summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/workflows/basic-eval.yml2
-rw-r--r--.github/workflows/editorconfig.yml2
-rw-r--r--.github/workflows/manual-nixos.yml2
-rw-r--r--.github/workflows/manual-nixpkgs.yml2
-rw-r--r--.github/workflows/manual-rendering.yml2
-rw-r--r--.github/workflows/update-terraform-providers.yml2
-rw-r--r--doc/languages-frameworks/beam.section.md1
-rw-r--r--maintainers/maintainer-list.nix77
-rw-r--r--maintainers/team-list.nix13
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md4
-rw-r--r--nixos/modules/services/databases/clickhouse.nix2
-rw-r--r--nixos/modules/services/matrix/appservice-discord.nix16
-rw-r--r--nixos/modules/services/misc/moonraker.nix49
-rw-r--r--nixos/modules/services/x11/desktop-managers/plasma5.nix3
-rw-r--r--nixos/modules/system/boot/systemd/initrd.nix2
-rw-r--r--nixos/modules/virtualisation/podman/default.nix13
-rw-r--r--nixos/tests/k3s/default.nix8
-rw-r--r--nixos/tests/k3s/multi-node.nix6
-rw-r--r--nixos/tests/k3s/single-node.nix6
-rw-r--r--nixos/tests/predictable-interface-names.nix2
-rw-r--r--nixos/tests/systemd-cryptenroll.nix1
-rw-r--r--pkgs/applications/audio/aether-lv2/default.nix6
-rw-r--r--pkgs/applications/audio/bespokesynth/default.nix4
-rw-r--r--pkgs/applications/audio/calf/default.nix2
-rw-r--r--pkgs/applications/audio/espeak/default.nix4
-rw-r--r--pkgs/applications/audio/furnace/default.nix6
-rw-r--r--pkgs/applications/audio/helvum/default.nix9
-rw-r--r--pkgs/applications/audio/jack-rack/default.nix2
-rw-r--r--pkgs/applications/audio/jamin/default.nix2
-rw-r--r--pkgs/applications/audio/lsp-plugins/default.nix22
-rw-r--r--pkgs/applications/audio/mimic/default.nix5
-rw-r--r--pkgs/applications/audio/mpg123/default.nix4
-rw-r--r--pkgs/applications/audio/musly/default.nix4
-rw-r--r--pkgs/applications/audio/odin2/default.nix5
-rw-r--r--pkgs/applications/audio/opusfile/default.nix11
-rw-r--r--pkgs/applications/audio/sonixd/default.nix14
-rw-r--r--pkgs/applications/audio/spotify/default.nix4
-rw-r--r--pkgs/applications/audio/stochas/default.nix5
-rw-r--r--pkgs/applications/blockchains/torq/default.nix13
-rw-r--r--pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix4
-rw-r--r--pkgs/applications/editors/cudatext/default.nix4
-rw-r--r--pkgs/applications/editors/cudatext/deps.json4
-rw-r--r--pkgs/applications/editors/ed/default.nix4
-rw-r--r--pkgs/applications/editors/poke/default.nix8
-rw-r--r--pkgs/applications/editors/texmacs/common.nix16
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix780
-rw-r--r--pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix149
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix6
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names1
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-utils.nix6
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix20
-rw-r--r--pkgs/applications/emulators/dolphin-emu/default.nix238
-rw-r--r--pkgs/applications/emulators/dolphin-emu/master.nix196
-rw-r--r--pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch18
-rw-r--r--pkgs/applications/emulators/mame/default.nix4
-rw-r--r--pkgs/applications/emulators/rpcs3/default.nix4
-rw-r--r--pkgs/applications/file-managers/vifm/default.nix4
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/graphics/foxotron/default.nix5
-rw-r--r--pkgs/applications/graphics/gimp/plugins/default.nix10
-rw-r--r--pkgs/applications/graphics/goxel/default.nix6
-rw-r--r--pkgs/applications/graphics/gthumb/default.nix13
-rw-r--r--pkgs/applications/graphics/hdrmerge/default.nix5
-rw-r--r--pkgs/applications/graphics/jpegoptim/default.nix4
-rw-r--r--pkgs/applications/graphics/krita/default.nix4
-rw-r--r--pkgs/applications/graphics/paraview/default.nix4
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--pkgs/applications/misc/darkman/default.nix6
-rw-r--r--pkgs/applications/misc/ikiwiki/default.nix5
-rw-r--r--pkgs/applications/misc/lyx/default.nix6
-rw-r--r--pkgs/applications/misc/maliit-framework/default.nix8
-rw-r--r--pkgs/applications/misc/mysql-workbench/default.nix7
-rw-r--r--pkgs/applications/misc/regextester/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.json18
-rw-r--r--pkgs/applications/networking/browsers/firefox-bin/update.nix2
-rw-r--r--pkgs/applications/networking/browsers/google-chrome/default.nix2
-rw-r--r--pkgs/applications/networking/circumflex/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/k3s/1_23/default.nix3
-rw-r--r--pkgs/applications/networking/cluster/k3s/1_24/default.nix3
-rw-r--r--pkgs/applications/networking/cluster/k3s/1_25/default.nix3
-rw-r--r--pkgs/applications/networking/cluster/k3s/1_26/default.nix9
-rw-r--r--pkgs/applications/networking/cluster/kluctl/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/linkerd/edge.nix6
-rw-r--r--pkgs/applications/networking/cluster/pluto/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json16
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/client.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common156
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux18
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x8610
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches7
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/daemon.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/default.nix30
-rw-r--r--pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch24
-rw-r--r--pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch24
-rw-r--r--pkgs/applications/networking/instant-messengers/signald/default.nix43
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix10
-rw-r--r--pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/evolution/evolution/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/mutt/default.nix2
-rw-r--r--pkgs/applications/networking/pcloud/default.nix6
-rw-r--r--pkgs/applications/networking/syncthing/default.nix4
-rw-r--r--pkgs/applications/office/gnucash/default.nix5
-rw-r--r--pkgs/applications/office/paperwork/paperwork-shell.nix2
-rw-r--r--pkgs/applications/office/paperwork/src.nix4
-rw-r--r--pkgs/applications/plasma-mobile/angelfish.nix4
-rw-r--r--pkgs/applications/plasma-mobile/audiotube.nix4
-rw-r--r--pkgs/applications/plasma-mobile/neochat.nix4
-rw-r--r--pkgs/applications/plasma-mobile/spacebar.nix6
-rw-r--r--pkgs/applications/radio/qdmr/default.nix4
-rw-r--r--pkgs/applications/science/biology/inormalize/default.nix2
-rw-r--r--pkgs/applications/science/biology/last/default.nix4
-rw-r--r--pkgs/applications/science/biology/minc-widgets/default.nix3
-rw-r--r--pkgs/applications/science/biology/octopus/default.nix5
-rw-r--r--pkgs/applications/science/biology/plink-ng/default.nix2
-rw-r--r--pkgs/applications/science/chemistry/jmol/default.nix4
-rw-r--r--pkgs/applications/science/chemistry/octopus/default.nix8
-rw-r--r--pkgs/applications/science/electronics/kicad/base.nix5
-rw-r--r--pkgs/applications/science/electronics/kicad/default.nix2
-rw-r--r--pkgs/applications/science/logic/cbmc/default.nix10
-rw-r--r--pkgs/applications/science/logic/coq/default.nix12
-rw-r--r--pkgs/applications/science/math/R/default.nix12
-rw-r--r--pkgs/applications/science/math/gap/default.nix2
-rw-r--r--pkgs/applications/science/math/mxnet/default.nix6
-rw-r--r--pkgs/applications/science/math/pari/default.nix10
-rw-r--r--pkgs/applications/science/math/sage/README.md40
-rw-r--r--pkgs/applications/science/math/sage/env-locations.nix3
-rw-r--r--pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch26
-rw-r--r--pkgs/applications/science/math/sage/sage-src.nix74
-rw-r--r--pkgs/applications/science/math/sage/sage-tests.nix2
-rw-r--r--pkgs/applications/science/misc/openmodelica/mkderivation/default.nix2
-rw-r--r--pkgs/applications/science/physics/nnpdf/default.nix12
-rw-r--r--pkgs/applications/version-management/commitizen/default.nix4
-rw-r--r--pkgs/applications/version-management/fnc/default.nix5
-rw-r--r--pkgs/applications/version-management/git-credential-keepassxc/default.nix6
-rw-r--r--pkgs/applications/version-management/git-trim/default.nix27
-rw-r--r--pkgs/applications/version-management/radicle-cli/default.nix12
-rw-r--r--pkgs/applications/version-management/sapling/Cargo.lock557
-rw-r--r--pkgs/applications/version-management/sapling/default.nix13
-rw-r--r--pkgs/applications/version-management/sapling/deps.json4
-rw-r--r--pkgs/applications/video/haruna/default.nix4
-rw-r--r--pkgs/applications/video/jellyfin-media-player/default.nix4
-rw-r--r--pkgs/applications/video/jellyfin-mpv-shim/default.nix4
-rw-r--r--pkgs/applications/video/mirakurun/default.nix3
-rw-r--r--pkgs/applications/video/openshot-qt/libopenshot.nix7
-rw-r--r--pkgs/applications/virtualization/podman/default.nix78
-rw-r--r--pkgs/applications/virtualization/podman/wrapper.nix78
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix11
-rw-r--r--pkgs/applications/virtualization/singularity/packages.nix6
-rw-r--r--pkgs/applications/window-managers/cardboard/default.nix4
-rw-r--r--pkgs/applications/window-managers/dwl/default.nix4
-rw-r--r--pkgs/applications/window-managers/sway/default.nix4
-rw-r--r--pkgs/build-support/alternatives/blas/default.nix8
-rw-r--r--pkgs/build-support/alternatives/lapack/default.nix8
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix5
-rw-r--r--pkgs/build-support/build-bazel-package/default.nix6
-rw-r--r--pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix2
-rw-r--r--pkgs/build-support/build-fhs-userenv/env.nix4
-rw-r--r--pkgs/build-support/build-graalvm-native-image/default.nix8
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix11
-rw-r--r--pkgs/build-support/fetchdocker/credentials.nix2
-rw-r--r--pkgs/build-support/fetchfossil/default.nix4
-rw-r--r--pkgs/build-support/fetchgit/default.nix4
-rw-r--r--pkgs/build-support/fetchhg/default.nix4
-rw-r--r--pkgs/build-support/fetchpatch/default.nix2
-rw-r--r--pkgs/build-support/libredirect/default.nix6
-rw-r--r--pkgs/build-support/libredirect/libredirect.c50
-rw-r--r--pkgs/build-support/libredirect/test.c20
-rw-r--r--pkgs/build-support/nuke-references/default.nix2
-rw-r--r--pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh2
-rw-r--r--pkgs/build-support/release/binary-tarball.nix4
-rw-r--r--pkgs/build-support/release/debian-build.nix2
-rw-r--r--pkgs/build-support/release/default.nix4
-rw-r--r--pkgs/build-support/release/maven-build.nix6
-rw-r--r--pkgs/build-support/release/nix-build.nix4
-rw-r--r--pkgs/build-support/release/rpm-build.nix4
-rw-r--r--pkgs/build-support/rust/build-rust-crate/default.nix2
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix2
-rw-r--r--pkgs/build-support/rust/fetch-cargo-tarball/default.nix3
-rw-r--r--pkgs/build-support/setup-hooks/make-symlinks-relative.sh11
-rw-r--r--pkgs/build-support/vm/default.nix18
-rw-r--r--pkgs/data/fonts/freefont-ttf/default.nix22
-rw-r--r--pkgs/data/fonts/iosevka/bin.nix2
-rw-r--r--pkgs/data/fonts/iosevka/variants.nix184
-rw-r--r--pkgs/data/fonts/julia-mono/default.nix4
-rw-r--r--pkgs/data/icons/capitaine-cursors-themed/default.nix20
-rw-r--r--pkgs/data/misc/cldr-annotations/default.nix23
-rw-r--r--pkgs/data/misc/papirus-folders/default.nix4
-rw-r--r--pkgs/data/misc/publicsuffix-list/default.nix32
-rw-r--r--pkgs/data/misc/unicode-emoji/default.nix37
-rw-r--r--pkgs/data/themes/whitesur/default.nix8
-rw-r--r--pkgs/desktops/gnome/apps/seahorse/default.nix9
-rw-r--r--pkgs/desktops/gnome/core/evolution-data-server/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch2
-rw-r--r--pkgs/desktops/gnome/core/gnome-contacts/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-software/default.nix4
-rw-r--r--pkgs/desktops/lxqt/lxqt-config/default.nix12
-rw-r--r--pkgs/desktops/plasma-5/default.nix11
-rw-r--r--pkgs/desktops/plasma-5/fetch.sh2
-rw-r--r--pkgs/desktops/plasma-5/flatpak-kcm.nix18
-rw-r--r--pkgs/desktops/plasma-5/kinfocenter/default.nix2
-rw-r--r--pkgs/desktops/plasma-5/kscreenlocker.nix2
-rw-r--r--pkgs/desktops/plasma-5/kwin/0001-Revert-x11-Refactor-output-updates.patch153
-rw-r--r--pkgs/desktops/plasma-5/kwin/0003-plugins-qpa-allow-using-nixos-wrapper.patch2
-rw-r--r--pkgs/desktops/plasma-5/kwin/default.nix10
-rw-r--r--pkgs/desktops/plasma-5/libkscreen/libkscreen-backends-path.patch20
-rw-r--r--pkgs/desktops/plasma-5/plasma-remotecontrollers.nix2
-rw-r--r--pkgs/desktops/plasma-5/plasma-welcome.nix44
-rw-r--r--pkgs/desktops/plasma-5/srcs.nix480
-rw-r--r--pkgs/desktops/rox/rox-filer/default.nix2
-rw-r--r--pkgs/development/beam-modules/fetch-mix-deps.nix2
-rw-r--r--pkgs/development/compilers/dmd/generic.nix7
-rw-r--r--pkgs/development/compilers/gcc/10/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix16
-rw-r--r--pkgs/development/compilers/gcc/11/gcc-issue-103910.patch41
-rw-r--r--pkgs/development/compilers/gcc/12/default.nix9
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/8/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/builder.sh11
-rw-r--r--pkgs/development/compilers/gnu-cim/default.nix45
-rw-r--r--pkgs/development/compilers/go/1.18.nix11
-rw-r--r--pkgs/development/compilers/go/1.19.nix11
-rw-r--r--pkgs/development/compilers/go/1.20.nix4
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix148
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix73
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/default.nix103
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json42
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json42
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/hashes.nix71
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/mkGraal.nix346
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix58
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/update.nix227
-rwxr-xr-xpkgs/development/compilers/graalvm/community-edition/update.sh86
-rw-r--r--pkgs/development/compilers/jetbrains-jdk/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/10/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/11/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/11/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/12/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/12/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/13/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/13/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/14/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/14/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/15/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/6/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/7/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/7/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/8/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/8/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/9/bintools/default.nix7
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/git/bintools/default.nix5
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/mit-scheme/default.nix6
-rw-r--r--pkgs/development/compilers/rust/1_66.nix64
-rw-r--r--pkgs/development/compilers/rust/1_67.nix81
-rw-r--r--pkgs/development/compilers/rust/cargo.nix13
-rw-r--r--pkgs/development/compilers/rust/rustc.nix1
-rw-r--r--pkgs/development/compilers/sbcl/2.x.nix2
-rw-r--r--pkgs/development/compilers/solc/default.nix2
-rw-r--r--pkgs/development/compilers/swift/wrapper/default.nix3
-rw-r--r--pkgs/development/compilers/tinycc/default.nix1
-rw-r--r--pkgs/development/compilers/urweb/default.nix5
-rw-r--r--pkgs/development/compilers/zig/0.10.nix1
-rw-r--r--pkgs/development/haskell-modules/make-package-set.nix2
-rw-r--r--pkgs/development/haskell-modules/package-list.nix5
-rw-r--r--pkgs/development/interpreters/clojure/default.nix4
-rw-r--r--pkgs/development/interpreters/dhall/generate-dhall-directory-package.nix2
-rw-r--r--pkgs/development/interpreters/gnu-apl/default.nix4
-rw-r--r--pkgs/development/interpreters/octave/default.nix2
-rw-r--r--pkgs/development/interpreters/python/pypy/default.nix2
-rw-r--r--pkgs/development/interpreters/python/pypy/prebuilt.nix2
-rw-r--r--pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix2
-rw-r--r--pkgs/development/interpreters/renpy/default.nix2
-rw-r--r--pkgs/development/interpreters/ruby/default.nix8
-rw-r--r--pkgs/development/interpreters/ruby/patchsets.nix18
-rw-r--r--pkgs/development/interpreters/ruby/ruby-version.nix6
-rw-r--r--pkgs/development/interpreters/ruby/rvm-patchsets.nix4
-rw-r--r--pkgs/development/interpreters/tcl/tcl-package-hook.sh2
-rw-r--r--pkgs/development/libraries/StormLib/default.nix14
-rw-r--r--pkgs/development/libraries/applet-window-buttons/default.nix9
-rw-r--r--pkgs/development/libraries/arrow-cpp/default.nix83
-rw-r--r--pkgs/development/libraries/assimp/default.nix5
-rw-r--r--pkgs/development/libraries/belle-sip/default.nix5
-rw-r--r--pkgs/development/libraries/boringssl/default.nix5
-rw-r--r--pkgs/development/libraries/botan/generic.nix2
-rw-r--r--pkgs/development/libraries/bzrtp/default.nix5
-rw-r--r--pkgs/development/libraries/clucene-core/2.x.nix13
-rw-r--r--pkgs/development/libraries/clucene-core/fix-missing-include-time.patch49
-rw-r--r--pkgs/development/libraries/cosmopolitan/default.nix7
-rw-r--r--pkgs/development/libraries/cpp-ipfs-http-client/default.nix2
-rw-r--r--pkgs/development/libraries/dbus-cplusplus/default.nix6
-rw-r--r--pkgs/development/libraries/eccodes/default.nix1
-rw-r--r--pkgs/development/libraries/example-robot-data/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg-full/default.nix511
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix10
-rw-r--r--pkgs/development/libraries/ffmpeg/5.nix9
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix804
-rw-r--r--pkgs/development/libraries/fizz/default.nix4
-rw-r--r--pkgs/development/libraries/galario/default.nix2
-rw-r--r--pkgs/development/libraries/gegl/default.nix9
-rw-r--r--pkgs/development/libraries/gettext/default.nix2
-rw-r--r--pkgs/development/libraries/glibc/common.nix2
-rw-r--r--pkgs/development/libraries/gloox/default.nix7
-rw-r--r--pkgs/development/libraries/gsl/default.nix6
-rw-r--r--pkgs/development/libraries/gsmlib/default.nix8
-rw-r--r--pkgs/development/libraries/gtest/default.nix16
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix1
-rw-r--r--pkgs/development/libraries/hidapi/default.nix15
-rw-r--r--pkgs/development/libraries/hunspell/default.nix4
-rw-r--r--pkgs/development/libraries/icu/63.nix6
-rw-r--r--pkgs/development/libraries/icu/base.nix10
-rw-r--r--pkgs/development/libraries/imlib2/default.nix10
-rw-r--r--pkgs/development/libraries/iqueue/default.nix6
-rw-r--r--pkgs/development/libraries/kerberos/krb5.nix5
-rw-r--r--pkgs/development/libraries/kuserfeedback/default.nix23
-rw-r--r--pkgs/development/libraries/lame/default.nix2
-rw-r--r--pkgs/development/libraries/libassuan/default.nix1
-rw-r--r--pkgs/development/libraries/libb2/default.nix10
-rw-r--r--pkgs/development/libraries/libbladeRF/default.nix5
-rw-r--r--pkgs/development/libraries/libcamera/default.nix2
-rw-r--r--pkgs/development/libraries/libcbor/default.nix23
-rw-r--r--pkgs/development/libraries/libcli/default.nix5
-rw-r--r--pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch2
-rw-r--r--pkgs/development/libraries/libdatrie/default.nix2
-rw-r--r--pkgs/development/libraries/libde265/default.nix14
-rw-r--r--pkgs/development/libraries/libdynd/default.nix5
-rw-r--r--pkgs/development/libraries/libepoxy/default.nix4
-rw-r--r--pkgs/development/libraries/libfaketime/default.nix12
-rw-r--r--pkgs/development/libraries/libfaketime/nix-store-date.patch4
-rw-r--r--pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch12
-rw-r--r--pkgs/development/libraries/libglvnd/default.nix4
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix9
-rw-r--r--pkgs/development/libraries/libpsl/default.nix4
-rw-r--r--pkgs/development/libraries/libraw/default.nix10
-rw-r--r--pkgs/development/libraries/libraw/unstable.nix12
-rw-r--r--pkgs/development/libraries/libssh/default.nix4
-rw-r--r--pkgs/development/libraries/libtiff/default.nix6
-rw-r--r--pkgs/development/libraries/libubox/default.nix12
-rw-r--r--pkgs/development/libraries/libunistring/default.nix3
-rw-r--r--pkgs/development/libraries/liburing/default.nix4
-rw-r--r--pkgs/development/libraries/libuv/default.nix17
-rw-r--r--pkgs/development/libraries/libvirt/default.nix2
-rw-r--r--pkgs/development/libraries/libvisual/default.nix16
-rw-r--r--pkgs/development/libraries/libvpx/1_8.nix2
-rw-r--r--pkgs/development/libraries/libvpx/default.nix2
-rw-r--r--pkgs/development/libraries/libvterm-neovim/default.nix4
-rw-r--r--pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix5
-rw-r--r--pkgs/development/libraries/maplibre-gl-native/default.nix6
-rw-r--r--pkgs/development/libraries/mesa/default.nix10
-rw-r--r--pkgs/development/libraries/newt/default.nix4
-rw-r--r--pkgs/development/libraries/nss_wrapper/default.nix4
-rw-r--r--pkgs/development/libraries/octomap/default.nix6
-rw-r--r--pkgs/development/libraries/openbabel/2.nix4
-rw-r--r--pkgs/development/libraries/openbabel/default.nix4
-rw-r--r--pkgs/development/libraries/opencv/4.x.nix63
-rw-r--r--pkgs/development/libraries/opencv/tests.nix70
-rw-r--r--pkgs/development/libraries/opendbx/default.nix5
-rw-r--r--pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch36
-rw-r--r--pkgs/development/libraries/openssl/default.nix25
-rw-r--r--pkgs/development/libraries/physics/applgrid/default.nix4
-rw-r--r--pkgs/development/libraries/physics/clhep/default.nix4
-rw-r--r--pkgs/development/libraries/pico-sdk/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/default.nix9
-rw-r--r--pkgs/development/libraries/qcoro/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix6
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix4
-rw-r--r--pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix4
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix12
-rw-r--r--pkgs/development/libraries/rocm-device-libs/default.nix2
-rw-r--r--pkgs/development/libraries/roctracer/default.nix5
-rw-r--r--pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix2
-rw-r--r--pkgs/development/libraries/science/math/amd-blis/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/liblapack/default.nix14
-rw-r--r--pkgs/development/libraries/science/math/p4est-sc/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/p4est/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/petsc/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/sympow/default.nix10
-rw-r--r--pkgs/development/libraries/swiftshader/default.nix6
-rw-r--r--pkgs/development/libraries/tbb/default.nix2
-rw-r--r--pkgs/development/libraries/thrift/default.nix12
-rw-r--r--pkgs/development/libraries/udns/default.nix12
-rw-r--r--pkgs/development/libraries/unittest-cpp/default.nix15
-rw-r--r--pkgs/development/libraries/uri/default.nix7
-rw-r--r--pkgs/development/libraries/v8/default.nix1
-rw-r--r--pkgs/development/libraries/webkitgtk/default.nix8
-rw-r--r--pkgs/development/libraries/wildmidi/default.nix4
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK32.nix4
-rw-r--r--pkgs/development/libraries/xgboost/default.nix117
-rw-r--r--pkgs/development/misc/brev-cli/default.nix4
-rw-r--r--pkgs/development/mobile/titaniumenv/build-app.nix3
-rw-r--r--pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix5
-rw-r--r--pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix5
-rw-r--r--pkgs/development/mobile/xcodeenv/build-app.nix2
-rw-r--r--pkgs/development/node-packages/overrides.nix6
-rw-r--r--pkgs/development/python-modules/Cython/default.nix11
-rw-r--r--pkgs/development/python-modules/Cython/trashcan.patch354
-rw-r--r--pkgs/development/python-modules/aio-geojson-generic-client/default.nix2
-rw-r--r--pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix7
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/airthings-ble/default.nix1
-rw-r--r--pkgs/development/python-modules/ansible-doctor/default.nix4
-rw-r--r--pkgs/development/python-modules/asana/default.nix4
-rw-r--r--pkgs/development/python-modules/asf-search/default.nix38
-rw-r--r--pkgs/development/python-modules/atc-ble/default.nix13
-rw-r--r--pkgs/development/python-modules/awswrangler/default.nix88
-rw-r--r--pkgs/development/python-modules/btrees/default.nix4
-rw-r--r--pkgs/development/python-modules/build/default.nix2
-rw-r--r--pkgs/development/python-modules/bundlewrap/default.nix2
-rw-r--r--pkgs/development/python-modules/certomancer/default.nix8
-rw-r--r--pkgs/development/python-modules/chart-studio/default.nix4
-rw-r--r--pkgs/development/python-modules/clustershell/default.nix4
-rw-r--r--pkgs/development/python-modules/coconut/default.nix4
-rw-r--r--pkgs/development/python-modules/collections-extended/default.nix4
-rw-r--r--pkgs/development/python-modules/cot/default.nix4
-rw-r--r--pkgs/development/python-modules/cvxopt/default.nix12
-rw-r--r--pkgs/development/python-modules/dask/default.nix6
-rw-r--r--pkgs/development/python-modules/datafusion/Cargo.lock.patch78
-rw-r--r--pkgs/development/python-modules/datafusion/default.nix61
-rw-r--r--pkgs/development/python-modules/django/3.nix4
-rw-r--r--pkgs/development/python-modules/drf-yasg/default.nix4
-rw-r--r--pkgs/development/python-modules/fiona/default.nix60
-rw-r--r--pkgs/development/python-modules/fpylll/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-container/default.nix4
-rw-r--r--pkgs/development/python-modules/h5py/default.nix2
-rw-r--r--pkgs/development/python-modules/hahomematic/default.nix4
-rw-r--r--pkgs/development/python-modules/hangups/default.nix70
-rw-r--r--pkgs/development/python-modules/hatch-requirements-txt/default.nix3
-rw-r--r--pkgs/development/python-modules/hist/default.nix45
-rw-r--r--pkgs/development/python-modules/histoprint/default.nix45
-rw-r--r--pkgs/development/python-modules/holoviews/default.nix4
-rw-r--r--pkgs/development/python-modules/home-assistant-bluetooth/default.nix4
-rw-r--r--pkgs/development/python-modules/ibeacon-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/ibis-framework/default.nix34
-rw-r--r--pkgs/development/python-modules/identify/default.nix4
-rw-r--r--pkgs/development/python-modules/iminuit/default.nix4
-rw-r--r--pkgs/development/python-modules/inkbird-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/inquirer/default.nix17
-rw-r--r--pkgs/development/python-modules/kegtron-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/led-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/lightning/default.nix30
-rw-r--r--pkgs/development/python-modules/limnoria/default.nix4
-rw-r--r--pkgs/development/python-modules/mediapy/default.nix2
-rw-r--r--pkgs/development/python-modules/moat-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/mox3/default.nix3
-rw-r--r--pkgs/development/python-modules/n3fit/default.nix50
-rw-r--r--pkgs/development/python-modules/nipy/default.nix6
-rw-r--r--pkgs/development/python-modules/onnx/default.nix70
-rw-r--r--pkgs/development/python-modules/optuna/default.nix4
-rw-r--r--pkgs/development/python-modules/oralb-ble/default.nix4
-rw-r--r--pkgs/development/python-modules/oslo-log/default.nix4
-rw-r--r--pkgs/development/python-modules/patool/default.nix15
-rw-r--r--pkgs/development/python-modules/pc-ble-driver-py/default.nix7
-rw-r--r--pkgs/development/python-modules/pefile/default.nix7
-rw-r--r--pkgs/development/python-modules/primer3/default.nix6
-rw-r--r--pkgs/development/python-modules/pyarrow/default.nix50
-rw-r--r--pkgs/development/python-modules/pyls-black/default.nix34
-rw-r--r--pkgs/development/python-modules/pyoutbreaksnearme/default.nix (renamed from pkgs/development/python-modules/pyflunearyou/default.nix)28
-rw-r--r--pkgs/development/python-modules/pyoverkiz/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-httpserver/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest-rerunfailures/default.nix26
-rw-r--r--pkgs/development/python-modules/python-magic/default.nix6
-rw-r--r--pkgs/development/python-modules/python-mpv-jsonipc/default.nix4
-rw-r--r--pkgs/development/python-modules/python-utils/default.nix10
-rw-r--r--pkgs/development/python-modules/pytz/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvo/default.nix9
-rw-r--r--pkgs/development/python-modules/pyweatherflowrest/default.nix7
-rw-r--r--pkgs/development/python-modules/qingping-ble/default.nix3
-rw-r--r--pkgs/development/python-modules/quantiphy/default.nix4
-rw-r--r--pkgs/development/python-modules/raincloudy/default.nix35
-rw-r--r--pkgs/development/python-modules/rapt-ble/default.nix58
-rw-r--r--pkgs/development/python-modules/remotezip/default.nix47
-rw-r--r--pkgs/development/python-modules/scipy/default.nix2
-rw-r--r--pkgs/development/python-modules/sensorpro-ble/default.nix12
-rw-r--r--pkgs/development/python-modules/sqlglot/default.nix10
-rw-r--r--pkgs/development/python-modules/tensorflow/default.nix2
-rw-r--r--pkgs/development/python-modules/thermopro-ble/default.nix1
-rw-r--r--pkgs/development/python-modules/torch/default.nix15
-rw-r--r--pkgs/development/python-modules/types-protobuf/default.nix4
-rw-r--r--pkgs/development/python-modules/uhi/default.nix39
-rw-r--r--pkgs/development/python-modules/validobj/default.nix4
-rw-r--r--pkgs/development/python-modules/validphys2/default.nix2
-rw-r--r--pkgs/development/python-modules/versioningit/default.nix4
-rw-r--r--pkgs/development/python-modules/vowpalwabbit/default.nix4
-rw-r--r--pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch15
-rw-r--r--pkgs/development/python-modules/wheel/default.nix4
-rw-r--r--pkgs/development/python-modules/xiaomi-ble/default.nix4
-rw-r--r--pkgs/development/python-modules/yalexs-ble/default.nix4
-rw-r--r--pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch37
-rw-r--r--pkgs/development/python2-modules/wheel/default.nix57
-rw-r--r--pkgs/development/ruby-modules/bundled-common/default.nix5
-rw-r--r--pkgs/development/tools/analysis/rr/default.nix1
-rw-r--r--pkgs/development/tools/analysis/tflint/default.nix6
-rw-r--r--pkgs/development/tools/analysis/valgrind/default.nix6
-rw-r--r--pkgs/development/tools/bbin/default.nix2
-rw-r--r--pkgs/development/tools/bpf-linker/default.nix10
-rw-r--r--pkgs/development/tools/build-managers/bear/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/cmake/002-application-services.diff36
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix47
-rw-r--r--pkgs/development/tools/build-managers/meson/disable-bitcode.patch24
-rw-r--r--pkgs/development/tools/build-managers/waf/default.nix4
-rw-r--r--pkgs/development/tools/coder/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/fly/default.nix6
-rw-r--r--pkgs/development/tools/cosmoc/default.nix41
-rw-r--r--pkgs/development/tools/cosmocc/default.nix35
-rw-r--r--pkgs/development/tools/esbuild/default.nix4
-rw-r--r--pkgs/development/tools/gci/default.nix6
-rw-r--r--pkgs/development/tools/glslviewer/default.nix4
-rw-r--r--pkgs/development/tools/jbang/default.nix4
-rw-r--r--pkgs/development/tools/konstraint/default.nix6
-rw-r--r--pkgs/development/tools/kustomize/kustomize-sops.nix6
-rw-r--r--pkgs/development/tools/language-servers/lua-language-server/default.nix5
-rw-r--r--pkgs/development/tools/lightningcss/default.nix6
-rw-r--r--pkgs/development/tools/misc/binutils/build-components-separately.patch155
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix46
-rw-r--r--pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch71
-rw-r--r--pkgs/development/tools/misc/binutils/libbfd.nix47
-rw-r--r--pkgs/development/tools/misc/binutils/libopcodes.nix42
-rw-r--r--pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch25
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix6
-rw-r--r--pkgs/development/tools/misc/dejagnu/default.nix7
-rw-r--r--pkgs/development/tools/misc/distcc/default.nix8
-rw-r--r--pkgs/development/tools/misc/edb/default.nix2
-rw-r--r--pkgs/development/tools/misc/gperf/default.nix2
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix23
-rw-r--r--pkgs/development/tools/misc/lsof/default.nix4
-rw-r--r--pkgs/development/tools/misc/lsof/no-build-info.patch20
-rw-r--r--pkgs/development/tools/misc/pahole/default.nix9
-rw-r--r--pkgs/development/tools/misc/saleae-logic-2/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/ocaml-top/default.nix9
-rw-r--r--pkgs/development/tools/oh-my-posh/default.nix6
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/default.nix2
-rw-r--r--pkgs/development/tools/picotool/default.nix10
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/lib.nix2
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix6
-rw-r--r--pkgs/development/tools/profiling/systemtap/default.nix1
-rw-r--r--pkgs/development/tools/rust/cargo-semver-checks/default.nix8
-rw-r--r--pkgs/development/tools/squawk/correct-Cargo.lock.patch13
-rw-r--r--pkgs/development/tools/squawk/default.nix67
-rw-r--r--pkgs/development/tools/squawk/fix-postgresql-version-in-snapshot-test.patch13
-rw-r--r--pkgs/development/tools/wgo/default.nix27
-rw-r--r--pkgs/development/tools/wlcs/default.nix5
-rw-r--r--pkgs/development/web/nodejs/v18.nix2
-rw-r--r--pkgs/games/cataclysm-dda/stable.nix5
-rw-r--r--pkgs/games/cdogs-sdl/default.nix5
-rw-r--r--pkgs/games/eboard/default.nix1
-rw-r--r--pkgs/games/factorio/default.nix2
-rw-r--r--pkgs/games/gimx/default.nix8
-rw-r--r--pkgs/games/liquidwar/default.nix10
-rw-r--r--pkgs/games/oilrush/default.nix3
-rw-r--r--pkgs/games/openmw/default.nix4
-rw-r--r--pkgs/games/openrct2/default.nix5
-rw-r--r--pkgs/games/sgt-puzzles/default.nix2
-rw-r--r--pkgs/games/stepmania/default.nix4
-rw-r--r--pkgs/games/supertux/default.nix4
-rw-r--r--pkgs/games/zod/default.nix7
-rw-r--r--pkgs/misc/cups/drivers/samsung/4.01.17.nix2
-rw-r--r--pkgs/misc/jackaudio/default.nix9
-rw-r--r--pkgs/misc/jackaudio/jack1.nix11
-rw-r--r--pkgs/misc/source-and-tags/default.nix2
-rw-r--r--pkgs/misc/uboot/default.nix10
-rw-r--r--pkgs/os-specific/darwin/xcode/default.nix63
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix4
-rw-r--r--pkgs/os-specific/linux/anbox/default.nix5
-rw-r--r--pkgs/os-specific/linux/bbswitch/default.nix1
-rw-r--r--pkgs/os-specific/linux/dracut/default.nix18
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/default.nix5
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipset/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix8
-rw-r--r--pkgs/os-specific/linux/musl/default.nix3
-rw-r--r--pkgs/os-specific/linux/mxu11x0/default.nix4
-rw-r--r--pkgs/os-specific/linux/ocf-resource-agents/default.nix5
-rw-r--r--pkgs/os-specific/linux/odp-dpdk/default.nix7
-rw-r--r--pkgs/os-specific/linux/pcmciautils/default.nix4
-rw-r--r--pkgs/os-specific/linux/pktgen/default.nix6
-rw-r--r--pkgs/os-specific/linux/projecteur/default.nix4
-rw-r--r--pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix5
-rw-r--r--pkgs/os-specific/linux/rtl8189es/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl8723ds/default.nix4
-rw-r--r--pkgs/os-specific/linux/rtl8812au/default.nix5
-rw-r--r--pkgs/os-specific/linux/rtl8814au/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl8821au/default.nix5
-rw-r--r--pkgs/os-specific/linux/rtl8821ce/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl8821cu/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl88x2bu/default.nix1
-rw-r--r--pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix3
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix4
-rw-r--r--pkgs/os-specific/linux/vmware/default.nix2
-rw-r--r--pkgs/os-specific/windows/wxMSW-2.8/default.nix2
-rw-r--r--pkgs/servers/computing/storm/default.nix2
-rw-r--r--pkgs/servers/foundationdb/cmake.nix5
-rw-r--r--pkgs/servers/gemini/molly-brown/default.nix17
-rw-r--r--pkgs/servers/gemini/molly-brown/deps.nix12
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix2
-rw-r--r--pkgs/servers/home-assistant/default.nix4
-rw-r--r--pkgs/servers/http/nginx/modules.nix4
-rw-r--r--pkgs/servers/libreddit/default.nix6
-rw-r--r--pkgs/servers/mail/exim/default.nix4
-rw-r--r--pkgs/servers/mail/vsmtp/default.nix6
-rw-r--r--pkgs/servers/matrix-synapse/default.nix6
-rw-r--r--pkgs/servers/monitoring/nagios/default.nix1
-rw-r--r--pkgs/servers/monitoring/prometheus/artifactory-exporter.nix4
-rw-r--r--pkgs/servers/monitoring/uptime-kuma/default.nix6
-rw-r--r--pkgs/servers/moonraker/default.nix6
-rw-r--r--pkgs/servers/nosql/ferretdb/default.nix6
-rw-r--r--pkgs/servers/nosql/influxdb/default.nix2
-rw-r--r--pkgs/servers/nosql/influxdb2/default.nix2
-rw-r--r--pkgs/servers/openafs/1.8/default.nix1
-rw-r--r--pkgs/servers/osrm-backend/default.nix6
-rw-r--r--pkgs/servers/pounce/default.nix4
-rw-r--r--pkgs/servers/pulseaudio/default.nix2
-rw-r--r--pkgs/servers/roapi/http.nix2
-rw-r--r--pkgs/servers/sql/postgresql/default.nix20
-rw-r--r--pkgs/servers/tvheadend/default.nix3
-rw-r--r--pkgs/servers/web-apps/wordpress/packages/thirdparty.nix6
-rw-r--r--pkgs/servers/x11/xorg/default.nix38
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix12
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list10
-rw-r--r--pkgs/shells/bash/5.nix11
-rw-r--r--pkgs/shells/hilbish/default.nix6
-rw-r--r--pkgs/stdenv/darwin/default.nix1
-rw-r--r--pkgs/stdenv/generic/check-meta.nix2
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix47
-rw-r--r--pkgs/stdenv/generic/setup.sh11
-rw-r--r--pkgs/stdenv/linux/default.nix4
-rw-r--r--pkgs/test/stdenv/hooks.nix12
-rw-r--r--pkgs/tools/X11/sunpaper/default.nix6
-rw-r--r--pkgs/tools/admin/awscli2/default.nix4
-rw-r--r--pkgs/tools/admin/google-cloud-sdk/components.nix10
-rw-r--r--pkgs/tools/admin/tigervnc/default.nix5
-rw-r--r--pkgs/tools/admin/trivy/default.nix6
-rw-r--r--pkgs/tools/archivers/arc_unpacker/default.nix1
-rw-r--r--pkgs/tools/audio/mpris-scrobbler/default.nix7
-rw-r--r--pkgs/tools/compression/brotli/default.nix13
-rw-r--r--pkgs/tools/compression/zstd/default.nix17
-rw-r--r--pkgs/tools/filesystems/blobfuse/default.nix6
-rw-r--r--pkgs/tools/filesystems/ceph/default.nix17
-rw-r--r--pkgs/tools/filesystems/httm/default.nix6
-rw-r--r--pkgs/tools/filesystems/idsk/default.nix5
-rw-r--r--pkgs/tools/filesystems/rmfuse/default.nix81
-rw-r--r--pkgs/tools/filesystems/rmfuse/poetry-git-overlay.nix14
-rw-r--r--pkgs/tools/filesystems/rmfuse/poetry.lock596
-rw-r--r--pkgs/tools/filesystems/rmfuse/pyproject.toml15
-rwxr-xr-xpkgs/tools/filesystems/rmfuse/update5
-rw-r--r--pkgs/tools/graphics/argyllcms/default.nix2
-rw-r--r--pkgs/tools/graphics/libyafaray/default.nix5
-rw-r--r--pkgs/tools/graphics/pikchr/default.nix16
-rw-r--r--pkgs/tools/graphics/vulkan-cts/default.nix32
-rw-r--r--pkgs/tools/graphics/wgpu-utils/default.nix6
-rw-r--r--pkgs/tools/misc/ethtool/default.nix15
-rw-r--r--pkgs/tools/misc/file/default.nix4
-rw-r--r--pkgs/tools/misc/grub/2.0x.nix4
-rw-r--r--pkgs/tools/misc/grub/trusted.nix5
-rw-r--r--pkgs/tools/misc/hdf4/default.nix21
-rw-r--r--pkgs/tools/misc/hoard/default.nix6
-rw-r--r--pkgs/tools/misc/ipxe/default.nix10
-rw-r--r--pkgs/tools/misc/lockfile-progs/default.nix5
-rw-r--r--pkgs/tools/misc/mpdscribble/default.nix4
-rw-r--r--pkgs/tools/misc/noti/default.nix6
-rw-r--r--pkgs/tools/misc/pspg/default.nix5
-rw-r--r--pkgs/tools/misc/steampipe/default.nix4
-rw-r--r--pkgs/tools/misc/vtm/default.nix4
-rw-r--r--pkgs/tools/misc/wimboot/default.nix14
-rw-r--r--pkgs/tools/misc/yafetch/default.nix2
-rw-r--r--pkgs/tools/networking/burpsuite/default.nix4
-rw-r--r--pkgs/tools/networking/dsniff/default.nix2
-rw-r--r--pkgs/tools/networking/frp/default.nix6
-rw-r--r--pkgs/tools/networking/grpc_cli/default.nix31
-rw-r--r--pkgs/tools/networking/ip2unix/default.nix4
-rw-r--r--pkgs/tools/networking/mozillavpn/default.nix10
-rw-r--r--pkgs/tools/networking/networkmanager/fortisslvpn/default.nix2
-rw-r--r--pkgs/tools/networking/networkmanager/iodine/default.nix2
-rw-r--r--pkgs/tools/networking/networkmanager/l2tp/default.nix2
-rw-r--r--pkgs/tools/networking/networkmanager/sstp/default.nix2
-rw-r--r--pkgs/tools/networking/openconnect/common.nix4
-rw-r--r--pkgs/tools/networking/pingu/default.nix6
-rw-r--r--pkgs/tools/networking/ppp/default.nix8
-rw-r--r--pkgs/tools/networking/tcpdump/default.nix10
-rw-r--r--pkgs/tools/networking/tgt/default.nix5
-rw-r--r--pkgs/tools/networking/uqmi/default.nix5
-rw-r--r--pkgs/tools/networking/wireguard-tools/default.nix3
-rw-r--r--pkgs/tools/networking/xray/default.nix6
-rw-r--r--pkgs/tools/package-management/nfpm/default.nix6
-rw-r--r--pkgs/tools/package-management/nix-index/default.nix6
-rw-r--r--pkgs/tools/package-management/repro-get/default.nix6
-rw-r--r--pkgs/tools/security/aflplusplus/default.nix5
-rw-r--r--pkgs/tools/security/chipsec/default.nix5
-rw-r--r--pkgs/tools/security/enc/default.nix55
-rw-r--r--pkgs/tools/security/erosmb/default.nix4
-rw-r--r--pkgs/tools/security/gnupg/24.nix (renamed from pkgs/tools/security/gnupg/23.nix)14
-rw-r--r--pkgs/tools/security/gopass/default.nix8
-rw-r--r--pkgs/tools/security/gopass/git-credential.nix8
-rw-r--r--pkgs/tools/security/gopass/hibp.nix8
-rw-r--r--pkgs/tools/security/gopass/jsonapi.nix8
-rw-r--r--pkgs/tools/security/gopass/summon.nix8
-rw-r--r--pkgs/tools/security/opencryptoki/default.nix36
-rw-r--r--pkgs/tools/security/vault/default.nix6
-rw-r--r--pkgs/tools/system/acpica-tools/default.nix6
-rw-r--r--pkgs/tools/system/ddrescue/default.nix4
-rw-r--r--pkgs/tools/system/facter/default.nix4
-rw-r--r--pkgs/tools/system/kanata/default.nix15
-rw-r--r--pkgs/tools/system/rocm-smi/default.nix4
-rw-r--r--pkgs/tools/text/d2/default.nix6
-rw-r--r--pkgs/tools/text/dos2unix/default.nix4
-rw-r--r--pkgs/tools/text/groff/default.nix5
-rw-r--r--pkgs/tools/text/justify/default.nix4
-rw-r--r--pkgs/tools/text/mdbook-katex/default.nix6
-rw-r--r--pkgs/tools/text/mdbook-pdf/default.nix6
-rw-r--r--pkgs/tools/text/qgrep/default.nix5
-rw-r--r--pkgs/tools/text/tab/default.nix5
-rw-r--r--pkgs/tools/text/unoconv/default.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/tl2nix.sed76
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix159
-rw-r--r--pkgs/top-level/darwin-packages.nix9
-rw-r--r--pkgs/top-level/python-aliases.nix2
-rw-r--r--pkgs/top-level/python-packages.nix24
-rw-r--r--pkgs/top-level/python2-packages.nix2
-rw-r--r--pkgs/top-level/qt5-packages.nix2
731 files changed, 7325 insertions, 6615 deletions
diff --git a/.github/workflows/basic-eval.yml b/.github/workflows/basic-eval.yml
index c12999e8d0c..fcc07b633b3 100644
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@@ -19,7 +19,7 @@ jobs:
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
     - uses: actions/checkout@v3
-    - uses: cachix/install-nix-action@v18
+    - uses: cachix/install-nix-action@v19
     - uses: cachix/cachix-action@v12
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index ae411fefbe4..549563d4ec2 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -28,7 +28,7 @@ jobs:
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@v18
+    - uses: cachix/install-nix-action@v19
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0
diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos.yml
index 08af28fcfb4..99f14562d50 100644
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@v18
+      - uses: cachix/install-nix-action@v19
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs.yml
index 23f2caf021b..63b504f670f 100644
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@v18
+      - uses: cachix/install-nix-action@v19
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/manual-rendering.yml b/.github/workflows/manual-rendering.yml
index c9f77c191c6..5534d23416e 100644
--- a/.github/workflows/manual-rendering.yml
+++ b/.github/workflows/manual-rendering.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v18
+      - uses: cachix/install-nix-action@v19
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 079147f7d72..c57102b0aa0 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v18
+      - uses: cachix/install-nix-action@v19
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup
diff --git a/doc/languages-frameworks/beam.section.md b/doc/languages-frameworks/beam.section.md
index 6b3a369c291..707da43e9dd 100644
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@@ -171,6 +171,7 @@ let
     inherit src version;
     # nix will complain and tell you the right value to replace this with
     hash = lib.fakeHash;
+    mixEnv = ""; # default is "prod", when empty includes all dependencies, such as "dev", "test".
     # if you have build time environment variables add them here
     MY_ENV_VAR="my_value";
   };
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 18b4118d631..ff7d1a66917 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -76,7 +76,7 @@
   _0xB10C = {
     email = "nixpkgs@b10c.me";
     name = "0xB10C";
-    github = "0xb10c";
+    github = "0xB10C";
     githubId = 19157360;
   };
   _0xbe7a = {
@@ -817,7 +817,7 @@
   notbandali = {
     name = "Amin Bandali";
     email = "bandali@gnu.org";
-    github = "notbandali";
+    github = "bandali0";
     githubId = 1254858;
     keys = [{
       fingerprint = "BE62 7373 8E61 6D6D 1B3A  08E8 A21A 0202 4881 6103";
@@ -932,6 +932,12 @@
     githubId = 106511;
     name = "Andrew Kelley";
   };
+  andrewsmith = {
+    email = "andrew@velvet.software";
+    github = "andrewsmith";
+    githubId = 29887;
+    name = "Andrew Smith";
+  };
   andsild = {
     email = "andsild@gmail.com";
     github = "andsild";
@@ -1760,7 +1766,7 @@
   benesim = {
     name = "Benjamin Isbarn";
     email = "benjamin.isbarn@gmail.com";
-    github = "benesim";
+    github = "BeneSim";
     githubId = 29384538;
     keys = [{
       fingerprint = "D35E C9CE E631 638F F1D8  B401 6F0E 410D C3EE D02";
@@ -2382,6 +2388,12 @@
     github = "CaptainJawZ";
     githubId = 43111068;
   };
+  CardboardTurkey = {
+    name = "Kiran Ostrolenk";
+    email = "kostrolenk@gmail.com";
+    github = "CardboardTurkey";
+    githubId = 34030186;
+  };
   carlosdagos = {
     email = "m@cdagostino.io";
     github = "carlosdagos";
@@ -3130,7 +3142,7 @@
   cust0dian = {
     email = "serg@effectful.software";
     github = "cust0dian";
-    githubId = 389387;
+    githubId = 119854490;
     name = "Serg Nesterov";
     keys = [{
       fingerprint = "6E7D BA30 DB5D BA60 693C  3BE3 1512 F6EB 84AE CC8C";
@@ -3409,7 +3421,7 @@
   };
   davsanchez = {
     email = "davidslt+nixpkgs@pm.me";
-    github = "davsanchez";
+    github = "DavSanchez";
     githubId = 11422515;
     name = "David Sánchez";
   };
@@ -3855,6 +3867,12 @@
     githubId = 39825;
     name = "Dominik Honnef";
   };
+  doriath = {
+    email = "tomasz.zurkowski@gmail.com";
+    github = "doriath";
+    githubId = 150959;
+    name = "Tomasz Zurkowski";
+  };
   doronbehar = {
     email = "me@doronbehar.com";
     github = "doronbehar";
@@ -3896,6 +3914,7 @@
     name = "Davide Peressoni";
     email = "davide.peressoni@tuta.io";
     matrix = "@dpd-:matrix.org";
+    github = "DPDmancul";
     githubId = 3186857;
   };
   dpercy = {
@@ -4326,7 +4345,7 @@
   };
   elnudev = {
     email = "elnu@elnu.com";
-    github = "elnudev";
+    github = "ElnuDev";
     githubId = 9874955;
     name = "Elnu";
   };
@@ -4614,7 +4633,7 @@
   };
   ewok = {
     email = "ewok@ewok.ru";
-    github = "ewok";
+    github = "ewok-old";
     githubId = 454695;
     name = "Artur Taranchiev";
   };
@@ -5745,7 +5764,7 @@
   };
   harrisonthorne = {
     email = "harrisonthorne@proton.me";
-    github = "harrisonthorne";
+    github = "muni-corn";
     githubId = 33523827;
     name = "Harrison Thorne";
   };
@@ -6980,7 +6999,7 @@
   };
   jkarlson = {
     email = "jekarlson@gmail.com";
-    github = "jkarlson";
+    github = "ethorsoe";
     githubId = 1204734;
     name = "Emil Karlson";
   };
@@ -7758,7 +7777,7 @@
     name = "Kid";
   };
   kidsan = {
-    github = "kidsan";
+    github = "Kidsan";
     githubId = 8798449;
     name = "kidsan";
   };
@@ -8655,6 +8674,8 @@
   loveisgrief = {
     name = "LoveIsGrief";
     email = "loveisgrief@tuta.io";
+    github = "LoveIsGrief";
+    githubId = 2829538;
     keys = [{
       fingerprint = "9847 4F48 18C6 4E0A F0C5  3529 E96D 1EDF A053 45EB";
     }];
@@ -8806,7 +8827,7 @@
   };
   lux = {
     email = "lux@lux.name";
-    github = "luxferresum";
+    github = "luxzeitlos";
     githubId = 1208273;
     matrix = "@lux:ontheblueplanet.com";
     name = "Lux";
@@ -9279,7 +9300,7 @@
   };
   maxwell-lt = {
     email = "maxwell.lt@live.com";
-    github = "maxwell-lt";
+    github = "Maxwell-lt";
     githubId = 17859747;
     name = "Maxwell L-T";
   };
@@ -9918,7 +9939,7 @@
     name = "Mon Aaraj";
     email = "owo69uwu69@gmail.com";
     matrix = "@mon:tchncs.de";
-    github = "MonAaraj";
+    github = "ribosomerocker";
     githubId = 46468162;
   };
   monsieurp = {
@@ -10167,7 +10188,7 @@
   munksgaard = {
     name = "Philip Munksgaard";
     email = "philip@munksgaard.me";
-    github = "munksgaard";
+    github = "Munksgaard";
     githubId = 230613;
     matrix = "@philip:matrix.munksgaard.me";
     keys = [{
@@ -10784,7 +10805,7 @@
   };
   nrhelmi = {
     email = "helmiinour@gmail.com";
-    github = "nrhelmi";
+    github = "NRHelmi";
     githubId = 15707703;
     name = "Helmi Nour";
   };
@@ -11161,7 +11182,7 @@
   };
   paddygord = {
     email = "pgpatrickgordon@gmail.com";
-    github = "paddygord";
+    github = "avaunit02";
     githubId = 10776658;
     name = "Patrick Gordon";
   };
@@ -12211,7 +12232,7 @@
   };
   ratsclub = {
     email = "victor@freire.dev.br";
-    github = "vtrf";
+    github = "ratsclub";
     githubId = 25647735;
     name = "Victor Freire";
   };
@@ -12475,7 +12496,7 @@
   };
   rika = {
     email = "rika@paymentswit.ch";
-    github = "NekomimiScience";
+    github = "ScarletHg";
     githubId = 1810487;
     name = "Rika";
   };
@@ -12821,6 +12842,12 @@
     githubId = 5236428;
     name = "Gaëtan André";
   };
+  rvnstn = {
+    email = "github@rvnstn.de";
+    github = "rvnstn";
+    githubId = 2364742;
+    name = "Tobias Ravenstein";
+  };
   rvolosatovs = {
     email = "rvolosatovs@riseup.net";
     github = "rvolosatovs";
@@ -13470,7 +13497,7 @@
   shreerammodi = {
     name = "Shreeram Modi";
     email = "shreerammodi10@gmail.com";
-    github = "Shrimpram";
+    github = "shrimpram";
     githubId = 67710369;
     keys = [{
       fingerprint = "EA88 EA07 26E9 6CBF 6365  3966 163B 16EE 76ED 24CE";
@@ -13708,7 +13735,7 @@
   sno2wman = {
     name = "SnO2WMaN";
     email = "me@sno2wman.net";
-    github = "sno2wman";
+    github = "SnO2WMaN";
     githubId = 15155608;
   };
   snpschaaf = {
@@ -14462,7 +14489,7 @@
   };
   teozkr = {
     email = "teo@nullable.se";
-    github = "teozkr";
+    github = "nightkr";
     githubId = 649832;
     name = "Teo Klestrup Röijezon";
   };
@@ -14949,7 +14976,7 @@
   };
   tonyshkurenko = {
     email = "support@twingate.com";
-    github = "tonyshkurenko";
+    github = "antonshkurenko";
     githubId = 8597964;
     name = "Anton Shkurenko";
   };
@@ -15288,7 +15315,7 @@
   };
   uthar = {
     email = "galkowskikasper@gmail.com";
-    github = "uthar";
+    github = "Uthar";
     githubId = 15697697;
     name = "Kasper Gałkowski";
   };
@@ -16418,7 +16445,7 @@
   zebreus = {
     matrix = "@lennart:cicen.net";
     email = "lennarteichhorn+nixpkgs@gmail.com";
-    github = "Zebreus";
+    github = "zebreus";
     githubId = 1557253;
     name = "Lennart Eichhorn";
   };
@@ -16484,7 +16511,7 @@
     name = "zimbatm";
   };
   Zimmi48 = {
-    email = "theo.zimmermann@univ-paris-diderot.fr";
+    email = "theo.zimmermann@telecom-paris.fr";
     github = "Zimmi48";
     githubId = 1108325;
     name = "Théo Zimmermann";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 49ddf1f10be..4d338675c65 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -312,6 +312,19 @@ with lib.maintainers; {
     enableFeatureFreezePing = true;
   };
 
+  graalvm-ce = {
+    members = [
+      bandresen
+      hlolli
+      glittershark
+      babariviere
+      ericdallo
+      thiagokokada
+    ];
+    scope = "Maintain GraalVM Community Edition packages.";
+    shortName = "GraalVM-CE";
+  };
+
   haskell = {
     members = [
       cdepillabout
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index abaefac66e3..8af1753bb78 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -10,6 +10,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed.
 
+- KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.
+
 - `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.
 
 ## New Services {#sec-release-23.05-new-services}
@@ -99,6 +101,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Calling `makeSetupHook` without passing a `name` argument is deprecated.
 
+- The `cosmoc` package has been removed. The upstream scripts in `cosmocc` should be used instead.
+
 - Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually.
 
 - The [services.wordpress.sites.<name>.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.<name>.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
diff --git a/nixos/modules/services/databases/clickhouse.nix b/nixos/modules/services/databases/clickhouse.nix
index 04dd20b5f14..1f4a39765cd 100644
--- a/nixos/modules/services/databases/clickhouse.nix
+++ b/nixos/modules/services/databases/clickhouse.nix
@@ -54,7 +54,7 @@ with lib;
         AmbientCapabilities = "CAP_SYS_NICE";
         StateDirectory = "clickhouse";
         LogsDirectory = "clickhouse";
-        ExecStart = "${cfg.package}/bin/clickhouse-server --config-file=${cfg.package}/etc/clickhouse-server/config.xml";
+        ExecStart = "${cfg.package}/bin/clickhouse-server --config-file=/etc/clickhouse-server/config.xml";
       };
     };
 
diff --git a/nixos/modules/services/matrix/appservice-discord.nix b/nixos/modules/services/matrix/appservice-discord.nix
index 15f0f0cc0cd..f579c2529c0 100644
--- a/nixos/modules/services/matrix/appservice-discord.nix
+++ b/nixos/modules/services/matrix/appservice-discord.nix
@@ -5,7 +5,6 @@ with lib;
 let
   dataDir = "/var/lib/matrix-appservice-discord";
   registrationFile = "${dataDir}/discord-registration.yaml";
-  appDir = "${pkgs.matrix-appservice-discord}/${pkgs.matrix-appservice-discord.passthru.nodeAppDir}";
   cfg = config.services.matrix-appservice-discord;
   opt = options.services.matrix-appservice-discord;
   # TODO: switch to configGen.json once RFC42 is implemented
@@ -16,6 +15,15 @@ in {
     services.matrix-appservice-discord = {
       enable = mkEnableOption (lib.mdDoc "a bridge between Matrix and Discord");
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.matrix-appservice-discord;
+        defaultText = literalExpression "pkgs.matrix-appservice-discord";
+        description = lib.mdDoc ''
+          Which package of matrix-appservice-discord to use.
+        '';
+      };
+
       settings = mkOption rec {
         # TODO: switch to types.config.json as prescribed by RFC42 once it's implemented
         type = types.attrs;
@@ -114,7 +122,7 @@ in {
 
       preStart = ''
         if [ ! -f '${registrationFile}' ]; then
-          ${pkgs.matrix-appservice-discord}/bin/matrix-appservice-discord \
+          ${cfg.package}/bin/matrix-appservice-discord \
             --generate-registration \
             --url=${escapeShellArg cfg.url} \
             ${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \
@@ -135,13 +143,13 @@ in {
 
         DynamicUser = true;
         PrivateTmp = true;
-        WorkingDirectory = appDir;
+        WorkingDirectory = "${cfg.package}/${cfg.package.passthru.nodeAppDir}";
         StateDirectory = baseNameOf dataDir;
         UMask = "0027";
         EnvironmentFile = cfg.environmentFile;
 
         ExecStart = ''
-          ${pkgs.matrix-appservice-discord}/bin/matrix-appservice-discord \
+          ${cfg.package}/bin/matrix-appservice-discord \
             --file='${registrationFile}' \
             --config='${settingsFile}' \
             --port='${toString cfg.port}'
diff --git a/nixos/modules/services/misc/moonraker.nix b/nixos/modules/services/misc/moonraker.nix
index 62064b5d90f..53638ded296 100644
--- a/nixos/modules/services/misc/moonraker.nix
+++ b/nixos/modules/services/misc/moonraker.nix
@@ -11,6 +11,8 @@ let
       else lib.concatMapStrings (s: "\n  ${generators.mkValueStringDefault {} s}") l;
     mkKeyValue = generators.mkKeyValueDefault {} ":";
   };
+
+  unifiedConfigDir = cfg.stateDir + "/config";
 in {
   options = {
     services.moonraker = {
@@ -30,11 +32,10 @@ in {
       };
 
       configDir = mkOption {
-        type = types.path;
-        default = cfg.stateDir + "/config";
-        defaultText = literalExpression ''config.${opt.stateDir} + "/config"'';
+        type = types.nullOr types.path;
+        default = null;
         description = lib.mdDoc ''
-          The directory containing client-writable configuration files.
+          Deprecated directory containing client-writable configuration files.
 
           Clients will be able to edit files in this directory via the API. This directory must be writable.
         '';
@@ -96,8 +97,18 @@ in {
   };
 
   config = mkIf cfg.enable {
-    warnings = optional (cfg.settings ? update_manager)
-      ''Enabling update_manager is not supported on NixOS and will lead to non-removable warnings in some clients.'';
+    warnings = []
+      ++ optional (cfg.settings ? update_manager)
+        ''Enabling update_manager is not supported on NixOS and will lead to non-removable warnings in some clients.''
+      ++ optional (cfg.configDir != null)
+        ''
+          services.moonraker.configDir has been deprecated upstream and will be removed.
+
+          Action: ${
+            if cfg.configDir == unifiedConfigDir then "Simply remove services.moonraker.configDir from your config."
+            else "Move files from `${cfg.configDir}` to `${unifiedConfigDir}` then remove services.moonraker.configDir from your config."
+          }
+        '';
 
     assertions = [
       {
@@ -124,20 +135,20 @@ in {
           port = cfg.port;
           klippy_uds_address = cfg.klipperSocket;
         };
+        machine = {
+          validate_service = false;
+        };
+      } // (lib.optionalAttrs (cfg.configDir != null) {
         file_manager = {
           config_path = cfg.configDir;
         };
-        database = {
-          database_path = "${cfg.stateDir}/database";
-        };
-      };
+      });
       fullConfig = recursiveUpdate cfg.settings forcedConfig;
     in format.generate "moonraker.cfg" fullConfig;
 
     systemd.tmpfiles.rules = [
       "d '${cfg.stateDir}' - ${cfg.user} ${cfg.group} - -"
-      "d '${cfg.configDir}' - ${cfg.user} ${cfg.group} - -"
-    ];
+    ] ++ lib.optional (cfg.configDir != null) "d '${cfg.configDir}' - ${cfg.user} ${cfg.group} - -";
 
     systemd.services.moonraker = {
       description = "Moonraker, an API web server for Klipper";
@@ -147,9 +158,16 @@ in {
 
       # Moonraker really wants its own config to be writable...
       script = ''
-        cp /etc/moonraker.cfg ${cfg.configDir}/moonraker-temp.cfg
-        chmod u+w ${cfg.configDir}/moonraker-temp.cfg
-        exec ${pkg}/bin/moonraker -c ${cfg.configDir}/moonraker-temp.cfg
+        config_path=${
+          # Deprecated separate config dir
+          if cfg.configDir != null then "${cfg.configDir}/moonraker-temp.cfg"
+          # Config in unified data path
+          else "${unifiedConfigDir}/moonraker-temp.cfg"
+        }
+        mkdir -p $(dirname "$config_path")
+        cp /etc/moonraker.cfg "$config_path"
+        chmod u+w "$config_path"
+        exec ${pkg}/bin/moonraker -d ${cfg.stateDir} -c "$config_path"
       '';
 
       # Needs `ip` command
@@ -184,5 +202,6 @@ in {
   meta.maintainers = with maintainers; [
     cab404
     vtuan10
+    zhaofengli
   ];
 }
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index c150adcac26..ab666ba3949 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -316,7 +316,8 @@ in
         ++ lib.optional config.services.colord.enable pkgs.colord-kde
         ++ lib.optional config.services.hardware.bolt.enable pkgs.plasma5Packages.plasma-thunderbolt
         ++ lib.optionals config.services.samba.enable [ kdenetwork-filesharing pkgs.samba ]
-        ++ lib.optional config.services.xserver.wacom.enable pkgs.wacomtablet;
+        ++ lib.optional config.services.xserver.wacom.enable pkgs.wacomtablet
+        ++ lib.optional config.services.flatpak.enable flatpak-kcm;
 
       # Extra services for D-Bus activation
       services.dbus.packages = [
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 620d76aef20..70edc13dc0f 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -495,7 +495,7 @@ in {
 
           # If we are not booting a NixOS closure (e.g. init=/bin/sh),
           # we don't know what root to prepare so we don't do anything
-          if ! [ -x "/sysroot$closure/prepare-root" ]; then
+          if ! [ -x "/sysroot$(readlink "/sysroot$closure/prepare-root" || echo "$closure/prepare-root")" ]; then
             echo "NEW_INIT=''${initParam[1]}" > /etc/switch-root.conf
             echo "$closure does not look like a NixOS installation - not activating"
             exit 0
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 6c00fabaa18..2e2190e4188 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -7,7 +7,10 @@ let
 
   podmanPackage = (pkgs.podman.override {
     extraPackages = cfg.extraPackages
-      ++ lib.optional (builtins.elem "zfs" config.boot.supportedFilesystems) config.boot.zfs.package;
+      # setuid shadow
+      ++ [ "/run/wrappers" ]
+      # include pkgs.zfs by default in the wrapped podman used by the module so it is cached
+      ++ (if (builtins.elem "zfs" config.boot.supportedFilesystems) then [ config.boot.zfs.package ] else [ pkgs.zfs ]);
   });
 
   # Provides a fake "docker" binary mapping to podman
@@ -181,10 +184,6 @@ in
 
       systemd.packages = [ cfg.package ];
 
-      systemd.services.podman.serviceConfig = {
-        ExecStart = [ "" "${cfg.package}/bin/podman $LOGGING system service" ];
-      };
-
       systemd.services.podman-prune = {
         description = "Prune podman resources";
 
@@ -205,10 +204,6 @@ in
       systemd.sockets.podman.wantedBy = [ "sockets.target" ];
       systemd.sockets.podman.socketConfig.SocketGroup = "podman";
 
-      systemd.user.services.podman.serviceConfig = {
-        ExecStart = [ "" "${cfg.package}/bin/podman $LOGGING system service" ];
-      };
-
       systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
 
       systemd.tmpfiles.packages = [
diff --git a/nixos/tests/k3s/default.nix b/nixos/tests/k3s/default.nix
index 07d93c41c7a..e168f8233c7 100644
--- a/nixos/tests/k3s/default.nix
+++ b/nixos/tests/k3s/default.nix
@@ -1,9 +1,13 @@
 { system ? builtins.currentSystem
 , pkgs ? import ../../.. { inherit system; }
+, lib ? pkgs.lib
 }:
+let
+  allK3s = lib.filterAttrs (n: _: lib.strings.hasPrefix "k3s_" n) pkgs;
+in
 {
   # Run a single node k3s cluster and verify a pod can run
-  single-node = import ./single-node.nix { inherit system pkgs; };
+  single-node = lib.mapAttrs (_: k3s: import ./single-node.nix { inherit system pkgs k3s; }) allK3s;
   # Run a multi-node k3s cluster and verify pod networking works across nodes
-  multi-node = import ./multi-node.nix { inherit system pkgs; };
+  multi-node = lib.mapAttrs (_: k3s: import ./multi-node.nix { inherit system pkgs k3s; }) allK3s;
 }
diff --git a/nixos/tests/k3s/multi-node.nix b/nixos/tests/k3s/multi-node.nix
index 9a6c7fd4657..932b4639b39 100644
--- a/nixos/tests/k3s/multi-node.nix
+++ b/nixos/tests/k3s/multi-node.nix
@@ -1,4 +1,4 @@
-import ../make-test-python.nix ({ pkgs, lib, ... }:
+import ../make-test-python.nix ({ pkgs, lib, k3s, ... }:
   let
     imageEnv = pkgs.buildEnv {
       name = "k3s-pause-image-env";
@@ -39,7 +39,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:
     tokenFile = pkgs.writeText "token" "p@s$w0rd";
   in
   {
-    name = "k3s-multi-node";
+    name = "${k3s.name}-multi-node";
 
     nodes = {
       server = { pkgs, ... }: {
@@ -52,7 +52,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:
           inherit tokenFile;
           enable = true;
           role = "server";
-          package = pkgs.k3s;
+          package = k3s;
           clusterInit = true;
           extraFlags = builtins.toString [
             "--disable" "coredns"
diff --git a/nixos/tests/k3s/single-node.nix b/nixos/tests/k3s/single-node.nix
index a95fa4a031e..c120f461ddc 100644
--- a/nixos/tests/k3s/single-node.nix
+++ b/nixos/tests/k3s/single-node.nix
@@ -1,4 +1,4 @@
-import ../make-test-python.nix ({ pkgs, lib, ... }:
+import ../make-test-python.nix ({ pkgs, lib, k3s, ... }:
   let
     imageEnv = pkgs.buildEnv {
       name = "k3s-pause-image-env";
@@ -24,7 +24,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:
     '';
   in
   {
-    name = "k3s";
+    name = "${k3s.name}-single-node";
     meta = with pkgs.lib.maintainers; {
       maintainers = [ euank ];
     };
@@ -38,7 +38,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:
 
       services.k3s.enable = true;
       services.k3s.role = "server";
-      services.k3s.package = pkgs.k3s;
+      services.k3s.package = k3s;
       # Slightly reduce resource usage
       services.k3s.extraFlags = builtins.toString [
         "--disable" "coredns"
diff --git a/nixos/tests/predictable-interface-names.nix b/nixos/tests/predictable-interface-names.nix
index 08773120bc1..fa9bd67073b 100644
--- a/nixos/tests/predictable-interface-names.nix
+++ b/nixos/tests/predictable-interface-names.nix
@@ -13,7 +13,7 @@ in pkgs.lib.listToAttrs (builtins.map ({ predictable, withNetworkd }: {
   name = pkgs.lib.optionalString (!predictable) "un" + "predictable"
        + pkgs.lib.optionalString withNetworkd "Networkd";
   value = makeTest {
-    name = "${if predictable then "" else "un"}predictableInterfaceNames${if withNetworkd then "-with-networkd" else ""}";
+    name = "${lib.optionalString (!predictable) "un"}predictableInterfaceNames${lib.optionalString withNetworkd "-with-networkd"}";
     meta = {};
 
     nodes.machine = { lib, ... }: {
diff --git a/nixos/tests/systemd-cryptenroll.nix b/nixos/tests/systemd-cryptenroll.nix
index 9ee2d280fbb..055ae7d1681 100644
--- a/nixos/tests/systemd-cryptenroll.nix
+++ b/nixos/tests/systemd-cryptenroll.nix
@@ -2,7 +2,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "systemd-cryptenroll";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ ymatsiuk ];
-    broken = true; # times out after two hours, details -> https://github.com/NixOS/nixpkgs/issues/167994
   };
 
   nodes.machine = { pkgs, lib, ... }: {
diff --git a/pkgs/applications/audio/aether-lv2/default.nix b/pkgs/applications/audio/aether-lv2/default.nix
index e912c7fa49a..179c656968c 100644
--- a/pkgs/applications/audio/aether-lv2/default.nix
+++ b/pkgs/applications/audio/aether-lv2/default.nix
@@ -18,6 +18,12 @@ stdenv.mkDerivation rec {
     lv2 libX11 libGL libGLU mesa
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=stringop-overflow"
+  ];
+
   installPhase = ''
     mkdir -p $out/lib/lv2
     cp -r aether.lv2 $out/lib/lv2
diff --git a/pkgs/applications/audio/bespokesynth/default.nix b/pkgs/applications/audio/bespokesynth/default.nix
index 6c48c756ab2..7fc921e59fb 100644
--- a/pkgs/applications/audio/bespokesynth/default.nix
+++ b/pkgs/applications/audio/bespokesynth/default.nix
@@ -66,6 +66,10 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i Source/TitleBar.h # gcc12
+  '';
+
   cmakeBuildType = "Release";
 
   cmakeFlags = lib.optionals enableVST2 [ "-DBESPOKE_VST2_SDK_LOCATION=${vst-sdk}/VST2_SDK" ];
diff --git a/pkgs/applications/audio/calf/default.nix b/pkgs/applications/audio/calf/default.nix
index 4ab651e3fb8..b4c9781ced1 100644
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "17x4hylgq4dn9qycsdacfxy64f5cv57n2qgkvsdp524gnqzw4az3";
   };
 
+  outputs = [ "out" "doc" ];
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/audio/espeak/default.nix b/pkgs/applications/audio/espeak/default.nix
index 2c59068720d..7164cb5fd3e 100644
--- a/pkgs/applications/audio/espeak/default.nix
+++ b/pkgs/applications/audio/espeak/default.nix
@@ -19,9 +19,9 @@ stdenv.mkDerivation rec {
   prePatch = ''
     sed -e s,/bin/ln,ln,g -i src/Makefile
     sed -e 's,^CXXFLAGS=-O2,CXXFLAGS=-O2 -D PATH_ESPEAK_DATA=\\\"$(DATADIR)\\\",' -i src/Makefile
-  '' + (if portaudio.api_version == 19 then ''
+  '' + (lib.optionalString (portaudio.api_version == 19) ''
     cp src/portaudio19.h src/portaudio.h
-  '' else "");
+  '');
 
   configurePhase = ''
     cd src
diff --git a/pkgs/applications/audio/furnace/default.nix b/pkgs/applications/audio/furnace/default.nix
index 0f15775b38d..f0bb039a79c 100644
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@@ -63,6 +63,12 @@ stdenv.mkDerivation rec {
     "-DWARNINGS_ARE_ERRORS=ON"
   ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or aarch64 (old gcc)
+    "-Wno-error=mismatched-new-delete"
+    "-Wno-error=use-after-free"
+  ];
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Normal CMake install phase on Darwin only installs the binary, the user is expected to use CPack to build a
     # bundle. That adds alot of overhead for not much benefit (CPack is currently abit broken, and needs impure access
diff --git a/pkgs/applications/audio/helvum/default.nix b/pkgs/applications/audio/helvum/default.nix
index 684f074b4e6..78891967fa4 100644
--- a/pkgs/applications/audio/helvum/default.nix
+++ b/pkgs/applications/audio/helvum/default.nix
@@ -16,20 +16,20 @@
 
 stdenv.mkDerivation rec {
   pname = "helvum";
-  version = "0.3.4";
+  version = "0.4.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "pipewire";
     repo = pname;
     rev = version;
-    sha256 = "0nhv6zw2zzxz2bg2zj32w1brywnm5lv6j3cvmmvwshc389z2k5x1";
+    hash = "sha256-TvjO7fGobGmAltVHeXWyMtMLANdVWVGvBYq20JD3mMI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-EIHO9qVPIXgezfFOaarlTU0an762nFmX1ELbQuAZ7rY";
+    hash = "sha256-W5Imlut30cjV4A6TCjBFLbViB0CDUucNsvIUiCXqu7I=";
   };
 
   nativeBuildInputs = [
@@ -50,9 +50,6 @@ stdenv.mkDerivation rec {
     pipewire
   ];
 
-  # FIXME: workaround for Pipewire 0.3.64 deprecated API change, remove when fixed upstream
-  NIX_CFLAGS_COMPILE = [ "-DPW_ENABLE_DEPRECATED" ];
-
   meta = with lib; {
     description = "A GTK patchbay for pipewire";
     homepage = "https://gitlab.freedesktop.org/pipewire/helvum";
diff --git a/pkgs/applications/audio/jack-rack/default.nix b/pkgs/applications/audio/jack-rack/default.nix
index 420c11562e2..8cf55289b2f 100644
--- a/pkgs/applications/audio/jack-rack/default.nix
+++ b/pkgs/applications/audio/jack-rack/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libjack2 ladspaH gtk2 alsa-lib libxml2 lrdf ];
-  NIX_LDFLAGS = "-ldl -lm -lpthread";
+  NIX_LDFLAGS = "-lm -lpthread";
 
   meta = {
     description = ''An effects "rack" for the JACK low latency audio API'';
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index 70cb4d7f110..36b6345c0f1 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -21,8 +21,6 @@ stdenv.mkDerivation rec {
   #       `l_notebook1'; jamin-callbacks.o:/build/jamin-0.95.0/src/hdeq.h:64: first defined here
   NIX_CFLAGS_COMPILE = "-fcommon";
 
-  NIX_LDFLAGS = "-ldl";
-
   postInstall = ''
     wrapProgram $out/bin/jamin --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa
   '';
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index dd00bd1f2c0..4e4612ef922 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -4,19 +4,21 @@
 , ladspaH, php, libXrandr }:
 
 stdenv.mkDerivation rec {
-        pname = "lsp-plugins";
-        version = "1.2.5";
+  pname = "lsp-plugins";
+  version = "1.2.5";
 
-        src = fetchurl {
-                url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-                sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
-        };
+  src = fetchurl {
+    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
+    sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
+  };
 
-        nativeBuildInputs = [ pkg-config php makeWrapper ];
-        buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];
+  outputs = [ "out" "dev" "doc" ];
 
-        makeFlags = [
-                "PREFIX=${placeholder "out"}"
+  nativeBuildInputs = [ pkg-config php makeWrapper ];
+  buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
   ];
 
   NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
diff --git a/pkgs/applications/audio/mimic/default.nix b/pkgs/applications/audio/mimic/default.nix
index 7e11c0a8d75..47e043f5d46 100644
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@@ -38,6 +38,11 @@ stdenv.mkDerivation rec {
     pcre2
   ] ++ lib.optional pulseaudioSupport libpulseaudio;
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=free-nonheap-object"
+  ];
+
   postInstall = ''
     wrapProgram $out/bin/mimic \
       --run "export ALSA_PLUGIN_DIR=${alsa-plugins}/lib/alsa-lib"
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 29f28203e13..3eb2cf20ee7 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mpg123";
-  version = "1.29.3";
+  version = "1.31.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ljiF2Mx3Ji8ot3GHx9GJ4yGV5kJE3iUwt5jd8yGD6Ec=";
+    sha256 = "sha256-sX8ikF4x9DtrQB399qce0Ru30Fb2jbRJ1wufmug5x94=";
   };
 
   outputs = [ "out" ] ++ lib.optionals withConplay [ "conplay" ];
diff --git a/pkgs/applications/audio/musly/default.nix b/pkgs/applications/audio/musly/default.nix
index 0d10b55d329..470d5c10507 100644
--- a/pkgs/applications/audio/musly/default.nix
+++ b/pkgs/applications/audio/musly/default.nix
@@ -10,11 +10,11 @@ stdenv.mkDerivation {
   };
   nativeBuildInputs = [ cmake ];
   buildInputs = [ eigen ffmpeg ];
-  fixupPhase = if stdenv.isDarwin then ''
+  fixupPhase = lib.optionalString stdenv.isDarwin ''
     install_name_tool -change libmusly.dylib $out/lib/libmusly.dylib $out/bin/musly
     install_name_tool -change libmusly_resample.dylib $out/lib/libmusly_resample.dylib $out/bin/musly
     install_name_tool -change libmusly_resample.dylib $out/lib/libmusly_resample.dylib $out/lib/libmusly.dylib
-  '' else "";
+  '';
 
   meta = with lib; {
     homepage = "https://www.musly.org";
diff --git a/pkgs/applications/audio/odin2/default.nix b/pkgs/applications/audio/odin2/default.nix
index beb12646793..de89f9aedea 100644
--- a/pkgs/applications/audio/odin2/default.nix
+++ b/pkgs/applications/audio/odin2/default.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-N96Nb7G6hqfh8DyMtHbttl/fRZUkS8f2KfPSqeMAhHY=";
   };
 
+  postPatch = ''
+    sed '1i#include <utility>' -i \
+      libs/JUCELV2/modules/juce_gui_basics/windows/juce_ComponentPeer.h # gcc12
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/applications/audio/opusfile/default.nix b/pkgs/applications/audio/opusfile/default.nix
index f86595361b6..47d7a64e3c2 100644
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, openssl, libogg, libopus }:
+{ lib, stdenv, fetchurl, pkg-config, openssl, libogg, libopus, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "opusfile";
@@ -12,7 +12,14 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl libogg ];
   propagatedBuildInputs = [ libopus ];
   outputs = [ "out" "dev" ];
-  patches = [ ./include-multistream.patch ]
+  patches = [
+    ./include-multistream.patch
+    (fetchpatch {
+      name = "CVE-2022-47021.patch";
+      url = "https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5.patch";
+      sha256 = "sha256-XThI/ys5caB+OncFVfxm5IsvQPy1MbLQKwIlYjPvTJQ=";
+    })
+  ]
     # fixes problem with openssl 1.1 dependency
     # see https://github.com/xiph/opusfile/issues/13
     ++ lib.optionals stdenv.hostPlatform.isWindows [ ./disable-cert-store.patch ];
diff --git a/pkgs/applications/audio/sonixd/default.nix b/pkgs/applications/audio/sonixd/default.nix
index 38110df2915..49c22a3aa4d 100644
--- a/pkgs/applications/audio/sonixd/default.nix
+++ b/pkgs/applications/audio/sonixd/default.nix
@@ -3,17 +3,25 @@
 , appimageTools
 }:
 
-appimageTools.wrapType2 rec {
+let
   pname = "sonixd";
   version = "0.15.3";
-
   src = fetchurl {
     url = "https://github.com/jeffvli/sonixd/releases/download/v${version}/Sonixd-${version}-linux-x86_64.AppImage";
     sha256 = "sha256-+4L3XAuR7T/z5a58SXre6yUiVi7TvSAs8vPgEC7hcIw=";
   };
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+in
+appimageTools.wrapType2 rec {
+  inherit pname version src;
 
   extraInstallCommands = ''
-    mv $out/bin/sonixd-${version} $out/bin/sonixd
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+    install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
+
+    install -m 444 -D ${appimageContents}/${pname}.png \
+      $out/share/icons/hicolor/1024x1024/apps/${pname}.png
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index 2c821ec6b4c..a0a17a93e1f 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -134,8 +134,8 @@ stdenv.mkDerivation {
       ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
       ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so
 
-      ln -s ${ffmpeg.out}/lib/libavcodec.so* $libdir
-      ln -s ${ffmpeg.out}/lib/libavformat.so* $libdir
+      ln -s ${ffmpeg.lib}/lib/libavcodec.so* $libdir
+      ln -s ${ffmpeg.lib}/lib/libavformat.so* $libdir
 
       rpath="$out/share/spotify:$libdir"
 
diff --git a/pkgs/applications/audio/stochas/default.nix b/pkgs/applications/audio/stochas/default.nix
index 84376a1bbe9..2b72664347e 100644
--- a/pkgs/applications/audio/stochas/default.nix
+++ b/pkgs/applications/audio/stochas/default.nix
@@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    sed '1i#include <utility>' -i \
+      lib/JUCE/modules/juce_gui_basics/windows/juce_ComponentPeer.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/applications/blockchains/torq/default.nix b/pkgs/applications/blockchains/torq/default.nix
index 4b786168bce..657e5b0e3ff 100644
--- a/pkgs/applications/blockchains/torq/default.nix
+++ b/pkgs/applications/blockchains/torq/default.nix
@@ -6,20 +6,20 @@
 
 let
   pname = "torq";
-  version = "0.17.3";
+  version = "0.18.17";
 
   src = fetchFromGitHub {
     owner = "lncapital";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fqHJZi1NQCrZqsa+N+FVYZ8s9o0D555Sqn5qNlJ1MmI=";
+    hash = "sha256-xiA66yGo8b1+zZ7jQ7SFOtNPmqbdna7fUCT21uibrIM=";
   };
 
   web = buildNpmPackage {
     pname = "${pname}-frontend";
     inherit version;
     src = "${src}/web";
-    npmDepsHash = "sha256-8mUfTFzPjQlQvhC3zZf+WruDBkYnmGt3yckNi0CPWs0=";
+    npmDepsHash = "sha256-/7x5RWYIB5BChYMnMuFVVaZd0pVkew4i4QrF7hSFnCM=";
 
     # copied from upstream Dockerfile
     npmInstallFlags = [ "--legacy-peer-deps" ];
@@ -29,14 +29,14 @@ let
     # override npmInstallHook, we only care about the build/ directory
     installPhase = ''
       mkdir $out
-      cp -r build $out/
+      cp -r build/* $out/
     '';
   };
 in
 buildGoModule rec {
   inherit pname version src;
 
