Merge #198236: staging-next 2022-10-28

45 files changed, 372 insertions, 405 deletions

diff --git a/pkgs/development/libraries/abseil-cpp/202206.nix b/pkgs/development/libraries/abseil-cpp/202206.nix
new file mode 100644
index 00000000000..7ca25f41404
--- /dev/null
+++ b/pkgs/development/libraries/abseil-cpp/202206.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, static ? stdenv.hostPlatform.isStatic
+, cxxStandard ? null
+}:
+
+stdenv.mkDerivation rec {
+  pname = "abseil-cpp";
+  version = "20220623.1";
+
+  src = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Od1FZOOWEXVQsnZBwGjDIExi6LdYtomyL0STR44SsG8=";
+  };
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
+  ] ++ lib.optionals (cxxStandard != null) [
+    "-DCMAKE_CXX_STANDARD=${cxxStandard}"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "An open-source collection of C++ code designed to augment the C++ standard library";
+    homepage = "https://abseil.io/";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = [ maintainers.andersk ];
+  };
+}
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index a72ebc29309..2ce613c7853 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -3,7 +3,6 @@
 , fetchurl
 , fetchFromGitHub
 , fixDarwinDylibNames
-, abseil-cpp
 , autoconf
 , aws-sdk-cpp
 , boost
@@ -147,10 +146,9 @@ stdenv.mkDerivation rec {
     protobuf
   ] ++ lib.optionals enableS3 [ aws-sdk-cpp openssl ]
   ++ lib.optionals enableGcs [
-    abseil-cpp
     crc32c
     curl
-    google-cloud-cpp
+    google-cloud-cpp grpc
     nlohmann_json
   ];
 
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index e70a8210df8..eaa80586f47 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.3.2";
+  version = "2.3.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-zpukf9TTQDG9aURVmKaYpmEWArKw6R1wXpGm9QmerW4=";
+    sha256 = "sha256-PaEhA/Ec9Jw88v0s4wF1dcUyGkieW5v6gd2R7EE/OJE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/faad2/default.nix b/pkgs/development/libraries/faad2/default.nix
index eb6915c7e67..e62a90fcd2b 100644
--- a/pkgs/development/libraries/faad2/default.nix
+++ b/pkgs/development/libraries/faad2/default.nix
@@ -14,13 +14,13 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = "faad2";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "knik0";
     repo = "faad2";
-    rev = builtins.replaceStrings [ "." ] [ "_" ] version;
-    sha256 = "0q52kdd95ls6ihzyspx176wg9x22425v5qsknrmrjq30q25qmmlg";
+    rev = version;
+    sha256 = "sha256-k7y12OwCn3YkNZY9Ov5Y9EQtlrZh6oFUzM27JDR960w=";
   };
 
   configureFlags = []
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 87b93a86898..5d9b41848ca 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -71,6 +71,7 @@ stdenv.mkDerivation rec {
   configureFlags = filter (v: v != null) ([
       "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
       "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
+      "--pkg-config=${pkg-config.targetPrefix}pkg-config"
     # License
       "--enable-gpl"
       "--enable-version3"
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index ae7d7460487..87d3285e64b 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gdk-pixbuf";
-  version = "2.42.9";
+  version = "2.42.10";
 
   outputs = [ "out" "dev" "man" "devdoc" ]
     ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) "installedTests";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "KPeVjnvymjLU6WNVbSQdCkGmeGWC/2pa0RZl4DR/yWI=";
+    sha256 = "7ptsddE7oJaQei48aye2G80X9cfr6rWltDnS8uOf5Es=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 18acca3f691..fb2929a72f1 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, abseil-cpp
 , c-ares
 , cmake
 , crc32c
@@ -66,7 +65,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    abseil-cpp
     c-ares
     crc32c
     (curl.override { inherit openssl; })
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index d44b85337dd..3858ac7c437 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.48.1"; # N.B: if you change this, please update:
+  version = "1.50.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-It9oFenKoPDCOVxiKCGJc8i18zdDZCceR22HR5Tu1sw=";
+    hash = "sha256-h79Ptx17tIMFpaaid4UGzbGDztee9JctfsEcetfude0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 5ec8c75e2af..9bee726e500 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -3,6 +3,9 @@
 , enableVmaf ? true, libvmaf
 }:
 
+let
+  isCross = stdenv.buildPlatform != stdenv.hostPlatform;
+in
 stdenv.mkDerivation rec {
   pname = "libaom";
   version = "3.5.0";
@@ -45,7 +48,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # CPU detection isn't supported on Darwin and breaks the aarch64-darwin build:
     "-DCONFIG_RUNTIME_CPU_DETECT=0"
-  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+  ] ++ lib.optionals (isCross && !stdenv.hostPlatform.isx86) [
     "-DAS_EXECUTABLE=${stdenv.cc.targetPrefix}as"
   ] ++ lib.optionals stdenv.isAarch32 [
     # armv7l-hf-multiplatform does not support NEON
@@ -55,6 +58,8 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     moveToOutput lib/libaom.a "$static"
+  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
+    ln -s $static $out
   '';
 
   outputs = [ "out" "bin" "dev" "static" ];
@@ -70,6 +75,7 @@ stdenv.mkDerivation rec {
     changelog   = "https://aomedia.googlesource.com/aom/+/refs/tags/v${version}/CHANGELOG";
     maintainers = with maintainers; [ primeos kiloreux dandellion ];
     platforms   = platforms.all;
+    outputsToInstall = [ "bin" ];
     license = licenses.bsd2;
   };
 }
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index d5a2a686b89..64e1657bcba 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -7,6 +7,7 @@
 , libpng
 , libjpeg
 , dav1d
+, libyuv
 }:
 
 stdenv.mkDerivation rec {
@@ -41,6 +42,7 @@ stdenv.mkDerivation rec {
     libpng
     libjpeg
     dav1d
+    libyuv
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 762fe1765fd..d054e223cf0 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,28 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+
+# for passthru.tests
+, imagemagick
+, imagemagick6
+, libheif
+, imlib2Full
+, gst_all_1
+}:
 
 stdenv.mkDerivation rec {
-  version = "1.0.8";
+  version = "1.0.9";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "1dzflqbk248lz5ws0ni5acmf32b3rmnq5gsfaz7691qqjxkl1zml";
+    sha256 = "sha256-OpiQapppuKCR27tIG5OW+KiNMP9ysv7CaobiBOW6VUI=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2022-1253.patch";
-      url = "https://github.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8.patch";
-      sha256 = "sha256-F1BOWFx9oXR2trM22atyD3AJ5x6vVfURQ/PTlYP2Ibg=";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    inherit imagemagick imagemagick6 libheif imlib2Full;
+    inherit (gst_all_1) gst-plugins-bad;
+  };
+
   meta = {
     homepage = "https://github.com/strukturag/libde265";
     description = "Open h.265 video codec implementation";
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 72ecdc51ab1..354b73f8050 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
     "-Dinstall-test-programs=true"
     "-Domap=enabled"
     "-Dcairo-tests=disabled"
+    "-Dvalgrind=${if withValgrind then "enabled" else "disabled"}"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch [
     "-Dtegra=enabled"
     "-Detnaviv=enabled"
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 2904e6e4567..02721ff8d9b 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -5,15 +5,16 @@
   # dejagnu also requires tcl which can't be built statically at the moment
 , doCheck ? !(stdenv.hostPlatform.isStatic)
 , dejagnu
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "libffi";
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchurl {
     url = "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-RBbdkrauj8tbEEIecRxNPLMSA9d1Iad9hdAQIxHmw7g=";
+    sha256 = "sha256-1mxWrSWags8qnfxAizK/XaUjcVALhHRff7i2RXEt9nY=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -52,6 +53,12 @@ stdenv.mkDerivation rec {
 
