summary refs log tree commit diff
diff options
context:
space:
mode:
authorgithub-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>2023-01-28 12:01:10 +0000
committerGitHub <noreply@github.com>2023-01-28 12:01:10 +0000
commitb460ba19982e9531f03e74bc8a0bf6668267daa7 (patch)
tree7f3b8e6c8206fee68dc80d566a7328ba929c7073
parentcfb80ea275295fb0c43ffbc0493ea6343244ee7b (diff)
parent8142fb901dfc9cd97936eba52515e8d4ce74c852 (diff)
downloadnixpkgs-b460ba19982e9531f03e74bc8a0bf6668267daa7.tar
nixpkgs-b460ba19982e9531f03e74bc8a0bf6668267daa7.tar.gz
nixpkgs-b460ba19982e9531f03e74bc8a0bf6668267daa7.tar.bz2
nixpkgs-b460ba19982e9531f03e74bc8a0bf6668267daa7.tar.lz
nixpkgs-b460ba19982e9531f03e74bc8a0bf6668267daa7.tar.xz
nixpkgs-b460ba19982e9531f03e74bc8a0bf6668267daa7.tar.zst
nixpkgs-b460ba19982e9531f03e74bc8a0bf6668267daa7.zip
Merge master into staging-next
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2305.section.xml19
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md4
-rw-r--r--nixos/modules/services/web-apps/wordpress.nix63
-rw-r--r--nixos/tests/nextcloud/default.nix2
-rw-r--r--pkgs/applications/audio/chuck/default.nix4
-rw-r--r--pkgs/applications/editors/gnome-latex/default.nix4
-rw-r--r--pkgs/applications/misc/gnome-firmware/default.nix4
-rw-r--r--pkgs/applications/misc/orca/default.nix4
-rw-r--r--pkgs/applications/networking/n8n/node-packages.nix517
-rw-r--r--pkgs/applications/networking/qv2ray/default.nix6
-rw-r--r--pkgs/applications/video/haruna/default.nix4
-rw-r--r--pkgs/data/fonts/andika/default.nix2
-rw-r--r--pkgs/data/fonts/annapurna-sil/default.nix2
-rw-r--r--pkgs/data/fonts/charis-sil/default.nix2
-rw-r--r--pkgs/data/fonts/doulos-sil/default.nix2
-rw-r--r--pkgs/data/fonts/eb-garamond/default.nix4
-rw-r--r--pkgs/data/fonts/encode-sans/default.nix4
-rw-r--r--pkgs/data/fonts/ezra-sil/default.nix2
-rw-r--r--pkgs/data/fonts/fraunces/default.nix4
-rw-r--r--pkgs/data/fonts/julia-mono/default.nix4
-rw-r--r--pkgs/data/fonts/public-sans/default.nix31
-rw-r--r--pkgs/data/fonts/quattrocento-sans/default.nix34
-rw-r--r--pkgs/data/fonts/quattrocento/default.nix33
-rw-r--r--pkgs/data/fonts/roboto/default.nix29
-rw-r--r--pkgs/data/fonts/scheherazade/default.nix41
-rw-r--r--pkgs/data/fonts/source-code-pro/default.nix29
-rw-r--r--pkgs/data/fonts/source-han-code-jp/default.nix29
-rw-r--r--pkgs/data/fonts/source-han/default.nix56
-rw-r--r--pkgs/data/fonts/source-sans-pro/default.nix33
-rw-r--r--pkgs/data/fonts/source-sans/default.nix32
-rw-r--r--pkgs/data/fonts/source-serif-pro/default.nix33
-rw-r--r--pkgs/data/fonts/source-serif/default.nix32
-rw-r--r--pkgs/data/fonts/stix-two/default.nix33
-rw-r--r--pkgs/data/fonts/sudo/default.nix30
-rw-r--r--pkgs/data/fonts/terminus-font-ttf/default.nix39
-rw-r--r--pkgs/data/fonts/theano/default.nix35
-rw-r--r--pkgs/data/fonts/times-newer-roman/default.nix31
-rw-r--r--pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix33
-rw-r--r--pkgs/data/fonts/undefined-medium/default.nix30
-rw-r--r--pkgs/data/fonts/vollkorn/default.nix41
-rw-r--r--pkgs/data/fonts/weather-icons/default.nix29
-rw-r--r--pkgs/data/fonts/work-sans/default.nix29
-rw-r--r--pkgs/data/fonts/yanone-kaffeesatz/default.nix29
-rw-r--r--pkgs/data/fonts/zilla-slab/default.nix32
-rw-r--r--pkgs/desktops/deepin/library/gio-qt/default.nix21
-rw-r--r--pkgs/desktops/gnome/apps/gedit/default.nix4
-rw-r--r--pkgs/desktops/gnome/games/gnome-sudoku/default.nix4
-rw-r--r--pkgs/desktops/gnome/misc/gpaste/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/15/bintools/default.nix40
-rw-r--r--pkgs/development/compilers/llvm/15/clang/default.nix129
-rw-r--r--pkgs/development/compilers/llvm/15/clang/gnu-install-dirs.patch105
-rw-r--r--pkgs/development/compilers/llvm/15/clang/purity.patch29
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/X86-support-extension.patch21
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/armv7l.patch32
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/darwin-targetconditionals.patch71
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/default.nix156
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/gnu-install-dirs.patch20
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/normalize-var.patch16
-rw-r--r--pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch12
-rw-r--r--pkgs/development/compilers/llvm/15/default.nix354
-rw-r--r--pkgs/development/compilers/llvm/15/libcxx/default.nix107
-rw-r--r--pkgs/development/compilers/llvm/15/libcxx/gnu-install-dirs.patch22
-rw-r--r--pkgs/development/compilers/llvm/15/libcxxabi/default.nix105
-rw-r--r--pkgs/development/compilers/llvm/15/libcxxabi/gnu-install-dirs.patch22
-rw-r--r--pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/15/libunwind/default.nix62
-rw-r--r--pkgs/development/compilers/llvm/15/libunwind/gnu-install-dirs.patch22
-rw-r--r--pkgs/development/compilers/llvm/15/lld/default.nix55
-rw-r--r--pkgs/development/compilers/llvm/15/lld/gnu-install-dirs.patch46
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/cpu_subtype_arm64e_replacement.patch12
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/default.nix186
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/gnu-install-dirs.patch23
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/procfs.patch46
-rw-r--r--pkgs/development/compilers/llvm/15/lldb/resource-dir.patch13
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/default.nix429
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs-polly.patch19
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs.patch138
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/lit-shell-script-runner-set-dyld-library-path.patch26
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch79
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch24
-rw-r--r--pkgs/development/compilers/llvm/15/openmp/default.nix71
-rw-r--r--pkgs/development/compilers/llvm/15/openmp/fix-find-tool.patch18
-rw-r--r--pkgs/development/compilers/llvm/15/openmp/gnu-install-dirs.patch22
-rw-r--r--pkgs/development/compilers/llvm/15/openmp/run-lit-directly.patch12
-rw-r--r--pkgs/development/libraries/gusb/default.nix4
-rw-r--r--pkgs/development/libraries/tepl/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/mdx/default.nix24
-rw-r--r--pkgs/development/python-modules/aladdin-connect/default.nix13
-rw-r--r--pkgs/development/python-modules/cvss/default.nix4
-rw-r--r--pkgs/development/python-modules/datasette-publish-fly/default.nix7
-rw-r--r--pkgs/development/python-modules/django-tastypie/default.nix7
-rw-r--r--pkgs/development/python-modules/intake/default.nix8
-rw-r--r--pkgs/development/python-modules/loguru/default.nix34
-rw-r--r--pkgs/development/python-modules/monty/default.nix27
-rw-r--r--pkgs/development/python-modules/neo4j/default.nix4
-rw-r--r--pkgs/development/python-modules/notify-py/default.nix4
-rw-r--r--pkgs/development/python-modules/peaqevcore/default.nix4
-rw-r--r--pkgs/development/python-modules/plugwise/default.nix4
-rw-r--r--pkgs/development/python-modules/pylutron/default.nix4
-rw-r--r--pkgs/development/python-modules/pyswitchbee/default.nix6
-rw-r--r--pkgs/development/python-modules/pywerview/default.nix15
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix1
-rw-r--r--pkgs/development/python-modules/whois/default.nix4
-rw-r--r--pkgs/development/python-modules/yark/default.nix41
-rw-r--r--pkgs/development/tools/buf/default.nix6
-rw-r--r--pkgs/development/tools/cocogitto/default.nix6
-rw-r--r--pkgs/servers/dns/knot-resolver/default.nix9
-rw-r--r--pkgs/servers/jackett/default.nix4
-rw-r--r--pkgs/servers/nextcloud/default.nix20
-rw-r--r--pkgs/servers/nextcloud/packages/24.json24
-rw-r--r--pkgs/servers/nextcloud/packages/25.json30
-rw-r--r--pkgs/servers/nextcloud/packages/26.json62
-rw-r--r--pkgs/servers/nextcloud/patches/v26/0001-Setup-remove-custom-dbuser-creation-behavior.patch149
-rw-r--r--pkgs/servers/web-apps/wordpress/generic.nix9
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/misc/gh-actions-cache/default.nix34
-rw-r--r--pkgs/tools/misc/licensor/default.nix12
-rw-r--r--pkgs/tools/networking/s3rs/default.nix6
-rw-r--r--pkgs/tools/package-management/nix/common.nix2
-rw-r--r--pkgs/tools/security/grype/default.nix6
-rw-r--r--pkgs/tools/security/trufflehog/default.nix6
-rw-r--r--pkgs/tools/system/automatic-timezoned/default.nix6
-rw-r--r--pkgs/tools/system/clinfo/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix22
124 files changed, 3918 insertions, 787 deletions
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 908b0cc6046..0d80824b28b 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -304,6 +304,14 @@
       </listitem>
       <listitem>
         <para>
+          The <literal>wordpress</literal> derivation no longer contains
+          any builtin plugins or themes. If you need them you have to
+          add them back to prevent your site from breaking. You can find
+          them in <literal>wordpressPackages.{plugins,themes}</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           <literal>llvmPackages_rocm.llvm</literal> will not contain
           <literal>clang</literal> or <literal>compiler-rt</literal>.
           <literal>llvmPackages_rocm.clang</literal> will not contain
@@ -360,6 +368,17 @@
       </listitem>
       <listitem>
         <para>
+          The
+          <link linkend="opt-services.wordpress.sites._name_.plugins">services.wordpress.sites.&lt;name&gt;.plugins</link>
+          and
+          <link linkend="opt-services.wordpress.sites._name_.themes">services.wordpress.sites.&lt;name&gt;.themes</link>
+          options have been converted from sets to attribute sets to
+          allow for consumers to specify explicit install paths via
+          attribute name.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           In <literal>mastodon</literal> it is now necessary to specify
           location of file with <literal>PostgreSQL</literal> database
           password. In
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 372cd8f0666..08ebba1bbc6 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -77,6 +77,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `tut` has been updated from 1.0.34 to 2.0.0, and now uses the TOML format for the configuration file instead of INI. Additional information can be found [here](https://github.com/RasmusLindroth/tut/releases/tag/2.0.0).
 
+- The `wordpress` derivation no longer contains any builtin plugins or themes. If you need them you have to add them back to prevent your site from breaking. You can find them in `wordpressPackages.{plugins,themes}`.
+
 - `llvmPackages_rocm.llvm` will not contain `clang` or `compiler-rt`. `llvmPackages_rocm.clang` will not contain `llvm`. `llvmPackages_rocm.clangNoCompilerRt` has been removed in favor of using `llvmPackages_rocm.clang-unwrapped`.
 
 - The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2.
@@ -89,6 +91,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually.
 
+- The [services.wordpress.sites.&lt;name&gt;.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.&lt;name&gt;.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
+
 - In `mastodon` it is now necessary to specify location of file with `PostgreSQL` database password. In `services.mastodon.database.passwordFile` parameter default value `/var/lib/mastodon/secrets/db-password` has been changed to `null`.
 
 - The `--target-host` and `--build-host` options of `nixos-rebuild` no longer treat the `localhost` value specially – to build on/deploy to local machine, omit the relevant flag.
diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix
index 416ad8556bd..d4c987da114 100644
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@@ -32,8 +32,8 @@ let
       # Since hard linking directories is not allowed, copying is the next best thing.
 
       # copy additional plugin(s), theme(s) and language(s)
-      ${concatMapStringsSep "\n" (theme: "cp -r ${theme} $out/share/wordpress/wp-content/themes/${theme.name}") cfg.themes}
-      ${concatMapStringsSep "\n" (plugin: "cp -r ${plugin} $out/share/wordpress/wp-content/plugins/${plugin.name}") cfg.plugins}
+      ${concatStringsSep "\n" (mapAttrsToList (name: theme: "cp -r ${theme} $out/share/wordpress/wp-content/themes/${name}") cfg.themes)}
+      ${concatStringsSep "\n" (mapAttrsToList (name: plugin: "cp -r ${plugin} $out/share/wordpress/wp-content/plugins/${name}") cfg.plugins)}
       ${concatMapStringsSep "\n" (language: "cp -r ${language} $out/share/wordpress/wp-content/languages/") cfg.languages}
     '';
   };
@@ -130,62 +130,45 @@ let
         };
 
         plugins = mkOption {
-          type = types.listOf types.path;
-          default = [];
+          type = with types; coercedTo
+            (listOf path)
+            (l: warn "setting this option with a list is deprecated"
+              listToAttrs (map (p: nameValuePair (p.name or (throw "${p} does not have a name")) p) l))
+            (attrsOf path);
+          default = {};
           description = lib.mdDoc ''
-            List of path(s) to respective plugin(s) which are copied from the 'plugins' directory.
+            Path(s) to respective plugin(s) which are copied from the 'plugins' directory.
 
             ::: {.note}
             These plugins need to be packaged before use, see example.
             :::
           '';
           example = literalExpression ''
-            let
-              # Wordpress plugin 'embed-pdf-viewer' installation example
-              embedPdfViewerPlugin = pkgs.stdenv.mkDerivation {
-                name = "embed-pdf-viewer-plugin";
-                # Download the theme from the wordpress site
-                src = pkgs.fetchurl {
-                  url = "https://downloads.wordpress.org/plugin/embed-pdf-viewer.2.0.3.zip";
-                  sha256 = "1rhba5h5fjlhy8p05zf0p14c9iagfh96y91r36ni0rmk6y891lyd";
-                };
-                # We need unzip to build this package
-                nativeBuildInputs = [ pkgs.unzip ];
-                # Installing simply means copying all files to the output directory
-                installPhase = "mkdir -p $out; cp -R * $out/";
-              };
-            # And then pass this theme to the themes list like this:
-            in [ embedPdfViewerPlugin ]
+            {
+              inherit (pkgs.wordpressPackages.plugins) embed-pdf-viewer-plugin;
+            }
           '';
         };
 
         themes = mkOption {
-          type = types.listOf types.path;
-          default = [];
+          type = with types; coercedTo
+            (listOf path)
+            (l: warn "setting this option with a list is deprecated"
+              listToAttrs (map (p: nameValuePair (p.name or (throw "${p} does not have a name")) p) l))
+            (attrsOf path);
+          default = { inherit (pkgs.wordpressPackages.themes) twentytwentythree; };
+          defaultText = literalExpression "{ inherit (pkgs.wordpressPackages.themes) twentytwentythree; }";
           description = lib.mdDoc ''
-            List of path(s) to respective theme(s) which are copied from the 'theme' directory.
+            Path(s) to respective theme(s) which are copied from the 'theme' directory.
 
             ::: {.note}
             These themes need to be packaged before use, see example.
             :::
           '';
           example = literalExpression ''
-            let
-              # Let's package the responsive theme
-              responsiveTheme = pkgs.stdenv.mkDerivation {
-                name = "responsive-theme";
-                # Download the theme from the wordpress site
-                src = pkgs.fetchurl {
-                  url = "https://downloads.wordpress.org/theme/responsive.3.14.zip";
-                  sha256 = "0rjwm811f4aa4q43r77zxlpklyb85q08f9c8ns2akcarrvj5ydx3";
-                };
-                # We need unzip to build this package
-                nativeBuildInputs = [ pkgs.unzip ];
-                # Installing simply means copying all files to the output directory
-                installPhase = "mkdir -p $out; cp -R * $out/";
-              };
-            # And then pass this theme to the themes list like this:
-            in [ responsiveTheme ]
+            {
+              inherit (pkgs.wordpressPackages.themes) responsive-theme;
+            }
           '';
         };
 
diff --git a/nixos/tests/nextcloud/default.nix b/nixos/tests/nextcloud/default.nix
index b8d3ba75b51..350486e8c73 100644
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@@ -26,4 +26,4 @@ foldl
     };
   })
 { }
-  [ 24 25 ]
+  [ 24 25 26 ]
diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
index bb0e885cd74..a62337d7d55 100644
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.1.1";
+  version = "1.4.2.0";
   pname = "chuck";
 
   src = fetchurl {
     url = "http://chuck.cs.princeton.edu/release/files/chuck-${version}.tgz";
-    sha256 = "sha256-RFnubxUdpy3N4VJeCv4FMp1hCGNWsWjs/AvDpXApD2M=";
+    sha256 = "sha256-hIwsC9rYgXWSTFqUufKGqoT0Gnsf4nR4KQ0iSVbj8xg=";
   };
 
   nativeBuildInputs = [ flex bison which ]
diff --git a/pkgs/applications/editors/gnome-latex/default.nix b/pkgs/applications/editors/gnome-latex/default.nix
index 156e8eaac7e..573b8cdfee9 100644
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@@ -21,12 +21,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.42.0";
+  version = "3.44.0";
   pname = "gnome-latex";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "ASMecEE3WNGu1pYNqhoigfqRNaYFkQuodM7VMn3LhUM=";
+    sha256 = "iL1TQL0ox+0Bx5ZqOgBzK72QJ3PfWsZZvmrRGAap50Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/gnome-firmware/default.nix b/pkgs/applications/misc/gnome-firmware/default.nix
index 2aebbf5194a..6d46727d5ab 100644
--- a/pkgs/applications/misc/gnome-firmware/default.nix
+++ b/pkgs/applications/misc/gnome-firmware/default.nix
@@ -20,14 +20,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-firmware";
-  version = "42.2";
+  version = "43.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "gnome-firmware";
     rev = version;
-    sha256 = "L0R2lXU69I6NI7Srq5s+8N9261Ic8B7FVaaXNjz2Ll0=";
+    sha256 = "9QS6X1Cm9/wToQ8hnGNn3VytSCpZI8StZ3+vf0/wbAw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/orca/default.nix b/pkgs/applications/misc/orca/default.nix
index 29cdac6b8d1..d88c4f549d3 100644
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@@ -34,13 +34,13 @@
 
