokio",
+  "tokio-util",
+  "tracing",
+- "tracing-futures",
+ ]
+ 
+ [[package]]
+ name = "handlebars"
+-version = "3.5.1"
++version = "4.3.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2764f9796c0ddca4b82c07f25dd2cb3db30b9a8f47940e78e1c883d9e95c3db9"
++checksum = "433e4ab33f1213cdc25b5fa45c76881240cfe79284cf2b395e8b9e312a30a2fd"
+ dependencies = [
+  "log",
+  "pest",
+  "pest_derive",
+- "quick-error 2.0.0",
+  "serde",
+  "serde_json",
++ "thiserror",
+ ]
+ 
+ [[package]]
+@@ -548,9 +587,9 @@ version = "0.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ed18eb2459bf1a09ad2d6b1547840c3e5e62882fa09b9a6a20b1de8e3228848f"
+ dependencies = [
+- "base64",
++ "base64 0.12.3",
+  "bitflags",
+- "bytes",
++ "bytes 0.5.6",
+  "headers-core",
+  "http",
+  "mime",
+@@ -567,15 +606,6 @@ dependencies = [
+  "http",
+ ]
+ 
+-[[package]]
+-name = "heck"
+-version = "0.3.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "20564e78d53d2bb135c343b3f47714a56af2061f1c928fdb541dc7b9fdd94205"
+-dependencies = [
+- "unicode-segmentation",
+-]
+-
+ [[package]]
+ name = "hermit-abi"
+ version = "0.1.17"
+@@ -605,19 +635,20 @@ version = "0.2.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "28d569972648b2c512421b5f2a405ad6ac9666547189d0c5477a3f200f3e02f9"
+ dependencies = [
+- "bytes",
++ "bytes 0.5.6",
+  "fnv",
+- "itoa",
++ "itoa 0.4.6",
+ ]
+ 
+ [[package]]
+ name = "http-body"
+-version = "0.3.1"
++version = "0.4.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "13d5ff830006f7646652e057693569bfe0d51760c0085a071769d142a205111b"
++checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+ dependencies = [
+- "bytes",
++ "bytes 1.2.1",
+  "http",
++ "pin-project-lite",
+ ]
+ 
+ [[package]]
+@@ -634,20 +665,17 @@ checksum = "494b4d60369511e7dea41cf646832512a94e542f68bb9c49e54518e0f468eb47"
+ 
+ [[package]]
+ name = "humantime"
+-version = "1.3.0"
++version = "2.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+-dependencies = [
+- "quick-error 1.2.3",
+-]
++checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+ 
+ [[package]]
+ name = "hyper"
+-version = "0.13.9"
++version = "0.14.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f6ad767baac13b44d4529fcf58ba2cd0995e36e7b435bc5b039de6f47e880dbf"
++checksum = "8bf09f61b52cfcf4c00de50df88ae423d6c02354e385a86341133b5338630ad1"
+ dependencies = [
+- "bytes",
++ "bytes 1.2.1",
+  "futures-channel",
+  "futures-core",
+  "futures-util",
+@@ -656,8 +684,8 @@ dependencies = [
+  "http-body",
+  "httparse",
+  "httpdate",
+- "itoa",
+- "pin-project 1.0.1",
++ "itoa 0.4.6",
++ "pin-project",
+  "socket2",
+  "tokio",
+  "tower-service",
+@@ -712,15 +740,6 @@ dependencies = [
+  "libc",
+ ]
+ 
+-[[package]]
+-name = "input_buffer"
+-version = "0.3.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "19a8a95243d5a0398cae618ec29477c6e3cb631152be5c19481f80bc71559754"
+-dependencies = [
+- "bytes",
+-]
+-
+ [[package]]
+ name = "iovec"
+ version = "0.1.4"
+@@ -736,6 +755,12 @@ version = "0.4.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "dc6f3ad7b9d11a0c00842ff8de1b60ee58661048eb8049ed33c73594f359d7e6"
+ 
++[[package]]
++name = "itoa"
++version = "1.0.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "6c8af84674fe1f223a982c933a0ee1086ac4d4052aa0fb8060c12c6ad838e754"
++
+ [[package]]
+ name = "katex"
+ version = "0.3.2"
+@@ -771,9 +796,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+ 
+ [[package]]
+ name = "libc"
+-version = "0.2.80"
++version = "0.2.134"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4d58d1b70b004888f764dfbf6a26a3b0342a1632d33968e4a179d8011c760614"
++checksum = "329c933548736bc49fd575ee68c89e8be4d260064184389a5b77517cddd99ffb"
+ 
+ [[package]]
+ name = "libquickjs-sys"
+@@ -843,14 +868,15 @@ checksum = "7ffc5c5338469d4d3ea17d269fa8ea3512ad247247c30bd2df69e68309ed0a08"
+ 
+ [[package]]
+ name = "mdbook"
+-version = "0.4.4"
++version = "0.4.21"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "714a3ac362b9b32eef9468ecfe604cb8e2204d50793602e9d49fee44781230e7"
++checksum = "23f3e133c6d515528745ffd3b9f0c7d975ae039f0b6abb099f2168daa2afb4f9"
+ dependencies = [
+  "ammonia",
+  "anyhow",
+  "chrono",
+- "clap",
++ "clap 3.2.22",
++ "clap_complete",
+  "elasticlunr-rs",
+  "env_logger",
+  "futures-util",
+@@ -860,16 +886,16 @@ dependencies = [
+  "log",
+  "memchr",
+  "notify",
+- "open",
++ "opener",
+  "pulldown-cmark",
+  "regex",
+  "serde",
+- "serde_derive",
+  "serde_json",
+  "shlex",
+  "tempfile",
+  "tokio",
+  "toml",
++ "topological-sort",
+  "warp",
+ ]
+ 
+@@ -877,7 +903,7 @@ dependencies = [
+ name = "mdbook-katex"
+ version = "0.2.10"
+ dependencies = [
+- "clap",
++ "clap 2.33.3",
+  "katex",
+  "mdbook",
+  "serde_json",
+@@ -886,9 +912,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "memchr"
+-version = "2.3.4"
++version = "2.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "0ee1c47aaa256ecabcaea351eae4a9b01ef39ed810004e298d2511ed284b1525"
++checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+ 
+ [[package]]
+ name = "mime"
+@@ -925,6 +951,18 @@ dependencies = [
+  "winapi 0.2.8",
+ ]
+ 
++[[package]]
++name = "mio"
++version = "0.8.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "57ee1c23c7c63b0c9250c339ffdc69255f110b298b901b9f6c82547b7b87caaf"
++dependencies = [
++ "libc",
++ "log",
++ "wasi 0.11.0+wasi-snapshot-preview1",
++ "windows-sys",
++]
++
+ [[package]]
+ name = "mio-extras"
+ version = "2.0.6"
+@@ -933,7 +971,7 @@ checksum = "52403fe290012ce777c4626790c8951324a2b9e3316b3143779c72b029742f19"
+ dependencies = [
+  "lazycell",
+  "log",
+- "mio",
++ "mio 0.6.22",
+  "slab",
+ ]
+ 
+@@ -978,7 +1016,7 @@ dependencies = [
+  "fsevent-sys",
+  "inotify",
+  "libc",
+- "mio",
++ "mio 0.6.22",
+  "mio-extras",
+  "walkdir 2.3.1",
+  "winapi 0.3.9",
+@@ -1004,32 +1042,43 @@ dependencies = [
+ ]
+ 
+ [[package]]
+-name = "once_cell"
+-version = "1.5.2"
++name = "num_cpus"
++version = "1.13.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "13bd41f508810a131401606d54ac32a467c97172d74ba7662562ebba5ad07fa0"
++checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
++dependencies = [
++ "hermit-abi",
++ "libc",
++]
+ 
+ [[package]]
+-name = "opaque-debug"
+-version = "0.2.3"
++name = "once_cell"
++version = "1.15.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2839e79665f131bdb5782e51f2c6c9599c133c6098982a54c794358bf432529c"
++checksum = "e82dad04139b71a90c080c8463fe0dc7902db5192d939bd0950f074d014339e1"
+ 
+ [[package]]
+ name = "opaque-debug"
+-version = "0.3.0"
++version = "0.2.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
++checksum = "2839e79665f131bdb5782e51f2c6c9599c133c6098982a54c794358bf432529c"
+ 
+ [[package]]
+-name = "open"
+-version = "1.4.0"
++name = "opener"
++version = "0.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7c283bf0114efea9e42f1a60edea9859e8c47528eae09d01df4b29c1e489cc48"
++checksum = "4ea3ebcd72a54701f56345f16785a6d3ac2df7e986d273eb4395c0b01db17952"
+ dependencies = [
++ "bstr",
+  "winapi 0.3.9",
+ ]
+ 
++[[package]]
++name = "os_str_bytes"
++version = "6.3.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9ff7415e9ae3fff1225851df9e0d9e4e5479f947619774677a63572e55e80eff"
++
+ [[package]]
+ name = "percent-encoding"
+ version = "2.1.0"
+@@ -1105,7 +1154,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "17367f0cc86f2d25802b2c26ee58a7b23faeccf78a396094c13dced0d0182526"
+ dependencies = [
+  "phf_shared",
+- "rand",
++ "rand 0.7.3",
+ ]
+ 
+ [[package]]
+@@ -1117,33 +1166,13 @@ dependencies = [
+  "siphasher",
+ ]
+ 
+-[[package]]
+-name = "pin-project"
+-version = "0.4.27"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2ffbc8e94b38ea3d2d8ba92aea2983b503cd75d0888d75b86bb37970b5698e15"
+-dependencies = [
+- "pin-project-internal 0.4.27",
+-]
+-
+ [[package]]
+ name = "pin-project"
+ version = "1.0.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ee41d838744f60d959d7074e3afb6b35c7456d0f61cad38a24e35e6553f73841"
+ dependencies = [
+- "pin-project-internal 1.0.1",
+-]
+-
+-[[package]]
+-name = "pin-project-internal"
+-version = "0.4.27"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "65ad2ae56b6abe3a1ee25f15ee605bacadb9a764edaba9c2bf4103800d4a1895"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "syn",
++ "pin-project-internal",
+ ]
+ 
+ [[package]]
