summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
authorVladimír Čunát <v@cunat.cz>2023-10-26 10:36:50 +0200
committerVladimír Čunát <v@cunat.cz>2023-10-26 10:36:50 +0200
commitd811555465785e76fc06872f4bb14d4dd1dfed8c (patch)
tree91db30ffe3553dcd7c9766c4163687f7b951dd16 /pkgs
parent7054a80f3b8061bd532e407f46f60e484a5e9a9c (diff)
parent0f8647b0c2bce447f8ce27428de242727104ffb0 (diff)
downloadnixpkgs-d811555465785e76fc06872f4bb14d4dd1dfed8c.tar
nixpkgs-d811555465785e76fc06872f4bb14d4dd1dfed8c.tar.gz
nixpkgs-d811555465785e76fc06872f4bb14d4dd1dfed8c.tar.bz2
nixpkgs-d811555465785e76fc06872f4bb14d4dd1dfed8c.tar.lz
nixpkgs-d811555465785e76fc06872f4bb14d4dd1dfed8c.tar.xz
nixpkgs-d811555465785e76fc06872f4bb14d4dd1dfed8c.tar.zst
nixpkgs-d811555465785e76fc06872f4bb14d4dd1dfed8c.zip
Merge branch 'staging' into staging-next
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix16
-rw-r--r--pkgs/applications/audio/industrializer/default.nix2
-rw-r--r--pkgs/applications/audio/kapitonov-plugins-pack/default.nix3
-rw-r--r--pkgs/applications/audio/mpg123/default.nix4
-rw-r--r--pkgs/applications/audio/paulstretch/default.nix3
-rw-r--r--pkgs/applications/audio/stone-phaser/default.nix4
-rw-r--r--pkgs/applications/audio/string-machine/default.nix4
-rw-r--r--pkgs/applications/editors/neovim/tests/default.nix2
-rw-r--r--pkgs/applications/editors/neovim/wrapper.nix56
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/graphics/autotrace/default.nix3
-rw-r--r--pkgs/applications/graphics/fbida/default.nix4
-rw-r--r--pkgs/applications/kde/marble.nix4
-rw-r--r--pkgs/applications/misc/adobe-reader/builder.sh2
-rw-r--r--pkgs/applications/misc/mission-center/default.nix2
-rw-r--r--pkgs/applications/misc/volnoti/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/firefox-bin/default.nix21
-rw-r--r--pkgs/applications/networking/localproxy/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/neomutt/default.nix3
-rw-r--r--pkgs/applications/networking/p2p/freenet/default.nix3
-rw-r--r--pkgs/applications/science/chemistry/gwyddion/default.nix4
-rw-r--r--pkgs/applications/science/logic/vampire/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/xterm/default.nix4
-rw-r--r--pkgs/applications/version-management/hub/default.nix6
-rw-r--r--pkgs/applications/video/clapper/default.nix2
-rw-r--r--pkgs/applications/video/kodi/unwrapped.nix2
-rw-r--r--pkgs/applications/window-managers/hyprwm/hyprland/default.nix2
-rw-r--r--pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix2
-rw-r--r--pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix2
-rw-r--r--pkgs/applications/window-managers/i3/lock-blur.nix4
-rw-r--r--pkgs/applications/window-managers/i3/lock-color.nix4
-rw-r--r--pkgs/applications/window-managers/i3/lock.nix4
-rw-r--r--pkgs/applications/window-managers/i3/wmfocus.nix4
-rw-r--r--pkgs/applications/window-managers/jay/default.nix2
-rw-r--r--pkgs/applications/window-managers/sway/default.nix4
-rw-r--r--pkgs/applications/window-managers/wayfire/default.nix2
-rw-r--r--pkgs/applications/window-managers/weston/default.nix4
-rw-r--r--pkgs/build-support/binary-cache/default.nix13
-rw-r--r--pkgs/build-support/binary-cache/make-binary-cache.py2
-rw-r--r--pkgs/build-support/cc-wrapper/add-hardening.sh9
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh2
-rw-r--r--pkgs/build-support/closure-info.nix14
-rw-r--r--pkgs/build-support/fetchbzr/builder.sh2
-rw-r--r--pkgs/build-support/fetchcvs/builder.sh2
-rw-r--r--pkgs/build-support/fetchdarcs/builder.sh2
-rw-r--r--pkgs/build-support/fetchdocker/fetchdocker-builder.sh2
-rw-r--r--pkgs/build-support/fetchfossil/builder.sh2
-rw-r--r--pkgs/build-support/fetchgit/builder.sh2
-rw-r--r--pkgs/build-support/fetchhg/builder.sh2
-rw-r--r--pkgs/build-support/fetchipfs/builder.sh2
-rw-r--r--pkgs/build-support/fetchmtn/builder.sh2
-rw-r--r--pkgs/build-support/fetchsvn/builder.sh2
-rw-r--r--pkgs/build-support/fetchsvnssh/builder.sh2
-rw-r--r--pkgs/build-support/fetchurl/builder.sh2
-rw-r--r--pkgs/build-support/references-by-popularity/default.nix13
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix3
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.py20
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.sh4
-rw-r--r--pkgs/by-name/ar/arrpc/package.nix3
-rw-r--r--pkgs/by-name/ce/celluloid/package.nix2
-rw-r--r--pkgs/by-name/ju/justbuild/package.nix6
-rw-r--r--pkgs/by-name/va/valijson/package.nix28
-rw-r--r--pkgs/data/misc/shared-mime-info/default.nix10
-rw-r--r--pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch31
-rw-r--r--pkgs/desktops/gnustep/make/builder.sh2
-rwxr-xr-xpkgs/development/compilers/aspectj/builder.sh2
-rw-r--r--pkgs/development/compilers/binaryen/default.nix4
-rw-r--r--pkgs/development/compilers/chicken/4/fetchegg/builder.sh2
-rw-r--r--pkgs/development/compilers/emscripten/default.nix9
-rwxr-xr-xpkgs/development/compilers/fpc/binary-builder-darwin.sh2
-rwxr-xr-xpkgs/development/compilers/fpc/binary-builder.sh2
-rw-r--r--pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch85
-rw-r--r--pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch84
-rw-r--r--pkgs/development/compilers/gcc/patches/default.nix4
-rw-r--r--pkgs/development/compilers/glslang/default.nix4
-rw-r--r--pkgs/development/compilers/ios-cross-compile/9.2_builder.sh2
-rw-r--r--pkgs/development/compilers/llvm/16/lld/add-table-base.patch190
-rw-r--r--pkgs/development/compilers/llvm/16/lld/default.nix1
-rw-r--r--pkgs/development/compilers/ocaml/builder.sh2
-rw-r--r--pkgs/development/compilers/rust/1_73.nix (renamed from pkgs/development/compilers/rust/1_72.nix)31
-rwxr-xr-xpkgs/development/compilers/rust/print-hashes.sh1
-rw-r--r--pkgs/development/compilers/rust/rustc.nix20
-rw-r--r--pkgs/development/compilers/squeak/default.nix5
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix7
-rw-r--r--pkgs/development/interpreters/guile/2.2.nix6
-rw-r--r--pkgs/development/interpreters/guile/3.0.nix7
-rw-r--r--pkgs/development/interpreters/nelua/default.nix6
-rw-r--r--pkgs/development/interpreters/python/default.nix4
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix5
-rw-r--r--pkgs/development/interpreters/python/hooks/sphinx-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/mk-python-derivation.nix7
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix4
-rw-r--r--pkgs/development/libraries/SDL2/default.nix4
-rw-r--r--pkgs/development/libraries/Xaw3d/default.nix6
-rw-r--r--pkgs/development/libraries/audio/game-music-emu/default.nix5
-rw-r--r--pkgs/development/libraries/audio/libmysofa/default.nix4
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix4
-rw-r--r--pkgs/development/libraries/audio/lilv/default.nix41
-rw-r--r--pkgs/development/libraries/audio/lilv/lilv-pkgconfig.patch6
-rw-r--r--pkgs/development/libraries/audiofile/default.nix3
-rw-r--r--pkgs/development/libraries/cairo/default.nix162
-rw-r--r--pkgs/development/libraries/check/default.nix3
-rw-r--r--pkgs/development/libraries/cogl/default.nix3
-rw-r--r--pkgs/development/libraries/glibc/2.38-master.patch.gzbin32759 -> 35936 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/glibc/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/locales-builder.sh2
-rw-r--r--pkgs/development/libraries/gnu-config/default.nix8
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix2
-rw-r--r--pkgs/development/libraries/gtk-sharp/builder.sh2
-rw-r--r--pkgs/development/libraries/imlib2/default.nix34
-rw-r--r--pkgs/development/libraries/jbig2dec/default.nix14
-rw-r--r--pkgs/development/libraries/kde-frameworks/baloo.nix15
-rw-r--r--pkgs/development/libraries/kde-frameworks/fetch.sh2
-rw-r--r--pkgs/development/libraries/kde-frameworks/kio/default.nix6
-rw-r--r--pkgs/development/libraries/kde-frameworks/srcs.nix664
-rw-r--r--pkgs/development/libraries/libcbor/default.nix14
-rw-r--r--pkgs/development/libraries/libdeflate/default.nix4
-rw-r--r--pkgs/development/libraries/libdrm/default.nix15
-rw-r--r--pkgs/development/libraries/libffi/default.nix6
-rw-r--r--pkgs/development/libraries/libglvnd/default.nix6
-rw-r--r--pkgs/development/libraries/libical/default.nix5
-rw-r--r--pkgs/development/libraries/libimagequant/Cargo.lock53
-rw-r--r--pkgs/development/libraries/libimagequant/default.nix4
-rw-r--r--pkgs/development/libraries/libiscsi/default.nix5
-rw-r--r--pkgs/development/libraries/libtiff/default.nix4
-rw-r--r--pkgs/development/libraries/libtiff/headers.patch5
-rw-r--r--pkgs/development/libraries/libtiff/rename-version.patch17
-rw-r--r--pkgs/development/libraries/libuv/default.nix12
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libvterm-neovim/default.nix6
-rw-r--r--pkgs/development/libraries/libwacom/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/minizip/default.nix12
-rw-r--r--pkgs/development/libraries/onnxruntime/default.nix6
-rw-r--r--pkgs/development/libraries/opencore-amr/default.nix6
-rw-r--r--pkgs/development/libraries/opencv/3.x.nix4
-rw-r--r--pkgs/development/libraries/opencv/4.x.nix6
-rw-r--r--pkgs/development/libraries/openexr/3.nix4
-rw-r--r--pkgs/development/libraries/openfec/default.nix18
-rw-r--r--pkgs/development/libraries/openjpeg/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix36
-rw-r--r--pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch13
-rw-r--r--pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch27
-rw-r--r--pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch30
-rw-r--r--pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch50
-rw-r--r--pkgs/development/libraries/pipewire/0095-spa-data-dir.patch12
-rw-r--r--pkgs/development/libraries/pipewire/default.nix37
-rw-r--r--pkgs/development/libraries/protobuf/21.nix6
-rw-r--r--pkgs/development/libraries/protobuf/23.nix6
-rw-r--r--pkgs/development/libraries/protobuf/24.nix6
-rw-r--r--pkgs/development/libraries/protobuf/3.21.nix6
-rw-r--r--pkgs/development/libraries/protobuf/3.23.nix6
-rw-r--r--pkgs/development/libraries/protobuf/3.24.nix6
-rw-r--r--pkgs/development/libraries/protobuf/generic.nix (renamed from pkgs/development/libraries/protobuf/generic-v3-cmake.nix)36
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix3
-rw-r--r--pkgs/development/libraries/qt-5/5.15/modules1
-rw-r--r--pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch79
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json165
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix52
-rw-r--r--pkgs/development/libraries/rapidfuzz-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix13
-rw-r--r--pkgs/development/libraries/spirv-headers/default.nix6
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/ti-rpc/default.nix9
-rw-r--r--pkgs/development/libraries/usrsctp/clang-fix-build.patch183
-rw-r--r--pkgs/development/libraries/usrsctp/default.nix7
-rw-r--r--pkgs/development/libraries/vulkan-headers/default.nix6
-rwxr-xr-xpkgs/development/libraries/vulkan-headers/update.sh11
-rw-r--r--pkgs/development/libraries/vulkan-loader/default.nix6
-rw-r--r--pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch4
-rw-r--r--pkgs/development/libraries/vulkan-utility-libraries/default.nix6
-rw-r--r--pkgs/development/libraries/webrtc-audio-processing/default.nix2
-rw-r--r--pkgs/development/libraries/wtk/builder.sh2
-rw-r--r--pkgs/development/libraries/wxSVG/default.nix2
-rw-r--r--pkgs/development/libraries/zeromq/4.x.nix17
-rw-r--r--pkgs/development/lua-modules/aliases.nix3
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix931
-rw-r--r--pkgs/development/lua-modules/overrides.nix46
-rw-r--r--pkgs/development/perl-modules/generic/builder.sh2
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix8
-rw-r--r--pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff27
-rw-r--r--pkgs/development/python-modules/aws-sam-translator/default.nix14
-rw-r--r--pkgs/development/python-modules/boto3/default.nix4
-rw-r--r--pkgs/development/python-modules/botocore/default.nix4
-rw-r--r--pkgs/development/python-modules/cffi/darwin-use-libffi-closures.diff11
-rw-r--r--pkgs/development/python-modules/cffi/default.nix60
-rw-r--r--pkgs/development/python-modules/fastapi/default.nix3
-rw-r--r--pkgs/development/python-modules/flask-cors/default.nix36
-rw-r--r--pkgs/development/python-modules/jedi/default.nix25
-rw-r--r--pkgs/development/python-modules/markdown-macros/default.nix4
-rw-r--r--pkgs/development/python-modules/moto/default.nix168
-rw-r--r--pkgs/development/python-modules/pandas/default.nix15
-rw-r--r--pkgs/development/python-modules/pandas/installer-fix.patch25
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix4
-rw-r--r--pkgs/development/python-modules/pillow/default.nix4
-rw-r--r--pkgs/development/python-modules/pluggy/default.nix11
-rw-r--r--pkgs/development/python-modules/protobuf/3.nix90
-rw-r--r--pkgs/development/python-modules/protobuf/default.nix24
-rw-r--r--pkgs/development/python-modules/psycopg2/default.nix18
-rw-r--r--pkgs/development/python-modules/py-partiql-parser/default.nix4
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix16
-rw-r--r--pkgs/development/python-modules/pympler/default.nix3
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix2
-rw-r--r--pkgs/development/python-modules/python-jose/default.nix52
-rw-r--r--pkgs/development/python-modules/rapidfuzz/default.nix4
-rw-r--r--pkgs/development/python-modules/rocket-errbot/default.nix4
-rw-r--r--pkgs/development/python-modules/s3transfer/default.nix5
-rw-r--r--pkgs/development/python-modules/simplejson/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlalchemy-migrate/default.nix3
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/udatetime/default.nix6
-rw-r--r--pkgs/development/python-modules/urllib3/default.nix4
-rw-r--r--pkgs/development/python-modules/uvloop/default.nix67
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/ruby-modules/gem-config/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/boot/builder.sh2
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/setup-hook.sh35
-rw-r--r--pkgs/development/tools/misc/automake/builder.sh2
-rw-r--r--pkgs/development/tools/misc/indent/default.nix2
-rw-r--r--pkgs/development/tools/misc/lttng-ust/default.nix4
-rw-r--r--pkgs/development/tools/misc/luarocks/luarocks-nix.nix6
-rw-r--r--pkgs/development/tools/parsing/antlr/builder.sh2
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/tools/spirv-tools/default.nix6
-rw-r--r--pkgs/development/tools/vulkan-validation-layers/default.nix11
-rw-r--r--pkgs/development/web/nodejs/nodejs.nix7
-rw-r--r--pkgs/development/web/nodejs/v14.nix16
-rw-r--r--pkgs/development/web/nodejs/v16.nix14
-rw-r--r--pkgs/games/orthorobot/default.nix4
-rw-r--r--pkgs/games/steam/fhsenv.nix2
-rw-r--r--pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh2
-rw-r--r--pkgs/misc/openrussian-cli/default.nix1
-rw-r--r--pkgs/os-specific/darwin/DarwinTools/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libm/missing-declarations.patch292
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix4
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix4
-rw-r--r--pkgs/os-specific/linux/ell/default.nix20
-rw-r--r--pkgs/os-specific/linux/fuse/common.nix5
-rw-r--r--pkgs/os-specific/linux/fuse/default.nix6
-rw-r--r--pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch5
-rw-r--r--pkgs/os-specific/linux/fuse/fuse3-install.patch22
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix32
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix5
-rw-r--r--pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch31
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix23
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix9
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix14
-rw-r--r--pkgs/os-specific/linux/kmod/default.nix4
-rw-r--r--pkgs/os-specific/linux/numatop/default.nix6
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder.sh2
-rw-r--r--pkgs/os-specific/linux/opengl/xorg-sys/builder.sh2
-rw-r--r--pkgs/os-specific/linux/pam/default.nix21
-rw-r--r--pkgs/os-specific/linux/pam_p11/default.nix4
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix20
-rw-r--r--pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch277
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix1
-rw-r--r--pkgs/servers/home-assistant/default.nix10
-rw-r--r--pkgs/servers/http/tomcat/axis2/builder.sh2
-rw-r--r--pkgs/servers/redpanda/server.nix4
-rw-r--r--pkgs/servers/x11/xorg/builder.sh2
-rw-r--r--pkgs/servers/x11/xorg/default.nix12
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list4
-rw-r--r--pkgs/stdenv/adapters.nix13
-rw-r--r--pkgs/stdenv/darwin/default.nix58
-rw-r--r--pkgs/stdenv/generic/default-builder.sh4
-rw-r--r--pkgs/stdenv/generic/setup.sh17
-rw-r--r--pkgs/test/simple/builder.sh2
-rw-r--r--pkgs/tools/admin/awscli/default.nix33
-rw-r--r--pkgs/tools/cd-dvd/sacd/default.nix3
-rw-r--r--pkgs/tools/filesystems/bcachefs-tools/default.nix23
-rw-r--r--pkgs/tools/graphics/spirv-cross/default.nix6
-rw-r--r--pkgs/tools/graphics/vulkan-extension-layer/default.nix10
-rw-r--r--pkgs/tools/graphics/vulkan-tools-lunarg/default.nix39
-rw-r--r--pkgs/tools/graphics/vulkan-tools-lunarg/gtest.patch34
-rw-r--r--pkgs/tools/graphics/vulkan-tools/default.nix40
-rw-r--r--pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch123
-rw-r--r--pkgs/tools/inputmethods/fcitx5/default.nix4
-rw-r--r--pkgs/tools/misc/expect/default.nix15
-rw-r--r--pkgs/tools/misc/expect/fix-darwin-clang16.patch31
-rw-r--r--pkgs/tools/misc/xvfb-run/default.nix2
-rw-r--r--pkgs/tools/networking/curl/default.nix11
-rw-r--r--pkgs/tools/networking/dnsmasq/default.nix5
-rw-r--r--pkgs/tools/networking/networkmanager/default.nix4
-rw-r--r--pkgs/tools/package-management/ciel/default.nix2
-rw-r--r--pkgs/tools/security/certmgr/default.nix4
-rw-r--r--pkgs/tools/security/ibm-sw-tpm2/default.nix19
-rw-r--r--pkgs/tools/security/pcsclite/default.nix4
-rw-r--r--pkgs/tools/system/which/default.nix9
-rw-r--r--pkgs/tools/video/mjpegtools/c++-17-fixes.patch44
-rw-r--r--pkgs/tools/video/mjpegtools/default.nix4
-rw-r--r--pkgs/tools/wayland/chayang/default.nix2
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix144
-rw-r--r--pkgs/top-level/darwin-packages.nix10
-rw-r--r--pkgs/top-level/linux-kernels.nix12
-rw-r--r--pkgs/top-level/python-packages.nix10
306 files changed, 3809 insertions, 2639 deletions
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index 503e72dfe0e..34329fb2ea8 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -1,29 +1,19 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, buildPackages, pkg-config, cmake
+{ stdenv, lib, fetchFromGitHub, buildPackages, pkg-config, cmake
 , alsa-lib, glib, libjack2, libsndfile, libpulseaudio
 , AppKit, AudioUnit, CoreAudio, CoreMIDI, CoreServices
 }:
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-RqhlpvMbRSwdcY2uuFAdJnihN3aObcLVMuvCZ294dgo=";
+    hash = "sha256-3qLmo9Ibl44v6Jj5Ix17ixwqfPt3ITTXUqBETF5pzE4=";
   };
 
-  patches = [
-    # Fixes bad CMAKE_INSTALL_PREFIX + CMAKE_INSTALL_LIBDIR concatenation for Darwin install name dir
-    # Remove when PR merged & in release
-    (fetchpatch {
-      name = "0001-Fix-incorrect-way-of-turning-CMAKE_INSTALL_LIBDIR-absolute.patch";
-      url = "https://github.com/FluidSynth/fluidsynth/pull/1261/commits/03cd38dd909fc24aa39553d869afbb4024416de8.patch";
-      hash = "sha256-nV+MbFttnbNBO4zWnPLpnnEuoiESkV9BGFlUS9tQQfk=";
-    })
-  ];
-
   outputs = [ "out" "dev" "man" ];
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
diff --git a/pkgs/applications/audio/industrializer/default.nix b/pkgs/applications/audio/industrializer/default.nix
index 97862104a05..80cb8f76981 100644
--- a/pkgs/applications/audio/industrializer/default.nix
+++ b/pkgs/applications/audio/industrializer/default.nix
@@ -6,6 +6,7 @@
 , automake
 , gnome2
 , gtk2
+, libGL
 , libjack2
 , libtool
 , libxml2
@@ -27,6 +28,7 @@ stdenv.mkDerivation rec {
     audiofile
     gnome2.gtkglext
     gtk2
+    libGL
     libjack2
     libtool
     libxml2
diff --git a/pkgs/applications/audio/kapitonov-plugins-pack/default.nix b/pkgs/applications/audio/kapitonov-plugins-pack/default.nix
index 935e3a95038..032ee8ec03c 100644
--- a/pkgs/applications/audio/kapitonov-plugins-pack/default.nix
+++ b/pkgs/applications/audio/kapitonov-plugins-pack/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, faust, meson, ninja, pkg-config
-, boost, cairo, fftw, ladspa-sdk, libxcb, lv2, xcbutilwm
+, boost, cairo, fftw, ladspa-sdk, libxcb, lv2, xcbutilwm, xorg
 , zita-convolver, zita-resampler
  }:
 
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
     libxcb
     lv2
     xcbutilwm
+    xorg.xcbutil
     zita-convolver
     zita-resampler
   ];
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 348dcfb5986..94ee6ad53e6 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.31.3";
+  version = "1.32.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-HKd9Omml/4RbegU294P+5VThBBE5prl49q/hT1gUrRo=";
+    hash = "sha256-LZkTpX1O6PSXoYLG6CWCYCQJeCpPtIHpif7r9ENYZ7Q=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
diff --git a/pkgs/applications/audio/paulstretch/default.nix b/pkgs/applications/audio/paulstretch/default.nix
index 5e781a9f511..d85b543baed 100644
--- a/pkgs/applications/audio/paulstretch/default.nix
+++ b/pkgs/applications/audio/paulstretch/default.nix
@@ -30,8 +30,9 @@ stdenv.mkDerivation {
   ];
 
   patches = [
+    # https://github.com/paulnasca/paulstretch_cpp/pull/12
     (fetchpatch {
-      url = "https://github.com/paulnasca/paulstretch_cpp/pull/12.patch";
+      url = "https://github.com/paulnasca/paulstretch_cpp/commit/d8671b36135fe66839b11eadcacb474cc8dae0d1.patch";
       sha256 = "0lx1rfrs53afkiz1drp456asqgj5yv6hx3lkc01165cv1jsbw6q4";
     })
   ];
diff --git a/pkgs/applications/audio/stone-phaser/default.nix b/pkgs/applications/audio/stone-phaser/default.nix
index b9ca1a1790d..4feaf9cd99a 100644
--- a/pkgs/applications/audio/stone-phaser/default.nix
+++ b/pkgs/applications/audio/stone-phaser/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, xorg, cairo, lv2, libjack2, mesa, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, xorg, cairo, libGL, lv2, libjack2, mesa, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "stone-phaser";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    xorg.libX11 cairo lv2 libjack2 mesa
+    xorg.libX11 cairo libGL lv2 libjack2 mesa
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/audio/string-machine/default.nix b/pkgs/applications/audio/string-machine/default.nix
index a146ea8cd97..312cf1db5ba 100644
--- a/pkgs/applications/audio/string-machine/default.nix
+++ b/pkgs/applications/audio/string-machine/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, boost, cairo, lv2, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, boost, cairo, libGL, lv2, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "string-machine";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
-    boost cairo lv2
+    boost cairo libGL lv2
   ];
 
   makeFlags = [
diff --git a/pkgs/applications/editors/neovim/tests/default.nix b/pkgs/applications/editors/neovim/tests/default.nix
index f1c38d2915d..a7e0e4c7705 100644
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@@ -212,7 +212,7 @@ rec {
 
   # having no RC generated should autodisable init.vim wrapping
   nvim_autowrap = runTest nvim_via_override ''
-      ! grep "-u" ${nvimShouldntWrap}/bin/nvim
+      ! grep ${nvimShouldntWrap}/bin/nvim
   '';
 
 
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 0fbb54df01a..d61a2fe5e5a 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -7,8 +7,10 @@
 , neovimUtils
 , vimUtils
 , perl
+, lndir
 }:
-neovim:
+
+neovim-unwrapped:
 
 let
   wrapper = {
@@ -62,7 +64,7 @@ let
     # wrapper with most arguments we need, excluding those that cause problems to
     # generate rplugin.vim, but still required for the final wrapper.
     finalMakeWrapperArgs =
-      [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim" ]
+      [ "${neovim-unwrapped}/bin/nvim" "${placeholder "out"}/bin/nvim" ]
       ++ [ "--set" "NVIM_SYSTEM_RPLUGIN_MANIFEST" "${placeholder "out"}/rplugin.vim" ]
       ++ lib.optionals wrapRc [ "--add-flags" "-u ${writeText "init.vim" neovimRcContent}" ]
       ++ commonWrapperArgs
@@ -72,36 +74,45 @@ let
   in
   assert withPython2 -> throw "Python2 support has been removed from the neovim wrapper, please remove withPython2 and python2Env.";
 
-  symlinkJoin {
-      name = "neovim-${lib.getVersion neovim}${extraName}";
+  stdenv.mkDerivation (finalAttrs: {
+      name = "neovim-${lib.getVersion neovim-unwrapped}${extraName}";
+
+      __structuredAttrs = true;
+      dontUnpack = true;
+      inherit viAlias vimAlias withNodeJs withPython3 withPerl;
+      inherit wrapRc providerLuaRc packpathDirs;
+      inherit python3Env rubyEnv;
+      withRuby = rubyEnv != null;
+      inherit wrapperArgs;
+
       # Remove the symlinks created by symlinkJoin which we need to perform
       # extra actions upon
       postBuild = lib.optionalString stdenv.isLinux ''
         rm $out/share/applications/nvim.desktop
-        substitute ${neovim}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
+        substitute ${neovim-unwrapped}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
           --replace 'Name=Neovim' 'Name=Neovim wrapper'
       ''
-      + lib.optionalString withPython3 ''
+      + lib.optionalString finalAttrs.withPython3 ''
         makeWrapper ${python3Env.interpreter} $out/bin/nvim-python3 --unset PYTHONPATH
       ''
-      + lib.optionalString (rubyEnv != null) ''
-        ln -s ${rubyEnv}/bin/neovim-ruby-host $out/bin/nvim-ruby
+      + lib.optionalString (finalAttrs.rubyEnv != null) ''
+        ln -s ${finalAttrs.rubyEnv}/bin/neovim-ruby-host $out/bin/nvim-ruby
       ''
-      + lib.optionalString withNodeJs ''
+      + lib.optionalString finalAttrs.withNodeJs ''
         ln -s ${nodePackages.neovim}/bin/neovim-node-host $out/bin/nvim-node
       ''
-      + lib.optionalString withPerl ''
+      + lib.optionalString finalAttrs.withPerl ''
         ln -s ${perlEnv}/bin/perl $out/bin/nvim-perl
       ''
-      + lib.optionalString vimAlias ''
+      + lib.optionalString finalAttrs.vimAlias ''
         ln -s $out/bin/nvim $out/bin/vim
       ''
-      + lib.optionalString viAlias ''
+      + lib.optionalString finalAttrs.viAlias ''
         ln -s $out/bin/nvim $out/bin/vi
       ''
       + lib.optionalString (manifestRc != null) (let
         manifestWrapperArgs =
-          [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim-wrapper" ] ++ commonWrapperArgs;
+          [ "${neovim-unwrapped}/bin/nvim" "${placeholder "out"}/bin/nvim-wrapper" ] ++ commonWrapperArgs;
       in ''
         echo "Generating remote plugin manifest"
         export NVIM_RPLUGIN_MANIFEST=$out/rplugin.vim
@@ -139,26 +150,33 @@ let
         makeWrapper ${lib.escapeShellArgs finalMakeWrapperArgs} ${wrapperArgsStr}
       '';
 
-    paths = [ neovim ];
+    buildPhase = ''
+      runHook preBuild
+      mkdir -p $out
+      for i in ${neovim-unwrapped}; do
+        lndir -silent $i $out
+      done
+      runHook postBuild
+    '';
 
     preferLocalBuild = true;
 
-    nativeBuildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper lndir ];
     passthru = {
       inherit providerLuaRc packpathDirs;
-      unwrapped = neovim;
+      unwrapped = neovim-unwrapped;
       initRc = neovimRcContent;
 
       tests = callPackage ./tests {
       };
     };
 
-    meta = neovim.meta // {
+    meta = neovim-unwrapped.meta // {
       # To prevent builds on hydra
       hydraPlatforms = [];
       # prefer wrapper over the package
-      priority = (neovim.meta.priority or 0) - 1;
+      priority = (neovim-unwrapped.meta.priority or 0) - 1;
     };
-  };
+  });
 in
   lib.makeOverridable wrapper
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 0179dabe394..83d61b37bfc 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1897";
+  version = "9.0.2048";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-ywxJ9evXWbqZ6o6EqDIQWK16J05McAdvPl0Y9cW5Zvc=";
+    hash = "sha256-zR2iPiD4/gf5BnxYoe3cx2ebGWE1P2bY4Cg15gveFgg=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/autotrace/default.nix b/pkgs/applications/graphics/autotrace/default.nix
index 96a53b5efba..e611a56a662 100644
--- a/pkgs/applications/graphics/autotrace/default.nix
+++ b/pkgs/applications/graphics/autotrace/default.nix
@@ -26,8 +26,9 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
+      # https://github.com/autotrace/autotrace/pull/105
       name = "imagemagick7-support.patch";
-      url = "https://github.com/autotrace/autotrace/pull/105.patch";
+      url = "https://github.com/autotrace/autotrace/compare/170488e1871d50aad7a800b901e33ded7d31773a...c26a2a059926c595a00839c8d9961e9381206579.patch";
       hash = "sha256-Q82LRF/BsJ/Ii2s+7yaYHs9agMKYVYIMnbwqz8P92s0=";
     })
   ];
diff --git a/pkgs/applications/graphics/fbida/default.nix b/pkgs/applications/graphics/fbida/default.nix
index 5cd574bf9b7..79e66d8ed98 100644
--- a/pkgs/applications/graphics/fbida/default.nix
+++ b/pkgs/applications/graphics/fbida/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, libGL
 , libjpeg
 , libexif
 , giflib
@@ -17,6 +18,7 @@
 , sane-backends
 , libXpm
 , libepoxy
+, pixman
 , poppler
 , mesa
 , lirc
@@ -42,6 +44,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config which ];
   buildInputs = [
+    libGL
     libexif
     libjpeg
     libpng
@@ -56,6 +59,7 @@ stdenv.mkDerivation rec {
     libdrm
     libXpm
     libepoxy
+    pixman
     poppler
     lirc
     mesa
diff --git a/pkgs/applications/kde/marble.nix b/pkgs/applications/kde/marble.nix
index f36d91df597..78fc52996dc 100644
--- a/pkgs/applications/kde/marble.nix
+++ b/pkgs/applications/kde/marble.nix
@@ -2,7 +2,7 @@
 , extra-cmake-modules, kdoctools
 , qtscript, qtsvg, qtquickcontrols, qtwebengine
 , krunner, shared-mime-info, kparts, knewstuff
-, gpsd, perl, protobuf3_21
+, gpsd, perl, protobuf_21
 }:
 
 mkDerivation {
@@ -15,7 +15,7 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools perl ];
   propagatedBuildInputs = [
-    protobuf3_21 qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
+    protobuf_21 qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
     knewstuff gpsd
   ];
   preConfigure = ''
diff --git a/pkgs/applications/misc/adobe-reader/builder.sh b/pkgs/applications/misc/adobe-reader/builder.sh
index 6047c082643..4291da80576 100644
--- a/pkgs/applications/misc/adobe-reader/builder.sh
+++ b/pkgs/applications/misc/adobe-reader/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "unpacking $src..."
diff --git a/pkgs/applications/misc/mission-center/default.nix b/pkgs/applications/misc/mission-center/default.nix
index 4bdb2b03291..8384fc1ce45 100644
--- a/pkgs/applications/misc/mission-center/default.nix
+++ b/pkgs/applications/misc/mission-center/default.nix
@@ -23,6 +23,7 @@
 , glib
 , graphene
 , gtk4
+, libGL
 , libadwaita
 , libdrm
 , mesa
@@ -92,6 +93,7 @@ stdenv.mkDerivation rec {
     glib
     graphene
     gtk4
+    libGL
     libadwaita
     libdrm
     mesa
diff --git a/pkgs/applications/misc/volnoti/default.nix b/pkgs/applications/misc/volnoti/default.nix
index d70918f2e7c..b54df7e9516 100644
--- a/pkgs/applications/misc/volnoti/default.nix
+++ b/pkgs/applications/misc/volnoti/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     # Fix dbus interface headers. See
     # https://github.com/davidbrazdil/volnoti/pull/10
     (fetchpatch {
-      url = "https://github.com/davidbrazdil/volnoti/pull/10.patch";
+      url = "https://github.com/davidbrazdil/volnoti/commit/623ad8ea5c3ac8720d00a2ced4b6163aae38c119.patch";
       sha256 = "046zfdjmvhb7jrsgh04vfgi35sgy1zkrhd3bzdby3nvds1wslfam";
     })
   ];
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 8130f9f7758..56d21187ebb 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -20,7 +20,6 @@
 , runtimeShell
 , systemLocale ? config.i18n.defaultLocale or "en_US"
 , patchelfUnstable  # have to use patchelfUnstable to support --no-clobber-old-sections
-, makeWrapper
 }:
 
 let
@@ -58,20 +57,6 @@ let
   source = lib.findFirst (sourceMatches mozLocale) defaultSource sources;
 
   pname = "firefox-${channel}-bin-unwrapped";
-
-  # FIXME: workaround for not being able to pass flags to patchelf
-  # Remove after https://github.com/NixOS/nixpkgs/pull/256525
-  wrappedPatchelf = stdenv.mkDerivation {
-    pname = "patchelf-wrapped";
-    inherit (patchelfUnstable) version;
-
-    nativeBuildInputs = [ makeWrapper ];
-
-    buildCommand = ''
-      mkdir -p $out/bin
-      makeWrapper ${patchelfUnstable}/bin/patchelf $out/bin/patchelf --append-flags "--no-clobber-old-sections"
-    '';
-  };
 in
 
 stdenv.mkDerivation {
@@ -79,7 +64,7 @@ stdenv.mkDerivation {
 
   src = fetchurl { inherit (source) url sha256; };
 
-  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook wrappedPatchelf ];
+  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook patchelfUnstable ];
   buildInputs = [
     gtk3
     adwaita-icon-theme
@@ -93,8 +78,10 @@ stdenv.mkDerivation {
     pciutils
   ];
   appendRunpaths = [
-    "${pipewire.lib}/lib"
+    "${pipewire}/lib"
   ];
+  # Firefox uses "relrhack" to manually process relocations from a fixed offset
+  patchelfFlags = [ "--no-clobber-old-sections" ];
 
   installPhase =
     ''
diff --git a/pkgs/applications/networking/localproxy/default.nix b/pkgs/applications/networking/localproxy/default.nix
index 019da469512..719b730817b 100644
--- a/pkgs/applications/networking/localproxy/default.nix
+++ b/pkgs/applications/networking/localproxy/default.nix
@@ -3,14 +3,14 @@
 , fetchFromGitHub
 , cmake
 , openssl
-, protobuf3_21
+, protobuf_21
 , catch2
 , boost181
 , icu
 }:
 let
   boost = boost181.override { enableStatic = true; };
-  protobuf = protobuf3_21.override { enableShared = false; };
+  protobuf = protobuf_21.override { enableShared = false; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "localproxy";
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 9ac8c83dc5e..8d0bc45c4a0 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -20,8 +20,9 @@ stdenv.mkDerivation rec {
     # https://github.com/neomutt/neomutt/issues/3773#issuecomment-1493295144
     ./fix-open-very-large-mailbox.patch
     (fetchpatch {
+      # https://github.com/neomutt/neomutt/pull/3933
       name = "disable-incorrect-tests.patch";
-      url = "https://github.com/neomutt/neomutt/pull/3933.patch";
+      url = "https://github.com/neomutt/neomutt/compare/f624551b86cdb53224b5b48304a808ca2815111e...a9a1d99e6c0fdf367188125451300fa89d3e801a.patch";
       hash = "sha256-Plei063T8XyXF4/7/nAb6/4OyXz72vBAXHwls9WL1vM=";
       excludes = [".github/workflows/macos.yml"];
     })
diff --git a/pkgs/applications/networking/p2p/freenet/default.nix b/pkgs/applications/networking/p2p/freenet/default.nix
index 8a46b5a476c..3ca23647251 100644
--- a/pkgs/applications/networking/p2p/freenet/default.nix
+++ b/pkgs/applications/networking/p2p/freenet/default.nix
@@ -16,8 +16,9 @@ let
 
   patches = [
     # gradle 7 support
+    # https://github.com/freenet/fred/pull/827
     (fetchpatch {
-      url = "https://github.com/freenet/fred/pull/827.patch";
+      url = "https://github.com/freenet/fred/commit/8991303493f2c0d9933f645337f0a7a5a979e70a.patch";
       sha256 = "sha256-T1zymxRTADVhhwp2TyB+BC/J4gZsT/CUuMrT4COlpTY=";
     })
   ];
diff --git a/pkgs/applications/science/chemistry/gwyddion/default.nix b/pkgs/applications/science/chemistry/gwyddion/default.nix
index d6d371bf505..cc2bc91f202 100644
--- a/pkgs/applications/science/chemistry/gwyddion/default.nix
+++ b/pkgs/applications/science/chemistry/gwyddion/default.nix
@@ -12,7 +12,7 @@
   zlibSupport ? true, zlib,
   libuniqueSupport ? true, libunique,
   libpngSupport ? true, libpng,
-  openglSupport ? !stdenv.isDarwin
+  openglSupport ? !stdenv.isDarwin, libGL
 }:
 
 let
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = with lib;
     [ gtk2 fftw ] ++
-    optional openglSupport gnome2.gtkglext ++
+    optionals openglSupport [ gnome2.gtkglext libGL ] ++
     optional openexrSupport openexr ++
     optional libXmuSupport xorg.libXmu ++
     optional fitsSupport cfitsio ++
diff --git a/pkgs/applications/science/logic/vampire/default.nix b/pkgs/applications/science/logic/vampire/default.nix
index 253c88705ae..a3c1aa3f131 100644
--- a/pkgs/applications/science/logic/vampire/default.nix
+++ b/pkgs/applications/science/logic/vampire/default.nix
@@ -19,13 +19,13 @@ stdenv.mkDerivation rec {
     # https://github.com/vprover/vampire/pull/54
     (fetchpatch {
       name = "fix-apple-cygwin-defines.patch";
-      url = "https://github.com/vprover/vampire/pull/54.patch";
+      url = "https://github.com/vprover/vampire/commit/b4bddd3bcac6a7688742da75c369b7b3213f6d1c.patch";
       sha256 = "0i6nrc50wlg1dqxq38lkpx4rmfb3lf7s8f95l4jkvqp0nxa20cza";
     })
     # https://github.com/vprover/vampire/pull/55
     (fetchpatch {
       name = "fix-wait-any.patch";
-      url = "https://github.com/vprover/vampire/pull/55.patch";
+      url = "https://github.com/vprover/vampire/commit/6da10eabb333aec54cdf13833ea33cb851159543.patch";
       sha256 = "1pwfpwpl23bqsgkmmvw6bnniyvp5j9v8l3z9s9pllfabnfcrcz9l";
     })
   ];
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index 6179c1719d3..b0d8dd7a4b3 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "384";
+  version = "388";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    hash = "sha256-Me+HB0DOrgIMPEtKlgHH9Hv9RmcsGq8tITpWXWTLw3M=";
+    hash = "sha256-rEKTReb5N6WUWonUJaJl/ubCFfxmnb3GoDJuIfTF9nQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/version-management/hub/default.nix b/pkgs/applications/version-management/hub/default.nix
index 0ed9d70c462..4486c71605d 100644
--- a/pkgs/applications/version-management/hub/default.nix
+++ b/pkgs/applications/version-management/hub/default.nix
@@ -23,13 +23,15 @@ buildGoModule rec {
 
   patches = [
     # Fix `fish` completions
+    # https://github.com/github/hub/pull/3036
     (fetchpatch {
-      url = "https://github.com/github/hub/pull/3036.patch";
+      url = "https://github.com/github/hub/commit/439b7699e79471fc789929bcdea2f30bd719963e.patch";
       hash = "sha256-pR/OkGa2ICR4n1pLNx8E2UTtLeDwFtXxeeTB94KFjC4=";
     })
     # Fix `bash` completions
+    # https://github.com/github/hub/pull/2948
     (fetchpatch {
-      url = "https://github.com/github/hub/pull/2948.patch";
+      url = "https://github.com/github/hub/commit/64b291006f208fc7db1d5be96ff7db5535f1d853.patch";
       hash = "sha256-jGFFIvSKEIpTQY0Wz63cqciUk25MzPHv5Z1ox8l7wmo=";
     })
   ];
diff --git a/pkgs/applications/video/clapper/default.nix b/pkgs/applications/video/clapper/default.nix
index 9e8e88ecfbf..954ea58b455 100644
--- a/pkgs/applications/video/clapper/default.nix
+++ b/pkgs/applications/video/clapper/default.nix
@@ -17,6 +17,7 @@
 , gjs
 , gtk4
 , gst_all_1
+, libGL
 , libadwaita
 , appstream-glib
 , libsoup
@@ -55,6 +56,7 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly
     gtk4
+    libGL
     libadwaita
     libsoup
     wayland
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index bb2c3408351..0f0008bd7a1 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -116,7 +116,7 @@ in stdenv.mkDerivation {
       # Remove with the next release: https://github.com/xbmc/xbmc/pull/23453
       (fetchpatch {
         name = "Fix fmt10 compat";
-        url = "https://github.com/xbmc/xbmc/pull/23453.patch";
+        url = "https://github.com/xbmc/xbmc/compare/acca69baa2eae65123e78ee2f77249181725ef5d...26c164a28cfd18ceef7a1f2bbba5bf8a4a5a750c.patch";
         hash = "sha256-zMUparbQ8gfgeXj8W3MDmPi5OgLNz/zGCJINU7H6Rx0=";
       })
     ];
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
index 47ec249ea11..e23a8bb244e 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@@ -10,6 +10,7 @@
 , git
 , hyprland-protocols
 , jq
+, libGL
 , libdrm
 , libexecinfo
 , libinput
@@ -88,6 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
       cairo
       git
       hyprland-protocols
+      libGL
       libdrm
       libinput
       libxkbcommon
diff --git a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
index 32c2a8085d1..80308ee138f 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , cmake
 , file
+, libGL
 , libjpeg
 , mesa
 , pango
@@ -31,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     file
+    libGL
     libjpeg
     mesa
     pango
diff --git a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
index 17f53883424..b7666d5d9b1 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
@@ -6,6 +6,7 @@
 , ninja
 , cairo
 , fribidi
+, libGL
 , libdatrie
 , libjpeg
 , libselinux
@@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     cairo
     fribidi
+    libGL
     libdatrie
     libjpeg
     libselinux
diff --git a/pkgs/applications/window-managers/i3/lock-blur.nix b/pkgs/applications/window-managers/i3/lock-blur.nix
index 47875ec47c3..f9f6de92127 100644
--- a/pkgs/applications/window-managers/i3/lock-blur.nix
+++ b/pkgs/applications/window-managers/i3/lock-blur.nix
@@ -1,4 +1,4 @@
-{ i3lock-color, lib, stdenv, fetchFromGitHub, fetchpatch }:
+{ i3lock-color, lib, stdenv, fetchFromGitHub, fetchpatch, libGL }:
 
 i3lock-color.overrideAttrs (oldAttrs : rec {
   pname = "i3lock-blur";
@@ -21,6 +21,8 @@ i3lock-color.overrideAttrs (oldAttrs : rec {
     })
   ];
 
+  buildInputs = oldAttrs.buildInputs ++ [ libGL ];
+
   meta = with lib; {
     description = "An improved screenlocker based upon XCB and PAM with background blurring filter";
     homepage = "https://github.com/karulont/i3lock-blur/";
diff --git a/pkgs/applications/window-managers/i3/lock-color.nix b/pkgs/applications/window-managers/i3/lock-color.nix
index 8656db60c4e..596aa8ceea1 100644
--- a/pkgs/applications/window-managers/i3/lock-color.nix
+++ b/pkgs/applications/window-managers/i3/lock-color.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libxcb,
   xcbutilkeysyms , xcbutilimage, pam, libX11, libev, cairo, libxkbcommon,
-  libxkbfile, libjpeg_turbo, xcbutilxrm
+  libxkbfile, libjpeg_turbo, xcbutilxrm, xorg
 }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libxcb xcbutilkeysyms xcbutilimage pam libX11
-    libev cairo libxkbcommon libxkbfile libjpeg_turbo xcbutilxrm ];
+    libev cairo libxkbcommon libxkbfile libjpeg_turbo xcbutilxrm xorg.xcbutil ];
 
   makeFlags = [ "all" ];
   preInstall = ''
diff --git a/pkgs/applications/window-managers/i3/lock.nix b/pkgs/applications/window-managers/i3/lock.nix
index b8dffa259d7..b7cca2b6637 100644
--- a/pkgs/applications/window-managers/i3/lock.nix
+++ b/pkgs/applications/window-managers/i3/lock.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config, libxcb, xcbutilkeysyms, xcbutilimage,
-  xcbutilxrm, pam, libX11, libev, cairo, libxkbcommon, libxkbfile }:
+  xcbutilxrm, pam, libX11, libev, cairo, libxkbcommon, libxkbfile, xorg }:
 
 stdenv.mkDerivation rec {
   pname = "i3lock";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja pkg-config ];
   buildInputs = [ libxcb xcbutilkeysyms xcbutilimage xcbutilxrm
-    pam libX11 libev cairo libxkbcommon libxkbfile ];
+    pam libX11 libev cairo libxkbcommon libxkbfile xorg.xcbutil ];
 
   meta = with lib; {
     description = "A simple screen locker like slock";
diff --git a/pkgs/applications/window-managers/i3/wmfocus.nix b/pkgs/applications/window-managers/i3/wmfocus.nix
index 1c06fc2ae28..43a1c13ee0e 100644
--- a/pkgs/applications/window-managers/i3/wmfocus.nix
+++ b/pkgs/applications/window-managers/i3/wmfocus.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, rustPlatform
-, xorg, python3, pkg-config, cairo, libxkbcommon }:
+, xorg, python3, pkg-config, cairo, expat, libxkbcommon }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wmfocus";
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-4eoV/viI7Q7I7mIqcHVAyPf/y2RWaWX0B+mLZWMEbcI=";
 
   nativeBuildInputs = [ python3 pkg-config ];
-  buildInputs = [ cairo libxkbcommon xorg.xcbutilkeysyms ];
+  buildInputs = [ cairo expat libxkbcommon xorg.xcbutilkeysyms ];
 
   # For now, this is the only available featureset. This is also why the file is
   # in the i3 folder, even though it might be useful for more than just i3
diff --git a/pkgs/applications/window-managers/jay/default.nix b/pkgs/applications/window-managers/jay/default.nix
index 0e233dd86ac..1b58fa0f2c8 100644
--- a/pkgs/applications/window-managers/jay/default.nix
+++ b/pkgs/applications/window-managers/jay/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, libGL
 , libinput
 , libxkbcommon
 , mesa
@@ -22,6 +23,7 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "sha256-zSq6YBlm6gJXGlF9xZ8gWSTMewdNqrJzwP58a0x8QIU=";
 
   buildInputs = [
+    libGL
     libxkbcommon
     mesa
     pango
diff --git a/pkgs/applications/window-managers/sway/default.nix b/pkgs/applications/window-managers/sway/default.nix
index a830a6a5752..d39382f493c 100644
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, substituteAll, swaybg
 , meson, ninja, pkg-config, wayland-scanner, scdoc
-, wayland, libxkbcommon, pcre2, json_c, libevdev
+, libGL, wayland, libxkbcommon, pcre2, json_c, libevdev
 , pango, cairo, libinput, gdk-pixbuf, librsvg
 , wlroots, wayland-protocols, libdrm
 , nixosTests
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    wayland libxkbcommon pcre2 json_c libevdev
+    libGL wayland libxkbcommon pcre2 json_c libevdev
     pango cairo libinput gdk-pixbuf librsvg
     wayland-protocols libdrm
     (wlroots.override { inherit (finalAttrs) enableXWayland; })
diff --git a/pkgs/applications/window-managers/wayfire/default.nix b/pkgs/applications/window-managers/wayfire/default.nix
index 8311c3690af..c633b19abc7 100644
--- a/pkgs/applications/window-managers/wayfire/default.nix
+++ b/pkgs/applications/window-managers/wayfire/default.nix
@@ -8,6 +8,7 @@
 , wf-config
 , cairo
 , doctest
+, libGL
 , libdrm
 , libexecinfo
 , libevdev
@@ -44,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     wf-config
+    libGL
     libdrm
     libexecinfo
     libevdev
diff --git a/pkgs/applications/window-managers/weston/default.nix b/pkgs/applications/window-managers/weston/default.nix
index 467396a6d8a..3d2c720e137 100644
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch2
 , meson, ninja, pkg-config, python3, wayland-scanner
-, cairo, libdrm, libevdev, libinput, libxkbcommon, mesa, seatd, wayland
+, cairo, libGL, libdrm, libevdev, libinput, libxkbcommon, mesa, seatd, wayland
 , wayland-protocols, xcbutilcursor
 
 , demoSupport ? true
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson ninja pkg-config python3 wayland-scanner ];
   buildInputs = [
-    cairo libdrm libevdev libinput libxkbcommon mesa seatd wayland
+    cairo libGL libdrm libevdev libinput libxkbcommon mesa seatd wayland
     wayland-protocols
   ] ++ lib.optional hdrSupport libdisplay-info
     ++ lib.optional jpegSupport libjpeg
diff --git a/pkgs/build-support/binary-cache/default.nix b/pkgs/build-support/binary-cache/default.nix
index 27f9ad96289..8c610c51227 100644
--- a/pkgs/build-support/binary-cache/default.nix
+++ b/pkgs/build-support/binary-cache/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages }:
+{ lib, stdenv, coreutils, jq, python3, nix, xz }:
 
 # This function is for creating a flat-file binary cache, i.e. the kind created by
 # nix copy --to file:///some/path and usable as a substituter (with the file:// prefix).
@@ -19,15 +19,10 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  PATH = lib.makeBinPath (with buildPackages; [ coreutils jq python3 nix xz ]);
+  nativeBuildInputs = [ coreutils jq python3 nix xz ];
 
-  builder = builtins.toFile "builder" ''
-    . .attrs.sh
-
-    export out=''${outputs[out]}
-
-    mkdir $out
-    mkdir $out/nar
+  buildCommand = ''
+    mkdir -p $out/nar
 
     python ${./make-binary-cache.py}
 
diff --git a/pkgs/build-support/binary-cache/make-binary-cache.py b/pkgs/build-support/binary-cache/make-binary-cache.py
index 16dd8a7e96b..589d005562b 100644
--- a/pkgs/build-support/binary-cache/make-binary-cache.py
+++ b/pkgs/build-support/binary-cache/make-binary-cache.py
@@ -3,7 +3,7 @@ import json
 import os
 import subprocess
 
-with open(".attrs.json", "r") as f:
+with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
   closures = json.load(f)["closure"]
 
 os.chdir(os.environ["out"])
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 8d02b4e5124..8cd63e46095 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -10,6 +10,13 @@ for flag in ${NIX_HARDENING_ENABLE_@suffixSalt@-}; do
   hardeningEnableMap["$flag"]=1
 done
 
+# fortify3 implies fortify enablement - make explicit before
+# we filter unsupported flags because unsupporting fortify3
+# doesn't mean we should unsupport fortify too
+if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
+  hardeningEnableMap["fortify"]=1
+fi
+
 # Remove unsupported flags.
 for flag in @hardening_unsupported_flags@; do
   unset -v "hardeningEnableMap[$flag]"
@@ -19,7 +26,7 @@ for flag in @hardening_unsupported_flags@; do
   fi
 done
 
-# make fortify and fortify3 mutually exclusive
+# now make fortify and fortify3 mutually exclusive
 if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
   unset -v "hardeningEnableMap['fortify']"
 fi
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 6c43f8cbfa6..b8d170df01b 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -246,7 +246,7 @@ if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
 fi
 
 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    responseFile=$(mktemp --tmpdir cc-params.XXXXXX)
+    responseFile=$(mktemp "${TMPDIR:-/tmp}/cc-params.XXXXXX")
     trap 'rm -f -- "$responseFile"' EXIT
     printf "%q\n" \
        ${extraBefore+"${extraBefore[@]}"} \
diff --git a/pkgs/build-support/closure-info.nix b/pkgs/build-support/closure-info.nix
index 6b3ff6fd62b..f6c31bd786b 100644
--- a/pkgs/build-support/closure-info.nix
+++ b/pkgs/build-support/closure-info.nix
@@ -4,7 +4,7 @@
 # "nix-store --load-db" and "nix-store --register-validity
 # --hash-given".
 
-{ stdenv, buildPackages }:
+{ stdenv, coreutils, jq }:
 
 { rootPaths }:
 
@@ -19,18 +19,16 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  PATH = "${buildPackages.coreutils}/bin:${buildPackages.jq}/bin";
+  nativeBuildInputs = [ coreutils jq ];
 
-  builder = builtins.toFile "builder"
+  buildCommand =
     ''
-      . .attrs.sh
-
       out=''${outputs[out]}
 
       mkdir $out
 
-      jq -r ".closure | map(.narSize) | add" < .attrs.json > $out/total-nar-size
-      jq -r '.closure | map([.path, .narHash, .narSize, "", (.references | length)] + .references) | add | map("\(.)\n") | add' < .attrs.json | head -n -1 > $out/registration
-      jq -r .closure[].path < .attrs.json > $out/store-paths
+      jq -r ".closure | map(.narSize) | add" < "$NIX_ATTRS_JSON_FILE" > $out/total-nar-size
+      jq -r '.closure | map([.path, .narHash, .narSize, "", (.references | length)] + .references) | add | map("\(.)\n") | add' < "$NIX_ATTRS_JSON_FILE" | head -n -1 > $out/registration
+      jq -r '.closure[].path' < "$NIX_ATTRS_JSON_FILE" > $out/store-paths
     '';
 }
diff --git a/pkgs/build-support/fetchbzr/builder.sh b/pkgs/build-support/fetchbzr/builder.sh
index 991864719a0..4515e0e82f4 100644
--- a/pkgs/build-support/fetchbzr/builder.sh
+++ b/pkgs/build-support/fetchbzr/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source "$stdenv/setup"
 
 echo "exporting \`$url' (revision $rev) into \`$out'"
diff --git a/pkgs/build-support/fetchcvs/builder.sh b/pkgs/build-support/fetchcvs/builder.sh
index 4b49e9676ec..7e4dde4a64c 100644
--- a/pkgs/build-support/fetchcvs/builder.sh
+++ b/pkgs/build-support/fetchcvs/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 (echo "#!$SHELL"; \
diff --git a/pkgs/build-support/fetchdarcs/builder.sh b/pkgs/build-support/fetchdarcs/builder.sh
index 75b9066dba6..39838db255a 100644
--- a/pkgs/build-support/fetchdarcs/builder.sh
+++ b/pkgs/build-support/fetchdarcs/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 tagtext=""
diff --git a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
index 4eb70f672d4..489914a2a8b 100644
--- a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
+++ b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source "${stdenv}/setup"
 echo "exporting ${repository}/${imageName} (tag: ${tag}) into ${out}"
 mkdir -p "${out}"
diff --git a/pkgs/build-support/fetchfossil/builder.sh b/pkgs/build-support/fetchfossil/builder.sh
index 36b758ab574..fe828d0ada9 100644
--- a/pkgs/build-support/fetchfossil/builder.sh
+++ b/pkgs/build-support/fetchfossil/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 echo "Cloning Fossil $url [$rev] into $out"
 
diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index 77f6381b09a..95176beea8c 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -3,7 +3,7 @@
 # - revision specified and remote has a HEAD
 # - revision specified and remote without HEAD
 #
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "exporting $url (rev $rev) into $out"
diff --git a/pkgs/build-support/fetchhg/builder.sh b/pkgs/build-support/fetchhg/builder.sh
index 1ce29475771..20dfde4b10d 100644
--- a/pkgs/build-support/fetchhg/builder.sh
+++ b/pkgs/build-support/fetchhg/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 echo "getting $url${rev:+ ($rev)} into $out"
 
diff --git a/pkgs/build-support/fetchipfs/builder.sh b/pkgs/build-support/fetchipfs/builder.sh
index ca77962b538..1ddd111b151 100644
--- a/pkgs/build-support/fetchipfs/builder.sh
+++ b/pkgs/build-support/fetchipfs/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 # Curl flags to handle redirects, not use EPSV, handle cookies for
diff --git a/pkgs/build-support/fetchmtn/builder.sh b/pkgs/build-support/fetchmtn/builder.sh
index 1aabd7949ee..de929fad55a 100644
--- a/pkgs/build-support/fetchmtn/builder.sh
+++ b/pkgs/build-support/fetchmtn/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 set -x
diff --git a/pkgs/build-support/fetchsvn/builder.sh b/pkgs/build-support/fetchsvn/builder.sh
index aa4d049aba4..e187747f14e 100644
--- a/pkgs/build-support/fetchsvn/builder.sh
+++ b/pkgs/build-support/fetchsvn/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "exporting $url (r$rev) into $out"
diff --git a/pkgs/build-support/fetchsvnssh/builder.sh b/pkgs/build-support/fetchsvnssh/builder.sh
index 5782151524f..e553446346d 100644
--- a/pkgs/build-support/fetchsvnssh/builder.sh
+++ b/pkgs/build-support/fetchsvnssh/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "exporting $url (r$rev) into $out"
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index e8eaba93485..a82728ef102 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 source $mirrorsFile
diff --git a/pkgs/build-support/references-by-popularity/default.nix b/pkgs/build-support/references-by-popularity/default.nix
index dfc25275f34..2171c622f00 100644
--- a/pkgs/build-support/references-by-popularity/default.nix
+++ b/pkgs/build-support/references-by-popularity/default.nix
@@ -6,11 +6,8 @@ path: runCommand "closure-paths"
   exportReferencesGraph.graph = path;
   __structuredAttrs = true;
   preferLocalBuild = true;
-  PATH = "${coreutils}/bin:${python3}/bin";
-  builder = builtins.toFile "builder"
-    ''
-      . .attrs.sh
-      python3 ${./closure-graph.py} .attrs.json graph > ''${outputs[out]}
-    '';
-  }
-  ""
+  nativeBuildInputs = [ coreutils python3 ];
+}
+''
+  python3 ${./closure-graph.py} "$NIX_ATTRS_JSON_FILE" graph > ''${outputs[out]}
+''
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 18d8ca56fd1..0b28121a5b7 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -156,7 +156,8 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
       # Platforms without host tools from
       # https://doc.rust-lang.org/nightly/rustc/platform-support.html
       "armv7a-darwin"
-      "armv5tel-linux" "armv7a-linux" "m68k-linux" "riscv32-linux"
+      "armv5tel-linux" "armv7a-linux" "m68k-linux" "mipsel-linux"
+      "mips64el-linux" "riscv32-linux"
       "armv6l-netbsd"
       "x86_64-redox"
       "wasm32-wasi"
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.py b/pkgs/build-support/setup-hooks/auto-patchelf.py
index 965384b876f..261f5585480 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.py
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -174,7 +174,7 @@ class Dependency:
     found: bool = False     # Whether it was found somewhere
 
 
-def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List[Path] = []) -> list[Dependency]:
+def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List[Path] = [], extra_args: List[str] = []) -> list[Dependency]:
     try:
         with open_elf(path) as elf:
 
@@ -213,7 +213,7 @@ def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List
     if file_is_dynamic_executable:
         print("setting interpreter of", path)
         subprocess.run(
-                ["patchelf", "--set-interpreter", interpreter_path.as_posix(), path.as_posix()],
+                ["patchelf", "--set-interpreter", interpreter_path.as_posix(), path.as_posix()] + extra_args,
                 check=True)
         rpath += runtime_deps
 
@@ -250,7 +250,7 @@ def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List
     if rpath:
         print("setting RPATH to:", rpath_str)
         subprocess.run(
-                ["patchelf", "--set-rpath", rpath_str, path.as_posix()],
+                ["patchelf", "--set-rpath", rpath_str, path.as_posix()] + extra_args,
                 check=True)
 
     return dependencies
@@ -262,7 +262,8 @@ def auto_patchelf(
         runtime_deps: List[Path],
         recursive: bool = True,
         ignore_missing: List[str] = [],
-        append_rpaths: List[Path] = []) -> None:
+        append_rpaths: List[Path] = [],
+        extra_args: List[str] = []) -> None:
 
     if not paths_to_patch:
         sys.exit("No paths to patch, stopping.")
@@ -275,7 +276,7 @@ def auto_patchelf(
     dependencies = []
     for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
         if not path.is_symlink() and path.is_file():
-            dependencies += auto_patchelf_file(path, runtime_deps, append_rpaths)
+            dependencies += auto_patchelf_file(path, runtime_deps, append_rpaths, extra_args)
 
     missing = [dep for dep in dependencies if not dep.found]
 
@@ -333,6 +334,12 @@ def main() -> None:
         type=Path,
         help="Paths to append to all runtime paths unconditionally",
     )
+    parser.add_argument(
+        "--extra-args",
+        nargs="*",
+        type=str,
+        help="Extra arguments to pass to patchelf"
+    )
 
     print("automatically fixing dependencies for ELF files")
     args = parser.parse_args()
@@ -344,7 +351,8 @@ def main() -> None:
         args.runtime_dependencies,
         args.recursive,
         args.ignore_missing,
-        append_rpaths=args.append_rpaths)
+        append_rpaths=args.append_rpaths,
+        extra_args=args.extra_args)
 
 
 interpreter_path: Path  = None # type: ignore
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 0625565606f..371389df427 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -63,6 +63,7 @@ autoPatchelf() {
 
     local appendRunpathsArray=($appendRunpaths)
     local runtimeDependenciesArray=($runtimeDependencies)
+    local patchelfFlagsArray=($patchelfFlags)
     @pythonInterpreter@ @autoPatchelfScript@                            \
         ${norecurse:+--no-recurse}                                      \
         --ignore-missing "${ignoreMissingDepsArray[@]}"                 \
@@ -70,7 +71,8 @@ autoPatchelf() {
         --libs "${autoPatchelfLibs[@]}"                                 \
                "${extraAutoPatchelfLibs[@]}"                            \
         --runtime-dependencies "${runtimeDependenciesArray[@]/%//lib}"  \
-        --append-rpaths "${appendRunpathsArray[@]}"
+        --append-rpaths "${appendRunpathsArray[@]}"                     \
+        --extra-args "${patchelfFlagsArray[@]}"
 }
 
 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
diff --git a/pkgs/by-name/ar/arrpc/package.nix b/pkgs/by-name/ar/arrpc/package.nix
index 15ad34b39d7..eeb4dd4fef2 100644
--- a/pkgs/by-name/ar/arrpc/package.nix
+++ b/pkgs/by-name/ar/arrpc/package.nix
@@ -21,7 +21,8 @@ buildNpmPackage {
   # Remove after next release
   patches = [
     (fetchpatch {
-      url = "https://github.com/OpenAsar/arrpc/pull/50.patch";
+      # https://github.com/OpenAsar/arrpc/pull/50
+      url = "https://github.com/OpenAsar/arrpc/commit/7fa6c90204450eb3952ce9cddfecb0a5ba5e4313.patch";
       hash = "sha256-qFlrbe2a4x811wpmWUcGDe2CPlt9x3HI+/t0P2v4kPc=";
     })
   ];
diff --git a/pkgs/by-name/ce/celluloid/package.nix b/pkgs/by-name/ce/celluloid/package.nix
index c0ada66edc6..64ee44b1ad1 100644
--- a/pkgs/by-name/ce/celluloid/package.nix
+++ b/pkgs/by-name/ce/celluloid/package.nix
@@ -5,6 +5,7 @@
 , desktop-file-utils
 , glib
 , gtk4
+, libGL
 , libepoxy
 , libadwaita
 , meson
@@ -40,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     glib
     gtk4
+    libGL
     libadwaita
     libepoxy
     mpv
diff --git a/pkgs/by-name/ju/justbuild/package.nix b/pkgs/by-name/ju/justbuild/package.nix
index 3403edcaacc..d630bdf22b3 100644
--- a/pkgs/by-name/ju/justbuild/package.nix
+++ b/pkgs/by-name/ju/justbuild/package.nix
@@ -11,7 +11,7 @@
   openssl,
 
   pkg-config,
-  protobuf3_23,
+  protobuf_23,
   grpc,
   pandoc,
   python3,
@@ -87,14 +87,14 @@ stdenv.mkDerivation rec {
     # For future updates: The currently used version can be found in the file
     # etc/repos.json: https://github.com/just-buildsystem/justbuild/blob/master/etc/repos.json
     # under the key .repositories.protobuf
-    protobuf3_23
+    protobuf_23
     python3
   ];
 
   postPatch = ''
     sed -ie 's|\./bin/just-mr.py|${python3}/bin/python3 ./bin/just-mr.py|' bin/bootstrap.py
     sed -ie 's|#!/usr/bin/env python3|#!${python3}/bin/python3|' bin/parallel-bootstrap-traverser.py
-    jq '.repositories.protobuf.pkg_bootstrap.local_path = "${protobuf3_23}"' etc/repos.json > etc/repos.json.patched
+    jq '.repositories.protobuf.pkg_bootstrap.local_path = "${protobuf_23}"' etc/repos.json > etc/repos.json.patched
     mv etc/repos.json.patched etc/repos.json
     jq '.repositories.com_github_grpc_grpc.pkg_bootstrap.local_path = "${grpc}"' etc/repos.json > etc/repos.json.patched
     mv etc/repos.json.patched etc/repos.json
diff --git a/pkgs/by-name/va/valijson/package.nix b/pkgs/by-name/va/valijson/package.nix
new file mode 100644
index 00000000000..777e192aee4
--- /dev/null
+++ b/pkgs/by-name/va/valijson/package.nix
@@ -0,0 +1,28 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "valijson";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "tristanpenman";
+    repo = "valijson";
+    rev = "v${version}";
+    hash = "sha256-COVFBZtuTd1nyI/25feUYCurBwPlQV3qbxSSkn6aLl4=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = with lib; {
+    description = "Header-only C++ library for JSON Schema validation, with support for many popular parsers";
+    homepage = "https://github.com/tristanpenman/valijson";
+    license = licenses.bsd2;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/data/misc/shared-mime-info/default.nix b/pkgs/data/misc/shared-mime-info/default.nix
index 197793db6c6..8de13f2eaf3 100644
--- a/pkgs/data/misc/shared-mime-info/default.nix
+++ b/pkgs/data/misc/shared-mime-info/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "shared-mime-info";
-  version = "2.2";
+  version = "2.3";
 
   outputs = [ "out" "dev" ];
 