 buildPythonApplication rec {
   pname = "orca";
-  version = "43.0";
+  version = "43.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "HKdaAMSoUSoJ5KJuszn615RNHtQayjL3D2lickQhglA=";
+    sha256 = "9ljgSc4WknO4Q0aBBCTW9QkpHwXX7MOnegPZEqo+aEA=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/n8n/node-packages.nix b/pkgs/applications/networking/n8n/node-packages.nix
index 0e9f619b1ff..86f24676772 100644
--- a/pkgs/applications/networking/n8n/node-packages.nix
+++ b/pkgs/applications/networking/n8n/node-packages.nix
@@ -292,6 +292,15 @@ let
         sha512 = "+00smmZBradoGFEkRjliN7BjqPh/Hx0KCHWOEibUmflUqZz2RwBTU0MrVovEEHozhx3AUSGcO/rl3/5f9e9Biw==";
       };
     };
+    "@codemirror/lang-css-6.0.1" = {
+      name = "_at_codemirror_slash_lang-css";
+      packageName = "@codemirror/lang-css";
+      version = "6.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@codemirror/lang-css/-/lang-css-6.0.1.tgz";
+        sha512 = "rlLq1Dt0WJl+2epLQeAsfqIsx3lGu4HStHCJu95nGGuz2P2fNugbU3dQYafr2VRjM4eMC9HviI6jvS98CNtG5w==";
+      };
+    };
     "@codemirror/lang-javascript-6.1.2" = {
       name = "_at_codemirror_slash_lang-javascript";
       packageName = "@codemirror/lang-javascript";
@@ -643,6 +652,15 @@ let
         sha512 = "SVgiGtMnMnW3ActR8SXgsDhw7a0w0ChHSYAyAUxxrOiJ1OqYWEKk/xJd84tTSPo1mo6DXLObAJALNnd0Hrv7Ng==";
       };
     };
+    "@lezer/css-1.1.1" = {
+      name = "_at_lezer_slash_css";
+      packageName = "@lezer/css";
+      version = "1.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lezer/css/-/css-1.1.1.tgz";
+        sha512 = "mSjx+unLLapEqdOYDejnGBokB5+AiJKZVclmud0MKQOKx3DLJ5b5VTCstgDDknR6iIV4gVrN6euzsCnj0A2gQA==";
+      };
+    };
     "@lezer/highlight-1.1.3" = {
       name = "_at_lezer_slash_highlight";
       packageName = "@lezer/highlight";
@@ -652,6 +670,15 @@ let
         sha512 = "3vLKLPThO4td43lYRBygmMY18JN3CPh9w+XS2j8WC30vR4yZeFG4z1iFe4jXE43NtGqe//zHW5q8ENLlHvz9gw==";
       };
     };
+    "@lezer/html-1.3.0" = {
+      name = "_at_lezer_slash_html";
+      packageName = "@lezer/html";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lezer/html/-/html-1.3.0.tgz";
+        sha512 = "jU/ah8DEoiECLTMouU/X/ujIg6k9WQMIOFMaCLebzaXfrguyGaR3DpTgmk0tbljiuIJ7hlmVJPcJcxGzmCd0Mg==";
+      };
+    };
     "@lezer/javascript-1.4.1" = {
       name = "_at_lezer_slash_javascript";
       packageName = "@lezer/javascript";
@@ -949,49 +976,49 @@ let
         sha512 = "gW69MEamZ4wk1OsOq1nG1jcyhXIQcnrsX5JwixVw/9xaiav8TCyjESAruu1Rz9yyInhgBXxkNwMeygKnN2uxNA==";
       };
     };
-    "@sentry/core-7.33.0" = {
+    "@sentry/core-7.34.0" = {
       name = "_at_sentry_slash_core";
       packageName = "@sentry/core";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/core/-/core-7.33.0.tgz";
-        sha512 = "mrSgUnXjxHVi0cVea1lv7gC/Y66ya2a3atCHaPEij/+l+3APg5d0Ixt1zMx5YllMiZKf6wpxlZ0uwXcqdAAw+w==";
+        url = "https://registry.npmjs.org/@sentry/core/-/core-7.34.0.tgz";
+        sha512 = "J1oxsYZX1N0tkEcaHt/uuDqk6zOnaivyampp+EvBsUMCdemjg7rwKvawlRB0ZtBEQu3HAhi8zecm03mlpWfCDw==";
       };
     };
-    "@sentry/integrations-7.33.0" = {
+    "@sentry/integrations-7.34.0" = {
       name = "_at_sentry_slash_integrations";
       packageName = "@sentry/integrations";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/integrations/-/integrations-7.33.0.tgz";
-        sha512 = "r67/9R+DaOZETg7gRvOuYPo5XQdzEaE8f7OaET071dUP0kyUBjO74Y7SZxZV/xjBthMXexw5TANHmLVrZQQVag==";
+        url = "https://registry.npmjs.org/@sentry/integrations/-/integrations-7.34.0.tgz";
+        sha512 = "xbWnTvG4gkKeCVpmhhdPtMbQkPO0RAfEJ8VPO5TWmUMT23ZWy2kE0gTZHtnBopy7AXxg231XxTi4fxnwgQGxEQ==";
       };
     };
-    "@sentry/node-7.33.0" = {
+    "@sentry/node-7.34.0" = {
       name = "_at_sentry_slash_node";
       packageName = "@sentry/node";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/node/-/node-7.33.0.tgz";
-        sha512 = "isQVF9LLSG4EZLHiSJ3chgK6f3ZBdGxm8fX6YGm8HWz07CubJddes3yBPLPRNXrRLd7X3SK8pPcK5oc3LIKqAw==";
+        url = "https://registry.npmjs.org/@sentry/node/-/node-7.34.0.tgz";
+        sha512 = "VM4XeydRdgeaNTRe8kwqYg2oNPddVyY74PlCFEFnPEN1NccycNuwiFno68kNrApeqxxLlTTmzkJy0BWo16x2Yg==";
       };
     };
-    "@sentry/types-7.33.0" = {
+    "@sentry/types-7.34.0" = {
       name = "_at_sentry_slash_types";
       packageName = "@sentry/types";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/types/-/types-7.33.0.tgz";
-        sha512 = "5kkmYjtBWSbPxfYGiXdZFPS6xpFBNlXvDqeX4NpCFXz6/LiEDn6tZ61kuCSFb8MZlyqyCX5WsP3aiI2FJfpGIA==";
+        url = "https://registry.npmjs.org/@sentry/types/-/types-7.34.0.tgz";
+        sha512 = "K+OeHIrl35PSYn6Zwqe4b8WWyAJQoI5NeWxHVkM7oQTGJ1YLG4BvLsR+UiUXnKdR5krE4EDtEA5jLsDlBEyPvw==";
       };
     };
-    "@sentry/utils-7.33.0" = {
+    "@sentry/utils-7.34.0" = {
       name = "_at_sentry_slash_utils";
       packageName = "@sentry/utils";
-      version = "7.33.0";
+      version = "7.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/utils/-/utils-7.33.0.tgz";
-        sha512 = "msp02GV1gOfaN5FjKjWxI00rtbYLXEE5cTGldhs/Dt9KI63dDk1nwPDkSLhg6joqRItAq0thlBh6un717HdWbg==";
+        url = "https://registry.npmjs.org/@sentry/utils/-/utils-7.34.0.tgz";
+        sha512 = "VIHHXEBw0htzqxnU8A7WkXKvmsG2pZVqHlAn0H9W/yyFQtXMuP1j1i0NsjADB/3JXUKK83kTNWGzScXvp0o+Jg==";
       };
     };
     "@servie/events-1.0.0" = {
@@ -1012,22 +1039,22 @@ let
         sha512 = "Uy0+khmZqUrUGm5dmMqVlnvufZRSK0FbYzVgp0UMstm+F5+W2/jnEEQyc9vo1ZR/E5ZI/B1WjjoTqBqwJL6Krw==";
       };
     };
-    "@swc/core-1.3.28" = {
+    "@swc/core-1.3.29" = {
       name = "_at_swc_slash_core";
       packageName = "@swc/core";
-      version = "1.3.28";
+      version = "1.3.29";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@swc/core/-/core-1.3.28.tgz";
-        sha512 = "yzc61HbAIjHeOYTUW/IgXAywlSviMFymnUiLY7dNUELGHjMVxSp0XnIlPQN4v5UekYbwLEV8+KChaoQRACiQCw==";
+        url = "https://registry.npmjs.org/@swc/core/-/core-1.3.29.tgz";
+        sha512 = "BYDBEqQ77ASZNQYTP7PlKnMLwbHh3lhtlzD/gQP2zIK9XhqQlcy/zIcLljYDn0EOogLn3IyaUiXgAzDWoAmWMg==";
       };
     };
-    "@swc/wasm-1.3.28" = {
+    "@swc/wasm-1.3.29" = {
       name = "_at_swc_slash_wasm";
       packageName = "@swc/wasm";
-      version = "1.3.28";
+      version = "1.3.29";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@swc/wasm/-/wasm-1.3.28.tgz";
-        sha512 = "6RDkQHSi6FxaoPmGnzMq5smYxXlcEec+t6EHrv8rk4emIrnsFjSc2D2PQ0K4xoryJn2NVD3cDbAEVHe6XZX5AQ==";
+        url = "https://registry.npmjs.org/@swc/wasm/-/wasm-1.3.29.tgz";
+        sha512 = "Tzpl541GRLyzQufasGScL9tMOzk0SsdcVX0jYpG74u6VZHqr0u62Cw6nYtRhTtkcsFsfNpg7RQM+CycyXY8Nmw==";
       };
     };
     "@techteamer/ocsp-1.0.0" = {
@@ -1111,6 +1138,15 @@ let
         sha512 = "yOlFc+7UtL/89t2ZhjPvvB/DeAr3r+Dq58IgzsFkOAvVC6NMJXmCGjbptdXdR9qsX7pKcTL+s87FtYREi2dEEQ==";
       };
     };
+    "@types/asn1-0.2.0" = {
+      name = "_at_types_slash_asn1";
+      packageName = "@types/asn1";
+      version = "0.2.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@types/asn1/-/asn1-0.2.0.tgz";
+        sha512 = "5TMxIpYbIA9c1J0hYQjQDX3wr+rTgQEAXaW2BI8ECM8FO53wSW4HFZplTalrKSHuZUc76NtXcePRhwuOHqGD5g==";
+      };
+    };
     "@types/big.js-6.1.6" = {
       name = "_at_types_slash_big.js";
       packageName = "@types/big.js";
@@ -1336,6 +1372,15 @@ let
         sha512 = "sOUTGn6h1SfQ+gbgqC364jLFBw2lnFqkgF3q0WovEHRLMrVD1sd5aufqi/aJObLekJO+Aq5z646U4Oxy6shXMA==";
       };
     };
+    "@types/uuid-9.0.0" = {
+      name = "_at_types_slash_uuid";
+      packageName = "@types/uuid";
+      version = "9.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.0.tgz";
+        sha512 = "kr90f+ERiQtKWMz5rP32ltJ/BtULDI5RVO0uavn1HQUOwjx0R1h0rnDYNL0CepF1zL5bSY6FISAfd9tOdDhU5Q==";
+      };
+    };
     "@types/validator-13.7.11" = {
       name = "_at_types_slash_validator";
       packageName = "@types/validator";
@@ -1867,13 +1912,13 @@ let
         sha512 = "9cYNccliXZDByFsFliVwk5GvTq058Fj513CiR4E60ndDwmuXzTJEp/Bp8FyuRmGyYupLjHLs+JA9/CBoVS4/NQ==";
       };
     };
-    "aws-sdk-2.1301.0" = {
+    "aws-sdk-2.1304.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.1301.0";
+      version = "2.1304.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1301.0.tgz";
-        sha512 = "AxCt0GfWV14AWC0yvN3+WEBr45JMu2X3FHb8r3H8EhZjJfHk3hWcDwu6vS5Qd8NFDATlFdWJfyQjPVU1YuaDfw==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1304.0.tgz";
+        sha512 = "9mf2uafa2M9yFC5IlMe85TIc7OUo1HSProCQWzpRmAAYhcSwmfbRyt02Wtr5YSVvJJPmcSgcyI92snsQR1c3nw==";
       };
     };
     "aws-sign2-0.7.0" = {
@@ -2632,6 +2677,15 @@ let
         sha512 = "RMr0FhtfXemyinomL4hrWcYJxmX6deFdCxpJzhDttxgO1+bcCnkk+9drydLVDmAMG7NE6aN/fl4F7ucU/90gAA==";
       };
     };
+    "codemirror-lang-html-n8n-1.0.0" = {
+      name = "codemirror-lang-html-n8n";
+      packageName = "codemirror-lang-html-n8n";
+      version = "1.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/codemirror-lang-html-n8n/-/codemirror-lang-html-n8n-1.0.0.tgz";
+        sha512 = "ofNP6VTDGJ5rue+kTCZlDZdF1PnE0sl2cAkfrsCAd5MlBgDmqTwuFJIkTI6KXOJXs0ucdTYH6QLhy9BSW7EaOQ==";
+      };
+    };
     "codemirror-lang-n8n-expression-0.1.0" = {
       name = "codemirror-lang-n8n-expression";
       packageName = "codemirror-lang-n8n-expression";
@@ -3703,15 +3757,6 @@ let
         sha512 = "hCx1oky9PFrJ611mf0ifBLBRW8lUUVRlFolb5gWRfIELabBlbp9xZvrqZLZAs+NxFnbfQoeGd8wDkygjg7U85w==";
       };
     };
-    "entities-2.2.0" = {
-      name = "entities";
-      packageName = "entities";
-      version = "2.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz";
-        sha512 = "p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==";
-      };
-    };
     "entities-4.4.0" = {
       name = "entities";
       packageName = "entities";
@@ -3991,6 +4036,15 @@ let
         sha512 = "5/PsL6iGPdfQ/lKM1UuielYgv3BUoJfz1aUwU9vHZ+J7gyvwdQXFEBIEIaxeGf0GIcreATNyBExtalisDbuMqQ==";
       };
     };
+    "express-async-errors-3.1.1" = {
+      name = "express-async-errors";
+      packageName = "express-async-errors";
+      version = "3.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/express-async-errors/-/express-async-errors-3.1.1.tgz";
+        sha512 = "h6aK1da4tpqWSbyCa3FxB/V6Ehd4EEB15zyQq9qe75OZBp0krinNKuH4rAY+S/U/2I36vdLAUFSjQJ+TFmODng==";
+      };
+    };
     "express-openapi-validator-4.13.8" = {
       name = "express-openapi-validator";
       packageName = "express-openapi-validator";
@@ -4891,13 +4945,13 @@ let
         sha512 = "4lVbmc1diZC7GUJQtRQ5yBAeUCL1exyMwmForWkRLnwyzWBFxN633SALPMGYaWZvKe9j1pRZJpauvmxENSp/EA==";
       };
     };
-    "http-cache-semantics-4.1.0" = {
+    "http-cache-semantics-4.1.1" = {
       name = "http-cache-semantics";
       packageName = "http-cache-semantics";
-      version = "4.1.0";
+      version = "4.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz";
-        sha512 = "carPklcUh7ROWRK7Cv27RPtdhYhUsela/ue5/jKzjegVvXDqM2ILE9Q2BGn9JZJh1g87cp56su/FgQSzcWS8cQ==";
+        url = "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz";
+        sha512 = "er295DKPVsV82j5kw1Gjt+ADA/XYHsajl82cGNQG2eyoPkvgUhX+nDIyelzhIWbbsXP39EHcI6l5tYs2FYqYXQ==";
       };
     };
     "http-errors-2.0.0" = {
@@ -4945,6 +4999,15 @@ let
         sha512 = "dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==";
       };
     };
+    "humanize-duration-3.28.0" = {
+      name = "humanize-duration";
+      packageName = "humanize-duration";
+      version = "3.28.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/humanize-duration/-/humanize-duration-3.28.0.tgz";
+        sha512 = "jMAxraOOmHuPbffLVDKkEKi/NeG8dMqP8lGRd6Tbf7JgAeG33jjgPWDbXXU7ypCI0o+oNKJFgbSB9FKVdWNI2A==";
+      };
+    };
     "humanize-ms-1.2.1" = {
       name = "humanize-ms";
       packageName = "humanize-ms";
@@ -5134,13 +5197,13 @@ let
         sha512 = "3GYo0GJtLqgNXj4YhrisLaNNvWSNwSS2wS4OELGfGxH8I69+XfNdnmV1AyN+ZqMh0i7eX+SWjrwFKDBDgfBC1A==";
       };
     };
-    "ioredis-5.2.6" = {
+    "ioredis-5.3.0" = {
       name = "ioredis";
       packageName = "ioredis";
-      version = "5.2.6";
+      version = "5.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/ioredis/-/ioredis-5.2.6.tgz";
-        sha512 = "F1xO+kYIz+TCOccvhThs2pem6sc9uTl9JsZybWpqe4FeCFDmf04XwbLQUGIqi2UWaDUuR61w2dhxx6NJEFehOA==";
+        url = "https://registry.npmjs.org/ioredis/-/ioredis-5.3.0.tgz";
+        sha512 = "Id9jKHhsILuIZpHc61QkagfVdUj2Rag5GzG1TGEvRNeM7dtTOjICgjC+tvqYxi//PuX2wjQ+Xjva2ONBuf92Pw==";
       };
     };
     "ip-1.1.8" = {
@@ -5926,6 +5989,15 @@ let
         sha512 = "Xq9nH7KlWZmXAtodXDDRE7vs6DU1gTU8zYDHDiWLSip45Egwq3plLHzPn27NgvzL2r1LMPC1vdqh98sQxtqj4A==";
       };
     };
+    "ldapts-4.2.2" = {
+      name = "ldapts";
+      packageName = "ldapts";
+      version = "4.2.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ldapts/-/ldapts-4.2.2.tgz";
+        sha512 = "UHe7BtEhPUFHZZ6XHnRvLHWQrftTap3PgGU0nOLtrFeigZvfpXSsqJ8C9uXNouDV+iDHqoWwplS0eHoDu/GIEQ==";
+      };
+    };
     "leac-0.6.0" = {
       name = "leac";
       packageName = "leac";
@@ -6547,6 +6619,15 @@ let
         sha512 = "TchMembfxfNVpHkbtriWltGWc+m3xszaRD0CZup7GFFhzIgQqxIfn3eGj1yZpfuflzPvfkt611B2Q/Bsk1YnGg==";
       };
     };
+    "markdown-it-13.0.1" = {
+      name = "markdown-it";
+      packageName = "markdown-it";
+      version = "13.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/markdown-it/-/markdown-it-13.0.1.tgz";
+        sha512 = "lTlxriVoy2criHP0JKRhO2VDG9c2ypWCsT237eDiLqi09rmbKoUetyGHq2uOIRoRS//kfoJckS0eUzzkDR+k2Q==";
+      };
+    };
     "markdown-it-emoji-2.0.2" = {
       name = "markdown-it-emoji";
       packageName = "markdown-it-emoji";
@@ -7033,49 +7114,49 @@ let
         sha512 = "z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==";
       };
     };
-    "n8n-core-0.151.2" = {
+    "n8n-core-0.152.0" = {
       name = "n8n-core";
       packageName = "n8n-core";
-      version = "0.151.2";
+      version = "0.152.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.151.2.tgz";
-        sha512 = "QIGNeKuRuY+G+kPxDShjXnxVjCMCEbZ6xB530+V30s2MFa+XnEKJtPdLbsCr0j8AUTHqEb/oMkHAoEyPPg8M1g==";
+        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.152.0.tgz";
+        sha512 = "Bx+4vv3E7SwjFvxLDqzpDbJwVzDUYAw1QTcqAfMnHpkUM9uxlYHV5U3kgSsjpkw0TAF7RVVroHWFYWgnrW9XHA==";
       };
     };
-    "n8n-design-system-0.51.1" = {
+    "n8n-design-system-0.52.0" = {
       name = "n8n-design-system";
       packageName = "n8n-design-system";
-      version = "0.51.1";
+      version = "0.52.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-design-system/-/n8n-design-system-0.51.1.tgz";
-        sha512 = "zK4UI/LkdRzAGZfL9K7/tZSLjxXTIKgt/72LrgEJ8CGNxYPavk0f7eYTH9Q8tbcLAaMLDjUcbcdzVEWh5YZofA==";
+        url = "https://registry.npmjs.org/n8n-design-system/-/n8n-design-system-0.52.0.tgz";
+        sha512 = "Dd6SdWYDjlhgrpPbof4DFPP4hPdpH9cA+3YkFSCgQLNyCi0RdqiQJqPQ5xQFlNVaxd6a7R69RHy/oNwt6/+cLw==";
       };
     };
-    "n8n-editor-ui-0.178.1" = {
+    "n8n-editor-ui-0.179.0" = {
       name = "n8n-editor-ui";
       packageName = "n8n-editor-ui";
-      version = "0.178.1";
+      version = "0.179.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.178.1.tgz";
-        sha512 = "bpSRVRys6fIAuhsmxQrU2QXP0UaRfGan+wODcZbX8SnWSG90ANN7R++CvS6tfL+i8vKvDzLYFjWlm1y40Esbag==";
+        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.179.0.tgz";
+        sha512 = "mo1HoCA7myKzkNkZgmjp9UZ5euxDUX+ZPAyLCoxI+HXki3mhVxELeffzbkBiXAfezi9xlaYAKzehg5HuUyiHjg==";
       };
     };
-    "n8n-nodes-base-0.210.1" = {
+    "n8n-nodes-base-0.211.0" = {
       name = "n8n-nodes-base";
       packageName = "n8n-nodes-base";
-      version = "0.210.1";
+      version = "0.211.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.210.1.tgz";
-        sha512 = "UvkjbmJoBtgqHMz+ff7AJYnVcRpPLY7rh0OPQSR3B6BQ7lzE9eBaBpfTvtIopxRwKeK3vke9UUb6ztdkgDaBDw==";
+        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.211.0.tgz";
+        sha512 = "AoERAZJTuztzCuVvSeAPJk0fko4XcnlK7oweum08+0C1g0X1o9iHQE2kkoHwTxsY77eS6mRbGd2r6OCggpKftQ==";
       };
     };
-    "n8n-workflow-0.133.2" = {
+    "n8n-workflow-0.134.0" = {
       name = "n8n-workflow";
       packageName = "n8n-workflow";
-      version = "0.133.2";
+      version = "0.134.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.133.2.tgz";
-        sha512 = "XnNmt5idpqb/7nVFtNCS4RQUDMfIslfepl2WJfwa/0jSQYWaJmFWhV0OmIj3mJTWaLaiy1qDjAEaEYZZBaQ69A==";
+        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.134.0.tgz";
+        sha512 = "m9sbI29zCXSeFprBEQ+Lqk1E53iI2Dbu0LoL+5Nw3fBcbxnTYCxReD9pSssZSKlHzb9BHSMSYeZk4pK5RyQuvw==";
       };
     };
     "named-placeholders-1.1.3" = {
@@ -7204,13 +7285,13 @@ let
         sha512 = "L8RfEgjBTHAISTuagw51PprVAqNZoG6KSB6LQ6H1bskMVkFs5E71IyjauLBv3XbuomJlguWF/VnRHdJ1gqiAqA==";
       };
     };
-    "node-abort-controller-3.0.1" = {
+    "node-abort-controller-3.1.1" = {
       name = "node-abort-controller";
       packageName = "node-abort-controller";
-      version = "3.0.1";
+      version = "3.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/node-abort-controller/-/node-abort-controller-3.0.1.tgz";
-        sha512 = "/ujIVxthRs+7q6hsdjHMaj8hRG9NuWmwrz+JdRwZ14jdFoKSkm+vDsCbF9PLpnSqjaWQJuTmVtcWHNLr+vrOFw==";
+        url = "https://registry.npmjs.org/node-abort-controller/-/node-abort-controller-3.1.1.tgz";
+        sha512 = "AGK2yQKIjRuqnc6VkX2Xj5d+QW8xZ87pa1UK6yA6ouUyuxfHuMP6umE5QK7UmTeOAymo+Zx1Fxiuw9rVx8taHQ==";
       };
     };
     "node-addon-api-4.3.0" = {
@@ -7330,13 +7411,13 @@ let
         sha512 = "EjYvSmHzekz6VNkNd12aUqAco+bOkRe3Of5jVhltqKhEsjw/y0PYPJfp83+s9Wzh1dspYAkUW/YNQ350NATbSQ==";
       };
     };
-    "nodemailer-6.9.0" = {
+    "nodemailer-6.9.1" = {
       name = "nodemailer";
       packageName = "nodemailer";
-      version = "6.9.0";
+      version = "6.9.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/nodemailer/-/nodemailer-6.9.0.tgz";
-        sha512 = "jFaCEGTeT3E/m/5R2MHWiyQH3pSARECRUDM+1hokOYc3lQAAG7ASuy+2jIsYVf+RVa9zePopSQwKNVFH8DKUpA==";
+        url = "https://registry.npmjs.org/nodemailer/-/nodemailer-6.9.1.tgz";
+        sha512 = "qHw7dOiU5UKNnQpXktdgQ1d3OFgRAekuvbJLcdG5dnEo/GtcTHRYM7+UfJARdOFU9WUQO8OiIamgWPmiSFHYAA==";
       };
     };
     "nopt-5.0.0" = {
@@ -8005,6 +8086,15 @@ let
         sha512 = "UXYN0ziKj+AeNNP7VDMwrehpACThH7LUl/p8TDFpEUuSejCUIwGSfxpHsPvtM6/WXFy6SU4E5RG4IJV/TZAGjw==";
       };
     };
+    "pg-8.9.0" = {
+      name = "pg";
+      packageName = "pg";
+      version = "8.9.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/pg/-/pg-8.9.0.tgz";
+        sha512 = "ZJM+qkEbtOHRuXjmvBtOgNOXOtLSbxiMiUVMgE4rV6Zwocy03RicCVvDXgx8l4Biwo8/qORUnEqn2fdQzV7KCg==";
+      };
+    };
     "pg-connection-string-2.5.0" = {
       name = "pg-connection-string";
       packageName = "pg-connection-string";
@@ -8014,13 +8104,13 @@ let
         sha512 = "r5o/V/ORTA6TmUnyWZR9nCj1klXCO2CEKNRlVuJptZe85QuhFayC7WeMic7ndayT5IRIR0S0xFxFi2ousartlQ==";
       };
     };
-    "pg-cursor-2.7.4" = {
+    "pg-cursor-2.8.0" = {
       name = "pg-cursor";
       packageName = "pg-cursor";
-      version = "2.7.4";
+      version = "2.8.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pg-cursor/-/pg-cursor-2.7.4.tgz";
-        sha512 = "CNWwOzTTZ9QvphoOL+Wg/7pmVr9GnAWBjPbuK2FRclrB4A/WRO/ssCJ9BlkzIGmmofK2M/LyokNHgsLSn+fMHA==";
+        url = "https://registry.npmjs.org/pg-cursor/-/pg-cursor-2.8.0.tgz";
+        sha512 = "LrOaEHK+R1C40e+xeri3FTRY/VKp9uTOCVsKtGB7LJ57qbeaphYvWjbVly8AesdT1GfHXYcAnVdExKhW7DKOvA==";
       };
     };
     "pg-int8-1.0.1" = {
@@ -8068,22 +8158,22 @@ let
         sha512 = "BKlHCMCdNUmF6gagVbehRWSEiVcZzPVltEx14OJExR9Iz9/1R6KETDWLLGv2l6yRqYFnEZZy1VDjRhArzeIGrw==";
       };
     };
-    "pg-protocol-1.5.0" = {
+    "pg-protocol-1.6.0" = {
       name = "pg-protocol";
       packageName = "pg-protocol";
-      version = "1.5.0";
+      version = "1.6.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.5.0.tgz";
-        sha512 = "muRttij7H8TqRNu/DxrAJQITO4Ac7RmX3Klyr/9mJEOBeIpgnF8f9jAfRz5d3XwQZl5qBjF9gLsUtMPJE0vezQ==";
+        url = "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.6.0.tgz";
+        sha512 = "M+PDm637OY5WM307051+bsDia5Xej6d9IR4GwJse1qA1DIhiKlksvrneZOYQq42OM+spubpcNYEo2FcKQrDk+Q==";
       };
     };
-    "pg-query-stream-4.2.4" = {
+    "pg-query-stream-4.3.0" = {
       name = "pg-query-stream";
       packageName = "pg-query-stream";
-      version = "4.2.4";
+      version = "4.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pg-query-stream/-/pg-query-stream-4.2.4.tgz";
-        sha512 = "Et3gTrWn4C2rj4LVioNq1QDd7aH/3mSJcBm79jZALv3wopvx9bWENtbOYZbHQ6KM+IkfFxs0JF1ZLjMDJ9/N6Q==";
+        url = "https://registry.npmjs.org/pg-query-stream/-/pg-query-stream-4.3.0.tgz";
+        sha512 = "+Eer4Y1e43rAaphFNu9/VJKn9nKTApFKCSwVtDjXYnuO4QYqWHOEkApmGJv8gvaU5T6fcuEtjsN24gk+Rx7X9A==";
       };
     };
     "pg-types-1.13.0" = {
@@ -8257,13 +8347,13 @@ let
         sha512 = "9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==";
       };
     };
-    "posthog-node-2.2.3" = {
+    "posthog-node-2.3.0" = {
       name = "posthog-node";
       packageName = "posthog-node";
-      version = "2.2.3";
+      version = "2.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/posthog-node/-/posthog-node-2.2.3.tgz";
-        sha512 = "dYlLZhrDus+uRov/Hh+EiRlMoMhRKchNjNa7mNE2iWmKg/ryOTipf0XYKS9UKdki7aU1NzWFhnLe11HF615XuA==";
+        url = "https://registry.npmjs.org/posthog-node/-/posthog-node-2.3.0.tgz";
+        sha512 = "VV4s1DP2DTAL1WaR4Detq28epLlX2DVWfr/+itRWLvDVFyK9EDbAMqBhOkh8dd3JPkng0kcIjJ8PFII/cCXP9A==";
       };
     };
     "prebuild-install-7.1.1" = {
@@ -8284,6 +8374,15 @@ let
         sha512 = "ESF23V4SKG6lVSGZgYNpbsiaAkdab6ZgOxe52p7+Kid3W3u3bxR4Vfd/o21dmN7jSt0IwgZ4v5MUd26FEtXE9w==";
       };
     };
+    "prettier-2.8.3" = {
+      name = "prettier";
+      packageName = "prettier";
+      version = "2.8.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/prettier/-/prettier-2.8.3.tgz";
+        sha512 = "tJ/oJ4amDihPoufT5sM0Z1SKEuKay8LfVAMlbbhnnkvt6BUserZylqo2PN+p9KeljLr0OHa2rXHU1T8reeoTrw==";
+      };
+    };
     "pretty-bytes-5.6.0" = {
       name = "pretty-bytes";
       packageName = "pretty-bytes";
@@ -9049,13 +9148,13 @@ let
         sha512 = "YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==";
       };
     };
-    "sanitize-html-2.7.0" = {
+    "sanitize-html-2.7.3" = {
       name = "sanitize-html";
       packageName = "sanitize-html";
-      version = "2.7.0";
+      version = "2.7.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.7.0.tgz";
-        sha512 = "jfQelabOn5voO7FAfnQF7v+jsA6z9zC/O4ec0z3E35XPEtHYJT/OdUziVWlKW4irCr2kXaQAyXTXDHWAibg1tA==";
+        url = "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.7.3.tgz";
+        sha512 = "jMaHG29ak4miiJ8wgqA1849iInqORgNv7SLfSw9LtfOhEUQ1C0YHKH73R+hgyufBW9ZFeJrb057k9hjlfBCVlw==";
       };
     };
     "sax-1.2.1" = {
@@ -9634,6 +9733,15 @@ let
         sha512 = "KXDYZ9dszj6bzvnEMRYvxgeTHU74QBFL54XKtP3nyMuJ81CFYtABZ3bAzL2EdFUaEwJOBOgENyFj3R7oTzDyyw==";
       };
     };
+    "stream-browserify-3.0.0" = {
+      name = "stream-browserify";
+      packageName = "stream-browserify";
+      version = "3.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/stream-browserify/-/stream-browserify-3.0.0.tgz";
+        sha512 = "H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==";
+      };
+    };
     "stream-events-1.0.5" = {
       name = "stream-events";
       packageName = "stream-events";
@@ -9661,6 +9769,15 @@ let
         sha512 = "Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==";
       };
     };
+    "strict-event-emitter-types-2.0.0" = {
+      name = "strict-event-emitter-types";
+      packageName = "strict-event-emitter-types";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/strict-event-emitter-types/-/strict-event-emitter-types-2.0.0.tgz";
+        sha512 = "Nk/brWYpD85WlOgzw5h173aci0Teyv8YdIAEtV+N88nDB0dLlazZyJMIsN6eo1/AR61l+p6CJTG1JIyFaoNEEA==";
+      };
+    };
     "strict-uri-encode-2.0.0" = {
       name = "strict-uri-encode";
       packageName = "strict-uri-encode";
@@ -10192,13 +10309,13 @@ let
         sha512 = "Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==";
       };
     };
-    "tslib-2.4.1" = {
+    "tslib-2.5.0" = {
       name = "tslib";
       packageName = "tslib";
-      version = "2.4.1";
+      version = "2.5.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/tslib/-/tslib-2.4.1.tgz";
-        sha512 = "tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA==";
+        url = "https://registry.npmjs.org/tslib/-/tslib-2.5.0.tgz";
+        sha512 = "336iVw3rtn2BUK7ORdIAHTyxHGRIHVReokCR3XjbckJMK7ms8FysBfhLR8IXnAgy7T0PTPNBWKiH514FOW/WSg==";
       };
     };
     "tsscmp-1.0.6" = {
@@ -10597,6 +10714,15 @@ let
         sha512 = "+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==";
       };
     };
+    "uuid-9.0.0" = {
+      name = "uuid";
+      packageName = "uuid";
+      version = "9.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/uuid/-/uuid-9.0.0.tgz";
+        sha512 = "MXcSTerfPa4uqyzStbRoTgt5XIe3x5+42+q1sDuy3R5MDk66URdLMOZe5aPX/SQd+kuYAh0FdP/pO28IkQyTeg==";
+      };
+    };
     "v-click-outside-3.2.0" = {
       name = "v-click-outside";
       packageName = "v-click-outside";
@@ -10714,6 +10840,15 @@ let
         sha512 = "C5GZjs1tYlAqjwymaaCPDjCyGo10ajUphiwA922jKt9n7KPpqR7oM1PCwYzhB/E7+nT3wfdG3oRre5raIT1rKA==";
       };
     };
+    "vue-infinite-loading-2.4.5" = {
+      name = "vue-infinite-loading";
+      packageName = "vue-infinite-loading";
+      version = "2.4.5";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vue-infinite-loading/-/vue-infinite-loading-2.4.5.tgz";
+        sha512 = "xhq95Mxun060bRnsOoLE2Be6BR7jYwuC89kDe18+GmCLVrRA/dU0jrGb12Xu6NjmKs+iTW0AA6saSEmEW4cR7g==";
+      };
+    };
     "vue-json-pretty-1.9.3" = {
       name = "vue-json-pretty";
       packageName = "vue-json-pretty";
@@ -10768,6 +10903,15 @@ let
         sha512 = "N3FYX9Z6rZdTeP3BOBz2LMxlWo9WRmPF6SOsYzz+tEuUH0QjX8UD7c1X95J8pZ7cFvbh9QflVujYQRqRiiwoAg==";
       };
     };
+    "vue2-boring-avatars-0.3.8" = {
+      name = "vue2-boring-avatars";
+      packageName = "vue2-boring-avatars";
+      version = "0.3.8";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vue2-boring-avatars/-/vue2-boring-avatars-0.3.8.tgz";
+        sha512 = "8vNN+zhCIiIMnSQDu0DwhJ11e9r3t4t12dromXmXDtRryBhV58NPn4XgMb4JKrBlfNK92KFrY/cxRy3nzhQfpQ==";
+      };
+    };
     "vue2-teleport-1.0.1" = {
       name = "vue2-teleport";
       packageName = "vue2-teleport";
@@ -11179,10 +11323,10 @@ in
   n8n = nodeEnv.buildNodePackage {
     name = "n8n";
     packageName = "n8n";
-    version = "0.212.1";
+    version = "0.213.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/n8n/-/n8n-0.212.1.tgz";
-      sha512 = "9i4U/dJ84TEFIkj++nx+u3lLgpOxeco5QjopG+Ejjv6Gd3Jc+oL8MF3opN9v0JWagPX+yOnszol6aN+U4Sl8tA==";
+      url = "https://registry.npmjs.org/n8n/-/n8n-0.213.0.tgz";
+      sha512 = "O6ZOT3nhCSBXt0aA3OH64M+6UNwVO7coURqTaCI0oVwbaH387OawtKn+mVnn5Jho52hAAZAoHdF1RVal2LQtJQ==";
     };
     dependencies = [
       (sources."@acuminous/bitsyntax-0.1.2" // {
@@ -11198,53 +11342,53 @@ in
       })
       (sources."@azure/abort-controller-1.1.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-auth-1.4.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-client-1.7.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-http-2.3.1" // {
         dependencies = [
           sources."@azure/core-tracing-1.0.0-preview.13"
           sources."tough-cookie-4.1.2"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
           sources."universalify-0.2.0"
         ];
       })
       sources."@azure/core-http-compat-1.3.0"
       (sources."@azure/core-lro-2.5.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-paging-1.4.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-rest-pipeline-1.10.1" // {
         dependencies = [
           sources."@tootallnate/once-2.0.0"
           sources."http-proxy-agent-5.0.0"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-tracing-1.0.1" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/core-util-1.1.1" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/identity-2.1.0" // {
@@ -11252,17 +11396,17 @@ in
           sources."jwa-2.0.0"
           sources."jws-4.0.0"
           sources."open-8.4.0"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/keyvault-keys-4.6.0" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@azure/logger-1.0.3" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."@azure/ms-rest-azure-env-2.0.0"
@@ -11286,13 +11430,14 @@ in
       (sources."@azure/storage-blob-12.12.0" // {
         dependencies = [
           sources."@azure/core-tracing-1.0.0-preview.13"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."@babel/parser-7.20.13"
       sources."@babel/runtime-7.20.13"
       sources."@codemirror/autocomplete-6.4.0"
       sources."@codemirror/commands-6.2.0"
+      sources."@codemirror/lang-css-6.0.1"
       sources."@codemirror/lang-javascript-6.1.2"
       sources."@codemirror/language-6.4.0"
       sources."@codemirror/lint-6.1.0"
@@ -11363,7 +11508,9 @@ in
       sources."@kwsites/file-exists-1.1.1"
       sources."@kwsites/promise-deferred-1.1.1"
       sources."@lezer/common-1.0.2"
+      sources."@lezer/css-1.1.1"
       sources."@lezer/highlight-1.1.3"
+      sources."@lezer/html-1.3.0"
       sources."@lezer/javascript-1.4.1"
       sources."@lezer/lr-1.3.1"
       sources."@mapbox/node-pre-gyp-1.0.10"
@@ -11385,13 +11532,13 @@ in
       sources."@oclif/command-1.8.21"
       (sources."@oclif/config-1.18.6" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."@oclif/core-1.26.1" // {
         dependencies = [
           sources."supports-color-8.1.1"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
           sources."wrap-ansi-7.0.0"
         ];
       })
@@ -11407,7 +11554,7 @@ in
       sources."@oclif/linewrap-1.0.0"
       (sources."@oclif/parser-3.8.9" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."@oclif/screen-3.0.4"
@@ -11440,15 +11587,15 @@ in
           sources."domhandler-5.0.3"
         ];
       })
-      sources."@sentry/core-7.33.0"
-      sources."@sentry/integrations-7.33.0"
-      sources."@sentry/node-7.33.0"
-      sources."@sentry/types-7.33.0"
-      sources."@sentry/utils-7.33.0"
+      sources."@sentry/core-7.34.0"
+      sources."@sentry/integrations-7.34.0"
+      sources."@sentry/node-7.34.0"
+      sources."@sentry/types-7.34.0"
+      sources."@sentry/utils-7.34.0"
       sources."@servie/events-1.0.0"
       sources."@sqltools/formatter-1.2.5"
-      sources."@swc/core-1.3.28"
-      sources."@swc/wasm-1.3.28"
+      sources."@swc/core-1.3.29"
+      sources."@swc/wasm-1.3.29"
       sources."@techteamer/ocsp-1.0.0"
       sources."@tediousjs/connection-string-0.3.0"
       sources."@tokenizer/token-0.3.0"
@@ -11457,6 +11604,7 @@ in
       sources."@tsconfig/node12-1.0.11"
       sources."@tsconfig/node14-1.0.3"
       sources."@tsconfig/node16-1.0.3"
+      sources."@types/asn1-0.2.0"
       sources."@types/big.js-6.1.6"
       sources."@types/body-parser-1.19.2"
       sources."@types/connect-3.4.35"
@@ -11486,6 +11634,7 @@ in
       sources."@types/stoppable-1.1.1"
       sources."@types/tough-cookie-2.3.8"
       sources."@types/tunnel-0.0.3"
+      sources."@types/uuid-9.0.0"
       sources."@types/validator-13.7.11"
       sources."@types/webidl-conversions-7.0.0"
       sources."@types/whatwg-url-8.2.2"
@@ -11560,7 +11709,7 @@ in
       sources."assert-plus-1.0.0"
       (sources."ast-types-0.13.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."async-3.2.4"
@@ -11574,7 +11723,7 @@ in
       })
       sources."available-typed-arrays-1.0.5"
       sources."avsc-5.7.7"
-      (sources."aws-sdk-2.1301.0" // {
+      (sources."aws-sdk-2.1304.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."events-1.1.1"
@@ -11611,11 +11760,7 @@ in
       sources."bignumber.js-2.4.0"
       sources."binary-extensions-2.2.0"
       sources."binascii-0.0.2"
-      (sources."bindings-1.5.0" // {
-        dependencies = [
-          sources."file-uri-to-path-1.0.0"
-        ];
-      })
+      sources."bindings-1.5.0"
       sources."bintrees-1.0.2"
       (sources."bl-4.1.0" // {
         dependencies = [
@@ -11666,12 +11811,12 @@ in
       sources."callsites-3.1.0"
       (sources."camel-case-4.1.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."capital-case-1.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."cardinal-2.1.1"
@@ -11684,7 +11829,7 @@ in
       sources."chalk-4.1.2"
       (sources."change-case-4.1.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."chardet-0.7.0"
@@ -11719,6 +11864,7 @@ in
         ];
       })
       sources."cluster-key-slot-1.1.2"
+      sources."codemirror-lang-html-n8n-1.0.0"
       sources."codemirror-lang-n8n-expression-0.1.0"
       sources."codepage-1.15.0"
       (sources."color-3.2.1" // {
@@ -11753,7 +11899,7 @@ in
       sources."console-control-strings-1.1.0"
       (sources."constant-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."content-disposition-0.5.4"
@@ -11823,7 +11969,7 @@ in
       sources."domutils-2.8.0"
       (sources."dot-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."dotenv-8.6.0"
@@ -11841,7 +11987,7 @@ in
       sources."encoding-japanese-2.0.0"
       sources."end-of-stream-1.4.4"
       sources."ent-2.2.0"
-      sources."entities-2.2.0"
+      sources."entities-2.1.0"
       sources."env-paths-2.2.1"
       sources."err-code-2.0.3"
       sources."es-abstract-1.21.1"
@@ -11875,6 +12021,7 @@ in
           sources."ms-2.0.0"
         ];
       })
+      sources."express-async-errors-3.1.1"
       (sources."express-openapi-validator-4.13.8" // {
         dependencies = [
           sources."media-typer-1.1.0"
@@ -11906,7 +12053,7 @@ in
       })
       sources."file-saver-2.0.5"
       sources."file-type-16.5.4"
-      sources."file-uri-to-path-2.0.0"
+      sources."file-uri-to-path-1.0.0"
       (sources."filelist-1.0.4" // {
         dependencies = [
           sources."minimatch-5.1.6"
@@ -11968,6 +12115,7 @@ in
       sources."get-system-fonts-2.0.2"
       (sources."get-uri-3.0.2" // {
         dependencies = [
+          sources."file-uri-to-path-2.0.0"
           sources."fs-extra-8.1.0"
           sources."jsonfile-4.0.0"
           sources."universalify-0.1.2"
@@ -12031,7 +12179,7 @@ in
       sources."he-1.2.0"
       (sources."header-case-2.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."heap-0.2.7"
@@ -12049,11 +12197,12 @@ in
         ];
       })
       sources."htmlparser2-6.1.0"
-      sources."http-cache-semantics-4.1.0"
+      sources."http-cache-semantics-4.1.1"
       sources."http-errors-2.0.0"
       sources."http-proxy-agent-4.0.1"
       sources."http-signature-1.2.0"
       sources."https-proxy-agent-5.0.1"
+      sources."humanize-duration-3.28.0"
       sources."humanize-ms-1.2.1"
       sources."hyperlinker-1.0.0"
       sources."iconv-lite-0.6.3"
@@ -12082,7 +12231,7 @@ in
       sources."inquirer-7.3.3"
       sources."internal-slot-1.0.4"
       sources."interpret-1.4.0"
-      (sources."ioredis-5.2.6" // {
+      (sources."ioredis-5.3.0" // {
         dependencies = [
           sources."denque-2.1.0"
         ];
@@ -12178,6 +12327,11 @@ in
       sources."jws-3.2.2"
       sources."kafkajs-1.16.0"
       sources."kuler-2.0.0"
+      (sources."ldapts-4.2.2" // {
+        dependencies = [
+          sources."uuid-9.0.0"
+        ];
+      })
       sources."leac-0.6.0"
       sources."leven-2.1.0"
       sources."levn-0.3.0"
@@ -12233,7 +12387,7 @@ in
       sources."lossless-json-1.0.5"
       (sources."lower-case-2.0.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."lru-cache-4.0.2"
@@ -12263,12 +12417,7 @@ in
         ];
       })
       sources."mappersmith-2.41.0"
-      (sources."markdown-it-12.3.2" // {
-        dependencies = [
-          sources."argparse-2.0.1"
-          sources."entities-2.1.0"
-        ];
-      })
+      sources."markdown-it-13.0.1"
       sources."markdown-it-emoji-2.0.2"
       sources."markdown-it-link-attributes-4.0.1"
       sources."markdown-it-task-lists-2.1.1"
@@ -12378,25 +12527,31 @@ in
         ];
       })
       sources."mz-2.7.0"
-      (sources."n8n-core-0.151.2" // {
+      (sources."n8n-core-0.152.0" // {
         dependencies = [
           sources."concat-stream-2.0.0"
           sources."readable-stream-3.6.0"
         ];
       })
-      sources."n8n-design-system-0.51.1"
-      (sources."n8n-editor-ui-0.178.1" // {
+      (sources."n8n-design-system-0.52.0" // {
+        dependencies = [
+          sources."argparse-2.0.1"
+          sources."markdown-it-12.3.2"
+          sources."vue2-boring-avatars-0.3.8"
+        ];
+      })
+      (sources."n8n-editor-ui-0.179.0" // {
         dependencies = [
           sources."luxon-2.5.2"
         ];
       })
-      (sources."n8n-nodes-base-0.210.1" // {
+      (sources."n8n-nodes-base-0.211.0" // {
         dependencies = [
           sources."chokidar-3.5.2"
           sources."luxon-2.3.2"
         ];
       })
-      (sources."n8n-workflow-0.133.2" // {
+      (sources."n8n-workflow-0.134.0" // {
         dependencies = [
           sources."luxon-2.3.2"
         ];
@@ -12418,11 +12573,11 @@ in
       sources."nice-try-1.0.5"
       (sources."no-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."node-abi-3.31.0"
-      sources."node-abort-controller-3.0.1"
+      sources."node-abort-controller-3.1.1"
       sources."node-addon-api-4.3.0"
       sources."node-ensure-0.0.0"
       sources."node-fetch-2.6.8"
@@ -12451,7 +12606,7 @@ in
       sources."node-rsa-1.1.1"
       sources."node-ssh-12.0.5"
       sources."nodeify-1.0.1"
-      sources."nodemailer-6.9.0"
+      sources."nodemailer-6.9.1"
       sources."nopt-5.0.0"
       sources."normalize-path-3.0.0"
       sources."normalize-wheel-1.0.1"
@@ -12498,7 +12653,7 @@ in
       sources."packet-reader-1.0.0"
       (sources."param-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."parse-github-url-1.0.2"
@@ -12510,7 +12665,7 @@ in
       sources."parseurl-1.3.3"
       (sources."pascal-case-3.1.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."passport-0.6.0"
@@ -12524,7 +12679,7 @@ in
       })
       (sources."path-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."path-dirname-1.0.2"
@@ -12543,9 +12698,9 @@ in
       sources."peberminta-0.8.0"
       sources."peek-readable-4.1.0"
       sources."performance-now-2.1.0"
-      sources."pg-8.8.0"
+      sources."pg-8.9.0"
       sources."pg-connection-string-2.5.0"
-      sources."pg-cursor-2.7.4"
+      sources."pg-cursor-2.8.0"
       sources."pg-int8-1.0.1"
       sources."pg-minify-1.6.2"
       (sources."pg-native-3.0.1" // {
@@ -12558,9 +12713,13 @@ in
         ];
       })
       sources."pg-pool-3.5.2"
-      sources."pg-promise-10.15.4"
-      sources."pg-protocol-1.5.0"
-      sources."pg-query-stream-4.2.4"
+      (sources."pg-promise-10.15.4" // {
+        dependencies = [
+          sources."pg-8.8.0"
+        ];
+      })
+      sources."pg-protocol-1.6.0"
+      sources."pg-query-stream-4.3.0"
       sources."pg-types-2.2.0"
       (sources."pgpass-1.0.5" // {
         dependencies = [
@@ -12582,13 +12741,14 @@ in
       sources."postgres-bytea-1.0.0"
       sources."postgres-date-1.0.7"
       sources."postgres-interval-1.2.0"
-      (sources."posthog-node-2.2.3" // {
+      (sources."posthog-node-2.3.0" // {
         dependencies = [
           sources."axios-0.27.2"
         ];
       })
       sources."prebuild-install-7.1.1"
       sources."prelude-ls-1.1.2"
+      sources."prettier-2.8.3"
       sources."pretty-bytes-5.6.0"
       sources."printj-1.1.2"
       sources."prismjs-1.29.0"
@@ -12651,7 +12811,7 @@ in
       (sources."recast-0.21.5" // {
         dependencies = [
           sources."ast-types-0.15.2"
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."rechoir-0.6.2"
@@ -12710,7 +12870,7 @@ in
       sources."safe-regex-test-1.0.0"
       sources."safe-stable-stringify-2.4.2"
       sources."safer-buffer-2.1.2"
-      (sources."sanitize-html-2.7.0" // {
+      (sources."sanitize-html-2.7.3" // {
         dependencies = [
           sources."deepmerge-4.2.2"
         ];
@@ -12737,7 +12897,7 @@ in
       })
       (sources."sentence-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."seq-queue-0.0.5"
@@ -12767,7 +12927,7 @@ in
       sources."smart-buffer-4.2.0"
       (sources."snake-case-3.0.4" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."snowflake-sdk-1.6.17" // {
@@ -12820,9 +12980,15 @@ in
       sources."statuses-2.0.1"
       sources."stealthy-require-1.1.1"
       sources."stoppable-1.1.0"
+      (sources."stream-browserify-3.0.0" // {
+        dependencies = [
+          sources."readable-stream-3.6.0"
+        ];
+      })
       sources."stream-events-1.0.5"
       sources."stream-shift-1.0.1"
       sources."streamsearch-1.1.0"
+      sources."strict-event-emitter-types-2.0.0"
       sources."strict-uri-encode-2.0.0"
       sources."string-similarity-4.0.4"
       sources."string-width-4.2.3"
@@ -12957,7 +13123,7 @@ in
               sources."bl-5.1.0"
             ];
           })
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
           sources."wrap-ansi-7.0.0"
           sources."yargs-17.6.2"
           sources."yargs-parser-21.1.1"
@@ -12978,12 +13144,12 @@ in
       sources."unpipe-1.0.0"
       (sources."upper-case-2.0.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       (sources."upper-case-first-2.0.2" // {
         dependencies = [
-          sources."tslib-2.4.1"
+          sources."tslib-2.5.0"
         ];
       })
       sources."uri-js-4.4.1"
@@ -13033,6 +13199,7 @@ in
       sources."vue-demi-0.13.11"
       sources."vue-fragment-1.5.1"
       sources."vue-i18n-8.28.2"
+      sources."vue-infinite-loading-2.4.5"
       sources."vue-json-pretty-1.9.3"
       sources."vue-prism-editor-0.3.0"
       sources."vue-router-3.6.5"
diff --git a/pkgs/applications/networking/qv2ray/default.nix b/pkgs/applications/networking/qv2ray/default.nix
index af0813a4669..af55fef18c7 100644
--- a/pkgs/applications/networking/qv2ray/default.nix
+++ b/pkgs/applications/networking/qv2ray/default.nix
@@ -74,9 +74,11 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "An GUI frontend to v2ray";
-    homepage = "https://qv2ray.net";
-    license = licenses.gpl3;
+    homepage = "https://github.com/Qv2ray/Qv2ray";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ poscat rewine ];
     platforms = platforms.all;
+    # never built on aarch64-darwin, x86_64-darwin since update to unstable-2022-09-25
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/video/haruna/default.nix b/pkgs/applications/video/haruna/default.nix
index a776fabc9a7..3849acda947 100644
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@@ -26,13 +26,13 @@
 