+@@ -1159,9 +1188,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pin-project-lite"
+-version = "0.1.11"
++version = "0.2.9"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c917123afa01924fc84bb20c4c03f004d9c38e5127e3c039bbf7f4b9c76a2f6b"
++checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+ 
+ [[package]]
+ name = "pin-utils"
+@@ -1181,18 +1210,6 @@ version = "0.1.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+ 
+-[[package]]
+-name = "proc-macro-hack"
+-version = "0.5.19"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "dbf0c48bc1d91375ae5c3cd81e3722dff1abcf81a30960240640d223f59fe0e5"
+-
+-[[package]]
+-name = "proc-macro-nested"
+-version = "0.1.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "eba180dafb9038b050a4c280019bbedf9f2467b61e5d892dcad585bb57aadc5a"
+-
+ [[package]]
+ name = "proc-macro2"
+ version = "1.0.24"
+@@ -1204,28 +1221,15 @@ dependencies = [
+ 
+ [[package]]
+ name = "pulldown-cmark"
+-version = "0.7.2"
++version = "0.9.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ca36dea94d187597e104a5c8e4b07576a8a45aa5db48a65e12940d3eb7461f55"
++checksum = "2d9cc634bc78768157b5cbfe988ffcd1dcba95cd2b2f03a88316c08c6d00ed63"
+ dependencies = [
+  "bitflags",
+- "getopts",
+  "memchr",
+  "unicase",
+ ]
+ 
+-[[package]]
+-name = "quick-error"
+-version = "1.2.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+-
+-[[package]]
+-name = "quick-error"
+-version = "2.0.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3ac73b1112776fc109b2e61909bc46c7e1bf0d7f690ffb1676553acce16d5cda"
+-
+ [[package]]
+ name = "quick-js"
+ version = "0.4.0"
+@@ -1251,14 +1255,25 @@ version = "0.7.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+ dependencies = [
+- "getrandom",
++ "getrandom 0.1.15",
+  "libc",
+- "rand_chacha",
+- "rand_core",
++ "rand_chacha 0.2.2",
++ "rand_core 0.5.1",
+  "rand_hc",
+  "rand_pcg",
+ ]
+ 
++[[package]]
++name = "rand"
++version = "0.8.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
++dependencies = [
++ "libc",
++ "rand_chacha 0.3.1",
++ "rand_core 0.6.4",
++]
++
+ [[package]]
+ name = "rand_chacha"
+ version = "0.2.2"
+@@ -1266,7 +1281,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+ dependencies = [
+  "ppv-lite86",
+- "rand_core",
++ "rand_core 0.5.1",
++]
++
++[[package]]
++name = "rand_chacha"
++version = "0.3.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
++dependencies = [
++ "ppv-lite86",
++ "rand_core 0.6.4",
+ ]
+ 
+ [[package]]
+@@ -1275,7 +1300,16 @@ version = "0.5.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+ dependencies = [
+- "getrandom",
++ "getrandom 0.1.15",
++]
++
++[[package]]
++name = "rand_core"
++version = "0.6.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
++dependencies = [
++ "getrandom 0.2.7",
+ ]
+ 
+ [[package]]
+@@ -1284,7 +1318,7 @@ version = "0.2.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+ dependencies = [
+- "rand_core",
++ "rand_core 0.5.1",
+ ]
+ 
+ [[package]]
+@@ -1293,7 +1327,7 @@ version = "0.2.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "16abd0c1b639e9eb4d7c50c0b8100b0d0f849be2349829c740fe8e6eb4816429"
+ dependencies = [
+- "rand_core",
++ "rand_core 0.5.1",
+ ]
+ 
+ [[package]]
+@@ -1304,21 +1338,26 @@ checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
+ 
+ [[package]]
+ name = "regex"
+-version = "1.4.2"
++version = "1.6.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "38cf2c13ed4745de91a5eb834e11c00bcc3709e773173b2ce4c56c9fbde04b9c"
++checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+ dependencies = [
+  "aho-corasick",
+  "memchr",
+  "regex-syntax",
+- "thread_local",
+ ]
+ 
++[[package]]
++name = "regex-automata"
++version = "0.1.10"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
++
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.21"
++version = "0.6.27"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3b181ba2dcf07aaccad5448e8ead58db5b742cf85dfe035e2227f137a539a189"
++checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+ 
+ [[package]]
+ name = "remove_dir_all"
+@@ -1329,6 +1368,15 @@ dependencies = [
+  "winapi 0.3.9",
+ ]
+ 
++[[package]]
++name = "rustls-pemfile"
++version = "0.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5eebeaeb360c87bfb72e84abdb3447159c0eaececf1bef2aecd65a8be949d1c9"
++dependencies = [
++ "base64 0.13.0",
++]
++
+ [[package]]
+ name = "ryu"
+ version = "1.0.5"
+@@ -1355,6 +1403,9 @@ name = "serde"
+ version = "1.0.117"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "b88fa983de7720629c9387e9f517353ed404164b1e482c970a90c1a4aaf7dc1a"
++dependencies = [
++ "serde_derive",
++]
+ 
+ [[package]]
+ name = "serde_derive"
+@@ -1373,21 +1424,21 @@ version = "1.0.59"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "dcac07dbffa1c65e7f816ab9eba78eb142c6d44410f4eeba1e26e4f5dfa56b95"
+ dependencies = [
+- "itoa",
++ "itoa 0.4.6",
+  "ryu",
+  "serde",
+ ]
+ 
+ [[package]]
+ name = "serde_urlencoded"
+-version = "0.6.1"
++version = "0.7.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9ec5d77e2d4c73717816afac02670d5c4f534ea95ed430442cad02e7a6e32c97"
++checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+ dependencies = [
+- "dtoa",
+- "itoa",
++ "form_urlencoded",
++ "itoa 1.0.3",
++ "ryu",
+  "serde",
+- "url",
+ ]
+ 
+ [[package]]
+@@ -1399,27 +1450,25 @@ dependencies = [
+  "block-buffer 0.7.3",
+  "digest 0.8.1",
+  "fake-simd",
+- "opaque-debug 0.2.3",
++ "opaque-debug",
+ ]
+ 
+ [[package]]
+ name = "sha-1"
+-version = "0.9.2"
++version = "0.10.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ce3cdf1b5e620a498ee6f2a171885ac7e22f0e12089ec4b3d22b84921792507c"
++checksum = "028f48d513f9678cda28f6e4064755b3fbb2af6acd672f2c209b62323f7aea0f"
+ dependencies = [
+- "block-buffer 0.9.0",
+  "cfg-if 1.0.0",
+- "cpuid-bool",
+- "digest 0.9.0",
+- "opaque-debug 0.3.0",
++ "cpufeatures",
++ "digest 0.10.5",
+ ]
+ 
+ [[package]]
+ name = "shlex"
+-version = "0.1.1"
++version = "1.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7fdf1b9db47230893d76faad238fd6097fd6d6a9245cd7a4d90dbd639536bbd2"
++checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
+ 
+ [[package]]
+ name = "siphasher"
+@@ -1435,13 +1484,11 @@ checksum = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"
+ 
+ [[package]]
+ name = "socket2"
+-version = "0.3.16"
++version = "0.4.7"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7fd8b795c389288baa5f355489c65e71fd48a02104600d15c4cfbc561e9e429d"
++checksum = "02e2d2db9033d13a1567121ddd7a095ee144db4e1ca1b1bda3419bc0da294ebd"
+ dependencies = [
+- "cfg-if 0.1.10",
+  "libc",
+- "redox_syscall",
+  "winapi 0.3.9",
+ ]
+ 
+@@ -1483,28 +1530,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+ 
+ [[package]]
+-name = "strum"
+-version = "0.18.0"
++name = "strsim"
++version = "0.10.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+-
+-[[package]]
+-name = "strum_macros"
+-version = "0.18.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+-dependencies = [
+- "heck",
+- "proc-macro2",
+- "quote",
+- "syn",
+-]
++checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+ 
+ [[package]]
+ name = "syn"
+-version = "1.0.48"
++version = "1.0.67"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cc371affeffc477f42a221a1e4297aedcea33d47d19b61455588bd9d8f6b19ac"
++checksum = "6498a9efc342871f91cc2d0d694c674368b4ceb40f62b65a7a08c3792935e702"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -1519,7 +1554,7 @@ checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
+ dependencies = [
+  "cfg-if 0.1.10",
+  "libc",
+- "rand",
++ "rand 0.7.3",
+  "redox_syscall",
+  "remove_dir_all",
+  "winapi 0.3.9",
+@@ -1538,9 +1573,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "termcolor"
+-version = "1.1.0"
++version = "1.1.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "bb6bfa289a4d7c5766392812c0a1f4c1ba45afa1ad47803c11e1f407d846d75f"
++checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+ dependencies = [
+  "winapi-util",
+ ]
+@@ -1554,35 +1589,32 @@ dependencies = [
+  "unicode-width",
+ ]
+ 
++[[package]]
++name = "textwrap"
++version = "0.15.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "949517c0cf1bf4ee812e2e07e08ab448e3ae0d23472aee8a06c985f0c8815b16"
++
+ [[package]]
+ name = "thiserror"
+-version = "1.0.22"
++version = "1.0.37"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "0e9ae34b84616eedaaf1e9dd6026dbe00dcafa92aa0c8077cb69df1fcfe5e53e"