   checkInputs = [ dejagnu ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "A foreign function call interface library";
     longDescription = ''
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 3e03d18ced8..760fc88e98e 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchurl
 , buildPackages
 , cmake
 , glib
@@ -20,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.15";
+  version = "3.0.16";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -28,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "sha256-7M5GBteFKmKCB6556XXV4s6iIC/+3c3Ck17s/QX3Jus=";
+    sha256 = "sha256-3D/0leI3LLKDFOXkKSrmMamLoaXdi/2Z4iPUXqgwtg8=";
   };
 
   strictDeps = true;
@@ -75,17 +74,6 @@ stdenv.mkDerivation rec {
     # Will appear in 3.1.0
     # https://github.com/libical/libical/issues/350
     ./respect-env-tzdir.patch
-
-    # Fixes tests with 32-bit time_t
-    # Remove with next version update (v3.0.16+)
-    (fetchurl {
-      url = "https://github.com/libical/libical/commit/4adc6f1d2b39a1cc3363b57215e12fa81076498b.patch";
-      sha256 = "1k3hav0z86kc1xd1sk23b57aqqjk4gf73574w7f1m66cyz98bxr3";
-    })
-    (fetchurl {
-      url = "https://github.com/libical/libical/commit/cce20bd051408b00521385c0bfb616ba068450d3.patch";
-      sha256 = "097hqmagl0q5p38r1kvx0592cfac2y7jbdqlis6m8gbs812pbqfc";
-    })
   ];
 
   # Using install check so we do not have to manually set
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index af7d640b6de..a5c6498166f 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , glib
 , meson
 , ninja
@@ -11,9 +10,7 @@
 , sqlite
 , glib-networking
 , gobject-introspection
-, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 , vala
-, withVala ? stdenv.buildPlatform == stdenv.hostPlatform
 , libpsl
 , python3
 , gi-docgen
@@ -23,21 +20,17 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.2.0";
+  version = "3.2.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-KDI3BpjKj5+/F0w0W3PYm2BWEQOmJsLfcHJrBwf3m9M=";
+    sha256 = "sha256-ses9LDvkn7vQUacfZTLJYmvOzqaXgxkGkM1+Tf3yjyk=";
   };
 
-  # https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/310
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libsoup/-/commit/0fae143dc8b0e668b7a35a9c1364009e7cf06d0f.patch";
-      sha256 = "sha256-yAKC7WGk0aQxMkT4At6Qfx1QO2InNotITrl/Lim41Jk=";
-    })
+  depsBuildBuild = [
+    pkg-config
   ];
 
   nativeBuildInputs = [
@@ -47,9 +40,7 @@ stdenv.mkDerivation rec {
     glib
     python3
     gi-docgen
-  ] ++ lib.optionals withIntrospection [
     gobject-introspection
-  ] ++ lib.optionals withVala [
     vala
   ];
 
@@ -70,8 +61,8 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Dtls_check=false" # glib-networking is a runtime dependency, not a compile-time dependency
     "-Dgssapi=disabled"
-    "-Dvapi=${if withVala then "enabled" else "disabled"}"
-    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
+    "-Dvapi=enabled"
+    "-Dintrospection=enabled"
     "-Dntlm=disabled"
     # Requires wstest from autobahn-testsuite.
     "-Dautobahn=disabled"
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index 9976f4109f0..df753b55b08 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "2.74.2";
+  version = "2.74.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8KQnZW5f4Z4d9xwQfojfobLmc8JcVHt4I7YBi0DQEVk=";
+    sha256 = "sha256-5Ld8Qc/EyMWgNfzcMgx7xs+3XvfFoDQVPfFBP6HZLxM=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index a87513174fb..82f3b97f6f0 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -46,6 +46,17 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/libtiff/libtiff/-/commit/48d6ece8389b01129e7d357f0985c8f938ce3da3.patch";
       sha256 = "sha256-h9hulV+dnsUt/2Rsk4C1AKdULkvweM2ypIJXYQ3BqQU=";
     })
+    (fetchpatch {
+      name = "CVE-2022-3626.CVE-2022-3627.CVE-2022-3597.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047.patch";
+      excludes = [ "doc/tools/tiffcrop.rst" ];
+      sha256 = "sha256-L2EMmmfMM4oEYeLapO93wvNS+HlO0yXsKxijXH+Wuas=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-3598.CVE-2022-3570.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff.patch";
+      sha256 = "sha256-SLq2+JaDEUOPZ5mY4GPB6uwhQOG5cD4qyL5o9i8CVVs=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libuninameslist/default.nix b/pkgs/development/libraries/libuninameslist/default.nix
index cd615ed81fe..7915e7b50f6 100644
--- a/pkgs/development/libraries/libuninameslist/default.nix
+++ b/pkgs/development/libraries/libuninameslist/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libuninameslist";
-  version = "20211114";
+  version = "20221022";
 
   src = fetchFromGitHub {
     owner = "fontforge";
     repo = pname;
     rev = version;
-    sha256 = "sha256-izxG2mx+D83s78eL19ERUaLrw9FPjlJRcFZw3+xzLDQ=";
+    sha256 = "sha256-YLlSe2++DpcptuAxLduTYAY2m9D8JSGDcvzijpAv1rU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libvorbis/default.nix b/pkgs/development/libraries/libvorbis/default.nix
index 281c7744a33..42e7328a8ec 100644
--- a/pkgs/development/libraries/libvorbis/default.nix
+++ b/pkgs/development/libraries/libvorbis/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.3.7";
 
   src = fetchurl {
-    url = "http://downloads.xiph.org/releases/vorbis/${pname}-${version}.tar.xz";
+    url = "https://downloads.xiph.org/releases/vorbis/${pname}-${version}.tar.xz";
     sha256 = "0jwmf87x5sdis64rbv0l87mdpah1rbilkkxszipbzg128f9w8g5k";
   };
 
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # strip -mno-ieee-fp flag from configure and configure.ac when using
+  # clang as the flag is not recognized by the compiler
+  preConfigure = lib.optionalString (stdenv.cc.isClang or false) ''
+    sed s/\-mno\-ieee\-fp// -i {configure,configure.ac}
+  '';
+
   meta = with lib; {
     description = "Vorbis audio compression reference implementation";
     homepage = "https://xiph.org/vorbis/";
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index ae97292b683..6e8936f7ce6 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -28,10 +28,10 @@ let
 in
   assert oldVer -> stdenv.isDarwin; # reduce likelihood of using old libxml2 unintentionally
 