 mkDerivation rec {
   pname = "haruna";
-  version = "0.10.0";
+  version = "0.10.2";
 
   src = fetchFromGitLab {
     owner = "multimedia";
     repo = "haruna";
     rev = "v${version}";
-    hash = "sha256-UU8tbaZz7udDulh+PHPZDc3rm1MvK4dafPgXL50apMI=";
+    hash = "sha256-hhHWxmr2EzW9QqfV1bpJCiWOWsmGJmvxvtQcuXlMTc4=";
     domain = "invent.kde.org";
   };
 
diff --git a/pkgs/data/fonts/andika/default.nix b/pkgs/data/fonts/andika/default.nix
index e31bc74bac2..92757d303ce 100644
--- a/pkgs/data/fonts/andika/default.nix
+++ b/pkgs/data/fonts/andika/default.nix
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     install -Dm644 *.ttf -t $out/share/fonts/truetype
-    install -Dm644 *OFL.txt *OFL-FAQ.txt *README.txt *FONTLOG.txt -t $out/share/doc/${pname}-${version}
+    install -Dm644 OFL.txt OFL-FAQ.txt README.txt FONTLOG.txt -t $out/share/doc/${pname}-${version}
 
     runHook postInstall
   '';
diff --git a/pkgs/data/fonts/annapurna-sil/default.nix b/pkgs/data/fonts/annapurna-sil/default.nix
index fd4d33a4aeb..59957bb7005 100644
--- a/pkgs/data/fonts/annapurna-sil/default.nix
+++ b/pkgs/data/fonts/annapurna-sil/default.nix
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     install -Dm644 *.ttf -t $out/share/fonts/truetype
-    install -Dm644 *OFL.txt *OFL-FAQ.txt *README.txt *FONTLOG.txt -t $out/share/doc/${pname}-${version}
+    install -Dm644 OFL.txt OFL-FAQ.txt README.txt FONTLOG.txt -t $out/share/doc/${pname}-${version}
 
     runHook postInstall
   '';
diff --git a/pkgs/data/fonts/charis-sil/default.nix b/pkgs/data/fonts/charis-sil/default.nix
index 1df7d794f65..52c32fcc3d8 100644
--- a/pkgs/data/fonts/charis-sil/default.nix
+++ b/pkgs/data/fonts/charis-sil/default.nix
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     install -Dm644 *.ttf -t $out/share/fonts/truetype
-    install -Dm644 *OFL.txt *OFL-FAQ.txt *README.txt *FONTLOG.txt -t $out/share/doc/${pname}-${version}
+    install -Dm644 OFL.txt OFL-FAQ.txt README.txt FONTLOG.txt -t $out/share/doc/${pname}-${version}
 
     runHook postInstall
   '';
diff --git a/pkgs/data/fonts/doulos-sil/default.nix b/pkgs/data/fonts/doulos-sil/default.nix
index 0d7be48d103..5ffd9da5e03 100644
--- a/pkgs/data/fonts/doulos-sil/default.nix
+++ b/pkgs/data/fonts/doulos-sil/default.nix
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     install -Dm644 *.ttf -t $out/share/fonts/truetype
-    install -Dm644 *OFL.txt *OFL-FAQ.txt *README.txt *FONTLOG.txt -t $out/share/doc/${pname}-${version}
+    install -Dm644 OFL.txt OFL-FAQ.txt README.txt FONTLOG.txt -t $out/share/doc/${pname}-${version}
 
     runHook postInstall
   '';
diff --git a/pkgs/data/fonts/eb-garamond/default.nix b/pkgs/data/fonts/eb-garamond/default.nix
index ad78327b8b6..6e5d09c9bcc 100644
--- a/pkgs/data/fonts/eb-garamond/default.nix
+++ b/pkgs/data/fonts/eb-garamond/default.nix
@@ -13,8 +13,8 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     mkdir -p $out/share/{doc,fonts}
-    install -Dm644 otf/*.otf                                    -t $out/share/fonts/opentype
-    install -Dm644 *Changes *README.markdown *README.xelualatex -t $out/share/doc/${pname}-${version}
+    install -Dm644 otf/*.otf                                 -t $out/share/fonts/opentype
+    install -Dm644 Changes README.markdown README.xelualatex -t $out/share/doc/${pname}-${version}
 
     runHook postInstall
   '';
diff --git a/pkgs/data/fonts/encode-sans/default.nix b/pkgs/data/fonts/encode-sans/default.nix
index e8696300576..1c9fc453c7d 100644
--- a/pkgs/data/fonts/encode-sans/default.nix
+++ b/pkgs/data/fonts/encode-sans/default.nix
@@ -12,8 +12,8 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 *.ttf                   -t $out/share/fonts/truetype
-    install -Dm644 *README.md *FONTLOG.txt -t $out/share/doc/${pname}-${version}
+    install -Dm644 *.ttf                 -t $out/share/fonts/truetype
+    install -Dm644 README.md FONTLOG.txt -t $out/share/doc/${pname}-${version}
 
     runHook postInstall
   '';
diff --git a/pkgs/data/fonts/ezra-sil/default.nix b/pkgs/data/fonts/ezra-sil/default.nix
index 4ebebc4da55..7b628bd4bbc 100644
--- a/pkgs/data/fonts/ezra-sil/default.nix
+++ b/pkgs/data/fonts/ezra-sil/default.nix
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     install -Dm644 *.ttf -t $out/share/fonts/truetype
-    install -Dm644 *OFL-FAQ.txt *README.txt *FONTLOG.txt -t $out/share/doc/${pname}-${version}
+    install -Dm644 OFL-FAQ.txt README.txt FONTLOG.txt -t $out/share/doc/${pname}-${version}
 
     runHook postInstall
   '';
diff --git a/pkgs/data/fonts/fraunces/default.nix b/pkgs/data/fonts/fraunces/default.nix
index 7e453d05173..21bab9002bc 100644
--- a/pkgs/data/fonts/fraunces/default.nix
+++ b/pkgs/data/fonts/fraunces/default.nix
@@ -12,8 +12,8 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 *Desktop/static/otf/*.otf -t $out/share/fonts/opentype
-    install -Dm644 *Desktop/static/ttf/*.ttf *Desktop/*.ttf -t $out/share/fonts/truetype
+    install -Dm644 */static/otf/*.otf -t $out/share/fonts/opentype
+    install -Dm644 */static/ttf/*.ttf */*.ttf -t $out/share/fonts/truetype
 
     runHook postInstall
   '';
diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index 47b1afd36fd..e99dfde411d 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "JuliaMono-ttf";
-  version = "0.046";
+  version = "0.047";
 
   src = fetchzip {
     url = "https://github.com/cormullion/juliamono/releases/download/v${version}/${pname}.tar.gz";
     stripRoot = false;
-    hash = "sha256-mq37L3bhUhdjB8z3I9i8+wyLrMSsu/nZrZXOuqE3JlU=";
+    hash = "sha256-tCZo48SBGdhcsP1wgaWkfWr3L3Yz+p/iqesLmarSWbk=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/fonts/public-sans/default.nix b/pkgs/data/fonts/public-sans/default.nix
index 36fa7b136af..06823889783 100644
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "public-sans";
   version = "2.001";
-in (fetchzip {
-  name = "public-sans-${version}";
 
-  url = "https://github.com/uswds/public-sans/releases/download/v${version}/public-sans-v${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/uswds/public-sans/releases/download/v${version}/public-sans-v${version}.zip";
+    stripRoot = false;
+    hash = "sha256-XFs/UMXI/kdrW+53t8Mj26+Rn5p+LQ6KW2K2/ShoIag=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-Ba7D4J72GZQsGn0KINRib9BmHsAnoEsAwAOC+M3CkMU=";
+    install -Dm644 */*/*.otf -t $out/share/fonts/opentype
+    install -Dm644 */*/*.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A strong, neutral, principles-driven, open source typeface for text or display";
@@ -18,10 +27,4 @@ in (fetchzip {
     maintainers = with maintainers; [ dtzWill ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/quattrocento-sans/default.nix b/pkgs/data/fonts/quattrocento-sans/default.nix
index 7841a203f7e..76595988423 100644
--- a/pkgs/data/fonts/quattrocento-sans/default.nix
+++ b/pkgs/data/fonts/quattrocento-sans/default.nix
@@ -1,27 +1,29 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "quattrocento-sans";
   version = "2.0";
-  name = "quattrocento-sans-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "https://web.archive.org/web/20170709124317/http://www.impallari.com/media/releases/quattrocento-sans-v${version}.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20170709124317/http://www.impallari.com/media/releases/quattrocento-sans-v${version}.zip";
+    stripRoot = false;
+    hash = "sha256-L3aFZmaA94B9APxsp8bSBpocIlK3Ehvj/RFXVcW2nso=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0g8hnn92ks4y0jbizwj7yfa097lk887wqkqpqjdmc09sd2n44343";
+    install -Dm644 */*/QuattrocentoSans*.otf -t $out/share/fonts/opentype
+    install -Dm644 */FONTLOG.txt             -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://www.impallari.com/quattrocentosans/";
     description = "A classic, elegant and sober sans-serif typeface";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{fonts,doc}
-    unzip -j $downloadedFile '*/QuattrocentoSans*.otf' -d $out/share/fonts/opentype
-    unzip -j $downloadedFile '*/FONTLOG.txt'           -d $out/share/doc/${name}
-  '';
-})
+}
diff --git a/pkgs/data/fonts/quattrocento/default.nix b/pkgs/data/fonts/quattrocento/default.nix
index 12f146c0e8f..a70396437ec 100644
--- a/pkgs/data/fonts/quattrocento/default.nix
+++ b/pkgs/data/fonts/quattrocento/default.nix
@@ -1,27 +1,28 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "quattrocento";
   version = "1.1";
-  name = "quattrocento-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "https://web.archive.org/web/20170707001804/http://www.impallari.com/media/releases/quattrocento-v${version}.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20170707001804/http://www.impallari.com/media/releases/quattrocento-v${version}.zip";
+    hash = "sha256-ntY6Wl6TI8F7SShMyD8mdOxVg4oz9kvJ7vKTyGdPLtE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "0f8l19y61y20sszn8ni8h9kgl0zy1gyzychg22z5k93ip4h7kfd0";
+    install -Dm644 */*.otf     -t $out/share/fonts/opentype
+    install -Dm644 FONTLOG.txt -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "http://www.impallari.com/quattrocento/";
     description = "A classic, elegant, sober and strong serif typeface";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{fonts,doc}
-    unzip -j $downloadedFile \*.otf        -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*FONTLOG.txt -d $out/share/doc/${name}
-  '';
-})
+}
diff --git a/pkgs/data/fonts/roboto/default.nix b/pkgs/data/fonts/roboto/default.nix
index 9f53eaa38cd..02ca82edf10 100644
--- a/pkgs/data/fonts/roboto/default.nix
+++ b/pkgs/data/fonts/roboto/default.nix
@@ -1,14 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "roboto";
   version = "2.138";
-in (fetchzip {
-  name = "roboto-${version}";
 
-  url = "https://github.com/google/roboto/releases/download/v${version}/roboto-unhinted.zip";
+  src = fetchzip {
+    url = "https://github.com/google/roboto/releases/download/v${version}/roboto-unhinted.zip";
+    stripRoot = false;
+    hash = "sha256-ue3PUZinBpcYgSho1Zrw1KHl7gc/GlN1GhWFk6g5QXE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1s3c48wwvvwd3p4w3hfkri5v2c54j2bdxmd3bjv54klc5mrlh6z3";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = {
     homepage = "https://github.com/google/roboto";
@@ -22,9 +30,4 @@ in (fetchzip {
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.romildo ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.ttf -x __MACOSX/\* -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/scheherazade/default.nix b/pkgs/data/fonts/scheherazade/default.nix
index 07c7f6b0bc3..9960248b0d7 100644
--- a/pkgs/data/fonts/scheherazade/default.nix
+++ b/pkgs/data/fonts/scheherazade/default.nix
@@ -1,20 +1,30 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip, version ? "3.300" }:
+{ lib, stdenvNoCC, fetchzip, version ? "3.300" }:
 
 let
   new = lib.versionAtLeast version "3.000";
-  sha256 = {
-    "2.100" = "1g5f5f9gzamkq3kqyf7vbzvl4rdj3wmjf6chdrbxksrm3rnb926z";
-    "3.300" = "1bja1ma1mnna0qlk3dis31cvq5z1kgcqj7wjp8ml03zc5mpa2wb2";
+  hash = {
+    "2.100" = "sha256-d2UyOOOnmE1afCwyIrM1bL3lQC7XRwh03hzetk/4V30=";
+    "3.300" = "sha256-LaaA6DWAE2dcwVVX4go9cJaiuwI6efYbPk82ym3W3IY=";
   }."${version}";
-  name = "scheherazade${lib.optionalString new "-new"}-${version}";
+  pname = "scheherazade${lib.optionalString new "-new"}";
+in
+stdenvNoCC.mkDerivation rec {
+  inherit pname version;
+
+  src = fetchzip {
+    url = "http://software.sil.org/downloads/r/scheherazade/Scheherazade${lib.optionalString new "New"}-${version}.zip";
+    inherit hash;
+  };
 
-in (fetchzip rec {
-  inherit name;
+  installPhase = ''
+    runHook preInstall
 
-  url = "http://software.sil.org/downloads/r/scheherazade/Scheherazade${lib.optionalString new "New"}-${version}.zip";
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 FONTLOG.txt README.txt -t $out/share/doc
+    cp -r documentation $out/share/doc/
 
-  inherit sha256;
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://software.sil.org/scheherazade/";
@@ -40,13 +50,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -l $downloadedFile
-    unzip -j $downloadedFile \*.ttf                        -d $out/share/fonts/truetype
-    unzip    $downloadedFile \*/documentation/\*           -d $out/share/doc/
-    mv $out/share/doc/* $out/share/doc/${name}
-    unzip -j $downloadedFile \*/FONTLOG.txt  \*/README.txt -d $out/share/doc/${name}
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-code-pro/default.nix b/pkgs/data/fonts/source-code-pro/default.nix
index 37273530bb5..c94e9aaca48 100644
--- a/pkgs/data/fonts/source-code-pro/default.nix
+++ b/pkgs/data/fonts/source-code-pro/default.nix
@@ -1,14 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "source-code-pro";
   version = "2.038";
-in (fetchzip {
-  name = "source-code-pro-${version}";
 
-  url = "https://github.com/adobe-fonts/source-code-pro/releases/download/${version}R-ro%2F1.058R-it%2F1.018R-VAR/OTF-source-code-pro-${version}R-ro-1.058R-it.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-code-pro/releases/download/${version}R-ro%2F1.058R-it%2F1.018R-VAR/OTF-source-code-pro-${version}R-ro-1.058R-it.zip";
+    stripRoot = false;
+    hash = "sha256-ijeTLka131jf6B9xj/eNWK1T5r7r3aBXBgnVyRAxmuY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "027cf62zj27q7l3d4sqzdfgz423lzysihdg8cvmkk6z910a1v368";
+    install -Dm644 *.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "Monospaced font family for user interface and coding environments";
@@ -17,9 +25,4 @@ in (fetchzip {
     homepage = "https://adobe-fonts.github.io/source-code-pro/";
     license = lib.licenses.ofl;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-han-code-jp/default.nix b/pkgs/data/fonts/source-han-code-jp/default.nix
index 076291ab889..2a64680ee19 100644
--- a/pkgs/data/fonts/source-han-code-jp/default.nix
+++ b/pkgs/data/fonts/source-han-code-jp/default.nix
@@ -1,15 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
   pname = "source-han-code-jp";
-  version = "2.012R";
-in (fetchzip {
-  name = "${pname}-${version}";
+  version = "2.012";
 
-  url = "https://github.com/adobe-fonts/${pname}/archive/${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/${pname}/archive/${version}R.zip";
+    hash = "sha256-ljO/1/CaE9Yj+AN5xxlIr30/nV/axGQPO0fGACAZGCQ=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "16y5as1k864ghy3vzp8svr3q0sw57rv53za3f48700ksvxz5pwry";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "A monospaced Latin font suitable for coding";
@@ -18,9 +24,4 @@ in (fetchzip {
     homepage = "https://blogs.adobe.com/CCJKType/2015/06/source-han-code-jp.html";
     license = lib.licenses.ofl;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-han/default.nix b/pkgs/data/fonts/source-han/default.nix
index edf8ecfaa49..2f911186545 100644
--- a/pkgs/data/fonts/source-han/default.nix
+++ b/pkgs/data/fonts/source-han/default.nix
@@ -1,7 +1,7 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ stdenvNoCC
-, lib
-, fetchzip
+{ lib
+, stdenvNoCC
+, fetchurl
+, unzip
 }:
 
 let
@@ -9,21 +9,37 @@ let
     { family
     , description
     , rev
-    , sha256
-    , postFetch ? ''
-        install -m444 -Dt $out/share/fonts/opentype/source-han-${family} $downloadedFile
-      ''
+    , hash
     , zip ? ""
     }:
     let Family =
       lib.toUpper (lib.substring 0 1 family) +
       lib.substring 1 (lib.stringLength family) family;
     in
-    (fetchzip {
-      name = "source-han-${family}-${lib.removeSuffix "R" rev}";
+    stdenvNoCC.mkDerivation rec {
+      pname = "source-han-${family}";
+      version = lib.removeSuffix "R" rev;
 
-      url = "https://github.com/adobe-fonts/source-han-${family}/releases/download/${rev}/SourceHan${Family}.ttc${zip}";
-      inherit sha256;
+      src = fetchurl {
+        url = "https://github.com/adobe-fonts/source-han-${family}/releases/download/${rev}/SourceHan${Family}.ttc${zip}";
+        inherit hash;
+      };
+
+      nativeBuildInputs = lib.optionals (zip == ".zip") [ unzip ];
+
+      unpackPhase = lib.optionalString (zip == "") ''
+        cp $src SourceHan${Family}.ttc${zip}
+      '' + lib.optionalString (zip == ".zip") ''
+        unzip $src
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        install -Dm444 *.ttc -t $out/share/fonts/opentype/${pname}
+
+        runHook postInstall
+      '';
 
       meta = {
         description = "An open source Pan-CJK ${description} typeface";
@@ -31,18 +47,14 @@ let
         license = lib.licenses.ofl;
         maintainers = with lib.maintainers; [ taku0 emily ];
       };
-    }).overrideAttrs (_: { inherit postFetch; });
+    };
 in
 {
   sans = makePackage {
     family = "sans";
     description = "sans-serif";
     rev = "2.004R";
-    sha256 = "052d17hvz435zc4r2y1p9cgkkgn0ps8g74mfbvnbm1pv8ykj40m9";
-    postFetch = ''
-      mkdir -p $out/share/fonts/opentype/source-han-sans
-      unzip $downloadedFile -d $out/share/fonts/opentype/source-han-sans
-    '';
+    hash = "sha256-b1kRiprdpaf+Tp5rtTgwn34dPFQR+anTKvMqeVAbfk8=";
     zip = ".zip";
   };
 
@@ -50,11 +62,7 @@ in
     family = "serif";
     description = "serif";
     rev = "2.000R";
-    sha256 = "0x3n6s4khdd6l0crwd7g9sjaqp8lkvksglhc7kj3cv80hldab9wp";
-    postFetch = ''
-      mkdir -p $out/share/fonts/opentype/source-han-serif
-      unzip $downloadedFile -d $out/share/fonts/opentype/source-han-serif
-    '';
+    hash = "sha256-RDgywab7gwT+YBO7F1KJvKOv0E/3+7Zi/pQl+UDsGcM=";
     zip = ".zip";
   };
 
@@ -62,6 +70,6 @@ in
     family = "mono";
     description = "monospaced";
     rev = "1.002";
-    sha256 = "010h1y469c21bjavwdmkpbwk3ny686inz8i062wh1dhcv8cnqk3c";
+    hash = "sha256-DBkkSN6QhI8R64M2h2iDqaNtxluJZeSJYAz8x6ZzWME=";
   };
 }
diff --git a/pkgs/data/fonts/source-sans-pro/default.nix b/pkgs/data/fonts/source-sans-pro/default.nix
index 382c20aa976..2a2d2c70f28 100644
--- a/pkgs/data/fonts/source-sans-pro/default.nix
+++ b/pkgs/data/fonts/source-sans-pro/default.nix
@@ -1,18 +1,28 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 # Source Sans Pro got renamed to Source Sans 3 (see
 # https://github.com/adobe-fonts/source-sans/issues/192). This is the
 # last version named "Pro". It is useful for backward compatibility
 # with older documents/templates/etc.
-let
-  version = "3.006";
-in (fetchzip {
+
+stdenvNoCC.mkDerivation rec {
   name = "source-sans-pro-${version}";
+  version = "3.006";
+
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-sans/archive/${version}R.zip";
+    hash = "sha256-1Savijgq3INuUN89MR0t748HOuGseXVw5Kd4hYwuVas=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  url = "https://github.com/adobe-fonts/source-sans/archive/${version}R.zip";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm444 TTF/*.ttf -t $out/share/fonts/truetype
+    install -Dm444 VAR/*.otf -t $out/share/fonts/variable
 
-  sha256 = "sha256-uWr/dFyLF65v0o6+oN/3RQoe4ziPspzGB1rgiBkoTYY=";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://adobe-fonts.github.io/source-sans/";
@@ -21,11 +31,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{opentype,truetype,variable}
-    unzip -j $downloadedFile "*/OTF/*.otf" -d $out/share/fonts/opentype
-    unzip -j $downloadedFile "*/TTF/*.ttf" -d $out/share/fonts/truetype
-    unzip -j $downloadedFile "*/VAR/*.otf" -d $out/share/fonts/variable
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-sans/default.nix b/pkgs/data/fonts/source-sans/default.nix
index 94df27765ee..1433804ce71 100644
--- a/pkgs/data/fonts/source-sans/default.nix
+++ b/pkgs/data/fonts/source-sans/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "source-sans";
   version = "3.046";
-in (fetchzip {
-  name = "source-sans-${version}";
 
-  url = "https://github.com/adobe-fonts/source-sans/archive/${version}R.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-sans/archive/${version}R.zip";
+    hash = "sha256-nBLEK+T5n1CdZK2zvCWIhF2MxPmiAwL9l55a55yHtgU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1wxdinnliq0xqbjrs0sqykwaggkmyqawfq862d9xn05g1pnxda94";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm444 TTF/*.ttf -t $out/share/fonts/truetype
+    install -Dm444 VAR/*.otf -t $out/share/fonts/variable
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://adobe-fonts.github.io/source-sans/";
@@ -17,11 +26,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{opentype,truetype,variable}
-    unzip -j $downloadedFile "*/OTF/*.otf" -d $out/share/fonts/opentype
-    unzip -j $downloadedFile "*/TTF/*.ttf" -d $out/share/fonts/truetype
-    unzip -j $downloadedFile "*/VAR/*.otf" -d $out/share/fonts/variable
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-serif-pro/default.nix b/pkgs/data/fonts/source-serif-pro/default.nix
index 8f2ae0f7990..698694faf50 100644
--- a/pkgs/data/fonts/source-serif-pro/default.nix
+++ b/pkgs/data/fonts/source-serif-pro/default.nix
@@ -1,18 +1,28 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 # Source Serif Pro got renamed to Source Serif 4 (see
 # https://github.com/adobe-fonts/source-serif/issues/77). This is the
 # last version named "Pro". It is useful for backward compatibility
 # with older documents/templates/etc.
-let
+
+stdenvNoCC.mkDerivation rec {
+  pname = "source-serif-pro";
   version = "3.001";
-in (fetchzip {
-  name = "source-serif-pro-${version}";
 
-  url = "https://github.com/adobe-fonts/source-serif/releases/download/${version}R/source-serif-pro-${version}R.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-serif/releases/download/${version}R/source-serif-pro-${version}R.zip";
+    hash = "sha256-chXoaPOACtQ7wz/etElXuIJH/yvUsP03WlxeCfqWF/w=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-rYWk8D41QMuuSP+cQMk8ttT7uX3a7gBk4OqjA7K9udk=";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm444 TTF/*.ttf -t $out/share/fonts/truetype
+    install -Dm444 VAR/*.otf -t $out/share/fonts/variable
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://adobe-fonts.github.io/source-serif/";
@@ -21,11 +31,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{opentype,truetype,variable}
-    unzip -j $downloadedFile "*/OTF/*.otf" -d $out/share/fonts/opentype
-    unzip -j $downloadedFile "*/TTF/*.ttf" -d $out/share/fonts/truetype
-    unzip -j $downloadedFile "*/VAR/*.otf" -d $out/share/fonts/variable
-  '';
-})
+}
diff --git a/pkgs/data/fonts/source-serif/default.nix b/pkgs/data/fonts/source-serif/default.nix
index 3c61627183c..626b36f2705 100644
--- a/pkgs/data/fonts/source-serif/default.nix
+++ b/pkgs/data/fonts/source-serif/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "source-serif";
   version = "4.004";
-in (fetchzip {
-  name = "source-serif-${version}";
 
-  url = "https://github.com/adobe-fonts/source-serif/releases/download/${version}R/source-serif-${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/adobe-fonts/source-serif/releases/download/${version}R/source-serif-${version}.zip";
+    hash = "sha256-tGSMOwYBEZat7MI78wkPr6lgJdsOdOaIZb+IAOoOlq4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "06814hcp20abca6p0ii61f23g6h1ibqyhq30lsva59wbwx5iha0h";
+    install -Dm444 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm444 TTF/*.ttf -t $out/share/fonts/truetype
+    install -Dm444 VAR/*.otf -t $out/share/fonts/variable
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://adobe-fonts.github.io/source-serif/";
@@ -17,11 +26,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/{opentype,truetype,variable}
-    unzip -j $downloadedFile "*/OTF/*.otf" -d $out/share/fonts/opentype
-    unzip -j $downloadedFile "*/TTF/*.ttf" -d $out/share/fonts/truetype
-    unzip -j $downloadedFile "*/VAR/*.otf" -d $out/share/fonts/variable
-  '';
-})
+}
diff --git a/pkgs/data/fonts/stix-two/default.nix b/pkgs/data/fonts/stix-two/default.nix
index fb494391a87..86ceb388f86 100644
--- a/pkgs/data/fonts/stix-two/default.nix
+++ b/pkgs/data/fonts/stix-two/default.nix
@@ -1,14 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
-let
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "stix-two";
   version = "2.13";
-in
-(fetchzip {
-  name = "stix-two-${version}";
 
-  url = "https://github.com/stipub/stixfonts/raw/v${version}/zipfiles/STIX${builtins.replaceStrings [ "." ] [ "_" ] version}-all.zip";
+  src = fetchzip {
+    url = "https://github.com/stipub/stixfonts/raw/v${version}/zipfiles/STIX${builtins.replaceStrings [ "." ] [ "_" ] version}-all.zip";
+    stripRoot = false;
+    hash = "sha256-hfQmrw7HjlhQSA0rVTs84i3j3iMVR0k7tCRBcB6hEpU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-cBtZe/oq4bQCscSAhJ4YuTSghDleD9O/+3MHOJyI50o=";
+    install -Dm644 */*.otf -t $out/share/fonts/opentype
+    install -Dm644 */*.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://www.stixfonts.org/";
@@ -17,10 +26,4 @@ in
     platforms = platforms.all;
     maintainers = [ maintainers.rycee ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/sudo/default.nix b/pkgs/data/fonts/sudo/default.nix
index c4af97c7cc2..dca4ccd200c 100644
--- a/pkgs/data/fonts/sudo/default.nix
+++ b/pkgs/data/fonts/sudo/default.nix
@@ -1,12 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "sudo-font";
   version = "0.64";
-in (fetchzip {
-  name = "sudo-font-${version}";
-  url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
-  sha256 = "sha256-ewLTeIVY76eq5mHTnjIsJ5Q2CMuBqXJzxvjZTONPsr8=";
+
+  src = fetchzip {
+    url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
+    hash = "sha256-Y99YPoNpe55Wrj5epiqqQ6ddUBTj9uI4oj4M5ARTzJo=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.ttf -t $out/share/fonts/truetype/
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Font for programmers and command line users";
@@ -16,9 +25,4 @@ in (fetchzip {
     maintainers = with maintainers; [ dtzWill ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype/
-  '';
-})
+}
diff --git a/pkgs/data/fonts/terminus-font-ttf/default.nix b/pkgs/data/fonts/terminus-font-ttf/default.nix
index 3c9494f1c04..6231d0e0c1d 100644
--- a/pkgs/data/fonts/terminus-font-ttf/default.nix
+++ b/pkgs/data/fonts/terminus-font-ttf/default.nix
@@ -1,14 +1,26 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "terminus-font-ttf";
   version = "4.49.1";
-in (fetchzip {
-  name = "terminus-font-ttf-${version}";
 
-  url = "https://files.ax86.net/terminus-ttf/files/${version}/terminus-ttf-${version}.zip";
+  src = fetchzip {
+    url = "https://files.ax86.net/terminus-ttf/files/${version}/terminus-ttf-${version}.zip";
+    hash = "sha256-NKswkZR05V21mszT56S2x85k//qhfzRShhepYaAybDc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    for i in *.ttf; do
+      local destname="$(echo "$i" | sed -E 's|-[[:digit:].]+\.ttf$|.ttf|')"
+      install -Dm 644 "$i" "$out/share/fonts/truetype/$destname"
+    done
+
+    install -Dm 644 COPYING "$out/share/doc/terminus-font-ttf/COPYING"
 
-  sha256 = "sha256-UaTnCamIRN/3xZsYt5nYzvykXQ3ri94a047sWOJ2RfU=";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A clean fixed width TTF font";
@@ -20,15 +32,4 @@ in (fetchzip {
     license = licenses.ofl;
     maintainers = with maintainers; [ ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    unzip -j $downloadedFile
-
-    for i in *.ttf; do
-      local destname="$(echo "$i" | sed -E 's|-[[:digit:].]+\.ttf$|.ttf|')"
-      install -Dm 644 "$i" "$out/share/fonts/truetype/$destname"
-    done
-
-    install -Dm 644 COPYING "$out/share/doc/terminus-font-ttf/COPYING"
-  '';
-})
+}
diff --git a/pkgs/data/fonts/theano/default.nix b/pkgs/data/fonts/theano/default.nix
index 69107f4a8e5..3a3107e1366 100644
--- a/pkgs/data/fonts/theano/default.nix
+++ b/pkgs/data/fonts/theano/default.nix
@@ -1,15 +1,25 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "theano";
   version = "2.0";
-  name = "theano-${version}";
-in (fetchzip rec {
-  inherit name;
 