@@ -23,9 +23,15 @@ stdenv.mkDerivation rec {
     owner = "xdg";
     repo = pname;
     rev = version;
-    sha256 = "sha256-QrRe/DcjpTMejHXDSOLbjpJywod8qIjP6/leTZ21rhE=";
+    sha256 = "sha256-cEfknRVtOJykEO9Iqlb0UoiayYtu+ugvmmZqAD5cGnE=";
   };
 
+  patches = [
+    # Submitted upstream at
+    # https://gitlab.freedesktop.org/xdg/shared-mime-info/-/issues/211
+    ./fix-clang-warnings.patch
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch b/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch
new file mode 100644
index 00000000000..2d185549c4e
--- /dev/null
+++ b/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch
@@ -0,0 +1,31 @@
+diff --git a/meson.build b/meson.build
+index 1780c44..7998a51 100644
+--- a/meson.build
++++ b/meson.build
+@@ -49,12 +49,7 @@ endif
+ ###############################################################################
+ # Dependencies
+ 
+-check_functions = [
+-    'fdatasync',
+-]
+-foreach function : check_functions
+-    config.set('HAVE_'+function.to_upper(), cc.has_function(function))
+-endforeach
++config.set('HAVE_FDATASYNC', cc.has_function('fdatasync', prefix: '#include <unistd.h>'))
+ 
+ 
+ if get_option('build-translations')
+diff --git a/src/update-mime-database.cpp b/src/update-mime-database.cpp
+index 733ba06..4ca6d06 100644
+--- a/src/update-mime-database.cpp
++++ b/src/update-mime-database.cpp
+@@ -2158,7 +2158,7 @@ static void check_in_path_xdg_data(const char *mime_path)
+ 
+ 	env = getenv("XDG_DATA_DIRS");
+ 	if (!env)
+-		env = "/usr/local/share/"PATH_SEPARATOR"/usr/share/";
++		env = "/usr/local/share/" PATH_SEPARATOR "/usr/share/";
+ 	dirs = g_strsplit(env, PATH_SEPARATOR, 0);
+ 	g_return_if_fail(dirs != NULL);
+ 	for (n = 0; dirs[n]; n++)
diff --git a/pkgs/desktops/gnustep/make/builder.sh b/pkgs/desktops/gnustep/make/builder.sh
index 736635ab502..79ead3f7b72 100644
--- a/pkgs/desktops/gnustep/make/builder.sh
+++ b/pkgs/desktops/gnustep/make/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 providedPreConfigure="$preConfigure";
diff --git a/pkgs/development/compilers/aspectj/builder.sh b/pkgs/development/compilers/aspectj/builder.sh
index 7ea0a40d374..31ec97942e5 100755
--- a/pkgs/development/compilers/aspectj/builder.sh
+++ b/pkgs/development/compilers/aspectj/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 export JAVA_HOME=$jre
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 5a139fb2906..dcadf054bc3 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "binaryen";
-  version = "114";
+  version = "116";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "binaryen";
     rev = "version_${version}";
-    hash = "sha256-bzHNIQy0AN8mIFGG+638p/MBSqlkWuaOzKGSsMDAPH4=";
+    hash = "sha256-gMwbWiP+YDCVafQMBWhTuJGWmkYtnhEdn/oofKaUT08=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
index cb56eabc5d7..78535382a7c 100644
--- a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "exporting egg ${eggName} (version $version) into $out"
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 37ccb5f1a02..436fda2a052 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "emscripten";
-  version = "3.1.45";
+  version = "3.1.47";
 
   llvmEnv = symlinkJoin {
     name = "emscripten-llvm-${version}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     name = "emscripten-node-modules-${version}";
     inherit pname version src;
 
-    npmDepsHash = "sha256-kcWAio1fKuwqFCFlupX9KevjWPbv9W/Z/5EPrihQ6ms=";
+    npmDepsHash = "sha256-Qft+//za5ed6Oquxtcdpv7g5oOc2WmWuRJ/CDe+FEiI=";
 
     dontBuild = true;
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "emscripten-core";
     repo = "emscripten";
-    hash = "sha256-yf0Yb/UjaBQpIEPZzzjaUmR+JzKPSJHMkrYLHxDXwOg=";
+    hash = "sha256-cRNkQ+7vUqJLNlf5dieeDcyT1jlBUeVxO8avoUvOPHI=";
     rev = version;
   };
 
@@ -85,6 +85,9 @@ stdenv.mkDerivation rec {
     cp -r . $appdir
     chmod -R +w $appdir
 
+    mkdir -p $appdir/node_modules
+    cp -r ${nodeModules}/* $appdir/node_modules
+
     mkdir -p $out/bin
     for b in em++ em-config emar embuilder.py emcc emcmake emconfigure emmake emranlib emrun emscons emsize; do
       makeWrapper $appdir/$b $out/bin/$b \
diff --git a/pkgs/development/compilers/fpc/binary-builder-darwin.sh b/pkgs/development/compilers/fpc/binary-builder-darwin.sh
index 39db0518281..8a8600f1f63 100755
--- a/pkgs/development/compilers/fpc/binary-builder-darwin.sh
+++ b/pkgs/development/compilers/fpc/binary-builder-darwin.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 pkgdir=$(pwd)/pkg
diff --git a/pkgs/development/compilers/fpc/binary-builder.sh b/pkgs/development/compilers/fpc/binary-builder.sh
index c471378c275..568c3094107 100755
--- a/pkgs/development/compilers/fpc/binary-builder.sh
+++ b/pkgs/development/compilers/fpc/binary-builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 tar xf $src
diff --git a/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
new file mode 100644
index 00000000000..d938d67a2d0
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
@@ -0,0 +1,85 @@
+From b10785c1be469319a09b10bc69db21159b0599ee Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <siarheit@google.com>
+Date: Fri, 22 Sep 2023 22:41:49 +0100
+Subject: [PATCH] gcc/file-prefix-map.cc: always mangle __FILE__ into invalid
+ store path
+
+Without the change `__FILE__` used in static inline functions in headers
+embed paths to header files into executable images. For local headers
+it's not a problem, but for headers in `/nix/store` this causes `-dev`
+inputs to be retained in runtime closure.
+
+Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
+`lttng-ust.dev`.
+
+Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
+
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/...
+
+In practice it quickly exhausts argument lengtth limit due to `gcc`
+deficiency: https://gcc.gnu.org/PR111527
+
+Until it;s fixed let's hardcode header mangling if $NIX_STORE variable
+is present in the environment.
+
+Tested as:
+
+    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    ...
+    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    ...
+
+Mangled successfully.
+--- a/gcc/file-prefix-map.cc
++++ b/gcc/file-prefix-map.cc
+@@ -60,6 +60,9 @@ add_prefix_map (file_prefix_map *&maps, const char *arg, const char *opt)
+   maps = map;
+ }
+ 
++/* Forward declaration for a $NIX_STORE remap hack below. */
++static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
++
+ /* Perform user-specified mapping of filename prefixes.  Return the
+    GC-allocated new name corresponding to FILENAME or FILENAME if no
+    remapping was performed.  */
+@@ -76,7 +79,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
+     if (filename_ncmp (filename, map->old_prefix, map->old_len) == 0)
+       break;
+   if (!map)
+-    return filename;
++    {
++      if (maps == macro_prefix_maps)
++	{
++	  /* Remap all fo $NIX_STORE/.{32} paths to
++	  * equivalent $NIX_STORE/e{32}.
++	  *
++	  * That way we avoid argument parameters explosion
++	  * and still avoid embedding headers into runtime closure:
++	  *   https://gcc.gnu.org/PR111527
++	  */
++	  char * nix_store = getenv("NIX_STORE");
++	  size_t nix_store_len = nix_store ? strlen(nix_store) : 0;
++	  const char * name = filename;
++	  size_t name_len = strlen(name);
++	  if (nix_store && name_len >= nix_store_len + 1 + 32 && memcmp(name, nix_store, nix_store_len) == 0)
++	    {
++	       s = (char *) ggc_alloc_atomic (name_len + 1);
++	       memcpy(s, name, name_len + 1);
++	       memset(s + nix_store_len + 1, 'e', 32);
++	       return s;
++	    }
++	}
++      return filename;
++    }
+   name = filename + map->old_len;
+   name_len = strlen (name) + 1;
+ 
+@@ -90,7 +116,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+    ignore it in DW_AT_producer (dwarf2out.cc).  */
+ 
+ /* Linked lists of file_prefix_map structures.  */
+-static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
+ static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
+ static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
+ 
diff --git a/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
new file mode 100644
index 00000000000..57ae2111f02
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
@@ -0,0 +1,84 @@
+From b10785c1be469319a09b10bc69db21159b0599ee Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <siarheit@google.com>
+Date: Fri, 22 Sep 2023 22:41:49 +0100
+Subject: [PATCH] gcc/file-prefix-map.cc: always mangle __FILE__ into invalid
+ store path
+
+Without the change `__FILE__` used in static inline functions in headers
+embed paths to header files into executable images. For local headers
+it's not a problem, but for headers in `/nix/store` this causes `-dev`
+inputs to be retained in runtime closure.
+
+Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
+`lttng-ust.dev`.
+
+Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
+
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/...
+
+In practice it quickly exhausts argument lengtth limit due to `gcc`
+deficiency: https://gcc.gnu.org/PR111527
+
+Until it;s fixed let's hardcode header mangling if $NIX_STORE variable
+is present in the environment.
+
+Tested as:
+
+    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    ...
+    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    ...
+
+Mangled successfully.
+--- a/gcc/file-prefix-map.cc
++++ b/gcc/file-prefix-map.cc
+@@ -69,6 +69,9 @@ add_prefix_map (file_prefix_map *&maps, const char *arg, const char *opt)
+   maps = map;
+ }
+ 
++/* Forward declaration for a $NIX_STORE remap hack below. */
++static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
++
+ /* Perform user-specified mapping of filename prefixes.  Return the
+    GC-allocated new name corresponding to FILENAME or FILENAME if no
+    remapping was performed.  */
+@@ -102,6 +105,29 @@ remap_filename (file_prefix_map *maps, const char *filename)
+       break;
+   if (!map)
+     {
++      if (maps == macro_prefix_maps)
++	{
++	  /* Remap all fo $NIX_STORE/.{32} paths to
++	   * equivalent $NIX_STORE/e{32}.
++	   *
++	   * That way we avoid argument parameters explosion
++	   * and still avoid embedding headers into runtime closure:
++	   *   https://gcc.gnu.org/PR111527
++	   */
++	   char * nix_store = getenv("NIX_STORE");
++	   size_t nix_store_len = nix_store ? strlen(nix_store) : 0;
++	   const char * name = realname ? realname : filename;
++	   size_t name_len = strlen(name);
++	   if (nix_store && name_len >= nix_store_len + 1 + 32 && memcmp(name, nix_store, nix_store_len) == 0)
++	     {
++		s = (char *) ggc_alloc_atomic (name_len + 1);
++		memcpy(s, name, name_len + 1);
++		memset(s + nix_store_len + 1, 'e', 32);
++		if (realname != filename)
++		  free (const_cast <char *> (realname));
++		return s;
++	     }
++	}
+       if (realname != filename)
+ 	free (const_cast <char *> (realname));
+       return filename;
+@@ -124,7 +150,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+    ignore it in DW_AT_producer (gen_command_line_string in opts.cc).  */
+ 
+ /* Linked lists of file_prefix_map structures.  */
+-static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
+ static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
+ static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
+ 
+
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 0afc6586511..4491c3fde47 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -63,8 +63,8 @@ in
 ++ optionals (noSysDirs) (
   [(if atLeast12 then ./gcc-12-no-sys-dirs.patch else ./no-sys-dirs.patch)] ++
   ({
-    "13" = [ ./13/no-sys-dirs-riscv.patch ];
-    "12" = [ ./no-sys-dirs-riscv.patch ];
+    "13" = [ ./13/no-sys-dirs-riscv.patch ./13/mangle-NIX_STORE-in-__FILE__.patch ];
+    "12" = [ ./no-sys-dirs-riscv.patch ./12/mangle-NIX_STORE-in-__FILE__.patch ];
     "11" = [ ./no-sys-dirs-riscv.patch ];
     "10" = [ ./no-sys-dirs-riscv.patch ];
     "9"  = [ ./no-sys-dirs-riscv-gcc9.patch ];
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index 9753a1077a6..ff55201ebd0 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "12.3.1";
+  version = "13.1.1";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    hash = "sha256-NP5ph598YSPbpzJJUR2r+EkqFmuItxgvOSDgDaN+Swg=";
+    hash = "sha256-fuzNsVYdnThMzd4tLN/sTbCBXg6qXKLDJRziOKyOBGg=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
diff --git a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
index 47459664af0..4eef8acb069 100644
--- a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
+++ b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
@@ -1,5 +1,5 @@
 # -*- shell-script -*-
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 function extract
diff --git a/pkgs/development/compilers/llvm/16/lld/add-table-base.patch b/pkgs/development/compilers/llvm/16/lld/add-table-base.patch
new file mode 100644
index 00000000000..15fc903a5e3
--- /dev/null
+++ b/pkgs/development/compilers/llvm/16/lld/add-table-base.patch
@@ -0,0 +1,190 @@
+From 93adcb770b99351b18553089c164fe3ef2119699 Mon Sep 17 00:00:00 2001
+From: Sam Clegg <sbc@chromium.org>
+Date: Fri, 25 Aug 2023 13:56:16 -0700
+Subject: [PATCH] [lld][WebAssembly] Add `--table-base` setting
+
+This is similar to `--global-base` but determines where to place the
+table segments rather than that data segments.
+
+See https://github.com/emscripten-core/emscripten/issues/20097
+
+Differential Revision: https://reviews.llvm.org/D158892
+---
+ test/wasm/table-base.s | 72 ++++++++++++++++++++++++++++++++++++++
+ wasm/Driver.cpp        | 19 ++++++++--
+ wasm/Options.td        |  5 ++-
+ wasm/Writer.cpp        |  8 -----
+ 4 files changed, 93 insertions(+), 11 deletions(-)
+ create mode 100644 test/wasm/table-base.s
+
+diff --git a/test/wasm/table-base.s b/test/wasm/table-base.s
+new file mode 100644
+index 000000000000000..56fff414fd31d96
+--- /dev/null
++++ b/test/wasm/table-base.s
+@@ -0,0 +1,72 @@
++# RUN: llvm-mc -filetype=obj -triple=wasm32-unknown-unknown %s -o %t.o
++
++# RUN: wasm-ld --export=__table_base -o %t.wasm %t.o
++# RUN: obj2yaml %t.wasm | FileCheck %s  -check-prefix=CHECK-DEFAULT
++
++# RUN: wasm-ld --table-base=100 --export=__table_base -o %t.wasm %t.o
++# RUN: obj2yaml %t.wasm | FileCheck %s  -check-prefix=CHECK-100
++
++.globl _start
++_start:
++  .functype _start () -> ()
++  i32.const _start
++  drop
++  end_function
++
++# CHECK-DEFAULT:       - Type:            TABLE
++# CHECK-DEFAULT-NEXT:    Tables:
++# CHECK-DEFAULT-NEXT:      - Index:           0
++# CHECK-DEFAULT-NEXT:        ElemType:        FUNCREF
++# CHECK-DEFAULT-NEXT:        Limits:
++# CHECK-DEFAULT-NEXT:          Flags:           [ HAS_MAX ]
++# CHECK-DEFAULT-NEXT:          Minimum:         0x2
++# CHECK-DEFAULT-NEXT:          Maximum:         0x2
++
++# CHECK-DEFAULT:       - Type:            GLOBAL
++# CHECK-DEFAULT-NEXT:    Globals:
++# CHECK-DEFAULT-NEXT:      - Index:           0
++# CHECK-DEFAULT-NEXT:        Type:            I32
++# CHECK-DEFAULT-NEXT:        Mutable:         true
++# CHECK-DEFAULT-NEXT:        InitExpr:
++# CHECK-DEFAULT-NEXT:          Opcode:          I32_CONST
++# CHECK-DEFAULT-NEXT:          Value:           66560
++# CHECK-DEFAULT-NEXT:      - Index:           1
++# CHECK-DEFAULT-NEXT:        Type:            I32
++# CHECK-DEFAULT-NEXT:        Mutable:         false
++# CHECK-DEFAULT-NEXT:        InitExpr:
++# CHECK-DEFAULT-NEXT:          Opcode:          I32_CONST
++# CHECK-DEFAULT-NEXT:          Value:           1
++
++# CHECK-DEFAULT:       - Type:            EXPORT
++# CHECK-DEFAULT:           - Name:            __table_base
++# CHECK-DEFAULT-NEXT:        Kind:            GLOBAL
++# CHECK-DEFAULT-NEXT:        Index:           1
++
++# CHECK-100:       - Type:            TABLE
++# CHECK-100-NEXT:    Tables:
++# CHECK-100-NEXT:      - Index:           0
++# CHECK-100-NEXT:        ElemType:        FUNCREF
++# CHECK-100-NEXT:        Limits:
++# CHECK-100-NEXT:          Flags:           [ HAS_MAX ]
++# CHECK-100-NEXT:          Minimum:         0x65
++# CHECK-100-NEXT:          Maximum:         0x65
++
++# CHECK-100:       - Type:            GLOBAL
++# CHECK-100-NEXT:    Globals:
++# CHECK-100-NEXT:      - Index:           0
++# CHECK-100-NEXT:        Type:            I32
++# CHECK-100-NEXT:        Mutable:         true
++# CHECK-100-NEXT:        InitExpr:
++# CHECK-100-NEXT:          Opcode:          I32_CONST
++# CHECK-100-NEXT:          Value:           66560
++# CHECK-100-NEXT:      - Index:           1
++# CHECK-100-NEXT:        Type:            I32
++# CHECK-100-NEXT:        Mutable:         false
++# CHECK-100-NEXT:        InitExpr:
++# CHECK-100-NEXT:          Opcode:          I32_CONST
++# CHECK-100-NEXT:          Value:           100
++
++# CHECK-100:       - Type:            EXPORT
++# CHECK-100:           - Name:            __table_base
++# CHECK-100-NEXT:        Kind:            GLOBAL
++# CHECK-100-NEXT:        Index:           1
+diff --git a/wasm/Driver.cpp b/wasm/Driver.cpp
+index 84304881f5ca34e..c2f5f0185781f36 100644
+--- a/wasm/Driver.cpp
++++ b/wasm/Driver.cpp
+@@ -502,6 +502,7 @@ static void readConfigs(opt::InputArgList &args) {
+ 
+   config->initialMemory = args::getInteger(args, OPT_initial_memory, 0);
+   config->globalBase = args::getInteger(args, OPT_global_base, 0);
++  config->tableBase = args::getInteger(args, OPT_table_base, 0);
+   config->maxMemory = args::getInteger(args, OPT_max_memory, 0);
+   config->zStackSize =
+       args::getZOptionValue(args, OPT_z, "stack-size", WasmPageSize);
+@@ -573,6 +574,17 @@ static void setConfigs() {
+     if (config->exportTable)
+       error("-shared/-pie is incompatible with --export-table");
+     config->importTable = true;
++  } else {
++    // Default table base.  Defaults to 1, reserving 0 for the NULL function
++    // pointer.
++    if (!config->tableBase)
++      config->tableBase = 1;
++    // The default offset for static/global data, for when --global-base is
++    // not specified on the command line.  The precise value of 1024 is
++    // somewhat arbitrary, and pre-dates wasm-ld (Its the value that
++    // emscripten used prior to wasm-ld).
++    if (!config->globalBase && !config->relocatable && !config->stackFirst)
++      config->globalBase = 1024;
+   }
+ 
+   if (config->relocatable) {
+@@ -666,8 +678,11 @@ static void checkOptions(opt::InputArgList &args) {
+     warn("-Bsymbolic is only meaningful when combined with -shared");
+   }
+ 
+-  if (config->globalBase && config->isPic) {
+-    error("--global-base may not be used with -shared/-pie");
++  if (config->isPic) {
++    if (config->globalBase)
++      error("--global-base may not be used with -shared/-pie");
++    if (config->tableBase)
++      error("--table-base may not be used with -shared/-pie");
+   }
+ }
+ 
+diff --git a/wasm/Options.td b/wasm/Options.td
+index 50417d2928e0a34..bb764396bf4df14 100644
+--- a/wasm/Options.td
++++ b/wasm/Options.td
+@@ -191,7 +191,7 @@ def growable_table: FF<"growable-table">,
+   HelpText<"Remove maximum size from function table, allowing table to grow">;
+ 
+ def global_base: JJ<"global-base=">,
+-  HelpText<"Where to start to place global data">;
++  HelpText<"Memory offset at which to place global data (Defaults to 1024)">;
+ 
+ def import_memory: FF<"import-memory">,
+   HelpText<"Import the module's memory from the default module of \"env\" with the name \"memory\".">;
+@@ -224,6 +224,9 @@ def no_entry: FF<"no-entry">,
+ def stack_first: FF<"stack-first">,
+   HelpText<"Place stack at start of linear memory rather than after data">;
+ 
++def table_base: JJ<"table-base=">,
++  HelpText<"Table offset at which to place address taken functions (Defaults to 1)">;
++
+ defm whole_archive: B<"whole-archive",
+     "Force load of all members in a static library",
+     "Do not force load of all members in a static library (default)">;
+diff --git a/wasm/Writer.cpp b/wasm/Writer.cpp
+index f25d358dc5bae6f..0576bf2907e49c4 100644
+--- a/wasm/Writer.cpp
++++ b/wasm/Writer.cpp
+@@ -358,13 +358,6 @@ void Writer::layoutMemory() {
+       memoryPtr = config->globalBase;
+     }
+   } else {
+-    if (!config->globalBase && !config->relocatable && !config->isPic) {
+-      // The default offset for static/global data, for when --global-base is
+-      // not specified on the command line.  The precise value of 1024 is
+-      // somewhat arbitrary, and pre-dates wasm-ld (Its the value that
+-      // emscripten used prior to wasm-ld).
+-      config->globalBase = 1024;
+-    }
+     memoryPtr = config->globalBase;
+   }
+ 
+@@ -1685,7 +1678,6 @@ void Writer::run() {
+   // For PIC code the table base is assigned dynamically by the loader.
+   // For non-PIC, we start at 1 so that accessing table index 0 always traps.
+   if (!config->isPic) {
+-    config->tableBase = 1;
+     if (WasmSym::definedTableBase)
+       WasmSym::definedTableBase->setVA(config->tableBase);
+     if (WasmSym::definedTableBase32)
diff --git a/pkgs/development/compilers/llvm/16/lld/default.nix b/pkgs/development/compilers/llvm/16/lld/default.nix
index cc18aee76a4..84943e8effc 100644
--- a/pkgs/development/compilers/llvm/16/lld/default.nix
+++ b/pkgs/development/compilers/llvm/16/lld/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gnu-install-dirs.patch
+    ./add-table-base.patch
   ];
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/compilers/ocaml/builder.sh b/pkgs/development/compilers/ocaml/builder.sh
index 88acc0654cf..85b26848f4e 100644
--- a/pkgs/development/compilers/ocaml/builder.sh
+++ b/pkgs/development/compilers/ocaml/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 configureFlags="-prefix $out $configureFlags"
diff --git a/pkgs/development/compilers/rust/1_72.nix b/pkgs/development/compilers/rust/1_73.nix
index f540c229c6f..37e75e0a7a4 100644
--- a/pkgs/development/compilers/rust/1_72.nix
+++ b/pkgs/development/compilers/rust/1_73.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.72.1";
-  rustcSha256 = "sha256-f0iEX2pSzbtdY/sFKP1fUg60QydbVfmOMoFZ+GVo+JU=";
+  rustcVersion = "1.73.0";
+  rustcSha256 = "sha256-ltYubR8tId96yKyzuYgkEfnnxwNhc/fy7enh8faxuzo=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
@@ -35,25 +35,24 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.71.1";
+  bootstrapVersion = "1.72.1";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "ea544e213cdf65194d9650df9d521dd2ed63251e2abe89c8123e336dfe580b21";
-    x86_64-unknown-linux-gnu = "34778d1cda674990dfc0537bc600066046ae9cb5d65a07809f7e7da31d4689c4";
-    x86_64-unknown-linux-musl = "67acc1744293e52f4b49231f3c503e8ad187c477e7b567e27925ec792d946a01";
-    arm-unknown-linux-gnueabihf = "4c88b32849132504fce5b93bebf06dd0fa17988340c7fe97afa661e038dfa258";
-    armv7-unknown-linux-gnueabihf = "8f8556dbd8b0350364c7dc8fda57549934bf3c26c65498dda5842087f5c90d60";
-    aarch64-unknown-linux-gnu = "c7cf230c740a62ea1ca6a4304d955c286aea44e3c6fc960b986a8c2eeea4ec3f";
-    aarch64-unknown-linux-musl = "da87f4ca2534886f1006b2e8abb0dda8db231ce82cc67b4857233ad48a21c87c";
-    x86_64-apple-darwin = "916056603da88336aba68bbeab49711cc8fdb9cfb46a49b04850c0c09761f58c";
-    aarch64-apple-darwin = "f4061b65b31ac75b9b5384c1f518e555f3da23f93bcf64dce252461ee65e9351";
-    powerpc64le-unknown-linux-gnu = "bac57066882366e4628d1ed2bbe4ab19c0b373aaf45582c2da9f639f2f6ea537";
-    riscv64gc-unknown-linux-gnu = "fcb67647b764669f3b4e61235fbdc0eca287229adf9aed8c41ce20ffaad4a3ea";
-    mips64el-unknown-linux-gnuabi64 = "6523efea9cd48c0375bd621460d890c65457a5534fafb2d8b69a37ee1e2a39ed";
+    i686-unknown-linux-gnu = "a2a849a701dfd6643aaaa27e1ed5ac56aea00f7dee26c00d81c520808efd8911";
+    x86_64-unknown-linux-gnu = "4fbd8df2000cf73c632d67a219a7fc153537ceffa2e6474491e3db71fdd5a410";
+    x86_64-unknown-linux-musl = "94eddc044868a944a887d0b0375e393cb3acc6ebc034e3eac2ef2890ec7c0eac";
+    arm-unknown-linux-gnueabihf = "a4d90538882181722d3e7cb8d7f021770e29e6b6d28375452e31a98049600110";
+    armv7-unknown-linux-gnueabihf = "4c8e6b3c705a84d17894d3a1cfe744fb6083dd57c61868e67aac8b8512640ecb";
+    aarch64-unknown-linux-gnu = "190d0473cbe619f163d33a6c4e2ef982abdd4178f73abc3194631cd2d5c8ed8b";
+    aarch64-unknown-linux-musl = "c83778d1a95f6604bc3610a9070e8a8435c60a8bca5117aad71ffab36dea020f";
+    x86_64-apple-darwin = "d01e7e9a7482f88a51b4fd888f06234274b49f51b5476c2d14fd46fd6e99ba9e";
+    aarch64-apple-darwin = "42b0aaf269b6d9c60db13a64a920336d6064ab11d0c7043c9deeb9d4f67b3983";
+    powerpc64le-unknown-linux-gnu = "9310df247efc072f2ca27354a875c4989cf3c29c9e545255a7472895d830163c";
+    riscv64gc-unknown-linux-gnu = "1e08cd3ecd29d5bf247e3f7f4bc97318b439f0443dd9c99c36edcfa717d55101";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_72;
+  selectRustPackage = pkgs: pkgs.rust_1_73;
 
   rustcPatches = [ ];
 }
diff --git a/pkgs/development/compilers/rust/print-hashes.sh b/pkgs/development/compilers/rust/print-hashes.sh
index dd2c116a341..ebf8d900bb3 100755
--- a/pkgs/development/compilers/rust/print-hashes.sh
+++ b/pkgs/development/compilers/rust/print-hashes.sh
@@ -19,7 +19,6 @@ PLATFORMS=(
   aarch64-apple-darwin
   powerpc64le-unknown-linux-gnu
   riscv64gc-unknown-linux-gnu
-  mips64el-unknown-linux-gnuabi64
 )
 BASEURL=https://static.rust-lang.org/dist
 VERSION=${1:-}
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 3a649bde95d..44c290acbd3 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -66,15 +66,18 @@ in stdenv.mkDerivation rec {
   # We need rust to build rust. If we don't provide it, configure will try to download it.
   # Reference: https://github.com/rust-lang/rust/blob/master/src/bootstrap/configure.py
   configureFlags = let
+    prefixForStdenv = stdenv: "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}";
+    ccPrefixForStdenv = stdenv: "${prefixForStdenv stdenv}${if (stdenv.cc.isClang or false) then "clang" else "cc"}";
+    cxxPrefixForStdenv = stdenv: "${prefixForStdenv stdenv}${if (stdenv.cc.isClang or false) then "clang++" else "c++"}";
     setBuild  = "--set=target.${rust.toRustTarget stdenv.buildPlatform}";
     setHost   = "--set=target.${rust.toRustTarget stdenv.hostPlatform}";
     setTarget = "--set=target.${rust.toRustTarget stdenv.targetPlatform}";
-    ccForBuild  = "${pkgsBuildBuild.targetPackages.stdenv.cc}/bin/${pkgsBuildBuild.targetPackages.stdenv.cc.targetPrefix}cc";
-    cxxForBuild = "${pkgsBuildBuild.targetPackages.stdenv.cc}/bin/${pkgsBuildBuild.targetPackages.stdenv.cc.targetPrefix}c++";
-    ccForHost  = "${pkgsBuildHost.targetPackages.stdenv.cc}/bin/${pkgsBuildHost.targetPackages.stdenv.cc.targetPrefix}cc";
-    cxxForHost = "${pkgsBuildHost.targetPackages.stdenv.cc}/bin/${pkgsBuildHost.targetPackages.stdenv.cc.targetPrefix}c++";
-    ccForTarget  = "${pkgsBuildTarget.targetPackages.stdenv.cc}/bin/${pkgsBuildTarget.targetPackages.stdenv.cc.targetPrefix}cc";
-    cxxForTarget = "${pkgsBuildTarget.targetPackages.stdenv.cc}/bin/${pkgsBuildTarget.targetPackages.stdenv.cc.targetPrefix}c++";
+    ccForBuild  = ccPrefixForStdenv pkgsBuildBuild.targetPackages.stdenv;
+    cxxForBuild  = cxxPrefixForStdenv pkgsBuildBuild.targetPackages.stdenv;
+    ccForHost  = ccPrefixForStdenv pkgsBuildHost.targetPackages.stdenv;
+    cxxForHost  = cxxPrefixForStdenv pkgsBuildHost.targetPackages.stdenv;
+    ccForTarget  = ccPrefixForStdenv pkgsBuildTarget.targetPackages.stdenv;
+    cxxForTarget  = cxxPrefixForStdenv pkgsBuildTarget.targetPackages.stdenv;
   in [
     "--release-channel=stable"
     "--set=build.rustc=${rustc}/bin/rustc"
@@ -272,9 +275,8 @@ in stdenv.mkDerivation rec {
       "i686-freebsd13" "x86_64-freebsd13"
       "x86_64-solaris"
       "aarch64-linux" "armv6l-linux" "armv7l-linux" "i686-linux"
-      "loongarch64-linux" "mipsel-linux" "mips64el-linux"
-      "powerpc64-linux" "powerpc64le-linux" "riscv64-linux"
-      "s390x-linux" "x86_64-linux"
+      "loongarch64-linux" "powerpc64-linux" "powerpc64le-linux"
+      "riscv64-linux" "s390x-linux" "x86_64-linux"
       "aarch64-netbsd" "armv7l-netbsd" "i686-netbsd" "powerpc-netbsd"
       "x86_64-netbsd"
       "i686-openbsd" "x86_64-openbsd"
diff --git a/pkgs/development/compilers/squeak/default.nix b/pkgs/development/compilers/squeak/default.nix
index 818ad22fae7..79627eba7c8 100644
--- a/pkgs/development/compilers/squeak/default.nix
+++ b/pkgs/development/compilers/squeak/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, fetchzip
 , autoconf, automake, autoreconfHook, clang, dos2unix, file, perl
 , pkg-config
-, alsa-lib, coreutils, freetype, glib, glibc, gnugrep, libpulseaudio, libtool
-, libuuid, openssl, pango, xorg
+, alsa-lib, coreutils, freetype, glib, glibc, gnugrep, libGL, libpulseaudio
+, libtool, libuuid, openssl, pango, xorg
 , squeakImageHash ? null, squeakSourcesHash ? null, squeakSourcesVersion ? null
 , squeakVersion ? null, squeakVmCommitHash ? null, squeakVmCommitHashHash ? null
 , squeakVmVersion ? null
@@ -88,6 +88,7 @@ in stdenv.mkDerivation {
     glib
     glibc
     gnugrep
+    libGL
     libpulseaudio
     libtool
     libuuid
diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
index f6ba21f3757..3004ef928bc 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
@@ -245,7 +245,9 @@ self: super: {
 
   # Fix ghc-9.6.x build errors.
   libmpd = appendPatch
-    (pkgs.fetchpatch { url = "https://github.com/vimus/libmpd-haskell/pull/138.patch";
+    # https://github.com/vimus/libmpd-haskell/pull/138
+    (pkgs.fetchpatch { url = "https://github.com/vimus/libmpd-haskell/compare/95d3b3bab5858d6d1f0e079d0ab7c2d182336acb...5737096a339edc265a663f51ad9d29baee262694.patch";
+                       name = "vimus-libmpd-haskell-pull-138.patch";
                        sha256 = "sha256-CvvylXyRmoCoRJP2MzRwL0SBbrEzDGqAjXS+4LsLutQ=";
                      })
     super.libmpd;
@@ -255,8 +257,9 @@ self: super: {
     editedCabalFile = null;
     buildDepends = drv.buildDepends or [] ++ [ self.HUnit ];
     patches = [(pkgs.fetchpatch {
+      # https://github.com/jgoerzen/configfile/pull/12
       name = "ConfigFile-pr-12.patch";
-      url = "https://github.com/jgoerzen/configfile/pull/12.patch";
+      url = "https://github.com/jgoerzen/configfile/compare/d0a2e654be0b73eadbf2a50661d00574ad7b6f87...83ee30b43f74d2b6781269072cf5ed0f0e00012f.patch";
       sha256 = "sha256-b7u9GiIAd2xpOrM0MfILHNb6Nt7070lNRIadn2l3DfQ=";
     })];
   }) super.ConfigFile;
diff --git a/pkgs/development/interpreters/guile/2.2.nix b/pkgs/development/interpreters/guile/2.2.nix
index 617658e748b..918735517ea 100644
--- a/pkgs/development/interpreters/guile/2.2.nix
+++ b/pkgs/development/interpreters/guile/2.2.nix
@@ -34,9 +34,9 @@ builder rec {
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = if stdenv.buildPlatform.isDarwin
-    then [ buildPackages.darwin.apple_sdk_11_0.stdenv.cc ]
-    else [ buildPackages.stdenv.cc ]
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile_2_2;
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index 81837791280..7b45ba50ded 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -36,10 +36,9 @@ builder rec {
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = if stdenv.buildPlatform.isDarwin
-    then [ buildPackages.darwin.apple_sdk_11_0.stdenv.cc ]
-    else [ buildPackages.stdenv.cc ]
-  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile_3_0;
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/development/interpreters/nelua/default.nix b/pkgs/development/interpreters/nelua/default.nix
index 8030980b778..fe4448c2f8d 100644
--- a/pkgs/development/interpreters/nelua/default.nix
+++ b/pkgs/development/interpreters/nelua/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "nelua";
-  version = "unstable-2023-01-21";
+  version = "unstable-2023-09-16";
 
   src = fetchFromGitHub {
     owner = "edubart";
     repo = "nelua-lang";
-    rev = "d10cc61bc54050b07874a8597f8df20534885105";
-    hash = "sha256-HyNYqhPCQVBJqEcAUUXfvycXE8tWIMIUJJMTIV48ne8=";
+    rev = "596fcca5c77932da8a07c249de59a9dff3099495";
+    hash = "sha256-gXTlAxW7s3VBiC1fGU0aUlGspHlvyY7FC5KLeU2FyGQ=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 2d293bb29a0..8f775699f48 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -30,10 +30,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "5";
+        patch = "6";
         suffix = "";
       };
-      hash = "sha256-hc0S6c8dbVpF8X96/hzr5+5ijTKCKBxJLoat9jbe+j8=";
+      hash = "sha256-D6t4+n8TP084IQxiYNkNfA1ccZhEZBnOBX7HrC5vXzg=";
     };
   };
 
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index ba51c43822d..6a05a7fa6ee 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -227,6 +227,9 @@ in {
   sphinxHook = callPackage ({ makePythonHook, installShellFiles }:
     makePythonHook {
       name = "python${python.pythonVersion}-sphinx-hook";
-      propagatedBuildInputs = [ pythonForBuild.pkgs.sphinx installShellFiles ];
+      propagatedBuildInputs = [ installShellFiles ];
+      substitutions = {
+        sphinxBuild = "${pythonForBuild.pkgs.sphinx}/bin/sphinx-build";
+      };
     } ./sphinx-hook.sh) {};
 }
diff --git a/pkgs/development/interpreters/python/hooks/sphinx-hook.sh b/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
index ca67fa9beab..0307e83d947 100644
--- a/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
@@ -38,7 +38,7 @@ buildSphinxPhase() {
 
     for __builder in "${__sphinxBuilders[@]}"; do
         echo "Executing sphinx-build with ${__builder} builder"
-        sphinx-build -M "${__builder}" "${__sphinxRoot}" ".sphinx/${__builder}" -v
+        @sphinxBuild@ -M "${__builder}" "${__sphinxRoot}" ".sphinx/${__builder}" -v
     done
 
     runHook postBuildSphinx
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index fbacf6bb233..81308900f22 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -102,13 +102,14 @@
 
 , disabledTestPaths ? []
 
+# Allow passing in a custom stdenv to buildPython*
+, stdenv ? python.stdenv
+
 , ... } @ attrs:
 
 assert (pyproject != null) -> (format == null);
 
 let
-  inherit (python) stdenv;
-
   format' =
     if pyproject != null then
       if pyproject then
@@ -194,7 +195,7 @@ let
   # Keep extra attributes from `attrs`, e.g., `patchPhase', etc.
   self = toPythonModule (stdenv.mkDerivation ((builtins.removeAttrs attrs [
     "disabled" "checkPhase" "checkInputs" "nativeCheckInputs" "doCheck" "doInstallCheck" "dontWrapPythonPrograms" "catchConflicts" "pyproject" "format"
-    "disabledTestPaths" "outputs"
+    "disabledTestPaths" "outputs" "stdenv"
   ]) // {
 
     name = namePrefix + name_;
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index e40ccb5908d..f0818da2a53 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.20";
+  version = "3.4.21";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-9jKKef7KPnSYgKb3zf1LaulFBJuDpY6pWOJHSpG6Hzs=";
+    hash = "sha256-oIz9sT+ZfKh1HZc3Fg300EQpSfNsG7fZZB/ilcKXEIA=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 7b741b803de..0a5980457d6 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -56,13 +56,13 @@
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.28.3";
+  version = "2.28.4";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL";
     rev = "release-${version}";
-    hash = "sha256-/kQ2IyvAfmZ+zIUt1WuEIeX0nYPGXDlAQk2qDsQnFFs=";
+    hash = "sha256-1+1m0s3pBCTu924J/4aIu4IHk/N88x2djWDEsDpAJn4=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/Xaw3d/default.nix b/pkgs/development/libraries/Xaw3d/default.nix
index f358a59ad62..f90be3a751e 100644
--- a/pkgs/development/libraries/Xaw3d/default.nix
+++ b/pkgs/development/libraries/Xaw3d/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "Xaw3d";
-  version = "1.6.3";
+  version = "1.6.5";
 
   src = fetchurl {
-    url = "https://www.x.org/releases/individual/lib/libXaw3d-${version}.tar.bz2";
-    sha256 = "0i653s8g25cc0mimkwid9366bqkbyhdyjhckx7bw77j20hzrkfid";
+    url = "https://www.x.org/releases/individual/lib/libXaw3d-${version}.tar.xz";
+    sha256 = "sha256-NIHuS2dTuI4YhW6iZcuE8rAznujDu+yWaxVrOLWEGDM=";
   };
   dontUseImakeConfigure = true;
   nativeBuildInputs = [ pkg-config bison flex imake gccmakedep ];
diff --git a/pkgs/development/libraries/audio/game-music-emu/default.nix b/pkgs/development/libraries/audio/game-music-emu/default.nix
index a10aace767b..0f420745bae 100644
--- a/pkgs/development/libraries/audio/game-music-emu/default.nix
+++ b/pkgs/development/libraries/audio/game-music-emu/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, removeReferencesTo }:
+{ lib, stdenv, fetchurl, cmake, removeReferencesTo, zlib }:
 
 stdenv.mkDerivation rec {
   version = "0.6.3";
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
     url = "https://bitbucket.org/mpyne/game-music-emu/downloads/${pname}-${version}.tar.xz";
     sha256 = "07857vdkak306d9s5g6fhmjyxk7vijzjhkmqb15s7ihfxx9lx8xb";
   };
-  cmakeFlags = lib.optionals (stdenv.isDarwin || stdenv.hostPlatform.isMusl) [ "-DENABLE_UBSAN=OFF" ];
+  cmakeFlags = [ "-DENABLE_UBSAN=OFF" ];
   nativeBuildInputs = [ cmake removeReferencesTo ];
+  buildInputs = [ zlib ];
 
   # It used to reference it, in the past, but thanks to the postFixup hook, now
   # it doesn't.
diff --git a/pkgs/development/libraries/audio/libmysofa/default.nix b/pkgs/development/libraries/audio/libmysofa/default.nix
index a5ecbdcfccc..8955c8876ad 100644
--- a/pkgs/development/libraries/audio/libmysofa/default.nix
+++ b/pkgs/development/libraries/audio/libmysofa/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmysofa";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "hoene";
     repo = "libmysofa";
     rev = "v${version}";
-    sha256 = "sha256-QEfkeofsVxB9gyISL/P7bvnbcBuG7Q3A4UoAyQAXxgE=";
+    hash = "sha256-eXMGwa6lOtKoUCcHR9BM2S3NWAZkGyZzF3FAjYaWTvg=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index bb5a4e0dd53..b8b89abc8ea 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.7.2";
+  version = "0.7.3";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-UJFD5aTzsT3Zjq4om/7BtWTt3XG7x8p4ZLgoNeMTMOE=";
+    hash = "sha256-LPg2m3kWsJJk8/FLn7bO81pum+4DKN7E9J2YIRzP1yI=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 14b0d4c5e46..a0869edf4fb 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -1,4 +1,16 @@
-{ lib, stdenv, fetchurl, lv2, pkg-config, python3, serd, sord, sratom, wafHook
+{ lib
+, stdenv
+, fetchurl
+, lv2
+, meson
+, ninja
+, pkg-config
+, python3
+, libsndfile
+, serd
+, sord
+, sratom
+, gitUpdater
 
 # test derivations
 , pipewire
@@ -6,24 +18,29 @@
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.24.12";
+  version = "0.24.20";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
-    url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-JqN3kIkMnB+DggO0f1sjIDNP6SwCpNJuu+Jmnb12kGE=";
+    url = "https://download.drobilla.net/${pname}-${version}.tar.xz";
+    hash = "sha256-T7CCubiyhuqSu7cb3mt1Ykzsq23wzGOe51oqCWIS7rw=";
   };
 
-  patches = [ ./lilv-pkgconfig.patch ];
-
-  nativeBuildInputs = [ pkg-config python3 wafHook ];
-  buildInputs = [ serd sord sratom ];
+  nativeBuildInputs = [ meson ninja pkg-config python3 ];
+  buildInputs = [ libsndfile serd sord sratom ];
   propagatedBuildInputs = [ lv2 ];
-  dontAddWafCrossFlags = true;
 
-  passthru.tests = {
-    inherit pipewire;
+  mesonFlags = [ "-Ddocs=disabled" ];
+
+  passthru = {
+    tests = {
+      inherit pipewire;
+    };
+    updateScript = gitUpdater {
+      url = "https://gitlab.com/lv2/lilv.git";
+      rev-prefix = "v";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/audio/lilv/lilv-pkgconfig.patch b/pkgs/development/libraries/audio/lilv/lilv-pkgconfig.patch
deleted file mode 100644
index a5a8c6007e4..00000000000
--- a/pkgs/development/libraries/audio/lilv/lilv-pkgconfig.patch
+++ /dev/null
@@ -1,6 +0,0 @@
---- a/lilv.pc.in
-+++ b/lilv.pc.in
-@@ -9 +9,2 @@ Description: Simple C library for hosting LV2 plugins
--Requires: @LILV_PKG_DEPS@
-+Requires: lv2
-+Requires.private: @LILV_PKG_DEPS@
diff --git a/pkgs/development/libraries/audiofile/default.nix b/pkgs/development/libraries/audiofile/default.nix
index c6d656388d4..f9974e2ca25 100644
--- a/pkgs/development/libraries/audiofile/default.nix
+++ b/pkgs/development/libraries/audiofile/default.nix
@@ -28,6 +28,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" ];
 
+  # std::unary_function has been removed in c++17
+  makeFlags = [ "CXXFLAGS=-std=c++11" ];
+
   # Even when statically linking, libstdc++.la is put in dependency_libs here,
   # and hence libstdc++.so passed to the linker, just pass -lstdc++ and let the
   # compiler do what it does best.  (libaudiofile.la is a generated file, so we
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index 69a8978ae62..b0ecf94e84f 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -1,12 +1,8 @@
-{ config, lib, stdenv, fetchurl, fetchpatch, pkg-config, libiconv
-, libintl, expat, zlib, libpng, pixman, fontconfig, freetype
-, x11Support? !stdenv.isDarwin, libXext, libXrender
+{ lib, stdenv, fetchurl, fetchpatch, gtk-doc, meson, ninja, pkg-config, python3
+, docbook_xsl, fontconfig, freetype, libpng, pixman, zlib
+, x11Support? !stdenv.isDarwin || true, libXext, libXrender
 , gobjectSupport ? true, glib
-, xcbSupport ? x11Support, libxcb, xcbutil # no longer experimental since 1.12
-, libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, glSupport ? x11Support && config.cairo.gl or (libGLSupported && stdenv.isLinux)
-, libGL # libGLU libGL is no longer a big dependency
-, pdfSupport ? true
+, xcbSupport ? x11Support, libxcb
 , darwin
 , testers
 }:
@@ -17,82 +13,27 @@ in stdenv.mkDerivation (finalAttrs: let
   inherit (finalAttrs) pname version;
 in {
   pname = "cairo";
-  version = "1.16.0";
+  version = "1.18.0";
 
   src = fetchurl {
     url = "https://cairographics.org/${if lib.mod (builtins.fromJSON (lib.versions.minor version)) 2 == 0 then "releases" else "snapshots"}/${pname}-${version}.tar.xz";
-    sha256 = "0c930mk5xr2bshbdljv005j3j8zr47gqmkry3q6qgvqky6rjjysy";
+    hash = "sha256-JDoHNrl4oz3uKfnMp1IXM7eKZbVBggb+970cPUzxC2Q=";
   };
 
-  patches = [
-    # Fixes CVE-2018-19876; see Nixpkgs issue #55384
-    # CVE information: https://nvd.nist.gov/vuln/detail/CVE-2018-19876
-    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5
-    #
-    # This patch is the merged commit from the above PR.
-    (fetchpatch {
-      name   = "CVE-2018-19876.patch";
-      url    = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/6edf572ebb27b00d3c371ba5ae267e39d27d5b6d.patch";
-      hash = "sha256-wZ51BZWlXByFY3/CTn7el2A9aYkwL1FygJ2zqnN+UIQ=";
-    })
-
-    # Fix PDF output.
-    # https://gitlab.freedesktop.org/cairo/cairo/issues/342
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/5e34c5a9640e49dcc29e6b954c4187cfc838dbd1.patch";
-      hash = "sha256-yCwsDUY7efVvOZkA6a0bPS+RrVc8Yk9bfPwWHeOjq5o=";
-    })
-
-    # Fixes CVE-2020-35492; see https://github.com/NixOS/nixpkgs/issues/120364.
-    # CVE information: https://nvd.nist.gov/vuln/detail/CVE-2020-35492
-    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/merge_requests/85
-    (fetchpatch {
-      name = "CVE-2020-35492.patch";
-      includes = [ "src/cairo-image-compositor.c" ];
-      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/78266cc8c0f7a595cfe8f3b694bfb9bcc3700b38.patch";
-      hash = "sha256-cXKzLMENx4/BHXLZg3Kfkx3esCnaNaB7WvjNfL77FhE=";
-    })
-
-    # Workaround https://gitlab.freedesktop.org/cairo/cairo/-/issues/121
-    ./skip-configure-stderr-check.patch
-
-    # Fixes cairo crash on macOS Big Sur
-    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/-/issues/420
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/e22d7212acb454daccc088619ee147af03883974.diff";
-      hash = "sha256-8G98nsPz3MLEWPDX9F0jKgXC4hC4NNdFQLSpmW3ay2s=";
-    })
-
-    # Fix clang build failures on newer LLVM versions
-    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/119
-    (fetchpatch {
-      name = "fix-types.patch";
-      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/38e486b34d435130f2fb38c429e6016c3c82cd53.patch";
-      hash = "sha256-vmluOJSuTRiQHmbBBVCxOIkZ0O0ZEo0J4mgrUPn0SIo=";
-    })
-
-    # Fix unexpected color addition on grayscale images (usually text).
-    # Upstream fix: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114
-    # Can be removed after 1.18 release
-    (fetchpatch {
-      name = "fix-grayscale-anialias.patch";
-      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/4f4d89506f58a64b4829b1bb239bab9e46d63727.diff";
-      hash = "sha256-mbTg67e7APfdELsuMAgXdY3xokWbGtHF7VDD5UyYqKM=";
-    })
-
-  ];
-
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev"; # very small
   separateDebugInfo = true;
 
   nativeBuildInputs = [
+    gtk-doc
+    meson
+    ninja
     pkg-config
+    python3
   ];
 
   buildInputs = [
-    libiconv
-    libintl
+    docbook_xsl
   ] ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     CoreGraphics
     CoreText
@@ -100,49 +41,53 @@ in {
     Carbon
   ]);
 
-  propagatedBuildInputs = [ fontconfig expat freetype pixman zlib libpng ]
+  propagatedBuildInputs = [ fontconfig freetype pixman libpng zlib ]
     ++ optionals x11Support [ libXext libXrender ]
-    ++ optionals xcbSupport [ libxcb xcbutil ]
+    ++ optionals xcbSupport [ libxcb ]
     ++ optional gobjectSupport glib
-    ++ optional glSupport libGL
     ; # TODO: maybe liblzo but what would it be for here?
 
-  configureFlags = [
-    "--enable-tee"
-  ] ++ (if stdenv.isDarwin then [
-    "--disable-dependency-tracking"
-    "--enable-quartz"
-    "--enable-quartz-font"
-    "--enable-quartz-image"
-    "--enable-ft"
-  ] else (optional xcbSupport "--enable-xcb"
-    ++ optional glSupport "--enable-gl"
-    ++ optional pdfSupport "--enable-pdf"
-  )) ++ optional (!x11Support) "--disable-xlib";
-
-  preConfigure =
-  # On FreeBSD, `-ldl' doesn't exist.
-    lib.optionalString stdenv.isFreeBSD
-       '' for i in "util/"*"/Makefile.in" boilerplate/Makefile.in
-          do
-            cat "$i" | sed -es/-ldl//g > t
-            mv t "$i"
-          done
-       ''
-    +
-    ''
-    # Work around broken `Requires.private' that prevents Freetype
-    # `-I' flags to be propagated.
-    sed -i "src/cairo.pc.in" \
-        -es'|^Cflags:\(.*\)$|Cflags: \1 -I${freetype.dev}/include/freetype2 -I${freetype.dev}/include|g'
-    substituteInPlace configure --replace strings $STRINGS
-    '';
+  mesonFlags = [
+    "-Dgtk_doc=true"
+
+    # error: #error config.h must be included before this header
+    "-Dsymbol-lookup=disabled"
+
+    # Only used in tests, causes a dependency cycle
+    "-Dspectre=disabled"
+
+    (lib.mesonEnable "glib" gobjectSupport)
+    (lib.mesonEnable "tests" finalAttrs.doCheck)
+    (lib.mesonEnable "xlib" x11Support)
+    (lib.mesonEnable "xcb" xcbSupport)
+  # ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+  #   "--cross-file=${builtins.toFile "cross-file.conf" ''
+  #     [properties]
+  #     ipc_rmid_deferred_release = ${
+  #       {
+  #         linux = "true";
+  #         freebsd = "true";
+  #         netbsd = "false";
+  #       }.${stdenv.hostPlatform.parsed.kernel.name} or
+  #         throw "Unknown value for ipc_rmid_deferred_release"
+  #     }
+  #   ''}"
+  ];
+
+  preConfigure = ''
+    patchShebangs version.py
+  '';
 
   enableParallelBuilding = true;
 
   doCheck = false; # fails
 
-  postInstall = lib.optionalString stdenv.isDarwin glib.flattenInclude;
+  postInstall = ''
+    # Work around broken `Requires.private' that prevents Freetype
+    # `-I' flags to be propagated.
+    sed -i "$out/lib/pkgconfig/cairo.pc" \
+        -es'|^Cflags:\(.*\)$|Cflags: \1 -I${freetype.dev}/include/freetype2 -I${freetype.dev}/include|g'
+  '' + lib.optionalString stdenv.isDarwin glib.flattenInclude;
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
@@ -151,9 +96,8 @@ in {
     longDescription = ''
       Cairo is a 2D graphics library with support for multiple output
       devices.  Currently supported output targets include the X
-      Window System, Quartz, Win32, image buffers, PostScript, PDF,
-      and SVG file output.  Experimental backends include OpenGL
-      (through glitz), XCB, BeOS, OS/2, and DirectFB.
+      Window System, XCB, Quartz, Win32, image buffers, PostScript,
+      PDF, and SVG file output.
 
       Cairo is designed to produce consistent output on all output
       media while taking advantage of display hardware acceleration
@@ -162,10 +106,10 @@ in {
     homepage = "http://cairographics.org/";
     license = with licenses; [ lgpl2Plus mpl10 ];
     pkgConfigModules = [
+      "cairo-pdf"
       "cairo-ps"
       "cairo-svg"
-    ] ++ lib.optional gobjectSupport "cairo-gobject"
-      ++ lib.optional pdfSupport "cairo-pdf";
+    ] ++ lib.optional gobjectSupport "cairo-gobject";
     platforms = platforms.all;
   };
 })
diff --git a/pkgs/development/libraries/check/default.nix b/pkgs/development/libraries/check/default.nix
index 8add9c62347..14b4e549264 100644
--- a/pkgs/development/libraries/check/default.nix
+++ b/pkgs/development/libraries/check/default.nix
@@ -11,6 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "02m25y9m46pb6n46s51av62kpd936lkfv3b13kfpckgvmh5lxpm8";
   };
 
+  # fortify breaks the libcompat vsnprintf implementation
+  hardeningDisable = lib.optionals (stdenv.hostPlatform.isMusl && (stdenv.hostPlatform != stdenv.buildPlatform)) [ "fortify" ];
+
   # Test can randomly fail: https://hydra.nixos.org/build/7243912
   doCheck = false;
 
diff --git a/pkgs/development/libraries/cogl/default.nix b/pkgs/development/libraries/cogl/default.nix
index 41aa3045841..c07c8b7c150 100644
--- a/pkgs/development/libraries/cogl/default.nix
+++ b/pkgs/development/libraries/cogl/default.nix
@@ -53,6 +53,9 @@ stdenv.mkDerivation rec {
     "--enable-wayland-egl-server"
     "--enable-gles1"
     "--enable-gles2"
+    # Force linking against libGL.
+    # Otherwise, it tries to load it from the runtime library path.
+    "LIBS=-lGL"
   ] ++ lib.optionals stdenv.isDarwin [
     "--disable-glx"
     "--without-x"
diff --git a/pkgs/development/libraries/glibc/2.38-master.patch.gz b/pkgs/development/libraries/glibc/2.38-master.patch.gz
index 4eb3c7b2cdb..6414956807f 100644
--- a/pkgs/development/libraries/glibc/2.38-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.38-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 51d8a4dbe05..646242de611 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -44,7 +44,7 @@
 
 let
   version = "2.38";
-  patchSuffix = "-23";
+  patchSuffix = "-27";
   sha256 = "sha256-+4KZiZiyspllRnvBtp0VLpwwfSzzAcnq+0VVt3DvP9I=";
 in
 
@@ -60,7 +60,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.38/master && git describe
-          glibc-2.38-23-g0e1ef6779a
+          glibc-2.38-27-g750a45a783
           $ git show --minimal --reverse glibc-2.38.. | gzip -9n --rsyncable - > 2.38-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 1c822bf1ed0..e3fdfc6a293 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -145,7 +145,7 @@ in
       ln -sf $out/lib/libpthread.so.0 $out/lib/libpthread.so
       ln -sf $out/lib/librt.so.1 $out/lib/librt.so
       ln -sf $out/lib/libdl.so.2 $out/lib/libdl.so
-      ln -sf $out/lib/libutil.so.1 $out/lib/libutil.so
+      test -f $out/lib/libutil.so.1 && ln -sf $out/lib/libutil.so.1 $out/lib/libutil.so
       touch $out/lib/libpthread.a
 
       # Put libraries for static linking in a separate output.  Note
@@ -154,6 +154,8 @@ in
       mkdir -p $static/lib
       mv $out/lib/*.a $static/lib
       mv $static/lib/lib*_nonshared.a $out/lib
+      # If libutil.so.1 is missing, libutil.a is required.
+      test -f $out/lib/libutil.so.1 || mv $static/lib/libutil.a $out/lib
       # Some of *.a files are linker scripts where moving broke the paths.
       sed "/^GROUP/s|$out/lib/lib|$static/lib/lib|g" \
         -i "$static"/lib/*.a
diff --git a/pkgs/development/libraries/glibc/locales-builder.sh b/pkgs/development/libraries/glibc/locales-builder.sh
index d91f936c937..27894b09b91 100644
--- a/pkgs/development/libraries/glibc/locales-builder.sh
+++ b/pkgs/development/libraries/glibc/locales-builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 # Glibc cannot have itself in its RPATH.
 export NIX_NO_SELF_RPATH=1
 
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index 2b088eb459a..0315f39c605 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -6,22 +6,22 @@
 # files.
 
 let
-  rev = "d4e37b5868ef910e3e52744c34408084bb13051c";
+  rev = "28ea239c53a2d5d8800c472bc2452eaa16e37af2";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     name = "config.guess-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "191czpnbc1nxrygg8fd3839y1f4m9x43rp57vgrsas6p07zzh3c1";
+    hash = "sha256-7CV3YUJSMm+InfHel7mkV8A6mpSBEEhWPCEaRElti6M=";
   };
   configSub = fetchurl {
     name = "config.sub-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "0148p54gw10p6sk2rn3gi9vvqm89rk8kcvl9335ckayhanx31381";
+    hash = "sha256-Rlxf5nx9NrcugIgScWRF1NONS5RzTKjTaoY50SMjh4s=";
   };
 in stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2023-07-31";
+  version = "2023-09-19";
 
   unpackPhase = ''
     runHook preUnpack
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 9599da0fdf5..8ff8220aa75 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -10,6 +10,7 @@
 , orc
 , bzip2
 , gettext
+, libGL
 , libv4l
 , libdv
 , libavc1394
@@ -129,6 +130,7 @@ stdenv.mkDerivation rec {
   ]) ++ lib.optionals stdenv.isDarwin [
     Cocoa
   ] ++ lib.optionals stdenv.isLinux [
+    libGL
     libv4l
     libpulseaudio
     libavc1394
diff --git a/pkgs/development/libraries/gtk-sharp/builder.sh b/pkgs/development/libraries/gtk-sharp/builder.sh
index 73914495d6d..45e640e2a70 100644
--- a/pkgs/development/libraries/gtk-sharp/builder.sh
+++ b/pkgs/development/libraries/gtk-sharp/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 genericBuild
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index f85ec4d96b3..ab237d9dca0 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -22,6 +22,8 @@
 , enlightenment
 , xorg
 , testers
+
+, gitUpdater
 }:
 
 let
@@ -29,11 +31,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "imlib2";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lf9dTMF92fk0wuetFRw2DzCIgKCnhJpspDt8e5pLshY=";
+    hash = "sha256-jCTS0YnE1a5gLb8vwPuxF6qSPqtsiDBB8P7spOjGd04=";
   };
 
   buildInputs = [
@@ -59,19 +61,25 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputs = [ "bin" "out" "dev" ];
 
-  passthru.tests = {
-    inherit
-      libcaca
-      diffoscopeMinimal
-      feh
-      icewm
-      openbox
-      fluxbox
-      enlightenment;
+  passthru = {
+    tests = {
+      inherit
+        libcaca
+        diffoscopeMinimal
+        feh
+        icewm
+        openbox
+        fluxbox
+        enlightenment;
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    };
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://git.enlightenment.org/old/legacy-imlib2.git";
+      rev-prefix = "v";
+    };
   };
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-
   meta = with lib; {
     description = "Image manipulation library";
 
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index a00399497e2..f8915282069 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,19 +1,23 @@
-{ lib, stdenv, fetchurl, python3, autoreconfHook }:
+{ lib, stdenv, fetchurl, python3, autoconf, automake, libtool }:
 
 stdenv.mkDerivation rec {
   pname = "jbig2dec";
-  version = "0.19";
+  version = "0.20";
 
   src = fetchurl {
-    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs9533/${pname}-${version}.tar.gz";
-    sha256 = "0dwa24kjqyg9hmm40fh048sdxfpnasz43l2rm8wlkw1qbdlpd517";
+    url = "https://github.com/ArtifexSoftware/jbig2dec/archive/${version}/jbig2dec-${version}.tar.gz";
+    hash = "sha256-qXBTaaZjOrpTJpNFDsgCxWI5fhuCRmLegJ7ekvZ6/yE=";
   };
 
   postPatch = ''
     patchShebangs test_jbig2dec.py
   '';
 
-  nativeBuildInputs = [ autoreconfHook ];
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  nativeBuildInputs = [ autoconf automake libtool ];
 
   nativeCheckInputs = [ python3 ];
   doCheck = true;
diff --git a/pkgs/development/libraries/kde-frameworks/baloo.nix b/pkgs/development/libraries/kde-frameworks/baloo.nix
index 3543fef6633..2a264d47c24 100644
--- a/pkgs/development/libraries/kde-frameworks/baloo.nix
+++ b/pkgs/development/libraries/kde-frameworks/baloo.nix
@@ -25,21 +25,6 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   propagatedBuildInputs = [ kcoreaddons kfilemetadata qtbase ];
 