-stdenv.mkDerivation rec {
+let
+libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = if oldVer then "2.10.1" else
-    "2.10.2";
+  version = "2.10.3";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
@@ -39,9 +39,8 @@ stdenv.mkDerivation rec {
   outputMan = "bin";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = if oldVer then "21a9e13cc7c4717a6c36268d0924f92c3f67a1ece6b7ff9d588958a6db9fb9d8" else
-      "0kCr5tqcZcsZAN2b86NQHM+Is8Khy5gxfQPyct2lsmU=";
+    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+    sha256 = "XSzD14vsPb4hKp1/pimtolp9qSivQyyTBg/1wX7iipw=";
   };
 
   patches = [
@@ -145,4 +144,15 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ eelco jtojnar ];
   };
-}
+};
+in
+if oldVer then
+  libxml.overrideAttrs (attrs: rec {
+    version = "2.10.1";
+    src = fetchurl {
+      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+      sha256 = "21a9e13cc7c4717a6c36268d0924f92c3f67a1ece6b7ff9d588958a6db9fb9d8";
+    };
+  })
+else
+  libxml
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 0fbc3f0c216..cf045179070 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch, buildPackages
+{ stdenv, lib, fetchurl
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
@@ -9,6 +9,7 @@
 , galliumDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
+, vulkanLayers ? [ "device-select" "overlay" ]
 , OpenGL, Xplugin
 , withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light && !valgrind-light.meta.broken, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
@@ -35,7 +36,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.2.1";
+  version = "22.2.2";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -50,7 +51,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0079beac0a33f45e7e0aec59e6913eafbc4268a3f1e2e330017440494f91b13c";
+    sha256 = "2de11fb74fc5cc671b818e49fe203cea0cd1d8b69756e97cdb06a2f4e78948f9";
   };
 
   # TODO:
@@ -119,7 +120,8 @@ self = stdenv.mkDerivation {
     "-Dgallium-opencl=icd" # Enable the gallium OpenCL frontend
     "-Dclang-libdir=${llvmPackages.clang-unwrapped.lib}/lib"
   ] ++ optional enablePatentEncumberedCodecs
-    "-Dvideo-codecs=h264dec,h264enc,h265dec,h265enc,vc1dec";
+    "-Dvideo-codecs=h264dec,h264enc,h265dec,h265enc,vc1dec"
+  ++ optional (vulkanLayers != []) "-D vulkan-layers=${builtins.concatStringsSep "," vulkanLayers}";
 
   buildInputs = with xorg; [
     expat llvmPackages.libllvm libglvnd xorgproto
@@ -195,6 +197,11 @@ self = stdenv.mkDerivation {
     # move libOSMesa to $osmesa, as it's relatively big
     mkdir -p $osmesa/lib
     mv -t $osmesa/lib/ $out/lib/libOSMesa*
+  '' + lib.optionalString (vulkanLayers != []) ''
+    mv -t $drivers/lib $out/lib/libVkLayer*
+    for js in $drivers/share/vulkan/{im,ex}plicit_layer.d/*.json; do
+      substituteInPlace "$js" --replace '"libVkLayer_' '"'"$drivers/lib/libVkLayer_"
+    done
   '';
 
   postFixup = optionalString stdenv.isLinux ''
diff --git a/pkgs/development/libraries/neon/default.nix b/pkgs/development/libraries/neon/default.nix
index 4a00044bb55..827d7eb6979 100644
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@@ -3,6 +3,7 @@
 , sslSupport ? true, openssl ? null
 , static ? stdenv.hostPlatform.isStatic
 , shared ? !stdenv.hostPlatform.isStatic
+, bash
 }:
 
 assert compressionSupport -> zlib != null;
@@ -25,9 +26,11 @@ stdenv.mkDerivation rec {
   patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [libxml2 openssl]
+  buildInputs = [libxml2 openssl bash]
     ++ lib.optional compressionSupport zlib;
 
+  strictDeps = true;
+
   configureFlags = [
     (lib.enableFeature shared "shared")
     (lib.enableFeature static "static")
diff --git a/pkgs/development/libraries/nghttp3/default.nix b/pkgs/development/libraries/nghttp3/default.nix
index 1633de12e43..3638422bb0c 100644
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nghttp3";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MZ5ynaGZTzO2w0hGHII19PFC0+kjfd+IlcsenGGgMgg=";
+    sha256 = "sha256-LSHhvRTzqpGJcyK3KoZZjbZVggXpgDEEVpp8gMoaE7U=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index e28a6c7b17c..da0e535c1bc 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nfXEX1GxtmOcb0reRyO0OyQkSHeUWtQW+SZ8thxor+s=";
+    sha256 = "sha256-zDiJlwcDTLCU+WpJ6Jz6tve4oV+XMRYOtppC2fj/HgU=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index b4a566030d0..2a3b25bc582 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.1";
-  hash = "sha256-NwxS5niE0dnCG5d+lzPcwYzIR2WmsgGBT77VDCbfThQ=";
+  version = "3.79.2";
+  hash = "sha256-hwcHDI74CgYp2vhQyKspKQ6T/O55f6g/cZvb9z1np4E=";
 }
diff --git a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
index baf162e88d0..04585565a33 100644
--- a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
+++ b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
@@ -1,22 +1,25 @@
 diff --git a/Configure b/Configure
-index f0ad787bc4..a48d2008c6 100755
+index a558e5ab1a..9a884f0b0f 100755
 --- a/Configure
 +++ b/Configure
-@@ -1688,17 +1688,6 @@ unless ($disabled{devcryptoeng}) {
+@@ -1714,20 +1714,6 @@ unless ($disabled{devcryptoeng}) {
+ 
  unless ($disabled{ktls}) {
      $config{ktls}="";
-     if ($target =~ m/^linux/) {
--        my $usr = "/usr/$config{cross_compile_prefix}";
--        chop($usr);
--        if ($config{cross_compile_prefix} eq "") {
--            $usr = "/usr";
--        }
--        my $minver = (4 << 16) + (13 << 8) + 0;
--        my @verstr = split(" ",`cat $usr/include/linux/version.h | grep LINUX_VERSION_CODE`);
--
--        if ($verstr[2] < $minver) {
+-    my $cc = $config{CROSS_COMPILE}.$config{CC};
+-    if ($target =~ m/^linux/) {
+-        system("printf '#include <sys/types.h>\n#include <linux/tls.h>' | $cc -E - >/dev/null 2>&1");
+-        if ($? != 0) {
 -            disable('too-old-kernel', 'ktls');
 -        }
-     } elsif ($target =~ m/^BSD/) {
-         my $cc = $config{CROSS_COMPILE}.$config{CC};
-         system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+-    } elsif ($target =~ m/^BSD/) {
+-        system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+-        if ($? != 0) {
+-            disable('too-old-freebsd', 'ktls');
+-        }
+-    } else {
+-        disable('not-linux-or-freebsd', 'ktls');
+-    }
+ }
+ 
+ push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls});
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 78cc680c7be..62cc8e24f41 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -130,7 +130,9 @@ let
       "-DUSE_CRYPTODEV_DIGESTS"
     ] ++ lib.optional enableSSL2 "enable-ssl2"
       ++ lib.optional enableSSL3 "enable-ssl3"
-      ++ lib.optional (lib.versionAtLeast version "3.0.0") "enable-ktls"
+      # We select KTLS here instead of the configure-time detection (which we patch out).
+      # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
+      ++ lib.optional (stdenv.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
       ++ lib.optional (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
       # OpenSSL needs a specific `no-shared` configure flag.
       # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
@@ -228,8 +230,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.5";
-    sha256 = "sha256-qn2Nm+9xrWUlxVuhHl9Dl4ic5Jwsk0nc6m0+TwsCSno=";
+    version = "3.0.7";
+    sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index b035df88e66..32571d9e9ab 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -188,7 +188,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.freedesktop.org/wiki/Software/polkit";
     description = "A toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes";
     license = licenses.lgpl2Plus;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     maintainers = teams.freedesktop.members ++ (with maintainers; [ ]);
   };
 }
diff --git a/pkgs/development/libraries/protobuf/3.19.nix b/pkgs/development/libraries/protobuf/3.19.nix
index 8e8674f1504..c62e4d46ce8 100644
--- a/pkgs/development/libraries/protobuf/3.19.nix
+++ b/pkgs/development/libraries/protobuf/3.19.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.19.5";
-  sha256 = "sha256-C5ZfPXHtUtNjPGS4tbswCwVH1gjd6A64KtIR16DgHzQ=";
+  version = "3.19.6";
+  sha256 = "sha256-+ul9F8tyrwk2p25Dd9ragqwpYzdxdeGjpXhLAwKYWfM=";
 }
diff --git a/pkgs/development/libraries/protobuf/3.20.nix b/pkgs/development/libraries/protobuf/3.20.nix
index d518e7298e9..818e65639e5 100644
--- a/pkgs/development/libraries/protobuf/3.20.nix
+++ b/pkgs/development/libraries/protobuf/3.20.nix
@@ -1,6 +1,6 @@
 { callPackage, abseil-cpp, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.20.2";
-  sha256 = "sha256-7hLTIujvYIGRqBQgPHrCq0XOh0GJrePBszXJnBFaXVM=";
+  version = "3.20.3";
+  sha256 = "sha256-u/1Yb8+mnDzc3OwirpGESuhjkuKPgqDAvlgo3uuzbbk=";
 }
diff --git a/pkgs/development/libraries/protobuf/3.21.nix b/pkgs/development/libraries/protobuf/3.21.nix
index c23afb9138f..6ba9ca31aba 100644
--- a/pkgs/development/libraries/protobuf/3.21.nix
+++ b/pkgs/development/libraries/protobuf/3.21.nix
@@ -1,6 +1,6 @@
 { callPackage, abseil-cpp, ... }:
 