-  url = "https://github.com/akryukov/theano/releases/download/v${version}/theano-${version}.otf.zip";
+  src = fetchzip {
+    url = "https://github.com/akryukov/theano/releases/download/v${version}/theano-${version}.otf.zip";
+    stripRoot = false;
+    hash = "sha256-9wnwHcRHB+AToOvGwZSXvHkQ8hqMd7Sdl26Ty/IwbPw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "1my1symb7k80ys33iphsxvmf6432wx6vjdnxhzhkgrang1rhx1h8";
+    mkdir -p $out/share/fonts/opentype
+    mkdir -p $out/share/doc/${pname}-${version}
+    cp *.otf $out/share/fonts/opentype
+    cp *.txt $out/share/doc/${pname}-${version}
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/akryukov/theano";
@@ -18,11 +28,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    mkdir -p $out/share/doc/${name}
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.txt -d "$out/share/doc/${name}"
-  '';
-})
+}
diff --git a/pkgs/data/fonts/times-newer-roman/default.nix b/pkgs/data/fonts/times-newer-roman/default.nix
index 8f6e7eceb0c..840e75c710b 100644
--- a/pkgs/data/fonts/times-newer-roman/default.nix
+++ b/pkgs/data/fonts/times-newer-roman/default.nix
@@ -1,15 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation {
+  pname = "times-newer-roman";
   version = "unstable-2018-09-11";
-in
-(fetchzip {
-  name = "times-newer-roman-${version}";
 
-  url = "https://web.archive.org/web/20210609022835/https://timesnewerroman.com/assets/TimesNewerRoman.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20210609022835/https://timesnewerroman.com/assets/TimesNewerRoman.zip";
+    stripRoot = false;
+    hash = "sha256-wO4rxyJNQyhRLpswCYKXdeiXy5G+iWyxulYCHZb60QM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  hash = "sha256-Hx59RYLLwfimEQjEEes0lCpg6iql46DFwhQ7kVGiEzc=";
+    mkdir -p $out/share/fonts/opentype
+    cp *.otf $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A font that looks just like Times New Roman, except each character is 5-10% wider";
@@ -18,9 +26,4 @@ in
     maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
index 2c945f24528..27933b5b139 100644
--- a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
+++ b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
@@ -1,13 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "ultimate-oldschool-pc-font-pack";
   version = "2.2";
-in
-(fetchzip {
-  name = "ultimate-oldschool-pc-font-pack-${version}";
-  url = "https://int10h.org/oldschool-pc-fonts/download/oldschool_pc_font_pack_v${version}_linux.zip";
-  sha256 = "sha256-BOA2fMa2KT3Bkpvj/0DzrzuZbl3RARvNn4qbI/+dApU=";
+
+  src = fetchzip {
+    url = "https://int10h.org/oldschool-pc-fonts/download/oldschool_pc_font_pack_v${version}_linux.zip";
+    stripRoot = false;
+    hash = "sha256-54U8tZzvivTSOgmGesj9QbIgkSTm9w4quMhsuEc0Xy4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp */*.ttf $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "The Ultimate Oldschool PC Font Pack (TTF Fonts)";
@@ -16,9 +26,4 @@ in
     license = licenses.cc-by-sa-40;
     maintainers = [ maintainers.endgame ];
   };
-}).overrideAttrs (_: {
-  postFetch= ''
-    mkdir -p $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/undefined-medium/default.nix b/pkgs/data/fonts/undefined-medium/default.nix
index fe694a5e31a..9c605668845 100644
--- a/pkgs/data/fonts/undefined-medium/default.nix
+++ b/pkgs/data/fonts/undefined-medium/default.nix
@@ -1,12 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
-let name = "undefined-medium-1.0";
-in (fetchzip rec {
-  inherit name;
+{ lib, stdenvNoCC, fetchzip }:
 
-  url = "https://github.com/andirueckel/undefined-medium/archive/v1.0.zip";
+stdenvNoCC.mkDerivation rec {
+  pname = "undefined-medium";
+  version = "1.0";
 
-  sha256 = "1wa04jzbffshwcxm705yb5wja8wakn8j7fvim1mlih2z1sqw0njk";
+  src = fetchzip {
+    url = "https://github.com/andirueckel/undefined-medium/archive/v1.0.zip";
+    hash = "sha256-HG+V7jR7dDI6LeoiCg/8F38lW8Zdo6CyLj2DXy/ff64=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 fonts/otf/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://undefined-medium.com/";
@@ -19,9 +28,4 @@ in (fetchzip rec {
     license = licenses.ofl;
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile ${name}/fonts/otf/\*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/vollkorn/default.nix b/pkgs/data/fonts/vollkorn/default.nix
index b5e3a8e5729..deeeac19c93 100644
--- a/pkgs/data/fonts/vollkorn/default.nix
+++ b/pkgs/data/fonts/vollkorn/default.nix
@@ -1,30 +1,33 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, stdenv, fetchzip }:
-let
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
   pname = "vollkorn";
   version = "4.105";
-in
-(fetchzip {
-  name = "${pname}-${version}";
-  url = "http://vollkorn-typeface.com/download/vollkorn-${builtins.replaceStrings ["."] ["-"] version}.zip";
-  sha256 = "0srff2nqs7353mqcpmvaq156lamfh621py4h1771n0l9ix2c8mss";
-  stripRoot = false;
 
-  meta = with lib; {
-    homepage = "http://vollkorn-typeface.com/";
-    description = "The free and healthy typeface for bread and butter use";
-    license = licenses.ofl;
-    platforms = platforms.all;
-    maintainers = [ maintainers.schmittlauch ];
+  src = fetchzip {
+    url = "http://vollkorn-typeface.com/download/vollkorn-${builtins.replaceStrings ["."] ["-"] version}.zip";
+    stripRoot = false;
+    hash = "sha256-oG79GgCwCavbMFAPakza08IPmt13Gwujrkc/NKTai7g=";
   };
-}).overrideAttrs (_: {
-  postFetch = ''
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,WOFF,WOFF2}}
-    unzip $downloadedFile
     cp -v {Fontlog,OFL-FAQ,OFL}.txt $out/share/doc/${pname}-${version}/
     cp -v PS-OTF/*.otf $out/share/fonts/opentype
     cp -v TTF/*.ttf $out/share/fonts/truetype
     cp -v WOFF/*.woff $out/share/fonts/WOFF
     cp -v WOFF2/*.woff2 $out/share/fonts/WOFF2
+
+    runHook postInstall
   '';
-})
+
+  meta = with lib; {
+    homepage = "http://vollkorn-typeface.com/";
+    description = "The free and healthy typeface for bread and butter use";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.schmittlauch ];
+  };
+}
diff --git a/pkgs/data/fonts/weather-icons/default.nix b/pkgs/data/fonts/weather-icons/default.nix
index 7171f65cb68..00f9cebac12 100644
--- a/pkgs/data/fonts/weather-icons/default.nix
+++ b/pkgs/data/fonts/weather-icons/default.nix
@@ -1,13 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "weather-icons";
   version = "2.0.12";
-in (fetchzip {
-  name = "weather-icons-${version}";
 
-  url = "https://github.com/erikflowers/weather-icons/archive/refs/tags/${version}.zip";
-  sha256 = "sha256-NGPzAloeZa1nCazb+mjAbYw7ZYYDoKpLwcvzg1Ly9oM=";
+  src = fetchzip {
+    url = "https://github.com/erikflowers/weather-icons/archive/refs/tags/${version}.zip";
+    hash = "sha256-0ZFH2awUo4BkTpK1OsWZ4YKczJHo+HHM6ezGBJAmT+U=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 _docs/font-source/weathericons-regular.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Weather Icons";
@@ -21,9 +29,4 @@ in (fetchzip {
     platforms = platforms.all;
     maintainers = with maintainers; [ pnelson ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile weather-icons-${version}/_docs/font-source/weathericons-regular.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/work-sans/default.nix b/pkgs/data/fonts/work-sans/default.nix
index 208f3701057..07c5704b517 100644
--- a/pkgs/data/fonts/work-sans/default.nix
+++ b/pkgs/data/fonts/work-sans/default.nix
@@ -1,15 +1,21 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "work-sans";
   version = "2.010";
-in
-(fetchzip {
-  name = "work-sans-${version}";
 
-  url = "https://github.com/weiweihuanghuang/Work-Sans/archive/refs/tags/v${version}.zip";
+  src = fetchzip {
+    url = "https://github.com/weiweihuanghuang/Work-Sans/archive/refs/tags/v${version}.zip";
+    hash = "sha256-cedcx3CpcPZk3jxxIs5Bz78dxZNtOemvXnUBO6zl2dw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-S4O5EoKY4w/p+MHeHRCmPyQRAOUfEwNiETxMgNcsrws=";
+    install -Dm644 fonts/variable/*.ttf fonts/static/TTF/*.ttf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A grotesque sans";
@@ -18,9 +24,4 @@ in
     maintainers = [ maintainers.marsam ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile "*/fonts/*.ttf" -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/yanone-kaffeesatz/default.nix b/pkgs/data/fonts/yanone-kaffeesatz/default.nix
index 2b1a967043d..99cd30f3dfa 100644
--- a/pkgs/data/fonts/yanone-kaffeesatz/default.nix
+++ b/pkgs/data/fonts/yanone-kaffeesatz/default.nix
@@ -1,12 +1,22 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-(fetchzip {
-  name = "yanone-kaffeesatz-2004";
+stdenvNoCC.mkDerivation rec {
+  pname = "yanone-kaffeesatz";
+  version = "2004";
 
-  url = "https://yanone.de/2015/data/UIdownloads/Yanone%20Kaffeesatz.zip";
+  src = fetchzip {
+    url = "https://yanone.de/2015/data/UIdownloads/Yanone%20Kaffeesatz.zip";
+    stripRoot = false;
+    hash = "sha256-8yAB73UJ77/c8/VLqiFeT1KtoBQzOh+vWrI+JA2dCoY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "190c4wx7avy3kp98lsyml7kc0jw7csf5n79af2ypbkhsadfsy8di";
+    install -Dm644 *.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "The free font classic";
@@ -15,9 +25,4 @@
     homepage = "https://yanone.de/fonts/kaffeesatz/";
     license = lib.licenses.ofl;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/zilla-slab/default.nix b/pkgs/data/fonts/zilla-slab/default.nix
index e3dd19c7112..886362d78e9 100644
--- a/pkgs/data/fonts/zilla-slab/default.nix
+++ b/pkgs/data/fonts/zilla-slab/default.nix
@@ -1,13 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "zilla-slab";
   version = "1.002";
-in (fetchzip {
-  name = "zilla-slab-${version}";
 
-  url = "https://github.com/mozilla/zilla-slab/releases/download/v${version}/Zilla-Slab-Fonts-v${version}.zip";
-  sha256 = "1b1ys28hyjcl4qwbnsyi6527nj01g3d6id9jl23fv6f8fjm4ph0f";
+  src = fetchzip {
+    url = "https://github.com/mozilla/zilla-slab/releases/download/v${version}/Zilla-Slab-Fonts-v${version}.zip";
+    stripRoot = false;
+    hash = "sha256-yOHu+dSWlyI7w1N1teED9R1Fphso2bKAlYDC1KdqBCc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp -v zilla-slab/ttf/*.ttf $out/share/fonts/truetype/
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/mozilla/zilla-slab";
@@ -26,10 +36,4 @@ in (fetchzip {
     maintainers = with maintainers; [ caugner ];
     platforms = platforms.all;
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    unzip $downloadedFile
-    mkdir -p $out/share/fonts/truetype
-    cp -v zilla-slab/ttf/*.ttf $out/share/fonts/truetype/
-  '';
-})
+}
diff --git a/pkgs/desktops/deepin/library/gio-qt/default.nix b/pkgs/desktops/deepin/library/gio-qt/default.nix
index a38e89bfc5b..5c27afe7e4c 100644
--- a/pkgs/desktops/deepin/library/gio-qt/default.nix
+++ b/pkgs/desktops/deepin/library/gio-qt/default.nix
@@ -6,7 +6,9 @@
 , wrapQtAppsHook
 , glibmm
 , doxygen
-, buildDocs ? false
+, qttools
+, qtbase
+, buildDocs ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -20,18 +22,25 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-dlY1CTlXywgGZUonBBe3cDwx8h2xXrPY6Ft/D59nlug=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ] ++ lib.optional buildDocs [ doxygen qttools.dev ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DPROJECT_VERSION=${version}"
-  ]
-  ++ lib.optional (!buildDocs) [ "-DBUILD_DOCS=OFF" ];
-
-  buildInputs = lib.optional buildDocs doxygen;
+  ] ++ lib.optional (!buildDocs) [ "-DBUILD_DOCS=OFF" ];
 
   propagatedBuildInputs = [ glibmm ];
 
+  preConfigure = ''
+    # qt.qpa.plugin: Could not find the Qt platform plugin "minimal"
+    # A workaround is to set QT_PLUGIN_PATH explicitly
+    export QT_PLUGIN_PATH=${qtbase.bin}/${qtbase.qtPluginPrefix}
+  '';
+
   meta = with lib; {
     description = "Gio wrapper for Qt applications";
     homepage = "https://github.com/linuxdeepin/gio-qt";
diff --git a/pkgs/desktops/gnome/apps/gedit/default.nix b/pkgs/desktops/gnome/apps/gedit/default.nix
index d7895df784b..3d79656d258 100644
--- a/pkgs/desktops/gnome/apps/gedit/default.nix
+++ b/pkgs/desktops/gnome/apps/gedit/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gedit";
-  version = "43.2";
+  version = "44.2";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gedit/${lib.versions.major version}/gedit-${version}.tar.xz";
-    sha256 = "+VDS01xZS7bI28n1RAytd4jKCoaI4rB4Rvg96aTj/CU=";
+    sha256 = "O7sbN3XUwnfa9UqqtEsOuDpOsfCfA5GAAEHJ5WiT7BE=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/games/gnome-sudoku/default.nix b/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
index 90ef25fcca5..9018df07e9c 100644
--- a/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-sudoku";
-  version = "43.0";
+  version = "43.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-sudoku/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "ftJ0KJz1ykELHJKxU3BQpcNi99szmaMrU0PQ3nBGbkk=";
+    sha256 = "we6/QJPzNrSJ+5HHMO2mcdpo7vZeYZehKYqVRseImZ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/misc/gpaste/default.nix b/pkgs/desktops/gnome/misc/gpaste/default.nix
index bc54591ebd6..adee04a0df8 100644
--- a/pkgs/desktops/gnome/misc/gpaste/default.nix
+++ b/pkgs/desktops/gnome/misc/gpaste/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , appstream-glib
 , clutter
 , gjs
@@ -22,26 +21,18 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "43.0";
+  version = "43.1";
   pname = "gpaste";
 
   src = fetchFromGitHub {
     owner = "Keruspe";
     repo = "GPaste";
     rev = "v${version}";
-    sha256 = "sha256-F+AWTYVK145RzJ1Zldh4Q4R/hN/D7aXO3SIJ1t6ClWs=";
+    sha256 = "sha256-wOxhaYWX76jSur3uh75vDfAedbiLh2ikoMuobCZx3jE=";
   };
 
   patches = [
     ./fix-paths.patch
-
-    # Build against GCR 4.
-    # Patch was temporarily reverted.
-    # https://github.com/Keruspe/GPaste/pull/409
-    (fetchpatch {
-      url = "https://github.com/Keruspe/GPaste/commit/0378cb4a657042ce5321f1d9728cff31e55bede6.patch";
-      sha256 = "0Ngr+/fS5/wICR84GEiE0pXEXQ/f/3G59lDivH167m8=";
-    })
   ];
 