++checksum = "10deb33631e3c9018b9baf9dcbbc4f737320d2b576bac10f6aefa048fa407e3e"
+ dependencies = [
+  "thiserror-impl",
+ ]
+ 
+ [[package]]
+ name = "thiserror-impl"
+-version = "1.0.22"
++version = "1.0.37"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9ba20f23e85b10754cd195504aebf6a27e2e6cbe28c17778a0c930724628dd56"
++checksum = "982d17546b47146b28f7c22e3d08465f6b8903d0ea13c1660d9d84a6e7adcdbb"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+  "syn",
+ ]
+ 
+-[[package]]
+-name = "thread_local"
+-version = "1.0.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d40c6d1b69745a6ec6fb1ca717914848da4b44ae29d9b3080cbee91d72a69b14"
+-dependencies = [
+- "lazy_static",
+-]
+-
+ [[package]]
+ name = "time"
+ version = "0.1.44"
+@@ -1611,58 +1643,68 @@ checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+ 
+ [[package]]
+ name = "tokio"
+-version = "0.2.23"
++version = "1.21.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a6d7ad61edd59bfcc7e80dababf0f4aed2e6d5e0ba1659356ae889752dfc12ff"
++checksum = "a9e03c497dc955702ba729190dc4aac6f2a0ce97f913e5b1b5912fc5039d9099"
+ dependencies = [
+- "bytes",
+- "fnv",
+- "futures-core",
+- "iovec",
+- "lazy_static",
++ "autocfg",
++ "bytes 1.2.1",
++ "libc",
+  "memchr",
+- "mio",
++ "mio 0.8.4",
++ "num_cpus",
+  "pin-project-lite",
+- "slab",
++ "socket2",
+  "tokio-macros",
++ "winapi 0.3.9",
+ ]
+ 
+ [[package]]
+ name = "tokio-macros"
+-version = "0.2.6"
++version = "1.8.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e44da00bfc73a25f814cd8d7e57a68a5c31b74b3152a0a1d1f590c97ed06265a"
++checksum = "9724f9a975fb987ef7a3cd9be0350edcbe130698af5b8f7a631e23d42d052484"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+  "syn",
+ ]
+ 
++[[package]]
++name = "tokio-stream"
++version = "0.1.10"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f6edf2d6bc038a43d31353570e27270603f4648d18f5ed10c0e179abe43255af"
++dependencies = [
++ "futures-core",
++ "pin-project-lite",
++ "tokio",
++]
++
+ [[package]]
+ name = "tokio-tungstenite"
+-version = "0.11.0"
++version = "0.17.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6d9e878ad426ca286e4dcae09cbd4e1973a7f8987d97570e2469703dd7f5720c"
++checksum = "f714dd15bead90401d77e04243611caec13726c2408afd5b31901dfcdcb3b181"
+ dependencies = [
+  "futures-util",
+  "log",
+- "pin-project 0.4.27",
+  "tokio",
+  "tungstenite",
+ ]
+ 
+ [[package]]
+ name = "tokio-util"
+-version = "0.3.1"
++version = "0.7.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "be8242891f2b6cbef26a2d7e8605133c2c554cd35b3e4948ea892d6d68436499"
++checksum = "0bb2e075f03b3d66d8d8785356224ba688d2906a371015e225beeb65ca92c740"
+ dependencies = [
+- "bytes",
++ "bytes 1.2.1",
+  "futures-core",
+  "futures-sink",
+- "log",
+  "pin-project-lite",
+  "tokio",
++ "tracing",
+ ]
+ 
+ [[package]]
+@@ -1674,6 +1716,12 @@ dependencies = [
+  "serde",
+ ]
+ 
++[[package]]
++name = "topological-sort"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "aa7c7f42dea4b1b99439786f5633aeb9c14c1b53f75e282803c2ec2ad545873c"
++
+ [[package]]
+ name = "tower-service"
+ version = "0.3.0"
+@@ -1682,11 +1730,11 @@ checksum = "e987b6bf443f4b5b3b6f38704195592cca41c5bb7aedd3c3693c7081f8289860"
+ 
+ [[package]]
+ name = "tracing"
+-version = "0.1.21"
++version = "0.1.35"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "b0987850db3733619253fe60e17cb59b82d37c7e6c0236bb81e4d6b87c879f27"
++checksum = "a400e31aa60b9d44a52a8ee0343b5b18566b03a8321e0d321f695cf56e940160"
+ dependencies = [
+- "cfg-if 0.1.10",
++ "cfg-if 1.0.0",
+  "log",
+  "pin-project-lite",
+  "tracing-core",
+@@ -1694,21 +1742,11 @@ dependencies = [
+ 
+ [[package]]
+ name = "tracing-core"
+-version = "0.1.17"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f50de3927f93d202783f4513cda820ab47ef17f624b03c096e86ef00c67e6b5f"
+-dependencies = [
+- "lazy_static",
+-]
+-
+-[[package]]
+-name = "tracing-futures"
+-version = "0.2.4"
++version = "0.1.29"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ab7bb6f14721aa00656086e9335d363c5c8747bae02ebe32ea2c7dece5689b4c"
++checksum = "5aeea4303076558a00714b823f9ad67d58a3bbda1df83d8827d21193156e22f7"
+ dependencies = [
+- "pin-project 0.4.27",
+- "tracing",
++ "once_cell",
+ ]
+ 
+ [[package]]
+@@ -1719,28 +1757,28 @@ checksum = "59547bce71d9c38b83d9c0e92b6066c4253371f15005def0c30d9657f50c7642"
+ 
+ [[package]]
+ name = "tungstenite"
+-version = "0.11.1"
++version = "0.17.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f0308d80d86700c5878b9ef6321f020f29b1bb9d5ff3cab25e75e23f3a492a23"
++checksum = "e27992fd6a8c29ee7eef28fc78349aa244134e10ad447ce3b9f0ac0ed0fa4ce0"
+ dependencies = [
+- "base64",
++ "base64 0.13.0",
+  "byteorder",
+- "bytes",
++ "bytes 1.2.1",
+  "http",
+  "httparse",
+- "input_buffer",
+  "log",
+- "rand",
+- "sha-1 0.9.2",
++ "rand 0.8.5",
++ "sha-1 0.10.0",
++ "thiserror",
+  "url",
+  "utf-8",
+ ]
+ 
+ [[package]]
+ name = "typenum"
+-version = "1.12.0"
++version = "1.15.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33"
++checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
+ 
+ [[package]]
+ name = "ucd-trie"
+@@ -1775,12 +1813,6 @@ dependencies = [
+  "tinyvec",
+ ]
+ 
+-[[package]]
+-name = "unicode-segmentation"
+-version = "1.7.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "db8716a166f290ff49dabc18b44aa407cb7c6dbe1aa0971b44b8a24b0ca35aae"
+-
+ [[package]]
+ name = "unicode-width"
+ version = "0.1.8"
+@@ -1805,12 +1837,6 @@ dependencies = [
+  "percent-encoding",
+ ]
+ 
+-[[package]]
+-name = "urlencoding"
+-version = "1.1.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c9232eb53352b4442e40d7900465dfc534e8cb2dc8f18656fcb2ac16112b5593"
+-
+ [[package]]
+ name = "utf-8"
+ version = "0.7.5"
+@@ -1862,29 +1888,32 @@ dependencies = [
+ 
+ [[package]]
+ name = "warp"
+-version = "0.2.5"
++version = "0.3.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f41be6df54c97904af01aa23e613d4521eed7ab23537cede692d4058f6449407"
++checksum = "ed7b8be92646fc3d18b06147664ebc5f48d222686cb11a8755e561a735aacc6d"
+ dependencies = [
+- "bytes",
+- "futures",
++ "bytes 1.2.1",
++ "futures-channel",
++ "futures-util",
+  "headers",
+  "http",
+  "hyper",
+  "log",
+  "mime",
+  "mime_guess",
+- "pin-project 0.4.27",
++ "percent-encoding",
++ "pin-project",
++ "rustls-pemfile",
+  "scoped-tls",
+  "serde",
+  "serde_json",
+  "serde_urlencoded",
+  "tokio",
++ "tokio-stream",
+  "tokio-tungstenite",
++ "tokio-util",
+  "tower-service",
+  "tracing",
+- "tracing-futures",
+- "urlencoding",
+ ]
+ 
+ [[package]]
+@@ -1899,6 +1928,12 @@ version = "0.10.0+wasi-snapshot-preview1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+ 
++[[package]]
++name = "wasi"
++version = "0.11.0+wasi-snapshot-preview1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
++
+ [[package]]
+ name = "winapi"
+ version = "0.2.8"
+@@ -1942,6 +1977,49 @@ version = "0.4.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+ 
++[[package]]
++name = "windows-sys"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
++dependencies = [
++ "windows_aarch64_msvc",
++ "windows_i686_gnu",
++ "windows_i686_msvc",
++ "windows_x86_64_gnu",
++ "windows_x86_64_msvc",
++]
++
++[[package]]
++name = "windows_aarch64_msvc"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
++
++[[package]]
++name = "windows_i686_gnu"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
++
++[[package]]
++name = "windows_i686_msvc"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
++
++[[package]]
++name = "windows_x86_64_gnu"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
++
++[[package]]
++name = "windows_x86_64_msvc"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
++
+ [[package]]
+ name = "ws2_32-sys"
+ version = "0.2.1"
+diff --git a/Cargo.toml b/Cargo.toml
+index 16efef1..e750ee2 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -10,6 +10,6 @@ readme = "README.md"
+ [dependencies]
+ katex = "0.3.2"
+ clap = "2.33.3"
+-mdbook = "0.4.4"
++mdbook = "0.4.21"
+ serde_json = "1.0.59"
+ toml = "0.5.7"
diff --git a/pkgs/tools/text/mdbook-man/default.nix b/pkgs/tools/text/mdbook-man/default.nix
index 7783be1ccac..541e27eb7e0 100644
--- a/pkgs/tools/text/mdbook-man/default.nix
+++ b/pkgs/tools/text/mdbook-man/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-man";
-  version = "unstable-2021-08-26";
+  version = "unstable-2022-11-05";
 