 callPackage ./generic-v3-cmake.nix {
-  version = "3.21.6";
-  sha256 = "sha256-6Omd2O/eIZIgod3YV+zIIv+GqT+trith6+eepFEJIWM=";
+  version = "3.21.8";
+  sha256 = "sha256-cSNHX18CvMmydpYWqfe6WWk9rGxIlFfY/85rfSyznU4=";
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 033331c474a..83f73c99307 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,207 +1,207 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "fe5fca853c09c7e03a2ff66dac21584e3307984d",
-    "sha256": "0z8vkr3a20sb428m5kizgj33fkrznqzhwc0mh1rdqivlcsfp4kfi"
+    "rev": "0ff905d194e273e04e95b72dbbfd4e58193ecbaa",
+    "sha256": "1jv4xjxdr6xbm4q8fk0ijhl845qnnhxqmwkzqg2ssxdn015iabj9"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "ccc9a61d10404a4999dec61fdb513aa50f265cc3",
-    "sha256": "1l4h721shvc5cy5n2ykj0bhi5bgn3c8w1dmiwxh45rnb6qz971da"
+    "rev": "80b43bfe4109820fb7feddb4a16e227a03bc1c4e",
+    "sha256": "1m3c0znrm63b2wbz7vghxrh22lxdp1s7bwc00qfwhgjn1ajyrp71"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "1d9324ce38ce5100d827942eda67fe634753655b",
-    "sha256": "1k00pibnadgjnvv42kfq5pynr0gljv35hri6k5gfswqw347dr6f8"
+    "rev": "3f8c9f144acbe921a759d261e1314614793f89e0",
+    "sha256": "1k680n1gvj55i0yb7zrlbai4w3mvhhcbbpmcgm1wlv29rg268gi4"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "e44097b63d17ba3178a637df7fac51ddc51cb48b",
-    "sha256": "071q48qnszwqkmdpf14nqzbyqs62apfjhm0640fggv5ydgrbqw6j"
+    "rev": "98c727f273fc83c24550274bd2728e1aafbd213a",
+    "sha256": "1hwswan0yw6l4rka60ch173sd71ijx0y15gb2hnd3mhzws8gjsb5"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "841083c263f16f8acb81e4915bf24bbed0461c9a",
-    "sha256": "1iic9q8qj6bz6qznfr0jdjdi3a72lb433d0k711cfz2np2i8ajz1"
+    "rev": "055c6d6e49c5ea369990e7078fd534392a0ba6b9",
+    "sha256": "0r07yjdlxzk34br905da5kcm6xda50907nrffkw99683ix9y64ag"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "01e8b04b121712ea0a2b2793ce13f4dd5e9cfcf8",
-    "sha256": "1mgm4dpsw7k79znw0h72h614i0lvivvbp8w67np2nqp411wghgaa"
+    "rev": "6796953f92a1d3af30d0676e56ec5dfd82199611",
+    "sha256": "16zh10rm2b4sk9mn4r4sfp2mzvrxlz4nqj8bpiy055mplz5day39"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "502612c72a2cd3b3b0c4cff926e7764d74106d33",
-    "sha256": "0g9y0gi78v256zv70dl3fbpwr4ihs2i99pis3x4m3br5w1p7lknq"
+    "rev": "8e1a57efa1ba3eabbf44098ce6ede3d130c57b5d",
+    "sha256": "19v7la492414d0qzqdqnbhpxpg0hsqll6ixhv4jrckvdaqv7iqxz"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "b3aaf1482c48bbc0ca4f7c7934597c055afe4b6a",
-    "sha256": "12ia5zr7ajlfxjsdc4qhwjcyyc7vwr4ihs244v40y8ym2p0hm02l"
+    "rev": "45d43c04088efb8346979f633f72bb1f23183461",
+    "sha256": "1ad6r1zwzzvl1i2rxkjgp8x5k4ahcf6grfq6xarbbj9qvvb08ny4"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "032bc4f434e1a914dfc29651533d491160d06add",
-    "sha256": "1r2az30pv2kvj6hif6ngmc8b2nf0rwv2rgss5mf9ks85kglvmy51"
+    "rev": "e3e926a66f0a4ffbf82f0df1a5f570d759faad4f",
+    "sha256": "1ji5qn9bhyz30z12dvh97xxi3ga9b4lymdc7kmzmcd37y56q9s5c"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "0a2d4651362810600d2ff7272772d5908bb8714b",
-    "sha256": "1qzfyarc910rg308lydaniwbr49a6wl0hwh74a5w223bl9qqi5mj"
+    "rev": "ce0202d67bf1ab2bb887f58122b20eab5b6c1d5d",
+    "sha256": "11c24b2pzjcv14xix96fghyx3j3kw6rmhh499wqwc0qy5mjb6kpw"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "e6e1e58ec28fd0f2e6426e6962cc4ccddb493349",
-    "sha256": "1780flyc57bvicvgp071590kmhgm4nfrfys2b0adbmnkwb3fm3ij"
+    "rev": "a2b1600300cda89804d48ec90e0068a075fecc8b",
+    "sha256": "0ca666260mvvlf551076840pvh9r67v2bhmf0yf1xp06rxc205zq"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "9044695f4b1acdd7ec24e7b01f6a6ca61f982a75",
-    "sha256": "1rzshk2s4prglwcvr2wfr7qk0m3x3gq0d2wk741ifl7gb5nidsd5"
+    "rev": "1b83a9c73d6e5459ec4c2221b2bd7e5396b5e874",
+    "sha256": "07ry1bfim24aa530xslp8njn1bzalrmrwcx0xz2p2jilhfvvp5fc"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "ebdf5b38da6e3fe0a183702bcca395c589c459ed",
-    "sha256": "17igx94c3qx0ahpnkpxip4db4413q3hcr19hcs0j4wc03vkcmafr"
+    "rev": "f920a6cc2931402023840c223fce2fed321e28ea",
+    "sha256": "08r6h5d120x6lnzrjwscvv1dbjf720mg508wkyf8f999xncmp0yi"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "d40b67401afe7156b03c62c9a4d517b07555fe64",
-    "sha256": "1w9qcx7aczkf03qwm2jzjlj9k0qb8j0x4lfrj4lw7pwggb16f6p0"
+    "rev": "8bb9237e4e1462f405d931a8a513ed4c27632d9e",
+    "sha256": "1qd86wrvf3487s3f39m6pvcipa5s7zhn99kbfnmrhg0q35cr2816"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "c9bf2516187331033f0860976497eab0828cf25e",
-    "sha256": "0242gbj3rmkx4s1jzrb3kz07pl06xcfy0aqyb5xanzkg4sllrsaw"
+    "rev": "e7d4c37810976b6a1730d842cbca04b66ca7de30",
+    "sha256": "01kxc4185kb3pq2dfcjyl3n765gjwpf9l2r4q6gncy5v75a2y700"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "76f84c545429a1b988b79f971734ef4bc3e6643f",
-    "sha256": "1i1ca3n9i1rwpsxda2xm9ap3ys7a5jazbgzcwnwjb4qsxvjss6gz"
+    "rev": "f3dc18968c437c993886d3bfb668b62344a10860",
+    "sha256": "0li29bvvjcck1y4zhhc6imxa8ip3988yv2zz5k6anyasb0ywbip8"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "01315e31c5164c896a524175854c4b6df17fe166",
-    "sha256": "03vpynmkcb58x13mxjsjl07kh3jymcf295z5vybssqimyijlfw0m"
+    "rev": "f34ac77b5955126be60faa2b801be2d19dff896f",
+    "sha256": "1ip0sp70q4mircngs77p2m8njh8aw6f1q1w6f7nm0i2vkydpqfy2"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "fa07915d5b7c5ba16f2e8ba32a9066fe7eed0cb1",
-    "sha256": "1khpg9dfd0bgmqffzi4f2sgm8hnwzq9fqfg32y857mbc85f346bv"
+    "rev": "25ead89b0834f669e0a193e6d6cf2da25d33a452",
+    "sha256": "1jx44zr8kpjjg92by6sb9p5nqkadsqdhprngdbzyvxzhh1bplg1h"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "5cf67a0a93026ffd41d2ea5a11b289f46a518376",
-    "sha256": "13yjb9y69by7jqw7l2qvmpi8835x7j0vxcy2slkjjw2msrj0mq2y"
+    "rev": "95f52cb212f66e6022661fb7f2eb81a8c21e9f22",
+    "sha256": "0j508pc4fyz7gi9bjmyq4i0q9kmfhcckgwp38wcvgr6xm83f224n"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "e62b8b6d2f45a79652238b33f4bbe23023004ae7",
-    "sha256": "0598ckgkmqayq0c4c5fq6fyi098m74249qvz98m61bkk5629s24c"
+    "rev": "c7dae5f6041d6c076311f2d8ed13fcfe3598be70",
+    "sha256": "1fxvhrikjywh7gbz4lyivkvmsfnlqb7sd7r5rzqg6xi61x7i3fm4"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "74e8db97fdb9b55c4b4614b83f4bf17e00df55e9",