-  vendorHash = "sha256-HETN2IMnpxnTyg6bQDpoD0saJu+gKocdEf0VzEi12Gs=";
+  vendorHash = "sha256-bvisI589Gq9IdyJEqI+uzs3iDPOTUkq95P3n/KoFhF0=";
 
   subPackages = [ "cmd/torq" ];
 
@@ -47,7 +47,8 @@ buildGoModule rec {
   ];
 
   postInstall = ''
-    ln -s ${web} $out/web
+    mkdir -p $out/web/build
+    cp -r ${web}/* $out/web/build/
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix b/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix
index 5c2a6d7c59b..53f004c2a36 100644
--- a/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
   buildInputs = [ lightdm gtk3 glib ];
 
-  postUnpack = if conf != "" then ''
+  postUnpack = lib.optionalString (conf != "") ''
     cp ${builtins.toFile "config.h" conf} source/config.h
-  '' else "";
+  '';
 
   buildPhase = ''
     mkdir -p $out/bin $out/share/xgreeters
diff --git a/pkgs/applications/editors/cudatext/default.nix b/pkgs/applications/editors/cudatext/default.nix
index 98b280f332d..f7af7620697 100644
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.183.0";
+  version = "1.184.0";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    hash = "sha256-hfOEL1Qkf8Sk6cNWUBwZXH/DSuo/ObyA5sRLOj9Iw3M=";
+    hash = "sha256-bRe9yS9CMsBH04oefImSYkd1jUe3SnJU6JZETLwow/0=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/cudatext/deps.json b/pkgs/applications/editors/cudatext/deps.json
index 2c6dcdf2913..7cbb440491e 100644
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@@ -16,8 +16,8 @@
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2023.02.05",
-    "hash": "sha256-V0mvSuiO5dTztXZ4uvteF0e7B21Ll1uq6o0UHPcZm1o="
+    "rev": "2023.02.12",
+    "hash": "sha256-PSRKxKJkX9GlV8JUACYzDZguv8M8jKVxlW7U4Mmla9o="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index f5ed28cedf6..b7b70eb501e 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (rec {
   pname = "ed";
-  version = "1.18";
+  version = "1.19";
 
   src = fetchurl {
     url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    sha256 = "sha256-rKjvrZgAxYdySiC5eqj8R+a1pH34Fgb+q6gxsHRGK08=";
+    hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/applications/editors/poke/default.nix b/pkgs/applications/editors/poke/default.nix
index 8f4bcfd6726..fba050a040c 100644
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@@ -80,13 +80,13 @@ in stdenv.mkDerivation rec {
     moveToOutput share/vim "$out"
   '';
 
+  # Prevent tclPackageHook from auto-wrapping all binaries, we only
+  # need to wrap poke-gui
+  dontWrapTclBinaries = true;
+
   postFixup = lib.optionalString guiSupport ''
     wrapProgram "$out/bin/poke-gui" \
       --prefix TCLLIBPATH ' ' "$TCLLIBPATH"
-
-    # Prevent tclPackageHook from auto-wrapping all binaries, we only
-    # need to wrap poke-gui
-    unset TCLLIBPATH
   '';
 
   passthru = {
diff --git a/pkgs/applications/editors/texmacs/common.nix b/pkgs/applications/editors/texmacs/common.nix
index e52d95f837d..82dd13920b0 100644
--- a/pkgs/applications/editors/texmacs/common.nix
+++ b/pkgs/applications/editors/texmacs/common.nix
@@ -27,18 +27,18 @@ rec {
 
   postPatch = (if tex == null then ''
     gunzip < ${fullFontsSrc} | (cd TeXmacs && tar xvf -)
-   '' else if extraFonts then ''
+   '' else lib.optionalString extraFonts ''
     gunzip < ${extraFontsSrc} | (cd TeXmacs && tar xvf -)
-   '' else "") +
-   (if chineseFonts then ''
+   '') +
+   (lib.optionalString chineseFonts ''
     gunzip < ${chineseFontsSrc} | (cd TeXmacs && tar xvf -)
-   '' else "") +
-   (if japaneseFonts then ''
+   '') +
+   (lib.optionalString japaneseFonts ''
     gunzip < ${japaneseFontsSrc} | (cd TeXmacs && tar xvf -)
-   '' else "") +
-   (if koreanFonts then ''
+   '') +
+   (lib.optionalString koreanFonts ''
     gunzip < ${koreanFontsSrc} | (cd TeXmacs && tar xvf -)
-   '' else "");
+   '');
 
 
   meta = {
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 91425fe0b18..739342fc2a4 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -29,12 +29,12 @@ final: prev:
 
   ChatGPT-nvim = buildVimPluginFrom2Nix {
     pname = "ChatGPT.nvim";
-    version = "2023-01-19";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "jackMort";
       repo = "ChatGPT.nvim";
-      rev = "dac83f630fc6aafd256b149a2c2ae0d4466ec85e";
-      sha256 = "1ny56csbrk2kzfqr9a3m858j4vi4iwpmx8w71fr9k6ncychk9pip";
+      rev = "ee7f528702bc7199f322b605cca76a2ae34717c9";
+      sha256 = "0r7lyjmx238qdnlflwqw95q6j40spa0fvykh9pc0vaxjj1xiqymv";
     };
     meta.homepage = "https://github.com/jackMort/ChatGPT.nvim/";
   };
@@ -65,12 +65,12 @@ final: prev:
 
   Coqtail = buildVimPluginFrom2Nix {
     pname = "Coqtail";
-    version = "2023-01-27";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "whonore";
       repo = "Coqtail";
-      rev = "564a64651578164b5c7f2503e306bc436beb88da";
-      sha256 = "151w10p8w7ml9v7h18y3zzgbr48ffpxsxj3lnxl8lm44dab76qp1";
+      rev = "9aefe2af9230e8e5aa43ed1faade069da0721b66";
+      sha256 = "0pl7qnzxxnzlyzvjwa0p828wx1m69b3qmixdzl18ix4c3g1wakf4";
     };
     meta.homepage = "https://github.com/whonore/Coqtail/";
   };
@@ -173,12 +173,12 @@ final: prev:
 
   LeaderF = buildVimPluginFrom2Nix {
     pname = "LeaderF";
-    version = "2022-12-18";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "Yggdroot";
       repo = "LeaderF";
-      rev = "43433aa8dad1601acf923d3c25fa3325799508aa";
-      sha256 = "111nhw85v6hkyjzfs8jx566s44i89mihvlcnwdgwc08pnmnm7fci";
+      rev = "e48b140fb9132cc26cc82c7464e473b8f0af65db";
+      sha256 = "17wkfx268j2lpwirw70fb6j4x8b96j9zsv36d3sbcz7dw1d68xqq";
     };
     meta.homepage = "https://github.com/Yggdroot/LeaderF/";
   };
@@ -257,12 +257,12 @@ final: prev:
 
   Recover-vim = buildVimPluginFrom2Nix {
     pname = "Recover.vim";
-    version = "2015-08-14";
+    version = "2022-09-07";
     src = fetchFromGitHub {
       owner = "chrisbra";
       repo = "Recover.vim";
-      rev = "efa491f6121f65e025f42d79a93081abb8db69d4";
-      sha256 = "17szim82bwnhf9q4n0n4jfmqkmhq6p0lh0j4y77a2x6lkn0pns5s";
+      rev = "e61319bce3cd1004e5b695933296d8f267dd65a3";
+      sha256 = "0hnww4a0vffgpj72qdhhsr28xdh219haldr6jd6my8mqy1rg3yq4";
     };
     meta.homepage = "https://github.com/chrisbra/Recover.vim/";
   };
@@ -293,12 +293,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPluginFrom2Nix {
     pname = "SchemaStore.nvim";
-    version = "2023-02-04";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "5c5723bd464fd048f5d62fcf20c41495d3386a33";
-      sha256 = "1vpay869faixkxpvxlwpk44pidjgnrhkchnchfsbd6c2brhgzz11";
+      rev = "b37874a63ceac681a15b83d5c8e67f58fe571341";
+      sha256 = "0s7r600g9g8zkrjglapargsgda4pss5s4wdj7jsfa1a84825iisp";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -449,12 +449,12 @@ final: prev:
 
   YouCompleteMe = buildVimPluginFrom2Nix {
     pname = "YouCompleteMe";
-    version = "2023-01-17";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "ycm-core";
       repo = "YouCompleteMe";
-      rev = "50379d35ddc38ee3651f568d080442d5e4cb4a3a";
-      sha256 = "0s830zxirqbw880xv7ddza8m988i4ljrd4vgdk1yxaifid2zx8yg";
+      rev = "9a5eb4443e8a990698daa99da512d0fd7aed0f32";
+      sha256 = "1fazaiax65fgijm1i5k6n0zazbwhr35bwlagafcv5l4hydrxidqx";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/ycm-core/YouCompleteMe/";
@@ -498,12 +498,12 @@ final: prev:
 
   aerial-nvim = buildVimPluginFrom2Nix {
     pname = "aerial.nvim";
-    version = "2023-02-03";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "aerial.nvim";
-      rev = "4428a478e70f6a6b52e86d16ced677020267f409";
-      sha256 = "18dvm2k6h0xvzhf6wr317b9j85qq46gkh2scxmi8b20p8d3kfi52";
+      rev = "a467e9a06aa92db81812f4c2c26364877bbafb80";
+      sha256 = "0r746hlr1y50fn7g6161mpk1nnbi21q5n1wv3f7h2hi3kfc86l4x";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/aerial.nvim/";
@@ -559,12 +559,12 @@ final: prev:
 
   ale = buildVimPluginFrom2Nix {
     pname = "ale";
-    version = "2023-02-03";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "45a3e3f574172028338de70ce8f8f606dec0a1b0";
-      sha256 = "0xyglfdqr8bq4s5mqq7wvj8czl1n9pgs16368q2zjj9j35x6m8xr";
+      rev = "f78e9d634f9c1177031d4bdeda93f98d63b6bc12";
+      sha256 = "15bpbm0w9crw8pgxfynlvp9ccqzbjibgk4p1pj5fix7vzlhchh2w";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
   };
@@ -583,12 +583,12 @@ final: prev:
 
   alpha-nvim = buildVimPluginFrom2Nix {
     pname = "alpha-nvim";
-    version = "2022-11-29";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "goolord";
       repo = "alpha-nvim";
-      rev = "21a0f2520ad3a7c32c0822f943368dc063a569fb";
-      sha256 = "1s9ywy69kap0gngpm5xnfkwlrb2apci9xv2ahs2xhhkjncqm38mq";
+      rev = "1c903fd40b1d51e7740b4d90e9f18e83f2916586";
+      sha256 = "1lnmik6853akgxqpadgz6wclfwgmcsj84zi91yycfxkri52mbizy";
     };
     meta.homepage = "https://github.com/goolord/alpha-nvim/";
   };
@@ -727,12 +727,12 @@ final: prev:
 
   aurora = buildVimPluginFrom2Nix {
     pname = "aurora";
-    version = "2023-02-04";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "aurora";
-      rev = "f7b2df980aa0518a1a208974dfcbc51ff91b531e";
-      sha256 = "1d0p7d7kicqy4bbh3kaxn9as71afjljp38lhcc595l2b8nlaf2hc";
+      rev = "624d065f1c3f88438839dba79b995bc858a4642a";
+      sha256 = "01y84kzfjnjrd34m9j9gx5d0gj7sd2vby5vmpiddh9skz8pb26f6";
     };
     meta.homepage = "https://github.com/ray-x/aurora/";
   };
@@ -775,12 +775,12 @@ final: prev:
 
   auto-session = buildVimPluginFrom2Nix {
     pname = "auto-session";
-    version = "2022-12-13";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "rmagatti";
       repo = "auto-session";
-      rev = "c8b2f4048f846387361bd04cc185bf1aa7d2e3d1";
-      sha256 = "0z02981n9gd5migx774cs4gnwpq9ksd4ava53f4xn973gc8jf4jn";
+      rev = "04ccdac802200ecc363b251cf922b2b022bb515c";
+      sha256 = "02xvdvy0jakpbgkp33ll21rcqpiybngwgxjsvvw6wg4wqg8dzykv";
     };
     meta.homepage = "https://github.com/rmagatti/auto-session/";
   };
@@ -847,24 +847,24 @@ final: prev:
 
   barbar-nvim = buildVimPluginFrom2Nix {
     pname = "barbar.nvim";
-    version = "2023-01-30";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "romgrk";
       repo = "barbar.nvim";
-      rev = "065c6d792a2a3aaf67a754ccd46800c8d1964812";
-      sha256 = "1y04sfcnzw4hnygbgg91bfsn7jas5xbcsxrhp7766whd22rl6dsh";
+      rev = "2d53f49c21327da48f0447841027848f49e1fea4";
+      sha256 = "1fm845zjw08pzcql7ikk8qz87wrffl4w2jwgqvrqx5207qlafcbn";
     };
     meta.homepage = "https://github.com/romgrk/barbar.nvim/";
   };
 
   barbecue-nvim = buildVimPluginFrom2Nix {
     pname = "barbecue.nvim";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "utilyre";
       repo = "barbecue.nvim";
-      rev = "572e4070d1f26ce7252570823598a656e828a9ec";
-      sha256 = "0k8mh345m8xxmss04zwscmpyfwxsa8pwd8pjklgv8njgxr5hk1hr";
+      rev = "f616376a453c32489e594e0bc71916d314baeaf8";
+      sha256 = "1hpfvvadxhf6njr186y1nk0b5czfkd3igdrn89vp9vxjjbqyi1ik";
     };
     meta.homepage = "https://github.com/utilyre/barbecue.nvim/";
   };
@@ -919,12 +919,12 @@ final: prev:
 
   better-escape-nvim = buildVimPluginFrom2Nix {
     pname = "better-escape.nvim";
-    version = "2023-01-09";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "max397574";
       repo = "better-escape.nvim";
-      rev = "6fed33809cde3b416087fc540ad9eb17ec470193";
-      sha256 = "1wqps75qkr7rqdvrsn6f8m02nkqap9g6cca1jqf53y9476jsbml7";
+      rev = "5cd64c0afb82688748d415710d0187df5bdb96f9";
+      sha256 = "0l7nrvk9v1ky0nx1raxmp1ah1qh54glwg18grv6mdg4iksd27kib";
     };
     meta.homepage = "https://github.com/max397574/better-escape.nvim/";
   };
@@ -1027,12 +1027,12 @@ final: prev:
 
   bufferline-nvim = buildVimPluginFrom2Nix {
     pname = "bufferline.nvim";
-    version = "2022-12-24";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "bufferline.nvim";
-      rev = "c7492a76ce8218e3335f027af44930576b561013";
-      sha256 = "18vfx8mq2gsv2hqy0c0vgbmx5mhr63bb8ixrmzmjgvbx2djz1jdb";
+      rev = "84b0822b2af478d0b4f7b0f9249ca218855331db";
+      sha256 = "0q6y91wpg0znzmr188hk20llaz6cdpbsw0fiazacfj0y5pkgid6w";
     };
     meta.homepage = "https://github.com/akinsho/bufferline.nvim/";
   };
@@ -1051,12 +1051,12 @@ final: prev:
 
   calendar-vim = buildVimPluginFrom2Nix {
     pname = "calendar.vim";
-    version = "2023-02-02";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "itchyny";
       repo = "calendar.vim";
-      rev = "6004885c90fd0239b84ce242babbcfe7cd379535";
-      sha256 = "0avpcl9y718xldlhc6ip8hq6y6wp50k4hqdfrm3zg1z6l7iladwh";
+      rev = "691d7d9eeed574bbc6ee70bf5329ccb55a5e1f81";
+      sha256 = "0mkcyaxzfjbzm7lnkfv2wwy5wg1jaaalfdnzng7q47yld4gabijn";
     };
     meta.homepage = "https://github.com/itchyny/calendar.vim/";
   };
@@ -1231,12 +1231,12 @@ final: prev:
 
   cmp-clippy = buildVimPluginFrom2Nix {
     pname = "cmp-clippy";
-    version = "2021-10-24";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "vappolinario";
       repo = "cmp-clippy";
-      rev = "9f8dd021f7b9326407a439105b0c646983191a49";
-      sha256 = "02k0zwjbd98f76f3v46lvd8wfm8wibkh703g8vxr26yv1fwghs4n";
+      rev = "eb501c9fa429c5852f8f420e71a9f565f4852c8f";
+      sha256 = "1l07fvfc37sp531rjzpajf90dprcnylrkj9prr6qrgr1xlxqsvwh";
     };
     meta.homepage = "https://github.com/vappolinario/cmp-clippy/";
   };
@@ -1315,12 +1315,12 @@ final: prev:
 
   cmp-dictionary = buildVimPluginFrom2Nix {
     pname = "cmp-dictionary";
-    version = "2023-02-04";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "uga-rosa";
       repo = "cmp-dictionary";
-      rev = "5662ec89119c49a806b77b5df7517017abe47f8e";
-      sha256 = "0md3msnkyw2dgkpgp12iskrdv7p4sywmdg4ifdmbcl56qn1dv5zr";
+      rev = "26522d209f5661c94f3a8bad8145160983d2252b";
+      sha256 = "12iqfbcrwh2bq9p8pxv7fwivfb07jvrvhqwal1kydfhwhzfxiswl";
     };
     meta.homepage = "https://github.com/uga-rosa/cmp-dictionary/";
   };
@@ -1387,12 +1387,12 @@ final: prev:
 
   cmp-git = buildVimPluginFrom2Nix {
     pname = "cmp-git";
-    version = "2023-01-09";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "petertriho";
       repo = "cmp-git";
-      rev = "6bcb61c0a5ec2e0d522ece7c8fb3e009f1c79261";
-      sha256 = "0n00apdpm920hjddmyhzynqxzdqz1scmqays9p4c4b6dq06jblbr";
+      rev = "414e6aefbc0f416ad1c83e5417455a861159e3b8";
+      sha256 = "0ps4fsv98g2j98lx1dgx2g2d0znxk9ibs5pwv8bpy0v2ggdvfpg5";
     };
     meta.homepage = "https://github.com/petertriho/cmp-git/";
   };
@@ -1459,12 +1459,12 @@ final: prev:
 
   cmp-nvim-lsp = buildVimPluginFrom2Nix {
     pname = "cmp-nvim-lsp";
-    version = "2022-11-16";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "cmp-nvim-lsp";
-      rev = "59224771f91b86d1de12570b4070fe4ad7cd1eeb";
-      sha256 = "1m8xs7fznf4kk6d96f2fxgwd7i5scd04pfy2s4qsb5gzh7q2ka9j";
+      rev = "0e6b2ed705ddcff9738ec4ea838141654f12eeef";
+      sha256 = "0gpwwc3rhfckaava83hpl7pw4rspicblxs7hy3y57gb560ymq6hg";
     };
     meta.homepage = "https://github.com/hrsh7th/cmp-nvim-lsp/";
   };
@@ -1759,12 +1759,12 @@ final: prev:
 
   coc-lua = buildVimPluginFrom2Nix {
     pname = "coc-lua";
-    version = "2023-02-04";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "josa42";
       repo = "coc-lua";
-      rev = "9f702344b9550800e9ca928cd21fd6dcc8dffaef";
-      sha256 = "10s0nqhybry6m6p13gvmchmc6in7zn7pgi1930svy7czqblcg6rw";
+      rev = "3a4f4ebfdc4f22aeec7dc1e2a10c5376c08b3c8e";
+      sha256 = "1n48shihdhm73mrcg10px9mmlmf9kkjaskvv98d4s67ws223xdfy";
     };
     meta.homepage = "https://github.com/josa42/coc-lua/";
   };
@@ -1963,12 +1963,12 @@ final: prev:
 
   compiler-explorer-nvim = buildVimPluginFrom2Nix {
     pname = "compiler-explorer.nvim";
-    version = "2023-01-25";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "krady21";
       repo = "compiler-explorer.nvim";
-      rev = "1528b525d17a98dfc6f7b07aa28672106df9cde7";
-      sha256 = "1mv844ijirg9vv8klphrdka3qyji9hvgfqcwf2v2a3c4h2vd78rf";
+      rev = "26009c1d6265a6b6e86d8e74a81a235892f67e87";
+      sha256 = "0g2b0mxssx6sjmn2iqlipwj50jmw8hfq648xcg3f78phmn03b4s4";
     };
     meta.homepage = "https://github.com/krady21/compiler-explorer.nvim/";
   };
@@ -2095,12 +2095,12 @@ final: prev:
 
   copilot-lua = buildVimPluginFrom2Nix {
     pname = "copilot.lua";
-    version = "2023-02-02";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "zbirenbaum";
       repo = "copilot.lua";
-      rev = "a54e7b11a2c6efc9ddd3f42e56cf7d9eed1a9683";
-      sha256 = "05bpgrq11zcp9flqp0gm0xjcaq622z46yjxlf6iliv8a4pmbrbgr";
+      rev = "a998e15d4221e5189958c8c9366045a6e53431cc";
+      sha256 = "0xkzpvhfbsr7f037ipbqqjr5pxwkjkqzpj8fwkz8sfr24pljl5dv";
     };
     meta.homepage = "https://github.com/zbirenbaum/copilot.lua/";
   };
@@ -2119,24 +2119,24 @@ final: prev:
 
   coq-artifacts = buildVimPluginFrom2Nix {
     pname = "coq.artifacts";
-    version = "2023-01-29";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.artifacts";
-      rev = "53513efa7cc878ae7929ec6a389028effa569441";
-      sha256 = "0syix30ag4fda8hzpraijm0v6s64gr4vwz4i9c3lvcwssd4q6dfw";
+      rev = "6acfe02d3b8057ed9ed5bbd02b1ecc426eb9d97d";
+      sha256 = "16rmmmh34y2pz1iwk8mnk88vs5cdqrm0sw52fnsmg5r82wy1i7y7";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.artifacts/";
   };
 
   coq-thirdparty = buildVimPluginFrom2Nix {
     pname = "coq.thirdparty";
-    version = "2023-01-29";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.thirdparty";
-      rev = "5b9fb4da049d48a1e8872f92c180a3646f610a14";
-      sha256 = "0bplxcdv3yxls893myc6a6kpq01wfypw2sgnd61pc8k78xkhmdps";
+      rev = "0b93c482acfc0bcdd760ff431b4d338e19395776";
+      sha256 = "0hns2zvxlxd9wpdkr5cvcgzms6vkcw3h9p8ck1zj6msh0w1pmg67";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
   };
@@ -2155,12 +2155,12 @@ final: prev:
 
   coq_nvim = buildVimPluginFrom2Nix {
     pname = "coq_nvim";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "d11f4eb12d73c5dcf5d6691378b18447446ec919";
-      sha256 = "08kkp57k4138cb4jgv3q3x3h2qx7f29kr914lzqzrb7q4ybzm6b8";
+      rev = "49189b020236002bae41f823da9ac0f73dca873f";
+      sha256 = "17rmg7b9ibx1d8bb8s9r9zxqxxh206hkb5avykrdbngrg1sy64y6";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
   };
@@ -2191,12 +2191,12 @@ final: prev:
 
   crates-nvim = buildVimPluginFrom2Nix {
     pname = "crates.nvim";
-    version = "2023-02-02";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "saecki";
       repo = "crates.nvim";
-      rev = "1bca9122ddc4bf4c6573402bf6686fc084470a7e";
-      sha256 = "0isvyph3lpqpijxpfj5rjfh1w1mh3629jpyahy5sj2g8hn46mj08";
+      rev = "3fc7ddac13ddf65914a733ef074317c4c72ef05b";
+      sha256 = "1gyhh32v40c9cndyg3jxpyhaaxh392xl93la3aplpl4xwaphhzbv";
     };
     meta.homepage = "https://github.com/saecki/crates.nvim/";
   };
@@ -2299,12 +2299,12 @@ final: prev:
 
   dashboard-nvim = buildVimPluginFrom2Nix {
     pname = "dashboard-nvim";
-    version = "2023-02-04";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "glepnir";
       repo = "dashboard-nvim";
-      rev = "d69d20170e12a20fa305e90870d6016e636cc328";
-      sha256 = "18i9rjjv7g5hr1gyb98w3mh50m1iwk643rb93z1n7f38ln55xzw8";
+      rev = "3af6176d41cad32ffc63d026bf522d6135b53a3b";
+      sha256 = "12lbparhv65b1cj3a9gx6pg475mc2kcl1ql61v0774vsiah6p7p1";
     };
     meta.homepage = "https://github.com/glepnir/dashboard-nvim/";
   };
@@ -2685,12 +2685,12 @@ final: prev:
 
   diffview-nvim = buildVimPluginFrom2Nix {
     pname = "diffview.nvim";
-    version = "2023-01-30";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "sindrets";
       repo = "diffview.nvim";
-      rev = "ab3757c1ea1b84ef59f7dda54f11d10022e0e3b7";
-      sha256 = "1rbcf3llcq542533l0cxqf3bwnzk99x76k9yclfdy12zfdcjx4fv";
+      rev = "11827d46e939b4748dbdb7e0df4982a63bd59d26";
+      sha256 = "101l5v8a0ya7cz230rd85gwc06b4hxnilbydf0zcxy85dq5j8wq7";
     };
     meta.homepage = "https://github.com/sindrets/diffview.nvim/";
   };
@@ -2733,24 +2733,24 @@ final: prev:
 
   dracula-nvim = buildVimPluginFrom2Nix {
     pname = "dracula.nvim";
-    version = "2023-01-19";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "Mofiqul";
       repo = "dracula.nvim";
-      rev = "a0b129d7dea51b317fa8064f13b29f68004839c4";
-      sha256 = "0q7ly95hp123z9z8qh4sih5a53dnbxv0jxa80b1s7d6h1wpr2w5j";
+      rev = "798274ba3c454a9aa3cd71f95a86ea55cbbbb142";
+      sha256 = "156g08ab9jghi580b1k88si3bc6h72d77avlpn34dnnn5481anvh";
     };
     meta.homepage = "https://github.com/Mofiqul/dracula.nvim/";
   };
 
   dressing-nvim = buildVimPluginFrom2Nix {
     pname = "dressing.nvim";
-    version = "2022-12-13";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "dressing.nvim";
-      rev = "4436d6f41e2f6b8ada57588acd1a9f8b3d21453c";
-      sha256 = "1iwxqfqp3x09wz3rnvli3y80n38rw149cmjj9pmbkhiqgsm9p461";
+      rev = "db716a0f1279f79a886c0e0b6ab3c3d5ffdb42fe";
+      sha256 = "00k2gpmikkp2bcpg8jg6pcjwvd806garficbjiv2k9ibzpbvc4xl";
     };
     meta.homepage = "https://github.com/stevearc/dressing.nvim/";
   };
@@ -2781,12 +2781,12 @@ final: prev:
 
   editorconfig-vim = buildVimPluginFrom2Nix {
     pname = "editorconfig-vim";
-    version = "2023-01-25";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "editorconfig";
       repo = "editorconfig-vim";
-      rev = "ee6e91ca09d59043d365bd96a32e989bd75abe84";
-      sha256 = "068af4iznkvkafxnyj54clwalmzcywlfxphlzas4psg6qxzcdj13";
+      rev = "1d54632f7fcad38df8e428f349bc58b15af4b206";
+      sha256 = "1692rzbv64332wi0cmyf0g5m8k039vvrijxmryrqnxaf15493mbw";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/editorconfig/editorconfig-vim/";
@@ -2939,12 +2939,12 @@ final: prev:
 
   fern-vim = buildVimPluginFrom2Nix {
     pname = "fern.vim";
-    version = "2023-01-15";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "lambdalisue";
       repo = "fern.vim";
-      rev = "4841c8830f0354808952fd4f64869383413c194f";
-      sha256 = "0jmv0wqx0234dz0xlqjf1rhn7y4hnd4vxxqfr0f166nz678fld05";
+      rev = "1856f0390b1ae15d446b94dc47ccf5b967537ad1";
+      sha256 = "06c54lhn30ibn721l6vh5gx4kdyrk39w2kkcwrlhskpx6dipava5";
     };
     meta.homepage = "https://github.com/lambdalisue/fern.vim/";
   };
@@ -2963,12 +2963,12 @@ final: prev:
 
   fidget-nvim = buildVimPluginFrom2Nix {
     pname = "fidget.nvim";
-    version = "2022-11-27";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "j-hui";
       repo = "fidget.nvim";
-      rev = "44585a0c0085765195e6961c15529ba6c5a2a13b";
-      sha256 = "112mjmy2nrqwj3l9dp3gzxsygaidcdrz2l6vzn27k1a57a7jyb8l";
+      rev = "9dc6d15fdb877b2fb09ea0ba2dfde9beccb5965a";
+      sha256 = "1xgb6ichs52qlzks3rlwx1v03q1yh2phl9papwd0h71mmns0plb1";
     };
     meta.homepage = "https://github.com/j-hui/fidget.nvim/";
   };
@@ -2987,12 +2987,12 @@ final: prev:
 
   firenvim = buildVimPluginFrom2Nix {
     pname = "firenvim";
-    version = "2023-01-31";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "glacambre";
       repo = "firenvim";
-      rev = "35b34ba566d9d9f6761cde3574f668d505c5137f";
-      sha256 = "06lrhk7xladf9vf5d3qk06ffh4fw3s1wzpckwrk285lqz3mqc2gm";
+      rev = "2ff7e2df6b1ffe8935d24ae90f5c173ea4cd8b1b";
+      sha256 = "049jfhbbn899xahidgx2qwca98140wiymw678x6930b0cvf16w0r";
     };
     meta.homepage = "https://github.com/glacambre/firenvim/";
   };
@@ -3060,12 +3060,12 @@ final: prev:
 
   flutter-tools-nvim = buildVimPluginFrom2Nix {
     pname = "flutter-tools.nvim";
-    version = "2023-02-02";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "flutter-tools.nvim";
-      rev = "f84836a906fac21e9fb096ce15478051cd7df589";
-      sha256 = "1j725v2cf9k1dlxnpmzcz1ys7v9iyj0vyvjw9bkmjvy17hqcrxaw";
+      rev = "d67caa7dd17eccb89bfda1c0657d0723e339ef60";
+      sha256 = "1rgl6kaa0rv7hx6fslrmm8glw9gfpl7yqpf31zj5lazw82k5wk1c";
     };
     meta.homepage = "https://github.com/akinsho/flutter-tools.nvim/";
   };
@@ -3096,12 +3096,12 @@ final: prev:
 
   friendly-snippets = buildVimPluginFrom2Nix {
     pname = "friendly-snippets";
-    version = "2023-01-26";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "a6f7a1609addb4e57daa6bedc300f77f8d225ab7";
-      sha256 = "1rw4r8g4hblmlddbddd5skf5x8i4zaba8ncmzbr26svdmayk1c16";
+      rev = "1645e7cd98ed99e766c84ab3cf13a1612c77dcee";
+      sha256 = "13zvkv7vnfrj0xs31s1gv74amxpdyvc2m2x8br58vxfscy3wbaa4";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
   };
@@ -3204,12 +3204,12 @@ final: prev:
 
   fzf-lua = buildVimPluginFrom2Nix {
     pname = "fzf-lua";
-    version = "2023-02-02";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "ibhagwan";
       repo = "fzf-lua";
-      rev = "5ad5771eb77d233ec7a4352240d2780dde8034d1";
-      sha256 = "0fkwsi9f2qymgavfpgxzrbga1z0z0024sri1wslsp66g1512x92f";
+      rev = "f4fe61067e20c7fb7ffc83c849d638dbdc38a2af";
+      sha256 = "0jvrac6m0wcn114a4gqyxrag90ivbdffypjdpf19qyqlykicpk6y";
     };
     meta.homepage = "https://github.com/ibhagwan/fzf-lua/";
   };
@@ -3252,12 +3252,12 @@ final: prev:
 
   gentoo-syntax = buildVimPluginFrom2Nix {
     pname = "gentoo-syntax";
-    version = "2023-02-01";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "gentoo";
       repo = "gentoo-syntax";
-      rev = "8abf42d2035374df1c87cb1b26039393c807ddd5";
-      sha256 = "1vka4b9qs54wrs2wzk8msbpadc01wc5b1py0zng8hq67dplcg9yx";
+      rev = "8340095e5a8263494abadf5a81970ff92091e004";
+      sha256 = "0glp8nnj9jsps465srn59bdc6g5pnyrs3n9kxghp0wzf8hrx2zic";
     };
     meta.homepage = "https://github.com/gentoo/gentoo-syntax/";
   };
@@ -3300,12 +3300,12 @@ final: prev:
 
   git-blame-nvim = buildVimPluginFrom2Nix {
     pname = "git-blame.nvim";
-    version = "2023-01-14";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "f-person";
       repo = "git-blame.nvim";
-      rev = "5ddf157139ecfc0d2161f00c2cce4874578dc355";
-      sha256 = "0d4caahrnqgy06mvqvxhhcr2li2hvk44hwqvw9dkxh9g6hyfjj87";
+      rev = "17840d01f42ee308e1dbbcc2cde991297aee36c9";
+      sha256 = "1ldc2lnabz5hr18xgiwrr83w93rnqidhycwkkhi4bc0hmabacsix";
     };
     meta.homepage = "https://github.com/f-person/git-blame.nvim/";
   };
@@ -3360,12 +3360,12 @@ final: prev:
 
   gitsigns-nvim = buildNeovimPluginFrom2Nix {
     pname = "gitsigns.nvim";
-    version = "2023-02-03";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "gitsigns.nvim";
-      rev = "ec4742a7eebf68bec663041d359b95637242b5c3";
-      sha256 = "18bwp15m2v4mrxp9i2vz061cfpv3ah08c8il3fx24aqhfbmaq6lz";
+      rev = "f29f0b22fd66c910b892aae3bc18a4872c002738";
+      sha256 = "0cizfyivvfgv72wxw543l6h2giais7bsgmvxrpcks8zmgmvlq0zq";
     };
     meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
   };
@@ -3384,12 +3384,12 @@ final: prev:
 
   glance-nvim = buildVimPluginFrom2Nix {
     pname = "glance.nvim";
-    version = "2023-01-30";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "DNLHC";
       repo = "glance.nvim";
-      rev = "3b7fbbe4e785bedbdaa1a9573dcd800261a7e32b";
-      sha256 = "09jcq6315njcw0khasnv41vi0lscbxk07cajzxqbm5pgjzww26fq";
+      rev = "7a0ad2d169b5a76734e9ba6cb7774e76cdd948dd";
+      sha256 = "0scn5jrqjdaigxfxif48andfa4frp9csy2ijsbm708bxw67myxm1";
     };
     meta.homepage = "https://github.com/DNLHC/glance.nvim/";
   };
@@ -3408,12 +3408,12 @@ final: prev:
 
   glow-nvim = buildVimPluginFrom2Nix {
     pname = "glow.nvim";
-    version = "2023-01-29";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "ellisonleao";
       repo = "glow.nvim";
-      rev = "c87b1120b618577e64d910a7493a26829044a8a2";
-      sha256 = "1i5d249jga0slnwnk6as1zqlc03x8nxd0vbrxr43qg6vw322sj7k";
+      rev = "2bb4afb6e9dbc93993a1d7d4168dac08c74590ac";
+      sha256 = "0k6wrlzn5i7c1gfhs077aivvgy1qbjrjr79j1m6y3n8jgdzk1f6z";
     };
     meta.homepage = "https://github.com/ellisonleao/glow.nvim/";
   };
@@ -3540,12 +3540,12 @@ final: prev:
 
   gruvbox-nvim = buildVimPluginFrom2Nix {
     pname = "gruvbox.nvim";
-    version = "2023-01-26";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "ellisonleao";
       repo = "gruvbox.nvim";
-      rev = "2e93ac50b3e95d650e62729f8810a005861e77ad";
-      sha256 = "0ahgpgjazrwsvqpvsgbgwzhiglzb291d1ww20f8grakdhppvas3h";
+      rev = "73f009df5ed929a853244c413bb52c1d02c117ce";
+      sha256 = "1q8lxhw9fcvgx6km4l32571c2qq7fid460h69c8j4wxz3a16y1n4";
     };
     meta.homepage = "https://github.com/ellisonleao/gruvbox.nvim/";
   };
@@ -3588,11 +3588,11 @@ final: prev:
 
   hare-vim = buildVimPluginFrom2Nix {
     pname = "hare.vim";
-    version = "2023-01-30";
+    version = "2023-02-10";
     src = fetchgit {
       url = "https://git.sr.ht/~sircmpwn/hare.vim";
-      rev = "92e8a80edc11ad5df6fdcfccee567515027682eb";
-      sha256 = "10fl95n5c2yk8v00hr4r4zbbi4rrdhbz6jg7r86d8jw6qjxl6c1b";
+      rev = "75874719e1aee0171a0f06d1508ff9a116f6ac75";
+      sha256 = "0n2rh59nnp0fv4jxvx30arrrqpfbagix6a94rxq3100n8kszr218";
     };
     meta.homepage = "https://git.sr.ht/~sircmpwn/hare.vim";
   };
@@ -3611,12 +3611,12 @@ final: prev:
 
   haskell-tools-nvim = buildVimPluginFrom2Nix {
     pname = "haskell-tools.nvim";
-    version = "2023-02-03";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "03dfa7fa3d08a34cdef09ca05a6da166a1ba22a2";
-      sha256 = "166ar0qy3pl2jvw7y6im7v7gmrsji44ph1aahxqdpgbf170xx6pa";
+      rev = "f676cfd95f76db50d746a3ab863b4d0dda0a55df";
+      sha256 = "1f25cdk47qmg4pf16s6mnrcscg5cb945hxr9hsiwy2hik2b05ygs";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -3683,11 +3683,11 @@ final: prev:
 
   himalaya-vim = buildVimPluginFrom2Nix {
     pname = "himalaya-vim";
-    version = "2022-10-09";
+    version = "2023-02-09";
     src = fetchgit {
       url = "https://git.sr.ht/~soywod/himalaya-vim";
-      rev = "747ff2a6055839cb5b403b540883515af37b7117";
-      sha256 = "05d8nfzqp96s05agj4fd5r2fckdsxacl0qvlk9dhxz4dh8kgsqyi";
+      rev = "a2fdf319dbdf0fda1b2f27c706f96a13b8077e58";
+      sha256 = "1bw399danjzprixd4mnrmsr3idspm2d7a9hkfpy4xra97hfnalii";
     };
     meta.homepage = "https://git.sr.ht/~soywod/himalaya-vim";
   };
@@ -3766,12 +3766,12 @@ final: prev:
 
   hydra-nvim = buildVimPluginFrom2Nix {
     pname = "hydra.nvim";
-    version = "2023-01-16";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "anuvyklack";
       repo = "hydra.nvim";
-      rev = "d00274f05363c13f29ed1fa571026a066a634cce";
-      sha256 = "1scf9pmwch081l2rvfm0np6cjd4kj3kzpzkjlbc7zjw4gbbrbr9s";
+      rev = "3ced42c0b6a6c85583ff0f221635a7f4c1ab0dd0";
+      sha256 = "1dwhi2543drbncrqx80nsi5hw48d6my4wbsp71gx6m0clkp4469h";
     };
     meta.homepage = "https://github.com/anuvyklack/hydra.nvim/";
   };
@@ -4175,12 +4175,12 @@ final: prev:
 
   lazy-nvim = buildVimPluginFrom2Nix {
     pname = "lazy.nvim";
-    version = "2023-02-01";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "lazy.nvim";
-      rev = "3d2dcb2d5ef99106c5ff412da88c6f59a9f8a693";
-      sha256 = "0gac6zw7zp53szjd8rfhb5ysgnhrsn01gb759pczmkayp2b2x4fd";
+      rev = "06f835d0b4b62d9d26fe0ec4190b981f2f5632d2";
+      sha256 = "0lm68yim0af06im3sd9lpmj7k5v333m5sd3wva35pdh0lr0l3q7f";
     };
     meta.homepage = "https://github.com/folke/lazy.nvim/";
   };
@@ -4235,12 +4235,12 @@ final: prev:
 
   leap-nvim = buildVimPluginFrom2Nix {
     pname = "leap.nvim";
-    version = "2023-02-04";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "leap.nvim";
-      rev = "f565a9c4d92245d8b619235bebeaa73cc38aa40e";
-      sha256 = "1i40bi18wn7vg6mdcg0xp5zxk960lzj4kzda3syj51sv1pgdq802";
+      rev = "7140feed70a5911b8c8a7eb9c218d198772f69cf";
+      sha256 = "0k5g95nlawv3r9farc7qgfdbvyvsy3w3rfysjfhrc37jvdz5ykhv";
     };
     meta.homepage = "https://github.com/ggandor/leap.nvim/";
   };
@@ -4319,12 +4319,12 @@ final: prev:
 
   lh-vim-lib = buildVimPluginFrom2Nix {
     pname = "lh-vim-lib";
-    version = "2021-08-18";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "LucHermitte";
       repo = "lh-vim-lib";
-      rev = "aa8e8f270c1d3be4fbe6b153827a191a5fcaa0d7";
-      sha256 = "0lgpxgg2696pbfdgnr2zcapvhfk6d1qwvci223h69rvg0fh853rz";
+      rev = "02764e0e87f85fa13e0d6a0e38ac6605f806d560";
+      sha256 = "0d4hs4qh4fm393f1k6085l1f8yvqjpr2wdh7ia26k9839s4k2pn0";
     };
     meta.homepage = "https://github.com/LucHermitte/lh-vim-lib/";
   };
@@ -4547,12 +4547,12 @@ final: prev:
 
   lsp-overloads-nvim = buildVimPluginFrom2Nix {
     pname = "lsp-overloads.nvim";
-    version = "2022-12-04";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "Issafalcon";
       repo = "lsp-overloads.nvim";
-      rev = "12f5468781d2d1d3feb6ad7459de764fc33898fe";
-      sha256 = "1lxsg05qv87v2imhsfwa9mqfib4332cvhflivpzkamg1acs6bc9j";
+      rev = "d371137c6d2c942c1ad4fe400f536c2ebf0792bd";
+      sha256 = "184ybjs9c6xn6079i4gw411j06kxsmf3gqxz8c6rcj0hiv87wsn2";
     };
     meta.homepage = "https://github.com/Issafalcon/lsp-overloads.nvim/";
   };
@@ -4583,12 +4583,12 @@ final: prev:
 
   lsp-zero-nvim = buildVimPluginFrom2Nix {
     pname = "lsp-zero.nvim";
-    version = "2023-01-31";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "VonHeikemen";
       repo = "lsp-zero.nvim";
-      rev = "42bc5a1081666098a7154532e6ff5e3edc483b39";
-      sha256 = "1y6jv9sldap59466v8jivbd5w6xs31anr8iqg3zyapdmr6pwflck";
+      rev = "7a598977074f62ebe958d8f3e927084be486788b";
+      sha256 = "1sh1xvfh88nm61qd0kaa7vxxv4h4h7xba577br85rc7imwh002x7";
     };
     meta.homepage = "https://github.com/VonHeikemen/lsp-zero.nvim/";
   };
@@ -4690,12 +4690,12 @@ final: prev:
 
   luasnip = buildVimPluginFrom2Nix {
     pname = "luasnip";
-    version = "2023-02-02";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "d404ec306bfa4cdb0c3605dbb17e8a93a9597337";
-      sha256 = "1m6dmfplyln4xvc09srqxby93ksq1a62qai09j9msnd5pv4yqniy";
+      rev = "58fbfc627a93281a77f7d161d4ff702e639677b1";
+      sha256 = "0vxqy0m1kvd4xfadv6pmx9l9h2pjrk7dsr43av6nf6xn2yrr7sin";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
@@ -4763,12 +4763,12 @@ final: prev:
 
   mason-lspconfig-nvim = buildVimPluginFrom2Nix {
     pname = "mason-lspconfig.nvim";
-    version = "2023-01-31";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "williamboman";
       repo = "mason-lspconfig.nvim";
-      rev = "53f3a8bdcb77d4a95b082fd57e12173f353c6c3e";
-      sha256 = "0588rpf28fk922nmj44nl5m74a9762g2xx8y72b61k5iwpi2vp3h";
+      rev = "e2b82cf4c68b453eeab5833d90c042ed4b49d0e1";
+      sha256 = "0lyfqhf7w3d5chpl6rrigkd8a6r4y16sgzv0p3ihw0zgqfqfksmv";
     };
     meta.homepage = "https://github.com/williamboman/mason-lspconfig.nvim/";
   };
@@ -4787,12 +4787,12 @@ final: prev:
 
   mason-nvim = buildVimPluginFrom2Nix {
     pname = "mason.nvim";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "williamboman";
       repo = "mason.nvim";
-      rev = "9ec92c1945b11ba7e7e6730fd60fd44525f24a25";
-      sha256 = "0snf7j4x4cmwrw81bwm3fj8k07l8iriqwzc5c47bl2w94fpbynyc";
+      rev = "f557094c77c4fa91c3613cfbd22cbcdbe0569793";
+      sha256 = "1dw0lr0jhhsjqdml31qk7vkzw53myq838r3zhax1ifd1l40igihm";
     };
     meta.homepage = "https://github.com/williamboman/mason.nvim/";
   };
@@ -4823,12 +4823,12 @@ final: prev:
 
   material-vim = buildVimPluginFrom2Nix {
     pname = "material.vim";
-    version = "2023-01-12";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "kaicataldo";
       repo = "material.vim";
-      rev = "ec5a2cecee50ea2074e6f19bd1c98e7d868a52c7";
-      sha256 = "08s8k9nwnmyqzlpvfz2pp1j8dhip1syhkilrrzbj723xknclxyzf";
+      rev = "b47e7f884cb606c19a20e8e520dfa10c3b3a52f9";
+      sha256 = "1abhf71ap9cs03ibi3qm8lw8kdynb86x85didnhlhb673xg0kbcz";
     };
     meta.homepage = "https://github.com/kaicataldo/material.vim/";
   };
@@ -4859,12 +4859,12 @@ final: prev:
 
   mini-nvim = buildVimPluginFrom2Nix {
     pname = "mini.nvim";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "33e76b0c22465de03906ebd00c01b64a04e495b3";
-      sha256 = "0kxfwmvp7pgvqr6cqs6zf5dklq6n7vcgzr1dj435f8yg6zh90aah";
+      rev = "8a248b3b2cf26bf450299cd715b770668c6b5d2d";
+      sha256 = "1fndvikaqz8b9mh51b0l27k2gwll9ivk6krqqjiyn5rsc6rjchc5";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
@@ -5219,12 +5219,12 @@ final: prev:
 
   neoconf-nvim = buildVimPluginFrom2Nix {
     pname = "neoconf.nvim";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "de8dbd4ba6583619ed02323dbde737d586ba572f";
-      sha256 = "1ms7chmmilq8slf659m8d45i39pllgng7a95fc20ykwbakhi8m9b";
+      rev = "8067d2dc3196f1a7ad98b6e93e92ec52d01b0f48";
+      sha256 = "0r1l1bqdq97cc4691k83zg5k23qi87p61h5v4wfrxffvfpnhkgbd";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
   };
@@ -5243,12 +5243,12 @@ final: prev:
 
   neodev-nvim = buildVimPluginFrom2Nix {
     pname = "neodev.nvim";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "70cab52c9d19e982f306716534e90c37a254b046";
-      sha256 = "13xrc45s5fx8y2dl1ds155r5w0yrivq2b1aqvqjk7ywgyyq2wr5l";
+      rev = "1b21ea60f5b67946282b0b0312773e85fc6f9b05";
+      sha256 = "02crx7q6zwx1p6wjsbra7v0lbhi80mav2imys6klvabsz6246rlc";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
@@ -5339,12 +5339,12 @@ final: prev:
 
   neorg = buildVimPluginFrom2Nix {
     pname = "neorg";
-    version = "2023-02-04";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "ac8828369cb2a4b2e1e17e6b495645585ed2a37b";
-      sha256 = "1ljyzvk3ff876sp4idfqq3ziqm7c6wc63kii3nsvh9i4m0w5i5af";
+      rev = "9766bef893ec993af9408ea0d44a8f13adbd1e80";
+      sha256 = "0wjiy1z19wgqn2jk419cm5545i3mp75zl6sq1srr5bfv8scvls2q";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
@@ -5399,12 +5399,12 @@ final: prev:
 
   neotest = buildVimPluginFrom2Nix {
     pname = "neotest";
-    version = "2023-01-25";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "392808a91d6ee28d27cbfb93c9fd9781759b5d00";
-      sha256 = "03s8kkj386i77vryss1br3033azmbjhf4wzaqnrm9238951hls5w";
+      rev = "568feb5e9c7c5b7386886ecd4520389153aa7c7d";
+      sha256 = "1066pwyvl2b05qq3z4mszm1b1aipc6mifdcxy43p5fg4n4kc0gzh";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
@@ -5423,12 +5423,12 @@ final: prev:
 
   neovim-ayu = buildVimPluginFrom2Nix {
     pname = "neovim-ayu";
-    version = "2023-01-07";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "Shatur";
       repo = "neovim-ayu";
-      rev = "ba749799e48a8c5065106989eb8bf9915b51081d";
-      sha256 = "0xqdz4qb0sdb9g2hdgm5c2ry0m3ar78hyp0n93k92dwd1v575996";
+      rev = "0eb91afe11f1763a477655965684269a545012e1";
+      sha256 = "1nhayyl8lr22j0qrf64h1sjq9z650sxwgcqi8an1b6g6nhqwc329";
     };
     meta.homepage = "https://github.com/Shatur/neovim-ayu/";
   };
@@ -5471,12 +5471,12 @@ final: prev:
 
   nerdcommenter = buildVimPluginFrom2Nix {
     pname = "nerdcommenter";
-    version = "2023-01-27";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "nerdcommenter";
-      rev = "06f6166e5dfcf78eb0d055c21274cafc3927d461";
-      sha256 = "0h340y2v4bb1wfqa8015skd7yb694iwqgq3v42mqpcsa3ssnvh70";
+      rev = "d069f7fb562fb9eb6911fe23cda7aca2a387043e";
+      sha256 = "0ir2cghjcz3wr1sp1fzvdjnwqrjy82n3zlhrcz7cs41n8f2wich7";
     };
     meta.homepage = "https://github.com/preservim/nerdcommenter/";
   };
@@ -5579,12 +5579,12 @@ final: prev:
 
   nlsp-settings-nvim = buildVimPluginFrom2Nix {
     pname = "nlsp-settings.nvim";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "tamago324";
       repo = "nlsp-settings.nvim";
-      rev = "c2db6cfd687df2fba323ba31ad0d862d6129f62c";
-      sha256 = "0k7mhz2k05qwyrx9iyc9psjfshxzw8p1618fiyr7cck9aphzwqlf";
+      rev = "b84ec546206bb8a6c8b99b8ac5824879d1181a4b";
+      sha256 = "0yyb8kfkj32dkz19a6n105hs503ccwsc1ajbyb2rqpya717bi86j";
     };
     meta.homepage = "https://github.com/tamago324/nlsp-settings.nvim/";
   };
@@ -5615,12 +5615,12 @@ final: prev:
 
   noice-nvim = buildVimPluginFrom2Nix {
     pname = "noice.nvim";
-    version = "2023-01-29";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "noice.nvim";
-      rev = "34f7cf628666c6eb0c93fbe8a0490e977ac78b7b";
-      sha256 = "0nkk0zji3fdjzjhd5l2lmqb5208mkw08xkgvvxbddsjwgxx3jbg4";
+      rev = "d8a1f3056ad713b5d471048f8d029264828e22c0";
+      sha256 = "0m6058yy4bn66bdr47na91g4pnm27y3msr386hj0hss975iaicwq";
     };
     meta.homepage = "https://github.com/folke/noice.nvim/";
   };
@@ -5687,12 +5687,12 @@ final: prev:
 
   null-ls-nvim = buildVimPluginFrom2Nix {
     pname = "null-ls.nvim";
-    version = "2023-02-03";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "jose-elias-alvarez";
       repo = "null-ls.nvim";
-      rev = "8f5d730021497233c39d3adbf4b8043d4be163f8";
-      sha256 = "0isrsbba9clpjjx5z37p4d0s8fasd7gxr1gxxjsvgkp2yn7blvi0";
+      rev = "ab4e9261843236d773f49a23fcfb3d2167a3c500";
+      sha256 = "0lf0xiz0f9lnnix3ajdcczp2x1wd1316jaf0vbn5w2b8pmc32rgv";
     };
     meta.homepage = "https://github.com/jose-elias-alvarez/null-ls.nvim/";
   };
@@ -5747,12 +5747,12 @@ final: prev:
 
   nvim-autopairs = buildVimPluginFrom2Nix {
     pname = "nvim-autopairs";
-    version = "2023-01-30";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "5a3523ddb573804752de6c021c5cb82e267b79ca";
-      sha256 = "1s17rmxgnadz6wbcd21x8504ra8crbxf27qjdxh6b4a1g0w75hy1";
+      rev = "45ae3122a4c7744db41298b41f9f5a3f092123e6";
+      sha256 = "16zryzm0ng0f8zl13jpkhjmqya0rbs4vy2zdm9zhd2qsnnpbb6rh";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
@@ -5783,12 +5783,12 @@ final: prev:
 
   nvim-bqf = buildVimPluginFrom2Nix {
     pname = "nvim-bqf";
-    version = "2023-02-01";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-bqf";
-      rev = "da1cd2557a16386829a213330e0fd46b61db7632";
-      sha256 = "0ws45yilaq9kyssm5s1rj65k0xsiflg8fivjgggb3g3fvr6286p3";
+      rev = "7a278012efb0a12bc49ecc3e16ec5591c41fae88";
+      sha256 = "1wykg4d6rx6grfb69svwwhk7f28g2cf87bdb13pwlbxyl7cxw908";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-bqf/";
   };
@@ -5819,12 +5819,12 @@ final: prev:
 
   nvim-cmp = buildNeovimPluginFrom2Nix {
     pname = "nvim-cmp";
-    version = "2023-02-03";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "nvim-cmp";
-      rev = "cfafe0a1ca8933f7b7968a287d39904156f2c57d";
-      sha256 = "1qgvlvjwah6581vppsb8racgkfjpjx2xqbk2ji1fmczc3rsk80h6";
+      rev = "aae0c3e4e778ca4be6fabc52e388cbd5b844b7a5";
+      sha256 = "015liiv48dg1yangmfjvbnqiv8gkzl9b8y5c3f0x2ppax2a3hp8y";
     };
     meta.homepage = "https://github.com/hrsh7th/nvim-cmp/";
   };
@@ -5927,24 +5927,24 @@ final: prev:
 
   nvim-dap = buildVimPluginFrom2Nix {
     pname = "nvim-dap";
-    version = "2023-01-29";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "0e376f00e7fac143e29e1017d2ac2cc3df13d185";
-      sha256 = "0xdbvbah2zxy27irc4dn9kz7ga5jv88d0z5vsbdgnqpnvv7gzc1c";
+      rev = "401f5f22b2d7f9bdbb9294d0235136091458816a";
+      sha256 = "086vy7vfsvdjrfl0m45s7cz0lakvrynb3lyzyh9p04m5y0g5h5mz";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
 
   nvim-dap-go = buildVimPluginFrom2Nix {
     pname = "nvim-dap-go";
-    version = "2023-01-04";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "leoluz";
       repo = "nvim-dap-go";
-      rev = "6f045a72a05a78e4071dd0880f08214a2bb1461b";
-      sha256 = "153dxjwq93wg1079485hqpvq81mai1yzqjmc9qybda09zra5wlk9";
+      rev = "b4ded7de579b4e2a85c203388233b54bf1028816";
+      sha256 = "188w0n42gzvc4c1j6i5i48j60zxx9lrc3nq2z8ly0m7l6lc88vx9";
     };
     meta.homepage = "https://github.com/leoluz/nvim-dap-go/";
   };
@@ -5963,12 +5963,12 @@ final: prev:
 
   nvim-dap-ui = buildVimPluginFrom2Nix {
     pname = "nvim-dap-ui";
-    version = "2023-01-31";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "nvim-dap-ui";
-      rev = "885e958ff9de30cfbc359259eccf28cc493ad46b";
-      sha256 = "1j7nbrilk63vdmnr1dp3gdzhdpa2m001jzd6ch6i8j8dzjjnbyss";
+      rev = "100c67dd63c870819fb998fec4867b17d02db4b7";
+      sha256 = "1036psvcn28xm5phg4w4l2pkszjcpa7c5ma7ry9x82wy5844zf50";
     };
     meta.homepage = "https://github.com/rcarriga/nvim-dap-ui/";
   };
@@ -6095,24 +6095,24 @@ final: prev:
 
   nvim-jdtls = buildVimPluginFrom2Nix {
     pname = "nvim-jdtls";
-    version = "2023-02-02";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-jdtls";
-      rev = "1f640d14d17f20cfc63c1acc26a10f9466e66a75";
-      sha256 = "1cfl5cjjfcijdsnbh1f23vp3msjlpkvr81am6lpkhx5as2dfws67";
+      rev = "8fe3be1c08ab0bb55f2998fbc02f1a08f87a44bc";
+      sha256 = "08nkbwzby8j156n3s89aj3nbhy99pb0nkpdj3rqqvrbyqyia5jbn";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-jdtls/";
   };
 
   nvim-jqx = buildVimPluginFrom2Nix {
     pname = "nvim-jqx";
-    version = "2022-09-21";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "gennaro-tedesco";
       repo = "nvim-jqx";
-      rev = "24d3e0228aec27280e091d09ff65593e99d4d564";
-      sha256 = "06zp3hffwjgq3c30d7h3a3bnx7vw77xwz4g3kcb54rxffvhjwwvj";
+      rev = "a4ff0404d0fdd5213a9804c74c4a5ca40a1e4364";
+      sha256 = "0zdzfrsn751ff34lbqjnr6m2pis0fij20d10dpjidy3dbrgzc34d";
     };
     meta.homepage = "https://github.com/gennaro-tedesco/nvim-jqx/";
   };
@@ -6179,12 +6179,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2023-01-31";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "902d6aa31450d26e11bedcbef8af5b6fe2e1ffe8";
-      sha256 = "1hmkm3znqm7c6fi0qai1i424qjm5b9dh9l0srzyy7cax3629yyfr";
+      rev = "1712672e4da3003a0dd9f771d30389600b360f42";
+      sha256 = "18dpijknw3w82rag39acw60vwc6q0apc8hm82x6103gqsimcs3as";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -6359,12 +6359,12 @@ final: prev:
 
   nvim-snippy = buildVimPluginFrom2Nix {
     pname = "nvim-snippy";
-    version = "2023-02-01";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "dcampos";
       repo = "nvim-snippy";
-      rev = "a5580956e2c1841a248fae6ba88e21f72df9f04d";
-      sha256 = "1607d7igrhrzhfaypnf20awgi1l32w57i5g1jdz4d5dpch1wi6wn";
+      rev = "108ce49e8de5986ab94f20c8a5d50f823d6450e5";
+      sha256 = "1q15xfp7aw40if3myn9x2zdj66kjdirgcxhij86vpgnvbbjk5n2k";
     };
     meta.homepage = "https://github.com/dcampos/nvim-snippy/";
   };
@@ -6383,24 +6383,24 @@ final: prev:
 
   nvim-spectre = buildVimPluginFrom2Nix {
     pname = "nvim-spectre";
-    version = "2023-02-02";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "nvim-pack";
       repo = "nvim-spectre";
-      rev = "17b7c84ea8884bfec8e71b8021e924cb3a39c180";
-      sha256 = "1r6jran2nqyzjgxmwnykd53k38iz8pdc5x9ndcqd8w88ybg3bbpd";
+      rev = "1d8b7a40677fd87da7648d246c4675c3612a7582";
+      sha256 = "1bcxyq8jglkpfkhrj0zq5gj74sivws00zavl5py37xrmqp0948a8";
     };
     meta.homepage = "https://github.com/nvim-pack/nvim-spectre/";
   };
 
   nvim-surround = buildVimPluginFrom2Nix {
     pname = "nvim-surround";
-    version = "2023-01-01";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "kylechui";
       repo = "nvim-surround";
-      rev = "ad56e6234bf42fb7f7e4dccc7752e25abd5ec80e";
-      sha256 = "1fi5lk3iacjdbq1p4wm0bia93awwqfn7jiy019vpg4gngi41azrz";
+      rev = "90821ad682aac189cd0a38fd83fc96f0cbcc5d29";
+      sha256 = "0lirvmb9yc2yc8an2x0wll1vwlpc4fh95x3r5wh21s8m0nqvv577";
     };
     meta.homepage = "https://github.com/kylechui/nvim-surround/";
   };
@@ -6431,24 +6431,24 @@ final: prev:
 
   nvim-tree-lua = buildVimPluginFrom2Nix {
     pname = "nvim-tree.lua";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-tree.lua";
-      rev = "7eb33d2a6d5d574a43159da90e0eac2445367393";
-      sha256 = "0x6lji8s86vgih7fv9yvvjkyh9bqlzrsmn04im1zif087wa1dcw1";
+      rev = "36e29c3a95ae606449f6616a0d8ab7247af807dc";
+      sha256 = "198b97d1vc9lx5b7ww0dl07wyq2vjg2z6hq2arch8489qaaamqwm";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "bd7b4b6eff2dcb4a8a65f55d51398e79fa3d4ec6";
-      sha256 = "08amxr13yfqi2301lrdb0swl6wfjkbi3i7cq5r5ypyw7xaj1nbqb";
+      rev = "2c2430d42f30d1aef8715aed933272c9a6898f4e";
+      sha256 = "0ypwcgkm1igk5flc5hf1rsf6ckz76pks33c562s8478ppbicnlwy";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -6491,12 +6491,12 @@ final: prev:
 
   nvim-treesitter-textobjects = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter-textobjects";
-    version = "2023-01-31";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-textobjects";
-      rev = "249d90a84df63f3ffff65fcc06a45d58415672de";
-      sha256 = "01wm4gnwimsxgvdhjgn15d23nq6d1304jjvkr1wdjz7xk5g0xvaz";
+      rev = "13edf91f47c91b390bb00e1df2f7cc1ca250af3a";
+      sha256 = "19c140aw8ksak2k0s6ww2dk7qh3p2rjhwbi56wjaf2282x4g9181";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-textobjects/";
   };
@@ -6539,23 +6539,23 @@ final: prev:
 
   nvim-ts-rainbow2 = buildVimPluginFrom2Nix {
     pname = "nvim-ts-rainbow2";
-    version = "2023-02-04";
+    version = "2023-02-06";
     src = fetchgit {
       url = "https://gitlab.com/HiPhish/nvim-ts-rainbow2";
-      rev = "7d33fb4402676723b0d7ca4d95717f5e020cd123";
-      sha256 = "0h4kfmh75p6c00f1xa6609y7zq9nm3p0r8yj17bwy30hpi51vnqv";
+      rev = "7b797cc0d50231089b81362237abc14fc085ba5b";
+      sha256 = "0c4yyl10g8m84is7n9kzgsqndf1k4bq5xd4va1zwkzia0hjrfrfr";
     };
     meta.homepage = "https://gitlab.com/HiPhish/nvim-ts-rainbow2";
   };
 
   nvim-web-devicons = buildVimPluginFrom2Nix {
     pname = "nvim-web-devicons";
-    version = "2023-02-04";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-web-devicons";
-      rev = "2b96193abe4372e18e4f4533895a42a466d53c17";
-      sha256 = "18vh5xpyzlmfwdz2n30fi7a6v7w5mnami857cczqy2bk5bc1xdvd";
+      rev = "bd7a222287c5828cd0607cd0a5605e52f0460074";
+      sha256 = "0yfik58mixrlhjla7aw4di61yzxkk79s9fvz6ly2vg5vdacf40bl";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-web-devicons/";
   };
@@ -6586,12 +6586,12 @@ final: prev:
 
   nvim_context_vt = buildVimPluginFrom2Nix {
     pname = "nvim_context_vt";
-    version = "2022-09-14";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "haringsrob";
       repo = "nvim_context_vt";
-      rev = "31436f34f3f95e4e70853cd653fdf78246cb0e85";
-      sha256 = "1i018fmglfyqd8q762vks8yhh2kwg754ysf7d6d3hq2sb7w7kzwn";
+      rev = "e592a9142fbfe0878ce886cd0d745963604c61d2";
+      sha256 = "00gwdnmsc0dlc0p8j6b6jld1vh78zf57dmk2arw3f0xpwirgkkxx";
     };
     meta.homepage = "https://github.com/haringsrob/nvim_context_vt/";
   };
@@ -6646,12 +6646,12 @@ final: prev:
 
   oil-nvim = buildVimPluginFrom2Nix {
     pname = "oil.nvim";
-    version = "2023-02-03";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "oil.nvim";
-      rev = "7371dd220f1d08789cc225846d8cafed938777e9";
-      sha256 = "0rcx62q9vrx0w6qgkpz39173r0fba6xk9ja212s93l3zwqp49wwb";
+      rev = "f1ea6e0ad03e1d7b1acad4d0796d39c4a82b3463";
+      sha256 = "0s9c7cdqs8rf8pzrw68ynh9q76rqzwq5kc96dlgip4273s38x25j";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/oil.nvim/";
@@ -6683,12 +6683,12 @@ final: prev:
 
   onedark-nvim = buildVimPluginFrom2Nix {
     pname = "onedark.nvim";
-    version = "2023-01-19";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "navarasu";
       repo = "onedark.nvim";
-      rev = "f0a70e0993acbb348c32a52a88058cc60c160992";
-      sha256 = "0mscpy6949zvcwfdp18nn4bkzrp9r5iyw4h2v310p5mr8gd3fjpv";
+      rev = "76b2b1ff819f70466f4e75c83cad64892f78ad8d";
+      sha256 = "15gq6ax1r3pf75y5l7bylxgk1ginf6q7ighggrwzq0ddmki2ma7i";
     };
     meta.homepage = "https://github.com/navarasu/onedark.nvim/";
   };
@@ -6707,12 +6707,12 @@ final: prev:
 
   onedarkpro-nvim = buildVimPluginFrom2Nix {
     pname = "onedarkpro.nvim";
-    version = "2023-02-02";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "onedarkpro.nvim";
-      rev = "64d5c6d75c9769f8edca674138cf63e71efcf65b";
-      sha256 = "1zacxqgrmbpnmx7xp99b9g1s348874i5vmf4dj3f9hxzawlqq351";
+      rev = "39e24f92f8029262759e897ce5331a65d8c47a3c";
+      sha256 = "0srapnscm874sfnqkqcfdpwa17v3p6p2r0bna0g9djsmsl3ari4c";
     };
     meta.homepage = "https://github.com/olimorris/onedarkpro.nvim/";
   };
@@ -6731,12 +6731,12 @@ final: prev:
 
   onenord-nvim = buildVimPluginFrom2Nix {
     pname = "onenord.nvim";
-    version = "2023-02-01";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "rmehri01";
       repo = "onenord.nvim";
-      rev = "09aab5d7ea230c9c4829e44698020b642e00d840";
-      sha256 = "07hrppbj1njnjdyq4v6vxx3nfycr4dx45my23h0ix2kwqhw8f4ad";
+      rev = "71bdcdf105a8feb16cd5248b40e44c88832f75ca";
+      sha256 = "0pflq1p48rd3s5vfi2bk04ick2iyl8fg1a25qpawm8wb1ds10ln4";
     };
     meta.homepage = "https://github.com/rmehri01/onenord.nvim/";
   };
@@ -6767,24 +6767,24 @@ final: prev:
 
   orgmode = buildVimPluginFrom2Nix {
     pname = "orgmode";
-    version = "2023-02-01";
+    version = "2023-02-11";
     src = fetchFromGitHub {
       owner = "nvim-orgmode";
       repo = "orgmode";
-      rev = "7ddbdc0741fdc90f73faa17fb332bc8700acadbf";
-      sha256 = "01pf6pi9mm88slf7667np60a7x9zk0rwxz40cyxrfc4d012ivs3a";
+      rev = "313ce5a04e7fc3d677ad906a94fc49c1f54d1572";
+      sha256 = "1d9a7ddyd09ym53nvijiy5z67mj79a93fqsm35jxfv4wkcraq9xd";
     };
     meta.homepage = "https://github.com/nvim-orgmode/orgmode/";
   };
 
   oxocarbon-nvim = buildVimPluginFrom2Nix {
     pname = "oxocarbon.nvim";
-    version = "2023-02-02";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "nyoom-engineering";
       repo = "oxocarbon.nvim";
-      rev = "f7b05feadc985f39639650067f1a333285cb4085";
-      sha256 = "0pwk7g59cmfpnqvvflbxxknmy3hnp6g9rz5la1gs00n7391gmcqq";
+      rev = "f93de9b8589eda0d1d766cbe3c76ed1e1abc0a71";
+      sha256 = "11yp33398vya0b4ncf2whf5rj42h16kyd2h4xglyl77dixawmvgf";
     };
     meta.homepage = "https://github.com/nyoom-engineering/oxocarbon.nvim/";
   };
@@ -7032,12 +7032,12 @@ final: prev:
 
   purescript-vim = buildVimPluginFrom2Nix {
     pname = "purescript-vim";
-    version = "2023-02-04";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "purescript-contrib";
       repo = "purescript-vim";
-      rev = "9a01f01991ca52ae835da09f483aeeeb79639739";
-      sha256 = "0ix3gxh1d3iw9zjmw41yc3fk2dxz5xi5j0l7bn4xv7shbdpki1la";
+      rev = "82348352e6568fcc0385bd7c99a8ead3a479feea";
+      sha256 = "14729v7rndi3l8fpnbzapgwb4dj7537fik54g6frm1r1724f5cr2";
     };
     meta.homepage = "https://github.com/purescript-contrib/purescript-vim/";
   };
@@ -7321,12 +7321,12 @@ final: prev:
 
   rust-tools-nvim = buildVimPluginFrom2Nix {
     pname = "rust-tools.nvim";
-    version = "2023-01-25";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "simrat39";
       repo = "rust-tools.nvim";
-      rev = "b297167d9e01accc9b9afe872ce91e791df2dde0";
-      sha256 = "1fwjykp6gaafniflb3816z2nkfkpwa9pkxdcs6l2ka06ngr3xdih";
+      rev = "bd1aa99ffb911a1cf99b3fcf3b44c0391c57e3ef";
+      sha256 = "0sja04sgpaa30v3ndnffh8n2lx0igicjpmddc7h5v2n62il5z1a8";
     };
     meta.homepage = "https://github.com/simrat39/rust-tools.nvim/";
   };
@@ -7598,12 +7598,12 @@ final: prev:
 
   solarized-nvim = buildVimPluginFrom2Nix {
     pname = "solarized.nvim";
-    version = "2022-12-02";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "shaunsingh";
       repo = "solarized.nvim";
-      rev = "36615f1e4d16b87def801a75132f4aab5944e9fc";
-      sha256 = "1nn12zpsgiq9idsa93s04m8l2mpb2aq7f7n11cs2yhv2kbb9krlf";
+      rev = "fe02ed49cc017cc93657bd6306a2624394611c69";
+      sha256 = "185drqdf6qcwbjvs2f5gnz660w45d4pwqal40mbf1p3gd32il6qa";
     };
     meta.homepage = "https://github.com/shaunsingh/solarized.nvim/";
   };
@@ -8165,12 +8165,12 @@ final: prev:
 
   telescope-file-browser-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-file-browser.nvim";
-    version = "2022-12-31";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-file-browser.nvim";
-      rev = "304508fb7bea78e3c0eeddd88c4837501e403ae8";
-      sha256 = "0hyy1fwp06748qy7rs7gf27p7904xfrr53v1sbrmqhlxinlsyp0m";
+      rev = "a18f78121d74c4fae9edd29e138a918a8ede2a70";
+      sha256 = "0x6vgnzh1zd4si95swc47v301c1dyd6say9fkdpnzjl4plzj507f";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-file-browser.nvim/";
   };
@@ -8189,12 +8189,12 @@ final: prev:
 
   telescope-fzf-native-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-fzf-native.nvim";
-    version = "2022-12-18";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-fzf-native.nvim";
-      rev = "fab3e2212e206f4f8b3bbaa656e129443c9b802e";
-      sha256 = "0paiaag3aazfv8rr0i43maq34pn3iga3lkjyllhfysqvdm8jk50f";
+      rev = "580b6c48651cabb63455e97d7e131ed557b8c7e2";
+      sha256 = "1yjdn4729syz80radl90f2bsh7jl73rxq5ss0yp2qjj7aj8hkhm6";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-fzf-native.nvim/";
   };
@@ -8332,6 +8332,18 @@ final: prev:
     meta.homepage = "https://github.com/fhill2/telescope-ultisnips.nvim/";
   };
 
+  telescope-undo-nvim = buildVimPluginFrom2Nix {
+    pname = "telescope-undo.nvim";
+    version = "2023-01-29";
+    src = fetchFromGitHub {
+      owner = "debugloop";
+      repo = "telescope-undo.nvim";
+      rev = "b5e31b358095074b60d87690bd1dc0a020a2afab";
+      sha256 = "1hpqd0dgb01in5dbqs2ps3wr12iqnf0pd0xdnaalvq7rmvsmvz7a";
+    };
+    meta.homepage = "https://github.com/debugloop/telescope-undo.nvim/";
+  };
+
   telescope-vim-bookmarks-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-vim-bookmarks.nvim";
     version = "2022-07-17";
@@ -8358,12 +8370,12 @@ final: prev:
 
   telescope-zoxide = buildVimPluginFrom2Nix {
     pname = "telescope-zoxide";
-    version = "2022-09-12";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "jvgrootveld";
       repo = "telescope-zoxide";
-      rev = "856af0d83d2e167b5efa080567456c1578647abe";
-      sha256 = "10cybnf6lzi3vqbigphjgx45naqfg9b3sz6sbmf8hb960h6f8jz8";
+      rev = "68966349aa1b8e9ade403e18479ecf79447389a7";
+      sha256 = "1ryc14kggh1qa6qcv5d0zfsxpfzf6jypf4c842cj5c9dm5385jqn";
     };
     meta.homepage = "https://github.com/jvgrootveld/telescope-zoxide/";
   };
@@ -8611,12 +8623,12 @@ final: prev:
 
   tokyonight-nvim = buildVimPluginFrom2Nix {
     pname = "tokyonight.nvim";
-    version = "2023-01-23";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "tokyonight.nvim";
-      rev = "affb21a81e6d7de073378eb86d02864c594104d9";
-      sha256 = "0q37ldqajhp46g0ikc3yfnq9bgmghqdb8884rc56sraql9g0nwmi";
+      rev = "a0abe53df53616d13da327636cb0bcac3ea7f5af";
+      sha256 = "1laa7fwg9sy6d83j7p8izij677d29iq6ih2x9jg2blhsc9bp6ds6";
     };
     meta.homepage = "https://github.com/folke/tokyonight.nvim/";
   };
@@ -8647,12 +8659,12 @@ final: prev:
 
   treesj = buildVimPluginFrom2Nix {
     pname = "treesj";
-    version = "2023-01-30";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "Wansmer";
       repo = "treesj";
-      rev = "2723d63aed0ca4564565cc2949e0d6d2bc2b8287";
-      sha256 = "1bxzww9qxb442ch3i7m4bw58hn3l9lzckr0vnqp9hh55vqh7c3xk";
+      rev = "7d397fddf9eb15e5d8e8cb0539beb6f6312a768e";
+      sha256 = "14mp801plz90yhf3cdpwhlpndgz724b4a9lykawdnc02jaw5vs5w";
     };
     meta.homepage = "https://github.com/Wansmer/treesj/";
   };
@@ -8683,12 +8695,12 @@ final: prev:
 
   trouble-nvim = buildVimPluginFrom2Nix {
     pname = "trouble.nvim";
-    version = "2023-01-23";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "trouble.nvim";
-      rev = "490f7fe6d227f4f7a64f00be8c7dcd7a508ed271";
-      sha256 = "1bdhn3y4zs5m66bj009lqyn5spdn36vr8yc04k35xv5434011p0i";
+      rev = "556ef3089709a6e253df1e500381fec5eb48e48a";
+      sha256 = "0ragk770zibpqggvz8l78is0zr839r2py6k5261wmn1qwslagz06";
     };
     meta.homepage = "https://github.com/folke/trouble.nvim/";
   };
@@ -8791,12 +8803,12 @@ final: prev:
 
   unison = buildVimPluginFrom2Nix {
     pname = "unison";
-    version = "2023-02-03";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "unisonweb";
       repo = "unison";
-      rev = "59acc0cbe429492a99bfebf2b783fc2fa3967f75";
-      sha256 = "1nrpxprq1f2pp269nrx18avv7ghngqlr7rjahib91rgkvhw6k1x7";
+      rev = "f61b16e5926b71400014a372ea617a9fdb3e6780";
+      sha256 = "1kcabzhvkay30nmilkr7nxv5jcza4c8gf87w8pkmpw40ql0xqv2v";
     };
     meta.homepage = "https://github.com/unisonweb/unison/";
   };
@@ -8887,12 +8899,12 @@ final: prev:
 
   vifm-vim = buildVimPluginFrom2Nix {
     pname = "vifm.vim";
-    version = "2023-01-30";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "vifm";
       repo = "vifm.vim";
-      rev = "13a24c0a09d29db4a1683ef950f929d97c57ef90";
-      sha256 = "044s9di41cif3d7ij349v135vnxqhrl10fnagq6lyn364jw3lad1";
+      rev = "e18bec4733c9d70e63183ed76a21fb0ae9645e1e";
+      sha256 = "0nv0m7a27prn5zrb4ws13c3ar37nzfy197jcq2p3cp9pnfawd9mj";
     };
     meta.homepage = "https://github.com/vifm/vifm.vim/";
   };
@@ -9079,12 +9091,12 @@ final: prev:
 
   vim-addon-manager = buildVimPluginFrom2Nix {
     pname = "vim-addon-manager";
-    version = "2022-06-29";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "MarcWeber";
       repo = "vim-addon-manager";
-      rev = "984320ed46ef6612a1c232bb44f5e51f92d12e7e";
-      sha256 = "1p7ads4rg2rcgh4rf2p5qy7bf5yrnvnx6nri90bfinzfsyddb00l";
+      rev = "8c970107391ca8d879b60ce3d02538b6573fc95f";
+      sha256 = "05d5z5lwaa83sff37kdwiflisk9q1597f8xlwk60z1sasdp1630q";
     };
     meta.homepage = "https://github.com/MarcWeber/vim-addon-manager/";
   };
@@ -9619,12 +9631,12 @@ final: prev:
 
   vim-clap = buildVimPluginFrom2Nix {
     pname = "vim-clap";
-    version = "2023-01-30";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vim-clap";
-      rev = "6a90a1db48569814e73d201c95d90f38ae4aa27f";
-      sha256 = "0svshn3g4w86wizxc7nybqgwkbr5nfs454vanr8q1z7ypgqax99h";
+      rev = "860483e57b4efde000b3cac682ef813f2d7b5b6d";
+      sha256 = "1sij1ijils2n0hyi8pw56dnw62hvrs1q1a2sbp3cgfh09vsqb9c5";
     };
     meta.homepage = "https://github.com/liuchengxu/vim-clap/";
   };
@@ -9679,12 +9691,12 @@ final: prev:
 
   vim-code-dark = buildVimPluginFrom2Nix {
     pname = "vim-code-dark";
-    version = "2022-12-16";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "tomasiser";
       repo = "vim-code-dark";
-      rev = "48d44707a821f962f56c3d0553144c77211749fa";
-      sha256 = "0pgrmcq79jbj68zw1s9wfa5lq133xn34gx3zd2r1dllp2ybqf62a";
+      rev = "080b38a0fd14d14e21cf85fc26b18415303c3c5e";
+      sha256 = "10734wy3j3ffkrc5ifm04kh4vk0axpl1isxdryak1ai90wxr3xhz";
     };
     meta.homepage = "https://github.com/tomasiser/vim-code-dark/";
   };
@@ -9883,12 +9895,12 @@ final: prev:
 
   vim-dadbod = buildVimPluginFrom2Nix {
     pname = "vim-dadbod";
-    version = "2022-12-27";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-dadbod";
-      rev = "a09e40664e9cd30cd2b3f8866b796598302070f6";
-      sha256 = "0fhbb5yq6ll58gc2wyai7h4c889lfdmvhwzidw1gw529jpgwvc67";
+      rev = "389a2b0120f82b13d51ff7c07f5c13f9bc9f412f";
+      sha256 = "09ly10yclzkg8p4p0d50bznss76h3252jvpi9wj3qar48jgpmng1";
     };
     meta.homepage = "https://github.com/tpope/vim-dadbod/";
   };
@@ -9907,12 +9919,12 @@ final: prev:
 
   vim-dadbod-ui = buildVimPluginFrom2Nix {
     pname = "vim-dadbod-ui";
-    version = "2023-01-06";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "kristijanhusak";
       repo = "vim-dadbod-ui";
-      rev = "f4ead480930a37dd2b0cf917a8c387ed36c2d86a";
-      sha256 = "00nmcsna4z1p8i5k74jykzci16by2ga2lf904f1aya0yhwpwrjg2";
+      rev = "caf45f54dad6150970331ac115e531524e418c7c";
+      sha256 = "1x1qvn245lz8q0a7v6l0s6fr9pjrm8ar9gf72hd1iiskzly28ax0";
     };
     meta.homepage = "https://github.com/kristijanhusak/vim-dadbod-ui/";
   };
@@ -10003,12 +10015,12 @@ final: prev:
 
   vim-dispatch = buildVimPluginFrom2Nix {
     pname = "vim-dispatch";
-    version = "2022-01-14";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-dispatch";
-      rev = "00e77d90452e3c710014b26dc61ea919bc895e92";
-      sha256 = "1ind8lyghdizgs0q59k3svwdmnq8l88b8ns1qq1xvz47rh836c6w";
+      rev = "6cc2691576f97d43f8751664d1a1a908b99927e5";
+      sha256 = "151fxvhz6pi021rg9bc2g564a13lvbcwh3lpa4vl3g5w9j95pmv3";
     };
     meta.homepage = "https://github.com/tpope/vim-dispatch/";
   };
@@ -10411,12 +10423,12 @@ final: prev:
 
   vim-fugitive = buildVimPluginFrom2Nix {
     pname = "vim-fugitive";
-    version = "2023-01-17";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "2febbe1f00be04f16daa6464cb39214a8566ec4b";
-      sha256 = "0njzhsn5xlwjcgr6nkm8pds4rby46dldl0b25dwj2bj6nyydaa23";
+      rev = "62f42f013d866139fa23068ac2651b3f7e05a56f";
+      sha256 = "1hbkhdfrg18zzxn2hqz070ns0nzydjj853i2dkz9d59s23bcyrql";
     };
     meta.homepage = "https://github.com/tpope/vim-fugitive/";
   };
@@ -10555,12 +10567,12 @@ final: prev:
 
   vim-go = buildVimPluginFrom2Nix {
     pname = "vim-go";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "58437d8250cc3355b565725073f51ff0ff77cea6";
-      sha256 = "1fsrhyawry2m4dq7lrh1zvanxn2qi35lqg1al92w065sf62mds9z";
+      rev = "582ceb4b14d1aaf9b0a52c7f4ede68ea29c85416";
+      sha256 = "0k2bl6f7xh21wmyzwasl6ifkl7blbjmv25bsb9w74rcq1gx92nma";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
   };
@@ -10856,12 +10868,12 @@ final: prev:
 
   vim-illuminate = buildVimPluginFrom2Nix {
     pname = "vim-illuminate";
-    version = "2023-02-01";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "vim-illuminate";
-      rev = "d6ca7f77eeaf61b3e6ce9f0e5a978d606df44298";
-      sha256 = "02sgnp9yr0bdg8r5w24cxdvy01vw2whkh0fx11d9vfg0gqshi2hh";
+      rev = "49062ab1dd8fec91833a69f0a1344223dd59d643";
+      sha256 = "15456qlblskafaq3x92kp8n8hdfzdfv1hzs9yb4k4aqps1bj2plf";
     };
     meta.homepage = "https://github.com/RRethy/vim-illuminate/";
   };
@@ -10940,12 +10952,12 @@ final: prev:
 
   vim-jack-in = buildVimPluginFrom2Nix {
     pname = "vim-jack-in";
-    version = "2023-01-29";
+    version = "2023-01-31";
     src = fetchFromGitHub {
       owner = "clojure-vim";
       repo = "vim-jack-in";
-      rev = "c7f73e6788b5a97ac700f6c1fe09c26ebfa324d0";
-      sha256 = "1f95877cgv9mvln6v78sgccwdfgvbaga9wbyckxw8rrbnrikwxam";
+      rev = "8ca306a9484d6d184de8921a9cab03c63ee9aa79";
+      sha256 = "0hrvsq95rqwp0kfsdiid5qv0bfx1i7wc5yn7qmdqc660s7abwqxs";
     };
     meta.homepage = "https://github.com/clojure-vim/vim-jack-in/";
   };
@@ -11169,12 +11181,12 @@ final: prev:
 
   vim-ledger = buildVimPluginFrom2Nix {
     pname = "vim-ledger";
-    version = "2023-02-04";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "ledger";
       repo = "vim-ledger";
-      rev = "9b18bd548ec1fd6e94b262b3af0d9fb337c0b1df";
-      sha256 = "1paqjvvrcgngpggwa2a57d85xzvz5g5mk43bzn5fkgc1xfd77yv1";
+      rev = "6990fa243b684d91bd7386af3f378cdf6ed7c536";
+      sha256 = "0zw3zwp9lywdxm47pngqfw5j39d9vkpzfjcckcqkgzzrm7579dcl";
     };
     meta.homepage = "https://github.com/ledger/vim-ledger/";
   };
@@ -11289,12 +11301,12 @@ final: prev:
 