   # TODO: switch to substituteAll with placeholder
@@ -79,6 +70,7 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
+    "-Dgcr3=false" # Build with gcr4
     "-Dcontrol-center-keybindings-dir=${placeholder "out"}/share/gnome-control-center/keybindings"
     "-Ddbus-services-dir=${placeholder "out"}/share/dbus-1/services"
     "-Dsystemd-user-unit-dir=${placeholder "out"}/etc/systemd/user"
diff --git a/pkgs/development/compilers/llvm/15/bintools/default.nix b/pkgs/development/compilers/llvm/15/bintools/default.nix
new file mode 100644
index 00000000000..303faf7bbb6
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/bintools/default.nix
@@ -0,0 +1,40 @@
+{ runCommand, stdenv, llvm, lld, version }:
+
+let
+  prefix =
+    if stdenv.hostPlatform != stdenv.targetPlatform
+    then "${stdenv.targetPlatform.config}-"
+    else "";
+in runCommand "llvm-binutils-${version}" {
+  preferLocalBuild = true;
+  passthru = {
+    isLLVM = true;
+  };
+} ''
+   mkdir -p $out/bin
+   for prog in ${lld}/bin/*; do
+     ln -s $prog $out/bin/${prefix}$(basename $prog)
+   done
+   for prog in ${llvm}/bin/*; do
+     ln -sf $prog $out/bin/${prefix}$(basename $prog)
+   done
+
+   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
+   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}dlltool
+   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ranlib
+   ln -s ${llvm}/bin/llvm-cxxfilt $out/bin/${prefix}c++filt
+   ln -s ${llvm}/bin/llvm-debuginfod $out/bin/${prefix}debuginfod
+   ln -s ${llvm}/bin/llvm-debuginfod-find $out/bin/${prefix}debuginfod-find
+   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
+   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
+   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
+   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}strip
+   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
+   ln -s ${llvm}/bin/llvm-rc $out/bin/${prefix}windres
+   ln -s ${llvm}/bin/llvm-readobj $out/bin/${prefix}readelf
+   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
+   ln -s ${llvm}/bin/llvm-strings $out/bin/${prefix}strings
+   ln -s ${llvm}/bin/llvm-symbolizer $out/bin/${prefix}addr2line
+
+   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
+''
diff --git a/pkgs/development/compilers/llvm/15/clang/default.nix b/pkgs/development/compilers/llvm/15/clang/default.nix
new file mode 100644
index 00000000000..b0671150a7b
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/clang/default.nix
@@ -0,0 +1,129 @@
+{ lib, stdenv, llvm_meta
+, monorepoSrc, runCommand
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
+, buildLlvmTools
+, fixDarwinDylibNames
+, enableManpages ? false
+}:
+
+let
+  self = stdenv.mkDerivation (rec {
+    pname = "clang";
+    inherit version;
+
+    src = runCommand "${pname}-src-${version}" {} ''
+      mkdir -p "$out"
+      cp -r ${monorepoSrc}/cmake "$out"
+      cp -r ${monorepoSrc}/${pname} "$out"
+      cp -r ${monorepoSrc}/clang-tools-extra "$out"
+    '';
+
+    sourceRoot = "${src.name}/${pname}";
+
+    nativeBuildInputs = [ cmake ninja python3 ]
+      ++ lib.optional enableManpages python3.pkgs.sphinx
+      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+    buildInputs = [ libxml2 libllvm ];
+
+    cmakeFlags = [
+      "-DCLANG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/clang"
+      "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ lib.optionals enableManpages [
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DLLVM_ENABLE_SPHINX=ON"
+      "-DSPHINX_OUTPUT_MAN=ON"
+      "-DSPHINX_OUTPUT_HTML=OFF"
+      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
+    ];
+
+    patches = [
+      ./purity.patch
+      # https://reviews.llvm.org/D51899
+      ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-11-12-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
+    ];
+
+    postPatch = ''
+      (cd tools && ln -s ../../clang-tools-extra extra)
+
+      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+             lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
+    '';
+
+    outputs = [ "out" "lib" "dev" "python" ];
+
+    postInstall = ''
+      ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+      moveToOutput "lib/libclang-cpp.*" "$lib"
+      substituteInPlace $dev/lib/cmake/clang/ClangTargets-release.cmake \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
+
+      mkdir -p $python/bin $python/share/clang/
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+      rm $out/bin/c-index-test
+      patchShebangs $python/bin
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
+    '';
+
+    passthru = {
+      isClang = true;
+      inherit libllvm;
+    };
+
+    meta = llvm_meta // {
+      homepage = "https://clang.llvm.org/";
+      description = "A C language family frontend for LLVM";
+      longDescription = ''
+        The Clang project provides a language front-end and tooling
+        infrastructure for languages in the C language family (C, C++, Objective
+        C/C++, OpenCL, CUDA, and RenderScript) for the LLVM project.
+        It aims to deliver amazingly fast compiles, extremely useful error and
+        warning messages and to provide a platform for building great source
+        level tools. The Clang Static Analyzer and clang-tidy are tools that
+        automatically find bugs in your code, and are great examples of the sort
+        of tools that can be built using the Clang frontend as a library to
+        parse C/C++ code.
+      '';
+      mainProgram = "clang";
+    };
+  } // lib.optionalAttrs enableManpages {
+    pname = "clang-manpages";
+
+    ninjaFlags = [ "docs-clang-man" ];
+
+    installPhase = ''
+      mkdir -p $out/share/man/man1
+      # Manually install clang manpage
+      cp docs/man/*.1 $out/share/man/man1/
+    '';
+
+    outputs = [ "out" ];
+
+    doCheck = false;
+
+    meta = llvm_meta // {
+      description = "man page for Clang ${version}";
+    };
+  });
+in self
diff --git a/pkgs/development/compilers/llvm/15/clang/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/clang/gnu-install-dirs.patch
new file mode 100644
index 00000000000..f767c56836d
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/clang/gnu-install-dirs.patch
@@ -0,0 +1,105 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index c27beec313d7..480f13e73c9f 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -78,15 +78,17 @@ if(CLANG_BUILT_STANDALONE)
+   if (NOT LLVM_CONFIG_FOUND)
+     # Pull values from LLVMConfig.cmake.  We can drop this once the llvm-config
+     # path is removed.
+-    set(MAIN_INCLUDE_DIR "${LLVM_INCLUDE_DIR}")
++    set(INCLUDE_DIRS ${LLVM_INCLUDE_DIRS})
+     set(LLVM_OBJ_DIR "${LLVM_BINARY_DIR}")
+     # N.B. this is just a default value, the CACHE PATHs below can be overriden.
+     set(MAIN_SRC_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../llvm")
+     set(TOOLS_BINARY_DIR "${LLVM_TOOLS_BINARY_DIR}")
+     set(LIBRARY_DIR "${LLVM_LIBRARY_DIR}")
++  else()
++    set(INCLUDE_DIRS "${LLVM_BINARY_DIR}/include" "${MAIN_INCLUDE_DIR}")
+   endif()
+ 
+-  set(LLVM_MAIN_INCLUDE_DIR "${MAIN_INCLUDE_DIR}" CACHE PATH "Path to llvm/include")
++  set(LLVM_INCLUDE_DIRS ${INCLUDE_DIRS} CACHE PATH "Path to llvm/include and any other header dirs needed")
+   set(LLVM_BINARY_DIR "${LLVM_OBJ_ROOT}" CACHE PATH "Path to LLVM build tree")
+   set(LLVM_MAIN_SRC_DIR "${MAIN_SRC_DIR}" CACHE PATH "Path to LLVM source tree")
+   set(LLVM_TOOLS_BINARY_DIR "${TOOLS_BINARY_DIR}" CACHE PATH "Path to llvm/bin")
+@@ -128,7 +130,7 @@ if(CLANG_BUILT_STANDALONE)
+     set(LLVM_INCLUDE_TESTS ON)
+   endif()
+ 
+-  include_directories("${LLVM_BINARY_DIR}/include" "${LLVM_MAIN_INCLUDE_DIR}")
++  include_directories(${LLVM_INCLUDE_DIRS})
+   link_directories("${LLVM_LIBRARY_DIR}")
+ 
+   set( CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin )
+diff --git a/cmake/modules/AddClang.cmake b/cmake/modules/AddClang.cmake
+index 21ac332e4f5f..b16c314bd1e2 100644
+--- a/cmake/modules/AddClang.cmake
++++ b/cmake/modules/AddClang.cmake
+@@ -119,8 +119,8 @@ macro(add_clang_library name)
+         install(TARGETS ${lib}
+           COMPONENT ${lib}
+           ${export_to_clangtargets}
+-          LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-          ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
++          LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}"
++          ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}"
+           RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
+ 
+         if (NOT LLVM_ENABLE_IDE)
+diff --git a/lib/Headers/CMakeLists.txt b/lib/Headers/CMakeLists.txt
+index 6e2060991b92..b9bc930d26b8 100644
+--- a/lib/Headers/CMakeLists.txt
++++ b/lib/Headers/CMakeLists.txt
+@@ -420,7 +420,7 @@ add_header_target("openmp-resource-headers" ${openmp_wrapper_files})
+ add_header_target("windows-resource-headers" ${windows_only_files})
+ add_header_target("utility-resource-headers" ${utility_files})
+ 
+-set(header_install_dir lib${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
++set(header_install_dir ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
+ 
+ #############################################################
+ # Install rules for the catch-all clang-resource-headers target
+diff --git a/tools/libclang/CMakeLists.txt b/tools/libclang/CMakeLists.txt
+index 8d95d0900e8c..ebc70ff7526d 100644
+--- a/tools/libclang/CMakeLists.txt
++++ b/tools/libclang/CMakeLists.txt
+@@ -180,7 +180,7 @@ foreach(PythonVersion ${CLANG_PYTHON_BINDINGS_VERSIONS})
+           COMPONENT
+             libclang-python-bindings
+           DESTINATION
+-            "lib${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
++            "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/python${PythonVersion}/site-packages")
+ endforeach()
+ if(NOT LLVM_ENABLE_IDE)
+   add_custom_target(libclang-python-bindings)
+diff --git a/tools/scan-build-py/CMakeLists.txt b/tools/scan-build-py/CMakeLists.txt
+index 061dc7ef4dd9..adc54b2edc32 100644
+--- a/tools/scan-build-py/CMakeLists.txt
++++ b/tools/scan-build-py/CMakeLists.txt
+@@ -88,7 +88,7 @@ foreach(lib ${LibScanbuild})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/${lib})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libscanbuild/${lib})
+   install(PROGRAMS lib/libscanbuild/${lib}
+-          DESTINATION lib/libscanbuild
++          DESTINATION "${CMAKE_INSTALL_LIBDIR}/libscanbuild"
+           COMPONENT scan-build-py)
+ endforeach()
+ 
+@@ -106,7 +106,7 @@ foreach(resource ${LibScanbuildResources})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/resources/${resource})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libscanbuild/resources/${resource})
+   install(PROGRAMS lib/libscanbuild/resources/${resource}
+-          DESTINATION lib/libscanbuild/resources
++          DESTINATION "${CMAKE_INSTALL_LIBDIR}/libscanbuild/resources"
+           COMPONENT scan-build-py)
+ endforeach()
+ 
+@@ -122,7 +122,7 @@ foreach(lib ${LibEar})
+                      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libear/${lib})
+   list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libear/${lib})
+   install(PROGRAMS lib/libear/${lib}
+-          DESTINATION lib/libear
++          DESTINATION "${CMAKE_INSTALL_LIBDIR}/libear"
+           COMPONENT scan-build-py)
+ endforeach()
+ 
diff --git a/pkgs/development/compilers/llvm/15/clang/purity.patch b/pkgs/development/compilers/llvm/15/clang/purity.patch
new file mode 100644
index 00000000000..1c94f293eb9
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/clang/purity.patch
@@ -0,0 +1,29 @@
+From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Thu, 18 May 2017 11:56:12 -0500
+Subject: [PATCH] "purity" patch for 5.0
+
+---
+ lib/Driver/ToolChains/Gnu.cpp | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
+index fe3c0191bb..c6a482bece 100644
+--- a/lib/Driver/ToolChains/Gnu.cpp
++++ b/lib/Driver/ToolChains/Gnu.cpp
+@@ -487,13 +487,7 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
+   } else {
+     if (Args.hasArg(options::OPT_rdynamic))
+       CmdArgs.push_back("-export-dynamic");
+
+-    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE &&
+-        !Args.hasArg(options::OPT_r)) {
+-      CmdArgs.push_back("-dynamic-linker");
+-      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
+-                                           ToolChain.getDynamicLinker(Args)));
+-    }
+   }
+ 
+   CmdArgs.push_back("-o");
+-- 
+2.11.0
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/X86-support-extension.patch b/pkgs/development/compilers/llvm/15/compiler-rt/X86-support-extension.patch
new file mode 100644
index 00000000000..07013e5a682
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/X86-support-extension.patch
@@ -0,0 +1,21 @@
+diff --git a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
+index 3a66dd9c3fb..7efc85d9f9f 100644
+--- a/lib/builtins/CMakeLists.txt
++++ b/lib/builtins/CMakeLists.txt
+@@ -348,4 +348,8 @@ if (NOT MSVC)
+ 
++  set(i486_SOURCES ${i386_SOURCES})
++  set(i586_SOURCES ${i386_SOURCES})
++  set(i686_SOURCES ${i386_SOURCES})
++
+   if (WIN32)
+     set(i386_SOURCES
+       ${i386_SOURCES}
+@@ -723,6 +723,7 @@ else ()
+   endif()
+ 
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
++      message("arch: ${arch}")
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+       if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/armv7l.patch b/pkgs/development/compilers/llvm/15/compiler-rt/armv7l.patch
new file mode 100644
index 00000000000..ca1c2332abd
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/armv7l.patch
@@ -0,0 +1,32 @@
+diff -ur a/cmake/builtin-config-ix.cmake b/cmake/builtin-config-ix.cmake
+--- a/cmake/builtin-config-ix.cmake @llvm 15.0.6
++++ b/cmake/builtin-config-ix.cmake
+@@ -46,7 +46,7 @@
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv8m.main armv8.1m.main)
++set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l armv8m.main armv8.1m.main)
+ set(AVR avr)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
+--- a/lib/builtins/CMakeLists.txt @llvm 15.0.6
++++ b/lib/builtins/CMakeLists.txt
+@@ -565,6 +565,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
++set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -734,7 +735,7 @@
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em|armv8m.main|armv8.1m.main)$")
++      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em|armv8m.main|armv8.1m.main)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/darwin-targetconditionals.patch b/pkgs/development/compilers/llvm/15/compiler-rt/darwin-targetconditionals.patch
new file mode 100644
index 00000000000..425dc2af01e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/darwin-targetconditionals.patch
@@ -0,0 +1,71 @@
+diff --git a/lib/sanitizer_common/sanitizer_mac.cpp b/lib/sanitizer_common/sanitizer_mac.cpp
+--- a/lib/sanitizer_common/sanitizer_mac.cpp
++++ b/lib/sanitizer_common/sanitizer_mac.cpp
+@@ -613,9 +613,15 @@ HandleSignalMode GetHandleSignalMode(int signum) {
+ // Offset example:
+ // XNU 17 -- macOS 10.13 -- iOS 11 -- tvOS 11 -- watchOS 4
+ constexpr u16 GetOSMajorKernelOffset() {
+-  if (TARGET_OS_OSX) return 4;
+-  if (TARGET_OS_IOS || TARGET_OS_TV) return 6;
+-  if (TARGET_OS_WATCH) return 13;
++#if TARGET_OS_OSX
++  return 4;
++#endif
++#if TARGET_OS_IOS || TARGET_OS_TV
++  return 6;
++#endif
++#if TARGET_OS_WATCH
++  return 13;
++#endif
+ }
+ 
+ using VersStr = char[64];
+@@ -627,13 +633,13 @@ static uptr ApproximateOSVersionViaKernelVersion(VersStr vers) {
+   u16 os_major = kernel_major - offset;
+ 
+   const char *format = "%d.0";
+-  if (TARGET_OS_OSX) {
+-    if (os_major >= 16) {  // macOS 11+
+-      os_major -= 5;
+-    } else {  // macOS 10.15 and below
+-      format = "10.%d";
+-    }
++#if TARGET_OS_OSX
++  if (os_major >= 16) {  // macOS 11+
++    os_major -= 5;
++  } else {  // macOS 10.15 and below
++    format = "10.%d";
+   }
++#endif
+   return internal_snprintf(vers, sizeof(VersStr), format, os_major);
+ }
+ 
+@@ -681,15 +687,14 @@ void ParseVersion(const char *vers, u16 *major, u16 *minor) {
+ // Aligned versions example:
+ // macOS 10.15 -- iOS 13 -- tvOS 13 -- watchOS 6
+ static void MapToMacos(u16 *major, u16 *minor) {
+-  if (TARGET_OS_OSX)
+-    return;
+-
+-  if (TARGET_OS_IOS || TARGET_OS_TV)
++#if !TARGET_OS_OSX
++#if TARGET_OS_IOS || TARGET_OS_TV
+     *major += 2;
+-  else if (TARGET_OS_WATCH)
++#elif TARGET_OS_WATCH
+     *major += 9;
+-  else
++#else
+     UNREACHABLE("unsupported platform");
++#endif
+ 
+   if (*major >= 16) {  // macOS 11+
+     *major -= 5;
+@@ -697,6 +702,7 @@ static void MapToMacos(u16 *major, u16 *minor) {
+     *minor = *major;
+     *major = 10;
+   }
++#endif
+ }
+ 
+ static MacosVersion GetMacosAlignedVersionInternal() {
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
new file mode 100644
index 00000000000..722a5bd90cb
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
@@ -0,0 +1,156 @@
+{ lib, stdenv, llvm_meta, version
+, monorepoSrc, runCommand
+, cmake, ninja, python3, xcbuild, libllvm, libcxxabi, libxcrypt
+, doFakeLibgcc ? stdenv.hostPlatform.isFreeBSD
+}:
+
+let
+
+  useLLVM = stdenv.hostPlatform.useLLVM or false;
+  bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
+  haveLibc = stdenv.cc.libc != null;
+  inherit (stdenv.hostPlatform) isMusl isGnu;
+
+  baseName = "compiler-rt";
+
+  src = runCommand "${baseName}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${baseName} "$out"
+  '';
+in
+
+stdenv.mkDerivation {
+  pname = baseName + lib.optionalString (haveLibc) "-libc";
+  inherit version;
+
+  inherit src;
+  sourceRoot = "${src.name}/${baseName}";
+
+  nativeBuildInputs = [ cmake ninja python3 libllvm.dev ]
+    ++ lib.optional stdenv.isDarwin xcbuild.xcrun;
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
+
+  NIX_CFLAGS_COMPILE = [
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+  ];
+
+  cmakeFlags = [
+    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
+    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.libc == "glibc") [
+    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
+  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
+    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
+    "-DCOMPILER_RT_BUILD_XRAY=OFF"
+    "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+    "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
+    "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
+  ] ++ lib.optionals (useLLVM || bareMetal) [
+     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+  ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
+    "-DCMAKE_C_COMPILER_WORKS=ON"
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
+    "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
+  ] ++ lib.optionals (useLLVM && !haveLibc) [
+    "-DCMAKE_C_FLAGS=-nodefaultlibs"
+  ] ++ lib.optionals (useLLVM) [
+    "-DCOMPILER_RT_BUILD_BUILTINS=ON"
+    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
+    "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
+  ] ++ lib.optionals (bareMetal) [
+    "-DCOMPILER_RT_OS_DIR=baremetal"
+  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+    "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
+    "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
+    "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
+
+    # `COMPILER_RT_DEFAULT_TARGET_ONLY` does not apply to Darwin:
+    # https://github.com/llvm/llvm-project/blob/27ef42bec80b6c010b7b3729ed0528619521a690/compiler-rt/cmake/base-config-ix.cmake#L153
+    "-DCOMPILER_RT_ENABLE_IOS=OFF"
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    ./X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
+    ./gnu-install-dirs.patch
+    # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
+    # extra `/`.
+    ./normalize-var.patch
+    # Prevent a compilation error on darwin
+    ./darwin-targetconditionals.patch
+    # See: https://github.com/NixOS/nixpkgs/pull/186575
+    ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
+    # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
+    ./armv7l.patch
+  ]
+    # The `compiler-rt` build inspects `ld` to figure out whether it needs to
+    # explicitly call `codesign`:
+    # https://github.com/llvm/llvm-project/blob/27ef42bec80b6c010b7b3729ed0528619521a690/compiler-rt/cmake/Modules/AddCompilerRT.cmake#L409-L422
+    #
+    # In our case, despite (currently) having an `ld` version than 609, we don't
+    # need an explicit codesigning step because `postLinkSignHook` handles this
+    # for us.
+    #
+    # Unfortunately there isn't an easy way to override
+    # `NEED_EXPLICIT_ADHOC_CODESIGN`.
+    #
+    # Adding `codesign` as a build input also doesn't currently work because, as
+    # of this writing, `codesign` in nixpkgs doesn't support the `--sign` alias
+    # which the `compiler-rt` build uses. See here for context:
+    # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272116014
+    #
+    # So, for now, we patch `compiler-rt` to skip the explicit codesigning step.
+    ++ lib.optional stdenv.hostPlatform.isDarwin ./skip-explicit-codesign.patch;
+
+  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
+  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
+  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
+  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
+  # a flag and turn the flag off during the stdenv build.
+  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
+  '' + lib.optionalString (useLLVM) ''
+    substituteInPlace lib/builtins/int_util.c \
+      --replace "#include <stdlib.h>" ""
+    substituteInPlace lib/builtins/clear_cache.c \
+      --replace "#include <assert.h>" ""
+    substituteInPlace lib/builtins/cpu_model.c \
+      --replace "#include <assert.h>" ""
+  '';
+
+  # Hack around weird upsream RPATH bug
+  postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
+    ln -s "$out/lib"/*/* "$out/lib"
+  '' + lib.optionalString (useLLVM) ''
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  '' + lib.optionalString doFakeLibgcc ''
+     ln -s $out/lib/freebsd/libclang_rt.builtins-*.a $out/lib/libgcc.a
+  '';
+
+  meta = llvm_meta // {
+    homepage = "https://compiler-rt.llvm.org/";
+    description = "Compiler runtime libraries";
+    longDescription = ''
+      The compiler-rt project provides highly tuned implementations of the
+      low-level code generator support routines like "__fixunsdfdi" and other
+      calls generated when a target doesn't have a short sequence of native
+      instructions to implement a core IR operation. It also provides
+      implementations of run-time libraries for dynamic testing tools such as
+      AddressSanitizer, ThreadSanitizer, MemorySanitizer, and DataFlowSanitizer.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/compiler-rt/gnu-install-dirs.patch
new file mode 100644
index 00000000000..f3b1f63a7d7
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/gnu-install-dirs.patch
@@ -0,0 +1,20 @@
+diff --git a/cmake/base-config-ix.cmake b/cmake/base-config-ix.cmake
+index 8a6219568b3f..30ee68a47ccf 100644
+--- a/cmake/base-config-ix.cmake
++++ b/cmake/base-config-ix.cmake
+@@ -100,13 +100,13 @@ endif()
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(COMPILER_RT_OUTPUT_LIBRARY_DIR
+     ${COMPILER_RT_OUTPUT_DIR}/lib)
+-  extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" lib)
++  extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "${CMAKE_INSTALL_LIBDIR}")
+   set(COMPILER_RT_INSTALL_LIBRARY_DIR "${default_install_path}" CACHE PATH
+     "Path where built compiler-rt libraries should be installed.")
+ else(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(COMPILER_RT_OUTPUT_LIBRARY_DIR
+     ${COMPILER_RT_OUTPUT_DIR}/lib/${COMPILER_RT_OS_DIR})
+-  extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "lib/${COMPILER_RT_OS_DIR}")
++  extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "${CMAKE_INSTALL_LIBDIR}/${COMPILER_RT_OS_DIR}")
+   set(COMPILER_RT_INSTALL_LIBRARY_DIR "${default_install_path}" CACHE PATH
+     "Path where built compiler-rt libraries should be installed.")
+ endif()
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/normalize-var.patch b/pkgs/development/compilers/llvm/15/compiler-rt/normalize-var.patch
new file mode 100644
index 00000000000..135cf625ef7
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/normalize-var.patch
@@ -0,0 +1,16 @@
+diff --git a/compiler-rt/cmake/Modules/CompilerRTUtils.cmake b/compiler-rt/cmake/Modules/CompilerRTUtils.cmake
+index f1f46fb9599c..6f19e69507ba 100644
+--- a/cmake/Modules/CompilerRTUtils.cmake
++++ b/cmake/Modules/CompilerRTUtils.cmake
+@@ -302,8 +302,9 @@ macro(load_llvm_config)
+     # Get some LLVM variables from LLVMConfig.
+     include("${LLVM_CMAKE_PATH}/LLVMConfig.cmake")
+ 
+-    set(LLVM_LIBRARY_OUTPUT_INTDIR
+-      ${LLVM_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX})
++    get_filename_component(LLVM_LIBRARY_OUTPUT_INTDIR
++      ${LLVM_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX}
++      REALPATH)
+   endif()
+ endmacro()
+ 
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch b/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch
new file mode 100644
index 00000000000..894a74e74d4
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch
@@ -0,0 +1,12 @@
+diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
+--- a/cmake/Modules/AddCompilerRT.cmake
++++ b/cmake/Modules/AddCompilerRT.cmake
+@@ -406,7 +406,7 @@ function(add_compiler_rt_runtime name type)
+         if (HAD_ERROR)
+           message(FATAL_ERROR "${CMAKE_LINKER} failed with status ${HAD_ERROR}")
+         endif()
+-        set(NEED_EXPLICIT_ADHOC_CODESIGN 1)
++        set(NEED_EXPLICIT_ADHOC_CODESIGN 0) # `postLinkSignHook` handles this for us
+         if ("${LD_V_OUTPUT}" MATCHES ".*ld64-([0-9.]+).*")
+           string(REGEX REPLACE ".*ld64-([0-9.]+).*" "\\1" HOST_LINK_VERSION ${LD_V_OUTPUT})
+           if (HOST_LINK_VERSION VERSION_GREATER_EQUAL 609)
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
new file mode 100644
index 00000000000..db98f2854a0
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -0,0 +1,354 @@
+{ lowPrio, newScope, pkgs, lib, stdenv, stdenvNoCC, cmake, ninja
+, gccForLibs, preLibcCrossHeaders
+, libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
+, buildLlvmTools # tools, but from the previous stage, for cross
+, targetLlvmLibraries # libraries, but from the next stage, for cross
+, targetLlvm
+# This is the default binutils, but with *this* version of LLD rather
+# than the default LLVM verion's, if LLD is the choice. We use these for
+# the `useLLVM` bootstrapping below.
+, bootBintoolsNoLibc ?
+    if stdenv.targetPlatform.linker == "lld"
+    then null
+    else pkgs.bintoolsNoLibc
+, bootBintools ?
+    if stdenv.targetPlatform.linker == "lld"
+    then null
+    else pkgs.bintools
+, darwin
+# LLVM release information; specify one of these but not both:
+, gitRelease ? null
+  # i.e.:
+  # {
+  #   version = /* i.e. "15.0.0" */;
+  #   rev = /* commit SHA */;
+  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
+  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
+  # }
+, officialRelease ? { version = "15.0.7"; sha256 = "sha256-wjuZQyXQ/jsmvy6y1aksCcEDXGBjuhpgngF3XQJ/T4s="; }
+  # i.e.:
+  # {
+  #   version = /* i.e. "15.0.0" */;
+  #   candidate = /* optional; if specified, should be: "rcN" */
+  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
+  # }
+# By default, we'll try to fetch a release from `github:llvm/llvm-project`
+# corresponding to the `gitRelease` or `officialRelease` specified.
+#
+# You can provide your own LLVM source by specifying this arg but then it's up
+# to you to make sure that the LLVM repo given matches the release configuration
+# specified.
+, monorepoSrc ? null
+}:
+
+assert let
+  int = a: if a then 1 else 0;
+  xor = a: b: ((builtins.bitXor (int a) (int b)) == 1);
+in
+  lib.assertMsg
+    (xor
+      (gitRelease != null)
+      (officialRelease != null))
+    ("must specify `gitRelease` or `officialRelease`" +
+      (lib.optionalString (gitRelease != null) " β€” not both"));
+let
+  monorepoSrc' = monorepoSrc;
+in let
+  releaseInfo = if gitRelease != null then rec {
+    original = gitRelease;
+    release_version = original.version;
+    version = gitRelease.rev-version;
+  } else rec {
+    original = officialRelease;
+    release_version = original.version;
+    version = if original ? candidate then
+      "${release_version}-${original.candidate}"
+    else
+      release_version;
+  };
+
+  monorepoSrc = if monorepoSrc' != null then
+    monorepoSrc'
+  else let
+    sha256 = releaseInfo.original.sha256;
+    rev = if gitRelease != null then
+      gitRelease.rev
+    else
+      "llvmorg-${releaseInfo.version}";
+  in fetchFromGitHub {
+    owner = "llvm";
+    repo = "llvm-project";
+    inherit rev sha256;
+  };
+
+  inherit (releaseInfo) release_version version;
+
+  llvm_meta = {
+    license     = with lib.licenses; [ ncsa llvm-exception ];
+    maintainers = lib.teams.llvm.members;
+    platforms   = lib.platforms.all;
+  };
+
+  tools = lib.makeExtensible (tools: let
+    callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
+    mkExtraBuildCommands0 = cc: ''
+      rsrc="$out/resource-root"
+      mkdir "$rsrc"
+      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
+      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+    '';
+    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
+    '';
+
+  bintoolsNoLibc' =
+    if bootBintoolsNoLibc == null
+    then tools.bintoolsNoLibc
+    else bootBintoolsNoLibc;
+  bintools' =
+    if bootBintools == null
+    then tools.bintools
+    else bootBintools;
+
+  in {
+
+    libllvm = callPackage ./llvm {
+      inherit llvm_meta;
+    };
+
+    # `llvm` historically had the binaries.  When choosing an output explicitly,
+    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
+    llvm = tools.libllvm.out // { outputSpecified = false; };
+
+    libclang = callPackage ./clang {
+      inherit llvm_meta;
+    };
+
+    clang-unwrapped = tools.libclang.out // { outputSpecified = false; };
+
+    llvm-manpages = lowPrio (tools.libllvm.override {
+      enableManpages = true;
+      python3 = pkgs.python3;  # don't use python-boot
+    });
+
+    clang-manpages = lowPrio (tools.libclang.override {
+      enableManpages = true;
+      python3 = pkgs.python3;  # don't use python-boot
+    });
+
+    lldb-manpages = lowPrio (tools.lldb.override {
+      enableManpages = true;
+      python3 = pkgs.python3;  # don't use python-boot
+    });
+
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
+
+    libstdcxxClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
+      libcxx = null;
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+    };
+
+    libcxxClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = targetLlvmLibraries.libcxx;
+      extraPackages = [
+        libcxx.cxxabi
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+    };
+
+    lld = callPackage ./lld {
+      inherit llvm_meta;
+    };
+
+    lldb = callPackage ./lldb {
+      inherit llvm_meta;
+      inherit (darwin) libobjc bootstrap_cmds;
+      inherit (darwin.apple_sdk.libs) xpc;
+      inherit (darwin.apple_sdk.frameworks) Foundation Carbon Cocoa;
+    };
+
+    # Below, is the LLVM bootstrapping logic. It handles building a
+    # fully LLVM toolchain from scratch. No GCC toolchain should be
+    # pulled in. As a consequence, it is very quick to build different
+    # targets provided by LLVM and we can also build for what GCC
+    # doesn’t support like LLVM. Probably we should move to some other
+    # file.
+
+    bintools-unwrapped = callPackage ./bintools {};
+
+    bintoolsNoLibc = wrapBintoolsWith {
+      bintools = tools.bintools-unwrapped;
+      libc = preLibcCrossHeaders;
+    };
+
+    bintools = wrapBintoolsWith {
+      bintools = tools.bintools-unwrapped;
+    };
+
+    clangUseLLVM = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = targetLlvmLibraries.libcxx;
+      bintools = bintools';
+      extraPackages = [
+        libcxx.cxxabi
+        targetLlvmLibraries.compiler-rt
+      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
+        targetLlvmLibraries.libunwind
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags =
+        [ "-rtlib=compiler-rt"
+          "-Wno-unused-command-line-argument"
+          "-B${targetLlvmLibraries.compiler-rt}/lib"
+        ]
+        ++ lib.optional (!stdenv.targetPlatform.isWasm) "--unwindlib=libunwind"
+        ++ lib.optional
+          (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
+          "-lunwind"
+        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+    };
+
+    clangNoLibcxx = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = bintools';
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags = [
+        "-rtlib=compiler-rt"
+        "-B${targetLlvmLibraries.compiler-rt}/lib"
+        "-nostdlib++"
+      ];
+    };
+
+    clangNoLibc = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = bintoolsNoLibc';
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+      nixSupport.cc-cflags = [
+        "-rtlib=compiler-rt"
+        "-B${targetLlvmLibraries.compiler-rt}/lib"
+      ];
+    };
+
+    clangNoCompilerRt = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = bintoolsNoLibc';
+      extraPackages = [ ];
+      extraBuildCommands = mkExtraBuildCommands0 cc;
+      nixSupport.cc-cflags = [ "-nostartfiles" ];
+    };
+
+    clangNoCompilerRtWithLibc = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = bintools';
+      extraPackages = [ ];
+      extraBuildCommands = mkExtraBuildCommands0 cc;
+    };
+
+  });
+
+  libraries = lib.makeExtensible (libraries: let
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc; });
+  in {
+
+    compiler-rt-libc = callPackage ./compiler-rt {
+      inherit llvm_meta;
+      stdenv = if stdenv.hostPlatform.useLLVM or false
+               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
+               else stdenv;
+    };
+
+    compiler-rt-no-libc = callPackage ./compiler-rt {
+      inherit llvm_meta;
+      stdenv = if stdenv.hostPlatform.useLLVM or false
+               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
+               else stdenv;
+    };
+
+    # N.B. condition is safe because without useLLVM both are the same.
+    compiler-rt = if stdenv.hostPlatform.isAndroid
+      then libraries.compiler-rt-libc
+      else libraries.compiler-rt-no-libc;
+
+    stdenv = overrideCC stdenv buildLlvmTools.clang;
+
+    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
+
+    libcxxabi = let
+      # CMake will "require" a compiler capable of compiling C++ programs
+      # cxx-header's build does not actually use one so it doesn't really matter
+      # what stdenv we use here, as long as CMake is happy.
+      cxx-headers = callPackage ./libcxx {
+        inherit llvm_meta;
+        # Note that if we use the regular stdenv here we'll get cycle errors
+        # when attempting to use this compiler in the stdenv.
+        #
+        # The final stdenv pulls `cxx-headers` from the package set where
+        # hostPlatform *is* the target platform which means that `stdenv` at
+        # that point attempts to use this toolchain.
+        #
+        # So, we use `stdenv_` (the stdenv containing `clang` from this package
+        # set, defined below) to sidestep this issue.
+        #
+        # Because we only use `cxx-headers` in `libcxxabi` (which depends on the
+        # clang stdenv _anyways_), this is okay.
+        stdenv = stdenv_;
+        headersOnly = true;
+      };
+
+      # `libcxxabi` *doesn't* need a compiler with a working C++ stdlib but it
+      # *does* need a relatively modern C++ compiler (see:
+      # https://releases.llvm.org/15.0.0/projects/libcxx/docs/index.html#platform-and-compiler-support).
+      #
+      # So, we use the clang from this LLVM package set, like libc++
+      # "boostrapping builds" do:
+      # https://releases.llvm.org/15.0.0/projects/libcxx/docs/BuildingLibcxx.html#bootstrapping-build
+      #
+      # We cannot use `clangNoLibcxx` because that contains `compiler-rt` which,
+      # on macOS, depends on `libcxxabi`, thus forming a cycle.
+      stdenv_ = overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc;
+    in callPackage ./libcxxabi {
+      stdenv = stdenv_;
+      inherit llvm_meta cxx-headers;
+    };
+
+    # Like `libcxxabi` above, `libcxx` requires a fairly modern C++ compiler,
+    # so: we use the clang from this LLVM package set instead of the regular
+    # stdenv's compiler.
+    libcxx = callPackage ./libcxx {
+      inherit llvm_meta;
+      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
+    };
+
+    libunwind = callPackage ./libunwind {
+      inherit llvm_meta;
+      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
+    };
+
+    openmp = callPackage ./openmp {
+      inherit llvm_meta targetLlvm;
+    };
+  });
+
+in { inherit tools libraries release_version; } // libraries // tools
diff --git a/pkgs/development/compilers/llvm/15/libcxx/default.nix b/pkgs/development/compilers/llvm/15/libcxx/default.nix
new file mode 100644
index 00000000000..7762df29386
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxx/default.nix
@@ -0,0 +1,107 @@
+{ lib, stdenv, llvm_meta
+, monorepoSrc, runCommand
+, cmake, ninja, python3, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
+, enableShared ? !stdenv.hostPlatform.isStatic
+
+# If headersOnly is true, the resulting package would only include the headers.
+# Use this to break the circular dependency between libcxx and libcxxabi.
+#
+# Some context:
+# https://reviews.llvm.org/rG1687f2bbe2e2aaa092f942d4a97d41fad43eedfb
+, headersOnly ? false
+}:
+
+let
+  basename = "libcxx";
+in
+
+assert stdenv.isDarwin -> cxxabi.libName == "c++abi";
+
+stdenv.mkDerivation rec {
+  pname = basename + lib.optionalString headersOnly "-headers";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${basename} "$out"
+    mkdir -p "$out/libcxxabi"
+    cp -r ${monorepoSrc}/libcxxabi/include "$out/libcxxabi"
+    mkdir -p "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+    cp -r ${monorepoSrc}/third-party "$out"
+    cp -r ${monorepoSrc}/runtimes "$out"
+  '';
+
+  sourceRoot = "${src.name}/runtimes";
+
+  outputs = [ "out" ] ++ lib.optional (!headersOnly) "dev";
+
+  prePatch = ''
+    cd ../${basename}
+    chmod -R u+w .
+  '';
+
+  patches = [
+    ./gnu-install-dirs.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    ../../libcxx-0001-musl-hacks.patch
+  ];
+
+  postPatch = ''
+    cd ../runtimes
+  '';
+
+  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
+    patchShebangs utils/cat_files.py
+  '';
+
+  nativeBuildInputs = [ cmake ninja python3 ]
+    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  buildInputs = lib.optionals (!headersOnly) [ cxxabi ];
+
+  cmakeFlags = let
+    # See: https://libcxx.llvm.org/BuildingLibcxx.html#cmdoption-arg-libcxx-cxx-abi-string
+    libcxx_cxx_abi_opt = {
+      "c++abi" = "system-libcxxabi";
+      "cxxrt" = "libcxxrt";
+    }.${cxxabi.libName} or (throw "unknown cxxabi: ${cxxabi.libName} (${cxxabi.pname})");
+  in [
+    "-DLLVM_ENABLE_RUNTIMES=libcxx"
+    "-DLIBCXX_CXX_ABI=${if headersOnly then "none" else libcxx_cxx_abi_opt}"
+  ] ++ lib.optional (!headersOnly && cxxabi.libName == "c++abi") "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${cxxabi.dev}/include/c++/v1"
+    ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
+      "-DLIBCXX_ENABLE_THREADS=OFF"
+      "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
+      "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
+    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF"
+    # If we're only building the headers we don't actually *need* a functioning
+    # C/C++ compiler:
+    ++ lib.optionals (headersOnly) [
+      "-DCMAKE_C_COMPILER_WORKS=ON"
+      "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    ];
+
+  ninjaFlags = lib.optional headersOnly "generate-cxx-headers";
+  installTargets = lib.optional headersOnly "install-cxx-headers";
+
+  passthru = {
+    isLLVM = true;
+    inherit cxxabi;
+  };
+
+  meta = llvm_meta // {
+    homepage = "https://libcxx.llvm.org/";
+    description = "C++ standard library";
+    longDescription = ''
+      libc++ is an implementation of the C++ standard library, targeting C++11,
+      C++14 and above.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/libcxx/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/libcxx/gnu-install-dirs.patch
new file mode 100644
index 00000000000..daee5bdd0ed
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxx/gnu-install-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 74eff2002fc9..c935d10878bb 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -419,7 +419,7 @@ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBCXX_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE})
+   set(LIBCXX_GENERATED_INCLUDE_DIR "${LLVM_BINARY_DIR}/include/c++/v1")
+   set(LIBCXX_GENERATED_INCLUDE_TARGET_DIR "${LLVM_BINARY_DIR}/include/${LLVM_DEFAULT_TARGET_TRIPLE}/c++/v1")
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
++  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
+       "Path where built libc++ libraries should be installed.")
+   set(LIBCXX_INSTALL_INCLUDE_TARGET_DIR "${CMAKE_INSTALL_INCLUDEDIR}/${LLVM_DEFAULT_TARGET_TRIPLE}/c++/v1" CACHE PATH
+       "Path where target-specific libc++ headers should be installed.")
+@@ -436,7 +436,7 @@ else()
+     set(LIBCXX_GENERATED_INCLUDE_DIR "${CMAKE_BINARY_DIR}/include/c++/v1")
+   endif()
+   set(LIBCXX_GENERATED_INCLUDE_TARGET_DIR "${LIBCXX_GENERATED_INCLUDE_DIR}")
+-  set(LIBCXX_INSTALL_LIBRARY_DIR lib${LIBCXX_LIBDIR_SUFFIX} CACHE PATH
++  set(LIBCXX_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX} CACHE PATH
+       "Path where built libc++ libraries should be installed.")
+   set(LIBCXX_INSTALL_INCLUDE_TARGET_DIR "${LIBCXX_INSTALL_INCLUDE_DIR}" CACHE PATH
+       "Path where target-specific libc++ headers should be installed.")
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/default.nix b/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
new file mode 100644
index 00000000000..fd99f4553c0
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxxabi/default.nix
@@ -0,0 +1,105 @@
+{ lib, stdenv, llvm_meta, cmake, ninja, python3
+, monorepoSrc, runCommand, fetchpatch
+, cxx-headers, libunwind, version
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libcxxabi";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    mkdir -p "$out/libcxx/src"
+    cp -r ${monorepoSrc}/libcxx/cmake "$out/libcxx"
+    cp -r ${monorepoSrc}/libcxx/include "$out/libcxx"
+    cp -r ${monorepoSrc}/libcxx/src/include "$out/libcxx/src"
+    mkdir -p "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+    cp -r ${monorepoSrc}/runtimes "$out"
+  '';
+
+  sourceRoot = "${src.name}/runtimes";
+
+  outputs = [ "out" "dev" ];
+
+  postUnpack = lib.optionalString stdenv.isDarwin ''
+    export TRIPLE=x86_64-apple-darwin
+  '' + lib.optionalString stdenv.hostPlatform.isWasm ''
+    patch -p1 -d llvm -i ${./wasm.patch}
+  '';
+
+  prePatch = ''
+    cd ../${pname}
+    chmod -R u+w .
+  '';
+
+  patches = [
+    ./gnu-install-dirs.patch
+
+    # https://reviews.llvm.org/D132298, Allow building libcxxabi alone
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/e6a0800532bb409f6d1c62f3698bdd6994a877dc.patch";
+      sha256 = "1xyjd56m4pfwq8p3xh6i8lhkk9kq15jaml7qbhxdf87z4jjkk63a";
+      stripLen = 1;
+    })
+  ];
+
+  postPatch = ''
+    cd ../runtimes
+  '';
+
+  nativeBuildInputs = [ cmake ninja python3 ];
+  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.hostPlatform.isWasm) libunwind;
+
+  cmakeFlags = [
+    "-DLLVM_ENABLE_RUNTIMES=libcxxabi"
+    "-DLIBCXXABI_LIBCXX_INCLUDES=${cxx-headers}/include/c++/v1"
+
+    # `libcxxabi`'s build does not need a toolchain with a c++ stdlib attached
+    # (we specify the headers it should use explicitly above).
+    #
+    # CMake however checks for this anyways; this flag tells it not to. See:
+    # https://github.com/llvm/llvm-project/blob/4bd3f3759259548e159aeba5c76efb9a0864e6fa/llvm/runtimes/CMakeLists.txt#L243
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
+  ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+  ] ++ lib.optionals stdenv.hostPlatform.isWasm [
+    "-DLIBCXXABI_ENABLE_THREADS=OFF"
+    "-DLIBCXXABI_ENABLE_EXCEPTIONS=OFF"
+  ] ++ lib.optionals (!enableShared) [
+    "-DLIBCXXABI_ENABLE_SHARED=OFF"
+  ];
+
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../../${pname}/include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';
+
+  passthru = {
+    libName = "c++abi";
+  };
+
+  meta = llvm_meta // {
+    homepage = "https://libcxxabi.llvm.org/";
+    description = "Provides C++ standard library support";
+    longDescription = ''
+      libc++abi is a new implementation of low level support for a standard C++ library.
+    '';
+    maintainers = llvm_meta.maintainers ++ [ lib.maintainers.vlstill ];
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/libcxxabi/gnu-install-dirs.patch
new file mode 100644
index 00000000000..fa587612aaf
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxxabi/gnu-install-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b8326d08d23a..a1e36f713161 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -187,7 +187,7 @@ set(LIBCXXABI_INSTALL_RUNTIME_DIR "${CMAKE_INSTALL_BINDIR}" CACHE PATH
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBCXXABI_HEADER_DIR ${LLVM_BINARY_DIR})
+   set(LIBCXXABI_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE})
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
++  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
+       "Path where built libc++abi libraries should be installed.")
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBCXXABI_LIBRARY_DIR /${LIBCXXABI_LIBDIR_SUBDIR})
+@@ -201,7 +201,7 @@ else()
+     set(LIBCXXABI_HEADER_DIR ${CMAKE_BINARY_DIR})
+     set(LIBCXXABI_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBCXXABI_LIBDIR_SUFFIX})
+   endif()
+-  set(LIBCXXABI_INSTALL_LIBRARY_DIR lib${LIBCXXABI_LIBDIR_SUFFIX} CACHE PATH
++  set(LIBCXXABI_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBCXXABI_LIBDIR_SUFFIX} CACHE PATH
+       "Path where built libc++abi libraries should be installed.")
+ endif()
+ 
diff --git a/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch b/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch
new file mode 100644
index 00000000000..4ebfe46aa81
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libcxxabi/wasm.patch
@@ -0,0 +1,16 @@
+diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
+index 15497d405e0..33f7f18193a 100644
+--- a/cmake/modules/HandleLLVMOptions.cmake
++++ b/cmake/modules/HandleLLVMOptions.cmake
+@@ -127,7 +127,10 @@ else(WIN32)
+       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
+     endif()
+   else(FUCHSIA OR UNIX)
+-    MESSAGE(SEND_ERROR "Unable to determine platform")
++    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
++    else()
++      MESSAGE(SEND_ERROR "Unable to determine platform")
++    endif()
+   endif(FUCHSIA OR UNIX)
+ endif(WIN32)
+ 
diff --git a/pkgs/development/compilers/llvm/15/libunwind/default.nix b/pkgs/development/compilers/llvm/15/libunwind/default.nix
new file mode 100644
index 00000000000..dd14e2acaf8
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libunwind/default.nix
@@ -0,0 +1,62 @@
+{ lib, stdenv, llvm_meta, version
+, monorepoSrc, runCommand
+, cmake
+, ninja
+, python3
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libunwind";
+  inherit version;
+
+  # I am not so comfortable giving libc++ and friends the whole monorepo as
+  # requested, so I filter it to what is needed.
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    mkdir -p "$out/libcxx"
+    cp -r ${monorepoSrc}/libcxx/cmake "$out/libcxx"
+    cp -r ${monorepoSrc}/libcxx/utils "$out/libcxx"
+    mkdir -p "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+    cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+    cp -r ${monorepoSrc}/runtimes "$out"
+  '';
+
+  sourceRoot = "${src.name}/runtimes";
+
+  prePatch = ''
+    cd ../${pname}
+    chmod -R u+w .
+  '';
+
+  patches = [
+    ./gnu-install-dirs.patch
+  ];
+
+  postPatch = ''
+    cd ../runtimes
+  '';
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ cmake ninja python3 ];
+
+  cmakeFlags = [
+    "-DLLVM_ENABLE_RUNTIMES=libunwind"
+  ] ++ lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF";
+
+  meta = llvm_meta // {
+    # Details: https://github.com/llvm/llvm-project/blob/main/libunwind/docs/index.rst
+    homepage = "https://clang.llvm.org/docs/Toolchain.html#unwind-library";
+    description = "LLVM's unwinder library";
+    longDescription = ''
+      The unwind library provides a family of _Unwind_* functions implementing
+      the language-neutral stack unwinding portion of the Itanium C++ ABI (Level
+      I). It is a dependency of the C++ ABI library, and sometimes is a
+      dependency of other runtimes.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/libunwind/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/libunwind/gnu-install-dirs.patch
new file mode 100644
index 00000000000..edfb2a8760b
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/libunwind/gnu-install-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 5a06805f05f1..86a50329e6a8 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -117,7 +117,7 @@ set(LIBUNWIND_INSTALL_RUNTIME_DIR "${CMAKE_INSTALL_BINDIR}" CACHE PATH
+ 
+ if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+   set(LIBUNWIND_LIBRARY_DIR ${LLVM_LIBRARY_OUTPUT_INTDIR}/${LLVM_DEFAULT_TARGET_TRIPLE})