-    "sha256": "1f8hjsy3qyljyrpdjvwgq6a6ixlxyz3xjn32irzxx9vfxlp54wxf"
+    "rev": "9ff77702cc3649cbaf94046742d682d77cdea698",
+    "sha256": "0sq2j94csmd7ifd1hw4lwv7b82l59iz2258jg50d0j5hcf3acydz"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "87ad61716a7cba5a070d8a7b1756c8b2b48d5d53",
-    "sha256": "02rhr3qk2k3g8ydv7w3pkkk4vdlq0jbmsbp78k1difadsxhnw563"
+    "rev": "e2438e010a98d731317c10a64c095e0282b51ab0",
+    "sha256": "0bbj0blxz3zbz03a85drwysshl0qib0fl46ln22ll52819qw111v"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "aa705010da0f658b78c1155babce7091ae44529a",
-    "sha256": "1lkrxjk11qwanr7l84hqxlgk9y4shgznnxhlmfkp61ysnqladilx"
+    "rev": "5f2a598a9134167a0da2efcbf1249fc167ae3750",
+    "sha256": "1c3cg8fq681wrqk2xhajym1l9f8vfsffc8g0xp06m7lp11hr9bmq"
   },
   "qtscript": {
     "url": "https://invent.kde.org/qt/qt/qtscript.git",
-    "rev": "197f10dad6213ec4bb2e1a8305f19ec7475a6266",
-    "sha256": "1hksdl3ran5nv0q0idrdq78nk2qqmszq911fgxwfhifqakdqxyvp"
+    "rev": "b169b3e6ac1f9d66834ad61fbe35d3e25ff204bc",
+    "sha256": "01nfg53ixlggam5id16n1lc9n2anclrk6prvawi2fhpcnw4dpdza"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "631fd7bcc34802b7650c2b1dc73691463954d982",
-    "sha256": "17r19f5s2lmj6avic2sx2hm1xlcl3gnnmigvjla6gc1wr71wbgaw"
+    "rev": "e1faea1db52b91d90ef64dd57eb6529e323b5526",
+    "sha256": "1j1ckm2jca0h8zyfyq3kzf0dwp8jw9xwlpg7f7qi5dd8wd9dncmi"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "35eb5ac7eaef4745a38958c3ca780d7baa2e4f30",
-    "sha256": "0c6p495rmfw741xp8vfjxkac3d144id0gjccgshp8xh4syld52q9"
+    "rev": "5f1f73fdba8906f58c4554cbef9c1a72edcf0230",
+    "sha256": "0y7zyx9br4scbgkja5smkmyhlb6snqhir8mypsgdc4kllnbr4wkh"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "f9f7eee60adac72fcf6617d164e3bf61222bb5c5",
-    "sha256": "1ixnagxhxd54y9kn27jmhgb41zg5dzxywvai3gg7jh0v7gxr8pxp"
+    "rev": "180cb13048a24510f9a1b20796772d27da762bdd",
+    "sha256": "1s7y7rdicb50aa2kfsl74y0dm1qd2kd6fncyqaq55w0rn95fks87"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "c9abfcd5d88cb43c2a7c1d5ddecbff4cdd320694",
-    "sha256": "180ypj7k36c64vgq5028hxh22vfc9bk8s4vczc1dzri8sw8pnpmm"
+    "rev": "966cf2a2077a8470715894363ad46ea7df0665fa",
+    "sha256": "1a3f3fhwblifgsn3x6qhx4fmpxp458q4x8vp3jdxmynnkfiigafp"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "d1273416f25a15a6edf6ea56a07602cd7d99fe48",
-    "sha256": "00ikp6zv96g253msfrcvxavpyw9lv2ia5pjsysmxb4vikrk7j8vr"
+    "rev": "d32f4a479d38a11f547598004b975f4356424a16",
+    "sha256": "1n0f2pym6kl0fh5iqrln7z45hwmw8bha5s7bzswsihrq6zxkca4f"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "a9752b00a03438de8e5b080073816e12409404b7",
-    "sha256": "1m3bg2xb1sa0r3dv5jljk8hsj3gw71qqzk9bsa7j2jn50inb2fh5"
+    "rev": "83296f10ebdb9a666b11dc69f3a148c38b9c425c",
+    "sha256": "0gifl43lnddp0shbyhmijlm2qpqj6fp2xip96nxn1ql3g70f9kyv"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "32912a06aadfc3dcbc34e0a668ce2c78351eee6e",
-    "sha256": "096gdp349n94d9y5zy9k3k1xrf5g7lbla3j1cm4dala8rrnachg5"
+    "rev": "c4750dd02070ce246ff98cc5d137193825043912",
+    "sha256": "0zryql6g77hdqsh10gzmw9n8ibki35b5jvh96gjl29yrvan9w5v7"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "d4db9d8a4893a70e7ba3a6d5fe62f24f9ce745ca",
-    "sha256": "0srprryw0fr13d3wqpdjbcc9n6mcq1cwsdd5mdilqr7bz375qz8d"
+    "rev": "c38edd3a5501bcd53132e1e4abb7d25a98e0e1a9",
+    "sha256": "0if1mx6jic67pzv1p0xqb5fknfbawvzxw7fx90hc4kkrwjm73q7m"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "9fbb837b55887bec5d73fad142c853ef68db35b3",
-    "sha256": "12769162183qyxgr5p1bx2p2wlnkqg3fgz86ya9g4iznx0nagx19"
+    "rev": "8aebadb96c1e57ba89bba2e5962399f676207a32",
+    "sha256": "0hygidp8l580d10c1g6pgdxd3g6lza0dkgfm6bd2kjrigg71fzh0"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "8faf74a7966b520f0ac3eb4d88235f8ec63b31b8",
-    "sha256": "1khbpg9wds1gg6z7nj58hflzhy2gjaiy3v6pa930hb1r8sisp154"
+    "rev": "9c607c771acdb3d820be7f112db99213a6c6d7eb",
+    "sha256": "1dbilhkldvhwwd2j0g7mwz1jyw9zgzwyyx43rsmnmv9lh36pb3dc"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "fb1ca87aa1a12048199d2aabe9015b7222d2b773",
-    "sha256": "1rsx3zf0xnvayanxwpr5yniiyw2a8bwifhrkw2gzdczdyasxdfw7"
+    "rev": "4e35fe9429920067c17596986b486fb1c1e95db0",
+    "sha256": "1j74hfrrrb1irchlgqclbk3zjgg98clndfw576psa3zm8xg3szin"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "68a322c391c2eb92876fce42b9fc23ad2f3a1ecb",
-    "sha256": "0rd1zr39nckqlxmmgxf4zhkrh8vb3098z33ajsizz9ld5ylwkyw7"
+    "rev": "3087cdd0758258163299602550f7d4e72edf2a80",
+    "sha256": "19gsc842njdgmiqhkl7xqqry1d40phjwixzajzphv4s5vmcbxn5w"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "a066371747a7eb9de9b1ae38fbc41b2059080802",
-    "sha256": "0cjy399xx15z2y00bvh7jn8m8wjpx65gwg4gwrn3r2zpdw8aqqrb"
+    "rev": "594477769ecac4032ba116196493f3ba3db1aaed",
+    "sha256": "102r5jam8kc46bjlxf3jdjsr1jzdj5vfwmf4yypbhihwz436z791"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "87577dde04ed219bda776dabca86176149736331",
-    "sha256": "070s9ml8ixbmd7a7b49mnc0fya4wy3mx174n50acb99mmi7ar6z3"
+    "rev": "b1605fea61a6bbb599b720c54282bc8ddb0aacf0",
+    "sha256": "158hiqrshblw3axpryv0lqk74691njdc8qmdxbz28hzaaq6rxj5n"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "a2ef397d1833c7417138a14ae23c880ae434d8a6",
-    "sha256": "1jqx03wwklqak8sjjlgmi55r2l07ylsfdar1j9kb0zn1krh7d9mw"
+    "rev": "2a04b162451460ffc208c2c27acce16a18f763ce",
+    "sha256": "17h5bd94jhwqgzlb5w75rfgb3v0jkg6fm79kd0byzp7bvp7i7ibj"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "982f20eb585d77e5b5c721e05a466d7161f7f2d1",
-    "sha256": "0zl4bdxvdx2kfjwkd0rxvh70580g6idrgj4m3pyyw7z2jbzawpv3"
+    "rev": "9134cdba9386e408ce2ffe515ca0c3f6f6c66685",
+    "sha256": "03qs1griqx3bccaqas8mifbj4f4bhwfzc3f6knws3zy3mc9l8qzq"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "30e6c84fe2752cde8b53aff9d38c2095cd7c8761",
-    "sha256": "04i1282hyqqspdlvny1dz5006svq84rpqvnvlvsas83vxzhr1g1k"
+    "rev": "b798a0f0265538a9dd12b5c7e4dad84ba8e1db4e",
+    "sha256": "1lh9rci7bqrjw912blns369qs76c7lywnxmmmlhchrhk9l89ailk"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index ef625a7c763..35d8eae1abb 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,7 +1,7 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.6";
+  version = "5.15.7";
   overrides = {};
 