-  # baloo suffers from issues when running on btrfs as well as with certain LVM/dm-crypt setups
-  # where the device id will change on reboot causing baloo to reindex all the files and then having
-  # duplicate files. A patch has been proposed that addresses this, which has not been accepted yet.
-  # However, without this patch, people tend to disable baloo rather than dealing with the constant
-  # reindexing.
-  #
-  # https://bugs.kde.org/show_bug.cgi?id=402154
-  patches = [
-    (fetchpatch {
-      url = "https://bugsfiles.kde.org/attachment.cgi?id=159031";
-      hash = "sha256-hCtNXUpRhIP94f7gpwTGWWh1h/7JRRJaRASIwHWQjnY=";
-      name = "use_fsid.patch";
-    })
-  ];
-
   # kde-baloo.service uses `ExecCondition=@KDE_INSTALL_FULL_BINDIR@/kde-systemd-start-condition ...`
   # which comes from the "plasma-workspace" derivation, but KDE_INSTALL_* all point at the "baloo" one
   # (`${lib.getBin pkgs.plasma-workspace}` would cause infinite recursion)
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index c72caa6d585..9899a98e25e 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.110/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.111/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/kio/default.nix b/pkgs/development/libraries/kde-frameworks/kio/default.nix
index 03e233c2879..8815683aef6 100644
--- a/pkgs/development/libraries/kde-frameworks/kio/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/kio/default.nix
@@ -29,12 +29,6 @@ mkDerivation {
   separateDebugInfo = true;
   patches = [
     ./0001-Remove-impure-smbd-search-path.patch
-
-    # Fix a crash when saving files.
-    (fetchpatch {
-      url = "https://invent.kde.org/frameworks/kio/-/commit/48322f44323a1fc09305d66d9093fe6c3780709e.patch";
-      hash = "sha256-4NxI2mD/TdthvrzgatCAlM6VN3N38i3IJUHh0Bs8Fjk=";
-    })
  ];
   meta = {
     homepage = "https://api.kde.org/frameworks/kio/html/";
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 1fd8a2ba15a..68782e43811 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/attica-5.110.0.tar.xz";
-      sha256 = "1lp7y0r3npv93kcw1fkgl8c2njbs6y4m8cg32b60pyjahfqspxd6";
-      name = "attica-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/attica-5.111.0.tar.xz";
+      sha256 = "0gdp7w585l3669rd10lkc5vman1pbv8agh5zh1zwzg83bj32hxl4";
+      name = "attica-5.111.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/baloo-5.110.0.tar.xz";
-      sha256 = "0bg2nyp7zp1mka7ng8bwcd0hrbglrdiz7xw43r9q8wycr9qmva1n";
-      name = "baloo-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/baloo-5.111.0.tar.xz";
+      sha256 = "04gqw22kdk4q18jlddhjpmgnxyayan18ndf7bswv633nyxrck32g";
+      name = "baloo-5.111.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/bluez-qt-5.110.0.tar.xz";
-      sha256 = "1xvr85i0lkdpca64dzd7wqasc7acpzvh2kawl9nrfkrn96vrm0cz";
-      name = "bluez-qt-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/bluez-qt-5.111.0.tar.xz";
+      sha256 = "0sz3kicjwy1zn868dng11r7ic4rn2ji542ijcykzfalpaa3apjy0";
+      name = "bluez-qt-5.111.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/breeze-icons-5.110.0.tar.xz";
-      sha256 = "1m5z8g7rvilvwfn65yazci51i83ixv7fc5sh2v5vgxrlmhbysg0s";
-      name = "breeze-icons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/breeze-icons-5.111.0.tar.xz";
+      sha256 = "1vrsbgfcigsi3gc61lgv58ns0n7vgn85vzmn3n8hz8vmbx60wmsc";
+      name = "breeze-icons-5.111.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/extra-cmake-modules-5.110.0.tar.xz";
-      sha256 = "0f347y8q3ckgfq4skh2q69n67v3w9k680db0br4f43i37vdzaikp";
-      name = "extra-cmake-modules-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/extra-cmake-modules-5.111.0.tar.xz";
+      sha256 = "16pamdxfsfbw56rg4h9akhhddz694hbz1lrm9bkb89v7z8fkqpam";
+      name = "extra-cmake-modules-5.111.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/frameworkintegration-5.110.0.tar.xz";
-      sha256 = "0ghl5p01g3jdj75wzyjwq4b0l0p98r0vkkf6zj6d3lbax207z0sq";
-      name = "frameworkintegration-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/frameworkintegration-5.111.0.tar.xz";
+      sha256 = "0q8ia4pw8zdcx5hcqsar46jrss5agxqmb4zfg3pyxn5la5j75bv1";
+      name = "frameworkintegration-5.111.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kactivities-5.110.0.tar.xz";
-      sha256 = "1c1456jc3s7cl2l3kmkgprgngip0j9c7ssd0b0fvjd41dwhzhra5";
-      name = "kactivities-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kactivities-5.111.0.tar.xz";
+      sha256 = "0320wl4kq3if3wzzr0y9vq8m2ghk8rgga22k9yli9ax5y8fj9dam";
+      name = "kactivities-5.111.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kactivities-stats-5.110.0.tar.xz";
-      sha256 = "1agqsdgbmglrzpg9w4df9qdg4hf8g1nnnkq7adp6cxsj3x8c8zx4";
-      name = "kactivities-stats-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kactivities-stats-5.111.0.tar.xz";
+      sha256 = "1mxdylx0g43rvlbwgclr6alvfnc5hgr6w4s0hh4icj565mcg8vdd";
+      name = "kactivities-stats-5.111.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kapidox-5.110.0.tar.xz";
-      sha256 = "1qi2mcslw0gsxc6p5q78lhg3if01j8dhxf0ypwb8njsfjcr45d24";
-      name = "kapidox-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kapidox-5.111.0.tar.xz";
+      sha256 = "0s14siybjgwmgcydh0q1jyl0c2s4sh67wi0r0vi63k0ngkw2psbz";
+      name = "kapidox-5.111.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/karchive-5.110.0.tar.xz";
-      sha256 = "1pqc0j4xkhwc6gdgg1q7pl3hjnrscwz8vbdz8jbvpaz51cy5iipw";
-      name = "karchive-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/karchive-5.111.0.tar.xz";
+      sha256 = "0bfdqbv4z1jhb0m26bz9glcphqg54pg6nb6ni518wy42514ks3p0";
+      name = "karchive-5.111.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kauth-5.110.0.tar.xz";
-      sha256 = "1yymmyvhqgrwdpy5c2narh6d0ac41mw9ifrhckcyr22kdyrmgcz1";
-      name = "kauth-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kauth-5.111.0.tar.xz";
+      sha256 = "1cxvhfakc1vi2rhnscfr5rmffqkkqfim66pg51p91mqxb3x83k75";
+      name = "kauth-5.111.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kbookmarks-5.110.0.tar.xz";
-      sha256 = "1k04mcfciv3gq4qw5gkpq7189wfxxlr427h4827m3hs3ysbgc4vh";
-      name = "kbookmarks-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kbookmarks-5.111.0.tar.xz";
+      sha256 = "1670i8v6p2j2znckqz29vazsp7l8169h3rpgjw5fshr2rxjyifhv";
+      name = "kbookmarks-5.111.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcalendarcore-5.110.0.tar.xz";
-      sha256 = "19zb1g4lbiqy4vcay6hbjx9ak5r00frfn1hahpc544q9l0dznl52";
-      name = "kcalendarcore-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcalendarcore-5.111.0.tar.xz";
+      sha256 = "18da625xrqxxs29xbd52mbvl3jkg3qlwv7jr3wbwn7s2hxqc4v26";
+      name = "kcalendarcore-5.111.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcmutils-5.110.0.tar.xz";
-      sha256 = "0ccgrd757ww890nvajw1s9yvq6iikp316q123rfminrc0mlrpzaq";
-      name = "kcmutils-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcmutils-5.111.0.tar.xz";
+      sha256 = "09nd5jb4mh8laap9r7haxs7m9ym0hymg301yp5g3alw65aaqiy70";
+      name = "kcmutils-5.111.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcodecs-5.110.0.tar.xz";
-      sha256 = "1i15q8kg1dn72sxg9djvg9h4mhqh9rgvnsf3bz0pjd5jbwqqyv1v";
-      name = "kcodecs-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcodecs-5.111.0.tar.xz";
+      sha256 = "1d564s2m926hi9k3j89xi9p7g4vlqsz5apncdlsdi9wjj774b4w6";
+      name = "kcodecs-5.111.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcompletion-5.110.0.tar.xz";
-      sha256 = "0a9l6p9kfg074wxz0r9dn43baibrbzbh80x60rds2jaf3yjg212g";
-      name = "kcompletion-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcompletion-5.111.0.tar.xz";
+      sha256 = "1fig1xxfbsc8sbwr57yxi6z8kfaj7mqrlpjn8j0f6xcxpq9i4zak";
+      name = "kcompletion-5.111.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kconfig-5.110.0.tar.xz";
-      sha256 = "1i9idh0rh8ryry5gf22wwgzd15y14jymxjdxbkgx13kqpfyqhaxd";
-      name = "kconfig-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kconfig-5.111.0.tar.xz";
+      sha256 = "0d812hn21g93v4mixpp8vsr6dq7qkscabj2zzw2gs4bk9anpkh4s";
+      name = "kconfig-5.111.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kconfigwidgets-5.110.0.tar.xz";
-      sha256 = "04mlw41xdps7qgnmmccqgs7jc5iipx2vqp9bd91l3sz4p90wj3sg";
-      name = "kconfigwidgets-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kconfigwidgets-5.111.0.tar.xz";
+      sha256 = "1zh1fzrvwidfda9yl873r0k7mlx84jax8p6iib67p58ggwsjxpv3";
+      name = "kconfigwidgets-5.111.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcontacts-5.110.0.tar.xz";
-      sha256 = "0gib8nlis59kbhydqvf6alwxvy4db94r2p3vpbcdy48gc4i06344";
-      name = "kcontacts-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcontacts-5.111.0.tar.xz";
+      sha256 = "0s3yzv1p6nac8y25kdn986121iavkar5rvkpasw9vj6n6l5rg8s9";
+      name = "kcontacts-5.111.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcoreaddons-5.110.0.tar.xz";
-      sha256 = "0xcd2ph62a7kbm8camp1vnsxlaq1kmqm9hw9gyphcdh0rh6fi3bf";
-      name = "kcoreaddons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcoreaddons-5.111.0.tar.xz";
+      sha256 = "0vi5fziv4kpndqan1fpyymqz6dc8qs0y7hj7grfzh7hbckxfgm6v";
+      name = "kcoreaddons-5.111.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcrash-5.110.0.tar.xz";
-      sha256 = "15j70r6afc0lyg41047r27l089gkq8fh39w9iyvhv0h8hfxxah6g";
-      name = "kcrash-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcrash-5.111.0.tar.xz";
+      sha256 = "0cbwnnf01c5bq59b7qmi27shrqaxnlkmcd62gk4g7wjy8fl9h8fw";
+      name = "kcrash-5.111.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdav-5.110.0.tar.xz";
-      sha256 = "0qz5iq9fi1vk1z7w4wdh7kxrc06vnyrvs7n0llyrjaprzjn8yx6a";
-      name = "kdav-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdav-5.111.0.tar.xz";
+      sha256 = "0nhlmd5dygd663cb7sb5qsyn8v9dfxg8sbrs15cz0ch31ak1zww8";
+      name = "kdav-5.111.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdbusaddons-5.110.0.tar.xz";
-      sha256 = "0ilzk67h5cxrjf78hw505pvbqvd2lkjk3m0g188pcw0sdg10xb8h";
-      name = "kdbusaddons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdbusaddons-5.111.0.tar.xz";
+      sha256 = "1d8q1a7b7isvi18ism6l3gakyh4skp4gv1wyb9x75kbn369g5ab1";
+      name = "kdbusaddons-5.111.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdeclarative-5.110.0.tar.xz";
-      sha256 = "1vcqdi4lji97wm5vil2p1g7wi6rwrz0g6aiqf1nzi026fpsc8njj";
-      name = "kdeclarative-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdeclarative-5.111.0.tar.xz";
+      sha256 = "0bjkf3k0fsrx6v58qf388q1zqsinaxjzsmh02lsh5slv5arnbnhw";
+      name = "kdeclarative-5.111.0.tar.xz";
     };
   };
   kded = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kded-5.110.0.tar.xz";
-      sha256 = "1n8hzkwhqrx4mb7ahqnkga01zslcp82ya22hppfapldy83bfrgyl";
-      name = "kded-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kded-5.111.0.tar.xz";
+      sha256 = "1b8kzsawk277p5bsfcfyvrzfrhvd1lcf6sk9gi8bvaw7i0dw8f57";
+      name = "kded-5.111.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kdelibs4support-5.110.0.tar.xz";
-      sha256 = "119hhc0f862kzr5flrlpg9b8xlcl1qxa5xkccad0hpba76pk2af4";
-      name = "kdelibs4support-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kdelibs4support-5.111.0.tar.xz";
+      sha256 = "1y6lj6gxcyd4rha03dxw9jvff5gd88ijm8wqc0ggssgc0hpv7fif";
+      name = "kdelibs4support-5.111.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kdesignerplugin-5.110.0.tar.xz";
-      sha256 = "146i8n9rrajh03x180z48qi8dn31dywsz052bhbn4yw61ag4w4nc";
-      name = "kdesignerplugin-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kdesignerplugin-5.111.0.tar.xz";
+      sha256 = "1qmsxz5zm9xsv0w6ksh33mib2swmi57pnndi74zhc7w6qvia8lj2";
+      name = "kdesignerplugin-5.111.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdesu-5.110.0.tar.xz";
-      sha256 = "0ll5k4lpn1v4bc365w2ky0qszikfz2r589ni8iyk109qdqciyrr9";
-      name = "kdesu-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdesu-5.111.0.tar.xz";
+      sha256 = "0y51rc5ckfa84a5d4422n89zznpdzr6493malw7n09nsrs0qcby6";
+      name = "kdesu-5.111.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kdewebkit-5.110.0.tar.xz";
-      sha256 = "0p09lby7csx3j513lm91k247iwxby423cz7da51n20qncan8g65v";
-      name = "kdewebkit-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kdewebkit-5.111.0.tar.xz";
+      sha256 = "1zh5i32bpb53bx2rq89fbn0nvqkbsl9kbp5azzc7bws1ksv2mzqd";
+      name = "kdewebkit-5.111.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdnssd-5.110.0.tar.xz";
-      sha256 = "0xmahgn572ah8ji4d4afalcl7r2krn971ix5jwcqgrj57m5haj45";
-      name = "kdnssd-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdnssd-5.111.0.tar.xz";
+      sha256 = "0ssdz7g88p0nk38pp1svjnlfffsnwhrzcy5k3fa3z6142albxsh0";
+      name = "kdnssd-5.111.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdoctools-5.110.0.tar.xz";
-      sha256 = "1g05gppc6qzkag1x18anymbwdswpg32w6jh12x9jfj79vcp7wg4j";
-      name = "kdoctools-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdoctools-5.111.0.tar.xz";
+      sha256 = "1gjf239f252g7bfji1378c48gzm5rz3gv6jd5g0ayrs0ixm15a9r";
+      name = "kdoctools-5.111.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kemoticons-5.110.0.tar.xz";
-      sha256 = "1r1d3kw6wzw63kq9wy4ic2b9hcnmm4rs7v9f1z9jhq9m1jp0zy12";
-      name = "kemoticons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kemoticons-5.111.0.tar.xz";
+      sha256 = "1aja459hsfnzlqlkdrfrfglwrh2mfpwq6pypbh46l2qycn1p1xzk";
+      name = "kemoticons-5.111.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kfilemetadata-5.110.0.tar.xz";
-      sha256 = "07ma48iq5vpnj391shm3s9an3rqhxskfziw6pksmzxxnga0whbl9";
-      name = "kfilemetadata-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kfilemetadata-5.111.0.tar.xz";
+      sha256 = "1ivdv6cyzi8qazy4ingdbc7n7iyjr17dlyyf30sxzp8x82cxqilg";
+      name = "kfilemetadata-5.111.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kglobalaccel-5.110.0.tar.xz";
-      sha256 = "1iw22vyrk07pzcsh41cvfp8i8589jm1yqn1cx1ad5rmryzsjalzp";
-      name = "kglobalaccel-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kglobalaccel-5.111.0.tar.xz";
+      sha256 = "10kviky0iddjpc96qa77g5gm8pzq6lmqwyzg2w7yx88pgly8gbbz";
+      name = "kglobalaccel-5.111.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kguiaddons-5.110.0.tar.xz";
-      sha256 = "0ajmxj8nhis6f4hwd64s9qfw3hbip80xrdy3d1wksykbq7g5b89c";
-      name = "kguiaddons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kguiaddons-5.111.0.tar.xz";
+      sha256 = "1icr0s56i9js9zciacvraf101f4k1mgvjmw3nxwfpdjabzyv1ppp";
+      name = "kguiaddons-5.111.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kholidays-5.110.0.tar.xz";
-      sha256 = "0zikajmic93wqgy9865pf61sdlnsyzzf2jal7bj25is7a1mk8mjc";
-      name = "kholidays-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kholidays-5.111.0.tar.xz";
+      sha256 = "0xqj36psgk6m75d5138w1flllq5x4prw3ybchxxs6krk562bj32p";
+      name = "kholidays-5.111.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/khtml-5.110.0.tar.xz";
-      sha256 = "17d87vjim32mn0s1d9zl9342aamqg4xmi6xh6d8ghrgms3vqc7in";
-      name = "khtml-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/khtml-5.111.0.tar.xz";
+      sha256 = "0zspwy2yn1vqjn1vl12ym9qx76x0z1lpi6rbrcjv307z7krfrfzx";
+      name = "khtml-5.111.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/ki18n-5.110.0.tar.xz";
-      sha256 = "03qks9kncvazq2wz3myrjgz5m0gjxm80m1ayv9vjndyyc74a9smw";
-      name = "ki18n-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/ki18n-5.111.0.tar.xz";
+      sha256 = "09yzhmf167jpa9nzpvxc1c7la5l43z5igarhi64134cwr2yjf2jd";
+      name = "ki18n-5.111.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kiconthemes-5.110.0.tar.xz";
-      sha256 = "0bb6r7jaknjyhyjhdrlji320qgb7cgxshcgab0209zk8dl8a510d";
-      name = "kiconthemes-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kiconthemes-5.111.0.tar.xz";
+      sha256 = "07dv2h7d3vjipia8cwbbb5n13bwpfp2clz27ya8vrccy46q6wvx5";
+      name = "kiconthemes-5.111.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kidletime-5.110.0.tar.xz";
-      sha256 = "0hc30778d1k0vm4qsp58cf3d5bnws328qxazm8d5a6kxdc7izz44";
-      name = "kidletime-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kidletime-5.111.0.tar.xz";
+      sha256 = "1m0amd3mrsz685zjfr0livzw324j3z4h561vp7758krv70rz72iv";
+      name = "kidletime-5.111.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kimageformats-5.110.0.tar.xz";
-      sha256 = "0ivks2c2kgd26pr0n0b4x3hb7dmmq52vlp7f6ny14qpvm3cgnscd";
-      name = "kimageformats-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kimageformats-5.111.0.tar.xz";
+      sha256 = "17d69dgcq4qk6qjgb3l6hngv2qg26nxbca0mwwjb8hc8ixc9cym2";
+      name = "kimageformats-5.111.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kinit-5.110.0.tar.xz";
-      sha256 = "0ps2299hf02yvgs971cb4bljbmdbcvcmm2xqz6q0h8asjkpkilv5";
-      name = "kinit-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kinit-5.111.0.tar.xz";
+      sha256 = "1wp9zqi2rn4idy9jpmj66jb33y6lrscjlmwaz4xbdxhjqfqdxr9q";
+      name = "kinit-5.111.0.tar.xz";
     };
   };
   kio = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kio-5.110.0.tar.xz";
-      sha256 = "0sy91zlk60q5jligxp870srfc6fhd3fyk5yamkg266yfvyy9m3r2";
-      name = "kio-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kio-5.111.0.tar.xz";
+      sha256 = "0ifhmywhsp9kv51ihss9gwjlml6lk7i2xdxzqgc81k9bjiqd5gsi";
+      name = "kio-5.111.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kirigami2-5.110.0.tar.xz";
-      sha256 = "13j9z0nha3wq97apgkj43bayqijpgy6a2l7f9iryww054aqdjggx";
-      name = "kirigami2-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kirigami2-5.111.0.tar.xz";
+      sha256 = "04d6vcpivq48lnwx7l61lnana717z86q1wxbsyw2vmr4x8rn0m10";
+      name = "kirigami2-5.111.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kitemmodels-5.110.0.tar.xz";
-      sha256 = "06gym33644npci4crhykyfyp2v74pya72kdzmqh4lkzp252pyfhj";
-      name = "kitemmodels-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kitemmodels-5.111.0.tar.xz";
+      sha256 = "1i4wacyl1r0dy8r0sindrh6p2lxs97vxbriwzzf4hzgw3n0indjm";
+      name = "kitemmodels-5.111.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kitemviews-5.110.0.tar.xz";
-      sha256 = "1nqbypn0crbaqa8x19z0fh8mqbr8wbf8nc8wg0irzp32js9vcqyp";
-      name = "kitemviews-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kitemviews-5.111.0.tar.xz";
+      sha256 = "10yim2c1af7n4ivcj9nvwxplnh8jk9h6ljsq53ph5asac2sys7yv";
+      name = "kitemviews-5.111.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kjobwidgets-5.110.0.tar.xz";
-      sha256 = "1bl7igakmh1ipiamigs5s8fj6fy905b3j1dqgq9hxdxk59k1r1h2";
-      name = "kjobwidgets-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kjobwidgets-5.111.0.tar.xz";
+      sha256 = "08dvz4bl1bhad42q87850v274l4fdqfvxplhm22nvl3ba3iz93va";
+      name = "kjobwidgets-5.111.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kjs-5.110.0.tar.xz";
-      sha256 = "0xlkdi7qs75ipf87h8m7bvjn4l28y5qy20hvag1gc370fxz54v15";
-      name = "kjs-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kjs-5.111.0.tar.xz";
+      sha256 = "08yg66c7fg8fbkj4wg118haw6lskfy1l336ygfn650s1kaspz50g";
+      name = "kjs-5.111.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kjsembed-5.110.0.tar.xz";
-      sha256 = "1ynmj8ac9g9amjz0ljz3wf7sjsrwmz1kfi26r36rpqlf9mmkzfqm";
-      name = "kjsembed-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kjsembed-5.111.0.tar.xz";
+      sha256 = "0x1fb1baas932ygpyabpy0gb7mk2kbdszg4rpkcb69k34m8lg8g2";
+      name = "kjsembed-5.111.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kmediaplayer-5.110.0.tar.xz";
-      sha256 = "1jhh3gsbibi2hrhswg1nz1mdxn2wir5p9cvqpcqv7k8vm6rb82z3";
-      name = "kmediaplayer-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kmediaplayer-5.111.0.tar.xz";
+      sha256 = "0shr58j52ac2aman381cl8c0si0mvrym60qfqr9rhjk9d7xasiza";
+      name = "kmediaplayer-5.111.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/knewstuff-5.110.0.tar.xz";
-      sha256 = "0qld8ijy7z60qdlwa9vaq905xgzyvh5zw6ymngs00axl33m9bbbl";
-      name = "knewstuff-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/knewstuff-5.111.0.tar.xz";
+      sha256 = "0shvp6jgwyn96ggcgd2780sm44xl4w2jyb2apncjp36z0rw7sx35";
+      name = "knewstuff-5.111.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/knotifications-5.110.0.tar.xz";
-      sha256 = "0zm3d36v9dgqb3pdwpj962wpngfhq08q9x9rj99f88g9dlnmy6gm";
-      name = "knotifications-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/knotifications-5.111.0.tar.xz";
+      sha256 = "0v5dyd0ginnrm0n4hxxyzqbxrnj32svq9qz15swjmp36v4saaf8d";
+      name = "knotifications-5.111.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/knotifyconfig-5.110.0.tar.xz";
-      sha256 = "1651rh0av8lqp8rmb3djizsb8ypihkabprgppla3af2xf446n7wp";
-      name = "knotifyconfig-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/knotifyconfig-5.111.0.tar.xz";
+      sha256 = "0p24iajm8i5mvxfwk8wx3g95vg5rk0j217f2q3bixvivjkb336wl";
+      name = "knotifyconfig-5.111.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kpackage-5.110.0.tar.xz";
-      sha256 = "1jd85m7pxzah9d6b3zi2nswvsinx85brkiq142vic5l0rm6l89id";
-      name = "kpackage-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kpackage-5.111.0.tar.xz";
+      sha256 = "1pfg4bbr9jbw5pyb9hql4f200ccr7w6l2ynsy68l9f3kkz6i2csp";
+      name = "kpackage-5.111.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kparts-5.110.0.tar.xz";
-      sha256 = "13av8v2kggbvyv8nxganjb88q38g3gbykbkwrigywc3767p838r3";
-      name = "kparts-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kparts-5.111.0.tar.xz";
+      sha256 = "1vk062faaym2xc6lyh11yg2p0wvh9qab01wsz9pzf5jzphyd6dq1";
+      name = "kparts-5.111.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kpeople-5.110.0.tar.xz";
-      sha256 = "10drcfjcw00qhdlsficxb07hnnsd93smcig8argznpgwd61f807p";
-      name = "kpeople-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kpeople-5.111.0.tar.xz";
+      sha256 = "07sy2yrkbzh1rwmg6kl028wwhlxb328j2dv0jph7k6xy1drqz5r9";
+      name = "kpeople-5.111.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kplotting-5.110.0.tar.xz";
-      sha256 = "1fbzy9k0gx1468qsdd1c8fqaml3c01yy0m6n205y3ymkca78hdbk";
-      name = "kplotting-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kplotting-5.111.0.tar.xz";
+      sha256 = "17j4xwzc70bac50hifmg21fk8xfylpf9xfzfcn6ak339g91ll9ck";
+      name = "kplotting-5.111.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kpty-5.110.0.tar.xz";
-      sha256 = "1cx9wszi9zlay0vb9wz9hgbmbq006xgssnzzrmby4q4s6bhb92ps";
-      name = "kpty-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kpty-5.111.0.tar.xz";
+      sha256 = "04qwpxccl70a7a99fkjl33l3mf02qrhsqc9bkjmk06z08k52ys3q";
+      name = "kpty-5.111.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kquickcharts-5.110.0.tar.xz";
-      sha256 = "0s8xnsmhx2m6wn7fmmddzwnwc2yr3kvy85vd65m3avfw073rgj5v";
-      name = "kquickcharts-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kquickcharts-5.111.0.tar.xz";
+      sha256 = "09sp58ln9sy1qmpl0hcz29cfaz7ljjhn3rwv679c7r54qpq5mqjv";
+      name = "kquickcharts-5.111.0.tar.xz";
     };
   };
   kross = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kross-5.110.0.tar.xz";
-      sha256 = "169zsxrmbdv5xn6s0wmf1l2a3qghn88hgl714i0cnymq5ixy25x5";
-      name = "kross-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kross-5.111.0.tar.xz";
+      sha256 = "0h5nfipj7bxj9lga8gdgkc0an2imgmx0c0lg2wpf1k4104m8hd9d";
+      name = "kross-5.111.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/krunner-5.110.0.tar.xz";
-      sha256 = "0q3jhq2cswnqj5rdkxhizlv06rsxsm38ipxhcsw6p8zqabi1i351";
-      name = "krunner-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/krunner-5.111.0.tar.xz";
+      sha256 = "1j1238vnmczffxcrjrrvmvlwbkd6qsmixd0wn45p2z0ff671fp49";
+      name = "krunner-5.111.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kservice-5.110.0.tar.xz";
-      sha256 = "0rin6v96mcmw53dzw8sw56g7188623d1k4vs18bv44l86gixdhgg";
-      name = "kservice-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kservice-5.111.0.tar.xz";
+      sha256 = "04ifmp21x94jsfk0pxy67xa9vddhbvikc96gjbzxxy61pvmbgl3c";
+      name = "kservice-5.111.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/ktexteditor-5.110.0.tar.xz";
-      sha256 = "0iwzw51km3mr8kdva14mxz9bvcfcf09v5igah2axkjaxazxyigla";
-      name = "ktexteditor-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/ktexteditor-5.111.0.tar.xz";
+      sha256 = "0af31frnnz8ckqz40r5k7ngkqa6frvas70n6va3ci03zs1qkli18";
+      name = "ktexteditor-5.111.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/ktextwidgets-5.110.0.tar.xz";
-      sha256 = "0cr7n58mak928dysyqhsr1pj0w90amikx9jav4gs4lzb4m4rjp7q";
-      name = "ktextwidgets-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/ktextwidgets-5.111.0.tar.xz";
+      sha256 = "1a8iz01w9vnbzlcpyqvy7j862pdj4x95b80binzp4y4mf1jxjkyw";
+      name = "ktextwidgets-5.111.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kunitconversion-5.110.0.tar.xz";
-      sha256 = "083w0gz157j2g8qzm03yq3qwq58wafcq26qcc2ly2fksyyxkzzda";
-      name = "kunitconversion-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kunitconversion-5.111.0.tar.xz";
+      sha256 = "0893q177371i881k1fypq8ykv7pwzy7p8kbafxw1xrcsfz664h05";
+      name = "kunitconversion-5.111.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kwallet-5.110.0.tar.xz";
-      sha256 = "0mg5y8cvzvs7w3yy5xnpsps2b6m476l5ilw5kvarrjjpq7ybnkqz";
-      name = "kwallet-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kwallet-5.111.0.tar.xz";
+      sha256 = "1gwpvmpi9m7dm620arrh6q25fhpdv2jv3flv6fmbvkmviidwcs9i";
+      name = "kwallet-5.111.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kwayland-5.110.0.tar.xz";
-      sha256 = "0ggxvywvqfhhhb5370n90dyw0mjwkp3i7rgv58nyqsmby0g08r85";
-      name = "kwayland-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kwayland-5.111.0.tar.xz";
+      sha256 = "0119jhdq6v70ccmh0dc26bc5kx2baz5678n1n7shss60h1wlcsbk";
+      name = "kwayland-5.111.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kwidgetsaddons-5.110.0.tar.xz";
-      sha256 = "1cyphs0r5j2v93pwi9mbn6xd928lnhb0zmyfj5pywdx9n7lv0x6a";
-      name = "kwidgetsaddons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kwidgetsaddons-5.111.0.tar.xz";
+      sha256 = "0s8dsngxi8qrvgvckmxj5dhjawikkjvhbxlsaqw3fz8y8ax7jrjf";
+      name = "kwidgetsaddons-5.111.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kwindowsystem-5.110.0.tar.xz";
-      sha256 = "0l3aknr3zqz9zwqlyhnr8n53bcfb22rm38vdiv0l5vpwjbjn0270";
-      name = "kwindowsystem-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kwindowsystem-5.111.0.tar.xz";
+      sha256 = "1774xj96yzn7ddksd62qv5agzlml244a0gcr20i07wqv5kvblkrl";
+      name = "kwindowsystem-5.111.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kxmlgui-5.110.0.tar.xz";
-      sha256 = "1j8v52ix9sv7q76cvl2gnpjs602ri57kgfh21bvqd88gf2xnwxjq";
-      name = "kxmlgui-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kxmlgui-5.111.0.tar.xz";
+      sha256 = "13g8qan7k144zcjjp53ck5480v6gc1vvxwahgdvg95fvw8nqd4jm";
+      name = "kxmlgui-5.111.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kxmlrpcclient-5.110.0.tar.xz";
-      sha256 = "0fzd9amj2j4bw54q8fbgczqf785s6siqr1a8wbqf56wyyhki5psx";
-      name = "kxmlrpcclient-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kxmlrpcclient-5.111.0.tar.xz";
+      sha256 = "1s9gdp2sns4ivrgggf9sd0i9c9mbhbd9x9l2jiki5pmsbcwm6jvq";
+      name = "kxmlrpcclient-5.111.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/modemmanager-qt-5.110.0.tar.xz";
-      sha256 = "08q43arx9q81rqwhczzcn4cyl5glalwzjncb120a2cihida2m71v";
-      name = "modemmanager-qt-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/modemmanager-qt-5.111.0.tar.xz";
+      sha256 = "17917rd1i9k50ciagyij5i3j7kr3mi017zjs35c6b41sbpa4wfh2";
+      name = "modemmanager-qt-5.111.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/networkmanager-qt-5.110.0.tar.xz";
-      sha256 = "1bnlvpfhw6l64rgaxx9zkxd5wmwvyal5xmv31vxzf92ig6sgjdqq";
-      name = "networkmanager-qt-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/networkmanager-qt-5.111.0.tar.xz";
+      sha256 = "0bknnfaxjk3pp77s58vghvmdh3zl251nai3vlqk9ydyy55bc9vdq";
+      name = "networkmanager-qt-5.111.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/oxygen-icons5-5.110.0.tar.xz";
-      sha256 = "1dmig458gbl0ypb99kj514nwl5gbjpfvixw9lipgc2wwnn1nkia2";
-      name = "oxygen-icons5-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/oxygen-icons5-5.111.0.tar.xz";
+      sha256 = "1bp4hhd14cyl3qibp2k9ifn0gdzn0kdlcdnhwzw78wimn6rnkg7s";
+      name = "oxygen-icons5-5.111.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/plasma-framework-5.110.0.tar.xz";
-      sha256 = "0jfln8lrzmcnkqhl8pij5w6mdj6g25rwc332f07g9465y9ap07cf";
-      name = "plasma-framework-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/plasma-framework-5.111.0.tar.xz";
+      sha256 = "0zhcyf03z633a9j4swzggmvad8q5zhgp95z8b59327nbpzbg5yvv";
+      name = "plasma-framework-5.111.0.tar.xz";
     };
   };
   prison = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/prison-5.110.0.tar.xz";
-      sha256 = "019a3z18gq7nb3ahf5dd3b5fixzyfklg60dk2w4win2w19s70wb7";
-      name = "prison-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/prison-5.111.0.tar.xz";
+      sha256 = "1zyynvzldy98dkyan846h1gswisikfwvv23w8w6rchg6s8hzh9gc";
+      name = "prison-5.111.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/purpose-5.110.0.tar.xz";
-      sha256 = "0nl6qh7j5c3ijnq0qw1a5jmj1x5nb9hlssjjn8fdvfr7q6z67rsc";
-      name = "purpose-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/purpose-5.111.0.tar.xz";
+      sha256 = "1aggccqz6pk2cpp6l0r37yzp8hs88bliadfi25z8lm0xvmbih79i";
+      name = "purpose-5.111.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/qqc2-desktop-style-5.110.0.tar.xz";
-      sha256 = "04pyhlr89azw0kyjxfpx6phxljck8yiflcszd4xkgiw3n9rjyg3g";
-      name = "qqc2-desktop-style-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/qqc2-desktop-style-5.111.0.tar.xz";
+      sha256 = "1i051h8igjv58y12p0shcpg3frdhr18mmbz8xvyyksd2b158d0bc";
+      name = "qqc2-desktop-style-5.111.0.tar.xz";
     };
   };
   solid = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/solid-5.110.0.tar.xz";
-      sha256 = "1k64cqlws7nxki21cwg197avfnxsxpw3isry5p7bqyfmq45ydcvd";
-      name = "solid-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/solid-5.111.0.tar.xz";
+      sha256 = "1wqr322lqxm3cnrr69cz9dhd0b7ka53q59hqzvv0017zms72nzdr";
+      name = "solid-5.111.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/sonnet-5.110.0.tar.xz";
-      sha256 = "16qk63yy1y03z4rlc08qzr7mmds1yz0k9x1ws2nzp47khkza250i";
-      name = "sonnet-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/sonnet-5.111.0.tar.xz";
+      sha256 = "0dbaq0rdma81mla0j5zf88sb3435zzjhvw8qsiys01ciy1523v3h";
+      name = "sonnet-5.111.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/syndication-5.110.0.tar.xz";
-      sha256 = "0dsd05ckfv9fdnrbgprriba7lbbfs2z9qv869pcr4n7pn7x778sd";
-      name = "syndication-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/syndication-5.111.0.tar.xz";
+      sha256 = "10a4jx93l3hjhwl007gby3wx6lwpf61zsai843hzbb676rznv1s2";
+      name = "syndication-5.111.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/syntax-highlighting-5.110.0.tar.xz";
-      sha256 = "0gbmgan0cy4xhjcf10g0lffhwvkhhpcgbnk190xlzl4chnmpq9w5";
-      name = "syntax-highlighting-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/syntax-highlighting-5.111.0.tar.xz";
+      sha256 = "0rsq8bq40g11qwil0zmfadksvqh74vgwik1p3z7r49w9pz96m9n0";
+      name = "syntax-highlighting-5.111.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/threadweaver-5.110.0.tar.xz";
-      sha256 = "085y4m7z0rybsvpqzl2sjwnf8yjm4lnc3n49idj2c0psm8v5ksm0";
-      name = "threadweaver-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/threadweaver-5.111.0.tar.xz";
+      sha256 = "0rmpdns5jvdd227crs7cl3f1qlmkva1qizypx8nb7wyk73mnq6wb";
+      name = "threadweaver-5.111.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index fff5f705d7c..efb17eeaf31 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , cmocka
 
@@ -22,6 +23,19 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-ZTa+wG1g9KsVoqJG/yqxo2fJ7OhPnaI9QcfOmpOT3pg=";
   };
 
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    # Pull fix pending upstream inclusion to support
+    # `CMAKE_INSTALL_INCLUDEDIR`:
+    #   https://github.com/PJK/libcbor/pull/297
+    (fetchpatch {
+      name = "includedir.patch";
+      url = "https://github.com/PJK/libcbor/commit/d00a63e6d6858a2ed6be9b431b42799ed2c99ad8.patch";
+      hash = "sha256-kBCSbAHOCGOs/4Yu6Vh0jcmzA/jYPkkPXPGPrptRfyk=";
+    })
+  ];
+
   strictDeps = true;
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index 6494f16a876..3bbf449d89a 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "libdeflate";
-  version = "1.18";
+  version = "1.19";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${version}";
-    sha256 = "sha256-dWSDAYn36GDtkghmouGhHzxpa6EVwCslIPqejlLMZNM=";
+    sha256 = "sha256-HgZ2an1PCPhiLsd3ZA7tgZ1wVTOdHzDr8FHrqJhEbQw=";
   };
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "-DLIBDEFLATE_BUILD_SHARED_LIB=OFF" ];
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 31b284861d1..63a8522bd07 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,15 +1,16 @@
 { stdenv, lib, fetchurl, pkg-config, meson, ninja, docutils
 , libpthreadstubs, libpciaccess
 , withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light, valgrind-light
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.116";
+  version = "2.4.117";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-RsU/QHNeo9JtYUKX8VX2ExpRBiSiQnT2VPZGnKkFM5o=";
+    hash = "sha256-ooiNaePrHIp3rcCKdaYPuuAfDSCNJvA00aEuNiNhJCs=";
   };
 
   outputs = [ "out" "dev" "bin" ];
@@ -29,6 +30,16 @@ stdenv.mkDerivation rec {
     "-Detnaviv=disabled"
   ];
 
+  passthru = {
+    updateScript = gitUpdater {
+      url = "https://gitlab.freedesktop.org/mesa/drm.git";
+      rev-prefix = "libdrm-";
+      # Skip versions like libdrm-2_0_2 that happen to go last when
+      # sorted.
+      ignoredVersions = "_";
+    };
+  };
+
   meta = with lib; {
     homepage = "https://gitlab.freedesktop.org/mesa/drm";
     downloadPage = "https://dri.freedesktop.org/libdrm/";
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 681f9cbfb22..5bfa335314f 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -34,12 +34,6 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-gcc-arch=generic" # no detection of -march= or -mtune=
     "--enable-pax_emutramp"
-
-    # Causes issues in downstream packages which misuse ffi_closure_alloc
-    # Reenable once these issues are fixed and merged:
-    # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/6155
-    # https://gitlab.gnome.org/GNOME/gobject-introspection/-/merge_requests/283
-    "--disable-exec-static-tramp"
   ];
 
   preCheck = ''
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index fa9562947f8..b7ccb7085fb 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "glvnd";
     repo = "libglvnd";
     rev = "v${version}";
-    sha256 = "sha256-p/vLxagN9nCYw1JpUmZetgctQbrp3Wo33OVFrtvmnjQ=";
+    sha256 = "sha256-2U9JtpGyP4lbxtVJeP5GUgh5XthloPvFIw28+nldYx8=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config python3 addOpenGLRunpath ];
@@ -69,6 +69,8 @@ stdenv.mkDerivation rec {
     changelog = "https://gitlab.freedesktop.org/glvnd/libglvnd/-/tags/v${version}";
     license = with licenses; [ mit bsd1 bsd3 gpl3Only asl20 ];
     platforms = platforms.unix;
+    # https://gitlab.freedesktop.org/glvnd/libglvnd/-/issues/212
+    badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
     maintainers = with maintainers; [ primeos ];
   };
 }
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 2cb8642ca87..bd7a7a61eb5 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.16";
+  version = "3.0.17";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "sha256-3D/0leI3LLKDFOXkKSrmMamLoaXdi/2Z4iPUXqgwtg8=";
+    sha256 = "sha256-GqPCjI40kkqNv9zTnLdJgZVBxS4eZRHl+k/BN9vGnDo=";
   };
 
   strictDeps = true;
@@ -105,6 +105,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/libical/libical";
     description = "An Open Source implementation of the iCalendar protocols";
+    changelog = "https://github.com/libical/libical/raw/v${version}/ReleaseNotes.txt";
     license = licenses.mpl20;
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/libraries/libimagequant/Cargo.lock b/pkgs/development/libraries/libimagequant/Cargo.lock
index 8823a070b81..fdad112994a 100644
--- a/pkgs/development/libraries/libimagequant/Cargo.lock
+++ b/pkgs/development/libraries/libimagequant/Cargo.lock
@@ -76,16 +76,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "crossbeam-channel"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
 name = "crossbeam-deque"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -135,9 +125,9 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -153,18 +143,11 @@ dependencies = [
 ]
 
 [[package]]
-name = "hermit-abi"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
-
-[[package]]
 name = "imagequant"
-version = "4.2.1"
+version = "4.2.2"
 dependencies = [
  "arrayvec",
  "lodepng",
- "num_cpus",
  "once_cell",
  "rayon",
  "rgb",
@@ -173,7 +156,7 @@ dependencies = [
 
 [[package]]
 name = "imagequant-sys"
-version = "4.0.2"
+version = "4.0.3"
 dependencies = [
  "bitflags",
  "imagequant",
@@ -182,15 +165,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
 
 [[package]]
 name = "lodepng"
-version = "3.7.2"
+version = "3.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0ad39f75bbaa4b10bb6f2316543632a8046a5bcf9c785488d79720b21f044f8"
+checksum = "a3cdccd0cf57a5d456f0656ebcff72c2e19503287e1afbf3b84382812adc0606"
 dependencies = [
  "crc32fast",
  "fallible_collections",
@@ -218,16 +201,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
 name = "once_cell"
 version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -235,9 +208,9 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "rayon"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
+checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
 dependencies = [
  "either",
  "rayon-core",
@@ -245,14 +218,12 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
+checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
 dependencies = [
- "crossbeam-channel",
  "crossbeam-deque",
  "crossbeam-utils",
- "num_cpus",
 ]
 
 [[package]]
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index 5792170b9f0..0ac6e89e23e 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -5,13 +5,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    hash = "sha256-a5TztgNFRV9BVERpHI33ZEYwfOR46F9FzmbquzwGq3k=";
+    hash = "sha256-cZgnJOmj+xJDcewsxH2Jp5AAnFZKVuYxKPtoGeN03g4=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/libraries/libiscsi/default.nix b/pkgs/development/libraries/libiscsi/default.nix
index 806a9729c57..826593b9d66 100644
--- a/pkgs/development/libraries/libiscsi/default.nix
+++ b/pkgs/development/libraries/libiscsi/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0ajrkkg5awmi8m4b3mha7h07ylg18k252qprvk1sgq0qbyd66zy7";
   };
 
+  postPatch = ''
+    substituteInPlace lib/socket.c \
+      --replace "void iscsi_decrement_iface_rr() {" "void iscsi_decrement_iface_rr(void) {"
+  '';
+
   nativeBuildInputs = [ autoreconfHook ];
 
   # This problem is gone on libiscsi master.
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 4fc6449230d..8055704b089 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libtiff";
-  version = "4.5.1";
+  version = "4.6.0";
 
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
     rev = "v${version}";
-    hash = "sha256-qQEthy6YhNAQmdDMyoCIvK8f3Tx25MgqhJZW74CB93E=";
+    hash = "sha256-qCg5qjsPPynCHIg0JsPJldwVdcYkI68zYmyNAKUCoyw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libtiff/headers.patch b/pkgs/development/libraries/libtiff/headers.patch
index e0ef9f3478a..933e06f3232 100644
--- a/pkgs/development/libraries/libtiff/headers.patch
+++ b/pkgs/development/libraries/libtiff/headers.patch
@@ -1,9 +1,8 @@
-diff --git i/libtiff/Makefile.am w/libtiff/Makefile.am
-index 44522b62..d66e5948 100644
+export private headers for freeimage
 --- i/libtiff/Makefile.am
 +++ w/libtiff/Makefile.am
 @@ -36,8 +36,12 @@ EXTRA_DIST = \
- 	tiffconf.h.cmake.in
+ 	tif_win32_versioninfo.rc
 
  libtiffinclude_HEADERS = \
 +	tif_config.h \
diff --git a/pkgs/development/libraries/libtiff/rename-version.patch b/pkgs/development/libraries/libtiff/rename-version.patch
index ddd33ad4904..04fa1bfc88c 100644
--- a/pkgs/development/libraries/libtiff/rename-version.patch
+++ b/pkgs/development/libraries/libtiff/rename-version.patch
@@ -1,3 +1,4 @@
+fix case-insensitive build
 --- a/Makefile.am
 +++ b/Makefile.am
 @@ -34,7 +34,7 @@ docfiles = \
@@ -6,15 +7,15 @@
  	TODO \
 -	VERSION
 +	VERSION.txt
-
+ 
  EXTRA_DIST = \
- 	cmake \
-@@ -61,7 +61,7 @@ SUBDIRS = port libtiff tools build contrib test doc
-
+ 	placeholder.h \
+@@ -68,7 +68,7 @@ NEW_LIBTIFF_RELEASE_DATE=$(shell date +"%Y%m%d")
  release:
-	(rm -f $(top_srcdir)/RELEASE-DATE && echo $(LIBTIFF_RELEASE_DATE) > $(top_srcdir)/RELEASE-DATE)
+ 	@(echo --- Setting release date to $(NEW_LIBTIFF_RELEASE_DATE) and release version to $(LIBTIFF_VERSION) ---)
+ 	(rm -f $(top_srcdir)/RELEASE-DATE && echo $(NEW_LIBTIFF_RELEASE_DATE) > $(top_srcdir)/RELEASE-DATE)
 -	(rm -f $(top_srcdir)/VERSION && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION)
-+	(rm -f $(top_srcdir)/VERSION.txt && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION.txt)
-	(rm -f $(top_srcdir)/libtiff/tiffvers.h && sed 's,LIBTIFF_VERSION,$(LIBTIFF_VERSION),;s,LIBTIFF_RELEASE_DATE,$(LIBTIFF_RELEASE_DATE),;s,LIBTIFF_MAJOR_VERSION,$(LIBTIFF_MAJOR_VERSION),;s,LIBTIFF_MINOR_VERSION,$(LIBTIFF_MINOR_VERSION),;s,LIBTIFF_MICRO_VERSION,$(LIBTIFF_MICRO_VERSION),' $(top_srcdir)/libtiff/tiffvers.h.in > $(top_srcdir)/libtiff/tiffvers.h)
-
++	(rm -f $(top_srcdir)/VERSION && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION.txt)
+ 	(rm -f $(top_builddir)/libtiff/tiffvers.h && sed 's,LIBTIFF_VERSION,$(LIBTIFF_VERSION),;s,LIBTIFF_RELEASE_DATE,$(NEW_LIBTIFF_RELEASE_DATE),;s,LIBTIFF_MAJOR_VERSION,$(LIBTIFF_MAJOR_VERSION),;s,LIBTIFF_MINOR_VERSION,$(LIBTIFF_MINOR_VERSION),;s,LIBTIFF_MICRO_VERSION,$(LIBTIFF_MICRO_VERSION),' $(top_srcdir)/libtiff/tiffvers.h.in > $(top_builddir)/libtiff/tiffvers.h && sed -i 's,@,,g' $(top_builddir)/libtiff/tiffvers.h)
+ 
  pkgconfigdir = $(libdir)/pkgconfig
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 7be9bee23a2..9d3ec125248 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , autoconf
 , automake
 , libtool
@@ -33,6 +34,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-Lrsyh4qd3OkTw1cSPfahzfSGNt6+pRN1X21iiv1SsFo=";
   };
 
+  patches = [
+    # Disable io_uring close on selected kernels. Remove on next release
+    # https://github.com/libuv/libuv/pull/4141
+    (fetchpatch {
+      url = "https://github.com/libuv/libuv/commit/c811169f91b2101f7302e96de3d2dc366ade3a25.patch";
+      hash = "sha256-7vk6XGXwJcwYUQPqIJ3JPd/fPIGrjE5WRDSJCMQfKeU=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   postPatch = let
@@ -113,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "A multi-platform support library with a focus on asynchronous I/O";
     homepage    = "https://libuv.org/";
     changelog   = "https://github.com/libuv/libuv/blob/v${finalAttrs.version}/ChangeLog";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ marsam ];
     platforms   = platforms.all;
     license     = with licenses; [ mit isc bsd2 bsd3 cc-by-40 ];
   };
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 7796ec25158..43fe69af2b0 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.19.0";
+  version = "2.20.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "sha256-M6mAHvGl4d9EqdkDBSxSbpZUCUcrkpnf+hfo16L3eHs=";
+    sha256 = "sha256-ENAsytjqvS8xHZyZLPih3bzBgQ1f/j+s3dWZs1GTWHs=";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index 27ce41d20f6..0e92d28046a 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -8,11 +8,11 @@
 stdenv.mkDerivation rec {
   pname = "libvterm-neovim";
   # Releases are not tagged, look at commit history to find latest release
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchurl {
-    url = "https://www.leonerd.org.uk/code/libvterm/libvterm-${version}.tar.gz";
-    sha256 = "sha256-ketQiAafTm7atp4UxCEvbaAZLmVpWVbcBIAWoNq4vPY=";
+    url = "https://launchpad.net/libvterm/trunk/v${lib.versions.majorMinor version}/+download/libvterm-${version}.tar.gz";
+    hash = "sha256-CRVvQ90hKL00fL7r5Q2aVx0yxk4M8Y0hEZeUav9yJuA=";
   };
 
   nativeBuildInputs = [ perl libtool ];
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index c03dd99a125..254769349b1 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.7.0";
+  version = "2.8.0";
 
   outputs = [ "out" "dev" ];
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "sha256-NNfhZMshM5U/EfJHuNgkDe5NEkEGKtJ56vSpXyGf/xw=";
+    hash = "sha256-VjFZBlOIG1L4dXPJ8DWxrbfVqdQC+X7zVXFryo43FFc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index ea0059e34b6..8e1447c31fa 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -223,6 +223,7 @@ self = stdenv.mkDerivation {
     libffi libvdpau libelf libXvMC
     libpthreadstubs openssl /*or another sha1 provider*/
     zstd libunwind
+    python3Packages.python # for shebang
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
     ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator' ]
@@ -320,6 +321,9 @@ self = stdenv.mkDerivation {
       fi
     done
 
+    # Don't depend on build python
+    patchShebangs --host --update $out/bin/*
+
     # NAR doesn't support hard links, so convert them to symlinks to save space.
     jdupes --hard-links --link-soft --recurse "$drivers"
 
diff --git a/pkgs/development/libraries/minizip/default.nix b/pkgs/development/libraries/minizip/default.nix
index 5619fe7039e..74493a06b52 100644
--- a/pkgs/development/libraries/minizip/default.nix
+++ b/pkgs/development/libraries/minizip/default.nix
@@ -1,9 +1,19 @@
-{ lib, stdenv, zlib, autoreconfHook }:
+{ lib, stdenv, zlib, autoreconfHook, fetchpatch }:
 
 stdenv.mkDerivation {
   pname = "minizip";
   inherit (zlib) src version;
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-45853.patch";
+      url = "https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c.patch";
+      hash = "sha256-yayfe1g9HsvgMN28WF/MYkH7dGMX4PsK53FcnfL3InM=";
+    })
+  ];
+
+  patchFlags = [ "-p3" ];
+
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ zlib ];
 
diff --git a/pkgs/development/libraries/onnxruntime/default.nix b/pkgs/development/libraries/onnxruntime/default.nix
index 4a9ee61f561..5252875b27e 100644
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@@ -17,7 +17,7 @@
 , microsoft-gsl
 , iconv
 , gtest
-, protobuf3_21
+, protobuf_21
 , pythonSupport ? true
 }:
 
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     python3Packages.python
-    protobuf3_21
+    protobuf_21
   ] ++ lib.optionals pythonSupport (with python3Packages; [
     setuptools
     wheel
@@ -177,7 +177,7 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
     tests = lib.optionalAttrs pythonSupport {
       python = python3Packages.onnxruntime;
     };
diff --git a/pkgs/development/libraries/opencore-amr/default.nix b/pkgs/development/libraries/opencore-amr/default.nix
index 26b2715658b..38a50b75027 100644
--- a/pkgs/development/libraries/opencore-amr/default.nix
+++ b/pkgs/development/libraries/opencore-amr/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "opencore-amr";
-  version = "0.1.5";
+  version = "0.1.6";
   src = fetchurl {
-    url = "https://vorboss.dl.sourceforge.net/project/opencore-amr/opencore-amr/opencore-amr-${version}.tar.gz";
-    sha256 = "0hfk9khz3by0119h3jdwgdfd7jgkdbzxnmh1wssvylgnsnwnq01c";
+    url = "mirror://sourceforge/opencore-amr/opencore-amr/opencore-amr-${version}.tar.gz";
+    hash = "sha256-SD60BhCI4rNLNY5HVAtdSVqWzUaONhBQ+uYVsYCdxKE=";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 037192d871e..7e928a98c53 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , fetchpatch
 , cmake, pkg-config, unzip, zlib, pcre, hdf5
-, glog, boost, gflags, protobuf3_21
+, glog, boost, gflags, protobuf_21
 , config
 
 , enableJPEG      ? true, libjpeg
@@ -186,7 +186,7 @@ stdenv.mkDerivation {
 
   buildInputs =
        [ zlib pcre hdf5 glog boost gflags ]
-    ++ lib.optional useSystemProtobuf protobuf3_21
+    ++ lib.optional useSystemProtobuf protobuf_21
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional enableGtk2 gtk2
     ++ lib.optional enableGtk3 gtk3
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 68099a57c63..6268a2c02e5 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -11,7 +11,7 @@
 , hdf5
 , boost
 , gflags
-, protobuf3_21
+, protobuf_21
 , config
 , ocl-icd
 , buildPackages
@@ -317,7 +317,7 @@ stdenv.mkDerivation {
     echo '"(build info elided)"' > modules/core/version_string.inc
   '';
 
-  buildInputs = [ zlib pcre boost gflags protobuf3_21 ]
+  buildInputs = [ zlib pcre boost gflags protobuf_21 ]
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) hdf5
     ++ lib.optional enableGtk2 gtk2
@@ -369,7 +369,7 @@ stdenv.mkDerivation {
     "-DOPENCV_GENERATE_PKGCONFIG=ON"
     "-DWITH_OPENMP=ON"
     "-DBUILD_PROTOBUF=OFF"
-    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf3_21}"
+    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf_21}"
     "-DPROTOBUF_UPDATE_FILES=ON"
     "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
     "-DBUILD_TESTS=${printEnabled runAccuracyTests}"
diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index a5ce27e270e..826c7b2c854 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-cV+qgx3WzdotypgpZhVFxzdKAU2rNVw0KWSdkeN0gLk=";
+    hash = "sha256-ycn2RbHM/vIDUGGGnfNZ0Zm0qjjKRRNhkMD11PkpGF0=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];
diff --git a/pkgs/development/libraries/openfec/default.nix b/pkgs/development/libraries/openfec/default.nix
index a908b4980da..dd6b0ce10c0 100644
--- a/pkgs/development/libraries/openfec/default.nix
+++ b/pkgs/development/libraries/openfec/default.nix
@@ -1,12 +1,17 @@
-{ stdenv, lib, fetchzip, cmake }:
+{ stdenv
+, lib
+, fetchzip
+, cmake
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "openfec";
-  version = "1.4.2";
+  version = "1.4.2.9";
 
   src = fetchzip {
-    url = "http://openfec.org/files/openfec_v1_4_2.tgz";
-    sha256 = "sha256:0c2lg8afr7lqpzrsi0g44a6h6s7nq4vz7yc9vm2k57ph2y6r86la";
+    url = "https://github.com/roc-streaming/openfec/archive/refs/tags/v${version}.tar.gz";
+    hash = "sha256-A/U9Nh8tspRoT3bYePJLUrNa9jxiL0r2Xaf64wWbmVA=";
   };
 
   outputs = [ "out" "dev" ];
@@ -33,6 +38,11 @@ stdenv.mkDerivation rec {
       ln -s libopenfec${so} $out/lib/libopenfec${so}.1
     '';
 
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/roc-streaming/openfec.git";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     description = "Application-level Forward Erasure Correction codes";
     homepage = "https://github.com/roc-streaming/openfec";
diff --git a/pkgs/development/libraries/openjpeg/default.nix b/pkgs/development/libraries/openjpeg/default.nix
index 50098de03dd..d528e2fc030 100644
--- a/pkgs/development/libraries/openjpeg/default.nix
+++ b/pkgs/development/libraries/openjpeg/default.nix
@@ -25,8 +25,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     # modernise cmake files, also fixes them for multiple outputs
+    # https://github.com/uclouvain/openjpeg/pull/1424
     (fetchpatch {
-      url = "https://github.com/uclouvain/openjpeg/pull/1424.patch";
+      name = "uclouvain-openjpeg-pull-1424.patch";
+      url = "https://github.com/uclouvain/openjpeg/compare/52927287402a9f7353de8854c88f931051211e2f...9d4f70cfe99626f82f9c8dcbf45f07709e3511b2.patch";
       sha256 = "sha256-CxVRt1u4HVOMUjWiZ2plmZC29t/zshCpSY+N4Wlrlvg=";
     })
     # fix cmake files cross compilation
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 2b0d778ef3d..3aeafccb1ed 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -18,14 +18,14 @@
 # files.
 
 let
-  common = { version, sha256, patches ? [], withDocs ? false, extraMeta ? {} }:
+  common = { version, hash, patches ? [], withDocs ? false, extraMeta ? {} }:
    stdenv.mkDerivation (finalAttrs: {
     pname = "openssl";
     inherit version;
 
     src = fetchurl {
       url = "https://www.openssl.org/source/${finalAttrs.pname}-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
     };
 
     inherit patches;
@@ -219,9 +219,11 @@ let
 
     meta = with lib; {
       homepage = "https://www.openssl.org/";
+      changelog = "https://github.com/openssl/openssl/blob/openssl-${version}/CHANGES.md";
       description = "A cryptographic library that implements the SSL and TLS protocols";
       license = licenses.openssl;
       mainProgram = "openssl";
+      maintainers = with maintainers; [ thillux ];
       pkgConfigModules = [
         "libcrypto"
         "libssl"
@@ -238,7 +240,7 @@ in {
   # and backport this to stable release (23.05).
   openssl_1_1 = common {
     version = "1.1.1w";
-    sha256 = "sha256-zzCYlQy02FOtlcCEHx+cbT3BAtzPys1SHZOSUgi3asg=";
+    hash = "sha256-zzCYlQy02FOtlcCEHx+cbT3BAtzPys1SHZOSUgi3asg=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -255,8 +257,32 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.11";
-    sha256 = "sha256-s0JdO7SiIY0Gl+tB9/wM3t4BbtGcpJ0Wi3jo2UeIf1U=";
+    version = "3.0.12";
+    hash = "sha256-+Tyejt3l6RZhGd4xdV/Ie0qjSGNmL2fd/LoU0La2m2E=";
+
+    patches = [
+      ./3.0/nix-ssl-cert-file.patch
+
+      # openssl will only compile in KTLS if the current kernel supports it.
+      # This patch disables build-time detection.
+      ./3.0/openssl-disable-kernel-detection.patch
+
+      (if stdenv.hostPlatform.isDarwin
+       then ./use-etc-ssl-certs-darwin.patch
+       else ./use-etc-ssl-certs.patch)
+    ];
+
+    withDocs = true;
+
+    extraMeta = with lib; {
+      license = licenses.asl20;
+    };
+  };
+
+  openssl_3_1 = common {
+    version = "3.1.4";
+    hash = "sha256-hAr1Nmq5tSK95SWCa+PvD7Cvgcap69hMqmAP6hcx7uM=";
+
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch b/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
deleted file mode 100644
index fab89c4ffd9..00000000000
--- a/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 99a4b2d1..d4a4cda7 100644
---- a/meson.build
-+++ b/meson.build
-@@ -55,7 +55,7 @@ endif
- 
- spa_plugindir = pipewire_libdir / spa_name
- 
--alsadatadir = pipewire_datadir / 'alsa-card-profile' / 'mixer'
-+alsadatadir = pipewire_libdir / '..' / 'share' / 'alsa-card-profile' / 'mixer'
- 
- pipewire_headers_dir = pipewire_name / 'pipewire'
- 
diff --git a/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch b/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
deleted file mode 100644
index 230f1b30394..00000000000
--- a/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/meson_options.txt b/meson_options.txt
-index 961ae2a76..692b84dfd 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -179,6 +179,9 @@ option('udev',
- option('udevrulesdir',
-        type : 'string',
-        description : 'Directory for udev rules (defaults to /lib/udev/rules.d)')
-+option('pipewire_pulse_prefix',
-+       type : 'string',
-+       description: 'Install directory for the pipewire-pulse daemon')
- option('systemd-system-unit-dir',
-        type : 'string',
-        description : 'Directory for system systemd units (defaults to /usr/lib/systemd/system)')
-diff --git a/src/daemon/systemd/user/meson.build b/src/daemon/systemd/user/meson.build
-index d17f3794f..34afe4f1a 100644
---- a/src/daemon/systemd/user/meson.build
-+++ b/src/daemon/systemd/user/meson.build
-@@ -9,7 +9,7 @@ install_data(
- 
- systemd_config = configuration_data()
- systemd_config.set('PW_BINARY', pipewire_bindir / 'pipewire')
--systemd_config.set('PW_PULSE_BINARY', pipewire_bindir / 'pipewire-pulse')
-+systemd_config.set('PW_PULSE_BINARY', get_option('pipewire_pulse_prefix') / 'bin/pipewire-pulse')
- 
- configure_file(input : 'pipewire.service.in',
-                output : 'pipewire.service',
diff --git a/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch b/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
deleted file mode 100644
index b8d8fcb0f90..00000000000
--- a/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/meson.build b/meson.build
-index b6b4553b..f21c29d8 100644
---- a/meson.build
-+++ b/meson.build
-@@ -37,7 +37,10 @@ pipewire_localedir = prefix / get_option('localedir')
- pipewire_sysconfdir = prefix / get_option('sysconfdir')
- 
- pipewire_configdir = pipewire_sysconfdir / 'pipewire'
--pipewire_confdatadir = pipewire_datadir / 'pipewire'
-+pipewire_confdatadir = get_option('pipewire_confdata_dir')
-+if pipewire_confdatadir == ''
-+  pipewire_confdatadir = pipewire_datadir / 'pipewire'
-+endif
- modules_install_dir = pipewire_libdir / pipewire_name
- 
- if host_machine.system() == 'linux'
-diff --git a/meson_options.txt b/meson_options.txt
-index 9bc33fcd..e4bd2dc1 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -61,6 +61,9 @@ option('jack-devel',
- option('libjack-path',
-        description: 'Where to install the libjack.so library',
-        type: 'string')
-+option('pipewire_confdata_dir',
-+       type: 'string',
-+       description: 'Directory for pipewire default configuration (defaults to /usr/share/pipewire)')
- option('spa-plugins',
-        description: 'Enable spa plugins integration',
-        type: 'feature',
diff --git a/pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch b/pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch
deleted file mode 100644
index ca7d351257b..00000000000
--- a/pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-diff --git a/src/daemon/minimal.conf.in b/src/daemon/minimal.conf.in
-index 9c885a38f..c474eb45d 100644
---- a/src/daemon/minimal.conf.in
-+++ b/src/daemon/minimal.conf.in
-@@ -111,7 +111,7 @@ context.modules = [
-             # access.allowed to list an array of paths of allowed
-             # apps.
-             #access.allowed = [
--            #    @session_manager_path@
-+            #    <session_manager_path>
-             #]
- 
-             # An array of rejected paths.
-@@ -359,5 +359,5 @@ context.exec = [
-     # It can be interesting to start another daemon here that listens
-     # on another address with the -a option (eg. -a tcp:4713).
-     #
--    #@pulse_comment@{ path = "@pipewire_path@" args = "-c pipewire-pulse.conf" }
-+    #@pulse_comment@{ path = "<pipewire_path>" args = "-c pipewire-pulse.conf" }
- ]
-diff --git a/src/daemon/pipewire.conf.in b/src/daemon/pipewire.conf.in
-index 697bf094d..3a7b54ddd 100644
---- a/src/daemon/pipewire.conf.in
-+++ b/src/daemon/pipewire.conf.in
-@@ -142,7 +142,7 @@ context.modules = [
-             # access.allowed to list an array of paths of allowed
-             # apps.
-             #access.allowed = [
--            #    @session_manager_path@
-+            #    <session_manager_path>
-             #]
- 
-             # An array of rejected paths.
-@@ -294,7 +294,7 @@ context.exec = [
-     # but it is better to start it as a systemd service.
-     # Run the session manager with -h for options.
-     #
--    @sm_comment@{ path = "@session_manager_path@" args = "@session_manager_args@"
-+    @sm_comment@{ path = "<session_manager_path>" args = "@session_manager_args@"
-     @sm_comment@  condition = [ { exec.session-manager = null } { exec.session-manager = true } ] }
-     #
-     # You can optionally start the pulseaudio-server here as well
-@@ -302,6 +302,6 @@ context.exec = [
-     # It can be interesting to start another daemon here that listens
-     # on another address with the -a option (eg. -a tcp:4713).
-     #
--    @pulse_comment@{ path = "@pipewire_path@" args = "-c pipewire-pulse.conf"
-+    @pulse_comment@{ path = "<pipewire_path>" args = "-c pipewire-pulse.conf"
-     @pulse_comment@  condition = [ { exec.pipewire-pulse = null } { exec.pipewire-pulse = true } ] }
- ]
diff --git a/pkgs/development/libraries/pipewire/0095-spa-data-dir.patch b/pkgs/development/libraries/pipewire/0095-spa-data-dir.patch
deleted file mode 100644
index d8241a809f6..00000000000
--- a/pkgs/development/libraries/pipewire/0095-spa-data-dir.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 56599ebd1..3bed2d3e3 100644
---- a/meson.build
-+++ b/meson.build
-@@ -54,7 +54,7 @@ else
- endif
- 
- spa_plugindir = pipewire_libdir / spa_name
--spa_datadir = pipewire_datadir / spa_name
-+spa_datadir = pipewire_libdir / spa_name
- 
- alsadatadir = pipewire_datadir / 'alsa-card-profile' / 'mixer'
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 1e66d1573fc..05741652f46 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -70,6 +70,7 @@
 , tinycompress
 , ffadoSupport ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 , ffado
+, libselinux
 }:
 