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
++  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE} CACHE PATH
+       "Path where built libunwind libraries should be installed.")
+   if(LIBCXX_LIBDIR_SUBDIR)
+     string(APPEND LIBUNWIND_LIBRARY_DIR /${LIBUNWIND_LIBDIR_SUBDIR})
+@@ -129,7 +129,7 @@ else()
+   else()
+     set(LIBUNWIND_LIBRARY_DIR ${CMAKE_BINARY_DIR}/lib${LIBUNWIND_LIBDIR_SUFFIX})
+   endif()
+-  set(LIBUNWIND_INSTALL_LIBRARY_DIR lib${LIBUNWIND_LIBDIR_SUFFIX} CACHE PATH
++  set(LIBUNWIND_INSTALL_LIBRARY_DIR ${CMAKE_INSTALL_LIBDIR}${LIBUNWIND_LIBDIR_SUFFIX} CACHE PATH
+       "Path where built libunwind libraries should be installed.")
+ endif()
+ 
diff --git a/pkgs/development/compilers/llvm/15/lld/default.nix b/pkgs/development/compilers/llvm/15/lld/default.nix
new file mode 100644
index 00000000000..e8bca769de5
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lld/default.nix
@@ -0,0 +1,55 @@
+{ lib, stdenv, llvm_meta
+, buildLlvmTools
+, monorepoSrc, runCommand
+, cmake
+, ninja
+, libxml2
+, libllvm
+, version
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lld";
+  inherit version;
+
+  # Blank llvm dir just so relative path works
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    mkdir -p "$out/libunwind"
+    cp -r ${monorepoSrc}/libunwind/include "$out/libunwind"
+    mkdir -p "$out/llvm"
+  '';
+
+  sourceRoot = "${src.name}/${pname}";
+
+  patches = [
+    ./gnu-install-dirs.patch
+  ];
+
+  nativeBuildInputs = [ cmake ninja ];
+  buildInputs = [ libllvm libxml2 ];
+
+  cmakeFlags = [
+    "-DLLD_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/lld"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+  ];
+  LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-Wl,-z,stack-size=2097152";
+
+  outputs = [ "out" "lib" "dev" ];
+
+  meta = llvm_meta // {
+    homepage = "https://lld.llvm.org/";
+    description = "The LLVM linker (unwrapped)";
+    longDescription = ''
+      LLD is a linker from the LLVM project that is a drop-in replacement for
+      system linkers and runs much faster than them. It also provides features
+      that are useful for toolchain developers.
+      The linker supports ELF (Unix), PE/COFF (Windows), Mach-O (macOS), and
+      WebAssembly in descending order of completeness. Internally, LLD consists
+      of several different linkers.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/lld/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/lld/gnu-install-dirs.patch
new file mode 100644
index 00000000000..ea62b2ad50c
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lld/gnu-install-dirs.patch
@@ -0,0 +1,46 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index dcc649629a4b..58dca54642e4 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -70,13 +70,15 @@ if(LLD_BUILT_STANDALONE)
+   if (NOT LLVM_CONFIG_FOUND)
+     # Pull values from LLVMConfig.cmake.  We can drop this once the llvm-config
+     # path is removed.
+-    set(MAIN_INCLUDE_DIR "${LLVM_INCLUDE_DIR}")
++    set(INCLUDE_DIRS ${LLVM_INCLUDE_DIRS})
+     set(LLVM_OBJ_DIR "${LLVM_BINARY_DIR}")
+     # N.B. this is just a default value, the CACHE PATHs below can be overridden.
+     set(MAIN_SRC_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../llvm")
++  else()
++    set(INCLUDE_DIRS "${LLVM_BINARY_DIR}/include" "${MAIN_INCLUDE_DIR}")
+   endif()
+ 
+-  set(LLVM_MAIN_INCLUDE_DIR "${MAIN_INCLUDE_DIR}" CACHE PATH "Path to llvm/include")
++  set(LLVM_INCLUDE_DIRS ${INCLUDE_DIRS} CACHE PATH "Path to llvm/include and any other header dirs needed")
+   set(LLVM_BINARY_DIR "${LLVM_OBJ_ROOT}" CACHE PATH "Path to LLVM build tree")
+   set(LLVM_MAIN_SRC_DIR "${MAIN_SRC_DIR}" CACHE PATH "Path to LLVM source tree")
+ 
+@@ -95,7 +97,7 @@ if(LLD_BUILT_STANDALONE)
+ 
+   set(PACKAGE_VERSION "${LLVM_PACKAGE_VERSION}")
+ 
+-  include_directories("${LLVM_BINARY_DIR}/include" ${LLVM_INCLUDE_DIRS})
++  include_directories(${LLVM_INCLUDE_DIRS})
+   link_directories(${LLVM_LIBRARY_DIRS})
+ 
+   if(LLVM_INCLUDE_TESTS)
+diff --git a/cmake/modules/AddLLD.cmake b/cmake/modules/AddLLD.cmake
+index d3924f7243d4..42a7cd62281c 100644
+--- a/cmake/modules/AddLLD.cmake
++++ b/cmake/modules/AddLLD.cmake
+@@ -18,8 +18,8 @@ macro(add_lld_library name)
+     install(TARGETS ${name}
+       COMPONENT ${name}
+       ${export_to_lldtargets}
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
++      LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}"
++      ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}"
+       RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
+ 
+     if (${ARG_SHARED} AND NOT CMAKE_CONFIGURATION_TYPES)
diff --git a/pkgs/development/compilers/llvm/15/lldb/cpu_subtype_arm64e_replacement.patch b/pkgs/development/compilers/llvm/15/lldb/cpu_subtype_arm64e_replacement.patch
new file mode 100644
index 00000000000..20d35c9f3ea
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/cpu_subtype_arm64e_replacement.patch
@@ -0,0 +1,12 @@
+diff --git a/source/Host/macosx/objcxx/HostInfoMacOSX.mm b/source/Host/macosx/objcxx/HostInfoMacOSX.mm
+--- a/source/Host/macosx/objcxx/HostInfoMacOSX.mm
++++ b/source/Host/macosx/objcxx/HostInfoMacOSX.mm
+@@ -233,7 +233,7 @@ void HostInfoMacOSX::ComputeHostArchitectureSupport(ArchSpec &arch_32,
+     len = sizeof(is_64_bit_capable);
+     ::sysctlbyname("hw.cpu64bit_capable", &is_64_bit_capable, &len, NULL, 0);
+ 
+-    if (cputype == CPU_TYPE_ARM64 && cpusubtype == CPU_SUBTYPE_ARM64E) {
++    if (cputype == CPU_TYPE_ARM64 && cpusubtype == ((cpu_subtype_t) 2)) { // CPU_SUBTYPE_ARM64E is not available in the macOS 10.12 headers
+       // The arm64e architecture is a preview. Pretend the host architecture
+       // is arm64.
+       cpusubtype = CPU_SUBTYPE_ARM64_ALL;
diff --git a/pkgs/development/compilers/llvm/15/lldb/default.nix b/pkgs/development/compilers/llvm/15/lldb/default.nix
new file mode 100644
index 00000000000..4b50b79cf61
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/default.nix
@@ -0,0 +1,186 @@
+{ lib, stdenv, llvm_meta
+, runCommand
+, monorepoSrc
+, cmake
+, ninja
+, zlib
+, ncurses
+, swig
+, which
+, libedit
+, libxml2
+, libllvm
+, libclang
+, python3
+, version
+, libobjc
+, xpc
+, Foundation
+, bootstrap_cmds
+, Carbon
+, Cocoa
+, lit
+, makeWrapper
+, darwin
+, enableManpages ? false
+, lua5_3
+}:
+
+# TODO: we build the python bindings but don't expose them as a python package
+# TODO: expose the vscode extension?
+
+stdenv.mkDerivation (rec {
+  pname = "lldb";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+  '';
+
+  sourceRoot = "${src.name}/${pname}";
+
+  patches = [
+    ./procfs.patch
+    (runCommand "resource-dir.patch" {
+      clangLibDir = "${libclang.lib}/lib";
+    } ''
+      substitute '${./resource-dir.patch}' "$out" --subst-var clangLibDir
+    '')
+    ./gnu-install-dirs.patch
+  ]
+  # This is a stopgap solution if/until the macOS SDK used for x86_64 is
+  # updated.
+  #
+  # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
+  # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
+  # of this preprocessor symbol in `lldb` with its expansion.
+  #
+  # See here for some context:
+  # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
+  ++ lib.optional (
+    stdenv.targetPlatform.isDarwin
+      && !stdenv.targetPlatform.isAarch64
+      && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
+  ) ./cpu_subtype_arm64e_replacement.patch;
+
+  outputs = [ "out" "lib" "dev" ];
+
+  nativeBuildInputs = [
+    cmake ninja python3 which swig lit makeWrapper lua5_3
+  ] ++ lib.optionals enableManpages [
+    python3.pkgs.sphinx python3.pkgs.recommonmark
+  ];
+
+  buildInputs = [
+    ncurses
+    zlib
+    libedit
+    libxml2
+    libllvm
+  ] ++ lib.optionals stdenv.isDarwin [
+    libobjc
+    xpc
+    Foundation
+    bootstrap_cmds
+    Carbon
+    Cocoa
+  ]
+  # The older libSystem used on x86_64 macOS is missing the
+  # `<bsm/audit_session.h>` header which `lldb` uses.
+  #
+  # We copy this header over from macOS 10.12 SDK.
+  #
+  # See here for context:
+  # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
+  ++ lib.optional (
+      stdenv.targetPlatform.isDarwin
+        && !stdenv.targetPlatform.isAarch64
+    ) (
+      runCommand "bsm-audit-session-header" { } ''
+        install -Dm444 \
+          "${lib.getDev darwin.apple_sdk.sdk}/include/bsm/audit_session.h" \
+          "$out/include/bsm/audit_session.h"
+      ''
+    );
+
+  hardeningDisable = [ "format" ];
+
+  cmakeFlags = [
+    "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
+    "-DLLVM_ENABLE_RTTI=OFF"
+    "-DClang_DIR=${libclang.dev}/lib/cmake"
+    "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+  ] ++ lib.optionals enableManpages [
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_OUTPUT_HTML=OFF"
+
+    # docs reference `automodapi` but it's not added to the extensions list when
+    # only building the manpages:
+    # https://github.com/llvm/llvm-project/blob/af6ec9200b09039573d85e349496c4f5b17c3d7f/lldb/docs/conf.py#L54
+    #
+    # so, we just ignore the resulting errors
+    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+  ] ++ lib.optionals doCheck [
+    "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
+    "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
+  ];
+
+  doCheck = false;
+
+  installCheckPhase = ''
+    if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
+        return 1;
+    fi
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/lldb --prefix PYTHONPATH : $lib/${python3.sitePackages}/
+
+    # Editor support
+    # vscode:
+    install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
+    mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+    ln -s $out/bin/lldb-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+  '';
+
+  meta = llvm_meta // {
+    homepage = "https://lldb.llvm.org/";
+    description = "A next-generation high-performance debugger";
+    longDescription = ''
+      LLDB is a next generation, high-performance debugger. It is built as a set
+      of reusable components which highly leverage existing libraries in the
+      larger LLVM Project, such as the Clang expression parser and LLVM
+      disassembler.
+    '';
+  };
+} // lib.optionalAttrs enableManpages {
+  pname = "lldb-manpages";
+
+  ninjaFlags = [ "docs-lldb-man" ];
+
+  propagatedBuildInputs = [];
+
+  # manually install lldb man page
+  installPhase = ''
+    mkdir -p $out/share/man/man1
+    install docs/man/lldb.1 -t $out/share/man/man1/
+  '';
+
+  postPatch = null;
+  postInstall = null;
+
+  outputs = [ "out" ];
+
+  doCheck = false;
+
+  meta = llvm_meta // {
+    description = "man pages for LLDB ${version}";
+  };
+})
diff --git a/pkgs/development/compilers/llvm/15/lldb/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/lldb/gnu-install-dirs.patch
new file mode 100644
index 00000000000..4388f5c7f59
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/gnu-install-dirs.patch
@@ -0,0 +1,23 @@
+diff --git a/cmake/modules/AddLLDB.cmake b/cmake/modules/AddLLDB.cmake
+index 3291a7c808e1..b27d27ce6a87 100644
+--- a/cmake/modules/AddLLDB.cmake
++++ b/cmake/modules/AddLLDB.cmake
+@@ -109,7 +109,7 @@ function(add_lldb_library name)
+   endif()
+ 
+   if(PARAM_SHARED)
+-    set(install_dest lib${LLVM_LIBDIR_SUFFIX})
++    set(install_dest ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+     if(PARAM_INSTALL_PREFIX)
+       set(install_dest ${PARAM_INSTALL_PREFIX})
+     endif()
+diff --git a/tools/intel-features/CMakeLists.txt b/tools/intel-features/CMakeLists.txt
+index 7d48491ec89a..c04543585588 100644
+--- a/tools/intel-features/CMakeLists.txt
++++ b/tools/intel-features/CMakeLists.txt
+@@ -30,4 +30,4 @@ add_lldb_library(lldbIntelFeatures SHARED
+   )
+ 
+ install(TARGETS lldbIntelFeatures
+-  LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX})
++  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
diff --git a/pkgs/development/compilers/llvm/15/lldb/procfs.patch b/pkgs/development/compilers/llvm/15/lldb/procfs.patch
new file mode 100644
index 00000000000..7b200e86505
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/procfs.patch
@@ -0,0 +1,46 @@
+--- a/source/Plugins/Process/Linux/Procfs.h
++++ b/source/Plugins/Process/Linux/Procfs.h
+@@ -10,6 +10,13 @@
+ // sys/procfs.h on Android/Linux for all supported architectures.
+ 
+ #include <sys/ptrace.h>
++#include <asm/ptrace.h>
++
++// on i686 preprocessor symbols with these register names are defined as
++// numeric constants; these symbols clash with identifier names used in
++// `llvm/Support/VirtualFileSystem.h` and `llvm/ADT/SmallVector.h`
++#undef FS
++#undef CS
+ 
+ #include "lldb/lldb-types.h"
+ 
+@@ -17,23 +24,13 @@
+ 
+ #include <vector>
+ 
+-#ifdef __ANDROID__
+-#if defined(__arm64__) || defined(__aarch64__)
+-typedef unsigned long elf_greg_t;
+-typedef elf_greg_t
+-    elf_gregset_t[(sizeof(struct user_pt_regs) / sizeof(elf_greg_t))];
+-typedef struct user_fpsimd_state elf_fpregset_t;
+-#ifndef NT_FPREGSET
+-#define NT_FPREGSET NT_PRFPREG
+-#endif // NT_FPREGSET
+-#elif defined(__mips__)
+-#ifndef NT_FPREGSET
+-#define NT_FPREGSET NT_PRFPREG
+-#endif // NT_FPREGSET
+-#endif
+-#else // __ANDROID__
++#if !defined(__GLIBC__) && defined(__powerpc__)
++#define pt_regs musl_pt_regs
++#include <sys/procfs.h>
++#undef pt_regs
++#else
+ #include <sys/procfs.h>
+-#endif // __ANDROID__
++#endif
+ 
+ namespace lldb_private {
+ namespace process_linux {
diff --git a/pkgs/development/compilers/llvm/15/lldb/resource-dir.patch b/pkgs/development/compilers/llvm/15/lldb/resource-dir.patch
new file mode 100644
index 00000000000..e0db80afeb9
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/lldb/resource-dir.patch
@@ -0,0 +1,13 @@
+diff --git a/lldb/cmake/modules/LLDBConfig.cmake b/lldb/cmake/modules/LLDBConfig.cmake
+index 37364341ff8b..7f74c1a3e257 100644
+--- a/cmake/modules/LLDBConfig.cmake
++++ b/cmake/modules/LLDBConfig.cmake
+@@ -257,7 +257,7 @@ if (NOT TARGET clang-resource-headers)
+   # Iterate over the possible places where the external resource directory
+   # could be and pick the first that exists.
+   foreach(CANDIDATE "${Clang_DIR}/../.." "${LLVM_DIR}" "${LLVM_LIBRARY_DIRS}"
+-                    "${LLVM_BUILD_LIBRARY_DIR}"
++                    "${LLVM_BUILD_LIBRARY_DIR}" "@clangLibDir@"
+                     "${LLVM_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}")
+     # Build the resource directory path by appending 'clang/<version number>'.
+     set(CANDIDATE_RESOURCE_DIR "${CANDIDATE}/clang/${LLDB_CLANG_RESOURCE_DIR_NAME}")
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
new file mode 100644
index 00000000000..e0b79a9acfe
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -0,0 +1,429 @@
+{ lib, stdenv, llvm_meta
+, pkgsBuildBuild
+, monorepoSrc
+, runCommand
+, fetchpatch
+, cmake
+, darwin
+, ninja
+, python3
+, python3Packages
+, libffi
+, libbfd
+, libpfm
+, libxml2
+, ncurses
+, version
+, release_version
+, zlib
+, which
+, sysctl
+, buildLlvmTools
+, debugVersion ? false
+, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
+  && (stdenv.hostPlatform == stdenv.buildPlatform)
+, enableManpages ? false
+, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
+, enablePFM ? stdenv.isLinux /* PFM only supports Linux */
+  # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  # broken for the armv7l builder
+  && !stdenv.hostPlatform.isAarch
+, enablePolly ? true
+} @args:
+
+let
+  inherit (lib) optional optionals optionalString;
+
+  # Used when creating a version-suffixed symlink of libLLVM.dylib
+  shortVersion = with lib;
+    concatStringsSep "." (take 1 (splitString "." release_version));
+
+  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
+  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
+  # out `doCheck` as a package level attribute).
+  #
+  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
+  # particular the children it uses to do feature detection.
+  #
+  # This means that python deps we add to `checkDeps` (which the python
+  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
+  # setup hook) are not picked up by `lit` which causes it to skip tests.
+  #
+  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
+  # because this package is shadowed in `$PATH` by the regular `python3`
+  # package.
+  #
+  # So, we "manually" assemble one python derivation for the package to depend
+  # on, taking into account whether checks are enabled or not:
+  python = if doCheck then
+    # Note that we _explicitly_ ask for a python interpreter for our host
+    # platform here; the splicing that would ordinarily take care of this for
+    # us does not seem to work once we use `withPackages`.
+    let
+      checkDeps = ps: with ps; [ psutil ];
+    in pkgsBuildBuild.targetPackages.python3.withPackages checkDeps
+  else python3;
+
+in stdenv.mkDerivation (rec {
+  pname = "llvm";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} (''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    cp -r ${monorepoSrc}/third-party "$out"
+  '' + lib.optionalString enablePolly ''
+    chmod u+w "$out/${pname}/tools"
+    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
+  '');
+
+  sourceRoot = "${src.name}/${pname}";
+
+  outputs = [ "out" "lib" "dev" "python" ];
+
+  nativeBuildInputs = [ cmake ninja python ]
+    ++ optionals enableManpages [
+      # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
+      # splicing does *not* work with the latter. (TODO: fix)
+      python3Packages.sphinx python3Packages.recommonmark
+    ];
+
+  buildInputs = [ libxml2 libffi ]
+    ++ optional enablePFM libpfm; # exegesis
+
+  propagatedBuildInputs = [ ncurses zlib ];
+
+  nativeCheckInputs = [
+    which
+  ] ++ lib.optional stdenv.isDarwin sysctl;
+
+  patches = [
+    ./gnu-install-dirs.patch
+
+    # Running the tests involves invoking binaries (like `opt`) that depend on
+    # the LLVM dylibs and reference them by absolute install path (i.e. their
+    # nix store path).
+    #
+    # Because we have not yet run the install phase (we're running these tests
+    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+    # paths do not exist yet; to work around this we point the loader (`ld` on
+    # unix, `dyld` on macOS) at the `lib` directory which will later become this
+    # package's `lib` output.
+    #
+    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+    # dir but:
+    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+    #     `DYLD_LIBRARY_PATH` (macOS):
+    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+    #   - even if `lit` forwarded this env var, we actually cannot set
+    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+    #     "protected processes" (i.e. the python interpreter that runs `lit`):
+    #     https://stackoverflow.com/a/35570229
+    #   - other LLVM subprojects deal with this issue by having their `lit`
+    #     configuration set these env vars for us; it makes sense to do the same
+    #     for LLVM:
+    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+    #
+    # !!! TODO: look into upstreaming this patch
+    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+    # `lit` has a mode where it executes run lines as a shell script which is
+    # constructs; this is problematic for macOS because it means that there's
+    # another process in between `lit` and the binaries being tested. As noted
+    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+    # tests fail with dyld errors.
+    #
+    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+    # present in the test configuration.
+    #
+    # It's not clear to me why this isn't an issue for LLVM developers running
+    # on macOS (nothing about this _seems_ nix specific)..
+    ./lit-shell-script-runner-set-dyld-library-path.patch
+  ] ++ lib.optionals enablePolly [
+    ./gnu-install-dirs-polly.patch
+
+    # Just like the `llvm-lit-cfg` patch, but for `polly`.
+    ./polly-lit-cfg-add-libs-to-dylib-path.patch
+  ];
+
+  postPatch = optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/modules/AddLLVM.cmake \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
+      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
+
+    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
+    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
+    rm test/MC/ELF/cfi-version.ll
+
+    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
+    # and thus fails under the sandbox:
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
+  '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
+    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
+    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
+    # and `roundeven` on x86_64 macOS.
+    #
+    # However these functions are glibc specific so the test fails:
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
+    #
+    # TODO(@rrbutani): this seems to run fine on `aarch64-darwin`, why does it
+    # pass there?
+    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
+      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
+      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
+
+    # This test fails on darwin x86_64 because `sw_vers` reports a different
+    # macOS version than what LLVM finds by reading
+    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
+    # the sandbox on macOS).
+    #
+    # The `sw_vers` provided by nixpkgs reports the macOS version associated
+    # with the `CoreFoundation` framework with which it was built. Because
+    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
+    # `sw_vers` reports is not guaranteed to match the macOS version of the host
+    # that's building this derivation.
+    #
+    # Astute readers will note that we only _patch_ this test on aarch64-darwin
+    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
+    # So why does this test pass on aarch64?
+    #
+    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
+    # CoreFoundation framework instead of the nixpkgs provided one.
+    #
+    # Not entirely sure what the right fix is here. I'm assuming aarch64
+    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
+    # (still digging into how this ends up happening, will follow up) but that
+    # aside I think the more pertinent question is: should we be patching LLVM's
+    # macOS version detection logic to use `sw_vers` instead of reading host
+    # paths? This *is* a way in which details about builder machines can creep
+    # into the artifacts that are produced, affecting reproducibility, but it's
+    # not clear to me when/where/for what this even gets used in LLVM.
+    #
+    # TODO(@rrbutani): fix/follow-up
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
+
+    # This test fails with a `dysmutil` crash; have not yet dug into what's
+    # going on here (TODO(@rrbutani)).
+    rm test/tools/dsymutil/ARM/obfuscated.test
+  '' + ''
+    # FileSystem permissions tests fail with various special bits
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "Path.cpp" ""
+    rm unittests/Support/Path.cpp
+    substituteInPlace unittests/IR/CMakeLists.txt \
+      --replace "PassBuilderCallbacksTest.cpp" ""
+    rm unittests/IR/PassBuilderCallbacksTest.cpp
+    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
+  '' + optionalString stdenv.hostPlatform.isMusl ''
+    patch -p1 -i ${../../TLI-musl.patch}
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "add_subdirectory(DynamicLibrary)" ""
+    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
+    # valgrind unhappy with musl or glibc, but fails w/musl only
+    rm test/CodeGen/AArch64/wineh4.mir
+  '' + optionalString stdenv.hostPlatform.isAarch32 ''
+    # skip failing X86 test cases on 32-bit ARM
+    rm test/DebugInfo/X86/convert-debugloc.ll
+    rm test/DebugInfo/X86/convert-inlined.ll
+    rm test/DebugInfo/X86/convert-linked.ll
+    rm test/tools/dsymutil/X86/op-convert.test
+    rm test/tools/gold/X86/split-dwarf.ll
+    rm test/tools/llvm-dwarfdump/X86/prettyprint_types.s
+    rm test/tools/llvm-dwarfdump/X86/simplified-template-names.s
+
+    # !!! Note: these tests are removed in LLVM 16.
+    #
+    # See here for context: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999790443
+    rm test/CodeGen/RISCV/rv32zbp.ll
+    rm test/CodeGen/RISCV/rv64zbp.ll
+  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
+    # Seems to require certain floating point hardware (NEON?)
+    rm test/ExecutionEngine/frem.ll
+  '' + ''
+    patchShebangs test/BugPoint/compile-custom.ll.py
+  '';
+
+  preConfigure = ''
+    # Workaround for configure flags that need to have spaces
+    cmakeFlagsArray+=(
+      -DLLVM_LIT_ARGS="-svj''${NIX_BUILD_CORES} --no-progress-bar"
+    )
+  '';
+
+  # Defensive check: some paths (that we make symlinks to) depend on the release
+  # version, for example:
+  #  - https://github.com/llvm/llvm-project/blob/406bde9a15136254f2b10d9ef3a42033b3cb1b16/clang/lib/Headers/CMakeLists.txt#L185
+  #
+  # So we want to sure that the version in the source matches the release
+  # version we were given.
+  #
+  # We do this check here, in the LLVM build, because it happens early.
+  postConfigure = let
+    v = lib.versions;
+    major = v.major release_version;
+    minor = v.minor release_version;
+    patch = v.patch release_version;
+  in ''
+    # $1: part, $2: expected
+    check_version() {
+      part="''${1^^}"
+      part="$(cat include/llvm/Config/llvm-config.h  | grep "#define LLVM_VERSION_''${part} " | cut -d' ' -f3)"
+
+      if [[ "$part" != "$2" ]]; then
+        echo >&2 \
+          "mismatch in the $1 version! we have version ${release_version}" \
+          "and expected the $1 version to be '$2'; the source has '$part' instead"
+        exit 3
+      fi
+    }
+
+    check_version major ${major}
+    check_version minor ${minor}
+    check_version patch ${patch}
+  '';
+
+  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
+  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
+
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/llvm"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
+    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
+    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
+    "-DLLVM_ENABLE_FFI=ON"
+    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_ENABLE_DUMP=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    "-DLLVM_LINK_LLVM_DYLIB=off"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
+  ] ++ optionals enableManpages [
+    "-DLLVM_BUILD_DOCS=ON"
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_OUTPUT_HTML=OFF"
+    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+  ] ++ optionals (!isDarwin) [
+    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
+  ] ++ optionals isDarwin [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DCAN_TARGET_i386=false"
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+    (
+      let
+        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
+        nativeBintools = nativeCC.bintools.bintools;
+        nativeToolchainFlags = [
+          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
+          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
+          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
+          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
+          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+        ];
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
+    )
+  ];
+
+  postInstall = ''
+    mkdir -p $python/share
+    mv $out/share/opt-viewer $python/share/opt-viewer
+    moveToOutput "bin/llvm-config*" "$dev"
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
+      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
+      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
+      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "'"$lib"'")'
+  ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
+  ''
+  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
+  '';
+
+  inherit doCheck;
+
+  checkTarget = "check-all";
+
+  # For the update script:
+  passthru.monorepoSrc = monorepoSrc;
+
+  requiredSystemFeatures = [ "big-parallel" ];
+  meta = llvm_meta // {
+    homepage = "https://llvm.org/";
+    description = "A collection of modular and reusable compiler and toolchain technologies";
+    longDescription = ''
+      The LLVM Project is a collection of modular and reusable compiler and
+      toolchain technologies. Despite its name, LLVM has little to do with
+      traditional virtual machines. The name "LLVM" itself is not an acronym; it
+      is the full name of the project.
+      LLVM began as a research project at the University of Illinois, with the
+      goal of providing a modern, SSA-based compilation strategy capable of
+      supporting both static and dynamic compilation of arbitrary programming
+      languages. Since then, LLVM has grown to be an umbrella project consisting
+      of a number of subprojects, many of which are being used in production by
+      a wide variety of commercial and open source projects as well as being
+      widely used in academic research. Code in the LLVM project is licensed
+      under the "Apache 2.0 License with LLVM exceptions".
+    '';
+  };
+} // lib.optionalAttrs enableManpages {
+  pname = "llvm-manpages";
+
+  propagatedBuildInputs = [];
+
+  ninjaFlags = [ "docs-llvm-man" ];
+  installTargets = [ "install-docs-llvm-man" ];
+
+  postPatch = null;
+  postInstall = null;
+
+  outputs = [ "out" ];
+
+  doCheck = false;
+
+  meta = llvm_meta // {
+    description = "man pages for LLVM ${version}";
+  };
+})
diff --git a/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs-polly.patch b/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs-polly.patch
new file mode 100644
index 00000000000..b01363e98aa
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs-polly.patch
@@ -0,0 +1,19 @@
+This is the one remaining Polly install dirs related change that hasn't made it
+into upstream yet; previously this patch file also included:
+https://reviews.llvm.org/D117541
+
+diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macros.cmake
+index 518a09b45a42..bd9d6f5542ad 100644
+--- a/tools/polly/cmake/polly_macros.cmake
++++ b/tools/polly/cmake/polly_macros.cmake
+@@ -44,8 +44,8 @@ macro(add_polly_library name)
+   if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY OR ${name} STREQUAL "LLVMPolly")
+     install(TARGETS ${name}
+       EXPORT LLVMExports
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
++	  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
++      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+   endif()
+   set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
+ endmacro(add_polly_library)
diff --git a/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs.patch
new file mode 100644
index 00000000000..0ef317af8cc
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/gnu-install-dirs.patch
@@ -0,0 +1,138 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 45399dc0537e..5d946e9e6583 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -942,7 +942,7 @@ if (NOT TENSORFLOW_AOT_PATH STREQUAL "")
+   add_subdirectory(${TENSORFLOW_AOT_PATH}/xla_aot_runtime_src
+     ${CMAKE_ARCHIVE_OUTPUT_DIRECTORY}/tf_runtime)
+   install(TARGETS tf_xla_runtime EXPORT LLVMExports
+-    ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT tf_xla_runtime)
++    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX} COMPONENT tf_xla_runtime)
+   set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS tf_xla_runtime)
+   # Once we add more modules, we should handle this more automatically.
+   if (DEFINED LLVM_OVERRIDE_MODEL_HEADER_INLINERSIZEMODEL)
+diff --git a/cmake/modules/AddLLVM.cmake b/cmake/modules/AddLLVM.cmake
+index 057431208322..56f0dcb258da 100644
+--- a/cmake/modules/AddLLVM.cmake
++++ b/cmake/modules/AddLLVM.cmake
+@@ -844,8 +844,8 @@ macro(add_llvm_library name)
+       get_target_export_arg(${name} LLVM export_to_llvmexports ${umbrella})
+       install(TARGETS ${name}
+               ${export_to_llvmexports}
+-              LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
+-              ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX} COMPONENT ${name}
++              LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" COMPONENT ${name}
++              ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" COMPONENT ${name}
+               RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT ${name})
+ 
+       if (NOT LLVM_ENABLE_IDE)
+@@ -2007,7 +2007,7 @@ function(llvm_install_library_symlink name dest type)
+   set(full_name ${CMAKE_${type}_LIBRARY_PREFIX}${name}${CMAKE_${type}_LIBRARY_SUFFIX})
+   set(full_dest ${CMAKE_${type}_LIBRARY_PREFIX}${dest}${CMAKE_${type}_LIBRARY_SUFFIX})
+ 
+-  set(output_dir lib${LLVM_LIBDIR_SUFFIX})
++  set(output_dir ${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+   if(WIN32 AND "${type}" STREQUAL "SHARED")
+     set(output_dir "${CMAKE_INSTALL_BINDIR}")
+   endif()
+@@ -2271,15 +2271,15 @@ function(llvm_setup_rpath name)
+ 
+   if (APPLE)
+     set(_install_name_dir INSTALL_NAME_DIR "@rpath")
+-    set(_install_rpath "@loader_path/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_install_rpath "@loader_path/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+   elseif(${CMAKE_SYSTEM_NAME} MATCHES "AIX" AND BUILD_SHARED_LIBS)
+     # $ORIGIN is not interpreted at link time by aix ld.
+     # Since BUILD_SHARED_LIBS is only recommended for use by developers,
+     # hardcode the rpath to build/install lib dir first in this mode.
+     # FIXME: update this when there is better solution.
+-    set(_install_rpath "${LLVM_LIBRARY_OUTPUT_INTDIR}" "${CMAKE_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_install_rpath "${LLVM_LIBRARY_OUTPUT_INTDIR}" "${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+   elseif(UNIX)
+-    set(_install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_install_rpath "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+     if(${CMAKE_SYSTEM_NAME} MATCHES "(FreeBSD|DragonFly)")
+       set_property(TARGET ${name} APPEND_STRING PROPERTY
+                    LINK_FLAGS " -Wl,-z,origin ")
+diff --git a/cmake/modules/AddOCaml.cmake b/cmake/modules/AddOCaml.cmake
+index 891c9e6d618c..8d963f3b0069 100644
+--- a/cmake/modules/AddOCaml.cmake
++++ b/cmake/modules/AddOCaml.cmake
+@@ -147,9 +147,9 @@ function(add_ocaml_library name)
+   endforeach()
+ 
+   if( APPLE )
+-    set(ocaml_rpath "@executable_path/../../../lib${LLVM_LIBDIR_SUFFIX}")
++    set(ocaml_rpath "@executable_path/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+   elseif( UNIX )
+-    set(ocaml_rpath "\\$ORIGIN/../../../lib${LLVM_LIBDIR_SUFFIX}")
++    set(ocaml_rpath "\\$ORIGIN/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+   endif()
+   list(APPEND ocaml_flags "-ldopt" "-Wl,-rpath,${ocaml_rpath}")
+ 
+diff --git a/cmake/modules/CMakeLists.txt b/cmake/modules/CMakeLists.txt
+index d4b0ab959148..26ed981fd09f 100644
+--- a/cmake/modules/CMakeLists.txt
++++ b/cmake/modules/CMakeLists.txt
+@@ -128,7 +128,7 @@ set(LLVM_CONFIG_INCLUDE_DIRS
+   )
+ list(REMOVE_DUPLICATES LLVM_CONFIG_INCLUDE_DIRS)
+ 
+-extend_path(LLVM_CONFIG_LIBRARY_DIR "\${LLVM_INSTALL_PREFIX}" "lib\${LLVM_LIBDIR_SUFFIX}")
++extend_path(LLVM_CONFIG_LIBRARY_DIR "\${LLVM_INSTALL_PREFIX}" "${CMAKE_INSTALL_LIBDIR}\${LLVM_LIBDIR_SUFFIX}")
+ set(LLVM_CONFIG_LIBRARY_DIRS
+   "${LLVM_CONFIG_LIBRARY_DIR}"
+   # FIXME: Should there be other entries here?
+diff --git a/docs/CMake.rst b/docs/CMake.rst
+index 879b7b231d4c..9c31d14e8950 100644
+--- a/docs/CMake.rst
++++ b/docs/CMake.rst
+@@ -250,7 +250,7 @@ description is in `LLVM-related variables`_ below.
+ **LLVM_LIBDIR_SUFFIX**:STRING
+   Extra suffix to append to the directory where libraries are to be
+   installed. On a 64-bit architecture, one could use ``-DLLVM_LIBDIR_SUFFIX=64``
+-  to install libraries to ``/usr/lib64``.
++  to install libraries to ``/usr/lib64``. See also ``CMAKE_INSTALL_LIBDIR``.
+ 
+ **LLVM_PARALLEL_{COMPILE,LINK}_JOBS**:STRING
+   Building the llvm toolchain can use a lot of resources, particularly
+@@ -284,6 +284,10 @@ manual, or execute ``cmake --help-variable VARIABLE_NAME``.
+   The path to install executables, relative to the *CMAKE_INSTALL_PREFIX*.
+   Defaults to "bin".
+ 
++**CMAKE_INSTALL_LIBDIR**:PATH
++  The path to install libraries, relative to the *CMAKE_INSTALL_PREFIX*.
++  Defaults to "lib".
++
+ **CMAKE_INSTALL_INCLUDEDIR**:PATH
+   The path to install header files, relative to the *CMAKE_INSTALL_PREFIX*.
+   Defaults to "include".
+diff --git a/tools/llvm-config/BuildVariables.inc.in b/tools/llvm-config/BuildVariables.inc.in
+index 370005cd8d7d..7e790bc52111 100644
+--- a/tools/llvm-config/BuildVariables.inc.in
++++ b/tools/llvm-config/BuildVariables.inc.in
+@@ -23,6 +23,7 @@
+ #define LLVM_CXXFLAGS "@LLVM_CXXFLAGS@"
+ #define LLVM_BUILDMODE "@LLVM_BUILDMODE@"
+ #define LLVM_LIBDIR_SUFFIX "@LLVM_LIBDIR_SUFFIX@"
++#define LLVM_INSTALL_LIBDIR "@CMAKE_INSTALL_LIBDIR@"
+ #define LLVM_INSTALL_INCLUDEDIR "@CMAKE_INSTALL_INCLUDEDIR@"
+ #define LLVM_INSTALL_PACKAGE_DIR "@LLVM_INSTALL_PACKAGE_DIR@"
+ #define LLVM_TARGETS_BUILT "@LLVM_TARGETS_BUILT@"
+diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
+index 2c6c55f89d38..f6d2068a0827 100644
+--- a/tools/llvm-config/llvm-config.cpp
++++ b/tools/llvm-config/llvm-config.cpp
+@@ -369,7 +369,11 @@ int main(int argc, char **argv) {
+       sys::fs::make_absolute(ActivePrefix, Path);
+       ActiveBinDir = std::string(Path.str());
+     }
+-    ActiveLibDir = ActivePrefix + "/lib" + LLVM_LIBDIR_SUFFIX;
++    {
++      SmallString<256> Path(LLVM_INSTALL_LIBDIR LLVM_LIBDIR_SUFFIX);
++      sys::fs::make_absolute(ActivePrefix, Path);
++      ActiveLibDir = std::string(Path.str());
++    }
+     {
+       SmallString<256> Path(LLVM_INSTALL_PACKAGE_DIR);
+       sys::fs::make_absolute(ActivePrefix, Path);
diff --git a/pkgs/development/compilers/llvm/15/llvm/lit-shell-script-runner-set-dyld-library-path.patch b/pkgs/development/compilers/llvm/15/llvm/lit-shell-script-runner-set-dyld-library-path.patch
new file mode 100644
index 00000000000..32f1d13a9dc
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/lit-shell-script-runner-set-dyld-library-path.patch
@@ -0,0 +1,26 @@
+diff --git a/utils/lit/lit/TestRunner.py b/utils/lit/lit/TestRunner.py
+index 0242e0b75af3..d732011306f7 100644
+--- a/utils/lit/lit/TestRunner.py
++++ b/utils/lit/lit/TestRunner.py
+@@ -1029,6 +1029,12 @@ def executeScript(test, litConfig, tmpBase, commands, cwd):
+             f.write('@echo off\n')
+         f.write('\n@if %ERRORLEVEL% NEQ 0 EXIT\n'.join(commands))
+     else:
++        # This env var is *purged* when invoking subprocesses so we have to
++        # manually set it from within the bash script in order for the commands
++        # in run lines to see this var:
++        if "DYLD_LIBRARY_PATH" in test.config.environment:
++            f.write(f'export DYLD_LIBRARY_PATH="{test.config.environment["DYLD_LIBRARY_PATH"]}"\n')
++
+         for i, ln in enumerate(commands):
+             match = re.match(kPdbgRegex, ln)
+             if match:
+@@ -1363,7 +1369,7 @@ def applySubstitutions(script, substitutions, conditions={},
+         return processed
+ 
+     process = processLine if recursion_limit is None else processLineToFixedPoint
+-    
++
+     return [unescapePercents(process(ln)) for ln in script]
+ 
+ 
diff --git a/pkgs/development/compilers/llvm/15/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch b/pkgs/development/compilers/llvm/15/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
new file mode 100644
index 00000000000..d824516c0a1
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
@@ -0,0 +1,79 @@
+diff --git a/test/Unit/lit.cfg.py b/test/Unit/lit.cfg.py
+index 81e8dc04acea..479ff95681e2 100644
+--- a/test/Unit/lit.cfg.py
++++ b/test/Unit/lit.cfg.py
+@@ -3,6 +3,7 @@
+ # Configuration file for the 'lit' test runner.
+ 
+ import os
++import platform
+ import subprocess
+ 
+ import lit.formats
+@@ -55,3 +56,26 @@ if sys.platform in ['win32', 'cygwin'] and os.path.isdir(config.shlibdir):
+ # Win32 may use %SYSTEMDRIVE% during file system shell operations, so propogate.
+ if sys.platform == 'win32' and 'SYSTEMDRIVE' in os.environ:
+     config.environment['SYSTEMDRIVE'] = os.environ['SYSTEMDRIVE']
++
++# Add the LLVM dynamic libs to the platform-specific loader search path env var:
++#
++# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
++def find_shlibpath_var():
++    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
++        yield 'LD_LIBRARY_PATH'
++    elif platform.system() == 'Darwin':
++        yield 'DYLD_LIBRARY_PATH'
++    elif platform.system() == 'Windows':
++        yield 'PATH'
++    elif platform.system() == 'AIX':
++        yield 'LIBPATH'
++
++for shlibpath_var in find_shlibpath_var():
++    shlibpath = os.path.pathsep.join(
++        (config.shlibdir,
++         config.environment.get(shlibpath_var, '')))
++    config.environment[shlibpath_var] = shlibpath
++    break
++else:
++    lit_config.warning("unable to inject shared library path on '{}'"
++                       .format(platform.system()))
+diff --git a/test/lit.cfg.py b/test/lit.cfg.py
+index 75a38b4c5dad..856fc75c9d74 100644
+--- a/test/lit.cfg.py
++++ b/test/lit.cfg.py
+@@ -42,6 +42,26 @@ llvm_config.with_environment('PATH', config.llvm_tools_dir, append_path=True)
+ llvm_config.with_system_environment(
+     ['HOME', 'INCLUDE', 'LIB', 'TMP', 'TEMP'])
+ 
++# Add the LLVM dynamic libs to the platform-specific loader search path env var:
++#
++# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
++def find_shlibpath_var():
++    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
++        yield 'LD_LIBRARY_PATH'
++    elif platform.system() == 'Darwin':
++        yield 'DYLD_LIBRARY_PATH'
++    elif platform.system() == 'Windows':
++        yield 'PATH'
++    elif platform.system() == 'AIX':
++        yield 'LIBPATH'
++
++for shlibpath_var in find_shlibpath_var():
++    shlibpath = config.llvm_shlib_dir
++    llvm_config.with_environment(shlibpath_var, shlibpath, append_path = True)
++    break
++else:
++    lit_config.warning("unable to inject shared library path on '{}'"
++                       .format(platform.system()))
+ 
+ # Set up OCAMLPATH to include newly built OCaml libraries.
+ top_ocaml_lib = os.path.join(config.llvm_lib_dir, 'ocaml')
+@@ -318,7 +338,7 @@ def have_cxx_shared_library():
+ 
+     try:
+         readobj_cmd = subprocess.Popen(
+-            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE)
++            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE, env=config.environment)
+     except OSError:
+         print('could not exec llvm-readobj')
+         return False
diff --git a/pkgs/development/compilers/llvm/15/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch b/pkgs/development/compilers/llvm/15/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
new file mode 100644
index 00000000000..1354ad26731
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
@@ -0,0 +1,24 @@
+diff --git a/tools/polly/test/lit.cfg b/tools/polly/test/lit.cfg
+index 41e3a589c61e..09f3b17498b0 100644
+--- a/tools/polly/test/lit.cfg
++++ b/tools/polly/test/lit.cfg
+@@ -36,9 +36,17 @@ base_paths = [config.llvm_tools_dir, config.environment['PATH']]
+ path = os.path.pathsep.join(base_paths + config.extra_paths)
+ config.environment['PATH'] = path
+ 
++# (Copied from polly/test/Unit/lit.cfg)
++if platform.system() == 'Darwin':
++    shlibpath_var = 'DYLD_LIBRARY_PATH'
++elif platform.system() == 'Windows':
++    shlibpath_var = 'PATH'
++else:
++    shlibpath_var = 'LD_LIBRARY_PATH'
++
+ path = os.path.pathsep.join((config.llvm_libs_dir,
+-                              config.environment.get('LD_LIBRARY_PATH','')))
+-config.environment['LD_LIBRARY_PATH'] = path
++                              config.environment.get(shlibpath_var,'')))
++config.environment[shlibpath_var] = path
+ 
+ llvm_config.use_default_substitutions()
+ 
diff --git a/pkgs/development/compilers/llvm/15/openmp/default.nix b/pkgs/development/compilers/llvm/15/openmp/default.nix
new file mode 100644
index 00000000000..8047cb1122d
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/openmp/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, llvm_meta
+, monorepoSrc
+, runCommand
+, cmake
+, ninja
+, llvm
+, targetLlvm
+, lit
+, clang-unwrapped
+, perl
+, pkg-config
+, xcbuild
+, version
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openmp";
+  inherit version;
+
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+  '';
+
+  sourceRoot = "${src.name}/${pname}";
+
+  patches = [
+    ./fix-find-tool.patch
+    ./gnu-install-dirs.patch
+    ./run-lit-directly.patch
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ cmake ninja perl pkg-config lit ];
+  buildInputs = [
+    (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
+  ];
+
+  nativeCheckInputs = lib.optional stdenv.hostPlatform.isDarwin xcbuild.xcrun;
+
+  # Unsup:Pass:XFail:Fail
+  # 26:267:16:8
+  doCheck = false;
+  checkTarget = "check-openmp";
+
+  preCheck = ''
+    patchShebangs ../tools/archer/tests/deflake.bash
+  '';
+
+  cmakeFlags = [
+    "-DCLANG_TOOL=${clang-unwrapped}/bin/clang"
+    "-DOPT_TOOL=${llvm}/bin/opt"
+    "-DLINK_TOOL=${llvm}/bin/llvm-link"
+  ];
+
+  meta = llvm_meta // {
+    homepage = "https://openmp.llvm.org/";
+    description = "Support for the OpenMP language";
+    longDescription = ''
+      The OpenMP subproject of LLVM contains the components required to build an
+      executable OpenMP program that are outside the compiler itself.
+      Contains the code for the runtime library against which code compiled by
+      "clang -fopenmp" must be linked before it can run and the library that
+      supports offload to target devices.
+    '';
+  };
+}
diff --git a/pkgs/development/compilers/llvm/15/openmp/fix-find-tool.patch b/pkgs/development/compilers/llvm/15/openmp/fix-find-tool.patch
new file mode 100644
index 00000000000..103b054ed17
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/openmp/fix-find-tool.patch
@@ -0,0 +1,18 @@
+diff --git a/libomptarget/DeviceRTL/CMakeLists.txt b/libomptarget/DeviceRTL/CMakeLists.txt
+index ce66214822a2..6ab7b33c95da 100644
+--- a/libomptarget/DeviceRTL/CMakeLists.txt
++++ b/libomptarget/DeviceRTL/CMakeLists.txt
+@@ -27,10 +27,10 @@ endif()
+ if (LLVM_DIR)
+   # Builds that use pre-installed LLVM have LLVM_DIR set.
+   # A standalone or LLVM_ENABLE_RUNTIMES=openmp build takes this route
+-  find_program(CLANG_TOOL clang PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH)
++  find_program(CLANG_TOOL clang PATHS ${LLVM_TOOLS_BINARY_DIR})
+   find_program(LINK_TOOL llvm-link PATHS ${LLVM_TOOLS_BINARY_DIR}
+-    NO_DEFAULT_PATH)
+-  find_program(OPT_TOOL opt PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH)
++    )
++  find_program(OPT_TOOL opt PATHS ${LLVM_TOOLS_BINARY_DIR})
+   if ((NOT CLANG_TOOL) OR (NOT LINK_TOOL) OR (NOT OPT_TOOL))
+     libomptarget_say("Not building DeviceRTL. Missing clang: ${CLANG_TOOL}, llvm-link: ${LINK_TOOL} or opt: ${OPT_TOOL}")
+     return()
diff --git a/pkgs/development/compilers/llvm/15/openmp/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/15/openmp/gnu-install-dirs.patch
new file mode 100644
index 00000000000..77a93208832
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/openmp/gnu-install-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b6ddbe90516d..311ab1d50e7f 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -29,7 +29,7 @@ if (OPENMP_STANDALONE_BUILD)
+   set(OPENMP_LIBDIR_SUFFIX "" CACHE STRING
+     "Suffix of lib installation directory, e.g. 64 => lib64")
+   # Do not use OPENMP_LIBDIR_SUFFIX directly, use OPENMP_INSTALL_LIBDIR.
+-  set(OPENMP_INSTALL_LIBDIR "lib${OPENMP_LIBDIR_SUFFIX}")
++  set(OPENMP_INSTALL_LIBDIR "${CMAKE_INSTALL_LIBDIR}${OPENMP_LIBDIR_SUFFIX}")
+ 
+   # Group test settings.
+   set(OPENMP_TEST_C_COMPILER ${CMAKE_C_COMPILER} CACHE STRING
+@@ -40,7 +40,7 @@ if (OPENMP_STANDALONE_BUILD)
+ else()
+   set(OPENMP_ENABLE_WERROR ${LLVM_ENABLE_WERROR})
+   # If building in tree, we honor the same install suffix LLVM uses.
+-  set(OPENMP_INSTALL_LIBDIR "lib${LLVM_LIBDIR_SUFFIX}")
++  set(OPENMP_INSTALL_LIBDIR "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+ 
+   if (NOT MSVC)
+     set(OPENMP_TEST_C_COMPILER ${LLVM_RUNTIME_OUTPUT_INTDIR}/clang)
diff --git a/pkgs/development/compilers/llvm/15/openmp/run-lit-directly.patch b/pkgs/development/compilers/llvm/15/openmp/run-lit-directly.patch
new file mode 100644
index 00000000000..1e952fdc36a
--- /dev/null
+++ b/pkgs/development/compilers/llvm/15/openmp/run-lit-directly.patch
@@ -0,0 +1,12 @@
+diff --git a/cmake/OpenMPTesting.cmake b/cmake/OpenMPTesting.cmake
+--- a/cmake/OpenMPTesting.cmake
++++ b/cmake/OpenMPTesting.cmake
+@@ -185,7 +185,7 @@ function(add_openmp_testsuite target comment)
+   if (${OPENMP_STANDALONE_BUILD})
+     set(LIT_ARGS ${OPENMP_LIT_ARGS} ${ARG_ARGS})
+     add_custom_target(${target}
+-      COMMAND ${PYTHON_EXECUTABLE} ${OPENMP_LLVM_LIT_EXECUTABLE} ${LIT_ARGS} ${ARG_UNPARSED_ARGUMENTS}
++      COMMAND ${OPENMP_LLVM_LIT_EXECUTABLE} ${LIT_ARGS} ${ARG_UNPARSED_ARGUMENTS}
+       COMMENT ${comment}
+       DEPENDS ${ARG_DEPENDS}
+       USES_TERMINAL
diff --git a/pkgs/development/libraries/gusb/default.nix b/pkgs/development/libraries/gusb/default.nix
index af24e46efe2..4d6546f0e5b 100644
--- a/pkgs/development/libraries/gusb/default.nix
+++ b/pkgs/development/libraries/gusb/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, substituteAll, meson, ninja, pkg-config, gettext, gobject-introspection
 , gtk-doc, docbook_xsl, docbook_xml_dtd_412, docbook_xml_dtd_44, python3
-, glib, systemd, libusb1, vala, hwdata
+, glib, libusb1, vala, hwdata
 }:
 