   vim-lsp = buildVimPluginFrom2Nix {
     pname = "vim-lsp";
-    version = "2023-02-01";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "prabirshrestha";
       repo = "vim-lsp";
-      rev = "25337623cf11e2ac9c73dcba1a48b86fe103d887";
-      sha256 = "020c8m76yp0ddwln4iajy231ifia2bxvly0b4ibfn5sgnqqf2cxm";
+      rev = "65628c3b0affacd0f36a6e294b1c1f96c6fe2455";
+      sha256 = "0qkxw3n59a9w74vawyp7b288pfvkjww1d61ipcg3z9bvcv2xf0gz";
     };
     meta.homepage = "https://github.com/prabirshrestha/vim-lsp/";
   };
@@ -11398,12 +11410,12 @@ final: prev:
 
   vim-matchup = buildVimPluginFrom2Nix {
     pname = "vim-matchup";
-    version = "2023-01-18";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "andymass";
       repo = "vim-matchup";
-      rev = "959e0e79ea240cdee29efbdd0d2e2e718931ccec";
-      sha256 = "0fyh7894fwnf8hxp8y9016blzmw7qv99izhy62bg11rhdjcgz4n8";
+      rev = "945e01e39fc137bd74bb3aa8c4f40e6ffb5be2dd";
+      sha256 = "04lzlz7y72nw5in3r46xc8xb1f4avdcjbwl1sic9v0gbr4w3g2hb";
     };
     meta.homepage = "https://github.com/andymass/vim-matchup/";
   };
@@ -11878,12 +11890,12 @@ final: prev:
 
   vim-pandoc = buildVimPluginFrom2Nix {
     pname = "vim-pandoc";
-    version = "2022-08-18";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "vim-pandoc";
       repo = "vim-pandoc";
-      rev = "7dbda1c885c4c5dd3f865aa29e1b82167663aeec";
-      sha256 = "0f4bkz619lp0fr1966njm3m5587vq2mbmahy2ya5d8nnqs5f770p";
+      rev = "9f406d964ca70d959b7867f1b5cee3d4884d4d3c";
+      sha256 = "0r0w4pr6jdh7ww08301h69xfih2gsqqbswfx4fzm10xx8y4csrfv";
     };
     meta.homepage = "https://github.com/vim-pandoc/vim-pandoc/";
   };
@@ -13091,12 +13103,12 @@ final: prev:
 
   vim-tpipeline = buildVimPluginFrom2Nix {
     pname = "vim-tpipeline";
-    version = "2023-02-02";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "vimpostor";
       repo = "vim-tpipeline";
-      rev = "0dfb1bf84bf8899dc57ae1102605336b929898e7";
-      sha256 = "1pyk4bf3mrmhylmmrxj0wlq145ilanmkiblyjmdl0imwn8m5jyl9";
+      rev = "9d1dd5116c13b6d850a81291422a4a9818622b6c";
+      sha256 = "00n2lq23m9b050ianbr5b655c23qasspvc5kf56dzpkjxgza56am";
     };
     meta.homepage = "https://github.com/vimpostor/vim-tpipeline/";
   };
@@ -13163,12 +13175,12 @@ final: prev:
 
   vim-ultest = buildVimPluginFrom2Nix {
     pname = "vim-ultest";
-    version = "2022-06-18";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "vim-ultest";
-      rev = "c93eb128332f8245776b753407ab6c4432c4c556";
-      sha256 = "1y686xrcvkwqmc263syh84a396xanqka39axc460ibl9zav7z4nn";
+      rev = "b06bc8715cbcb4aa0444abfd85fb705b659ba055";
+      sha256 = "0k69hqaxgbhjwq7wf30l8i1b6xv5qhzm4mbg6hydil5rj6zwf7xv";
     };
     meta.homepage = "https://github.com/rcarriga/vim-ultest/";
   };
@@ -13319,12 +13331,12 @@ final: prev:
 
   vim-wakatime = buildVimPluginFrom2Nix {
     pname = "vim-wakatime";
-    version = "2023-02-01";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "wakatime";
       repo = "vim-wakatime";
-      rev = "b67957731086466ed5d967cd1dac7f6981603156";
-      sha256 = "0s35cx7yxx6rc7qs88c4j0109y7b9lgwd15p0a33pwbwj0h3x6ap";
+      rev = "ee4ab57adf62a309aeef383a2da23b6e48e5ae50";
+      sha256 = "1k5nhwcn7ckn44pzy49fn7i116lydarzn9ks1cczwh9nkmwwwsks";
     };
     meta.homepage = "https://github.com/wakatime/vim-wakatime/";
   };
@@ -13619,12 +13631,12 @@ final: prev:
 
   vimspector = buildVimPluginFrom2Nix {
     pname = "vimspector";
-    version = "2023-01-31";
+    version = "2023-02-07";
     src = fetchFromGitHub {
       owner = "puremourning";
       repo = "vimspector";
-      rev = "ecf0c51b07ffedeca054581623bdda0d458e39d2";
-      sha256 = "0xvpfsbglr65zjs26slwms9n8ibjy4s93vny2p5s2q5f5mgnlsd7";
+      rev = "4deaffdec34508621934fa4532748ee9deb1f55c";
+      sha256 = "014kcjwab8jy89r0rcgci5ih8isbyz4v29q5nv6d2prld100p72f";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/puremourning/vimspector/";
@@ -13632,12 +13644,12 @@ final: prev:
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2023-02-02";
+    version = "2023-02-09";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "8ef5b0d9b85e7bb57b00b4571db4804aec0e10eb";
-      sha256 = "1nk85v06s4kybvnmh8raxcmj49snph4nsbfyizwcixwr592amcs1";
+      rev = "3a9180f1d2cc984fe24bc7afaf9d4d00b3e4c20a";
+      sha256 = "01bciy0vcx2fqqw6rpxvvi272hr8867blh1992w9b1232pglx5di";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -13740,12 +13752,12 @@ final: prev:
 
   which-key-nvim = buildVimPluginFrom2Nix {
     pname = "which-key.nvim";
-    version = "2023-01-23";
+    version = "2023-02-10";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "which-key.nvim";
-      rev = "684e96c5e8477f1ee9b3f2e9a12d802fd12c5531";
-      sha256 = "0kdmv1jkkfcrhrvc6mcdy173cx39mwq5nwq3yni46zgcn5iyxiq3";
+      rev = "5224c261825263f46f6771f1b644cae33cd06995";
+      sha256 = "1r16iz5yhp56bb2rqi40qsis5yqnfkdq7x5ibwafv5xsmk7nrlgj";
     };
     meta.homepage = "https://github.com/folke/which-key.nvim/";
   };
@@ -13921,12 +13933,12 @@ final: prev:
 
   zen-mode-nvim = buildVimPluginFrom2Nix {
     pname = "zen-mode.nvim";
-    version = "2023-02-01";
+    version = "2023-02-08";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "zen-mode.nvim";
-      rev = "136dda65769cee45119f16e4bc3d3f13a7aecb28";
-      sha256 = "0bsnvcixvk2vrimbyhxblj9anhig69jwxscyd2l05pp1njpzb424";
+      rev = "3c92f503823088862ca2a7809d1c7edc90fb92fa";
+      sha256 = "1l4dg11bdnkncdscmz3j1wsx9qnllwpsz5pm1a1c96v3s4wlmw0p";
     };
     meta.homepage = "https://github.com/folke/zen-mode.nvim/";
   };
@@ -13981,12 +13993,12 @@ final: prev:
 
   zk-nvim = buildVimPluginFrom2Nix {
     pname = "zk-nvim";
-    version = "2022-12-19";
+    version = "2023-02-06";
     src = fetchFromGitHub {
       owner = "mickael-menu";
       repo = "zk-nvim";
-      rev = "2fd9f9f29270bb28477e000100625276ec2a2377";
-      sha256 = "1b8w280yivsb34547y7kdcsvgcil41sfj8kvyvs6d24yrxbqs20w";
+      rev = "0413c52500cd0133b0cd8e7e7d43084855ac1760";
+      sha256 = "0yw7fi9z4rlb2vpm2qp6sm118hjz5vzix6nl7h654vp12zzqrs0g";
     };
     meta.homepage = "https://github.com/mickael-menu/zk-nvim/";
   };
@@ -14017,12 +14029,12 @@ final: prev:
 
   catppuccin-nvim = buildVimPluginFrom2Nix {
     pname = "catppuccin-nvim";
-    version = "2023-02-01";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "8769e767f12f5bf0b7d1250ee067088e7054809a";
-      sha256 = "1k57sb89abypkiwx94w0dadbg5qc73q5lfragmnvm81hhikdbf5p";
+      rev = "a5f3ed5d3b1d9ea21183718a8a89a6653bd6ea48";
+      sha256 = "1vx7p3f8339v1w9ww9l1lg3s6wf699q2bp762aqkmwmh88ykhi8i";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
@@ -14041,12 +14053,12 @@ final: prev:
 
   chad = buildVimPluginFrom2Nix {
     pname = "chad";
-    version = "2023-02-03";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "baae8d0a8afb062f5be6d83189e626dd74f41f98";
-      sha256 = "024iis733yvvkqil2m0wxh7lpkz0j7ij2if4yds07izbyyrpdxg6";
+      rev = "cb53c2a463aada65080eb40aa2cd03f18cadc5fb";
+      sha256 = "00wkr7n57py6dbw295mpr2ac4hi5flgb2qbq4qw4jd032gmw054r";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -14065,12 +14077,12 @@ final: prev:
 
   embark-vim = buildVimPluginFrom2Nix {
     pname = "embark-vim";
-    version = "2023-02-03";
+    version = "2023-02-05";
     src = fetchFromGitHub {
       owner = "embark-theme";
       repo = "vim";
-      rev = "89a044730bf5402c49db03475a9fa56782ca9d1c";
-      sha256 = "0d7956wi0lcbimxbn5cmghw11vb8gfsg2pd6yr4xja6bb4ldlbrk";
+      rev = "ebcbf51e13a5fea046c784906c149a057ba9d8b6";
+      sha256 = "1hbjwv2chrj310nvikb0pbs5wjj0bicx2874vjn2qh0rfypzqr1b";
     };
     meta.homepage = "https://github.com/embark-theme/vim/";
   };
@@ -14089,12 +14101,12 @@ final: prev:
 
   lspsaga-nvim-original = buildVimPluginFrom2Nix {
     pname = "lspsaga-nvim-original";
-    version = "2023-02-04";
+    version = "2023-02-12";
     src = fetchFromGitHub {
       owner = "glepnir";
       repo = "lspsaga.nvim";
-      rev = "9a7013874a9d5e0413039fc9ded613fcdbd59cbd";
-      sha256 = "1n9dkd6wlghw1b011xnja2h36l68x5pi3cf7f4khw7zfk0f49r1k";
+      rev = "215b0a71cc8b98662b56eb95731f897b59bd7869";
+      sha256 = "1fvd9z97rh295h72zrk8p97v29rp2n7pl961f5pi5wdfjv2ablva";
     };
     meta.homepage = "https://github.com/glepnir/lspsaga.nvim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 80e960b640a..0c47122ba77 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -27,12 +27,12 @@
   };
   arduino = buildGrammar {
     language = "arduino";
-    version = "c473c09";
+    version = "257efff";
     src = fetchFromGitHub {
       owner = "ObserverOfTime";
       repo = "tree-sitter-arduino";
-      rev = "c473c09f23b13d9404ec5208fad3eddea89d70f8";
-      hash = "sha256-aAw1ZgKuMWozQzmENUhkdkHV0BjSGmTdH4Bna7EfDaQ=";
+      rev = "257efffa387da3283a37816b71dedfecf4af5222";
+      hash = "sha256-Yc3oFzOMyQwW2URyEzSIe6wBNAu9J2vPFIXk43sVUv8=";
     };
     meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-arduino";
   };
@@ -115,23 +115,23 @@
   };
   c_sharp = buildGrammar {
     language = "c_sharp";
-    version = "a29bac0";
+    version = "18e4343";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c-sharp";
-      rev = "a29bac0681802139710b4d3875540901504d15cb";
-      hash = "sha256-TpOaxR0Do7oGjAZ8IrbXJAP6//Kt7VxhkrWEz7yNiLY=";
+      rev = "18e434383a4582b4fd183a30e55022c2923764e1";
+      hash = "sha256-ggvCj2yGDINuGr8Jb+aOoRxlKa5LaXCoiQC/Y5Hrcn0=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
   };
   capnp = buildGrammar {
     language = "capnp";
-    version = "740c757";
+    version = "cb85cdd";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-capnp";
-      rev = "740c757b9585925b1ed27cef7d61ac39b7824304";
-      hash = "sha256-0zCSWV3afsEIhN6XavMnn4LrLenjerhdnTfQ/EaL4aA=";
+      rev = "cb85cddfdf398530110c807ba046822dbaee6afb";
+      hash = "sha256-VB8fNF8EtTAkKBLIAByazczPHJYdBULCeoGQ1ZLLRhI=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-capnp";
   };
@@ -159,12 +159,12 @@
   };
   cmake = buildGrammar {
     language = "cmake";
-    version = "a322653";
+    version = "399605a";
     src = fetchFromGitHub {
       owner = "uyha";
       repo = "tree-sitter-cmake";
-      rev = "a32265307aa2d31941056d69e8b6633e61750b2f";
-      hash = "sha256-LBd3SMem1dxZr/dOdJdEFTQxI6d+H8uYE46yN02E/6Y=";
+      rev = "399605a02bcd5daa309ce63a6459c600dce3473f";
+      hash = "sha256-7pzKyfR9RmfgzuX9/elUesmsdbLlwgrfiRP73YQu+gM=";
     };
     meta.homepage = "https://github.com/uyha/tree-sitter-cmake";
   };
@@ -304,12 +304,12 @@
   };
   ebnf = buildGrammar {
     language = "ebnf";
-    version = "ef241bc";
+    version = "8e635b0";
     src = fetchFromGitHub {
       owner = "RubixDev";
       repo = "ebnf";
-      rev = "ef241bc09f2f105c35f5e4f2ccd8a522dd99071c";
-      hash = "sha256-N5TGYJnYNjYIdFXspGn+dDRm0wmJymXHY+Io43wSKlI=";
+      rev = "8e635b0b723c620774dfb8abf382a7f531894b40";
+      hash = "sha256-Cch6WCYq9bsWGypzDGapxBLJ0ZB432uAl6YjEjBJ5yg=";
     };
     location = "crates/tree-sitter-ebnf";
     meta.homepage = "https://github.com/RubixDev/ebnf.git";
@@ -371,12 +371,12 @@
   };
   embedded_template = buildGrammar {
     language = "embedded_template";
-    version = "a130858";
+    version = "203f7bd";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-embedded-template";
-      rev = "a13085849cf69e2401ec44e38cffc3d73f22f3df";
-      hash = "sha256-JNyLOW/na8J0WEsLDv3BuC+UXxGpYMYvAlywq4z6Wzo=";
+      rev = "203f7bd3c1bbfbd98fc19add4b8fcb213c059205";
+      hash = "sha256-SaZkyy2wKYoK0+pdHLVpQrdXjEeX/uR5XxgahcAdwz0=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-embedded-template";
   };
@@ -426,12 +426,12 @@
   };
   fortran = buildGrammar {
     language = "fortran";
-    version = "edcb337";
+    version = "bfa6fd4";
     src = fetchFromGitHub {
       owner = "stadelmanma";
       repo = "tree-sitter-fortran";
-      rev = "edcb3374f4698aaedf24bc572f6b2f5ef0e89ac7";
-      hash = "sha256-xZfWtRHWy3MQtkzN9jSwx+sAwLlcRiVLTJjYXyWEIs8=";
+      rev = "bfa6fd4c4aa0bb9b39ad33daa004ad4637a91d20";
+      hash = "sha256-5Lf/6jhgRPgSPNCHqiYT8OeI7UUnTfQqH8rzf8ggHj0=";
     };
     meta.homepage = "https://github.com/stadelmanma/tree-sitter-fortran";
   };
@@ -448,12 +448,12 @@
   };
   func = buildGrammar {
     language = "func";
-    version = "88ee7d0";
+    version = "f161cfe";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-func";
-      rev = "88ee7d0f569af10ab8c78a12f37217a8d15a0ffa";
-      hash = "sha256-SLI59AtprfCQr6VccCVr+2sazEtUSXnAwHcclWrkXxA=";
+      rev = "f161cfe22452b386eeeab29ba0d2c14893f1a31f";
+      hash = "sha256-Swyg5EdBWVT6P9vgS7h/fmK0ySRwiFlynJEZT9I10qg=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-func";
   };
@@ -470,12 +470,12 @@
   };
   gdscript = buildGrammar {
     language = "gdscript";
-    version = "4849e65";
+    version = "5d43d78";
     src = fetchFromGitHub {
       owner = "PrestonKnopp";
       repo = "tree-sitter-gdscript";
-      rev = "4849e657b98945cd040ffa7fd833d6130259dbab";
-      hash = "sha256-Rs1W2jahp+J42JzICi+QLAqfHYXth47g4LjejJnJypo=";
+      rev = "5d43d78c276570f76773685f08baf9e4ada09639";
+      hash = "sha256-SNyZutgab3T1UaD/D6jnhF3QmAR/UVtlXTpNjYlf2+Y=";
     };
     meta.homepage = "https://github.com/PrestonKnopp/tree-sitter-gdscript";
   };
@@ -537,12 +537,12 @@
   };
   glimmer = buildGrammar {
     language = "glimmer";
-    version = "c0bfd26";
+    version = "40cfb72";
     src = fetchFromGitHub {
       owner = "alexlafroscia";
       repo = "tree-sitter-glimmer";
-      rev = "c0bfd260cdcbe2976f4633547c218f09f7222a89";
-      hash = "sha256-Goj900MJxO44KYkzD0UpGFEGHAwr6qhe2bmCzpx5BhE=";
+      rev = "40cfb72a53654cbd666451ca04ffd500257c7b73";
+      hash = "sha256-h9ZZz6mbkErLIG/BamNRRoRdqmuBO3v17W0uvmpbm7A=";
     };
     meta.homepage = "https://github.com/alexlafroscia/tree-sitter-glimmer";
   };
@@ -637,12 +637,12 @@
   };
   haskell = buildGrammar {
     language = "haskell";
-    version = "aee3725";
+    version = "3bdba07";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-haskell";
-      rev = "aee3725d02cf3bca5f307b35dd3a96a97e109b4e";
-      hash = "sha256-DmrrRht3g0hG+OsJCHRL+xW4jflLqtG57AuFf7zd26c=";
+      rev = "3bdba07c7a8eec23f87fa59ce9eb2ea4823348b3";
+      hash = "sha256-/aGUdyVxXqXCvjruI8rqiKzfTsyxzOKaXSAUG5xK4cE=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-haskell";
   };
@@ -835,12 +835,12 @@
   };
   jsonnet = buildGrammar {
     language = "jsonnet";
-    version = "505f5bd";
+    version = "fdc7757";
     src = fetchFromGitHub {
       owner = "sourcegraph";
       repo = "tree-sitter-jsonnet";
-      rev = "505f5bd90053ae895aa3d6f2bac8071dd9abd8b2";
-      hash = "sha256-XZqywAzM+UCKto/OFn50hhRpEyFVLpFV7Q1Z0NKoPsI=";
+      rev = "fdc775714afa27fdef823adbaba6ab98f5ae66f2";
+      hash = "sha256-KVpSB3LiC1qpF05Y1ScIglaXWIrAL+m7G4Q4/EVn0U8=";
     };
     meta.homepage = "https://github.com/sourcegraph/tree-sitter-jsonnet";
   };
@@ -857,12 +857,12 @@
   };
   kdl = buildGrammar {
     language = "kdl";
-    version = "f83f394";
+    version = "b50d6c8";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-kdl";
-      rev = "f83f3943568c7e7b4f5e0de1b04d722223bd4d80";
-      hash = "sha256-BakY6V4A2N/ZZCkyr7KU04/DWeGTAkkJua5TyZ6uNW4=";
+      rev = "b50d6c8b77d311639ecbf2b803ffb720c2b4cee2";
+      hash = "sha256-dE2SqRSjy05Un3DPkrVDN0+na1ahddY57RYPMtaWynA=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-kdl";
   };
@@ -956,24 +956,24 @@
   };
   markdown = buildGrammar {
     language = "markdown";
-    version = "abea13b";
+    version = "7e7aa9a";
     src = fetchFromGitHub {
       owner = "MDeiml";
       repo = "tree-sitter-markdown";
-      rev = "abea13b86c404564991244b69b7afc4ca362d0c0";
-      hash = "sha256-gdRl+jTSGlijc3/hn1BYClAlpYljzSRVpRoi9Q446PU=";
+      rev = "7e7aa9a25ca9729db9fe22912f8f47bdb403a979";
+      hash = "sha256-KsE9oYzD+vVqgR35JdL0NmPfNGJqpC12sEsZVIs7NX0=";
     };
     location = "tree-sitter-markdown";
     meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
   };
   markdown_inline = buildGrammar {
     language = "markdown_inline";
-    version = "abea13b";
+    version = "7e7aa9a";
     src = fetchFromGitHub {
       owner = "MDeiml";
       repo = "tree-sitter-markdown";
-      rev = "abea13b86c404564991244b69b7afc4ca362d0c0";
-      hash = "sha256-gdRl+jTSGlijc3/hn1BYClAlpYljzSRVpRoi9Q446PU=";
+      rev = "7e7aa9a25ca9729db9fe22912f8f47bdb403a979";
+      hash = "sha256-KsE9oYzD+vVqgR35JdL0NmPfNGJqpC12sEsZVIs7NX0=";
     };
     location = "tree-sitter-markdown-inline";
     meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
@@ -1126,12 +1126,12 @@
   };
   php = buildGrammar {
     language = "php";
-    version = "973694f";
+    version = "f860e59";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-php";
-      rev = "973694ffcdeebca245b7ecf0d7c4cadd4f41b3c9";
-      hash = "sha256-upJ8WwosOe4Xv/H9LUFVUVThLSLS+5Htr71Lyc/ZTJo=";
+      rev = "f860e598194f4a71747f91789bf536b393ad4a56";
+      hash = "sha256-j4RJUBbp2zvCHsZwnz62t2Tf6Cy1LOKrhg/pi8cqzAs=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
   };
@@ -1192,12 +1192,12 @@
   };
   pug = buildGrammar {
     language = "pug";
-    version = "26f6ac8";
+    version = "884e225";
     src = fetchFromGitHub {
       owner = "zealot128";
       repo = "tree-sitter-pug";
-      rev = "26f6ac805e11e19c4492089f24aa44fe71be7c1f";
-      hash = "sha256-KUIjt8p4B3LrU9vRQGL9Pf3ZYMfdDrazC2kNwTpRAgg=";
+      rev = "884e225b5ecca5d885ae627275f16ef648acd42e";
+      hash = "sha256-qPfVSnsw9bDznq7rhzftGyv9cGi2OiF6DCh55Lxk8xA=";
     };
     meta.homepage = "https://github.com/zealot128/tree-sitter-pug";
   };
@@ -1311,6 +1311,17 @@
     };
     meta.homepage = "https://github.com/bamonroe/tree-sitter-rnoweb";
   };
+  ron = buildGrammar {
+    language = "ron";
+    version = "049a3ef";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-ron";
+      rev = "049a3ef4e271089107dd08e4aeb195abd1f77103";
+      hash = "sha256-ITWls8kp/UvwWOBE19v1UWQ1/BEiDhsK5VIFHicJM84=";
+    };
+    meta.homepage = "https://github.com/amaanq/tree-sitter-ron";
+  };
   rst = buildGrammar {
     language = "rst";
     version = "25e6328";
@@ -1434,12 +1445,12 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "c508e60";
+    version = "7be06f4";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "c508e6044adf4298d7b321f966c90cbe32d75d23";
-      hash = "sha256-Ed+6pwxwvwLKOVB9XVHF+IftEiO4bG0yZAe77xBcazI=";
+      rev = "7be06f4d5eabace883dd45959c13dc740f1f1b98";
+      hash = "sha256-Hi/4/Aou85MYCMMFqf5xqAyKECTzfeiaksJxdv9MVCU=";
     };
     generate = true;
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
@@ -1538,12 +1549,12 @@
   };
   thrift = buildGrammar {
     language = "thrift";
-    version = "634a73f";
+    version = "763ae3d";
     src = fetchFromGitHub {
       owner = "duskmoon314";
       repo = "tree-sitter-thrift";
-      rev = "634a73fd2c80e169f302917ba665c07ec0b6ff7b";
-      hash = "sha256-pB7zd48aonYYKdvD3+35zsD76+F/lqBYveFBxBQISvA=";
+      rev = "763ae3d760b7a7719b57568bdf9ffae2d896680f";
+      hash = "sha256-LXHXCaD76H9kWjOwCPfrpO2ZEv3mlq0IpWnwzV/qr2M=";
     };
     meta.homepage = "https://github.com/duskmoon314/tree-sitter-thrift";
   };
@@ -1560,12 +1571,12 @@
   };
   tlaplus = buildGrammar {
     language = "tlaplus";
-    version = "6fd16d8";
+    version = "6d2ec89";
     src = fetchFromGitHub {
       owner = "tlaplus-community";
       repo = "tree-sitter-tlaplus";
-      rev = "6fd16d8469c6898317423d61738d97e2b3f5caf7";
-      hash = "sha256-s5mYc/kPZ4wHhm1ZeC5WBjBfzTFnANPRAZeE8UOVE1I=";
+      rev = "6d2ec894aef843fc89312c904e20c5f555aec4e3";
+      hash = "sha256-5V4sMnjVsdSJdeYspxn0nYqq73lVHvz7eGRfD/orqo4=";
     };
     meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
   };
@@ -1639,12 +1650,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "719cf0c";
+    version = "136f3a0";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "vls";
-      rev = "719cf0cd297f9b2f45ecfbeb0115379fb8cfa9c3";
-      hash = "sha256-4xb5x/JZN1pFvPVqazcZMdZm8DTpBb5nW5AgOrB3YHc=";
+      rev = "136f3a0ad91ab8a781c2d4eb419df0a981839f69";
+      hash = "sha256-zmbR2Of/XEJuGvNmXAJ+C4aAMem51LVS3e1rSqjaSb0=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/vlang/vls";
@@ -1684,12 +1695,12 @@
   };
   vim = buildGrammar {
     language = "vim";
-    version = "55ff1b0";
+    version = "e39a7bb";
     src = fetchFromGitHub {
       owner = "vigoux";
       repo = "tree-sitter-viml";
-      rev = "55ff1b080c09edeced9b748cf4c16d0b49d17fb9";
-      hash = "sha256-bMh6RPP0+zpNkMS/mpbKTaug9EL6u4kTcztnEXaNGyA=";
+      rev = "e39a7bbcfdcfc7900629962b785c7e14503ae590";
+      hash = "sha256-f3UAHwCL5yerEjmuDp+guzX4/ik4h7ProH5P8AmdO10=";
     };
     meta.homepage = "https://github.com/vigoux/tree-sitter-viml";
   };
@@ -1750,12 +1761,12 @@
   };
   zig = buildGrammar {
     language = "zig";
-    version = "b0693dd";
+    version = "6b3f578";
     src = fetchFromGitHub {
       owner = "maxxnino";
       repo = "tree-sitter-zig";
-      rev = "b0693dd473efd91d6085acd8e0ff9c627d37e077";
-      hash = "sha256-Jmz2XDI+mrBYE2TEhxPJZbICbhs5AOC0tyC4OOgT61U=";
+      rev = "6b3f5788f38be900b45f5af5a753bf6a37d614b8";
+      hash = "sha256-KwMo1gwre8/AXkXXwQqPHZIEPXM26PK8SI0p3tmkt24=";
     };
     meta.homepage = "https://github.com/maxxnino/tree-sitter-zig";
   };
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 0b02b1d9d80..b5005879969 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -941,6 +941,10 @@ self: super: {
     dependencies = with self; [ telescope-nvim ];
   });
 
+  telescope-undo-nvim = super.telescope-undo-nvim.overrideAttrs (old: {
+    dependencies = with self; [ telescope-nvim ];
+  });
+
   telescope-z-nvim = super.telescope-z-nvim.overrideAttrs (old: {
     dependencies = with self; [ telescope-nvim ];
   });
@@ -1088,7 +1092,7 @@ self: super: {
             libiconv
           ];
 
-          cargoSha256 = "sha256-jpO26OXaYcWirQ5tTKIwlva7dHIfdmnruF4WdwSq0nI=";
+          cargoSha256 = "sha256-JQwT7IFYC/K+t3YO34hoalxdt1TEsmEcBXtDKFVdles=";
         };
       in
       ''
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index a1cf1dd374d..08b63e40389 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -699,6 +699,7 @@ https://github.com/nvim-telescope/telescope-project.nvim/,,
 https://github.com/nvim-telescope/telescope-symbols.nvim/,,
 https://github.com/nvim-telescope/telescope-ui-select.nvim/,,
 https://github.com/fhill2/telescope-ultisnips.nvim/,,
+https://github.com/debugloop/telescope-undo.nvim/,HEAD,
 https://github.com/tom-anders/telescope-vim-bookmarks.nvim/,,
 https://github.com/nvim-telescope/telescope-z.nvim/,,
 https://github.com/jvgrootveld/telescope-zoxide/,,
diff --git a/pkgs/applications/editors/vim/plugins/vim-utils.nix b/pkgs/applications/editors/vim/plugins/vim-utils.nix
index 4235aa5e929..74c811c2eae 100644
--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@@ -317,8 +317,8 @@ rec {
       lib.warnIf (wrapManual != null) ''
         vim.customize: wrapManual is deprecated: the manual is now included by default if `name == "vim"`.
         ${if wrapManual == true && name != "vim" then "Set `standalone = false` to include the manual."
-        else if wrapManual == false && name == "vim" then "Set `standalone = true` to get the *vim wrappers only."
-        else ""}''
+        else lib.optionalString (wrapManual == false && name == "vim") "Set `standalone = true` to get the *vim wrappers only."
+        }''
       lib.warnIf (wrapGui != null)
         "vim.customize: wrapGui is deprecated: gvim is now automatically included if present"
       lib.throwIfNot (vimExecutableName == null && gvimExecutableName == null)
@@ -330,7 +330,7 @@ rec {
           else throw "at least one of vimrcConfig and vimrcFile must be specified";
         bin = runCommand "${name}-bin" { nativeBuildInputs = [ makeWrapper ]; } ''
           vimrc=${lib.escapeShellArg vimrc}
-          gvimrc=${if gvimrcFile != null then lib.escapeShellArg gvimrcFile else ""}
+          gvimrc=${lib.optionalString (gvimrcFile != null) (lib.escapeShellArg gvimrcFile)}
 
           mkdir -p "$out/bin"
           for exe in ${
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 41666183ce2..a8e91494b7e 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -927,8 +927,8 @@ let
         mktplcRef = {
           name = "gitlens";
           publisher = "eamodio";
-          version = "2022.12.604";
-          sha256 = "sha256-yfqGITviASp5ZDEJA+zyVz1LpPWV4FM/4fU4eq52Xng=";
+          version = "2023.2.1204";
+          sha256 = "sha256-FurYfkw+mOjyymR1VCGf0jJ2JCZJ8eGb1J7zD2peBjw=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -3089,6 +3089,22 @@ let
         };
       };
 
+      zhwu95.riscv = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "riscv";
+          publisher = "zhwu95";
+          version = "0.0.8";
+          sha256 = "sha256-PXaHSEXoN0ZboHIoDg37tZ+Gv6xFXP4wGBS3YS/53TY=";
+        };
+        meta = with lib; {
+          description = "Basic RISC-V colorization and snippets support.";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=zhwu95.riscv";
+          homepage = "https://github.com/zhuanhao-wu/vscode-riscv-support";
+          license = licenses.mit;
+          maintainers = [ maintainers.CardboardTurkey ];
+        };
+      };
+
       zxh404.vscode-proto3 = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-proto3";
diff --git a/pkgs/applications/emulators/dolphin-emu/default.nix b/pkgs/applications/emulators/dolphin-emu/default.nix
index ad9c470bf42..b9ef4682e87 100644
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@@ -1,126 +1,190 @@
-{ stdenv
-, lib
-, fetchpatch
-, pkg-config
+{ lib
+, stdenv
+, fetchFromGitHub
 , cmake
+, pkg-config
+, wrapQtAppsHook
+, alsa-lib
 , bluez
+, bzip2
+, cubeb
+, curl
+, enet
 , ffmpeg
-, libao
-, gtk3
-, glib
-, libGLU
+, fmt_8
+, hidapi
+, libevdev
 , libGL
-, gettext
-, libpthreadstubs
-, libXrandr
-, libXext
-, readline
-, openal
-, libXdmcp
-, portaudio
-, fetchFromGitHub
+, libiconv
+, libpulseaudio
+, libspng
 , libusb1
-, libevdev
-, wxGTK30
-, soundtouch
-, miniupnpc
+, libXdmcp
+, libXext
+, libXrandr
 , mbedtls_2
-, curl
-, lzo
+, mgba
+, miniupnpc
+, minizip-ng
+, openal
+, pugixml
+, qtbase
 , sfml
-, libpulseaudio ? null
+, soundtouch
+, udev
+, vulkan-loader
+, xxHash
+, xz
+
+  # Used in passthru
+, common-updater-scripts
+, dolphin-emu
+, jq
+, testers
+, writeShellScript
+
+  # Darwin-only dependencies
+, CoreBluetooth
+, ForceFeedback
+, IOKit
+, moltenvk
+, OpenGL
+, VideoToolbox
 }:
 
 stdenv.mkDerivation rec {
   pname = "dolphin-emu";
-  version = "5.0";
+  version = "5.0-18498";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = version;
-    sha256 = "07mlfnh0hwvk6xarcg315x7z2j0qbg9g7cm040df9c8psiahc3g6";
+    rev = "46b99671d9158e0ca840c1d8ef249db0f321ced7";
+    sha256 = "sha256-K+OF8o8I1XDLQQcsWC8p8jUuWeb+RoHlBG3cEZ1aWIU=";
+    fetchSubmodules = true;
   };
 
-  patches = [
-    # Fix FTBFS with glibc 2.26
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/02_glibc-2.26.patch";
-      name = "02_glibc-2.26.patch";
-      sha256 = "sha256-LBXT3rf5klwmX9YQXt4/iv06GghsWZprNhLGYlKiDqk=";
-    })
-    # Fix FTBFS with GCC 8
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/03_gcc8.patch";
-      name = "03_gcc8.patch";
-      sha256 = "sha256-uWP6zMjoHYbX6K+oPSQdBn2xWQpvNyhZabMkhtYrSbU=";
-    })
-    # Fix FTBFS with SoundTouch 2.1.2
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/05_soundtouch-2.1.2.patch";
-      name = "05_soundtouch-2.1.2.patch";
-      sha256 = "sha256-Y7CNM6GQC9GRhlOBLZlxkIpj1CFhIwA5L8lGXur/bwY=";
-    })
-    # Use GTK+3 wxWidgets backend
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/06_gtk3.patch";
-      name = "06_gtk3.patch";
-      sha256 = "sha256-pu5Q0+8kNwmpf2DoXCXHFqxF0EGTnFXJipkBz1Vh2cs=";
-    })
-  ];
-
-  cmakeFlags = [
-    "-DENABLE_LTO=True"
-  ];
-
   nativeBuildInputs = [
-    pkg-config
     cmake
+    pkg-config
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    bluez
+    bzip2
+    cubeb
+    curl
+    enet
     ffmpeg
-    libao
-    libGLU
+    fmt_8
+    hidapi
     libGL
-    gtk3
-    glib
-    gettext
-    libpthreadstubs
-    libXrandr
-    libXext
-    readline
-    openal
-    libevdev
-    libXdmcp
-    portaudio
+    libiconv
     libpulseaudio
-    libevdev
-    libXdmcp
-    portaudio
+    libspng
     libusb1
-    libpulseaudio
-    wxGTK30
-    soundtouch
-    miniupnpc
+    libXdmcp
     mbedtls_2
-    curl
-    lzo
+    miniupnpc
+    minizip-ng
+    openal
+    pugixml
+    qtbase
     sfml
+    soundtouch
+    xxHash
+    xz
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    bluez
+    libevdev
+    libXext
+    libXrandr
+    mgba # Derivation doesn't support Darwin
+    udev
+    vulkan-loader
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreBluetooth
+    ForceFeedback
+    IOKit
+    moltenvk
+    OpenGL
+    VideoToolbox
+  ];
+
+  cmakeFlags = [
+    "-DDISTRIBUTOR=NixOS"
+    "-DUSE_SHARED_ENET=ON"
+    "-DDOLPHIN_WC_REVISION=${src.rev}"
+    "-DDOLPHIN_WC_DESCRIBE=${version}"
+    "-DDOLPHIN_WC_BRANCH=master"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
+    "-DUSE_BUNDLED_MOLTENVK=OFF"
+    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
+    "-DSKIP_POSTPROCESS_BUNDLE=ON"
+    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
+    # Note: The updater isn't available on linux, so we dont need to disable it there.
+    "-DENABLE_AUTOUPDATE=OFF"
+  ];
+
+  qtWrapperArgs = lib.optionals stdenv.isLinux [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+    # https://bugs.dolphin-emu.org/issues/11807
+    # The .desktop file should already set this, but Dolphin may be launched in other ways
+    "--set QT_QPA_PLATFORM xcb"
   ];
 
+  # https://github.com/NixOS/nixpkgs/issues/201254
+  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
+
+  # Use nix-provided libraries instead of submodules
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace "if(NOT APPLE)" "if(true)" \
+      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
+  '';
+
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Only gets installed automatically if the standalone executable is used
+    mkdir -p $out/Applications
+    cp -r ./Binaries/Dolphin.app $out/Applications
+    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
   '';
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = dolphin-emu;
+      command = "dolphin-emu-nogui --version";
+    };
+
+    updateScript = writeShellScript "dolphin-update-script" ''
+      set -eou pipefail
+      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
+
+      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
+      version="$(jq -r '.shortrev' <<< "$json")"
+      rev="$(jq -r '.hash' <<< "$json")"
+      update-source-version dolphin-emu "$version" --rev="$rev"
+    '';
+  };
+
   meta = with lib; {
-    homepage = "https://dolphin-emu.org/";
+    homepage = "https://dolphin-emu.org";
     description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
+    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
+    branch = "master";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ MP2E ashkitten ];
-    # x86_32 is an unsupported platform.
-    # Enable generic build if you really want a JIT-less binary.
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      MP2E
+      ashkitten
+      xfix
+      ivar
+    ];
+    # Requires both LLVM and SDK bump
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }
diff --git a/pkgs/applications/emulators/dolphin-emu/master.nix b/pkgs/applications/emulators/dolphin-emu/master.nix
deleted file mode 100644
index 7f68b582149..00000000000
--- a/pkgs/applications/emulators/dolphin-emu/master.nix
+++ /dev/null
@@ -1,196 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, cmake
-, wrapQtAppsHook
-, qtbase
-, bluez
-, ffmpeg
-, libGL
-, libXrandr
-, libusb1
-, libXdmcp
-, libXext
-, openal
-, udev
-, libevdev
-, cubeb
-, curl
-, alsa-lib
-, miniupnpc
-, enet
-, mbedtls_2
-, soundtouch
-, sfml
-, minizip-ng
-, xz
-, hidapi
-, fmt_8
-, vulkan-loader
-, libpulseaudio
-, bzip2
-, libiconv
-, pugixml
-, xxHash
-
-  # Used in passthru
-, testers
-, dolphin-emu-beta
-, writeShellScript
-, common-updater-scripts
-, jq
-
-  # Darwin-only dependencies
-, CoreBluetooth
-, ForceFeedback
-, IOKit
-, VideoToolbox
-, OpenGL
-, libpng
-, moltenvk
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dolphin-emu";
-  version = "5.0-17995";
-
-  src = fetchFromGitHub {
-    owner = "dolphin-emu";
-    repo = "dolphin";
-    rev = "8bad821019721b9b72701b495da95656ace5fea5";
-    sha256 = "sha256-uxHzn+tXRBr11OPpZ4ELBw7DTJH4mnqUBOeyPlXNAh8=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # On x86_64-darwin CMake reportedly does not work without this in some cases.
-    # See https://github.com/NixOS/nixpkgs/pull/190373#issuecomment-1241310765
-    ./minizip-external-missing-include.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    cubeb
-    curl
-    ffmpeg
-    pugixml
-    xxHash
-    libGL
-    libpulseaudio
-    openal
-    libusb1
-    libiconv
-    libpng
-    libXdmcp
-    hidapi
-    miniupnpc
-    enet
-    mbedtls_2
-    soundtouch
-    sfml
-    minizip-ng
-    xz
-    qtbase
-    fmt_8
-    bzip2
-  ] ++ lib.optionals stdenv.isLinux [
-    libXrandr
-    libXext
-    bluez
-    udev
-    libevdev
-    alsa-lib
-    vulkan-loader
-  ] ++ lib.optionals stdenv.isDarwin [
-    CoreBluetooth
-    OpenGL
-    ForceFeedback
-    IOKit
-    VideoToolbox
-    moltenvk
-  ];
-
-  cmakeFlags = [
-    "-DDISTRIBUTOR=NixOS"
-    "-DUSE_SHARED_ENET=ON"
-    "-DDOLPHIN_WC_REVISION=${src.rev}"
-    "-DDOLPHIN_WC_DESCRIBE=${version}"
-    "-DDOLPHIN_WC_BRANCH=master"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
-    "-DUSE_BUNDLED_MOLTENVK=OFF"
-    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
-    "-DSKIP_POSTPROCESS_BUNDLE=ON"
-    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
-    # Note: The updater isn't available on linux, so we dont need to disable it there.
-    "-DENABLE_AUTOUPDATE=OFF"
-  ];
-
-  qtWrapperArgs = lib.optionals stdenv.isLinux [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
-    # https://bugs.dolphin-emu.org/issues/11807
-    # The .desktop file should already set this, but Dolphin may be launched in other ways
-    "--set QT_QPA_PLATFORM xcb"
-    # https://bugs.dolphin-emu.org/issues/12913
-    "--set QT_XCB_NO_XI2 1"
-  ];
-
-  # https://github.com/NixOS/nixpkgs/issues/201254
-  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
-
-  # Use nix-provided libraries instead of submodules
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace CMakeLists.txt \
-      --replace "if(NOT APPLE)" "if(true)" \
-      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
-  '';
-
-  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
-    install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Only gets installed automatically if the standalone executable is used
-    mkdir -p $out/Applications
-    cp -r ./Binaries/Dolphin.app $out/Applications
-    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = dolphin-emu-beta;
-      command = "dolphin-emu-nogui --version";
-    };
-
-    updateScript = writeShellScript "dolphin-update-script" ''
-      set -eou pipefail
-      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
-
-      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
-      version="$(jq -r '.shortrev' <<< "$json")"
-      rev="$(jq -r '.hash' <<< "$json")"
-      update-source-version dolphin-emu-beta "$version" --rev="$rev"
-    '';
-  };
-
-  meta = with lib; {
-    homepage = "https://dolphin-emu.org";
-    description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
-    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
-    branch = "master";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
-      MP2E
-      ashkitten
-      xfix
-      ivar
-    ];
-    # Requires both LLVM and SDK bump
-    broken = stdenv.isDarwin && stdenv.isx86_64;
-  };
-}
diff --git a/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch b/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
deleted file mode 100644
index 7da013ecd8f..00000000000
--- a/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-commit 5e0cb8066fb1653399c54e93e42375295c2562bd
-Author: Ivar Scholten <ivar.scholten@protonmail.com>
-Date:   Fri Sep 9 14:27:55 2022 +0200
-
-    Externals/minizip: add missing include to CheckFunctionExists
-
-diff --git a/Externals/minizip/CMakeLists.txt b/Externals/minizip/CMakeLists.txt
-index c3d7c5512e..f59f8b295c 100644
---- a/Externals/minizip/CMakeLists.txt
-+++ b/Externals/minizip/CMakeLists.txt
-@@ -60,6 +60,7 @@ if (HAVE_INTTYPES_H)
-   target_compile_definitions(minizip PRIVATE HAVE_INTTYPES_H)
- endif()
-
-+include(CheckFunctionExists)
- check_function_exists(fseeko HAVE_FSEEKO)
- if (NOT HAVE_FSEEKO)
-   target_compile_definitions(minizip PRIVATE NO_FSEEKO)
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index 084bf074542..aedf42ee126 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -117,6 +117,10 @@ stdenv.mkDerivation rec {
       --subst-var-by mamePath "$out/opt/mame"
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=use-after-free"
+  ];
+
   desktopItems = [
     (makeDesktopItem {
       name = "MAME";
diff --git a/pkgs/applications/emulators/rpcs3/default.nix b/pkgs/applications/emulators/rpcs3/default.nix
index b2861184a61..b9efcaaf4f6 100644
--- a/pkgs/applications/emulators/rpcs3/default.nix
+++ b/pkgs/applications/emulators/rpcs3/default.nix
@@ -1,4 +1,4 @@
-{ gcc11Stdenv, lib, fetchFromGitHub, wrapQtAppsHook, cmake, pkg-config, git
+{ gcc12Stdenv, lib, fetchFromGitHub, wrapQtAppsHook, cmake, pkg-config, git
 , qtbase, qtquickcontrols, qtmultimedia, openal, glew, vulkan-headers, vulkan-loader, libpng
 , ffmpeg, libevdev, libusb1, zlib, curl, wolfssl, python3, pugixml, faudio, flatbuffers
 , sdl2Support ? true, SDL2
@@ -21,7 +21,7 @@ let
     sha256 = "0c3g30rj1y8fbd2q4kwlpg1jdy02z4w5ryhj3yr9051pdnf4kndz";
   };
 in
-gcc11Stdenv.mkDerivation {
+gcc12Stdenv.mkDerivation {
   pname = "rpcs3";
   version = rpcs3Version;
 
diff --git a/pkgs/applications/file-managers/vifm/default.nix b/pkgs/applications/file-managers/vifm/default.nix
index 55a7ebd84af..ab7da2deac8 100644
--- a/pkgs/applications/file-managers/vifm/default.nix
+++ b/pkgs/applications/file-managers/vifm/default.nix
@@ -34,11 +34,11 @@ in stdenv.mkDerivation rec {
 
     wrapVifmMedia = "wrapProgram $out/share/vifm/vifm-media --prefix PATH : ${path}";
   in ''
-    ${if mediaSupport then wrapVifmMedia else ""}
+    ${lib.optionalString mediaSupport wrapVifmMedia}
   '';
 
   meta = with lib; {
-    description = "A vi-like file manager${if isFullPackage then "; Includes support for optional features" else ""}";
+    description = "A vi-like file manager${lib.optionalString isFullPackage "; Includes support for optional features"}";
     maintainers = with maintainers; [ raskin ];
     platforms = if mediaSupport then platforms.linux else platforms.unix;
     license = licenses.gpl2;
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 0ad52261330..1d7863df05e 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.0-61";
+  version = "7.1.0-62";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-g7WeqPpPd1gceU+s+vRDpb41IX1lzpiqh3cAYeFdUlg=";
+    hash = "sha256-K74BWxGTpkaE+KBrdOCVd+m/2MJP6YUkB2CFh/YEHyI=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/graphics/foxotron/default.nix b/pkgs/applications/graphics/foxotron/default.nix
index e8fd0364808..ca2aa96bea1 100644
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@@ -46,6 +46,11 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [ libX11 libXrandr libXinerama libXcursor libXi libXext alsa-lib fontconfig libGLU ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ AVFoundation Carbon Cocoa CoreAudio Kernel OpenGL ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index ae44b47643c..5f75d2770ac 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -109,7 +109,9 @@ in
     /* menu:
        Video
     */
-    name = "gap-2.6.0";
+    pname = "gap";
+    version = "2.6.0";
+
     src = fetchurl {
       url = "https://ftp.gimp.org/pub/gimp/plug-ins/v2.6/gap/gimp-gap-2.6.0.tar.bz2";
       sha256 = "1jic7ixcmsn4kx2cn32nc5087rk6g8xsrz022xy11yfmgvhzb0ql";
@@ -228,7 +230,9 @@ in
     /* menu:
       Filters/Enhance/Wavelet sharpen
     */
-    name = "wavelet-sharpen-0.1.2";
+    pname = "wavelet-sharpen";
+    version = "0.1.2";
+
     # Workaround build failure on -fno-common toolchains like upstream
     # gcc-10. Otherwise build fails as:
     #   ld: interface.o:(.bss+0xe0): multiple definition of `fimg'; plugin.o:(.bss+0x40): first defined here
@@ -271,7 +275,7 @@ in
 
   gimplensfun = pluginDerivation rec {
     version = "unstable-2018-10-21";
-    name = "gimplensfun-${version}";
+    pname = "gimplensfun";
 
     src = fetchFromGitHub {
       owner = "seebk";
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index 325d1bcf083..8f70d9273b7 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons pkg-config wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+  ];
+
   NIX_LDFLAGS = "-lpthread";
 
   buildPhase = ''
diff --git a/pkgs/applications/graphics/gthumb/default.nix b/pkgs/applications/graphics/gthumb/default.nix
index a82c6ec2f78..ecb09e539b3 100644
--- a/pkgs/applications/graphics/gthumb/default.nix
+++ b/pkgs/applications/graphics/gthumb/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchurl
+, fetchpatch
 , gnome
 , pkg-config
 , meson
@@ -40,6 +42,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-l/iv5SJTUhZUHrvx47VG0Spr6zio8OuF8m5naTSq1CU=";
   };
 
+  patches = [
+    # Fix build with libraw 0.21, can be removed on next update
+    # https://hydra.nixos.org/build/209327709/nixlog/1
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gthumb/-/commit/da0d3f22a5c3a141211d943e7d963d14090011ec.patch";
+      sha256 = "sha256-/l9US19rKxIUJjZ+oynGLr/9PKJPg9VUuA/VSuIT5AQ=";
+    })
+  ];
+
   nativeBuildInputs = [
     bison
     desktop-file-utils
diff --git a/pkgs/applications/graphics/hdrmerge/default.nix b/pkgs/applications/graphics/hdrmerge/default.nix
index b0e346331bc..d690f5e0671 100644
--- a/pkgs/applications/graphics/hdrmerge/default.nix
+++ b/pkgs/applications/graphics/hdrmerge/default.nix
@@ -46,6 +46,11 @@ mkDerivation rec {
       url = "https://github.com/mkroehnert/hdrmerge/commit/472b2dfe7d54856158aea3d5412a02d0bab1da4c.patch";
       sha256 = "0jc713ajr4w08pfbi6bva442prj878nxp1fpl9112i3xj34x9sdi";
     })
+    (fetchpatch {
+      name = "support-libraw-0.21.patch";
+      url = "https://github.com/jcelaya/hdrmerge/commit/779e566b3e2807280b78c79affda2cdfa64bde87.diff";
+      sha256 = "48sivCfJWEtGiBXTrO+SWTVlT9xyx92w2kkB8Wt/clk=";
+    })
   ];
 
   desktopItems = [
diff --git a/pkgs/applications/graphics/jpegoptim/default.nix b/pkgs/applications/graphics/jpegoptim/default.nix
index 951bb9d7d89..ff00d565f47 100644
--- a/pkgs/applications/graphics/jpegoptim/default.nix
+++ b/pkgs/applications/graphics/jpegoptim/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "1.5.1";
+  version = "1.5.2";
   pname = "jpegoptim";
 
   src = fetchFromGitHub {
     owner = "tjko";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QPipwBk+BS/u3YxB8ACeFXQSuoW1aynEyG3tEMrhcaE=";
+    sha256 = "sha256-PROQvOqsis8we58OOZ/kuY+L/CoV7XfnY9wvrpsTJu8=";
   };
 
   # There are no checks, it seems.
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index cfb63e0e3f7..e8e6a2cc9f8 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -1,7 +1,7 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  version = "5.1.4";
+  version = "5.1.5";
   kde-channel = "stable";
-  sha256 = "sha256-wisCCGJZbrL92RHhsXnbvOewgb4RFFei6sr2rhzKLcs=";
+  sha256 = "1lx4x4affkbh47b7w5qvahkkr4db0vcw6h24nykak6gpy2z5wxqw";
 })
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index 7a05114a1e9..54f956981ee 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "5.10.0";
+  version = "5.11.0";
 
   docFiles = [
     (fetchurl {
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
     owner = "paraview";
     repo = "paraview";
     rev = "v${version}";
-    sha256 = "0ipx6zq44hpic7gvv0s2jvjncak6vlmrz5sp9ypc15b15bna0gs2";
+    sha256 = "sha256-WvkKGl5lG+apX6m4ULVZZVtDsSUjEVXe/seh95b+LmI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 42909784263..9bb2a11b7cd 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -87,10 +87,10 @@ stdenv.mkDerivation rec {
     '' else ''
       substituteInPlace extern/clew/src/clew.c --replace '"libOpenCL.so"' '"${ocl-icd}/lib/libOpenCL.so"'
     '') +
-    (if hipSupport then ''
+    (lib.optionalString hipSupport ''
       substituteInPlace extern/hipew/src/hipew.c --replace '"/opt/rocm/hip/lib/libamdhip64.so"' '"${hip}/lib/libamdhip64.so"'
       substituteInPlace extern/hipew/src/hipew.c --replace '"opt/rocm/hip/bin"' '"${hip}/bin"'
-    '' else "");
+    '');
 
   cmakeFlags =
     [
diff --git a/pkgs/applications/misc/darkman/default.nix b/pkgs/applications/misc/darkman/default.nix
index 04b1af9bc2a..a20b8ab7262 100644
--- a/pkgs/applications/misc/darkman/default.nix
+++ b/pkgs/applications/misc/darkman/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "darkman";
-  version = "1.4.0";
+  version = "1.5.4";
 
   src = fetchFromGitLab {
     owner = "WhyNotHugo";
     repo = "darkman";
     rev = "v${version}";
-    sha256 = "sha256-Q/pjQmlyREl32C0LiwypEz1qBw2AeBOZbUIwNP392Sc=";
+    sha256 = "sha256-6SNXVe6EfVwcXH9O6BxNw+v4/uhKhCtVS3XE2GTc2Sc=";
   };
 
-  vendorSha256 = "09rjqw6v1jaf0mhmycw9mcay9q0y1fya2azj8216gdgkl48ics08";
+  vendorSha256 = "sha256-xEPmNnaDwFU4l2G4cMvtNeQ9KneF5g9ViQSFrDkrafY=";
 
   nativeBuildInputs = [ scdoc ];
 
diff --git a/pkgs/applications/misc/ikiwiki/default.nix b/pkgs/applications/misc/ikiwiki/default.nix
index 09f9b85e4b7..49798c84323 100644
--- a/pkgs/applications/misc/ikiwiki/default.nix
+++ b/pkgs/applications/misc/ikiwiki/default.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation rec {
     # Without patched plugin shebangs, some tests like t/rst.t fail
     # (with docutilsSupport enabled)
     patchShebangs plugins/*
+
+    # Creating shared git repo fails when running tests in Nix sandbox.
+    # The error is: "fatal: Could not make /tmp/ikiwiki-test-git.2043/repo/branches/ writable by group".
+    # Hopefully, not many people use `ikiwiki-makerepo` to create locally shared repositories these days.
+    substituteInPlace ikiwiki-makerepo --replace "git --bare init --shared" "git --bare init"
   '';
 
   configurePhase = "perl Makefile.PL PREFIX=$out";
diff --git a/pkgs/applications/misc/lyx/default.nix b/pkgs/applications/misc/lyx/default.nix
index d1a19eeccc5..921ae570bca 100644
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@@ -11,6 +11,12 @@ mkDerivation rec {
     sha256 = "sha256-xr7SYzQZiY4Bp8w1AxDX2TS/WRyrcln8JYGqTADq+ng=";
   };
 
+  # Needed with GCC 12
+  postPatch = ''
+    sed '1i#include <iterator>' -i src/lyxfind.cpp
+    sed '1i#include <cstring>'  -i src/insets/InsetListings.cpp
+  '';
+
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
   nativeBuildInputs = [ pkg-config makeWrapper ];
   buildInputs = [
diff --git a/pkgs/applications/misc/maliit-framework/default.nix b/pkgs/applications/misc/maliit-framework/default.nix
index 7c27b3b9714..ce8ebef16a8 100644
--- a/pkgs/applications/misc/maliit-framework/default.nix
+++ b/pkgs/applications/misc/maliit-framework/default.nix
@@ -33,6 +33,14 @@ mkDerivation rec {
     sha256 = "sha256-q+hiupwlA0PfG+xtomCUp2zv6HQrGgmOd9CU193ucrY=";
   };
 
+  patches = [
+    # FIXME: backport GCC 12 build fix, remove for next release
+    (fetchpatch {
+      url = "https://github.com/maliit/framework/commit/86e55980e3025678882cb9c4c78614f86cdc1f04.diff";
+      hash = "sha256-5R+sCI05vJX5epu6hcDSWWzlZ8ns1wKEJ+u8xC6d8Xo=";
+    })
+  ];
+
   buildInputs = [
     at-spi2-atk
     at-spi2-core
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 935a9582fca..e5e0f92ed1d 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -140,13 +140,16 @@ in stdenv.mkDerivation rec {
     patchShebangs tools/get_wb_version.sh
   '';
 
-  NIX_CFLAGS_COMPILE = toString ([
+  NIX_CFLAGS_COMPILE = [
     # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
     "-Wno-error=deprecated-declarations"
   ] ++ lib.optionals stdenv.isAarch64 [
     # error: narrowing conversion of '-1' from 'int' to 'char'
     "-Wno-error=narrowing"
-  ]);
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=maybe-uninitalized"
+  ];
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/misc/regextester/default.nix b/pkgs/applications/misc/regextester/default.nix
index 2a00cb92b9d..e5900a050ef 100644
--- a/pkgs/applications/misc/regextester/default.nix
+++ b/pkgs/applications/misc/regextester/default.nix
@@ -11,18 +11,19 @@
 , ninja
 , gobject-introspection
 , gsettings-desktop-schemas
+, desktop-file-utils
 , pantheon
 , wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "regextester";
-  version = "1.0.1";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "artemanufrij";
     repo = "regextester";
     rev = version;
-    sha256 = "1xwwv1hccni1mrbl58f7ly4qfq6738vn24bcbl2q346633cd7kx3";
+    hash = "sha256-5+gU8DeB99w2h/4vMal2eHkR0305dmRYiY6fsLZzlnc=";
   };
 
   nativeBuildInputs = [
@@ -34,6 +35,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     wrapGAppsHook
+    desktop-file-utils
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 62004164367..25e3cb65908 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -19,9 +19,9 @@
     }
   },
   "beta": {
-    "version": "110.0.5481.77",
-    "sha256": "1kl1k29sr5qw8pg7shvizw4b37fxjlgah56p57kq641iqhnsnj73",
-    "sha256bin64": "0wnzgvwbpmb5ja4ba5mjk4bk0aaxzbw4zi509vw96q6mbqmr4iwr",
+    "version": "111.0.5563.19",
+    "sha256": "0hrapzi45jpkb1b87nzlb896jd2h2jbz1mq91md5r2y6ag6fc55w",
+    "sha256bin64": "1mjrp13xf913xhm9hz6yg595g0jg2afmwvzxzpw79y4snaf2ihza",
     "deps": {
       "gn": {
         "version": "2022-12-12",
@@ -32,15 +32,15 @@
     }
   },
   "dev": {
-    "version": "111.0.5563.19",
-    "sha256": "0hrapzi45jpkb1b87nzlb896jd2h2jbz1mq91md5r2y6ag6fc55w",
-    "sha256bin64": "02aaqny23dcdp611n6jr7swkjnx1wd0lb8dgxq53b806f0s374cp",
+    "version": "112.0.5582.0",
+    "sha256": "139g5cpqxvh6bf2x3aqs4md379rwrx143f8lcsym8hgpqdwq5sfk",
+    "sha256bin64": "1npksnnxcni62wx517xy64ysk3ja868gw48vgx4q8xc93g15n89c",
     "deps": {
       "gn": {
-        "version": "2022-12-12",
+        "version": "2023-01-30",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "5e19d2fb166fbd4f6f32147fbb2f497091a54ad8",
-        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
+        "rev": "84c8431f3e03cc6226c59dd49637c15ea31169a1",
+        "sha256": "15dqiy1bf1cixqg23bqpfb8mrlcxqbarjwzajc5hjmivykrjn2s3"
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/firefox-bin/update.nix b/pkgs/applications/networking/browsers/firefox-bin/update.nix
index e5284c4097c..f7fe34cb8d0 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/update.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/update.nix
@@ -46,7 +46,7 @@ in writeScript "update-${pname}" ''
            grep "^[0-9]" | \
            sort --version-sort | \
            grep -v "funnelcake" | \
-           grep -e "${if isBeta then "b" else ""}\([[:digit:]]\|[[:digit:]][[:digit:]]\)$" | ${if isBeta then "" else "grep -v \"b\" |"} \
+           grep -e "${lib.optionalString isBeta "b"}\([[:digit:]]\|[[:digit:]][[:digit:]]\)$" | ${lib.optionalString (not isBeta) "grep -v \"b\" |"} \
            tail -1`
 
   curl --silent -o $HOME/shasums "$url$version/SHA256SUMS"
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index 01cd54cf8ee..208bff18e1f 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -70,7 +70,7 @@ let
     ++ lib.optional libvaSupport libva
     ++ [ gtk3 ];
 
-  suffix = if channel != "stable" then "-" + channel else "";
+  suffix = lib.optionalString (channel != "stable") "-${channel}";
 
   crashpadHandlerBinary = if lib.versionAtLeast version "94"
     then "chrome_crashpad_handler"
diff --git a/pkgs/applications/networking/circumflex/default.nix b/pkgs/applications/networking/circumflex/default.nix
index 0afe9466b4c..4dab874fd84 100644
--- a/pkgs/applications/networking/circumflex/default.nix
+++ b/pkgs/applications/networking/circumflex/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "circumflex";
-  version = "2.8";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "bensadeh";
     repo = "circumflex";
     rev = version;
-    hash = "sha256-knN+T/dmIwHLqT3MJBjQhGlSeAu0lE2ZOv6tLqkcwS0=";
+    hash = "sha256-hFhK1/ck37lfZJ2wpk1MGCfYEANhh8qzTb8m1t7EoBo=";
   };
 
-  vendorHash = "sha256-Xwek2xlvdGO6C/T0a96RGuMcX7jCbvntEYBf10tvmAo=";
+  vendorHash = "sha256-rwqY6illp5+h/oHOnVg6QfZ6tRFJOamwqJxQx/zlpyI=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/networking/cluster/k3s/1_23/default.nix b/pkgs/applications/networking/cluster/k3s/1_23/default.nix
index 3865cb0a06e..72fbe89dd6b 100644
--- a/pkgs/applications/networking/cluster/k3s/1_23/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_23/default.nix
@@ -320,8 +320,7 @@ buildGoModule rec {
   # Fix-Me: Needs to be adapted specifically for 1.23
   # passthru.updateScript = ./update.sh;
 
-  # Fix-Me: Needs to be adapted specifically for 1.23
-  # passthru.tests = { inherit (nixosTests) k3s-single-node k3s-single-node-docker; };
+  passthru.tests = k3s.passthru.mkTests k3sVersion;
 
   meta = baseMeta;
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/default.nix b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
index 18e0258432e..11037db5b6d 100644
--- a/pkgs/applications/networking/cluster/k3s/1_24/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
@@ -322,8 +322,7 @@ buildGoModule rec {
   # Fix-Me: Needs to be adapted specifically for 1.24
   # passthru.updateScript = ./update.sh;
 
-  # Fix-Me: Needs to be adapted specifically for 1.24
-  # passthru.tests = nixosTests.k3s;
+  passthru.tests = k3s.passthru.mkTests k3sVersion;
 
   meta = baseMeta;
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_25/default.nix b/pkgs/applications/networking/cluster/k3s/1_25/default.nix
index dc34821fb25..b62eec69285 100644
--- a/pkgs/applications/networking/cluster/k3s/1_25/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_25/default.nix
@@ -322,8 +322,7 @@ buildGoModule rec {
   # Fix-Me: Needs to be adapted specifically for 1.25
   # passthru.updateScript = ./update.sh;
 
-  # Fix-Me: Needs to be adapted specifically for 1.25
-  # passthru.tests = nixosTests.k3s;
+  passthru.tests = k3s.passthru.mkTests k3sVersion;
 
   meta = baseMeta;
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_26/default.nix b/pkgs/applications/networking/cluster/k3s/1_26/default.nix
index 144e1116bb1..cef2355a3da 100644
--- a/pkgs/applications/networking/cluster/k3s/1_26/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_26/default.nix
@@ -319,7 +319,14 @@ buildGoModule rec {
 
   passthru.updateScript = ./update.sh;
 
-  passthru.tests = nixosTests.k3s;
+  passthru.mkTests = version:
+    let k3s_version = "k3s_" + lib.replaceStrings ["."] ["_"] (lib.versions.majorMinor version);
+    in {
+      single-node = nixosTests.k3s.single-node.${k3s_version};
+      multi-node = nixosTests.k3s.multi-node.${k3s_version};
+    };
+  passthru.tests = passthru.mkTests k3sVersion;
+
 
   meta = baseMeta;
 }
diff --git a/pkgs/applications/networking/cluster/kluctl/default.nix b/pkgs/applications/networking/cluster/kluctl/default.nix
index aefcef2bacc..6a02127405d 100644
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kluctl";
-  version = "2.18.4";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     rev = "v${version}";
-    hash = "sha256-nHfJ7Dt9nAY4fY+U7W46cPRwWSgtGvwdbUjQAynOQdw=";
+    hash = "sha256-2nAgJj/cMDiE5rw/YixNYQNCWnuC/8EX4BrnXN4Npao=";
   };
 
-  vendorHash = "sha256-ADYXLcCYmlQim9KvqkXGdEXJ9cACBsRCb3emcmrL0kg=";
+  vendorHash = "sha256-xBUrY8v4yHtWGaaRXHxQRGdZHzMGoJX2hFLL+0Vb1QY=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/linkerd/edge.nix b/pkgs/applications/networking/cluster/linkerd/edge.nix
index 365016eb672..a124d633b37 100644
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "23.1.2";
-  sha256 = "1c8l5zzy5pjilp1a84084g3dgdm0rxkx7hj7lqcn0iihfvhxc1xq";
-  vendorSha256 = "sha256-6dOX3SsKjpwC/dEUO2SnVna99lpav7kIEKrMUy4YfhA=";
+  version = "23.2.1";
+  sha256 = "0qjl6qxfg6bj22fwm2y01if5dqp2w79y45ibrg46r33pf6gbwjxj";
+  vendorSha256 = "sha256-YxWBjbE3aBFfCbQeSTfQv5QzP5n4IRHHqNrFwrJPQ7g=";
 }
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index c9af58b1a8a..fc2aa83aa43 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.12.0";
+  version = "5.13.3";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    sha256 = "sha256-WE/XWNBy5p8PEQ11s8nmW+HoVEkQB9cKoj5ZS8Suvs8=";
+    sha256 = "sha256-6kbfsqhALf7LFl0GS4VAMTVDFKP+CaEr6IPfpTZ33Fo=";
   };
 
-  vendorHash = "sha256-F5Vh9wPd53bifLStk6wEwidPZvOjN87jn4RxJbSuW4o=";
+  vendorHash = "sha256-lXW1yHrGLwZdhfkMLeu7zm0w2HxXk1DW+QEY+rfGZpE=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 89614342129..e3fae245ee4 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -364,11 +364,11 @@
     "vendorHash": "sha256-Zi2e/Vg9iKTrU8Mb37Y8xHYIBL+IfDnWMUUg5Vqrbfo="
   },
   "exoscale": {
-    "hash": "sha256-48msmXj7SFmi5TA0/QYm66oIETymWi5ayF+yExyp+hk=",
+    "hash": "sha256-nkCpgreQ8mOLfGAlCDQYYA14Df1Lr6RzDCBWgQNVi6k=",
     "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
     "owner": "exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.44.0",
+    "rev": "v0.45.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -438,24 +438,24 @@
     "vendorHash": "sha256-aVbJT31IIgW0GYzwVX7kT4j7E+dadSbnttThh2lzGyE="
   },
   "google": {
-    "hash": "sha256-B/eXf31mRtWpl6TCv/hukPWfbb7Ne4W2FUMxiAbfsfI=",
+    "hash": "sha256-z5Fi+ac7dcDr/eTTJWWfsIm9tJJ+NgcY2L08h317G7g=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.52.0",
+    "rev": "v4.53.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-oModEw/gaQCDHLf+2EKf1O1HQSGWnqEReXowE6F7W0o="
+    "vendorHash": "sha256-glxBI4e5BN28GMGeixUSiCaDTIlr+8e4QHnzaDagyno="
   },
   "google-beta": {
-    "hash": "sha256-ISOhZqc6/RMqG4n63RjQluy0odkKATcCa52YpQW89xQ=",
+    "hash": "sha256-0NCndgGz/xrYNvWjs49u//VXvndw0RFyAINnGUTKQ4s=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.52.0",
+    "rev": "v4.53.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-oModEw/gaQCDHLf+2EKf1O1HQSGWnqEReXowE6F7W0o="
+    "vendorHash": "sha256-glxBI4e5BN28GMGeixUSiCaDTIlr+8e4QHnzaDagyno="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 5a71b1acfcc..dca8f277867 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -5,7 +5,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.5.22";
+  version = "3.5.23";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
     owner = "flexget";
     repo = "flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-I+7fTSyw5oKrad6HMxhex2wI4JLXDtoxHL4pxO3w2l8=";
+    hash = "sha256-VWpcXwiQHpQ3X/rmm6fWfPfuUoUmWQMfOq5A87nED3A=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index fdfb992192b..87eb241686c 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -3,7 +3,7 @@ let
   versions = if stdenv.isLinux then {
     stable = "0.0.24";
     ptb = "0.0.38";
-    canary = "0.0.146";
+    canary = "0.0.148";
   } else {
     stable = "0.0.264";
     ptb = "0.0.59";
@@ -22,7 +22,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-5GiG+RGqwHUdIeSVWpbaIw3sTuZbvIQeetXSEvSqTls=";
+        sha256 = "sha256-2ZrSDyPj3AHriCWZ/bb303H3J97TTun//WjmInNEmwk=";
       };
     };
     x86_64-darwin = {
diff --git a/pkgs/applications/networking/instant-messengers/jami/client.nix b/pkgs/applications/networking/instant-messengers/jami/client.nix
index f76d9ee9f12..80efff68e65 100644
--- a/pkgs/applications/networking/instant-messengers/jami/client.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/client.nix
@@ -9,7 +9,7 @@
 , python3
 , qttools # for translations
 , wrapQtAppsHook
-, ffmpeg-jami
+, ffmpeg_5
 , jami-daemon
 , libnotify
 , qt5compat
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
-    ffmpeg-jami
+    ffmpeg_5
     jami-daemon
     libnotify
     networkmanager
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common
deleted file mode 100644
index 0aac24e24bb..00000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common
+++ /dev/null
@@ -1,156 +0,0 @@
---disable-everything
---enable-zlib
---enable-gpl
---enable-swscale
---enable-bsfs
---disable-filters
---disable-programs
---disable-postproc
---disable-protocols
---enable-protocol=crypto
---enable-protocol=file
---enable-protocol=rtp
---enable-protocol=srtp
---enable-protocol=tcp
---enable-protocol=udp
---enable-protocol=unix
---enable-protocol=pipe
---disable-demuxers
---disable-muxers
---enable-muxer=rtp
---enable-muxer=g722
---enable-muxer=g723_1
---enable-muxer=g726
---enable-muxer=g726le
---enable-muxer=h263
---enable-muxer=h264
---enable-muxer=hevc
---enable-muxer=matroska
---enable-muxer=webm
---enable-muxer=ogg
---enable-muxer=pcm_s16be
---enable-muxer=pcm_s16le
---enable-demuxer=rtp
---enable-demuxer=mjpeg
---enable-demuxer=mjpeg_2000
---enable-demuxer=mpegvideo
---enable-demuxer=gif
---enable-demuxer=image_jpeg_pipe
---enable-demuxer=image_png_pipe
---enable-demuxer=image_webp_pipe
---enable-demuxer=matroska
---enable-demuxer=m4v
---enable-demuxer=mp3
---enable-demuxer=ogg
---enable-demuxer=flac
---enable-demuxer=wav
---enable-demuxer=ac3
---enable-demuxer=g722
---enable-demuxer=g723_1
---enable-demuxer=g726
---enable-demuxer=g726le
---enable-demuxer=pcm_mulaw
---enable-demuxer=pcm_alaw
---enable-demuxer=pcm_s16be
---enable-demuxer=pcm_s16le
---enable-demuxer=h263
---enable-demuxer=h264
---enable-demuxer=hevc
---enable-parser=h263
---enable-parser=h264
---enable-parser=hevc
---enable-parser=mpeg4video
---enable-parser=vp8
---enable-parser=vp9
---enable-parser=opus
---enable-encoder=adpcm_g722
---enable-decoder=adpcm_g722
---enable-encoder=adpcm_g726
---enable-decoder=adpcm_g726
---enable-encoder=adpcm_g726le
---enable-decoder=adpcm_g726le
---enable-decoder=g729
---enable-encoder=g723_1
---enable-decoder=g723_1
---enable-encoder=rawvideo
---enable-decoder=rawvideo
---enable-encoder=libx264
---enable-decoder=h264
---enable-encoder=pcm_alaw
---enable-decoder=pcm_alaw
---enable-encoder=pcm_mulaw
---enable-decoder=pcm_mulaw
---enable-encoder=mpeg4
---enable-decoder=mpeg4
---enable-encoder=libvpx_vp8
---enable-decoder=vp8
---enable-decoder=vp9
---enable-encoder=h263
---enable-encoder=h263p
---enable-decoder=h263
---enable-encoder=mjpeg
---enable-decoder=mjpeg
---enable-decoder=mjpegb
---enable-libspeex
---enable-libopus
---enable-libvpx
---enable-libx264
---enable-encoder=libspeex
---enable-decoder=libspeex
---enable-encoder=libopus
---enable-decoder=libopus
---enable-decoder=flac
---enable-decoder=vorbis
---enable-decoder=aac
---enable-decoder=ac3
---enable-decoder=eac3
---enable-decoder=mp3
---enable-decoder=pcm_u24be
---enable-decoder=pcm_u24le
---enable-decoder=pcm_u32be
---enable-decoder=pcm_u32le
---enable-decoder=pcm_u8
---enable-decoder=pcm_f16le
---enable-decoder=pcm_f24le
---enable-decoder=pcm_f32be
---enable-decoder=pcm_f32le
---enable-decoder=pcm_f64be
---enable-decoder=pcm_f64le
---enable-decoder=pcm_s16be
---enable-decoder=pcm_s16be_planar
---enable-decoder=pcm_s16le
---enable-decoder=pcm_s16le_planar
---enable-decoder=pcm_s24be
---enable-decoder=pcm_s24le
---enable-decoder=pcm_s24le_planar
---enable-decoder=pcm_s32be
---enable-decoder=pcm_s32le
---enable-decoder=pcm_s32le_planar
---enable-decoder=pcm_s64be
---enable-decoder=pcm_s64le
---enable-decoder=pcm_s8
---enable-decoder=pcm_s8_planar
---enable-decoder=pcm_u16be
---enable-decoder=pcm_u16le
---enable-encoder=gif
---enable-decoder=gif
---enable-encoder=jpegls
---enable-decoder=jpegls
---enable-encoder=ljpeg
---enable-decoder=jpeg2000
---enable-encoder=png
---enable-decoder=png
---enable-encoder=bmp
---enable-decoder=bmp
---enable-encoder=tiff
---enable-decoder=tiff
---enable-filter=scale
---enable-filter=overlay
---enable-filter=amix
---enable-filter=amerge
---enable-filter=aresample
---enable-filter=format
---enable-filter=aformat
---enable-filter=fps
---enable-filter=transpose
---enable-filter=pad
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux
deleted file mode 100644
index 6c40e8d2ea9..00000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux
+++ /dev/null
@@ -1,18 +0,0 @@
---enable-pic
---target-os=linux
---enable-indev=v4l2
---enable-indev=xcbgrab
---enable-vdpau
---enable-hwaccel=h264_vdpau
---enable-hwaccel=mpeg4_vdpau
---enable-vaapi
---enable-hwaccel=h264_vaapi
---enable-hwaccel=mpeg4_vaapi
---enable-hwaccel=h263_vaapi
---enable-hwaccel=vp8_vaapi
---enable-hwaccel=mjpeg_vaapi
---enable-hwaccel=hevc_vaapi
---enable-encoder=h264_vaapi
---enable-encoder=vp8_vaapi
---enable-encoder=mjpeg_vaapi
---enable-encoder=hevc_vaapi
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86 b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86
deleted file mode 100644
index 2043aa3ee2d..00000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86
+++ /dev/null
@@ -1,10 +0,0 @@
---enable-cuvid
---enable-ffnvcodec
---enable-nvdec
---enable-nvenc
---enable-hwaccel=h264_nvdec
---enable-hwaccel=hevc_nvdec
---enable-hwaccel=vp8_nvdec
---enable-hwaccel=mjpeg_nvdec
---enable-encoder=h264_nvenc
---enable-encoder=hevc_nvenc
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches
deleted file mode 100644
index 28f884e6676..00000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches
+++ /dev/null
@@ -1,7 +0,0 @@
-remove-mjpeg-log.patch
-change-RTCP-ratio.patch
-rtp_ext_abs_send_time.patch
-libopusdec-enable-FEC.patch
-libopusenc-reload-packet-loss-at-encode.patch
-ios-disable-b-frames.patch
-screen-sharing-x11-fix.patch
diff --git a/pkgs/applications/networking/instant-messengers/jami/daemon.nix b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
index 715560c6e12..bf2392f6315 100644
--- a/pkgs/applications/networking/instant-messengers/jami/daemon.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
@@ -9,7 +9,7 @@
 , asio
 , dbus
 , dbus_cplusplus
-, ffmpeg-jami
+, ffmpeg_5
 , fmt
 , gmp
 , gnutls
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     dbus
     dbus_cplusplus
     fmt
-    ffmpeg-jami
+    ffmpeg_5
     gmp
     gnutls
     http-parser
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index ea898c0da8c..497616a6c03 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -4,7 +4,6 @@
 , fetchFromGitHub
 , fetchzip
 , fetchpatch
-, ffmpeg_5
 , pjsip
 , opendht
 , jack
@@ -41,31 +40,6 @@ let
   readLinesToList = with builtins; file: filter (s: isString s && stringLength s > 0) (split "\n" (readFile file));
 in
 rec {
-  ffmpeg-jami = (ffmpeg_5.override rec {
-    version = "5.0.1";
-    branch = version;
-    sha256 = "sha256-KN8z1AChwcGyDQepkZeAmjuI73ZfXwfcH/Bn+sZMWdY=";
-    doCheck = false;
-  }).overrideAttrs (old:
-    let
-      patch-src = src + "/daemon/contrib/src/ffmpeg/";
-    in
-    {
-      patches = old.patches ++ (map (x: patch-src + x) (readLinesToList ./config/ffmpeg_patches)) ++
-        # SDL2 recently changed their versioning
-        [
-          (fetchpatch {
-            url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
-            hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
-          })
-        ];
-      configureFlags = old.configureFlags
-        ++ (readLinesToList ./config/ffmpeg_args_common)
-        ++ lib.optionals stdenv.isLinux (readLinesToList ./config/ffmpeg_args_linux)
-        ++ lib.optionals (stdenv.isx86_32 || stdenv.isx86_64) (readLinesToList ./config/ffmpeg_args_x86);
-      outputs = [ "out" "doc" ];
-    });
-
   pjsip-jami = pjsip.overrideAttrs (old:
     let
       patch-src = src + "/daemon/contrib/src/pjproject/";
@@ -105,10 +79,10 @@ rec {
   };
 
   jami-daemon = callPackage ./daemon.nix {
-    inherit version src udev jack jami-meta ffmpeg-jami pjsip-jami opendht-jami;
+    inherit version src udev jack jami-meta pjsip-jami opendht-jami;
   };
 
   jami-client = qt6Packages.callPackage ./client.nix {
-    inherit version src ffmpeg-jami jami-meta;
+    inherit version src jami-meta;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch b/pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch
index 1d9ca8d838d..4a49ff991e6 100644
--- a/pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch
+++ b/pkgs/applications/networking/instant-messengers/signald/0001-Fetch-buildconfig-during-gradle-build-inside-Nix-FOD.patch
@@ -1,4 +1,4 @@
-From 2c126682aaabd7f486dfb2ff75fe29b5d8697060 Mon Sep 17 00:00:00 2001
+From 33d8de9ccce7eecb12542e0fc11131b5101e1aa8 Mon Sep 17 00:00:00 2001
 From: Maximilian Bosch <maximilian@mbosch.me>
 Date: Sat, 26 Feb 2022 12:33:13 +0100
 Subject: [PATCH] Fetch buildconfig during gradle build inside Nix FOD
@@ -8,10 +8,10 @@ Subject: [PATCH] Fetch buildconfig during gradle build inside Nix FOD
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/build.gradle b/build.gradle
-index 799e782..caceaac 100644
+index ea3fea1..01e444d 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -83,6 +83,9 @@ static String getVersion() {
+@@ -82,6 +82,9 @@ static String getVersion() {
  
  repositories {
      maven {url "https://gitlab.com/api/v4/groups/6853927/-/packages/maven"} // https://gitlab.com/groups/signald/-/packages
@@ -21,16 +21,16 @@ index 799e782..caceaac 100644
      mavenCentral()
  }
  
-@@ -104,6 +107,8 @@ dependencies {
+@@ -101,6 +104,8 @@ dependencies {
+     implementation 'io.prometheus:simpleclient:0.16.0'
+     implementation 'io.prometheus:simpleclient_hotspot:0.16.0'
      implementation 'io.prometheus:simpleclient_httpserver:0.16.0'
-     implementation 'com.squareup.okhttp3:logging-interceptor:4.9.3'
-     implementation 'io.sentry:sentry:6.4.0'
-+    implementation 'com.github.gmazzo.buildconfig:com.github.gmazzo.buildconfig.gradle.plugin:3.1.0'
++    implementation 'com.github.gmazzo.buildconfig:com.github.gmazzo.buildconfig.gradle.plugin:3.0.3'
 +    implementation 'org.jetbrains.kotlin:kotlin-scripting-jvm:1.7.10'
-     testImplementation 'org.junit.jupiter:junit-jupiter:5.8.2'
- }
- 
-@@ -171,4 +176,4 @@ allprojects {
+     implementation 'com.squareup.okhttp3:logging-interceptor:4.10.0'
+     implementation 'io.sentry:sentry:6.11.0'
+     testImplementation 'org.junit.jupiter:junit-jupiter:5.9.0'
+@@ -170,4 +175,4 @@ allprojects {
  runtime {
      options = ['--strip-java-debug-attributes', '--compress', '2', '--no-header-files', '--no-man-pages']
      modules = ['java.base', 'java.management', 'java.naming', 'java.sql', 'java.xml', 'jdk.crypto.ec', 'jdk.httpserver', 'java.desktop', 'jdk.unsupported']
@@ -38,5 +38,5 @@ index 799e782..caceaac 100644
 \ No newline at end of file
 +}
 -- 
-2.36.2
+2.38.3
 
diff --git a/pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch b/pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch
index 96a7d6d2ef3..bf583de53ba 100644
--- a/pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch
+++ b/pkgs/applications/networking/instant-messengers/signald/0002-buildconfig-local-deps-fixes.patch
@@ -1,4 +1,4 @@
-From b068af1f3e49dedfb489e3ed957934ff651e98ee Mon Sep 17 00:00:00 2001
+From 4bf0aef4003f7494103a93ae1c2957b2cd32bb59 Mon Sep 17 00:00:00 2001
 From: Maximilian Bosch <maximilian@mbosch.me>
 Date: Sat, 26 Feb 2022 12:36:15 +0100
 Subject: [PATCH 2/2] buildconfig/local deps fixes
@@ -8,7 +8,7 @@ Subject: [PATCH 2/2] buildconfig/local deps fixes
  1 file changed, 18 insertions(+), 8 deletions(-)
 
 diff --git a/build.gradle b/build.gradle
-index 799e782..6ecef3e 100644
+index ea3fea1..24415d8 100644
 --- a/build.gradle
 +++ b/build.gradle
 @@ -10,11 +10,21 @@ import org.gradle.nativeplatform.platform.internal.ArchitectureInternal
@@ -35,7 +35,7 @@ index 799e782..6ecef3e 100644
  
  compileJava.options.encoding = 'UTF-8'
  