   mk = name: args:
diff --git a/pkgs/development/libraries/quictls/default.nix b/pkgs/development/libraries/quictls/default.nix
index 22981bfef7a..cd0ae4d3eef 100644
--- a/pkgs/development/libraries/quictls/default.nix
+++ b/pkgs/development/libraries/quictls/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quictls";
-  version = "3.0.5+quick_unstable-2022-07.05";
+  version = "3.0.7+quic1";
 
   src = fetchFromGitHub {
     owner = "quictls";
     repo = "openssl";
-    rev = "75e940831d0570d6b020cfebf128ae500f424867";
-    sha256 = "sha256-1HBGKafcCbM0RZWLvyl3vpSfGBsAcGDgjz1Nm/qclWM=";
+    rev = "openssl-${version}";
+    sha256 = "sha256-ZRS0ZV+/U4PD2lVE+PsUAWSuk5EFg5mOKYlwgY3Ecus=";
   };
 
   patches = [
@@ -108,6 +108,9 @@ stdenv.mkDerivation rec {
     "-DUSE_CRYPTODEV_DIGESTS"
   ] ++ lib.optional enableSSL2 "enable-ssl2"
     ++ lib.optional enableSSL3 "enable-ssl3"
+    # We select KTLS here instead of the configure-time detection (which we patch out).
+    # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
+    ++ lib.optional (stdenv.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
     ++ lib.optional stdenv.hostPlatform.isAarch64 "no-afalgeng"
     # OpenSSL needs a specific `no-shared` configure flag.
     # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index 2e163a79d59..857da102bb8 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -1,16 +1,13 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, nix-update-script
-
-# for passthru.tests
-, bazel
+, cmake
+, ninja
 , chromium
 , grpc
 , haskellPackages
 , mercurial
-, ninja
-, python3
+, python3Packages
 }:
 
 stdenv.mkDerivation rec {
@@ -21,48 +18,54 @@ stdenv.mkDerivation rec {
     owner = "google";
     repo = "re2";
     rev = version;
-    sha256 = "sha256-UontAjOXpnPcOgoFHjf+1WSbCR7h58/U7nn4meT200Y=";
+    hash = "sha256-UontAjOXpnPcOgoFHjf+1WSbCR7h58/U7nn4meT200Y=";
   };
 
-  preConfigure = ''
-    substituteInPlace Makefile --replace "/usr/local" "$out"
-    # we're using gnu sed, even on darwin
-    substituteInPlace Makefile  --replace "SED_INPLACE=sed -i '''" "SED_INPLACE=sed -i"
-  '';
+  outputs = [ "out" "dev" ];
 
-  buildFlags = lib.optionals stdenv.hostPlatform.isStatic [ "static" ];
+  nativeBuildInputs = [ cmake ninja ];
 