 # Bluetooth codec only makes sense if general bluetooth enabled
@@ -80,12 +81,10 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.80";
+    version = "0.3.83";
 
     outputs = [
       "out"
-      "lib"
-      "pulse"
       "jack"
       "dev"
       "doc"
@@ -98,30 +97,14 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-6Ka83Bqd/nsfp8rv0GTBerpGP226MeZvC5u/j62FzP0=";
+      sha256 = "sha256-12g8/zLTCQkBtgwE6zt3yEDwcHCr2LQXJCjB1nqbmB0=";
     };
 
     patches = [
-      # Break up a dependency cycle between outputs.
-      ./0040-alsa-profiles-use-libdir.patch
-      # Change the path of the pipewire-pulse binary in the service definition.
-      ./0050-pipewire-pulse-path.patch
       # Load libjack from a known location
       ./0060-libjack-path.patch
       # Move installed tests into their own output.
       ./0070-installed-tests-path.patch
-      # Add option for changing the config install directory
-      ./0080-pipewire-config-dir.patch
-      # Remove output paths from the comments in the config templates to break dependency cycles
-      ./0090-pipewire-config-template-paths.patch
-      # Place SPA data files in lib output to avoid dependency cycles
-      ./0095-spa-data-dir.patch
-
-      # backport fix for building with webrtc-audio-processing 0.3 on platforms where we don't have 1.x
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/1f1c308c9766312e684f0b53fc2d1422c7414d31.patch";
-        hash = "sha256-ECM7/84G99yzXsg5A2DkFnXFGJSV9lz3vD0IRSzR8vU=";
-      })
     ];
 
     strictDeps = true;
@@ -142,6 +125,7 @@ let
       glib
       libjack2
       libusb1
+      libselinux
       libsndfile
       lilv
       ncurses
@@ -174,9 +158,7 @@ let
       "-Dudevrulesdir=lib/udev/rules.d"
       "-Dinstalled_tests=enabled"
       "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-      "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
       "-Dlibjack-path=${placeholder "jack"}/lib"
-      "-Dlibv4l2-path=${placeholder "out"}/lib"
       "-Dlibcamera=${mesonEnableFeature libcameraSupport}"
       "-Dlibffado=${mesonEnableFeature ffadoSupport}"
       "-Droc=${mesonEnableFeature rocSupport}"
@@ -185,7 +167,6 @@ let
       "-Dgstreamer=${mesonEnableFeature gstreamerSupport}"
       "-Dsystemd-system-service=${mesonEnableFeature enableSystemd}"
       "-Dudev=${mesonEnableFeature (!enableSystemd)}"
-      "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
       "-Dffmpeg=${mesonEnableFeature ffmpegSupport}"
       "-Dbluez5=${mesonEnableFeature bluezSupport}"
       "-Dbluez5-backend-hsp-native=${mesonEnableFeature nativeHspSupport}"
@@ -198,7 +179,6 @@ let
       "-Dbluez5-codec-lc3=${mesonEnableFeature bluezSupport}"
       "-Dbluez5-codec-ldac=${mesonEnableFeature ldacbtSupport}"
       "-Dsysconfdir=/etc"
-      "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
       "-Draop=${mesonEnableFeature raopSupport}"
       "-Dsession-managers="
       "-Dvulkan=enabled"
@@ -222,15 +202,6 @@ let
     '';
 
     postInstall = ''
-      ${lib.optionalString enableSystemd ''
-        moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
-        moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
-      ''}
-
-      rm $out/bin/pipewire-pulse
-      mkdir -p $pulse/bin
-      ln -sf $out/bin/pipewire $pulse/bin/pipewire-pulse
-
       moveToOutput "bin/pw-jack" "$jack"
     '';
 
diff --git a/pkgs/development/libraries/protobuf/21.nix b/pkgs/development/libraries/protobuf/21.nix
new file mode 100644
index 00000000000..09a8c81b3d1
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/21.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix ({
+  version = "21.12";
+  hash = "sha256-VZQEFHq17UsTH5CZZOcJBKiScGV2xPJ/e6gkkVliRCU=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/23.nix b/pkgs/development/libraries/protobuf/23.nix
new file mode 100644
index 00000000000..abb2cc2f446
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/23.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix ({
+  version = "23.4";
+  hash = "sha256-eI+mrsZAOLEsdyTC3B+K+GjD3r16CmPx1KJ2KhCwFdg=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/24.nix b/pkgs/development/libraries/protobuf/24.nix
new file mode 100644
index 00000000000..6741b8afe52
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/24.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix ({
+  version = "24.4";
+  hash = "sha256-I+Xtq4GOs++f/RlVff9MZuolXrMLmrZ2z6mkBayqQ2s=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/3.21.nix b/pkgs/development/libraries/protobuf/3.21.nix
deleted file mode 100644
index fe85be8cf02..00000000000
--- a/pkgs/development/libraries/protobuf/3.21.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic-v3-cmake.nix ({
-  version = "3.21.12";
-  sha256 = "sha256-VZQEFHq17UsTH5CZZOcJBKiScGV2xPJ/e6gkkVliRCU=";
-} // args)
diff --git a/pkgs/development/libraries/protobuf/3.23.nix b/pkgs/development/libraries/protobuf/3.23.nix
deleted file mode 100644
index 2d658d57419..00000000000
--- a/pkgs/development/libraries/protobuf/3.23.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic-v3-cmake.nix ({
-  version = "3.23.4";
-  sha256 = "sha256-eI+mrsZAOLEsdyTC3B+K+GjD3r16CmPx1KJ2KhCwFdg=";
-} // args)
diff --git a/pkgs/development/libraries/protobuf/3.24.nix b/pkgs/development/libraries/protobuf/3.24.nix
deleted file mode 100644
index 60ad747194d..00000000000
--- a/pkgs/development/libraries/protobuf/3.24.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic-v3-cmake.nix ({
-  version = "3.24.3";
-  sha256 = "sha256-wXGQW/o674DeLXX2IlyZskl5OrBcSRptOMoJqLQGm94=";
-} // args)
diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic.nix
index dd31aba434c..6b4d2a74e74 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@@ -11,7 +11,7 @@
 , gtest
 , zlib
 , version
-, sha256
+, hash
 
   # downstream dependencies
 , python3
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "protocolbuffers";
     repo = "protobuf";
     rev = "v${version}";
-    inherit sha256;
+    inherit hash;
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
@@ -37,28 +37,24 @@ stdenv.mkDerivation (finalAttrs: {
       --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
   '';
 
-  patches = lib.optionals (lib.versionOlder version "3.22") [
+  patches = lib.optionals (lib.versionOlder version "22") [
     # fix protobuf-targets.cmake installation paths, and allow for CMAKE_INSTALL_LIBDIR to be absolute
     # https://github.com/protocolbuffers/protobuf/pull/10090
     (fetchpatch {
       url = "https://github.com/protocolbuffers/protobuf/commit/a7324f88e92bc16b57f3683403b6c993bf68070b.patch";
-      sha256 = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
+      hash = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
     })
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
     ./static-executables-have-no-rpath.patch
   ];
 
-  nativeBuildInputs =
-    let
-      protobufVersion = "${lib.versions.major version}_${lib.versions.minor version}";
-    in
-    [
-      cmake
-    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      # protoc of the same version must be available for build. For non-cross builds, it's able to
-      # re-use the executable generated as part of the build
-      buildPackages."protobuf${protobufVersion}"
-    ];
+  nativeBuildInputs = [
+    cmake
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # protoc of the same version must be available for build. For non-cross builds, it's able to
+    # re-use the executable generated as part of the build
+    buildPackages."protobuf_${lib.versions.major version}"
+  ];
 
   buildInputs = [
     gtest
@@ -71,23 +67,23 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
+  cmakeDir = if lib.versionOlder version "22" then "../cmake" else null;
   cmakeFlags = [
     "-Dprotobuf_USE_EXTERNAL_GTEST=ON"
     "-Dprotobuf_ABSL_PROVIDER=package"
   ] ++ lib.optionals enableShared [
     "-Dprotobuf_BUILD_SHARED_LIBS=ON"
   ]
-  # Tests fail to build on 32-bit platforms; fixed in 3.22
+  # Tests fail to build on 32-bit platforms; fixed in 22.x
   # https://github.com/protocolbuffers/protobuf/issues/10418
-  ++ lib.optionals (stdenv.targetPlatform.is32bit && lib.versionOlder version "3.22") [
+  ++ lib.optionals (stdenv.targetPlatform.is32bit && lib.versionOlder version "22") [
     "-Dprotobuf_BUILD_TESTS=OFF"
   ];
 
-  # FIXME: investigate.  3.24 and 3.23 have different errors.
+  # FIXME: investigate.  24.x and 23.x have different errors.
   # At least some of it is not reproduced on some other machine; example:
   # https://hydra.nixos.org/build/235677717/nixlog/4/tail
-  doCheck = !(stdenv.isDarwin && lib.versionAtLeast version "3.23");
+  doCheck = !(stdenv.isDarwin && lib.versionAtLeast version "23");
 
   passthru = {
     tests = {
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index e6e6b24360a..b09c7af54a5 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -46,7 +46,6 @@ let
       ./qtbase.patch.d/0009-qtbase-qtpluginpath.patch
       ./qtbase.patch.d/0010-qtbase-assert.patch
       ./qtbase.patch.d/0011-fix-header_module.patch
-      ./qtbase.patch.d/9999-backport-dbus-crash.patch
     ];
     qtdeclarative = [
       ./qtdeclarative.patch
@@ -313,7 +312,7 @@ let
         qt3d qtcharts qtconnectivity qtdeclarative qtdoc qtgraphicaleffects
         qtimageformats qtlocation qtmultimedia qtquickcontrols qtquickcontrols2
         qtscript qtsensors qtserialport qtsvg qttools qttranslations
-        qtvirtualkeyboard qtwebchannel qtwebengine qtwebkit qtwebsockets
+        qtvirtualkeyboard qtwebchannel qtwebengine qtwebsockets
         qtwebview qtx11extras qtxmlpatterns qtlottie qtdatavis3d
       ] ++ lib.optional (!stdenv.isDarwin) qtwayland
         ++ lib.optional (stdenv.isDarwin) qtmacextras);
diff --git a/pkgs/development/libraries/qt-5/5.15/modules b/pkgs/development/libraries/qt-5/5.15/modules
index d6ce8822d54..ccc7dbcb815 100644
--- a/pkgs/development/libraries/qt-5/5.15/modules
+++ b/pkgs/development/libraries/qt-5/5.15/modules
@@ -21,7 +21,6 @@ qtquickcontrols
 qtquickcontrols2
 qtquicktimeline
 qtremoteobjects
-qtscript
 qtscxml
 qtsensors
 qtserialbus
diff --git a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch
deleted file mode 100644
index e1aa0119aa2..00000000000
--- a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-commit eb0c6846a5d05d686f0686f0f1ddddcad762ad26 (HEAD -> kde/5.15)
-Author: K900 <me@0upti.me>
-Date:   Mon Aug 14 22:44:02 2023 +0300
-
-    QLibraryPrivate: Actually merge load hints
-
-    Or old and new load hints in mergeLoadHints() instead of just storing
-    new ones. Andjust QLibraryPrivate::setLoadHints() to handle objects
-    with no file name differently and just set load hints directly.
-
-    Mention that load hints are merged once the file name is set
-    in the documentation for QLibrary::setLoadHints().
-
-    Add a regression test into tst_qfactoryloader.
-
-    Update and extend tst_QPluginLoader::loadHints() to take into account
-    load hints merging.
-
-    Fixes: QTBUG-114480
-    Change-Id: I3b9afaec7acde1f5ff992d913f8d7217392c7e00
-    Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
-    Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
-
-diff --git a/src/corelib/plugin/qlibrary.cpp b/src/corelib/plugin/qlibrary.cpp
-index 5d2f024267..45b5a3fe27 100644
---- a/src/corelib/plugin/qlibrary.cpp
-+++ b/src/corelib/plugin/qlibrary.cpp
-@@ -526,7 +526,7 @@ void QLibraryPrivate::mergeLoadHints(QLibrary::LoadHints lh)
-     if (pHnd.loadRelaxed())
-         return;
-
--    loadHintsInt.storeRelaxed(lh);
-+    loadHintsInt.fetchAndOrRelaxed(lh);
- }
-
- QFunctionPointer QLibraryPrivate::resolve(const char *symbol)
-@@ -538,6 +538,13 @@ QFunctionPointer QLibraryPrivate::resolve(const char *symbol)
-
- void QLibraryPrivate::setLoadHints(QLibrary::LoadHints lh)
- {
-+    // Set the load hints directly for a dummy if this object is not associated
-+    // with a file. Such object is not shared between multiple instances.
-+    if (fileName.isEmpty()) {
-+        loadHintsInt.storeRelaxed(lh);
-+        return;
-+    }
-+
-     // this locks a global mutex
-     QMutexLocker lock(&qt_library_mutex);
-     mergeLoadHints(lh);
-@@ -1166,6 +1173,10 @@ QString QLibrary::errorString() const
-     lazy symbol resolution, and will not export external symbols for resolution
-     in other dynamically-loaded libraries.
-
-+    \note Hints can only be cleared when this object is not associated with a
-+    file. Hints can only be added once the file name is set (\a hints will
-+    be or'ed with the old hints).
-+
-     \note Setting this property after the library has been loaded has no effect
-     and loadHints() will not reflect those changes.
-
-diff --git a/src/corelib/plugin/qpluginloader.cpp b/src/corelib/plugin/qpluginloader.cpp
-index 0a63b93762..ceee5d6385 100644
---- a/src/corelib/plugin/qpluginloader.cpp
-+++ b/src/corelib/plugin/qpluginloader.cpp
-@@ -414,10 +414,11 @@ QString QPluginLoader::errorString() const
- void QPluginLoader::setLoadHints(QLibrary::LoadHints loadHints)
- {
-     if (!d) {
--        d = QLibraryPrivate::findOrCreate(QString());   // ugly, but we need a d-ptr
-+        d = QLibraryPrivate::findOrCreate({}, {}, loadHints); // ugly, but we need a d-ptr
-         d->errorString.clear();
-+    } else {
-+        d->setLoadHints(loadHints);
-     }
--    d->setLoadHints(loadHints);
- }
-
- QLibrary::LoadHints QPluginLoader::loadHints() const
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index f67f9d66da7..81712934971 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,207 +1,202 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "01aa0a9cb22ce5ed2b7ead03ed9cbeb5f978e897",
-    "sha256": "0r1bicsjn4addsf0cw2vkf26kxlf8z1fh65w19gnqmcwkrr8hnja"
+    "rev": "c1f8fa2578d99e07f5e581f26bd532695b9534f9",
+    "sha256": "19wsf9capc8i5157hfp8g735scpcms329ylp0fg86j9qalg7ccwg"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "7a04a93e97390de2d91e89dc907e8240dd5a0c4f",
-    "sha256": "1bqy5cmimnlmgd02zpv0ipf74nx350fk0d4pm2j4pqipq1spq3bh"
+    "rev": "2ed4be9e852d2533b982493a26bf061b245dc106",
+    "sha256": "0v6fwykibl4d20sdh10inaavpzwp5ijpyw8k31078shw3hsgkqxf"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "1170e17043ff51590ccee30447bef1e43a999b0d",
-    "sha256": "0qhlhz7ng35mb5pmva9ivpxq1ib30dz8f1p93yil78cyl9mwqbbi"
+    "rev": "3d30862e761afd5fe8451857bb531b6fb8f63dc3",
+    "sha256": "0sq4dgk88n96wja1wp6j5swxhz8wksf1v4sibywvg7v431nfy82p"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "e24dc54b2b4054413650904288aa7a363eee23a7",
-    "sha256": "0gpg0avl06jbamgk5f9034cfqwyifgv4nyqx49rp0r9wm2m1cgxb"
+    "rev": "ea7a183732c17005f08ca14fd70cdd305c90396d",
+    "sha256": "0lblir4zcnxc2ix9frcsygkhfs5qx7xibpflapmi6d978jjfxjmx"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "7ce22b0633eb9d1eb59854fee4f2f545e1b842e0",
-    "sha256": "0q173ql5xyacwb5lwyrzhgch1bbjq4mmsfwhyssm3a9phqcj083m"
+    "rev": "e17308d5ce83a8b66aeeaaaf16ce16d4ee6b2826",
+    "sha256": "1igna3qdwpaf67lhj0m743cj127hyg73ynjhadhjk3gz34h12r09"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "eeaf42bccd49e8161fbae82d110026d25a5a9a7f",
-    "sha256": "0daa72yizb6v28bci72fw1w8y8al0mhb9k7kxn7vg22fbb3iyksf"
+    "rev": "e33b82889625b6a72e0be91c5023a30d53136a80",
+    "sha256": "17yxmj1xd2q0a2in6aygp88bsg1vivklmzjwi97llbmvcxxvzhfn"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "d366b0aad8454355acac79eddbab445c1108b1e9",
-    "sha256": "15ad1cbfdwnl6lnafgd4chdsl9wnwfcqqnd2m0dwj10n2lsa3nmw"
+    "rev": "d7af24d26b9fbb83bf57b2b7245d280eb78e8b22",
+    "sha256": "1h85cn4qabva8fcr69b35cmy9c7vbk2fz8licw5ca42bq141k4kw"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "3e98cdb2780d052fce3d7a3694596a690cd76aca",
-    "sha256": "15fn0zjfz7jnjgc7m368sna2mvhcp33r85r2kwc9hy7zkp1is6a1"
+    "rev": "1b0e366092bcfae0392592c3b7891f0e47af1018",
+    "sha256": "0fif6gbin3clvy7rfvrs5qdjqvi3ql9yciiwdbm7z0by2kzz1qsg"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "9dfbbfb9971db22d51eb40d6636583df5913be01",
-    "sha256": "1l192k1w5mjw14zq3h3pjb3m0zl56fhgxdjfxhmbncjx0ym98wzr"
+    "rev": "c8af0c56f1765302f8bdf874dfacb11c4e0bf4e3",
+    "sha256": "161wm1pq732nnbx8jbmiv1g1ziqzjwy48dpasy3zgj4i83qyvdas"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "f90bd729eb70d4a0770efed3f9bb1b6dbe67d37c",
-    "sha256": "1vbfmyb51lv3ms0iyizi05jiba688scjwxwvyrr8qnmg4qrjqjd5"
+    "rev": "4b52913503e3713200265cd6bc19b301792dbf96",
+    "sha256": "1n5pafxarhb4rsvr18al4hyc6xmm5nhjkknrnhdldy9vz7w50bgs"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "500ae59f809877e0ada9a68601564882f2733145",
-    "sha256": "0p8vxp5l7iihd1xww94asnb9xv2v94p9whqbljzn6gwr56wvys5l"
+    "rev": "cce7d784237cd2dd4af1abe2757d048e34e02685",
+    "sha256": "1yvxpkfxd44z9z44mfv77lfsbgjlmxz1rilblpp8h276zc5w6l5z"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "5aa33ec870977863c400103db94da452edbaf414",
-    "sha256": "02i3ns2ijiiy0jfad3lxrvvlr38bgarl8246ka0y8aa8by1ih35b"
+    "rev": "b22bf4d0d77c7dafe8b4622f8bb45ac0b9cc9bdd",
+    "sha256": "0gz1par4gkcwwbxh0g1n1lrzyjjmi53gqfmbb222gkf5k8kf0r2i"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "664701dc3acfca37500bc84ba03eed4953b684e9",
-    "sha256": "0nlzjksfzkjhla89warkj7c5h8z2h5ivnhnq1sw2385gfd4q5d8w"
+    "rev": "48a17e88fc1df5b6ae82a9787466226c830bcbf2",
+    "sha256": "0gn4zsf01xr0g8divixk2zpq97dnqs1cdc3q577ijczd2rcs6z4f"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "f65b6a268832fc86e1263a6597f2e369aefecd19",
-    "sha256": "157in9bvnd9q2jigrrl955y7d2gpj308g8mg7k19r1vaz6h4zlm7"
+    "rev": "909b79f4810b8ac62baa3544837793cfb132593b",
+    "sha256": "1bh5418nshzlgc3xf8yg1c0n70xcazr3ya9fdfn1xs3yhxdxcd8h"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "ca5e5fdca44e8e56dafaac2a5bd886cad2a5c0f5",
-    "sha256": "1yrk7kj5dvfcha8w0abvh8xfjn6nbl4njm1r2h2776l3sf46xd4c"
+    "rev": "cc717d0093d796e6bafb65892e6825f146c1d3cd",
+    "sha256": "1cdal8yfjwgl30fh2s5s45hy1mw70n8bfdsbx8q6j4g062dr16zd"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "78d05cfcec57a9e890cb5ddbea604f194e04315d",
-    "sha256": "1vf0gmf6bh3hadrrk0922dbagmvxi1il3pjiyhmz087bm80km1md"
+    "rev": "f587b18db4abd68cb6d4d77fbcec1b94c38d2a51",
+    "sha256": "16b3yaq7i0cs9sw8q5f98g9kzphy3kwy0nw6hzznnzpkmg0pgkv1"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "a0f23c6a1f11bd7c6a8e4fd34f10bdb0a35789fa",
-    "sha256": "0sy2s7xnq2xmqm3lcp439wn6zk6znzja489gh531mmkaj13kiqa9"
+    "rev": "1e3f2196bd45a5ee272b08b1d82cef29aaa89b61",
+    "sha256": "1jshzvsa2nnckakiybh6q7f0wdl5p04b6mymxvjzzphr0q32qn75"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "a3e675872e4b323f89b94b90b66caa945b576b2e",
-    "sha256": "0b6da91fja6w3mphsfydp0plcwmk8nywhd5v8irgc98v1hw114dg"
+    "rev": "736144c5827385000e391e9a55a0f0162b7e8112",
+    "sha256": "1djvj4glxc360my597g81aqjmrhk46447x5s2jj81yiflppvkbny"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "353f50a9851518eb637181c00302cd354e0ae98b",
-    "sha256": "1y269yamhlf46rwcvwzhdqhajyqj41xxf9x0l1nrcr4n07l4mbr8"
+    "rev": "f3c3c2041f4800a7fc1904771f5c6af036167dc9",
+    "sha256": "1xsxhx20spj50jmsqd5f2qa7kmr9rn08c22zkckhrgic73188dpg"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "0ea7cfdfbfa72d467fe542cc48ab3206c177a387",
-    "sha256": "1bvg32cz4x00j9333yas7cmfzx8rlhika4a9vwdikrr5a64awsl9"
+    "rev": "dcc90558d9c0cba41eec7df290943994289b0e87",
+    "sha256": "0xccglsr1c519lyfg58hj6aa34zfyxc4zff360kd84yxmp8r4y9i"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "0472a07a8f39587052216d85a7ed235c531eba2c",
-    "sha256": "1psal4kldwbhfgg0b234dhgm30s5q83g2krcik1p4sifrzgrry3r"
+    "rev": "a2d56960dd76c94a5115b5415be5ee174d377718",
+    "sha256": "03wikwwf329wzml59hw0mqqzqjqfp95k8bvifi21zgrnjfl8rsrr"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "4956b556ccb021e4691f314ab907ea2ebb1ca8a6",
-    "sha256": "0d6w36pvnk616ps7k1ykpk2ahcvn746svwmv3dxvf4capfij96rj"
+    "rev": "b1b4b882dabaa036c3fb73c4a879ba8efbb02ded",
+    "sha256": "07zaziin88y5cq9xy4dsfw2y7njs92qq00mg42350g1s6zqrlbv2"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "d10e7673218fa2b00191a82ad20cd3304a711fa6",
-    "sha256": "0z5dzgdr92yw3y5vx6l9r9kz81r0vvwi264la9r7j20jqb75i2a5"
-  },
-  "qtscript": {
-    "url": "https://invent.kde.org/qt/qt/qtscript.git",
-    "rev": "4f8c35a528586541ea55bb8b3361eaa6749e52b1",
-    "sha256": "01jddzy51ks899mszz35lcdgmpl5czcgh5g9fb84pxdnpgaxrx9b"
+    "rev": "bdc316aca82769b43cb7821c10d80a1ca02b846e",
+    "sha256": "136izb42sdy42lr5amh343f97s59fwf3mv44dg5n8jwg0mg7s67b"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "7f276be586be79d41213a8dd05ef31144313d440",
-    "sha256": "0yiryqzs44nx5lg54gbs7gf5n2d5chybya71kcv0iwn48dbzy33n"
+    "rev": "e8727aabe55526956295407d27317ec15e12b283",
+    "sha256": "1gyas1prkvnmxlvb90s9qzpy1frk8c4b7n0wnjn0vkfp0cmv3w52"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "45c04582b15a9bb4be01ae99aa7fda1bbba7d0df",
-    "sha256": "0wp9ddna0zidl18707nrqsg8sybaggam0hmm9yxyyfnsr39wms4m"
+    "rev": "a41492b23cde20d1e00427d31e4637d06aea3638",
+    "sha256": "1p9w444bzgixw6a8qarznnr15ayn22k2limsi5mzqanf3j3bd3ml"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "b3081c36baee48b43b6285b4811dc6da451e2390",
-    "sha256": "167bmp5wrp9mflvzhgc2am9nnyw1vb58skdxjn7ag8jq88fhv0zz"
+    "rev": "c41785c9f36560722b917d373ee97eed8cc4089a",
+    "sha256": "05nvzh9lbkbsghpdb3q26nbxgdq5007xak8zxwd3cz9mhqy8xnyc"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "af58a4c62415fbfd997c43422acf93e2e6ab5155",
-    "sha256": "1ihjj7gqjy75ccf4qniilddyiknjklc88mxns6sy8wz3ymr58vfh"
+    "rev": "3380465d5d4977326616c5e57789a81681be650e",
+    "sha256": "06dzraplqhidkngl3sjb3sppqpvc8v8ahrjz06dnsh1dwj8hizh7"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "75142c77cda8ef3a5c1cae69863e963797c667b5",
-    "sha256": "0iaw13vx80yfcchkmrmp6n79i0i6b9rv7k69xxp3wb3l5d3n0ng0"
+    "rev": "3b163bfd46d96bc9ee848dcee49e9cabe6699287",
+    "sha256": "03d4qvxfzwcfgbjdrpq0hvnhbz8bj6diphwiywdp16kvfmp13g9f"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "37b2c764fb599c96fc415049208e871c729217c8",
-    "sha256": "11h0n9k6l4r97x6h1m09nzsblwmmkkj46nl80dnvjimb395d71ri"
+    "rev": "7d6e373c7db9c05ef586db0eb50c87cd894229ad",
+    "sha256": "1aw9xxfjhm14raj7nivrr1ljnqcmibbbjyrx4bawp58mqbq4as4x"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "9f7af2d08eea7c2a2a2bfe7e6a9b73d1b99f5123",
-    "sha256": "1vb6s9zy8nw6gd0kmk77bjvxwpnfbhaifrznp019zccckibzffsg"
+    "rev": "38ae810be3fb4984f75b55a16d3413e35d701af1",
+    "sha256": "0hc65pidlp6lnb3srr2hg3dnas3hdj9cxkp7azcndj3wi36mclwf"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "a680686754d84b91d4cc4252a2fb8af0c58f5f49",
-    "sha256": "1i92mk6f2ldwq12qa4wnlz52zya4nlpjm3r2vy95vkj69xi2bfk3"
+    "rev": "56065158ffc4cd0fd78f9edf4b21b77b969f8dbb",
+    "sha256": "1lyh8hryi6hgw50gz9l6qxjfb72k4a7cg10vw18iffi7yv262g0z"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "72373522141dd3206183eb5fa56ae1c36a6d4c2b",
-    "sha256": "1ndgy8jxn9f7dwg9kydhlbll20qdivfbvdlcxk8qpzilpccd2l3z"
+    "rev": "817378aa10176fd26eed36542bc657e48d9dd42e",
+    "sha256": "0ihgm8y19zlkp3677rp9hnzm56y74djsnpr78yk0mrbcbxv1hpwb"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "d4f650b6c29c621c58bc7b7e7c9ddcbbbc72e3b4",
-    "sha256": "11xqpj36mfyfhcip89i82dyclbkvs77byffax2kscv1kdj3x7w2l"
+    "rev": "4de268cbaf6ff3b633429577f06d3d746a3b202a",
+    "sha256": "1ris6yxd4igrjvjv7bnxkdr402lk1k0djalkbk5s4z8l4qpavn3y"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "74c0625337c8a8de0a465878c7e7d238e8d979ed",
-    "sha256": "0yz2sg8k3l88ngsgyfb6cljh8x5sicww59m447xk7yngxgyaj75m"
+    "rev": "f84887c1aee4ab04af375e639ae965c9ea2186a5",
+    "sha256": "0pn4ly4lyf0db9pfb80q45zssifjg3466hnw7ryxnm4331izvbja"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "13202e8a8c0c6d39026344b5a19a0148592160bc",
-    "sha256": "0gki7hc3684qhqbq7i4wa3w7szy3j6af0yfd50q2mxb1lbxjsdrx"
+    "rev": "ddcff45e8f2ca9f229017b3ded62327d2fb50af2",
+    "sha256": "1ybc94jidzqhrkm0v2daqq0nm34ydqpcgd8q4qhz9abi0ccj17s4"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "89fbe461e7091ae6a4689b7791293a06c9167776",
-    "sha256": "15vkh80rma5l9mrmg41vhxvqxlzqjzl8x20k33xm11lw2kjsszm5"
+    "rev": "d41bb9f4f7ab9d5ff184ef94cf2f6ff7cf01de00",
+    "sha256": "0pc14sd1dzrw599kdjg1309l9hf9ylp0pnyv7i6s2pyfqqq0x85r"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "7e941648610ff4033ae8f9709077edd0595364f0",
-    "sha256": "082w4r674fq7ks5jbh3pj3xb3sqlhn4giy7fy0h3vw170lmcqz0m"
+    "rev": "f078642eb9a440f6aa88f2beaf10f445de1e29bb",
+    "sha256": "0qak3y3qaxs6lf34y8rcp922sqd08nvag0lvl7znxm8d5b7qmnn6"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "5afc77f5347113b607ca0262505f3406e1be5bf4",
-    "sha256": "1a7dm0dxqq817pib1y6m0f09sc2cqd1qkfb9anznsgpmzynvfp6r"
+    "rev": "1bf19cc6a7972d8543485786418b6631459d3469",
+    "sha256": "09a6xacb0zsp44w5zz15lkh6sypy7y1xg7m1fkxj2n26wbdc2p52"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "74f81f0bfe17e5aabcebafcb0cf36f739133554c",
-    "sha256": "1akp4mwvfspxdq5akpyphf6p3ay0z9pzaigiiy198w9q0yvrkgl7"
+    "rev": "5fb2e067a38d3583684310130f5d8aad064f512f",
+    "sha256": "1whfsdmyihnzzy3ijh5wcbsw9ppg3s5nx2insw5yrx36iz0y054d"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "0c1dcfe344c03d48d753aeb58f139bc990f2611c",
-    "sha256": "1cab7y9asivdg9ypwc951pczf4ddgni60l1ajlfsprk48rypr7w1"
+    "rev": "5a1948ddc05bf44017ac12bd5c2b9bc79fbcb9a2",
+    "sha256": "0613zb8lzd1i2g5kbn7h39warx7hn1z5qi28zk8l88ivpn84dx4q"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 6729c7c31af..130fcd332ba 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,25 +1,18 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.10";
-  overrides = {
-    qtscript.version = "5.15.9";
-  };
+  version = "5.15.11";
 
   mk = name: args:
-    let
-      override = overrides.${name} or {};
-    in
     {
-      version = override.version or version;
-      src = override.src or
-        fetchgit {
-          inherit (args) url rev sha256;
-          fetchLFS = false;
-          fetchSubmodules = true;
-          deepClone = false;
-          leaveDotGit = false;
-        };
+      inherit version;
+      src = fetchgit {
+        inherit (args) url rev sha256;
+        fetchLFS = false;
+        fetchSubmodules = true;
+        deepClone = false;
+        leaveDotGit = false;
+      };
     };
 in
 lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
@@ -76,15 +69,26 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
     hash = "sha256-LPfBCEB5tJOljXpptsNk0sHGtJf/wIRL7fccN79Nh6o=";
   };
 
+  qtscript = rec {
+    version = "5.15.15";
+
+    src = fetchFromGitHub {
+      owner = "qt";
+      repo = "qtscript";
+      rev = "v${version}-lts";
+      hash = "sha256-o2YG1m3LuG9Kq9Bqi1wRa6ceHsivK+hJR7w08NE/kBo=";
+    };
+  };
+
   qtwebengine = rec {
-      version = "5.15.14";
+    version = "5.15.15";
 
-      src = fetchFromGitHub {
-        owner = "qt";
-        repo = "qtwebengine";
-        rev = "v${version}-lts";
-        hash = "sha256-jIoNwRdr0bZ2p0UMp/KDQuwgNjhzzGlb91UGjQgT60Y=";
-        fetchSubmodules = true;
-      };
+    src = fetchFromGitHub {
+      owner = "qt";
+      repo = "qtwebengine";
+      rev = "v${version}-lts";
+      hash = "sha256-AmW3u8D9Y8lXZu0aiuxYXNPzZ5GCXeBQGfAcgFuXAh4=";
+      fetchSubmodules = true;
     };
+  };
 }
diff --git a/pkgs/development/libraries/rapidfuzz-cpp/default.nix b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
index ec9669f3c7d..2f4a2ee6b1d 100644
--- a/pkgs/development/libraries/rapidfuzz-cpp/default.nix
+++ b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "2.0.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "maxbachmann";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gLiITRCxX3nkzrlvU1/ZPxEo2v7q79/MwrnURUjrY28=";
+    hash = "sha256-OeGn3ks+vSHt4Kdzy6kqhpFOtjoHrbPZB1BrV6Ggzz4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index c1483f90c43..9c826aa4dde 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.50";
+  version = "1.3.55";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-B+znuvQ7TTl2u4rw64ylPywfpr066Yf8Wg0qrdByGRE=";
+    hash = "sha256-d/h6vBqef4pE/6cb1bQboIXAAMRxdAALKHUVW07jOlE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 950402315a9..3fc533e848d 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -141,7 +141,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.21";
+  version = "0.3.24";
 
   outputs = [ "out" "dev" ];
 
@@ -149,18 +149,9 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-F6cXPqQai4kA5zrsa8E0Q7dD9zZHlwZ+B16EOGNXoXs=";
+    sha256 = "sha256-IuXhrZRB3o7kbnivv/6En/aAeF2F18sQw9pKs1WEJc4=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isLoongArch64 [
-    # https://github.com/xianyi/OpenBLAS/pull/3626
-    (fetchpatch {
-      name = "openblas-0.3.21-fix-loong.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sci-libs/openblas/files/openblas-0.3.21-fix-loong.patch?id=37ee4c70278eb41181f69e175575b0152b941655";
-      hash = "sha256-iWy11l3wEvzNV08LbhOjnSPj1SjPH8RMnb3ORz7V+gc";
-    })
-  ];
-
   postPatch = ''
     # cc1: error: invalid feature modifier 'sve2' in '-march=armv8.5-a+sve+sve2+bf16'
     substituteInPlace Makefile.arm64 --replace "+sve2+bf16" ""
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 44ad21d6a14..3e18424d6b7 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.261.0";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
-    rev = "sdk-${version}";
-    hash = "sha256-P/ZD53Xa4Fk9+N/bW5HhsfA+LjUnCbBsQDHvXesKu5M=";
+    rev = "vulkan-sdk-${version}";
+    hash = "sha256-uOnSTih14bUPtrJgp7vVb3/UfdKsF6jFQqjlFeJ81AI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index f51ce3a5000..ec4cc458c4b 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.43.1";
+  version = "3.43.2";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-ORFslOdmMPItVM2Cw86jCFZfFxX3FtGyUn8cnJabpNk=";
+    hash = "sha256-bUIrb2LE3iyoDWGGDjo/tpNVTS91uxqsp0PMxNb2CfA=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 31207ad9edf..6028c638a7e 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.43.1";
+    version = "3.43.2";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-IunC70n+b4otvJPE09zgnG1qT1Y95SsKgXGtSajHKRc=";
+      hash = "sha256-62ZRUj9XpccPJC/Ba8QWuB7QLVkmOb+34JnyAeL5otM=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/ti-rpc/default.nix b/pkgs/development/libraries/ti-rpc/default.nix
index 0e67ce8adea..c12178d833d 100644
--- a/pkgs/development/libraries/ti-rpc/default.nix
+++ b/pkgs/development/libraries/ti-rpc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libtirpc";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchurl {
-    url = "http://git.linux-nfs.org/?p=steved/libtirpc.git;a=snapshot;h=0fb94eef5062d2657d75eee686fa47238fafa312;sf=tgz";
-    sha256 = "sha256-3P3xYKeAmLbBI4TdsG1VZBO7py9ktiwhXNtGsnryGNI=";
+    url = "http://git.linux-nfs.org/?p=steved/libtirpc.git;a=snapshot;h=refs/tags/libtirpc-${lib.replaceStrings ["."] ["-"] version};sf=tgz";
+    sha256 = "sha256-fmZxpdyl98z+QBHpEccGB8A+YktuWONw6k0p06AImDw=";
     name = "${pname}-${version}.tar.gz";
   };
 
@@ -15,11 +15,14 @@ stdenv.mkDerivation rec {
   KRB5_CONFIG = "${libkrb5.dev}/bin/krb5-config";
   nativeBuildInputs = [ autoreconfHook ];
   propagatedBuildInputs = [ libkrb5 ];
+  strictDeps = true;
 
   preConfigure = ''
     sed -es"|/etc/netconfig|$out/etc/netconfig|g" -i doc/Makefile.in tirpc/netconfig.h
   '';
 
+  enableParallelBuilding = true;
+
   preInstall = ''
     mkdir -p $out/etc
   '';
diff --git a/pkgs/development/libraries/usrsctp/clang-fix-build.patch b/pkgs/development/libraries/usrsctp/clang-fix-build.patch
new file mode 100644
index 00000000000..eb136e8be30
--- /dev/null
+++ b/pkgs/development/libraries/usrsctp/clang-fix-build.patch
@@ -0,0 +1,183 @@
+diff --git a/usrsctplib/netinet/sctp_cc_functions.c b/usrsctplib/netinet/sctp_cc_functions.c
+index 57bcdaa..70cf8b7 100755
+--- a/usrsctplib/netinet/sctp_cc_functions.c
++++ b/usrsctplib/netinet/sctp_cc_functions.c
+@@ -764,7 +764,7 @@ sctp_cwnd_update_after_sack_common(struct sctp_tcb *stcb,
+ #if defined(__FreeBSD__) && !defined(__Userspace__)
+ 	int old_cwnd;
+ #endif
+-	uint32_t t_ssthresh, t_cwnd, incr;
++	uint32_t t_ssthresh, incr;
+ 	uint64_t t_ucwnd_sbw;
+ 	uint64_t t_path_mptcp;
+ 	uint64_t mptcp_like_alpha;
+@@ -773,7 +773,6 @@ sctp_cwnd_update_after_sack_common(struct sctp_tcb *stcb,
+ 
+ 	/* MT FIXME: Don't compute this over and over again */
+ 	t_ssthresh = 0;
+-	t_cwnd = 0;
+ 	t_ucwnd_sbw = 0;
+ 	t_path_mptcp = 0;
+ 	mptcp_like_alpha = 1;
+@@ -783,7 +782,6 @@ sctp_cwnd_update_after_sack_common(struct sctp_tcb *stcb,
+ 		max_path = 0;
+ 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
+ 			t_ssthresh += net->ssthresh;
+-			t_cwnd += net->cwnd;
+ 			/* lastsa>>3;  we don't need to devide ...*/
+ 			srtt = net->lastsa;
+ 			if (srtt > 0) {
+diff --git a/usrsctplib/netinet/sctp_indata.c b/usrsctplib/netinet/sctp_indata.c
+index 3bce9e9..42ce111 100755
+--- a/usrsctplib/netinet/sctp_indata.c
++++ b/usrsctplib/netinet/sctp_indata.c
+@@ -3320,7 +3320,6 @@ sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
+ 	struct sctp_tmit_chunk *tp1;
+ 	int strike_flag = 0;
+ 	struct timeval now;
+-	int tot_retrans = 0;
+ 	uint32_t sending_seq;
+ 	struct sctp_nets *net;
+ 	int num_dests_sacked = 0;
+@@ -3691,7 +3690,6 @@ sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
+ 			}
+ 
+ 			tp1->rec.data.doing_fast_retransmit = 1;
+-			tot_retrans++;
+ 			/* mark the sending seq for possible subsequent FR's */
+ 			/*
+ 			 * SCTP_PRINTF("Marking TSN for FR new value %x\n",
+diff --git a/usrsctplib/netinet/sctp_output.c b/usrsctplib/netinet/sctp_output.c
+index 6a7dff9..a914b3b 100755
+--- a/usrsctplib/netinet/sctp_output.c
++++ b/usrsctplib/netinet/sctp_output.c
+@@ -9970,7 +9970,7 @@ sctp_chunk_retransmission(struct sctp_inpcb *inp,
+ 	struct mbuf *m, *endofchain;
+ 	struct sctp_nets *net = NULL;
+ 	uint32_t tsns_sent = 0;
+-	int no_fragmentflg, bundle_at, cnt_thru;
++	int no_fragmentflg, bundle_at;
+ 	unsigned int mtu;
+ 	int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
+ 	struct sctp_auth_chunk *auth = NULL;
+@@ -10046,7 +10046,6 @@ sctp_chunk_retransmission(struct sctp_inpcb *inp,
+ 		}
+ 	}
+ 	one_chunk = 0;
+-	cnt_thru = 0;
+ 	/* do we have control chunks to retransmit? */
+ 	if (m != NULL) {
+ 		/* Start a timer no matter if we succeed or fail */
+@@ -10368,7 +10367,6 @@ sctp_chunk_retransmission(struct sctp_inpcb *inp,
+ 			/* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */
+ 
+ 			/* For auto-close */
+-			cnt_thru++;
+ 			if (*now_filled == 0) {
+ 				(void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
+ 				*now = asoc->time_last_sent;
+@@ -13416,7 +13414,7 @@ sctp_lower_sosend(struct socket *so,
+ 	struct epoch_tracker et;
+ #endif
+ 	ssize_t sndlen = 0, max_len, local_add_more;
+-	int error, len;
++	int error;
+ 	struct mbuf *top = NULL;
+ 	int queue_only = 0, queue_only_for_init = 0;
+ 	int free_cnt_applied = 0;
+@@ -14035,7 +14033,6 @@ sctp_lower_sosend(struct socket *so,
+ 		 */
+ 		local_add_more = sndlen;
+ 	}
+-	len = 0;
+ 	if (non_blocking) {
+ 		goto skip_preblock;
+ 	}
+@@ -14265,7 +14262,6 @@ skip_preblock:
+ 				}
+ 				sctp_snd_sb_alloc(stcb, sndout);
+ 				atomic_add_int(&sp->length, sndout);
+-				len += sndout;
+ 				if (sinfo_flags & SCTP_SACK_IMMEDIATELY) {
+ 					sp->sinfo_flags |= SCTP_SACK_IMMEDIATELY;
+ 				}
+diff --git a/usrsctplib/netinet/sctp_pcb.c b/usrsctplib/netinet/sctp_pcb.c
+index 89a66bc..a952921 100755
+--- a/usrsctplib/netinet/sctp_pcb.c
++++ b/usrsctplib/netinet/sctp_pcb.c
+@@ -7943,7 +7943,7 @@ sctp_drain_mbufs(struct sctp_tcb *stcb)
+ }
+ 
+ void
+-sctp_drain()
++sctp_drain(void)
+ {
+ 	/*
+ 	 * We must walk the PCB lists for ALL associations here. The system
+diff --git a/usrsctplib/netinet/sctp_sysctl.c b/usrsctplib/netinet/sctp_sysctl.c
+index bb49e17..8b77f7e 100755
+--- a/usrsctplib/netinet/sctp_sysctl.c
++++ b/usrsctplib/netinet/sctp_sysctl.c
+@@ -61,7 +61,7 @@ FEATURE(sctp, "Stream Control Transmission Protocol");
+  */
+ 
+ void
+-sctp_init_sysctls()
++sctp_init_sysctls(void)
+ {
+ 	SCTP_BASE_SYSCTL(sctp_sendspace) = SCTPCTL_MAXDGRAM_DEFAULT;
+ 	SCTP_BASE_SYSCTL(sctp_recvspace) = SCTPCTL_RECVSPACE_DEFAULT;
+diff --git a/usrsctplib/user_socket.c b/usrsctplib/user_socket.c
+index 513a5a9..89e9eb2 100755
+--- a/usrsctplib/user_socket.c
++++ b/usrsctplib/user_socket.c
+@@ -2857,7 +2857,6 @@ sctp_userspace_ip_output(int *result, struct mbuf *o_pak,
+ 	struct mbuf *m_orig;
+ 	int iovcnt;
+ 	int len;
+-	int send_count;
+ 	struct ip *ip;
+ 	struct udphdr *udp;
+ 	struct sockaddr_in dst;
+@@ -2930,16 +2929,13 @@ sctp_userspace_ip_output(int *result, struct mbuf *o_pak,
+ 		m_adj(m, sizeof(struct ip) + sizeof(struct udphdr));
+ 	}
+ 
+-	send_count = 0;
+ 	for (iovcnt = 0; m != NULL && iovcnt < MAXLEN_MBUF_CHAIN; m = m->m_next, iovcnt++) {
+ #if !defined(_WIN32)
+ 		send_iovec[iovcnt].iov_base = (caddr_t)m->m_data;
+ 		send_iovec[iovcnt].iov_len = SCTP_BUF_LEN(m);
+-		send_count += send_iovec[iovcnt].iov_len;
+ #else
+ 		send_iovec[iovcnt].buf = (caddr_t)m->m_data;
+ 		send_iovec[iovcnt].len = SCTP_BUF_LEN(m);
+-		send_count += send_iovec[iovcnt].len;
+ #endif
+ 	}
+ 
+@@ -3002,7 +2998,6 @@ void sctp_userspace_ip6_output(int *result, struct mbuf *o_pak,
+ 	struct mbuf *m_orig;
+ 	int iovcnt;
+ 	int len;
+-	int send_count;
+ 	struct ip6_hdr *ip6;
+ 	struct udphdr *udp;
+ 	struct sockaddr_in6 dst;
+@@ -3076,16 +3071,13 @@ void sctp_userspace_ip6_output(int *result, struct mbuf *o_pak,
+ 	  m_adj(m, sizeof(struct ip6_hdr));
+ 	}
+ 
+-	send_count = 0;
+ 	for (iovcnt = 0; m != NULL && iovcnt < MAXLEN_MBUF_CHAIN; m = m->m_next, iovcnt++) {
+ #if !defined(_WIN32)
+ 		send_iovec[iovcnt].iov_base = (caddr_t)m->m_data;
+ 		send_iovec[iovcnt].iov_len = SCTP_BUF_LEN(m);
+-		send_count += send_iovec[iovcnt].iov_len;
+ #else
+ 		send_iovec[iovcnt].buf = (caddr_t)m->m_data;
+ 		send_iovec[iovcnt].len = SCTP_BUF_LEN(m);
+-		send_count += send_iovec[iovcnt].len;
+ #endif
+ 	}
+ 	if (m != NULL) {
diff --git a/pkgs/development/libraries/usrsctp/default.nix b/pkgs/development/libraries/usrsctp/default.nix
index af8979c79d1..9723f887b82 100644
--- a/pkgs/development/libraries/usrsctp/default.nix
+++ b/pkgs/development/libraries/usrsctp/default.nix
@@ -11,6 +11,13 @@ stdenv.mkDerivation rec {
     sha256 = "10ndzkip8blgkw572n3dicl6mgjaa7kygwn3vls80liq92vf1sa9";
   };
 
+  patches = [
+    # usrsctp fails to build with clang 15+ due to set but unused variable and missing prototype
+    # errors. These issues are fixed in the master branch, but a new release with them has not
+    # been made. The following patch can be dropped once a release has been made.
+    ./clang-fix-build.patch
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   # https://github.com/sctplab/usrsctp/issues/662
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index 48e036ad030..f6c9dcb953e 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.261";
+  version = "1.3.268.0";
 
   nativeBuildInputs = [ cmake ];
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
-    rev = "v${version}";
-    hash = "sha256-zKHew7SGUq1C3XGp/HrCle6KyqB4cziPcTYVqAr814s=";
+    rev = "vulkan-sdk-${version}";
+    hash = "sha256-CDjWTXXnUgj9QaLDNuSVy+wf8If5LehwOZ0t0Fuh2Ro=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/development/libraries/vulkan-headers/update.sh b/pkgs/development/libraries/vulkan-headers/update.sh
index 7f6292ed23b..da4e42ded84 100755
--- a/pkgs/development/libraries/vulkan-headers/update.sh
+++ b/pkgs/development/libraries/vulkan-headers/update.sh
@@ -3,7 +3,7 @@
 
 set -euf -o pipefail
 
-V_PACKAGES=(
+SDK_PACKAGES=(
     "vulkan-headers"
     "vulkan-loader"
     "vulkan-validation-layers"
@@ -11,9 +11,6 @@ V_PACKAGES=(
     "vulkan-tools-lunarg"
     "vulkan-extension-layer"
     "vulkan-utility-libraries"
-)
-
-SDK_PACKAGES=(
     "spirv-headers"
     "spirv-cross"
     "spirv-tools"
@@ -21,10 +18,6 @@ SDK_PACKAGES=(
 
 nix-update glslang --version-regex '(\d+\.\d+\.\d+)' --commit
 
-for P in "${V_PACKAGES[@]}"; do
-    nix-update "$P" --version-regex "(?:v)(.*)" --commit
-done
-
 for P in "${SDK_PACKAGES[@]}"; do
-    nix-update "$P" --version-regex "(?:sdk-)(.*)" --commit
+    nix-update "$P" --version-regex "(?:vulkan-sdk-)(.*)" --commit
 done
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 6e994eaa78c..163cea7565c 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.261";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
-    rev = "v${version}";
-    hash = "sha256-5QCVHfvjE98EnL2Dr7g9fdrJAg+np1Q6hgqcuZCWReQ=";
+    rev = "vulkan-sdk-${version}";
+    hash = "sha256-TDn8eVz1fhGfvUiGcxqOk2BN9tuIF5+ssIXtOo3weS0=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch b/pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch
index 42295a67d46..b9c5e8ad453 100644
--- a/pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch
+++ b/pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch
@@ -5,8 +5,8 @@ index 153815577..584b15273 100644
 @@ -1,7 +1,5 @@
 -prefix=@CMAKE_INSTALL_PREFIX@
 -exec_prefix=${prefix}
--libdir=${exec_prefix}/@CMAKE_INSTALL_REL_LIBDIR_PC@
--includedir=${prefix}/@CMAKE_INSTALL_REL_INCLUDEDIR_PC@
+-libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR_PC@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR_PC@
 +libdir=@CMAKE_INSTALL_LIBDIR@
 +includedir=@CMAKE_INSTALL_INCLUDEDIR@
 
diff --git a/pkgs/development/libraries/vulkan-utility-libraries/default.nix b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
index 54e7afb3e58..fe967ef1a2a 100644
--- a/pkgs/development/libraries/vulkan-utility-libraries/default.nix
+++ b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.3.261";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-szkBKNcxTHMYhhHFWr5WjD91Vf/AyZaGymvlDU9ff7s=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-O1agpzZpXiQZFYx1jPosIhxJovZtfZSLBNFj1LVB1VI=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/libraries/webrtc-audio-processing/default.nix b/pkgs/development/libraries/webrtc-audio-processing/default.nix
index 2c1e15bfbef..c3f7d2591ac 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/default.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-8CDt4kMt2Owzyv22dqWIcFuHeg4Y3FxB405cLw3FZ+g=";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/wtk/builder.sh b/pkgs/development/libraries/wtk/builder.sh
index c3ad173b093..ca5157c6d71 100644
--- a/pkgs/development/libraries/wtk/builder.sh
+++ b/pkgs/development/libraries/wtk/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 mkdir unzipped
diff --git a/pkgs/development/libraries/wxSVG/default.nix b/pkgs/development/libraries/wxSVG/default.nix
index 7b018c89f50..5e9b9f2fcb7 100644
--- a/pkgs/development/libraries/wxSVG/default.nix
+++ b/pkgs/development/libraries/wxSVG/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , cairo
+, expat
 , ffmpeg
 , libexif
 , pango
@@ -28,6 +29,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     cairo
+    expat
     ffmpeg
     libexif
     pango
diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index 9fa429f9a4c..6a0e173db3a 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , asciidoc
 , pkg-config
@@ -11,25 +10,15 @@
 
 stdenv.mkDerivation rec {
   pname = "zeromq";
-  version = "4.3.4";
+  version = "4.3.5";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "libzmq";
     rev = "v${version}";
-    sha256 = "sha256-epOEyHOswUGVwzz0FLxhow/zISmZHxsIgmpOV8C8bQM=";
+    sha256 = "sha256-q2h5y0Asad+fGB9haO4Vg7a1ffO2JSb7czzlhmT3VmI=";
   };
 
-  patches = [
-    # Backport gcc-13 fix:
-    #   https://github.com/zeromq/libzmq/pull/4480
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/zeromq/libzmq/commit/438d5d88392baffa6c2c5e0737d9de19d6686f0d.patch";
-      hash = "sha256-tSTYSrQzgnfbY/70QhPdOnpEXX05VAYwVYuW8P1LWf0=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake asciidoc pkg-config ];
   buildInputs = [ libsodium ];
 
@@ -41,7 +30,7 @@ stdenv.mkDerivation rec {
     branch = "4";
     homepage = "http://www.zeromq.org";
     description = "The Intelligent Transport Layer";
-    license = licenses.lgpl3Plus;
+    license = licenses.mpl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ fpletz ];
   };
diff --git a/pkgs/development/lua-modules/aliases.nix b/pkgs/development/lua-modules/aliases.nix
index 47a097fd7f7..8f4ed9799c2 100644
--- a/pkgs/development/lua-modules/aliases.nix
+++ b/pkgs/development/lua-modules/aliases.nix
@@ -39,5 +39,6 @@ let
 in
 
 mapAliases {
-  "lpty" = throw "lpy was removed because broken and unmaintained "; # added 2023-10-14
+  lpty = throw "lpy was removed because broken and unmaintained "; # added 2023-10-14
+  cyrussasl = throw "cyrussasl was removed because broken and unmaintained "; # added 2023-10-18
 }
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 1f4baeaa618..9d265967462 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -5,10 +5,10 @@ nixpkgs$ ./maintainers/scripts/update-luarocks-packages
 You can customize the generated packages in pkgs/development/lua-modules/overrides.nix
 */
 
-{ stdenv, lib, fetchurl, fetchgit, callPackage, ... } @ args:
+{ stdenv, lib, fetchurl, fetchgit, callPackage, ... }:
 final: prev:
 {
-alt-getopt = callPackage({ luaAtLeast, lua, luaOlder, fetchgit, buildLuarocksPackage }:
+alt-getopt = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "alt-getopt";
   version = "0.8.0-1";
@@ -22,12 +22,13 @@ buildLuarocksPackage {
   "date": "2017-01-06T13:50:55+03:00",
   "path": "/nix/store/z72v77cw9188408ynsppwhlzii2dr740-lua-alt-getopt",
   "sha256": "1kq7r5668045diavsqd1j6i9hxdpsk99w8q4zr8cby9y3ws4q6rv",
+  "hash": "sha256-OxtMNB8++cVQ/gQjntLUt3WYopGhYb1VbIUAZEzJB88=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -40,23 +41,18 @@ buildLuarocksPackage {
   };
 }) {};
 
-argparse = callPackage({ luaOlder, buildLuarocksPackage, luaAtLeast, lua, fetchgit }:
+argparse = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "argparse";
-  version = "scm-2";
-
-  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/luarocks/argparse.git",
-  "rev": "27967d7b52295ea7885671af734332038c132837",
-  "date": "2020-07-08T11:17:50+10:00",
-  "path": "/nix/store/vjm6c826hgvj7h7vqlbgkfpvijsd8yaf-argparse",
-  "sha256": "0idg79d0dfis4qhbkbjlmddq87np75hb2vj41i6prjpvqacvg5v1",
-  "fetchLFS": false,
-  "fetchSubmodules": true,
-  "deepClone": false,
-  "leaveDotGit": false
-}
- '') ["date" "path"]) ;
+  version = "0.7.1-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/argparse-0.7.1-1.rockspec";
+    sha256 = "116iaczq6glzzin6qqa2zn7i22hdyzzsq6mzjiqnz6x1qmi0hig8";
+  }).outPath;
+  src = fetchzip {
+    url    = "https://github.com/luarocks/argparse/archive/0.7.1.zip";
+    sha256 = "0idg79d0dfis4qhbkbjlmddq87np75hb2vj41i6prjpvqacvg5v1";
+  };
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -68,15 +64,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-basexx = callPackage({ buildLuarocksPackage, lua, fetchurl, luaOlder }:
+basexx = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "basexx";
-  version = "scm-0";
-  rockspecDir = "dist";
-
+  version = "0.4.1-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/basexx-0.4.1-1.rockspec";
+    sha256 = "0kmydxm2wywl18cgj303apsx7hnfd68a9hx9yhq10fj7yfcxzv5f";
+  }).outPath;
   src = fetchurl {
-    url    = "https://github.com/aiq/basexx/archive/master.tar.gz";
-    sha256 = "1x0d24aaj4zld4ifr7mi8zwrym5shsfphmwx5jzw2zg22r6xzlz1";
+    url    = "https://github.com/aiq/basexx/archive/v0.4.1.tar.gz";
+    sha256 = "1rnz6xixxqwy0q6y2hi14rfid4w47h69gfi0rnlq24fz8q2b0qpz";
   };
 
   disabled = (luaOlder "5.1");
@@ -89,11 +87,14 @@ buildLuarocksPackage {
   };
 }) {};
 
-binaryheap = callPackage({ buildLuarocksPackage, lua, fetchurl, luaOlder }:
+binaryheap = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "binaryheap";
   version = "0.4-1";
-
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/binaryheap-0.4-1.rockspec";
+    sha256 = "1ah37lhskmrb26by5ygs7jblx7qnf6mphgw8kwhw0yacvmkcbql4";
+  }).outPath;
   src = fetchurl {
     url    = "https://github.com/Tieske/binaryheap.lua/archive/version_0v4.tar.gz";
     sha256 = "0f5l4nb5s7dycbkgh3rrl7pf0npcf9k6m2gr2bsn09fjyb3bdc8h";
@@ -110,7 +111,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-bit32 = callPackage({ fetchgit, buildLuarocksPackage, lua, luaOlder }:
+bit32 = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "bit32";
   version = "5.3.0-1";
@@ -124,12 +125,13 @@ buildLuarocksPackage {
   "date": "2015-02-17T10:44:04+01:00",
   "path": "/nix/store/9kz7kgjmq0w9plrpha866bmwsgp4rfhn-lua-compat-5.2",
   "sha256": "1ipqlbvb5w394qwhm2f3w6pdrgy8v4q8sps5hh3pqz14dcqwakhj",
+  "hash": "sha256-Ek7FMWskfHwHhEVfjTDZyL/cruHDiQo5Jmnwsvai+MY=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -142,26 +144,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-busted = callPackage({ buildLuarocksPackage, luafilesystem, luasystem, fetchgit, luaOlder, lua-term, say, mediator_lua, penlight, luassert, lua_cliargs, lua, dkjson }:
+busted = callPackage({ buildLuarocksPackage, dkjson, fetchgit, fetchurl, lua, lua-term, luaOlder, lua_cliargs, luafilesystem, luassert, luasystem, mediator_lua, penlight, say }:
 buildLuarocksPackage {
   pname = "busted";
-  version = "2.1.1-1";
+  version = "2.1.2-3";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/busted-2.1.1-1.rockspec";
-    sha256 = "0f9iz3pa2gmb2vccvygp6zdiji7l8bap0vlgqgrcg331qsrkf70h";
+    url    = "mirror://luarocks/busted-2.1.2-3.rockspec";
+    sha256 = "0ll8jzbpp6a9zdbbjglmq30jmx2zvr0rs83jgsjxmlfzzylkry8p";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/busted.git",
-  "rev": "e3ed48759b625f2e37bf02ccc057b2b98108f108",
-  "date": "2022-08-24T17:34:58+03:00",
-  "path": "/nix/store/7g9rxkyhabgx0acwmzl4r4xfh193avpw-busted",
-  "sha256": "0nab0s5lhk0nhh58c4jspv5sj4g7839gb5q145hrlgbsxqncp8wy",
+  "rev": "673cb6bad2ee3876d45e004fcac1c2f8a816344f",
+  "date": "2023-03-20T10:00:33+01:00",
+  "path": "/nix/store/k7xnpg0s36gxk5mb59wx1dj8ikiz92ja-busted",
+  "sha256": "1wsiiiw26yqglqkkailksinzcb9gaffcldrcfhga3zawf2518h8y",
+  "hash": "sha256-HkEUinBc/aEedCw3ypxTLy32bdSTRjUnpg97I3iMUfM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ dkjson lua lua-term lua_cliargs luafilesystem luassert luasystem mediator_lua penlight say ];
@@ -173,7 +176,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cassowary = callPackage({ buildLuarocksPackage, fetchgit, penlight, luaOlder, lua }:
+cassowary = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, penlight }:
 buildLuarocksPackage {
   pname = "cassowary";
   version = "2.3.2-1";
@@ -187,12 +190,13 @@ buildLuarocksPackage {
   "date": "2022-04-22T11:23:46+03:00",
   "path": "/nix/store/51mb376xh9pnh2krk08ljmy01zhr9y3z-cassowary.lua",
   "sha256": "1lvl40dhzmbqqjrqpjgqlg2kl993fpdy1mpc6d1610zpa9znx1f0",
+  "hash": "sha256-wIVuf1L3g2BCM+zW4Nt1IyU6xaP4yYuzxHjVDxsgdNM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua penlight ];
@@ -205,7 +209,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cldr = callPackage({ penlight, luaOlder, lua, fetchgit, buildLuarocksPackage }:
+cldr = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, penlight }:
 buildLuarocksPackage {
   pname = "cldr";
   version = "0.3.0-0";
@@ -219,12 +223,13 @@ buildLuarocksPackage {
   "date": "2022-12-06T12:36:06+03:00",
   "path": "/nix/store/3xgwqd2pica8301sbfrw4bmv0xm2wzx5-cldr-lua",
   "sha256": "0hlfb115qhamczzskvckxczf9dpp8cv8h6vz7zgdl2n025ik9dp4",
+  "hash": "sha256-5LY0YxHACtreP38biDZD97bkPuuT7an/Z1VBXEJYjkI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua penlight ];
@@ -237,7 +242,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-compat53 = callPackage({ lua, luaAtLeast, fetchzip, luaOlder, buildLuarocksPackage }:
+compat53 = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "compat53";
   version = "0.7-1";
@@ -261,7 +266,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cosmo = callPackage({ buildLuarocksPackage, fetchgit, lpeg }:
+cosmo = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lpeg }:
 buildLuarocksPackage {
   pname = "cosmo";
   version = "16.06.04-1";
@@ -275,12 +280,13 @@ buildLuarocksPackage {
   "date": "2016-06-17T05:39:58-07:00",
   "path": "/nix/store/k3p4xc4cfihp4h8aj6vacr25rpcsjd96-cosmo",
   "sha256": "03b5gwsgxd777970d2h6rx86p7ivqx7bry8xmx2r396g3w85qy2p",
+  "hash": "sha256-V3hcEB/PpJFFrx35vE7HO55rUM8GigZOOue0/jR/ZQ0=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ lpeg ];
 
@@ -292,7 +298,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-coxpcall = callPackage({ buildLuarocksPackage, fetchgit }:
+coxpcall = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "coxpcall";
   version = "1.17.0-1";
@@ -306,12 +312,13 @@ buildLuarocksPackage {
   "date": "2018-02-26T19:53:11-03:00",
   "path": "/nix/store/1q4p5qvr6rlwisyarlgnmk4dx6vp8xdl-coxpcall",
   "sha256": "1k3q1rr2kavkscf99b5njxhibhp6iwhclrjk6nnnp233iwc2jvqi",
+  "hash": "sha256-EW8pGI9jiGutNVNmyiCP5sIVYZe2rJQc03OrKXIOeMw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
 
   meta = {
@@ -321,7 +328,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cqueues = callPackage({ fetchurl, buildLuarocksPackage, lua }:
+cqueues = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "cqueues";
   version = "20200726.52-0";
@@ -345,7 +352,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cyan = callPackage({ argparse, buildLuarocksPackage, tl, fetchgit, luafilesystem }:
+cyan = callPackage({ argparse, buildLuarocksPackage, fetchgit, fetchurl, luafilesystem, tl }:
 buildLuarocksPackage {
   pname = "cyan";
   version = "0.3.0-1";
@@ -359,12 +366,13 @@ buildLuarocksPackage {
   "date": "2023-02-19T18:58:20-06:00",
   "path": "/nix/store/smpj81z2a2blb3qfpjwx9n52d50rp39w-cyan",
   "sha256": "0pskargvjn2phgz481b08ndhp3z23s7lqfs8qlwailr7a4f2fc7h",
+  "hash": "sha256-8DAnHFEn06g4xUg7TI8e4o8Lm0VgBUT+g1dYuV9WU18=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ argparse luafilesystem tl ];
 