-@@ -83,7 +93,10 @@ static String getVersion() {
+@@ -82,7 +92,10 @@ static String getVersion() {
  
  repositories {
      maven {url "https://gitlab.com/api/v4/groups/6853927/-/packages/maven"} // https://gitlab.com/groups/signald/-/packages
@@ -47,16 +47,16 @@ index 799e782..6ecef3e 100644
  }
  
  dependencies {
-@@ -104,6 +117,8 @@ dependencies {
+@@ -101,6 +114,8 @@ dependencies {
+     implementation 'io.prometheus:simpleclient:0.16.0'
+     implementation 'io.prometheus:simpleclient_hotspot:0.16.0'
      implementation 'io.prometheus:simpleclient_httpserver:0.16.0'
-     implementation 'com.squareup.okhttp3:logging-interceptor:4.9.3'
-     implementation 'io.sentry:sentry:6.4.0'
-+    implementation 'com.github.gmazzo.buildconfig:com.github.gmazzo.buildconfig.gradle.plugin:3.1.0'
++    implementation 'com.github.gmazzo.buildconfig:com.github.gmazzo.buildconfig.gradle.plugin:3.0.3'
 +    implementation 'org.jetbrains.kotlin:kotlin-scripting-jvm:1.7.10'
-     testImplementation 'org.junit.jupiter:junit-jupiter:5.8.2'
- }
- 
-@@ -167,8 +182,3 @@ allprojects {
+     implementation 'com.squareup.okhttp3:logging-interceptor:4.10.0'
+     implementation 'io.sentry:sentry:6.11.0'
+     testImplementation 'org.junit.jupiter:junit-jupiter:5.9.0'
+@@ -166,8 +181,3 @@ allprojects {
          }
      }
  }
@@ -67,5 +67,5 @@ index 799e782..6ecef3e 100644
 -}
 \ No newline at end of file
 -- 
-2.36.2
+2.38.3
 
diff --git a/pkgs/applications/networking/instant-messengers/signald/default.nix b/pkgs/applications/networking/instant-messengers/signald/default.nix
index a9e023cdf63..b15dbbb92bd 100644
--- a/pkgs/applications/networking/instant-messengers/signald/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signald/default.nix
@@ -2,15 +2,18 @@
 , makeWrapper, fetchpatch, substituteAll, jre_minimal
 }:
 
+# NOTE: when updating the package, please check if some of the hacks in `deps.installPhase`
+# can be removed again!
+
 let
   pname = "signald";
-  version = "0.23.0";
+  version = "0.23.2";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-RN0OYjOmVtHKeFkviep952uf3qWuBj8lhcaP1Lk/gDo=";
+    sha256 = "sha256-EofgwZSDp2ZFhlKL2tHfzMr3EsidzuY4pkRZrV2+1bA=";
   };
 
   jre' = jre_minimal.override {
@@ -42,11 +45,30 @@ let
       export GRADLE_USER_HOME=$(mktemp -d)
       gradle --no-daemon build
     '';
-    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
     installPhase = ''
       find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
-        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/''${\($5 =~ s/okio-jvm/okio/r)}" #e' \
-        | sh
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
+        | sh -x
+
+      # WARNING: don't try this at home and wear safety-goggles while working with this!
+      # We patch around in the dependency tree to resolve some spurious dependency resolution errors.
+      # Whenever this package gets updated, please check if some of these hacks are obsolete!
+
+      # Mimic existence of okio-3.2.0.jar. Originally known as okio-jvm-3.2.0 (and renamed),
+      # but gradle doesn't detect such renames, only fetches the latter and then fails
+      # in `signald.buildPhase` because it cannot find `okio-3.2.0.jar`.
+      pushd $out/com/squareup/okio/okio/3.2.0 &>/dev/null
+        cp -v ../../okio-jvm/3.2.0/okio-jvm-3.2.0.jar okio-3.2.0.jar
+      popd &>/dev/null
+
+      # For some reason gradle fetches 2.14.1 instead of 2.14.0 here even though 2.14.0 is required
+      # according to `./gradlew -q dependencies`, so we pretend to have 2.14.0 available here.
+      # According to the diff in https://github.com/FasterXML/jackson-dataformats-text/compare/jackson-dataformats-text-2.14.0...jackson-dataformats-text-2.14.1
+      # the only relevant change is in the code itself (and in the tests/docs), so this seems
+      # binary-compatible.
+      cp -v \
+        $out/com/fasterxml/jackson/dataformat/jackson-dataformat-toml/2.14.1/jackson-dataformat-toml-2.14.1.jar \
+        $out/com/fasterxml/jackson/dataformat/jackson-dataformat-toml/2.14.0/jackson-dataformat-toml-2.14.0.jar
     '';
     # Don't move info to share/
     forceShare = [ "dummy" ];
@@ -54,12 +76,12 @@ let
     outputHashMode = "recursive";
     # Downloaded jars differ by platform
     outputHash = {
-      x86_64-linux = "sha256-ANiNDdTuCuDEH5zUPsrVF6Uegdq3zVsMv+uMtYRX0jE=";
-      aarch64-linux = "sha256-V9zn4v/ZeLELAwFJ5y7OVAeJwZp4DmHm4KWxE6KpwGs=";
+      x86_64-linux = "sha256-9DHykkvazVBN2kfw1Pbejizk/R18v5w8lRBHZ4aXL5Q=";
+      aarch64-linux = "sha256-RgAiRbUojBc+9RN/HpAzzpTjkjZ6q+jebDsqvah5XBw=";
     }.${stdenv.system} or (throw "Unsupported platform");
   };
 
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation {
   inherit pname src version;
 
   patches = [
@@ -69,6 +91,11 @@ in stdenv.mkDerivation rec {
     })
   ];
 
+  passthru = {
+    # Mostly for debugging purposes.
+    inherit deps;
+  };
+
   buildPhase = ''
     runHook preBuild
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
index e80ccd2105a..9feb5ff10a0 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config, cmake, ninja, yasm
 , libjpeg, openssl_1_1, libopus, ffmpeg, alsa-lib, libpulseaudio, protobuf
 , openh264, usrsctp, libevent, libvpx
@@ -31,6 +31,14 @@ stdenv.mkDerivation {
     mesa libepoxy libglvnd
   ];
 
+  patches = [
+    # GCC 12 Fix
+    (fetchpatch {
+      url = "https://github.com/desktop-app/tg_owt/pull/101/commits/86d2bcd7afb8706663d29e30f65863de5a626142.patch";
+      hash = "sha256-iWS0mB8R0vqPU/0qf6Ax54UCAKYDVCPac2mi/VHbFm0=";
+    })
+  ];
+
   cmakeFlags = [
     # Building as a shared library isn't officially supported and may break at any time.
     "-DBUILD_SHARED_LIBS=OFF"
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
index 8033a734b98..49e8852fd0c 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.46.3";
+  version = "3.46.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "BFnqQFY2OKWllPQt3BzHGRotOCLCEcz/+82LNtMmQCU=";
+    sha256 = "bLYE99MKkh7MgxA9ZPKOj1+1VcFT9mHSQvayB/9Hy58=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index a5ed92f519e..65bb334611a 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -44,11 +44,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.46.3";
+  version = "3.46.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "riIQdCXTDRejo0w1bNpfQKrXhG12vbYINEUYtdQpwfM=";
+    sha256 = "eghCMc7SRaNLcT141Dp3Zgyso79S5qT1AwpqCAxpez0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index dfa92fc42c9..91a424d9eb1 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -18,6 +18,8 @@
 , gssSupport   ? true
 , writeScript
 }:
+assert smimeSupport -> sslSupport;
+assert gpgmeSupport -> sslSupport;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
diff --git a/pkgs/applications/networking/pcloud/default.nix b/pkgs/applications/networking/pcloud/default.nix
index 13175aaca67..caba7159214 100644
--- a/pkgs/applications/networking/pcloud/default.nix
+++ b/pkgs/applications/networking/pcloud/default.nix
@@ -38,12 +38,12 @@
 
 let
   pname = "pcloud";
-  version = "1.10.0";
-  code = "XZCy4sVZGb7r8VpDE4SCv2QI3OYx1HYChIvy";
+  version = "1.10.1";
+  code = "XZwHPTVZ7J1WFU374k8BqSWO2519y4aGFdAV";
   # Archive link's codes: https://www.pcloud.com/release-notes/linux.html
   src = fetchzip {
     url = "https://api.pcloud.com/getpubzip?code=${code}&filename=${pname}-${version}.zip";
-    hash = "sha256-kzID1y/jVuqFfD/PIUR2TFa0AvxKVcfNQ4ZXiHx0gRk=";
+    hash = "sha256-Mum1SL/EZ7iFK9e3o+T0CxkAQ0FkjSBy2FEUDonxtTI=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index e74084e14c5..3b171070a57 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,13 +4,13 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.23.0";
+      version = "1.23.1";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-Z4YVU45na4BgIbN/IlORpTCuf2EuSuOyppDRzswn3EI=";
+        hash = "sha256-Jbg56Nn+5ZjIv1KZrThkqWY+P13MglLE78E6jc0rbY0=";
       };
 
       vendorHash = "sha256-q63iaRxJRvPY0Np20O6JmdMEjSg/kxRneBfs8fRTwXk=";
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 700a9442996..f9e9ec57704 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -80,6 +80,11 @@ stdenv.mkDerivation rec {
   # guile warning
   GUILE_AUTO_COMPILE="0";
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=use-after-free"
+  ];
+
   # `make check` target does not define its prerequisites but expects them to
   # have already been built.  The list of targets below was built through trial
   # and error based on failing tests.
diff --git a/pkgs/applications/office/paperwork/paperwork-shell.nix b/pkgs/applications/office/paperwork/paperwork-shell.nix
index ee621df4d83..ca6cab2c1e4 100644
--- a/pkgs/applications/office/paperwork/paperwork-shell.nix
+++ b/pkgs/applications/office/paperwork/paperwork-shell.nix
@@ -11,6 +11,7 @@
 , fabulous
 , getkey
 , psutil
+, shared-mime-info
 
 , pkgs
 }:
@@ -39,6 +40,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    shared-mime-info
     openpaperwork-gtk
   ];
 
diff --git a/pkgs/applications/office/paperwork/src.nix b/pkgs/applications/office/paperwork/src.nix
index 980a4aabf7a..6323c2c417b 100644
--- a/pkgs/applications/office/paperwork/src.nix
+++ b/pkgs/applications/office/paperwork/src.nix
@@ -1,13 +1,13 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.1.1";
+  version = "2.1.2";
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     repo = "paperwork";
     group = "World";
     owner = "OpenPaperwork";
     rev = version;
-    sha256 = "2M2eMP54F3RRDMBuAZ1gBiBoMmTRJaHTUwtTjj4ZU+4=";
+    sha256 = "/5k+zUtTE+Dr879xbHDCAYrqlEJLsbkcRSG3GbA/PCg=";
   };
   sample_documents = fetchFromGitLab {
     domain = "gitlab.gnome.org";
diff --git a/pkgs/applications/plasma-mobile/angelfish.nix b/pkgs/applications/plasma-mobile/angelfish.nix
index 1e1800fad45..7a7e48d736d 100644
--- a/pkgs/applications/plasma-mobile/angelfish.nix
+++ b/pkgs/applications/plasma-mobile/angelfish.nix
@@ -3,7 +3,7 @@
 , cmake
 , corrosion
 , extra-cmake-modules
-, gcc11
+, gcc12
 , kconfig
 , kcoreaddons
 , kdbusaddons
@@ -46,7 +46,7 @@ mkDerivation rec {
     cmake
     corrosion
     extra-cmake-modules
-    gcc11 # doesn't build with GCC 9 from stdenv on aarch64
+    gcc12 # doesn't build with GCC 9 from stdenv on aarch64
   ] ++ (with rustPlatform; [
     cargoSetupHook
     rust.cargo
diff --git a/pkgs/applications/plasma-mobile/audiotube.nix b/pkgs/applications/plasma-mobile/audiotube.nix
index cb87fe0ed24..14bfc6d1891 100644
--- a/pkgs/applications/plasma-mobile/audiotube.nix
+++ b/pkgs/applications/plasma-mobile/audiotube.nix
@@ -2,7 +2,7 @@
 , mkDerivation
 
 , extra-cmake-modules
-, gcc11
+, gcc12
 , wrapGAppsHook
 
 , gst_all_1
@@ -22,7 +22,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     extra-cmake-modules
     wrapGAppsHook
-    gcc11 # doesn't build with GCC 9 from stdenv on aarch64
+    gcc12 # doesn't build with GCC 9 from stdenv on aarch64
     python3Packages.wrapPython
     python3Packages.pybind11
   ];
diff --git a/pkgs/applications/plasma-mobile/neochat.nix b/pkgs/applications/plasma-mobile/neochat.nix
index 2f655d5a9e0..8b3da82b8b8 100644
--- a/pkgs/applications/plasma-mobile/neochat.nix
+++ b/pkgs/applications/plasma-mobile/neochat.nix
@@ -1,4 +1,4 @@
-{ gcc11Stdenv
+{ gcc12Stdenv
 , lib
 , srcs
 
@@ -31,7 +31,7 @@
 }:
 
 # Workaround for AArch64 not using GCC11 yet.
-gcc11Stdenv.mkDerivation rec {
+gcc12Stdenv.mkDerivation rec {
   pname = "neochat";
   inherit (srcs.neochat) version src;
 
diff --git a/pkgs/applications/plasma-mobile/spacebar.nix b/pkgs/applications/plasma-mobile/spacebar.nix
index 7a2a3c0af8f..c120851e5b2 100644
--- a/pkgs/applications/plasma-mobile/spacebar.nix
+++ b/pkgs/applications/plasma-mobile/spacebar.nix
@@ -1,6 +1,6 @@
 { lib
 , mkDerivation
-, gcc11Stdenv
+, gcc12Stdenv
 , srcs
 
 , cmake
@@ -24,8 +24,8 @@
 , qtquickcontrols2
 }:
 
-# Workaround for AArch64 not using GCC11 yet.
-gcc11Stdenv.mkDerivation rec {
+# Workaround for AArch64 still using GCC9.
+gcc12Stdenv.mkDerivation rec {
   pname = "spacebar";
   inherit (srcs.spacebar) version src;
 
diff --git a/pkgs/applications/radio/qdmr/default.nix b/pkgs/applications/radio/qdmr/default.nix
index 6d0d71e8673..aa89d881975 100644
--- a/pkgs/applications/radio/qdmr/default.nix
+++ b/pkgs/applications/radio/qdmr/default.nix
@@ -9,11 +9,11 @@
   docbook_xsl_ns,
   wrapQtAppsHook,
   libusb1,
-  libyamlcpp,
   qtlocation,
   qtserialport,
   qttools,
   qtbase,
+  yaml-cpp,
 }:
 
 let
@@ -39,12 +39,12 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    libyamlcpp
     libusb1
     qtlocation
     qtserialport
     qttools
     qtbase
+    yaml-cpp
   ];
 
   postPatch = lib.optionalString isLinux ''
diff --git a/pkgs/applications/science/biology/inormalize/default.nix b/pkgs/applications/science/biology/inormalize/default.nix
index 8ea115c6b25..b4999193e17 100644
--- a/pkgs/applications/science/biology/inormalize/default.nix
+++ b/pkgs/applications/science/biology/inormalize/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "inormalize";
-  name  = "${pname}-2014-10-21";
+  version  = "unstable-2014-10-21";
 
   src = fetchFromGitHub {
     owner  = "BIC-MNI";
diff --git a/pkgs/applications/science/biology/last/default.nix b/pkgs/applications/science/biology/last/default.nix
index 7a101e6e19d..0104a5506bc 100644
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1445";
+  version = "1447";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-E3D9KmCIVcwXblwJ0wePk0wKoXwKA2UsSGqfMmRsw2A=";
+    hash = "sha256-zts1F2tFeBP7CQifpc2M4i6duK8FA7hQXTOizv8/kWM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/minc-widgets/default.nix b/pkgs/applications/science/biology/minc-widgets/default.nix
index e8aef4138b0..42178722b55 100644
--- a/pkgs/applications/science/biology/minc-widgets/default.nix
+++ b/pkgs/applications/science/biology/minc-widgets/default.nix
@@ -4,8 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "minc-widgets";
-  name  = "${pname}-2016-04-20";
-
+  version = "unstable-2016-04-20";
 
   src = fetchFromGitHub {
     owner  = "BIC-MNI";
diff --git a/pkgs/applications/science/biology/octopus/default.nix b/pkgs/applications/science/biology/octopus/default.nix
index 659b1e97f20..b7c8c138cb8 100644
--- a/pkgs/applications/science/biology/octopus/default.nix
+++ b/pkgs/applications/science/biology/octopus/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VaUr63v7mzhh4VBghH7a7qrqOYwl6vucmmKzTi9yAjY=";
   }) ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
   postInstall = ''
     mkdir $out/bin
     mv $out/octopus $out/bin
diff --git a/pkgs/applications/science/biology/plink-ng/default.nix b/pkgs/applications/science/biology/plink-ng/default.nix
index b21ef2d71d6..00fd0ff0083 100644
--- a/pkgs/applications/science/biology/plink-ng/default.nix
+++ b/pkgs/applications/science/biology/plink-ng/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   preBuild = ''
     sed -i 's|zlib-1.2.8/zlib.h|zlib.h|g' *.c *.h
-    ${if stdenv.cc.isClang then "sed -i 's|g++|clang++|g' Makefile.std" else ""}
+    ${lib.optionalString stdenv.cc.isClang "sed -i 's|g++|clang++|g' Makefile.std"}
 
     makeFlagsArray+=(
       ZLIB=-lz
diff --git a/pkgs/applications/science/chemistry/jmol/default.nix b/pkgs/applications/science/chemistry/jmol/default.nix
index b5b5be84c8e..98f7ccbfee0 100644
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.83";
+  version = "16.1.3";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-otvaDPdGRmtUfWfy7m+CJOyDOFuW/AExbskYnYEikY8=";
+    sha256 = "sha256-k1F4OaER9vg8GIi4eqppeh2f0MtlcBSfd4zkewFp2As=";
   };
 
   patchPhase = ''
diff --git a/pkgs/applications/science/chemistry/octopus/default.nix b/pkgs/applications/science/chemistry/octopus/default.nix
index d0058c8650d..cc145baef03 100644
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@@ -41,12 +41,12 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = with lib; [
-    "--with-yaml-prefix=${libyaml}"
+    "--with-yaml-prefix=${lib.getDev libyaml}"
     "--with-blas=-lblas"
     "--with-lapack=-llapack"
-    "--with-fftw-prefix=${fftw.dev}"
-    "--with-gsl-prefix=${gsl}"
-    "--with-libxc-prefix=${libxc}"
+    "--with-fftw-prefix=${lib.getDev fftw}"
+    "--with-gsl-prefix=${lib.getDev gsl}"
+    "--with-libxc-prefix=${lib.getDev libxc}"
     "--enable-openmp"
   ] ++ optional enableFma "--enable-fma3"
     ++ optional enableFma4 "--enable-fma4"
diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index d7250db07b4..83d696ec52b 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -76,11 +76,10 @@ stdenv.mkDerivation rec {
   # tagged releases don't have "unknown"
   # kicad nightlies use git describe --dirty
   # nix removes .git, so its approximated here
-  postPatch = if (!stable) then ''
+  postPatch = lib.optionalString (!stable) ''
     substituteInPlace cmake/KiCadVersion.cmake \
       --replace "unknown" "${builtins.substring 0 10 src.rev}"
-  ''
-  else "";
+  '';
 
   makeFlags = optionals (debug) [ "CFLAGS+=-Og" "CFLAGS+=-ggdb" ];
 
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index 9765d2fcc1e..047484fd9ff 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -214,7 +214,7 @@ stdenv.mkDerivation rec {
     description = (if (stable)
     then "Open Source Electronics Design Automation suite"
     else "Open Source EDA suite, development build")
-    + (if (!with3d) then ", without 3D models" else "");
+    + (lib.optionalString (!with3d) ", without 3D models");
     homepage = "https://www.kicad.org/";
     longDescription = ''
       KiCad is an open source software suite for Electronic Design Automation.
diff --git a/pkgs/applications/science/logic/cbmc/default.nix b/pkgs/applications/science/logic/cbmc/default.nix
index ba5719012ed..d61a9893942 100644
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@@ -60,9 +60,13 @@ stdenv.mkDerivation rec {
       --prefix PATH : "$out/share/cbmc" \
   '';
 
-  # fix "argument unused during compilation"
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
-    "-Wno-unused-command-line-argument";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    # fix "argument unused during compilation"
+    "-Wno-unused-command-line-argument"
+  ];
 
   # TODO: add jbmc support
   cmakeFlags = [ "-DWITH_JBMC=OFF" "-Dsat_impl=cadical" "-Dcadical_INCLUDE_DIR=${cadical.dev}/include" ];
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 10d77885b5c..49c9fc47fef 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -66,10 +66,10 @@ let
   buildIde = args.buildIde or (!coqAtLeast "8.14");
   ideFlags = optionalString (buildIde && !coqAtLeast "8.10")
     "-lablgtkdir ${ocamlPackages.lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt";
-  csdpPatch = if csdp != null then ''
+  csdpPatch = lib.optionalString (csdp != null) ''
     substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
     substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
-  '' else "";
+  '';
   ocamlPackages = if !isNull customOCamlPackages then customOCamlPackages
     else with versions; switch coq-version [
       { case = range "8.16" "8.17"; out = ocamlPackages_4_14; }
@@ -158,7 +158,7 @@ self = stdenv.mkDerivation {
     UNAME=$(type -tp uname)
     RM=$(type -tp rm)
     substituteInPlace tools/beautify-archive --replace "/bin/rm" "$RM"
-    ${if !coqAtLeast "8.7" then "substituteInPlace configure.ml --replace \"md5 -q\" \"md5sum\"" else ""}
+    ${lib.optionalString (!coqAtLeast "8.7") "substituteInPlace configure.ml --replace \"md5 -q\" \"md5sum\""}
     ${csdpPatch}
   '';
 
@@ -196,7 +196,7 @@ self = stdenv.mkDerivation {
     categories = [ "Development" "Science" "Math" "IDE" "GTK" ];
   });
 
-  postInstall = let suffix = if coqAtLeast "8.14" then "-core" else ""; in optionalString (!coqAtLeast "8.17") ''
+  postInstall = let suffix = optionalString (coqAtLeast "8.14") "-core"; in optionalString (!coqAtLeast "8.17") ''
     cp bin/votour $out/bin/
   '' + ''
     ln -s $out/lib/coq${suffix} $OCAMLFIND_DESTDIR/coq${suffix}
@@ -227,12 +227,12 @@ if coqAtLeast "8.17" then self.overrideAttrs(_: {
   buildPhase = ''
     runHook preBuild
     make dunestrap
-    dune build -p coq-core,coq-stdlib,coq,coqide-server${if buildIde then ",coqide" else ""} -j $NIX_BUILD_CORES
+    dune build -p coq-core,coq-stdlib,coq,coqide-server${lib.optionalString buildIde ",coqide"} -j $NIX_BUILD_CORES
     runHook postBuild
   '';
   installPhase = ''
     runHook preInstall
-    dune install --prefix $out coq-core coq-stdlib coq coqide-server${if buildIde then " coqide" else ""}
+    dune install --prefix $out coq-core coq-stdlib coq coqide-server${lib.optionalString buildIde " coqide"}
     runHook postInstall
   '';
 }) else self
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 83acfcfe9c3..580de87bdb2 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -8,15 +8,18 @@
 # R as of writing does not support outputting both .so and .a files; it outputs:
 #     --enable-R-static-lib conflicts with --enable-R-shlib and will be ignored
 , static ? false
+, testers
 }:
 
 assert (!blas.isILP64) && (!lapack.isILP64);
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "R";
   version = "4.2.2";
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "https://cran.r-project.org/src/base/R-${lib.versions.major version}/${pname}-${version}.tar.gz";
     sha256 = "sha256-D/YrQuxRr6VxPK7nxP3noMRZQLo5vvjFyUh/7wyVPfU=";
   };
@@ -97,6 +100,8 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "http://www.r-project.org/";
     description = "Free software environment for statistical computing and graphics";
@@ -121,8 +126,9 @@ stdenv.mkDerivation rec {
       user-defined recursive functions and input and output facilities.
     '';
 
+    pkgConfigModules = [ "libR" ];
     platforms = platforms.all;
 
     maintainers = with maintainers; [ jbedo ] ++ teams.sage.members;
   };
-}
+})
diff --git a/pkgs/applications/science/math/gap/default.nix b/pkgs/applications/science/math/gap/default.nix
index 677e7d9a0d9..7a466f8c000 100644
--- a/pkgs/applications/science/math/gap/default.nix
+++ b/pkgs/applications/science/math/gap/default.nix
@@ -134,8 +134,6 @@ stdenv.mkDerivation rec {
     # https://github.com/NixOS/nixpkgs/pull/192548#discussion_r992824942
     rm -r "$out/share/gap/pkg"
     cp -ar pkg tst "$out/share/gap"
-
-    makeWrapper "$out/lib/gap/gap" "$out/bin/gap" --add-flags "-l $out/share/gap"
   '';
 
   preFixup = ''
diff --git a/pkgs/applications/science/math/mxnet/default.nix b/pkgs/applications/science/math/mxnet/default.nix
index dcba888ce2f..021593124a3 100644
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@@ -54,6 +54,12 @@ stdenv.mkDerivation rec {
     ] else [ "-DUSE_CUDA=OFF" ])
     ++ lib.optional (!cudnnSupport) "-DUSE_CUDNN=OFF";
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
   postPatch = ''
     substituteInPlace 3rdparty/mkldnn/tests/CMakeLists.txt \
       --replace "/bin/bash" "${bash}/bin/bash"
diff --git a/pkgs/applications/science/math/pari/default.nix b/pkgs/applications/science/math/pari/default.nix
index 4c0032e6c8b..41dff3adede 100644
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , gmp
 , libX11
 , libpthreadstubs
@@ -25,6 +26,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-sEYoER7iKHZRmksc2vsy/rqjTq+iT56B9Y+NBX++4N0=";
   };
 
+  patches = [
+    # https://pari.math.u-bordeaux.fr/cgi-bin/bugreport.cgi?bug=2441
+    (fetchpatch {
+      name = "fix-find_isogenous_from_Atkin.patch";
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/pari/patches/bug2441.patch?id=9.8.rc0";
+      hash = "sha256-DvOUFlFDnopN+MJY6GYRPNabuoHPFch/nNn+49ygznc=";
+    })
+  ];
+
   buildInputs = [
     gmp
     libX11
diff --git a/pkgs/applications/science/math/sage/README.md b/pkgs/applications/science/math/sage/README.md
index c3a81c2109e..c4de5da45db 100644
--- a/pkgs/applications/science/math/sage/README.md
+++ b/pkgs/applications/science/math/sage/README.md
@@ -10,7 +10,7 @@ First you should find out which change to nixpkgs is at fault (if you don't alre
 
 If the build broke as a result of a package update, try those solutions in order:
 
-- search the [sage trac](https://trac.sagemath.org/) for keywords like "Upgrade <package>". Maybe somebody has already proposed a patch that fixes the issue. You can then add a `fetchpatch` to `sage-src.nix`.
+- search the [sage GitHub repo](https://github.com/sagemath/sage) for keywords like "Upgrade <package>". Maybe somebody has already proposed a patch that fixes the issue. You can then add a `fetchpatch` to `sage-src.nix`.
 
 - check if [gentoo](https://github.com/cschwan/sage-on-gentoo/tree/master/sci-mathematics/sage), [debian](https://salsa.debian.org/science-team/sagemath/tree/master/debian) or [arch linux](https://git.archlinux.org/svntogit/community.git/tree/trunk?h=packages/sagemath) already solved the problem. You can then again add a `fetchpatch` to `sage-src.nix`. If applicable you should also [propose the patch upstream](#proposing-a-sage-patch).
 
@@ -19,7 +19,7 @@ If the build broke as a result of a package update, try those solutions in order
 ```
 [user@localhost ~]$ git clone https://github.com/sagemath/sage.git
 [user@localhost ~]$ cd sage
-[user@localhost sage]$ git checkout 8.2 # substitute the relevant version here
+[user@localhost sage]$ git checkout 9.8 # substitute the relevant version here
 ```
 