-  enableParallelBuilding = true;
+  postPatch = ''
+    substituteInPlace re2Config.cmake.in \
+      --replace "\''${PACKAGE_PREFIX_DIR}/" ""
+  '';
 
-  preCheck = "patchShebangs runtests";
-  doCheck = true;
-  checkTarget = if stdenv.hostPlatform.isStatic then "static-test" else "test";
+  # Needed for case-insensitive filesystems (i.e. MacOS) because a file named
+  # BUILD already exists.
+  cmakeBuildDir = "build_dir";
+
+  cmakeFlags = lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS:BOOL=ON";
 
-  installTargets = lib.optionals stdenv.hostPlatform.isStatic [ "static-install" ];
+  # This installs a pkg-config definition.
+  postInstall = ''
+    pushd "$src"
+    make common-install prefix="$dev" SED_INPLACE="sed -i"
+    popd
+  '';
 
-  doInstallCheck = true;
-  installCheckTarget = if stdenv.hostPlatform.isStatic then "static-testinstall" else "testinstall";
+  doCheck = true;
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
-    tests = {
-      inherit
-        chromium
-        grpc
-        mercurial;
-      inherit (python3.pkgs)
-        fb-re2
-        google-re2;
-      haskellPackages-re2 = haskellPackages.re2;
-    };
+  passthru.tests = {
+    inherit
+      chromium
+      grpc
+      mercurial;
+    inherit (python3Packages)
+      fb-re2
+      google-re2;
+    haskell-re2 = haskellPackages.re2;
   };
 
-  meta = {
+  meta = with lib; {
+    description = "A regular expression library";
+    longDescription = ''
+      RE2 is a fast, safe, thread-friendly alternative to backtracking regular
+      expression engines like those used in PCRE, Perl, and Python. It is a C++
+      library.
+    '';
+    license = licenses.bsd3;
     homepage = "https://github.com/google/re2";
-    description = "An efficient, principled regular expression library";
-    license = lib.licenses.bsd3;
-    platforms = with lib.platforms; all;
+    maintainers = with maintainers; [ azahi ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index de135e9168a..d1c854f0cfb 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-qYhFoRrQOlvYvVXhIFsa3dZuORDpZyVC5peeYmGNimw=";
+    hash = "sha256-lUWgZYGPu+IaLUrbtyC7R0o3Hq/q7C7BE8r7DAsiC30=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index d27d2bf008c..47cdccf41fc 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-zUT5+Ttmkrj51a9FS1tQxoYMS0Y0xV8uaCEJNur4khc=";
+    hash = "sha256-EoD48jBoJmIet4BDC6bYxOsKK2358SZ/NcZeM61q/5g=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 0c3e48289cb..27c1423d94e 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,14 +3,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Loader";
       rev = "sdk-${version}";
-      hash = "sha256-lmdImPeosHbAbEzPVW4K9Wkz/mF6gr8MVroGf0bDEPc=";
+      hash = "sha256-HWaa3JT0znhvqbvZdcsAwy8Dr6HDQp4rgpVmMOuCo0s=";
     });
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 5fca71ebf0c..34b5d4ff3c6 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wayland-protocols";
-  version = "1.26";
+  version = "1.27";
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
   src = fetchurl {
-    url = "https://wayland.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "04vgllmpmrv14x3x64ns01vgwx4hriljayjkz9idgbv83i63hly5";
+    url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
+    hash = "sha256-kEbxCkJdTioAlloDrPtrP7V1pWUDrHLCuGghxpZTN1w=";
   };
 
   postPatch = lib.optionalString doCheck ''
diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index 3bf11737eb3..b4a7777b891 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -25,6 +25,8 @@
 let
   mkFlag = optSet: flag: if optSet then "-D${flag}=ON" else "-D${flag}=OFF";
 
+  isCross = stdenv.buildPlatform != stdenv.hostPlatform;
+
   cmakeCommonFlags = [
     "-Wno-dev"
     (mkFlag custatsSupport "DETAILED_CU_STATS")
@@ -81,6 +83,8 @@ stdenv.mkDerivation rec {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/x265/files/test-ns.patch?id=1d1de341e1404a46b15ae3e84bc400d474cf1a2c";
       sha256 = "0zg3g53l07yh7ar5c241x50y5zp7g8nh8rh63ad4bdpchpc2f52d";
     })
+    # Fix detection of NEON (and armv6 build) :
+    ./fix-neon-detection.patch
   ];
 