   src = fetchFromGitHub {
     owner = "vv9k";
     repo = pname;
-    rev = "419c91db0fcfcce65a6006ed9ec8415a8b705186";
-    sha256 = "sha256-NOPyDPQms/YJzjkXjVAFR60gLK4zqOuFSdRvFkZRRxQ=";
+    rev = "b9537dfbb241d7456835ed7e9d27ab8c8184e5f6";
+    hash = "sha256-ssAk60jnwYzAjseL26/3FaDv1vBAylgdE+vLhWZ8It4=";
   };
 
-  cargoSha256 = "sha256-NyeB2vI9Za5T1SKrjqwTi8LXX7A+M+2r/n1u2qtnK5g=";
+  cargoHash = "sha256-cR86eFhP9Swh+Ff8FNbAfWpWMkliOAyPwDQ6lRvU+nk=";
 
   meta = with lib; {
     description = "Generate manual pages from mdBooks";
diff --git a/pkgs/tools/text/mdbook-mermaid/default.nix b/pkgs/tools/text/mdbook-mermaid/default.nix
index bf666d36cb6..1977fcd4efe 100644
--- a/pkgs/tools/text/mdbook-mermaid/default.nix
+++ b/pkgs/tools/text/mdbook-mermaid/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, CoreServices }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, CoreServices }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-mermaid";
@@ -8,10 +8,19 @@ rustPlatform.buildRustPackage rec {
     owner = "badboy";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zXgXgcMF7MOa9Vx3rhv9aavqRCfMcyRLtaWEvYlyaTs=";
+    hash = "sha256-zXgXgcMF7MOa9Vx3rhv9aavqRCfMcyRLtaWEvYlyaTs=";
   };
 