 Then make the needed changes and generate a patch with `git diff`:
@@ -29,42 +29,10 @@ Then make the needed changes and generate a patch with `git diff`:
 [user@localhost ~]$ git diff -u > /path/to/nixpkgs/pkgs/applications/science/math/sage/patches/name-of-patch.patch
 ```
 
-Now just add the patch to `sage-src.nix` and test your changes. If they fix the problem, [propose them upstream](#proposing-a-sage-patch) and add a link to the trac ticket.
+Now just add the patch to `sage-src.nix` and test your changes. If they fix the problem, submit a PR upstream (refer to sages [Developer's Guide](http://doc.sagemath.org/html/en/developer/index.html) for further details).
 
 - pin the package version in `default.nix` and add a note that explains why that is necessary.
 
-
-## Proposing a sage patch
-
-You can [login the sage trac using GitHub](https://trac.sagemath.org/login). Your username will then be `gh-<your-github-name>`. The only other way is to request a trac account via email. After that refer to [git the hard way](http://doc.sagemath.org/html/en/developer/manual_git.html#chapter-manual-git) in the sage documentation. The "easy way" requires a non-GitHub account (requested via email) and a special tool. The "hard way" is really not all that hard if you're a bit familiar with git.
-
-Here's the gist, assuming you want to use ssh key authentication. First, [add your public ssh key](https://trac.sagemath.org/prefs/sshkeys). Then:
-
-```
-[user@localhost ~]$ git clone https://github.com/sagemath/sage.git
-[user@localhost ~]$ cd sage
-[user@localhost sage]$ git remote add trac git@trac.sagemath.org:sage.git -t master
-[user@localhost sage]$ git checkout -b u/gh-<your-github-username>/<your-branch-name> develop
-[user@localhost sage]$ <make changes>
-[user@localhost sage]$ git add .
-[user@localhost sage]$ git commit
-[user@localhost sage]$ git show # review your changes
-[user@localhost sage]$ git push --set-upstream trac u/gh-<your-github-username>/<your-branch-name>
-```
-
-You now created a branch on the trac server (you *must* follow the naming scheme as you only have push access to branches with the `u/gh-<your-github-username>/` prefix).
-Now you can [create a new trac ticket](https://trac.sagemath.org/newticket).
-- Write a description of the change
-- set the type and component as appropriate
-- write your real name in the "Authors" field
-- write `u/gh-<your-github-username>/<your-branch-name>` in the "Branch" field
-- click "Create ticket"
-- click "Modify" on the top right of your ticket (for some reason you can only change the ticket status after you have created it)
-- set the ticket status from `new` to `needs_review`
-- click "Save changes"
-
-Refer to sages [Developer's Guide](http://doc.sagemath.org/html/en/developer/index.html) for further details.
-
 ## I want to update sage
 
 You'll need to change the `version` field in `sage-src.nix`. Afterwards just try to build and let nix tell you which patches no longer apply (hopefully because they were adopted upstream). Remove those.
@@ -74,5 +42,5 @@ If the problem is not obvious, you can try to first update sage to an intermedia
 
 ## Well, that didn't help!
 
-If you couldn't fix the problem, create a GitHub issue on the nixpkgs repo and ping @timokau (or whoever is listed in the `maintainers` list of the sage package).
+If you couldn't fix the problem, create a GitHub issue on the nixpkgs repo and ping the sage maintainers (as listed in the sage package).
 Describe what you did and why it didn't work. Afterwards it would be great if you help the next guy out and improve this documentation!
diff --git a/pkgs/applications/science/math/sage/env-locations.nix b/pkgs/applications/science/math/sage/env-locations.nix
index 1f8b33f6873..39d358a1f9a 100644
--- a/pkgs/applications/science/math/sage/env-locations.nix
+++ b/pkgs/applications/science/math/sage/env-locations.nix
@@ -35,7 +35,8 @@ writeTextFile rec {
     export GRAPHS_DATA_DIR='${graphs}/share/graphs'
     export ELLCURVE_DATA_DIR='${elliptic_curves}/share/ellcurves'
     export POLYTOPE_DATA_DIR='${polytopes_db}/share/reflexive_polytopes'
-    export GAP_ROOT_DIR='${gap}/share/gap'
+    export GAP_LIB_DIR='${gap}/lib/gap'
+    export GAP_SHARE_DIR='${gap}/share/gap'
     export ECLDIR='${maxima.lisp-compiler}/lib/${maxima.lisp-compiler.pname}-${maxima.lisp-compiler.version}/'
     export COMBINATORIAL_DESIGN_DATA_DIR="${combinatorial_designs}/share/combinatorial_designs"
     export CREMONA_MINI_DATA_DIR="${elliptic_curves}/share/cremona"
diff --git a/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch b/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch
deleted file mode 100644
index 40bbbe23f1a..00000000000
--- a/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/sage/geometry/polyhedron/backend_normaliz.py b/src/sage/geometry/polyhedron/backend_normaliz.py
-index 86b89632a5..ca8a43b248 100644
---- a/src/sage/geometry/polyhedron/backend_normaliz.py
-+++ b/src/sage/geometry/polyhedron/backend_normaliz.py
-@@ -53,7 +53,7 @@ def _number_field_elements_from_algebraics_list_of_lists_of_lists(listss, **kwds
-         1.732050807568878?
-         sage: from sage.geometry.polyhedron.backend_normaliz import _number_field_elements_from_algebraics_list_of_lists_of_lists
-         sage: K, results, hom = _number_field_elements_from_algebraics_list_of_lists_of_lists([[[rt2], [1]], [[rt3]], [[1], []]]); results  # optional - sage.rings.number_field
--        [[[-a^3 + 3*a], [1]], [[-a^2 + 2]], [[1], []]]
-+        [[[-a^3 + 3*a], [1]], [[a^2 - 2]], [[1], []]]
-     """
-     from sage.rings.qqbar import number_field_elements_from_algebraics
-     numbers = []
-diff --git a/src/sage/lfunctions/pari.py b/src/sage/lfunctions/pari.py
-index d2b20f1891..6c31efe239 100644
---- a/src/sage/lfunctions/pari.py
-+++ b/src/sage/lfunctions/pari.py
-@@ -339,7 +339,7 @@ def lfun_eta_quotient(scalings, exponents):
-         0.0374412812685155
- 
-         sage: lfun_eta_quotient([6],[4])
--        [[Vecsmall([7]), [Vecsmall([6]), Vecsmall([4])]], 0, [0, 1], 2, 36, 1]
-+        [[Vecsmall([7]), [Vecsmall([6]), Vecsmall([4]), 0]], 0, [0, 1], 2, 36, 1]
- 
-         sage: lfun_eta_quotient([2,1,4], [5,-2,-2])
-         Traceback (most recent call last):
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index d68a2c8a107..5e18b741563 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -57,14 +57,14 @@ let
   );
 in
 stdenv.mkDerivation rec {
-  version = "9.7";
+  version = "9.8";
   pname = "sage-src";
 
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "sage";
     rev = version;
-    sha256 = "sha256-MYpCp18wqKwCa+tcJ7He14p1FXDlVm1vubQqQS9g3LY=";
+    sha256 = "sha256-dDbrzJXsOBARYfJz0r7n3LbaoXHnx7Acz6HBa95NV9o=";
   };
 
   # Patches needed because of particularities of nix or the way this is packaged.
@@ -89,14 +89,6 @@ stdenv.mkDerivation rec {
     # To help debug the transient error in
     # https://trac.sagemath.org/ticket/23087 when it next occurs.
     ./patches/configurationpy-error-verbose.patch
-
-    # https://trac.sagemath.org/ticket/33907
-    (fetchSageDiff {
-      name = "interfaces-expectpy-intermittent.patch";
-      base = "9.8.beta6";
-      rev = "6f5c1c2fc8bcfb5e6555716d05ce70511795ffa1";
-      sha256 = "sha256-z8FQxtrk62MHzPjrUTad+fMAE6XV8GTsLWKgGOM3zBg=";
-    })
   ];
 
   # Patches needed because of package updates. We could just pin the versions of
@@ -119,28 +111,12 @@ stdenv.mkDerivation rec {
     # adapted from https://trac.sagemath.org/ticket/23712#comment:22
     ./patches/tachyon-renamed-focallength.patch
 
-    # https://trac.sagemath.org/ticket/34118
-    (fetchSageDiff {
-      name = "sympy-1.11-upgrade.patch";
-      base = "9.7";
-      rev = "52815744bde2b682245b6f985a112f7cb8666056";
-      sha256 = "sha256-gv6z6JkQ6S6oCJQNkVgcPVvzlplyvR1nC7pWmcUiSc0=";
-    })
-
-    # https://trac.sagemath.org/ticket/34460
-    (fetchSageDiff {
-      name = "ipywidgets-8-upgrade.patch";
-      base = "9.7";
-      rev = "2816dbacb342398a23bb3099e20c92c8020ab0fa";
-      sha256 = "sha256-tCOsMxXwPkRg3FJGVvTqDzlWdra78UfDY6nci0Nr9GI=";
-    })
-
     # https://trac.sagemath.org/ticket/34391
     (fetchSageDiff {
       name = "gap-4.12-upgrade.patch";
-      base = "9.8.beta2";
-      rev = "eb8cd42feb58963adba67599bf6e311e03424328";
-      sha256 = "sha256-0dKewOZe2n3PqSdxCJt18FkqwTdrD0VA5MXAMiTW8Tw=";
+      base = "9.8.beta7";
+      rev = "dd4a17281adcda74e11f998ef519b6bd0dafb043";
+      sha256 = "sha256-UQT9DO9xd5hh5RucvUkIm+rggPKu8bc1YaSI6LVYH98=";
     })
 
     # https://trac.sagemath.org/ticket/34701
@@ -151,46 +127,6 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-9BhQLFB3wUhiXRQsK9L+I62lSjvTfrqMNi7QUIQvH4U=";
     })
 
-    # https://trac.sagemath.org/ticket/34537
-    (fetchSageDiff {
-      name = "pari-2.15.1-upgrade.patch";
-      squashed = true;
-      base = "54cd6fe6de52aee5a433e0569e8c370618cb2047"; # 9.8.beta1
-      rev = "1e86aa26790d84bf066eca67f98a60a8aa3d4d3a";
-      sha256 = "sha256-LUgcMqrKXWb72Kxl0n6MV5unLXlQSeG8ncN41F7TRSc=";
-      excludes = ["build/*"
-                  "src/sage/geometry/polyhedron/base_number_field.py"
-                  "src/sage/geometry/polyhedron/backend_normaliz.py"
-                  "src/sage/lfunctions/pari.py"];
-    })
-    # Some files were excluded from the above patch due to
-    # conflicts. The patch below contains rebased versions.
-    ./patches/pari-2.15.1-upgrade-rebased.patch
-
-    # https://trac.sagemath.org/ticket/34668
-    (fetchSageDiff {
-      name = "matplotlib-3.6-upgrade.patch";
-      base = "9.8.beta2";
-      rev = "5501e0de0dca1cff0355326dd42bd8c7e5749568";
-      sha256 = "sha256-ceJkVaecIsZewN8v/3gPQXFbFjv5Akz6zEFg/ToXdek=";
-    })
-
-    # https://trac.sagemath.org/ticket/34693
-    (fetchSageDiff {
-      name = "matplotlib-3.6-docbuilding.patch";
-      base = "9.8.beta4";
-      rev = "64589686c261d33e6b5aff2589bcae8af004bcc6";
-      sha256 = "sha256-j5AMY1TmhP+HBBBYaFZSkABJ5vtwe6iP2LRfGEgSm8Q=";
-    })
-
-    # https://trac.sagemath.org/ticket/34615
-    (fetchSageDiff {
-      name = "sphinx-5.2-upgrade.patch";
-      base = "9.8.beta1";
-      rev = "8f8af65e54d3a9962cfab40f15dc23f4e955b43f";
-      sha256 = "sha256-yhDdyxnXSSkqLcuOPBWSEBc26rk1Od3gLcWW8S2p8bY=";
-    })
-
     # temporarily paper over https://github.com/jupyter-widgets/ipywidgets/issues/3669
     ./patches/ipywidgets-on_submit-deprecationwarning.patch
 
diff --git a/pkgs/applications/science/math/sage/sage-tests.nix b/pkgs/applications/science/math/sage/sage-tests.nix
index 79d4f78082e..4910f5e8bf1 100644
--- a/pkgs/applications/science/math/sage/sage-tests.nix
+++ b/pkgs/applications/science/math/sage/sage-tests.nix
@@ -18,7 +18,7 @@ let
   src = sage-with-env.env.lib.src;
   runAllTests = files == null;
   testArgs = if runAllTests then "--all" else testFileList;
-  patienceSpecifier = if longTests then "--long" else "";
+  patienceSpecifier = lib.optionalString longTests "--long";
   timeSpecifier = if timeLimit == null then "" else "--short ${toString timeLimit}";
   relpathToArg = relpath: lib.escapeShellArg "${src}/${relpath}"; # paths need to be absolute
   testFileList = lib.concatStringsSep " " (map relpathToArg files);
diff --git a/pkgs/applications/science/misc/openmodelica/mkderivation/default.nix b/pkgs/applications/science/misc/openmodelica/mkderivation/default.nix
index 088fa83b7d9..ffa0a158ac9 100644
--- a/pkgs/applications/science/misc/openmodelica/mkderivation/default.nix
+++ b/pkgs/applications/science/misc/openmodelica/mkderivation/default.nix
@@ -16,7 +16,7 @@ let
   # getAttr-like helper for optional append to string:
   # "Hello" + appendByAttr "a" " " {a = "world";} = "Hello world"
   # "Hello" + appendByAttr "a" " " {} = "Hello"
-  appendByAttr = attr: sep: x: if hasAttr attr x then sep + (getAttr attr x) else "";
+  appendByAttr = attr: sep: x: lib.optionalString (hasAttr attr x) (sep + (getAttr attr x));
 
   # Are there any OM dependencies at all?
   ifDeps = length pkg.omdeps != 0;
diff --git a/pkgs/applications/science/physics/nnpdf/default.nix b/pkgs/applications/science/physics/nnpdf/default.nix
index c3ac1f6e0a8..ec29c02054d 100644
--- a/pkgs/applications/science/physics/nnpdf/default.nix
+++ b/pkgs/applications/science/physics/nnpdf/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , apfel
@@ -16,22 +15,15 @@
 
 stdenv.mkDerivation rec {
   pname = "nnpdf";
-  version = "4.0.4";
+  version = "4.0.6";
 
   src = fetchFromGitHub {
     owner = "NNPDF";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Alx4W0TkPzJBsnRXcKBrlEU6jWTnOjrji/IPk+dNCw0=";
+    hash = "sha256-mwOMNlYFhHZq/wakO1/HGwcxvKGKh5OyFa2D9d3Y3IA=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/NNPDF/nnpdf/commit/7943b62a91d3a41fd4f6366b18881d50695f4b45.diff";
-      hash = "sha256-UXhTO7vZgJiY8h3bgjg7SQC0gMUQsYQ/V/PgtCEQ7VU=";
-    })
-  ];
-
   postPatch = ''
     for file in CMakeLists.txt buildmaster/CMakeLists.txt; do
       substituteInPlace $file \
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index f53c6fb153b..04a810cf9e8 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -26,13 +26,13 @@
 
 buildPythonApplication rec {
   pname = "commitizen";
-  version = "2.41.0";
+  version = "2.42.0";
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dzAIRfUdyHSefDRDuPMsr8l2Dsiall2ZUDB6GufTbXE=";
+    hash = "sha256-13WEbF6in+zYZXWYqlYA98qJkKxjmcpQY9GuGS+DDtk=";
   };
 
   format = "pyproject";
diff --git a/pkgs/applications/version-management/fnc/default.nix b/pkgs/applications/version-management/fnc/default.nix
index a60aa27a843..7fd1b34d456 100644
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   preInstall = ''
     mkdir -p $out/bin
   '';
diff --git a/pkgs/applications/version-management/git-credential-keepassxc/default.nix b/pkgs/applications/version-management/git-credential-keepassxc/default.nix
index 27998f1c9c1..e9b4d75bf64 100644
--- a/pkgs/applications/version-management/git-credential-keepassxc/default.nix
+++ b/pkgs/applications/version-management/git-credential-keepassxc/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-credential-keepassxc";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "Frederick888";
     repo = "git-credential-keepassxc";
     rev = "v${version}";
-    hash = "sha256-ZpysJ+xs3IenqAdoswG0OkzxzuNPSKkqlutGxn4VRw8=";
+    hash = "sha256-siVSZke+anVTaLiJVyDEKvgX+VmS0axa+4721nlgmiw=";
   };
 
-  cargoHash = "sha256-IPsMlVfgwoFEQlXmW4gnt16WNF5W6akobUVct/iF42E=";
+  cargoHash = "sha256-QMAAKkjWgM/UiOfkNMLQxyGEYYmiSvE0Pd8fZXYyN48=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ DiskArbitration Foundation ];
 
diff --git a/pkgs/applications/version-management/git-trim/default.nix b/pkgs/applications/version-management/git-trim/default.nix
index 0ef5a678ee8..a7dbf0c6ba4 100644
--- a/pkgs/applications/version-management/git-trim/default.nix
+++ b/pkgs/applications/version-management/git-trim/default.nix
@@ -1,4 +1,14 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, openssl, libiconv, Security }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, libgit2
+, IOKit
+, CoreFoundation
+, fetchpatch
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-trim";
@@ -11,11 +21,22 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-XAO3Qg5I2lYZVNx4+Z5jKHRIFdNwBJsUQwJXFb4CbvM=";
   };
 
-  cargoHash = "sha256-KCLMb8NXxjscrmKXkP/RbV+LsJqOG7zaClJGFiQ4o9k=";
+  cargoHash = "sha256-mS8kNkZs8jX99ryG4XkU+U/iWIIcmET2vOfG1YNNZFU=";
+
+  cargoPatches = [
+    # Update git2 https://github.com/foriequal0/git-trim/pull/202
+    (fetchpatch {
+      url = "https://github.com/foriequal0/git-trim/commit/4355cd1d6f605455087c4d7ad16bfb92ffee941f.patch";
+      sha256 = "sha256-C1pX4oe9ZCgvqYTBJeSjMdr0KFyjv2PNVMJDlwCAngY=";
+    })
+  ];
+
+  OPENSSL_NO_VENDOR = 1;
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
+  buildInputs = [ openssl libgit2 ]
+    ++ lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];
 
   postInstall = ''
     install -Dm644 -t $out/share/man/man1/ docs/git-trim.1
diff --git a/pkgs/applications/version-management/radicle-cli/default.nix b/pkgs/applications/version-management/radicle-cli/default.nix
index f74ae1cf37a..213243f1851 100644
--- a/pkgs/applications/version-management/radicle-cli/default.nix
+++ b/pkgs/applications/version-management/radicle-cli/default.nix
@@ -10,7 +10,10 @@
 , openssl
 , libusb1
 , AppKit
+, git
 , openssh
+, testers
+, radicle-cli
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -50,11 +53,18 @@ rustPlatform.buildRustPackage rec {
     done
   '';
 
-  nativeCheckInputs = [ openssh ];
+  nativeCheckInputs = [
+    git
+    openssh
+  ];
   preCheck = ''
     eval $(ssh-agent)
   '';
 
+  passthru.tests = {
+    version = testers.testVersion { package = radicle-cli; };
+  };
+
   meta = {
     description = "Command-line tooling for Radicle, a decentralized code collaboration network";
     homepage = "https://radicle.xyz";
diff --git a/pkgs/applications/version-management/sapling/Cargo.lock b/pkgs/applications/version-management/sapling/Cargo.lock
index cd4fee21945..ff91d07e87b 100644
--- a/pkgs/applications/version-management/sapling/Cargo.lock
+++ b/pkgs/applications/version-management/sapling/Cargo.lock
@@ -4,9 +4,11 @@ version = 3
 
 [[package]]
 name = "abomonation"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e72913c99b1f927aa7bd59a41518fdd9995f63ffc8760f211609e0241c4fb2"
+version = "0.7.3+smallvec1"
+source = "git+https://github.com/markbt/abomonation?rev=0f43346d2afa2aedc64d61f3f4273e8d1e454642#0f43346d2afa2aedc64d61f3f4273e8d1e454642"
+dependencies = [
+ "smallvec",
+]
 
 [[package]]
 name = "abomonation_derive"
@@ -86,9 +88,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.68"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cb2f989d18dd141ab8ae82f64d1a8cdd37e0840f73a406896cf5e99502fab61"
+checksum = "224afbd727c3d6e4b90103ece64b8d1b67fbb1973b1046c2281eed3f3803f800"
 
 [[package]]
 name = "arc-swap"
@@ -148,7 +150,7 @@ dependencies = [
  "slab",
  "socket2",
  "waker-fn",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -165,7 +167,7 @@ dependencies = [
 name = "async-runtime"
 version = "0.1.0"
 dependencies = [
- "futures 0.3.25",
+ "futures 0.3.26",
  "num_cpus",
  "once_cell",
  "tokio",
@@ -173,9 +175,9 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.61"
+version = "0.1.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705339e0e4a9690e2908d2b3d049d85682cf19fbd5782494498fbf7003a6a282"
+checksum = "1cd7fce9ba8c3c042128ce72d8b2ddbf3a05747efb67ea0313c635e10bda47a2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -448,9 +450,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "2.3.2"
+version = "2.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ad2d4653bf5ca36ae797b1f4bb4dbddb60ce49ca4aed8a2ce4829f60425b80"
+checksum = "4b6561fd3f895a11e8f72af2cb7d22e08366bebc2b6b57f7744c4bda27034744"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -470,9 +472,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b45ea9b00a7b3f2988e9a65ad3917e62123c38dba709b666506207be96d1790b"
+checksum = "b7f0778972c64420fdedc63f09919c8a88bda7b25135357fd25a5d9f3257e832"
 dependencies = [
  "memchr",
  "serde",
@@ -484,14 +486,14 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ccc76d50a81d3a49665c71444ecefed1d1386477cb700c6fb7db517454fe1ff"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
 ]
 
 [[package]]
 name = "bumpalo"
-version = "3.11.1"
+version = "3.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "572f695136211188308f16ad2ca5c851a712c464060ae6974944458eb83880ba"
+checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
 
 [[package]]
 name = "byteorder"
@@ -511,9 +513,9 @@ dependencies = [
 
 [[package]]
 name = "bytes"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfb24e866b15a1af2a1b663f10c6b6b8f397a84aadb828f12e5b289ec23a3a3c"
+checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
 dependencies = [
  "serde",
 ]
@@ -540,6 +542,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "camino"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c77df041dc383319cc661b428b6961a005db4d6808d5e12536931b1ca9556055"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "cassowary"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -576,9 +587,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.78"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
 dependencies = [
  "jobserver",
 ]
@@ -604,7 +615,7 @@ dependencies = [
  "async-trait",
  "configmodel",
  "fail",
- "futures 0.3.25",
+ "futures 0.3.26",
  "io",
  "manifest",
  "manifest-tree",
@@ -688,7 +699,7 @@ version = "3.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea0c8bce528c4be4da13ea6fead8965e95b6073585a2f05204bd8f4119f82a65"
 dependencies = [
- "heck 0.4.0",
+ "heck 0.4.1",
  "proc-macro-error",
  "proc-macro2",
  "quote",
@@ -773,12 +784,12 @@ dependencies = [
 [[package]]
 name = "cloned"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 
 [[package]]
 name = "codegen_includer_proc_macro"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "quote",
 ]
@@ -822,6 +833,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "filetime",
+ "futures 0.3.26",
  "hostcaps",
  "identity",
  "lazy_static",
@@ -829,11 +841,13 @@ dependencies = [
  "mime",
  "regex",
  "reqwest",
+ "reqwest-eventsource",
  "rust-ini",
  "serde",
  "serde_json",
  "tempfile",
  "thiserror",
+ "tokio",
 ]
 
 [[package]]
@@ -854,9 +868,9 @@ dependencies = [
 
 [[package]]
 name = "concurrent-queue"
-version = "2.0.0"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd7bef69dc86e3c610e4e7aed41035e2a7ed12e72dd7530f61327a6579a4390b"
+checksum = "c278839b831783b70278b14df4d45e1beb1aad306c07bb796637de9a0e323e8e"
 dependencies = [
  "crossbeam-utils 0.8.14",
 ]
@@ -870,7 +884,7 @@ dependencies = [
  "codegen_includer_proc_macro",
  "const-cstr",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
  "ref-cast",
  "serde",
@@ -890,7 +904,7 @@ dependencies = [
  "codegen_includer_proc_macro",
  "const-cstr",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
  "ref-cast",
  "serde",
@@ -964,14 +978,14 @@ dependencies = [
 
 [[package]]
 name = "console"
-version = "0.15.4"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9b6515d269224923b26b5febea2ed42b2d5f2ce37284a4dd670fedd6cb8347a"
+checksum = "c3d79fbe8970a77e3e34151cc13d3b3e248aa0faaecb9f6091fa07ebefe5ad60"
 dependencies = [
  "encode_unicode",
  "lazy_static",
  "libc",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -1039,7 +1053,7 @@ dependencies = [
  "async-runtime",
  "cpython",
  "cpython_ext",
- "futures 0.3.25",
+ "futures 0.3.26",
  "itertools 0.10.5",
  "tokio",
 ]
@@ -1384,9 +1398,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d1075c37807dcf850c379432f0df05ba52cc30f279c5cfc43cc221ce7f8579"
+checksum = "bc831ee6a32dd495436e317595e639a587aa9907bef96fe6e6abc290ab6204e9"
 dependencies = [
  "cc",
  "cxxbridge-flags",
@@ -1396,9 +1410,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5044281f61b27bc598f2f6647d480aed48d2bf52d6eb0b627d84c0361b17aa70"
+checksum = "94331d54f1b1a8895cd81049f7eaaaef9d05a7dcb4d1fd08bf3ff0806246789d"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -1411,15 +1425,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61b50bc93ba22c27b0d31128d2d130a0a6b3d267ae27ef7e4fae2167dfe8781c"
+checksum = "48dcd35ba14ca9b40d6e4b4b39961f23d835dbb8eed74565ded361d93e1feb8a"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39e61fda7e62115119469c7b3591fd913ecca96fb766cfd3f2e2502ab7bc87a5"
+checksum = "81bbeb29798b407ccd82a3324ade1a7286e0d29851475990b612670f6f5124d2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1439,22 +1453,21 @@ dependencies = [
  "drawdag",
  "fail",
  "fs2",
- "futures 0.3.25",
+ "futures 0.3.26",
  "indexedlog",
  "indexmap",
- "itertools 0.10.5",
  "mincode",
  "minibytes",
  "nonblocking",
  "once_cell",
  "quickcheck",
  "rand 0.8.5",
+ "renderdag",
  "serde",
  "tempfile",
  "thiserror",
  "tokio",
  "tracing",
- "unicode-width",
  "vlqencoding",
 ]
 
@@ -1478,7 +1491,6 @@ dependencies = [
  "abomonation_derive",
  "minibytes",
  "quickcheck",
- "quickcheck_arbitrary_derive",
  "serde",
 ]
 
@@ -1492,7 +1504,7 @@ dependencies = [
  "hashbrown 0.12.3",
  "lock_api",
  "once_cell",
- "parking_lot_core 0.9.6",
+ "parking_lot_core 0.9.7",
  "rayon",
  "serde",
 ]
@@ -1624,7 +1636,7 @@ dependencies = [
  "dag",
  "edenapi_trait",
  "fail",
- "futures 0.3.25",
+ "futures 0.3.26",
  "http",
  "identity",
  "manifest-tree",
@@ -1663,12 +1675,12 @@ dependencies = [
  "async-runtime",
  "async-trait",
  "auth",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "chrono",
  "configmodel",
  "edenapi_trait",
  "edenapi_types",
- "futures 0.3.25",
+ "futures 0.3.26",
  "hg-http",
  "http-client",
  "itertools 0.10.5",
@@ -1701,7 +1713,7 @@ dependencies = [
  "crossbeam 0.8.2",
  "edenapi",
  "edenapi_types",
- "futures 0.3.25",
+ "futures 0.3.26",
  "itertools 0.10.5",
  "minibytes",
  "tokio",
@@ -1717,7 +1729,7 @@ dependencies = [
  "async-trait",
  "configmodel",
  "edenapi_types",
- "futures 0.3.25",
+ "futures 0.3.26",
  "http",
  "http-client",
  "minibytes",
@@ -1732,7 +1744,7 @@ name = "edenapi_types"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "dag-types",
  "insta_ext",
  "paste",
@@ -1773,9 +1785,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
 
 [[package]]
 name = "encode_unicode"
@@ -1794,9 +1806,9 @@ dependencies = [
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.31"
+version = "0.8.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9852635589dc9f9ea1b6fe9f05b50ef208c85c834a562f0c6abb1c475736ec2b"
+checksum = "071a31f4ee85403370b58aca746f01041ede6f0da2730960ad001edc2b71b394"
 dependencies = [
  "cfg-if 1.0.0",
 ]
@@ -1807,7 +1819,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21cdad81446a7f7dc43f6a77409efeb9733d2fa65553efef6018ef257c959b73"
 dependencies = [
- "heck 0.4.0",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "syn",
@@ -1876,6 +1888,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
 
 [[package]]
+name = "eventsource-stream"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74fef4569247a5f429d9156b9d0a2599914385dd189c539334c625d8099d90ab"
+dependencies = [
+ "futures-core",
+ "nom 7.1.3",
+ "pin-project-lite",
+]
+
+[[package]]
 name = "exchange"
 version = "0.1.0"
 dependencies = [
@@ -1931,14 +1954,14 @@ dependencies = [
 [[package]]
 name = "fb303_core"
 version = "0.0.0"
-source = "git+https://github.com/facebook/fb303.git?branch=main#0b9b58848f96c78f65513457c15292b81dc6b91e"
+source = "git+https://github.com/facebook/fb303.git?branch=main#d35b962b6f3dc787ed64c8d6b1b49a986e69f4d0"
 dependencies = [
  "anyhow",
  "async-trait",
  "codegen_includer_proc_macro",
  "const-cstr",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
  "ref-cast",
  "serde",
@@ -1952,7 +1975,7 @@ dependencies = [
 [[package]]
 name = "fbinit"
 version = "0.1.2"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "fbinit_macros",
  "quickcheck",
@@ -1961,7 +1984,7 @@ dependencies = [
 [[package]]
 name = "fbinit_macros"
 version = "0.1.2"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1971,14 +1994,15 @@ dependencies = [
 [[package]]
 name = "fbthrift"
 version = "0.0.1+unstable"
-source = "git+https://github.com/facebook/fbthrift.git?branch=main#46238c81c2c30ec8e9907203922218e4ecfd4cbb"
+source = "git+https://github.com/facebook/fbthrift.git?branch=main#f5641439382254134d192ca8fe3c9af23f87b5fa"
 dependencies = [
  "anyhow",
  "async-trait",
  "base64 0.11.0",
  "bufsize",
- "bytes 1.3.0",
- "futures 0.3.25",
+ "bytes 1.4.0",
+ "camino",
+ "futures 0.3.26",
  "ghost",
  "num-derive",
  "num-traits",
@@ -1991,24 +2015,24 @@ dependencies = [
 [[package]]
 name = "fbthrift_framed"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "byteorder",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "tokio-util 0.6.10",
 ]
 
 [[package]]
 name = "fbthrift_socket"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "anyhow",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "fbthrift",
  "fbthrift_framed",
  "fbthrift_util",
- "futures 0.3.25",
+ "futures 0.3.26",
  "tokio",
  "tokio-tower",
  "tokio-util 0.6.10",
@@ -2018,7 +2042,7 @@ dependencies = [
 [[package]]
 name = "fbthrift_util"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "tokio",
 ]
@@ -2043,7 +2067,7 @@ dependencies = [
  "cfg-if 1.0.0",
  "libc",
  "redox_syscall",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -2200,9 +2224,9 @@ checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"
 
 [[package]]
 name = "futures"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38390104763dc37a5145a53c29c63c1290b5d316d6086ec32c293f6736051bb0"
+checksum = "13e2792b0ff0340399d58445b88fd9770e3489eff258a4cbc1523418f12abf84"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2219,16 +2243,16 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f444c45a1cb86f2a7e301469fd50a82084a60dadc25d94529a8312276ecb71a"
 dependencies = [
- "futures 0.3.25",
+ "futures 0.3.26",
  "futures-timer",
  "pin-utils",
 ]
 
 [[package]]
 name = "futures-channel"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ba265a92256105f45b719605a571ffe2d1f0fea3807304b522c1d778f79eed"
+checksum = "2e5317663a9089767a1ec00a487df42e0ca174b61b4483213ac24448e4664df5"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -2236,15 +2260,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04909a7a7e4633ae6c4a9ab280aeb86da1236243a77b694a49eacd659a4bd3ac"
+checksum = "ec90ff4d0fe1f57d600049061dc6bb68ed03c7d2fbd697274c41805dcb3f8608"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7acc85df6714c176ab5edf386123fafe217be88c0840ec11f199441134a074e2"
+checksum = "e8de0a35a6ab97ec8869e32a2473f4b1324459e14c29275d14b10cb1fd19b50e"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -2253,9 +2277,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00f5fb52a06bdcadeb54e8d3671f8888a39697dcb0b81b23b55174030427f4eb"
+checksum = "bfb8371b6fb2aeb2d280374607aeabfc99d95c72edfe51692e42d3d7f0d08531"
 
 [[package]]
 name = "futures-lite"
@@ -2274,9 +2298,9 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdfb8ce053d86b91919aad980c220b1fb8401a9394410e1c289ed7e66b61835d"
+checksum = "95a73af87da33b5acf53acfebdc339fe592ecf5357ac7c0a7734ab9d8c876a70"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2285,15 +2309,15 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39c15cf1a4aa79df40f1bb462fb39676d0ad9e366c2a33b590d7c66f4f81fcf9"
+checksum = "f310820bb3e8cfd46c80db4d7fb8353e15dfff853a127158425f31e0be6c8364"
 
 [[package]]
 name = "futures-task"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ffb393ac5d9a6eaa9d3fdf37ae2776656b706e200c8e16b1bdb227f5198e6ea"
+checksum = "dcf79a1bf610b10f42aea489289c5a2c478a786509693b80cd39c44ccd936366"
 
 [[package]]
 name = "futures-timer"
@@ -2303,9 +2327,9 @@ checksum = "e64b03909df88034c26dc1547e8970b91f98bdb65165d6a4e9110d94263dbb2c"
 
 [[package]]
 name = "futures-util"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "197676987abd2f9cadff84926f410af1c183608d36641465df73ae8211dc65d6"
+checksum = "9c1d6de3acfef38d2be4b1f543f553131788603495be83da675e180c8d6b7bd1"
 dependencies = [
  "futures 0.1.31",
  "futures-channel",
@@ -2405,7 +2429,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "futures 0.3.25",
+ "futures 0.3.26",
  "git2",
  "minibytes",
  "storemodel",
@@ -2425,7 +2449,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "029d74589adefde59de1a0c4f4732695c32805624aec7b68d91503d4dba79afc"
 dependencies = [
  "aho-corasick",
- "bstr 1.1.0",
+ "bstr 1.2.0",
  "fnv",
  "log",
  "regex",
@@ -2437,7 +2461,7 @@ version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f9f29bc9dda355256b2916cf526ab02ce0aeaaaf2bad60d65ef3f12f11dd0f4"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "fnv",
  "futures-core",
  "futures-sink",
@@ -2485,9 +2509,9 @@ dependencies = [
 
 [[package]]
 name = "heck"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
@@ -2615,7 +2639,7 @@ dependencies = [
  "async-trait",
  "dag",
  "edenapi",
- "futures 0.3.25",
+ "futures 0.3.26",
  "gitdag",
  "metalog",
  "minibytes",
@@ -2669,7 +2693,7 @@ dependencies = [
 [[package]]
 name = "hostcaps"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "lazy_static",
 ]
@@ -2677,7 +2701,7 @@ dependencies = [
 [[package]]
 name = "hostname"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "anyhow",
  "hostname 0.3.1",
@@ -2700,7 +2724,7 @@ version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75f43d41e26995c17e71ee126451dd3941010b0514a81a9d11f3b341debc2399"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "fnv",
  "itoa 1.0.5",
 ]
@@ -2711,7 +2735,7 @@ version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "http",
  "pin-project-lite",
 ]
@@ -2728,7 +2752,7 @@ dependencies = [
  "curl",
  "curl-sys",
  "env_logger 0.7.1",
- "futures 0.3.25",
+ "futures 0.3.26",
  "http",
  "lru-cache",
  "maplit",
@@ -2780,11 +2804,11 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.23"
+version = "0.14.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "034711faac9d2166cb1baf1a2fb0b60b1f277f8492fd72176c17f3515e1abd3c"
+checksum = "5e011372fa0b68db8350aa7a248930ecc7839bf46d8485577d69f117a75f164c"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "futures-channel",
  "futures-core",
  "futures-util",
@@ -2821,7 +2845,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "hyper",
  "native-tls",
  "tokio",
@@ -2887,9 +2911,9 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a05705bc64e0b66a806c3740bd6578ea66051b157ec42dc219c785cbf185aef3"
+checksum = "dbe7873dab538a9a44ad79ede1faf5f30d49f9a5c883ddbab48bce81b64b7492"
 dependencies = [
  "globset",
  "lazy_static",
@@ -3004,12 +3028,12 @@ dependencies = [
 
 [[package]]
 name = "io-lifetimes"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7d6c6f8c91b4b9ed43484ad1a938e393caf35960fce7f82a040497207bd8e9e"
+checksum = "1abeb7a0dd0f8181267ff8adc397075586500b81b28a73e8a0208b00fc170fb3"
 dependencies = [
  "libc",
- "windows-sys",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -3080,9 +3104,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.60"
+version = "0.3.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+checksum = "445dde2150c55e483f3d8416706b97ec8e8237c307e5b7b4b8dd15e6af2a0730"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -3140,9 +3164,9 @@ checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
 
 [[package]]
 name = "libgit2-sys"
-version = "0.13.4+1.4.2"
+version = "0.13.5+1.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0fa6563431ede25f5cc7f6d803c6afbc1c5d3ad3d4925d12c882bf2b526f5d1"
+checksum = "51e5ea06c26926f1002dd553fded6cfcdc9784c1f60feeb58368b4d9b07b6dba"
 dependencies = [
  "cc",
  "libc",
@@ -3305,7 +3329,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-runtime",
- "futures 0.3.25",
+ "futures 0.3.26",
  "futures-batch",
  "manifest",
  "minibench",
@@ -3347,9 +3371,9 @@ dependencies = [
 
 [[package]]
 name = "matches"
-version = "0.1.9"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
+checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "maybe-uninit"
@@ -3441,7 +3465,7 @@ dependencies = [
 name = "metrics"
 version = "0.1.0"
 dependencies = [
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
 ]
 
@@ -3498,13 +3522,19 @@ version = "0.1.0"
 name = "minibytes"
 version = "0.1.0"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "memmap",
  "quickcheck",
  "serde",
 ]
 
 [[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
 name = "miniz_oxide"
 version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3555,7 +3585,7 @@ dependencies = [
  "libc",
  "log",
  "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -3645,11 +3675,10 @@ dependencies = [
  "bitflags",
  "dag",
  "drawdag",
- "futures 0.3.25",
+ "futures 0.3.26",
  "indexedlog",
  "rand 0.8.5",
  "rand_chacha 0.3.1",
- "renderdag",
  "tempdir",
  "types",
  "vlqencoding",
@@ -3735,10 +3764,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
 name = "nonblocking"
 version = "0.1.0"
 dependencies = [
- "futures 0.3.25",
+ "futures 0.3.26",
 ]
 
 [[package]]
@@ -3981,7 +4020,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
 dependencies = [
  "lock_api",
- "parking_lot_core 0.9.6",
+ "parking_lot_core 0.9.7",
 ]
 
 [[package]]
@@ -4000,15 +4039,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.6"
+version = "0.9.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba1ef8814b5c993410bb3adfad7a5ed269563e4a2f90c41f5d85be7fb47133bf"
+checksum = "9069cbb9f99e3a5083476ccb29ceb1de18b9118cafa53e90c9551235de2b9521"
 dependencies = [
  "cfg-if 1.0.0",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-sys",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -4070,9 +4109,9 @@ checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
 
 [[package]]
 name = "pest"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4257b4a04d91f7e9e6290be5d3da4804dd5784fafde3a497d73eb2b4a158c30a"
+checksum = "4ab62d2fa33726dbe6321cc97ef96d8cde531e3eeaf858a058de53a8a6d40d8f"
 dependencies = [
  "thiserror",
  "ucd-trie",
@@ -4080,9 +4119,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241cda393b0cdd65e62e07e12454f1f25d57017dcc514b1514cd3c4645e3a0a6"
+checksum = "8bf026e2d0581559db66d837fe5242320f525d85c76283c61f4d51a1238d65ea"
 dependencies = [
  "pest",
  "pest_generator",
@@ -4090,9 +4129,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46b53634d8c8196302953c74d5352f33d0c512a9499bd2ce468fc9f4128fa27c"
+checksum = "2b27bd18aa01d91c8ed2b61ea23406a676b42d82609c6e2581fba42f0c15f17f"
 dependencies = [
  "pest",
  "pest_meta",
@@ -4103,9 +4142,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ef4f1332a8d4678b41966bb4cc1d0676880e84183a1ecc3f4b69f03e99c7a51"
+checksum = "9f02b677c1859756359fc9983c2e56a0237f18624a3789528804406b7e915e5d"
 dependencies = [
  "once_cell",
  "pest",
@@ -4114,15 +4153,6 @@ dependencies = [
 
 [[package]]
 name = "phf"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dfb61232e34fcb633f43d12c58f83c1df82962dcdfa565a4e866ffc17dafe12"
-dependencies = [
- "phf_shared 0.8.0",
-]
-
-[[package]]
-name = "phf"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
@@ -4142,22 +4172,12 @@ dependencies = [
 
 [[package]]
 name = "phf_codegen"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbffee61585b0411840d3ece935cce9cb6321f01c45477d30066498cd5e1a815"
-dependencies = [
- "phf_generator 0.8.0",
- "phf_shared 0.8.0",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.8.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17367f0cc86f2d25802b2c26ee58a7b23faeccf78a396094c13dced0d0182526"
+checksum = "a56ac890c5e3ca598bbdeaa99964edb5b0258a583a9eb6ef4e89fc85d9224770"
 dependencies = [
- "phf_shared 0.8.0",
- "rand 0.7.3",
+ "phf_generator",
+ "phf_shared 0.11.1",
 ]
 
 [[package]]
@@ -4176,7 +4196,7 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92aacdc5f16768709a569e913f7451034034178b05bdc8acda226659a3dccc66"
 dependencies = [
- "phf_generator 0.11.1",
+ "phf_generator",
  "phf_shared 0.11.1",
  "proc-macro2",
  "quote",
@@ -4185,15 +4205,6 @@ dependencies = [
 
 [[package]]
 name = "phf_shared"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c00cf8b9eafe68dde5e9eaa2cef8ee84a9336a47d566ec55ca16589633b65af7"
-dependencies = [
- "siphasher",
-]
-
-[[package]]
-name = "phf_shared"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
@@ -4314,7 +4325,7 @@ dependencies = [
  "libc",
  "log",
  "wepoll-ffi",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -4369,9 +4380,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.49"
+version = "1.0.51"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57a8eca9f9c4ffde41714334dee777596264c7825420f521abc92b5b5deb63a5"
+checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
 dependencies = [
  "unicode-ident",
 ]
@@ -4524,13 +4535,12 @@ dependencies = [
  "cpython",
  "cpython_ext",
  "dag",
- "futures 0.3.25",
+ "futures 0.3.26",
  "hgcommits",
  "minibytes",
  "parking_lot 0.11.2",
  "pyedenapi",
  "pymetalog",
- "renderdag",
  "storemodel",
 ]
 
@@ -4599,7 +4609,7 @@ dependencies = [
  "edenapi",
  "edenapi_ext",
  "edenapi_types",
- "futures 0.3.25",
+ "futures 0.3.26",
  "minibytes",
  "progress-model",
  "pyconfigloader",
@@ -4896,7 +4906,7 @@ dependencies = [
  "configmodel",
  "cpython",
  "cpython_ext",
- "futures 0.3.25",
+ "futures 0.3.26",
  "io",
  "minibytes",
  "parking_lot 0.11.2",
@@ -5075,7 +5085,7 @@ dependencies = [
 [[package]]
 name = "quickcheck_arbitrary_derive"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "proc-macro2",
  "quickcheck",
@@ -5138,7 +5148,6 @@ dependencies = [
  "rand_chacha 0.2.2",
  "rand_core 0.5.1",
  "rand_hc",
- "rand_pcg",
 ]
 
 [[package]]
@@ -5215,15 +5224,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "rand_pcg"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16abd0c1b639e9eb4d7c50c0b8100b0d0f849be2349829c740fe8e6eb4816429"
-dependencies = [
- "rand_core 0.5.1",
-]
-
-[[package]]
 name = "rayon"
 version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5235,9 +5235,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.10.1"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cac410af5d00ab6884528b4ab69d1e8e146e8d471201800fa1b4524126de6ad3"
+checksum = "356a0625f1954f730c0201cdab48611198dc6ce21f4acff55089b5a78e6e835b"
 dependencies = [
  "crossbeam-channel 0.5.6",
  "crossbeam-deque 0.8.2",
@@ -5340,7 +5340,12 @@ dependencies = [
 name = "renderdag"
 version = "0.1.0"
 dependencies = [
+ "bitflags",
  "dag",
+ "itertools 0.10.5",
+ "nonblocking",
+ "serde",
+ "unicode-width",
 ]
 
 [[package]]
@@ -5401,7 +5406,7 @@ version = "0.11.11"
 source = "git+https://github.com/vmagro/reqwest?rev=f9490c06756a9d35ab874c44657db790a87af80b#f9490c06756a9d35ab874c44657db790a87af80b"
 dependencies = [
  "base64 0.13.1",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "encoding_rs",
  "futures-core",
  "futures-util",
@@ -5441,6 +5446,22 @@ dependencies = [
 ]
 
 [[package]]
+name = "reqwest-eventsource"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f03f570355882dd8d15acc3a313841e6e90eddbc76a93c748fd82cc13ba9f51"
+dependencies = [
+ "eventsource-stream",
+ "futures-core",
+ "futures-timer",
+ "mime",
+ "nom 7.1.3",
+ "pin-project-lite",
+ "reqwest",
+ "thiserror",
+]
+
+[[package]]
 name = "resolv-conf"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5466,7 +5487,7 @@ dependencies = [
  "edenapi",
  "edenapi_types",
  "fbinit",
- "futures 0.3.25",
+ "futures 0.3.26",
  "hex",
  "hg-http",
  "hg-metrics",
@@ -5613,16 +5634,16 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.36.6"
+version = "0.36.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4feacf7db682c6c329c4ede12649cd36ecab0f3be5b7d74e6a20304725db4549"
+checksum = "f43abb88211988493c1abb44a70efa56ff0ce98f233b7b276146f1f3f7ba9644"
 dependencies = [
  "bitflags",
  "errno",
  "io-lifetimes",
  "libc",
  "linux-raw-sys",
- "windows-sys",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -5685,7 +5706,7 @@ version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "713cfb06c7059f3588fb8044c0fad1d09e3c01d225e25b9220dbfdcf16dbb1b3"
 dependencies = [
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -5700,6 +5721,7 @@ dependencies = [
  "log",
  "serde",
  "thiserror",
+ "tokio",
  "toml",
 ]
 
@@ -5727,9 +5749,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.7.0"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bc1bb97804af6631813c55739f771071e0f2ed33ee20b68c86ec505d906356c"
+checksum = "a332be01508d814fed64bf28f798a146d73792121129962fdf335bb3c49a4254"
 dependencies = [
  "bitflags",
  "core-foundation",
@@ -5740,9 +5762,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.6.1"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0160a13a177a45bfb43ce71c01580998474f556ad854dcbca936dd2841a5c556"
+checksum = "31c9bb296072e961fcbd8853511dd39c2d8be2deb1e17c6860b1d30732b323b4"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -5788,20 +5810,20 @@ version = "0.1.0"
 [[package]]
 name = "serde_bser"
 version = "0.3.1"
-source = "git+https://github.com/facebook/watchman.git?branch=main#d21cc8bb48e1e03e7f0327b6ddbf28d76523ad1b"
+source = "git+https://github.com/facebook/watchman.git?branch=main#5cba53852d5970c5fa6c5ffe8f35afc908b77279"
 dependencies = [
  "anyhow",
  "byteorder",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "serde",
  "thiserror",
 ]
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.8"
+version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "718dc5fff5b36f99093fc49b280cfc96ce6fc824317783bff5a1fed0c7a64819"
+checksum = "416bda436f9aab92e02c8e10d49a15ddd339cea90b6e340fe51ed97abb548294"
 dependencies = [
  "serde",
 ]
@@ -5829,9 +5851,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.91"
+version = "1.0.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877c235533714907a8c2464236f5c4b2a17262ef1bd71f38f35ea592c8da6883"
+checksum = "7434af0dc1cbd59268aa98b4c22c131c0584d2232f6fb166efb993e2832e896a"
 dependencies = [
  "itoa 1.0.5",
  "ryu",
@@ -6037,7 +6059,7 @@ dependencies = [
 [[package]]
 name = "sorted_vector_map"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "itertools 0.10.5",
  "quickcheck",
@@ -6048,7 +6070,7 @@ name = "sparse"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "futures 0.3.25",
+ "futures 0.3.26",
  "globset",
  "once_cell",
  "pathmatcher",
@@ -6111,7 +6133,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "auto_impl",
- "futures 0.3.25",
+ "futures 0.3.26",
  "minibytes",
  "types",
 ]
@@ -6154,7 +6176,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "futures 0.3.25",
+ "futures 0.3.26",
  "pin-project 0.4.30",
  "tokio",
 ]
@@ -6284,9 +6306,9 @@ dependencies = [
 
 [[package]]
 name = "termcolor"
-version = "1.1.3"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
 dependencies = [
  "winapi-util",
 ]
@@ -6308,19 +6330,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb20089a8ba2b69debd491f8d2d023761cbf196e999218c591fa1e7e15a21907"
 dependencies = [
  "rustix",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
 name = "terminfo"
-version = "0.7.3"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76971977e6121664ec1b960d1313aacfa75642adc93b9d4d53b247bd4cb1747e"
+checksum = "da31aef70da0f6352dbcb462683eb4dd2bfad01cf3fc96cf204547b9a839a585"
 dependencies = [
- "dirs 2.0.2",
+ "dirs 4.0.0",
  "fnv",
- "nom",
- "phf 0.8.0",
+ "nom 5.1.2",
+ "phf 0.11.1",
  "phf_codegen",
 ]
 
@@ -6458,7 +6480,7 @@ dependencies = [
  "const-cstr",
  "fb303_core",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "once_cell",
  "ref-cast",
  "serde",
@@ -6479,7 +6501,7 @@ dependencies = [
  "config_thrift",
  "fb303_core",
  "fbthrift",
- "futures 0.3.25",
+ "futures 0.3.26",
  "thiserror",
  "thrift",
 ]
@@ -6487,7 +6509,7 @@ dependencies = [
 [[package]]
 name = "thrift_compiler"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "anyhow",
  "clap 2.34.0",
@@ -6555,18 +6577,18 @@ dependencies = [
 
 [[package]]
 name = "tinyvec_macros"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.24.1"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d9f76183f91ecfb55e1d7d5602bd1d979e38a3a522fe900241cf195624d67ae"
+checksum = "c8e00990ebabbe4c14c08aca901caed183ecd5c09562a12c824bb53d3c3fd3af"
 dependencies = [
  "autocfg",
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "libc",
  "memchr",
  "mio 0.8.5",
@@ -6577,7 +6599,7 @@ dependencies = [
  "socket2",
  "tokio-macros",
  "tracing",
- "windows-sys",
+ "windows-sys 0.42.0",
 ]
 
 [[package]]
@@ -6655,10 +6677,10 @@ dependencies = [
 [[package]]
 name = "tokio-uds-compat"
 version = "0.1.0"
-source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#2c560e8df63ad0228d6fa4fb1d7611d4477cd0b7"
+source = "git+https://github.com/facebookexperimental/rust-shed.git?branch=main#885afcb11d04db1fd59d1e2acdd18cc095f45eb2"
 dependencies = [
  "async-io",
- "futures 0.3.25",
+ "futures 0.3.26",
  "tokio",
  "tracing",
  "uds_windows",
@@ -6670,7 +6692,7 @@ version = "0.6.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "36943ee01a6d67977dd3f84a5a1d2efeb4ada3a1ae771cadfaa535d9d9fc6507"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "futures-core",
  "futures-io",
  "futures-sink",
@@ -6686,7 +6708,7 @@ version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bb2e075f03b3d66d8d8785356224ba688d2906a371015e225beeb65ca92c740"
 dependencies = [
- "bytes 1.3.0",
+ "bytes 1.4.0",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
@@ -6881,6 +6903,7 @@ dependencies = [
  "anyhow",
  "bitflags",
  "byteorder",
+ "fs2",
  "identity",
  "itertools 0.10.5",
  "pretty_assertions",
@@ -6889,7 +6912,7 @@ dependencies = [
  "rand_chacha 0.3.1",
  "repolock",
  "sha2 0.10.6",
- "tempdir",
+ "tempfile",
  "thiserror",
  "tracing",
  "twox-hash",
@@ -7028,9 +7051,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.8"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "099b7128301d285f79ddd55b9a83d5e6b9e97c92e0ea0daebee7263e932de992"
+checksum = "d54675592c1dbefd78cbd98db9bacd89886e1ca50692a0692baefffdeb92dd58"
 
 [[package]]
 name = "unicode-ident"
@@ -7049,9 +7072,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fdbf052a0783de01e944a6ce7a8cb939e295b1e7be835a1112c3b9a7f047a5a"
+checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
 
 [[package]]
 name = "unicode-width"
@@ -7255,9 +7278,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+checksum = "31f8dcbc21f30d9b8f2ea926ecb58f6b91192c17e9d33594b3df58b2007ca53b"
 dependencies = [
  "cfg-if 1.0.0",
  "wasm-bindgen-macro",
@@ -7265,9 +7288,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+checksum = "95ce90fd5bcc06af55a641a86428ee4229e44e07033963a2290a8e241607ccb9"
 dependencies = [
  "bumpalo",
  "log",
@@ -7280,9 +7303,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23639446165ca5a5de86ae1d8896b737ae80319560fbaa4c2887b7da6e7ebd7d"
+checksum = "f219e0d211ba40266969f6dbdd90636da12f75bee4fc9d6c23d1260dadb51454"
 dependencies = [
  "cfg-if 1.0.0",
  "js-sys",
@@ -7292,9 +7315,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+checksum = "4c21f77c0bedc37fd5dc21f897894a5ca01e7bb159884559461862ae90c0b4c5"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -7302,9 +7325,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+checksum = "2aff81306fcac3c7515ad4e177f521b5c9a15f2b08f4e32d823066102f35a5f6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7315,18 +7338,18 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.83"
+version = "0.2.84"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+checksum = "0046fef7e28c3804e5e38bfa31ea2a0f73905319b677e57ebe37e49358989b5d"
 
 [[package]]
 name = "watchman_client"
 version = "0.8.0"
-source = "git+https://github.com/facebook/watchman.git?branch=main#d21cc8bb48e1e03e7f0327b6ddbf28d76523ad1b"
+source = "git+https://github.com/facebook/watchman.git?branch=main#5cba53852d5970c5fa6c5ffe8f35afc908b77279"
 dependencies = [
  "anyhow",
- "bytes 1.3.0",
- "futures 0.3.25",
+ "bytes 1.4.0",
+ "futures 0.3.26",
  "maplit",
  "serde",
  "serde_bser",
@@ -7338,9 +7361,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.60"
+version = "0.3.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+checksum = "e33b99f4b23ba3eec1a53ac264e35a755f00e966e0065077d6027c0f575b0b97"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -7422,9 +7445,9 @@ dependencies = [
 
 [[package]]
 name = "which"
-version = "4.3.0"
+version = "4.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c831fbbee9e129a8cf93e7747a82da9d95ba8e16621cae60ec2cdc849bacb7b"
+checksum = "2441c784c52b289a054b7201fc93253e288f094e2f4be9058343127c4226a269"
 dependencies = [
  "either",
  "libc",
@@ -7496,6 +7519,30 @@ dependencies = [
 ]
 
 [[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2522491fbfcd58cc84d47aeb2958948c4b8982e9a2d8a2a35bbaed431390e7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -7556,7 +7603,7 @@ dependencies = [
  "configmodel",
  "crossbeam 0.8.2",
  "edenfs_client",
- "futures 0.3.25",
+ "futures 0.3.26",
  "identity",
  "io",
  "manifest",
@@ -7650,9 +7697,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.5+zstd.1.5.2"
+version = "2.0.6+zstd.1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edc50ffce891ad571e9f9afe5039c4837bede781ac4bb13052ed7ae695518596"
+checksum = "68a3f9792c0c3dc6c165840a75f47ae1f4da402c2d006881129579f6597e801b"
 dependencies = [
  "cc",
  "libc",
diff --git a/pkgs/applications/version-management/sapling/default.nix b/pkgs/applications/version-management/sapling/default.nix
index 3436c1ecda6..80cc6bf9e93 100644
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@@ -43,7 +43,7 @@ let
     owner = "facebook";
     repo = "sapling";
     rev = version;
-    hash = "sha256-zlvb+qn9SSBPZmlF8KwKTWyKj94FGOafSMRMNLsccOU";
+    hash = "sha256-WOvkw+vuU/9vWgxCx7ogawQWCr1O7E70uw/LhuLiSzE";
   };
 
   addonsSrc = "${src}/addons";
@@ -51,7 +51,7 @@ let
   # Fetches the Yarn modules in Nix to to be used as an offline cache
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${addonsSrc}/yarn.lock";
-    sha256 = "sha256-+29WAgSXVciHhLMN04yfKiWCpjM3Vo54nUdTP6owSLs";
+    sha256 = "sha256-haeVRO5JBStrO7fjI9WhC5xZwX0IlZR1wxh0Q+m/UQM";
   };
 
   # Builds the NodeJS server that runs with `sl web`
@@ -100,12 +100,13 @@ python3Packages.buildPythonApplication {
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "cloned-0.1.0" = "sha256-DYQTK722wgeDUJtOVXHLt42G6gpe6A62rET+JH+bPKU=";
+      "abomonation-0.7.3+smallvec1" = "sha256-AxEXR6GC8gHjycIPOfoViP7KceM29p2ZISIt4iwJzvM=";
+      "cloned-0.1.0" = "sha256-ZWO3/+O3Oc2Zg99seJ40CInrW1+3rFvL5HjIxhjDW5I=";
       "deltae-0.3.0" = "sha256-a9Skaqs+tVTw8x83jga+INBr+TdaMmo35Bf2wbfR6zs=";
-      "fb303_core-0.0.0" = "sha256-YEFNTYvtgp8nc/1O7AbdyxCD3Xx2xCjbS17fTTEsUL0=";
-      "fbthrift-0.0.1+unstable" = "sha256-mDoYhXOzQIDqP7XdmiBbmq5VmAKAgggTNH/kW2kHv4k=";
+      "fb303_core-0.0.0" = "sha256-LEib4QL5sMCUyQ9yGWnsOmO6hmlDaE80nfmrTC8elu0=";
+      "fbthrift-0.0.1+unstable" = "sha256-4SjdZzG6UP8OY7/Qy7ebdKOg1WdZ2USG6wJ7YhA/PxU=";
       "reqwest-0.11.11" = "sha256-uhc8XhkGW22XDNo0qreWdXeFF2cslOOZHfTRQ30IBcE=";
-      "serde_bser-0.3.1" = "sha256-/zn1NfXWytXvnalkgPsg9BdujVV97PGkXwmPtQGVeCc=";
+      "serde_bser-0.3.1" = "sha256-uW7qXEn0p7m6uo5r+rD3TDH/Lf1cBMWml0TbhysgDH8=";
     };
   };
   postPatch = ''
diff --git a/pkgs/applications/version-management/sapling/deps.json b/pkgs/applications/version-management/sapling/deps.json
index 9cbcd71cbcf..eeedd64b950 100644
--- a/pkgs/applications/version-management/sapling/deps.json
+++ b/pkgs/applications/version-management/sapling/deps.json
@@ -73,6 +73,6 @@
       "url": "https://files.pythonhosted.org/packages/4c/76/1e41fbb365ad20b6efab2e61b0f4751518444c953b390f9b2d36cf97eea0/Cython-0.29.32.tar.gz"
     }
   ],
-  "version": "0.2.20221222-152408-ha6a66d09",
-  "versionHash": "14601963598499040874"
+  "version": "0.2.20230124-180750-hf8cd450a",
+  "versionHash": "5465836048527734544"
 }
diff --git a/pkgs/applications/video/haruna/default.nix b/pkgs/applications/video/haruna/default.nix
index 3849acda947..25fac4fba61 100644
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@@ -26,13 +26,13 @@
 
 mkDerivation rec {
   pname = "haruna";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitLab {
     owner = "multimedia";
     repo = "haruna";
     rev = "v${version}";
-    hash = "sha256-hhHWxmr2EzW9QqfV1bpJCiWOWsmGJmvxvtQcuXlMTc4=";
+    hash = "sha256-kXafPUcWWvadGbcN4PAtXlFmfll/mSpwu2Sbh6Gxx4w=";
     domain = "invent.kde.org";
   };
 
diff --git a/pkgs/applications/video/jellyfin-media-player/default.nix b/pkgs/applications/video/jellyfin-media-player/default.nix
index 4f2b4ef440f..d6379550e88 100644
--- a/pkgs/applications/video/jellyfin-media-player/default.nix
+++ b/pkgs/applications/video/jellyfin-media-player/default.nix
@@ -28,13 +28,13 @@
 
 mkDerivation rec {
   pname = "jellyfin-media-player";
-  version = "1.7.1";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-media-player";
     rev = "v${version}";
-    sha256 = "sha256-piMqI4qxcNUSNC+0JE2KZ/cvlNgtxUOnSfrcWnBVzC0=";
+    sha256 = "sha256-/FqxZd0cFSfkeBQmZ2gU+5FUZZ+WbQ8c2IjaZ4/uGt8=";
   };
 
   patches = [
diff --git a/pkgs/applications/video/jellyfin-mpv-shim/default.nix b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
index 02c58925558..b1bf0dac39b 100644
--- a/pkgs/applications/video/jellyfin-mpv-shim/default.nix
+++ b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonApplication rec {
   pname = "jellyfin-mpv-shim";
-  version = "2.2.0";
+  version = "2.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JiSC6WjrLsWk3/m/EHq7KNXaJ6rqT2fG9TT1jPvYlK0=";
+    sha256 = "sha256-v5enaNcZ0aoyEcOFfkAsOIwEpVZ2oqYGMkLlDepBY7c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/mirakurun/default.nix b/pkgs/applications/video/mirakurun/default.nix
index ce4d412b77f..bc360392247 100644
--- a/pkgs/applications/video/mirakurun/default.nix
+++ b/pkgs/applications/video/mirakurun/default.nix
@@ -39,6 +39,9 @@ stdenvNoCC.mkDerivation rec {
     yarnLock = ./yarn.lock;
     packageJSON = ./package.json;
 
+    # workaround for https://github.com/webpack/webpack/issues/14532
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
     patches = [
       # NOTE: fixes for hardcoded paths and assumptions about filesystem
       # permissions
diff --git a/pkgs/applications/video/openshot-qt/libopenshot.nix b/pkgs/applications/video/openshot-qt/libopenshot.nix
index 4214bed7167..904f039758c 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot.nix
@@ -31,8 +31,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i 's/{UNITTEST++_INCLUDE_DIR}/ENV{UNITTEST++_INCLUDE_DIR}/g' tests/CMakeLists.txt
-    sed -i 's/{_REL_PYTHON_MODULE_PATH}/ENV{_REL_PYTHON_MODULE_PATH}/g' bindings/python/CMakeLists.txt
-    export _REL_PYTHON_MODULE_PATH=$(toPythonPath $out)
   '';
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
@@ -62,7 +60,10 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
-  cmakeFlags = [ "-DENABLE_RUBY=OFF" ];
+  cmakeFlags = [
+    "-DENABLE_RUBY=OFF"
+    "-DPYTHON_MODULE_PATH=${python3.sitePackages}"
+  ];
 
   meta = with lib; {
     homepage = "http://openshot.org/";
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 0ac55e0bec2..766a9fd1de5 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -14,8 +14,52 @@
 , go-md2man
 , nixosTests
 , python3
+, makeWrapper
+, symlinkJoin
+, extraPackages ? [ ]
+, runc
+, crun
+, conmon
+, slirp4netns
+, fuse-overlayfs
+, util-linux
+, iptables
+, iproute2
+, catatonit
+, gvproxy
+, aardvark-dns
+, netavark
+, testers
+, podman
 }:
+let
+  # do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
 
+  binPath = lib.makeBinPath ([
+  ] ++ lib.optionals stdenv.isLinux [
+    runc
+    crun
+    conmon
+    slirp4netns
+    fuse-overlayfs
+    util-linux
+    iptables
+    iproute2
+  ] ++ extraPackages);
+
+  helpersBin = symlinkJoin {
+    name = "podman-helper-binary-wrapper";
+
+    # this only works for some binaries, others may need to be be added to `binPath` or in the modules
+    paths = [
+      gvproxy
+    ] ++ lib.optionals stdenv.isLinux [
+      aardvark-dns
+      catatonit # added here for the pause image and also set in `containersConf` for `init_path`
+      netavark
+    ];
+  };
+in
 buildGoModule rec {
   pname = "podman";
   version = "4.4.1";
@@ -36,9 +80,9 @@ buildGoModule rec {
 
   doCheck = false;
 
-  outputs = [ "out" "man" ] ++ lib.optionals stdenv.isLinux [ "rootlessport" ];
+  outputs = [ "out" "man" ];
 
-  nativeBuildInputs = [ pkg-config go-md2man installShellFiles python3 ];
+  nativeBuildInputs = [ pkg-config go-md2man installShellFiles makeWrapper python3 ];
 
   buildInputs = lib.optionals stdenv.isLinux [
     btrfs-progs
@@ -50,13 +94,16 @@ buildGoModule rec {
     systemd
   ];
 
+  HELPER_BINARIES_DIR = "${helpersBin}/bin";
+  PREFIX = "${placeholder "out"}";
+
   buildPhase = ''
     runHook preBuild
     patchShebangs .
     ${if stdenv.isDarwin then ''
       make podman-remote # podman-mac-helper uses FHS paths
     '' else ''
-      make bin/podman bin/rootlessport
+      make bin/podman bin/rootlessport bin/quadlet
     ''}
     make docs
     runHook postBuild
@@ -64,29 +111,28 @@ buildGoModule rec {
 
   installPhase = ''
     runHook preInstall
-    mkdir -p {$out/{bin,etc,lib,share},$man} # ensure paths exist for the wrapper
     ${if stdenv.isDarwin then ''
-      mv bin/{darwin/podman,podman}
+      install bin/darwin/podman -Dt $out/bin
     '' else ''
-      install -Dm644 contrib/tmpfile/podman.conf -t $out/lib/tmpfiles.d
-      for s in contrib/systemd/**/*.in; do
-        substituteInPlace "$s" --replace "@@PODMAN@@" "podman" # don't use unwrapped binary
-      done
-      PREFIX=$out make install.systemd
-      install -Dm555 bin/rootlessport -t $rootlessport/bin
+      make install.bin install.systemd
     ''}
-    install -Dm555 bin/podman -t $out/bin
-    PREFIX=$out make install.completions
-    MANDIR=$man/share/man make install.man
+    make install.completions install.man
+    wrapProgram $out/bin/podman \
+      --prefix PATH : ${lib.escapeShellArg binPath}
     runHook postInstall
   '';
 
   postFixup = lib.optionalString stdenv.isLinux ''
-    RPATH=$(patchelf --print-rpath $out/bin/podman)
-    patchelf --set-rpath "${lib.makeLibraryPath [ systemd ]}":$RPATH $out/bin/podman
+    RPATH=$(patchelf --print-rpath $out/bin/.podman-wrapped)
+    patchelf --set-rpath "${lib.makeLibraryPath [ systemd ]}":$RPATH $out/bin/.podman-wrapped
   '';
 
   passthru.tests = {
+    version = testers.testVersion {
+      package = podman;
+      command = "HOME=$TMPDIR podman --version";
+    };
+  } // lib.optionalAttrs stdenv.isLinux {
     inherit (nixosTests) podman;
     # related modules
     inherit (nixosTests)
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
deleted file mode 100644
index 7fe483a7079..00000000000
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ podman-unwrapped
-, runCommand
-, makeWrapper
-, symlinkJoin
-, lib
-, stdenv
-, extraPackages ? []
-, runc # Default container runtime
-, crun # Container runtime (default with cgroups v2 for podman/buildah)
-, conmon # Container runtime monitor
-, slirp4netns # User-mode networking for unprivileged namespaces
-, fuse-overlayfs # CoW for images, much faster than default vfs
-, util-linux # nsenter
-, iptables
-, iproute2
-, catatonit
-, gvproxy
-, aardvark-dns
-, netavark
-}:
-
-# do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
-
-let
-  binPath = lib.makeBinPath ([
-  ] ++ lib.optionals stdenv.isLinux [
-    runc
-    crun
-    conmon
-    slirp4netns
-    fuse-overlayfs
-    util-linux
-    iptables
-    iproute2
-  ] ++ extraPackages);
-
-  helpersBin = symlinkJoin {
-    name = "${podman-unwrapped.pname}-helper-binary-wrapper-${podman-unwrapped.version}";
-
-    # this only works for some binaries, others may need to be be added to `binPath` or in the modules
-    paths = [
-      gvproxy
-    ] ++ lib.optionals stdenv.isLinux [
-      aardvark-dns
-      catatonit # added here for the pause image and also set in `containersConf` for `init_path`
-      netavark
-      podman-unwrapped.rootlessport
-    ];
-  };
-
-in runCommand podman-unwrapped.name {
-  name = "${podman-unwrapped.pname}-wrapper-${podman-unwrapped.version}";
-  inherit (podman-unwrapped) pname version passthru;
-
-  preferLocalBuild = true;
-
-  meta = builtins.removeAttrs podman-unwrapped.meta [ "outputsToInstall" ];
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-} ''
-  ln -s ${podman-unwrapped.man} $man
-
-  mkdir -p $out/bin
-  ln -s ${podman-unwrapped}/etc $out/etc
-  ln -s ${podman-unwrapped}/lib $out/lib
-  ln -s ${podman-unwrapped}/share $out/share
-  makeWrapper ${podman-unwrapped}/bin/podman $out/bin/podman \
-    --set CONTAINERS_HELPER_BINARY_DIR ${helpersBin}/bin \
-    --prefix PATH : ${lib.escapeShellArg binPath}
-''
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index e68cf7048b5..c20a2c53d60 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, python3, zlib, pkg-config, glib, buildPackages
+{ lib, stdenv, fetchurl, fetchpatch, python3Packages, zlib, pkg-config, glib, buildPackages
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
 , makeWrapper, runtimeShell, removeReferencesTo
@@ -51,7 +51,13 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [ makeWrapper removeReferencesTo pkg-config flex bison meson ninja perl python3 python3.pkgs.sphinx python3.pkgs.sphinx-rtd-theme ]
+  nativeBuildInputs = [
+    makeWrapper removeReferencesTo
+    pkg-config flex bison meson ninja perl
+
+    # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
+    python3Packages.python python3Packages.sphinx python3Packages.sphinx-rtd-theme
+  ]
     ++ lib.optionals gtkSupport [ wrapGAppsHook ]
     ++ lib.optionals stdenv.isDarwin [ sigtool ];
 
@@ -143,7 +149,6 @@ stdenv.mkDerivation rec {
     # have our patches and will be subtly broken because of that.
     "--meson=meson"
     "--cross-prefix=${stdenv.cc.targetPrefix}"
-    "--cpu=${stdenv.hostPlatform.uname.processor}"
     (lib.enableFeature guestAgentSupport "guest-agent")
   ] ++ lib.optional numaSupport "--enable-numa"
     ++ lib.optional seccompSupport "--enable-seccomp"
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index 06c8c4fcc0d..aa626443c53 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -7,16 +7,14 @@ let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
-      # TODO: Upgrade to 1.1.4 only after https://github.com/apptainer/apptainer/pull/967 get merge
-      # and https://github.com/apptainer/apptainer/issues/958 get fixed
-      version = "1.1.3";
+      version = "1.1.5";
       projectName = "apptainer";
 
       src = fetchFromGitHub {
         owner = "apptainer";
         repo = "apptainer";
         rev = "v${version}";
-        hash = "sha256-QFg6RC77OE/a6Qlzn6Zi5I7Iaq/U3/m0eI9yLArzuNc=";
+        hash = "sha256-onJkpHJNsO0cQO2m+TmdMuMkuvH178mDhOeX41bYFic=";
       };
 
       # Update by running
diff --git a/pkgs/applications/window-managers/cardboard/default.nix b/pkgs/applications/window-managers/cardboard/default.nix
index 5347b0961a5..6e483a40ef5 100644
--- a/pkgs/applications/window-managers/cardboard/default.nix
+++ b/pkgs/applications/window-managers/cardboard/default.nix
@@ -99,6 +99,8 @@ stdenv.mkDerivation rec {
      cp -r ${expected-wrap} ${expected-wrap.name}
      cp -r ${wlroots-wrap} ${wlroots-wrap.name}
     )
+
+    sed '1i#include <functional>' -i cardboard/ViewAnimation.h # gcc12
   '';
 
   # "Inherited" from Nixpkgs expression for wlroots
@@ -108,6 +110,8 @@ stdenv.mkDerivation rec {
     "-Dwlroots:libseat=disabled"
   ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ]; # gcc12
+
   meta = with lib; {
     homepage = "https://gitlab.com/cardboardwm/cardboard";
     description = "A scrollable, tiling Wayland compositor inspired on PaperWM";
diff --git a/pkgs/applications/window-managers/dwl/default.nix b/pkgs/applications/window-managers/dwl/default.nix
index 251092049c9..6e2e45e8b9a 100644
--- a/pkgs/applications/window-managers/dwl/default.nix
+++ b/pkgs/applications/window-managers/dwl/default.nix
@@ -63,8 +63,8 @@ stdenv.mkDerivation (self: {
 
   preBuild = ''
     makeFlagsArray+=(
-      XWAYLAND=${if enableXWayland then "-DXWAYLAND" else ""}
-      XLIBS=${if enableXWayland then "xcb\\ xcb-icccm" else ""}
+      XWAYLAND=${lib.optionalString enableXWayland "-DXWAYLAND"}
+      XLIBS=${lib.optionalString enableXWayland "xcb\\ xcb-icccm"}
     )
   '';
 
diff --git a/pkgs/applications/window-managers/sway/default.nix b/pkgs/applications/window-managers/sway/default.nix
index 6cfc5524022..32c8cf1b86a 100644
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@@ -22,13 +22,13 @@ let sd-bus-provider = if systemdSupport then "libsystemd" else "basu"; in
 
 stdenv.mkDerivation rec {
   pname = "sway-unwrapped";
-  version = "1.8";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "sway";
     rev = version;
-    hash = "sha256-r5qf50YK0Wl0gFiFdSE/J6ZU+D/Cz32u1mKzOqnIuJ0=";
+    hash = "sha256-WxnT+le9vneQLFPz2KoBduOI+zfZPhn1fKlaqbPL6/g=";
   };
 
   patches = [
diff --git a/pkgs/build-support/alternatives/blas/default.nix b/pkgs/build-support/alternatives/blas/default.nix
index 7186675a5c6..fec2d0526bb 100644
--- a/pkgs/build-support/alternatives/blas/default.nix
+++ b/pkgs/build-support/alternatives/blas/default.nix
@@ -83,12 +83,12 @@ stdenv.mkDerivation {
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname libblas${canonicalExtension} $out/lib/libblas${canonicalExtension}
   patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libblas${canonicalExtension}):${lib.getLib blasProvider'}/lib" $out/lib/libblas${canonicalExtension}
-'' else if stdenv.hostPlatform.isDarwin then ''
+'' else lib.optionalString (stdenv.hostPlatform.isDarwin) ''
   install_name_tool \
     -id $out/lib/libblas${canonicalExtension} \
     -add_rpath ${lib.getLib blasProvider'}/lib \
     $out/lib/libblas${canonicalExtension}
-'' else "") + ''
+'') + ''
 
   if [ "$out/lib/libblas${canonicalExtension}" != "$out/lib/libblas${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
     ln -s $out/lib/libblas${canonicalExtension} "$out/lib/libblas${stdenv.hostPlatform.extensions.sharedLibrary}"
@@ -115,12 +115,12 @@ EOF
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname libcblas${canonicalExtension} $out/lib/libcblas${canonicalExtension}
   patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libcblas${canonicalExtension}):${lib.getLib blasProvider'}/lib" $out/lib/libcblas${canonicalExtension}
-'' else if stdenv.hostPlatform.isDarwin then ''
+'' else lib.optionalString stdenv.hostPlatform.isDarwin ''
   install_name_tool \
     -id $out/lib/libcblas${canonicalExtension} \
     -add_rpath ${lib.getLib blasProvider'}/lib \
     $out/lib/libcblas${canonicalExtension}
-'' else "") + ''
+'') + ''
   if [ "$out/lib/libcblas${canonicalExtension}" != "$out/lib/libcblas${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
     ln -s $out/lib/libcblas${canonicalExtension} "$out/lib/libcblas${stdenv.hostPlatform.extensions.sharedLibrary}"
   fi
diff --git a/pkgs/build-support/alternatives/lapack/default.nix b/pkgs/build-support/alternatives/lapack/default.nix
index 80fb7be8c1e..9886a035e4e 100644
--- a/pkgs/build-support/alternatives/lapack/default.nix
+++ b/pkgs/build-support/alternatives/lapack/default.nix
@@ -54,10 +54,10 @@ stdenv.mkDerivation {
   cp -L "$liblapack" $out/lib/liblapack${canonicalExtension}
   chmod +w $out/lib/liblapack${canonicalExtension}
 
-'' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
+'' + (lib.optionalString (stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf") ''
   patchelf --set-soname liblapack${canonicalExtension} $out/lib/liblapack${canonicalExtension}
   patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapack${canonicalExtension}):${lapackProvider'}/lib" $out/lib/liblapack${canonicalExtension}
-'' else "") + ''
+'') + ''
 
   if [ "$out/lib/liblapack${canonicalExtension}" != "$out/lib/liblapack${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
     ln -s $out/lib/liblapack${canonicalExtension} "$out/lib/liblapack${stdenv.hostPlatform.extensions.sharedLibrary}"
@@ -83,10 +83,10 @@ EOF
   cp -L "$liblapacke" $out/lib/liblapacke${canonicalExtension}
   chmod +w $out/lib/liblapacke${canonicalExtension}
 
-'' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
+'' + (lib.optionalString (stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf") ''
   patchelf --set-soname liblapacke${canonicalExtension} $out/lib/liblapacke${canonicalExtension}
   patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapacke${canonicalExtension}):${lib.getLib lapackProvider'}/lib" $out/lib/liblapacke${canonicalExtension}
-'' else "") + ''
+'') + ''
 
   if [ -f "$out/lib/liblapacke.so.3" ]; then
     ln -s $out/lib/liblapacke.so.3 $out/lib/liblapacke.so
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 45ae3eba9b4..6e33f6189a4 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -92,9 +92,8 @@ let
     else "";
 
   expand-response-params =
-    if buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null"
-    then import ../expand-response-params { inherit (buildPackages) stdenv; }
-    else "";
+    lib.optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
+    (import ../expand-response-params { inherit (buildPackages) stdenv; });
 
 in
 
diff --git a/pkgs/build-support/build-bazel-package/default.nix b/pkgs/build-support/build-bazel-package/default.nix
index d1cd502e7e4..a3f331b23cb 100644
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@@ -118,10 +118,10 @@ stdenv.mkDerivation (fBuildAttrs // {
 
       # Remove all built in external workspaces, Bazel will recreate them when building
       rm -rf $bazelOut/external/{bazel_tools,\@bazel_tools.marker}
-      ${if removeRulesCC then "rm -rf $bazelOut/external/{rules_cc,\\@rules_cc.marker}" else ""}
+      ${lib.optionalString removeRulesCC "rm -rf $bazelOut/external/{rules_cc,\\@rules_cc.marker}"}
       rm -rf $bazelOut/external/{embedded_jdk,\@embedded_jdk.marker}
-      ${if removeLocalConfigCc then "rm -rf $bazelOut/external/{local_config_cc,\\@local_config_cc.marker}" else ""}
-      ${if removeLocal then "rm -rf $bazelOut/external/{local_*,\\@local_*.marker}" else ""}
+      ${lib.optionalString removeLocalConfigCc "rm -rf $bazelOut/external/{local_config_cc,\\@local_config_cc.marker}"}
+      ${lib.optionalString removeLocal "rm -rf $bazelOut/external/{local_*,\\@local_*.marker}"}
 
       # Clear markers
       find $bazelOut/external -name '@*\.marker' -exec sh -c 'echo > {}' \;
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
index 7ebcba73708..c4d967a11c6 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
@@ -212,7 +212,7 @@ in stdenv.mkDerivation {
     cd $out
     ${extraBuildCommands}
     cd $out
-    ${if isMultiBuild then extraBuildCommandsMulti else ""}
+    ${lib.optionalString isMultiBuild extraBuildCommandsMulti}
   '';
   preferLocalBuild = true;
   allowSubstitutes = false;
diff --git a/pkgs/build-support/build-fhs-userenv/env.nix b/pkgs/build-support/build-fhs-userenv/env.nix
index 09457caecb8..fbc50c2dc25 100644
--- a/pkgs/build-support/build-fhs-userenv/env.nix
+++ b/pkgs/build-support/build-fhs-userenv/env.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildEnv, writeText, pkgs, pkgsi686Linux }:
+{ stdenv, lib, buildEnv, writeText, pkgs, pkgsi686Linux }:
 
 { name
 , profile ? ""
@@ -237,7 +237,7 @@ in stdenv.mkDerivation {
     cd $out
     ${extraBuildCommands}
     cd $out
-    ${if isMultiBuild then extraBuildCommandsMulti else ""}
+    ${lib.optionalString isMultiBuild extraBuildCommandsMulti}
   '';
   preferLocalBuild = true;
   allowSubstitutes = false;
diff --git a/pkgs/build-support/build-graalvm-native-image/default.nix b/pkgs/build-support/build-graalvm-native-image/default.nix
index 64c6568e1bc..810ef52235e 100644
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, graalvm, glibcLocales }:
+{ lib, stdenv, graalvm-ce, glibcLocales }:
 
 { name ? "${args.pname}-${args.version}"
   # Final executable name
@@ -19,7 +19,7 @@
   # XMX size of GraalVM during build
 , graalvmXmx ? "-J-Xmx6g"
   # The GraalVM derivation to use
-, graalvmDrv ? graalvm
+, graalvmDrv ? graalvm-ce
   # Locale to be used by GraalVM compiler
 , LC_ALL ? "en_US.UTF-8"
 , meta ? { }
@@ -51,12 +51,14 @@ stdenv.mkDerivation (args // {
 
   disallowedReferences = [ graalvmDrv ];
 
+  passthru = { inherit graalvmDrv; };
+
   meta = {
     # default to graalvm's platforms
     platforms = graalvmDrv.meta.platforms;
     # default to executable name
     mainProgram = executable;
     # need to have native-image-installable-svm available
-    broken = !(builtins.elem "native-image-installable-svm" graalvmDrv.products);
+    broken = !(builtins.any (p: (p.product or "") == "native-image-installable-svm") graalvmDrv.products);
   } // meta;
 })
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 33df804d5ef..6520c04f5e8 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -59,9 +59,7 @@ let
   suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
 
   expand-response-params =
-    if (buildPackages.stdenv.hasCC or false) && buildPackages.stdenv.cc != "/dev/null"
-    then import ../expand-response-params { inherit (buildPackages) stdenv; }
-    else "";
+    lib.optionalString ((buildPackages.stdenv.hasCC or false) && buildPackages.stdenv.cc != "/dev/null") (import ../expand-response-params { inherit (buildPackages) stdenv; });
 
   useGccForLibs = isClang
     && libcxx == null
@@ -343,18 +341,11 @@ stdenv.mkDerivation {
     # compile, because it uses "#include_next <limits.h>" to find the
     # limits.h file in ../includes-fixed. To remedy the problem,
     # another -idirafter is necessary to add that directory again.
-    #
-    # We use --sysroot=/nix/store/does/not/exist to drop embedded default
-    # path to glibc headers gcc was built against. Without it -idirafter
-    # only appends to the list and outdated glibc headers end up being
-    # used. 'cc-cflags-before' is used to allow user's --sysroot= option
-    # to override our default.
     + optionalString (libc != null) (''
       touch "$out/nix-support/libc-cflags"
       touch "$out/nix-support/libc-ldflags"
       echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
     '' + optionalString (!(cc.langD or false)) ''
-      echo "--sysroot=/nix/store/does/not/exist" >> $out/nix-support/cc-cflags-before
       echo "-idirafter ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
     '' + optionalString (isGNU && (!(cc.langD or false))) ''
       for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
diff --git a/pkgs/build-support/fetchdocker/credentials.nix b/pkgs/build-support/fetchdocker/credentials.nix
index 6d084d3c77e..da198483268 100644
--- a/pkgs/build-support/fetchdocker/credentials.nix
+++ b/pkgs/build-support/fetchdocker/credentials.nix
@@ -35,4 +35,4 @@ let
     ({prefix, path}: "DOCKER_CREDENTIALS" == prefix)
     builtins.nixPath);
 in
-  if (pathParts != []) then (builtins.head pathParts).path else ""
+  lib.optionalString (pathParts != []) ((builtins.head pathParts).path)
diff --git a/pkgs/build-support/fetchfossil/default.nix b/pkgs/build-support/fetchfossil/default.nix
index 3a4876bc5de..7866c403ec4 100644
--- a/pkgs/build-support/fetchfossil/default.nix
+++ b/pkgs/build-support/fetchfossil/default.nix
@@ -1,9 +1,9 @@
-{stdenv, fossil, cacert}:
+{stdenv, lib, fossil, cacert}:
 
 {name ? null, url, rev, sha256}:
 
 stdenv.mkDerivation {
-  name = "fossil-archive" + (if name != null then "-${name}" else "");
+  name = "fossil-archive" + (lib.optionalString (name != null) "-${name}");
   builder = ./builder.sh;
   nativeBuildInputs = [fossil cacert];
 
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 2d0b4b20ef8..56973f5d367 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -7,9 +7,7 @@
 
     short = builtins.substring 0 7 rev;
 
-    appendShort = if (builtins.match "[a-f0-9]*" rev) != null
-      then "-${short}"
-      else "";
+    appendShort = lib.optionalString ((builtins.match "[a-f0-9]*" rev) != null) "-${short}";
   in "${if matched == null then base else builtins.head matched}${appendShort}";
 in
 { url, rev ? "HEAD", md5 ? "", sha256 ? "", hash ? "", leaveDotGit ? deepClone
diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index 15309d0a195..b3c28fb0e26 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -12,13 +12,13 @@ if md5 != null then
 else
 # TODO: statically check if mercurial as the https support if the url starts woth https.
 stdenvNoCC.mkDerivation {
-  name = "hg-archive" + (if name != null then "-${name}" else "");
+  name = "hg-archive" + (lib.optionalString (name != null) "-${name}");
   builder = ./builder.sh;
   nativeBuildInputs = [mercurial];
 
   impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
-  subrepoClause = if fetchSubrepos then "S" else "";
+  subrepoClause = lib.optionalString fetchSubrepos "S";
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchpatch/default.nix b/pkgs/build-support/fetchpatch/default.nix
index 3ebe797f736..d059715cedc 100644
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@@ -18,7 +18,7 @@
 let
   args' = if relative != null then {
     stripLen = 1 + lib.length (lib.splitString "/" relative) + stripLen;
-    extraPrefix = if extraPrefix != null then extraPrefix else "";
+    extraPrefix = lib.optionalString (extraPrefix != null) extraPrefix;
   } else {
     inherit stripLen extraPrefix;
   };
diff --git a/pkgs/build-support/libredirect/default.nix b/pkgs/build-support/libredirect/default.nix
index b5eb21e5ba4..6e2de7fa11b 100644
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@@ -46,14 +46,14 @@ else stdenv.mkDerivation rec {
       -L${llvmPackages_13.clang.libc}/lib \
       -Wl,-install_name,$libName \
       -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     '' else if stdenv.isDarwin then ''
     $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
       -Wl,-install_name,$out/lib/$libName \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     '' else ''
     $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     ''}
 
     if [ -n "$doInstallCheck" ]; then
diff --git a/pkgs/build-support/libredirect/libredirect.c b/pkgs/build-support/libredirect/libredirect.c
index 1222d2ee75c..9ecc16450cc 100644
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@@ -201,6 +201,37 @@ WRAPPER(int, __xstat64)(int ver, const char * path, struct stat64 * st)
 WRAPPER_DEF(__xstat64)
 #endif
 
+#if defined(__linux__) && defined(STATX_TYPE)
+WRAPPER(int, statx)(int dirfd, const char * restrict pathname, int flags,
+    unsigned int mask, struct statx * restrict statxbuf)
+{
+    int (*statx_real) (int, const char * restrict, int,
+        unsigned int, struct statx * restrict) = LOOKUP_REAL(statx);
+    char buf[PATH_MAX];
+    return statx_real(dirfd, rewrite(pathname, buf), flags, mask, statxbuf);
+}
+WRAPPER_DEF(statx)
+#endif
+
+WRAPPER(int, fstatat)(int dirfd, const char * pathname, struct stat * statbuf, int flags)
+{
+    int (*fstatat_real) (int, const char *, struct stat *, int) = LOOKUP_REAL(fstatat);
+    char buf[PATH_MAX];
+    return fstatat_real(dirfd, rewrite(pathname, buf), statbuf, flags);
+}
+WRAPPER_DEF(fstatat);
+
+// In musl libc, fstatat64 is simply a macro for fstatat
+#if !defined(__APPLE__) && !defined(fstatat64)
+WRAPPER(int, fstatat64)(int dirfd, const char * pathname, struct stat64 * statbuf, int flags)
+{
+    int (*fstatat64_real) (int, const char *, struct stat64 *, int) = LOOKUP_REAL(fstatat64);
+    char buf[PATH_MAX];
+    return fstatat64_real(dirfd, rewrite(pathname, buf), statbuf, flags);
+}
+WRAPPER_DEF(fstatat64);
+#endif
+
 WRAPPER(int, stat)(const char * path, struct stat * st)
 {
     int (*__stat_real) (const char *, struct stat *) = LOOKUP_REAL(stat);
@@ -209,6 +240,17 @@ WRAPPER(int, stat)(const char * path, struct stat * st)
 }
 WRAPPER_DEF(stat)
 
+// In musl libc, stat64 is simply a macro for stat
+#if !defined(__APPLE__) && !defined(stat64)
+WRAPPER(int, stat64)(const char * path, struct stat64 * st)
+{
+    int (*stat64_real) (const char *, struct stat64 *) = LOOKUP_REAL(stat64);
+    char buf[PATH_MAX];
+    return stat64_real(rewrite(path, buf), st);
+}
+WRAPPER_DEF(stat64)
+#endif
+
 WRAPPER(int, access)(const char * path, int mode)
 {
     int (*access_real) (const char *, int mode) = LOOKUP_REAL(access);
@@ -346,6 +388,14 @@ WRAPPER(int, system)(const char *command)
 }
 WRAPPER_DEF(system)
 
+WRAPPER(int, chdir)(const char *path)
+{
+    int (*chdir_real) (const char *) = LOOKUP_REAL(chdir);
+    char buf[PATH_MAX];
+    return chdir_real(rewrite(path, buf));
+}
+WRAPPER_DEF(chdir);
+
 WRAPPER(int, mkdir)(const char *path, mode_t mode)
 {
     int (*mkdir_real) (const char *path, mode_t mode) = LOOKUP_REAL(mkdir);
diff --git a/pkgs/build-support/libredirect/test.c b/pkgs/build-support/libredirect/test.c
index 144e6d3d66d..7dd384ae3ed 100644
--- a/pkgs/build-support/libredirect/test.c
+++ b/pkgs/build-support/libredirect/test.c
@@ -63,6 +63,12 @@ int main(int argc, char *argv[])
     FILE *testfp;
     int testfd;
     struct stat testsb;
+#ifndef __APPLE__
+    struct stat64 testsb64;
+#endif
+#if defined(__linux__) && defined(STATX_TYPE)
+    struct statx testsbx;
+#endif
     char buf[PATH_MAX];
 
     testfp = fopen(TESTPATH, "r");
@@ -76,6 +82,20 @@ int main(int argc, char *argv[])
     assert(access(TESTPATH, X_OK) == 0);
 
     assert(stat(TESTPATH, &testsb) != -1);
+#ifndef __APPLE__
+    assert(stat64(TESTPATH, &testsb64) != -1);
+#endif
+    assert(fstatat(123, TESTPATH, &testsb, 0) != -1);
+#ifndef __APPLE__
+    assert(fstatat64(123, TESTPATH, &testsb64, 0) != -1);
+#endif
+#if defined(__linux__) && defined(STATX_TYPE)
+    assert(statx(123, TESTPATH, 0, STATX_ALL, &testsbx) != -1);
+#endif
+
+    assert(getcwd(buf, PATH_MAX) != NULL);
+    assert(chdir(TESTDIR) == 0);
+    assert(chdir(buf) == 0);
 
     assert(mkdir(TESTDIR "/dir-mkdir", 0777) == 0);
     assert(unlink(TESTDIR "/dir-mkdir") == -1); // it's a directory!
diff --git a/pkgs/build-support/nuke-references/default.nix b/pkgs/build-support/nuke-references/default.nix
index c2dfe27b2c6..8f02c559238 100644
--- a/pkgs/build-support/nuke-references/default.nix
+++ b/pkgs/build-support/nuke-references/default.nix
@@ -36,6 +36,6 @@ stdenvNoCC.mkDerivation {
     inherit perl;
     inherit (builtins) storeDir;
     shell = lib.getBin shell + (shell.shellPath or "");
-    signingUtils = if darwinCodeSign then signingUtils else "";
+    signingUtils = lib.optionalString darwinCodeSign signingUtils;
   };
 }
diff --git a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
index 1aa14cfeb7c..1d43c8e162a 100644
--- a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@@ -12,7 +12,7 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-set -- "$@" @addFlags@
+set -- @addFlags@ "$@"
 
 if (( ${#role_suffixes[@]} > 0 )); then
     # replace env var with nix-modified one
diff --git a/pkgs/build-support/release/binary-tarball.nix b/pkgs/build-support/release/binary-tarball.nix
index 168343c8082..24d5b2e1caf 100644
--- a/pkgs/build-support/release/binary-tarball.nix
+++ b/pkgs/build-support/release/binary-tarball.nix
@@ -10,7 +10,7 @@
    directory, so the Makefile of the package should support DESTDIR.
 */
 
-{ src, stdenv
+{ src, lib, stdenv
 , name ? "binary-tarball"
 , ... } @ args:
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation (
   // args //
 
   {
-    name = name + (if src ? version then "-" + src.version else "");
+    name = name + (lib.optionalString (src ? version) "-${src.version}");
 
     postHook = ''
       mkdir -p $out/nix-support
diff --git a/pkgs/build-support/release/debian-build.nix b/pkgs/build-support/release/debian-build.nix
index 679adad827d..6e08caf0a4e 100644
--- a/pkgs/build-support/release/debian-build.nix
+++ b/pkgs/build-support/release/debian-build.nix
@@ -24,7 +24,7 @@ vmTools.runInLinuxImage (stdenv.mkDerivation (
   // removeAttrs args ["vmTools" "lib"] //
 
   {
-    name = name + "-" + diskImage.name + (if src ? version then "-" + src.version else "");
+    name = name + "-" + diskImage.name + (lib.optionalString (src ? version) "-${src.version}");
 
     # !!! cut&paste from rpm-build.nix
     postHook = ''
diff --git a/pkgs/build-support/release/default.nix b/pkgs/build-support/release/default.nix
index da1078369a5..ee414ea3280 100644
--- a/pkgs/build-support/release/default.nix
+++ b/pkgs/build-support/release/default.nix
@@ -11,7 +11,7 @@ rec {
   makeSourceTarball = sourceTarball; # compatibility
 
   binaryTarball = args: import ./binary-tarball.nix (
-    { inherit stdenv;
+    { inherit lib stdenv;
     } // args);
 
   mvnBuild = args: import ./maven-build.nix (
@@ -38,7 +38,7 @@ rec {
     } // args);
 
   rpmBuild = args: import ./rpm-build.nix (
-    { inherit vmTools;
+    { inherit lib vmTools;
     } // args);
 
   debBuild = args: import ./debian-build.nix (
diff --git a/pkgs/build-support/release/maven-build.nix b/pkgs/build-support/release/maven-build.nix
index daee44b85ac..f618032724c 100644
--- a/pkgs/build-support/release/maven-build.nix
+++ b/pkgs/build-support/release/maven-build.nix
@@ -22,7 +22,7 @@ in
 
 stdenv.mkDerivation ( {
   inherit name src;
-  phases = "setupPhase unpackPhase patchPhase mvnCompile ${if doTestCompile then "mvnTestCompile mvnTestJar" else ""} ${if doTest then "mvnTest" else ""} ${if doJavadoc then "mvnJavadoc" else ""} ${if doCheckstyle then "mvnCheckstyle" else ""} mvnJar mvnAssembly mvnRelease finalPhase";
+  phases = "setupPhase unpackPhase patchPhase mvnCompile ${lib.optionalString doTestCompile "mvnTestCompile mvnTestJar"} ${lib.optionalString doTest "mvnTest"} ${lib.optionalString doJavadoc "mvnJavadoc"} ${lib.optionalString doCheckstyle "mvnCheckstyle"} mvnJar mvnAssembly mvnRelease finalPhase";
 
   setupPhase = ''
     runHook preSetupPhase
@@ -88,9 +88,9 @@ stdenv.mkDerivation ( {
 
     echo "$releaseName" > $out/nix-support/hydra-release-name
 
-    ${if doRelease then  ''
+    ${lib.optionalString doRelease ''
     echo "file zip $out/release/$releaseName.zip" >> $out/nix-support/hydra-build-products
-    '' else ""}
+    ''}
   '';
 
   finalPhase = ''
diff --git a/pkgs/build-support/release/nix-build.nix b/pkgs/build-support/release/nix-build.nix
index 9578fbf482f..0498232d4d6 100644
--- a/pkgs/build-support/release/nix-build.nix
+++ b/pkgs/build-support/release/nix-build.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation (
   // removeAttrs args [ "lib" ] # Propagating lib causes the evaluation to fail, because lib is a function that can't be converted to a string
 
   // {
-    name = name + (if src ? version then "-" + src.version else "");
+    name = name + (lib.optionalString (src ? version) "-${src.version}");
 
     postHook = ''
       . ${./functions.sh}
@@ -167,7 +167,7 @@ stdenv.mkDerivation (
 
           echo "building out of source tree, from \`$PWD'..."
 
-          ${if preConfigure != null then preConfigure else ""}
+          ${lib.optionalString (preConfigure != null) preConfigure}
        '';
    }
    else {})
diff --git a/pkgs/build-support/release/rpm-build.nix b/pkgs/build-support/release/rpm-build.nix
index 47c01f2e66b..8f471147050 100644