   postPatch = ''
@@ -107,7 +111,7 @@ stdenv.mkDerivation rec {
     "-DENABLE_SHARED=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
     "-DHIGH_BIT_DEPTH=OFF"
     "-DENABLE_HDR10_PLUS=ON"
-  ] ++ [
+    (mkFlag (isCross && stdenv.hostPlatform.isAarch) "CROSS_COMPILE_ARM")
     (mkFlag cliSupport "ENABLE_CLI")
     (mkFlag unittestsSupport "ENABLE_TESTS")
   ] ++ lib.optionals (multibitdepthSupport) [
diff --git a/pkgs/development/libraries/x265/fix-neon-detection.patch b/pkgs/development/libraries/x265/fix-neon-detection.patch
new file mode 100644
index 00000000000..dbb826e5466
--- /dev/null
+++ b/pkgs/development/libraries/x265/fix-neon-detection.patch
@@ -0,0 +1,28 @@
+commit 72489cd0a1c229258abe4f20e4fdfd414dfa88da
+Author: rnhmjoj <rnhmjoj@inventati.org>
+Date:   Sun Oct 2 00:15:24 2022 +0200
+
+    Fix NEON detection
+
+diff --git a/cmake/FindNeon.cmake b/cmake/FindNeon.cmake
+index 0062449..9c436d9 100644
+--- a/cmake/FindNeon.cmake
++++ b/cmake/FindNeon.cmake
+@@ -1,10 +1,11 @@
+ include(FindPackageHandleStandardArgs)
+ 
+ # Check the version of neon supported by the ARM CPU
+-execute_process(COMMAND cat /proc/cpuinfo | grep Features | grep neon
+-                OUTPUT_VARIABLE neon_version
+-                ERROR_QUIET
+-                OUTPUT_STRIP_TRAILING_WHITESPACE)
+-if(neon_version)
+-    set(CPU_HAS_NEON 1)
++message(STATUS "Detecting NEON support")
++execute_process(COMMAND sed -n "/Features.* neon/q 1" /proc/cpuinfo
++                RESULT_VARIABLE CPU_HAS_NEON)
++if(CPU_HAS_NEON)
++    message(STATUS "Detecting NEON support - supported")
++else()
++    message(STATUS "Detecting NEON support - not supported" )
+ endif()
diff --git a/pkgs/development/libraries/zlib/CVE-2022-37434.patch b/pkgs/development/libraries/zlib/CVE-2022-37434.patch
deleted file mode 100644
index ad2a849d3b8..00000000000
--- a/pkgs/development/libraries/zlib/CVE-2022-37434.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
-From: Mark Adler <fork@madler.net>
-Date: Sat, 30 Jul 2022 15:51:11 -0700
-Subject: [PATCH] Fix a bug when getting a gzip header extra field with
- inflate().
-
-If the extra field was larger than the space the user provided with
-inflateGetHeader(), and if multiple calls of inflate() delivered
-the extra header data, then there could be a buffer overflow of the
-provided space. This commit assures that provided space is not
-exceeded.
----
- inflate.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/inflate.c b/inflate.c
-index 7be8c6366..7a7289749 100644
---- a/inflate.c
-+++ b/inflate.c
-@@ -763,9 +763,10 @@ int flush;
-                 copy = state->length;
-                 if (copy > have) copy = have;
-                 if (copy) {
-+                    len = state->head->extra_len - state->length;
-                     if (state->head != Z_NULL &&
--                        state->head->extra != Z_NULL) {
--                        len = state->head->extra_len - state->length;
-+                        state->head->extra != Z_NULL &&
-+                        len < state->head->extra_max) {
-                         zmemcpy(state->head->extra + len, next,
-                                 len + copy > state->head->extra_max ?
-                                 state->head->extra_max - len : copy);
-
-From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001
-From: Mark Adler <fork@madler.net>
-Date: Mon, 8 Aug 2022 10:50:09 -0700
-Subject: [PATCH] Fix extra field processing bug that dereferences NULL
- state->head.
-
-The recent commit to fix a gzip header extra field processing bug
-introduced the new bug fixed here.
----
- inflate.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/inflate.c b/inflate.c
-index 7a7289749..2a3c4fe98 100644
---- a/inflate.c
-+++ b/inflate.c
-@@ -763,10 +763,10 @@ int flush;
-                 copy = state->length;
-                 if (copy > have) copy = have;
-                 if (copy) {
--                    len = state->head->extra_len - state->length;
-                     if (state->head != Z_NULL &&
-                         state->head->extra != Z_NULL &&
--                        len < state->head->extra_max) {
-+                        (len = state->head->extra_len - state->length) <
-+                            state->head->extra_max) {
-                         zmemcpy(state->head->extra + len, next,
-                                 len + copy > state->head->extra_max ?
-                                 state->head->extra_max - len : copy);
diff --git a/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch b/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch
deleted file mode 100644
index 85a6a7e3ab4..00000000000
--- a/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From ec3df00224d4b396e2ac6586ab5d25f673caa4c2 Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Wed, 30 Mar 2022 11:14:53 -0700
-Subject: [PATCH] Correct incorrect inputs provided to the CRC functions.
-
-The previous releases of zlib were not sensitive to incorrect CRC
-inputs with bits set above the low 32. This commit restores that
-behavior, so that applications with such bugs will continue to
-operate as before.
----
- crc32.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/crc32.c b/crc32.c
-index a1bdce5c2..451887bc7 100644
---- a/crc32.c
-+++ b/crc32.c
-@@ -630,7 +630,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
- #endif /* DYNAMIC_CRC_TABLE */
- 
-     /* Pre-condition the CRC */
--    crc ^= 0xffffffff;
-+    crc = (~crc) & 0xffffffff;
- 
-     /* Compute the CRC up to a word boundary. */
-     while (len && ((z_size_t)buf & 7) != 0) {
-@@ -749,7 +749,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
- #endif /* DYNAMIC_CRC_TABLE */
- 
-     /* Pre-condition the CRC */
--    crc ^= 0xffffffff;
-+    crc = (~crc) & 0xffffffff;
- 
- #ifdef W
- 
-@@ -1077,7 +1077,7 @@ uLong ZEXPORT crc32_combine64(crc1, crc2, len2)
- #ifdef DYNAMIC_CRC_TABLE
-     once(&made, make_crc_table);
- #endif /* DYNAMIC_CRC_TABLE */
--    return multmodp(x2nmodp(len2, 3), crc1) ^ crc2;
-+    return multmodp(x2nmodp(len2, 3), crc1) ^ (crc2 & 0xffffffff);
- }
- 
- /* ========================================================================= */
-@@ -1112,5 +1112,5 @@ uLong crc32_combine_op(crc1, crc2, op)
-     uLong crc2;
-     uLong op;
- {
--    return multmodp(op, crc1) ^ crc2;
-+    return multmodp(op, crc1) ^ (crc2 & 0xffffffff);
- }
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index a51fec31c14..52654b6541e 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -21,16 +21,18 @@ assert shared || static;
 
 assert splitStaticOutput -> static;
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   pname = "zlib";
-  version = "1.2.12";
+  version = "1.2.13";
 
   src = fetchurl {
-    urls =
-      [ "https://www.zlib.net/fossils/zlib-${version}.tar.gz"  # stable archive path
-        "mirror://sourceforge/libpng/zlib/${version}/zlib-${version}.tar.gz"
-      ];
-    sha256 = "91844808532e5ce316b3c010929493c0244f3d37593afd6de04f71821d5136d9";
+    urls = [
+      # This URL works for 1.2.13 only; hopefully also for future releases.
+      "https://github.com/madler/zlib/releases/download/v${version}/zlib-${version}.tar.gz"
+      # Stable archive path, but captcha can be encountered, causing hash mismatch.
+      "https://www.zlib.net/fossils/zlib-${version}.tar.gz"
+    ];
+    hash = "sha256-s6JN6XqP28g1uYMxaVAQMLiXcDG8tUs7OsE3QPhGqzA=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -40,23 +42,18 @@ stdenv.mkDerivation (rec {
       --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
   '';
 
-  patches = [
-    ./fix-configure-issue-cross.patch
-    # Starting zlib 1.2.12, zlib is stricter to incorrect CRC inputs
-    # with bits set above the low 32.
-    # see https://github.com/madler/zlib/issues/618
-    # TODO: remove the patch if upstream releases https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2
-    # see https://github.com/NixOS/nixpkgs/issues/170539 for history.
-    ./comprehensive-crc-validation-for-wrong-implementations.patch
-    ./CVE-2022-37434.patch
-  ];
-
   strictDeps = true;
   outputs = [ "out" "dev" ]
     ++ lib.optional splitStaticOutput "static";
   setOutputFlags = false;
   outputDoc = "dev"; # single tiny man3 page
 
+  dontConfigure = stdenv.hostPlatform.libc == "msvcrt";
+
+  preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    export CHOST=${stdenv.hostPlatform.config}
+  '';
+
   # For zlib's ./configure (as of verion 1.2.11), the order
   # of --static/--shared flags matters!
   # `--shared --static` builds only static libs, while
@@ -128,20 +125,10 @@ stdenv.mkDerivation (rec {
     "SHARED_MODE=1"
   ];
 
-  passthru = {
-    inherit version;
-  };
-
   meta = with lib; {
     homepage = "https://zlib.net";
     description = "Lossless data-compression library";
     license = licenses.zlib;
     platforms = platforms.all;
   };
-} // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
-  preConfigure = ''
-    export CHOST=${stdenv.hostPlatform.config}
-  '';
-} // lib.optionalAttrs (stdenv.hostPlatform.libc == "msvcrt") {
-  dontConfigure = true;
-})
+}
diff --git a/pkgs/development/libraries/zlib/fix-configure-issue-cross.patch b/pkgs/development/libraries/zlib/fix-configure-issue-cross.patch
deleted file mode 100644
index 0136071eabe..00000000000
--- a/pkgs/development/libraries/zlib/fix-configure-issue-cross.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 05796d3d8d5546cf1b4dfe2cd72ab746afae505d Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Mon, 28 Mar 2022 18:34:10 -0700
-Subject: [PATCH] Fix configure issue that discarded provided CC definition.
-
----
- configure | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/configure b/configure
-index 52ff4a04e..3fa3e8618 100755
---- a/configure
-+++ b/configure
-@@ -174,7 +174,10 @@ if test -z "$CC"; then
-   else
-     cc=${CROSS_PREFIX}cc
-   fi
-+else
-+  cc=${CC}
- fi
-+
- cflags=${CFLAGS-"-O3"}
- # to force the asm version use: CFLAGS="-O3 -DASMV" ./configure
- case "$cc" in