 let
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     gtk-doc docbook_xsl docbook_xml_dtd_412 docbook_xml_dtd_44
     gobject-introspection vala
   ];
-  buildInputs = [ systemd glib ];
+  buildInputs = [ glib ];
 
   propagatedBuildInputs = [ libusb1 ];
 
diff --git a/pkgs/development/libraries/tepl/default.nix b/pkgs/development/libraries/tepl/default.nix
index 259d5964655..3b228b6c625 100644
--- a/pkgs/development/libraries/tepl/default.nix
+++ b/pkgs/development/libraries/tepl/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tepl";
-  version = "6.2.0";
+  version = "6.4.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "jNaGXCw4GIdgyzjK4z3J4KiI+tGNCwTx1V5laqmJqEQ=";
+    sha256 = "XlayBmnQzwX6HWS1jIw0LFkVgSLcUYEA0JPVnfm4cyE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/mdx/default.nix b/pkgs/development/ocaml-modules/mdx/default.nix
index 19cd08af85f..4affea99510 100644
--- a/pkgs/development/ocaml-modules/mdx/default.nix
+++ b/pkgs/development/ocaml-modules/mdx/default.nix
@@ -1,30 +1,26 @@
-{ lib, fetchFromGitHub, buildDunePackage, ocaml
+{ lib, fetchurl, buildDunePackage, ocaml
 , alcotest
-, astring, cmdliner, cppo, fmt, logs, ocaml-version, odoc-parser, ocaml_lwt, re, result, csexp
-, pandoc
+, astring, cppo, fmt, logs, ocaml-version, odoc-parser, lwt, re, csexp
 , gitUpdater
 }:
 
 buildDunePackage rec {
   pname = "mdx";
-  version = "2.1.0";
+  version = "2.2.1";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
-  src = fetchFromGitHub {
-    owner = "realworldocaml";
-    repo = pname;
-    rev = version;
-    hash = "sha256-p7jmksltgfLFTSkPxMuJWJexLq2VvPWT/DJtDveOL/A=";
+  src = fetchurl {
+    url = "https://github.com/realworldocaml/mdx/releases/download/${version}/mdx-${version}.tbz";
+    hash = "sha256-8J7XM/5EYWBfApdzdIpjU9Ablb5l65hrzOF9bdr1Cdg=";
   };
 
   nativeBuildInputs = [ cppo ];
-  buildInputs = [ cmdliner ];
-  propagatedBuildInputs = [ astring fmt logs result csexp ocaml-version odoc-parser re ];
-  nativeCheckInputs = [ alcotest ocaml_lwt pandoc ];
+  propagatedBuildInputs = [ astring fmt logs csexp ocaml-version odoc-parser re ];
+  nativeCheckInputs = [ alcotest lwt ];
 
-  # Check fails with cmdliner β‰₯ 1.1
-  doCheck = false;
+  doCheck = true;
 
   outputs = [ "bin" "lib" "out" ];
 
diff --git a/pkgs/development/python-modules/aladdin-connect/default.nix b/pkgs/development/python-modules/aladdin-connect/default.nix
index ca6c6cca963..3ca8016cd76 100644
--- a/pkgs/development/python-modules/aladdin-connect/default.nix
+++ b/pkgs/development/python-modules/aladdin-connect/default.nix
@@ -2,17 +2,21 @@
 , requests
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "aladdin-connect";
   version = "0.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "shoejosh";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-kLvMpSGa5WyDOH3ejAJyFGsB9IiMXp+nvVxM/ZkxyFw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-kLvMpSGa5WyDOH3ejAJyFGsB9IiMXp+nvVxM/ZkxyFw=";
   };
 
   propagatedBuildInputs = [
@@ -22,11 +26,14 @@ buildPythonPackage rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "aladdin_connect" ];
+  pythonImportsCheck = [
+    "aladdin_connect"
+  ];
 
   meta = with lib; {
     description = "Python library for interacting with Genie Aladdin Connect devices";
     homepage = "https://github.com/shoejosh/aladdin-connect";
+    changelog = "https://github.com/shoejosh/aladdin-connect/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/cvss/default.nix b/pkgs/development/python-modules/cvss/default.nix
index e9d42e4535f..9f4979c5326 100644
--- a/pkgs/development/python-modules/cvss/default.nix
+++ b/pkgs/development/python-modules/cvss/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "cvss";
-  version = "2.5";
+  version = "2.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "RedHatProductSecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-6S646cvm+UwdpRGOtCuNijWcUxhZD6IG407hNBz+NA4=";
+    sha256 = "sha256-gD9MreJQPaxziy02Wt3BGFiIoQ/+pW3KqiNfNlTijJY=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/datasette-publish-fly/default.nix b/pkgs/development/python-modules/datasette-publish-fly/default.nix
index 0ca0bec0839..521b408b524 100644
--- a/pkgs/development/python-modules/datasette-publish-fly/default.nix
+++ b/pkgs/development/python-modules/datasette-publish-fly/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "datasette-publish-fly";
-  version = "1.2";
+  version = "1.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "simonw";
     repo = pname;
-    rev = version;
-    hash = "sha256-0frP/RkpZX6LCR8cOlzcBG3pbcOh0KPuELlYUXS3dRE=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-L94QYcrTWjuoz0aEFTxPi8Xg0xERP1zCs7+vzhoJagc=";
   };
 
   propagatedBuildInputs = [
@@ -39,6 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Datasette plugin for publishing data using Fly";
     homepage = "https://datasette.io/plugins/datasette-publish-fly";
+    changelog = "https://github.com/simonw/datasette-publish-fly/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/django-tastypie/default.nix b/pkgs/development/python-modules/django-tastypie/default.nix
index a6c184e2d67..8056aca7100 100644
--- a/pkgs/development/python-modules/django-tastypie/default.nix
+++ b/pkgs/development/python-modules/django-tastypie/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "django-tastypie";
-  version = "0.14.4";
+  version = "0.14.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "django-tastypie";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-O/aVi8BshOZmg9WQxrFlBEOXfgyqJKVK/QlEFG3Edqs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RgYinpo8eVzRaSkcnFkSq+IqpcFt6LCCHkpHyB/7u5M=";
   };
 
   propagatedBuildInputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Utilities and helpers for writing Pylint plugins";
     homepage = "https://github.com/django-tastypie/django-tastypie";
+    changelog = "https://github.com/django-tastypie/django-tastypie/releases/tag/v${version}";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index 1ba9a973774..687fe8e58e6 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "intake";
-  version = "0.6.5";
+  version = "0.6.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -34,8 +34,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    hash = "sha256-ABMXWUVptpOSPB1jQ57iXk/UG92puNCICzXo3ZMG2Pk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-/VQKLmEpIOULTPpJKuVLyqqQVLKVhwVBoos9Q/upwQM=";
   };
 
   propagatedBuildInputs = [
@@ -98,6 +98,7 @@ buildPythonPackage rec {
     "test_read_pattern"
     "test_remote_arr"
     "test_remote_cat"
+    "test_remote_env"
     # ValueError
     "test_mlist_parameter"
     # ImportError
@@ -118,6 +119,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Data load and catalog system";
     homepage = "https://github.com/ContinuumIO/intake";
+    changelog = "https://github.com/intake/intake/blob/${version}/docs/source/changelog.rst";
     license = licenses.bsd2;
     maintainers = with maintainers; [ costrouc ];
   };
diff --git a/pkgs/development/python-modules/loguru/default.nix b/pkgs/development/python-modules/loguru/default.nix
index 70476a4b890..f89741e527a 100644
--- a/pkgs/development/python-modules/loguru/default.nix
+++ b/pkgs/development/python-modules/loguru/default.nix
@@ -4,31 +4,29 @@
 , buildPythonPackage
 , colorama
 , fetchpatch
-, fetchPypi
+, fetchFromGitHub
+, freezegun
+, mypy
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "loguru";
-  version = "0.6.0";
+  # No release since Jan 2022, only master is compatible with Python 3.11
+  # https://github.com/Delgan/loguru/issues/740
+  version = "unstable-2023-01-20";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-BmvQZ1jQpRPpg2/ZxrWnW/s/02hB9LmWvGC1R6MJ1Bw=";
+  src = fetchFromGitHub {
+    owner = "Delgan";
+    repo = pname;
+    rev = "07f94f3c8373733119f85aa8b9ca05ace3325a4b";
+    hash = "sha256-lMGyQbBX3z6186ojs/iew7JMrG91ivPA679T9r+7xYw=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-test-repr-infinite-recursion.patch";
-      url = "https://github.com/Delgan/loguru/commit/4fe21f66991abeb1905e24c3bc3c634543d959a2.patch";
-      hash = "sha256-NUOkgUS28TOazO0txMinFtaKwsi/J1Y7kqjjvMRCnR8=";
-    })
-  ];
-
   propagatedBuildInputs = lib.optionals (pythonOlder "3.7") [
     aiocontextvars
   ];
@@ -36,19 +34,15 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     colorama
+    freezegun
+    mypy
   ];
 
   disabledTestPaths = lib.optionals stdenv.isDarwin [
     "tests/test_multiprocessing.py"
   ];
 
-  disabledTests = [
-    "test_time_rotation_reopening"
-    "test_file_buffering"
-    # Tests are failing with Python 3.10
-    "test_exception_others"
-    ""
-  ] ++ lib.optionals stdenv.isDarwin [
+  disabledTests = lib.optionals stdenv.isDarwin [
     "test_rotation_and_retention"
     "test_rotation_and_retention_timed_file"
     "test_renaming"
diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index 8156764dee4..d6d67cd7633 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -1,13 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
 , msgpack
-, pytestCheckHook
 , numpy
 , pandas
 , pydantic
 , pymongo
+, pytestCheckHook
+, pythonOlder
 , ruamel-yaml
 , tqdm
 }:
@@ -15,13 +15,15 @@
 buildPythonPackage rec {
   pname = "monty";
   version = "2022.9.9";
-  disabled = pythonOlder "3.5"; # uses type annotations
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "materialsvirtuallab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-7ToNiRSWxe9nNcaWWmS6bhVqWMEwXN4uiwtjAmuK5qw=";
+    hash = "sha256-7ToNiRSWxe9nNcaWWmS6bhVqWMEwXN4uiwtjAmuK5qw=";
   };
 
   postPatch = ''
@@ -30,17 +32,29 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
+    msgpack
     ruamel-yaml
     tqdm
-    msgpack
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     numpy
     pandas
     pydantic
     pymongo
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "monty"
+  ];
+
+  disabledTests = [
+    # Test file was removed and re-added after 2022.9.9
+    "test_reverse_readfile_gz"
+    "test_Path_objects"
+    "test_zopen"
+    "test_zpath"
   ];
 
   meta = with lib; {
@@ -51,6 +65,7 @@ buildPythonPackage rec {
       patterns such as singleton and cached_class, and many more.
     ";
     homepage = "https://github.com/materialsvirtuallab/monty";
+    changelog = "https://github.com/materialsvirtuallab/monty/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ psyanticy ];
   };
diff --git a/pkgs/development/python-modules/neo4j/default.nix b/pkgs/development/python-modules/neo4j/default.nix
index ea3558ab0bd..5f7e3430cb0 100644
--- a/pkgs/development/python-modules/neo4j/default.nix
+++ b/pkgs/development/python-modules/neo4j/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j";
-  version = "5.4.0";
+  version = "5.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-emUz6DHnrDBOu9Wlhum7ntK3JIt94/05tuBAT2x4Bjs=";
+    hash = "sha256-K3ggXXDDdyPIcWL4eLo1HrpZB05tA9oYWpbOohcCF/w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/notify-py/default.nix b/pkgs/development/python-modules/notify-py/default.nix
index d2d21ab09b6..61c1c9026e0 100644
--- a/pkgs/development/python-modules/notify-py/default.nix
+++ b/pkgs/development/python-modules/notify-py/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "notify-py";
-  version = "0.3.39";
+  version = "0.3.42";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "ms7m";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-QIK5MCCOsD8SStoh7TRw+l9k28SjChwV2J/T7gMKnAs=";
+    hash = "sha256-XtjJImH9UwPPZS/Yqs8S5xGXOLBRmJRawzxWXoPWvrM=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 0e6a82bab6a..38e06d362d9 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "11.0.0";
+  version = "11.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XWJlhbpOyEuAmnjOCYDe0LEtWckwi38rZv6KBydFgfM=";
+    hash = "sha256-SU8vsKwZio/5UD2SMhLenfkBjXRuMZCPo2k6+1hx8Y4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 6b0b6db157b..30306842529 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.27.3";
+  version = "0.27.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JO9Gc7ZhWeQIheAwanzCBQFum1BUoh7K/exAEkWp/1U=";
+    hash = "sha256-Ti0ZQlWsZaGvpfCTUnGNzdKcqKO84fAtlIUWC0wiyTI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pylutron/default.nix b/pkgs/development/python-modules/pylutron/default.nix
index 4bf56d5e6ed..e3949861637 100644
--- a/pkgs/development/python-modules/pylutron/default.nix
+++ b/pkgs/development/python-modules/pylutron/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "pylutron";
-  version = "0.2.9";
+  version = "0.2.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-xy5XPNOrvdPZMCfa2MYA+xtUcFdGSurW5QYL6H7n2VI=";
+    sha256 = "sha256-DKwjBQXC7O/8bFxq5shJJxRV3HYgBeS7tJXg4m3vQMY=";
   };
 
   # Project has no tests
diff --git a/pkgs/development/python-modules/pyswitchbee/default.nix b/pkgs/development/python-modules/pyswitchbee/default.nix
index 4ee6f81ac31..978fc21ac92 100644
--- a/pkgs/development/python-modules/pyswitchbee/default.nix
+++ b/pkgs/development/python-modules/pyswitchbee/default.nix
@@ -1,4 +1,5 @@
 { lib
+, awesomeversion
 , buildPythonPackage
 , aiohttp
 , fetchFromGitHub
@@ -9,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbee";
-  version = "1.7.18";
+  version = "1.7.21";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +19,7 @@ buildPythonPackage rec {
     owner = "jafar-atili";
     repo = "pySwitchbee";
     rev = "refs/tags/${version}";
-    hash = "sha256-LQjtePFSMvZdAGH6f8CveaE7ASm/x9GuFj9s3TipYHQ=";
+    hash = "sha256-3Ujs9GgdJm69vb8F00ZWaRgWXxkaPguX5DJ71bqOFec=";
   };
 
   nativeBuildInputs = [
@@ -27,6 +28,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
+    awesomeversion
     packaging
   ];
 
diff --git a/pkgs/development/python-modules/pywerview/default.nix b/pkgs/development/python-modules/pywerview/default.nix
index 9dbb19738be..43543279efc 100644
--- a/pkgs/development/python-modules/pywerview/default.nix
+++ b/pkgs/development/python-modules/pywerview/default.nix
@@ -7,12 +7,13 @@
 , ldap3
 , lxml
 , pyasn1
+, pycryptodome
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pywerview";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "the-useless-one";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-nrPhyBHW13dkXFC5YJfrkiztAxMw4KuEif0zCdjQEq0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5/Cn70qQaUp38qko1Wq+gZMCcQtcAPtZwt7Zrx8MFc4=";
   };
 
   propagatedBuildInputs = [
@@ -30,18 +31,13 @@ buildPythonPackage rec {
     impacket
     ldap3
     lxml
+    pycryptodome
     pyasn1
   ];
 
   # Module has no tests
   doCheck = false;
 
-  postPatch = ''
-    # https://github.com/the-useless-one/pywerview/pull/51
-    substituteInPlace setup.py \
-      --replace "bs4" "beautifulsoup4"
-  '';
-
   pythonImportsCheck = [
     "pywerview"
   ];
@@ -49,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module for PowerSploit's PowerView support";
     homepage = "https://github.com/the-useless-one/pywerview";
+    changelog = "https://github.com/the-useless-one/pywerview/releases/tag/v${version}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix b/pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix
index ce5546566fd..1f4eb94fea5 100644
--- a/pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix
@@ -47,6 +47,5 @@ buildPythonPackage rec {
     longDescription = "Sphinx AutoAPI provides 'autodoc' style documentation for multiple programming languages without needing to load, run, or import the project being documented.";
     license = licenses.mit;
     maintainers = with maintainers; [ karolchmist ];
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/whois/default.nix b/pkgs/development/python-modules/whois/default.nix
index 7ec9251eb0e..7c8ce7492e1 100644
--- a/pkgs/development/python-modules/whois/default.nix
+++ b/pkgs/development/python-modules/whois/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "whois";
-  version = "0.9.24";
+  version = "0.9.25";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "DannyCork";
     repo = "python-whois";
     rev = "refs/tags/${version}";
-    hash = "sha256-DxjfRBJh/qLafxXN2VcXHTWuajDg6lvmJ5U86Na3L5g=";
+    hash = "sha256-h4s0cJbzc5uorT9yPtXIgVDwUExUe3cNMSHCWRhN1Q4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/yark/default.nix b/pkgs/development/python-modules/yark/default.nix
index c9be7901c14..c2ac28e64d9 100644
--- a/pkgs/development/python-modules/yark/default.nix
+++ b/pkgs/development/python-modules/yark/default.nix
@@ -1,26 +1,57 @@
-{ lib, buildPythonPackage, fetchPypi,
-  click, colorama, flask, requests, yt-dlp }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, poetry-core
+, pythonRelaxDepsHook
+, click
+, colorama
+, flask
+, requests
+, yt-dlp
+, progress
+}:
 
 buildPythonPackage rec {
   pname = "yark";
-  version = "1.2.3";
+  version = "1.2.4";
+
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KMnQpEH2Z19Y0jBjqx2rZjmlle2M9bcuDCjDIljQEYY=";
+    sha256 = "fdd50d0e832b4522cbe24433f42ed571a1f199f571c1d0c98472b94a501db9cf";
   };
 
+  pythonRelaxDeps = [
+    "requests"
+  ];
+
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
   propagatedBuildInputs = [
-    click colorama flask requests yt-dlp
+    click
+    colorama
+    flask
+    progress
+    requests
+    yt-dlp
   ];
 
   # There aren't any unit tests. If test discovery runs, it will crash, halting the build.
   # When upstream adds unit tests, please configure them here. Thanks! ~ C.
   doCheck = false;
 
+  pythonImportsCheck = [
+    "yark"
+  ];
+
   meta = with lib; {
     description = "YouTube archiving made simple";
     homepage = "https://github.com/Owez/yark";
     license = licenses.mit;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 071bb884237..79c7962865e 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.12.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tEeAr1QSec1Sayfg2/erk5u6wBZDodZIMYq9MaU7ATA=";
+    hash = "sha256-FEc83SVFCsGDrCg7IYmn8iZ6NozYFsIUJ3QORBYUdMI=";
   };
 
-  vendorHash = "sha256-FCAxqyacDdt3mR628/sguvrBx+nG10648XqF5hA8z+s=";
+  vendorHash = "sha256-Zmias6mJWYh+PCyBdnRlNyKIoFqEYJZNF19i559SGTI=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/cocogitto/default.nix b/pkgs/development/tools/cocogitto/default.nix
index af3a32bb9d6..e4217f06e22 100644
--- a/pkgs/development/tools/cocogitto/default.nix
+++ b/pkgs/development/tools/cocogitto/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cocogitto";
-  version = "5.3.0";
+  version = "5.3.1";
 
   src = fetchFromGitHub {
     owner = "oknozor";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BqyV4hJw7H9yN5Kj/XwhYS6hElXdKUJEUi5M/PNlPO0=";
+    sha256 = "sha256-Z0snC5NomUWzxI2qcRMxdZbC1aOQ8P2Ll9EdVfhP7ZU=";
   };
 
-  cargoHash = "sha256-MA3XW2tPn0qVx7ve+UqCoG4nQ7UyuvXEebrPuLKqS4g=";
+  cargoHash = "sha256-P/xwE3oLVsIoxPmG+S0htSHhZxCj79z2ARGe2WzWCEo=";
 