@@ -375,51 +383,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-cyrussasl = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchgit }:
-buildLuarocksPackage {
-  pname = "cyrussasl";
-  version = "1.1.0-1";
-
-  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/JorjBauer/lua-cyrussasl",
-  "rev": "78ceec610da76d745d0eff4e21a4fb24832aa72d",
-  "date": "2015-08-21T18:24:54-04:00",
-  "path": "/nix/store/s7n7f80pz8k6lvfav55a5rwy5l45vs4l-lua-cyrussasl",
-  "sha256": "14kzm3vk96k2i1m9f5zvpvq4pnzaf7s91h5g4h4x2bq1mynzw2s1",
-  "fetchLFS": false,
-  "fetchSubmodules": true,
-  "deepClone": false,
-  "leaveDotGit": false
-}
- '') ["date" "path"]) ;
-
-  disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua ];
-
-  meta = {
-    homepage = "http://github.com/JorjBauer/lua-cyrussasl";
-    description = "Cyrus SASL library for Lua 5.1+";
-    license.fullName = "BSD";
-  };
-}) {};
-
-digestif = callPackage({ luafilesystem, fetchgit, lpeg, lua, buildLuarocksPackage, luaOlder }:
+digestif = callPackage({ buildLuarocksPackage, fetchgit, lpeg, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "digestif";
   version = "dev-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/astoff/digestif",
-  "rev": "8f8448fa3f27611b32fe6398fe22ef24b8602ec9",
-  "date": "2023-02-24T22:38:11+01:00",
-  "path": "/nix/store/s7wxqcj3k8pgb3m86d8rs2ggpl63jxwn-digestif",
-  "sha256": "0k3srmilrz3ajj76kklksmifkgqrm0y7gr25h0vrrldrf1xp4pk0",
+  "rev": "c0199f9cd86021c0a89662002d7a3411d12fb168",
+  "date": "2023-03-10T15:04:26+01:00",
+  "path": "/nix/store/3s849fwc80lf7pvgsiavqmvc5538cwwd-digestif",
+  "sha256": "0xccrrfwvcj03nnrzs3iwig7y2ahl706h413hkywcplyd5407dv9",
+  "hash": "sha256-abcDSGmeXsb9hCMQaMChUAl/XuRx6J+tHUCyzV3OjHU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.3");
   propagatedBuildInputs = [ lpeg lua luafilesystem ];
@@ -431,7 +412,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-dkjson = callPackage({ buildLuarocksPackage, lua, luaAtLeast, luaOlder, fetchurl }:
+dkjson = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "dkjson";
   version = "2.6-1";
@@ -454,17 +435,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-fennel = callPackage({ luaOlder, buildLuarocksPackage, fetchurl, lua }:
+fennel = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "fennel";
-  version = "1.3.0-1";
+  version = "1.3.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fennel-1.3.0-1.rockspec";
-    sha256 = "1by78423n8k8i5sz7ji6w5igm8jkmyvd5x1y519hzmknphjqa263";
+    url    = "mirror://luarocks/fennel-1.3.1-1.rockspec";
+    sha256 = "1dsavrsvngwx8vf1l2sj44arvip3bqkhsfh2sdkwa6r9mnw9zx87";
   }).outPath;
   src = fetchurl {
-    url    = "https://fennel-lang.org/downloads/fennel-1.3.0.tar.gz";
-    sha256 = "0m754c74pj10c1qmc4zl89ifjiqcwafn8qagzfpfmcqv6r46pr23";
+    url    = "https://fennel-lang.org/downloads/fennel-1.3.1.tar.gz";
+    sha256 = "1c7iwyc9f3a9k34fjq77zjk0minl3bl3f7wqlj8i1n2x7598nzgx";
   };
 
   disabled = (luaOlder "5.1");
@@ -478,7 +459,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-fifo = callPackage({ fetchzip, lua, buildLuarocksPackage }:
+fifo = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua }:
 buildLuarocksPackage {
   pname = "fifo";
   version = "0.2-0";
@@ -500,7 +481,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-fluent = callPackage({ lua, luaepnf, fetchgit, cldr, buildLuarocksPackage, penlight, luaOlder }:
+fluent = callPackage({ buildLuarocksPackage, cldr, fetchgit, fetchurl, lua, luaOlder, luaepnf, penlight }:
 buildLuarocksPackage {
   pname = "fluent";
   version = "0.2.0-0";
@@ -514,12 +495,13 @@ buildLuarocksPackage {
   "date": "2022-04-16T23:08:20+03:00",
   "path": "/nix/store/flxlnrzg6rx75qikiggmy494npx59p0b-fluent-lua",
   "sha256": "12js8l4hcxhziza0sry0f01kfm8f8m6kx843dmcky36z1y2mccmq",
+  "hash": "sha256-uDJWhQ/fDD9ZbYOgPk1FDlU3A3DAZw3Ujx92BglFWoo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ cldr lua luaepnf penlight ];
@@ -532,23 +514,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-gitsigns-nvim = callPackage({ lua, fetchgit, buildLuarocksPackage }:
+gitsigns-nvim = callPackage({ buildLuarocksPackage, fetchgit, lua }:
 buildLuarocksPackage {
   pname = "gitsigns.nvim";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lewis6991/gitsigns.nvim",
-  "rev": "f388995990aba04cfdc7c3ab870c33e280601109",
-  "date": "2023-02-16T11:22:47+00:00",
-  "path": "/nix/store/i4acpc5h3sv909gyppm1qv2vqjq84xs1-gitsigns.nvim",
-  "sha256": "1nm1f1d8c632nfnkiak4j7ynyin379bmhag5qp2p912cd9cjvsgx",
+  "rev": "ff01d34daaed72f271a8ffa088a7e839a60c640f",
+  "date": "2023-10-06T09:04:46+01:00",
+  "path": "/nix/store/2m4fyzkkg6bdbfb4kpjrqgbawvs3khqg-gitsigns.nvim",
+  "sha256": "0clyngmmz0qilnjykqc8n7c5kidspywazwy3axsikgh4x8wzdn17",
+  "hash": "sha256-J9j2OeoEvhl1V8Pzr7i/usVZ2LGI4emlpRGDX+uznjI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (lua.luaversion != "5.1");
   propagatedBuildInputs = [ lua ];
@@ -560,17 +543,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-haskell-tools-nvim = callPackage({ plenary-nvim, fetchzip, lua, luaOlder, buildLuarocksPackage }:
+haskell-tools-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, plenary-nvim }:
 buildLuarocksPackage {
   pname = "haskell-tools.nvim";
-  version = "2.3.0-1";
+  version = "2.4.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/haskell-tools.nvim-2.3.0-1.rockspec";
-    sha256 = "0jcmb0hzyhq14b2xcwdhwr9a9wbmfaw27vzfzkv52is24mwfr0p0";
+    url    = "mirror://luarocks/haskell-tools.nvim-2.4.0-1.rockspec";
+    sha256 = "1sapapkz3ay9yrljmc1lwxjglv27f1zbh6m014r2z59px4ir61dz";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/2.3.0.zip";
-    sha256 = "0lg8g2j9fbikgmhimvz9d0yb63csn85racc09qyszba2kviipr24";
+    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/2.4.0.zip";
+    sha256 = "054vfqsccq1qmqmglnppi2n7ksckldx8b5p62y35y0cbcdyh7wz3";
   };
 
   disabled = (luaOlder "5.1");
@@ -583,7 +566,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-http = callPackage({ luaossl, lpeg_patterns, lpeg, binaryheap, compat53, cqueues, bit32, basexx, fetchzip, lua, fifo, luaOlder, buildLuarocksPackage }:
+http = callPackage({ basexx, binaryheap, bit32, buildLuarocksPackage, compat53, cqueues, fetchurl, fetchzip, fifo, lpeg, lpeg_patterns, lua, luaOlder, luaossl }:
 buildLuarocksPackage {
   pname = "http";
   version = "0.3-0";
@@ -607,7 +590,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-inspect = callPackage({ fetchurl, buildLuarocksPackage, lua, luaOlder }:
+inspect = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "inspect";
   version = "3.1.3-0";
@@ -630,7 +613,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-jsregexp = callPackage({ buildLuarocksPackage, lua, luaOlder, fetchgit }:
+jsregexp = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "jsregexp";
   version = "0.0.6-1";
@@ -644,12 +627,13 @@ buildLuarocksPackage {
   "date": "2023-02-12T14:19:03+01:00",
   "path": "/nix/store/aj42wy1yp53w406id33dyxpv1ws23g4b-jsregexp",
   "sha256": "0l7hn5f2jl4n2bpikb72szfzgc192jy3ig5pxx9061j44amyq89m",
+  "hash": "sha256-NSHsqyJEBgNS77e8OLwUKbD33dfirBnvEpZQKVyx8FA=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -661,7 +645,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-ldbus = callPackage({ luaOlder, fetchgit, lua, luaAtLeast, buildLuarocksPackage }:
+ldbus = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "ldbus";
   version = "scm-0";
@@ -675,12 +659,13 @@ buildLuarocksPackage {
   "date": "2021-11-10T23:58:54+11:00",
   "path": "/nix/store/j830jk2hkanz7abkdsbvg2warsyr0a2c-ldbus",
   "sha256": "18q98b98mfvjzbyssf18bpnlx4hsx4s9lwcwia4z9dxiaiw7b77j",
+  "hash": "sha256-8px1eFSxt/SJipxxmjTpGpJO7V0oOK39+nK7itJCCaM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -692,34 +677,35 @@ buildLuarocksPackage {
   };
 }) {};
 
-ldoc = callPackage({ fetchgit, buildLuarocksPackage, markdown, penlight }:
+ldoc = callPackage({ buildLuarocksPackage, fetchgit, markdown, penlight }:
 buildLuarocksPackage {
   pname = "ldoc";
-  version = "scm-3";
+  version = "dev-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/stevedonovan/LDoc.git",
-  "rev": "01d648f4ad50c3d14f2acadee6acb26beda56990",
-  "date": "2022-11-18T00:01:45+01:00",
-  "path": "/nix/store/m7vvl2b5k69jrb88d0y60f2y4ryazkp9-LDoc",
-  "sha256": "1kl0ba9mnd7nksakzb3vwr0hkkkgyk92v93r2w9xnrq879dhy5mm",
+  "url": "https://github.com/lunarmodules/ldoc.git",
+  "rev": "e4940daf748affb86489b0782ed8abab2e88bebc",
+  "date": "2023-05-13T08:12:31+03:00",
+  "path": "/nix/store/sqhilwlh0glw1dxcx6w98wjkp65amvil-ldoc",
+  "sha256": "0an92jxvhbw2lvg269x6z3874x3wqmbmx52j4gsgxf9ldpizssgd",
+  "hash": "sha256-7Wn94200uf70I1KUXlfFfHRy0PimJyPepoIvuLsUySo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ markdown penlight ];
 
   meta = {
-    homepage = "https://github.com/lunarmodules/LDoc";
+    homepage = "http://lunarmodules.github.io/ldoc";
     description = "A Lua Documentation Tool";
-    license.fullName = "MIT/X11";
+    license.fullName = "MIT <http://opensource.org/licenses/MIT>";
   };
 }) {};
 
-lgi = callPackage({ luaOlder, fetchgit, buildLuarocksPackage, lua }:
+lgi = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lgi";
   version = "0.9.2-1";
@@ -733,12 +719,13 @@ buildLuarocksPackage {
   "date": "2017-10-09T20:55:55+02:00",
   "path": "/nix/store/vh82n8pc8dy5c8nph0vssk99vv7q4qg2-lgi",
   "sha256": "03rbydnj411xpjvwsyvhwy4plm96481d7jax544mvk7apd8sd5jj",
+  "hash": "sha256-UpamUbvqzF0JKV3J0wIiJlV6iedwe823vD0EIm3zKw8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -750,7 +737,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-linenoise = callPackage({ buildLuarocksPackage, lua, fetchurl, luaOlder }:
+linenoise = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "linenoise";
   version = "0.9-1";
@@ -770,7 +757,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-ljsyscall = callPackage({ lua, fetchurl, buildLuarocksPackage }:
+ljsyscall = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "ljsyscall";
   version = "0.12-1";
@@ -794,7 +781,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lmathx = callPackage({ fetchurl, buildLuarocksPackage, lua }:
+lmathx = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "lmathx";
   version = "20150624-1";
@@ -817,7 +804,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lmpfrlib = callPackage({ buildLuarocksPackage, fetchurl, luaAtLeast, lua, luaOlder }:
+lmpfrlib = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lmpfrlib";
   version = "20170112-2";
@@ -827,7 +814,7 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchurl {
     url    = "http://www.circuitwizard.de/lmpfrlib/lmpfrlib.c";
-    sha256 = "00d32cwvk298k3vyrjkdmfjgc69x1fwyks3hs7dqr2514zdhgssm";
+    sha256 = "1bkfwdacj1drzqsfxf352fjppqqwi5d4j084jr9vj9dvjb31rbc1";
   };
 
   disabled = (luaOlder "5.3") || (luaAtLeast "5.5");
@@ -841,7 +828,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-loadkit = callPackage({ luaOlder, lua, buildLuarocksPackage, fetchgit }:
+loadkit = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "loadkit";
   version = "1.1.0-1";
@@ -851,16 +838,17 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/leafo/loadkit.git",
-  "rev": "c6c712dab45f6c568821f9ed7b49c790a44d12e7",
-  "date": "2021-01-07T14:41:10-08:00",
-  "path": "/nix/store/xvwq7b2za8ciww1gjw7vnspg9183xmfa-loadkit",
-  "sha256": "15znriijs7izf9f6vmhr6dnvw3pzr0yr0mh6ah41fmdwjqi7jzcz",
+  "rev": "95b13a36442f59b41ab52df96d52233c4a725dfd",
+  "date": "2023-08-17T11:36:25-07:00",
+  "path": "/nix/store/9xcy2p5pxiq0p17szv8p2lagb6xzb8c8-loadkit",
+  "sha256": "0hivmn5r1scxv3nckm4hqfplq33wiab3ypjwsfdkmp3bdri0dhxs",
+  "hash": "sha256-usMGYm5r3Dqb01xeP5aKfAxMr8OQ1Mns2J3pkIutO0I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -873,17 +861,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-lpeg = callPackage({ luaOlder, buildLuarocksPackage, fetchurl, lua }:
+lpeg = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lpeg";
-  version = "1.0.2-1";
+  version = "1.1.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lpeg-1.0.2-1.rockspec";
-    sha256 = "08a8p5cwlwpjawk8sczb7bq2whdsng4mmhphahyklf1bkvl2li89";
+    url    = "mirror://luarocks/lpeg-1.1.0-1.rockspec";
+    sha256 = "03af1p00madfhfxjzrsxb0jm0n49ixwadnkdp0vbgs77d2v985jn";
   }).outPath;
   src = fetchurl {
-    url    = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz";
-    sha256 = "1zjzl7acvcdavmcg5l7wi12jd4rh95q9pl5aiww7hv0v0mv6bmj8";
+    url    = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.1.0.tar.gz";
+    sha256 = "0aimsjpcpkh3kk65f0pg1z2bp6d83rn4dg6pgbx1yv14s9kms5ab";
   };
 
   disabled = (luaOlder "5.1");
@@ -897,7 +885,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lpeg_patterns = callPackage({ lpeg, fetchzip, buildLuarocksPackage, lua }:
+lpeg_patterns = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lpeg, lua }:
 buildLuarocksPackage {
   pname = "lpeg_patterns";
   version = "0.5-0";
@@ -919,7 +907,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lpeglabel = callPackage({ fetchurl, lua, luaOlder, buildLuarocksPackage }:
+lpeglabel = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lpeglabel";
   version = "1.6.0-1";
@@ -942,7 +930,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lrexlib-gnu = callPackage({ buildLuarocksPackage, luaOlder, lua, fetchgit }:
+lrexlib-gnu = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-gnu";
   version = "2.9.1-1";
@@ -956,12 +944,13 @@ buildLuarocksPackage {
   "date": "2020-08-07T12:10:29+03:00",
   "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
   "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
+  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -973,7 +962,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lrexlib-pcre = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchgit }:
+lrexlib-pcre = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-pcre";
   version = "2.9.1-1";
@@ -987,12 +976,13 @@ buildLuarocksPackage {
   "date": "2020-08-07T12:10:29+03:00",
   "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
   "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
+  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1005,7 +995,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lrexlib-posix = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchgit }:
+lrexlib-posix = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-posix";
   version = "2.9.1-1";
@@ -1019,12 +1009,13 @@ buildLuarocksPackage {
   "date": "2020-08-07T12:10:29+03:00",
   "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
   "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
+  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1036,7 +1027,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-cjson = callPackage({ luaOlder, fetchgit, lua, buildLuarocksPackage }:
+lua-cjson = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-cjson";
   version = "2.1.0.10-1";
@@ -1050,12 +1041,13 @@ buildLuarocksPackage {
   "date": "2021-12-10T20:19:58+08:00",
   "path": "/nix/store/1ac8lz6smfa8zqfipqfsg749l9rw4ly9-lua-cjson",
   "sha256": "03hdsv7d77mggis58k8fmlpbh1d544m0lfqyl9rpjcqkiqs1qvza",
+  "hash": "sha256-6m8cNI4TM3lzoh47CiohpQW4Lq0OTVR0fK+e087WDQ4=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1067,7 +1059,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-cmsgpack = callPackage({ luaOlder, fetchgit, lua, buildLuarocksPackage }:
+lua-cmsgpack = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-cmsgpack";
   version = "0.4.0-0";
@@ -1081,12 +1073,13 @@ buildLuarocksPackage {
   "date": "2015-06-03T08:39:04+02:00",
   "path": "/nix/store/ksqvl7hbd5s7nb6hjffyic1shldac4z2-lua-cmsgpack",
   "sha256": "0j0ahc9rprgl6dqxybaxggjam2r5i2wqqsd6764n0d7fdpj9fqm0",
+  "hash": "sha256-oGKX5G3uNGCJOaZpjLmIJYuq5HtdLd9xM/TlmxODCkg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1098,7 +1091,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-curl = callPackage({ lua, buildLuarocksPackage, fetchzip, luaOlder, luaAtLeast }:
+lua-curl = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-curl";
   version = "0.3.13-1";
@@ -1121,30 +1114,61 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-iconv = callPackage({ fetchurl, lua, buildLuarocksPackage, luaOlder }:
+lua-ffi-zlib = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
+buildLuarocksPackage {
+  pname = "lua-ffi-zlib";
+  version = "0.6-0";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/lua-ffi-zlib-0.6-0.rockspec";
+    sha256 = "060sac715f1ris13fjv6gwqm0lk6by0a2zhldxd8hdrc0jss8p34";
+  }).outPath;
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/hamishforbes/lua-ffi-zlib",
+  "rev": "61e95cb434e4047c8bc65a180c293a05bf754416",
+  "date": "2023-08-11T09:28:16+12:00",
+  "path": "/nix/store/gfyr81q84mgpgwyh28xpzlf34ndjkfwc-lua-ffi-zlib",
+  "sha256": "0r6vima495h0d4f8ibf3fv9b6k7rqnavgvsy78dybslrm7lwsz4p",
+  "hash": "sha256-l3zN6amZ6uUbOl7vt5XF+Uyz0nbDrYgcaQCWRFSN22Q=",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path" "sha256"]) ;
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/hamishforbes/lua-ffi-zlib";
+    description = "A Lua module using LuaJIT's FFI feature to access zlib.";
+  };
+}) {};
+
+lua-iconv = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-iconv";
-  version = "7-3";
+  version = "7.0.0-2";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-iconv-7-3.rockspec";
-    sha256 = "0qh5vsaxd7s31p7a8rl08lwd6zv90wnvp15nll4fcz452kffpp72";
+    url    = "mirror://luarocks/lua-iconv-7.0.0-2.rockspec";
+    sha256 = "1bj512kqcj2cxna7si4648fci51fs4bqvdn592i9cahscsc0kk9g";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/downloads/ittner/lua-iconv/lua-iconv-7.tar.gz";
-    sha256 = "02dg5x79fg5mwsycr0fj6w04zykdpiki9xjswkkwzdalqwaikny1";
+    url    = "https://github.com/lunarmodules/lua-iconv/archive/v7.0.0/lua-iconv-7.0.0.tar.gz";
+    sha256 = "0arp0h342hpp4kfdxc69yxspziky4v7c13jbf12yrs8f1lnjzr0x";
   };
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://ittner.github.com/lua-iconv/";
+    homepage = "https://github.com/lunarmodules/lua-iconv/";
     description = "Lua binding to the iconv";
     license.fullName = "MIT/X11";
   };
 }) {};
 
-lua-lsp = callPackage({ fetchgit, inspect, lua, lpeglabel, dkjson, luaAtLeast, luaOlder, buildLuarocksPackage }:
+lua-lsp = callPackage({ buildLuarocksPackage, dkjson, fetchgit, fetchurl, inspect, lpeglabel, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-lsp";
   version = "0.1.0-2";
@@ -1158,12 +1182,13 @@ buildLuarocksPackage {
   "date": "2020-10-17T15:07:11-04:00",
   "path": "/nix/store/qn9syhm875k1qardhhsp025cm3dbnqvm-lua-lsp",
   "sha256": "17k3jq61jz6j9bz4vc3hmsfx1s26cfgq1acja8fqyixljklmsbqp",
+  "hash": "sha256-Fy9d6ZS0R48dUpKpgJ9jRujQna5wsE3+StJ8GQyWY54=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ dkjson inspect lpeglabel lua ];
@@ -1175,17 +1200,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-messagepack = callPackage({ buildLuarocksPackage, lua, fetchurl, luaOlder }:
+lua-messagepack = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-messagepack";
-  version = "0.5.2-1";
+  version = "0.5.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-messagepack-0.5.2-1.rockspec";
-    sha256 = "15liz6v8hsqgb3xrcd74a71nnjcz79gpc3ak351hk6k4gyjq2rfc";
+    url    = "mirror://luarocks/lua-messagepack-0.5.3-1.rockspec";
+    sha256 = "0sc11ckizivijgdnqvb0xnagrak6d2caxc5j8jz8ad1b2plp50pq";
   }).outPath;
   src = fetchurl {
-    url    = "https://framagit.org/fperrad/lua-MessagePack/raw/releases/lua-messagepack-0.5.2.tar.gz";
-    sha256 = "1jgi944d0vx4zs9lrphys9pw0wrsibip93sh141qjwymrjyjg1nc";
+    url    = "https://framagit.org/fperrad/lua-MessagePack/raw/releases/lua-messagepack-0.5.3.tar.gz";
+    sha256 = "17qdigs2pzi38rfqgs63xh44n1vylb6bcmmbz3sby68f0n9p8kq6";
   };
 
   disabled = (luaOlder "5.1");
@@ -1198,26 +1223,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-protobuf = callPackage({ luaOlder, buildLuarocksPackage, lua, fetchgit }:
+lua-protobuf = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-protobuf";
-  version = "0.4.1-1";
+  version = "0.5.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-protobuf-0.4.1-1.rockspec";
-    sha256 = "0b395lhby26drb8dzf2gn2avlwvxmnaqmqx5m4g3ik7dmmn7p09i";
+    url    = "mirror://luarocks/lua-protobuf-0.5.0-1.rockspec";
+    sha256 = "08z73rsqi7ysdyjcwfqyr8z6i5r43kx5fd8l32wlzv6cx6yvlqc9";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/starwing/lua-protobuf.git",
-  "rev": "2a2b0b95117642ad9470bfe0add7dd6ce82f3869",
-  "date": "2022-11-29T21:34:24+08:00",
-  "path": "/nix/store/8yjzfj6gy8nkz1dxf0bmy8afwiv8gsjr-lua-protobuf",
-  "sha256": "0c1vjji0nj9lznsxw5gbnhab0ibs69298yrsn5yky0hhz8mmx5nr",
+  "rev": "a256c34e12cad643d6ad189bddcbc314da9b0658",
+  "date": "2023-04-30T02:11:27+08:00",
+  "path": "/nix/store/n7ihjh36kp2f80016f9y8xydia2pclzq-lua-protobuf",
+  "sha256": "1kbanbgvmzcfnxq30f8hmirgc1d768lacpjihis9961pc7w96l9n",
+  "hash": "sha256-NlGT+GE3mJR0hFFepigypwX2cqwQOTBwt479ut+yas0=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1230,26 +1256,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-http = callPackage({ lua, fetchgit, luaOlder, buildLuarocksPackage }:
+lua-resty-http = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-http";
-  version = "0.17.0.beta.1-0";
+  version = "0.17.1-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-http-0.17.0.beta.1-0.rockspec";
-    sha256 = "1cjl007k43cyrwvj0p58hvp00q4lnd9rq3v3pcvwi5an2pvxnv80";
+    url    = "mirror://luarocks/lua-resty-http-0.17.1-0.rockspec";
+    sha256 = "05gid7c5i459clw707z1jic42s52ap4z66dbr9ims5znaq5s3wdk";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/ledgetech/lua-resty-http",
-  "rev": "8cb73c4cc2118f0c62d9132e3b3b14aa36192e34",
-  "date": "2022-02-11T16:44:50+00:00",
-  "path": "/nix/store/29kr6whllphz0nla5nh1f8q30dgp9vnz-lua-resty-http",
-  "sha256": "0y253dnnx59a5c1nbkcv1p5kq7kdsd5i094i7wzpg5ar6xwvqhjb",
+  "rev": "4ab4269cf442ba52507aa2c718f606054452fcad",
+  "date": "2023-03-22T09:48:56+00:00",
+  "path": "/nix/store/ykd1d5fa56i1c286k58jm233lqvdv2mi-lua-resty-http",
+  "sha256": "0xdhygjqjpfkq1bq8b09fichww57q1z694lz16i3hcc3g4sr4hxg",
+  "hash": "sha256-r0OSNXmDMTiiCZ+SZH7Ap3AOWXQJLIRXwNNdieXzsHU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1261,7 +1288,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-jwt = callPackage({ luaOlder, lua-resty-openssl, fetchgit, lua, buildLuarocksPackage }:
+lua-resty-jwt = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, lua-resty-openssl, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-jwt";
   version = "0.2.3-0";
@@ -1275,12 +1302,13 @@ buildLuarocksPackage {
   "date": "2021-01-20T16:53:57-05:00",
   "path": "/nix/store/z4a8ffxj2i3gbjp0f8r377cdp88lkzl4-lua-resty-jwt",
   "sha256": "07w8r8gqbby06x493qzislig7a3giw0anqr4ivp3g2ms8v9fnng6",
+  "hash": "sha256-5lnr0ka6ijfujiRjqwCPb6jzItXx45FIN8CvhR/KiB8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua lua-resty-openssl ];
@@ -1292,7 +1320,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-openidc = callPackage({ lua-resty-http, buildLuarocksPackage, fetchgit, lua-resty-session, luaOlder, lua, lua-resty-jwt }:
+lua-resty-openidc = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, lua-resty-http, lua-resty-jwt, lua-resty-session, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-openidc";
   version = "1.7.6-3";
@@ -1306,12 +1334,13 @@ buildLuarocksPackage {
   "date": "2023-01-30T19:06:51+01:00",
   "path": "/nix/store/nyd2jqhlq8gx4chapqyxk2q4dsxgm8hz-lua-resty-openidc",
   "sha256": "15dh9z7y84n840x02xsn2m9h9hdakbbv4p1z7dfz85v5w5i6c86p",
+  "hash": "sha256-1yBmYuFlF/RdOz9csteaqsEEUxVWdwE6IMgS5M9PsJU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua lua-resty-http lua-resty-jwt lua-resty-session ];
@@ -1323,26 +1352,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-openssl = callPackage({ fetchgit, buildLuarocksPackage }:
+lua-resty-openssl = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "lua-resty-openssl";
-  version = "0.8.17-1";
+  version = "0.8.25-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-openssl-0.8.17-1.rockspec";
-    sha256 = "1b4dv9mdb90n0f6982pnjb05rgb12nkn1j66a1ywcs5fqcmj4sb5";
+    url    = "mirror://luarocks/lua-resty-openssl-0.8.25-1.rockspec";
+    sha256 = "0wy0fjb50kpcyk6mkjj364p4lrfxl0b34xnv2n0wib1brk536s1l";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/fffonion/lua-resty-openssl.git",
-  "rev": "dc17f6b2ff3adaa3bcb586f1d09073a4f4f4ec9d",
-  "date": "2023-01-20T01:36:57+08:00",
-  "path": "/nix/store/hh9i8ndb861iplkf9mz6vs2akkyibazn-lua-resty-openssl",
-  "sha256": "14xmxskbw3clqr97y69d311rs6i97vl7dg8pzixsqf4ypgllzvig",
+  "rev": "f9a153288238e9b7e3d5d40144610410a06a83cd",
+  "date": "2023-09-05T15:19:20+08:00",
+  "path": "/nix/store/jnvr2pzvxl2psd5w030m4qnv5dsm8spb-lua-resty-openssl",
+  "sha256": "08fqgdfi0dr3n2lqrbgwa94dd2f6crn1kb0cfpccphknaypaw7dp",
+  "hash": "sha256-tx2urld2wsvYdQysGWxmxonWSFL8rYypsCM3EF172CE=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
 
   meta = {
@@ -1352,39 +1382,39 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-session = callPackage({ buildLuarocksPackage, fetchgit, luaOlder, lua, lua-resty-openssl /*, lua_pack, lua-ffi-zlib */  }:
+lua-resty-session = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, lua-ffi-zlib, lua-resty-openssl, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-session";
-  version = "4.0.3-1";
+  version = "4.0.5-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-session-4.0.3-1.rockspec";
-    sha256 = "17q8gf0zjdbfgphvjsnlzw1d6158v4ppiqxap6hjqr0prqa5yyfq";
+    url    = "mirror://luarocks/lua-resty-session-4.0.5-1.rockspec";
+    sha256 = "0h0kqwna46mrraq310qjb7yigxwv13n4czk24xnqr21czxsskzkg";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/bungle/lua-resty-session.git",
-  "rev": "3373d8138930b6d1e255bb80d9127503019301d7",
-  "date": "2023-02-21T20:52:32+02:00",
-  "path": "/nix/store/pdwd03w7505wkv4fw79a3mdlfijk9ngd-lua-resty-session",
-  "sha256": "1d105785jzn9x3by4r0baaffr5xmc2ilgd7z7izcwq9z29pnfv02",
+  "rev": "5f2aed616d16fa7ca04dc40e23d6941740cd634d",
+  "date": "2023-08-16T18:24:43+03:00",
+  "path": "/nix/store/s6i1idv9lx52x7lcl0kc2c9sm9pic4kq-lua-resty-session",
+  "sha256": "08pih1baqhlvsqvcr1zzympmn8v7gskmis6ffhigll37hbzvljcz",
+  "hash": "sha256-n0m6/4JnUPoidM7oWKd+ZyNbb/X/h8w21ptCrFaA8SI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua lua-resty-openssl /* lua_pack lua-ffi-zlib */ ];
+  propagatedBuildInputs = [ lua lua-ffi-zlib lua-resty-openssl ];
 
   meta = {
     homepage = "https://github.com/bungle/lua-resty-session";
     description = "Session Library for OpenResty - Flexible and Secure";
     license.fullName = "BSD";
-    broken = true; # lua_pack and lua-ffi-zlib are unpackaged, causing this package to not evaluate
   };
 }) {};
 
-lua-subprocess = callPackage({ lua, buildLuarocksPackage, fetchgit, luaOlder }:
+lua-subprocess = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "subprocess";
   version = "scm-1";
@@ -1395,12 +1425,13 @@ buildLuarocksPackage {
   "date": "2021-01-09T22:31:54+01:00",
   "path": "/nix/store/3lr7n1k85kbf718wxr51xd40i8dfs5qd-lua-subprocess",
   "sha256": "0p91hda0b0hpgdbff5drcyygaizq086gw8vnvzn0y0fg3mc9if70",
+  "hash": "sha256-4LiYWB3PAQ/s33Yj/gwC+Ef1vGe5FedWexeCBVSDIV0=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1413,7 +1444,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-term = callPackage({ fetchurl, buildLuarocksPackage }:
+lua-term = callPackage({ buildLuarocksPackage, fetchurl }:
 buildLuarocksPackage {
   pname = "lua-term";
   version = "0.7-1";
@@ -1434,7 +1465,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-toml = callPackage({ fetchgit, buildLuarocksPackage, luaOlder, lua }:
+lua-toml = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-toml";
   version = "2.0-1";
@@ -1448,12 +1479,13 @@ buildLuarocksPackage {
   "date": "2017-12-08T16:30:50-08:00",
   "path": "/nix/store/cnpflpyj441c65jhb68hjr2bcvnj9han-lua-toml",
   "sha256": "0lklhgs4n7gbgva5frs39240da1y4nwlx6yxaj3ix6r5lp9sh07b",
+  "hash": "sha256-6wCo06Ulmx6HVN2bTrklPqgGiEhDZ1fUfusdS/SDdFI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1465,7 +1497,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-yajl = callPackage({ luaOlder, buildLuarocksPackage, lua, fetchgit }:
+lua-yajl = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-yajl";
   version = "2.0-1";
@@ -1479,12 +1511,13 @@ buildLuarocksPackage {
   "date": "2020-11-12T06:22:23-08:00",
   "path": "/nix/store/9acgxpqk52kwn03m5xasn4f6mmsby2r9-lua-yajl",
   "sha256": "1frry90y7vqnw1rd1dfnksilynh0n24gfhkmjd6wwba73prrg0pf",
+  "hash": "sha256-7oKX8x1HLc5Nk3VC94iwAFpPo57WtdBy4Bbv40HyObs=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1497,7 +1530,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-zlib = callPackage({ fetchgit, buildLuarocksPackage, luaOlder, lua }:
+lua-zlib = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-zlib";
   version = "1.2-2";
@@ -1511,12 +1544,13 @@ buildLuarocksPackage {
   "date": "2017-10-07T08:26:37-07:00",
   "path": "/nix/store/6hjfczd3xkilkdxidgqzdrwmaiwnlf05-lua-zlib",
   "sha256": "1cv12s5c5lihmf3hb0rz05qf13yihy1bjpb7448v8mkiss6y1s5c",
+  "hash": "sha256-rOjgjdZxVrQRIWdduYKH0Y/gcAE/gwWHqzDSwooWYbM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1529,7 +1563,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua_cliargs = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchurl }:
+lua_cliargs = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua_cliargs";
   version = "3.0-2";
@@ -1549,7 +1583,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luabitop = callPackage({ luaAtLeast, lua, fetchgit, buildLuarocksPackage, luaOlder }:
+luabitop = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luabitop";
   version = "1.0.2-3";
@@ -1560,12 +1594,13 @@ buildLuarocksPackage {
   "date": "2021-08-30T10:14:03+02:00",
   "path": "/nix/store/sdnza0zpmlkz9jppnysasbvqy29f4zia-luabitop",
   "sha256": "1b57f99lrjbwsi4m23cq5kpj0dbpxh3xwr0mxs2rzykr2ijpgwrw",
+  "hash": "sha256-PPN3ZRR5+p+F7hVk3gfsdzUg7yyYDVFJ1HzJTFNyp6w=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.3");
   propagatedBuildInputs = [ lua ];
@@ -1577,26 +1612,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-luacheck = callPackage({ argparse, luafilesystem, lua, luaOlder, fetchgit, buildLuarocksPackage }:
+luacheck = callPackage({ argparse, buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "luacheck";
-  version = "1.1.0-1";
+  version = "1.1.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luacheck-1.1.0-1.rockspec";
-    sha256 = "1r8d02x0hw28rd5p2gr7sf503lczjxv6qk1q66b375ibx6smpyza";
+    url    = "mirror://luarocks/luacheck-1.1.1-1.rockspec";
+    sha256 = "11nrryqff2yis5s7jscbyv221p21i9sh924x7g9l3d6ijns8zmba";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/luacheck.git",
-  "rev": "fcbdeacad00e643e0d78c56b9ba6d8b3c7fa584f",
-  "date": "2022-12-19T20:51:56+03:00",
-  "path": "/nix/store/srzi8dfrbb9gby9lc7r4sndzzrpzd7nm-luacheck",
-  "sha256": "0bkbcxadlf0j59lyvadp7hs7l107blkci15i0hrbi72bx18hj99h",
+  "rev": "ababb6d403d634eb74d2c541035e9ede966e710d",
+  "date": "2023-06-10T11:27:25+03:00",
+  "path": "/nix/store/wkrhda7nww45g1waxdv9ghm35mwbvlfq-luacheck",
+  "sha256": "0abd5rfxv667n8d8v3g9cnkyghiwzhj3yk498gr2agd3mfcni7d7",
+  "hash": "sha256-p51omaujPSXyQ4lMPyT8PMLnp2XpjY0asseY3V0ubSk=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ argparse lua luafilesystem ];
@@ -1608,7 +1644,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luacov = callPackage({ luaAtLeast, buildLuarocksPackage, luaOlder, lua, fetchgit }:
+luacov = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luacov";
   version = "0.15.0-1";
@@ -1622,12 +1658,13 @@ buildLuarocksPackage {
   "date": "2021-02-15T18:47:58-03:00",
   "path": "/nix/store/9vm38il9knzx2m66m250qj1fzdfzqg0y-luacov",
   "sha256": "08550nna6qcb5jn6ds1hjm6010y8973wx4qbf9vrvrcn1k2yr6ki",
+  "hash": "sha256-cZrsxQyW5Z13cguTzsdJyIMATJUw6GasLItho6wFpSA=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -1639,7 +1676,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luadbi = callPackage({ buildLuarocksPackage, lua, luaOlder, fetchgit, luaAtLeast }:
+luadbi = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luadbi";
   version = "0.7.2-1";
@@ -1653,12 +1690,13 @@ buildLuarocksPackage {
   "date": "2019-01-14T09:39:17+00:00",
   "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
   "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
+  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -1670,7 +1708,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luadbi-mysql = callPackage({ luaOlder, lua, buildLuarocksPackage, fetchgit, luadbi, luaAtLeast }:
+luadbi-mysql = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-mysql";
   version = "0.7.2-1";
@@ -1684,12 +1722,13 @@ buildLuarocksPackage {
   "date": "2019-01-14T09:39:17+00:00",
   "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
   "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
+  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua luadbi ];
@@ -1701,7 +1740,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luadbi-postgresql = callPackage({ lua, fetchgit, buildLuarocksPackage, luaOlder, luaAtLeast, luadbi }:
+luadbi-postgresql = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-postgresql";
   version = "0.7.2-1";
@@ -1715,12 +1754,13 @@ buildLuarocksPackage {
   "date": "2019-01-14T09:39:17+00:00",
   "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
   "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
+  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua luadbi ];
@@ -1732,7 +1772,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luadbi-sqlite3 = callPackage({ luaAtLeast, lua, luaOlder, buildLuarocksPackage, fetchgit, luadbi }:
+luadbi-sqlite3 = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-sqlite3";
   version = "0.7.2-1";
@@ -1746,12 +1786,13 @@ buildLuarocksPackage {
   "date": "2019-01-14T09:39:17+00:00",
   "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
   "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
+  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua luadbi ];
@@ -1763,7 +1804,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaepnf = callPackage({ luaOlder, buildLuarocksPackage, lpeg, luaAtLeast, lua, fetchgit }:
+luaepnf = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lpeg, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luaepnf";
   version = "0.3-2";
@@ -1777,12 +1818,13 @@ buildLuarocksPackage {
   "date": "2015-01-15T16:54:10+01:00",
   "path": "/nix/store/n7gb0z26sl7dzdyy3bx1y3cz3npsna7d-lua-luaepnf",
   "sha256": "1lvsi3fklhvz671jgg0iqn0xbkzn9qjcbf2ks41xxjz3lapjr6c9",
+  "hash": "sha256-iZksr6Ljy94D0VO4xSRO9s/VgcURvCfDMX9DOt2IetM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lpeg lua ];
@@ -1794,7 +1836,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaevent = callPackage({ lua, fetchurl, luaOlder, buildLuarocksPackage }:
+luaevent = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luaevent";
   version = "0.4.6-1";
@@ -1817,7 +1859,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaexpat = callPackage({ buildLuarocksPackage, fetchgit, luaOlder, lua }:
+luaexpat = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luaexpat";
   version = "1.4.1-1";
@@ -1831,12 +1873,13 @@ buildLuarocksPackage {
   "date": "2022-10-04T16:36:23+02:00",
   "path": "/nix/store/dgrdkalikpqdap642qhppha1ajdnsvx0-luaexpat",
   "sha256": "1b4ck23p01ks3hgayan9n33f2kb6jvv63v4ww2mqczc09rqi0q46",
+  "hash": "sha256-hmAQcU6AfYar4JzsYfaWZk3hxrDJKq8eHHoGcIeYjKw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1849,7 +1892,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaffi = callPackage({ fetchgit, buildLuarocksPackage, lua, luaOlder }:
+luaffi = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luaffi";
   version = "scm-1";
@@ -1863,12 +1906,13 @@ buildLuarocksPackage {
   "date": "2021-03-01T11:46:30-05:00",
   "path": "/nix/store/6dwfn64p3clcsxkq41b307q8izi0fvji-luaffifb",
   "sha256": "0nj76fw3yi57vfn35yvbdmpdbg9gmn5j1gw84ajs9w1j86sc0661",
+  "hash": "sha256-wRjAtEEy8KSlIoi/IIutL73Vbm1r+zKs26dEP7gzR1o=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1880,7 +1924,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luafilesystem = callPackage({ luaOlder, lua, fetchgit, buildLuarocksPackage }:
+luafilesystem = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luafilesystem";
   version = "1.8.0-1";
@@ -1894,44 +1938,46 @@ buildLuarocksPackage {
   "date": "2020-04-22T22:16:42-03:00",
   "path": "/nix/store/qzjav1cmn4zwclpfs0xzykpbv835d84z-luafilesystem",
   "sha256": "16hpwhj6zgkjns3zilcg3lxfijm3cl71v39y9n5lbjk4b9kkwh54",
+  "hash": "sha256-pEA+Z1pkykWLTT6NHQ5lo8roOh2P0fiHtnK+byTkF5o=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "git://github.com/keplerproject/luafilesystem";
+    homepage = "https://github.com/keplerproject/luafilesystem";
     description = "File System Library for the Lua Programming Language";
     maintainers = with lib.maintainers; [ flosse ];
     license.fullName = "MIT/X11";
   };
 }) {};
 
-lualdap = callPackage({ fetchgit, lua, luaOlder, buildLuarocksPackage }:
+lualdap = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lualdap";
-  version = "1.3.0-1";
+  version = "1.3.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lualdap-1.3.0-1.rockspec";
-    sha256 = "0b51sm0fz4kiim20w538v31k9g20wq3msxdkh17drkr60ab25sc8";
+    url    = "mirror://luarocks/lualdap-1.3.1-1.rockspec";
+    sha256 = "0c0j9dmrphg0dil4yhahcqzzyxhrv525g65jsz0q6iqwyx10bqbp";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lualdap/lualdap",
-  "rev": "be380f5d98f779c813a4fb4ae1400262366fc8d4",
-  "date": "2021-06-05T15:49:42+02:00",
-  "path": "/nix/store/99sy73yz6sidqhkl0kwdsd7r853aw38n-lualdap",
-  "sha256": "133d8br5f24z03ni38m0czrqfz0mr0ksdrc1g73rawpmiqarpps8",
+  "rev": "5c21b3e0d97a07b103f63edc7e649018e0453427",
+  "date": "2023-03-15T09:02:07+01:00",
+  "path": "/nix/store/ah7y5wpp3l0v5bk0gwzdvgzfpczb691k-lualdap",
+  "sha256": "1y3ap9si894xjlbrwx3c6bcfg60y80av802rscldg9scvm984jrg",
+  "hash": "sha256-L0uCUt1Mp9co01kAtBVAHpjn2DJsdJ4XlZ0kFHW6avg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1944,7 +1990,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lualogging = callPackage({ luasocket, buildLuarocksPackage, fetchgit }:
+lualogging = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, luasocket }:
 buildLuarocksPackage {
   pname = "lualogging";
   version = "1.8.2-1";
@@ -1958,12 +2004,13 @@ buildLuarocksPackage {
   "date": "2023-01-27T20:29:41+01:00",
   "path": "/nix/store/pvb3yq11xgqhq6559sjd8rkf1x991rrz-lualogging",
   "sha256": "1mz5iiv9pfikkm4ay7j0q6mk3bmcxylnlg9piwda47xxc1zyb1j4",
+  "hash": "sha256-RIblf2C9H6Iajzc9aqnvrK4xq8FAHq9InTO6m3aM5dc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ luasocket ];
 
@@ -1974,7 +2021,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaossl = callPackage({ buildLuarocksPackage, lua, fetchzip }:
+luaossl = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua }:
 buildLuarocksPackage {
   pname = "luaossl";
   version = "20220711-0";
@@ -1996,7 +2043,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaposix = callPackage({ bit32, lua, luaOlder, fetchzip, luaAtLeast, buildLuarocksPackage }:
+luaposix = callPackage({ bit32, buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luaposix";
   version = "34.1.1-1";
@@ -2020,7 +2067,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luarepl = callPackage({ buildLuarocksPackage, fetchurl, luaOlder, lua }:
+luarepl = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luarepl";
   version = "0.10-1";
@@ -2043,7 +2090,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luarocks-build-rust-mlua = callPackage({ fetchgit, buildLuarocksPackage }:
+luarocks-build-rust-mlua = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "luarocks-build-rust-mlua";
   version = "0.1.2-1";
@@ -2057,41 +2104,44 @@ buildLuarocksPackage {
   "date": "2023-06-29T16:47:41+01:00",
   "path": "/nix/store/n7id28r1m11xd550hayv99xhz96vpdjq-luarocks-build-rust-mlua",
   "sha256": "1zh1p5k7xpczi5db3k0fw0ljw9w0xxk1qjjcfg5rcznqjf48i3x7",
+  "hash": "sha256-p4+IiJPYfpbLc0xKHGbvgCcuKeAOzLFaiZ/dfma5Af4=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
 
   meta = {
     homepage = "https://github.com/khvzak/luarocks-build-rust-mlua";
     description = "A LuaRocks build backend for Lua modules written in Rust using mlua";
+    maintainers = with lib.maintainers; [ mrcjkb ];
     license.fullName = "MIT";
   };
 }) {};
 
-luasec = callPackage({ fetchgit, luaOlder, luasocket, buildLuarocksPackage, lua }:
+luasec = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, luasocket }:
 buildLuarocksPackage {
   pname = "luasec";
-  version = "1.2.0-1";
+  version = "1.3.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luasec-1.2.0-1.rockspec";
-    sha256 = "0zavdkwd701j8zqyzrpn1n5xd242vziq2l79amjdn5mcw81nrsdf";
+    url    = "mirror://luarocks/luasec-1.3.2-1.rockspec";
+    sha256 = "09nqs60cmbq1bi70cdh7v5xjnlsm2mrxv9pmbbvczijvz184jh33";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/brunoos/luasec",
-  "rev": "d9215ee00f6694a228daad50ee85827a4cd13583",
-  "date": "2022-07-30T08:42:53-03:00",
-  "path": "/nix/store/77m3g768a230h77nxiw23ay73aryq1zh-luasec",
-  "sha256": "1rz2lhf243lrsjsyjwxhijhqr88l8l8sndzzv9w4x1j0zpa9sblb",
+  "rev": "4c06287052d68fdbe7429b8f967cdc8ee94aa44a",
+  "date": "2023-08-31T17:09:53-03:00",
+  "path": "/nix/store/wnl78b5l3dxw52slphmi4rmr1cd8bd3r-luasec",
+  "sha256": "0rrdfbnkd8pgqwh3f0iyd5cxy7g1h0568a88m3sq1z7715js4yx3",
+  "hash": "sha256-o3uiZQnn/ID1qAgpZAqA4R3fWWk+Ajcgx++iNu1yLWc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua luasocket ];
@@ -2104,7 +2154,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luasocket = callPackage({ fetchgit, lua, luaOlder, buildLuarocksPackage }:
+luasocket = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasocket";
   version = "3.1.0-1";
@@ -2118,12 +2168,13 @@ buildLuarocksPackage {
   "date": "2022-07-27T10:07:00+03:00",
   "path": "/nix/store/r5pqxqjkdwl80nmjkv400mbls7cfymjc-luasocket",
   "sha256": "13hyf9cvny0kxwyg08929kkl31w74j66fj6zg1myyjr9nh5b795h",
+  "hash": "sha256-sKSzCrQpS+9reN9IZ4wkh4dB50wiIfA87xN4u1lyHo4=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -2135,26 +2186,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-luasql-sqlite3 = callPackage({ lua, buildLuarocksPackage, fetchgit, luaOlder }:
+luasql-sqlite3 = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasql-sqlite3";
-  version = "2.6.0-1";
+  version = "2.6.0-2";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luasql-sqlite3-2.6.0-1.rockspec";
-    sha256 = "0w32znsfcaklcja6avqx7daaxbf0hr2v8g8bmz0fysb3401lmp02";
+    url    = "mirror://luarocks/luasql-sqlite3-2.6.0-2.rockspec";
+    sha256 = "1xpbcpl4qhnzpyyszhdsrxhx2qc1dmndh926lv91xwphw7inwdwg";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/keplerproject/luasql.git",
-  "rev": "e2660cbaeb13cb33d8346bb816c6a526241b3c2d",
-  "date": "2022-10-03T18:44:40-03:00",
-  "path": "/nix/store/mxzq779w3l19bgb424aa4cqdzxczmwr3-luasql",
-  "sha256": "052hc174am05plidilzf36vr736sp8vyydfb12qa8xr6mk74f6d1",
+  "rev": "25bf4ffce9323d28cb6f382f7ec9e8951e3084f9",
+  "date": "2023-07-19T14:20:27-03:00",
+  "path": "/nix/store/949886jxp7sx3yx910lc6d1yf3ym9mx5-luasql",
+  "sha256": "00q73j2nzqsm0vmxjkv83qh1dncmr5dgmkrkyxnb5ggygvcbh7w5",
+  "hash": "sha256-hR+42H7+vbJs9zPP+lrJldkWIB5oT9nrBlXjb4UcBwM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -2167,7 +2219,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luassert = callPackage({ luaOlder, fetchgit, buildLuarocksPackage, lua, say }:
+luassert = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, say }:
 buildLuarocksPackage {
   pname = "luassert";
   version = "1.9.0-1";
@@ -2181,12 +2233,13 @@ buildLuarocksPackage {
   "date": "2022-08-24T00:00:45+03:00",
   "path": "/nix/store/vfcl25wxps5kvh5prjkkjlj1ga3kgw63-luassert",
   "sha256": "0wlp6qdm9dkwzs8lvnj7zvmid4y12v717ywlhxn2brkbjpvl2dwf",
+  "hash": "sha256-jjdB95Vr5iVsh5T7E84WwZMW6/5H2k2R/ny2VBs2l3I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua say ];
@@ -2198,7 +2251,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luasystem = callPackage({ buildLuarocksPackage, luaOlder, lua, fetchurl }:
+luasystem = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasystem";
   version = "0.2.1-0";
@@ -2221,7 +2274,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaunbound = callPackage({ fetchurl, lua, buildLuarocksPackage, luaOlder, luaAtLeast }:
+luaunbound = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luaunbound";
   version = "1.0.0-1";
@@ -2244,7 +2297,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaunit = callPackage({ buildLuarocksPackage, fetchzip, lua, luaAtLeast, luaOlder }:
+luaunit = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luaunit";
   version = "3.4-1";
@@ -2268,7 +2321,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luautf8 = callPackage({ fetchurl, buildLuarocksPackage, lua, luaOlder }:
+luautf8 = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luautf8";
   version = "0.1.5-2";
@@ -2292,7 +2345,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luazip = callPackage({ luaOlder, luaAtLeast, buildLuarocksPackage, lua, fetchgit }:
+luazip = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luazip";
   version = "1.2.7-1";
@@ -2306,12 +2359,13 @@ buildLuarocksPackage {
   "date": "2017-09-05T14:02:52+03:00",
   "path": "/nix/store/idllj442c0iwnx1cpkrifx2afb7vh821-luazip",
   "sha256": "1jlqzqlds3aa3hnp737fm2awcx0hzmwyd87klv0cv13ny5v9f2x4",
+  "hash": "sha256-pAuXdvF2hM3ApvOg5nn9EHTGlajujHMtHEoN3Sj+mMo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -2323,23 +2377,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-lush-nvim = callPackage({ buildLuarocksPackage, fetchgit, luaAtLeast, luaOlder, lua }:
+lush-nvim = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lush.nvim";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rktjmp/lush.nvim",
-  "rev": "b1e8eb1da3fee95ef31515a73c9eff9bf251088d",
-  "date": "2023-01-03T10:45:29+11:00",
-  "path": "/nix/store/wpnvi5bjlp7sl8g2li21qkcd7m1f3d3w-lush.nvim",
-  "sha256": "0q3prq4fm9rpczl7b1lgqnhs0z5jgvpdy0cp45jfpw4bvcy6vkpq",
+  "rev": "966aad1accd47fa11fbe2539234f81f678fef2de",
+  "date": "2023-09-23T12:10:39+10:00",
+  "path": "/nix/store/67046ilc92czfvwc5zdkkxg7iw2xjj45-lush.nvim",
+  "sha256": "0g1xib2k42py9qqccjz11qk52ri0drgdk5rb0ls7wzx4v636k15h",
+  "hash": "sha256-sIRphtmkf340BSuX2V5uIGZRJg7hS8YwTv4KMsWKPTw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -2352,7 +2407,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luuid = callPackage({ luaOlder, luaAtLeast, buildLuarocksPackage, fetchurl, lua }:
+luuid = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luuid";
   version = "20120509-2";
@@ -2375,7 +2430,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luv = callPackage({ luaOlder, buildLuarocksPackage, fetchurl, lua }:
+luv = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luv";
   version = "1.44.2-1";
@@ -2398,7 +2453,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lyaml = callPackage({ buildLuarocksPackage, fetchzip, lua, luaOlder, luaAtLeast }:
+lyaml = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lyaml";
   version = "6.2.8-1";
@@ -2422,7 +2477,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-magick = callPackage({ fetchgit, buildLuarocksPackage, lua }:
+magick = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "magick";
   version = "1.6.0-1";
@@ -2436,24 +2491,26 @@ buildLuarocksPackage {
   "date": "2022-03-10T20:02:11-08:00",
   "path": "/nix/store/fpl99q09zg3qnk4kagxk1djabl1dm47l-magick",
   "sha256": "01b9qsz27f929rz5z7vapqhazxak74sichdwkjwb219nlhrwfncm",
+  "hash": "sha256-lVnHM6Q2BbG4nLxBFjU5U/WvIL5qn19+TiK5I77GaQU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (lua.luaversion != "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "git://github.com/leafo/magick.git";
+    homepage = "https://github.com/leafo/magick.git";
     description = "Lua bindings to ImageMagick & GraphicsMagick for LuaJIT using FFI";
+    maintainers = with lib.maintainers; [ donovanglover ];
     license.fullName = "MIT";
   };
 }) {};
 
-markdown = callPackage({ buildLuarocksPackage, luaAtLeast, fetchgit, luaOlder, lua }:
+markdown = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "markdown";
   version = "0.33-1";
@@ -2467,12 +2524,13 @@ buildLuarocksPackage {
   "date": "2015-09-27T17:49:28+03:00",
   "path": "/nix/store/akl80hh077hm20bdqj1lksy0fn2285b5-markdown",
   "sha256": "019bk2qprszqncnm8zy6ns6709iq1nwkf7i86nr38f035j4lc11y",
+  "hash": "sha256-PgRGiSwDODSyNSgeN7kNOCZwjLbGf1Qts/jrfLGYKwU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -2484,7 +2542,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-mediator_lua = callPackage({ luaOlder, lua, fetchurl, buildLuarocksPackage }:
+mediator_lua = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "mediator_lua";
   version = "1.1.2-0";
@@ -2507,7 +2565,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-middleclass = callPackage({ luaOlder, buildLuarocksPackage, fetchurl, lua }:
+middleclass = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "middleclass";
   version = "4.1.1-0";
@@ -2530,23 +2588,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-moonscript = callPackage({ lpeg, luaOlder, fetchgit, lua, buildLuarocksPackage, argparse, luafilesystem }:
+moonscript = callPackage({ argparse, buildLuarocksPackage, fetchgit, lpeg, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "moonscript";
   version = "dev-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/leafo/moonscript.git",
-  "rev": "a0108328373d5f3f1aefb98341aa895dd75a1b2a",
-  "date": "2022-11-04T13:38:05-07:00",
-  "path": "/nix/store/js597jw44cdfq154a7bpqba99ninzsqh-moonscript",
-  "sha256": "02ig93c1dzrbs64mz40bkzz3p93fdxm6m0i7gfqwiickybr9wd97",
+  "rev": "fbd8ad48737651114a3d3a672b9f8f8b3a7022b7",
+  "date": "2023-06-23T09:33:37-07:00",
+  "path": "/nix/store/sy1dkcfp3rg7lvazba36sivpk0bs12r5-moonscript",
+  "sha256": "02w6lp5kid73dcd5x71666my7413l05ak0xvva6hp8ixbn6qraqn",
+  "hash": "sha256-FquMjV09oguN2ruDqQqgI5DjqzEmnF4aa+O0OMulhgs=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ argparse lpeg lua luafilesystem ];
@@ -2562,14 +2621,14 @@ buildLuarocksPackage {
 mpack = callPackage({ buildLuarocksPackage, fetchurl }:
 buildLuarocksPackage {
   pname = "mpack";
-  version = "1.0.9-0";
+  version = "1.0.11-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/mpack-1.0.9-0.rockspec";
-    sha256 = "1v10kmw3qw559bbm142z40ib26bwvcyi64qjrk0vf8v6n1mx8wcn";
+    url    = "mirror://luarocks/mpack-1.0.11-0.rockspec";
+    sha256 = "0alydkccamxldij7ki42imd37630d9qnqg22pndcgkawfclfqzqa";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/libmpack/libmpack-lua/releases/download/1.0.9/libmpack-lua-1.0.9.tar.gz";
-    sha256 = "17lyjmnbychacwahqgs128nb00xky777g7zw5wf20vrzkiq7xl0g";
+    url    = "https://github.com/libmpack/libmpack-lua/releases/download/1.0.11/libmpack-lua-1.0.11.tar.gz";
+    sha256 = "15np7603rijavycvrjgjp12y64zs36390lg2hsnr5av790cfrnd2";
   };
 
 
@@ -2580,7 +2639,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-nui-nvim = callPackage( { fetchgit, buildLuarocksPackage }:
+nui-nvim = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "nui.nvim";
   version = "0.2.0-1";
@@ -2594,12 +2653,13 @@ buildLuarocksPackage {
   "date": "2023-07-20T10:45:09+06:00",
   "path": "/nix/store/8zdhjgipjjhi9b1y40r2yk5np4lp39as-nui.nvim",
   "sha256": "14a73dwl56kah9h36b40ir6iylvfs261ysz17qvi9vhp63vjq9cx",
+  "hash": "sha256-nSUs9zAX7hQ3PuFrH4zQblMfTY6ALDNggmqaQnkbR5E=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
 
   meta = {
@@ -2610,7 +2670,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-nvim-client = callPackage({ coxpcall, fetchurl, mpack, lua, luaOlder, luv, buildLuarocksPackage }:
+nvim-client = callPackage({ buildLuarocksPackage, coxpcall, fetchurl, lua, luaOlder, luv, mpack }:
 buildLuarocksPackage {
   pname = "nvim-client";
   version = "0.2.4-1";
@@ -2630,23 +2690,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-nvim-cmp = callPackage({ luaAtLeast, lua, fetchgit, buildLuarocksPackage, luaOlder }:
+nvim-cmp = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "nvim-cmp";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/hrsh7th/nvim-cmp",
-  "rev": "7a3b1e76f74934b12fda82158237c6ad8bfd3d40",
-  "date": "2023-02-24T12:23:36+09:00",
-  "path": "/nix/store/s1qark9y2zkbwyl2mzg60z9r0h4hajf4-nvim-cmp",
-  "sha256": "0cy93aj02nkspr83sqsrix12jcnhkl5s2mbpjr5ffhpcrk19vlmx",
+  "rev": "5dce1b778b85c717f6614e3f4da45e9f19f54435",
+  "date": "2023-08-26T15:31:42+00:00",
+  "path": "/nix/store/lvpzc5q7mv66knxh1igvzkrcwkpg8l8q-nvim-cmp",
+  "sha256": "1yl5b680p6vhk1741riiwjnw7a4wn0nimjvcab0ij6mx3kf28rsq",
+  "hash": "sha256-WGck3By9GhnBUmzLGi2wnKjDreQx5kBOmHCbC5BZhfo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -2658,23 +2719,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-penlight = callPackage({ luafilesystem, luaOlder, fetchgit, buildLuarocksPackage, lua }:
+penlight = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "penlight";
   version = "dev-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/penlight.git",
-  "rev": "7e67bcb1c4d95e7ca817356533419b4a72049b96",
-  "date": "2022-12-28T23:34:46+01:00",
-  "path": "/nix/store/14kax7nswd7in005cgb0f0r8194s9nsd-penlight",
-  "sha256": "17gcfi8hqpdp8m0f1nr9n5p1mzxxpq2qwf8zkqvjkb7qv1zqabj1",
+  "rev": "dc6d19c5c1e1b4ac55b14df17b7645af6b410140",
+  "date": "2023-09-21T10:51:09+02:00",
+  "path": "/nix/store/vbi0d32mbaqcra3jligv8ajq17m1wxa4-penlight",
+  "sha256": "12ppgby8ldh4zxwcr7cknacbdvk30fi92sgyzh1zbgvym4l44g0c",
+  "hash": "sha256-DDxCKKl+v/UD/P5pkaIDY+62mLKTncx4/wQ2ivx694o=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua luafilesystem ];
@@ -2687,23 +2749,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-plenary-nvim = callPackage({ lua, fetchgit, luaOlder, luaAtLeast, luassert, buildLuarocksPackage }:
+plenary-nvim = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder, luassert }:
 buildLuarocksPackage {
   pname = "plenary.nvim";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-lua/plenary.nvim",
-  "rev": "253d34830709d690f013daf2853a9d21ad7accab",
-  "date": "2023-02-19T10:05:49+01:00",
-  "path": "/nix/store/dnzlin3gqpvd35a8c5g5hwg3fl28vxgs-plenary.nvim",
-  "sha256": "17vvl06jc5vrfrv7gljflkqykshhg84wnhbl9br4pm050ywlg4ng",
+  "rev": "50012918b2fc8357b87cff2a7f7f0446e47da174",
+  "date": "2023-10-11T15:43:47+02:00",
+  "path": "/nix/store/jsgaq274w8pbl4pnmpii3izxafpl346g-plenary.nvim",
+  "sha256": "1sn7vpsbwpyndsjyxb4af8fvz4sfhlbavvw6jjsv3h18sdvkh7nd",
+  "hash": "sha256-zR44d9MowLG1lIbvrRaFTpO/HXKKrO6lbtZfvvTdx+o=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua luassert ];
@@ -2715,7 +2778,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-rapidjson = callPackage({ lua, buildLuarocksPackage, luaOlder, fetchgit }:
+rapidjson = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "rapidjson";
   version = "0.7.1-1";
@@ -2726,12 +2789,13 @@ buildLuarocksPackage {
   "date": "2021-04-09T19:59:20+08:00",
   "path": "/nix/store/65l71ph27pmipgrq8j4whg6n8h2avvs4-lua-rapidjson",
   "sha256": "1a6srvximxlh6gjkaj5y86d1kf06pc4gby2r6wpdw2pdac8k7xyb",
+  "hash": "sha256-y/czEVPtCt4uN1n49Qi7BrgZmkG+SDXlM5D2GvvO2qg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -2743,44 +2807,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-readline = callPackage({ buildLuarocksPackage, fetchurl, luaAtLeast, luaOlder, lua, luaposix }:
-buildLuarocksPackage {
-  pname = "readline";
-  version = "3.2-0";
-  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/readline-3.2-0.rockspec";
-    sha256 = "1r0sgisxm4xd1r6i053iibxh30j7j3rcj4wwkd8rzkj8nln20z24";
-  }).outPath;
-  src = fetchurl {
-    url    = "http://www.pjb.com.au/comp/lua/readline-3.2.tar.gz";
-    sha256 = "1mk9algpsvyqwhnq7jlw4cgmfzj30l7n2r6ak4qxgdxgc39f48k4";
-  };
-
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
-  propagatedBuildInputs = [ lua luaposix ];
-
-  meta = {
-    homepage = "http://pjb.com.au/comp/lua/readline.html";
-    description = "Interface to the readline library";
-    license.fullName = "MIT/X11";
-  };
-}) {};
-
-rest-nvim = callPackage({ lua, luaAtLeast, buildLuarocksPackage, luaOlder, fetchzip, plenary-nvim }:
+rest-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "rest.nvim";
-  version = "0.1-2";
+  version = "0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rest.nvim-0.1-2.rockspec";
-    sha256 = "0l8k91483nz75ijgnyfb8r7mynsaps7ikvjkziimf62bv7aks3qh";
+    url    = "mirror://luarocks/rest.nvim-0.2-1.rockspec";
+    sha256 = "1yq8gx585c10j8kybp20swyv9q0i3lm5k0rrv4bgsbwz3ychn0k1";
   }).outPath;
   src = fetchzip {
-    url    = "http://github.com/rest-nvim/rest.nvim/archive/0.1.zip";
-    sha256 = "0yf1a1cjrrzw0wmjgg48g3qn9kfxn7hv38yx88l1sc1r1nsfijrq";
+    url    = "https://github.com/rest-nvim/rest.nvim/archive/0.2.zip";
+    sha256 = "0ycjrrl37z465p71bdkas3q2ky1jmgr2cjnirnskdc6wz14wl09g";
   };
 
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ lua plenary-nvim ];
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "https://github.com/rest-nvim/rest.nvim";
@@ -2814,23 +2855,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-say = callPackage({ luaOlder, fetchgit, lua, buildLuarocksPackage }:
+say = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "say";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/say.git",
-  "rev": "45a3057e68c52b34ab59ef167efeb2340e356661",
-  "date": "2022-08-27T11:00:01+03:00",
-  "path": "/nix/store/324ryi5hlaisnyp4wpd1hvzcfv508i4s-say",
-  "sha256": "178pdsswwnja2f106701xmdxsdijjl5smm28dhhdcmjyb4mn8cr2",
+  "rev": "3e1f783d0aa496eb21d16e85b2235335cb9332df",
+  "date": "2023-08-13T02:37:27+03:00",
+  "path": "/nix/store/5biavac0k8z0xg4rr3bm8z3kdi8mm8c0-say",
+  "sha256": "04dkf0av6n71vmz0h86i5brklvaf9p91lkldn1xldpdr0qqs0x63",
+  "hash": "sha256-w3SgMQa53UZ7sI1OGtJNTm068yrRIAh+3eFYsxVwsxE=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -2842,7 +2884,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-serpent = callPackage({ fetchgit, luaAtLeast, lua, buildLuarocksPackage, luaOlder }:
+serpent = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "serpent";
   version = "0.30-2";
@@ -2856,12 +2898,13 @@ buildLuarocksPackage {
   "date": "2017-09-01T21:35:14-07:00",
   "path": "/nix/store/z6df44n3p07n4bia7s514vgngbkbpnap-serpent",
   "sha256": "0q80yfrgqgr01qprf0hrp284ngb7fbcq1v9rbzmdkhbm9lpgy8v8",
+  "hash": "sha256-aCP/Lk11wdnqXzntgNlyZz1LkLgZApcvDiA//LLzAGE=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -2874,7 +2917,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-sqlite = callPackage({ fetchgit, buildLuarocksPackage, luv }:
+sqlite = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, luv }:
 buildLuarocksPackage {
   pname = "sqlite";
   version = "v1.2.2-0";
@@ -2888,12 +2931,13 @@ buildLuarocksPackage {
   "date": "2022-06-17T15:57:13+03:00",
   "path": "/nix/store/637s46bsvsxfnzmy6ygig3y0vqmf3r8p-sqlite.lua",
   "sha256": "0ckifx6xxrannn9szacgiiqjsp4rswghxscdl3s411dhas8djj1m",
+  "hash": "sha256-NUjZkFawhUD0oI3pDh/XmVwtcYyPqa+TtVbl3k13cTI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ luv ];
 