-  cargoSha256 = "sha256-sV/1caeXq/he92cvAajDL7pZJNiXCzf/DDXKnPKU4XQ=";
+  cargoPatches = [
+    # https://github.com/badboy/mdbook-mermaid/pull/23
+    (fetchpatch {
+      name = "update-mdbook-for-rust-1.64.patch";
+      url = "https://github.com/badboy/mdbook-mermaid/commit/5a3432d1b28ef9a065dd37aa77b82a3593358793.patch";
+      hash = "sha256-NkCxGmRdwJ+jdkgxp5gWfGpgpLpEpKUd44LyPx0kyEE=";
+    })
+  ];
+
+  cargoHash = "sha256-IkMBnBuobrJzR6+030/Wfbu2ZCjvFnjBV+6sSWdiNUw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/mdbook-open-on-gh/default.nix b/pkgs/tools/text/mdbook-open-on-gh/default.nix
index 09b0db3866b..f334645ba5a 100644
--- a/pkgs/tools/text/mdbook-open-on-gh/default.nix
+++ b/pkgs/tools/text/mdbook-open-on-gh/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, rustPlatform, fetchFromGitHub, fetchpatch }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-open-on-gh";
@@ -8,10 +8,19 @@ rustPlatform.buildRustPackage rec {
     owner = "badboy";
     repo = pname;
     rev = "2.2.0";
-    sha256 = "sha256-x7ESuXoF5dYnJZpgDyYliVixCG4w/VX/Vhm3VqxsiEI=";
+    hash = "sha256-x7ESuXoF5dYnJZpgDyYliVixCG4w/VX/Vhm3VqxsiEI=";
   };
 