--- a/pkgs/build-support/release/rpm-build.nix
+++ b/pkgs/build-support/release/rpm-build.nix
@@ -3,7 +3,7 @@
 
 { name ? "rpm-build"
 , diskImage
-, src, vmTools
+, src, lib, vmTools
 , ... } @ args:
 
 vmTools.buildRPM (
@@ -11,7 +11,7 @@ vmTools.buildRPM (
   removeAttrs args ["vmTools"] //
 
   {
-    name = name + "-" + diskImage.name + (if src ? version then "-" + src.version else "");
+    name = name + "-" + diskImage.name + (lib.optionalString (src ? version) "-${src.version}");
 
     preBuild = ''
       . ${./functions.sh}
diff --git a/pkgs/build-support/rust/build-rust-crate/default.nix b/pkgs/build-support/rust/build-rust-crate/default.nix
index 98030225bcb..435a942daa2 100644
--- a/pkgs/build-support/rust/build-rust-crate/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/default.nix
@@ -299,7 +299,7 @@ crate_: lib.makeOverridable
         );
 
       libName = if crate ? libName then crate.libName else crate.crateName;
-      libPath = if crate ? libPath then crate.libPath else "";
+      libPath = lib.optionalString (crate ? libPath) crate.libPath;
 
       # Seed the symbol hashes with something unique every time.
       # https://doc.rust-lang.org/1.0.0/rustc/metadata/loader/index.html#frobbing-symbols
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 69ee4f56b98..b057d1681b0 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -4,7 +4,6 @@
 , rust
 , stdenv
 , callPackage
-, cacert
 , cargoBuildHook
 , cargoCheckHook
 , cargoInstallHook
@@ -124,7 +123,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
       inherit cargo cargo-auditable;
     })
   ] ++ [
-    cacert
     cargoBuildHook
     (if useNextest then cargoNextestHook else cargoCheckHook)
     cargoInstallHook
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
index 7ca306b613b..36ab9316974 100644
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@@ -73,6 +73,9 @@ in stdenv.mkDerivation ({
 
     ${cargoUpdateHook}
 
+    # Override the `http.cainfo` option usually specified in `.cargo/config`.
+    export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
+
     cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
 
     # Create an empty vendor directory when there is no dependency to vendor
diff --git a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
index f34353a7617..b07b0c5ae80 100644
--- a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@@ -1,4 +1,6 @@
-postFixupHooks+=(_makeSymlinksRelative)
+# symlinks are often created in postFixup
+# don't use fixupOutputHooks, it is before postFixup
+postFixupHooks+=(_makeSymlinksRelativeInAllOutputs)
 
 # For every symlink in $output that refers to another file in $output
 # ensure that the symlink is relative. This removes references to the output
@@ -26,3 +28,10 @@ _makeSymlinksRelative() {
 
     done < <(find $prefix -type l -print0)
 }
+
+_makeSymlinksRelativeInAllOutputs() {
+  local output
+  for output in $(getAllOutputNames); do
+    prefix="${!output}" _makeSymlinksRelative
+  done
+}
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 84754e58030..7b383118a06 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -406,7 +406,7 @@ rec {
       eval "$origPostHook"
     '';
 
-    origPostHook = if attrs ? postHook then attrs.postHook else "";
+    origPostHook = lib.optionalString (attrs ? postHook) attrs.postHook;
 
     /* Don't run Nix-specific build steps like patchelf. */
     fixupPhase = "true";
@@ -1032,22 +1032,22 @@ rec {
     };
 
     debian11i386 = {
-      name = "debian-11.5-bullseye-i386";
-      fullName = "Debian 11.5 Bullseye (i386)";
+      name = "debian-11.6-bullseye-i386";
+      fullName = "Debian 11.6 Bullseye (i386)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20221126T084953Z/dists/bullseye/main/binary-i386/Packages.xz";
-        hash = "sha256-tHrWSd4K5TCwIaLTPqK/Rcon0O0r+Jsxb7OcchOo8Vo=";
+        url = "https://snapshot.debian.org/archive/debian/20230131T034648Z/dists/bullseye/main/binary-i386/Packages.xz";
+        hash = "sha256-z9eG7RlvelEnZAaeCfIO+XxTZVL3d+zTA7ShU43l/pw=";
       };
       urlPrefix = "mirror://debian";
       packages = commonDebianPackages;
     };
 
     debian11x86_64 = {
-      name = "debian-11.5-bullseye-amd64";
-      fullName = "Debian 11.5 Bullseye (amd64)";
+      name = "debian-11.6-bullseye-amd64";
+      fullName = "Debian 11.6 Bullseye (amd64)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20221126T084953Z/dists/bullseye/main/binary-amd64/Packages.xz";
-        hash = "sha256-whpBERKOPyhrWguVQ2QchrwRHU4tCkGwu42x6khF/2g=";
+        url = "https://snapshot.debian.org/archive/debian/20230131T034648Z/dists/bullseye/main/binary-amd64/Packages.xz";
+        hash = "sha256-mz0eCWdn6uWt40OxsSPheHzEnMeLE52yR/vpb48/VF0=";
       };
       urlPrefix = "mirror://debian";
       packages = commonDebianPackages;
diff --git a/pkgs/data/fonts/freefont-ttf/default.nix b/pkgs/data/fonts/freefont-ttf/default.nix
index 9d8c28681a9..4bf50d33858 100644
--- a/pkgs/data/fonts/freefont-ttf/default.nix
+++ b/pkgs/data/fonts/freefont-ttf/default.nix
@@ -1,18 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "freefont-ttf";
   version = "20120503";
 
-  url = "mirror://gnu/freefont/freefont-ttf-${version}.zip";
+  src = fetchzip {
+    url = "mirror://gnu/freefont/freefont-ttf-${version}.zip";
+    hash = "sha256-K3kVHGcDTxQ7N7XqSdwRObriVkBoBYPKHbyYrYvm7VU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype
-    find $out -maxdepth 1 ! -type d -exec rm {} +
-  '';
+    mv *.ttf $out/share/fonts/truetype
 
-  sha256 = "sha256-bdMZg/mHYc0N6HiR8uNl0CjeOwBou+OYj3LPkyEUHUA=";
+    runHook postInstall
+  '';
 
   meta = {
     description = "GNU Free UCS Outline Fonts";
@@ -24,6 +28,6 @@ fetchzip rec {
     homepage = "https://www.gnu.org/software/freefont/";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
-    maintainers = [];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index 7e3a662fda8..5baa9374a54 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "18.0.0";
+  version = "19.0.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index 6d387516e8a..7c5525c85d0 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "03f2rabj2w2l7jwqyl2awj42jhh0l3picqgyfcv3q067i34abfyn";
-  iosevka-aile = "0p1r5sysy6djfd1sx0pfxf42bv7ayqgk1nvil33jr925w96i2dp6";
-  iosevka-curly = "0r33wcgvh315avgkkic27qpf3bavrqwbig1kj4wm5rdr957ldk40";
-  iosevka-curly-slab = "0yd7grhnx7z27xmd3wr8x2xx2002hmfi1y3ndmqq1sc9gab5gcb7";
-  iosevka-etoile = "0jhd49vxxxaqi1rxfkmpc3v1q96ak1b5wyggchngqi3739pjgqy3";
-  iosevka-slab = "00wk15kj9b1nr3b0bmarx6gqx3jg8z1pm9qqf9x09s72b3ng8adm";
-  iosevka-ss01 = "1kp6zv8zyx50la7zrfz4fis68s41kplibagny61w5v3w36xpm3cs";
-  iosevka-ss02 = "1c0dl28a3wwa5g4793jyb4n4c8p5vjlyh1b8j2i5da31dqrqm9gj";
-  iosevka-ss03 = "0vs8x6l8gwqi47g1c5ainsk5fb2i6j4wv7mgdyw5j5l3blnba5yh";
-  iosevka-ss04 = "1caf4xqd1dywzbq06ip042rw88833yk9ws7y3vjvsp93g7a2r675";
-  iosevka-ss05 = "008aphj4w6ri3fgnydrxavvpm3bfywv4cym10fqi9xgd84jhm9m1";
-  iosevka-ss06 = "00dkagqiwzwzvv75zss82yx0gdcbmh9xvr8swhi5zk0y0bc3xk2y";
-  iosevka-ss07 = "1acnva081awp76xyspksq9jkvlyswh3q1jy9gnsc6kh4vyn17vjs";
-  iosevka-ss08 = "0lmkglcjlppvfd7k2pz57r476fa4c0q5l4gqzfy1mlklh0mc5hqb";
-  iosevka-ss09 = "04r2k2z54iszwfnif872p5br0dm4fvc5341cpbxv4almpzxjyqnr";
-  iosevka-ss10 = "1c6gs9g8dhywpd2ha7kx2l7g7bwj7i5a78645ipx8126f749y0y9";
-  iosevka-ss11 = "0286k56r12a2yjylxynvzd0idrcv4ykrmpkn3b5xv9f74qq6irmf";
-  iosevka-ss12 = "0ab4x5lh8spbg0djb092vcq1cnvjhazwkia8byq1q47iwiyh756l";
-  iosevka-ss13 = "0kva71mfkl9xzz8khjzgrj47zg2505rg0hv5hxflawxsqwi4iwvl";
-  iosevka-ss14 = "1gk7m3xh4v3jm6s5g2prd27w4p0r1blbxsxdy3b020bdwikxcaga";
-  iosevka-ss15 = "0frxjc3hhay8izsx4ywff4j39qxp9ljz6hvw0rjcya3vny515jq5";
-  iosevka-ss16 = "1g299yhn0kfc7vn8vbgwq4798w5lcl72j6hj91k90i1yq11lg13i";
-  iosevka-ss17 = "02z83x73bhpgf44kq0gw46bdnpqzr4vm37h78bh19vydzqaj8hg0";
-  iosevka-ss18 = "1b7vhhbspi98xzmk4hpiw08jmscm7f7nibqxhkfmppl6y0ymbm9d";
-  sgr-iosevka = "1n60dgprl2p22wwfhxpwy9v9xf6vyv3qwm2jdc0m9m0q9jwjashr";
-  sgr-iosevka-aile = "1k195vqv2wajhmyma43xgda3s2z86kl2gksgdrm95s9sx7ijns2s";
-  sgr-iosevka-curly = "15yq1fs7knp9gxgqjxslpmlx85c6kvpm31sf81llpf4k5f9dmlcp";
-  sgr-iosevka-curly-slab = "0fa68lm6iwlf2s5k8388dwgk015c55zg1wkhhhjmixwn7p8gifxz";
-  sgr-iosevka-etoile = "1ry1zc7cdx6g927d1752ipz39v4wsnfrnn8n9cfwamz8v458wld1";
-  sgr-iosevka-fixed = "173v09dx5pwsbh9jac5qxi7nk95dqyryg747hl58bchby6kmnc3k";
-  sgr-iosevka-fixed-curly = "11y8bj9vmdq48n370f1r4zsk72ci3cq7c9ff6y40hn5w40s8k379";
-  sgr-iosevka-fixed-curly-slab = "1a4gmz6sl67l23awkfl8f3xdr8hbb2mi1lsc0ain1wvvyx1bi56m";
-  sgr-iosevka-fixed-slab = "11xv18ykrfg2fdvbrlcx7k3qvp5yqbm278ks3gm0gbck1awvfckg";
-  sgr-iosevka-fixed-ss01 = "1yb96x53wjks537vs0gd7rss6piszs139k1kgb1swrpq7519awaz";
-  sgr-iosevka-fixed-ss02 = "10yy0yg2i9nm00lzpmrfbdh7jjcll37wql3fcsaxha57gcxf9nf0";
-  sgr-iosevka-fixed-ss03 = "1fpjfqlqq6lz3gya1q24nzy2xls6nxn567lhglj0ykjnh3prkll8";
-  sgr-iosevka-fixed-ss04 = "1kwa5mwd6ihsyj2y70hrrvgy41cs19i0f7nvl4khs3i69a1l58ag";
-  sgr-iosevka-fixed-ss05 = "08v8in8s8p2nayazq60w1kc1jpq48nwdwh6wbxv7ij7lfwii8xws";
-  sgr-iosevka-fixed-ss06 = "03jzylw99xa3b6hpy6bpwhyii6d9fggy9synfl54sn7smwqk08wr";
-  sgr-iosevka-fixed-ss07 = "13yzd6r51gka03fcl3bvx6d97b4m4px2cnsd724maqkqrcxkbxgb";
-  sgr-iosevka-fixed-ss08 = "1xghlj7drx9328jr1cb051nkwv47r5ykkyy6ydff1c4amc1xabsq";
-  sgr-iosevka-fixed-ss09 = "12l6lbz4m1lwyqqmv583777r9ymssy9x34rz72y3dch0mqhmjjzg";
-  sgr-iosevka-fixed-ss10 = "1flrh6a7m0dw7na30nhbxjld54517z77ff3s9fjrpmgyb9wz7i2j";
-  sgr-iosevka-fixed-ss11 = "1j4v4h6k505gkxyswcjf61kj9cfgkalxjg1arms9zb351p8rrkda";
-  sgr-iosevka-fixed-ss12 = "00qwnsxc08bm5cq3ljz2pjqsiw019ah4z0crqcwaysijicxmbckc";
-  sgr-iosevka-fixed-ss13 = "0jrw0amhfi28mc4i7a74qvgjamvymijlf3akskaw9qrmzvks8wn1";
-  sgr-iosevka-fixed-ss14 = "0rvh842zkxdrna9nh2ylsjs3q90sq39658l0mafi85b8z5asdwai";
-  sgr-iosevka-fixed-ss15 = "0j5yrr1biqfhgj6qg6359xg9rfv6qzqiqdqjgfjwbhijs6xfn8f1";
-  sgr-iosevka-fixed-ss16 = "06jrfhb257nmldnxxyc5rh869r5y62v2y034c0r9j7354s7gcq7a";
-  sgr-iosevka-fixed-ss17 = "0cgmsh0478963k1dgpkhy6j1b383gx2q09z3shr6j87knjjwqgp0";
-  sgr-iosevka-fixed-ss18 = "0r4nyd459aqgna7dyzvxnznclqihxdb888g949kdzhxykfchq53s";
-  sgr-iosevka-slab = "1bv8asz66hn80xvjxa7b0vgywha1bpmhd8q95cssc3085dprz1r6";
-  sgr-iosevka-ss01 = "0sv19w0adnddzarf8dlz0n73jzqnp0xfb2lgh4xcpjkhm66j3fhh";
-  sgr-iosevka-ss02 = "1ih10a666r77pvj57crdgyn7ll15giwxj0nis501r1fkp1bzkscn";
-  sgr-iosevka-ss03 = "180hkjzzgasf9a58vi0n0cishnbyjgbjmkh60awcpxwvh85qd4hf";
-  sgr-iosevka-ss04 = "1i4rpg9j967xaxg8h9dmachd3896f4jgwxa0mfjlizls2hfvnbsi";
-  sgr-iosevka-ss05 = "1ca2z4dincjk7jl16pa6d7dnnzq3w3il7fr2lphvrjvdrxbci615";
-  sgr-iosevka-ss06 = "08dj9dcq58grnp6lh16yvvzjqhzlm765v4ci1rys0wbjnp72xxda";
-  sgr-iosevka-ss07 = "13k6plhdgxhp5gjs8z98wb480hh5wy6p2zmc4xvhp88y93fy8kk7";
-  sgr-iosevka-ss08 = "1zfxamanq6a06fazn1jkaswh5g6iw22qnycg5dnxn4flk8nas1db";
-  sgr-iosevka-ss09 = "0qaxp4fsvl26il16h78y2l8013m49cbk2nzxcs1k9g5if11a49d3";
-  sgr-iosevka-ss10 = "1qvvm6rvhrbp83qjfb3dfsbam20f6aw52kg1i5ggfrqj35niv0hd";
-  sgr-iosevka-ss11 = "1v2b456qj8kyacm7308gsim5p25wnyg8qabyrfvdj00h81s31akl";
-  sgr-iosevka-ss12 = "1rsi6ir5vccar0n3ychisc40axiyhqj5yvcx450ppd33f3sd5rc7";
-  sgr-iosevka-ss13 = "12x4q5l1pdxi065zs913dqd7zb8qpi4bbgd43h3k5azsrwxwvixr";
-  sgr-iosevka-ss14 = "1snzdv23jqmbz25k9i2zl7px7yysk5hn74q1x251s07ghdx3nfdj";
-  sgr-iosevka-ss15 = "0hbmj6wij6cv9yh76npp4xrl7fdm8jjx03398anfcsa02gkvg8zz";
-  sgr-iosevka-ss16 = "0v6vhg0vp5ig6ngs96q5mxa2snfp08nk68a9772sm1ny61q3chrq";
-  sgr-iosevka-ss17 = "0268b85yhdfsbjyhi0vlxwrpwxa8h919np53s060z94094h6jd9x";
-  sgr-iosevka-ss18 = "13vnhh8181h36y6iz2p2x6rjgjv5w3d0gqbcdkwhgmvx7s03k122";
-  sgr-iosevka-term = "05c2sxb4aris90mhjxyfkw1b0ga0hplfas669076h7yjsimw647l";
-  sgr-iosevka-term-curly = "1j0b4fhcivkdgka9zyqf732hcxj8rchqxkwv2bwxib1a17fmwn6c";
-  sgr-iosevka-term-curly-slab = "0dvv2n3plfxm8z2xi1ihzn4rncyk1kz8xbgyprnb0lvqiyf18igy";
-  sgr-iosevka-term-slab = "0i7wrvq6c96q8v6zw9iym42b6sbm0vc04ysljghpblnnfymq5yv9";
-  sgr-iosevka-term-ss01 = "1n23qp50pr466blpn2h9dhjbn0wnbbxyzb0sz751bk8db41lpyqb";
-  sgr-iosevka-term-ss02 = "0ghvfhkdsfsjb8yjwvwlwhn66lmy8dx34126ccnvj0g77ww2nwa9";
-  sgr-iosevka-term-ss03 = "03hnmy9wijqwsc36cg5b3pxj7mb1cbyacii00pcvrpcns2w1ssbw";
-  sgr-iosevka-term-ss04 = "0fv9xhhii0h5ii4yxsdnywn45254494mgq1n5aajasq494cgxhp4";
-  sgr-iosevka-term-ss05 = "0qa4l77sjpxd9l4nb555bhgzm0f1c74w6014md2rpljjvyy2mzwg";
-  sgr-iosevka-term-ss06 = "05y7rmghvhmzw3spn7b3v6hmpcqg5p32flm437a1aljdr46sbxli";
-  sgr-iosevka-term-ss07 = "1lzqgpr1vchi4ricqp1v49nv62rl3anbdvzpvddby81wr5jcyd1y";
-  sgr-iosevka-term-ss08 = "1sxicv2gspc39fyja370dpiq12xd1bgndiw5r6cqfkkd8x8dgpdv";
-  sgr-iosevka-term-ss09 = "0ax9pgm3d171kksrqd2z8xpr68kdxkqg9h344an55gjk01q7dzay";
-  sgr-iosevka-term-ss10 = "1rgvadmvdldcaqa0r76kzmrck814qwksdqficaxcd7wk8bx64n81";
-  sgr-iosevka-term-ss11 = "02if14ff5kax4p1aa2wkbidhwlzgyxi7lxir2ildahwfkvkp971y";
-  sgr-iosevka-term-ss12 = "0sj8n12is4094nbj67wkk88953jp9235kvvr4230abql1g6s263r";
-  sgr-iosevka-term-ss13 = "006sdcj8qw247b63d647ykm8razyb0apsfd0cjmlikj9hdmyzrr2";
-  sgr-iosevka-term-ss14 = "0i7d3ldp9rj1f4kwdk8hkxq0s38df6i25qfx6hwfjj1c5bl3a843";
-  sgr-iosevka-term-ss15 = "15gjqz7zc6wwy1l61pgpnz7wwyyaij43dcrwcwyi6h10jhm8b3ia";
-  sgr-iosevka-term-ss16 = "1c1i1iyqzgh3pz4fzjp26d71lphmcgqbjp2s91yyqg3nfhwbzvyc";
-  sgr-iosevka-term-ss17 = "0kr58576vlx81nb2ia5z9226m6h0ybd5vzfj5li9b721l4q0rpky";
-  sgr-iosevka-term-ss18 = "1zjs40i4dmw2l45k8wydngl4g3a88nhbmmjwd5lsz8a40pq4bw15";
+  iosevka = "0m8z67daj1gwb3yiw8qw3n1nxp96xb11fvb5183bh02r7ncym0da";
+  iosevka-aile = "02jhyzk3bpsjng3b1jfffwvr2inhhjsm4jdahzj05j381fp717c4";
+  iosevka-curly = "1si2kzv7qhlpyaaa954vnjmfk1c5rjxjimvckinpkjz30cnvg1bl";
+  iosevka-curly-slab = "1ngk3r6kdqngksga3s3m615jkqrxdcplj8srvlb6642vcc38w6vh";
+  iosevka-etoile = "1yg38x8dk5nyyjyy71v5j4x2x701hmp8gjwvphf5scf6vn52lvxz";
+  iosevka-slab = "1bw6lyy8lg4vpalnrsrnkrm9dlyl6vm6faigy2y9bfvh7nxrd8qa";
+  iosevka-ss01 = "1p02d8mdqx6mbnycs9d2r0qwqsxjrlgbl7skf8y66dsmjn6xxd0y";
+  iosevka-ss02 = "0ds8ad38h7h8250hdm89v2imya6jdzgk1h5jgsf983ls1gqjikhc";
+  iosevka-ss03 = "1s6rc4qhlfgvr7g8ywmlmsl58hfrqx0w24ivx5zz4jr5zqj70j7l";
+  iosevka-ss04 = "1lc8kx0p8m8nm4ql6ylcw9g4iq0j65hv6x48273cclqqcmqdn4qj";
+  iosevka-ss05 = "1wx02ysbj0rpr623jp1jy64ywrj8rm3n2fqzq05f4qv996bij11k";
+  iosevka-ss06 = "1bf0qnpvbq94d42gvbzikfkk20d788cicsyk8kz1vsf5xbg37kla";
+  iosevka-ss07 = "1ybl5gfyz4dnarimamshf002p9k6148wbbrbarpswb85kab502hd";
+  iosevka-ss08 = "1llp8iryr5dixdarwls9iw8mmnhzhlr7q8fzq969p64ygk76rkn4";
+  iosevka-ss09 = "14b49k0zv49xybdwrbf0p1krrga3jjviwzy0alxrwn0zf7vlbnbi";
+  iosevka-ss10 = "1xs1dkq62pml17dii2lhsianhzr22059i17sw2b334wbszc00j7y";
+  iosevka-ss11 = "0mrjzmk74vlq69ih4gm2iza4qdzyznn42bk3jwlvpd67z5vq36ag";
+  iosevka-ss12 = "0z16a8wrydi0ch9zj0lcz6cxbvawkr0ck03bzdbb81waggk4fxin";
+  iosevka-ss13 = "1rv8n3vbhwqv7bks6v86v4w13fr4a015xpvprzfz76xp98hb9dmc";
+  iosevka-ss14 = "0m7kpvy8bknmrfsql9b24w7n15hybnkisjxzzmrxkf8a60jrydni";
+  iosevka-ss15 = "006jkgww0hdb0c1wgby0y5535xapjpk1w8vm51d3yyrp04pwr1r1";
+  iosevka-ss16 = "1mmc7cyyk64lcavb2gib64b64zcr7qcn0m3cmlwnr1zgm6nb3w64";
+  iosevka-ss17 = "0wanv1h8qg5jyx7w380h7jkbc22slg9566pzw7dv7dg1nw0h2v3k";
+  iosevka-ss18 = "1y1daxghw3jbfn785935906j76l0230yixdmwlrzyra2svyaql3w";
+  sgr-iosevka = "182nzxxrxfz8xc3w8g9bsr0can71671w4xplyvyi7b1v9f62g9f5";
+  sgr-iosevka-aile = "1arjiwx5qf8j6pzb8mpd1g46z0kn80341wvcmsnx42d97b2m64jx";
+  sgr-iosevka-curly = "1lyh0rh2pswbaxsqyxicyknhla4gm2h0jb2rg0wx9vib9h53lazn";
+  sgr-iosevka-curly-slab = "0h2j7dwcyd5v1acpwjsz9li5g4r1ssx715x5pj4gdvskq4calff4";
+  sgr-iosevka-etoile = "15ag0w6sv24rc91mxh4c89gq6jwnq37bxml6a41rvn54fy0h1jnd";
+  sgr-iosevka-fixed = "0935zbk5x0mk06al11nig74b2rv1x8zc3waxs8hvbri0ryzykzk4";
+  sgr-iosevka-fixed-curly = "1i8cqfwcdsaxdlh87kaya8bp33fwlyz984r757122qnqbywcfm30";
+  sgr-iosevka-fixed-curly-slab = "0ba77jxn8n5dssjpwj4iyvwxw3mxqizrvsz5jyv9a4f3gfvwi18k";
+  sgr-iosevka-fixed-slab = "0qfhc7pg30ashpx504lln4h2w36icrbgij7fga07z2a715qxmfq9";
+  sgr-iosevka-fixed-ss01 = "1597hn4vzh0r8j22k7866blj3kw2bhp70z7msfr2hbszpscwxwqg";
+  sgr-iosevka-fixed-ss02 = "1ygrsvamgp6f26zg5qysk6dn4fa1im02dzsrlpgpv3sl4gh0cv44";
+  sgr-iosevka-fixed-ss03 = "0936ggnzaavqn4d7fsmmf54bwp0v31sz0n1w15ky7c5bsqp9h8ja";
+  sgr-iosevka-fixed-ss04 = "1xjslygh3f5nv0k8fiby0cgg22wr0a9jh79fbzallx3zh4d60a2a";
+  sgr-iosevka-fixed-ss05 = "0vnm398zdvkzymhw41gljpf9jq52wq3vawiyw5xsdr75d4n63fpb";
+  sgr-iosevka-fixed-ss06 = "1pnk8ijb193h85sk702ar0m0wk03xz1xcnvx8iq4k52q3a3vdd40";
+  sgr-iosevka-fixed-ss07 = "0qfcf6r2gzc5zwjfrcq1hjp9c5s13fc34lwwmxkj8224d42543jn";
+  sgr-iosevka-fixed-ss08 = "1ram9wm14k2sncfqpak23vss3pyqbwd1ndhm1i4ib7bpq8skd3wi";
+  sgr-iosevka-fixed-ss09 = "0r8zy1fwih42clxm2rsjqks5rxgy1qxirz396r25gvwxng2503y4";
+  sgr-iosevka-fixed-ss10 = "1v44s7n1gwz7mcybjsi1amv6xc8z47k20miycngjcy1cccrds2da";
+  sgr-iosevka-fixed-ss11 = "1fdclqvzq45shpj97awc7636ymgrnfd69iaizwxy49y2krpa7dx9";
+  sgr-iosevka-fixed-ss12 = "07f7i0qh9z6hlgy0ak3myxmiy4rbrixcap52lhk8wwapbnf21r7l";
+  sgr-iosevka-fixed-ss13 = "07z3hfi5vynwl15dqfsldwjj5i9fldmm6i1nypm28cxbya3izj60";
+  sgr-iosevka-fixed-ss14 = "1r001yna7ydf24bkgygld2kh47pvsz1yr9s57ssvdql37q24wzf1";
+  sgr-iosevka-fixed-ss15 = "1757lzbp9payykcdywdbfilhgm1yij8gsnazc7bywpc4sv806vhz";
+  sgr-iosevka-fixed-ss16 = "18mr7wvz5q60kgz0h2k05ahd0krz3ng7wgg1amd3292cji61vxvw";
+  sgr-iosevka-fixed-ss17 = "1bykqwspssv1vbx2nns8dfckijqmd633g57glmlhjmxlavv5gxnw";
+  sgr-iosevka-fixed-ss18 = "034w2yv2ihybkz03zalcsixrmjs7as62v8jhk8xkyckqc3bk0kc7";
+  sgr-iosevka-slab = "04b1w9ij6dgy5gyvi7d47g9xadpb230mlgbdrk36fyhvfyw048y1";
+  sgr-iosevka-ss01 = "077d4dan7f41ydi64xv0z0784j5vcj98vmqagmy1c1xyr0p68dac";
+  sgr-iosevka-ss02 = "1hmy2cwnsb3f60yp66lznas78432518xkj2jmpqy8ad05d2zmmc8";
+  sgr-iosevka-ss03 = "1bs1hb6magmbc2zh4fzx7h6j6bdllbvv85fv5krs3b888w3fzjw1";
+  sgr-iosevka-ss04 = "1c3wb8nz0xz57crwn151b5sgzm320jkirsajyjf0srdaid1gkjkx";
+  sgr-iosevka-ss05 = "1dx33y8rk3nzgdfikz262javq4v3n76hvv5b7rx7kxlkxycpy8ya";
+  sgr-iosevka-ss06 = "1s54xx4w3zvbz2w7f5sl5vlqazwsm033jsq8ljrdh4c2l88mpcq3";
+  sgr-iosevka-ss07 = "03zfq3jib2df6dhj1pbmw8hq57i0fx98gkawxzk13sfgrzz1zv47";
+  sgr-iosevka-ss08 = "09k220gha919lv18bs6y2zlcjqa5j7jsq8mfqx8xddcwq1v9v094";
+  sgr-iosevka-ss09 = "0plvxhqwkr52sich4kwzqs3xq5s5x61hq7n423ar2zaskx007sjv";
+  sgr-iosevka-ss10 = "0c42h417sir120cp6fbnbhv3s1ys8pxky56v6f44h50w7p6qhlx1";
+  sgr-iosevka-ss11 = "03sp7z0s5sb9bnhxb9liainpiqmq1r0lpmigscl6wr1rpaxq2l7i";
+  sgr-iosevka-ss12 = "0y2xs0qv3b1k4s4my9c69j94ql2kwmqmm3f626vjj8rar8r0wab0";
+  sgr-iosevka-ss13 = "1pyv3i1972n5gxr16fl68gydjsxndh7kbba3d15bmkankahgll6c";
+  sgr-iosevka-ss14 = "1c7y8h8jv937wnlxkgdswb0ixa5v747z598pd0yhvwid3ksxb1px";
+  sgr-iosevka-ss15 = "08wzzkr0l0xz4l7qk9kbhvybr4favl0qz0cjr7raw0hibqkw17sp";
+  sgr-iosevka-ss16 = "0q63x71mq19gqqiaqbqsp0lvf3knhckx5d17caq6ipv5gs3xxmzr";
+  sgr-iosevka-ss17 = "04054qbvyfvp1aqs3likyh85kqyckkg2ac83s65lvkj3f46r50sg";
+  sgr-iosevka-ss18 = "1ckrfx3f4mncm1hbc2bcsbk97kkzsi524wfgvhz10jw1yk5yyd60";
+  sgr-iosevka-term = "1ygfsc86fihkxpwm2q3j2y3ibpb7lkrjwrld7dg9ymb83hah29xm";
+  sgr-iosevka-term-curly = "1qz8x2z23m5yvdpf0055a7xb5z77dabwbf3hkmh4r77rp1h6idv4";
+  sgr-iosevka-term-curly-slab = "011n7qpcx2abvp5i9z6picy5bcjvvfx7pjqy8m7sf02fdm14s2jl";
+  sgr-iosevka-term-slab = "1iwgcqnxbjf25k6bbx3iwcqy2ghwnnxvfinjp5slwr7bhjjjbl9y";
+  sgr-iosevka-term-ss01 = "09s813a8ywqpncmq0iqkjjnh1sb5zn267fzp2dz92cmw5929627s";
+  sgr-iosevka-term-ss02 = "1yyvnxdwi6caq6b6pgviad5l7b7znx4xkxdg1np23a7imr94vb1c";
+  sgr-iosevka-term-ss03 = "1hrdipmf54z2hrl7g8m8z17aq3lp5v66xy24f58qsm4c1pfab3i7";
+  sgr-iosevka-term-ss04 = "1h54glwrzblg61y4f1sxm78mci47wjry4h4gdrbpx96snf31ynbb";
+  sgr-iosevka-term-ss05 = "1xzzj36817nsw15s3a1f740d89gc4634dnczjjj6vrddli8ilann";
+  sgr-iosevka-term-ss06 = "0c07i831bmfz6y7jqaip6il4cvqzc51d0w17s2dnjrnj4x3ndgmx";
+  sgr-iosevka-term-ss07 = "0x9wzf0w4pzjmzzbmzj56nkhhz5834chvxqn9519fbq1md4pfl3b";
+  sgr-iosevka-term-ss08 = "1gf1l17d8hrf1aq4pq9ai05kan8m86z8s2d7masjkvg1zaw2lb4s";
+  sgr-iosevka-term-ss09 = "1nnhciib413ll2h7ps3vyghiayz9iwniwr7byyn9pdimm0j5vq07";
+  sgr-iosevka-term-ss10 = "0qvficwhpya5sy5myxsjjfmrn9z2d9lpzyi88l8dhz3dfvyr1yzs";
+  sgr-iosevka-term-ss11 = "0ml6swvyddhz2nvq14skfh1d9d98c3d6ir0qgf97pc0qxyqbcfp2";
+  sgr-iosevka-term-ss12 = "01nxs1m2iif6lswx22h58i45zxab0nbqpf0rzlp6v3wnb8ylpbi5";
+  sgr-iosevka-term-ss13 = "0zadj9fakpqmibnxz883hwbcgqfssjvsi6kcvzik5cnamlk2jz8c";
+  sgr-iosevka-term-ss14 = "1dwfm8lcbgf8rfw11i2alrv98f9332cqyk9zvzfrjrdp9camr7j0";
+  sgr-iosevka-term-ss15 = "0z7ad7vy2faq33kpbl1x2w6i3s4af8v8fzj05rdyadws35ra3idd";
+  sgr-iosevka-term-ss16 = "1fzzkmk7ppcbmg7s50nknc7nwavfpqsja12af8qidzba9z535w2g";
+  sgr-iosevka-term-ss17 = "1rcpfgf5blg3nbf6prw9h2ylc2ji8vl6cxqlck482kncz8ph9swk";
+  sgr-iosevka-term-ss18 = "1nksii5xyi97lsrf1hxl06m0pdlk8rnsbg1s81amkzz8fxlyhzlc";
 }
diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index e99dfde411d..6054066465c 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "JuliaMono-ttf";
-  version = "0.047";
+  version = "0.048";
 
   src = fetchzip {
     url = "https://github.com/cormullion/juliamono/releases/download/v${version}/${pname}.tar.gz";
     stripRoot = false;
-    hash = "sha256-tCZo48SBGdhcsP1wgaWkfWr3L3Yz+p/iqesLmarSWbk=";
+    hash = "sha256-KSyJMlQclEj2CR+5uSYLmPtseWiDIUuahaPDx7Tn/bw=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/icons/capitaine-cursors-themed/default.nix b/pkgs/data/icons/capitaine-cursors-themed/default.nix
index d86ce3f8161..bd0147fecde 100644
--- a/pkgs/data/icons/capitaine-cursors-themed/default.nix
+++ b/pkgs/data/icons/capitaine-cursors-themed/default.nix
@@ -1,14 +1,22 @@
-{ lib, fetchzip }:
-fetchzip rec {
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
   pname = "capitaine-cursors-themed";
   version = "5";
-  stripRoot = false;
-  url = "https://github.com/sainnhe/capitaine-cursors/releases/download/r${version}/Linux.zip";
-  sha256 = "jQNAXuR/OtvohWziGYgb5Ni2/tEIGaY9HIyUUW793EY=";
 
-  postFetch = ''
+  src = fetchzip {
+    url = "https://github.com/sainnhe/capitaine-cursors/releases/download/r${version}/Linux.zip";
+    stripRoot = false;
+    hash = "sha256-ipPpmZKU/xLA45fdOvxVbtFDCUsCYIvzeps/DjhFkNg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/icons
     cp -r ./ $out/share/icons
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/misc/cldr-annotations/default.nix b/pkgs/data/misc/cldr-annotations/default.nix
index f19b666abea..729d3cdbb7b 100644
--- a/pkgs/data/misc/cldr-annotations/default.nix
+++ b/pkgs/data/misc/cldr-annotations/default.nix
@@ -1,23 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "cldr-annotations";
   version = "42.0";
 
-  url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
+  src = fetchzip {
+    url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-paRon3ecGXNp3ZDnN1DU9RVU2NDWTBiKjy0OP3vcPLE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  stripRoot = false;
-  postFetch = ''
     mkdir -p $out/share/unicode/cldr/common
-    mv $out/common/annotations{,Derived} -t $out/share/unicode/cldr/common
+    mv common/annotations{,Derived} -t $out/share/unicode/cldr/common
 
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+    runHook postInstall
   '';
 
-  hash = "sha256-9OOd69nBaDSt+ilL3PTGpcQgC60PnHqd8/CYa2LgeI0=";
-
   meta = with lib; {
     description = "Names and keywords for Unicode characters from the Common Locale Data Repository";
     homepage = "https://cldr.unicode.org";
diff --git a/pkgs/data/misc/papirus-folders/default.nix b/pkgs/data/misc/papirus-folders/default.nix
index 92bfe362bcd..24fbeb0b0e2 100644
--- a/pkgs/data/misc/papirus-folders/default.nix
+++ b/pkgs/data/misc/papirus-folders/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-folders";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "papirus-folders";
     rev = "v${version}";
-    sha256 = "sha256-ZZMEZCWO+qW76eqa+TgxWGVz69VkSCPcttLoCrH7ppY=";
+    sha256 = "sha256-Dus9f2m5Wj46Url7N3UYEvBAankppzGzdJHGPH3CT3g=";
   };
 
   buildInputs = [
diff --git a/pkgs/data/misc/publicsuffix-list/default.nix b/pkgs/data/misc/publicsuffix-list/default.nix
index 063e120d3c4..02b0ba0b439 100644
--- a/pkgs/data/misc/publicsuffix-list/default.nix
+++ b/pkgs/data/misc/publicsuffix-list/default.nix
@@ -1,20 +1,24 @@
-{ lib, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-let
+stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "2021-09-03";
-in fetchFromGitHub {
-  name = "${pname}-${version}";
-  owner = "publicsuffix";
-  repo = "list";
-  rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
-  sha256 = "sha256-Q8uIXM1CMu8dlWcVoL17M1XRGu3kG7Y7jpx0oHQh+2I=";
+  version = "unstable-2021-09-03";
 
-  postFetch = ''
-    install -Dm0444 $out/public_suffix_list.dat $out/tests/test_psl.txt -t $out/share/publicsuffix
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  src = fetchFromGitHub {
+    owner = "publicsuffix";
+    repo = "list";
+    rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
+    hash = "sha256-moibTN9KovABcg+ubKUgMXg4b8sMrTVo6Itmiati/Vk=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm0444 public_suffix_list.dat tests/test_psl.txt -t $out/share/publicsuffix
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/misc/unicode-emoji/default.nix b/pkgs/data/misc/unicode-emoji/default.nix
index bf27cb03e28..ae14a27c8b7 100644
--- a/pkgs/data/misc/unicode-emoji/default.nix
+++ b/pkgs/data/misc/unicode-emoji/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenvNoCC
 , fetchurl
 , symlinkJoin
 }:
@@ -6,30 +7,40 @@
 let
   version = "15.0";
 
-  fetchData = { file, sha256 }: fetchurl {
-    url = "https://www.unicode.org/Public/emoji/${version}/${file}";
-    inherit sha256;
-    downloadToTemp = true;
-    recursiveHash = true;
-    postFetch = ''
+  fetchData = { suffix, hash }: stdenvNoCC.mkDerivation {
+    pname = "unicode-emoji-${suffix}";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://www.unicode.org/Public/emoji/${version}/emoji-${suffix}.txt";
+      inherit hash;
+    };
+
+    dontUnpack = true;
+
+    installPhase = ''
+      runHook preInstall
+
       installDir="$out/share/unicode/emoji"
       mkdir -p "$installDir"
-      mv "$downloadedFile" "$installDir/${file}"
+      cp "$src" "$installDir/emoji-${suffix}.txt"
+
+      runHook postInstall
     '';
   };
 
   srcs = {
     emoji-sequences = fetchData {
-      file = "emoji-sequences.txt";
-      sha256 = "sha256-vRpXHAcdY3arTnFwBH3WUW3DOh8B3L9+sRcecLHZ2lg=";
+      suffix = "sequences";
+      hash = "sha256-XCIi2KQy2JagMaaML1SwT79HsPzi5phT8euKPpRetW0=";
     };
     emoji-test = fetchData {
-      file = "emoji-test.txt";
-      sha256 = "sha256-3Rega6+ZJ5jXRhLFL/i/12V5IypEo5FaGG6Wf9Bj0UU=";
+      suffix = "test";
+      hash = "sha256-hEXyOsg4jglr4Z0CYuFPzv+Fb/Ugk/I1bciUhfGoU9s=";
     };
     emoji-zwj-sequences = fetchData {
-      file = "emoji-zwj-sequences.txt";
-      sha256 = "sha256-9AqrpyUCiBcR/fafa4VaH0pT5o1YzEZDVySsX4ja1u8=";
+      suffix = "zwj-sequences";
+      hash = "sha256-/jV/kRe3dGZ2Bjdl1YcTft+bJZA6eSvVSTW/CFZ5EYI=";
     };
   };
 in
diff --git a/pkgs/data/themes/whitesur/default.nix b/pkgs/data/themes/whitesur/default.nix
index 1073fd8f250..c01c8e08166 100644
--- a/pkgs/data/themes/whitesur/default.nix
+++ b/pkgs/data/themes/whitesur/default.nix
@@ -33,13 +33,13 @@ lib.checkListOfEnum "${pname}: panel size" [ "default" "smaller" "bigger" ] (sin
 
 stdenv.mkDerivation rec {
   pname = "whitesur-gtk-theme";
-  version = "2022-10-27";
+  version = "2023-02-07";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-jOrTasnkNExCgvST+09JOQ0iosjoEu3aoj3C1pNHTgY=";
+    sha256 = "sha256-RGYD2+ZTUTPyFbaHvXU9VD3W6WTNeg3ifY+DAR3MmtI=";
   };
 
   nativeBuildInputs = [
@@ -61,10 +61,10 @@ stdenv.mkDerivation rec {
     done
 
     # Do not provide `sudo`, as it is not needed in our use case of the install script
-    substituteInPlace lib-core.sh --replace '$(which sudo)' false
+    substituteInPlace shell/lib-core.sh --replace '$(which sudo)' false
 
     # Provides a dummy home directory
-    substituteInPlace lib-core.sh --replace 'MY_HOME=$(getent passwd "''${MY_USERNAME}" | cut -d: -f6)' 'MY_HOME=/tmp'
+    substituteInPlace shell/lib-core.sh --replace 'MY_HOME=$(getent passwd "''${MY_USERNAME}" | cut -d: -f6)' 'MY_HOME=/tmp'
   '';
 
   dontBuild = true;
diff --git a/pkgs/desktops/gnome/apps/seahorse/default.nix b/pkgs/desktops/gnome/apps/seahorse/default.nix
index 60de418f1e4..bbab612b9c8 100644
--- a/pkgs/desktops/gnome/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome/apps/seahorse/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch
 , fetchurl
 , vala
 , meson
@@ -36,6 +37,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-Wx0b+6dPNlgifzyC4pbzMN0PzR70Y2tqIYIo/uXqgy0=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "gpg-2.4.patch";
+      url = "https://gitlab.gnome.org/GNOME/seahorse/-/commit/9260c74779be3d7a378db0671af862ffa3573d42.patch";
+      hash = "sha256-4QiFgH4jC1ucmA9fFozUQZ3Mat76SgpYkMpRz80RH64=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index 082483b1c24..f5ea57f1f80 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -50,13 +50,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.46.3";
+  version = "3.46.4";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "CTjiJ55c+8IgR2bKnT/qVwkRaZsHwQy+AaymKn6LK+4=";
+    sha256 = "pZslQUXFn6zXx7U4LbeNxfDtH2pum4/n1edZWfk8DMg=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
index dfe109f57bd..c0cfade44b4 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
+++ b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
@@ -298,7 +298,7 @@ index e61160c..b6553a4 100644
  		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
  	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index 611d5c8..4790fca 100644
+index 28755e2..da8c40c 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
 @@ -5593,7 +5593,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
diff --git a/pkgs/desktops/gnome/core/gnome-contacts/default.nix b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
index 760af24880c..560d40ddc11 100644
--- a/pkgs/desktops/gnome/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-contacts";
-  version = "43.0";
+  version = "43.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "VbYd9+k/Cr4f+kZeGOPF3k9JqQ8mjqnRHtyGrwbQceE=";
+    sha256 = "Ug3IjJAce4/n4SoBOhQlz+2R8vhAhIWitJ+SxnWZACA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-software/default.nix b/pkgs/desktops/gnome/core/gnome-software/default.nix
index 450da49cf98..591bd397c0a 100644
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnome-software";
-  version = "43.3";
+  version = "43.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "k+6AdHl4rSzALlrnPQo9Psgu6hNPx3niqpFpAbu1gJA=";
+    sha256 = "6d8GDrq1n0lpfV7yYw7DbeYEVBadwZGvYNNINyCq2z4=";
   };
 
   patches = [
diff --git a/pkgs/desktops/lxqt/lxqt-config/default.nix b/pkgs/desktops/lxqt/lxqt-config/default.nix
index 55239caf2bd..727ae635859 100644
--- a/pkgs/desktops/lxqt/lxqt-config/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-config/default.nix
@@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , glib
@@ -29,6 +30,17 @@ mkDerivation rec {
     sha256 = "WgrcHM4iJLZsJO2obqSkjHHMB+/kcadQArkcXC5FB24=";
   };
 
+  patches = [
+    # FIXME: backport Plasma 5.27 build fix, remove for next release
+    (fetchpatch {
+      url = "https://github.com/lxqt/lxqt-config/commit/6add4e4f0040693e7c4242fbae48c9d32007686c.diff";
+      hash = "sha256-Tir4KeGhBnD9dYmB1FAjuf4R4V+rn12MOxsRwTdE0Sc=";
+    })
+  ];
+
+  # FIXME: required to build with Plasma 5.27, which uses std::optional
+  cmakeFlags = ["-DCMAKE_CXX_STANDARD=17"];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/desktops/plasma-5/default.nix b/pkgs/desktops/plasma-5/default.nix
index dcc5c7f7cf3..f8fc60a5409 100644
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@@ -51,9 +51,9 @@ let
     mirror = "mirror://kde";
   };
 
-  mkDerivation = libsForQt5.callPackage ({ mkDerivation }: mkDerivation) { };
+  qtStdenv = libsForQt5.callPackage ({ stdenv }: stdenv) {};
 
-  packages = self: with self;
+  packages = self:
     let
 
       propagate = out:
@@ -98,6 +98,7 @@ let
 
             defaultSetupHook = if hasBin && hasDev then propagateBin else null;
             setupHook = args.setupHook or defaultSetupHook;
+            nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ libsForQt5.wrapQtAppsHook ];
 
             meta =
               let meta = args.meta or { }; in
@@ -109,8 +110,8 @@ let
                 broken = meta.broken or broken;
               };
           in
-          mkDerivation (args // {
-            inherit pname version meta outputs setupHook src;
+          (args.stdenv or qtStdenv).mkDerivation (args // {
+            inherit pname version meta outputs setupHook src nativeBuildInputs;
           });
       };
 
@@ -123,6 +124,7 @@ let
       breeze-grub = callPackage ./breeze-grub.nix { };
       breeze-plymouth = callPackage ./breeze-plymouth { };
       discover = callPackage ./discover.nix { };
+      flatpak-kcm = callPackage ./flatpak-kcm.nix { };
       kactivitymanagerd = callPackage ./kactivitymanagerd.nix { };
       kde-cli-tools = callPackage ./kde-cli-tools.nix { };
       kde-gtk-config = callPackage ./kde-gtk-config { inherit gsettings-desktop-schemas; };
@@ -162,6 +164,7 @@ let
       plasma-systemmonitor = callPackage ./plasma-systemmonitor.nix { };
       plasma-thunderbolt = callPackage ./plasma-thunderbolt.nix { };
       plasma-vault = callPackage ./plasma-vault { };
+      plasma-welcome = callPackage ./plasma-welcome.nix { };
       plasma-workspace = callPackage ./plasma-workspace { };
       plasma-workspace-wallpapers = callPackage ./plasma-workspace-wallpapers.nix { };
       polkit-kde-agent = callPackage ./polkit-kde-agent.nix { };
diff --git a/pkgs/desktops/plasma-5/fetch.sh b/pkgs/desktops/plasma-5/fetch.sh
index 2da4dc40e6b..0c77e43817c 100644
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.26.5/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.27.0/ -A '*.tar.xz' )
diff --git a/pkgs/desktops/plasma-5/flatpak-kcm.nix b/pkgs/desktops/plasma-5/flatpak-kcm.nix
new file mode 100644
index 00000000000..406a0c9c920
--- /dev/null
+++ b/pkgs/desktops/plasma-5/flatpak-kcm.nix
@@ -0,0 +1,18 @@
+{ mkDerivation
+, extra-cmake-modules
+, flatpak
+, kcmutils
+, kconfig
+, kdeclarative
+}:
+
+mkDerivation {
+  pname = "flatpak-kcm";
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [
+    flatpak
+    kcmutils
+    kconfig
+    kdeclarative
+  ];
+}
diff --git a/pkgs/desktops/plasma-5/kinfocenter/default.nix b/pkgs/desktops/plasma-5/kinfocenter/default.nix
index 222e7855826..2f27dd201ce 100644
--- a/pkgs/desktops/plasma-5/kinfocenter/default.nix
+++ b/pkgs/desktops/plasma-5/kinfocenter/default.nix
@@ -99,6 +99,6 @@ mkDerivation {
   # the same directory, while it is actually located in a completely different
   # store path
   preFixup = ''
-    ln -sf ${lib.getExe systemsettings} $out/bin/kinfocenter
+    ln -sf ${systemsettings}/bin/systemsettings $out/bin/kinfocenter
   '';
 }
diff --git a/pkgs/desktops/plasma-5/kscreenlocker.nix b/pkgs/desktops/plasma-5/kscreenlocker.nix
index d53d808e108..f09104d534f 100644
--- a/pkgs/desktops/plasma-5/kscreenlocker.nix
+++ b/pkgs/desktops/plasma-5/kscreenlocker.nix
@@ -7,6 +7,7 @@
 , kdeclarative
 , kglobalaccel
 , kidletime
+, libkscreen
 , kwayland
 , libXcursor
 , pam
@@ -27,6 +28,7 @@ mkDerivation {
     kdeclarative
     kglobalaccel
     kidletime
+    libkscreen
     kwayland
     libXcursor
     pam
diff --git a/pkgs/desktops/plasma-5/kwin/0001-Revert-x11-Refactor-output-updates.patch b/pkgs/desktops/plasma-5/kwin/0001-Revert-x11-Refactor-output-updates.patch
deleted file mode 100644
index ddaa7f76b13..00000000000
--- a/pkgs/desktops/plasma-5/kwin/0001-Revert-x11-Refactor-output-updates.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-From 84f020835e3624342a928aae68e62e636bf2cc8c Mon Sep 17 00:00:00 2001
-From: Yuriy Taraday <yorik.sar@gmail.com>
-Date: Wed, 12 Oct 2022 12:07:23 +0400
-Subject: [PATCH] Revert "[x11] Refactor output updates"
-
-This reverts commit 9a34ebbffc791cbeadc9abafda793ebee654b270.
-
-This should fix compilation with older GCC.
----
- CMakeLists.txt                                |  2 +-
- .../standalone/x11_standalone_platform.cpp    | 63 +++++++++++--------
- 2 files changed, 38 insertions(+), 27 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 3e7bf700e..6ff24aa5c 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -70,7 +70,7 @@ add_definitions(-DMESA_EGL_NO_X11_HEADERS)
- add_definitions(-DEGL_NO_X11)
- add_definitions(-DEGL_NO_PLATFORM_SPECIFIC_TYPES)
- 
--set(CMAKE_CXX_STANDARD 20)
-+set(CMAKE_CXX_STANDARD 17)
- set(CMAKE_CXX_STANDARD_REQUIRED ON)
- 
- # required frameworks by Core
-diff --git a/src/backends/x11/standalone/x11_standalone_platform.cpp b/src/backends/x11/standalone/x11_standalone_platform.cpp
-index 498d5cbe3..ac0f732b2 100644
---- a/src/backends/x11/standalone/x11_standalone_platform.cpp
-+++ b/src/backends/x11/standalone/x11_standalone_platform.cpp
-@@ -54,8 +54,6 @@
- #include <QX11Info>
- #endif
- 
--#include <span>
--
- namespace KWin
- {
- 
-@@ -407,7 +405,8 @@ void X11StandalonePlatform::invertScreen()
-         ScreenResources res((active_client && active_client->window() != XCB_WINDOW_NONE) ? active_client->window() : rootWindow());
- 
-         if (!res.isNull()) {
--            for (auto crtc : std::span(res.crtcs(), res->num_crtcs)) {
-+            for (int j = 0; j < res->num_crtcs; ++j) {
-+                auto crtc = res.crtcs()[j];
-                 CrtcGamma gamma(crtc);
-                 if (gamma.isNull()) {
-                     continue;
-@@ -480,39 +479,54 @@ void X11StandalonePlatform::doUpdateOutputs()
-     if (Xcb::Extensions::self()->isRandrAvailable()) {
-         T resources(rootWindow());
-         if (!resources.isNull()) {
-+            xcb_randr_crtc_t *crtcs = resources.crtcs();
-+            const xcb_randr_mode_info_t *modes = resources.modes();
-+
-+            QVector<Xcb::RandR::CrtcInfo> infos(resources->num_crtcs);
-+            for (int i = 0; i < resources->num_crtcs; ++i) {
-+                infos[i] = Xcb::RandR::CrtcInfo(crtcs[i], resources->config_timestamp);
-+            }
- 
--            std::span crtcs(resources.crtcs(), resources->num_crtcs);
--            for (auto crtc : crtcs) {
--                Xcb::RandR::CrtcInfo info(crtc, resources->config_timestamp);
-+            for (int i = 0; i < resources->num_crtcs; ++i) {
-+                Xcb::RandR::CrtcInfo info(infos.at(i));
- 
-                 const QRect geometry = info.rect();
-                 if (!geometry.isValid()) {
-                     continue;
-                 }
- 
--                float refreshRate = -1.0f;
-+                xcb_randr_output_t *outputs = info.outputs();
-+                QVector<Xcb::RandR::OutputInfo> outputInfos(outputs ? resources->num_outputs : 0);
-+                QVector<Xcb::RandR::OutputProperty> edids(outputs ? resources->num_outputs : 0);
-+                if (outputs) {
-+                    for (int i = 0; i < resources->num_outputs; ++i) {
-+                        outputInfos[i] = Xcb::RandR::OutputInfo(outputs[i], resources->config_timestamp);
-+                        edids[i] = Xcb::RandR::OutputProperty(outputs[i], atoms->edid, XCB_ATOM_INTEGER, 0, 100, false, false);
-+                    }
-+                }
- 
--                for (auto mode : std::span(resources.modes(), resources->num_modes)) {
--                    if (info->mode == mode.id) {
--                        if (mode.htotal != 0 && mode.vtotal != 0) { // BUG 313996
-+                float refreshRate = -1.0f;
-+                for (int j = 0; j < resources->num_modes; ++j) {
-+                    if (info->mode == modes[j].id) {
-+                        if (modes[j].htotal != 0 && modes[j].vtotal != 0) { // BUG 313996
-                             // refresh rate calculation - WTF was wikipedia 1998 when I needed it?
--                            int dotclock = mode.dot_clock,
--                                vtotal = mode.vtotal;
--                            if (mode.mode_flags & XCB_RANDR_MODE_FLAG_INTERLACE) {
-+                            int dotclock = modes[j].dot_clock,
-+                                vtotal = modes[j].vtotal;
-+                            if (modes[j].mode_flags & XCB_RANDR_MODE_FLAG_INTERLACE) {
-                                 dotclock *= 2;
-                             }
--                            if (mode.mode_flags & XCB_RANDR_MODE_FLAG_DOUBLE_SCAN) {
-+                            if (modes[j].mode_flags & XCB_RANDR_MODE_FLAG_DOUBLE_SCAN) {
-                                 vtotal *= 2;
-                             }
--                            refreshRate = dotclock / float(mode.htotal * vtotal);
-+                            refreshRate = dotclock / float(modes[j].htotal * vtotal);
-                         }
-                         break; // found mode
-                     }
-                 }
- 
--                for (auto xcbOutput : std::span(info.outputs(), info->num_outputs)) {
--                    Xcb::RandR::OutputInfo outputInfo(xcbOutput, resources->config_timestamp);
--                    if (outputInfo->crtc != crtc) {
-+                for (int j = 0; j < info->num_outputs; ++j) {
-+                    Xcb::RandR::OutputInfo outputInfo(outputInfos.at(j));
-+                    if (outputInfo->crtc != crtcs[i]) {
-                         continue;
-                     }
- 
-@@ -528,14 +542,12 @@ void X11StandalonePlatform::doUpdateOutputs()
-                     // TODO: Perhaps the output has to save the inherited gamma ramp and
-                     // restore it during tear down. Currently neither standalone x11 nor
-                     // drm platform do this.
--                    Xcb::RandR::CrtcGamma gamma(crtc);
-+                    Xcb::RandR::CrtcGamma gamma(crtcs[i]);
- 
-                     output->setRenderLoop(m_renderLoop.get());
--                    output->setCrtc(crtc);
-+                    output->setCrtc(crtcs[i]);
-                     output->setGammaRampSize(gamma.isNull() ? 0 : gamma->size);
--                    auto it = std::find(crtcs.begin(), crtcs.end(), crtc);
--                    int crtcIndex = std::distance(crtcs.begin(), it);
--                    output->setXineramaNumber(crtcIndex);
-+                    output->setXineramaNumber(i);
- 
-                     QSize physicalSize(outputInfo->mm_width, outputInfo->mm_height);
-                     switch (info->rotation) {
-@@ -556,10 +568,9 @@ void X11StandalonePlatform::doUpdateOutputs()
-                         .physicalSize = physicalSize,
-                     };
- 
--                    auto edidProperty = Xcb::RandR::OutputProperty(xcbOutput, atoms->edid, XCB_ATOM_INTEGER, 0, 100, false, false);
-                     bool ok;
--                    if (auto data = edidProperty.toByteArray(&ok); ok && !data.isEmpty()) {
--                        if (auto edid = Edid(data, edidProperty.data()->num_items); edid.isValid()) {
-+                    if (auto data = edids[j].toByteArray(&ok); ok && !data.isEmpty()) {
-+                        if (auto edid = Edid(data, edids[j].data()->num_items); edid.isValid()) {
-                             information.manufacturer = edid.manufacturerString();
-                             information.model = edid.monitorName();
-                             information.serialNumber = edid.serialNumber();
--- 
-2.37.2
-
diff --git a/pkgs/desktops/plasma-5/kwin/0003-plugins-qpa-allow-using-nixos-wrapper.patch b/pkgs/desktops/plasma-5/kwin/0003-plugins-qpa-allow-using-nixos-wrapper.patch
index 50c7cef3f8c..d0be721b044 100644
--- a/pkgs/desktops/plasma-5/kwin/0003-plugins-qpa-allow-using-nixos-wrapper.patch
+++ b/pkgs/desktops/plasma-5/kwin/0003-plugins-qpa-allow-using-nixos-wrapper.patch
@@ -13,9 +13,9 @@ index efd236b..a69c046 100644
 --- a/src/plugins/qpa/main.cpp
 +++ b/src/plugins/qpa/main.cpp
 @@ -23,7 +23,7 @@ public:
+
  QPlatformIntegration *KWinIntegrationPlugin::create(const QString &system, const QStringList &paramList)
  {
-     Q_UNUSED(paramList)
 -    if (!QCoreApplication::applicationFilePath().endsWith(QLatin1String("kwin_wayland")) && !qEnvironmentVariableIsSet("KWIN_FORCE_OWN_QPA")) {
 +    if (!QCoreApplication::applicationFilePath().endsWith(QLatin1String("kwin_wayland")) && !QCoreApplication::applicationFilePath().endsWith(QLatin1String(".kwin_wayland-wrapped")) && !qEnvironmentVariableIsSet("KWIN_FORCE_OWN_QPA")) {
          // Not KWin
diff --git a/pkgs/desktops/plasma-5/kwin/default.nix b/pkgs/desktops/plasma-5/kwin/default.nix
index 8f69c965ea0..6269dd4d0c2 100644
--- a/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/pkgs/desktops/plasma-5/kwin/default.nix
@@ -57,6 +57,7 @@
 , plasma-framework
 , libqaccessibilityclient
 , python3
+, gcc12Stdenv
 }:
 
 # TODO (ttuegel): investigate qmlplugindump failure
@@ -142,12 +143,15 @@ mkDerivation {
       url = "https://invent.kde.org/plasma/kwin/-/commit/9a008b223ad696db3bf5692750f2b74e578e08b8.diff";
       sha256 = "sha256-f35G+g2MVABLDbAkCed3ZmtDWrzYn1rdD08mEx35j4k=";
     })
-  ] ++ lib.optionals stdenv.isAarch64 [
-    ./0001-Revert-x11-Refactor-output-updates.patch
   ];
+
+  stdenv = if stdenv.isAarch64 then gcc12Stdenv else stdenv;
+
   CXXFLAGS = [
     ''-DNIXPKGS_XWAYLAND=\"${lib.getBin xwayland}/bin/Xwayland\"''
-  ];
+  ]
+  ++ lib.optional stdenv.isAarch64 "-mno-outline-atomics";
+
   postInstall = ''
     # Some package(s) refer to these service types by the wrong name.
     # I would prefer to patch those packages, but I cannot find them!
diff --git a/pkgs/desktops/plasma-5/libkscreen/libkscreen-backends-path.patch b/pkgs/desktops/plasma-5/libkscreen/libkscreen-backends-path.patch
index 3d19f2d89fa..948c045db4b 100644
--- a/pkgs/desktops/plasma-5/libkscreen/libkscreen-backends-path.patch
+++ b/pkgs/desktops/plasma-5/libkscreen/libkscreen-backends-path.patch
@@ -1,16 +1,20 @@
-Index: libkscreen-5.9.4/src/backendmanager.cpp
-===================================================================
---- libkscreen-5.9.4.orig/src/backendmanager.cpp
-+++ libkscreen-5.9.4/src/backendmanager.cpp
-@@ -172,14 +172,11 @@ QFileInfo BackendManager::preferredBackend(const QString &backend)
+diff --git a/src/backendmanager.cpp b/src/backendmanager.cpp
+index e1013d5..4bded53 100644
+--- a/src/backendmanager.cpp
++++ b/src/backendmanager.cpp
+@@ -164,18 +164,11 @@ QFileInfo BackendManager::preferredBackend(const QString &backend)
+ 
  QFileInfoList BackendManager::listBackends()
  {
-     // Compile a list of installed backends first
+-    // Compile a list of installed backends first
 -    const QString backendFilter = QStringLiteral("KSC_*");
 -    const QStringList paths = QCoreApplication::libraryPaths();
 -    QFileInfoList finfos;
 -    for (const QString &path : paths) {
--        const QDir dir(path + QLatin1String("/kf5/kscreen/"), backendFilter, QDir::SortFlags(QDir::QDir::Name), QDir::NoDotAndDotDot | QDir::Files);
+-        const QDir dir(path + QStringLiteral("/kf" QT_STRINGIFY(QT_VERSION_MAJOR) "/kscreen/"),
+-                       backendFilter,
+-                       QDir::SortFlags(QDir::QDir::Name),
+-                       QDir::NoDotAndDotDot | QDir::Files);
 -        finfos.append(dir.entryInfoList());
 -    }
 -    return finfos;
@@ -21,4 +25,4 @@ Index: libkscreen-5.9.4/src/backendmanager.cpp
 +    return dir.entryInfoList();
  }
  
- KScreen::AbstractBackend *BackendManager::loadBackendPlugin(QPluginLoader *loader, const QString &name, const QVariantMap &arguments)
+ void BackendManager::setBackendArgs(const QVariantMap &arguments)
diff --git a/pkgs/desktops/plasma-5/plasma-remotecontrollers.nix b/pkgs/desktops/plasma-5/plasma-remotecontrollers.nix
index 3f169244fda..be1c6ff42ef 100644
--- a/pkgs/desktops/plasma-5/plasma-remotecontrollers.nix
+++ b/pkgs/desktops/plasma-5/plasma-remotecontrollers.nix
@@ -8,6 +8,7 @@
 , kdeclarative
 , kcmutils
 , kpackage
+, kscreenlocker
 , kwindowsystem
 , wayland
 , pkg-config
@@ -29,6 +30,7 @@ mkDerivation {
     kdeclarative
     kcmutils
     kpackage
+    kscreenlocker
     kwindowsystem
     wayland
     libcec
diff --git a/pkgs/desktops/plasma-5/plasma-welcome.nix b/pkgs/desktops/plasma-5/plasma-welcome.nix
new file mode 100644
index 00000000000..1ae778b3282
--- /dev/null
+++ b/pkgs/desktops/plasma-5/plasma-welcome.nix
@@ -0,0 +1,44 @@
+{ mkDerivation
+, extra-cmake-modules
+, qtquickcontrols2
+, accounts-qt
+, kaccounts-integration
+, kcoreaddons
+, kconfigwidgets
+, kdbusaddons
+, kdeclarative
+, ki18n
+, kio
+, kirigami2
+, knewstuff
+, knotifications
+, kservice
+, kuserfeedback
+, kwindowsystem
+, plasma-framework
+, signond
+}:
+
+mkDerivation {
+  pname = "plasma-welcome";
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [
+    qtquickcontrols2
+    accounts-qt
+    kaccounts-integration
+    kcoreaddons
+    kconfigwidgets
+    kdbusaddons
+    kdeclarative
+    ki18n
+    kio
+    kirigami2
+    knewstuff
+    knotifications
+    kservice
+    kuserfeedback
+    kwindowsystem
+    plasma-framework
+    signond
+  ];
+}
diff --git a/pkgs/desktops/plasma-5/srcs.nix b/pkgs/desktops/plasma-5/srcs.nix
index cc0a02b6aab..496223dc842 100644
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@@ -4,467 +4,483 @@
 
 {
   aura-browser = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/aura-browser-5.26.5.tar.xz";
-      sha256 = "0dhj058vh577jyhcjdp6x9dmh6apxk6yinknfci8l6vss9gchini";
-      name = "aura-browser-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/aura-browser-5.27.0.tar.xz";
+      sha256 = "0lw7qvvgbyrqy7zb3m4bd0j4j36x26z0nzxm2g84kgddmczf95az";
+      name = "aura-browser-5.27.0.tar.xz";
     };
   };
   bluedevil = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/bluedevil-5.26.5.tar.xz";
-      sha256 = "069hsn40zbnpkd73zcnnkdjv7n30dqyls5yvg3m0ljphn1syi79y";
-      name = "bluedevil-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/bluedevil-5.27.0.tar.xz";
+      sha256 = "0wjll668bmdk8xm2vl7p31md8ljwzycnr99y3bli4whczihiclly";
+      name = "bluedevil-5.27.0.tar.xz";
     };
   };
   breeze = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/breeze-5.26.5.tar.xz";
-      sha256 = "00zzb03jan14byh19mga3jrzwi3rl084cgpnk0wj3gwgf903p78y";
-      name = "breeze-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/breeze-5.27.0.tar.xz";
+      sha256 = "0g68l0kfdsp9halrwpbn3azm3v97gdynpc4y1bwa6j2xxaj5fp4a";
+      name = "breeze-5.27.0.tar.xz";
     };
   };
   breeze-grub = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/breeze-grub-5.26.5.tar.xz";
-      sha256 = "0ibjqv6hyqi4ljf5jhx5sv55li9jcvk5lydl0xrb54v8czbarg4w";
-      name = "breeze-grub-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/breeze-grub-5.27.0.tar.xz";
+      sha256 = "0mnga6fhpy10shvbfys6lw0q3hk61vhfa95ykvgv6d5ssavzamyp";
+      name = "breeze-grub-5.27.0.tar.xz";
     };
   };
   breeze-gtk = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/breeze-gtk-5.26.5.tar.xz";
-      sha256 = "1k1kcrv6cbx9m0yxnqhdgwq0bd8qf8055acwjdphwjhl50icliqi";
-      name = "breeze-gtk-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/breeze-gtk-5.27.0.tar.xz";
+      sha256 = "1apd17b7p8i2i2ls6pdpabzijca4lwdzd4p1srx46wb0slm6fqma";
+      name = "breeze-gtk-5.27.0.tar.xz";
     };
   };
   breeze-plymouth = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/breeze-plymouth-5.26.5.tar.xz";
-      sha256 = "0skiii7ni6r6jp3a7nq10hd6qdria1481lml4l57ma9afgvpxi9v";
-      name = "breeze-plymouth-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/breeze-plymouth-5.27.0.tar.xz";
+      sha256 = "103f8v56a8qm1hlnakbzljsv5iyfc3ynry169f2vvsafm40bc6c0";
+      name = "breeze-plymouth-5.27.0.tar.xz";
     };
   };
   discover = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/discover-5.26.5.tar.xz";
-      sha256 = "19fd4f7nvqznfkrivxh77si627kqjnm1g17lidl9alz2iy2bxfm6";
-      name = "discover-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/discover-5.27.0.tar.xz";
+      sha256 = "0qa9hz7fxf1c9wi5c1x5z345mac3d5prgxxvadv4285c0sxvqidz";
+      name = "discover-5.27.0.tar.xz";
     };
   };
   drkonqi = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/drkonqi-5.26.5.tar.xz";
-      sha256 = "1syl78sl7wzjdb53glln6laa017cawgz0c39p33bdwq3kpzckw07";
-      name = "drkonqi-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/drkonqi-5.27.0.tar.xz";
+      sha256 = "015ivarw48ymsz06jbd2rdqvdmcww93r2msrmmfh7jrzszqh3dlg";
+      name = "drkonqi-5.27.0.tar.xz";
+    };
+  };
+  flatpak-kcm = {
+    version = "5.27.0";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma/5.27.0/flatpak-kcm-5.27.0.tar.xz";
+      sha256 = "0318p0pm79kzk4l1rc239h7a7kvswz9vy3kylznn561fazkn3lss";
+      name = "flatpak-kcm-5.27.0.tar.xz";
     };
   };
   kactivitymanagerd = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kactivitymanagerd-5.26.5.tar.xz";
-      sha256 = "0ypnnh3lpcfw8ggi6nc8sr4hcsamx6s3ax869b6rhh392avcw2ha";
-      name = "kactivitymanagerd-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kactivitymanagerd-5.27.0.tar.xz";
+      sha256 = "02k8il4sgl63rdkn63hhpsc6pymc9a5p4jv452fiw0vpf2zbj3sn";
+      name = "kactivitymanagerd-5.27.0.tar.xz";
     };
   };
   kde-cli-tools = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kde-cli-tools-5.26.5.tar.xz";
-      sha256 = "0djxqxdkih4svmggk6lk6p6n3sx3w4q9fsnx2dxfn5injwh0qrkr";
-      name = "kde-cli-tools-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kde-cli-tools-5.27.0.tar.xz";
+      sha256 = "1w5cxbxwfnv5wl04jwchr14c6fx0yf3s3x98d18h87bd0vx3w48m";
+      name = "kde-cli-tools-5.27.0.tar.xz";
     };
   };
   kde-gtk-config = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kde-gtk-config-5.26.5.tar.xz";
-      sha256 = "10r4kgpd04hh05yriga2r5awwdb8v93jsx0qksdgj3661xy00x7n";
-      name = "kde-gtk-config-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kde-gtk-config-5.27.0.tar.xz";
+      sha256 = "1bhqxnpgpj69jrfkn0znbnwp7r73gl6qb9xzi1pjj8cqb5bn5skg";
+      name = "kde-gtk-config-5.27.0.tar.xz";
     };
   };
   kdecoration = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kdecoration-5.26.5.tar.xz";
-      sha256 = "1dzpqzi25wxmilj92lqjmd6wid3nlkbvnnpcpp0ywd860q30zzd2";
-      name = "kdecoration-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kdecoration-5.27.0.tar.xz";
+      sha256 = "04vw9kyvwq5jg8pw85b96c3ahm8213pf4a03dm49hv1fdzslvjaf";
+      name = "kdecoration-5.27.0.tar.xz";
     };
   };
   kdeplasma-addons = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kdeplasma-addons-5.26.5.tar.xz";
-      sha256 = "17vrdnigif4v38gbh04p8qs7wqp3y3nqll1m7xc4qfqbq1dydyjq";
-      name = "kdeplasma-addons-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kdeplasma-addons-5.27.0.tar.xz";
+      sha256 = "19nr13aipfds1y5zr0a05wb55s7pdzqmpidmm7w9aaxxa5rbg623";
+      name = "kdeplasma-addons-5.27.0.tar.xz";
     };
   };
   kgamma5 = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kgamma5-5.26.5.tar.xz";
-      sha256 = "0v4rpm2asv31w1rqrhn25kbcdl1acahg10lmh6iwisxl1i3x8hd8";
-      name = "kgamma5-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kgamma5-5.27.0.tar.xz";
+      sha256 = "1dyfpwfadp2n83lcr3mak3n8h2cxgxs2hv35madah6zf78m5ldw5";
+      name = "kgamma5-5.27.0.tar.xz";
     };
   };
   khotkeys = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/khotkeys-5.26.5.tar.xz";
-      sha256 = "0lkmh5n76kmrdxm4snkk1zz7d927qkl69ajd5qhz277whpz3slw8";
-      name = "khotkeys-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/khotkeys-5.27.0.tar.xz";
+      sha256 = "1xyy7511k6a1xlr63qq3qbk8wr1c12skmqzxliijv8q2b7b8dpiz";
+      name = "khotkeys-5.27.0.tar.xz";
     };
   };
   kinfocenter = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kinfocenter-5.26.5.tar.xz";
-      sha256 = "0rka2fm7r2zikv3lcd1q39swgcp6fs5l4f5ldpgwpk9bps96cy4x";
-      name = "kinfocenter-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kinfocenter-5.27.0.tar.xz";
+      sha256 = "0k9h4m0jzxdyqyfn9pam0ssmhj6lng0l8mn23r7yw6mqi1i01yvl";
+      name = "kinfocenter-5.27.0.tar.xz";
     };
   };
   kmenuedit = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kmenuedit-5.26.5.tar.xz";
-      sha256 = "17iyk77mb1lp9xjl92ffvv111b4m2qq98xznd1qafnah7ix1cg7p";
-      name = "kmenuedit-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kmenuedit-5.27.0.tar.xz";
+      sha256 = "1jb5pjy6flar0hxy9avnryxjmvh0ixyxr7xjbzbwjfx6zzf40i62";
+      name = "kmenuedit-5.27.0.tar.xz";
     };
   };
   kpipewire = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kpipewire-5.26.5.tar.xz";
-      sha256 = "1yqymwq48mqv9zfw3idb0abizrfhr7f4d37ys9w7a9jixcm7rdrv";
-      name = "kpipewire-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kpipewire-5.27.0.tar.xz";
+      sha256 = "0mhpi16025bznxgp9lkg44rjxbm541yl39nj1rffpqh3bvhgw600";
+      name = "kpipewire-5.27.0.tar.xz";
     };
   };
   kscreen = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kscreen-5.26.5.tar.xz";
-      sha256 = "0w8yrzpgr23s7sr3296lrm2zbm2j2174zv5az41i44l907iq9y1x";
-      name = "kscreen-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kscreen-5.27.0.tar.xz";
+      sha256 = "043g0h2lk6k4xqfbma45m91wf93fm0v1vgf49ax6bqx9y3hvb1gw";
+      name = "kscreen-5.27.0.tar.xz";
     };
   };
   kscreenlocker = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kscreenlocker-5.26.5.tar.xz";
-      sha256 = "0lwn3xbbk1578974m3nkk2x5h9fadrcizvh4q4528s5wgxja6w2g";
-      name = "kscreenlocker-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kscreenlocker-5.27.0.tar.xz";
+      sha256 = "0xvwlqh6knrj2l9asrkmv7fzwl5xbxm05pgimb9lk1bk67nr0xir";
+      name = "kscreenlocker-5.27.0.tar.xz";
     };
   };
   ksshaskpass = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/ksshaskpass-5.26.5.tar.xz";
-      sha256 = "0k0jxbkav115i5nhazxyz3s3wg6gyfcsa1jilf3j3fr8vnh8qhx0";
-      name = "ksshaskpass-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/ksshaskpass-5.27.0.tar.xz";
+      sha256 = "1p55lf47vznvvprs2wn5c7ccq4iy6cxkqqdl9di02rzj9rf81zbs";
+      name = "ksshaskpass-5.27.0.tar.xz";
     };
   };
   ksystemstats = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/ksystemstats-5.26.5.tar.xz";
-      sha256 = "18sa2w6vgbqmw8wrg5vqbraql04x9kb7mj9k35z4zs2n4abfrrbi";
-      name = "ksystemstats-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/ksystemstats-5.27.0.tar.xz";
+      sha256 = "1vax9cq33gxv2qaz908bsckrvdpffl975ayliz72f6d2mhsx9r5i";
+      name = "ksystemstats-5.27.0.tar.xz";
     };
   };
   kwallet-pam = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kwallet-pam-5.26.5.tar.xz";
-      sha256 = "1c5pzih8id0gld7qdf8ffxsbfgq9bsvpx37qyzr941b3vif7f9yx";
-      name = "kwallet-pam-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kwallet-pam-5.27.0.tar.xz";
+      sha256 = "0kwlinn6xcxqrib4xc200c9dmbq0gk0hmh6ahzd0nvgng6g6bvw7";
+      name = "kwallet-pam-5.27.0.tar.xz";
     };
   };
   kwayland-integration = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kwayland-integration-5.26.5.tar.xz";
-      sha256 = "0czq16lq210hq7a3wqg7pvdr9a8vm16z6yb82p0w6yqv15kk7alx";
-      name = "kwayland-integration-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kwayland-integration-5.27.0.tar.xz";
+      sha256 = "0aml251n9amrjiyp6933iz245z3qr5lvpdyxsgnpzlvn652zyfqv";
+      name = "kwayland-integration-5.27.0.tar.xz";
     };
   };
   kwin = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kwin-5.26.5.tar.xz";
-      sha256 = "1n0v0553s9l8s6wgdz5bhrnvww20q49h92v3m4w216razj7q3q0k";
-      name = "kwin-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kwin-5.27.0.tar.xz";
+      sha256 = "1g1rma3ks6i10dvqksa61fi0w0g87gbb73jjzkz0jicbs5823w9c";
+      name = "kwin-5.27.0.tar.xz";
     };
   };
   kwrited = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/kwrited-5.26.5.tar.xz";
-      sha256 = "14savlbywkx5107s0viprafs9pl389zhjk32iy4x5jmf9dk6vmm9";
-      name = "kwrited-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/kwrited-5.27.0.tar.xz";
+      sha256 = "15fxhk9dd0z9pfc99hsb9zqwish8wkbld8kgj8a1nzl5a2dnjnd3";
+      name = "kwrited-5.27.0.tar.xz";
     };
   };
   layer-shell-qt = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/layer-shell-qt-5.26.5.tar.xz";
-      sha256 = "1k79dcyic2hkm92sd7aix03ywagr4rgsdf86a9zy06kafg92jra9";
-      name = "layer-shell-qt-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/layer-shell-qt-5.27.0.tar.xz";
+      sha256 = "1zs3p7fbw3yf24d2zy51pyjlxy9gxs8k78c481yck04sj8vlf3cw";
+      name = "layer-shell-qt-5.27.0.tar.xz";
     };
   };
   libkscreen = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/libkscreen-5.26.5.tar.xz";
-      sha256 = "0vajgzjvpn909ds88jddsg7bman0rdphrm70b0k5ar7bcw0x54d5";
-      name = "libkscreen-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/libkscreen-5.27.0.tar.xz";
+      sha256 = "16b2j8gfgf12nxwm8pij41yl6ffcjh7h31rw54j6mlx2q7i5lq2h";
+      name = "libkscreen-5.27.0.tar.xz";
     };
   };
   libksysguard = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/libksysguard-5.26.5.tar.xz";
-      sha256 = "01a1wm6z191lzjqd5iws90jd3ld3r6r1qaw95bl65l9ar8p3gr8p";
-      name = "libksysguard-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/libksysguard-5.27.0.tar.xz";
+      sha256 = "01lsf52kfzp6h964s1aifg4wlf52hba56wf66cq3vi05ghckfbb5";
+      name = "libksysguard-5.27.0.tar.xz";
     };
   };
   milou = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/milou-5.26.5.tar.xz";
-      sha256 = "1pmz4n41ysb0mhgykvc65r5as8fkd7wr4k57sk0a12wzsndy7zv8";
-      name = "milou-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/milou-5.27.0.tar.xz";
+      sha256 = "1zs5n37crpqzbycjb5x239fs65wv2ghkx5m87sq65713rs7lmpbx";
+      name = "milou-5.27.0.tar.xz";
     };
   };
   oxygen = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/oxygen-5.26.5.tar.xz";
-      sha256 = "0wllhniaqpzvzji51a9871j1697kjwbz4xj8q9x1w89ip88pb6gq";
-      name = "oxygen-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/oxygen-5.27.0.tar.xz";
+      sha256 = "0vld1m3ac5z2z4k6vp8v5kzib094baj5ndwqvf6ryhyp9v7in3r0";
+      name = "oxygen-5.27.0.tar.xz";
     };
   };
   oxygen-sounds = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/oxygen-sounds-5.26.5.tar.xz";
-      sha256 = "1ws6bssn2r2m666kd6i0xnmzxb8x3z2pa6qk36xpbs1xjxdv5wny";
-      name = "oxygen-sounds-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/oxygen-sounds-5.27.0.tar.xz";
+      sha256 = "08brv177p3hlqvkf7chy1s5i45vnbjsjxiqxmac8grfh9dgsjyk6";
+      name = "oxygen-sounds-5.27.0.tar.xz";
     };
   };
   plank-player = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plank-player-5.26.5.tar.xz";
-      sha256 = "18yw74mqcd0igps10m1sd41rlir2y8y78xkljxj5w2y4yvh97vbs";
-      name = "plank-player-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plank-player-5.27.0.tar.xz";
+      sha256 = "0ng97dcpfvm5klwnqzc47rv8lwxj0cmidx3igzjgkrl23k4rcxy2";
+      name = "plank-player-5.27.0.tar.xz";
     };
   };
   plasma-bigscreen = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-bigscreen-5.26.5.tar.xz";
-      sha256 = "0893ngwdgq1l76gib4p9212lwp4i2gxvpnmxygndbmkz7nhjax75";
-      name = "plasma-bigscreen-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-bigscreen-5.27.0.tar.xz";
+      sha256 = "0c2zldcsfqklwv3lsw9fb7q39vsaq5lzxad3wqrhsphz8c8v6yxg";
+      name = "plasma-bigscreen-5.27.0.tar.xz";
     };
   };
   plasma-browser-integration = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-browser-integration-5.26.5.tar.xz";
-      sha256 = "1bfzha5vd8hjij758b0g6ibyi4f8gmijz92fgn5is0p1hydm8y4l";
-      name = "plasma-browser-integration-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-browser-integration-5.27.0.tar.xz";
+      sha256 = "014fn47khppa7ay5sxcz43g81igbx6lpv19whc7p4ik3cp3rzk7i";
+      name = "plasma-browser-integration-5.27.0.tar.xz";
     };
   };
   plasma-desktop = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-desktop-5.26.5.tar.xz";
-      sha256 = "15kc5sam3y2c1ccp14cs7v5zakgzz9gpxpyxapimlvkwscxmvzn6";
-      name = "plasma-desktop-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-desktop-5.27.0.tar.xz";
+      sha256 = "0d52a4adjkyah6ab93153mp5af8338mipm9712i9xzylwf73100q";
+      name = "plasma-desktop-5.27.0.tar.xz";
     };
   };
   plasma-disks = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-disks-5.26.5.tar.xz";
-      sha256 = "137k44lly2qv6vrmfi4g2xqc7y907ywwshp7mn07qmbps3a85h30";
-      name = "plasma-disks-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-disks-5.27.0.tar.xz";
+      sha256 = "1m7hh901p7h0ibj7pgsqhz6jkn07mnw7m1xgs6d43i1n7vnw9hlb";
+      name = "plasma-disks-5.27.0.tar.xz";
     };
   };
   plasma-firewall = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-firewall-5.26.5.tar.xz";
-      sha256 = "18fp7iqnyjx2p44n8hjs7fss212ja3k2i5cryrnmwpf7r0q73l36";
-      name = "plasma-firewall-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-firewall-5.27.0.tar.xz";
+      sha256 = "02haqjiim2qk77074likhvmj07120p7cr9lsxjsmhfc4f69wwkh2";
+      name = "plasma-firewall-5.27.0.tar.xz";
     };
   };
   plasma-integration = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-integration-5.26.5.tar.xz";
-      sha256 = "0ap7rzhqmm7ai9sc6w281f2kf81qgs2h2qpf5bvbc6wm3vn1lm1g";
-      name = "plasma-integration-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-integration-5.27.0.tar.xz";
+      sha256 = "0ma6ig7gldl26pav4j1svcwxbpmgfq72q6nxzyysrgxzfyk93c1w";
+      name = "plasma-integration-5.27.0.tar.xz";
     };
   };
   plasma-mobile = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-mobile-5.26.5.tar.xz";
-      sha256 = "06gha8mga9xqmmvzc9why9pfzzpy8czrqym3k3n23pa9hy2qqsvj";
-      name = "plasma-mobile-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-mobile-5.27.0.tar.xz";
+      sha256 = "14a68d6lxm3pfq8znzk0k0f4kq9wpgmmj0zqa5jfr1gapqyrdkmv";
+      name = "plasma-mobile-5.27.0.tar.xz";
     };
   };
   plasma-nano = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-nano-5.26.5.tar.xz";
-      sha256 = "161sabckgl8gjxxsm0aklp33bf05iq2p84vh2v5y6bfpimsnamnj";
-      name = "plasma-nano-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-nano-5.27.0.tar.xz";
+      sha256 = "0sc8fdbbwwn3a1gip31dvwb5pfdl1zk08i795yp5gfjc04kckxs1";
+      name = "plasma-nano-5.27.0.tar.xz";
     };
   };
   plasma-nm = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-nm-5.26.5.tar.xz";
-      sha256 = "1msi9lhkhpb29h6fwkxqmp9js70r8vrvzzf38hzkgxcbf3757k64";
-      name = "plasma-nm-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-nm-5.27.0.tar.xz";
+      sha256 = "0p7vqw7nkwpy84lg5w5alkrkaisg56fwsrgvwb43mb54h5pfcd4f";
+      name = "plasma-nm-5.27.0.tar.xz";
     };
   };
   plasma-pa = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-pa-5.26.5.tar.xz";
-      sha256 = "19i9ipajiz68silvprap9pykki6rhb7d2ways501bx8g4vfcb0h5";
-      name = "plasma-pa-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-pa-5.27.0.tar.xz";
+      sha256 = "0z3njcfr8y9y9025sdz28qvi9fc6vsndfb7zi1wacrrncjxg1wkl";
+      name = "plasma-pa-5.27.0.tar.xz";
     };
   };
   plasma-remotecontrollers = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-remotecontrollers-5.26.5.tar.xz";
-      sha256 = "1cam1jchp3nwqkqskln4qbpb4rixzwa0bwma89ysdgqy0pzpq2x0";
-      name = "plasma-remotecontrollers-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-remotecontrollers-5.27.0.tar.xz";
+      sha256 = "0q8wjr5qi97k4j5lm5wy35r78hf9cwa9sbj170xm5ni2rmdlsb14";
+      name = "plasma-remotecontrollers-5.27.0.tar.xz";
     };
   };
   plasma-sdk = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-sdk-5.26.5.tar.xz";
-      sha256 = "0p20s2cp5vd1chj28wq88ixb625hisl134hnlllz6h70s5vzy79n";
-      name = "plasma-sdk-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-sdk-5.27.0.tar.xz";
+      sha256 = "0fqbpcw705yy0szbvvnf266bclv9l65v563kmcsryq31y7ji15iz";
+      name = "plasma-sdk-5.27.0.tar.xz";
     };
   };
   plasma-systemmonitor = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-systemmonitor-5.26.5.tar.xz";
-      sha256 = "0xghszlm8h70p192qizv2kj7f02fnf3p3hg1p10ni7sqfaczrbq1";
-      name = "plasma-systemmonitor-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-systemmonitor-5.27.0.tar.xz";
+      sha256 = "139jyqvwykxc7pfrcrrsyks0jdg3ljw8hg7plqw5n2cd4slx6psx";
+      name = "plasma-systemmonitor-5.27.0.tar.xz";
     };
   };
   plasma-tests = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-tests-5.26.5.tar.xz";
-      sha256 = "1h0cinrgjdp7rhl3v55c40a5agd93rqwx1xjqyj06vkjkbigx0fr";
-      name = "plasma-tests-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-tests-5.27.0.tar.xz";
+      sha256 = "1ncsjiwlx73kc6xzlz1da8xdppw8q1al9k8lm6zj1qvf4mnb62kr";
+      name = "plasma-tests-5.27.0.tar.xz";
     };
   };
   plasma-thunderbolt = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-thunderbolt-5.26.5.tar.xz";
-      sha256 = "1lzj3m2k34m3fvcq3ykr5igaq0sbc4v87cncxvz6ln0p7cq0i6y5";
-      name = "plasma-thunderbolt-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-thunderbolt-5.27.0.tar.xz";
+      sha256 = "053xi6vjlavavxqcz5d0b78pnjmswqg0y5kq4r7pqkazj0829ca3";
+      name = "plasma-thunderbolt-5.27.0.tar.xz";
     };
   };
   plasma-vault = {
-    version = "5.26.5";
+    version = "5.27.0";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma/5.27.0/plasma-vault-5.27.0.tar.xz";
+      sha256 = "0i5m9jyvpv5rfwms75pw65c4x315lwby0cg7pab3dz2xsy82g2p8";
+      name = "plasma-vault-5.27.0.tar.xz";
+    };
+  };
+  plasma-welcome = {
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-vault-5.26.5.tar.xz";
-      sha256 = "104cs6prb8v5mccshz5brknfllyfbfnjzzpdrgk1xpzh5apwmhja";
-      name = "plasma-vault-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-welcome-5.27.0.tar.xz";
+      sha256 = "00pr7bvx1accs1faw149r28qkkjdxmmib2a6m7asyn591pykzbyh";
+      name = "plasma-welcome-5.27.0.tar.xz";
     };
   };
   plasma-workspace = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-workspace-5.26.5.tar.xz";
-      sha256 = "082jnlqgbp48bmyp1nbzg2d0p0pxkvra6xjv40kvh6k6rmpr5cjc";
-      name = "plasma-workspace-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-workspace-5.27.0.tar.xz";
+      sha256 = "0fq71fhqn0lx88a7n8rw9jrwkcm720s2c2l1ry9035kmvz94w901";
+      name = "plasma-workspace-5.27.0.tar.xz";
     };
   };
   plasma-workspace-wallpapers = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plasma-workspace-wallpapers-5.26.5.tar.xz";
-      sha256 = "07gln5jl947qfpvrgiqa1fnw8lnnf4jg734ayybi927j059s3g8i";
-      name = "plasma-workspace-wallpapers-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plasma-workspace-wallpapers-5.27.0.tar.xz";
+      sha256 = "1pyz1gnbg2n907yi4wlj9gq495145ww50z66q8ykgmix1yxwmjnz";
+      name = "plasma-workspace-wallpapers-5.27.0.tar.xz";
     };
   };
   plymouth-kcm = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/plymouth-kcm-5.26.5.tar.xz";
-      sha256 = "1isxs6gxbab2ddl22c3992gmdgy3mi5yjb9inv32ajzs6r7snrj1";
-      name = "plymouth-kcm-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/plymouth-kcm-5.27.0.tar.xz";
+      sha256 = "1cbwpqfxlm0vc2hjllqbsy929my1pmmbmb15ggj9m7gmxc59fbaf";
+      name = "plymouth-kcm-5.27.0.tar.xz";
     };
   };
   polkit-kde-agent = {
-    version = "1-5.26.5";
+    version = "1-5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/polkit-kde-agent-1-5.26.5.tar.xz";
-      sha256 = "19jrjx40m8g6hwq5k7ibbm0fmb803hxync2022gqbwzfrdb4493i";
-      name = "polkit-kde-agent-1-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/polkit-kde-agent-1-5.27.0.tar.xz";
+      sha256 = "0mihvr8w9rlqvsh2g19r3zrxp3shaiwlmjcx2w3lx4swiysnyps1";
+      name = "polkit-kde-agent-1-5.27.0.tar.xz";
     };
   };
   powerdevil = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/powerdevil-5.26.5.tar.xz";
-      sha256 = "063bqwdnpskcwqzpgcmjwgs9vpkn1gnq2nnzj2sdzrlflfrdsfvp";
-      name = "powerdevil-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/powerdevil-5.27.0.tar.xz";
+      sha256 = "0gdp2zsx761zkl4r4pj799x6q5jw0yzsljgx5p9cmrl4pvxb89rg";
+      name = "powerdevil-5.27.0.tar.xz";
     };
   };
   qqc2-breeze-style = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/qqc2-breeze-style-5.26.5.tar.xz";
-      sha256 = "1lhv4jlg15w8a88czq0fazaizjwva3yv8wv3scdnhhyfnbkch9mr";
-      name = "qqc2-breeze-style-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/qqc2-breeze-style-5.27.0.tar.xz";
+      sha256 = "14aw06dvpqjglm4y0230b3yy2fg3z427ff87f9xn8f96603c8447";
+      name = "qqc2-breeze-style-5.27.0.tar.xz";
     };
   };
   sddm-kcm = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/sddm-kcm-5.26.5.tar.xz";
-      sha256 = "0cglb7dvwrkdpl5bgg91yfxrvqfpc2szj3qipcmd6ladsvbz8cxv";
-      name = "sddm-kcm-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/sddm-kcm-5.27.0.tar.xz";
+      sha256 = "1kdb5jyv4lrx02bjyzyaakq4ip4z095sfcipgipgc0w2ayicf1np";
+      name = "sddm-kcm-5.27.0.tar.xz";
     };
   };
   systemsettings = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/systemsettings-5.26.5.tar.xz";
-      sha256 = "1jb1d6933gq07vgg3kzqna91cpcv87p38wrk70g17iz7pszjb3ns";
-      name = "systemsettings-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/systemsettings-5.27.0.tar.xz";
+      sha256 = "0smsv1kr9c5d7ypi74hvp3hrckk41p62ddhvjvlxw44qvykby597";
+      name = "systemsettings-5.27.0.tar.xz";
     };
   };
   xdg-desktop-portal-kde = {
-    version = "5.26.5";
+    version = "5.27.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.5/xdg-desktop-portal-kde-5.26.5.tar.xz";
-      sha256 = "1hznyl90d3xswnjs4qc6r5azw1z3pzkr7z507v696xhv41j8bzsj";
-      name = "xdg-desktop-portal-kde-5.26.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.0/xdg-desktop-portal-kde-5.27.0.tar.xz";
+      sha256 = "069fsw47v7p63m05rf2pxllxw7f4agclndvxccyrjyvsv12hrmbh";
+      name = "xdg-desktop-portal-kde-5.27.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/desktops/rox/rox-filer/default.nix b/pkgs/desktops/rox/rox-filer/default.nix
index e26c9059225..b05be287a89 100644
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
   buildInputs = [ libxml2 gtk shared-mime-info libSM ];
-  NIX_LDFLAGS = "-ldl -lm";
+  NIX_LDFLAGS = "-lm";
 
   patches = [
     ./rox-filer-2.11-in-source-build.patch
diff --git a/pkgs/development/beam-modules/fetch-mix-deps.nix b/pkgs/development/beam-modules/fetch-mix-deps.nix
index ac6d5f3c8b9..2bba3a93c29 100644
--- a/pkgs/development/beam-modules/fetch-mix-deps.nix
+++ b/pkgs/development/beam-modules/fetch-mix-deps.nix
@@ -45,7 +45,7 @@ stdenvNoCC.mkDerivation (attrs // {
 
   installPhase = attrs.installPhase or ''
     runHook preInstall
-    mix deps.get --only ${mixEnv}
+    mix deps.get ''${mixEnv:+--only $mixEnv}
     find "$TEMPDIR/deps" -path '*/.git/*' -a ! -name HEAD -exec rm -rf {} +
     cp -r --no-preserve=mode,ownership,timestamps $TEMPDIR/deps $out
     runHook postInstall
diff --git a/pkgs/development/compilers/dmd/generic.nix b/pkgs/development/compilers/dmd/generic.nix
index c1fb9abf77d..3f8871df4f9 100644
--- a/pkgs/development/compilers/dmd/generic.nix
+++ b/pkgs/development/compilers/dmd/generic.nix
@@ -151,13 +151,6 @@ stdenv.mkDerivation rec {
     git
   ];
 
-  # Workaround cc-wrapper's --sysroot= value for `staging-next`: it
-  # breaks library lookup via RUNPATH:
-  #   ld: warning: libm.so.6, needed by ./generated/linux/release/64/lib.so, not found (try using -rpath or -rpath-link)
-  #   ld: /build/druntime/generated/linux/release/64/libdruntime.so: undefined reference to `log10@GLIBC_2.2.5'
-  # TODO(trofi): remove the workaround once cc-wrapper is fixed.
-  NIX_CFLAGS_COMPILE = [ "--sysroot=/" ];
-
   buildInputs = [
     curl
     tzdata
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 97ed0ee9b05..4df0872688b 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -186,10 +186,10 @@ stdenv.mkDerivation ({
       --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
   ''
   + (
-    if targetPlatform != hostPlatform || stdenv.cc.libc != null then
+    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
-      let
+      (let
         libc = if libcCross != null then libcCross else stdenv.cc.libc;
       in
         (
@@ -207,8 +207,8 @@ stdenv.mkDerivation ({
         ''
             sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
-        )
-    else "")
+        ))
+      )
       + lib.optionalString targetPlatform.isAvr ''
             makeFlagsArray+=(
                '-s' # workaround for hitting hydra log limit
@@ -222,7 +222,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
     ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
@@ -235,7 +235,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index f29da83bb57..4b91e059830 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -82,7 +82,10 @@ let majorVersion = "11";
       ++ optional (stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      # openjdk build fails without this on -march=opteron; is upstream in gcc12
+      ++ [ ./gcc-issue-103910.patch ];
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@@ -192,10 +195,10 @@ stdenv.mkDerivation ({
       --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
   ''
   + (
-    if targetPlatform != hostPlatform || stdenv.cc.libc != null then
+    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
-      let
+      (let
         libc = if libcCross != null then libcCross else stdenv.cc.libc;
       in
         (
@@ -213,8 +216,8 @@ stdenv.mkDerivation ({
         ''
             sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
-        )
-    else "")
+        ))
+    )
       + lib.optionalString targetPlatform.isAvr ''
             makeFlagsArray+=(
                '-s' # workaround for hitting hydra log limit
@@ -228,7 +231,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
     ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
@@ -241,7 +244,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch b/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch
new file mode 100644
index 00000000000..c3edd960f09
--- /dev/null
+++ b/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch
@@ -0,0 +1,41 @@
+From d243f4009d8071b734df16cd70f4c5d09a373769 Mon Sep 17 00:00:00 2001
+From: Andrew Pinski <apinski@marvell.com>
+Date: Wed, 5 Jan 2022 22:00:07 +0000
+Subject: [PATCH] Fix target/103910: missing GTY on x86_mfence causing PCH
+ usage to ICE
+
+With -O3 -march=opteron, a mfence builtin is added after the loop
+to say the nontemporal stores are no longer needed. This all good
+without precompiled headers as the function decl that is referneced
+by x86_mfence is referenced in another variable but with precompiled
+headers, x86_mfence is all messed up and the decl was GC'ed away.
+This fixes the problem by marking x86_mfence as GTY to save/restore
+during precompiled headers just like most other variables in
+the header file.
+
+Committed as obvious after a bootstrap/test on x86_64-linux-gnu.
+
+gcc/ChangeLog:
+
+	PR target/103910
+	* config/i386/i386.h (x86_mfence): Mark with GTY.
+---
+ gcc/config/i386/i386.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gcc/config/i386/i386.h b/gcc/config/i386/i386.h
+index f027608eefa..3ac0f698ae2 100644
+--- a/gcc/config/i386/i386.h
++++ b/gcc/config/i386/i386.h
+@@ -486,7 +486,7 @@ extern unsigned char ix86_prefetch_sse;
+ 
+ /* Fence to use after loop using storent.  */
+ 
+-extern tree x86_mfence;
++extern GTY(()) tree x86_mfence;
+ #define FENCE_FOLLOWING_MOVNT x86_mfence
+ 
+ /* Once GDB has been enhanced to deal with functions without frame
+-- 
+2.31.1
+
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 3a8af389469..63168968cd6 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -226,10 +226,10 @@ stdenv.mkDerivation ({
       --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
   ''
   + (
-    if targetPlatform != hostPlatform || stdenv.cc.libc != null then
+    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
-      let
+      (let
         libc = if libcCross != null then libcCross else stdenv.cc.libc;
       in
         (
@@ -248,7 +248,7 @@ stdenv.mkDerivation ({
             sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
         )
-    else "")
+    ))
       + lib.optionalString targetPlatform.isAvr ''
             makeFlagsArray+=(
                '-s' # workaround for hitting hydra log limit
@@ -261,7 +261,7 @@ stdenv.mkDerivation ({
 
   inherit (callFile ../common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
@@ -275,7 +275,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index cee54a09217..7e6d4eb1223 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -246,7 +246,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index e1ae025cd27..4ea63d7c12e 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -266,7 +266,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index c3410a72fc7..7e5e2c6b10b 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -246,10 +246,10 @@ stdenv.mkDerivation ({
         --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
     ''
   + (
-    if targetPlatform != hostPlatform || stdenv.cc.libc != null then
+    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
-      let
+      (let
         libc = if libcCross != null then libcCross else stdenv.cc.libc;
       in
         (
@@ -267,8 +267,8 @@ stdenv.mkDerivation ({
         ''
             sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
-        )
-    else "");
+        ))
+    );
 
   inherit noSysDirs staticCompiler langJava crossStageStatic
     libcCross crossMingw;
@@ -276,7 +276,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -287,7 +287,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 4d8d1f51ff6..75366c5b04d 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -190,10 +190,10 @@ stdenv.mkDerivation ({
       --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
   ''
   + (
-    if targetPlatform != hostPlatform || stdenv.cc.libc != null then
+    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
-      let
+      (let
         libc = if libcCross != null then libcCross else stdenv.cc.libc;
       in
         (
@@ -211,8 +211,8 @@ stdenv.mkDerivation ({
         ''
             sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
-        )
-    else "")
+        ))
+    )
       + lib.optionalString targetPlatform.isAvr ''
         makeFlagsArray+=(
            'LIMITS_H_TEST=false'
@@ -226,7 +226,7 @@ stdenv.mkDerivation ({
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
   NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -240,7 +240,6 @@ stdenv.mkDerivation ({
   ;
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index e19d0888f00..e0b1a1e24ad 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -172,10 +172,10 @@ stdenv.mkDerivation ({
       --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
   ''
   + (
-    if targetPlatform != hostPlatform || stdenv.cc.libc != null then
+    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
-      let
+      (let
         libc = if libcCross != null then libcCross else stdenv.cc.libc;
       in
         (
@@ -193,8 +193,8 @@ stdenv.mkDerivation ({
         ''
             sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
-        )
-    else "")
+        ))
+    )
       + lib.optionalString targetPlatform.isAvr ''
             makeFlagsArray+=(
                'LIMITS_H_TEST=false'
@@ -207,7 +207,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -218,7 +218,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index ae26908a10a..bcfd1c7dd38 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -186,10 +186,10 @@ stdenv.mkDerivation ({
       --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
   ''
   + (
-    if targetPlatform != hostPlatform || stdenv.cc.libc != null then
+    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
-      let
+      (let
         libc = if libcCross != null then libcCross else stdenv.cc.libc;
       in
         (
@@ -207,8 +207,8 @@ stdenv.mkDerivation ({
         ''
             sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
-        )
-    else "")
+        ))
+    )
       + lib.optionalString targetPlatform.isAvr ''
           makeFlagsArray+=(
              'LIMITS_H_TEST=false'
@@ -221,7 +221,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -232,7 +232,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index dd5a8de76e2..2d7a058fa01 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -203,17 +203,6 @@ preInstall() {
         ln -s lib "$out/${targetConfig}/lib32"
         ln -s lib "${!outputLib}/${targetConfig}/lib32"
     fi
-
-    # cc-wrappers uses --sysroot=/nix/store/does/not/exist as a way to
-    # drop default sysheaders search path. Unfortunately that switches
-    # clang++ into searching libraries in gcc in cross-compiler paths:
-    #   from ${!outputLib}/lib (native)
-    #   to ${!outputLib}/${targetPlatformConfig}/lib
-    # We create the symlink to make both native and cross paths
-    # available even if the toolchain is not the cross-compiler.
-    if [ ! -e ${!outputLib}/${targetPlatformConfig} ] ; then
-        ln -s . ${!outputLib}/${targetPlatformConfig}
-    fi
 }
 
 
diff --git a/pkgs/development/compilers/gnu-cim/default.nix b/pkgs/development/compilers/gnu-cim/default.nix
new file mode 100644
index 00000000000..b1cb9f08597
--- /dev/null
+++ b/pkgs/development/compilers/gnu-cim/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnu-cim";
+  version = "5.1";
+
+  outputs = ["out" "lib" "man" "info"];
+
+  src = fetchurl {
+    url = "mirror://gnu/cim/cim-${version}.tar.gz";
+    hash = "sha256-uQcXtm7EAFA73WnlN+i38+ip0QbDupoIoErlc2mgaak=";
+  };
+
+  postPatch = ''
+    for fname in lib/{simulation,simset}.c; do
+      substituteInPlace "$fname" \
+        --replace \
+          '#include "../../lib/cim.h"' \
+          '#include "../lib/cim.h"'
+    done
+  '';
+
+  CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-return-type";
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "A GNU compiler for the programming language Simula";
+    longDescription = ''
+      GNU Cim is a compiler for the programming language Simula.
+      It offers a class concept, separate compilation with full type checking,
+      interface to external C routines, an application package for process
+      simulation and a coroutine concept. Commonly used with the Demos for
+      discrete event modelling.
+    '';
+    homepage = "https://www.gnu.org/software/cim/";
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    badPlatforms = [ "aarch64-darwin" ];
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 3c089f02920..a09d9b1f960 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , substituteAll
@@ -87,6 +88,12 @@ stdenv.mkDerivation rec {
     })
     ./remove-tools-1.11.patch
     ./go_no_vendor_checks-1.16.patch
+
+    # runtime: support riscv64 SV57 mode
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
+      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
+    })
   ];
 
   GOOS = stdenv.targetPlatform.parsed.kernel.name;
@@ -148,12 +155,12 @@ stdenv.mkDerivation rec {
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
     ''}
-  '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
+  '' else lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
     rm -rf bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
     ''}
-  '' else "");
+  '');
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 84a6059581e..c8c2e09d335 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , substituteAll
@@ -87,6 +88,12 @@ stdenv.mkDerivation rec {
     })
     ./remove-tools-1.11.patch
     ./go_no_vendor_checks-1.16.patch
+
+    # runtime: support riscv64 SV57 mode
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
+      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
+    })
   ];
 
   GOOS = stdenv.targetPlatform.parsed.kernel.name;
@@ -148,12 +155,12 @@ stdenv.mkDerivation rec {
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
     ''}
-  '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
+  '' else lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
     rm -rf bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
     ''}
-  '' else "");
+  '');
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index a8c441813f1..203081fb379 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -147,12 +147,12 @@ stdenv.mkDerivation rec {
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
     ''}
-  '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
+  '' else lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
     rm -rf bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
     ''}
-  '' else "");
+  '');
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
new file mode 100644
index 00000000000..f8a1e515db3
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@@ -0,0 +1,148 @@
+{ lib
+, stdenv
+, alsa-lib
+, autoPatchelfHook
+, cairo
+, cups
+, fontconfig
+, Foundation
+, glib
+, gtk3
+, gtkSupport ? stdenv.isLinux
+, makeWrapper
+, setJavaClassPath
+, unzip
+, xorg
+, zlib
+}:
+{ javaVersion
+, meta ? { }
+, products ? [ ]
+, ... } @ args:
+
+let
+  runtimeLibraryPath = lib.makeLibraryPath
+    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
+  mapProducts = key: default: (map (p: p.${key} or default) products);
+  concatProducts = key: lib.concatStringsSep "\n" (mapProducts key "");
+
+  graalvmXXX-ce = stdenv.mkDerivation (args // {
+    pname = "graalvm${javaVersion}-ce";
+
+    unpackPhase = ''
+      runHook preUnpack
+
+      mkdir -p "$out"
+
+      # The tarball on Linux has the following directory structure:
+      #
+      #   graalvm-ce-java11-20.3.0/*
+      #
+      # while on Darwin it looks like this:
+      #
+      #   graalvm-ce-java11-20.3.0/Contents/Home/*
+      #
+      # We therefor use --strip-components=1 vs 3 depending on the platform.
+      tar xf "$src" -C "$out" --strip-components=${
+        if stdenv.isLinux then "1" else "3"
+      }
+
+      # Sanity check
+      if [ ! -d "$out/bin" ]; then
+          echo "The `bin` is directory missing after extracting the graalvm"