@@ -2904,7 +2948,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-std-_debug = callPackage({ buildLuarocksPackage, lua, luaOlder, fetchgit, luaAtLeast }:
+std-_debug = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "std._debug";
   version = "git-1";
@@ -2915,12 +2959,13 @@ buildLuarocksPackage {
   "date": "2023-01-31T16:39:35-07:00",
   "path": "/nix/store/i24iz2hvnjp18iz9z8kljsy9iv17m2zl-_debug",
   "sha256": "07z5lz3gy8wzzks79r3v68vckj42i3sybhfmqx7h2s58ld2kn5fd",
+  "hash": "sha256-zRU7RaOoaAFPx9XB5fWIgsjJNjJ75HT0/J8j/8an5R8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -2932,23 +2977,18 @@ buildLuarocksPackage {
   };
 }) {};
 
-std-normalize = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, std-_debug, luaOlder }:
+std-normalize = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder, std-_debug }:
 buildLuarocksPackage {
   pname = "std.normalize";
-  version = "git-1";
-
-  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/lua-stdlib/normalize.git",
-  "rev": "ccc697998af22d9d7f675e73f4b27c7a52151b5c",
-  "date": "2022-01-02T16:33:35-08:00",
-  "path": "/nix/store/nvyy1ibp43pzaldj6ark02ypqr45wmy1-normalize",
-  "sha256": "1m6x4lp7xzghvagbqjljyqfcpilh76j25b71da6jd304xc9r0ngy",
-  "fetchLFS": false,
-  "fetchSubmodules": true,
-  "deepClone": false,
-  "leaveDotGit": false
-}
- '') ["date" "path"]) ;
+  version = "2.0.3-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/std.normalize-2.0.3-1.rockspec";
+    sha256 = "1l83ikiaw4dch2r69cxpl93b9d4wf54vbjb6fcggnkxxgm0amj3a";
+  }).outPath;
+  src = fetchzip {
+    url    = "http://github.com/lua-stdlib/normalize/archive/v2.0.3.zip";
+    sha256 = "1gyywglxd2y7ck3hk8ap73w0x7hf9irpg6vgs8yc6k9k4c5g3fgi";
+  };
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua std-_debug ];
@@ -2960,7 +3000,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-stdlib = callPackage({ buildLuarocksPackage, luaAtLeast, fetchzip, lua, luaOlder }:
+stdlib = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "stdlib";
   version = "41.2.2-1";
@@ -2984,7 +3024,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-teal-language-server = callPackage({ luafilesystem, buildLuarocksPackage, dkjson, cyan, fetchgit }:
+teal-language-server = callPackage({ buildLuarocksPackage, cyan, dkjson, fetchgit, fetchurl, luafilesystem }:
 buildLuarocksPackage {
   pname = "teal-language-server";
   version = "dev-1";
@@ -2998,12 +3038,13 @@ buildLuarocksPackage {
   "date": "2022-12-21T20:33:53-06:00",
   "path": "/nix/store/qyaz38njm8qgyfxca6m6f8i4lkfcfdb0-teal-language-server",
   "sha256": "12nqarykmdvxxci9l6gq2yhn4pjzzqlxyrl2c8svb97hka68wjvx",
+  "hash": "sha256-fUuOjJrwpLU1YoJm3yn+X15ioRf4GZoi6323On1W2Io=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ cyan dkjson luafilesystem ];
 
@@ -3014,17 +3055,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-telescope-manix = callPackage({ telescope-nvim, buildLuarocksPackage, lua, fetchzip, luaOlder }:
+telescope-manix = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, telescope-nvim }:
 buildLuarocksPackage {
   pname = "telescope-manix";
-  version = "0.4.0-1";
+  version = "0.5.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/telescope-manix-0.4.0-1.rockspec";
-    sha256 = "1kh3dn4aixydxrq01sbl40v7if8bmpsvv30qf7vig7dvl21aqkrp";
+    url    = "mirror://luarocks/telescope-manix-0.5.0-1.rockspec";
+    sha256 = "0i5q9sr0vn0w6yqg530jx2fx52k9jr7rss4ibl49f1x3wv6sckv1";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/telescope-manix/archive/0.4.0.zip";
-    sha256 = "153fqnk8iymyq309kpfiz3xmlqryj02rji3z7air23bgyjkx0gr8";
+    url    = "https://github.com/mrcjkb/telescope-manix/archive/0.5.0.zip";
+    sha256 = "093vkh822ycnc1pri3zmzzqnz235xxam3z1l67zyyqlc1apbarax";
   };
 
   disabled = (luaOlder "5.1");
@@ -3037,7 +3078,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-telescope-nvim = callPackage({ plenary-nvim, buildLuarocksPackage, lua, fetchgit }:
+telescope-nvim = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, plenary-nvim }:
 buildLuarocksPackage {
   pname = "telescope.nvim";
   version = "scm-1";
@@ -3047,16 +3088,17 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-telescope/telescope.nvim",
-  "rev": "a3f17d3baf70df58b9d3544ea30abe52a7a832c2",
-  "date": "2023-02-26T13:26:12+01:00",
-  "path": "/nix/store/qyzs7im9nqn04h9w9nii4nv12ysgk1fk-telescope.nvim",
-  "sha256": "136pik53kwl2avjdakwfls10d85jqybl7yd0mbzxc5nry8krav22",
+  "rev": "74ce793a60759e3db0d265174f137fb627430355",
+  "date": "2023-10-11T12:29:23+02:00",
+  "path": "/nix/store/7k50qqgamc2ldxdf54jqs8sy8m8vcfzr-telescope.nvim",
+  "sha256": "1m4v097y8ypjm572k1qqii3z56w4x1dsjxd6gp0z24xqyvd4kpa4",
+  "hash": "sha256-RN1J2va4E/HBfaZ1qVvohJvyR4wYhylOqfJ65E8Cm9Q=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (lua.luaversion != "5.1");
   propagatedBuildInputs = [ lua plenary-nvim ];
@@ -3068,26 +3110,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-tl = callPackage({ compat53, luafilesystem, argparse, buildLuarocksPackage, fetchgit }:
+tl = callPackage({ argparse, buildLuarocksPackage, compat53, fetchgit, fetchurl, luafilesystem }:
 buildLuarocksPackage {
   pname = "tl";
-  version = "0.15.1-1";
+  version = "0.15.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/tl-0.15.1-1.rockspec";
-    sha256 = "0f9wr91pxcvx43jp9ma4yb6f0r9yrc2fm437nx7xm0dyh7kac9p6";
+    url    = "mirror://luarocks/tl-0.15.2-1.rockspec";
+    sha256 = "1qisdflgikry0jdqvnzdcqib2svbafp10n0gfwm3fcrzqsdxy0xr";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/teal-language/tl",
-  "rev": "a10fb2c69827c1b0f8e1b8a5c848a06d6da5d3be",
-  "date": "2023-01-23T18:14:26-03:00",
-  "path": "/nix/store/x5p9v443g53sz2c8rvxa465gzfiv47wb-tl",
-  "sha256": "0hql1274wxji54cadalv4j3k82vd9xasvi119cdnm16mh85ir70s",
+  "rev": "d2fc36b5ff9a52d7265e63eb74cce70fd1cdbcb2",
+  "date": "2023-04-27T11:28:21-03:00",
+  "path": "/nix/store/ramhj3a29lrn0bblbgyxn4712a7caq8k-tl",
+  "sha256": "1dgldi9pgg23iz3xis4i43bnvkwirh7kkycmr5xp75s2cc85zhg0",
+  "hash": "sha256-4MFfEGNCl3N7yZX5OQ/Mkc9t1yCR6NjHj0O8d1Ns9LU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ argparse compat53 luafilesystem ];
 
@@ -3099,7 +3142,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-toml = callPackage({ lua, fetchgit, luaOlder, buildLuarocksPackage }:
+toml = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "toml";
   version = "0.3.0-0";
@@ -3113,12 +3156,13 @@ buildLuarocksPackage {
   "date": "2023-02-19T23:00:49-05:00",
   "path": "/nix/store/p6a98sqp9a4jwsw6ghqcwpn9lxmhvkdg-toml.lua",
   "sha256": "05p33bq0ajl41vbsw9bx73shpf0p11n5gb6yy8asvp93zh2m51hq",
+  "hash": "sha256-GIZSBfwj3a0V8t6sV2wIF7gL9Th9Ja7XDoRKBfAa4xY=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -3131,7 +3175,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-toml-edit = callPackage({ luaOlder, luarocks-build-rust-mlua, buildLuarocksPackage, lua, fetchgit }:
+toml-edit = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, luarocks-build-rust-mlua }:
 buildLuarocksPackage {
   pname = "toml-edit";
   version = "0.1.4-1";
@@ -3145,12 +3189,13 @@ buildLuarocksPackage {
   "date": "2023-10-02T16:54:10+02:00",
   "path": "/nix/store/p1368agmqg4jwb1qvf2iff3fdrq9vkdj-toml-edit.lua",
   "sha256": "1aa8znjnmm84392gnl7w0hm069xfv7niym3i8my7kyk0vdgxja06",
+  "hash": "sha256-BijZX9tg+nl8RXFUH+3ZricDKgT8UPtEGgTVaqX9SKk=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua luarocks-build-rust-mlua ];
@@ -3163,7 +3208,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-vstruct = callPackage({ fetchgit, lua, buildLuarocksPackage, luaOlder }:
+vstruct = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "vstruct";
   version = "2.1.1-1";
@@ -3174,12 +3219,13 @@ buildLuarocksPackage {
   "date": "2020-05-06T23:13:06-04:00",
   "path": "/nix/store/a4i9k5hx9xiz38bij4hb505dg088jkss-vstruct",
   "sha256": "0sl9v874mckhh6jbxsan48s5xajzx193k4qlphw69sdbf8kr3p57",
+  "hash": "sha256-p9yRJ3Kr6WQ4vBSTOVLoX6peNCJW6b6kgXCySg7aiWo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -3190,26 +3236,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-vusted = callPackage({ buildLuarocksPackage, fetchgit, busted }:
+vusted = callPackage({ buildLuarocksPackage, busted, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "vusted";
-  version = "2.2.0-1";
+  version = "2.3.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/vusted-2.2.0-1.rockspec";
-    sha256 = "1ri96pdwhck1sbdnkqj9ksv9hs86pv8v2f6vl25696v9snp9jkzs";
+    url    = "mirror://luarocks/vusted-2.3.1-1.rockspec";
+    sha256 = "03h7l12xk43rql9vxb5nzfimx9srwaazx2r3j2zm1ba2qz06h0qc";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/notomo/vusted.git",
-  "rev": "f142170d3b802f6cedfcff67b945a260087ecf65",
-  "date": "2023-01-03T11:23:56+09:00",
-  "path": "/nix/store/la7h2a39wnjkdg1fzhkgw3hbrhs4c5kf-vusted",
-  "sha256": "17pdwaqjfkv2b7a801k5fdg2s0s75miiilfdjgmsyv7phighvkvw",
+  "rev": "2bc6818a756e47240d9284f1dfac21b011ca84ea",
+  "date": "2023-10-09T11:47:28+09:00",
+  "path": "/nix/store/jq2yl4adpnyilp3yyw161j1a29bwahqi-vusted",
+  "sha256": "04lxc78n3h1qhby6b4k9x8hb1c3sgqdid71fsvyg4y6j7rb55a8z",
+  "hash": "sha256-H6lSVj7SePL81i6cFht+erCwIOppkmX8gjjAYdFhnRI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ busted ];
 
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 62d4e066e50..66e92b58f85 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -117,12 +117,6 @@ with prev;
       '';
   });
 
-  cyrussasl = prev.cyrussasl.overrideAttrs (drv: {
-    externalDeps = [
-      { name = "LIBSASL"; dep = cyrus_sasl; }
-    ];
-  });
-
   fennel = prev.fennel.overrideAttrs(oa: {
     nativeBuildInputs = oa.nativeBuildInputs ++ [
       installShellFiles
@@ -322,7 +316,7 @@ with prev;
     externalDeps = [
       { name = "EVENT"; dep = libevent; }
     ];
-    disabled = luaOlder "5.1" || luaAtLeast "5.4";
+    meta.broken = luaOlder "5.1" || luaAtLeast "5.4";
   });
 
   luaexpat = prev.luaexpat.overrideAttrs (_: {
@@ -386,6 +380,11 @@ with prev;
     ];
   });
 
+  # lua-resty-session =  prev.lua-resty-session.overrideAttrs (oa: {
+  #   # lua_pack and lua-ffi-zlib are unpackaged, causing this package to not evaluate
+  #   meta.broken = true;
+  # });
+
   lua-yajl =  prev.lua-yajl.overrideAttrs (oa: {
     buildInputs = oa.buildInputs ++ [
       yajl
@@ -514,8 +513,21 @@ with prev;
     '';
   });
 
-  readline = prev.readline.overrideAttrs (oa: {
-    propagatedBuildInputs = oa.propagatedBuildInputs ++ [ readline.out ];
+  readline = final.callPackage({ buildLuarocksPackage, fetchurl, luaAtLeast, luaOlder, lua, luaposix }:
+  buildLuarocksPackage ({
+    pname = "readline";
+    version = "3.2-0";
+    knownRockspec = (fetchurl {
+      url    = "mirror://luarocks/readline-3.2-0.rockspec";
+      sha256 = "1r0sgisxm4xd1r6i053iibxh30j7j3rcj4wwkd8rzkj8nln20z24";
+    }).outPath;
+    src = fetchurl {
+      # the rockspec url doesn't work because 'www.' is not covered by the certificate so
+      # I manually removed the 'www' prefix here
+      url    = "http://pjb.com.au/comp/lua/readline-3.2.tar.gz";
+      sha256 = "1mk9algpsvyqwhnq7jlw4cgmfzj30l7n2r6ak4qxgdxgc39f48k4";
+    };
+
     extraVariables = rec {
       READLINE_INCDIR = "${readline.dev}/include";
       HISTORY_INCDIR = READLINE_INCDIR;
@@ -524,9 +536,19 @@ with prev;
       unzip "$curSrc"
       tar xf *.tar.gz
     '';
-    # Without this, source root is wrongly set to ./readline-2.6/doc
-    sourceRoot = "readline-${lib.versions.majorMinor oa.version}";
-  });
+
+    disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
+    propagatedBuildInputs = [ lua luaposix
+      readline.out
+    ];
+
+    meta = {
+      homepage = "http://pjb.com.au/comp/lua/readline.html";
+      description = "Interface to the readline library";
+      license.fullName = "MIT/X11";
+    };
+  })) {};
+
 
   sqlite = prev.sqlite.overrideAttrs (drv: {
 
diff --git a/pkgs/development/perl-modules/generic/builder.sh b/pkgs/development/perl-modules/generic/builder.sh
index 110094ad8a4..4da9f7a9821 100644
--- a/pkgs/development/perl-modules/generic/builder.sh
+++ b/pkgs/development/perl-modules/generic/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 PERL5LIB="$PERL5LIB${PERL5LIB:+:}$out/lib/perl5/site_perl"
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index b988abe6010..326b9ff94cf 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -33,25 +33,23 @@
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.8.5";
+  version = "3.8.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uVUuxSzBR9vxlErHrJivdgLlHqLc0HbtGUyjwNHH0Lw=";
+    hash = "sha256-sM8qRQG/+TMKilJItM6VGFHkFb3M6dwVjnbP1V4VCFw=";
   };
 
   patches = [
     (fetchpatch {
       # https://github.com/aio-libs/aiohttp/pull/7260
-      # Merged upstream, should likely be dropped post-3.8.5
+      # Merged upstream, should be dropped once updated to 3.9.0
       url = "https://github.com/aio-libs/aiohttp/commit/7dcc235cafe0c4521bbbf92f76aecc82fee33e8b.patch";
       hash = "sha256-ZzhlE50bmA+e2XX2RH1FuWQHZIAa6Dk/hZjxPoX5t4g=";
     })
-    # https://github.com/aio-libs/aiohttp/pull/7454 but does not merge cleanly
-    ./setuptools-67.5.0-compatibility.diff
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff b/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff
deleted file mode 100644
index 2f75b6b4c13..00000000000
--- a/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/setup.cfg b/setup.cfg
-index 6944b7e2..dfa65d69 100644
---- a/setup.cfg
-+++ b/setup.cfg
-@@ -128,6 +128,7 @@ filterwarnings =
- 	ignore:Creating a LegacyVersion has been deprecated and will be removed in the next major release:DeprecationWarning::
- 	ignore:module 'sre_constants' is deprecated:DeprecationWarning:pkg_resources._vendor.pyparsing
- 	ignore:path is deprecated. Use files.. instead. Refer to https.//importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy for migration advice.:DeprecationWarning:certifi.core
-+	ignore:pkg_resources is deprecated as an API:DeprecationWarning
- junit_suite_name = aiohttp_test_suite
- norecursedirs = dist docs build .tox .eggs
- minversion = 3.8.2
-diff --git a/tests/test_circular_imports.py b/tests/test_circular_imports.py
-index 22e5ea47..a655fd1d 100644
---- a/tests/test_circular_imports.py
-+++ b/tests/test_circular_imports.py
-@@ -113,6 +113,10 @@ def test_no_warnings(import_path: str) -> None:
-         "-W",
-         "ignore:Creating a LegacyVersion has been deprecated and will "
-         "be removed in the next major release:DeprecationWarning:",
-+        # Deprecation warning emitted by setuptools v67.5.0+ triggered by importing
-+        # `gunicorn.util`.
-+        "-W", "ignore:pkg_resources is deprecated as an API:"
-+        "DeprecationWarning",
-         "-c", f"import {import_path!s}",
-         # fmt: on
-     )
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 5a7b1af3e8f..32a8baa4486 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -2,7 +2,6 @@
 , boto3
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , jsonschema
 , parameterized
 , pydantic
@@ -17,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.74.0";
+  version = "1.78.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,16 +25,9 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "serverless-application-model";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uOfBR0bvLVyBcfSAkSqOx4KjmSYbfktpJlxKjipfj50=";
+    hash = "sha256-hSXJBEntj3k3Kml+Yuvn19X7YXL+Y1hXBkb8iZ7DxR4=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/aws/serverless-application-model/commit/e41b0f02204635a655100b68dd38220af32a2728.patch";
-      hash = "sha256-V6KXdXQUr9fvLzxI6sUMrSRnGX5SrAaDygcaQ87FaQ8=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace " --cov samtranslator --cov-report term-missing --cov-fail-under 95" ""
@@ -87,7 +79,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python library to transform SAM templates into AWS CloudFormation templates";
-    homepage = "https://github.com/awslabs/serverless-application-model";
+    homepage = "https://github.com/aws/serverless-application-model";
     changelog = "https://github.com/aws/serverless-application-model/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index e6ac07612c4..779871db10e 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.28.9"; # N.B: if you change this, change botocore and awscli to a matching version
+  version = "1.28.57"; # N.B: if you change this, change botocore and awscli to a matching version
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-NkNHA20yn1Q7uoq/EL1Wn8F1fpi1waQujutGIKsnxlI=";
+    hash = "sha256-+kuILCUK10tvpfTEAHZGvKKmpw6Pgn+v2kQkwCkPMKg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 3dac327a48b..ddb9d35d05f 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.31.48"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.31.57"; # N.B: if you change this, change boto3 and awscli to a matching version
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-btFvZqpu1gcP7SbWl2TLFMd1nkzAscGRKDzEiwXWXek=";
+    hash = "sha256-MBQ2F0Y1vsc5siW4QPw2XKAOXBpj5bKhnuZ50gTgG3g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cffi/darwin-use-libffi-closures.diff b/pkgs/development/python-modules/cffi/darwin-use-libffi-closures.diff
index c48c8090dd4..fdbec4f6fe4 100644
--- a/pkgs/development/python-modules/cffi/darwin-use-libffi-closures.diff
+++ b/pkgs/development/python-modules/cffi/darwin-use-libffi-closures.diff
@@ -1,7 +1,8 @@
-diff -r bac92fcfe4d7 c/_cffi_backend.c
---- a/c/_cffi_backend.c	Mon Jul 18 15:58:34 2022 +0200
-+++ b/c/_cffi_backend.c	Sat Aug 20 12:38:31 2022 -0700
-@@ -96,7 +96,7 @@
+diff --git a/src/c/_cffi_backend.c b/src/c/_cffi_backend.c
+index 537271f..9c3bf94 100644
+--- a/src/c/_cffi_backend.c
++++ b/src/c/_cffi_backend.c
+@@ -103,7 +103,7 @@
  # define CFFI_CHECK_FFI_PREP_CIF_VAR 0
  # define CFFI_CHECK_FFI_PREP_CIF_VAR_MAYBE 0
  
@@ -10,7 +11,7 @@ diff -r bac92fcfe4d7 c/_cffi_backend.c
  
  # define CFFI_CHECK_FFI_CLOSURE_ALLOC __builtin_available(macos 10.15, ios 13, watchos 6, tvos 13, *)
  # define CFFI_CHECK_FFI_CLOSURE_ALLOC_MAYBE 1
-@@ -6413,7 +6413,7 @@
+@@ -6422,7 +6422,7 @@ static PyObject *b_callback(PyObject *self, PyObject *args)
      else
  #endif
      {
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 0d93941b974..7b2547afff1 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , isPyPy
 , fetchPypi
-, fetchpatch
+, setuptools
 , pytestCheckHook
 , libffi
 , pkg-config
@@ -13,11 +13,12 @@
 
 if isPyPy then null else buildPythonPackage rec {
   pname = "cffi";
-  version = "1.15.1";
+  version = "1.16.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1AC/uaN7E1ElPLQCZxzqfom97MKU6AFqcH9tHYrJNPk=";
+    hash = "sha256-vLPvQ+WGZbvaL7GYaY/K5ndkg+DEpjGqVkeAbCXgLMA=";
   };
 
   patches = [
@@ -32,38 +33,12 @@ if isPyPy then null else buildPythonPackage rec {
     # deemed safe to trust in cffi.
     #
     ./darwin-use-libffi-closures.diff
-    (fetchpatch {
-      # Drop py.code usage from tests, no longer depend on the deprecated py package
-      url = "https://foss.heptapod.net/pypy/cffi/-/commit/9c7d865e17ec16a847090a3e0d1498b698b99756.patch";
-      excludes = [
-        "README.md"
-        "requirements.txt"
-      ];
-      hash = "sha256-HSuLLIYXXGGCPccMNLV7o1G3ppn2P0FGCrPjqDv2e7k=";
-    })
-    (fetchpatch {
-      #  Replace py.test usage with pytest
-      url = "https://foss.heptapod.net/pypy/cffi/-/commit/bd02e1b122612baa74a126e428bacebc7889e897.patch";
-      excludes = [
-        "README.md"
-        "requirements.txt"
-      ];
-      hash = "sha256-+2daRTvxtyrCPimOEAmVbiVm1Bso9hxGbaAbd03E+ws=";
-    })
   ] ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc) "13") [
     # -Wnull-pointer-subtraction is enabled with -Wextra. Suppress it to allow the following tests
     # to run and pass when cffi is built with newer versions of clang:
     # - testing/cffi1/test_verify1.py::test_enum_usage
     # - testing/cffi1/test_verify1.py::test_named_pointer_as_argument
     ./clang-pointer-substraction-warning.diff
-  ] ++  lib.optionals (pythonAtLeast "3.11") [
-    # Fix test that failed because python seems to have changed the exception format in the
-    # final release. This patch should be included in the next version and can be removed when
-    # it is released.
-    (fetchpatch {
-      url = "https://foss.heptapod.net/pypy/cffi/-/commit/8a3c2c816d789639b49d3ae867213393ed7abdff.diff";
-      hash = "sha256-3wpZeBqN4D8IP+47QDGK7qh/9Z0Ag4lAe+H0R5xCb1E=";
-    })
   ];
 
   postPatch = lib.optionalString stdenv.isDarwin ''
@@ -74,11 +49,18 @@ if isPyPy then null else buildPythonPackage rec {
       --replace '/usr/include/libffi' '${lib.getDev libffi}/include'
   '';
 
-  buildInputs = [ libffi ];
+  nativeBuildInputs = [
+    pkg-config
+    setuptools
+  ];
 
-  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    libffi
+  ];
 
-  propagatedBuildInputs = [ pycparser ];
+  propagatedBuildInputs = [
+    pycparser
+  ];
 
   # The tests use -Werror but with python3.6 clang detects some unreachable code.
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
@@ -86,18 +68,16 @@ if isPyPy then null else buildPythonPackage rec {
 
   doCheck = !stdenv.hostPlatform.isMusl;
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  disabledTests = lib.optionals stdenv.isDarwin [
-    # AssertionError: cannot seem to get an int[10] not completely cleared
-    # https://foss.heptapod.net/pypy/cffi/-/issues/556
-    "test_ffi_new_allocator_1"
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
   meta = with lib; {
-    maintainers = with maintainers; [ domenkozar lnl7 ];
+    changelog = "https://github.com/python-cffi/cffi/releases/tag/v${version}";
+    description = "Foreign Function Interface for Python calling C code";
+    downloadPage = "https://github.com/python-cffi/cffi";
     homepage = "https://cffi.readthedocs.org/";
     license = licenses.mit;
-    description = "Foreign Function Interface for Python calling C code";
+    maintainers = teams.python.members;
   };
 }
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 553f313bd0b..428cf9f8d91 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -80,7 +80,8 @@ buildPythonPackage rec {
     python-jose
     trio
     sqlalchemy
-  ] ++ passthru.optional-dependencies.all;
+  ] ++ passthru.optional-dependencies.all
+  ++ python-jose.optional-dependencies.cryptography;
 
   pytestFlagsArray = [
     # ignoring deprecation warnings to avoid test failure from
diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
index 4ea6857cbd3..4bfbb494f64 100644
--- a/pkgs/development/python-modules/flask-cors/default.nix
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -1,27 +1,37 @@
-{ lib, fetchPypi, buildPythonPackage
-, nose, flask, six, packaging }:
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, flask
+, packaging
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "Flask-Cors";
-  version = "3.0.10";
+  version = "4.0.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "b60839393f3b84a0f3746f6cdca56c1ad7426aa738b70d6c61375857823181de";
+  src = fetchFromGitHub {
+    owner = "corydolphin";
+    repo = "flask-cors";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dRrgSJ5CADM0/VNSMYPPk3CALmyMH18OofrONVEKNMU=";
   };
 
-  nativeCheckInputs = [ nose packaging ];
-  propagatedBuildInputs = [ flask six ];
+  propagatedBuildInputs = [
+    flask
+  ];
 
-  # Exclude test_acl_uncaught_exception_500 test case because is not compatible
-  # with Flask>=1.1.0. See: https://github.com/corydolphin/flask-cors/issues/253
-  checkPhase = ''
-    nosetests --exclude test_acl_uncaught_exception_500
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+    packaging
+  ];
 
   meta = with lib; {
     description = "A Flask extension adding a decorator for CORS support";
     homepage = "https://github.com/corydolphin/flask-cors";
+    changelog = "https://github.com/corydolphin/flask-cors/releases/tag/v${version}";
     license = with licenses; [ mit ];
+    maintainers = with maintainers; [ nickcao ];
   };
 }
diff --git a/pkgs/development/python-modules/jedi/default.nix b/pkgs/development/python-modules/jedi/default.nix
index 5f802767c83..eb90d3c907e 100644
--- a/pkgs/development/python-modules/jedi/default.nix
+++ b/pkgs/development/python-modules/jedi/default.nix
@@ -3,16 +3,22 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
+, parso
+
+# tests
 , attrs
-, django_3
 , pytestCheckHook
-, parso
 }:
 
 buildPythonPackage rec {
   pname = "jedi";
-  version = "0.19.0";
-  format = "setuptools";
+  version = "0.19.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -20,15 +26,20 @@ buildPythonPackage rec {
     owner = "davidhalter";
     repo = "jedi";
     rev = "v${version}";
-    hash = "sha256-Hw0+KQkB9ICWbBJDQQmHyKngzJlJ8e3wlpe4aSrlkvo=";
+    hash = "sha256-MD7lIKwAwULZp7yLE6jiao2PU6h6RIl0SQ/6b4Lq+9I=";
     fetchSubmodules = true;
   };
 
-  propagatedBuildInputs = [ parso ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    parso
+  ];
 
   nativeCheckInputs = [
     attrs
-    django_3
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/markdown-macros/default.nix b/pkgs/development/python-modules/markdown-macros/default.nix
index e95cbe3c4c1..e0e41bf3d0a 100644
--- a/pkgs/development/python-modules/markdown-macros/default.nix
+++ b/pkgs/development/python-modules/markdown-macros/default.nix
@@ -16,8 +16,10 @@ buildPythonPackage rec {
 
   patches = [
     # Fixes a bug with markdown>2.4
+    # https://github.com/wnielson/markdown-macros/pull/1
     (fetchpatch {
-      url = "https://github.com/wnielson/markdown-macros/pull/1.patch";
+      name = "wnielson-markdown-macros-pull-1.patch";
+      url = "https://github.com/wnielson/markdown-macros/commit/e38cba9acb6789cc128f6fe9ca427ba71815a20f.patch";
       sha256 = "17njbgq2srzkf03ar6yn92frnsbda3g45cdi529fdh0x8mmyxci0";
     })
   ];
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index 73e95a6e1ea..2dc5bd55ee7 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -1,54 +1,55 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
 
-# build
+# build-system
 , setuptools
 
-# runtime
-, aws-xray-sdk
+# dependencies
 , boto3
 , botocore
-, cfn-lint
 , cryptography
+, jinja2
+, python-dateutil
+, requests
+, responses
+, werkzeug
+, xmltodict
+
+# optional-dependencies
+, aws-xray-sdk
+, cfn-lint
 , docker
+, ecdsa
 , flask
 , flask-cors
 , graphql-core
-, idna
-, jinja2
 , jsondiff
+, multipart
 , openapi-spec-validator
+, py-partiql-parser
 , pyparsing
-, python-dateutil
 , python-jose
 , pyyaml
-, requests
-, responses
 , sshpubkeys
-, werkzeug
-, xmltodict
 
 # tests
 , freezegun
-, py-partiql-parser
 , pytestCheckHook
 , pytest-xdist
-, sure
 }:
 
 buildPythonPackage rec {
   pname = "moto";
-  version = "4.2.2";
-  format = "pyproject";
+  version = "4.2.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7jTEw/U5ANlTGAlGkgyduhJ6SD4u1A5tv5PUri52Dnw=";
+    hash = "sha256-zgpV1+dWxZpaQ5LHCXqlylPgCqLdP3AACTNWvhXnrvk=";
   };
 
   nativeBuildInputs = [
@@ -56,114 +57,91 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    aws-xray-sdk
     boto3
     botocore
-    cfn-lint
     cryptography
-    docker
-    flask
-    flask-cors
-    graphql-core
-    idna
-    jinja2
-    jsondiff
-    openapi-spec-validator
-    pyparsing
-    python-dateutil
-    python-jose
-    pyyaml
     requests
-    responses
-    sshpubkeys
-    werkzeug
     xmltodict
+    werkzeug
+    python-dateutil
+    responses
+    jinja2
   ];
 
+  passthru.optional-dependencies = {
+    # non-exhaustive list of extras, that was cobbled together for testing
+    all = [
+      aws-xray-sdk
+      cfn-lint
+      docker
+      ecdsa
+      flask
+      flask-cors
+      graphql-core
+      jsondiff
+      multipart
+      openapi-spec-validator
+      py-partiql-parser
+      pyparsing
+      python-jose
+      pyyaml
+      setuptools
+      sshpubkeys
+    ] ++ python-jose.optional-dependencies.cryptography;
+  };
+
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
     freezegun
-    py-partiql-parser
     pytestCheckHook
-    sure
-  ];
+    pytest-xdist
+  ] ++ passthru.optional-dependencies.all;
 
   pytestFlagsArray = [
-    # Disable tests that try to access the network
-    "--deselect=tests/test_cloudformation/test_cloudformation_custom_resources.py::test_create_custom_lambda_resource__verify_cfnresponse_failed"
-    "--deselect=tests/test_cloudformation/test_server.py::test_cloudformation_server_get"
-    "--deselect=tests/test_core/test_decorator_calls.py::test_context_manager"
-    "--deselect=tests/test_core/test_decorator_calls.py::test_decorator_start_and_stop"
-    "--deselect=tests/test_core/test_request_mocking.py::test_passthrough_requests"
-    "--deselect=tests/test_firehose/test_firehose_put.py::test_put_record_batch_http_destination"
-    "--deselect=tests/test_firehose/test_firehose_put.py::test_put_record_http_destination"
-    "--deselect=tests/test_logs/test_integration.py::test_put_subscription_filter_with_lambda"
-    "--deselect=tests/test_sqs/test_integration.py::test_invoke_function_from_sqs_exception"
-    "--deselect=tests/test_sqs/test_sqs_integration.py::test_invoke_function_from_sqs_exception"
-    "--deselect=tests/test_stepfunctions/test_stepfunctions.py::test_state_machine_creation_fails_with_invalid_names"
-    "--deselect=tests/test_stepfunctions/test_stepfunctions.py::test_state_machine_list_executions_with_pagination"
-    "--deselect=tests/test_iotdata/test_iotdata.py::test_update"
-    "--deselect=tests/test_iotdata/test_iotdata.py::test_basic"
-    "--deselect=tests/test_iotdata/test_iotdata.py::test_delete_field_from_device_shadow"
-    "--deselect=tests/test_iotdata/test_iotdata.py::test_publish"
-    "--deselect=tests/test_moto_api/recorder/test_recorder.py::TestRecorder::test_s3_upload_data"
-    "--deselect=tests/test_moto_api/recorder/test_recorder.py::TestRecorder::test_s3_upload_file_using_requests"
+    "-m" "'not network and not requires_docker'"
+
+    # Fails at local name resolution
     "--deselect=tests/test_s3/test_multiple_accounts_server.py::TestAccountIdResolution::test_with_custom_request_header"
-    "--deselect=tests/test_s3/test_s3.py::test_presigned_put_url_with_approved_headers"
-    "--deselect=tests/test_s3/test_s3.py::test_presigned_put_url_with_custom_headers"
-    "--deselect=tests/test_s3/test_s3.py::test_put_chunked_with_v4_signature_in_body"
-    "--deselect=tests/test_s3/test_s3.py::test_upload_from_file_to_presigned_url"
-    "--deselect=tests/test_s3/test_server.py::test_s3_server_bucket_versioning"
     "--deselect=tests/test_s3/test_server.py::test_s3_server_post_cors_multiple_origins"
 
-    # Disable tests that require docker daemon
-    "--deselect=tests/test_core/test_docker.py::test_docker_is_running_and_available"
-    "--deselect=tests/test_events/test_events_lambdatriggers_integration.py::test_creating_bucket__invokes_lambda"
-    "--deselect=tests/test_s3/test_s3_lambda_integration.py::test_objectcreated_put__invokes_lambda"
-    "--deselect=tests/test_sqs/test_sqs_integration.py"
-
-    # json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
-    "--deselect=tests/test_cloudformation/test_cloudformation_stack_integration.py::test_lambda_function"
+    # Fails at resolving google.com
+    "--deselect=tests/test_firehose/test_firehose_put.py::test_put_record_http_destination"
+    "--deselect=tests/test_firehose/test_firehose_put.py::test_put_record_batch_http_destination"
 
-    # AssertionError: CloudWatch log event was not found.
-    "--deselect=tests/test_logs/test_integration.py::test_subscription_filter_applies_to_new_streams"
+    # Download recordings returns faulty JSON
+    "--deselect=tests/test_moto_api/recorder/test_recorder.py::TestRecorder::test_ec2_instance_creation_recording_on"
+    "--deselect=tests/test_moto_api/recorder/test_recorder.py::TestRecorder::test_ec2_instance_creation__recording_off"
 
-    # KeyError: 'global'
-    "--deselect=tests/test_iotdata/test_server.py::test_iotdata_list"
-    "--deselect=tests/test_iotdata/test_server.py::test_publish"
+    # Connection Reset by Peer, when connecting to localhost:5678
+    "--deselect=tests/test_moto_api/recorder/test_recorder.py::TestRecorder::test_replay"
 
-    # Blocks test execution
-    "--deselect=tests/test_utilities/test_threaded_server.py::TestThreadedMotoServer::test_load_data_from_inmemory_client"
-  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
-    "--deselect=tests/test_utilities/test_threaded_server.py::test_threaded_moto_server__different_port"
-    "--deselect=tests/test_utilities/test_threaded_server.py::TestThreadedMotoServer::test_server_can_handle_multiple_services"
-    "--deselect=tests/test_utilities/test_threaded_server.py::TestThreadedMotoServer::test_server_is_reachable"
+    # Requires docker, but isn't marked
+    # https://github.com/getmoto/moto/pull/6938
+    "--deselect=tests/test_awslambda/test_lambda_layers_invoked.py::test_invoke_local_lambda_layers"
 
-    # AssertionError: expected `{0}` to be greater than `{1}`
+    # Racy, expects two timestamp two differ
+    # https://github.com/getmoto/moto/issues/6946
     "--deselect=tests/test_databrew/test_databrew_recipes.py::test_publish_recipe"
   ];
 
   disabledTestPaths = [
-    # xml.parsers.expat.ExpatError: out of memory: line 1, column 0
-    "tests/test_sts/test_sts.py"
+    # Requires pytest-ordering, which is unmaintained
+    # https://github.com/getmoto/moto/issues/6937
     # botocore.exceptions.NoCredentialsError: Unable to locate credentials
+    "tests/test_dynamodb/test_dynamodb_statements.py"
+    "tests/test_lakeformation/test_resource_tags_integration.py"
     "tests/test_redshiftdata/test_redshiftdata.py"
+    "tests/test_s3/test_s3_file_handles.py"
+    "tests/test_s3/test_s3.py"
+    "tests/test_s3/test_s3_select.py"
+
     # Tries to access the network
-    "tests/test_appsync/test_appsync_schema.py"
-    "tests/test_awslambda/test_lambda_eventsourcemapping.py"
-    "tests/test_awslambda/test_lambda_invoke.py"
     "tests/test_batch/test_batch_jobs.py"
-    "tests/test_kinesis/test_kinesis.py"
-    "tests/test_kinesis/test_kinesis_stream_consumers.py"
-  ];
 
-  disabledTests = [
-    # only appears in aarch64 currently, but best to be safe
-    "test_state_machine_list_executions_with_filter"
-    # tests fail with 404 after Werkzeug 2.2 upgrade, see https://github.com/spulec/moto/issues/5341#issuecomment-1206995825
-    "test_appsync_list_tags_for_resource"
-    "test_s3_server_post_to_bucket_redirect"
+    # Threading tests regularly blocks test execution
+    "tests/test_utilities/test_threaded_server.py"
+    "tests/test_s3/test_s3_bucket_policy.py"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 147366a2c51..5f3be77651a 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -65,27 +65,22 @@
 
 buildPythonPackage rec {
   pname = "pandas";
-  version = "2.1.0";
-  format = "pyproject";
+  version = "2.1.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "pandas-dev";
     repo = "pandas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QwMW/qc1n51DaVhUnIaG0bdOvDitvvPh6ftoDawiYlc=";
+    hash = "sha256-6SgW4BtO7EFnS8P8LL4AGk5EdPwOQ0+is0wXgqsm9w0=";
   };
 
-  patches = [
-    # https://github.com/pandas-dev/pandas/issues/54888#issuecomment-1701186809
-    ./installer-fix.patch
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "meson-python==0.13.1" "meson-python>=0.13.1" \
-      --replace "meson==1.0.1" "meson>=1.0.1"
+      --replace "meson==1.2.1" "meson>=1.2.1"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pandas/installer-fix.patch b/pkgs/development/python-modules/pandas/installer-fix.patch
deleted file mode 100644
index b1659c9dbb3..00000000000
--- a/pkgs/development/python-modules/pandas/installer-fix.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff --git a/pandas/_libs/meson.build b/pandas/_libs/meson.build
-index f302c649bc..ddce9ea2d6 100644
---- a/pandas/_libs/meson.build
-+++ b/pandas/_libs/meson.build
-@@ -113,8 +113,4 @@ foreach ext_name, ext_dict : libs_sources
-     )
- endforeach
- 
--py.install_sources('__init__.py',
--                    pure: false,
--                    subdir: 'pandas/_libs')
--
- subdir('window')
-diff --git a/pandas/_libs/tslibs/meson.build b/pandas/_libs/tslibs/meson.build
-index 14d2eef46d..a862345c3a 100644
---- a/pandas/_libs/tslibs/meson.build
-+++ b/pandas/_libs/tslibs/meson.build
-@@ -30,7 +30,3 @@ foreach ext_name, ext_dict : tslibs_sources
-         install: true
-     )
- endforeach
--
--py.install_sources('__init__.py',
--                    pure: false,
--                    subdir: 'pandas/_libs/tslibs')
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 01884677f26..0891ad28ec3 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.3.0";
+  version = "8.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-d76s4iJFwhzWSySXTS53PQQuWfWIboIRecEyjzobsME=";
+    hash = "sha256-48tb5bhmBdKVjMld07303qIi5C16yaf+5TpRPVC6EQk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index ebfcdd8d557..3b5dffb42cf 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -12,7 +12,7 @@
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "10.0.1";
+  version = "10.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ import ./generic.nix (rec {
   src = fetchPypi {
     pname = "Pillow";
     inherit version;
-    hash = "sha256-1ylnsGvpMA/tXPvItbr87sSL983H2rZrHSVJA1KHGR0=";
+    hash = "sha256-5r+N5sNu2WyG6jtuHVJzxT9G71GKBiRkzX713Sz5Ljg=";
   };
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/pluggy/default.nix b/pkgs/development/python-modules/pluggy/default.nix
index e6473e98a28..1128d1c69ea 100644
--- a/pkgs/development/python-modules/pluggy/default.nix
+++ b/pkgs/development/python-modules/pluggy/default.nix
@@ -9,24 +9,23 @@
 
 buildPythonPackage rec {
   pname = "pluggy";
-  version = "1.2.0";
+  version = "1.3.0";
+
+  disabled = pythonOlder "3.8";
+
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = "pluggy";
     rev = "refs/tags/${version}";
-    hash = "sha256-SzJu7ITdmUgusn8sz6fRBpxTMQncWIViP5NCAj4q4GM=";
+    hash = "sha256-jLasnqmATIOoheGu90Wo1+iTCwslYzNOKckqHIZDJec=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
-  ];
-
   # To prevent infinite recursion with pytest
   doCheck = false;
   passthru.tests = {
diff --git a/pkgs/development/python-modules/protobuf/3.nix b/pkgs/development/python-modules/protobuf/3.nix
new file mode 100644
index 00000000000..d9e3cce5f91
--- /dev/null
+++ b/pkgs/development/python-modules/protobuf/3.nix
@@ -0,0 +1,90 @@
+{ buildPackages
+, buildPythonPackage
+, fetchpatch
+, isPyPy
+, lib
+, protobuf
+, pytestCheckHook
+, pythonAtLeast
+, tzdata
+}:
+
+assert lib.versionAtLeast protobuf.version "3.21" -> throw "Protobuf 3.20 or older required";
+
+buildPythonPackage {
+  inherit (protobuf) pname src;
+
+  version = protobuf.version;
+
+  sourceRoot = "${protobuf.src.name}/python";
+
+  patches = lib.optionals (pythonAtLeast "3.11") [
+    (fetchpatch {
+      name = "support-python311.patch";
+      url = "https://github.com/protocolbuffers/protobuf/commit/2206b63c4649cf2e8a06b66c9191c8ef862ca519.diff";
+      stripLen = 1; # because sourceRoot above
+      hash = "sha256-3GaoEyZIhS3QONq8LEvJCH5TdO9PKnOgcQF0GlEiwFo=";
+    })
+  ];
+
+  prePatch = ''
+    if [[ "$(<../version.json)" != *'"python": "'"$version"'"'* ]]; then
+      echo "Python library version mismatch. Derivation version: $version, actual: $(<../version.json)"
+      exit 1
+    fi
+  '';
+
+  # Remove the line in setup.py that forces compiling with C++14. Upstream's
+  # CMake build has been updated to support compiling with other versions of
+  # C++, but the Python build has not. Without this, we observe compile-time
+  # errors using GCC.
+  #
+  # Fedora appears to do the same, per this comment:
+  #
+  #   https://github.com/protocolbuffers/protobuf/issues/12104#issuecomment-1542543967
+  #
+  postPatch = ''
+    sed -i "/extra_compile_args.append('-std=c++14')/d" setup.py
+  '';
+
+  nativeBuildInputs = lib.optional isPyPy tzdata;
+
+  buildInputs = [ protobuf ];
+
+  propagatedNativeBuildInputs = [
+    # For protoc of the same version.
+    buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
+  ];
+
+  setupPyGlobalFlags = [ "--cpp_implementation" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = lib.optionals isPyPy [
+    # error message differs
+    "testInvalidTimestamp"
+    # requires tracemalloc which pypy does not implement
+    # https://foss.heptapod.net/pypy/pypy/-/issues/3048
+    "testUnknownFieldsNoMemoryLeak"
+    # assertion is not raised for some reason
+    "testStrictUtf8Check"
+  ];
+
+  pythonImportsCheck = [
+    "google.protobuf"
+    "google.protobuf.internal._api_implementation" # Verify that --cpp_implementation worked
+  ];
+
+  passthru = {
+    inherit protobuf;
+  };
+
+  meta = with lib; {
+    description = "Protocol Buffers are Google's data interchange format";
+    homepage = "https://developers.google.com/protocol-buffers/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ knedlsepp ];
+  };
+}
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 2676dc90d68..3a42754de77 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -11,30 +11,28 @@
 , tzdata
 }:
 
+assert lib.versionOlder protobuf.version "21" -> throw "Protobuf 21 or newer required";
+
 let
-  versionMajor = lib.versions.major protobuf.version;
-  versionMinor = lib.versions.minor protobuf.version;
-  versionPatch = lib.versions.patch protobuf.version;
+  protobufVersionMajor = lib.versions.major protobuf.version;
+  protobufVersionMinor = lib.versions.minor protobuf.version;
 in
 buildPythonPackage {
   inherit (protobuf) pname src;
 
-  # protobuf 3.21 corresponds with its python library 4.21
-  version =
-    if lib.versionAtLeast protobuf.version "3.21"
-    then "${toString (lib.toInt versionMajor + 1)}.${versionMinor}.${versionPatch}"
-    else protobuf.version;
+  # protobuf 21 corresponds with its python library 4.21
+  version = "4.${protobufVersionMajor}.${protobufVersionMinor}";
 
   sourceRoot = "${protobuf.src.name}/python";
 
-  patches = lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+  patches = lib.optionals (lib.versionAtLeast protobuf.version "22") [
     # Replace the vendored abseil-cpp with nixpkgs'
     (substituteAll {
       src = ./use-nixpkgs-abseil-cpp.patch;
       abseil_cpp_include_path = "${lib.getDev protobuf.abseil-cpp}/include";
     })
   ]
-  ++ lib.optionals (pythonAtLeast "3.11" && lib.versionOlder protobuf.version "3.22") [
+  ++ lib.optionals (pythonAtLeast "3.11" && lib.versionOlder protobuf.version "22") [
     (fetchpatch {
       name = "support-python311.patch";
       url = "https://github.com/protocolbuffers/protobuf/commit/2206b63c4649cf2e8a06b66c9191c8ef862ca519.diff";
@@ -69,14 +67,14 @@ buildPythonPackage {
 
   propagatedNativeBuildInputs = [
     # For protoc of the same version.
-    buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
+    buildPackages."protobuf_${protobufVersionMajor}"
   ];
 
   setupPyGlobalFlags = [ "--cpp_implementation" ];
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "22") [
     numpy
   ];
 
@@ -90,7 +88,7 @@ buildPythonPackage {
     "testStrictUtf8Check"
   ];
 
-  disabledTestPaths = lib.optionals (lib.versionAtLeast protobuf.version "3.23") [
+  disabledTestPaths = lib.optionals (lib.versionAtLeast protobuf.version "23") [
     # The following commit (I think) added some internal test logic for Google
     # that broke generator_test.py. There is a new proto file that setup.py is
     # not generating into a .py file. However, adding this breaks a bunch of
diff --git a/pkgs/development/python-modules/psycopg2/default.nix b/pkgs/development/python-modules/psycopg2/default.nix
index bfe33e1ec3a..43a06e5a9e4 100644
--- a/pkgs/development/python-modules/psycopg2/default.nix
+++ b/pkgs/development/python-modules/psycopg2/default.nix
@@ -8,6 +8,7 @@
 , openssl
 , sphinxHook
 , sphinx-better-theme
+, buildPackages
 }:
 
 buildPythonPackage rec {
@@ -19,20 +20,29 @@ buildPythonPackage rec {
   # c.f. https://github.com/NixOS/nixpkgs/pull/104151#issuecomment-729750892
   disabled = pythonOlder "3.6" || isPyPy;
 
+  outputs = [ "out" "doc" ];
+
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-8AzDW9cRnx/tF7hb0QB4VRlN3iy9jeAauOuxdIdECtg=";
   };
 
-  outputs = [ "out" "doc" ];
+  postPatch = ''
+    # Preferably upstream would not depend on pg_config because config scripts are incompatible with cross-compilation, however postgresql's pc file is lacking information.
+    # some linker flags are added but the linker ignores them because they're incompatible
+    # https://github.com/psycopg/psycopg2/blob/89005ac5b849c6428c05660b23c5a266c96e677d/setup.py
+    substituteInPlace setup.py \
+      --replace "self.pg_config_exe = self.build_ext.pg_config" 'self.pg_config_exe = "${lib.getExe' buildPackages.postgresql "pg_config"}"'
+  '';
 
   nativeBuildInputs = [
-    postgresql
     sphinxHook
     sphinx-better-theme
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    postgresql
+  ] ++ lib.optionals stdenv.isDarwin [
     openssl
   ];
 
@@ -45,6 +55,8 @@ buildPythonPackage rec {
     "psycopg2"
   ];
 
+  disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ buildPackages.postgresql ];
+
   meta = with lib; {
     description = "PostgreSQL database adapter for the Python programming language";
     homepage = "https://www.psycopg.org";
diff --git a/pkgs/development/python-modules/py-partiql-parser/default.nix b/pkgs/development/python-modules/py-partiql-parser/default.nix
index 07855f6b328..56036d21c10 100644
--- a/pkgs/development/python-modules/py-partiql-parser/default.nix
+++ b/pkgs/development/python-modules/py-partiql-parser/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "py-partiql-parser";
-  version = "0.3.8";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "getmoto";
     repo = "py-partiql-parser";
     rev = "refs/tags/${version}";
-    hash = "sha256-uIO06RRuUuE9qCEg/tTcn68i7vaFAAeFhxdxW9WAbuw=";
+    hash = "sha256-gxoBc7PjS4EQix38VNX6u9cwy4FCjENcUN1euOJJLCo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index fe29cde9e52..d17bc80c809 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -12,6 +12,7 @@
 , pytestCheckHook
 , libxcrypt
 , makeSetupHook
+, darwin
 }: let
   setupHook = makeSetupHook {
     name = "pybind11-setup-hook";
@@ -22,6 +23,19 @@
       pythonSitePackages = "${python}/${python.sitePackages}";
     };
   } ./setup-hook.sh;
+
+  # clang 16 defaults to C++17, which results in the use of aligned allocations by pybind11.
+  # libc++ supports aligned allocations via `posix_memalign`, which is available since 10.6,
+  # but clang has a check hard-coded requiring 10.13 because that’s when Apple first shipped a
+  # support for C++17 aligned allocations on macOS.
+  # Tell clang we’re targeting 10.13 on x86_64-darwin while continuing to use the default SDK.
+  stdenv' = if stdenv.isDarwin && stdenv.isx86_64
+    then python.stdenv.override (oldStdenv: {
+      buildPlatform = oldStdenv.buildPlatform // { darwinMinVersion = "10.13"; };
+      targetPlatform = oldStdenv.targetPlatform // { darwinMinVersion = "10.13"; };
+      hostPlatform = oldStdenv.hostPlatform // { darwinMinVersion = "10.13"; };
+    })
+    else python.stdenv;
 in buildPythonPackage rec {
   pname = "pybind11";
   version = "2.11.1";
@@ -41,6 +55,8 @@ in buildPythonPackage rec {
   buildInputs = lib.optionals (pythonOlder "3.9") [ libxcrypt ];
   propagatedBuildInputs = [ setupHook ];
 
+  stdenv = stdenv';
+
   dontUseCmakeBuildDir = true;
 
   # Don't build tests if not needed, read the doInstallCheck value at runtime
diff --git a/pkgs/development/python-modules/pympler/default.nix b/pkgs/development/python-modules/pympler/default.nix
index 9b801e42c8a..463de728aea 100644
--- a/pkgs/development/python-modules/pympler/default.nix
+++ b/pkgs/development/python-modules/pympler/default.nix
@@ -19,9 +19,10 @@ buildPythonPackage rec {
   patches = [
     # Fixes a TypeError on Python 3.11
     # (see https://github.com/pympler/pympler/issues/148)
+    # https://github.com/pympler/pympler/pull/149
     (fetchpatch {
       name = "${pname}-python-3.11-compat.patch";
-      url = "https://github.com/pympler/pympler/pull/149.patch";
+      url = "https://github.com/pympler/pympler/commit/0fd8ad8da39207bd0dcb28bdac0407e04744c965.patch";
       hash = "sha256-6MK0AuhVhQkUzlk29HUh1+mSbfsVTBJ1YBtYNIFhh7U=";
     })
   ];
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 4e67fd0783d..bc841cc2fd4 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     # remove cryptography pin
-    sed "/cryptography/ s/,<[0-9]*//g" setup.py
+    sed -i "/cryptography/ s/,<[0-9]*//g" setup.py
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-jose/default.nix b/pkgs/development/python-modules/python-jose/default.nix
index 68150935da9..6e3f406fe5a 100644
--- a/pkgs/development/python-modules/python-jose/default.nix
+++ b/pkgs/development/python-modules/python-jose/default.nix
@@ -1,18 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
 , ecdsa
 , rsa
-, pycrypto
 , pyasn1
-, pycryptodome
+
+# optional-dependencies
 , cryptography
+, pycrypto
+, pycryptodome
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "python-jose";
   version = "3.3.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mpdavis";
@@ -21,27 +31,43 @@ buildPythonPackage rec {
     hash = "sha256-6VGC6M5oyGCOiXcYp6mpyhL+JlcYZKIqOQU9Sm/TkKM=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace '"pytest-runner",' ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    cryptography
     ecdsa
     pyasn1
-    pycrypto
-    pycryptodome
     rsa
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  passthru.optional-dependencies = {
+    cryptography = [
+      cryptography
+    ];
+    pycrypto = [
+      pycrypto
+    ];
+    pycryptodome = [
+      pycryptodome
+    ];
+  };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"pytest-runner",' ""
-  '';
+  pythonImportsCheck = [
+    "jose"
+  ];
 
-  pythonImportsCheck = [ "jose" ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   meta = with lib; {
+    changelog = "https://github.com/mpdavis/python-jose/releases/tag/${version}";
     homepage = "https://github.com/mpdavis/python-jose";
     description = "A JOSE implementation in Python";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index f640012d9a5..80094a1a350 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.3.1";
+  version = "3.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-C+jQN0QXZzH0IKdC3O5uPNAEd+XSffi3nkwFSv2HqPY=";
+    hash = "sha256-JgTmhnKVzv9m8//GMQjvCFPNJQM/7dalCD5bk6fWBPc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rocket-errbot/default.nix b/pkgs/development/python-modules/rocket-errbot/default.nix
index 29970e7fd28..65b7c62b9e3 100644
--- a/pkgs/development/python-modules/rocket-errbot/default.nix
+++ b/pkgs/development/python-modules/rocket-errbot/default.nix
@@ -11,7 +11,9 @@ buildPythonPackage rec {
 
   # remove with 1.2.6
   patches = [ (fetchpatch {
-    url = "https://github.com/errbotio/rocket/pull/1.patch";
+    # https://github.com/errbotio/rocket/pull/1
+    name = "errbotio-rocket-pull-1.patch";
+    url = "https://github.com/errbotio/rocket/compare/f1a52fe17164f83bccce5e6a1935fc5071c2265f...d69adcd49de5d78bd80f952a2ee31e6a0bac4e3d.patch";
     sha256 = "1s668yv5b86b78vbqwhcl44k2l16c9bhk3199yy9hayf0vkxnwif";
   }) ];
 
diff --git a/pkgs/development/python-modules/s3transfer/default.nix b/pkgs/development/python-modules/s3transfer/default.nix
index 36176481860..748b6abecf4 100644
--- a/pkgs/development/python-modules/s3transfer/default.nix
+++ b/pkgs/development/python-modules/s3transfer/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "s3transfer";
-  version = "0.6.2";
+  version = "0.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-hoHNblnCSZteHmI5sJN72WrX7tveNFZqmL1jFKQmdag=";
+    hash = "sha256-EvLqRvm9E1Taf+JvbhQbfJqIlbu2a+rB2MX0IO90x98=";
   };
 
   propagatedBuildInputs = [ botocore ];
@@ -39,6 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for managing Amazon S3 transfers";
     homepage = "https://github.com/boto/s3transfer";
+    changelog = "https://github.com/boto/s3transfer/blob/${version}/CHANGELOG.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ nickcao ];
   };
diff --git a/pkgs/development/python-modules/simplejson/default.nix b/pkgs/development/python-modules/simplejson/default.nix
index f495e463864..b136d9e94da 100644
--- a/pkgs/development/python-modules/simplejson/default.nix
+++ b/pkgs/development/python-modules/simplejson/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "simplejson";
-  version = "3.19.1";
+  version = "3.19.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LUD0Eoj7fDGiR0yhIZOto6kn7Ud0TXyDTO1UTbRMJiQ=";
+    hash = "sha256-+HHtU6sxxwISciLxiwa5m1zj7h/SLDmRxOZNqW5FQSY=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/sqlalchemy-migrate/default.nix b/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
index ecfa57be2e3..c71172764af 100644
--- a/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
@@ -26,8 +26,9 @@ buildPythonPackage rec {
 
   patches = [
     # See: https://review.openstack.org/#/c/608382/
+    # https://github.com/openstack/sqlalchemy-migrate/pull/18
     (fetchpatch {
-      url = "https://github.com/openstack/sqlalchemy-migrate/pull/18.patch";
+      url = "https://github.com/openstack/sqlalchemy-migrate/commit/a5d69a17d9354ec1a792493280f96484740cf7ff.patch";
       sha256 = "1qyfq2m7w7xqf0r9bc2x42qcra4r9k9l9g1jy5j0fvlb6bvvjj07";
     })
     ./python3.11-comp.diff
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 95e357cabda..c69779186e7 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -40,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "2.0.21";
+  version = "2.0.22";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-ldBn+pdZfqnBKdYkOcG47ScH/hBgeJBeIvn1hCIBw/A=";
+    hash = "sha256-HyT8wFsUukg1fnTREa0Rv1+dFb21e4Os42l09Zox/SY=";
   };
 
   nativeBuildInputs =[
diff --git a/pkgs/development/python-modules/udatetime/default.nix b/pkgs/development/python-modules/udatetime/default.nix
index 49b56c5f1e3..17011e1b907 100644
--- a/pkgs/development/python-modules/udatetime/default.nix
+++ b/pkgs/development/python-modules/udatetime/default.nix
@@ -15,9 +15,11 @@ buildPythonPackage rec {
 
   patches = [
     # fix build with python 3.9
+    # https://github.com/freach/udatetime/pull/33
     (fetchpatch {
-      url = "https://github.com/freach/udatetime/pull/33.patch";
-      sha256 = "02wm7ivkv1viqn2wflgd10dgpddfqfrwacmrldigb1mwb79n554j";
+      name = "freach-udatetime-pull-33.patch";
+      url = "https://github.com/freach/udatetime/compare/75a07891426364f8bf0b44305b00bb1dd90534ae...2cfbc92cb274a80476a45c6c0d387c19e77a9f6e.patch";
+      sha256 = "pPskJnie+9H3qKqf8X37sxB+CH3lpkj7IYl8HfiuV/4=";
     })
   ];
 
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index a5a3e6b8b64..2222412e83d 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -21,12 +21,12 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "2.0.5";
+  version = "2.0.6";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-E6vzc4LqLOb7dE1NrWeDjuyFfJ9PVwCYkYBeC14SNZQ=";
+    hash = "sha256-sZ4ahdIGtW198dXmg99KdyUlKpZOOZNkjdD7WhwVdWQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index 38283c71acd..9ee7fec9194 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -3,34 +3,42 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+
+# build-system
 , cython
+, setuptools
+
+# native dependencies
 , libuv
 , CoreServices
 , ApplicationServices
 
-# Check Inputs
+# tests
 , aiohttp
 , psutil
 , pyopenssl
-, pytest-forked
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "uvloop";
-  version = "0.17.0";
-  format = "setuptools";
-  disabled = pythonOlder "3.7";
+  version = "0.19.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Dd9rr5zxGhoixxSH858Vss9461vefltF+7meip2RueE=";
+    hash = "sha256-Akb0/Rvyv3AuBrDUXukWd+5cMSQvOaq06m/gxRrt0P0=";
   };
 
   nativeBuildInputs = [
     cython
+    setuptools
   ];
 
+  env.LIBUV_CONFIGURE_HOST = stdenv.hostPlatform.config;
+
   buildInputs = [
     libuv
   ] ++ lib.optionals stdenv.isDarwin [
@@ -38,45 +46,25 @@ buildPythonPackage rec {
     ApplicationServices
   ];
 
-  dontUseSetuptoolsCheck = true;
   nativeCheckInputs = [
-    pytest-forked
+    aiohttp
+    pyopenssl
     pytestCheckHook
     psutil
-  ] ++ lib.optionals (pythonOlder "3.11") [
-    aiohttp
   ];
 
-  LIBUV_CONFIGURE_HOST = stdenv.hostPlatform.config;
-
   pytestFlagsArray = [
-    # from pytest.ini, these are NECESSARY to prevent failures
-    "--capture=no"
-    "--assert=plain"
-    "--strict"
-    "--tb=native"
-    # Depend on pyopenssl
-    "--deselect=tests/test_tcp.py::Test_UV_TCPSSL::test_flush_before_shutdown"
-    "--deselect=tests/test_tcp.py::Test_UV_TCPSSL::test_renegotiation"
-    # test gets stuck in epoll_pwait on hydras aarch64 builders
-    # https://github.com/MagicStack/uvloop/issues/412
-    "--deselect=tests/test_tcp.py::Test_AIO_TCPSSL::test_remote_shutdown_receives_trailing_data"
-    # Tries to import cythonized file for which the .pyx file is not shipped via PyPi
-    "--deselect=tests/test_libuv_api.py::Test_UV_libuv::test_libuv_get_loop_t_ptr"
-    # Tries to run "env", but fails to find it
+    # Tries to run "env", but fails to find it, even with coreutils provided
     "--deselect=tests/test_process.py::Test_UV_Process::test_process_env_2"
     "--deselect=tests/test_process.py::Test_AIO_Process::test_process_env_2"
     # AssertionError: b'' != b'out\n'
     "--deselect=tests/test_process.py::Test_UV_Process::test_process_streams_redirect"
     "--deselect=tests/test_process.py::Test_AIO_Process::test_process_streams_redirect"
-  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+  ] ++ lib.optionals (stdenv.isDarwin) [
     # Segmentation fault
     "--deselect=tests/test_fs_event.py::Test_UV_FS_EVENT_RENAME::test_fs_event_rename"
-  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # Broken: https://github.com/NixOS/nixpkgs/issues/160904
     "--deselect=tests/test_context.py::Test_UV_Context::test_create_ssl_server_manual_connection_lost"
-    # Segmentation fault
-    "--deselect=tests/test_fs_event.py::Test_UV_FS_EVENT_RENAME::test_fs_event_rename"
   ];
 
   disabledTestPaths = [
@@ -84,23 +72,13 @@ buildPythonPackage rec {
     "tests/test_sourcecode.py"
   ];
 
-  preCheck = lib.optionalString stdenv.isDarwin ''
+  preCheck = ''
+    # force using installed/compiled uvloop
+    rm -rf uvloop
+  '' + lib.optionalString stdenv.isDarwin ''
     # Work around "OSError: AF_UNIX path too long"
     # https://github.com/MagicStack/uvloop/issues/463
     export TMPDIR="/tmp"
-  '' + ''
-    # pyopenssl is not well supported by upstream
-    # https://github.com/NixOS/nixpkgs/issues/175875
-    substituteInPlace tests/test_tcp.py \
-      --replace "from OpenSSL import SSL as openssl_ssl" ""
-    # force using installed/compiled uvloop vs source by moving tests to temp dir
-    export TEST_DIR=$(mktemp -d)
-    cp -r tests $TEST_DIR
-    pushd $TEST_DIR
-  '';
-
-  postCheck = ''
-    popd
   '';
 
   pythonImportsCheck = [
@@ -112,6 +90,7 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
+    changelog = "https://github.com/MagicStack/uvloop/releases/tag/v${version}";
     description = "Fast implementation of asyncio event loop on top of libuv";
     homepage = "https://github.com/MagicStack/uvloop";
     license = licenses.mit;
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index cb907556727..632aa101b31 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.20";
-  source.sha256 = "sha256-dEsrGVHaYTryr2hU98H54W3ZC0tmzZrxonqfRIx2G+4=";
+  version = "2.4.21";
+  source.sha256 = "sha256-AXrnGnsKMCTGFONEzQzFahbLNK/FOtoYmfs3nSZiTJE=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index ff9e3b1968c..1704df297a6 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -22,7 +22,7 @@
 , pkg-config , ncurses, xapian, gpgme, util-linux, tzdata, icu, libffi
 , cmake, libssh2, openssl, openssl_1_1, libmysqlclient, git, perl, pcre, pcre2, gecode_3, curl
 , msgpack, libsodium, snappy, libossp_uuid, lxc, libpcap, xorg, gtk2, buildRubyGem
-, cairo, re2, rake, gobject-introspection, gdk-pixbuf, zeromq, czmq, graphicsmagick, libcxx
+, cairo, expat, re2, rake, gobject-introspection, gdk-pixbuf, zeromq, czmq, graphicsmagick, libcxx
 , file, libvirt, glib, vips, taglib, libopus, linux-pam, libidn, protobuf, fribidi, harfbuzz
 , bison, flex, pango, python3, patchelf, binutils, freetds, wrapGAppsHook, atk
 , bundler, libsass, dart-sass, libexif, libselinux, libsepol, shared-mime-info, libthai, libdatrie
@@ -76,7 +76,7 @@ in
   cairo-gobject = attrs: {
     nativeBuildInputs = [ pkg-config ]
       ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
-    buildInputs = [ cairo pcre2 xorg.libpthreadstubs xorg.libXdmcp ];
+    buildInputs = [ cairo expat pcre2 xorg.libpthreadstubs xorg.libXdmcp ];
   };
 
   charlock_holmes = attrs: {
diff --git a/pkgs/development/tools/build-managers/boot/builder.sh b/pkgs/development/tools/build-managers/boot/builder.sh
index e007cbac958..4506e3f0f86 100644
--- a/pkgs/development/tools/build-managers/boot/builder.sh
+++ b/pkgs/development/tools/build-managers/boot/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 boot_bin=$out/bin/boot
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 8758afea821..6674fbe7819 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -18,13 +18,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.2.1";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-x2VN/6Kg/n6BW5S4nLKfG67dYrSR/G+Aowf6d2Vbc+0=";
+    hash = "sha256-dgYYz3tQDG6Z4eE77WO2dXdardxVzzGaFLQ5znPcTlw=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 6305a405af2..dc7780b2fd3 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -28,14 +28,43 @@ mesonConfigurePhase() {
         echo "meson: enabled parallel building"
     fi
 