-  cargoSha256 = "sha256-FVcCzL0jJ827HHS/9G597QjNFY3HLNYHCPWcepEulD0=";
+  cargoPatches = [
+    # https://github.com/badboy/mdbook-open-on-gh/pull/7
+    (fetchpatch {
+      name = "update-mdbook-for-rust-1.64.patch";
+      url = "https://github.com/badboy/mdbook-open-on-gh/commit/bd20601bfcec144c9302b1ba1a1aff4b95b334d9.patch";
+      hash = "sha256-3Df9Q3sqCpZzqCN9fi+wdeWjLUW4XdywIS3QUjsDE9g=";
+    })
+  ];
+
+  cargoHash = "sha256-N0RwengTWk4luPIecIxzbFReGi+PtE77FJalPq1CdbA=";
 
   meta = with lib; {
     description = "mdbook preprocessor to add a open-on-github link on every page";
diff --git a/pkgs/tools/text/mdbook-pdf/default.nix b/pkgs/tools/text/mdbook-pdf/default.nix
index 8c21f50b1d7..ca24909ed1d 100644
--- a/pkgs/tools/text/mdbook-pdf/default.nix
+++ b/pkgs/tools/text/mdbook-pdf/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-pdf";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "1ibmn8x9kyfd058hsyah2ggyzpahzf2w2qjn6rs9qv8mr3bvc0pv";
+    sha256 = "sha256-zFeEmIv3DIYKmhVYO9cJwRQbSP8yELaJjVjP7hYegco=";
   };
 
-  cargoSha256 = "0k47a5yqnjjc599vgk39ijy6fm62rr8xarvz37g0c7fx9cljhihz";
+  cargoHash = "sha256-pB7NEloeow4TE1Y1EMUZzeCJ/f4DnCS+sQlyN49gqzA=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/text/mdbook-plantuml/default.nix b/pkgs/tools/text/mdbook-plantuml/default.nix
index 0b26bee0953..e57bd1a4522 100644
--- a/pkgs/tools/text/mdbook-plantuml/default.nix
+++ b/pkgs/tools/text/mdbook-plantuml/default.nix
@@ -1,18 +1,36 @@
-{ lib, fetchFromGitHub, stdenv, rustPlatform, darwin, pkg-config, openssl
-, libiconv, CoreServices }:
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, stdenv
+, rustPlatform
+, darwin
+, pkg-config
+, openssl
+, libiconv
+, CoreServices
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-plantuml";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "sytsereitsma";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1m53sp3k387injn6mwk2c6rkzw16b12m4j7q0p69fdb3fiqbkign";
+    hash = "sha256-26epwn6j/ZeMAphiFsrLjS0KIewvElr7V3p/EDr4Uqk=";
   };
 
-  cargoSha256 = "0xi14k86ym3rfz6901lmj444y814m7vp90bwsyjmcph3hdv6mjp0";
+  cargoPatches = [
+    # https://github.com/sytsereitsma/mdbook-plantuml/pull/60
+    (fetchpatch {
+      name = "update-mdbook-for-rust-1.64.patch";
+      url = "https://github.com/sytsereitsma/mdbook-plantuml/commit/a1c7fdaff65fbbcc086006f6d180b27e180739e7.patch";
+      hash = "sha256-KXFQxogR6SaoX8snsSYMA8gn1FrQVKMl5l8khxB09WE=";
+    })
+  ];
+
+  cargoHash = "sha256-3HlnhRexfFcAuk1RoatWORMJvYRrnoEft5ys6j3t9S0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/typesetting/asciidoc/default.nix b/pkgs/tools/typesetting/asciidoc/default.nix
index cf6e0bdb3d4..4cfecfccdbc 100644
--- a/pkgs/tools/typesetting/asciidoc/default.nix
+++ b/pkgs/tools/typesetting/asciidoc/default.nix
@@ -218,7 +218,7 @@ in python3.pkgs.buildPythonApplication rec {
     # cannot find their neighbours (e.g. pdflatex doesn't find mktextfm).
     # We can remove PATH= when those impurities are fixed.
     # TODO: Is this still necessary when using texlive?
-    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', PATH='${lib.makeBinPath [ texlive coreutils gnused ]}')|" \
+    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', PATH='${lib.makeBinPath [ texlive coreutils gnused ]}', **(dict(filter(lambda v: v[0] == 'SOURCE_DATE_EPOCH', os.environ.items()))))|" \
         -e "s|^ASCIIDOC =.*|ASCIIDOC = '$out/bin/asciidoc'|" \
         -e "s|^XSLTPROC =.*|XSLTPROC = '${libxslt.bin}/bin/xsltproc'|" \
         -e "s|^DBLATEX =.*|DBLATEX = '${dblatexFull}/bin/dblatex'|" \
@@ -229,7 +229,7 @@ in python3.pkgs.buildPythonApplication rec {
         -e "s|^EPUBCHECK =.*|EPUBCHECK = '${epubcheck}/bin/epubcheck'|" \
         -i asciidoc/a2x.py
   '' else ''
-    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml')|" \
+    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', **(dict(filter(lambda v: v[0] == 'SOURCE_DATE_EPOCH', os.environ.items()))))|" \
         -e "s|^XSLTPROC =.*|XSLTPROC = '${libxslt.bin}/bin/xsltproc'|" \
         -e "s|^XMLLINT =.*|XMLLINT = '${libxml2.bin}/bin/xmllint'|" \
         -i asciidoc/a2x.py
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 8da3df2773f..94ed0b87362 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch
+{ lib, stdenv, fetchurl, fetchpatch, buildPackages
 , texlive
 , zlib, libiconv, libpng, libX11
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
@@ -77,7 +77,13 @@ core = stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # configure: error: tangle was not found but is required when cross-compiling.
+    texlive.bin.core
+  ];
+
   buildInputs = [
     /*teckit*/ zziplib mpfr gmp
     pixman gd freetype libpng libpaper zlib
@@ -94,7 +100,10 @@ core = stdenv.mkDerivation rec {
   '';
   configureScript = "../configure";
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   configureFlags = common.configureFlags
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "BUILDCC=${buildPackages.stdenv.cc.targetPrefix}cc" ]
     ++ [ "--without-x" ] # disable xdvik and xpdfopen
     ++ map (what: "--disable-${what}") [
       "chktex"
@@ -113,7 +122,7 @@ core = stdenv.mkDerivation rec {
 