   # Test depend on git configuration that would likly exist in a normal user enviroment
   # and might be failing to create the test repository it works in.
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 929c76e7e2c..aee57689308 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -3,7 +3,7 @@
 , runCommand, pkg-config, meson, ninja, makeWrapper
 # build+runtime deps.
 , knot-dns, luajitPackages, libuv, gnutls, lmdb
-, systemd, libcap_ng, dns-root-data, nghttp2 # optionals, in principle
+, jemalloc, systemd, libcap_ng, dns-root-data, nghttp2 # optionals, in principle
 # test-only deps.
 , cmocka, which, cacert
 , extraFeatures ? false /* catch-all if defaults aren't enough */
@@ -17,11 +17,11 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.5.3";
+  version = "5.6.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "a38f57c68b7d237d662784d8406e6098aad66a148f44dcf498d1e9664c5fed2d";
+    sha256 = "0c82ae937b685dc477fb3176098e3dc106c898b7cd83553e5bc54dccb83c80d7";
   };
 
   outputs = [ "out" "dev" ];
@@ -63,7 +63,7 @@ unwrapped = stdenv.mkDerivation rec {
   # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
   buildInputs = [ knot-dns lua.lua libuv gnutls lmdb ]
     ++ optionals stdenv.isLinux [ /*lib*/systemd libcap_ng ]
-    ++ [ nghttp2 ]
+    ++ [ jemalloc nghttp2 ]
     ## optional dependencies; TODO: dnstap
     ;
 
@@ -71,6 +71,7 @@ unwrapped = stdenv.mkDerivation rec {
     "-Dkeyfile_default=${dns-root-data}/root.ds"
     "-Droot_hints=${dns-root-data}/root.hints"
     "-Dinstall_kresd_conf=disabled" # not really useful; examples are inside share/doc/
+    "-Dmalloc=jemalloc"
     "--default-library=static" # not used by anyone
   ]
   ++ optional doInstallCheck "-Dunit_tests=enabled"
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index a672433583c..2bd89a7c143 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.2688";
+  version = "0.20.2732";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-e2uJ4uV6e3cwvnt3hw8qAYmUOhoyfX93YEgsV1pT/lZynYS7/FRF2jgo8ZUa1WC8lr/+tBQl+17jkxuQoIT7AA==";
+    hash = "sha512-h9vQ4OFXt3Fb7+2QSsXJh/uqy9glRFAZfZ8fdBqqna/59PV8GtItYWSJi7FhGVeFMX+WMQnsxG0/8Hq1z7akMA==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 391644379ef..29edb77fabd 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -2,17 +2,18 @@
 
 let
   generic = {
-    version, sha256,
+    version, hash,
     eol ? false, extraVulnerabilities ? []
   }: let
     major = lib.versions.major version;
+    prerelease = builtins.length (lib.versions.splitVersion version) > 3;
   in stdenv.mkDerivation rec {
     pname = "nextcloud";
     inherit version;
 
     src = fetchurl {
-      url = "https://download.nextcloud.com/server/releases/${pname}-${version}.tar.bz2";
-      inherit sha256;
+      url = "https://download.nextcloud.com/server/${if prerelease then "prereleases" else "release"}/${pname}-${version}.tar.bz2";
+      inherit hash;
     };
 
     patches = [ (./patches + "/v${major}/0001-Setup-remove-custom-dbuser-creation-behavior.patch") ];
@@ -51,14 +52,19 @@ in {
 
   nextcloud24 = generic {
     version = "24.0.9";
-    sha256 = "580a3384c9c09aefb8e9b41553d21a6e20001799549dbd25b31dea211d97dd1e";
+    hash = "sha256-WAozhMnAmu+46bQVU9IabiAAF5lUnb0lsx3qIR2X3R4=";
   };
 
   nextcloud25 = generic {
     version = "25.0.3";
-    sha256 = "4b2b1423736ef92469096fe24f61c24cad87a34e07c1c7a81b385d3ea25c00ec";
+    hash = "sha256-SysUI3Nu+SRpCW/iT2HCTK2Ho04HwceoGzhdPqJcAOw=";
   };
 
-  # tip: get the sha with:
-  # curl 'https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256'
+  nextcloud26 = generic {
+    version = "26.0.0beta1";
+    hash = "sha256-EfSfn0KjQzciHa3VcrDhGC/aZUw/KDjihXs+qVIcYX0=";
+  };
+
+  # tip: get hash with:
+  # nix hash to-sri --type sha256 $(curl https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256 | cut -d' ' -f1)
 }
diff --git a/pkgs/servers/nextcloud/packages/24.json b/pkgs/servers/nextcloud/packages/24.json
index 0b775a81e88..7b45c83af8a 100644
--- a/pkgs/servers/nextcloud/packages/24.json
+++ b/pkgs/servers/nextcloud/packages/24.json
@@ -20,9 +20,9 @@
     ]
   },
   "contacts": {
-    "sha256": "0qv3c7wmf9j74562xbjvhk6kbpna6ansiw3724dh4w8j5sldqysd",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v4.2.3/contacts-v4.2.3.tar.gz",
-    "version": "4.2.3",
+    "sha256": "1996f97w74slmh7ihv8p1lxl32rri5nnzp90mbb1imclpgac2i63",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v4.2.4/contacts-v4.2.4.tar.gz",
+    "version": "4.2.4",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* πŸš€ **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* πŸŽ‰ **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* πŸ‘₯ **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* πŸ™ˆ **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -110,9 +110,9 @@
     ]
   },
   "news": {
-    "sha256": "0pnriarr2iqci2v2hn6vpvszf4m4pkcxsd2i13bp7n1zqkg6swd7",
-    "url": "https://github.com/nextcloud/news/releases/download/20.0.0/news.tar.gz",
-    "version": "20.0.0",
+    "sha256": "0iz1yrl7h60yhc1d1gkalkzc5vlj8sq6lff0ggns6a6qpsdpn9c5",
+    "url": "https://github.com/nextcloud/news/releases/download/20.0.1/news.tar.gz",
+    "version": "20.0.1",
     "description": "πŸ“° A RSS/Atom Feed reader App for Nextcloud\n\n- πŸ“² Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- πŸ”„ Automatic updates of your news feeds\n- πŸ†“ Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "polls": {
-    "sha256": "b6ef0e8b34cdb5169341e30340bc9cefaa1254a1a6020e951f86e828f8591a11",
-    "url": "https://github.com/nextcloud/polls/releases/download/v3.8.3/polls.tar.gz",
-    "version": "3.8.3",
+    "sha256": "0qdm0hnljkv0df1s929awyjj1gsp3d6xv9llr52cxv66kkfx086y",
+    "url": "https://github.com/nextcloud/polls/releases/download/v3.8.4/polls.tar.gz",
+    "version": "3.8.4",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -160,9 +160,9 @@
     ]
   },
   "spreed": {
-    "sha256": "0frilxny4mvp34fxw0k8al3r5apy3q6vq7z35jkph3vaq1889m9k",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v14.0.7/spreed-v14.0.7.tar.gz",
-    "version": "14.0.7",
+    "sha256": "0c5b46g5vi8fsjcd2r0wqza7iqyvbgznwww5zcyajf29a32950c6",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v14.0.8/spreed-v14.0.8.tar.gz",
+    "version": "14.0.8",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* πŸ’¬ **Chat integration!** Nextcloud Talk comes with a simple text chat. Allowing you to share files from your Nextcloud and mentioning other participants.\n* πŸ‘₯ **Private, group, public and password protected calls!** Just invite somebody, a whole group or send a public link to invite to a call.\n* πŸ’» **Screen sharing!** Share your screen with participants of your call. You just need to use Firefox version 66 (or newer), latest Edge or Chrome 72 (or newer, also possible using Chrome 49 with this [Chrome extension](https://chrome.google.com/webstore/detail/screensharing-for-nextclo/kepnpjhambipllfmgmbapncekcmabkol)).\n* πŸš€ **Integration with other Nextcloud apps** like Files, Contacts and Deck. More to come.\n\nAnd in the works for the [coming versions](https://github.com/nextcloud/spreed/milestones/):\n* βœ‹ [Federated calls](https://github.com/nextcloud/spreed/issues/21), to call people on other Nextclouds",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/25.json b/pkgs/servers/nextcloud/packages/25.json
index 98ab7ebe3e2..e6051ccb13b 100644
--- a/pkgs/servers/nextcloud/packages/25.json
+++ b/pkgs/servers/nextcloud/packages/25.json
@@ -10,9 +10,9 @@
     ]
   },
   "calendar": {
-    "sha256": "04g1xm3q46j7harxr0n56r7kkkqjxvah7xijddyq5fj7icr6qf5d",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.2.1/calendar-v4.2.1.tar.gz",
-    "version": "4.2.1",
+    "sha256": "0yqpfp5nbzd7zar2rbcx3bhfgjxrp1sy6a57fdagndfi4y0r56hq",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.2.2/calendar-v4.2.2.tar.gz",
+    "version": "4.2.2",
     "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* πŸš€ **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* πŸ™‹ **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* πŸ” Search! Find your events at ease\n* β˜‘οΈ Tasks! See tasks with a due date directly in the calendar\n* πŸ™ˆ **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
@@ -20,9 +20,9 @@
     ]
   },
   "contacts": {
-    "sha256": "097a71if6kkc7nphfc8b6llqlsskjwp1vg83134hzgfscvllvaj8",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v5.0.2/contacts-v5.0.2.tar.gz",
-    "version": "5.0.2",
+    "sha256": "181lycyz4v7v1yir6ylmblgha625sn23nf3661g3izq1whi0wgr9",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v5.0.3/contacts-v5.0.3.tar.gz",
+    "version": "5.0.3",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* πŸš€ **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* πŸŽ‰ **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* πŸ‘₯ **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* πŸ™ˆ **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -90,9 +90,9 @@
     ]
   },
   "news": {
-    "sha256": "0pnriarr2iqci2v2hn6vpvszf4m4pkcxsd2i13bp7n1zqkg6swd7",
-    "url": "https://github.com/nextcloud/news/releases/download/20.0.0/news.tar.gz",
-    "version": "20.0.0",
+    "sha256": "0iz1yrl7h60yhc1d1gkalkzc5vlj8sq6lff0ggns6a6qpsdpn9c5",
+    "url": "https://github.com/nextcloud/news/releases/download/20.0.1/news.tar.gz",
+    "version": "20.0.1",
     "description": "πŸ“° A RSS/Atom Feed reader App for Nextcloud\n\n- πŸ“² Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- πŸ”„ Automatic updates of your news feeds\n- πŸ†“ Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -120,9 +120,9 @@
     ]
   },
   "polls": {
-    "sha256": "1amywiw91acp4g90wazmqmnw51s7z6rf27bdrzxrcqryd8igsniq",
-    "url": "https://github.com/nextcloud/polls/releases/download/v4.1.0-beta4/polls.tar.gz",
-    "version": "4.1.0-beta4",
+    "sha256": "0mqc9zmxrm98byy6v13si3hwii8hx85998c4kv91vk6ad0sfxjhb",
+    "url": "https://github.com/nextcloud/polls/releases/download/v4.1.2/polls.tar.gz",
+    "version": "4.1.2",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "spreed": {
-    "sha256": "1w5v866lkd0skv666vhz75zwalr2w83shrhdvv354kill9k53awh",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v15.0.2/spreed-v15.0.2.tar.gz",
-    "version": "15.0.2",
+    "sha256": "07nh7nlz8di69ms1156fklj29526i3phlvki5vf2mxnlcz8ihg27",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v15.0.3/spreed-v15.0.3.tar.gz",
+    "version": "15.0.3",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* πŸ’¬ **Chat integration!** Nextcloud Talk comes with a simple text chat. Allowing you to share files from your Nextcloud and mentioning other participants.\n* πŸ‘₯ **Private, group, public and password protected calls!** Just invite somebody, a whole group or send a public link to invite to a call.\n* πŸ’» **Screen sharing!** Share your screen with participants of your call. You just need to use Firefox version 66 (or newer), latest Edge or Chrome 72 (or newer, also possible using Chrome 49 with this [Chrome extension](https://chrome.google.com/webstore/detail/screensharing-for-nextclo/kepnpjhambipllfmgmbapncekcmabkol)).\n* πŸš€ **Integration with other Nextcloud apps** like Files, Contacts and Deck. More to come.\n\nAnd in the works for the [coming versions](https://github.com/nextcloud/spreed/milestones/):\n* βœ‹ [Federated calls](https://github.com/nextcloud/spreed/issues/21), to call people on other Nextclouds",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/26.json b/pkgs/servers/nextcloud/packages/26.json
new file mode 100644
index 00000000000..e3a075c7c8e
--- /dev/null
+++ b/pkgs/servers/nextcloud/packages/26.json
@@ -0,0 +1,62 @@
+{
+  "calendar": {
+    "sha256": "0yqpfp5nbzd7zar2rbcx3bhfgjxrp1sy6a57fdagndfi4y0r56hq",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.2.2/calendar-v4.2.2.tar.gz",
+    "version": "4.2.2",
+    "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* πŸš€ **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* πŸ™‹ **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* πŸ” Search! Find your events at ease\n* β˜‘οΈ Tasks! See tasks with a due date directly in the calendar\n* πŸ™ˆ **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
+    "homepage": "https://github.com/nextcloud/calendar/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "files_texteditor": {
+    "sha256": "0rmk14iw34pd81snp3lm01k07wm5j2nh9spcd4j0m43l20b7kxss",
+    "url": "https://github.com/nextcloud-releases/files_texteditor/releases/download/v2.15.0/files_texteditor.tar.gz",
+    "version": "2.15.0",
+    "description": "This application enables Nextcloud users to open, save and edit text files in the web browser. If enabled, an entry called \"Text file\" in the \"New\" button menu at the top of the web browser appears. When clicked, a new text file opens in the browser and the file can be saved into the current Nextcloud directory. Further, when a text file is clicked in the web browser, it will be opened and editable. If the privileges allow, a user can also edit shared files and save these changes back into the web browser.\nMore information is available in the text editor documentation.",
+    "homepage": "https://github.com/nextcloud/files_texteditor",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "mail": {
+    "sha256": "",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v2.2.2/mail-v2.2.2.tar.gz",
+    "version": "2.2.2",
+    "description": "**πŸ’Œ A mail app for Nextcloud**\n\n- **πŸš€ Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **πŸ“₯ Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **πŸ”’ Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **πŸ™ˆ We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **πŸ“¬ Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!",
+    "homepage": "https://github.com/nextcloud/mail#readme",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "notes": {
+    "sha256": "1jcgv3awr45jq3n3qv851qlpbdl2plixba0iq2s54dmhciypdckl",
+    "url": "https://github.com/nextcloud/notes/releases/download/v4.6.0/notes.tar.gz",
+    "version": "4.6.0",
+    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into third-party apps (currently, there are notes apps for [Android](https://github.com/stefan-niedermann/nextcloud-notes), [iOS](https://github.com/owncloud/notes-iOS-App) and the [console](https://git.danielmoch.com/nncli/about) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
+    "homepage": "https://github.com/nextcloud/notes",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "tasks": {
+    "sha256": "0jm13d6nm7cfsw27yfiq1il9xjlh0qrq8xby2yz9dmggn7lk1dx5",
+    "url": "https://github.com/nextcloud/tasks/releases/download/v0.14.5/tasks.tar.gz",
+    "version": "0.14.5",
+    "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
+    "homepage": "https://github.com/nextcloud/tasks/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "unsplash": {
+    "sha256": "17qqn6kwpvkq21c92jyy3pfvjaj5xms1hr07fnn39zxg0nmwjdd8",
+    "url": "https://github.com/nextcloud/unsplash/releases/download/v2.1.1/unsplash.tar.gz",
+    "version": "2.1.1",
+    "description": "Show a new random featured nature photo in your nextcloud. Now with choosable motives!",
+    "homepage": "https://github.com/nextcloud/unsplash/",
+    "licenses": [
+      "agpl"
+    ]
+  }
+}
diff --git a/pkgs/servers/nextcloud/patches/v26/0001-Setup-remove-custom-dbuser-creation-behavior.patch b/pkgs/servers/nextcloud/patches/v26/0001-Setup-remove-custom-dbuser-creation-behavior.patch
new file mode 100644
index 00000000000..28af5ec7658
--- /dev/null
+++ b/pkgs/servers/nextcloud/patches/v26/0001-Setup-remove-custom-dbuser-creation-behavior.patch
@@ -0,0 +1,149 @@
+From fc3e14155b3c4300b691ab46579830e725457a54 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Sat, 10 Sep 2022 15:18:05 +0200
+Subject: [PATCH] Setup: remove custom dbuser creation behavior
+
+Both PostgreSQL and MySQL can be authenticated against from Nextcloud by
+supplying a database password. Now, during setup the following things
+happen:
+
+* When using postgres and the db user has elevated permissions, a new
+  unprivileged db user is created and the settings `dbuser`/`dbpass` are
+  altered in `config.php`.
+
+* When using MySQL, the password is **always** regenerated since
+  24.0.5/23.0.9[1].
+
+I consider both cases problematic: the reason why people do configuration
+management is to have it as single source of truth! So, IMHO any
+application that silently alters config and thus causes deployed
+nodes to diverge from the configuration is harmful for that.
+
+I guess it was sheer luck that it worked for so long in NixOS because
+nobody has apparently used password authentication with a privileged
+user to operate Nextcloud (which is a good thing in fact).
+
+[1] https://github.com/nextcloud/server/pull/33513
+---
+ lib/private/Setup/MySQL.php      | 53 --------------------------------
+ lib/private/Setup/PostgreSQL.php | 37 ----------------------
+ 2 files changed, 90 deletions(-)
+
+diff --git a/lib/private/Setup/MySQL.php b/lib/private/Setup/MySQL.php
+index e3004c269bc..bc958e84e44 100644
+--- a/lib/private/Setup/MySQL.php
++++ b/lib/private/Setup/MySQL.php
+@@ -141,62 +141,6 @@
+ 		$rootUser = $this->dbUser;
+ 		$rootPassword = $this->dbPassword;
+ 
+-		//create a random password so we don't need to store the admin password in the config file
+-		$saveSymbols = str_replace(['\"', '\\', '\'', '`'], '', ISecureRandom::CHAR_SYMBOLS);
+-		$password = $this->random->generate(22, ISecureRandom::CHAR_ALPHANUMERIC . $saveSymbols)
+-			. $this->random->generate(2, ISecureRandom::CHAR_UPPER)
+-			. $this->random->generate(2, ISecureRandom::CHAR_LOWER)
+-			. $this->random->generate(2, ISecureRandom::CHAR_DIGITS)
+-			. $this->random->generate(2, $saveSymbols)
+-		;
+-		$this->dbPassword = str_shuffle($password);
+-
+-		try {
+-			//user already specified in config
+-			$oldUser = $this->config->getValue('dbuser', false);
+-
+-			//we don't have a dbuser specified in config
+-			if ($this->dbUser !== $oldUser) {
+-				//add prefix to the admin username to prevent collisions
+-				$adminUser = substr('oc_' . $username, 0, 16);
+-
+-				$i = 1;
+-				while (true) {
+-					//this should be enough to check for admin rights in mysql
+-					$query = 'SELECT user FROM mysql.user WHERE user=?';
+-					$result = $connection->executeQuery($query, [$adminUser]);
+-
+-					//current dbuser has admin rights
+-					$data = $result->fetchAll();
+-					$result->closeCursor();
+-					//new dbuser does not exist
+-					if (count($data) === 0) {
+-						//use the admin login data for the new database user
+-						$this->dbUser = $adminUser;
+-						$this->createDBUser($connection);
+-
+-						break;
+-					} else {
+-						//repeat with different username
+-						$length = strlen((string)$i);
+-						$adminUser = substr('oc_' . $username, 0, 16 - $length) . $i;
+-						$i++;
+-					}
+-				}
+-			} else {
+-				// Reuse existing password if a database config is already present
+-				$this->dbPassword = $rootPassword;
+-			}
+-		} catch (\Exception $ex) {
+-			$this->logger->info('Can not create a new MySQL user, will continue with the provided user.', [
+-				'exception' => $ex,
+-				'app' => 'mysql.setup',
+-			]);
+-			// Restore the original credentials
+-			$this->dbUser = $rootUser;
+-			$this->dbPassword = $rootPassword;
+-		}
+-
+ 		$this->config->setValues([
+ 			'dbuser' => $this->dbUser,
+ 			'dbpassword' => $this->dbPassword,
+diff --git a/lib/private/Setup/PostgreSQL.php b/lib/private/Setup/PostgreSQL.php
+index af816c7ad04..e49e5508e15 100644
+--- a/lib/private/Setup/PostgreSQL.php
++++ b/lib/private/Setup/PostgreSQL.php
+@@ -45,43 +45,6 @@ class PostgreSQL extends AbstractDatabase {
+ 			$connection = $this->connect([
+ 				'dbname' => 'postgres'
+ 			]);
+-			//check for roles creation rights in postgresql
+-			$builder = $connection->getQueryBuilder();
+-			$builder->automaticTablePrefix(false);
+-			$query = $builder
+-				->select('rolname')
+-				->from('pg_roles')
+-				->where($builder->expr()->eq('rolcreaterole', new Literal('TRUE')))
+-				->andWhere($builder->expr()->eq('rolname', $builder->createNamedParameter($this->dbUser)));
+-
+-			try {
+-				$result = $query->execute();
+-				$canCreateRoles = $result->rowCount() > 0;
+-			} catch (DatabaseException $e) {
+-				$canCreateRoles = false;
+-			}
+-
+-			if ($canCreateRoles) {
+-				$connectionMainDatabase = $this->connect();
+-				//use the admin login data for the new database user
+-
+-				//add prefix to the postgresql user name to prevent collisions
+-				$this->dbUser = 'oc_' . strtolower($username);
+-				//create a new password so we don't need to store the admin config in the config file
+-				$this->dbPassword = \OC::$server->getSecureRandom()->generate(30, ISecureRandom::CHAR_ALPHANUMERIC);
+-
+-				$this->createDBUser($connection);
+-
+-				// Go to the main database and grant create on the public schema
+-				// The code below is implemented to make installing possible with PostgreSQL version 15:
+-				// https://www.postgresql.org/docs/release/15.0/
+-				// From the release notes: For new databases having no need to defend against insider threats, granting CREATE permission will yield the behavior of prior releases
+-				// Therefore we assume that the database is only used by one user/service which is Nextcloud
+-				// Additional services should get installed in a separate database in order to stay secure
+-				// Also see https://www.postgresql.org/docs/15/ddl-schemas.html#DDL-SCHEMAS-PATTERNS
+-				$connectionMainDatabase->executeQuery('GRANT CREATE ON SCHEMA public TO ' . addslashes($this->dbUser));
+-				$connectionMainDatabase->close();
+-			}
+ 
+ 			$this->config->setValues([
+ 				'dbuser' => $this->dbUser,
+-- 
+2.38.1
+
diff --git a/pkgs/servers/web-apps/wordpress/generic.nix b/pkgs/servers/web-apps/wordpress/generic.nix
index e15640c8828..d2d97dab35d 100644
--- a/pkgs/servers/web-apps/wordpress/generic.nix
+++ b/pkgs/servers/web-apps/wordpress/generic.nix
@@ -12,6 +12,15 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
+    # remove non-essential plugins and themes
+    rm -r wp-content/{plugins,themes}
+    mkdir wp-content/plugins
+    cat << EOF > wp-content/plugins/index.php
+    <?php
+    // Silence is golden.
+    EOF
+    cp -a wp-content/{plugins,themes}
+
     mkdir -p $out/share/wordpress
     cp -r . $out/share/wordpress
 
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 104365de5d4..30e61e00522 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.66.2";
+  version = "0.68.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CIFK4XIYpRK9CJOwQUV6kRGU++iWJCdMBR7v6xh0iaY=";
+    sha256 = "sha256-iOJnSeVRAjmJblaipmk05J9BvAkYgyS1OA8b3xDykXc=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorHash = "sha256-ttvfzlSFgh0xQ0W/ftLeSrJNOzg7Iq1qdLgflGy7N8Q=";
+  vendorHash = "sha256-5erZB2CoXVfIK0jYEe0HmdZaeLKLAqOiKi8QAQQFVKU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/gh-actions-cache/default.nix b/pkgs/tools/misc/gh-actions-cache/default.nix
new file mode 100644
index 00000000000..4c80d032ab1
--- /dev/null
+++ b/pkgs/tools/misc/gh-actions-cache/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "gh-actions-cache";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "actions";
+    repo = "gh-actions-cache";
+    rev = "v${version}";
+    hash = "sha256-5iCj6z4HCMVFeplb3dGP/V60z6zMUnUPVBMnPi4yU1Q=";
+  };
+
+  vendorHash = "sha256-i9akQ0IjH9NItjYvMWLiGnFQrfZhA7SOvPZiUvdtDrk=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  # Tests need network
+  doCheck = false;
+
+  meta = {
+    description = "gh extension to manage GitHub Actions caches";
+    homepage = "https://github.com/actions/gh-actions-cache";
+    changelog = "https://github.com/actions/gh-actions-cache/releases/tag/${src.rev}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ amesgen ];
+  };
+}
diff --git a/pkgs/tools/misc/licensor/default.nix b/pkgs/tools/misc/licensor/default.nix
index 510a169f215..8a81286eebb 100644
--- a/pkgs/tools/misc/licensor/default.nix
+++ b/pkgs/tools/misc/licensor/default.nix
@@ -17,14 +17,10 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1h66d1brx441bg7vzbqdish4avgmc6h7rrkw2qf1siwmplwqqhw0";
 
-  patches = [
-    # Support for 2022, https://github.com/raftario/licensor/pull/68
-    (fetchpatch {
-      name = "support-for-2022.patch";
-      url = "https://github.com/raftario/licensor/commit/6b2f248e5ad9e454fe30d71397691e47ac69b19e.patch";
-      sha256 = "sha256-kXiY5s2kuU+ibV3RpBoy7y3cmJU+gECBTsmRXWBOTP8=";
-    })
-  ];
+  # https://github.com/raftario/licensor/issues/67
+  postPatch = ''
+    sed "/Copyright (c) 2021/s/2021/$(date +%Y)/" -i tests/integration.rs
+  '';
 
   meta = with lib; {
     description = "Write licenses to stdout";
diff --git a/pkgs/tools/networking/s3rs/default.nix b/pkgs/tools/networking/s3rs/default.nix
index f8c52cdc43c..cb73eaf6b59 100644
--- a/pkgs/tools/networking/s3rs/default.nix
+++ b/pkgs/tools/networking/s3rs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "s3rs";
-  version = "0.4.16";
+  version = "0.4.19";
 
   src = fetchFromGitHub {
     owner = "yanganto";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-n95ejw6EZ4zXzP16xFoUkVn1zIMcVgINy7m5NOz063A=";
+    sha256 = "sha256-mJ1bMfv/HY74TknpRvu8RIs1d2VlNreEVtHCtQSHQw8=";
   };
 
-  cargoSha256 = "sha256-eecQi03w7lq3VAsv9o+3kulwhAXPoxuDPMu/ZCQEom4=";
+  cargoHash = "sha256-Q1EqEyNxWIx3wD8zuU7/MO3Qz6zsfBZbtT/IIUmJccE=";
 
   nativeBuildInputs = [ python3 perl pkg-config ];
   buildInputs = [ openssl ]
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index 72978db577a..d85e40bdc28 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -169,6 +169,8 @@ self = stdenv.mkDerivation {
     "--disable-init-state"
   ] ++ lib.optionals stdenv.isLinux [
     "--with-sandbox-shell=${busybox-sandbox-shell}/bin/busybox"
+  ] ++ lib.optionals (atLeast210 && stdenv.isLinux && stdenv.hostPlatform.isStatic) [
+    "--enable-embedded-sandbox-shell"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform ? nix && stdenv.hostPlatform.nix ? system) [
     "--with-system=${stdenv.hostPlatform.nix.system}"
   ] ++ lib.optionals (!withLibseccomp) [
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index f745a2374ff..9b3a9a44d9c 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.55.0";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Y72h1YCf42RinGw2mKZb8Bz8ip+LUW377xwJht67Q1s=";
+    hash = "sha256-xNv4pI6iT6lNmjeUIW8ObPFJw9H1SiVTg9fRx6Osiwc=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
   };
   proxyVendor = true;
 
-  vendorHash = "sha256-xzBOZyzwxVFTFgtmu7DLBpdkV9bwzJ9RETkdyV2HtQo=";
+  vendorHash = "sha256-Sez5jNFdL11cHBBPcY0b8qUiupmjPo9MHwUUi7FaNiA=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 49c519fe348..3f4613b9876 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.25.4";
+  version = "3.26.0";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aj7Zeaj2zvIp/USRYnhCWCsTiYlPL9AmEFKQYZbwhCE=";
+    hash = "sha256-cjggYIc/xy7w8Q8yXd26QWr1ky4gMuwRAmxrEObVlx0=";
   };
 
-  vendorHash = "sha256-71gPd42kaJaLpyXH1FpCf6sRiKmyGNuGxkX3QV8vvHY=";
+  vendorHash = "sha256-z2na/CO/YqIYEAYJ9ATQ/wbOOBFt0Kr+ERN5TCFbZbA=";
 
   # Test cases run git clone and require network access
   doCheck = false;
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index 829bd30e4e9..ea3f03161db 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.57";
+  version = "1.0.60";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Wb7X4eDG9vZLJF5b9JPb0JVjQgstFo7Zr1MnidKcuZI=";
+    sha256 = "sha256-6p9hLbU5ZaA4o6PRyfSt/gb3D3XeeWacJ2LlpJ0+w18=";
   };
 
-  cargoHash = "sha256-BcIGaAGTwm8QBvrL7J91asNEpnFdsgDtRPDSWdE9JHI=";
+  cargoHash = "sha256-COWvEfFQMi3ltQSEFK3S6y07YLqqtjAf2H4p0TX/U70=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/clinfo/default.nix b/pkgs/tools/system/clinfo/default.nix
index a9e7c0c81de..746f83690e7 100644
--- a/pkgs/tools/system/clinfo/default.nix
+++ b/pkgs/tools/system/clinfo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clinfo";
-  version = "3.0.21.02.21";
+  version = "3.0.23.01.25";
 
   src = fetchFromGitHub {
     owner = "Oblomov";
     repo = "clinfo";
     rev = version;
-    sha256 = "sha256-0ijfbfv1F6mnt1uFH/A4yOADJoAFrPMa3yAOFJW53ek=";
+    sha256 = "sha256-1jZP4SnLIHh3vQJLBp+j/eQ1c8XBGFR2hjYxflhpWAU=";
   };
 
   buildInputs = lib.optionals (!stdenv.isDarwin) [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c8c6c8a29f5..63a91e4aa0f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1425,6 +1425,8 @@ with pkgs;
 
   gfshare = callPackage ../tools/security/gfshare { };
 
+  gh-actions-cache = callPackage ../tools/misc/gh-actions-cache { };
+
   gh-cal = callPackage ../tools/misc/gh-cal {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -9992,7 +9994,7 @@ with pkgs;
   grocy = callPackage ../servers/grocy { };
 
   inherit (callPackage ../servers/nextcloud {})
-    nextcloud23 nextcloud24 nextcloud25;
+    nextcloud23 nextcloud24 nextcloud25 nextcloud26;
 
   nextcloud23Packages = ( callPackage ../servers/nextcloud/packages {
     apps = lib.importJSON ../servers/nextcloud/packages/23.json;
@@ -10003,6 +10005,9 @@ with pkgs;
   nextcloud25Packages = ( callPackage ../servers/nextcloud/packages {
     apps = lib.importJSON ../servers/nextcloud/packages/25.json;
   });
+  nextcloud26Packages = ( callPackage ../servers/nextcloud/packages {
+    apps = lib.importJSON ../servers/nextcloud/packages/26.json;
+  });
 
   nextcloud-client = libsForQt5.callPackage ../applications/networking/nextcloud-client { };
 
@@ -14015,6 +14020,7 @@ with pkgs;
   clang_12 = llvmPackages_12.clang;
   clang_13 = llvmPackages_13.clang;
   clang_14 = llvmPackages_14.clang;
+  clang_15 = llvmPackages_15.clang;
 
   clang-tools = callPackage ../development/tools/clang-tools {
     llvmPackages = llvmPackages_latest;
@@ -14060,6 +14066,10 @@ with pkgs;
     llvmPackages = llvmPackages_14;
   };
 
+  clang-tools_15 = callPackage ../development/tools/clang-tools {
+    llvmPackages = llvmPackages_15;
+  };
+
   clang-analyzer = callPackage ../development/tools/analysis/clang-analyzer {
     llvmPackages = llvmPackages_latest;
     inherit (llvmPackages_latest) clang;
@@ -15042,6 +15052,7 @@ with pkgs;
   lld_12 = llvmPackages_12.lld;
   lld_13 = llvmPackages_13.lld;
   lld_14 = llvmPackages_14.lld;
+  lld_15 = llvmPackages_15.lld;
 
   lldb = llvmPackages_latest.lldb;
   lldb_5 = llvmPackages_5.lldb;
@@ -15054,6 +15065,7 @@ with pkgs;
   lldb_12 = llvmPackages_12.lldb;
   lldb_13 = llvmPackages_13.lldb;
   lldb_14 = llvmPackages_14.lldb;
+  lldb_15 = llvmPackages_15.lldb;
 
   llvm = llvmPackages.llvm;
   llvm_5  = llvmPackages_5.llvm;
@@ -15066,6 +15078,7 @@ with pkgs;
   llvm_12 = llvmPackages_12.llvm;
   llvm_13 = llvmPackages_13.llvm;
   llvm_14 = llvmPackages_14.llvm;
+  llvm_15 = llvmPackages_15.llvm;
 
   libllvm = llvmPackages.libllvm;
   llvm-manpages = llvmPackages.llvm-manpages;
@@ -15160,6 +15173,13 @@ with pkgs;
     targetLlvm = targetPackages.llvmPackages_14.llvm or llvmPackages_14.llvm;
   }));
 
+  llvmPackages_15 = recurseIntoAttrs (callPackage ../development/compilers/llvm/15 ({
+    inherit (stdenvAdapters) overrideCC;
+    buildLlvmTools = buildPackages.llvmPackages_15.tools;
+    targetLlvmLibraries = targetPackages.llvmPackages_15.libraries or llvmPackages_15.libraries;
+    targetLlvm = targetPackages.llvmPackages_15.llvm or llvmPackages_15.llvm;
+  }));
+
   llvmPackages_latest = llvmPackages_14;
 
   llvmPackages_rocm = recurseIntoAttrs (callPackage ../development/compilers/llvm/rocm { });