-    if ! [[ -v enableParallelInstalling ]]; then
-        enableParallelInstalling=1
-        echo "meson: enabled parallel installing"
+    if [[ ${checkPhase-ninjaCheckPhase} = ninjaCheckPhase && -z $dontUseMesonCheck ]]; then
+        checkPhase=mesonCheckPhase
+    fi
+    if [[ ${installPhase-ninjaInstallPhase} = ninjaInstallPhase && -z $dontUseMesonInstall ]]; then
+        installPhase=mesonInstallPhase
     fi
 
     runHook postConfigure
 }
 
+mesonCheckPhase() {
+    runHook preCheck
+
+    local flagsArray=($mesonCheckFlags "${mesonCheckFlagsArray[@]}")
+
+    echoCmd 'check flags' "${flagsArray[@]}"
+    meson test --no-rebuild "${flagsArray[@]}"
+
+    runHook postCheck
+}
+
+mesonInstallPhase() {
+    runHook preInstall
+
+    # shellcheck disable=SC2086
+    local flagsArray=($mesonInstallFlags "${mesonInstallFlagsArray[@]}")
+
+    if [[ -n "$mesonInstallTags" ]]; then
+        flagsArray+=("--tags" "${mesonInstallTags// /,}")
+    fi
+
+    echoCmd 'install flags' "${flagsArray[@]}"
+    meson install --no-rebuild "${flagsArray[@]}"
+
+    runHook postInstall
+}
+
 if [ -z "${dontUseMesonConfigure-}" -a -z "${configurePhase-}" ]; then
     setOutputFlags=
     configurePhase=mesonConfigurePhase
diff --git a/pkgs/development/tools/misc/automake/builder.sh b/pkgs/development/tools/misc/automake/builder.sh
index 0cb1d5d61e3..b08e7251e9e 100644
--- a/pkgs/development/tools/misc/automake/builder.sh
+++ b/pkgs/development/tools/misc/automake/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 # Wrap the given `aclocal' program, appending extra `-I' flags
diff --git a/pkgs/development/tools/misc/indent/default.nix b/pkgs/development/tools/misc/indent/default.nix
index 0d4c272e414..8e6ba9b70c0 100644
--- a/pkgs/development/tools/misc/indent/default.nix
+++ b/pkgs/development/tools/misc/indent/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   strictDeps = true;
   nativeBuildInputs = [ texinfo ];
   buildInputs = [ libintl ];
-  pkgsBuildBuild = [ buildPackages.stdenv.cc ]; # needed when cross-compiling
+  depsBuildBuild = [ buildPackages.stdenv.cc ]; # needed when cross-compiling
 
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optional stdenv.cc.isClang "-Wno-implicit-function-declaration"
diff --git a/pkgs/development/tools/misc/lttng-ust/default.nix b/pkgs/development/tools/misc/lttng-ust/default.nix
index 3bace16de56..0c19b59c5c3 100644
--- a/pkgs/development/tools/misc/lttng-ust/default.nix
+++ b/pkgs/development/tools/misc/lttng-ust/default.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "2.13.1";
-  sha256 = "sha256-Vme/Amnh5i4tnLl0xFb/huBAG9eqO/yNX9uXIzJJ7dw=";
+  version = "2.13.6";
+  sha256 = "sha256-5+BFlt1zrHqpnifNAA+UnbsP7VG9KQmfmwiiXB3wztU=";
 }
diff --git a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
index 941a582cead..20acab5a858 100644
--- a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
+++ b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
@@ -2,13 +2,13 @@
 
 luarocks.overrideAttrs (old: {
   pname = "luarocks-nix";
-  version = "unstable-2023-02-26";
+  version = "unstable-2023-10-19";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "luarocks-nix";
-    rev = "4cfea3d5d826db4cfbc809ef8bb5f0a9f3a18919";
-    sha256 = "sha256-7L8B+/C7Kzt25Ec+OsM2rliYB2/wyZQ3OT63V7AaOxo=";
+    rev = "4240b25b95d7165cde66fc2acaf5a0f9ad40fd0c";
+    sha256 = "sha256-dqFFYehBgK0RqH0/1GtZXq7XLGCcc3Kfadq8ICYNCWk=";
   };
 
   patches = [ ];
diff --git a/pkgs/development/tools/parsing/antlr/builder.sh b/pkgs/development/tools/parsing/antlr/builder.sh
index 55259b93212..c1d20845e6b 100644
--- a/pkgs/development/tools/parsing/antlr/builder.sh
+++ b/pkgs/development/tools/parsing/antlr/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 tar zxvf $src
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 4b66ecfa467..37cec14ee4c 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.2.3";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-hxtT5cL1PTXkTXGB0nVPhMI8Vlqrk4q2MHW0KGosFwc=";
+    hash = "sha256-MVmu9m+9XhWuPBEEoaYmsSbMFziSZaM5Gg5kOr1DT54=";
   };
 
-  cargoHash = "sha256-IZWh/Bp9TdB+flc1PXVkwrIdOr83TFk6X6O5M0FVaO4=";
+  cargoHash = "sha256-hrdrGFtL2vGczINnvDa4rclkXsNWnEqtTt3NVaRay8w=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 274aff3f4e1..8827d6b709e 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.261.0";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    rev = "sdk-${version}";
-    hash = "sha256-K7cv0mMNrXYOlJsxAPwz3rVX5FnsnBNvaU33k9hYnQc=";
+    rev = "vulkan-sdk-${version}";
+    hash = "sha256-Bned5Pa6zCFByfNvqD0M5t3l4uAJYkDlpe6wu8e7a3U=";
   };
 
   # The cmake options are sufficient for turning on static building, but not
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 754b2d4a5e0..09a11cef84f 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -23,18 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.261";
-
-  # If we were to use "dev" here instead of headers, the setupHook would be
-  # placed in that output instead of "out".
-  outputs = ["out" "headers"];
-  outputInclude = "headers";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
-    rev = "v${version}";
-    hash = "sha256-4kE3pkyYu6hnbv19fHhON+hI2HU4vLm31tNlp5fhndM=";
+    rev = "vulkan-sdk-${version}";
+    hash = "sha256-DwkSUclStYKe54tC1H3jMv1KOSScgqf25tR5ajQZ6os=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 8b615a55dd3..b1bd0ae912d 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -34,6 +34,7 @@ let
      */
   ]) (builtins.attrNames sharedLibDeps) ++ [
     "--with-intl=system-icu"
+    "--openssl-use-def-ca-store"
   ];
 
   copyLibHeaders =
@@ -52,6 +53,12 @@ let
 
     strictDeps = true;
 
+    env = lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
+      # Make sure libc++ uses `posix_memalign` instead of `aligned_alloc` on x86_64-darwin.
+      # Otherwise, nodejs would require the 11.0 SDK and macOS 10.15+.
+      NIX_CFLAGS_COMPILE = "-D__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__=101300";
+    };
+
     CC_host = "cc";
     CXX_host = "c++";
     depsBuildBuild = [ buildPackages.stdenv.cc openssl libuv zlib icu ];
diff --git a/pkgs/development/web/nodejs/v14.nix b/pkgs/development/web/nodejs/v14.nix
index e7dec1c12f6..c2d5d58bea7 100644
--- a/pkgs/development/web/nodejs/v14.nix
+++ b/pkgs/development/web/nodejs/v14.nix
@@ -1,8 +1,20 @@
-{ callPackage, python3, lib, stdenv, openssl, enableNpm ? true }:
+{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, enableNpm ? true }:
 
 let
+  # Clang 16+ cannot build Node v14 due to -Wenum-constexpr-conversion errors.
+  # Use an older version of clang with the current libc++ for compatibility (e.g., with icu).
+  ensureCompatibleCC = packages:
+    if packages.stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion packages.stdenv.cc.cc) "16"
+      then overrideCC packages.llvmPackages_15.stdenv (packages.llvmPackages_15.stdenv.cc.override {
+        inherit (packages.llvmPackages) libcxx;
+        extraPackages = [ packages.llvmPackages.libcxxabi ];
+      })
+      else packages.stdenv;
+
   buildNodejs = callPackage ./nodejs.nix {
     inherit openssl;
+    stdenv = ensureCompatibleCC pkgs;
+    buildPackages = buildPackages // { stdenv = ensureCompatibleCC buildPackages; };
     python = python3;
   };
 in
@@ -10,5 +22,5 @@ in
     inherit enableNpm;
     version = "14.21.3";
     sha256 = "sha256-RY7AkuYK1wDdzwectj1DXBXaTHuz0/mbmo5YqZ5UB14=";
-    patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
+    patches = lib.optional pkgs.stdenv.isDarwin ./bypass-xcodebuild.diff;
   }
diff --git a/pkgs/development/web/nodejs/v16.nix b/pkgs/development/web/nodejs/v16.nix
index d4bb94c07d3..930b648ca55 100644
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@@ -1,8 +1,20 @@
-{ callPackage, openssl, python3, fetchpatch, enableNpm ? true }:
+{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, fetchpatch, enableNpm ? true }:
 
 let
+  # Clang 16+ cannot build Node v14 due to -Wenum-constexpr-conversion errors.
+  # Use an older version of clang with the current libc++ for compatibility (e.g., with icu).
+  ensureCompatibleCC = packages:
+    if packages.stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion packages.stdenv.cc.cc) "16"
+      then overrideCC packages.llvmPackages_15.stdenv (packages.llvmPackages_15.stdenv.cc.override {
+        inherit (packages.llvmPackages) libcxx;
+        extraPackages = [ packages.llvmPackages.libcxxabi ];
+      })
+      else packages.stdenv;
+
   buildNodejs = callPackage ./nodejs.nix {
     inherit openssl;
+    stdenv = ensureCompatibleCC pkgs;
+    buildPackages = buildPackages // { stdenv = ensureCompatibleCC buildPackages; };
     python = python3;
   };
 
diff --git a/pkgs/games/orthorobot/default.nix b/pkgs/games/orthorobot/default.nix
index 6ca70596458..10bf3f9268e 100644
--- a/pkgs/games/orthorobot/default.nix
+++ b/pkgs/games/orthorobot/default.nix
@@ -48,8 +48,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     # support for love11
+    # https://github.com/Stabyourself/orthorobot/pull/3
     (fetchpatch {
-      url = "https://github.com/Stabyourself/orthorobot/pull/3.patch";
+      name = "Stabyourself-orthorobot-pull-3.patch";
+      url = "https://github.com/Stabyourself/orthorobot/compare/48f07423950b29a94b04aefe268f2f951f55b62e...05856ba7dbf1bb86d0f16a5f511d8ee9f2176015.patch";
       sha256 = "sha256-WHHP6QM7R5eEkVF+J2pGNnds/OKRIRXyon85wjd3GXI=";
     })
   ];
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 78c669614c0..25f2a01de8a 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -81,7 +81,7 @@ in buildFHSEnv rec {
     xorg.libXfixes
     libGL
     libva
-    pipewire.lib
+    pipewire
 
     # steamwebhelper
     harfbuzz
diff --git a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
index bdb52274418..829bc6509e0 100644
--- a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
+++ b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 arch=$(uname -m)
diff --git a/pkgs/misc/openrussian-cli/default.nix b/pkgs/misc/openrussian-cli/default.nix
index 038bdd5a73f..6c62315143b 100644
--- a/pkgs/misc/openrussian-cli/default.nix
+++ b/pkgs/misc/openrussian-cli/default.nix
@@ -55,5 +55,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ zane ];
     mainProgram = "openrussian";
     platforms   = platforms.unix;
+    broken = true;
   };
 }
diff --git a/pkgs/os-specific/darwin/DarwinTools/default.nix b/pkgs/os-specific/darwin/DarwinTools/default.nix
index 72a37502845..11e4c84395d 100644
--- a/pkgs/os-specific/darwin/DarwinTools/default.nix
+++ b/pkgs/os-specific/darwin/DarwinTools/default.nix
@@ -13,17 +13,17 @@ stdenv.mkDerivation rec {
     ./sw_vers-CFPriv.patch
   ];
 
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace gcc cc
-  '';
-
   configurePhase = ''
     export SRCROOT=.
     export SYMROOT=.
     export DSTROOT=$out
   '';
 
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "STRIP=${stdenv.cc.targetPrefix}strip"
+  ];
+
   postInstall = ''
     mv $out/usr/* $out
     rmdir $out/usr
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
index 6e6712f375e..931bebeae5d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
@@ -1,6 +1,13 @@
 { appleDerivation', stdenvNoCC }:
 
 appleDerivation' stdenvNoCC {
+  patches = [
+    # The source release version of math.h is missing some symbols that are actually present
+    # in newer SDKs. Patch them into the header to avoid implicit function declaration errors
+    # when compiling with newer versions of clang.
+    ./missing-declarations.patch
+  ];
+
   installPhase = ''
     mkdir -p $out/include
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libm/missing-declarations.patch b/pkgs/os-specific/darwin/apple-source-releases/Libm/missing-declarations.patch
new file mode 100644
index 00000000000..e56934e59d4
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libm/missing-declarations.patch
@@ -0,0 +1,292 @@
+--- a/Source/Intel/math.h	2023-10-20 09:43:42.640416006 -0400
++++ b/Source/Intel/math.h	2023-10-20 09:47:59.743127003 -0400
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2002 Apple Computer, Inc. All rights reserved.
++ * Copyright (c) 2002-2015 Apple Inc. All rights reserved.
+  *
+  * @APPLE_LICENSE_HEADER_START@
+  * 
+@@ -27,14 +27,17 @@
+ *     Contains: typedefs, prototypes, and macros germane to C99 floating point.*
+ *                                                                              *
+ *******************************************************************************/
++#ifndef __MATH_H__
++#define __MATH_H__
++
+ #ifndef __MATH__
+ #define __MATH__
++#endif
+ 
+-#include <sys/cdefs.h> /* For definition of __DARWIN_UNIX03 et al */
++#include <sys/cdefs.h>
++#include <Availability.h>
+ 
+-#ifdef __cplusplus
+-extern "C" {
+-#endif
++__BEGIN_DECLS
+ 
+ /******************************************************************************
+ *       Floating point data types                                             *
+@@ -87,14 +90,26 @@
+ #define FP_SUBNORMAL    5
+ #define FP_SUPERNORMAL  6 /* meaningful only on PowerPC */
+ 
+-/* fma() *function call* is more costly than equivalent (in-line) multiply and add operations    */
+-/* For single and double precision, the cost isn't too bad, because we can fall back on higher   */
+-/* precision hardware, with the necessary range to handle infinite precision products. However,  */
+-/* expect the long double fma to be at least an order of magnitude slower than a simple multiply */
+-/* and an add.                                                                                   */
+-#undef FP_FAST_FMA
+-#undef FP_FAST_FMAF
+-#undef FP_FAST_FMAL
++#if defined __arm64__ || defined __ARM_VFPV4__
++/*  On these architectures, fma(), fmaf( ), and fmal( ) are generally about as
++    fast as (or faster than) separate multiply and add of the same operands.  */
++#   define FP_FAST_FMA     1
++#   define FP_FAST_FMAF    1
++#   define FP_FAST_FMAL    1
++#elif (defined __i386__ || defined __x86_64__) && (defined __FMA__)
++/*  When targeting the FMA ISA extension, fma() and fmaf( ) are generally
++    about as fast as (or faster than) separate multiply and add of the same
++    operands, but fmal( ) may be more costly.                                 */
++#   define FP_FAST_FMA     1
++#   define FP_FAST_FMAF    1
++#   undef  FP_FAST_FMAL
++#else
++/*  On these architectures, fma( ), fmaf( ), and fmal( ) function calls are
++    significantly more costly than separate multiply and add operations.      */
++#   undef  FP_FAST_FMA
++#   undef  FP_FAST_FMAF
++#   undef  FP_FAST_FMAL
++#endif
+ 
+ /* The values returned by `ilogb' for 0 and NaN respectively. */
+ #define FP_ILOGB0	(-2147483647 - 1)
+@@ -191,6 +206,23 @@
+ 	static __inline__  int __inline_isnormalf( float __x ) { float fabsf = __builtin_fabsf(__x); if( __x != __x ) return 0; return fabsf < __builtin_inff() && fabsf >= __FLT_MIN__; }  
+ 	static __inline__  int __inline_isnormald( double __x ) { double fabsf = __builtin_fabs(__x); if( __x != __x ) return 0; return fabsf < __builtin_inf() && fabsf >= __DBL_MIN__; }  
+ 	static __inline__  int __inline_isnormal( long double __x ) { long double fabsf = __builtin_fabsl(__x); if( __x != __x ) return 0; return fabsf < __builtin_infl() && fabsf >= __LDBL_MIN__; }  
++
++#if defined __i386__ || defined __x86_64__
++__header_always_inline int __inline_signbitl(long double __x) {
++    union {
++        long double __ld;
++        struct{ unsigned long long __m; unsigned short __sexp; } __p;
++    } __u;
++    __u.__ld = __x;
++    return (int)(__u.__p.__sexp >> 15);
++}
++#else
++__header_always_inline int __inline_signbitl(long double __x) {
++    union { long double __f; unsigned long long __u;} __u;
++    __u.__f = __x;
++    return (int)(__u.__u >> 63);
++}
++#endif
+ 	
+ #else
+ 
+@@ -509,7 +541,112 @@
+ extern long double  __infl( void );
+ extern float  		__nan( void ); /* 10.3 (and later) must retain in ABI for backward compatability */
+ 
+-#if !defined(_ANSI_SOURCE)
++
++/******************************************************************************
++ *  Apple extensions to the C standard                                        *
++ ******************************************************************************/
++
++/*  Because these functions are not specified by any relevant standard, they
++    are prefixed with __, which places them in the implementor's namespace, so
++    they should not conflict with any developer or third-party code.  If they
++    are added to a relevant standard in the future, un-prefixed names may be
++    added to the library and they may be moved out of this section of the
++    header.                                                                   
++ 
++    Because these functions are non-standard, they may not be available on non-
++    Apple platforms.                                                          */
++
++/*  __exp10(x) returns 10**x.  Edge cases match those of exp( ) and exp2( ).  */
++extern float __exp10f(float) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern double __exp10(double) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++
++/*  __sincos(x,sinp,cosp) computes the sine and cosine of x with a single
++    function call, storing the sine in the memory pointed to by sinp, and
++    the cosine in the memory pointed to by cosp. Edge cases match those of
++    separate calls to sin( ) and cos( ).                                      */
++__header_always_inline void __sincosf(float __x, float *__sinp, float *__cosp);
++__header_always_inline void __sincos(double __x, double *__sinp, double *__cosp);
++
++/*  __sinpi(x) returns the sine of pi times x; __cospi(x) and __tanpi(x) return
++    the cosine and tangent, respectively.  These functions can produce a more
++    accurate answer than expressions of the form sin(M_PI * x) because they
++    avoid any loss of precision that results from rounding the result of the
++    multiplication M_PI * x.  They may also be significantly more efficient in
++    some cases because the argument reduction for these functions is easier
++    to compute.  Consult the man pages for edge case details.                 */
++extern float __cospif(float) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern double __cospi(double) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern float __sinpif(float) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern double __sinpi(double) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern float __tanpif(float) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern double __tanpi(double) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++
++#if (defined __MAC_OS_X_VERSION_MIN_REQUIRED && __MAC_OS_X_VERSION_MIN_REQUIRED < 1090) || \
++    (defined __IPHONE_OS_VERSION_MIN_REQUIRED && __IPHONE_OS_VERSION_MIN_REQUIRED < 70000)
++/*  __sincos and __sincosf were introduced in OSX 10.9 and iOS 7.0.  When
++    targeting an older system, we simply split them up into discrete calls
++    to sin( ) and cos( ).                                                     */
++__header_always_inline void __sincosf(float __x, float *__sinp, float *__cosp) {
++  *__sinp = sinf(__x);
++  *__cosp = cosf(__x);
++}
++
++__header_always_inline void __sincos(double __x, double *__sinp, double *__cosp) {
++  *__sinp = sin(__x);
++  *__cosp = cos(__x);
++}
++#else
++/*  __sincospi(x,sinp,cosp) computes the sine and cosine of pi times x with a
++    single function call, storing the sine in the memory pointed to by sinp,
++    and the cosine in the memory pointed to by cosp.  Edge cases match those
++    of separate calls to __sinpi( ) and __cospi( ), and are documented in the
++    man pages.
++ 
++    These functions were introduced in OSX 10.9 and iOS 7.0.  Because they are
++    implemented as header inlines, weak-linking does not function as normal,
++    and they are simply hidden when targeting earlier OS versions.            */
++__header_always_inline void __sincospif(float __x, float *__sinp, float *__cosp);
++__header_always_inline void __sincospi(double __x, double *__sinp, double *__cosp);
++
++/*  Implementation details of __sincos and __sincospi allowing them to return
++    two results while allowing the compiler to optimize away unnecessary load-
++    store traffic.  Although these interfaces are exposed in the math.h header
++    to allow compilers to generate better code, users should call __sincos[f]
++    and __sincospi[f] instead and allow the compiler to emit these calls.     */
++struct __float2 { float __sinval; float __cosval; };
++struct __double2 { double __sinval; double __cosval; };
++
++extern struct __float2 __sincosf_stret(float);
++extern struct __double2 __sincos_stret(double);
++extern struct __float2 __sincospif_stret(float);
++extern struct __double2 __sincospi_stret(double);
++
++__header_always_inline void __sincosf(float __x, float *__sinp, float *__cosp) {
++    const struct __float2 __stret = __sincosf_stret(__x);
++    *__sinp = __stret.__sinval; *__cosp = __stret.__cosval;
++}
++
++__header_always_inline void __sincos(double __x, double *__sinp, double *__cosp) {
++    const struct __double2 __stret = __sincos_stret(__x);
++    *__sinp = __stret.__sinval; *__cosp = __stret.__cosval;
++}
++
++__header_always_inline void __sincospif(float __x, float *__sinp, float *__cosp) {
++    const struct __float2 __stret = __sincospif_stret(__x);
++    *__sinp = __stret.__sinval; *__cosp = __stret.__cosval;
++}
++
++__header_always_inline void __sincospi(double __x, double *__sinp, double *__cosp) {
++    const struct __double2 __stret = __sincospi_stret(__x);
++    *__sinp = __stret.__sinval; *__cosp = __stret.__cosval;
++}
++#endif
++
++/******************************************************************************
++ *  POSIX/UNIX extensions to the C standard                                   *
++ ******************************************************************************/
++
++#if __DARWIN_C_LEVEL >= 199506L
+ extern double j0 ( double );
+ 
+ extern double j1 ( double );
+@@ -543,14 +680,32 @@
+ extern int signgam;     /* required for unix 2003 */
+ 
+ 
+-#endif /* !defined(_ANSI_SOURCE) */
++#endif /* __DARWIN_C_LEVEL >= 199506L */
+ 
+-#if !defined(__NOEXTENSIONS__) && (!defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE))
+-#define __WANT_EXTENSIONS__
+-#endif
++/*  Long-double versions of M_E, etc for convenience on Intel where long-
++    double is not the same as double.  Define __MATH_LONG_DOUBLE_CONSTANTS
++    to make these constants available.                                        */
++#if defined __MATH_LONG_DOUBLE_CONSTANTS
++#define M_El        0xa.df85458a2bb4a9bp-2L
++#define M_LOG2El    0xb.8aa3b295c17f0bcp-3L
++#define M_LOG10El   0xd.e5bd8a937287195p-5L
++#define M_LN2l      0xb.17217f7d1cf79acp-4L
++#define M_LN10l     0x9.35d8dddaaa8ac17p-2L
++#define M_PIl       0xc.90fdaa22168c235p-2L
++#define M_PI_2l     0xc.90fdaa22168c235p-3L
++#define M_PI_4l     0xc.90fdaa22168c235p-4L
++#define M_1_PIl     0xa.2f9836e4e44152ap-5L
++#define M_2_PIl     0xa.2f9836e4e44152ap-4L
++#define M_2_SQRTPIl 0x9.06eba8214db688dp-3L
++#define M_SQRT2l    0xb.504f333f9de6484p-3L
++#define M_SQRT1_2l  0xb.504f333f9de6484p-4L
++#endif /* defined __MATH_LONG_DOUBLE_CONSTANTS */
+ 
+-#ifdef __WANT_EXTENSIONS__
++/******************************************************************************
++ *  Legacy BSD extensions to the C standard                                   *
++ ******************************************************************************/
+ 
++#if __DARWIN_C_LEVEL >= __DARWIN_C_FULL
+ #define FP_SNAN		FP_NAN
+ #define FP_QNAN		FP_NAN
+ 
+@@ -560,11 +715,6 @@
+ /* Legacy API: please use C99 lround() instead. */
+ extern long int roundtol ( double );
+ 
+-/*
+- * XOPEN/SVID
+- */
+-#if !defined(_ANSI_SOURCE) && (!defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE))
+-#if (!defined(_XOPEN_SOURCE) || defined(_DARWIN_C_SOURCE))
+ #if !defined(__cplusplus)
+ /* used by matherr below */
+ struct exception {
+@@ -592,19 +742,12 @@
+ #define	TLOSS		5
+ #define	PLOSS		6
+ 
+-#endif /* (!_XOPEN_SOURCE || _DARWIN_C_SOURCE) */
+-#endif /* !_ANSI_SOURCE && (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */
+-
+-#if !defined( __STRICT_ANSI__) && !defined(_ANSI_SOURCE) && (!defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE))
+-    
+ /* Legacy API: please use C99 isfinite() instead. */
+ extern int finite ( double );
+     
+ /* Legacy API: please use C99 tgamma() instead. */
+ extern double gamma ( double );
+ 
+-#if (!defined(_XOPEN_SOURCE) || defined(_DARWIN_C_SOURCE))
+-
+ #if !defined(__cplusplus)
+ extern int matherr ( struct exception * );
+ #endif
+@@ -633,14 +776,8 @@
+ 	extern double lgamma_r ( double, int * ) AVAILABLE_MAC_OS_X_VERSION_10_6_AND_LATER;
+ 	extern long double lgammal_r ( long double, int * ) AVAILABLE_MAC_OS_X_VERSION_10_6_AND_LATER;
+ #endif /* _REENTRANT */
+-	
+-#endif /* (!_XOPEN_SOURCE || _DARWIN_C_SOURCE) */
+-#endif /* !_ANSI_SOURCE && (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */
+-
+-#endif /* __WANT_EXTENSIONS__ */
+ 
+-#ifdef __cplusplus
+-}
+-#endif
++#endif /* __DARWIN_C_LEVEL >= __DARWIN_C_FULL */
+ 
+-#endif /* __MATH__ */
++__END_DECLS
++#endif /* __MATH_H__ */
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
index 75ec2932c89..b7203a73763 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-ucm-conf";
-  version = "1.2.9";
+  version = "1.2.10";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    hash = "sha256-N09oM7/XfQpGdeSqK/t53v6FDlpGpdRUKkWWL0ueJyo=";
+    hash = "sha256-nCHj8B/wC6p1jfF+hnzTbiTrtBpr7ElzfpkQXhbyrpc=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index acb484ba6b6..c6c7d9d0f50 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -23,11 +23,11 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.66";
+  version = "5.70";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Of6mS1kMlJKYSgwnqJ/CA+HNx0hmCG77j0aYZ3qytXQ=";
+    sha256 = "sha256-N+Ny6RaVXhRMuIL4iOS+QImPEK47fCE93N1V7pwAkng=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index c85a75d1f17..789a59f751f 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -3,20 +3,20 @@
 , autoreconfHook
 , pkg-config
 , dbus
-, fetchpatch
 , sysctl
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.58";
+  version = "0.59";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-CwUwwvyT541aIvypVMqRhHkVJLna121Cme+v7c0FLWo=";
+    hash = "sha256-uJcGYT+JSdz/XTyJb/VUyedmSKJW/4BbTM3fw3ebtIc=";
   };
 
   nativeBuildInputs = [
@@ -30,19 +30,17 @@ stdenv.mkDerivation rec {
     sysctl
   ];
 
-  patches = [
-    # /proc/sys/net/core/somaxconn doesn't always exist in the nix build environment
-    (fetchpatch {
-      name = "skip-sysctl-test-if-sysfs-not-available.patch";
-      url = "https://patchwork.kernel.org/project/ell/patch/526DA75D-01AB-4D85-BF5C-5F25E5C39480@kloenk.dev/raw/";
-      hash = "sha256-YYGYWQ67cbMLt6RnqZmHt+tpvVIDKPbSCqPIouk6alU=";
-    })
-  ];
   enableParallelBuilding = true;
 
   # tests sporadically fail on musl
   doCheck = !stdenv.hostPlatform.isMusl;
 
+  passthru = {
+    updateScript = gitUpdater {
+      url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
+    };
+  };
+
   meta = with lib; {
     homepage = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     description = "Embedded Linux Library";
diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index bbd871a1b9a..f4b8bfc5661 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -1,4 +1,4 @@
-{ version, sha256Hash }:
+{ version, hash }:
 
 { lib, stdenv, fetchFromGitHub, fetchpatch
 , fusePackages, util-linux, gettext, shadow
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     owner = "libfuse";
     repo = "libfuse";
     rev = "${pname}-${version}";
-    sha256 = sha256Hash;
+    inherit hash;
   };
 
   preAutoreconf = "touch config.rpath";
@@ -48,6 +48,7 @@ in stdenv.mkDerivation rec {
   mesonFlags = lib.optionals isFuse3 [
     "-Dudevrulesdir=/udev/rules.d"
     "-Duseroot=false"
+    "-Dinitscriptdir="
   ];
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 6aa3e46d4e1..f692c2fb41c 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -7,11 +7,11 @@ let
 in {
   fuse_2 = mkFuse {
     version = "2.9.9";
-    sha256Hash = "1yxxvm58c30pc022nl1wlg8fljqpmwnchkywic3r74zirvlcq23n";
+    hash = "sha256-dgjM6M7xk5MHi9xPyCyvF0vq0KM8UCsEYBcMhkrdvfs=";
   };
 
   fuse_3 = mkFuse {
-    version = "3.11.0";
-    sha256Hash = "1wx80xxlvjn0wxhmkr1g91vwrgxssyzds1hizzxc2xrd4kjh9dfb";
+    version = "3.16.2";
+    hash = "sha256-QO9s+IkR0rkqIYNqt2IYST6AVBkCr56jcuuz5nKJuA4=";
   };
 }
diff --git a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
index 903f30325df..582d3eb0dec 100644
--- a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
@@ -1,12 +1,13 @@
+diff --git a/lib/meson.build b/lib/meson.build
 --- a/lib/meson.build
 +++ b/lib/meson.build
 @@ -37,8 +37,7 @@ libfuse = library('fuse3', libfuse_sources, version: meson.project_version(),
                    soversion: '3', include_directories: include_dirs,
                    dependencies: deps, install: true,
                    link_depends: 'fuse_versionscript',
--                  c_args: [ '-DFUSE_USE_VERSION=35',
+-                  c_args: [ '-DFUSE_USE_VERSION=312',
 -                            '-DFUSERMOUNT_DIR="@0@"'.format(fusermount_path) ],
-+                  c_args: [ '-DFUSE_USE_VERSION=35' ],
++                  c_args: [ '-DFUSE_USE_VERSION=312' ],
                    link_args: ['-Wl,--version-script,' + meson.current_source_dir()
                                + '/fuse_versionscript' ])
  
diff --git a/pkgs/os-specific/linux/fuse/fuse3-install.patch b/pkgs/os-specific/linux/fuse/fuse3-install.patch
index 147bcb439fb..769e3088664 100644
--- a/pkgs/os-specific/linux/fuse/fuse3-install.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-install.patch
@@ -1,18 +1,20 @@
---- a/util/install_helper.sh	2019-07-10 12:00:15.984840142 +0200
-+++ b/util/install_helper.sh	2019-07-10 12:28:56.343011401 +0200
-@@ -37,10 +37,10 @@
- fi
+--- a/util/install_helper.sh	2023-08-26 22:12:11.028651669 +0200
++++ b/util/install_helper.sh	2023-08-26 22:38:03.165058694 +0200
+@@ -39,12 +39,12 @@
  
- install -D -m 644 "${MESON_SOURCE_ROOT}/util/udev.rules" \
+ if [ "${udevrulesdir}" != "" ]; then
+     install -D -m 644 "${MESON_SOURCE_ROOT}/util/udev.rules" \
 -        "${DESTDIR}${udevrulesdir}/99-fuse3.rules"
 +        "${sysconfdir}${udevrulesdir}/99-fuse3.rules"
+ fi
  
- install -D -m 755 "${MESON_SOURCE_ROOT}/util/init_script" \
--        "${DESTDIR}/etc/init.d/fuse3"
-+        "${sysconfdir}/init.d/fuse3"
- 
+ if [ "$initscriptdir" != "" ]; then
+     install -D -m 755 "${MESON_SOURCE_ROOT}/util/init_script" \
+-            "${DESTDIR}${initscriptdir}/fuse3"
++            "${sysconfdir}${initscriptdir}/fuse3"
  
- if test -x /usr/sbin/update-rc.d && test -z "${DESTDIR}"; then
+     if test -x /usr/sbin/update-rc.d && test -z "${DESTDIR}"; then
+         /usr/sbin/update-rc.d fuse3 start 34 S . start 41 0 6 . || /bin/true
 diff --git a/util/meson.build b/util/meson.build
 index aa0e734..06d4378 100644
 --- a/util/meson.build
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index a64a0574d8f..1719dbe01ca 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.374";
+  version = "0.375";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-RvjYd8iD6JkGhh6TDy/Qo+UzLxbhPvIJvhl/Rw14lbk=";
+    hash = "sha256-2cahF9kOtr1R42zhwdwRqXSbWK9EkknTPnjs0DJl4TU=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 9d2848556ea..b82484514e5 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -2,31 +2,18 @@
 , autoreconfHook, pkg-config, pruneLibtoolFiles, flex, bison
 , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap
 , nftablesCompat ? true
-, fetchpatch
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.8.9";
+  version = "1.8.10";
   pname = "iptables";
 
   src = fetchurl {
     url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
-    sha256 = "72Y5pDvoMlpPjqaBI/+sI2y2lujHhQG2ToEGr7AIyH8=";
+    sha256 = "XMJVwYk1bjF9BwdVzpNx62Oht4PDRJj7jDAmTzzFnJw=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "format-security.patch";
-      url = "https://git.netfilter.org/iptables/patch/?id=ed4082a7405a5838c205a34c1559e289949200cc";
-      sha256 = "OdytFmHk+3Awu+sDQpGTl5/qip4doRblmW2vQzfNZiU=";
-    })
-    (fetchurl {
-      name = "static.patch";
-      url = "https://lore.kernel.org/netfilter-devel/20230402232939.1060151-1-hi@alyssa.is/raw";
-      sha256 = "PkH+1HbJjBb3//ffBe0XUQok1lBwgj/STL8Ppu/28f4=";
-    })
-  ];
-
   outputs = [ "out" "dev" "man" ];
 
   nativeBuildInputs = [
@@ -35,10 +22,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libmnl libnetfilter_conntrack libnfnetlink libnftnl libpcap ];
 
-  preConfigure = ''
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lmnl -lnftnl"
-  '';
-
   configureFlags = [
     "--enable-bpf-compiler"
     "--enable-devel"
@@ -47,6 +30,8 @@ stdenv.mkDerivation rec {
     "--enable-shared"
   ] ++ lib.optional (!nftablesCompat) "--disable-nftables";
 
+  enableParallelBuilding = true;
+
   postInstall = lib.optionalString nftablesCompat ''
     rm $out/sbin/{iptables,iptables-restore,iptables-save,ip6tables,ip6tables-restore,ip6tables-save}
     ln -sv xtables-nft-multi $out/bin/iptables
@@ -57,6 +42,13 @@ stdenv.mkDerivation rec {
     ln -sv xtables-nft-multi $out/bin/ip6tables-save
   '';
 
+  passthru = {
+    updateScript = gitUpdater {
+      url = "https://git.netfilter.org/iptables";
+      rev-prefix = "v";
+    };
+  };
+
   meta = with lib; {
     description = "A program to configure the Linux IP packet filtering ruleset";
     homepage = "https://www.netfilter.org/projects/iptables/index.html";
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index ff40e585b1d..e0a3c4319b8 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -119,7 +119,10 @@ in {
         hash = "sha256-eldLvCCALqdrUsp/rwcmf3IEXoYbGJFcUnKpjCer+IQ=";
       };
       patches = [
-         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
+        ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
+
+        # Fix regression turning `struct sockaddr_ll` flexible size.
+        ./revert-af_packet-flex.patch
       ];
     };
 }
diff --git a/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch b/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch
new file mode 100644
index 00000000000..ed6c8861d2f
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch
@@ -0,0 +1,31 @@
+Revert commit https://github.com/torvalds/linux/commit/a0ade8404c3bc2bf2631cb0f20d372eed22d9d96
+
+The change caused API regression by turning fixed size struct to
+flexible size struct. It was an unintentional change, broke `udp2raw`:
+    https://github.com/NixOS/nixpkgs/pull/252587#issuecomment-1744427473
+--- a/include/uapi/linux/if_packet.h
++++ b/include/uapi/linux/if_packet.h
+@@ -18,11 +18,7 @@ struct sockaddr_ll {
+ 	unsigned short	sll_hatype;
+ 	unsigned char	sll_pkttype;
+ 	unsigned char	sll_halen;
+-	union {
+-		unsigned char	sll_addr[8];
+-		/* Actual length is in sll_halen. */
+-		__DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
+-	};
++	unsigned char	sll_addr[8];
+ };
+ 
+ /* Packet types */
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3607,7 +3607,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
+ 	if (dev) {
+ 		sll->sll_hatype = dev->type;
+ 		sll->sll_halen = dev->addr_len;
+-		memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
++		memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
+ 	} else {
+ 		sll->sll_hatype = 0;	/* Bad: we have no ARPHRD_UNSPEC */
+ 		sll->sll_halen = 0;
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index ceb34fe0c76..3c1697e1c08 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -833,6 +833,8 @@ let
       CLEANCACHE = whenOlder "5.17" (option yes);
       CRASH_DUMP = option no;
 
+      FSCACHE_STATS = yes;
+
       DVB_DYNAMIC_MINORS = option yes; # we use udev
 
       EFI_STUB            = yes; # EFI bootloader in the bzImage itself
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index a21890a38ca..c32b06bc27c 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -131,8 +131,6 @@ let
     platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
     kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
-    # e.g. "bzImage"
-    kernelTarget = stdenv.hostPlatform.linux-kernel.target;
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 926a172a724..8137358552a 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -7,10 +7,6 @@
         "version": "6.5.9",
         "hash": "sha256:1mcg0lpxr832mwyqlbn0s5gssvsk2nn2xhq9w0qbymizf5j2yrn6"
     },
-    "6.4": {
-        "version": "6.4.16",
-        "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
-    },
     "6.1": {
         "version": "6.1.60",
         "hash": "sha256:02pvymr1dgd36mp7yikxqqv0sfrpwi1grnvxvx6jbbx6wmx0wljq"
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index 0763ffda26b..c58c4e67e4d 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -6,27 +6,32 @@
 # bcachefs-tools stores the expected-revision in:
 #   https://evilpiepirate.org/git/bcachefs-tools.git/tree/.bcachefs_revision
 # but this does not means that it'll be the latest-compatible revision
-, currentCommit ? "84f132d5696138bb038d2dc8f1162d2fab5ac832"
-, diffHash ? "sha256-RaBWBU7rXjJFb1euFAFBHWCBQAG7npaCodjp/vMYpyw="
+, currentCommit ? "4d2faeb4fb58c389dc9f76b8d5ae991ef4497e04"
+, diffHash ? "sha256-DtMc8P4lTRzvS6PVvD7WtWEPsfnxIXSpqMsKKWs+edI="
 , kernelPatches # must always be defined in bcachefs' all-packages.nix entry because it's also a top-level attribute supplied by callPackage
 , argsOverride ? {}
 , ...
 } @ args:
-
 # NOTE: bcachefs-tools should be updated simultaneously to preserve compatibility
 (kernel.override ( args // {
-  version = "${kernel.version}-bcachefs-unstable-${commitDate}";
 
-  extraMeta = {
-    branch = "master";
-    broken = stdenv.isAarch64;
-    maintainers = with lib.maintainers; [ davidak Madouura pedrohlc raitobezarius ];
-  };
+  argsOverride = {
+    version = "${kernel.version}-bcachefs-unstable-${commitDate}";
+    modDirVersion = kernel.modDirVersion;
+
+    extraMeta = {
+      homepage = "https://bcachefs.org/";
+      branch = "master";
+      maintainers = with lib.maintainers; [ davidak Madouura pedrohlc raitobezarius YellowOnion ];
+    };
+  } // argsOverride;
 
   structuredExtraConfig = with lib.kernel; {
     BCACHEFS_FS = module;
     BCACHEFS_QUOTA = option yes;
     BCACHEFS_POSIX_ACL = option yes;
+    # useful for bug reports
+    FTRACE = option yes;
   };
 
   kernelPatches = [ {
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d5b67b5efbe..2ba31fbc978 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod
+, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
 , fetchpatch
 }:
 
@@ -120,10 +120,6 @@ let
         # Ensure that depmod gets resolved through PATH
         sed -i Makefile -e 's|= /sbin/depmod|= depmod|'
 
-        # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
-        # FIXME: remove when no longer needed
-        substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
-
         # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
         # This way kernels can be bit-by-bit reproducible depending on settings
         # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
@@ -368,8 +364,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
   enableParallelBuilding = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ]
-      ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
+  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
       ++ optional  (lib.versionOlder version "5.8") libelf
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index d938f361c85..693fd00fe29 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -2,6 +2,9 @@
 
 let
   # These names are how they are designated in https://xanmod.org.
+
+  # NOTE: When updating these, please also take a look at the changes done to
+  # kernel config in the xanmod version commit
   ltsVariant = {
     version = "6.1.57";
     hash = "sha256-ZzZj1Ij9L6WtjEJRcOdNtZ18oFRybNPV4uID6umC2Zg=";
@@ -26,21 +29,10 @@ let
     };
 
     structuredExtraConfig = with lib.kernel; {
-      # AMD P-state driver
-      X86_AMD_PSTATE = lib.mkOverride 60 yes;
-
       # Google's BBRv3 TCP congestion Control
       TCP_CONG_BBR = yes;
       DEFAULT_BBR = yes;
 
-      # FQ-PIE Packet Scheduling
-      NET_SCH_DEFAULT = yes;
-      DEFAULT_FQ_PIE = yes;
-
-      # Futex WAIT_MULTIPLE implementation for Wine / Proton Fsync.
-      FUTEX = yes;
-      FUTEX_PI = yes;
-
       # WineSync driver for fast kernel-backed Wine
       WINESYNC = module;
 
diff --git a/pkgs/os-specific/linux/kmod/default.nix b/pkgs/os-specific/linux/kmod/default.nix
index 0843ca3556a..3f971e7a6ed 100644
--- a/pkgs/os-specific/linux/kmod/default.nix
+++ b/pkgs/os-specific/linux/kmod/default.nix
@@ -12,7 +12,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "kmod";
-  version = "30";
+  version = "31";
 
   # autogen.sh is missing from the release tarball,
   # and we need to run it to regenerate gtk_doc.make,
@@ -21,7 +21,7 @@ in stdenv.mkDerivation rec {
   # https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/commit/.gitignore?id=61a93a043aa52ad62a11ba940d4ba93cb3254e78
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/snapshot/kmod-${version}.tar.gz";
-    sha256 = "sha256-/dih2LoqgRrAsVdHRwld28T8pXgqnzapnQhqkXnxbbc=";
+    hash = "sha256-FNR015/AoYBbi7Eb1M2TXH3yxUuddKICCu+ot10CdeQ=";
   };
 
   outputs = [ "out" "dev" "lib" ] ++ lib.optional withDevdoc "devdoc";
diff --git a/pkgs/os-specific/linux/numatop/default.nix b/pkgs/os-specific/linux/numatop/default.nix
index ad0138f18b7..f4995264b09 100644
--- a/pkgs/os-specific/linux/numatop/default.nix
+++ b/pkgs/os-specific/linux/numatop/default.nix
@@ -16,12 +16,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://github.com/intel/numatop/pull/54.patch";
+      # https://github.com/intel/numatop/pull/54
+      url = "https://github.com/intel/numatop/compare/eab0ac5253c5843aa0f0ac36e2eec7612207711b...c1001fd926c24eae2d40729492e07270ce133b72.patch";
       sha256 = "sha256-TbMLv7TT9T8wE4uJ1a/AroyPPwrwL0eX5IBLsh9GTTM=";
       name = "fix-string-operations.patch";
     })
     (fetchpatch {
-      url = "https://github.com/intel/numatop/pull/64.patch";
+      # https://github.com/intel/numatop/pull/64
+      url = "https://github.com/intel/numatop/commit/635e2ce2ccb1ac793cc276a7fcb8a92b1ffefa5d.patch";
       sha256 = "sha256-IevbSFJRTS5iQ5apHOVXzF67f3LJaW6j7DySFmVuyiM=";
       name = "fix-format-strings-mvwprintw.patch";
     })
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index b7824f20977..fbb116ab42a 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 unpackManually() {
diff --git a/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh b/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
index 34f9b157945..ed2c60da261 100644
--- a/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
+++ b/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 mkdir -p $out/lib
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index b16bebbe3d6..9a0b2161ce4 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -1,5 +1,8 @@
-{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit, libxcrypt
+{ lib, stdenv, buildPackages, fetchurl
+, fetchpatch
+, flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
+, autoreconfHook269, pkg-config-unwrapped
 }:
 
 stdenv.mkDerivation rec {
@@ -11,12 +14,24 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-5OxxMakdpEUSV0Jo9JPG2MoQXIcJFpG46bVspoXU+U0=";
   };
 
-  patches = [ ./suid-wrapper-path.patch ];
+  patches = [
+    ./suid-wrapper-path.patch
+    # Pull support for localization on non-default --prefix:
+    #   https://github.com/NixOS/nixpkgs/issues/249010
+    #   https://github.com/linux-pam/linux-pam/pull/604
+    (fetchpatch {
+      name = "bind-locales.patch";
+      url = "https://github.com/linux-pam/linux-pam/commit/77bd338125cde583ecdfb9fd69619bcd2baf15c2.patch";
+      hash = "sha256-tlc9RcLZpEH315NFD4sdN9yOco8qhC6+bszl4OHm+AI=";
+    })
+  ];
 
   outputs = [ "out" "doc" "man" /* "modules" */ ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ flex ]
+  # autoreconfHook269 is needed for `bind-locales.patch` above
+  # pkg-config-unwrapped is needed for `AC_CHECK_LIB` and `AC_SEARCH_LIBS`
+  nativeBuildInputs = [ flex autoreconfHook269 pkg-config-unwrapped ]
     ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
 
   buildInputs = [ cracklib db4 libxcrypt ]
diff --git a/pkgs/os-specific/linux/pam_p11/default.nix b/pkgs/os-specific/linux/pam_p11/default.nix
index 8970f7ed628..0a7e02f4ad8 100644
--- a/pkgs/os-specific/linux/pam_p11/default.nix
+++ b/pkgs/os-specific/linux/pam_p11/default.nix
@@ -13,8 +13,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     # fix with openssl 3.x
+    # https://github.com/OpenSC/pam_p11/pull/22
     (fetchpatch {
-      url = "https://github.com/OpenSC/pam_p11/pull/22.patch";
+      name = "OpenSC-pam_p11-pull-22.patch";
+      url = "https://github.com/OpenSC/pam_p11/compare/cd4eba2e921e1c2f93cde71922a76af99376246c...debd4f7acfaf998cfe4002e0be5c35ad9a9591b5.patch";
       excludes = [ ".github/build.sh" ];
       hash = "sha256-bm/agnBgvrr8L8yoGK4gzBqOGgsNWf9NIgcNJG7proE=";
     })
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 746f9b17a69..38fec65b333 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.14.0";
+  version = "4.14.1";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = pname;
     rev = version;
-    hash = "sha256-zopJevCv7ot8RLp/rSQGKO05eF4FjkLaOEMo9aq9Afo=";
+    hash = "sha256-DzPPnttnJSOMQwXWyFcz6fEtjwBC3p2PpZpBAQ/Ew18=";
   };
 
   outputs = [ "out" "su" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 01054fa7fc6..809bf48be1e 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -134,6 +134,8 @@
 , withUtmp ? !stdenv.hostPlatform.isMusl
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
+  # build only libudev and libsystemd
+, buildLibsOnly ? false
 
   # name argument
 , pname ? "systemd"
@@ -202,6 +204,14 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-core-don-t-taint-on-unmerged-usr.patch
     ./0018-tpm2_context_init-fix-driver-name-checking.patch
     ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+
+    # Fix for `RuntimeError: ELF .dynamic section is missing.`
+    # https://github.com/systemd/systemd/issues/29381
+    # https://github.com/systemd/systemd/pull/29392
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/cecbb162a3134b43d2ca160e13198c73ff34c3ef.patch";
+      hash = "sha256-hWpUosTDA18mYm5nIb9KnjwOlnzbEHgzha/WpyHoC54=";
+    })
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -372,7 +382,7 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs tools test src/!(rpm|kernel-install|ukify) src/kernel-install/test-kernel-install.sh
   '';
 
-  outputs = [ "out" "man" "dev" ];
+  outputs = [ "out" "dev" ] ++ (lib.optional (!buildLibsOnly) "man");
 
   nativeBuildInputs =
     [
@@ -436,7 +446,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withUkify (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
   ;
 
-  #dontAddPrefix = true;
+  mesonBuildType = "release";
 
   mesonFlags = [
     "-Dversion-tag=${version}"
@@ -697,7 +707,9 @@ stdenv.mkDerivation (finalAttrs: {
     export DESTDIR=/
   '';
 
-  postInstall = ''
+  mesonInstallTags = lib.optionals buildLibsOnly [ "devel" "libudev" "libsystemd" ];
+
+  postInstall = lib.optionalString (!buildLibsOnly) ''
     mkdir -p $out/example/systemd
     mv $out/lib/{binfmt.d,sysctl.d,tmpfiles.d} $out/example
     mv $out/lib/systemd/{system,user} $out/example/systemd
@@ -715,7 +727,7 @@ stdenv.mkDerivation (finalAttrs: {
     find $out -name "*kernel-install*" -exec rm {} \;
   '' + lib.optionalString (!withDocumentation) ''
     rm -rf $out/share/doc
-  '' + lib.optionalString withKmod ''
+  '' + lib.optionalString (withKmod && !buildLibsOnly) ''
     mv $out/lib/modules-load.d $out/example
   '';
 
diff --git a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
new file mode 100644
index 00000000000..068744d4f32
--- /dev/null
+++ b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
@@ -0,0 +1,277 @@
+commit 68564ebb50f8afab5a9527c534417e247cca0b27
+Author: Filipe Manana <fdmanana@kernel.org>
+Date:   Thu Aug 17 10:20:13 2023 +0100
+
+    libmount: Fix regression when mounting with atime
+    
+    A regression was introduced in v2.39 that causes mounting with the atime
+    option to fail:
+    
+      $ mkfs.ext4 -F /dev/sdi
+      $ mount -o atime /dev/sdi /mnt/sdi
+      mount: /mnt/sdi: not mount point or bad option.
+             dmesg(1) may have more information after failed mount system call.
+    
+    The failure comes from the mount_setattr(2) call returning -EINVAL. This
+    is because we pass an invalid value for the attr_clr argument. From a
+    strace capture we have:
+    
+      mount_setattr(4, "", AT_EMPTY_PATH, {attr_set=0, attr_clr=MOUNT_ATTR_NOATIME, propagation=0 /* MS_??? */, userns_fd=0}, 32) = -1 EINVAL (Invalid argument)
+    
+    We can't pass MOUNT_ATTR_NOATIME to mount_setattr(2) through the attr_clr
+    argument because all atime options are exclusive, so in order to set atime
+    one has to pass MOUNT_ATTR__ATIME to attr_clr and leave attr_set as
+    MOUNT_ATTR_RELATIME (which is defined as a value of 0).
+    
+    This can be read from the man page for mount_setattr(2) and also from the
+    kernel source:
+    
+      $ cat fs/namespace.c
+      static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
+                                   struct mount_kattr *kattr, unsigned int flags)
+      {
+          (...)
+          /*
+           * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
+           * users wanting to transition to a different atime setting cannot
+           * simply specify the atime setting in @attr_set, but must also
+           * specify MOUNT_ATTR__ATIME in the @attr_clr field.
+           * So ensure that MOUNT_ATTR__ATIME can't be partially set in
+           * @attr_clr and that @attr_set can't have any atime bits set if
+           * MOUNT_ATTR__ATIME isn't set in @attr_clr.
+           */
+          if (attr->attr_clr & MOUNT_ATTR__ATIME) {
+              if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
+                  return -EINVAL;
+    
+                  /*
+                   * Clear all previous time settings as they are mutually
+                   * exclusive.
+                   */
+                  kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
+                  switch (attr->attr_set & MOUNT_ATTR__ATIME) {
+                  case MOUNT_ATTR_RELATIME:
+                      kattr->attr_set |= MNT_RELATIME;
+                      break;
+                  case MOUNT_ATTR_NOATIME:
+                      kattr->attr_set |= MNT_NOATIME;
+                      break;
+                  case MOUNT_ATTR_STRICTATIME:
+                      break;
+                  default:
+                      return -EINVAL;
+                  }
+        (...)
+    
+    So fix this by setting attr_clr MOUNT_ATTR__ATIME if we want to clear any
+    atime related option.
+    
+    Signed-off-by: Filipe Manana <fdmanana@kernel.org>
+
+diff --git a/libmount/src/optlist.c b/libmount/src/optlist.c
+index 1e962ec6d..0702adae7 100644
+--- a/libmount/src/optlist.c
++++ b/libmount/src/optlist.c
+@@ -875,7 +875,18 @@ int mnt_optlist_get_attrs(struct libmnt_optlist *ls, uint64_t *set, uint64_t *cl
+ 
+ 		if (opt->ent->mask & MNT_INVERT) {
+ 			DBG(OPTLIST, ul_debugobj(ls, " clr: %s", opt->ent->name));
+-			*clr |= x;
++			/*
++			 * All atime settings are mutually exclusive so *clr must
++			 * have MOUNT_ATTR__ATIME set.
++			 *
++			 * See the function fs/namespace.c:build_mount_kattr()
++			 * in the linux kernel source.
++			 */
++			if (x == MOUNT_ATTR_RELATIME || x == MOUNT_ATTR_NOATIME ||
++			    x == MOUNT_ATTR_STRICTATIME)
++				*clr |= MOUNT_ATTR__ATIME;
++			else
++				*clr |= x;
+ 		} else {
+ 			DBG(OPTLIST, ul_debugobj(ls, " set: %s", opt->ent->name));
+ 			*set |= x;
+diff --git a/tests/expected/libmount/context-mount-flags b/tests/expected/libmount/context-mount-flags
+index 960641863..eb71323dd 100644
+--- a/tests/expected/libmount/context-mount-flags
++++ b/tests/expected/libmount/context-mount-flags
+@@ -3,3 +3,6 @@ ro,nosuid,noexec
+ successfully mounted
+ rw,nosuid,noexec
+ successfully umounted
++successfully mounted
++rw,relatime
++successfully umounted
+diff --git a/tests/ts/libmount/context b/tests/ts/libmount/context
+index f5b47185e..a5d2e81a3 100755
+--- a/tests/ts/libmount/context
++++ b/tests/ts/libmount/context
+@@ -116,8 +116,15 @@ $TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPU
+ 
+ ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
+ is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
+-ts_finalize_subtest
+ 
++# Test that the atime option works after the migration to use the new kernel mount APIs.
++ts_run $TESTPROG --mount -o atime $DEVICE $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
++$TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPUT 2>> $TS_ERRLOG
++is_mounted $DEVICE || echo "$DEVICE not mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
++ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
++is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
++
++ts_finalize_subtest
+ 
+ ts_init_subtest "mount-loopdev"
+ mkdir -p $MOUNTPOINT &> /dev/null
+
+commit 1ec71634aa4ef5ddca23d65c8a296f3614231e8a
+Author: Colin Gillespie <colin@cgillespie.xyz>
+Date:   Wed Aug 9 18:28:07 2023 +1000
+
+    libblkid: (bcachefs) fix not detecting large superblocks
+    
+    Probing does not detect bcachefs filesystems with a superblock larger
+    than 4KiB. Bcachefs superblocks grow in size and can become much larger
+    than this.
+    
+    Increase the superblock maximum size limit to 1MiB.
+    
+    Validate the superblock isn't larger than the maximum size defined in
+    the superblocks layout section.
+    
+    (cherry picked from commit 48d573797797650d96456979797c0155d58f61cb)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 40e702d75..236877042 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -102,6 +102,15 @@ union bcachefs_sb_csum {
+ 	uint8_t raw[16];
+ } __attribute__((packed));
+ 
++struct bcachefs_sb_layout {
++	uint8_t		magic[16];
++	uint8_t		layout_type;
++	uint8_t		sb_max_size_bits;
++	uint8_t		nr_superblocks;
++	uint8_t		pad[5];
++	uint64_t	sb_offset[61];
++} __attribute__((packed));
++
+ struct bcachefs_super_block {
+ 	union bcachefs_sb_csum	csum;
+ 	uint16_t	version;
+@@ -123,7 +132,7 @@ struct bcachefs_super_block {
+ 	uint64_t	flags[8];
+ 	uint64_t	features[2];
+ 	uint64_t	compat[2];
+-	uint8_t		layout[512];
++	struct bcachefs_sb_layout layout;
+ 	struct bcachefs_sb_field _start[];
+ }  __attribute__((packed));
+ 
+@@ -143,7 +152,7 @@ struct bcachefs_super_block {
+ /* granularity of offset and length fields within superblock */
+ #define BCACHEFS_SECTOR_SIZE   512
+ /* maximum superblock size */
+-#define BCACHEFS_SB_MAX_SIZE   4096
++#define BCACHEFS_SB_MAX_SIZE   0x100000
+ /* fields offset within super block */
+ #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
+ /* tag value for members field */
+@@ -302,6 +311,9 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
++	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
++		return BLKID_PROBE_NONE;
++
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+ 		return BLKID_PROBE_NONE;
+ 
+
+commit acbf17ae8f8ee0f941fe98ed12f115f2b349bba8
+Author: Karel Zak <kzak@redhat.com>
+Date:   Wed Aug 23 11:53:45 2023 +0200
+
+    libblkid: (bcachefs) fix compiler warning [-Werror=sign-compare]
+    
+    Addresses: https://github.com/util-linux/util-linux/pull/2427
+    Signed-off-by: Karel Zak <kzak@redhat.com>
+    (cherry picked from commit 17873d38fc97913c0a31d4bd08cfbfe45c4de5be)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 236877042..6ab3fe9d4 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -311,7 +311,7 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
+-	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
++	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
+ 		return BLKID_PROBE_NONE;
+ 
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+
+commit 6b9fda87c4e5d0c6f945d7565197f157b9fa3d5f
+Author: Thomas Weißschuh <thomas@t-8ch.de>
+Date:   Wed Aug 23 11:58:33 2023 +0200
+
+    libblkid: (bcachefs) fix size validation
+    
+    Avoid signed shift out-of-bounds.
+    
+    Also mark the constants explitly as unsigned instead of casting.
+    
+    Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
+    (cherry picked from commit befe455f59de8c7bc66b85ed52aae8cbc95325fa)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 6ab3fe9d4..28ac4b52b 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -142,17 +142,19 @@ struct bcachefs_super_block {
+ /* magic string len */
+ #define BCACHE_SB_MAGIC_LEN (sizeof(BCACHE_SB_MAGIC) - 1)
+ /* super block offset */
+-#define BCACHE_SB_OFF       0x1000
++#define BCACHE_SB_OFF       0x1000U
+ /* supper block offset in kB */
+ #define BCACHE_SB_KBOFF     (BCACHE_SB_OFF >> 10)
+ /* magic string offset within super block */
+ #define BCACHE_SB_MAGIC_OFF offsetof(struct bcache_super_block, magic)
+ /* start of checksummed data within superblock */
+-#define BCACHE_SB_CSUMMED_START 8
++#define BCACHE_SB_CSUMMED_START 8U
+ /* granularity of offset and length fields within superblock */
+-#define BCACHEFS_SECTOR_SIZE   512
++#define BCACHEFS_SECTOR_SIZE   512U
++/* maximum superblock size shift */
++#define BCACHEFS_SB_MAX_SIZE_SHIFT   0x10U
+ /* maximum superblock size */
+-#define BCACHEFS_SB_MAX_SIZE   0x100000
++#define BCACHEFS_SB_MAX_SIZE   (1U << BCACHEFS_SB_MAX_SIZE_SHIFT)
+ /* fields offset within super block */
+ #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
+ /* tag value for members field */
+@@ -311,12 +313,16 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
+-	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
+-		return BLKID_PROBE_NONE;
+ 
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+ 		return BLKID_PROBE_NONE;
+ 
++	if (bcs->layout.sb_max_size_bits > BCACHEFS_SB_MAX_SIZE_SHIFT)
++		return BLKID_PROBE_NONE;
++
++	if (sb_size > (BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
++		return BLKID_PROBE_NONE;
++
+ 	sb = blkid_probe_get_sb_buffer(pr, mag, sb_size);
+ 	if (!sb)
+ 		return BLKID_PROBE_NONE;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 45c0d57cbff..d710fabb7ac 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
+    ./bcachefs-patch-set.patch
   ];
 
   # We separate some of the utilities into their own outputs. This
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 1be1169c778..38e81f05199 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -40,6 +40,16 @@ let
         };
       });
 
+      # https://github.com/home-assistant/core/pull/101913
+      aiohttp = super.aiohttp.overridePythonAttrs (old: rec {
+        version = "3.8.5";
+        src = fetchPypi {
+          inherit (old) pname;
+          inherit version;
+          hash = "sha256-uVUuxSzBR9vxlErHrJivdgLlHqLc0HbtGUyjwNHH0Lw=";
+        };
+      });
+
       aiowatttime = super.aiowatttime.overridePythonAttrs (oldAttrs: rec {
         version = "0.1.1";
         src = fetchFromGitHub {
diff --git a/pkgs/servers/http/tomcat/axis2/builder.sh b/pkgs/servers/http/tomcat/axis2/builder.sh
index d334ab6f927..de8e225456b 100644
--- a/pkgs/servers/http/tomcat/axis2/builder.sh
+++ b/pkgs/servers/http/tomcat/axis2/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 unzip $src
diff --git a/pkgs/servers/redpanda/server.nix b/pkgs/servers/redpanda/server.nix
index 27e6343a42a..ec4250820d3 100644
--- a/pkgs/servers/redpanda/server.nix
+++ b/pkgs/servers/redpanda/server.nix
@@ -16,7 +16,7 @@
 , p11-kit
 , pkg-config
 , procps
-, protobuf3_21
+, protobuf_21
 , python3
 , snappy
 , src
@@ -100,7 +100,7 @@ llvmPackages_14.stdenv.mkDerivation rec {
     dpdk
     hdr-histogram
     p11-kit
-    protobuf3_21
+    protobuf_21
     rapidjson
     seastar
     snappy
diff --git a/pkgs/servers/x11/xorg/builder.sh b/pkgs/servers/x11/xorg/builder.sh
index a9c607ae35e..833acf43a5b 100644
--- a/pkgs/servers/x11/xorg/builder.sh
+++ b/pkgs/servers/x11/xorg/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 # This is the builder for all X.org components.
 source $stdenv/setup
 
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index eb9c1ced671..1024eeeaa4c 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1518,11 +1518,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXrandr = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXrender, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libXrandr";
-    version = "1.5.3";
+    version = "1.5.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXrandr-1.5.3.tar.xz";
-      sha256 = "0a5l9q37c9m6gfdchlj43a9j3mw2avfwasfn0ivlkqbq980kjxl9";
+      url = "mirror://xorg/individual/lib/libXrandr-1.5.4.tar.xz";
+      sha256 = "1lxlqd9ffjr1myfpyk91594n1h07ck6121m6ba8qajjz6xjv1m8s";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3899,11 +3899,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkeyboardconfig = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xkeyboard-config";
-    version = "2.39";
+    version = "2.40";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.39.tar.xz";
-      sha256 = "10m6mbjymi7qf30g5yd400kqijdjg7ym9qjzh0bc3c7pxwrzbias";
+      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.40.tar.xz";
+      sha256 = "1qrakn6gyj701mxwbrlhjv4gd73ws51140ns68a1kivxxhdvlgbs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index e7c93e10bac..9a3c13d3cac 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -74,7 +74,7 @@ mirror://xorg/individual/app/xwininfo-1.1.6.tar.xz
 mirror://xorg/individual/app/xwud-1.0.6.tar.xz
 mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz
 mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.39.tar.xz
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.40.tar.xz
 mirror://xorg/individual/doc/xorg-docs-1.7.2.tar.gz
 mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.tar.gz
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
@@ -195,7 +195,7 @@ mirror://xorg/individual/lib/libXmu-1.1.4.tar.xz
 mirror://xorg/individual/lib/libXp-1.0.4.tar.xz
 mirror://xorg/individual/lib/libXpm-3.5.17.tar.xz
 mirror://xorg/individual/lib/libXpresent-1.0.1.tar.xz
-mirror://xorg/individual/lib/libXrandr-1.5.3.tar.xz
+mirror://xorg/individual/lib/libXrandr-1.5.4.tar.xz
 mirror://xorg/individual/lib/libXrender-0.9.11.tar.xz
 mirror://xorg/individual/lib/libXres-1.2.2.tar.xz
 mirror://xorg/individual/lib/libXScrnSaver-1.2.4.tar.xz
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index f7d7053c77a..7c64fd7e392 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -60,12 +60,13 @@ rec {
       mkDerivationFromStdenv = withOldMkDerivation old (stdenv: mkDerivationSuper: args:
       if stdenv.hostPlatform.isDarwin
       then throw "Cannot build fully static binaries on Darwin/macOS"
-      else (mkDerivationSuper args).overrideAttrs(finalAttrs: {
-        NIX_CFLAGS_LINK = toString (finalAttrs.NIX_CFLAGS_LINK or "") + " -static";
-      } // lib.optionalAttrs (!(finalAttrs.dontAddStaticConfigureFlags or false)) {
-        configureFlags = (finalAttrs.configureFlags or []) ++ [
-            "--disable-shared" # brrr...
-          ];
+      else (mkDerivationSuper args).overrideAttrs (args: {
+        NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "") + " -static";
+      } // lib.optionalAttrs (!(args.dontAddStaticConfigureFlags or false)) {
+        configureFlags = (args.configureFlags or []) ++ [
+          "--disable-shared" # brrr...
+        ];
+        cmakeFlags = (args.cmakeFlags or []) ++ ["-DCMAKE_SKIP_INSTALL_RPATH=On"];
       }));
     } // lib.optionalAttrs (stdenv0.hostPlatform.libc == "glibc") {
       extraBuildInputs = (old.extraBuildInputs or []) ++ [
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 25a80fd11aa..9ee6dfb1080 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -1047,9 +1047,9 @@ in
 
     overrides = self: super: {
       inherit (prevStage) ccWrapperStdenv
-        autoconf automake bash bison cmake cmakeMinimal cpio cyrus_sasl db expat flex groff
-        libedit libtool m4 ninja openldap openssh patchutils pbzx perl pkg-config python3
-        python3Minimal scons serf sqlite subversion sysctl texinfo unzip which
+        autoconf automake bash bison cmake cmakeMinimal cyrus_sasl db expat flex groff
+        libedit libtool m4 ninja openldap openssh patchutils perl pkg-config python3 scons
+        serf sqlite subversion sysctl texinfo unzip which
 