+          echo "tarball, please compare the directory structure of the"
+          echo "tarball with what happens in the unpackPhase (in particular"
+          echo "with regards to the `--strip-components` flag)."
+          exit 1
+      fi
+
+      runHook postUnpack
+    '';
+
+    postUnpack = ''
+      for product in ${toString products}; do
+        cp -Rv $product/* $out
+      done
+    '';
+
+    dontStrip = true;
+
+    nativeBuildInputs = [ unzip makeWrapper ]
+      ++ lib.optional stdenv.isLinux autoPatchelfHook;
+
+    propagatedBuildInputs = [ setJavaClassPath zlib ]
+      ++ lib.optional stdenv.isDarwin Foundation;
+
+    buildInputs = lib.optionals stdenv.isLinux [
+      alsa-lib # libasound.so wanted by lib/libjsound.so
+      fontconfig
+      stdenv.cc.cc.lib # libstdc++.so.6
+      xorg.libX11
+      xorg.libXext
+      xorg.libXi
+      xorg.libXrender
+      xorg.libXtst
+    ];
+
+    preInstall = concatProducts "preInstall";
+    postInstall = ''
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -sf $out/include/linux/*_md.h $out/include/
+
+      # copy-paste openjdk's preFixup
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat > $out/nix-support/setup-hook << EOF
+        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '' + concatProducts "postInstall";
+
+    preFixup = lib.optionalString (stdenv.isLinux) ''
+      # Find all executables in any directory that contains '/bin/'
+      for bin in $(find "$out" -executable -type f -wholename '*/bin/*'); do
+        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+      done
+    '' + concatProducts "preFixup";
+    postFixup = concatProducts "postFixup";
+
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+
+      echo ${
+        lib.escapeShellArg ''
+          public class HelloWorld {
+            public static void main(String[] args) {
+              System.out.println("Hello World");
+            }
+          }
+        ''
+      } > HelloWorld.java
+      $out/bin/javac HelloWorld.java
+
+      # run on JVM with Graal Compiler
+      echo "Testing GraalVM"
+      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+
+      ${concatProducts "installCheckPhase"}
+
+      runHook postInstallCheck
+    '';
+
+    passthru = {
+      inherit products;
+      home = graalvmXXX-ce;
+      updateScript = ./update.sh;
+    };
+
+    meta = with lib; ({
+      inherit platforms;
+      homepage = "https://www.graalvm.org/";
+      description = "High-Performance Polyglot VM";
+      license = with licenses; [ upl gpl2Classpath bsd3 ];
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+      mainProgram = "java";
+      maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
+    } // meta);
+  });
+in graalvmXXX-ce
diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
new file mode 100644
index 00000000000..e4b55cc756b
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, autoPatchelfHook
+, makeWrapper
+, perl
+, unzip
+, zlib
+}:
+{ product
+, javaVersion
+, extraNativeBuildInputs ? [ ]
+, extraBuildInputs ? [ ]
+, meta ? { }
+, passthru ? { }
+, ... } @ args:
+
+stdenv.mkDerivation (args // {
+  pname = "${product}-java${javaVersion}";
+
+  nativeBuildInputs = [ perl unzip makeWrapper ]
+    ++ lib.optional stdenv.isLinux autoPatchelfHook
+    ++ extraNativeBuildInputs;
+
+  buildInputs = [
+    stdenv.cc.cc.lib # libstdc++.so.6
+    zlib
+  ] ++ extraBuildInputs;
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    unpack_jar() {
+      local jar="$1"
+      unzip -q -o "$jar" -d "$out"
+      perl -ne 'use File::Path qw(make_path);
+                use File::Basename qw(dirname);
+                if (/^(.+) = (.+)$/) {
+                  make_path dirname("$ENV{out}/$1");
+                  symlink $2, "$ENV{out}/$1";
+                }' "$out/META-INF/symlinks"
+      perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
+                  my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
+                              ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
+                              ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
+                  chmod $mode, "$ENV{out}/$1";
+                }' "$out/META-INF/permissions"
+      rm -rf "$out/META-INF"
+    }
+
+    unpack_jar "$src"
+
+    runHook postUnpack
+  '';
+
+  dontInstall = true;
+  dontBuild = true;
+  dontStrip = true;
+  # installCheckPhase is going to run in GraalVM main derivation (see buildGraalvm.nix)
+  # to make sure that it has everything it needs to run correctly.
+  # Other hooks like fixupPhase/installPhase are also going to run there for the
+  # same reason.
+  doInstallCheck = false;
+
+  passthru = { inherit product; } // passthru;
+
+  meta = with lib; ({
+    homepage = "https://www.graalvm.org/";
+    description = "High-Performance Polyglot VM (Product: ${product})";
+    license = with licenses; [ upl gpl2Classpath bsd3 ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
+  } // meta);
+})
diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index 17ecd5060ba..0f9cec44f18 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -1,75 +1,52 @@
-{ callPackage, Foundation }:
-/*
-  Add new graal versions and products here and then see update.nix on how to
-  generate the sources.
-*/
+{ lib
+, stdenv
+, callPackage
+, fetchurl
+, Foundation
+}:
 
 let
-  mkGraal = opts: callPackage (import ./mkGraal.nix opts) {
-    inherit Foundation;
+  buildGraalvm = callPackage ./buildGraalvm.nix { inherit Foundation; };
+  buildGraalvmProduct = callPackage ./buildGraalvmProduct.nix { };
+  javaPlatform = {
+    "aarch64-linux" = "linux-aarch64";
+    "x86_64-linux" = "linux-amd64";
+    "aarch64-darwin" = "darwin-aarch64";
+    "x86_64-darwin" = "darwin-amd64";
   };
-
-  /*
-    Looks a bit ugly but makes version update in the update script using sed
-    much easier
-
-    Don't change these values! They will be updated by the update script, see ./update.nix.
-  */
-  graalvm11-ce-release-version = "22.3.0";
-  graalvm17-ce-release-version = "22.3.0";
-
-  products = [
-    "graalvm-ce"
-    "native-image-installable-svm"
-  ];
+  javaPlatformVersion = javaVersion:
+    "${javaVersion}-${javaPlatform.${stdenv.system} or (throw "Unsupported platform: ${stdenv.system}")}";
+  source = product: javaVersion: (import ./hashes.nix).${product}.${javaPlatformVersion javaVersion};
 
 in
-{
-  inherit mkGraal;
+rec {
+  inherit buildGraalvm buildGraalvmProduct;
 
-  graalvm11-ce = mkGraal rec {
-    config = {
-      x86_64-darwin = {
-        inherit products;
-        arch = "darwin-amd64";
-      };
-      x86_64-linux = {
-        inherit products;
-        arch = "linux-amd64";
-      };
-      aarch64-darwin = {
-        inherit products;
-        arch = "darwin-aarch64";
-      };
-      aarch64-linux = {
-        inherit products;
-        arch = "linux-aarch64";
-      };
-    };
-    defaultVersion = graalvm11-ce-release-version;
+  graalvm11-ce = buildGraalvm rec {
+    version = "22.3.1";
     javaVersion = "11";
+    src = fetchurl (source "graalvm-ce" javaVersion);
+    meta.platforms = builtins.attrNames javaPlatform;
+    products = [ native-image-installable-svm-java11 ];
+  };
+
+  native-image-installable-svm-java11 = callPackage ./native-image-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "native-image-installable-svm" javaVersion);
+  };
+
+  graalvm17-ce = buildGraalvm rec {
+    version = "22.3.1";
+    javaVersion = "17";
+    src = fetchurl (source "graalvm-ce" javaVersion);
+    meta.platforms = builtins.attrNames javaPlatform;
+    products = [ native-image-installable-svm-java17 ];
   };
 
-  graalvm17-ce = mkGraal rec {
-    config = {
-      x86_64-darwin = {
-        inherit products;
-        arch = "darwin-amd64";
-      };
-      x86_64-linux = {
-        inherit products;
-        arch = "linux-amd64";
-      };
-      aarch64-darwin = {
-        inherit products;
-        arch = "darwin-aarch64";
-      };
-      aarch64-linux = {
-        inherit products;
-        arch = "linux-aarch64";
-      };
-    };
-    defaultVersion = graalvm17-ce-release-version;
+  native-image-installable-svm-java17 = callPackage ./native-image-installable-svm.nix rec {
     javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "native-image-installable-svm" javaVersion);
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
deleted file mode 100644
index c9145e9654f..00000000000
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "darwin-aarch64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "c9657e902c2ba674931c3cf233a38c4de3d5186ae5d70452f9df75ac0c4cacff",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-darwin-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "dd9f91a970c7270b3f7fe8e711ba1ae081d34ed433c75f2bb0459aaf19e0fbe7",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-darwin-aarch64-22.3.0.jar"
-    }
-  },
-  "darwin-amd64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "b8b39d6a3e3a9ed6348c2776ff071fc64ca90f98999ee846e6ca7e5fdc746a8b",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-darwin-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "00fe13c42813f581955eb35370bb8409ba17c7fdc83971d000baf695be2a0cb5",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-darwin-amd64-22.3.0.jar"
-    }
-  },
-  "linux-aarch64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "c6646149dad486a0b02c5fc10649786240f275efda65aa14a25d01d2f5bafe15",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-linux-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "0886e214f03f8a44962ecab459a94afb5c6a0f20910cb128d9ff775f4a9e4162",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-linux-aarch64-22.3.0.jar"
-    }
-  },
-  "linux-amd64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "d4200bcc43e5ad4e6949c1b1edc1e59f63066e3a2280d5bd82d0c9b1d67c3f2c",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-linux-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "17843f92dc9de74b161a63c52cc2a4597e5472cf3f6f6d71930fb655b35f9208",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-linux-amd64-22.3.0.jar"
-    }
-  }
-}
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
deleted file mode 100644
index dc2da450b69..00000000000
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "darwin-aarch64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "dfc0c8998b8d00fcca87ef1c866c6e4985fd20b0beba3021f9677f9b166dfaf8",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-darwin-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "b6e44cb03f560bb43db1fd0aa862af36ba1df6717765920d91c18519712adfe9",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-darwin-aarch64-22.3.0.jar"
-    }
-  },
-  "darwin-amd64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "422cd6abecfb8b40238460c09c42c5a018cb92fab4165de9691be2e3c3d0e8d1",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-darwin-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "9ce13874e62877d3bbe3faa4a57fbbffc766fdc8191971e7b25de0226fe86598",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-darwin-amd64-22.3.0.jar"
-    }
-  },
-  "linux-aarch64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "e27249d9eef4504deb005cf14c6a028aad1adfa37209e12e9d7407710c08ed90",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-linux-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "d5b833c44d37fbe4df75906f73144e2db01e683bca3386fe185f4abbc8fbc798",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-linux-aarch64-22.3.0.jar"
-    }
-  },
-  "linux-amd64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "3473d8b3b1bc682e95adfb3ac1d9a59b51b0f43e2b752f2a5b550e4ebfa2fd17",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-linux-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "d1f5c58b65c57ad8a0c7da0c4569ce815ebf1ae503b0741ba1facf27b816d398",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-linux-amd64-22.3.0.jar"
-    }
-  }
-}
diff --git a/pkgs/development/compilers/graalvm/community-edition/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
new file mode 100644
index 00000000000..c0353e033ae
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@@ -0,0 +1,71 @@
+# Generated by pkgs/development/compilers/graalvm/community-edition/update.sh script
+{
+  "native-image-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "0z9rbmci6yz7f7mqd3xzsxc5ih4hq72lyzqfchan7fr6mh38d6gw";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "03v20fc9famlnbrznpasnd5gdl5k9nl4dlj3pp6bad4y6l7rqnx5";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "1yb7kpbs7hrzlysvrqjzgfz678p1hbg6237jzb35zmwdaczav51n";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "00fbyqsj4xj9ay8bki1190lf59bgrzvla8lzzq51p53a1bdrhhmv";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "1kaqvkbhj3iifq6asyrpy225a89y7klzbh7an1ycnvc2hvqkv4nz";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "09l7x4x8yanq55v6y6wpfx94mvsq1bpbnihknjc6dnq3vcrci77n";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "036w9dmdcs46kmjqr3086mg389fgr3h1zysavfq8cbh199x0ibia";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "1hvjfvcn878bzvi944v3x23sby72hbfvg5s3zzspyc37l5cdpqi3";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "graalvm-ce" = {
+    "11-linux-aarch64" = {
+      sha256 = "1g4a3z9993pq52j3jf25pbcq9rvl8jz1yar8c859jw5chaf3ysml";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-linux-aarch64-22.3.1.tar.gz";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "06288dwbql943nii74i9mngzb38h2nzrxzzgs346mgk2965gwm59";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-linux-aarch64-22.3.1.tar.gz";
+    };
+    "11-linux-amd64" = {
+      sha256 = "1f6xkdnxn6xsm24sqw24rsca72wm7v6q96m23l5fng5ym0jpfm2m";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-linux-amd64-22.3.1.tar.gz";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0aci9i28rq5nk2qya9dcg5hxr3sgsbv7f5x8679hrjrqmrclmkrs";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-linux-amd64-22.3.1.tar.gz";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "0cbcm9d211m4b6g1bkpfksma917lzqkl4kx38vm1nrwjkll357y5";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-darwin-aarch64-22.3.1.tar.gz";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "1qbw3hlmqcrmd70xk56463scdxr50n66z2n3c24h68qlwwlpqc73";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-darwin-aarch64-22.3.1.tar.gz";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "0a12rzf99x5l29f6bwm6myk18dgnrx2c9rwmii2pm864y7azlnij";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-darwin-amd64-22.3.1.tar.gz";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "02lclv2j3v850izh84wdvksi3d3xmgpfl7x85vzifhgsvagm6sz4";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-darwin-amd64-22.3.1.tar.gz";
+    };
+  };
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
deleted file mode 100644
index 023fc81474e..00000000000
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ /dev/null
@@ -1,346 +0,0 @@
-{
-  # An attrset describing each platform configuration. All values are extract
-  # from the GraalVM releases available on
-  # https://github.com/graalvm/graalvm-ce-builds/releases
-  # Example:
-  # config = {
-  #   x86_64-linux = {
-  #     # List of products that will be included in the GraalVM derivation
-  #     # See `with{NativeImage,Ruby,Python,WASM,*}Svm` variables for the
-  #     # available values
-  #     products = [ "graalvm-ce" "native-image-installable-svm" ];
-  #     # GraalVM arch, not to be confused with the nix platform
-  #     arch = "linux-amd64";
-  #     # GraalVM version
-  #     version = "22.0.0.2";
-  #   };
-  # }
-  config
-  # GraalVM version that will be used unless overridden by `config.<platform>.version`
-, defaultVersion
-  # Java version used by GraalVM
-, javaVersion
-  # Platforms were GraalVM will be allowed to build (i.e. `meta.platforms`)
-, platforms ? builtins.attrNames config
-  # If set to true, update script will (re-)generate the sources file even if
-  # there are no updates available
-, forceUpdate ? false
-  # Path for the sources file that will be used
-  # See `update.nix` file for a description on how this file works
-, sourcesPath ? ./. + "/graalvm${javaVersion}-ce-sources.json"
-}:
-
-{ stdenv
-, lib
-, autoPatchelfHook
-, fetchurl
-, makeWrapper
-, setJavaClassPath
-, writeShellScriptBin
-  # minimum dependencies
-, alsa-lib
-, fontconfig
-, Foundation
-, freetype
-, glibc
-, openssl
-, perl
-, unzip
-, xorg
-, zlib
-  # runtime dependencies
-, binutils
-, cups
-, gcc
-, musl
-  # runtime dependencies for GTK+ Look and Feel
-, gtkSupport ? stdenv.isLinux
-, cairo
-, glib
-  # updateScript deps
-, gnused
-, gtk3
-, jq
-, writeShellScript
-  # Use musl instead of glibc to allow true static builds in GraalVM's
-  # Native Image (i.e.: `--static --libc=musl`). This will cause glibc static
-  # builds to fail, so it should be used with care
-, useMusl ? false
-  # Extra libraries to be included in native-image using '-H:CLibraryPath' flag
-, extraCLibs ? [ ]
-}:
-
-assert useMusl -> stdenv.isLinux;
-
-let
-  platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  version = platform.version or defaultVersion;
-  name = "graalvm${javaVersion}-ce";
-  sources = builtins.fromJSON (builtins.readFile sourcesPath);
-
-  cLibs = [ glibc zlib.static ]
-    ++ lib.optionals (!useMusl) [ glibc.static ]
-    ++ lib.optionals useMusl [ musl ]
-    ++ extraCLibs;
-
-  runtimeLibraryPath = lib.makeLibraryPath
-    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
-
-  runtimeDependencies = lib.makeBinPath ([
-    binutils
-    stdenv.cc
-  ] ++ lib.optionals useMusl [
-    (lib.getDev musl)
-    # GraalVM 21.3.0+ expects musl-gcc as <system>-musl-gcc
-    (writeShellScriptBin "${stdenv.hostPlatform.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'')
-  ]);
-
-  withNativeImageSvm = builtins.elem "native-image-installable-svm" platform.products;
-  withRubySvm = builtins.elem "ruby-installable-svm" platform.products;
-  withPythonSvm = builtins.elem "python-installable-svm" platform.products;
-  withWasmSvm = builtins.elem "wasm-installable-svm" platform.products;
-
-  graalvmXXX-ce = stdenv.mkDerivation rec {
-    inherit version;
-    pname = name;
-
-    srcs = map fetchurl (builtins.attrValues sources.${platform.arch});
-
-    buildInputs = lib.optionals stdenv.isLinux [
-      alsa-lib # libasound.so wanted by lib/libjsound.so
-      fontconfig
-      freetype
-      stdenv.cc.cc.lib # libstdc++.so.6
-      xorg.libX11
-      xorg.libXext
-      xorg.libXi
-      xorg.libXrender
-      xorg.libXtst
-      zlib
-    ] ++ lib.optionals withRubySvm [
-      openssl # libssl.so wanted by languages/ruby/lib/mri/openssl.so
-    ];
-
-    nativeBuildInputs = [ unzip perl makeWrapper ]
-      ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
-
-    unpackPhase = ''
-      runHook preUnpack
-
-      unpack_jar() {
-        jar=$1
-        unzip -q -o $jar -d $out
-        perl -ne 'use File::Path qw(make_path);
-                  use File::Basename qw(dirname);
-                  if (/^(.+) = (.+)$/) {
-                    make_path dirname("$ENV{out}/$1");
-                    system "ln -s $2 $ENV{out}/$1";
-                  }' $out/META-INF/symlinks
-        perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
-                    my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
-                               ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
-                               ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
-                    chmod $mode, "$ENV{out}/$1";
-                  }' $out/META-INF/permissions
-        rm -rf $out/META-INF
-      }
-
-      mkdir -p $out
-      arr=($srcs)
-
-      # The tarball on Linux has the following directory structure:
-      #
-      #   graalvm-ce-java11-20.3.0/*
-      #
-      # while on Darwin it looks like this:
-      #
-      #   graalvm-ce-java11-20.3.0/Contents/Home/*
-      #
-      # We therefor use --strip-components=1 vs 3 depending on the platform.
-      tar xf ''${arr[0]} -C $out --strip-components=${
-        if stdenv.isLinux then "1" else "3"
-      }
-
-      # Sanity check
-      if [ ! -d $out/bin ]; then
-         echo "The `bin` is directory missing after extracting the graalvm"
-         echo "tarball, please compare the directory structure of the"
-         echo "tarball with what happens in the unpackPhase (in particular"
-         echo "with regards to the `--strip-components` flag)."
-         exit 1
-      fi
-
-      for jar in "''${arr[@]:1}"; do
-        unpack_jar "$jar"
-      done
-
-      runHook postUnpack
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/linux/*_md.h $out/include/
-
-      # copy-paste openjdk's preFixup
-      # Set JAVA_HOME automatically.
-      mkdir -p $out/nix-support
-      cat > $out/nix-support/setup-hook << EOF
-        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-      ${
-        # Wrap native-image binary to pass -H:CLibraryPath flag and find glibc
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux) ''
-          wrapProgram $out/bin/native-image \
-            ${lib.concatStringsSep " "
-              (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
-        ''
-      }
-
-      runHook postInstall
-    '';
-
-    dontStrip = true;
-
-    # Workaround for libssl.so.10 wanted by TruffleRuby
-    # Resulting TruffleRuby cannot use `openssl` library.
-    autoPatchelfIgnoreMissingDeps = withRubySvm && stdenv.isDarwin;
-
-    preFixup = lib.optionalString (stdenv.isLinux) ''
-      # Find all executables in any directory that contains '/bin/'
-      for bin in $(find "$out" -executable -type f -wholename '*/bin/*'); do
-        wrapProgram "$bin" \
-          --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}" \
-          --prefix PATH : "${runtimeDependencies}"
-      done
-
-      find "$out" -name libfontmanager.so -exec \
-        patchelf --add-needed libfontconfig.so {} \;
-
-      ${
-        lib.optionalString withRubySvm ''
-          # Workaround for libssl.so.10/libcrypto.so.10 wanted by TruffleRuby
-          patchelf $out/languages/ruby/lib/mri/openssl.so \
-            --replace-needed libssl.so.10 libssl.so \
-            --replace-needed libcrypto.so.10 libcrypto.so
-        ''
-      }
-    '';
-
-    # $out/bin/native-image needs zlib to build native executables.
-    propagatedBuildInputs = [ setJavaClassPath zlib ] ++
-      # On Darwin native-image calls clang and it
-      # tries to include <Foundation/Foundation.h>,
-      # and Interactive Ruby (irb) requires OpenSSL
-      # headers.
-      lib.optionals stdenv.hostPlatform.isDarwin [ Foundation openssl ];
-
-    doInstallCheck = true;
-    installCheckPhase = ''
-      runHook preInstallCheck
-
-      echo ${
-        lib.escapeShellArg ''
-          public class HelloWorld {
-            public static void main(String[] args) {
-              System.out.println("Hello World");
-            }
-          }
-        ''
-      } > HelloWorld.java
-      $out/bin/javac HelloWorld.java
-
-      # run on JVM with Graal Compiler
-      echo "Testing GraalVM"
-      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
-
-      ${
-        lib.optionalString withNativeImageSvm ''
-          echo "Ahead-Of-Time compilation"
-          $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${# --static flag doesn't work for darwin
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux && !useMusl) ''
-          echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
-          $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
-          ./helloworld | fgrep 'Hello World'
-
-          echo "Ahead-Of-Time compilation with --static"
-          $out/bin/native-image --static HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${# --static flag doesn't work for darwin
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux && useMusl) ''
-          echo "Ahead-Of-Time compilation with --static and --libc=musl"
-          $out/bin/native-image --libc=musl --static HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${
-        lib.optionalString withWasmSvm ''
-          echo "Testing Jshell"
-          echo '1 + 1' | $out/bin/jshell
-        ''
-      }
-
-      ${
-        lib.optionalString withPythonSvm ''
-          echo "Testing GraalPython"
-          $out/bin/graalpython -c 'print(1 + 1)'
-          echo '1 + 1' | $out/bin/graalpython
-        ''
-      }
-
-      ${
-        lib.optionalString withRubySvm ''
-          echo "Testing TruffleRuby"
-          # Hide warnings about wrong locale
-          export LANG=C
-          export LC_ALL=C
-          $out/bin/ruby -e 'puts(1 + 1)'
-        ''
-        # FIXME: irb is broken in all platforms
-        + lib.optionalString false ''
-          echo '1 + 1' | $out/bin/irb
-        ''
-      }
-
-      runHook postInstallCheck
-    '';
-
-    passthru = {
-      inherit (platform) products;
-      home = graalvmXXX-ce;
-      updateScript = import ./update.nix {
-        inherit config defaultVersion forceUpdate gnused jq lib name sourcesPath writeShellScript;
-        graalVersion = version;
-        javaVersion = "java${javaVersion}";
-      };
-    };
-
-    meta = with lib; {
-      inherit platforms;
-      homepage = "https://www.graalvm.org/";
-      description = "High-Performance Polyglot VM";
-      license = with licenses; [ upl gpl2Classpath bsd3 ];
-      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-      mainProgram = "java";
-      maintainers = with maintainers; [
-        bandresen
-        hlolli
-        glittershark
-        babariviere
-        ericdallo
-        thiagokokada
-      ];
-    };
-  };
-in
-graalvmXXX-ce
diff --git a/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix b/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
new file mode 100644
index 00000000000..393a226df19
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, gcc
+, glibc
+, javaVersion
+, musl
+, src
+, version
+, writeShellScriptBin
+, zlib
+, useMusl ? false
+, extraCLibs ? [ ]
+}:
+
+assert useMusl -> stdenv.isLinux;
+let
+  cLibs = [ glibc zlib.static ]
+    ++ lib.optionals (!useMusl) [ glibc.static ]
+    ++ lib.optionals useMusl [ musl ]
+    ++ extraCLibs;
+  # GraalVM 21.3.0+ expects musl-gcc as <system>-musl-gcc
+  musl-gcc = (writeShellScriptBin "${stdenv.hostPlatform.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'');
+  binPath = lib.makeBinPath ([ gcc ] ++ lib.optionals useMusl [ musl-gcc ]);
+in
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "native-image-installable-svm";
+
+  postInstall = lib.optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/native-image \
+      --prefix PATH : ${binPath} \
+      ${lib.concatStringsSep " "
+        (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
+  '';
+
+  installCheckPhase = ''
+    echo "Ahead-Of-Time compilation"
+    $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
+    ./helloworld | fgrep 'Hello World'
+
+    ${lib.optionalString (stdenv.isLinux && !useMusl) ''
+      echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
+      $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
+      ./helloworld | fgrep 'Hello World'
+
+      echo "Ahead-Of-Time compilation with --static"
+      $out/bin/native-image --static HelloWorld
+      ./helloworld | fgrep 'Hello World'
+    ''}
+
+    ${lib.optionalString (stdenv.isLinux && useMusl) ''
+      echo "Ahead-Of-Time compilation with --static and --libc=musl"
+      $out/bin/native-image --static HelloWorld --libc=musl
+      ./helloworld | fgrep 'Hello World'
+    ''}
+  '';
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.nix b/pkgs/development/compilers/graalvm/community-edition/update.nix
deleted file mode 100644
index 8bb31c792dd..00000000000
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ /dev/null
@@ -1,227 +0,0 @@
-{ config
-, defaultVersion
-, forceUpdate
-, gnused
-, graalVersion
-, javaVersion
-, jq
-, lib
-, name
-, sourcesPath
-, writeShellScript
-}:
-
-/*
-  How to  use:
-  run `nix-shell maintainers/scripts/update.nix --argstr package graalvmXX-ce`
-  to update the graalvmXX-ce-sources.json file.
-  E.g: nix-shell maintainers/scripts/update.nix --argstr package graalvm17-ce
-
-  Basic idea:
-  If we know the platform, product, javaVersion and graalVersion
-  we can create the url. This leads to the following json structure:
-  {
-  "platform/arch1": {
-  "product1|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
-  "product2|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
-  ...
-  },
-  "platform/arch2": {
-  ...
-  }
-  }
-*/
-
-let
-  separator = "|";
-
-  # isDev :: String -> Boolean
-  isDev = version:
-    lib.hasInfix "dev" version;
-
-  # getLatestVersion :: String -> String
-  getLatestVersion = currentVersion:
-    let
-      dev = if isDev currentVersion then "dev-" else "";
-      url = "https://api.github.com/repos/graalvm/graalvm-ce-${dev}builds/releases/latest";
-      file = builtins.fetchurl url;
-      json = builtins.fromJSON (builtins.readFile file);
-    in
-    lib.removePrefix "vm-" json.tag_name;
-
-  # getArchString :: String -> String
-  getArchString = nixArchString:
-    {
-      "aarch64-linux" = "linux-aarch64";
-      "aarch64-darwin" = "darwin-aarch64";
-      "x86_64-linux" = "linux-amd64";
-      "x86_64-darwin" = "darwin-amd64";
-    }.${nixArchString};
-
-
-  # getProductSuffix :: String -> String
-  getProductSuffix = productName:
-    {
-      "graalvm-ce" = ".tar.gz";
-      "native-image-installable-svm" = ".jar";
-      "ruby-installable-svm" = ".jar";
-      "wasm-installable-svm" = ".jar";
-      "python-installable-svm" = ".jar";
-      "js-installable-svm" = ".jar";
-    }.${productName};
-
-  # getProductSuffix :: String -> String
-  getProductBaseUrl = productName:
-    {
-      "graalvm-ce" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "native-image-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "ruby-installable-svm" = "https://github.com/oracle/truffleruby/releases/download";
-      "wasm-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "python-installable-svm" = "https://github.com/graalvm/graalpython/releases/download";
-      "js-installable-svm" = "https://github.com/oracle/graaljs/releases/download";
-    }.${productName};
-
-  # getDevUrl :: String
-  getDevUrl = { arch, graalVersion, product, javaVersion }:
-    let
-      baseUrl = https://github.com/graalvm/graalvm-ce-dev-builds/releases/download;
-    in
-    "${baseUrl}/${graalVersion}/${product}-${javaVersion}-${arch}-dev${getProductSuffix product}";
-
-  # getReleaseUrl :: AttrSet -> String
-  getReleaseUrl = { arch, graalVersion, product, javaVersion }:
-    let baseUrl = getProductBaseUrl product;
-    in
-    "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
-
-  # getUrl :: AttrSet -> String
-  getUrl = args@{ arch, graalVersion, product, javaVersion }:
-    if isDev graalVersion
-    then getDevUrl args
-    else getReleaseUrl args;
-
-  # computeSha256 :: String -> String
-  computeSha256 = url:
-    builtins.hashFile "sha256" (builtins.fetchurl url);
-
-  # downloadSha256 :: String -> String
-  downloadSha256 = url:
-    let sha256Url = url + ".sha256";
-    in
-    builtins.readFile (builtins.fetchurl sha256Url);
-
-  # getSha256 :: String -> String -> String
-  getSha256 = graalVersion: url:
-    if isDev graalVersion
-    then computeSha256 url
-    else downloadSha256 url;
-
-  # cartesianZipListsWith :: (a -> b -> c) -> [a] -> [b] -> [c]
-  cartesianZipListsWith = f: fst: snd:
-    let
-      cartesianProduct = lib.cartesianProductOfSets { a = fst; b = snd; };
-      fst' = builtins.catAttrs "a" cartesianProduct;
-      snd' = builtins.catAttrs "b" cartesianProduct;
-    in
-    lib.zipListsWith f fst' snd';
-
-  # zipListsToAttrs :: [a] -> [b] -> AttrSet
-  zipListsToAttrs = names: values:
-    lib.listToAttrs (
-      lib.zipListsWith (name: value: { inherit name value; }) names values
-    );
-
-  # genProductJavaVersionGraalVersionAttrSet :: String -> AttrSet
-  genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
-    let
-      attrNames = [ "product" "javaVersion" "graalVersion" ];
-      attrValues = lib.splitString separator product_javaVersion_graalVersion;
-    in
-    zipListsToAttrs attrNames attrValues;
-
-  # genUrlAndSha256 :: String -> String -> AttrSet
-  genUrlAndSha256 = arch: product_javaVersion_graalVersion:
-    let
-      productJavaVersionGraalVersion =
-        (genProductJavaVersionGraalVersionAttrSet product_javaVersion_graalVersion)
-        // { inherit arch; };
-      url = getUrl productJavaVersionGraalVersion;
-      sha256 = getSha256 productJavaVersionGraalVersion.graalVersion url;
-    in
-    {
-      ${arch} = {
-        ${product_javaVersion_graalVersion} = {
-          inherit sha256 url;
-        };
-      };
-    };
-
-  # genArchProductVersionPairs :: String -> -> String -> AttrSet -> [AttrSet]
-  genArchProductVersionList = javaVersion: graalVersion: archProducts:
-    let
-      arch = archProducts.arch;
-      products = archProducts.products;
-      javaGraalVersion = javaVersion + separator + (getLatestVersion (archProducts.version or graalVersion));
-      productJavaGraalVersionList =
-        cartesianZipListsWith (a: b: a + separator + b)
-          products [ javaGraalVersion ];
-    in
-    cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
-
-
-  # genSources :: String -> String -> AttrSet -> Path String
-  genSources = javaVersion: defaultVersion: config:
-    let
-      archProducts = builtins.attrValues config;
-      sourcesList = builtins.concatMap (genArchProductVersionList javaVersion defaultVersion) archProducts;
-      sourcesAttr = builtins.foldl' (lib.recursiveUpdate) { } sourcesList;
-    in
-    builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
-
-  # isNew :: String -> String -> Boolean
-  isNew = newVersion: currentVersion:
-    {
-      "-1" = false;
-      "0" = false;
-      "1" = true;
-    }.${builtins.toString (builtins.compareVersions newVersion currentVersion)};
-
-  newVersion = getLatestVersion graalVersion;
-  sourcesJson = genSources javaVersion defaultVersion config;
-  sourcesJsonPath = lib.strings.escapeShellArg sourcesPath;
-
-  # versionKeyInDefaultNix String -> String
-  versionKeyInDefaultNix = graalVersion:
-    if isDev graalVersion
-    then "${name}-dev-version"
-    else "${name}-release-version";
-
-  /*
-    updateScriptText :: String -> String -> String
-    Writes the json file and updates the version in default.nix using sed
-    because update-source-version does not work srcs.
-  */
-  updateScriptText = newVersion: currentVersion:
-
-    if (forceUpdate || (isNew newVersion currentVersion))
-    then
-      let
-        versionKey = versionKeyInDefaultNix currentVersion;
-      in
-      ''
-        echo "New version found. Updating ${currentVersion} -> ${newVersion}".
-        export PATH="${lib.makeBinPath [ jq gnused ]}:$PATH"
-        jq . ${sourcesJson} > ${sourcesJsonPath}
-        sed -i 's|${versionKey} = "${currentVersion}";|${versionKey} = "${newVersion}";|' \
-          ${lib.strings.escapeShellArg ./default.nix}
-      ''
-    else ''echo "No new version found. Skip updating."'';
-
-in
-writeShellScript "update-graal.sh" ''
-  set -o errexit
-  set -o nounset
-  set -o pipefail
-
-  ${updateScriptText newVersion graalVersion}
-''
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.sh b/pkgs/development/compilers/graalvm/community-edition/update.sh
new file mode 100755
index 00000000000..476bd754ad5
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p coreutils curl.out nix jq gnused -i bash
+
+set -eou pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+tmpfile="$(mktemp --suffix=.nix)"
+
+info() { echo "[INFO] $*"; }
+
+echo_file() { echo "$@" >> "$tmpfile"; }
+
+verlte() {
+    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
+}
+
+readonly nixpkgs=../../../../..
+
+readonly current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm-ce.version | tr -d \")"
+
+if [[ -z "${1:-}" ]]; then
+  readonly gh_version="$(curl \
+      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | \
+      jq --raw-output .tag_name)"
+  readonly new_version="${gh_version//vm-/}"
+else
+  readonly new_version="$1"
+fi
+
+info "Current version: $current_version"
+info "New version: $new_version"
+if verlte "$new_version" "$current_version"; then
+  info "graalvm-ce $current_version is up-to-date."
+  [[ -z "${FORCE:-}" ]]  && exit 0
+else
+  info "graalvm-ce $current_version is out-of-date. Updating..."
+fi
+
+declare -r -A products_urls=(
+  [graalvm-ce]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/graalvm-ce-java@platform@-${new_version}.tar.gz"
+  [native-image-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/native-image-installable-svm-java@platform@-${new_version}.jar"
+  # [ruby-installable-svm]="https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
+  # [wasm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
+  # [python-installable-svm]="https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
+)
+
+readonly platforms=(
+  "11-linux-aarch64"
+  "17-linux-aarch64"
+  "11-linux-amd64"
+  "17-linux-amd64"
+  "11-darwin-aarch64"
+  "17-darwin-aarch64"
+  "11-darwin-amd64"
+  "17-darwin-amd64"
+)
+
+info "Generating hashes.nix file for 'graalvm-ce' $new_version. This will take a while..."
+
+# Indentation of `echo_file` function is on purpose to make it easier to visualize the output
+echo_file "# Generated by $0 script"
+echo_file "{"
+for product in "${!products_urls[@]}"; do
+  url="${products_urls["${product}"]}"
+echo_file "  \"$product\" = {"
+  for platform in "${platforms[@]}"; do
+    if hash="$(nix-prefetch-url "${url//@platform@/$platform}")"; then
+echo_file "    \"$platform\" = {"
+echo_file "      sha256 = \"$hash\";"
+echo_file "      url = \"${url//@platform@/${platform}}\";"
+echo_file "    };"
+    fi
+  done
+echo_file "  };"
+done
+echo_file "}"
+
+info "Updating graalvm-ce version..."
+# update-source-version does not work here since it expects src attribute
+sed "s|$current_version|$new_version|" -i default.nix
+
+info "Moving the temporary file to hashes.nix"
+mv "$tmpfile" hashes.nix
+
+info "Done!"
diff --git a/pkgs/development/compilers/jetbrains-jdk/default.nix b/pkgs/development/compilers/jetbrains-jdk/default.nix
index 5702ba2a2e6..143feeb98e1 100644
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@@ -79,8 +79,8 @@ openjdk17.overrideAttrs (oldAttrs: rec {
 
   installPhase = let
     buildType = if debugBuild then "fastdebug" else "release";
-    debugSuffix = if debugBuild then "-fastdebug" else "";
-    jcefSuffix = if debugBuild then "" else "_jcef";
+    debugSuffix = lib.optionalString debugBuild "-fastdebug";
+    jcefSuffix = lib.optionalString (!debugBuild) "_jcef";
   in ''
     runHook preInstall
 
diff --git a/pkgs/development/compilers/llvm/10/bintools/default.nix b/pkgs/development/compilers/llvm/10/bintools/default.nix
index 1eb7215c008..38002439c20 100644
--- a/pkgs/development/compilers/llvm/10/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/10/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 95eba5d7fb3..41c20ac47eb 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -191,7 +192,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/11/bintools/default.nix b/pkgs/development/compilers/llvm/11/bintools/default.nix
index 1eb7215c008..38002439c20 100644
--- a/pkgs/development/compilers/llvm/11/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/11/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 2123efdf235..93cf2757c65 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -203,7 +204,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/12/bintools/default.nix b/pkgs/development/compilers/llvm/12/bintools/default.nix
index 1eb7215c008..38002439c20 100644
--- a/pkgs/development/compilers/llvm/12/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/12/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index b04eeb3c726..3d5592e19ee 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -191,7 +192,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/13/bintools/default.nix b/pkgs/development/compilers/llvm/13/bintools/default.nix
index b6ee7b4dc25..b69f4bd1291 100644
--- a/pkgs/development/compilers/llvm/13/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/13/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 32e96212fa5..e2d6da816f3 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -153,7 +154,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/14/bintools/default.nix b/pkgs/development/compilers/llvm/14/bintools/default.nix
index b6ee7b4dc25..b69f4bd1291 100644
--- a/pkgs/development/compilers/llvm/14/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/14/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 5437735f78f..d8010ecf893 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -165,7 +166,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/15/bintools/default.nix b/pkgs/development/compilers/llvm/15/bintools/default.nix
index 303faf7bbb6..c7b20dd28e2 100644
--- a/pkgs/development/compilers/llvm/15/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/15/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
index e0b79a9acfe..de98c436153 100644
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -9,6 +9,7 @@
 , python3
 , python3Packages
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -327,7 +328,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index a4d04f0618c..31b88098c83 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libxml2
 , ncurses
@@ -168,10 +169,9 @@ stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ]
-  ++ lib.optional (!isDarwin)
+  ] ++ lib.optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ++ lib.optionals (isDarwin) [
+  ] ++ lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index d18bf2149e1..954887cd236 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -4,6 +4,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libxml2
 , ncurses
@@ -162,7 +163,7 @@ stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/7/bintools/default.nix b/pkgs/development/compilers/llvm/7/bintools/default.nix
index 1eb7215c008..38002439c20 100644
--- a/pkgs/development/compilers/llvm/7/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/7/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index da72bb8b35a..eaeef3c2ef5 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -180,7 +181,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/8/bintools/default.nix b/pkgs/development/compilers/llvm/8/bintools/default.nix
index 1eb7215c008..38002439c20 100644
--- a/pkgs/development/compilers/llvm/8/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/8/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 5c381a896e1..aa76fc0c3cf 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -173,7 +174,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/9/bintools/default.nix b/pkgs/development/compilers/llvm/9/bintools/default.nix
index 1eb7215c008..38002439c20 100644
--- a/pkgs/development/compilers/llvm/9/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/9/bintools/default.nix
@@ -1,10 +1,7 @@
-{ runCommand, stdenv, llvm, lld, version }:
+{ lib, runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index f8b6a8170f8..89bc014f5c6 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -188,7 +189,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/git/bintools/default.nix b/pkgs/development/compilers/llvm/git/bintools/default.nix
index 303faf7bbb6..3162b0d41e0 100644
--- a/pkgs/development/compilers/llvm/git/bintools/default.nix
+++ b/pkgs/development/compilers/llvm/git/bintools/default.nix
@@ -1,10 +1,7 @@
 { runCommand, stdenv, llvm, lld, version }:
 
 let
-  prefix =
-    if stdenv.hostPlatform != stdenv.targetPlatform
-    then "${stdenv.targetPlatform.config}-"
-    else "";
+  prefix = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) "${stdenv.targetPlatform.config}-";
 in runCommand "llvm-binutils-${version}" {
   preferLocalBuild = true;
   passthru = {
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index b4e2757f20c..9a0d375df9c 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? (!stdenv.isDarwin && !stdenv.targetPlatform.isWasi)
 , libbfd
 , libpfm
 , libxml2
@@ -151,7 +152,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/mit-scheme/default.nix b/pkgs/development/compilers/mit-scheme/default.nix
index 5a96242da7b..da668b51e27 100644
--- a/pkgs/development/compilers/mit-scheme/default.nix
+++ b/pkgs/development/compilers/mit-scheme/default.nix
@@ -49,6 +49,12 @@ stdenv.mkDerivation {
     runHook postConfigure
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-parameter"
+    "-Wno-error=use-after-free"
+  ];
+
   buildPhase = ''
     runHook preBuild
     cd src
diff --git a/pkgs/development/compilers/rust/1_66.nix b/pkgs/development/compilers/rust/1_66.nix
deleted file mode 100644
index 6aee98bdba0..00000000000
--- a/pkgs/development/compilers/rust/1_66.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_14, llvm_14
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.66.1";
-  rustcSha256 = "sha256-WzyTOpTHIYdwXU7ikxmLq/3QlEL1k3+9aF2zqB9JWbo=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_14.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_14;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.65.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "b29869f8e2c7029150a929b2c4e26843f363846ad99253a25be6abcfa8e84f46";
-    x86_64-unknown-linux-gnu = "8f754fdd5af783fe9020978c64e414cb45f3ad0a6f44d045219bbf2210ca3cb9";
-    x86_64-unknown-linux-musl = "716984def5509a844c2dde1c7be42bfadeb179f751d5c1a30c9c7198c8c089cd";
-    arm-unknown-linux-gnueabihf = "e27f835c16bfcb66ad022a17d5c4602899e021e483a432ca4cc2cb4ecd39e938";
-    armv7-unknown-linux-gnueabihf = "5376d467a29b32cacb771e0c76dc280bd623852709e7ffd92caabab076d5475f";
-    aarch64-unknown-linux-gnu = "f406136010e6a1cdce3fb6573506f00d23858af49dd20a46723c3fa5257b7796";
-    aarch64-unknown-linux-musl = "4b701dc3cbac04ebf0e336cff2f4ce5fc1a1984c183226863c9ed911eb00b07e";
-    x86_64-apple-darwin = "139087a3937799415fd829e5a88162a69a32c23725a44457f9c96b98e4d64a7c";
-    aarch64-apple-darwin = "7ddc335bd10fc32d3039ef36248a5d0c4865db2437c8aad20a2428a6cf41df09";
-    powerpc64le-unknown-linux-gnu = "3f1d0d5bb13213348dc65e373f8c412fc0a12ee55abc1c864f7e0300932fc687";
-    riscv64gc-unknown-linux-gnu = "aac7067348d218faa452b4bdc735778a51570a310ad645313ec767b5d7c88492";
-    mips64el-unknown-linux-gnuabi64 = "d91ed3857c5256720da890f6533684b684e880bf9006dc4e4f4181213a5c4a09";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_66;
-
-  rustcPatches = [
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_14" "llvm_14"])
diff --git a/pkgs/development/compilers/rust/1_67.nix b/pkgs/development/compilers/rust/1_67.nix
new file mode 100644
index 00000000000..a0a43f31386
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_67.nix
@@ -0,0 +1,81 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_15, llvm_15
+, fetchpatch
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.67.0";
+  rustcSha256 = "sha256-0CnxT85Foux6mmBdKgpAquRznLL9rinun3pukCWn/eQ=";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_15.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackages = llvmPackages_15;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.66.1";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "823128f64e902ee8aff61488c552c983e17ccca10c3f46dd93fde924d5100eb3";
+    x86_64-unknown-linux-gnu = "7ecf79e9ea23d05917b0172f9f81fb1e47011d261a719998f8d5620a1e835023";
+    x86_64-unknown-linux-musl = "70b660148238b8a137c6f165b0bc7bdcb50204c22a314bed6174ecd672f02e57";
+    arm-unknown-linux-gnueabihf = "12c93efe71f3334ef6e718786f6a60b9566f097d23a7f1e8f38ed9add209126f";
+    armv7-unknown-linux-gnueabihf = "f43c8cd3fd7d1c1e08bd6317220b2ec9b25891f464604f80bb17985b09bbf62a";
+    aarch64-unknown-linux-gnu = "84b8a79803c1b91386460fe6a7d04c54002344452ff8e5c5631d5fa275ed0c9c";
+    aarch64-unknown-linux-musl = "b2665da33efd328cff192a67ad026ea84f9deab8d1971892f4bbc22647606163";
+    x86_64-apple-darwin = "0fcf341db2579aa6eb61a3430cd1dbc79b042dfe89686b93cc887d818d086c30";
+    aarch64-apple-darwin = "03469fcaa0d8c505e6db03c18ded73cfbb6a2ce159292f8cf06c042bfc9f7cf9";
+    powerpc64le-unknown-linux-gnu = "ccf915a0137bb83a9d9b133a234ae53cc099f2ba26e3cb09d209b47bbee2ade7";
+    riscv64gc-unknown-linux-gnu = "525cb05edaf3ed0560753b413c72dd1b06492df28bf3c427a66fda683fdca3fc";
+    mips64el-unknown-linux-gnuabi64 = "3c241cc80410fe389e8b04beda62c42496c225fe8776db9d55a498c53244f7a6";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_67;
+
+  rustcPatches = [
+    # fix thin archive reading
+    # https://github.com/rust-lang/rust/pull/107360
+    (fetchpatch {
+      name = "revert-back-to-llvmarchivebuilder-on-all-platforms.patch";
+      url = "https://github.com/rust-lang/rust/commit/de363d54c40a378717881240e719f5f7223ba376.patch";
+      hash = "sha256-3Xb803LZUZ1dldxGJ65Iw6gg1V1K827OB/0b32GqilU=";
+    })
+
+    # Fixes ICE.
+    # https://github.com/rust-lang/rust/pull/107688
+    (fetchpatch {
+      name = "re-erased-regions-are-local.patch";
+      url = "https://github.com/rust-lang/rust/commit/9d110847ab7f6aef56a8cd20cb6cea4fbcc51cd9.patch";
+      excludes = [ "*tests/*" ];
+      hash = "sha256-EZH5K1BEOOfi97xZr1xEHFP4jjvJ1+xqtRMvxBoL8pU=";
+    })
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_15" "llvm_15"])
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index d04eebe7ead..481b4195891 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
-, installShellFiles, makeWrapper, cacert, rustPlatform, rustc
+, installShellFiles, makeWrapper, rustPlatform, rustc
 , CoreFoundation, Security
 , auditable ? false # TODO: change to true when this is the default
 }:
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage {
     (lib.getDev pkgsHostHost.curl)
     zlib
   ];
-  buildInputs = [ cacert file curl python3 openssl zlib ]
+  buildInputs = [ file curl python3 openssl zlib ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
 
   # cargo uses git-rs which is made for a version of libgit2 from recent master that
@@ -39,14 +39,7 @@ rustPlatform.buildRustPackage {
   RUSTC_BOOTSTRAP = 1;
 
   postInstall = ''
-    # NOTE: We override the `http.cainfo` option usually specified in
-    # `.cargo/config`. This is an issue when users want to specify
-    # their own certificate chain as environment variables take
-    # precedence
-    wrapProgram "$out/bin/cargo" \
-      --suffix PATH : "${rustc}/bin" \
-      --set CARGO_HTTP_CAINFO "${cacert}/etc/ssl/certs/ca-bundle.crt" \
-      --set SSL_CERT_FILE "${cacert}/etc/ssl/certs/ca-bundle.crt"
+    wrapProgram "$out/bin/cargo" --suffix PATH : "${rustc}/bin"
 
     installManPage src/tools/cargo/src/etc/man/*
 
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 426f1377883..60f07a64299 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -165,7 +165,6 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openssl ]
-    # TODO: remove libiconv once 1.66 is used to bootstrap
     ++ optionals stdenv.isDarwin [ libiconv Security ]
     ++ optional (!withBundledLLVM) llvmShared;
 
diff --git a/pkgs/development/compilers/sbcl/2.x.nix b/pkgs/development/compilers/sbcl/2.x.nix
index c9aa4a962ff..f7bcd8e5b49 100644
--- a/pkgs/development/compilers/sbcl/2.x.nix
+++ b/pkgs/development/compilers/sbcl/2.x.nix
@@ -188,7 +188,7 @@ stdenv.mkDerivation rec {
                   lib.concatStringsSep " "
                     (builtins.map (x: "--with-${x}") enableFeatures ++
                      builtins.map (x: "--without-${x}") disableFeatures)
-                } ${if stdenv.hostPlatform.system == "aarch64-darwin" then "--arch=arm64" else ""}
+                } ${lib.optionalString (stdenv.hostPlatform.system == "aarch64-darwin") "--arch=arm64"}
     (cd doc/manual ; make info)
 
     runHook postBuild
diff --git a/pkgs/development/compilers/solc/default.nix b/pkgs/development/compilers/solc/default.nix
index 55bf5237e61..9a3e68a1b73 100644
--- a/pkgs/development/compilers/solc/default.nix
+++ b/pkgs/development/compilers/solc/default.nix
@@ -96,7 +96,7 @@ let
       for i in ./scripts/*.sh ./scripts/*.py ./test/*.sh ./test/*.py; do
         patchShebangs "$i"
       done
-      TERM=xterm ./scripts/tests.sh ${if z3Support then "--no-smt" else ""}
+      TERM=xterm ./scripts/tests.sh ${lib.optionalString z3Support "--no-smt"}
       popd
     '';
 
diff --git a/pkgs/development/compilers/swift/wrapper/default.nix b/pkgs/development/compilers/swift/wrapper/default.nix
index a7d16cc2471..0c7e0f8cbcf 100644
--- a/pkgs/development/compilers/swift/wrapper/default.nix
+++ b/pkgs/development/compilers/swift/wrapper/default.nix
@@ -16,8 +16,7 @@ stdenv.mkDerivation (swift._wrapperParams // {
     swiftOs swiftArch
     swiftModuleSubdir swiftLibSubdir
     swiftStaticModuleSubdir swiftStaticLibSubdir;
-  swiftDriver = if useSwiftDriver
-    then "${swift-driver}/bin/swift-driver" else "";
+  swiftDriver = lib.optionalString useSwiftDriver "${swift-driver}/bin/swift-driver";
 
   passAsFile = [ "buildCommand" ];
   buildCommand = ''
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index 159b1827fc8..ed1d7fc57a6 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
         "-L${variables.libdir}"
         "-Wl,--rpath ${variables.libdir}"
         "-ltcc"
-        "-ldl"
       ];
       variables = rec {
         prefix = "${placeholder "out"}";
diff --git a/pkgs/development/compilers/urweb/default.nix b/pkgs/development/compilers/urweb/default.nix
index 67ebaa04699..a881b2f1bad 100644
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@@ -33,6 +33,11 @@ stdenv.mkDerivation rec {
                    -L${sqlite.out}/lib";
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=use-after-free"
+  ];
+
   # Be sure to keep the statically linked libraries
   dontDisableStatic = true;
 
diff --git a/pkgs/development/compilers/zig/0.10.nix b/pkgs/development/compilers/zig/0.10.nix
index 89f23b9ca25..6d41b63f03b 100644
--- a/pkgs/development/compilers/zig/0.10.nix
+++ b/pkgs/development/compilers/zig/0.10.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     # file RPATH_CHANGE could not write new RPATH
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    "-DZIG_TARGET_MCPU=baseline"
   ];
 
   doCheck = true;
diff --git a/pkgs/development/haskell-modules/make-package-set.nix b/pkgs/development/haskell-modules/make-package-set.nix
index 5b9546e7505..7104a2164af 100644
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -254,7 +254,7 @@ in package-set { inherit pkgs lib callPackage; } self // {
     # a cabal flag with '--flag=myflag'.
     developPackage =
       { root
-      , name ? if builtins.typeOf root == "path" then builtins.baseNameOf root else ""
+      , name ? lib.optionalString (builtins.typeOf root == "path") (builtins.baseNameOf root)
       , source-overrides ? {}
       , overrides ? self: super: {}
       , modifier ? drv: drv
diff --git a/pkgs/development/haskell-modules/package-list.nix b/pkgs/development/haskell-modules/package-list.nix
index 688844bcc46..50daaf13623 100644
--- a/pkgs/development/haskell-modules/package-list.nix
+++ b/pkgs/development/haskell-modules/package-list.nix
@@ -10,9 +10,8 @@ let
     let
       version = pkg.version or "";
     in
-    if isPvpVersion version then
-      ''"${name}","${version}","http://hydra.nixos.org/job/nixpkgs/trunk/haskellPackages.${name}.x86_64-linux"''
-    else "";
+    lib.optionalString (isPvpVersion version)
+      ''"${name}","${version}","http://hydra.nixos.org/job/nixpkgs/trunk/haskellPackages.${name}.x86_64-linux"'';
   all-haskellPackages = builtins.toFile "all-haskellPackages" (lib.concatStringsSep "\n" (lib.filter (x: x != "") (lib.mapAttrsToList pkgLine haskellPackages)));
 in
 runCommand "hackage-package-list" { }
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 95b7d611fa9..dfae27b3710 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.11.1.1208";
+  version = "1.11.1.1224";
 
   src = fetchurl {
     # https://clojure.org/releases/tools
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "sha256-bn9uNM46oYc0wxJJ8HMGbE8/2mnYxm/p9S6MhYfhcQM=";
+    sha256 = "sha256-T55/uETQFBWYS9ZifbF3KW8vWoeInq/QxH7UabVkBVI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/dhall/generate-dhall-directory-package.nix b/pkgs/development/interpreters/dhall/generate-dhall-directory-package.nix
index 03dfb72d7ab..8ece89ef4f4 100644
--- a/pkgs/development/interpreters/dhall/generate-dhall-directory-package.nix
+++ b/pkgs/development/interpreters/dhall/generate-dhall-directory-package.nix
@@ -19,7 +19,7 @@ lib.makePackageOverridable
       name = "dhall-directory-package.nix";
 
       buildCommand = ''
-        dhall-to-nixpkgs directory --fixed-output-derivations --file "${file}" "${src}" ${if document then "--document" else ""} > $out
+        dhall-to-nixpkgs directory --fixed-output-derivations --file "${file}" "${src}" ${lib.optionalString document "--document"} > $out
       '';
 
       nativeBuildInputs = [ dhall-nixpkgs ];
diff --git a/pkgs/development/interpreters/gnu-apl/default.nix b/pkgs/development/interpreters/gnu-apl/default.nix
index 3bcada9aa8f..e413914aa39 100644
--- a/pkgs/development/interpreters/gnu-apl/default.nix
+++ b/pkgs/development/interpreters/gnu-apl/default.nix
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
     "-Wno-error=maybe-uninitialized"
     # Needed with GCC 11
     "-Wno-error=misleading-indentation"
+    # Needed with GCC 12
+    "-Wno-error=nonnull"
+    "-Wno-error=stringop-overflow"
+    "-Wno-error=use-after-free"
    ]) ++ optional stdenv.cc.isClang "-Wno-error=null-dereference");
 
   patchPhase = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index dff3e4101d5..e221956cf22 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -186,7 +186,7 @@ let
     NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lobjc";
 
     # See https://savannah.gnu.org/bugs/?50339
-    F77_INTEGER_8_FLAG = if use64BitIdx then "-fdefault-integer-8" else "";
+    F77_INTEGER_8_FLAG = lib.optionalString use64BitIdx "-fdefault-integer-8";
 
     configureFlags = [
       "--with-blas=blas"
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index 6fad25ee8d6..b7597a9925b 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -26,7 +26,7 @@ let
     inherit self sourceVersion pythonVersion packageOverrides;
     implementation = "pypy";
     libPrefix = "pypy${pythonVersion}";
-    executable = "pypy${if isPy39OrNewer then lib.versions.majorMinor pythonVersion else if isPy3k then "3" else ""}";
+    executable = "pypy${if isPy39OrNewer then lib.versions.majorMinor pythonVersion else lib.optionalString isPy3k "3"}";
     sitePackages = "site-packages";
     hasDistutilsCxxPatch = false;
     inherit pythonAttr;
diff --git a/pkgs/development/interpreters/python/pypy/prebuilt.nix b/pkgs/development/interpreters/python/pypy/prebuilt.nix
index a25ab8a7822..9b3baf84848 100644
--- a/pkgs/development/interpreters/python/pypy/prebuilt.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt.nix
@@ -32,7 +32,7 @@ let
     inherit self sourceVersion pythonVersion packageOverrides;
     implementation = "pypy";
     libPrefix = "pypy${pythonVersion}";
-    executable = "pypy${if isPy3k then "3" else ""}";
+    executable = "pypy${lib.optionalString isPy3k "3"}";
     sitePackages = "lib/${libPrefix}/site-packages";
     hasDistutilsCxxPatch = false;
 
diff --git a/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix b/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
index a95e0c2f651..ddf3963060d 100644
--- a/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
@@ -32,7 +32,7 @@ let
     inherit self sourceVersion pythonVersion packageOverrides;
     implementation = "pypy";
     libPrefix = "pypy${pythonVersion}";
-    executable = "pypy${if isPy3k then "3" else ""}";
+    executable = "pypy${lib.optionalString isPy3k "3"}";
     sitePackages = "site-packages";
     hasDistutilsCxxPatch = false;
 
diff --git a/pkgs/development/interpreters/renpy/default.nix b/pkgs/development/interpreters/renpy/default.nix
index 07c917473cc..d5505009a07 100644
--- a/pkgs/development/interpreters/renpy/default.nix
+++ b/pkgs/development/interpreters/renpy/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   ]);
 
   RENPY_DEPS_INSTALL = lib.concatStringsSep "::" (map (path: path) [
-    SDL2 SDL2.dev libpng ffmpeg.out freetype glew.dev libGLU libGL fribidi zlib
+    SDL2 SDL2.dev libpng ffmpeg.lib freetype glew.dev libGLU libGL fribidi zlib
   ]);
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 57d1e6d84fe..4461bd08365 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -273,13 +273,13 @@ in {
   mkRuby = generic;
 
   ruby_2_7 = generic {
-    version = rubyVersion "2" "7" "6" "";
-    sha256 = "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877";
+    version = rubyVersion "2" "7" "7" "";
+    sha256 = "sha256-4QEn22kdf/NkAs/oj0GMjQJaPx7qkgRLFi3XLwuMe5A=";
   };
 
   ruby_3_0 = generic {
-    version = rubyVersion "3" "0" "4" "";
-    sha256 = "0avj4g3s2839b2y4m6pk8kid74r8nj7k0qm2rsdcwjzhg8h7rd3h";
+    version = rubyVersion "3" "0" "5" "";
+    sha256 = "sha256-mvxjgKAnpP4a4aPi7MtrSXucWsBjHBLKVvm3vrSEh3Y=";
   };
 
   ruby_3_1 = generic {
diff --git a/pkgs/development/interpreters/ruby/patchsets.nix b/pkgs/development/interpreters/ruby/patchsets.nix
index bdc4cf3690f..2bf5bc7296c 100644
--- a/pkgs/development/interpreters/ruby/patchsets.nix
+++ b/pkgs/development/interpreters/ruby/patchsets.nix
@@ -1,17 +1,15 @@
 { patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:
 
 {
-  "2.7.6" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-with-openssl-dir-option.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-fix-broken-tests-caused-by-ad.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-more-detailed-stacktrace.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/05-malloc-trim.patch"
+  "2.7.7" = ops useRailsExpress [
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-more-detailed-stacktrace.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-malloc-trim.patch"
   ];
-  "3.0.4" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-fix-with-openssl-dir-option.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/03-malloc-trim.patch"
+  "3.0.5" = ops useRailsExpress [
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-malloc-trim.patch"
   ];
   "3.1.2" = ops useRailsExpress [
     "${patchSet}/patches/ruby/3.1/head/railsexpress/01-improve-gc-stats.patch"
diff --git a/pkgs/development/interpreters/ruby/ruby-version.nix b/pkgs/development/interpreters/ruby/ruby-version.nix
index 23f7f46a47a..57fa60aea28 100644
--- a/pkgs/development/interpreters/ruby/ruby-version.nix
+++ b/pkgs/development/interpreters/ruby/ruby-version.nix
@@ -55,9 +55,9 @@ let
         self.majMinTiny + (
           if self.patchLevel != null then
             "-p${self.patchLevel}"
-          else if self.tail != "" then
-            "-${self.tail}"
-          else "");
+          else
+            lib.optionalString (self.tail != "") "-${self.tail}"
+        );
     };
 in
   rubyVersion
diff --git a/pkgs/development/interpreters/ruby/rvm-patchsets.nix b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
index 51c0a9a7dfb..fbbfd4c9730 100644
--- a/pkgs/development/interpreters/ruby/rvm-patchsets.nix
+++ b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
@@ -3,6 +3,6 @@
 fetchFromGitHub {
   owner  = "skaes";
   repo   = "rvm-patchsets";
-  rev    = "a6429bb1a7fb9b5798c22f43338739a6c192b42d";
-  sha256 = "sha256-NpSa+uGQA1rfHNcLzPNTK65J+Wk9ZlzhHFePDA4uuo0=";
+  rev    = "e6574c54a34fe6e4d45aa1433872a22ddfe14cf3";
+  hash   = "sha256-x2KvhgRVJ4Nc5v1j4DggKO1u3otG8HVMxhq4yuUKnds=";
 }
diff --git a/pkgs/development/interpreters/tcl/tcl-package-hook.sh b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
index 41603037931..8548ac66402 100644
--- a/pkgs/development/interpreters/tcl/tcl-package-hook.sh
+++ b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
@@ -41,6 +41,8 @@ findInstalledTclPkgs() {
 
 # Wrap any freshly-installed binaries and set up their TCLLIBPATH
 wrapTclBins() {
+    if [ "$dontWrapTclBinaries" ]; then return; fi
+
     if [[ -z "${TCLLIBPATH-}" ]]; then
         echo "skipping automatic Tcl binary wrapping (nothing to do)"
         return
diff --git a/pkgs/development/libraries/StormLib/default.nix b/pkgs/development/libraries/StormLib/default.nix
index 0bf9ba63dc4..cbf33e7a2cb 100644
--- a/pkgs/development/libraries/StormLib/default.nix
+++ b/pkgs/development/libraries/StormLib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, bzip2, libtomcrypt, zlib }:
+{ lib, stdenv, fetchFromGitHub, cmake, bzip2, libtomcrypt, zlib, darwin }:
 
 stdenv.mkDerivation rec {
   pname = "StormLib";
@@ -11,13 +11,23 @@ stdenv.mkDerivation rec {
     sha256 = "1rcdl6ryrr8fss5z5qlpl4prrw8xpbcdgajg2hpp0i7fpk21ymcc";
   };
 
+  # Fixes a build failure on aarch64-darwin. Define for all Darwin targets for when x86_64-darwin
+  # upgrades to a newer SDK.
+  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-DTARGET_OS_IPHONE=0";
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "FRAMEWORK DESTINATION /Library/Frameworks" "FRAMEWORK DESTINATION Library/Frameworks"
+  '';
+
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
     "-DWITH_LIBTOMCRYPT=ON"
   ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ bzip2 libtomcrypt zlib ];
+  buildInputs = [ bzip2 libtomcrypt zlib ] ++
+    lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Carbon ];
 
   meta = with lib; {
     homepage = "https://github.com/ladislav-zezula/StormLib";
diff --git a/pkgs/development/libraries/applet-window-buttons/default.nix b/pkgs/development/libraries/applet-window-buttons/default.nix
index 61187581e9a..4f605b8af98 100644
--- a/pkgs/development/libraries/applet-window-buttons/default.nix
+++ b/pkgs/development/libraries/applet-window-buttons/default.nix
@@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , extra-cmake-modules
 , kcoreaddons
@@ -20,6 +21,14 @@ mkDerivation rec {
     hash = "sha256-Qww/22bEmjuq+R3o0UDcS6U+34qjaeSEy+g681/hcfE=";
   };
 
+  patches = [
+    # FIXME: cherry-pick Plasma 5.27 build fix, remove for next release
+    (fetchpatch {
+      url = "https://github.com/psifidotos/applet-window-buttons/commit/924994e10402921bf22fefc099bca2914989081c.diff";
+      hash = "sha256-4ErqmkIbkvKwns50LhI8Et1EMyvrXYcNRL1rXCxau2w=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 5c60723309b..4bebd827145 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -43,7 +43,7 @@
   # non-existent in older versions
   # see https://github.com/boostorg/process/issues/55
 , enableS3 ? (!stdenv.isDarwin) || (lib.versionOlder boost.version "1.69" || lib.versionAtLeast boost.version "1.70")
-, enableGcs ? !stdenv.isDarwin # google-cloud-cpp is not supported on darwin
+, enableGcs ? (!stdenv.isDarwin) && (lib.versionAtLeast grpc.cxxStandard "17") # google-cloud-cpp is not supported on darwin, needs to support C++17
 }:
 
 assert lib.asserts.assertMsg
@@ -52,17 +52,19 @@ assert lib.asserts.assertMsg
 
 let
   arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
     owner = "apache";
     repo = "arrow-testing";
-    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
-    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
+    rev = "ecab1162cbec872e17d949ecc86181670aee045c";
+    hash = "sha256-w6rEuxfLTEO8DyXV44G6JOMeTfYtskFCOj9rHXNmj2Y=";
   };
 
   parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
     owner = "apache";
     repo = "parquet-testing";
-    rev = "aafd3fc9df431c2625a514fb46626e5614f1d199";
-    hash = "sha256-cO5t/mgsbBhbSefx8EMGTyxmgTjhZ8mFujkFQ3p/JS0=";
+    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
+    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
   };
 
   aws-sdk-cpp-arrow = aws-sdk-cpp.override {
@@ -79,11 +81,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "arrow-cpp";
-  version = "9.0.0";
+  version = "11.0.0";
 
   src = fetchurl {
     url = "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    hash = "sha256-qaAz8KNJAomZj0WGgNGVec8HkRcXumWv3my4AHD3qbU=";
+    hash = "sha256-Ldjw6ghIpYeFYo7jpXZ1VI1QnhchOi9dcrDZALQ/VDA=";
   };
   sourceRoot = "apache-arrow-${version}/cpp";
 
@@ -108,15 +110,15 @@ stdenv.mkDerivation rec {
   ARROW_XSIMD_URL = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
-    rev = "8.1.0";
-    hash = "sha256-Aqs6XJkGjAjGAp0PprabSM4m+32M/UXpSHppCHdzaZk=";
+    rev = "9.0.1";
+    hash = "sha256-onALN6agtrHWigtFlCeefD9CiRZI4Y690XTzy2UDnrk=";
   };
 
   ARROW_SUBSTRAIT_URL = fetchFromGitHub {
     owner = "substrait-io";
     repo = "substrait";
-    rev = "v0.6.0";
-    hash = "sha256-hxCBomL4Qg9cHLRg9ZiO9k+JVOZXn6f4ikPtK+V9tno=";
+    rev = "v0.20.0";
+    hash = "sha256-71hAwJ0cGvpwK/ibeeQt82e9uqxcu9sM1rPtPENMPfs=";
   };
 
   patches = [
@@ -148,18 +150,17 @@ stdenv.mkDerivation rec {
     utf8proc
     zlib
     zstd
-  ] ++ lib.optionals enableShared [
-    python3.pkgs.python
-    python3.pkgs.numpy
   ] ++ lib.optionals enableFlight [
     grpc
     openssl
     protobuf
+    sqlite
   ] ++ lib.optionals enableS3 [ aws-sdk-cpp-arrow openssl ]
   ++ lib.optionals enableGcs [
     crc32c
     curl
-    google-cloud-cpp grpc
+    google-cloud-cpp
+    grpc
     nlohmann_json
   ];
 
@@ -183,16 +184,12 @@ stdenv.mkDerivation rec {
     "-DARROW_COMPUTE=ON"
     "-DARROW_CSV=ON"
     "-DARROW_DATASET=ON"
-    "-DARROW_ENGINE=ON"
     "-DARROW_FILESYSTEM=ON"
     "-DARROW_FLIGHT_SQL=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_HDFS=ON"
     "-DARROW_IPC=ON"
     "-DARROW_JEMALLOC=${if enableJemalloc then "ON" else "OFF"}"
     "-DARROW_JSON=ON"
-    "-DARROW_PLASMA=ON"
-    # Disable Python for static mode because openblas is currently broken there.
-    "-DARROW_PYTHON=${if enableShared then "ON" else "OFF"}"
     "-DARROW_USE_GLOG=ON"
     "-DARROW_WITH_BACKTRACE=ON"
     "-DARROW_WITH_BROTLI=ON"
@@ -203,21 +200,21 @@ stdenv.mkDerivation rec {
     "-DARROW_WITH_ZLIB=ON"
     "-DARROW_WITH_ZSTD=ON"
     "-DARROW_MIMALLOC=ON"
-    # Parquet options:
-    "-DARROW_PARQUET=ON"
     "-DARROW_SUBSTRAIT=ON"
-    "-DPARQUET_BUILD_EXECUTABLES=ON"
     "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_FLIGHT_TESTING=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
     "-DARROW_GCS=${if enableGcs then "ON" else "OFF"}"
+    # Parquet options:
+    "-DARROW_PARQUET=ON"
+    "-DPARQUET_BUILD_EXECUTABLES=ON"
+    "-DPARQUET_REQUIRE_ENCRYPTION=ON"
   ] ++ lib.optionals (!enableShared) [
     "-DARROW_TEST_LINKAGE=static"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
-  ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF"
-  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h"
-  ++ lib.optionals enableGcs [ "-DCMAKE_CXX_STANDARD=${grpc.cxxStandard}" ];
+  ] ++ lib.optionals (!stdenv.isx86_64) [ "-DARROW_USE_SIMD=OFF" ]
+  ++ lib.optionals enableS3 [ "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h" ];
 
   doInstallCheck = true;
   ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
@@ -239,31 +236,33 @@ stdenv.mkDerivation rec {
         "TestS3FSGeneric.*"
       ];
     in
-    lib.optionalString doInstallCheck "-${builtins.concatStringsSep ":" filteredTests}";
+    lib.optionalString doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+
   __darwinAllowLocalNetworking = true;
-  nativeInstallCheckInputs = [ perl which sqlite ] ++ lib.optional enableS3 minio;
-  installCheckPhase =
-    let
-      excludedTests = lib.optionals stdenv.isDarwin [
-        # Some plasma tests need to be patched to use a shorter AF_UNIX socket
-        # path on Darwin. See https://github.com/NixOS/nix/pull/1085
-        "plasma-external-store-tests"
-        "plasma-client-tests"
-      ] ++ [ "arrow-gcsfs-test" ];
-    in
-    ''
-      runHook preInstallCheck
 
-      ctest -L unittest \
-        --exclude-regex '^(${builtins.concatStringsSep "|" excludedTests})$'
+  nativeInstallCheckInputs = [ perl which sqlite ]
+    ++ lib.optionals enableS3 [ minio ]
+    ++ lib.optionals enableFlight [ python3 ];
+
+  disabledTests = [
+    # requires networking
+    "arrow-gcsfs-test"
+    "arrow-flight-integration-test"
+  ];
 
-      runHook postInstallCheck
-    '';
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
+
+    runHook postInstallCheck
+  '';
 
   meta = with lib; {
     description = "A cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/docs/cpp/";
     license = licenses.asl20;
+    broken = stdenv.isLinux && stdenv.isAarch64; # waiting on gtest changes in staging
     platforms = platforms.unix;
     maintainers = with maintainers; [ tobim veprbl cpcloud ];
   };
diff --git a/pkgs/development/libraries/assimp/default.nix b/pkgs/development/libraries/assimp/default.nix
index 81d9e54de43..ed0476fea64 100644
--- a/pkgs/development/libraries/assimp/default.nix
+++ b/pkgs/development/libraries/assimp/default.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DASSIMP_BUILD_ASSIMP_TOOLS=ON" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   meta = with lib; {
     description = "A library to import various 3D model formats";
     homepage = "https://www.assimp.org/";
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 152572c6b16..a7606854812 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -29,11 +29,14 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  NIX_CFLAGS_COMPILE = [
     "-Wno-error=cast-function-type"
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-overflow"
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs and probably clang
+    "-Wno-error=use-after-free"
   ];
 
   propagatedBuildInputs = [ libantlr3c mbedtls_2 bctoolbox belr ];
diff --git a/pkgs/development/libraries/boringssl/default.nix b/pkgs/development/libraries/boringssl/default.nix
index 61c2a27f3d8..955157d055a 100644
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@@ -30,6 +30,11 @@ buildGoModule {
     export GOARCH=$(go env GOHOSTARCH)
   '';
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-Wno-error=stringop-overflow"
+  ];
+
   buildPhase = ''
     ninjaBuildPhase
   '';
diff --git a/pkgs/development/libraries/botan/generic.nix b/pkgs/development/libraries/botan/generic.nix
index 71ac20c4f31..1c5126584c2 100644
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
   configurePhase = ''
-    python configure.py --prefix=$out --with-bzip2 --with-zlib ${extraConfigureFlags}${if stdenv.cc.isClang then " --cc=clang" else "" }
+    python configure.py --prefix=$out --with-bzip2 --with-zlib ${extraConfigureFlags}${lib.optionalString stdenv.cc.isClang " --cc=clang"}
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/bzrtp/default.nix b/pkgs/development/libraries/bzrtp/default.nix
index 4bccc0c5cf2..5791924ad14 100644
--- a/pkgs/development/libraries/bzrtp/default.nix
+++ b/pkgs/development/libraries/bzrtp/default.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" "-DCMAKE_C_FLAGS=-Wno-error=cast-function-type" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   meta = with lib; {
     description = "An opensource implementation of ZRTP keys exchange protocol. Part of the Linphone project.";
     homepage = "https://gitlab.linphone.org/BC/public/bzrtp";
diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 861e9179e09..d928b814e82 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -30,11 +30,14 @@ stdenv.mkDerivation rec {
     "-DLUCENE_STATIC_CONSTANT_SYNTAX_EXITCODE__TRYRUN_OUTPUT="
   ];
 
-  patches = # From debian
-    [ ./Fix-pkgconfig-file-by-adding-clucene-shared-library.patch
-      ./Fixing_ZLIB_configuration_in_shared_CMakeLists.patch
-      ./Install-contribs-lib.patch
-    ] ++ lib.optionals stdenv.isDarwin [ ./fix-darwin.patch ];
+  patches = [
+    # From debian
+    ./Fix-pkgconfig-file-by-adding-clucene-shared-library.patch
+    ./Fixing_ZLIB_configuration_in_shared_CMakeLists.patch
+    ./Install-contribs-lib.patch
+    # From arch
+    ./fix-missing-include-time.patch
+  ] ++ lib.optionals stdenv.isDarwin [ ./fix-darwin.patch ];
 
   # fails with "Unable to find executable:
   # /build/clucene-core-2.3.3.4/build/bin/cl_test"
diff --git a/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch b/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch
new file mode 100644
index 00000000000..0ac26f76929
--- /dev/null
+++ b/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch
@@ -0,0 +1,49 @@
+From c1c2000c35ff39b09cb70fbdf66a107d3b17a674 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 12 Oct 2022 08:40:49 +0200
+Subject: [PATCH] Fix missing #include <time.h>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+At least on recent Fedora 37 beta, building now failed with
+
+> CLucene/document/DateTools.cpp:26:19: error: ‘gmtime’ was not declared in this scope
+>    26 |         tm *ptm = gmtime(&secs);
+>       |                   ^~~~~~
+
+etc.
+
+As it turns out, after 22f9d40320e3deeaa8d6aaa7a770077c20a21dae "git-svn-id:
+https://clucene.svn.sourceforge.net/svnroot/clucene/branches/lucene2_3_2@2672
+20ef185c-fe11-0410-a618-ba9304b01011" on 2008-06-26 had commented out
+_CL_TIME_WITH_SYS_TIME in clucene-config.h.cmake as "not actually used for
+anything", then cceccfb52917b5f4da447f1cf20c135952d41442 "Presenting DateTools
+and deprecating DateField. DateTools still requires some testing and its own
+unit testing" on 2008-06-29 had introduced this use of it (into then
+src/CLucene/document/DateTools.H).  And apparently most build environments have
+silently been happy ever since when the dead leading check for
+_CL_TIME_WITH_SYS_TIME didn't include both <sys/time.h> and <time.h>, but the
+following check for _CL_HAVE_SYS_TIME_H only included <sys/time.h> but not
+<time.h>.
+---
+ src/shared/CLucene/clucene-config.h.cmake | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/shared/CLucene/clucene-config.h.cmake b/src/shared/CLucene/clucene-config.h.cmake
+index bd8683a5..6fe0f92b 100644
+--- a/src/shared/CLucene/clucene-config.h.cmake
++++ b/src/shared/CLucene/clucene-config.h.cmake
+@@ -100,8 +100,7 @@ ${SYMBOL__T}
+ //#cmakedefine _CL_STAT_MACROS_BROKEN
+ 
+ /* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
+-//not actually used for anything...
+-//#cmakedefine _CL_TIME_WITH_SYS_TIME  1 
++#cmakedefine _CL_TIME_WITH_SYS_TIME  1 
+ 
+ /* Define that we will be using -fvisibility=hidden, and 
+  * make public classes visible using __attribute__ ((visibility("default")))
+-- 
+2.37.3
+
diff --git a/pkgs/development/libraries/cosmopolitan/default.nix b/pkgs/development/libraries/cosmopolitan/default.nix
index 88e5bcf5d9d..6f4cdb1cf68 100644
--- a/pkgs/development/libraries/cosmopolitan/default.nix
+++ b/pkgs/development/libraries/cosmopolitan/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cosmopolitan";
-  version = "2.1.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "jart";
     repo = pname;
     rev = version;
-    sha256 = "sha256-2Q4lutSIQ6tBwTy01lPSMepNAww9Kb7BwNyEcsSdWZ0=";
+    sha256 = "sha256-DTL1dXH+LhaxWpiCrsNjV74Bw5+kPbhEAA2Z1NKiPDk=";
   };
 
   patches = [
@@ -34,6 +34,9 @@ stdenv.mkDerivation rec {
     rm test/libc/calls/sched_setscheduler_test.c
     rm test/libc/thread/pthread_create_test.c
     rm test/libc/calls/getgroups_test.c
+
+    # fails
+    rm test/libc/stdio/posix_spawn_test.c
   '';
 
   installPhase = ''
diff --git a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
index 44fcbe5463c..38acb5def4a 100644
--- a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
+++ b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation {
 
   NIX_CFLAGS_COMPILE = [
     "-Wno-error=range-loop-construct"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/dbus-cplusplus/default.nix b/pkgs/development/libraries/dbus-cplusplus/default.nix
index 005f1ac0302..1e38ddf44e1 100644
--- a/pkgs/development/libraries/dbus-cplusplus/default.nix
+++ b/pkgs/development/libraries/dbus-cplusplus/default.nix
@@ -29,6 +29,12 @@ stdenv.mkDerivation rec {
           + "dbus-c++-threading.patch?id=7f371172f5c";
       sha256 = "1h362anx3wyxm5lq0v8girmip1jmkdbijrmbrq7k5pp47zkhwwrq";
     })
+    (fetchurl {
+      name = "template-operators.patch"; # since gcc12
+      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
+          + "dbus-c++-template-operators.patch?id=d3f0d8bb519c0af";
+      sha256 = "N25Y7jXDbr0qb7MfRr2yz3zRySppgGOe+oCfNQhRvVc=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/eccodes/default.nix b/pkgs/development/libraries/eccodes/default.nix
index 54df7be6f1b..d91cf929807 100644
--- a/pkgs/development/libraries/eccodes/default.nix
+++ b/pkgs/development/libraries/eccodes/default.nix
@@ -67,7 +67,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     homepage = "https://confluence.ecmwf.int/display/ECC/";
     license = licenses.asl20;
     maintainers = with maintainers; [ knedlsepp ];
diff --git a/pkgs/development/libraries/example-robot-data/default.nix b/pkgs/development/libraries/example-robot-data/default.nix
index 08a650dbca0..5fbb03a9fa2 100644
--- a/pkgs/development/libraries/example-robot-data/default.nix
+++ b/pkgs/development/libraries/example-robot-data/default.nix
@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "example-robot-data";
-  version = "4.0.3";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner = "Gepetto";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-rxVyka8tcF/CmGTVNyh3FPR1LVa6JOAN+9zjElgqCak=";
+    sha256 = "sha256-5FqMRChv/YGeoZq/jLSEJI5iQazQIDwslT78fbERVfs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
deleted file mode 100644
index a8acf7a7ce6..00000000000
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ /dev/null
@@ -1,511 +0,0 @@
-{ lib, stdenv, buildPackages, ffmpeg, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
-/*
- *  Licensing options (yes some are listed twice, filters and such are not listed)
- */
-, gplLicensing ? true # GPL: fdkaac,openssl,frei0r,cdio,samba,utvideo,vidstab,x265,x265,xavs,avid,zvbi,x11grab
-, version3Licensing ? true # (L)GPL3: libvmaf,opencore-amrnb,opencore-amrwb,samba,vo-aacenc,vo-amrwbenc
-, nonfreeLicensing ? false # NONFREE: openssl,fdkaac,blackmagic-design-desktop-video
-/*
- *  Build options
- */
-, smallBuild ? false # Optimize for size instead of speed
-, runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime (disable to compile natively)
-, grayBuild ? true # Full grayscale support
-, swscaleAlphaBuild ? true # Alpha channel support in swscale
-, hardcodedTablesBuild ? true # Hardcode decode tables instead of runtime generation
-, safeBitstreamReaderBuild ? true # Buffer boundary checking in bitreaders
-, multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, networkBuild ? true # Network support
-, pixelutilsBuild ? true # Pixel utils in libavutil
-, enableLto ? false # build with link-time optimization
-/*
- *  Program options
- */
-, ffmpegProgram ? true # Build ffmpeg executable
-, ffplayProgram ? true # Build ffplay executable
-, ffprobeProgram ? true # Build ffprobe executable
-, qtFaststartProgram ? true # Build qt-faststart executable
-/*
- *  Library options
- */
-, avcodecLibrary ? true # Build avcodec library
-, avdeviceLibrary ? true # Build avdevice library
-, avfilterLibrary ? true # Build avfilter library
-, avformatLibrary ? true # Build avformat library
-, avutilLibrary ? true # Build avutil library
-, postprocLibrary ? true # Build postproc library
-, swresampleLibrary ? true # Build swresample library
-, swscaleLibrary ? true # Build swscale library
-/*
- *  Documentation options
- */
-, htmlpagesDocumentation ? false # HTML documentation pages
-, manpagesDocumentation ? true # Man documentation pages
-, podpagesDocumentation ? false # POD documentation pages
-, txtpagesDocumentation ? false # Text documentation pages
-/*
- *  External libraries options
- */
-, alsa-lib ? null # Alsa in/output support
-#, avisynth ? null # Support for reading AviSynth scripts
-, bzip2 ? null
-, clang ? null
-, celt ? null # CELT decoder
-#, crystalhd ? null # Broadcom CrystalHD hardware acceleration
-, cuda ? !stdenv.isDarwin && !stdenv.isAarch64 # Dynamically linked CUDA
-, cuda-llvm ? !stdenv.isDarwin && !stdenv.isAarch64 # LLVM-based CUDA compilation
-, dav1d ? null # AV1 decoder (focused on speed and correctness)
-#, decklinkExtlib ? false, blackmagic-design-desktop-video ? null # Blackmagic Design DeckLink I/O support
-, fdkaacExtlib ? false, fdk_aac ? null # Fraunhofer FDK AAC de/encoder
-#, flite ? null # Flite (voice synthesis) support
-, fontconfig ? null # Needed for drawtext filter
-, freetype ? null # Needed for drawtext filter
-, frei0r ? null # frei0r video filtering
-, fribidi ? null # Needed for drawtext filter
-, game-music-emu ? null # Game Music Emulator
-, gnutls ? null
-, gsm ? null # GSM de/encoder
-#, ilbc ? null # iLBC de/encoder
-, libjack2 ? null # Jack audio (only version 2 is supported in this build)
-, ladspaH ? null # LADSPA audio filtering
-, lame ? null # LAME MP3 encoder
-, libass ? null # (Advanced) SubStation Alpha subtitle rendering
-, libaom ? null # AV1 encoder
-, libbluray ? null # BluRay reading
-, libbs2b ? null # bs2b DSP library
-, libcaca ? null # Textual display (ASCII art)
-#, libcdio-paranoia ? null # Audio CD grabbing
-, libdc1394 ? null, libraw1394 ? null # IIDC-1394 grabbing (ieee 1394)
-, libdrm ? null # libdrm support
-, libiconv ? null
-#, libiec61883 ? null, libavc1394 ? null # iec61883 (also uses libraw1394)
-, libmfx ? null # Hardware acceleration vis libmfx
-, libmodplug ? null # ModPlug support
-, libmysofa ? null # HRTF support via SOFAlizer
-#, libnut ? null # NUT (de)muxer, native (de)muser exists
-, libogg ? null # Ogg container used by vorbis & theora
-, libopenmpt ? null # Tracked music files decoder
-, libopus ? null # Opus de/encoder
-, librsvg ? null # SVG protocol
-, libssh ? null # SFTP protocol
-, libtheora ? null # Theora encoder
-, libv4l ? null # Video 4 Linux support
-, libva ? null # Vaapi hardware acceleration
-, libvdpau ? null # Vdpau hardware acceleration
-, libvmaf ? null # Netflix's VMAF (Video Multi-Method Assessment Fusion)
-, libvorbis ? null # Vorbis de/encoding, native encoder exists
-, libvpx ? null # VP8 & VP9 de/encoding
-, libwebp ? null # WebP encoder
-, libX11 ? null # Xlib support
-, libxcb ? null # X11 grabbing using XCB
-, libxcbshmExtlib ? true # X11 grabbing shm communication
-, libxcbxfixesExtlib ? true # X11 grabbing mouse rendering
-, libxcbshapeExtlib ? true # X11 grabbing shape rendering
-, libXv ? null # Xlib support
-, libXext ? null # Xlib support
-, libxml2 ? null # libxml2 support, for IMF and DASH demuxers
-, xz ? null # xz-utils
-, nv-codec-headers ? null
-, nvdec ? !stdenv.isDarwin && !stdenv.isAarch64 # NVIDIA NVDEC support
-, nvenc ? !stdenv.isDarwin && !stdenv.isAarch64 # NVIDIA NVENC support
-, openal ? null # OpenAL 1.1 capture support
-, ocl-icd ? null # OpenCL ICD
-, opencl-headers ? null # OpenCL headers
-, opencore-amr ? null # AMR-NB de/encoder & AMR-WB decoder
-#, opencv ? null # Video filtering
-, openglExtlib ? false, libGL ? null, libGLU ? null # OpenGL rendering
-, openh264 ? null # H.264/AVC encoder
-, openjpeg ? null # JPEG 2000 de/encoder
-, opensslExtlib ? false, openssl ? null
-, libpulseaudio ? null # Pulseaudio input support
-, rav1e ? null # AV1 encoder (focused on speed and safety)
-, svt-av1 ? null # AV1 encoder/decoder (focused on speed and correctness)
-, rtmpdump ? null # RTMP[E] support
-#, libquvi ? null # Quvi input support
-, samba ? null # Samba protocol
-#, schroedinger ? null # Dirac de/encoder
-, SDL2 ? null
-#, shine ? null # Fixed-point MP3 encoder
-, soxr ? null # Resampling via soxr
-, speex ? null # Speex de/encoder
-, srt ? null # Secure Reliable Transport (SRT) protocol
-#, twolame ? null # MP2 encoder
-#, utvideo ? null # Ut Video de/encoder
-, vid-stab ? null # Video stabilization
-#, vo-aacenc ? null # AAC encoder
-, vo-amrwbenc ? null # AMR-WB encoder
-, x264 ? null # H.264/AVC encoder
-, x265 ? null # H.265/HEVC encoder
-, xavs ? null # AVS encoder
-, xvidcore ? null # Xvid encoder, native encoder exists
-, zeromq4 ? null # Message passing
-, zimg ? null
-, zlib ? null
-, vulkan-loader ? null
-, glslang ? null
-#, zvbi ? null # Teletext support
-/*
- *  Developer options
- */
-, debugDeveloper ? false
-, optimizationsDeveloper ? true
-, extraWarningsDeveloper ? false
-, strippingDeveloper ? false
-/*
- *  Darwin frameworks
- */
-, Cocoa, CoreAudio, CoreServices, AVFoundation, MediaToolbox
-, VideoDecodeAcceleration, VideoToolbox
-}:
-
-/* Maintainer notes:
- *
- * Version bumps:
- * It should always be safe to bump patch releases (e.g. 2.1.x, x being a patch release)
- * If adding a new branch, note any configure flags that were added, changed, or deprecated/removed
- *   and make the necessary changes.
- *
- * Packages with errors:
- *   flite ilbc schroedinger
- *   opencv - circular dependency issue
- *
- * Not packaged:
- *   aacplus avisynth cdio-paranoia crystalhd libavc1394 libiec61883
- *   libnut libquvi nvenc oss shine twolame
- *   utvideo vo-aacenc vo-amrwbenc xvmc zvbi blackmagic-design-desktop-video
- *
- * Need fixes to support Darwin:
- *   gsm libjack2 libmodplug libmfx(intel-media-sdk) nvenc pulseaudio samba
- *   vid-stab
- *
- * Need fixes to support AArch64:
- *   libmfx(intel-media-sdk) nvenc
- *
- * Not supported:
- *   stagefright-h264(android only)
- *
- * Known issues:
- * flite: configure fails to find library
- *   Tried modifying ffmpeg's configure script and flite to use pkg-config
- * Cross-compiling will disable features not present on host OS
- *   (e.g. dxva2 support [DirectX] will not be enabled unless natively compiled on Cygwin)
- *
- */
-
-let
-  inherit (stdenv) isCygwin isDarwin isFreeBSD isLinux isAarch64;
-  inherit (lib) optional optionals optionalString enableFeature;
-in
-
-/*
- *  Licensing dependencies
- */
-assert version3Licensing -> gplLicensing;
-assert nonfreeLicensing -> gplLicensing && version3Licensing;
-/*
- *  Build dependencies