   # TODO: perhaps improve texmf.cnf search locations
   postInstall = /* links format -> engine will be regenerated in texlive.combine */ ''
-    PATH="$out/bin:$PATH" ${texlinks}/bin/texlinks --cnffile "$out/share/texmf-dist/web2c/fmtutil.cnf" --unlink "$out/bin"
+    PATH="$out/bin:$PATH" ${buildPackages.texlive.bin.texlinks}/bin/texlinks --cnffile "$out/share/texmf-dist/web2c/fmtutil.cnf" --unlink "$out/bin"
   '' + /* a few texmf-dist files are useful; take the rest from pkgs */ ''
     mv "$out/share/texmf-dist/web2c/texmf.cnf" .
     rm -r "$out/share/texmf-dist"
@@ -202,7 +211,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
         if [[ "$path" =~ "libs/pplib" ]]; then
           # TODO: revert for texlive 2022
           # ../../../texk/web2c/luatexdir/luamd5/md5lib.c:197:10: fatal error: 'utilsha.h' file not found
-          make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES} -l''${NIX_BUILD_CORES}}
+          make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}}
         fi
       )
     done
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 33ca400bbb8..f6fad9190f1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -187,7 +187,9 @@ with pkgs;
     meta.platforms = lib.platforms.linux;
   } ../build-support/setup-hooks/auto-patchelf.sh;
 
-  appflowy = callPackage ../applications/office/appflowy { };
+  appflowy = callPackage ../applications/office/appflowy {
+    openssl = openssl_1_1;
+  };
 
   appimageTools = callPackage ../build-support/appimage {
     buildFHSUserEnv = buildFHSUserEnvBubblewrap;
@@ -930,7 +932,9 @@ with pkgs;
     { deps = [ dieHook ];
       substitutions = {
         shell = targetPackages.runtimeShell;
-        passthru.tests = tests.makeWrapper;
+      };
+      passthru = {
+        tests = tests.makeWrapper;
       };
     }
     ../build-support/setup-hooks/make-wrapper.sh;
@@ -2215,7 +2219,10 @@ with pkgs;
 
   brewtarget = libsForQt514.callPackage ../applications/misc/brewtarget { } ;
 
-  stdenvBootstrapTools = if stdenv.hostPlatform.isDarwin then
+  # Derivation's result is not used by nixpkgs. Useful for validation for
+  # regressions of bootstrapTools on hydra and on ofborg. Example:
+  #     pkgsCross.aarch64-multiplatform.freshBootstrapTools.build
+  freshBootstrapTools = if stdenv.hostPlatform.isDarwin then
     callPackage ../stdenv/darwin/make-bootstrap-tools.nix {
       localSystem = stdenv.buildPlatform;
       crossSystem =
@@ -2223,7 +2230,7 @@ with pkgs;
     }
   else if stdenv.hostPlatform.isLinux then
     callPackage ../stdenv/linux/make-bootstrap-tools.nix {}
-  else throw "stdenvBootstrapTools: unknown hostPlatform ${stdenv.hostPlatform.config}";
+  else throw "freshBootstrapTools: unknown hostPlatform ${stdenv.hostPlatform.config}";
 
   boxes = callPackage ../tools/text/boxes { };
 
@@ -14650,11 +14657,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_63 = callPackage ../development/compilers/rust/1_63.nix {
+  rust_1_64 = callPackage ../development/compilers/rust/1_64.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_14 = llvmPackages_14.libllvm;
   };
-  rust = rust_1_63;
+  rust = rust_1_64;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -14663,8 +14670,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_63 = rust_1_63.packages.stable;
-  rustPackages = rustPackages_1_63;
+  rustPackages_1_64 = rust_1_64.packages.stable;
+  rustPackages = rustPackages_1_64;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -24624,7 +24631,9 @@ with pkgs;
 
   iwd = callPackage ../os-specific/linux/iwd { };
 
-  jfbview = callPackage ../os-specific/linux/jfbview { };
+  jfbview = callPackage ../os-specific/linux/jfbview {
+    imlib2 = imlib2Full;
+  };
   jfbpdf = jfbview.override {
     imageSupport = false;
   };
@@ -28151,7 +28160,9 @@ with pkgs;
 
   fdupes = callPackage ../tools/misc/fdupes { };
 
-  feh = callPackage ../applications/graphics/feh { };
+  feh = callPackage ../applications/graphics/feh {
+    imlib2 = imlib2Full;
+  };
 
   feishu = callPackage ../applications/networking/instant-messengers/feishu {};
 
@@ -30843,7 +30854,9 @@ with pkgs;
 
   pqiv = callPackage ../applications/graphics/pqiv { };
 
-  qiv = callPackage ../applications/graphics/qiv { };
+  qiv = callPackage ../applications/graphics/qiv {
+    imlib2 = imlib2Full;
+  };
 
   premid = callPackage ../applications/misc/premid { };
 
@@ -31388,9 +31401,13 @@ with pkgs;
 
   swingsane = callPackage ../applications/graphics/swingsane { };
 
-  sxiv = callPackage ../applications/graphics/sxiv { };
+  sxiv = callPackage ../applications/graphics/sxiv {
+    imlib2 = imlib2Full;
+  };
 