         # CF dependencies - don’t rebuild them.
         icu
@@ -1057,11 +1057,40 @@ in
         # LLVM dependencies - don’t rebuild them.
         libffi libiconv libxml2 ncurses zlib;
 
+      # These overrides are required to break an infinite recursion. curl depends on Darwin
+      # frameworks, but those frameworks require these dependencies to build, which
+      # depend on curl indirectly.
+      cpio = super.cpio.override {
+        inherit (prevStage) fetchurl;
+      };
+
+      libyaml = super.libyaml.override {
+        inherit (prevStage) fetchFromGitHub;
+      };
+
+      pbzx = super.pbzx.override {
+        inherit (prevStage) fetchFromGitHub;
+      };
+
+      python3Minimal = super.python3Minimal.override {
+        inherit (prevStage) fetchurl;
+      };
+
+      xar = super.xar.override {
+        inherit (prevStage) fetchurl;
+      };
+
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin) dyld CF Libsystem darwin-stubs
           # CF dependencies - don’t rebuild them.
           libobjc objc4;
 
+        # rewrite-tbd is also needed to build Darwin frameworks, so it’s built using the
+        # previous stage’s fetchFromGitHub to avoid an infinite recursion (same as above).
+        rewrite-tbd = superDarwin.rewrite-tbd.override {
+          inherit (prevStage) fetchFromGitHub;
+        };
+
         signingUtils = superDarwin.signingUtils.override {
           inherit (selfDarwin) sigtool;
         };
@@ -1158,9 +1187,10 @@ in
   (prevStage:
     # previous stage4 stdenv:
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage; [
-      bash binutils-unwrapped brotli bzip2 curl diffutils ed file findutils gawk gettext gmp
-      gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libkrb5 libssh2
-      libunistring libxml2 ncurses nghttp2 openbsm openpam openssl patch pcre xz zlib zstd
+      bash binutils-unwrapped brotli bzip2 cpio curl diffutils ed file findutils gawk
+      gettext gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libkrb5
+      libssh2 libunistring libxml2 libyaml ncurses nghttp2 openbsm openpam openssl patch
+      pbzx pcre python3Minimal xar xz zlib zstd
     ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
@@ -1176,9 +1206,9 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      autoconf automake bison cmake cmakeMinimal cpio cyrus_sasl db expat flex groff libedit
-      libtool m4 ninja openldap openssh patchutils pbzx perl pkg-config.pkg-config python3
-      python3Minimal scons serf sqlite subversion sysctl.provider texinfo unzip which
+      autoconf automake bison cmake cmakeMinimal cyrus_sasl db expat flex groff libedit
+      libtool m4 ninja openldap openssh patchutils perl pkg-config.pkg-config python3 scons
+      serf sqlite subversion sysctl.provider texinfo unzip which
     ]);
 
     assert prevStage.darwin.cctools == prevStage.darwin.cctools-llvm;
@@ -1307,14 +1337,14 @@ in
 
       overrides = self: super: {
         inherit (prevStage)
-          bash binutils brotli bzip2 coreutils curl diffutils ed file findutils gawk gettext
-          gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libssh2
-          libunistring libxml2 ncurses nghttp2 openbsm openpam openssl patch pcre xz zlib
-          zstd;
+          bash binutils brotli bzip2 coreutils cpio curl diffutils ed file findutils gawk
+          gettext gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libssh2
+          libunistring libxml2 libyaml ncurses nghttp2 openbsm openpam openssl patch pbzx
+          pcre python3Minimal xar xz zlib zstd;
 
         darwin = super.darwin.overrideScope (_: _: {
           inherit (prevStage.darwin)
-            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi xnu;
+            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi rewrite-tbd xnu;
         } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
           inherit (prevStage.darwin) binutils binutils-unwrapped cctools-llvm cctools-port;
         });
diff --git a/pkgs/stdenv/generic/default-builder.sh b/pkgs/stdenv/generic/default-builder.sh
index 8c6fec7873b..d49fb8aa57f 100644
--- a/pkgs/stdenv/generic/default-builder.sh
+++ b/pkgs/stdenv/generic/default-builder.sh
@@ -1,6 +1,4 @@
-if [ -f .attrs.sh ]; then
-    . .attrs.sh
-fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 
 source $stdenv/setup
 genericBuild
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index ad9857fc9d6..419a66261e6 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -16,29 +16,15 @@ if (( "${NIX_DEBUG:-0}" >= 6 )); then
     set -x
 fi
 
-if [ -f .attrs.sh ]; then
+if [ -f .attrs.sh ] || [[ -n "${NIX_ATTRS_JSON_FILE:-}" ]]; then
     __structuredAttrs=1
     echo "structuredAttrs is enabled"
-else
-    __structuredAttrs=
-fi
 
-if [ -n "$__structuredAttrs" ]; then
     for outputName in "${!outputs[@]}"; do
         # ex: out=/nix/store/...
         export "$outputName=${outputs[$outputName]}"
     done
 
-    # Before Nix 2.4, $NIX_ATTRS_*_FILE was named differently:
-    # https://github.com/NixOS/nix/commit/27ce722
-    if [[ -n "${ATTRS_JSON_FILE:-}" ]]; then
-        export NIX_ATTRS_JSON_FILE="$ATTRS_JSON_FILE"
-    fi
-
-    if [[ -n "${ATTRS_SH_FILE:-}" ]]; then
-        export NIX_ATTRS_SH_FILE="$ATTRS_SH_FILE"
-    fi
-
     # $NIX_ATTRS_JSON_FILE pointed to the wrong location in sandbox
     # https://github.com/NixOS/nix/issues/6736; please keep around until the
     # fix reaches *every patch version* that's >= lib/minver.nix
@@ -49,6 +35,7 @@ if [ -n "$__structuredAttrs" ]; then
         export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
     fi
 else
+    __structuredAttrs=
     : "${outputs:=out}"
 fi
 
diff --git a/pkgs/test/simple/builder.sh b/pkgs/test/simple/builder.sh
index 908faec3c38..0b09a109bea 100644
--- a/pkgs/test/simple/builder.sh
+++ b/pkgs/test/simple/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 set -x
 
 export NIX_DEBUG=1
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index e65cac675db..16acc62416a 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -3,24 +3,20 @@
 , fetchPypi
 , groff
 , less
+, nix-update-script
+, testers
+, awscli
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "awscli";
-  version = "1.29.9"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.29.57"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8SmOu79FZESL1Hd15wdd1m1Uewswqaum2y8LOZAl9P8=";
+    hash = "sha256-+xME5GiDitxn61yrIkiEByx/xeMeXMrVS2rifIX6Ci8=";
   };
 
-  # https://github.com/aws/aws-cli/issues/4837
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "docutils>=0.10,<0.17" "docutils>=0.10" \
-      --replace "colorama>=0.2.5,<0.4.5" "colorama>=0.2.5,<0.5" \
-      --replace "rsa>=3.1.2,<4.8" "rsa<5,>=3.1.2"
-  '';
 
   propagatedBuildInputs = with python3.pkgs; [
     botocore
@@ -44,10 +40,6 @@ python3.pkgs.buildPythonApplication rec {
     rm $out/bin/aws.cmd
   '';
 
-  passthru = {
-    python = python3; # for aws_shell
-  };
-
   doInstallCheck = true;
 
   installCheckPhase = ''
@@ -59,12 +51,25 @@ python3.pkgs.buildPythonApplication rec {
     runHook postInstallCheck
   '';
 
+  passthru = {
+    python = python3; # for aws_shell
+    updateScript = nix-update-script {
+      # Excludes 1.x versions from the Github tags list
+      extraArgs = [ "--version-regex" "^(1\.(.*))" ];
+    };
+    tests.version = testers.testVersion {
+      package = awscli;
+      command = "aws --version";
+      inherit version;
+    };
+  };
+
   meta = with lib; {
     homepage = "https://aws.amazon.com/cli/";
     changelog = "https://github.com/aws/aws-cli/blob/${version}/CHANGELOG.rst";
     description = "Unified tool to manage your AWS services";
     license = licenses.asl20;
     mainProgram = "aws";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ anthonyroussel ];
   };
 }
diff --git a/pkgs/tools/cd-dvd/sacd/default.nix b/pkgs/tools/cd-dvd/sacd/default.nix
index 963300c9ca1..948c5142840 100644
--- a/pkgs/tools/cd-dvd/sacd/default.nix
+++ b/pkgs/tools/cd-dvd/sacd/default.nix
@@ -17,8 +17,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # Makefile prefix, otherwise `/usr` prefix is enforced
+    # https://github.com/Sound-Linux-More/sacd/pull/1
     (fetchpatch {
-      url = "https://github.com/Sound-Linux-More/sacd/pull/1.patch";
+      url = "https://github.com/Sound-Linux-More/sacd/commit/a72def4fab234bcd68b444cf7447a8876b4e2ce8.patch";
       name = "makefile-prefix.patch";
       sha256 = "0a7r4x0yqpg6l4vr84dq4wbrypabqm4vvcjv91am068gqjiw6w64";
     })
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index 81152d144aa..8ea406a5f1f 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -12,32 +12,29 @@
 , lz4
 , attr
 , udev
-, valgrind
 , nixosTests
 , fuse3
 , cargo
 , rustc
-, coreutils
 , rustPlatform
 , makeWrapper
 , fuseSupport ? false
 }:
 let
-  rev = "cfa816bf3f823a3bedfedd8e214ea929c5c755fe";
-in stdenv.mkDerivation {
+  rev = "6b175a022496572416918bd38d083120c23ba5f2";
+in
+stdenv.mkDerivation {
   pname = "bcachefs-tools";
-  version = "unstable-2023-06-28";
+  version = "unstable-2023-09-29";
+
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     inherit rev;
-    hash = "sha256-XgXUwyZV5N8buYTuiu1Y1ZU3uHXjZ/OZ1kbZ9d6Rt5I=";
+    hash = "sha256-qC6Bq2zdO8Tj+bZbIUvcVBqvuKccqDEX3HIeOXsEloQ=";
   };
 
-  # errors on fsck_err function. Maybe miss-detection?
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
-
   nativeBuildInputs = [
     pkg-config
     cargo
@@ -71,7 +68,6 @@ in stdenv.mkDerivation {
 
   doCheck = false; # needs bcachefs module loaded on builder
   checkFlags = [ "BCACHEFS_TEST_USE_VALGRIND=no" ];
-  nativeCheckInputs = [ valgrind ];
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
@@ -79,7 +75,7 @@ in stdenv.mkDerivation {
     "INITRAMFS_DIR=${placeholder "out"}/etc/initramfs-tools"
   ];
 
-  preCheck = lib.optionalString fuseSupport ''
+  preCheck = lib.optionalString (!fuseSupport) ''
     rm tests/test_fuse.py
   '';
 
@@ -88,11 +84,6 @@ in stdenv.mkDerivation {
     inherit (nixosTests.installer) bcachefsSimple bcachefsEncrypted bcachefsMulti;
   };
 
-  postFixup = ''
-    wrapProgram $out/bin/mount.bcachefs \
-      --prefix PATH : ${lib.makeBinPath [ coreutils ]}
-  '';
-
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index 1bf20910cf5..642a49c39b8 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.3.261.0";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
-    rev = "sdk-${finalAttrs.version}";
-    hash = "sha256-abVqLovvcKBJhGhSCbyD5mc1DSfvh4TWssGxi52ukQ8=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-UIk5hihUPjXNzEeO2laS4dUef/rEExxXAZjMcftx+3A=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index 96edbcad83f..dae55225a0b 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -1,19 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, writeText, vulkan-headers, jq, libX11, libXrandr, libxcb, wayland }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, writeText, vulkan-headers, vulkan-utility-libraries,  jq, libX11, libXrandr, libxcb, wayland }:
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.261";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
-    rev = "v${version}";
-    hash = "sha256-MeW7mmbjgqEvXEnAYzTNu4omC4fqq1fplIVjDpV2LcA=";
+    rev = "vulkan-sdk-${version}";
+    hash = "sha256-rSKPTeTDOz6IeJGRt9aIu1VH8VfVzXNYZfjdiSXEJxg=";
   };
 
   nativeBuildInputs = [ cmake pkg-config jq ];
 
-  buildInputs = [ vulkan-headers libX11 libXrandr libxcb wayland ];
+  buildInputs = [ vulkan-headers vulkan-utility-libraries libX11 libXrandr libxcb wayland ];
 
   # Help vulkan-loader find the validation layers
   setupHook = writeText "setup-hook" ''
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 072876e46de..ab593a9bc4d 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -16,23 +16,22 @@
 , which
 , xcbutilkeysyms
 , xcbutilwm
+, valijson
 , vulkan-headers
 , vulkan-loader
-, symlinkJoin
-, vulkan-validation-layers
+, vulkan-utility-libraries
 , writeText
 }:
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.3.261";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
    owner = "LunarG";
    repo = "VulkanTools";
-   rev = "v${version}";
-   hash = "sha256-Kem3nWVaMeDEsidKYMsWr9Bu0yBgjjennDB0sKBDogA=";
-   fetchSubmodules = true;
+   rev = "vulkan-sdk-${version}";
+   hash = "sha256-2ZUD+RBsl35QV3250JOPCIoJb4sJcBsiRE4SZaS6ROs=";
  };
 
   nativeBuildInputs = [ cmake python3 jq which pkg-config ];
@@ -45,6 +44,10 @@ stdenv.mkDerivation rec {
     libXrandr
     libffi
     libxcb
+    valijson
+    vulkan-headers
+    vulkan-loader
+    vulkan-utility-libraries
     wayland
     xcbutilkeysyms
     xcbutilwm
@@ -52,27 +55,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DVULKAN_HEADERS_INSTALL_DIR=${vulkan-headers}"
-    "-DVULKAN_LOADER_INSTALL_DIR=${vulkan-loader}"
-    "-DVULKAN_VALIDATIONLAYERS_INSTALL_DIR=${
-      symlinkJoin {
-        name = "vulkan-validation-layers-merged";
-        paths = [ vulkan-validation-layers.headers vulkan-validation-layers ];
-      }
-    }"
-    # Hide dev warnings that are useless for packaging
-    "-Wno-dev"
   ];
 
   preConfigure = ''
-    # We need to run this update script which generates some source files,
-    # Remove the line in it which calls 'git submodule update' though.
-    # Also patch the scripts in ./scripts
-    update=update_external_sources.sh
-    patchShebangs $update
     patchShebangs scripts/*
-    sed -i '/^git /d' $update
-    ./$update
-
     substituteInPlace via/CMakeLists.txt --replace "jsoncpp_static" "jsoncpp"
   '';
 
@@ -85,13 +71,6 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  patches = [
-    ./gtest.patch
-  ];
-
-  # Same as vulkan-validation-layers
-  dontPatchELF = true;
-
   # Help vulkan-loader find the validation layers
   setupHook = writeText "setup-hook" ''
     export XDG_CONFIG_DIRS=@out@/etc''${XDG_CONFIG_DIRS:+:''${XDG_CONFIG_DIRS}}
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/gtest.patch b/pkgs/tools/graphics/vulkan-tools-lunarg/gtest.patch
deleted file mode 100644
index cf062a8591f..00000000000
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/gtest.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/external/googletest/googlemock/CMakeLists.txt b/external/googletest/googlemock/CMakeLists.txt
-index e7df8ec53d..869bfcb716 100644
---- a/external/googletest/googlemock/CMakeLists.txt
-+++ b/external/googletest/googlemock/CMakeLists.txt
-@@ -111,10 +111,10 @@ endif()
- if (DEFINED CMAKE_VERSION AND NOT "${CMAKE_VERSION}" VERSION_LESS "2.8.11")
-   target_include_directories(gmock SYSTEM INTERFACE
-     "$<BUILD_INTERFACE:${gmock_build_include_dirs}>"
--    "$<INSTALL_INTERFACE:$<INSTALL_PREFIX>/${CMAKE_INSTALL_INCLUDEDIR}>")
-+    "$<INSTALL_INTERFACE:${CMAKE_INSTALL_FULL_INCLUDEDIR}>")
-   target_include_directories(gmock_main SYSTEM INTERFACE
-     "$<BUILD_INTERFACE:${gmock_build_include_dirs}>"
--    "$<INSTALL_INTERFACE:$<INSTALL_PREFIX>/${CMAKE_INSTALL_INCLUDEDIR}>")
-+    "$<INSTALL_INTERFACE:${CMAKE_INSTALL_FULL_INCLUDEDIR}>")
- endif()
- 
- ########################################################################
-diff --git a/external/googletest/googletest/CMakeLists.txt b/external/googletest/googletest/CMakeLists.txt
-index abdd98b79a..7ae174d566 100644
---- a/external/googletest/googletest/CMakeLists.txt
-+++ b/external/googletest/googletest/CMakeLists.txt
-@@ -138,10 +138,10 @@ set_target_properties(gtest_main PROPERTIES VERSION ${GOOGLETEST_VERSION})
- if (DEFINED CMAKE_VERSION AND NOT "${CMAKE_VERSION}" VERSION_LESS "2.8.11")
-   target_include_directories(gtest SYSTEM INTERFACE
-     "$<BUILD_INTERFACE:${gtest_build_include_dirs}>"
--    "$<INSTALL_INTERFACE:$<INSTALL_PREFIX>/${CMAKE_INSTALL_INCLUDEDIR}>")
-+    "$<INSTALL_INTERFACE:${CMAKE_INSTALL_FULL_INCLUDEDIR}>")
-   target_include_directories(gtest_main SYSTEM INTERFACE
-     "$<BUILD_INTERFACE:${gtest_build_include_dirs}>"
--    "$<INSTALL_INTERFACE:$<INSTALL_PREFIX>/${CMAKE_INSTALL_INCLUDEDIR}>")
-+    "$<INSTALL_INTERFACE:${CMAKE_INSTALL_FULL_INCLUDEDIR}>")
- endif()
- target_link_libraries(gtest_main PUBLIC gtest)
-
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 9327bd9c9d6..e148f51d868 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.261";
+  version = "1.3.268.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
-    rev = "v${version}";
-    hash = "sha256-C5FVkI9F/dgIS8qp7VaOn9J2zoNLb1PnmgAemsVO6zM=";
+    rev = "vulkan-sdk-${version}";
+    hash = "sha256-IsMxiAR4ak6kC3BNYhtI+JVNkEka4ZceSElxk39THXg=";
   };
 
   nativeBuildInputs = [
@@ -57,27 +57,19 @@ stdenv.mkDerivation rec {
     Cocoa
   ];
 
-  libraryPath = lib.strings.makeLibraryPath [ vulkan-loader ];
-
-  patches = [
-    # Vulkan-Tools expects to find the MoltenVK ICD and `libMoltenVK.dylib` in its source repo.
-    # Patch it to use the already-built binaries and ICD in nixpkgs.
-    ./use-nix-moltenvk.patch
-  ];
-
-  # vkcube.app and vkcubepp.app require `ibtool`, but the version in `xib2nib` is not capable of
-  # building these apps. Build them using `ibtool` from Xcode, but don’t allow any other binaries
-  # into the sandbox. Note that the CLT are not supported because `ibtool` requires Xcode.
-  sandboxProfile = lib.optionalString stdenv.isDarwin ''
-    (allow process-exec
-      (literal "/usr/bin/ibtool")
-      (regex "/Xcode.app/Contents/Developer/usr/bin/ibtool")
-      (regex "/Xcode.app/Contents/Developer/usr/bin/xcodebuild"))
-    (allow file-read*)
-    (deny file-read* (subpath "/usr/local") (with no-log))
-    (allow file-write* (subpath "/private/var/folders"))
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    # Modify mac_common.cmake to find the ICD where nixpkgs puts it.
+    substituteInPlace mac_common.cmake \
+      --replace MoltenVK/icd/MoltenVK_icd.json MoltenVK_icd.json
+    # Remove the unconditional check for `ibtool` since the cube demo that needs it won’t be built.
+    sed -e '/#.*Interface Builder/,/^endif()/d' -i mac_common.cmake
+    # Install `vulkaninfo` to $out/bin even on Darwin.
+    substituteInPlace vulkaninfo/CMakeLists.txt \
+      --replace 'install(TARGETS vulkaninfo RUNTIME DESTINATION "vulkaninfo")' 'install(TARGETS vulkaninfo)'
   '';
 
+  libraryPath = lib.strings.makeLibraryPath [ vulkan-loader ];
+
   dontPatchELF = true;
 
   cmakeFlags = [
@@ -91,7 +83,8 @@ stdenv.mkDerivation rec {
     "-Wno-dev"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DMOLTENVK_REPO_ROOT=${moltenvk}/share/vulkan/icd.d"
-    "-DIBTOOL=/usr/bin/ibtool"
+    # Don’t build the cube demo because it requires `ibtool`, which is not available in nixpkgs.
+    "-DBUILD_CUBE=OFF"
   ];
 
   meta = with lib; {
@@ -102,7 +95,6 @@ stdenv.mkDerivation rec {
       use of the Vulkan API.
     '';
     homepage    = "https://github.com/KhronosGroup/Vulkan-Tools";
-    hydraPlatforms = [ "x86_64-linux" "i686-linux" ];
     platforms   = platforms.unix;
     license     = licenses.asl20;
     maintainers = [ maintainers.ralith ];
diff --git a/pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch b/pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch
deleted file mode 100644
index 5d09bff9c95..00000000000
--- a/pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-diff --git a/cube/CMakeLists.txt b/cube/CMakeLists.txt
-index a2f026e7..327f5dba 100644
---- a/cube/CMakeLists.txt
-+++ b/cube/CMakeLists.txt
-@@ -257,14 +257,7 @@ else()
- endif()
- 
- if(APPLE)
--    # Keep RPATH so fixup_bundle can use it to find libraries
--    set_target_properties(vkcube PROPERTIES INSTALL_RPATH_USE_LINK_PATH TRUE)
--    install(TARGETS vkcube BUNDLE DESTINATION "cube")
--    # Fix up the library references to be self-contained within the bundle.
--    install(CODE "
--        include(BundleUtilities)
--        fixup_bundle(\${CMAKE_INSTALL_PREFIX}/cube/vkcube.app \"\" \"${Vulkan_LIBRARY_DIR}\")
--        ")
-+    install(TARGETS vkcube BUNDLE DESTINATION "Applications")
- else()
-     install(TARGETS vkcube RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
- endif()
-@@ -302,14 +295,7 @@ else()
- endif()
- 
- if(APPLE)
--    # Keep RPATH so fixup_bundle can use it to find libraries
--    set_target_properties(vkcubepp PROPERTIES INSTALL_RPATH_USE_LINK_PATH TRUE)
--    install(TARGETS vkcubepp BUNDLE DESTINATION "cube")
--    # Fix up the library references to be self-contained within the bundle.
--    install(CODE "
--        include(BundleUtilities)
--        fixup_bundle(\${CMAKE_INSTALL_PREFIX}/cube/vkcubepp.app \"\" \"${Vulkan_LIBRARY_DIR}\")
--        ")
-+    install(TARGETS vkcubepp BUNDLE DESTINATION "Applications")
- else()
-     install(TARGETS vkcubepp RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
- endif()
-diff --git a/cube/macOS/cube/cube.cmake b/cube/macOS/cube/cube.cmake
-index 9b823f95..0c43a2c9 100644
---- a/cube/macOS/cube/cube.cmake
-+++ b/cube/macOS/cube/cube.cmake
-@@ -72,12 +72,14 @@ set_source_files_properties("${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json"
- # Copy the MoltenVK lib into the bundle.
- if(${CMAKE_GENERATOR} MATCHES "^Xcode.*")
-     add_custom_command(TARGET vkcube POST_BUILD
--                       COMMAND ${CMAKE_COMMAND} -E copy "${MOLTENVK_DIR}/MoltenVK/dylib/macOS/libMoltenVK.dylib"
-+                       COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/$<CONFIG>/vkcube.app/Contents/Frameworks
-+                       COMMAND ${CMAKE_COMMAND} -E create_symlink "${MOLTENVK_DIR}/lib/libMoltenVK.dylib"
-                                ${CMAKE_CURRENT_BINARY_DIR}/$<CONFIG>/vkcube.app/Contents/Frameworks/libMoltenVK.dylib
-                        DEPENDS vulkan)
- else()
-     add_custom_command(TARGET vkcube POST_BUILD
--                       COMMAND ${CMAKE_COMMAND} -E copy "${MOLTENVK_DIR}/MoltenVK/dylib/macOS/libMoltenVK.dylib"
-+                       COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/vkcube.app/Contents/Frameworks
-+                       COMMAND ${CMAKE_COMMAND} -E create_symlink "${MOLTENVK_DIR}/lib/libMoltenVK.dylib"
-                                ${CMAKE_CURRENT_BINARY_DIR}/vkcube.app/Contents/Frameworks/libMoltenVK.dylib
-                        DEPENDS vulkan)
- endif()
-diff --git a/cube/macOS/cubepp/cubepp.cmake b/cube/macOS/cubepp/cubepp.cmake
-index eae4de3c..e528ae26 100644
---- a/cube/macOS/cubepp/cubepp.cmake
-+++ b/cube/macOS/cubepp/cubepp.cmake
-@@ -74,12 +74,14 @@ set_source_files_properties("${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json"
- # Copy the MoltenVK lib into the bundle.
- if(${CMAKE_GENERATOR} MATCHES "^Xcode.*")
-     add_custom_command(TARGET vkcubepp POST_BUILD
--                       COMMAND ${CMAKE_COMMAND} -E copy "${MOLTENVK_DIR}/MoltenVK/dylib/macOS/libMoltenVK.dylib"
-+                       COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/$<CONFIG>/vkcubepp.app/Contents/Frameworks
-+                       COMMAND ${CMAKE_COMMAND} -E create_symlink "${MOLTENVK_DIR}/lib/libMoltenVK.dylib"
-                                ${CMAKE_CURRENT_BINARY_DIR}/$<CONFIG>/vkcubepp.app/Contents/Frameworks/libMoltenVK.dylib
-                        DEPENDS vulkan)
- else()
-     add_custom_command(TARGET vkcubepp POST_BUILD
--                       COMMAND ${CMAKE_COMMAND} -E copy "${MOLTENVK_DIR}/MoltenVK/dylib/macOS/libMoltenVK.dylib"
-+                       COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/vkcubepp.app/Contents/Frameworks
-+                       COMMAND ${CMAKE_COMMAND} -E create_symlink "${MOLTENVK_DIR}/lib/libMoltenVK.dylib"
-                                ${CMAKE_CURRENT_BINARY_DIR}/vkcubepp.app/Contents/Frameworks/libMoltenVK.dylib
-                        DEPENDS vulkan)
- endif()
-diff --git a/mac_common.cmake b/mac_common.cmake
-index bad3c414..b498906d 100644
---- a/mac_common.cmake
-+++ b/mac_common.cmake
-@@ -23,9 +23,8 @@ set(MOLTENVK_DIR ${MOLTENVK_REPO_ROOT})
- # MoltenVK JSON File
- 
- execute_process(COMMAND mkdir -p ${CMAKE_BINARY_DIR}/staging-json)
--execute_process(COMMAND sed -e "/\"library_path\":/s$:[[:space:]]*\"[[:space:]]*[\\.\\/]*$: \"..\\/..\\/..\\/Frameworks\\/$"
--                        ${MOLTENVK_DIR}/MoltenVK/icd/MoltenVK_icd.json
--                OUTPUT_FILE ${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json)
-+execute_process(COMMAND ${CMAKE_COMMAND} -E create_symlink ${MOLTENVK_DIR}/MoltenVK_icd.json
-+                        ${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json)
- 
- # ~~~
- # Modify the ICD JSON file to adjust the library path.
-@@ -36,10 +35,9 @@ execute_process(COMMAND sed -e "/\"library_path\":/s$:[[:space:]]*\"[[:space:]]*
- # ~~~
- add_custom_target(MoltenVK_icd-staging-json ALL
-                   COMMAND mkdir -p ${CMAKE_BINARY_DIR}/staging-json
--                  COMMAND sed -e "/\"library_path\":/s$:[[:space:]]*\"[[:space:]]*[\\.\\/]*$: \"..\\/..\\/..\\/Frameworks\\/$"
--                          ${MOLTENVK_DIR}/MoltenVK/icd/MoltenVK_icd.json > ${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json
--                  VERBATIM
--                  DEPENDS "${MOLTENVK_DIR}/MoltenVK/icd/MoltenVK_icd.json")
-+                  COMMAND ${CMAKE_COMMAND} -E create_symlink ${MOLTENVK_DIR}/MoltenVK_icd.json
-+                          ${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json
-+                  DEPENDS "${MOLTENVK_DIR}/MoltenVK_icd.json")
- set_source_files_properties(${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json PROPERTIES GENERATED TRUE)
- 
- find_library(COCOA NAMES Cocoa)
-diff --git a/vulkaninfo/CMakeLists.txt b/vulkaninfo/CMakeLists.txt
-index d23dcf89..32aa0ebb 100644
---- a/vulkaninfo/CMakeLists.txt
-+++ b/vulkaninfo/CMakeLists.txt
-@@ -136,9 +136,5 @@ elseif(APPLE)
-     add_definitions(-DVK_USE_PLATFORM_MACOS_MVK -DVK_USE_PLATFORM_METAL_EXT)
- endif()
- 
--if(APPLE)
--    install(TARGETS vulkaninfo RUNTIME DESTINATION "vulkaninfo")
--else()
--    install(TARGETS vulkaninfo RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
--endif()
-+install(TARGETS vulkaninfo RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
- 
diff --git a/pkgs/tools/inputmethods/fcitx5/default.nix b/pkgs/tools/inputmethods/fcitx5/default.nix
index 136550548e6..877b3ec6e52 100644
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@@ -8,6 +8,7 @@
 , extra-cmake-modules
 , cairo
 , pango
+, expat
 , fribidi
 , fmt
 , wayland
@@ -29,6 +30,7 @@
 , libdatrie
 , xcbutilkeysyms
 , pcre
+, xcbutil
 , xcbutilwm
 , xcb-imdkit
 , libxkbfile
@@ -63,6 +65,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    expat
     fmt
     isocodes
     cairo
@@ -84,6 +87,7 @@ stdenv.mkDerivation rec {
     libXdmcp
     libxkbcommon
     pcre
+    xcbutil
     xcbutilwm
     xcbutilkeysyms
     xcb-imdkit
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 19ab5158a65..e2457ad63e1 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -6,18 +6,29 @@ tcl.mkTclDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/expect/Expect/${version}/expect${version}.tar.gz";
-    sha256 = "0d1cp5hggjl93xwc8h1y6adbnrvpkk0ywkd00inz9ndxn21xm9s9";
+    hash = "sha256-Safag7C92fRtBKBN7sGcd2e7mjI+QMR4H4nK92C5LDQ=";
   };
 
   patches = [
     (fetchpatch {
       url = "https://raw.githubusercontent.com/buildroot/buildroot/c05e6aa361a4049eabd8b21eb64a34899ef83fc7/package/expect/0001-enable-cross-compilation.patch";
-      sha256 = "1jwx2l1slidvcpahxbyqs942l81jd62rzbxliyd9lwysk38c8b6b";
+      hash = "sha256-yyzE0Jjac5qaj7Svn4VpMiAqSNLYrw7VZbtFqgMVncs=";
     })
     (substituteAll {
       src = ./fix-cross-compilation.patch;
       tcl = "${buildPackages.tcl}/bin/tclsh";
     })
+    # The following patches fix compilation with clang 15+
+    (fetchpatch {
+      url = "https://sourceforge.net/p/expect/patches/24/attachment/0001-Add-prototype-to-function-definitions.patch";
+      hash = "sha256-X2Vv6VVM3KjmBHo2ukVWe5YTVXRmqe//Kw2kr73OpZs=";
+    })
+    (fetchpatch {
+      url = "https://sourceforge.net/p/expect/patches/_discuss/thread/b813ca9895/6759/attachment/expect-configure-c99.patch";
+      hash = "sha256-PxQQ9roWgVXUoCMxkXEgu+it26ES/JuzHF6oML/nk54=";
+    })
+    # Include `sys/ioctl.h` and `util.h` on Darwin, which are required for `ioctl` and `openpty`.
+    ./fix-darwin-clang16.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/expect/fix-darwin-clang16.patch b/pkgs/tools/misc/expect/fix-darwin-clang16.patch
new file mode 100644
index 00000000000..9454769c99c
--- /dev/null
+++ b/pkgs/tools/misc/expect/fix-darwin-clang16.patch
@@ -0,0 +1,31 @@
+diff -ur a/exp_win.c b/exp_win.c
+--- a/exp_win.c	2018-02-02 14:15:52.000000000 -0500
++++ b/exp_win.c	2023-10-10 07:47:33.082690432 -0400
+@@ -39,7 +39,8 @@
+ /* Sigh.  On AIX 2.3, termios.h exists but does not define TIOCGWINSZ */
+ /* Instead, it has to come from ioctl.h.  However, As I said above, this */
+ /* can't be cavalierly included on all machines, even when it exists. */
+-#if defined(HAVE_TERMIOS) && !defined(HAVE_TIOCGWINSZ_IN_TERMIOS_H)
++/* Darwin also has termios.h, but it requires ioctl.h for `ioctl`. */
++#if defined(HAVE_TERMIOS) && (defined(__APPLE__) || !defined(HAVE_TIOCGWINSZ_IN_TERMIOS_H))
+ #  include <sys/ioctl.h>
+ #endif
+ 
+diff -ur d/pty_termios.c c/pty_termios.c
+--- d/pty_termios.c	2023-10-10 07:59:23.244452442 -0400
++++ c/pty_termios.c	2023-10-10 08:00:35.303231582 -0400
+@@ -7,7 +7,13 @@
+ 
+ */
+ 
+-#include <pty.h> /* openpty */
++/* openpty */
++#ifdef __APPLE__
++#include <util.h>
++#else /* pty.h is Linux-specific */
++#include <pty.h>
++#endif
++
+ #include <stdio.h>
+ #include <signal.h>
+ 
diff --git a/pkgs/tools/misc/xvfb-run/default.nix b/pkgs/tools/misc/xvfb-run/default.nix
index fc87723208e..eb1e7c5b01b 100644
--- a/pkgs/tools/misc/xvfb-run/default.nix
+++ b/pkgs/tools/misc/xvfb-run/default.nix
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation rec {
     chmod a+x $out/bin/xvfb-run
     patchShebangs $out/bin/xvfb-run
     wrapProgram $out/bin/xvfb-run \
-      --set FONTCONFIG_FILE "${fontsConf}" \
+      --set-default FONTCONFIG_FILE "${fontsConf}" \
       --prefix PATH : ${lib.makeBinPath [ getopt xorgserver xauth which util-linux gawk coreutils ]}
   '';
 
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index c99f09e7f93..ad7cac085b4 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, perl, nixosTests
+{ lib, stdenv, fetchurl, darwin, pkg-config, perl, nixosTests
 , brotliSupport ? false, brotli
 , c-aresSupport ? false, c-aresMinimal
 , gnutlsSupport ? false, gnutls
@@ -57,10 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
   };
 
-  patches = [
-    ./7.79.1-darwin-no-systemconfiguration.patch
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
@@ -68,6 +64,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    CoreFoundation
+    CoreServices
+    SystemConfiguration
+  ]);
   nativeBuildInputs = [ pkg-config perl ];
 
   # Zlib and OpenSSL must be propagated because `libcurl.la' contains
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index b23753e2041..43d2124d682 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, nettle
-, libidn, libnetfilter_conntrack, buildPackages
+, libidn, libnetfilter_conntrack, nftables, buildPackages
 , dbusSupport ? stdenv.isLinux
 , dbus
 , nixosTests
@@ -13,6 +13,7 @@ let
     "-DHAVE_DBUS"
   ] ++ lib.optionals stdenv.isLinux [
     "-DHAVE_CONNTRACK"
+    "-DHAVE_NFTSET"
   ]);
 in
 stdenv.mkDerivation rec {
@@ -75,7 +76,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ nettle libidn ]
     ++ lib.optionals dbusSupport [ dbus ]
-    ++ lib.optionals stdenv.isLinux [ libnetfilter_conntrack ];
+    ++ lib.optionals stdenv.isLinux [ libnetfilter_conntrack nftables ];
 
   passthru.tests = {
     prometheus-exporter = nixosTests.prometheus-exporters.dnsmasq;
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index ebf56f3cc29..6ee8c4928e0 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -57,11 +57,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.44.0";
+  version = "1.44.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-7coJY30YL4BrOxLYxWI9e629c8zKGuY74g0vKYd5+58=";
+    sha256 = "sha256-S1i/OsV+LO+1ZS79CUXrC0vDamPZKmGrRx2LssmkIOE=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/package-management/ciel/default.nix b/pkgs/tools/package-management/ciel/default.nix
index 7ccd34c665d..d6040c4a076 100644
--- a/pkgs/tools/package-management/ciel/default.nix
+++ b/pkgs/tools/package-management/ciel/default.nix
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage rec {
     # FIXME: remove this patch after https://github.com/AOSC-Dev/ciel-rs/pull/16 is merged
     (fetchpatch {
       name = "use-canonicalize-path-to-find-libexec.patch";
-      url = "https://github.com/AOSC-Dev/ciel-rs/pull/16.patch";
+      url = "https://github.com/AOSC-Dev/ciel-rs/commit/17f41538ed1057e855540f5abef7faf6ea4abf5c.patch";
       sha256 = "sha256-ELK2KpOuoBS774apomUIo8q1eXYs/FX895G7eBdgOQg=";
     })
   ];
diff --git a/pkgs/tools/security/certmgr/default.nix b/pkgs/tools/security/certmgr/default.nix
index e2318c853f1..da62e7d0568 100644
--- a/pkgs/tools/security/certmgr/default.nix
+++ b/pkgs/tools/security/certmgr/default.nix
@@ -35,7 +35,9 @@ in
     # TODO: remove patch when PR is merged.
     patches = [
       (fetchpatch {
-        url    = "https://github.com/cloudflare/certmgr/pull/51.patch";
+        # https://github.com/cloudflare/certmgr/pull/51
+        name   = "cloudflare-certmgr-pull-51.patch";
+        url    = "https://github.com/cloudflare/certmgr/compare/232e0adf8379db28ab74c46e0dd3eddb3cd8f2ea...55c595a4a2dc871726b3c8337469daf5597718a3.patch";
         sha256 = "0jhsw159d2mgybvbbn6pmvj4yqr5cwcal5fjwkcn9m4f4zlb6qrs";
       })
     ];
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
index 012d492aaca..de260e06824 100644
--- a/pkgs/tools/security/ibm-sw-tpm2/default.nix
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -1,4 +1,9 @@
-{ stdenv, fetchurl, lib, openssl }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, openssl
+}:
 
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
@@ -9,6 +14,18 @@ stdenv.mkDerivation rec {
     hash = "sha256-PLZC+HGheyPVCwRuX5X0ScIodBX8HnrrS9u4kg28s48=";
   };
 
+  patches = [
+    # Backport openssl-3.1 from development branch.
+    # Can be removed with next release.
+    (fetchpatch {
+      name = "openssl-3.1.patch";
+      url = "https://github.com/kgoldman/ibmswtpm2/commit/15501bf4973d334ca9420fa2fb0f0fe1800871e0.patch";
+      includes = [ "TpmToOsslMath.h" ];
+      stripLen = 1;
+      hash = "sha256-8TwyZVy8pQwq5Fl8cy9xJWtdckwL+QK0+DL5EHDLYUY=";
+    })
+  ];
+
   buildInputs = [ openssl ];
 
   sourceRoot = "src";
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 478cca8be0e..a4ae25715c3 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -8,7 +8,7 @@
 , python3
 , dbus
 , polkit
-, systemdMinimal
+, systemdLibs
 , IOKit
 , pname ? "pcsclite"
 , polkitSupport ? false
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config perl ];
 
   buildInputs = [ python3 ]
-    ++ lib.optionals stdenv.isLinux [ systemdMinimal ]
+    ++ lib.optionals stdenv.isLinux [ systemdLibs ]
     ++ lib.optionals stdenv.isDarwin [ IOKit ]
     ++ lib.optionals polkitSupport [ dbus polkit ];
 
diff --git a/pkgs/tools/system/which/default.nix b/pkgs/tools/system/which/default.nix
index 82316541f4c..831791a2f8b 100644
--- a/pkgs/tools/system/which/default.nix
+++ b/pkgs/tools/system/which/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/which/which-${version}.tar.gz";
-    sha256 = "1bgafvy3ypbhhfznwjv1lxmd6mci3x1byilnnkc7gcr486wlb8pl";
+    hash = "sha256-9KJFuUEks3fYtJZGv0IfkVXTaqdhS26/g3BdP/x26q0=";
   };
 
   strictDeps = true;
@@ -19,10 +19,11 @@ stdenv.mkDerivation rec {
     lib.optional stdenv.hostPlatform.is32bit "-D_FILE_OFFSET_BITS=64"
   );
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.gnu.org/software/which/";
     description = "Shows the full path of (shell) commands";
-    platforms = platforms.all;
-    license = licenses.gpl3;
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "which";
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/video/mjpegtools/c++-17-fixes.patch b/pkgs/tools/video/mjpegtools/c++-17-fixes.patch
new file mode 100644
index 00000000000..018cc7e9bea
--- /dev/null
+++ b/pkgs/tools/video/mjpegtools/c++-17-fixes.patch
@@ -0,0 +1,44 @@
+diff -ur a/mplex/main.cpp b/mplex/main.cpp
+--- a/mplex/main.cpp	2021-09-05 02:14:13.029372000 -0400
++++ b/mplex/main.cpp	2023-09-23 08:47:07.683450627 -0400
+@@ -50,7 +50,7 @@
+ #include "multiplexor.hpp"
+ 
+ 
+-using std::auto_ptr;
++using std::unique_ptr;
+ 
+ 
+ /*************************************************************************
+@@ -138,7 +138,7 @@
+ void 
+ FileOutputStream::NextSegment( )
+ {
+-    auto_ptr<char> prev_filename_buf( new char[strlen(cur_filename)+1] );
++    unique_ptr<char> prev_filename_buf( new char[strlen(cur_filename)+1] );
+     char *prev_filename = prev_filename_buf.get();
+ 	fclose(strm);
+ 	++segment_num;
+diff -ur a/utils/fastintfns.h b/utils/fastintfns.h
+--- a/utils/fastintfns.h	2021-09-05 02:14:13.033372000 -0400
++++ b/utils/fastintfns.h	2023-09-23 08:44:40.147112973 -0400
+@@ -2,12 +2,17 @@
+  *
+  * WARNING: Assumes 2's complement arithmetic.
+  */
+-static inline int intmax( register int x, register int y )
++#ifdef __cplusplus
++#define REGISTER
++#else
++#define REGISTER register
++#endif
++static inline int intmax( REGISTER int x, REGISTER int y )
+ {
+ 	return x < y ? y : x;
+ }
+ 
+-static inline int intmin( register int x, register int y )
++static inline int intmin( REGISTER int x, REGISTER int y )
+ {
+ 	return x < y ? x : y;
+ }
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 675dfc109de..f231d6ed184 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-sYBTbX2ZYLBeACOhl7ANyxAJKaSaq3HRnVX0obIQ9Jo=";
   };
 
+  # Clang 16 defaults to C++17. `std::auto_ptr` has been removed from C++17, and the
+  # `register` type class specifier is no longer allowed.
+  patches = [ ./c++-17-fixes.patch ];
+
   hardeningDisable = [ "format" ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/wayland/chayang/default.nix b/pkgs/tools/wayland/chayang/default.nix
index ccfba6a0cf0..30780ed90a8 100644
--- a/pkgs/tools/wayland/chayang/default.nix
+++ b/pkgs/tools/wayland/chayang/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  pkgsBuildBuild = [
+  depsBuildBuild = [
     pkg-config
   ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ed87a4a123a..2412ad41884 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -702,6 +702,9 @@ mapAliases ({
   prometheus-speedtest-exporter = throw "prometheus-speedtest-exporter was removed as unmaintained"; # Added 2023-07-31
   protobuf3_17 = throw "protobuf3_17 does not receive updates anymore and has been removed"; # Added 2023-05-21
   protobuf3_19 = throw "protobuf3_19 does not receive updates anymore and has been removed"; # Added 2023-10-01
+  protobuf3_24 = protobuf_24;
+  protobuf3_23 = protobuf_23;
+  protobuf3_21 = protobuf_21;
   protonup = protonup-ng; # Added 2022-11-06
   proxmark3-rrg = proxmark3; # Added 2023-07-25
   proxmark3-unstable = throw "removed in favor of rfidresearchgroup fork"; # Added 2023-07-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index eacb266e2ff..12ed97b9bab 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -761,7 +761,7 @@ with pkgs;
   protoc-gen-go-vtproto = callPackage ../development/tools/protoc-gen-go-vtproto { };
 
   protoc-gen-grpc-web = callPackage ../development/tools/protoc-gen-grpc-web {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   protoc-gen-connect-go = callPackage ../development/tools/protoc-gen-connect-go { };
@@ -1085,7 +1085,7 @@ with pkgs;
     antlr = antlr4_10;
     boost = boost177; # Configure checks for specific version.
     icu =  icu69;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   mysql-shell-innovation = callPackage ../development/tools/mysql-shell/innovation.nix {
@@ -1094,7 +1094,7 @@ with pkgs;
     antlr = antlr4_10;
     boost = boost177; # Configure checks for specific version.
     icu =  icu69;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   broadlink-cli = callPackage ../tools/misc/broadlink-cli { };
@@ -2673,7 +2673,7 @@ with pkgs;
   gensgs = pkgsi686Linux.callPackage ../applications/emulators/gens-gs { };
 
   goldberg-emu = callPackage ../applications/emulators/goldberg-emu {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   gopsuinfo = callPackage ../tools/system/gopsuinfo { };
@@ -4159,7 +4159,7 @@ with pkgs;
   amoco = callPackage ../tools/security/amoco { };
 
   anbox = callPackage ../os-specific/linux/anbox {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   androidenv = callPackage ../development/mobile/androidenv { };
@@ -4707,7 +4707,7 @@ with pkgs;
   common-licenses = callPackage ../data/misc/common-licenses { };
 
   compactor = callPackage ../applications/networking/compactor {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   consul = callPackage ../servers/consul { };
@@ -5517,7 +5517,7 @@ with pkgs;
   ghdorker = callPackage ../tools/security/ghdorker { };
 
   ghidra = darwin.apple_sdk_11_0.callPackage ../tools/security/ghidra/build.nix {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   ghidra-bin = callPackage ../tools/security/ghidra { };
@@ -6837,7 +6837,7 @@ with pkgs;
   clementine = libsForQt5.callPackage ../applications/audio/clementine {
     gst_plugins =
       with gst_all_1; [ gst-plugins-base gst-plugins-good gst-plugins-ugly gst-libav ];
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   mellowplayer = libsForQt5.callPackage ../applications/audio/mellowplayer { };
@@ -7042,7 +7042,7 @@ with pkgs;
 
     mozc = callPackage ../tools/inputmethods/ibus-engines/ibus-mozc {
       stdenv = clangStdenv;
-      protobuf = pkgs.protobuf3_21.overrideDerivation (_: { stdenv = clangStdenv; });
+      protobuf = pkgs.protobuf_21.overrideDerivation (_: { stdenv = clangStdenv; });
     };
 
     openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard { withIbusSupport = true; };
@@ -10242,7 +10242,7 @@ with pkgs;
 
   netdata = callPackage ../tools/system/netdata {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
   netdataCloud = netdata.override {
     withCloud = !stdenv.isDarwin;
@@ -11388,7 +11388,7 @@ with pkgs;
   nq = callPackage ../tools/system/nq { };
 
   nsjail = callPackage ../tools/security/nsjail {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   nss_pam_ldapd = callPackage ../tools/networking/nss-pam-ldapd { };
@@ -11518,7 +11518,7 @@ with pkgs;
   oh-my-zsh = callPackage ../shells/zsh/oh-my-zsh { };
 
   ola = callPackage ../applications/misc/ola {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   olive-editor = qt6Packages.callPackage ../applications/video/olive-editor {
@@ -11791,7 +11791,7 @@ with pkgs;
   p3x-onenote = callPackage ../applications/office/p3x-onenote { };
 
   p4c = callPackage ../development/compilers/p4c {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   p7zip = callPackage ../tools/archivers/p7zip { };
@@ -11891,7 +11891,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
     boost = boost177; # Configure checks for specific version.
     icu = icu69;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
   percona-xtrabackup = percona-xtrabackup_8_0;
   percona-xtrabackup_8_0 = callPackage ../tools/backup/percona-xtrabackup/8_0.nix {
@@ -15192,7 +15192,7 @@ with pkgs;
   zasm = callPackage ../development/compilers/zasm { };
 
   zbackup = callPackage ../tools/backup/zbackup {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   zbar = libsForQt5.callPackage ../tools/graphics/zbar {
@@ -16671,10 +16671,10 @@ with pkgs;
     # This returns the minimum supported version for the platform. The
     # assumption is that or any later version is good.
     choose = platform:
-      /**/ if platform.isDarwin then 11
+      /**/ if platform.isDarwin then 16
       else if platform.isFreeBSD then 12
       else if platform.isAndroid then 12
-      else if platform.isLinux then 11
+      else if platform.isLinux then 16
       else if platform.isWasm then 12
       else 14;
     # We take the "max of the mins". Why? Since those are lower bounds of the
@@ -16958,11 +16958,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_72 = callPackage ../development/compilers/rust/1_72.nix {
+  rust_1_73 = callPackage ../development/compilers/rust/1_73.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_16 = llvmPackages_16.libllvm;
   };
-  rust = rust_1_72;
+  rust = rust_1_73;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16970,8 +16970,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_72 = rust_1_72.packages.stable;
-  rustPackages = rustPackages_1_72;
+  rustPackages_1_73 = rust_1_73.packages.stable;
+  rustPackages = rustPackages_1_73;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -18060,9 +18060,9 @@ with pkgs;
     inherit (darwin) libobjc;
   };
 
-  inherit (darwin.apple_sdk_11_0.callPackage ../development/interpreters/ruby {
+  inherit (callPackage ../development/interpreters/ruby {
     inherit (darwin) libobjc libunwind;
-    inherit (darwin.apple_sdk_11_0.frameworks) Foundation;
+    inherit (darwin.apple_sdk.frameworks) Foundation;
   })
     mkRubyVersion
     mkRuby
@@ -18199,9 +18199,9 @@ with pkgs;
   # Needed for autogen
   guile_2_0 = callPackage ../development/interpreters/guile/2.0.nix { };
 
-  guile_2_2 = darwin.apple_sdk_11_0.callPackage ../development/interpreters/guile/2.2.nix { };
+  guile_2_2 = callPackage ../development/interpreters/guile/2.2.nix { };
 
-  guile_3_0 = darwin.apple_sdk_11_0.callPackage ../development/interpreters/guile/3.0.nix { };
+  guile_3_0 = callPackage ../development/interpreters/guile/3.0.nix { };
 
   guile = guile_3_0;
 
@@ -20140,12 +20140,12 @@ with pkgs;
   };
 
   spoofer = callPackage ../tools/networking/spoofer {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   spoofer-gui = callPackage ../tools/networking/spoofer {
     withGUI = true;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   spooles = callPackage ../development/libraries/science/math/spooles { };
@@ -20888,7 +20888,7 @@ with pkgs;
   cmrt = callPackage ../development/libraries/cmrt { };
 
   codecserver = callPackage ../applications/audio/codecserver {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   coeurl = callPackage ../development/libraries/coeurl { };
@@ -21400,7 +21400,7 @@ with pkgs;
   gallia = callPackage ../tools/security/gallia { };
 
   gamenetworkingsockets = callPackage ../development/libraries/gamenetworkingsockets {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   game-music-emu = callPackage ../development/libraries/audio/game-music-emu { };
@@ -21779,7 +21779,16 @@ with pkgs;
 
   grilo-plugins = callPackage ../development/libraries/grilo-plugins { };
 
-  grpc = callPackage ../development/libraries/grpc { };
+  grpc = callPackage ../development/libraries/grpc {
+    stdenv = if (stdenv.isDarwin && stdenv.isx86_64) then
+      # Work around Clang check for 10.13 when using aligned allocations with C++17.
+      stdenv.override (old: {
+        hostPlatform = old.hostPlatform // { darwinMinVersion = "10.13"; };
+        buildPlatform = old.buildPlatform // { darwinMinVersion = "10.13"; };
+        targetPlatform = old.targetPlatform // { darwinMinVersion = "10.13"; };
+      })
+      else stdenv;
+  };
 
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
@@ -22030,8 +22039,6 @@ with pkgs;
 
   hidapi = callPackage ../development/libraries/hidapi {
     inherit (darwin.apple_sdk.frameworks) Cocoa IOKit;
-    # TODO: remove once `udev` is `systemdMinimal` everywhere.
-    udev = systemdMinimal;
   };
 
   highfive = callPackage ../development/libraries/highfive { };
@@ -22735,9 +22742,7 @@ with pkgs;
 
   libfakekey = callPackage ../development/libraries/libfakekey { };
 
-  libfido2 = callPackage ../development/libraries/libfido2 {
-    udev = systemdMinimal;
-  };
+  libfido2 = callPackage ../development/libraries/libfido2 {};
 
   libfilezilla = darwin.apple_sdk_11_0.callPackage ../development/libraries/libfilezilla {
     inherit (darwin.apple_sdk_11_0.frameworks) ApplicationServices;
@@ -23418,7 +23423,7 @@ with pkgs;
   libptytty = callPackage ../development/libraries/libptytty { };
 
   libpulsar = callPackage ../development/libraries/libpulsar {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   libpwquality = callPackage ../development/libraries/libpwquality {
@@ -23613,8 +23618,6 @@ with pkgs;
   libusb1 = callPackage ../development/libraries/libusb1 {
     inherit (darwin) libobjc;
     inherit (darwin.apple_sdk.frameworks) IOKit Security;
-    # TODO: remove once `udev` is `systemdMinimal` everywhere.
-    udev = systemdMinimal;
   };
 
   libusbgx = callPackage ../development/libraries/libusbgx { };
@@ -24427,7 +24430,8 @@ with pkgs;
 
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_1
-    openssl_3;
+    openssl_3
+    openssl_3_1;
 
   opensubdiv = callPackage ../development/libraries/opensubdiv { };
 
@@ -24583,13 +24587,14 @@ with pkgs;
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf3_24;
+  protobuf = protobuf_24;
 
-  protobuf3_24 = callPackage ../development/libraries/protobuf/3.24.nix { };
-  protobuf3_23 = callPackage ../development/libraries/protobuf/3.23.nix { };
-  protobuf3_21 = callPackage ../development/libraries/protobuf/3.21.nix {
+  protobuf_24 = callPackage ../development/libraries/protobuf/24.nix { };
+  protobuf_23 = callPackage ../development/libraries/protobuf/23.nix { };
+  protobuf_21 = callPackage ../development/libraries/protobuf/21.nix {
     abseil-cpp = abseil-cpp_202103;
   };
+
   protobuf3_20 = callPackage ../development/libraries/protobuf/3.20.nix {
     abseil-cpp = abseil-cpp_202103;
   };
@@ -24763,7 +24768,7 @@ with pkgs;
   qm-dsp = callPackage ../development/libraries/audio/qm-dsp { };
 
   qradiolink = callPackage ../applications/radio/qradiolink {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   qrupdate = callPackage ../development/libraries/qrupdate { };
@@ -25443,7 +25448,7 @@ with pkgs;
 
   valhalla = callPackage ../development/libraries/valhalla {
     boost = boost.override { enablePython = true; python = python38; };
-    protobuf = protobuf3_21.override {
+    protobuf = protobuf_21.override {
       abseil-cpp = abseil-cpp_202103.override {
         cxxStandard = "17";
       };
@@ -26971,7 +26976,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
     boost = boost177; # Configure checks for specific version.
     icu = icu69;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   mysql_jdbc = callPackage ../servers/sql/mysql/jdbc { };
@@ -27260,7 +27265,7 @@ with pkgs;
   rethinkdb = callPackage ../servers/nosql/rethinkdb {
     stdenv = clangStdenv;
     libtool = darwin.cctools;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   rippled = callPackage ../servers/rippled {
@@ -28255,10 +28260,6 @@ with pkgs;
   lsscsi = callPackage ../os-specific/linux/lsscsi { };
 
   lvm2 = callPackage ../os-specific/linux/lvm2/2_03.nix {
-    # udev is the same package as systemd which depends on cryptsetup
-    # which depends on lvm2 again.  But we only need the libudev part
-    # which does not depend on cryptsetup.
-    udev = systemdMinimal;
     # break the cyclic dependency:
     # util-linux (non-minimal) depends (optionally, but on by default) on systemd,
     # systemd (optionally, but on by default) on cryptsetup and cryptsetup depends on lvm2
@@ -28700,7 +28701,7 @@ with pkgs;
   sgx-ssl = callPackage ../os-specific/linux/sgx/ssl { };
 
   sgx-psw = callPackage ../os-specific/linux/sgx/psw {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   shadow = callPackage ../os-specific/linux/shadow { };
@@ -28795,11 +28796,14 @@ with pkgs;
     withUkify = false;
     withBootloader = false;
   };
-
+  systemdLibs = systemdMinimal.override {
+    pname = "systemd-minimal-libs";
+    buildLibsOnly = true;
+  };
 
   udev =
     if (with stdenv.hostPlatform; isLinux && isStatic) then libudev-zero
-    else systemd; # TODO: change to systemdMinimal
+    else systemdLibs;
 
   systemd-wait = callPackage ../os-specific/linux/systemd-wait { };
 
@@ -30466,7 +30470,7 @@ with pkgs;
 
   astroid = callPackage ../applications/networking/mailreaders/astroid {
     vim = vim-full.override { features = "normal"; };
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   aucatctl = callPackage ../applications/audio/aucatctl { };
@@ -32487,7 +32491,7 @@ with pkgs;
   };
 
   hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   hyperledger-fabric = callPackage ../tools/misc/hyperledger-fabric { };
@@ -33984,14 +33988,14 @@ with pkgs;
       avahi = avahi-compat;
       pulseSupport = config.pulseaudio or false;
       iceSupport = config.murmur.iceSupport or true;
-      protobuf = protobuf3_21;
+      protobuf = protobuf_21;
     }).murmur;
 
   mumble = (callPackages ../applications/networking/mumble {
       avahi = avahi-compat;
       jackSupport = config.mumble.jackSupport or false;
       speechdSupport = config.mumble.speechdSupport or false;
-      protobuf = protobuf3_21;
+      protobuf = protobuf_21;
     }).mumble;
 
   mumble_overlay = callPackage ../applications/networking/mumble/overlay.nix {
@@ -34119,7 +34123,7 @@ with pkgs;
   osm2pgsql = callPackage ../tools/misc/osm2pgsql { };
 
   ostinato = libsForQt5.callPackage ../applications/networking/ostinato {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   p4 = callPackage ../applications/version-management/p4 {
@@ -34228,7 +34232,7 @@ with pkgs;
 
   shogun = callPackage ../applications/science/machine-learning/shogun {
     opencv = opencv3;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   smplayer = libsForQt5.callPackage ../applications/video/smplayer { };
@@ -34593,7 +34597,7 @@ with pkgs;
   osmo-sip-connector = callPackage ../servers/osmocom/osmo-sip-connector { };
 
   osmscout-server = libsForQt5.callPackage ../applications/misc/osmscout-server {
-    protobuf = protobuf3_21.override {
+    protobuf = protobuf_21.override {
       abseil-cpp = abseil-cpp_202103.override {
         cxxStandard = "17";
       };
@@ -35112,7 +35116,7 @@ with pkgs;
   rgp = libsForQt5.callPackage ../development/tools/rgp { };
 
   ricochet = libsForQt5.callPackage ../applications/networking/instant-messengers/ricochet {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   ries = callPackage ../applications/science/math/ries { };
@@ -35435,7 +35439,7 @@ with pkgs;
 
   curaengine = callPackage ../applications/misc/curaengine {
     inherit (python3.pkgs) libarcus;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   cura = libsForQt5.callPackage ../applications/misc/cura { };
@@ -35824,7 +35828,7 @@ with pkgs;
   tijolo = callPackage ../applications/editors/tijolo { };
 
   tilemaker = callPackage ../applications/misc/tilemaker {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   timbreid = callPackage ../applications/audio/pd-plugins/timbreid {
@@ -37024,11 +37028,11 @@ with pkgs;
 
   bitcoin-abc  = libsForQt5.callPackage ../applications/blockchains/bitcoin-abc {
     withGui = true;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
   bitcoind-abc = callPackage ../applications/blockchains/bitcoin-abc {
     mkDerivation = stdenv.mkDerivation;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
     withGui = false;
   };
 
@@ -37599,7 +37603,7 @@ with pkgs;
   ckan = callPackage ../games/ckan { };
 
   cockatrice = libsForQt5.callPackage ../games/cockatrice {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   commandergenius = callPackage ../games/commandergenius { };
@@ -38192,12 +38196,12 @@ with pkgs;
   pong3d = callPackage ../games/pong3d { };
 
   pokerth = libsForQt5.callPackage ../games/pokerth {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   pokerth-server = libsForQt5.callPackage ../games/pokerth {
     target = "server";
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   pokete = callPackage ../games/pokete { };
@@ -39280,7 +39284,7 @@ with pkgs;
 
   or-tools = callPackage ../development/libraries/science/math/or-tools {
     python = python3;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
     # or-tools builds with -std=c++20, so abseil-cpp must
     # also be built that way
     abseil-cpp = abseil-cpp_202206.override {
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index bc35b206569..435687279c7 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -13,6 +13,11 @@ let
   # default.
   targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
                                         (stdenv.targetPlatform.config + "-");
+
+  # Bootstrap `fetchurl` needed to build SDK packages without causing an infinite recursion.
+  fetchurlBoot = import ../build-support/fetchurl/boot.nix {
+    inherit (stdenv) system;
+  };
 in
 
 makeScopeWithSplicing' {
@@ -32,10 +37,13 @@ makeScopeWithSplicing' {
   apple_sdk_10_12 = pkgs.callPackage ../os-specific/darwin/apple-sdk {
     inherit (buildPackages.darwin) print-reexports;
     inherit (self) darwin-stubs;
+    fetchurl = fetchurlBoot;
   };
 
   # macOS 11.0 SDK
-  apple_sdk_11_0 = pkgs.callPackage ../os-specific/darwin/apple-sdk-11.0 { };
+  apple_sdk_11_0 = pkgs.callPackage ../os-specific/darwin/apple-sdk-11.0 {
+    fetchurl = fetchurlBoot;
+  };
 
   # Pick an SDK
   apple_sdk = if stdenv.hostPlatform.isAarch64 then apple_sdk_11_0 else apple_sdk_10_12;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index d796fa7164d..28526297f5d 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -195,15 +195,9 @@ in {
 
     linux_testing_bcachefs = callPackage ../os-specific/linux/kernel/linux-testing-bcachefs.nix {
       # Pinned on the last version which Kent's commits can be cleany rebased up.
-      kernel = callPackage ../os-specific/linux/kernel/mainline.nix {
-        branch = "6.4";
-      };
-      kernelPatches = [
-        kernelPatches.bridge_stp_helper
-        kernelPatches.request_key_helper
-        kernelPatches.dell_xps_regression
-      ];
-    };
+      kernel = linux_6_5;
+      kernelPatches = linux_6_5.kernelPatches;
+   };
 
     # Using zenKernels like this due lqx&zen came from one source, but may have different base kernel version
     # https://github.com/NixOS/nixpkgs/pull/161773#discussion_r820134708
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 774ffab03a2..ef3b150cd88 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2480,10 +2480,10 @@ self: super: with self; {
   cython = callPackage ../development/python-modules/Cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.2";
+    version = "3.0.3";
     src = old.src.override {
       inherit version;
-      hash = "sha256-lZSBjcqLsirmWAxSItorxcwyM0NQvS0pSgDYZpvMYbU=";
+      hash = "sha256-MnMJMBsB9ynxc6lFEcsigMh7oDyJ7UKOiPkT93gkUDA=";
     };
     patches = [ ];
   });
@@ -6106,7 +6106,7 @@ self: super: with self; {
   };
 
   libarcus = callPackage ../development/python-modules/libarcus {
-    protobuf = pkgs.protobuf3_21;
+    protobuf = pkgs.protobuf_21;
   };
 
   libasyncns = callPackage ../development/python-modules/libasyncns {
@@ -9537,11 +9537,11 @@ self: super: with self; {
   # Protobuf 4.x
   protobuf = callPackage ../development/python-modules/protobuf {
     # If a protobuf upgrade causes many Python packages to fail, please pin it here to the previous version.
-    inherit (pkgs) protobuf;
+    protobuf = pkgs.protobuf;
   };
 
   # Protobuf 3.x
-  protobuf3 = callPackage ../development/python-modules/protobuf {
+  protobuf3 = callPackage ../development/python-modules/protobuf/3.nix {
     protobuf = pkgs.protobuf3_20;
   };