-  nsxiv = callPackage ../applications/graphics/nsxiv { };
+  nsxiv = callPackage ../applications/graphics/nsxiv {
+    imlib2 = imlib2Full;
+  };
 
   resilio-sync = callPackage ../applications/networking/resilio-sync { };
 
diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index 9a6b1880950..d5f820d0d60 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -50,7 +50,7 @@ rec {
   }).overrideDerivation
     (old: {
       propagatedBuildInputs = [ zlib ];
-      buildInputs = old.buildInputs ++ [ pkg-config ];
+      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pkg-config ];
 
       # just override it with nothing so it does not fail
       autoreconfPhase = "echo autoreconfPhase not used...";
@@ -87,7 +87,7 @@ rec {
     pname = "xmlmirror";
     version = "unstable-2016-06-05";
 
-    buildInputs = [ pkg-config libtool gnumake libxml2 nodejs openjdk json_c ];
+    buildInputs = [ libtool gnumake libxml2 nodejs openjdk json_c ];
     nativeBuildInputs = [ pkg-config zlib autoconf automake ];
 
     src = pkgs.fetchgit {
@@ -140,7 +140,7 @@ rec {
     stdenv = pkgs.emscriptenStdenv;
   }).overrideDerivation
     (old: {
-      buildInputs = old.buildInputs ++ [ pkg-config ];
+      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pkg-config ];
       # we need to reset this setting!
       NIX_CFLAGS_COMPILE="";
       dontStrip = true;
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index 302b301b115..ba69287fa8d 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -45,7 +45,11 @@ in {
     mkBootstrap = adoptopenjdk: path: args:
       /* adoptopenjdk not available for i686, so fall back to our old builds for bootstrapping */
       if   adoptopenjdk.jdk-hotspot.meta.available
-      then adoptopenjdk.jdk-hotspot
+      then
+        # only linux has the gtkSupport option
+        if stdenv.isLinux
+        then adoptopenjdk.jdk-hotspot.override { gtkSupport = false; }
+        else adoptopenjdk.jdk-hotspot
       else callPackage path args;
 
     mkOpenjdk = path-linux: path-darwin: args:
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 73a753bae29..53848811592 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13873,7 +13873,8 @@ let
       url = "mirror://cpan/authors/id/L/LK/LKUNDRAK/Log-Journald-0.30.tar.gz";
       hash = "sha256-VZks+aHh+4M/QoMAUlv6fPftRrg+xBT4KgkXibN9CKM=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.systemd ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.systemd ];
     postPatch = ''
       substituteInPlace Build.PL \
         --replace "libsystemd-journal" "libsystemd"
@@ -20936,7 +20937,8 @@ let
       url = "mirror://cpan/authors/id/L/LK/LKUNDRAK/RPM2-1.4.tar.gz";
       hash = "sha256-XstCqmkyTm9AiKv64HMTkG5aq/L0bxIE8/HeWRVbtjY=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.rpm ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.rpm ];
     doCheck = false; # Tries to open /var/lib/rpm
     meta = {
       description = "Perl bindings for the RPM Package Manager API";
@@ -27229,7 +27231,8 @@ let
       url = "mirror://cpan/authors/id/S/SH/SHLOMIF/XML-LibXSLT-1.99.tar.gz";
       hash = "sha256-En4XqHf7YeR7nouHv42q0xM5pioAEh+XUdUitDiw9/A=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.zlib pkgs.libxml2 pkgs.libxslt ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.zlib pkgs.libxml2 pkgs.libxslt ];
     propagatedBuildInputs = [ XMLLibXML ];
     meta = {
       description = "Interface to the GNOME libxslt library";
@@ -27805,7 +27808,8 @@ let
 
     makeMakerFlags = "--prefix-openssl=${pkgs.openssl_1_1.dev}";
 
-    buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl_1_1 pkgs.pkg-config ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl_1_1 ];
     meta = {
       description = "Perl wrapper for the ldns DNS library";
       license = with lib.licenses; [ bsd3 ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7bbf1a5deac..93ef7cf7da0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7363,7 +7363,7 @@ in {
   psd-tools = callPackage ../development/python-modules/psd-tools { };
 
   psutil = callPackage ../development/python-modules/psutil {
-    inherit (pkgs.darwin.apple_sdk.frameworks) IOKit;
+    inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation IOKit;
   };
 
   psutil-home-assistant = callPackage ../development/python-modules/psutil-home-assistant { };
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index bac3d1b1171..61116328b29 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -30,7 +30,7 @@ let
     "aarch64"
   ] (arch: builtins.elem "${arch}-darwin" systemsWithAnySupport);
 
-  jobs =
+  nonPackageJobs =
     { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease supportedSystems; };
 
       metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
@@ -167,7 +167,9 @@ let
           (system: {
             inherit
               (import ../stdenv/linux/make-bootstrap-tools.nix {
-                localSystem = { inherit system; };
+                pkgs = import ../.. {
+                  localSystem = { inherit system; };
+                };
               })
               dist test;
           })
@@ -175,7 +177,9 @@ let
         // optionalAttrs supportDarwin.x86_64 {
           x86_64-darwin =
             let
-              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix { system = "x86_64-darwin"; };
+              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix {
+                localSystem = { system = "x86_64-darwin"; };
+              };
             in {
               # Lightweight distribution and test
               inherit (bootstrap) dist test;
@@ -186,14 +190,25 @@ let
           # Cross compiled bootstrap tools
           aarch64-darwin =
             let
-              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix { system = "x86_64-darwin"; crossSystem = "aarch64-darwin"; };
+              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix {
+                localSystem = { system = "x86_64-darwin"; };
+                crossSystem = { system = "aarch64-darwin"; };
+              };
             in {
               # Distribution only for now
               inherit (bootstrap) dist;
             };
           };
 
-    } // (mapTestOn ((packagePlatforms pkgs) // {
+       };
+
+  # Do not allow attribute collision between jobs inserted in
+  # 'nonPackageAttrs' and jobs pulled in from 'pkgs'.
+  # Conflicts usually cause silent job drops like in
+  #   https://github.com/NixOS/nixpkgs/pull/182058
+  jobs = lib.attrsets.unionOfDisjoint
+    nonPackageJobs
+    (mapTestOn ((packagePlatforms pkgs) // {
       haskell.compiler = packagePlatforms pkgs.haskell.compiler;
       haskellPackages = packagePlatforms pkgs.haskellPackages;
       idrisPackages = packagePlatforms pkgs.idrisPackages;