- */
-assert networkBuild -> gnutls != null || opensslExtlib;
-assert pixelutilsBuild -> avutilLibrary;
-/*
- *  Platform dependencies
- */
-assert isDarwin -> !nvenc;
-/*
- *  Program dependencies
- */
-assert ffmpegProgram -> avcodecLibrary
-                     && avfilterLibrary
-                     && avformatLibrary
-                     && swresampleLibrary;
-assert ffplayProgram -> avcodecLibrary
-                     && avformatLibrary
-                     && swscaleLibrary
-                     && swresampleLibrary
-                     && SDL2 != null;
-assert ffprobeProgram -> avcodecLibrary && avformatLibrary;
-/*
- *  Library dependencies
- */
-assert avcodecLibrary -> avutilLibrary; # configure flag since 0.6
-assert avdeviceLibrary -> avformatLibrary
-                       && avcodecLibrary
-                       && avutilLibrary; # configure flag since 0.6
-assert avformatLibrary -> avcodecLibrary && avutilLibrary; # configure flag since 0.6
-assert postprocLibrary -> avutilLibrary;
-assert swresampleLibrary -> soxr != null;
-assert swscaleLibrary -> avutilLibrary;
-/*
- *  External libraries
- */
-#assert decklinkExtlib -> blackmagic-design-desktop-video != null
-#                                       && !isCygwin && multithreadBuild # POSIX threads required
-#                                       && nonfreeLicensing;
-assert fdkaacExtlib -> fdk_aac != null && nonfreeLicensing;
-assert gnutls != null -> !opensslExtlib;
-assert libxcbshmExtlib -> libxcb != null;
-assert libxcbxfixesExtlib -> libxcb != null;
-assert libxcbshapeExtlib -> libxcb != null;
-assert openglExtlib -> libGL != null && libGLU != null;
-assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;
-
-stdenv.mkDerivation rec {
-  pname = "ffmpeg-full";
-  inherit (ffmpeg) src version patches;
-
-  prePatch = ''
-    patchShebangs .
-  '' + lib.optionalString stdenv.isDarwin ''
-    sed -i 's/#ifndef __MAC_10_11/#if 1/' ./libavcodec/audiotoolboxdec.c
-  '' + lib.optionalString (frei0r != null) ''
-    substituteInPlace libavfilter/vf_frei0r.c \
-      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-    substituteInPlace doc/filters.texi \
-      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-  '';
-
-  configurePlatforms = [];
-  configureFlags = [
-    "--target_os=${if stdenv.hostPlatform.isMinGW then "mingw64" else stdenv.hostPlatform.parsed.kernel.name}" #mingw32 and mingw64 doesn't have a difference here, it is internally rewritten as mingw32
-    "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-    /*
-     *  Licensing flags
-     */
-    (enableFeature gplLicensing "gpl")
-    (enableFeature version3Licensing "version3")
-    (enableFeature nonfreeLicensing "nonfree")
-    /*
-     *  Build flags
-     */
-    # On some ARM platforms --enable-thumb
-    "--enable-shared"
-    (enableFeature true "pic")
-    (enableFeature smallBuild "small")
-    (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
-    (enableFeature enableLto "lto")
-    (enableFeature grayBuild "gray")
-    (enableFeature swscaleAlphaBuild "swscale-alpha")
-    (enableFeature hardcodedTablesBuild "hardcoded-tables")
-    (enableFeature safeBitstreamReaderBuild "safe-bitstream-reader")
-    (if multithreadBuild then (
-       if stdenv.hostPlatform.isWindows then
-         "--disable-pthreads --enable-w32threads"
-       else # Use POSIX threads by default
-         "--enable-pthreads --disable-w32threads")
-     else
-       "--disable-pthreads --disable-w32threads")
-    "--disable-os2threads" # We don't support OS/2
-    (enableFeature networkBuild "network")
-    (enableFeature pixelutilsBuild "pixelutils")
-    /*
-     *  Program flags
-     */
-    (enableFeature ffmpegProgram "ffmpeg")
-    (enableFeature ffplayProgram "ffplay")
-    (enableFeature ffprobeProgram "ffprobe")
-    /*
-     *  Library flags
-     */
-    (enableFeature avcodecLibrary "avcodec")
-    (enableFeature avdeviceLibrary "avdevice")
-    (enableFeature avfilterLibrary "avfilter")
-    (enableFeature avformatLibrary "avformat")
-    (enableFeature avutilLibrary "avutil")
-    (enableFeature (postprocLibrary && gplLicensing) "postproc")
-    (enableFeature swresampleLibrary "swresample")
-    (enableFeature swscaleLibrary "swscale")
-    /*
-     *  Documentation flags
-     */
-    (enableFeature (htmlpagesDocumentation
-          || manpagesDocumentation
-          || podpagesDocumentation
-          || txtpagesDocumentation) "doc")
-    (enableFeature htmlpagesDocumentation "htmlpages")
-    (enableFeature manpagesDocumentation "manpages")
-    (enableFeature podpagesDocumentation "podpages")
-    (enableFeature txtpagesDocumentation "txtpages")
-    /*
-     *  External libraries
-     */
-    #(enableFeature avisynth "avisynth")
-    (enableFeature (bzip2 != null) "bzlib")
-    (enableFeature (celt != null) "libcelt")
-    (enableFeature cuda "cuda")
-    (enableFeature (clang != null && cuda-llvm) "cuda-llvm")
-    #(enableFeature crystalhd "crystalhd")
-    (enableFeature (dav1d != null) "libdav1d")
-    #(enableFeature decklinkExtlib "decklink")
-    (enableFeature (fdkaacExtlib && gplLicensing) "libfdk-aac")
-    #(enableFeature (flite != null) "libflite")
-    "--disable-libflite" # Force disable until a solution is found
-    (enableFeature (fontconfig != null) "fontconfig")
-    (enableFeature (freetype != null) "libfreetype")
-    (enableFeature (frei0r != null && gplLicensing) "frei0r")
-    (enableFeature (fribidi != null) "libfribidi")
-    (enableFeature (game-music-emu != null) "libgme")
-    (enableFeature (gnutls != null) "gnutls")
-    (enableFeature (gsm != null) "libgsm")
-    #(enableFeature (ilbc != null) "libilbc")
-    (enableFeature (ladspaH !=null) "ladspa")
-    (enableFeature (lame != null) "libmp3lame")
-    (enableFeature (libaom != null) "libaom")
-    (enableFeature (libass != null) "libass")
-    #(enableFeature (libavc1394 != null) null null)
-    (enableFeature (libbluray != null) "libbluray")
-    (enableFeature (libbs2b != null) "libbs2b")
-    #(enableFeature (libcaca != null) "libcaca")
-    #(enableFeature (cdio-paranoia != null && gplLicensing) "libcdio")
-    (enableFeature (if isLinux then libdc1394 != null && libraw1394 != null else false) "libdc1394")
-    (enableFeature ((isLinux || isFreeBSD) && libdrm != null) "libdrm")
-    (enableFeature (libiconv != null) "iconv")
-    (enableFeature (libjack2 != null) "libjack")
-    #(enableFeature (if isLinux then libiec61883 != null && libavc1394 != null && libraw1394 != null else false) "libiec61883")
-    (enableFeature (if isLinux && !isAarch64 then libmfx != null else false) "libmfx")
-    (enableFeature (libmodplug != null) "libmodplug")
-    (enableFeature (libmysofa != null) "libmysofa")
-    #(enableFeature (libnut != null) "libnut")
-    (enableFeature (libopenmpt != null) "libopenmpt")
-    (enableFeature (libopus != null) "libopus")
-    (enableFeature (librsvg != null) "librsvg")
-    (enableFeature (srt != null) "libsrt")
-    (enableFeature (libssh != null) "libssh")
-    (enableFeature (libtheora != null) "libtheora")
-    (enableFeature (if isLinux then libv4l != null else false) "libv4l2")
-    (enableFeature ((isLinux || isFreeBSD) && libva != null) "vaapi")
-    (enableFeature (libvdpau != null) "vdpau")
-    (enableFeature (libvorbis != null) "libvorbis")
-    (enableFeature (!isAarch64 && libvmaf != null && version3Licensing) "libvmaf")
-    (enableFeature (libvpx != null) "libvpx")
-    (enableFeature (libwebp != null) "libwebp")
-    (enableFeature (libX11 != null && libXv != null && libXext != null) "xlib")
-    (enableFeature (libxcb != null) "libxcb")
-    (enableFeature libxcbshmExtlib "libxcb-shm")
-    (enableFeature libxcbxfixesExtlib "libxcb-xfixes")
-    (enableFeature libxcbshapeExtlib "libxcb-shape")
-    (enableFeature (libxml2 != null) "libxml2")
-    (enableFeature (xz != null) "lzma")
-    (enableFeature nvdec "cuvid")
-    (enableFeature nvdec "nvdec")
-    (enableFeature nvenc "nvenc")
-    (enableFeature (openal != null) "openal")
-    (enableFeature (ocl-icd != null && opencl-headers != null) "opencl")
-    (enableFeature (opencore-amr != null && version3Licensing) "libopencore-amrnb")
-    #(enableFeature (opencv != null) "libopencv")
-    (enableFeature openglExtlib "opengl")
-    (enableFeature (openh264 != null) "libopenh264")
-    (enableFeature (openjpeg != null) "libopenjpeg")
-    (enableFeature (opensslExtlib && gplLicensing) "openssl")
-    (enableFeature (libpulseaudio != null) "libpulse")
-    #(enableFeature quvi "libquvi")
-    (enableFeature (rav1e != null) "librav1e")
-    (enableFeature (svt-av1 != null) "libsvtav1")
-    (enableFeature (rtmpdump != null) "librtmp")
-    #(enableFeature (schroedinger != null) "libschroedinger")
-    (enableFeature (SDL2 != null) "sdl2")
-    (enableFeature (soxr != null) "libsoxr")
-    (enableFeature (speex != null) "libspeex")
-    #(enableFeature (twolame != null) "libtwolame")
-    #(enableFeature (utvideo != null && gplLicensing) "libutvideo")
-    (enableFeature (vid-stab != null && gplLicensing) "libvidstab") # Actual min. version 2.0
-    #(enableFeature (vo-aacenc != null && version3Licensing) "libvo-aacenc")
-    (enableFeature (vo-amrwbenc != null && version3Licensing) "libvo-amrwbenc")
-    (enableFeature (x264 != null && gplLicensing) "libx264")
-    (enableFeature (x265 != null && gplLicensing) "libx265")
-    (enableFeature (xavs != null && gplLicensing) "libxavs")
-    (enableFeature (xvidcore != null && gplLicensing) "libxvid")
-    (enableFeature (zeromq4 != null) "libzmq")
-    (enableFeature (zimg != null) "libzimg")
-    (enableFeature (zlib != null) "zlib")
-    (enableFeature (isLinux && vulkan-loader != null) "vulkan")
-    (enableFeature (isLinux && vulkan-loader != null && glslang != null) "libglslang")
-    (enableFeature (samba != null && gplLicensing && version3Licensing) "libsmbclient")
-    #(enableFeature (zvbi != null && gplLicensing) "libzvbi")
-    /*
-     * Developer flags
-     */
-    (enableFeature debugDeveloper "debug")
-    (enableFeature optimizationsDeveloper "optimizations")
-    (enableFeature extraWarningsDeveloper "extra-warnings")
-    (enableFeature strippingDeveloper "stripping")
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--cross-prefix=${stdenv.cc.targetPrefix}"
-    "--enable-cross-compile"
-    "--host-cc=${buildPackages.stdenv.cc}/bin/cc"
-  ] ++ optionals stdenv.cc.isClang [
-    "--cc=clang"
-    "--cxx=clang++"
-  ];
-
-  nativeBuildInputs = [ addOpenGLRunpath perl pkg-config texinfo yasm ];
-
-  buildInputs = [
-    bzip2 celt dav1d fontconfig freetype frei0r fribidi game-music-emu gnutls gsm
-    libjack2 ladspaH lame libaom libass libbluray libbs2b libcaca libdc1394 libmodplug libmysofa
-    libogg libopenmpt libopus librsvg libssh libtheora libvdpau libvorbis libvpx libwebp libX11
-    libxcb libXv libXext libxml2 xz openal ocl-icd opencl-headers openjpeg libpulseaudio rav1e svt-av1 rtmpdump opencore-amr
-    samba SDL2 soxr speex srt vid-stab vo-amrwbenc x264 x265 xavs xvidcore
-    zeromq4 zimg zlib openh264
-  ] ++ optionals openglExtlib [ libGL libGLU ]
-    ++ optionals nonfreeLicensing [ fdk_aac openssl ]
-    ++ optional ((isLinux || isFreeBSD) && libva != null) libva
-    ++ optional ((isLinux || isFreeBSD) && libdrm != null) libdrm
-    ++ optional (!isAarch64 && libvmaf != null && version3Licensing) libvmaf
-    ++ optionals isLinux [ alsa-lib libraw1394 libv4l vulkan-loader glslang ]
-    ++ optional (isLinux && !isAarch64 && libmfx != null) libmfx
-    ++ optional (nvdec || nvenc) nv-codec-headers
-    ++ optional cuda-llvm clang
-    ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
-                                   MediaToolbox VideoDecodeAcceleration VideoToolbox
-                                   libiconv ];
-
-  buildFlags = [ "all" ]
-    ++ optional qtFaststartProgram "tools/qt-faststart"; # Build qt-faststart executable
-
-  doCheck = true;
-  checkPhase = let
-    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
-  in ''
-    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
-      make check -j$NIX_BUILD_CORES
-  '';
-
-  # Hacky framework patching technique borrowed from the phantomjs2 package
-  postInstall = optionalString qtFaststartProgram ''
-    cp -a tools/qt-faststart $out/bin/
-  '';
-
-  postFixup = optionalString stdenv.isLinux ''
-    # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
-    # See the explanation in addOpenGLRunpath.
-    addOpenGLRunpath $out/lib/libavcodec.so
-    addOpenGLRunpath $out/lib/libavutil.so
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "A complete, cross-platform solution to record, convert and stream audio and video";
-    homepage = "https://www.ffmpeg.org/";
-    changelog = "https://github.com/FFmpeg/FFmpeg/blob/n${version}/Changelog";
-    longDescription = ''
-      FFmpeg is the leading multimedia framework, able to decode, encode, transcode,
-      mux, demux, stream, filter and play pretty much anything that humans and machines
-      have created. It supports the most obscure ancient formats up to the cutting edge.
-      No matter if they were designed by some standards committee, the community or
-      a corporation.
-    '';
-    license = (
-      if nonfreeLicensing then
-        licenses.unfreeRedistributable
-      else if version3Licensing then
-        licenses.gpl3
-      else if gplLicensing then
-        licenses.gpl2Plus
-      else
-        licenses.lgpl21Plus
-    );
-    platforms = platforms.all;
-    maintainers = with maintainers; [ codyopel ];
-  };
-}
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index ac88df93076..7882c19da8f 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,8 +1,4 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (rec {
+import ./generic.nix rec {
   version = "4.4.3";
-  branch = version;
-  sha256 = "sha256-M7jC281TD+HbVxBBU0Vgm0yiJ70NoeOpMy27DxH9Jzo=";
-
-} // args)
+  sha256 = "sha256-zZDzG1hD+0AHqElzeGR6OVm+H5wqtdktloSPmEUzT/c=";
+}
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index b19c22a55f3..7ff9b1fc2e4 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,7 +1,4 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (rec {
+import ./generic.nix rec {
   version = "5.1.2";
-  branch = version;
-  sha256 = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
-} // args)
+  sha256 = "sha256-4jcfwIE0/DgP7ibwkrSm/aPiHIMFn34JNcXkCMx4ceI=";
+}
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 01995e9237b..d0374c74901 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,205 +1,666 @@
-{ lib, stdenv, buildPackages, fetchurl, pkg-config, addOpenGLRunpath, perl, texinfo, yasm
-, alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
-, libssh, libtheora, libva, libdrm, libvorbis, xz, soxr
-, x264, x265, xvidcore, zimg, zlib, libopus, speex, nv-codec-headers, dav1d
-, vpxSupport ? !stdenv.isAarch32, libvpx
-, srtSupport ? true, srt
-, vaapiSupport ? ((stdenv.isLinux || stdenv.isFreeBSD) && !stdenv.isAarch32)
-, openglSupport ? false, libGLU, libGL
-, libmfxSupport ? false, intel-media-sdk
-, libaomSupport ? false, libaom
-# Build options
-, runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime
-, multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, sdlSupport ? !stdenv.isAarch32, SDL2
-, vdpauSupport ? !stdenv.isAarch32, libvdpau
-# Developer options
-, debugDeveloper ? false
-, optimizationsDeveloper ? true
-, extraWarningsDeveloper ? false
-, Cocoa, CoreMedia, VideoToolbox
-# Inherit generics
-, branch, sha256, version, patches ? [], knownVulnerabilities ? []
-, doCheck ? true
-, pulseaudioSupport ? stdenv.isLinux
+{ version, sha256, extraPatches ? [], knownVulnerabilities ? [] }:
+
+{ lib, stdenv, buildPackages, removeReferencesTo, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
+
+, ffmpegVariant ? "small" # Decides which dependencies are enabled by default
+
+  # Build with headless deps; excludes dependencies that are only necessary for
+  # GUI applications. To be used for purposes that don't generally need such
+  # components and i.e. only depend on libav
+, withHeadlessDeps ? ffmpegVariant == "headless" || withSmallDeps
+
+  # Dependencies a user might customarily expect from a regular ffmpeg build.
+  # /All/ packages that depend on ffmpeg and some of its feaures should depend
+  # on the small variant. Small means the minimal set of features that satisfies
+  # all dependants in Nixpkgs
+, withSmallDeps ? ffmpegVariant == "small" || withFullDeps
+
+  # Everything enabled; only guarded behind platform exclusivity or brokeness.
+  # If you need to depend on ffmpeg-full because ffmpeg is missing some feature
+  # your package needs, you should enable that feature in regular ffmpeg
+  # instead.
+, withFullDeps ? ffmpegVariant == "full"
+
+, fetchgit
+, fetchpatch
+
+  # Feature flags
+, withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
+, withAom ? withFullDeps # AV1 reference encoder
+, withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
+, withBluray ? withFullDeps # BluRay reading
+, withBs2b ? withFullDeps # bs2b DSP library
+, withBzlib ? withHeadlessDeps
+, withCaca ? withFullDeps # Textual display (ASCII art)
+, withCelt ? withFullDeps # CELT decoder
+, withCrystalhd ? withFullDeps
+, withCuda ? withFullDeps && (with stdenv; (!isDarwin && !isAarch64))
+, withCudaLLVM ? withFullDeps
+, withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
+, withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
+, withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
+, withFdkAac ? withFullDeps && withUnfree # Fraunhofer FDK AAC de/encoder
+, withFontconfig ? withHeadlessDeps # Needed for drawtext filter
+, withFreetype ? withHeadlessDeps # Needed for drawtext filter
+, withFrei0r ? withFullDeps # frei0r video filtering
+, withFribidi ? withFullDeps # Needed for drawtext filter
+, withGlslang ? withFullDeps && !stdenv.isDarwin
+, withGme ? withFullDeps # Game Music Emulator
+, withGnutls ? withHeadlessDeps
+, withGsm ? withFullDeps # GSM de/encoder
+, withIconv ? withHeadlessDeps
+, withIlbc ? withFullDeps
+, withJack ? withFullDeps && !stdenv.isDarwin # Jack audio
+, withLadspa ? withFullDeps # LADSPA audio filtering
+, withLzma ? withHeadlessDeps # xz-utils
+, withMfx ? withFullDeps && (with stdenv.targetPlatform; isLinux && !isAarch) # Hardware acceleration via intel-media-sdk/libmfx
+, withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
+, withMp3lame ? withHeadlessDeps # LAME MP3 encoder
+, withMysofa ? withFullDeps # HRTF support via SOFAlizer
+, withNvdec ? withHeadlessDeps && !stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform
+, withNvenc ? withHeadlessDeps && !stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform
+, withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
+, withOpenal ? withFullDeps # OpenAL 1.1 capture support
+, withOpencl ? withFullDeps
+, withOpencoreAmrnb ? withFullDeps # AMR-NB de/encoder & AMR-WB decoder
+, withOpengl ? false # OpenGL rendering
+, withOpenh264 ? withFullDeps # H.264/AVC encoder
+, withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
+, withOpenmpt ? withFullDeps # Tracked music files decoder
+, withOpus ? withHeadlessDeps # Opus de/encoder
+, withPulse ? withSmallDeps && !stdenv.isDarwin # Pulseaudio input support
+, withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
+, withRtmp ? false # RTMP[E] support
+, withSamba ? withFullDeps && !stdenv.isDarwin # Samba protocol
+, withSdl2 ? withSmallDeps
+, withSoxr ? withHeadlessDeps # Resampling via soxr
+, withSpeex ? withHeadlessDeps # Speex de/encoder
+, withSrt ? withHeadlessDeps # Secure Reliable Transport (SRT) protocol
+, withSsh ? withHeadlessDeps # SFTP protocol
+, withSvg ? withFullDeps # SVG protocol
+, withSvtav1 ? withFullDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
+, withTheora ? withHeadlessDeps # Theora encoder
+, withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
+, withV4l2M2m ? withV4l2
+, withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
+, withVdpau ? withSmallDeps # Vdpau hardware acceleration
+, withVidStab ? withFullDeps # Video stabilization
+, withVmaf ? withFullDeps && withGPLv3 && !stdenv.isAarch64 # Netflix's VMAF (Video Multi-Method Assessment Fusion)
+, withVoAmrwbenc ? withFullDeps # AMR-WB encoder
+, withVorbis ? withHeadlessDeps # Vorbis de/encoding, native encoder exists
+, withVpx ? withHeadlessDeps && stdenv.buildPlatform == stdenv.hostPlatform # VP8 & VP9 de/encoding
+, withVulkan ? withFullDeps && !stdenv.isDarwin
+, withWebp ? withFullDeps # WebP encoder
+, withX264 ? withHeadlessDeps # H.264/AVC encoder
+, withX265 ? withHeadlessDeps # H.265/HEVC encoder
+, withXavs ? withFullDeps # AVS encoder
+, withXcb ? withXcbShm || withXcbxfixes || withXcbShape # X11 grabbing using XCB
+, withXcbShape ? withFullDeps # X11 grabbing shape rendering
+, withXcbShm ? withFullDeps # X11 grabbing shm communication
+, withXcbxfixes ? withFullDeps # X11 grabbing mouse rendering
+, withXlib ? withFullDeps # Xlib support
+, withXml2 ? withFullDeps # libxml2 support, for IMF and DASH demuxers
+, withXvid ? withHeadlessDeps # Xvid encoder, native encoder exists
+, withZimg ? withHeadlessDeps
+, withZlib ? withHeadlessDeps
+, withZmq ? withFullDeps # Message passing
+
+/*
+ *  Licensing options (yes some are listed twice, filters and such are not listed)
+ */
+, withGPL ? true
+, withGPLv3 ? true
+, withUnfree ? false
+
+/*
+ *  Build options
+ */
+, withSmallBuild ? false # Optimize for size instead of speed
+, withRuntimeCPUDetection ? true # Detect CPU capabilities at runtime (disable to compile natively)
+, withGrayscale ? withFullDeps # Full grayscale support
+, withSwscaleAlpha ? buildSwscale # Alpha channel support in swscale. You probably want this when buildSwscale.
+, withHardcodedTables ? withHeadlessDeps # Hardcode decode tables instead of runtime generation
+, withSafeBitstreamReader ? withHeadlessDeps # Buffer boundary checking in bitreaders
+, withMultithread ? true # Multithreading via pthreads/win32 threads
+, withNetwork ? withHeadlessDeps # Network support
+, withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
+, withLTO ? false # build with link-time optimization
+/*
+ *  Program options
+ */
+, buildFfmpeg ? withHeadlessDeps # Build ffmpeg executable
+, buildFfplay ? withFullDeps # Build ffplay executable
+, buildFfprobe ? withHeadlessDeps # Build ffprobe executable
+, buildQtFaststart ? withFullDeps # Build qt-faststart executable
+, withBin ? buildFfmpeg || buildFfplay || buildFfprobe || buildQtFaststart
+/*
+ *  Library options
+ */
+, buildAvcodec ? withHeadlessDeps # Build avcodec library
+, buildAvdevice ? withHeadlessDeps # Build avdevice library
+, buildAvfilter ? withHeadlessDeps # Build avfilter library
+, buildAvformat ? withHeadlessDeps # Build avformat library
+# Deprecated but depended upon by some packages.
+# https://github.com/NixOS/nixpkgs/pull/211834#issuecomment-1417435991)
+, buildAvresample ? withHeadlessDeps && lib.versionOlder version "5" # Build avresample library
+, buildAvutil ? withHeadlessDeps # Build avutil library
+, buildPostproc ? withHeadlessDeps # Build postproc library
+, buildSwresample ? withHeadlessDeps # Build swresample library
+, buildSwscale ? withHeadlessDeps # Build swscale library
+, withLib ? buildAvcodec
+  || buildAvdevice
+  || buildAvfilter
+  || buildAvformat
+  || buildAvutil
+  || buildPostproc
+  || buildSwresample
+  || buildSwscale
+/*
+ *  Documentation options
+ */
+, withDocumentation ? withHtmlDoc || withManPages || withPodDoc || withTxtDoc
+, withHtmlDoc ? withHeadlessDeps # HTML documentation pages
+, withManPages ? withHeadlessDeps # Man documentation pages
+, withPodDoc ? withHeadlessDeps # POD documentation pages
+, withTxtDoc ? withHeadlessDeps # Text documentation pages
+# Whether a "doc" output will be produced. Note that withManPages does not produce
+# a "doc" output because its files go to "man".
+, withDoc ? withDocumentation && (withHtmlDoc || withPodDoc || withTxtDoc)
+
+/*
+ *  Developer options
+ */
+, withDebug ? false
+, withOptimisations ? true
+, withExtraWarnings ? false
+, withStripping ? false
+
+/*
+ *  External libraries options
+ */
+, alsa-lib
+, bzip2
+, clang
+, celt
+, dav1d
+, fdk_aac
+, fontconfig
+, freetype
+, frei0r
+, fribidi
+, game-music-emu
+, gnutls
+, gsm
+, libjack2
+, ladspaH
+, lame
+, libass
+, libaom
+, libbluray
+, libbs2b
+, libcaca
+, libdc1394
+, libraw1394
+, libdrm
+, libiconv
+, intel-media-sdk
+, libmodplug
+, libmysofa
+, libogg
+, libopenmpt
+, libopus
+, librsvg
+, libssh
+, libtheora
+, libv4l
+, libva
+, libva-minimal
+, libvdpau
+, libvmaf
+, libvorbis
+, libvpx
+, libwebp
+, libX11
+, libxcb
+, libXv
+, libXext
+, libxml2
+, xz
+, nv-codec-headers
+, openal
+, ocl-icd # OpenCL ICD
+, opencl-headers  # OpenCL headers
+, opencore-amr
+, libGL
+, libGLU
+, openh264
+, openjpeg
 , libpulseaudio
-, ...
+, rav1e
+, svt-av1
+, rtmpdump
+, samba
+, SDL2
+, soxr
+, speex
+, srt
+, vid-stab
+, vo-amrwbenc
+, x264
+, x265
+, xavs
+, xvidcore
+, zeromq4
+, zimg
+, zlib
+, vulkan-loader
+, glslang
+/*
+ *  Darwin frameworks
+ */
+, AVFoundation
+, Cocoa
+, CoreAudio
+, CoreMedia
+, CoreServices
+, MediaToolbox
+, VideoDecodeAcceleration
+, VideoToolbox
+/*
+ *  Testing
+ */
+, testers
 }:
 
 /* Maintainer notes:
  *
- * THIS IS A MINIMAL BUILD OF FFMPEG, do not include dependencies unless
- * a build that depends on ffmpeg requires them to be compiled into ffmpeg,
- * see `ffmpeg-full' for an ffmpeg build with all features included.
- *
- * Need fixes to support Darwin:
- *   pulseaudio
+ * Version bumps:
+ * It should always be safe to bump patch releases (e.g. 2.1.x, x being a patch release)
+ * If adding a new branch, note any configure flags that were added, changed, or deprecated/removed
+ *   and make the necessary changes.
  *
  * Known issues:
- * ALL     - Cross-compiling will disable features not present on host OS
- *           (e.g. dxva2 support [DirectX] will not be enabled unless natively
- *           compiled on Cygwin)
+ * Cross-compiling will disable features not present on host OS
+ *   (e.g. dxva2 support [DirectX] will not be enabled unless natively compiled on Cygwin)
  *
  */
 
 let
-  inherit (lib) optional optionals optionalString enableFeature filter;
+  inherit (stdenv) isCygwin isDarwin isFreeBSD isLinux isAarch64;
+  inherit (lib) optional optionals optionalString enableFeature;
+in
 
-  reqMin = requiredVersion: (builtins.compareVersions requiredVersion branch != 1);
 
-  ifMinVer = minVer: flag: if reqMin minVer then flag else null;
+assert lib.elem ffmpegVariant [ "headless" "small" "full" ];
 
-  ifVerOlder = maxVer: flag: if (lib.versionOlder branch maxVer) then flag else null;
-in
+/*
+ *  Licensing dependencies
+ */
+assert withGPLv3 -> withGPL;
+assert withUnfree -> withGPL && withGPLv3;
+/*
+ *  Build dependencies
+ */
+assert withPixelutils -> buildAvutil;
+/*
+ *  Program dependencies
+ */
+assert buildFfmpeg -> buildAvcodec
+                     && buildAvfilter
+                     && buildAvformat
+                     && (buildSwresample || buildAvresample);
+assert buildFfplay -> buildAvcodec
+                     && buildAvformat
+                     && buildSwscale
+                     && (buildSwresample || buildAvresample);
+assert buildFfprobe -> buildAvcodec && buildAvformat;
+/*
+ *  Library dependencies
+ */
+assert buildAvcodec -> buildAvutil; # configure flag since 0.6
+assert buildAvdevice -> buildAvformat
+                       && buildAvcodec
+                       && buildAvutil; # configure flag since 0.6
+assert buildAvformat -> buildAvcodec && buildAvutil; # configure flag since 0.6
+assert buildPostproc -> buildAvutil;
+assert buildSwscale -> buildAvutil;
 
-stdenv.mkDerivation rec {
-  pname = "ffmpeg";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ffmpeg" + (if ffmpegVariant == "small" then "" else "-${ffmpegVariant}");
   inherit version;
 
-  src = fetchurl {
-    url = "https://www.ffmpeg.org/releases/${pname}-${version}.tar.bz2";
+  src = fetchgit {
+    url = "https://git.ffmpeg.org/ffmpeg.git";
+    rev = "n${finalAttrs.version}";
     inherit sha256;
   };
 
-  postPatch = "patchShebangs .";
-  inherit patches;
+  postPatch = ''
+    patchShebangs .
+  '' + lib.optionalString withFrei0r ''
+    substituteInPlace libavfilter/vf_frei0r.c \
+      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
+    substituteInPlace doc/filters.texi \
+      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
+  '';
 
-  outputs = [ "bin" "dev" "out" "man" "doc" ];
-  setOutputFlags = false; # doesn't accept all and stores configureFlags in libs!
+  patches = map (patch: fetchpatch patch) extraPatches;
 
   configurePlatforms = [];
-  configureFlags = filter (v: v != null) ([
-      "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-      "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
-      "--pkg-config=${buildPackages.pkg-config.targetPrefix}pkg-config"
-    # License
-      "--enable-gpl"
-      "--enable-version3"
-    # Build flags
-      "--enable-shared"
-      "--enable-pic"
-      (ifMinVer "4.0" (enableFeature srtSupport "libsrt"))
-      (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
-      "--enable-hardcoded-tables"
-    ] ++
-      (if multithreadBuild then (
-         if stdenv.isCygwin then
-           ["--disable-pthreads" "--enable-w32threads"]
-         else # Use POSIX threads by default
-           ["--enable-pthreads" "--disable-w32threads"])
-       else
-         ["--disable-pthreads" "--disable-w32threads"])
-    ++ [
-      "--disable-os2threads" # We don't support OS/2
-      "--enable-network"
-      "--enable-pixelutils"
-    # Executables
-      "--enable-ffmpeg"
-      "--disable-ffplay"
-      "--enable-ffprobe"
-      (ifVerOlder "4" "--disable-ffserver")
-    # Libraries
-      "--enable-avcodec"
-      "--enable-avdevice"
-      "--enable-avfilter"
-      "--enable-avformat"
-      (ifVerOlder "5.0" "--enable-avresample")
-      "--enable-avutil"
-      "--enable-postproc"
-      "--enable-swresample"
-      "--enable-swscale"
-    # Docs
-      "--disable-doc"
-    # External Libraries
-      "--enable-libass"
-      "--enable-bzlib"
-      "--enable-gnutls"
-      "--enable-fontconfig"
-      "--enable-libfreetype"
-      "--enable-libmp3lame"
-      "--enable-iconv"
-      "--enable-libtheora"
-      "--enable-libssh"
-      (enableFeature vaapiSupport "vaapi")
-      (enableFeature vaapiSupport "libdrm")
-      (enableFeature vdpauSupport "vdpau")
-      "--enable-libvorbis"
-      (enableFeature vpxSupport "libvpx")
-      "--enable-lzma"
-      (enableFeature openglSupport "opengl")
-      (ifMinVer "4.2" (enableFeature libmfxSupport "libmfx"))
-      (ifMinVer "4.2" (enableFeature libaomSupport "libaom"))
-      (lib.optionalString pulseaudioSupport "--enable-libpulse")
-      (enableFeature sdlSupport "sdl2")
-      "--enable-libsoxr"
-      "--enable-libx264"
-      "--enable-libxvid"
-      "--enable-libzimg"
-      "--enable-zlib"
-      "--enable-libopus"
-      "--enable-libspeex"
-      "--enable-libx265"
-      (ifMinVer "4.2" (enableFeature (reqMin "4.2") "libdav1d"))
-    # Developer flags
-      (enableFeature debugDeveloper "debug")
-      (enableFeature optimizationsDeveloper "optimizations")
-      (enableFeature extraWarningsDeveloper "extra-warnings")
-      "--disable-stripping"
+  setOutputFlags = false; # Only accepts some of them
+  configureFlags = [
+    #mingw64 is internally treated as mingw32, so 32 and 64 make no difference here
+    "--target_os=${if stdenv.hostPlatform.isMinGW then "mingw64" else stdenv.hostPlatform.parsed.kernel.name}"
+    "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
+    "--pkg-config=${buildPackages.pkg-config.targetPrefix}pkg-config"
+    /*
+     *  Licensing flags
+     */
+    (enableFeature withGPL "gpl")
+    (enableFeature withGPLv3 "version3")
+    (enableFeature withUnfree "nonfree")
+    /*
+     *  Build flags
+     */
+    # On some ARM platforms --enable-thumb
+    "--enable-shared"
+    "--enable-pic"
+
+    (enableFeature withSmallBuild "small")
+    (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
+    (enableFeature withLTO "lto")
+    (enableFeature withGrayscale "gray")
+    (enableFeature withSwscaleAlpha "swscale-alpha")
+    (enableFeature withHardcodedTables "hardcoded-tables")
+    (enableFeature withSafeBitstreamReader "safe-bitstream-reader")
+
+    (enableFeature (withMultithread && stdenv.targetPlatform.isUnix) "pthreads")
+    (enableFeature (withMultithread && stdenv.targetPlatform.isWindows) "w32threads")
+    "--disable-os2threads" # We don't support OS/2
+
+    (enableFeature withNetwork "network")
+    (enableFeature withPixelutils "pixelutils")
+
+    "--datadir=${placeholder "data"}/share/ffmpeg"
+
+    /*
+     *  Program flags
+     */
+    (enableFeature buildFfmpeg "ffmpeg")
+    (enableFeature buildFfplay "ffplay")
+    (enableFeature buildFfprobe "ffprobe")
+  ] ++ optionals withBin [
+    "--bindir=${placeholder "bin"}/bin"
+  ] ++ [
+    /*
+     *  Library flags
+     */
+    (enableFeature buildAvcodec "avcodec")
+    (enableFeature buildAvdevice "avdevice")
+    (enableFeature buildAvfilter "avfilter")
+    (enableFeature buildAvformat "avformat")
+  ] ++ optionals (lib.versionOlder version "5") [
+    # Ffmpeg > 4 doesn't know about the flag anymore
+    (enableFeature buildAvresample "avresample")
+  ] ++ [
+    (enableFeature buildAvutil "avutil")
+    (enableFeature (buildPostproc && withGPL) "postproc")
+    (enableFeature buildSwresample "swresample")
+    (enableFeature buildSwscale "swscale")
+  ] ++ optionals withLib [
+    "--libdir=${placeholder "lib"}/lib"
+    "--incdir=${placeholder "dev"}/include"
+  ] ++ [
+    /*
+     *  Documentation flags
+     */
+    (enableFeature withDocumentation "doc")
+    (enableFeature withHtmlDoc "htmlpages")
+    (enableFeature withManPages "manpages")
+  ] ++ optionals withManPages [
+    "--mandir=${placeholder "man"}/share/man"
+  ] ++ [
+    (enableFeature withPodDoc "podpages")
+    (enableFeature withTxtDoc "txtpages")
+  ] ++ optionals withDoc [
+    "--docdir=${placeholder "doc"}/share/doc/ffmpeg"
+  ] ++ [
+    /*
+     *  External libraries
+     */
+    (enableFeature withAlsa "alsa")
+    (enableFeature withBzlib "bzlib")
+    (enableFeature withCelt "libcelt")
+    (enableFeature withCuda "cuda")
+    (enableFeature withCudaLLVM "cuda-llvm")
+    (enableFeature withDav1d "libdav1d")
+    (enableFeature withFdkAac "libfdk-aac")
+    "--disable-libflite" # Force disable until a solution is found
+    (enableFeature withFontconfig "fontconfig")
+    (enableFeature withFreetype "libfreetype")
+    (enableFeature withFrei0r "frei0r")
+    (enableFeature withFribidi "libfribidi")
+    (enableFeature withGme "libgme")
+    (enableFeature withGnutls "gnutls")
+    (enableFeature withGsm "libgsm")
+    (enableFeature withLadspa "ladspa")
+    (enableFeature withMp3lame "libmp3lame")
+    (enableFeature withAom "libaom")
+    (enableFeature withAss "libass")
+    (enableFeature withBluray "libbluray")
+    (enableFeature withBs2b "libbs2b")
+    (enableFeature withDc1394 "libdc1394")
+    (enableFeature withDrm "libdrm")
+    (enableFeature withIconv "iconv")
+    (enableFeature withJack "libjack")
+    (enableFeature withMfx "libmfx")
+    (enableFeature withModplug "libmodplug")
+    (enableFeature withMysofa "libmysofa")
+    (enableFeature withOpus "libopus")
+    (enableFeature withSvg "librsvg")
+    (enableFeature withSrt "libsrt")
+    (enableFeature withSsh "libssh")
+    (enableFeature withTheora "libtheora")
+    (enableFeature withV4l2 "libv4l2")
+    (enableFeature withV4l2M2m "v4l2-m2m")
+    (enableFeature withVaapi "vaapi")
+    (enableFeature withVdpau "vdpau")
+    (enableFeature withVorbis "libvorbis")
+    (enableFeature withVmaf "libvmaf")
+    (enableFeature withVpx "libvpx")
+    (enableFeature withWebp "libwebp")
+    (enableFeature withXlib "xlib")
+    (enableFeature withXcb "libxcb")
+    (enableFeature withXcbShm "libxcb-shm")
+    (enableFeature withXcbxfixes "libxcb-xfixes")
+    (enableFeature withXcbShape "libxcb-shape")
+    (enableFeature withXml2 "libxml2")
+    (enableFeature withLzma "lzma")
+    (enableFeature withNvdec "cuvid")
+    (enableFeature withNvdec "nvdec")
+    (enableFeature withNvenc "nvenc")
+    (enableFeature withOpenal "openal")
+    (enableFeature withOpencl "opencl")
+    (enableFeature withOpencoreAmrnb "libopencore-amrnb")
+    (enableFeature withOpengl "opengl")
+    (enableFeature withOpenh264 "libopenh264")
+    (enableFeature withOpenjpeg "libopenjpeg")
+    (enableFeature withOpenmpt "libopenmpt")
+    (enableFeature withPulse "libpulse")
+    (enableFeature withRav1e "librav1e")
+    (enableFeature withSvtav1 "libsvtav1")
+    (enableFeature withRtmp "librtmp")
+    (enableFeature withSdl2 "sdl2")
+    (enableFeature withSoxr "libsoxr")
+    (enableFeature withSpeex "libspeex")
+    (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
+    (enableFeature withVoAmrwbenc "libvo-amrwbenc")
+    (enableFeature withX264 "libx264")
+    (enableFeature withX265 "libx265")
+    (enableFeature withXavs "libxavs")
+    (enableFeature withXvid "libxvid")
+    (enableFeature withZmq "libzmq")
+    (enableFeature withZimg "libzimg")
+    (enableFeature withZlib "zlib")
+    (enableFeature withVulkan "vulkan")
+    (enableFeature withGlslang "libglslang")
+    (enableFeature withSamba "libsmbclient")
+    /*
+     * Developer flags
+     */
+    (enableFeature withDebug "debug")
+    (enableFeature withOptimisations "optimizations")
+    (enableFeature withExtraWarnings "extra-warnings")
+    (enableFeature withStripping "stripping")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "--cross-prefix=${stdenv.cc.targetPrefix}"
-      "--enable-cross-compile"
-  ] ++ optional stdenv.cc.isClang "--cc=clang");
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ addOpenGLRunpath perl pkg-config texinfo yasm ];
-
-  buildInputs = [
-    bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex nv-codec-headers
-  ] ++ optionals openglSupport [ libGL libGLU ]
-    ++ optional libmfxSupport intel-media-sdk
-    ++ optional libaomSupport libaom
-    ++ optional vpxSupport libvpx
-    ++ optionals (!stdenv.isDarwin && pulseaudioSupport) [ libpulseaudio ] # Need to be fixed on Darwin
-    ++ optionals vaapiSupport [ libva libdrm ]
-    ++ optional stdenv.isLinux alsa-lib
-    ++ optionals stdenv.isDarwin [ Cocoa CoreMedia VideoToolbox ]
-    ++ optional vdpauSupport libvdpau
-    ++ optional sdlSupport SDL2
-    ++ optional srtSupport srt
-    ++ optional (reqMin "4.2") dav1d;
+    "--cross-prefix=${stdenv.cc.targetPrefix}"
+    "--enable-cross-compile"
+    "--host-cc=${buildPackages.stdenv.cc}/bin/cc"
+  ] ++ optionals stdenv.cc.isClang [
+    "--cc=clang"
+    "--cxx=clang++"
+  ];
 
-  enableParallelBuilding = true;
+  # ffmpeg embeds the configureFlags verbatim in its binaries and because we
+  # configure binary, include, library dir etc., this causes references in
+  # outputs where we don't want them. Patch the generated config.h to remove all
+  # such references except for data.
+  postConfigure = let
+    toStrip = lib.remove "data" finalAttrs.outputs; # We want to keep references to the data dir.
+  in
+    "remove-references-to ${lib.concatStringsSep " " (map (o: "-t ${placeholder o}") toStrip)} config.h";
+
+  nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ];
+
+  # TODO This was always in buildInputs before, why?
+  buildInputs = optionals withFullDeps [ libdc1394 ]
+  ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
+  ++ optionals (withNvdec || withNvenc) [ nv-codec-headers ]
+  ++ optionals withAlsa [ alsa-lib ]
+  ++ optionals withAom [ libaom ]
+  ++ optionals withAss [ libass ]
+  ++ optionals withBluray [ libbluray ]
+  ++ optionals withBs2b [ libbs2b ]
+  ++ optionals withBzlib [ bzip2 ]
+  ++ optionals withCaca [ libcaca ]
+  ++ optionals withCelt [ celt ]
+  ++ optionals withCudaLLVM [ clang ]
+  ++ optionals withDav1d [ dav1d ]
+  ++ optionals withDrm [ libdrm ]
+  ++ optionals withFdkAac [ fdk_aac ]
+  ++ optionals withFontconfig [ fontconfig ]
+  ++ optionals withFreetype [ freetype ]
+  ++ optionals withFrei0r [ frei0r ]
+  ++ optionals withFribidi [ fribidi ]
+  ++ optionals withGlslang [ glslang ]
+  ++ optionals withGme [ game-music-emu ]
+  ++ optionals withGnutls [ gnutls ]
+  ++ optionals withGsm [ gsm ]
+  ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
+  ++ optionals withJack [ libjack2 ]
+  ++ optionals withLadspa [ ladspaH ]
+  ++ optionals withLzma [ xz ]
+  ++ optionals withMfx [ intel-media-sdk ]
+  ++ optionals withModplug [ libmodplug ]
+  ++ optionals withMp3lame [ lame ]
+  ++ optionals withMysofa [ libmysofa ]
+  ++ optionals withOgg [ libogg ]
+  ++ optionals withOpenal [ openal ]
+  ++ optionals withOpencl [ ocl-icd opencl-headers ]
+  ++ optionals withOpencoreAmrnb [ opencore-amr ]
+  ++ optionals withOpengl [ libGL libGLU ]
+  ++ optionals withOpenh264 [ openh264 ]
+  ++ optionals withOpenjpeg [ openjpeg ]
+  ++ optionals withOpenmpt [ libopenmpt ]
+  ++ optionals withOpus [ libopus ]
+  ++ optionals withPulse [ libpulseaudio ]
+  ++ optionals withRav1e [ rav1e ]
+  ++ optionals withRtmp [ rtmpdump ]
+  ++ optionals withSamba [ samba ]
+  ++ optionals withSdl2 [ SDL2 ]
+  ++ optionals withSoxr [ soxr ]
+  ++ optionals withSpeex [ speex ]
+  ++ optionals withSrt [ srt ]
+  ++ optionals withSsh [ libssh ]
+  ++ optionals withSvg [ librsvg ]
+  ++ optionals withSvtav1 [ svt-av1 ]
+  ++ optionals withTheora [ libtheora ]
+  ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
+  ++ optionals withVdpau [ libvdpau ]
+  ++ optionals withVidStab [ vid-stab ]
+  ++ optionals withVmaf [ libvmaf ]
+  ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
+  ++ optionals withVorbis [ libvorbis ]
+  ++ optionals withVpx [ libvpx ]
+  ++ optionals withV4l2 [ libv4l ]
+  ++ optionals withVulkan [ vulkan-loader ]
+  ++ optionals withWebp [ libwebp ]
+  ++ optionals withX264 [ x264 ]
+  ++ optionals withX265 [ x265 ]
+  ++ optionals withXavs [ xavs ]
+  ++ optionals withXcb [ libxcb ]
+  ++ optionals withXlib [ libX11 libXv libXext ]
+  ++ optionals withXml2 [ libxml2 ]
+  ++ optionals withXvid [ xvidcore ]
+  ++ optionals withZimg [ zimg ]
+  ++ optionals withZlib [ zlib ]
+  ++ optionals withZmq [ zeromq4 ]
+  ++ optionals stdenv.isDarwin [
+    # TODO fine-grained flags
+    AVFoundation
+    Cocoa
+    CoreAudio
+    CoreMedia
+    CoreServices
+    MediaToolbox
+    VideoDecodeAcceleration
+    VideoToolbox
+  ];
+
+  buildFlags = [ "all" ]
+    ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
+
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
-  inherit doCheck;
+  # Fails with SIGABRT otherwise FIXME: Why?
   checkPhase = let
     ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+    libsToLink = [ ]
+      ++ optional buildAvcodec "libavcodec"
+      ++ optional buildAvdevice "libavdevice"
+      ++ optional buildAvfilter "libavfilter"
+      ++ optional buildAvformat "libavformat"
+      ++ optional buildAvresample "libavresample"
+      ++ optional buildAvutil "libavutil"
+      ++ optional buildPostproc "libpostproc"
+      ++ optional buildSwresample "libswresample"
+      ++ optional buildSwscale "libswscale"
+    ;
   in ''
-    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavresample:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
-      make check -j$NIX_BUILD_CORES
+    ${ldLibraryPathEnv}="${lib.concatStringsSep ":" libsToLink}" make check -j$NIX_BUILD_CORES
   '';
 
-  # ffmpeg 3+ generates pkg-config (.pc) files that don't have the
-  # form automatically handled by the multiple-outputs hooks.
-  postFixup = ''
-    moveToOutput bin "$bin"
-    moveToOutput share/ffmpeg/examples "$doc"
-    for pc in ''${!outputDev}/lib/pkgconfig/*.pc; do
-      substituteInPlace $pc \
-        --replace "includedir=$out" "includedir=''${!outputInclude}"
-    done
-  '' + optionalString stdenv.isLinux ''
-    # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
-    # See the explanation in addOpenGLRunpath.
+  outputs = optionals withBin [ "bin" ] # The first output is the one that gets symlinked by default!
+    ++ optionals withLib [ "lib" "dev" ]
+    ++ optionals withDoc [ "doc" ]
+    ++ optionals withManPages [ "man" ]
+    ++ [ "data" "out" ] # We need an "out" output because we get an error otherwise. It's just an empty dir.
+  ;
+
+  postInstall = optionalString buildQtFaststart ''
+    install -D tools/qt-faststart -t $bin/bin
+  '';
+
+  # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
+  # See the explanation in addOpenGLRunpath.
+  postFixup = optionalString stdenv.isLinux ''
     addOpenGLRunpath $out/lib/libavcodec.so
     addOpenGLRunpath $out/lib/libavutil.so
   '';
 
-  installFlags = [ "install-man" ];
+  enableParallelBuilding = true;
 
-  passthru = {
-    inherit vaapiSupport vdpauSupport;
-  };
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
   meta = with lib; {
     description = "A complete, cross-platform solution to record, convert and stream audio and video";
@@ -212,9 +673,12 @@ stdenv.mkDerivation rec {
       No matter if they were designed by some standards committee, the community or
       a corporation.
     '';
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ ];
+    license = with licenses; [ lgpl21Plus ]
+      ++ optional withGPL gpl2Plus
+      ++ optional withGPLv3 gpl3Plus
+      ++ optional withUnfree unfreeRedistributable;
+    pkgConfigModules = [ "libavutil" ];
     platforms = platforms.all;
-    inherit branch knownVulnerabilities;
+    maintainers = with maintainers; [ atemu ];
   };
-}
+})
diff --git a/pkgs/development/libraries/fizz/default.nix b/pkgs/development/libraries/fizz/default.nix
index 2addb574826..f00980cdd9b 100644
--- a/pkgs/development/libraries/fizz/default.nix
+++ b/pkgs/development/libraries/fizz/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fizz";
-  version = "2023.01.30.00";
+  version = "2023.02.06.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "fizz";
     rev = "v${version}";
-    sha256 = "sha256-WyqDVoByBP91qGohNadr3iGpKEwZrURjr9mEaAdbfvs=";
+    sha256 = "sha256-JwRoIiSumT1jw5/VX/TkxpTJbrmLLke27xH8UHtrs2c=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/galario/default.nix b/pkgs/development/libraries/galario/default.nix
index 4000129f557..8b54cfb7b87 100644
--- a/pkgs/development/libraries/galario/default.nix
+++ b/pkgs/development/libraries/galario/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
   preCheck = ''
     ${if stdenv.isDarwin then "export DYLD_LIBRARY_PATH=$(pwd)/src/" else "export LD_LIBRARY_PATH=$(pwd)/src/"}
-    ${if enablePython then "sed -i -e 's|^#!.*|#!${stdenv.shell}|' python/py.test.sh" else ""}
+    ${lib.optionalString enablePython "sed -i -e 's|^#!.*|#!${stdenv.shell}|' python/py.test.sh"}
   '';
 
   cmakeFlags = lib.optionals enablePython [
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index 61106d7f620..5400c1de592 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -47,6 +47,15 @@ stdenv.mkDerivation rec {
     sha256 = "zd6A0VpJ2rmmFO+Y+ATIzm5M/hM5o8JAw08/tFQ2uF0=";
   };
 
+  patches = [
+    (fetchurl {
+      name = "libraw.patch";
+      url = "https://src.fedoraproject.org/cgit/rpms/gegl04.git/plain/"
+          + "libraw.patch?id=5efd0c16a7b0e73abcaecc48af544ef027f4531b";
+      hash = "sha256-ZgVigN1T7JmeBMwSdBsMsmXx0h7UW4Ft9HlSqeB0se8=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     gettext
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index ae5b9f48293..81f7abc90a3 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  LDFLAGS = if stdenv.isSunOS then "-lm -lmd -lmp -luutil -lnvpair -lnsl -lidmap -lavl -lsec" else "";
+  LDFLAGS = lib.optionalString stdenv.isSunOS "-lm -lmd -lmp -luutil -lnvpair -lnsl -lidmap -lavl -lsec";
 
   configureFlags = [
      "--disable-csharp" "--with-xz"
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 780a3e091da..a3c2e461849 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -169,7 +169,7 @@ stdenv.mkDerivation ({
   buildInputs = [ linuxHeaders ] ++ lib.optionals withGd [ gd libpng ] ++ extraBuildInputs;
 
   env = {
-    linuxHeaders = if withLinuxHeaders then linuxHeaders else "";
+    linuxHeaders = lib.optionalString withLinuxHeaders linuxHeaders;
     inherit (stdenv) is64bit;
     # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
     # prevent a retained dependency on the bootstrap tools in the stdenv-linux
diff --git a/pkgs/development/libraries/gloox/default.nix b/pkgs/development/libraries/gloox/default.nix
index 8fc57d865fd..69243a13ef3 100644
--- a/pkgs/development/libraries/gloox/default.nix
+++ b/pkgs/development/libraries/gloox/default.nix
@@ -14,6 +14,13 @@ stdenv.mkDerivation rec{
     sha256 = "1jgrd07qr9jvbb5hcmhrqz4w4lvwc51m30jls1fgxf1f5az6455f";
   };
 
+  # needed since gcc12
+  postPatch = ''
+    sed '1i#include <ctime>' -i \
+      src/tests/{tag/tag_perf.cpp,zlib/zlib_perf.cpp} \
+      src/examples/*.cpp
+  '';
+
   buildInputs = [ ]
     ++ lib.optional zlibSupport zlib
     ++ lib.optional sslSupport openssl
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index 0d14630bda3..590a4508c9b 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "gsl";
   version = "2.7.1";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnu/gsl/${pname}-${version}.tar.gz";
     sha256 = "sha256-3LD71DBIgyt1f/mUJpGo3XACbV2g/4VgHlJof23us0s=";
@@ -13,6 +15,10 @@ stdenv.mkDerivation rec {
     MACOSX_DEPLOYMENT_TARGET=10.16
   '' else null;
 
+  postInstall = ''
+    moveToOutput bin/gsl-config "$dev"
+  '';
+
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isx86_64 "-mno-fma";
 
diff --git a/pkgs/development/libraries/gsmlib/default.nix b/pkgs/development/libraries/gsmlib/default.nix
index ec6646d98f5..f993eeedc33 100644
--- a/pkgs/development/libraries/gsmlib/default.nix
+++ b/pkgs/development/libraries/gsmlib/default.nix
@@ -2,13 +2,21 @@
 stdenv.mkDerivation rec {
   pname = "gsmlib";
   version = "unstable-2017-10-06";
+
   src = fetchFromGitHub {
     owner = "x-logLT";
     repo = "gsmlib";
     rev = "4f794b14450132f81673f7d3570c5a859aecf7ae";
     sha256 = "16v8aj914ac1ipf14a867ljib3gy7fhzd9ypxnsg9l0zi8mm3ml5";
   };
+
   nativeBuildInputs = [ autoreconfHook ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   meta = with lib; {
     description = "Library to access GSM mobile phones through GSM modems";
     homepage = "https://github.com/x-logLT/gsmlib";
diff --git a/pkgs/development/libraries/gtest/default.nix b/pkgs/development/libraries/gtest/default.nix
index 049d202a71e..1dd68b077b2 100644
--- a/pkgs/development/libraries/gtest/default.nix
+++ b/pkgs/development/libraries/gtest/default.nix
@@ -1,4 +1,10 @@
-{ lib, stdenv, cmake, ninja, fetchFromGitHub }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, ninja
+, static ? stdenv.hostPlatform.isStatic,
+}:
 
 stdenv.mkDerivation rec {
   pname = "gtest";
@@ -19,7 +25,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ninja ];
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
+  ] ++ lib.optionals (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0")) [
+    # Enable C++17 support
+    # https://github.com/google/googletest/issues/3081
+    "-DCMAKE_CXX_STANDARD=17"
+  ];
 
   meta = with lib; {
     description = "Google's framework for writing C++ tests";
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 782823cd674..7a9904f31da 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -90,7 +90,6 @@ stdenv.mkDerivation rec {
   # Slightly hacky; some pkgs expect them in a single directory.
   postFixup = lib.optionalString withIcu ''
     rm "$out"/lib/libharfbuzz.* "$dev/lib/pkgconfig/harfbuzz.pc"
-    ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.la
     ln -s {'${harfbuzz.dev}',"$dev"}/lib/pkgconfig/harfbuzz.pc
     ${lib.optionalString stdenv.isDarwin ''
       ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.dylib
diff --git a/pkgs/development/libraries/hidapi/default.nix b/pkgs/development/libraries/hidapi/default.nix
index b29b64c2a75..e9bfe33e9f4 100644
--- a/pkgs/development/libraries/hidapi/default.nix
+++ b/pkgs/development/libraries/hidapi/default.nix
@@ -7,16 +7,17 @@
 , udev
 , Cocoa
 , IOKit
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hidapi";
   version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "hidapi";
-    rev = "${pname}-${version}";
+    rev = "${finalAttrs.pname}-${finalAttrs.version}";
     sha256 = "sha256-SMhlcB7LcViC6UFVYACjunxsGkvSOKC3mbLBH4XQSzM=";
   };
 
@@ -28,12 +29,20 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ Cocoa IOKit ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Library for communicating with USB and Bluetooth HID devices";
     homepage = "https://github.com/libusb/hidapi";
     maintainers = with maintainers; [ prusnak ];
     # You can choose between GPLv3, BSD or HIDAPI license (even more liberal)
     license = with licenses; [ bsd3 /* or */ gpl3Only ] ;
+    pkgConfigModules = lib.optionals stdenv.isDarwin [
+      "hidapi"
+    ] ++ lib.optionals stdenv.isLinux [
+      "hidapi-hidraw"
+      "hidapi-libusb"
+    ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index 66441a91160..324b4337c87 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, ncurses, readline, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "1.7.1";
+  version = "1.7.2";
   pname = "hunspell";
 
   src = fetchFromGitHub {
     owner = "hunspell";
     repo = "hunspell";
     rev = "v${version}";
-    sha256 = "sha256-J1kgNUElRO63mtU62qU7asf7hht9oyplMIO9I/E6BPU=";
+    sha256 = "sha256-x2FXxnVIqsf5/UEQcvchAndXBv/3mW8Z55djQAFgNA8=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/development/libraries/icu/63.nix b/pkgs/development/libraries/icu/63.nix
index 19838763f5b..a83e2cd5f5e 100644
--- a/pkgs/development/libraries/icu/63.nix
+++ b/pkgs/development/libraries/icu/63.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchurl, fetchpatch, fixDarwinDylibNames, nativeBuildRoot, buildRootOnly ? false }:
+{ stdenv, lib, fetchurl, fetchpatch, fixDarwinDylibNames, nativeBuildRoot, testers
+, buildRootOnly ? false
+}:
 
 import ./base.nix {
   version = "63.1";
@@ -11,4 +13,4 @@ import ./base.nix {
     })
   ];
   patchFlags = [ "-p3" ];
-} { inherit stdenv lib fetchurl fixDarwinDylibNames nativeBuildRoot buildRootOnly; }
+} { inherit stdenv lib fetchurl fixDarwinDylibNames nativeBuildRoot testers buildRootOnly; }
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index a714e758bd8..c5e46fa4530 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -2,6 +2,7 @@
 { stdenv, lib, fetchurl, fixDarwinDylibNames
   # Cross-compiled icu4c requires a build-root of a native compile
 , buildRootOnly ? false, nativeBuildRoot
+, testers
 }:
 
 let
@@ -45,6 +46,11 @@ let
       description = "Unicode and globalization support library";
       homepage = "https://icu.unicode.org/";
       maintainers = with maintainers; [ raskin ];
+      pkgConfigModules = [
+        "icu-i18n"
+        "icu-io"
+        "icu-uc"
+      ];
       platforms = platforms.all;
     };
   };
@@ -97,4 +103,6 @@ let
             then buildRootOnlyAttrs
           else realAttrs;
 in
-stdenv.mkDerivation attrs
+stdenv.mkDerivation (finalAttrs: attrs // {
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+})
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 66092f43650..02707c750c0 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -21,17 +21,18 @@
 , fluxbox
 , enlightenment
 , xorg
+, testers
 }:
 
 let
   inherit (lib) optional optionals;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "imlib2";
   version = "1.9.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.xz";
+    url = "mirror://sourceforge/enlightenment/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
     hash = "sha256-SiJAOL//vl1NJQxE4F9O5a4k3P74OVsWd8cVxY92TUM=";
   };
 
@@ -69,6 +70,8 @@ stdenv.mkDerivation rec {
       enlightenment;
   };
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Image manipulation library";
 
@@ -83,7 +86,8 @@ stdenv.mkDerivation rec {
     homepage = "https://docs.enlightenment.org/api/imlib2/html";
     changelog = "https://git.enlightenment.org/legacy/imlib2.git/plain/ChangeLog?h=v${version}";
     license = licenses.imlib2;
+    pkgConfigModules = [ "imlib2" ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ spwhitt ];
   };
-}
+})
diff --git a/pkgs/development/libraries/iqueue/default.nix b/pkgs/development/libraries/iqueue/default.nix
index 04fd7202d1d..ab873f82c57 100644
--- a/pkgs/development/libraries/iqueue/default.nix
+++ b/pkgs/development/libraries/iqueue/default.nix
@@ -12,6 +12,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libbsd microsoft_gsl ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-parameter"
+    "-Wno-error=misleading-indentation"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/twosigma/iqueue";
     description = "Indexed queue";
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 22b29151caa..4caea890e70 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "krb5-${version}/src";
 
+  postPatch = ''
+    substituteInPlace config/shlib.conf \
+        --replace "'ld " "'${stdenv.cc.targetPrefix}ld "
+  '';
+
   libFolders = [ "util" "include" "lib" "build-tools" ];
 
   buildPhase = lib.optionalString libOnly ''
diff --git a/pkgs/development/libraries/kuserfeedback/default.nix b/pkgs/development/libraries/kuserfeedback/default.nix
new file mode 100644
index 00000000000..bea9f86fc90
--- /dev/null
+++ b/pkgs/development/libraries/kuserfeedback/default.nix
@@ -0,0 +1,23 @@
+{ lib
+, mkDerivation
+, fetchurl
+, extra-cmake-modules
+, qttools
+}:
+mkDerivation rec {
+  pname = "kuserfeedback";
+  version = "1.2.0";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-dqrJIrFTJJsnRoCm9McsI47xTj3wS60Ay2QVixBj8mQ=";
+  };
+
+  nativeBuildInputs = [ extra-cmake-modules qttools ];
+
+  meta = with lib; {
+    license = [ licenses.mit ];
+    maintainers = [ maintainers.k900 ];
+    description = "Framework for collecting user feedback for apps via telemetry and surveys";
+  };
+}
diff --git a/pkgs/development/libraries/lame/default.nix b/pkgs/development/libraries/lame/default.nix
index 506be919322..bdc173507c0 100644
--- a/pkgs/development/libraries/lame/default.nix
+++ b/pkgs/development/libraries/lame/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     (lib.enableFeature frontendSupport "dynamic-frontends")
     #(enableFeature mp3xSupport "mp3x")
     (lib.enableFeature mp3rtpSupport "mp3rtp")
-    (if debugSupport then "--enable-debug=alot" else "")
+    (lib.optionalString debugSupport "--enable-debug=alot")
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/libassuan/default.nix b/pkgs/development/libraries/libassuan/default.nix
index 3a00ca498cb..e2fbb3f9287 100644
--- a/pkgs/development/libraries/libassuan/default.nix
+++ b/pkgs/development/libraries/libassuan/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ npth gettext ];
 
   configureFlags = [
+    # Required for cross-compilation.
     "--with-libgpg-error-prefix=${libgpg-error.dev}"
   ];
 
diff --git a/pkgs/development/libraries/libb2/default.nix b/pkgs/development/libraries/libb2/default.nix
index a461f5039aa..9e507188aad 100644
--- a/pkgs/development/libraries/libb2/default.nix
+++ b/pkgs/development/libraries/libb2/default.nix
@@ -4,16 +4,17 @@
 , autoreconfHook
 , libtool
 , pkg-config
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libb2";
   version = "0.98.1";
 
   src = fetchFromGitHub {
     owner = "BLAKE2";
     repo = "libb2";
-    rev = "refs/tags/v${version}";
+    rev = "refs/tags/v${finalAttrs.version}";
     sha256 = "0qj8aaqvfcavj1vj5asm4pqm03ap7q8x4c2fy83cqggvky0frgya";
   };
 
@@ -29,11 +30,14 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "The BLAKE2 family of cryptographic hash functions";
     homepage = "https://blake2.net/";
+    pkgConfigModules = [ "libb2" ];
     platforms = platforms.all;
     maintainers = with maintainers; [ dfoxfranke dotlambda ];
     license = licenses.cc0;
   };
-}
+})
diff --git a/pkgs/development/libraries/libbladeRF/default.nix b/pkgs/development/libraries/libbladeRF/default.nix
index 4b2c48824fb..e5e51a447b4 100644
--- a/pkgs/development/libraries/libbladeRF/default.nix
+++ b/pkgs/development/libraries/libbladeRF/default.nix
@@ -46,6 +46,11 @@ in stdenv.mkDerivation rec {
     "-DBLADERF_GROUP=bladerf"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   hardeningDisable = [ "fortify" ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index d03783f2fd9..11c8ce9e097 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-0/wvH07bJRKFwYnOARRJNzH8enIX3TNnWQnJdfpfvgE=";
   };
 
+  outputs = [ "out" "dev" "doc" ];
+
   postPatch = ''
     patchShebangs utils/
   '';
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 7abbd944ed0..8f8e33cbeab 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -13,28 +13,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "0.10.0";
+  version = "unstable-2023-01-29"; # Musl fix hasn't been released yet.
 
   src = fetchFromGitHub {
     owner = "PJK";
-    repo = finalAttrs.pname;
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-YJSIZ7o191/0QJf1fH6LUYykS2pvP17knSeRO2WcDeM=";
+    repo = "libcbor";
+    rev = "cb4162f40d94751141b4d43b07c4add83e738a68";
+    sha256 = "sha256-ZTa+wG1g9KsVoqJG/yqxo2fJ7OhPnaI9QcfOmpOT3pg=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-    "-DBUILD_SHARED_LIBS=on"
-  ] ++ lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON";
+  cmakeFlags = lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON"
+    ++ lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS=ON";
 
-  # 2 tests are not 32-bit clean: overflow size_t:
-  #   https://github.com/PJK/libcbor/issues/263
-  doCheck =
-    !stdenv.hostPlatform.is32bit
-    && (!stdenv.hostPlatform.isStatic)
+  # Tests are restricted while pkgsStatic.cmocka is broken. Tracked at:
+  # https://github.com/NixOS/nixpkgs/issues/213623
+  doCheck = !stdenv.hostPlatform.isStatic
     && stdenv.hostPlatform == stdenv.buildPlatform;
+
   nativeCheckInputs = [ cmocka ];
 
   passthru.tests = {
diff --git a/pkgs/development/libraries/libcli/default.nix b/pkgs/development/libraries/libcli/default.nix
index da076a590e1..6e38c1ab84f 100644
--- a/pkgs/development/libraries/libcli/default.nix
+++ b/pkgs/development/libraries/libcli/default.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "AR=${stdenv.cc.targetPrefix}ar" "PREFIX=$(out)" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+  ];
+
   meta = with lib; {
     description = "Emulate a Cisco-style telnet command-line interface";
     homepage = "http://sites.dparrish.com/libcli";
diff --git a/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch b/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
index e12b584d16e..19aa27b549c 100644
--- a/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
+++ b/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
@@ -17,7 +17,7 @@ index 4486e7b2..be5b28b4 100644
  
  if test	"$DO_CHECK" = "yes"; then
 -	accepted_versions="1.2 1.4 2.0"
-+	accepted_versions="1.2 1.4 2.0 2.2 2.3"
++	accepted_versions="1.2 1.4 2.0 2.2 2.3 2.4"
  	AC_PATH_PROGS(GNUPG, [gpg gpg2], no)
  	AC_DEFINE_UNQUOTED(GNUPG, "$GNUPG", [Path to gpg executable.])
  	ok="no"
diff --git a/pkgs/development/libraries/libdatrie/default.nix b/pkgs/development/libraries/libdatrie/default.nix
index 257673b1a96..57d30124a6f 100644
--- a/pkgs/development/libraries/libdatrie/default.nix
+++ b/pkgs/development/libraries/libdatrie/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  buildInputs = [ libiconv ];
 
   preAutoreconf = let
     reports = "https://github.com/tlwg/libdatrie/issues";
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 18b8d6ba5d6..7cbcbe238ea 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 
@@ -12,16 +13,25 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.9";
+  version = "1.0.10";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "sha256-OpiQapppuKCR27tIG5OW+KiNMP9ysv7CaobiBOW6VUI=";
+    sha256 = "sha256-d2TJKPvOAqLe+ZO1+Rd/yRIn3W1u1q62ZH20/9N2Shw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "revert-cmake-change-pkg-config.patch";
+      url = "https://github.com/strukturag/libde265/commit/388b61459c2abe2b949114ab54e83fb4dbfa8ba0.patch";
+      sha256 = "sha256-b6wwSvZpK7lIu0uD1SqK2zGBUjb/25+JW1Pf1fvHc0I=";
+      revert = true;
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libdynd/default.nix b/pkgs/development/libraries/libdynd/default.nix
index b418279e477..6018e00f944 100644
--- a/pkgs/development/libraries/libdynd/default.nix
+++ b/pkgs/development/libraries/libdynd/default.nix
@@ -15,14 +15,17 @@ stdenv.mkDerivation rec {
     "-DDYND_BUILD_BENCHMARKS=OFF"
   ];
 
-  # added to fix build with gcc7+
   NIX_CFLAGS_COMPILE = builtins.toString [
+    # added to fix build with gcc7+
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=nonnull"
     "-Wno-error=tautological-compare"
     "-Wno-error=class-memaccess"
     "-Wno-error=parentheses"
     "-Wno-error=deprecated-copy"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=maybe-uninitialized"
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libepoxy/default.nix b/pkgs/development/libraries/libepoxy/default.nix
index 196ac1afaae..8b35097778d 100644
--- a/pkgs/development/libraries/libepoxy/default.nix
+++ b/pkgs/development/libraries/libepoxy/default.nix
@@ -50,8 +50,10 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dtests=${if doCheck then "true" else "false"}"
+    "-Degl=${if x11Support then "yes" else "no"}"
     "-Dglx=${if x11Support then "yes" else "no"}"
+    "-Dtests=${lib.boolToString doCheck}"
+    "-Dx11=${lib.boolToString x11Support}"
   ];
 
   NIX_CFLAGS_COMPILE = lib.optionalString x11Support ''-DLIBGL_PATH="${getLib libGL}/lib"'';
diff --git a/pkgs/development/libraries/libfaketime/default.nix b/pkgs/development/libraries/libfaketime/default.nix
index ac501c660b0..e58c74f2c67 100644
--- a/pkgs/development/libraries/libfaketime/default.nix
+++ b/pkgs/development/libraries/libfaketime/default.nix
@@ -1,19 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, perl, coreutils }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "libfaketime";
-  version = "0.9.9";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "wolfcw";
     repo = "libfaketime";
     rev = "v${version}";
-    sha256 = "sha256-P1guVggteGtoq8+eeE966hDPkRwsn0m7oLCohyPrIb4=";
+    sha256 = "sha256-DYRuQmIhQu0CNEboBAtHOr/NnWxoXecuPMSR/UQ/VIQ=";
   };
 
   patches = [
-    ./no-date-in-gzip-man-page.patch
     ./nix-store-date.patch
+    (fetchpatch {
+      name = "0001-libfaketime.c-wrap-timespec_get-in-TIME_UTC-macro.patch";
+      url = "https://github.com/wolfcw/libfaketime/commit/e0e6b79568d36a8fd2b3c41f7214769221182128.patch";
+      sha256 = "sha256-KwwP76v0DXNW73p/YBvwUOPdKMAcVdbQSKexD/uFOYo=";
+    })
   ] ++ (lib.optionals stdenv.cc.isClang [
     # https://github.com/wolfcw/libfaketime/issues/277
     ./0001-Remove-unsupported-clang-flags.patch
diff --git a/pkgs/development/libraries/libfaketime/nix-store-date.patch b/pkgs/development/libraries/libfaketime/nix-store-date.patch
index b88245dfe8f..e93a7ec7650 100644
--- a/pkgs/development/libraries/libfaketime/nix-store-date.patch
+++ b/pkgs/development/libraries/libfaketime/nix-store-date.patch
@@ -13,9 +13,9 @@ index af618f2..48e47da 100644
 +++ b/src/faketime.c
 @@ -50,11 +50,7 @@
  
- const char version[] = "0.9.9";
+ const char version[] = "0.9.10";
  
--#ifdef __APPLE__
+-#if (defined __APPLE__) || (defined __sun)
 -static const char *date_cmd = "gdate";
 -#else
 -static const char *date_cmd = "date";
diff --git a/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch b/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch
deleted file mode 100644
index 7b7e362fbf0..00000000000
--- a/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -ur libfaketime-0.9.5.orig/man/Makefile libfaketime-0.9.5/man/Makefile
---- libfaketime-0.9.5.orig/man/Makefile	2013-10-13 11:19:30.000000000 +0200
-+++ libfaketime-0.9.5/man/Makefile	2014-04-13 01:22:14.362296519 +0200
-@@ -6,7 +6,7 @@
- 
- install:
- 	$(INSTALL) -Dm0644 faketime.1 "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
--	gzip -f "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
-+	gzip -9nf "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
- 
- uninstall:
- 	rm -f "${DESTDIR}${PREFIX}/share/man/man1/faketime.1.gz"
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index bf43bb1b50e..0b983e6edf4 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "glvnd";
     repo = "libglvnd";
     rev = "v${version}";
-    sha256 = "sha256-yXSuG8UwD5KZbn4ysDStTdOGD4uHigjOhazlHT9ndNs=";
+    sha256 = "sha256-p/vLxagN9nCYw1JpUmZetgctQbrp3Wo33OVFrtvmnjQ=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config python3 addOpenGLRunpath ];
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index fcd7946a135..d8c5d87b165 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -17,17 +17,22 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.45";
+  version = "1.46";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Vw+O5PtL/3t0lc/5IMJ1ACrqIUfpodIgwGghMmf4CiY=";
+    sha256 = "sha256-t+EaZCRrvl7zd0jeQ7JFq9cs/NU8muXn/FylnxyBJo0=";
   };
 
   postPatch = ''
     sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
   '';
 
+  configureFlags = [
+    # See https://dev.gnupg.org/T6257#164567
+    "--enable-install-gpg-error-config"
+  ];
+
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev"; # deps want just the lib, most likely
 
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index 3dddc02aeab..10a12dbfa77 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -25,11 +25,11 @@ let
   ;
 in stdenv.mkDerivation rec {
   pname = "libpsl";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchurl {
     url = "https://github.com/rockdaboot/libpsl/releases/download/${version}/libpsl-${version}.tar.lz";
-    sha256 = "1a9kp2rj71jb9q030lmp3zhy33rqxscawbfzhp288fxvazapahv4";
+    sha256 = "sha256-qj1wbEUnhtE0XglNriAc022B8Dz4HWNtXPwQ02WQfxc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libraw/default.nix b/pkgs/development/libraries/libraw/default.nix
index 758b00febf5..26d7616ba8f 100644
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, lcms2, pkg-config }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "libraw";
-  version = "0.20.2.p2";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "LibRaw";
     repo = "LibRaw";
-    rev = "fedad11e87daad7b7d389a3ef84ccf10b5e84710"; # current 0.20-stable branch
-    sha256 = "1mklf8lzybzyg75ja34822xlv6h9nw93griyrjjna7darl1dyvja";
+    rev = version;
+    sha256 = "sha256-K9mULf6V/TCl5Vu4iuIdSGF9HzQlgNQLRFHIpNbmAlY";
   };
 
   outputs = [ "out" "lib" "dev" "doc" ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others)";
     homepage = "https://www.libraw.org/";
-    license = licenses.gpl2Plus;
+    license = with licenses; [ cddl lgpl2Plus ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libraw/unstable.nix b/pkgs/development/libraries/libraw/unstable.nix
deleted file mode 100644
index 3f19bb53c4e..00000000000
--- a/pkgs/development/libraries/libraw/unstable.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ libraw, fetchFromGitHub }:
-
-libraw.overrideAttrs (_: rec {
-  version = "unstable-2021-12-03";
-
-  src = fetchFromGitHub {
-    owner = "LibRaw";
-    repo = "LibRaw";
-    rev = "52b2fc52e93a566e7e05eaa44cada58e3360b6ad";
-    sha256 = "kW0R4iPuqnFuWYDrl46ok3kaPcGgY2MqZT7mqVX+BDQ=";
-  };
-})
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index dd202d4a295..b1cb2fc4570 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh";
-  version = "0.10.0";
+  version = "0.10.4";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-DcFYxTTNg4rQt4WoLexYbeQNp+CWUjrmwIybe9KvC1c=";
+    sha256 = "sha256-BzksVKthR2KI0cHwp8VXtQIReXrQDDTDryu8TbxL2X0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 892ed71583d..f2147632eb7 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitLab
+, fetchpatch
 , nix-update-script
 
 , autoreconfHook
@@ -38,6 +39,11 @@ stdenv.mkDerivation rec {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2022-48281.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5.diff";
+      sha256 = "sha256-FWUlyJyHXac6fuM5f9PG33kcF5Bm4fyFmYnaDal46iM=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libubox/default.nix b/pkgs/development/libraries/libubox/default.nix
index bb49ad4472c..cd8790c0e88 100644
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, lib, fetchgit, cmake, pkg-config, json_c }:
+{ stdenv, lib, fetchgit, cmake, pkg-config, json_c, with_lua ? false, lua5_1 }:
 
 stdenv.mkDerivation {
   pname = "libubox";
-  version = "unstable-2021-03-09";
+  version = "unstable-2023-01-03";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libubox.git";
-    rev = "551d75b5662cccd0466b990d58136bdf799a804d";
-    sha256 = "05cnjjqjv9nvrs1d8pg4xxxf27jryiv6xk8plmdpmm7r2wkvwn3r";
+    rev = "eac92a4d5d82eb31e712157e7eb425af728b2c43";
+    sha256 = "0w6mmwmd3ljhkqfk0qswq28dp63k30s3brlgf8lyi7vj7mrhvn3c";
   };
 
-  cmakeFlags = [ "-DBUILD_LUA=OFF" "-DBUILD_EXAMPLES=OFF" ];
+  cmakeFlags = [ "-DBUILD_EXAMPLES=OFF" (if with_lua then "-DLUAPATH=${placeholder "out"}/lib/lua" else "-DBUILD_LUA=OFF") ];
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ json_c ];
+  buildInputs = [ json_c ] ++ lib.optional with_lua lua5_1;
 
   meta = with lib; {
     description = "C utility functions for OpenWrt";
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 7da2c46fafe..8c899268f7d 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -37,7 +37,8 @@ stdenv.mkDerivation rec {
         ./unistdio/test-u16-vasnprintf3.sh: line 16: ./test-u16-vasnprintf1: No such file or directory
         FAIL unistdio/test-u16-vasnprintf3.sh (exit status: 1)
   */
-  enableParallelBuilding = false;
+  enableParallelChecking = false;
+  enableParallelBuilding = true;
 
   meta = {
     homepage = "https://www.gnu.org/software/libunistring/";
diff --git a/pkgs/development/libraries/liburing/default.nix b/pkgs/development/libraries/liburing/default.nix
index c95ea31b3bf..7a5fa8a34a1 100644
--- a/pkgs/development/libraries/liburing/default.nix
+++ b/pkgs/development/libraries/liburing/default.nix
@@ -4,12 +4,12 @@
 
 stdenv.mkDerivation rec {
   pname = "liburing";
-  version = "2.2";
+  version = "2.3";
 
   src = fetchgit {
     url    = "http://git.kernel.dk/${pname}";
     rev    = "liburing-${version}";
-    sha256 = "sha256-M/jfxZ+5DmFvlAt8sbXrjBTPf2gLd9UyTNymtjD+55g";
+    sha256 = "sha256-vN6lLb5kpgHTKDxwibJPS61sdelILETVtJE2BYgp79k=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index a350cd378bc..8a86bc46d4d 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices, pkgsStatic }:
 
 stdenv.mkDerivation rec {
   version = "1.44.2";
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-K6v+00basjI32ON27ZjC5spQi/zWCcslDwQwyosq2iY=";
   };
 
+  patches = [
+    # Fix tests for statically linked variant upstream PR is
+    # https://github.com/libuv/libuv/pull/3735
+    (fetchpatch {
+      url = "https://github.com/libuv/libuv/commit/9d898acc564351dde74e9ed9865144e5c41f5beb.patch";
+      sha256 = "sha256-6XsjrseD8a+ny887EKOX0NmHocLMXGf2YL13vkNHUZ0=";
+    })
+  ];
+
   postPatch = let
     toDisable = [
       "getnameinfo_basic" "udp_send_hang_loop" # probably network-dependent
@@ -21,6 +30,10 @@ stdenv.mkDerivation rec {
       "get_passwd" # passed on NixOS but failed on other Linuxes
       "tcp_writealot" "udp_multicast_join" "udp_multicast_join6" # times out sometimes
       "fs_fstat" # https://github.com/libuv/libuv/issues/2235#issuecomment-1012086927
+
+      # Assertion failed in test/test-tcp-bind6-error.c on line 60: r == UV_EADDRINUSE
+      # Assertion failed in test/test-tcp-bind-error.c on line 99: r == UV_EADDRINUSE
+      "tcp_bind6_error_addrinuse" "tcp_bind_error_addrinuse_listen"
     ] ++ lib.optionals stdenv.isDarwin [
         # Sometimes: timeout (no output), failed uv_listen. Someone
         # should report these failures to libuv team. There tests should
@@ -66,6 +79,8 @@ stdenv.mkDerivation rec {
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
 
+  passthru.tests.static = pkgsStatic.libuv;
+
   meta = with lib; {
     description = "A multi-platform support library with a focus on asynchronous I/O";
     homepage    = "https://libuv.org/";
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 734f96850c5..8db7964257e 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -269,7 +269,7 @@ stdenv.mkDerivation rec {
       (cfg "runstatedir" "/run")
 
       (cfg "init_script" (if isDarwin then "none" else "systemd"))
-      (cfg "qemu_datadir" (if isDarwin then "${qemu}/share/qemu" else ""))
+      (cfg "qemu_datadir" (lib.optionalString isDarwin "${qemu}/share/qemu"))
 
       (feat "apparmor" isLinux)
       (feat "attr" isLinux)
diff --git a/pkgs/development/libraries/libvisual/default.nix b/pkgs/development/libraries/libvisual/default.nix
index 3e61ee8a6a1..f32ee433694 100644
--- a/pkgs/development/libraries/libvisual/default.nix
+++ b/pkgs/development/libraries/libvisual/default.nix
@@ -1,18 +1,22 @@
-{ lib, stdenv, fetchurl, pkg-config, glib }:
+{ lib
+, stdenv
+, fetchurl
+, SDL
+, glib
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
   pname = "libvisual";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/libvisual/${pname}-${version}.tar.gz";
-    sha256 = "1my1ipd5k1ixag96kwgf07bgxkjlicy9w22jfxb2kq95f6wgsk8b";
+    hash = "sha256-qhKHdBf3bTZC2fTHIzAjgNgzF1Y51jpVZB0Bkopd230=";
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib ];
-
-  hardeningDisable = [ "format" ];
+  buildInputs = [ SDL glib ];
 
   configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
diff --git a/pkgs/development/libraries/libvpx/1_8.nix b/pkgs/development/libraries/libvpx/1_8.nix
index befbafd5a4e..643dcb4d8f4 100644
--- a/pkgs/development/libraries/libvpx/1_8.nix
+++ b/pkgs/development/libraries/libvpx/1_8.nix
@@ -156,7 +156,7 @@ stdenv.mkDerivation rec {
               else if stdenv.hostPlatform.osxMinVersion == "10.5"  then "9"
               else "8"
             else ""}-gcc"
-    (if stdenv.hostPlatform.isCygwin then "--enable-static-msvcrt" else "")
+    (lib.optionalString stdenv.hostPlatform.isCygwin "--enable-static-msvcrt")
   ] # Experimental features
     ++ optional experimentalSpatialSvcSupport "--enable-spatial-svc"
     ++ optional experimentalFpMbStatsSupport "--enable-fp-mb-stats"
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index d82bf42bef6..1d791aec6fa 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -165,7 +165,7 @@ stdenv.mkDerivation rec {
                     experimentalEmulateHardwareSupport) "experimental")
   ] ++ optionals (stdenv.isBSD || stdenv.hostPlatform != stdenv.buildPlatform) [
     "--force-target=${stdenv.hostPlatform.parsed.cpu.name}-${kernel}-gcc"
-    (if stdenv.hostPlatform.isCygwin then "--enable-static-msvcrt" else "")
+    (lib.optionalString stdenv.hostPlatform.isCygwin "--enable-static-msvcrt")
   ] # Experimental features
     ++ optional experimentalSpatialSvcSupport "--enable-spatial-svc"
     ++ optional experimentalFpMbStatsSupport "--enable-fp-mb-stats"
diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index ca16063cca6..bbbceab3ab7 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -8,11 +8,11 @@
 stdenv.mkDerivation rec {
   pname = "libvterm-neovim";
   # Releases are not tagged, look at commit history to find latest release
-  version = "0.3";
+  version = "0.3.1";
 
   src = fetchurl {
     url = "https://www.leonerd.org.uk/code/libvterm/libvterm-${version}.tar.gz";
-    sha256 = "sha256-YesNZijFK98CkA39RGiqhqGnElIourimcyiYGIdIM1g=";
+    sha256 = "sha256-JaitnBVIU2jf0Kip3KGuyP6lwn2j+nTsUY1dN4fww5c=";
   };
 
   nativeBuildInputs = [ perl libtool ];
diff --git a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
index 6578a86e35b..3997ceb623f 100644
--- a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
+++ b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     "--with-x-locale-root=${libX11.out}/share/X11/locale"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   preBuild = lib.optionalString stdenv.isDarwin ''
     sed -i 's/,--version-script=.*$//' Makefile
   '';
diff --git a/pkgs/development/libraries/maplibre-gl-native/default.nix b/pkgs/development/libraries/maplibre-gl-native/default.nix
index 568f3fbe64e..8d6c0664ca1 100644
--- a/pkgs/development/libraries/maplibre-gl-native/default.nix
+++ b/pkgs/development/libraries/maplibre-gl-native/default.nix
@@ -9,6 +9,7 @@
 , libuv
 , glfw3
 , rapidjson
+, stdenv
 }:
 
 mkDerivation rec {
@@ -55,6 +56,11 @@ mkDerivation rec {
     "-DMBGL_WITH_QT_HEADLESS=OFF"
   ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=use-after-free"
+  ];
+
   meta = with lib; {
     description = "Open-source alternative to Mapbox GL Native";
     homepage = "https://maplibre.org/";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 56fa74e5c0c..52633a6d216 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -28,9 +28,9 @@
       "tegra" # Nvidia Tegra SoCs
       "v3d" # Broadcom VC5 (Raspberry Pi 4)
       "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
-    ] ++ lib.optionals stdenv.isx86_64 [
-      "iris" # new Intel, could work on non-x86_64 with PCIe cards, but doesn't build as of 22.3.4
-      "crocus" # Intel legacy, x86_64 only
+    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+      "iris" # new Intel, could work on non-x86 with PCIe cards, but doesn't build as of 22.3.4
+      "crocus" # Intel legacy, x86 only
     ]
   else [ "auto" ]
 , vulkanDrivers ?
@@ -326,10 +326,6 @@ self = stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [ "-fno-common" ] ++ lib.optionals enableOpenCL [
     "-UPIPE_SEARCH_DIR"
     "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
-
-    # Work around regression from https://github.com/NixOS/nixpkgs/pull/210004
-    # TODO(trofi): remove
-    "--sysroot=/"
   ];
 
   passthru = {
diff --git a/pkgs/development/libraries/newt/default.nix b/pkgs/development/libraries/newt/default.nix
index 6114c4c70d0..3ba07c7b5be 100644
--- a/pkgs/development/libraries/newt/default.nix
+++ b/pkgs/development/libraries/newt/default.nix
@@ -5,11 +5,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "newt";
-  version = "0.52.21";
+  version = "0.52.23";
 
   src = fetchurl {
     url = "https://releases.pagure.org/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0cdvbancr7y4nrj8257y5n45hmhizr8isynagy4fpsnpammv8pi6";
+    sha256 = "sha256-yqNykHsU7Oz+KY8NUSpi9B0zspBhAkSliu0Hu8WtoSo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/nss_wrapper/default.nix b/pkgs/development/libraries/nss_wrapper/default.nix
index a6974295690..324c5269dfb 100644
--- a/pkgs/development/libraries/nss_wrapper/default.nix
+++ b/pkgs/development/libraries/nss_wrapper/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nss_wrapper";
-  version = "1.1.12";
+  version = "1.1.15";
 
   src = fetchurl {
     url = "mirror://samba/cwrap/nss_wrapper-${version}.tar.gz";
-    sha256 = "sha256-zdBg/wnAO32i0wsMta00dSNNQ4rqJ5A9slwvFvVwIYY=";
+    sha256 = "sha256-Nvh0gypPIVjgT2mqd+VRXhbPbjv4GWjV3YSW231pBq0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/octomap/default.nix b/pkgs/development/libraries/octomap/default.nix
index 9b1635511ec..5a2064eb595 100644
--- a/pkgs/development/libraries/octomap/default.nix
+++ b/pkgs/development/libraries/octomap/default.nix
@@ -10,10 +10,16 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     hash = "sha256-qE5i4dGugm7tR5tgDCpbla/R7hYR/PI8BzrZQ4y6Yz8=";
   };
+
   sourceRoot = "source/octomap";
 
   nativeBuildInputs = [ cmake ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
   meta = with lib; {
     description = "A probabilistic, flexible, and compact 3D mapping library for robotic systems";
     homepage = "https://octomap.github.io/";
diff --git a/pkgs/development/libraries/openbabel/2.nix b/pkgs/development/libraries/openbabel/2.nix
index 3e989561470..0cc752d993f 100644
--- a/pkgs/development/libraries/openbabel/2.nix
+++ b/pkgs/development/libraries/openbabel/2.nix
@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i include/openbabel/obutil.h # gcc12
+  '';
+
   buildInputs = [ zlib libxml2 eigen python3 cairo pcre ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/openbabel/default.nix b/pkgs/development/libraries/openbabel/default.nix
index a23382d3f89..fe12bbffa53 100644
--- a/pkgs/development/libraries/openbabel/default.nix
+++ b/pkgs/development/libraries/openbabel/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wQpgdfCyBAoh4pmj9j7wPTlMtraJ62w/EShxi/olVMY=";
   };
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i include/openbabel/obutil.h # gcc12
+  '';
+
   buildInputs = [ zlib libxml2 eigen python cairo pcre swig rapidjson ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 2c676e008f0..4a9af9a5388 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -15,6 +15,7 @@
 , ocl-icd
 , buildPackages
 , qimgv
+, opencv4
 
 , enableJPEG ? true
 , libjpeg
@@ -31,8 +32,8 @@
 , openjpeg
 , enableEigen ? true
 , eigen
-, enableOpenblas ? true
-, openblas
+, enableBlas ? true
+, blas
 , enableContrib ? true
 
 , enableCuda ? (config.cudaSupport or false) && stdenv.hostPlatform.isx86_64
@@ -74,6 +75,7 @@
 , CoreMedia
 , MediaToolbox
 , bzip2
+, callPackage
 }:
 
 let
@@ -93,6 +95,13 @@ let
     sha256 = "sha256-meya0J3RdOIeMM46e/6IOVwrKn3t/c0rhwP2WQaybkE=";
   };
 
+  testDataSrc = fetchFromGitHub {
+    owner = "opencv";
+    repo = "opencv_extra";
+    rev = version;
+    sha256 = "sha256-6hAdJdaUgtRGQanQKuY/q6fcXWXFZ3K/oLbGxvksry0=";
+  };
+
   # Contrib must be built in order to enable Tesseract support:
   buildContrib = enableContrib || enableTesseract || enableOvis;
 
@@ -171,10 +180,10 @@ let
   ade = rec {
     src = fetchurl {
       url = "https://github.com/opencv/ade/archive/${name}";
-      sha256 = "04n9na2bph706bdxnnqfcbga4cyj8kd9s9ni7qyvnpj5v98jwvlm";
+      sha256 = "sha256-TjLRbFbC7MDY9PxIy560ryviBI58cbQwqgc7A7uOHkg=";
     };
-    name = "v0.1.1f.zip";
-    md5 = "b624b995ec9c439cbc2e9e6ee940d3a2";
+    name = "v0.1.2a.zip";
+    md5 = "fa4b3e25167319cb0fa9432ef8281945";
     dst = ".cache/ade";
   };
 
@@ -208,13 +217,24 @@ let
 
   opencvFlag = name: enabled: "-DWITH_${name}=${printEnabled enabled}";
 
+  runAccuracyTests = true;
+  runPerformanceTests = false;
   printEnabled = enabled: if enabled then "ON" else "OFF";
+  withOpenblas = (enableBlas && blas.provider.pname == "openblas");
+  #multithreaded openblas conflicts with opencv multithreading, which manifest itself in hung tests
+  #https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+  openblas_ = blas.provider.override { singleThreaded = true; };
 in
 
 stdenv.mkDerivation {
   pname = "opencv";
   inherit version src;
 
+  outputs = [
+    "out"
+    "package_tests"
+  ];
+
   postUnpack = lib.optionalString buildContrib ''
     cp --no-preserve=mode -r "${contribSrc}/modules" "$NIX_BUILD_TOP/source/opencv_contrib"
   '';
@@ -263,12 +283,12 @@ stdenv.mkDerivation {
     ++ lib.optional enableFfmpeg ffmpeg
     ++ lib.optionals (enableFfmpeg && stdenv.isDarwin)
       [ VideoDecodeAcceleration bzip2 ]
-    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base ])
+    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ])
     ++ lib.optional enableOvis ogre
     ++ lib.optional enableGPhoto2 libgphoto2
     ++ lib.optional enableDC1394 libdc1394
     ++ lib.optional enableEigen eigen
-    ++ lib.optional enableOpenblas openblas
+    ++ lib.optional enableBlas blas.provider
     # There is seemingly no compile-time flag for Tesseract.  It's
     # simply enabled automatically if contrib is built, and it detects
     # tesseract & leptonica.
@@ -290,7 +310,8 @@ stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
-  OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
+  OpenBLAS_HOME = lib.optionalString withOpenblas openblas_.dev;
+  OpenBLAS = lib.optionalString withOpenblas openblas_;
 
   cmakeFlags = [
     "-DOPENCV_GENERATE_PKGCONFIG=ON"
@@ -299,8 +320,9 @@ stdenv.mkDerivation {
     "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf}"
     "-DPROTOBUF_UPDATE_FILES=ON"
     "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
-    "-DBUILD_TESTS=OFF"
-    "-DBUILD_PERF_TESTS=OFF"
+    "-DBUILD_TESTS=${printEnabled runAccuracyTests}"
+    "-DBUILD_PERF_TESTS=${printEnabled runPerformanceTests}"
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
     "-DBUILD_DOCS=${printEnabled enableDocs}"
     # "OpenCV disables pkg-config to avoid using of host libraries. Consider using PKG_CONFIG_LIBDIR to specify target SYSROOT"
     # but we have proper separation of build and host libs :), fixes cross
@@ -334,6 +356,14 @@ stdenv.mkDerivation {
     make doxygen
   '';
 
+  preInstall =
+    lib.optionalString (runAccuracyTests || runPerformanceTests) ''
+    mkdir $package_tests
+    cp -R $src/samples $package_tests/
+    ''
+    + lib.optionalString runAccuracyTests "mv ./bin/*test* $package_tests/ \n"
+    + lib.optionalString runPerformanceTests "mv ./bin/*perf* $package_tests/";
+
   # By default $out/lib/pkgconfig/opencv4.pc looks something like this:
   #
   #   prefix=/nix/store/g0wnfyjjh4rikkvp22cpkh41naa43i4i-opencv-4.0.0
@@ -368,16 +398,23 @@ stdenv.mkDerivation {
 
   passthru = {
     tests = {
-      inherit qimgv;
       inherit (gst_all_1) gst-plugins-bad;
-    } // lib.optionalAttrs (!enablePython) { pythonEnabled = pythonPackages.opencv4; };
+    }
+    // lib.optionalAttrs (!stdenv.isDarwin) { inherit qimgv; }
+    // lib.optionalAttrs (!enablePython) { pythonEnabled = pythonPackages.opencv4; }
+    // lib.optionalAttrs (stdenv.buildPlatform != "x86_64-darwin") {
+      opencv4-tests = callPackage ./tests.nix {
+        inherit enableGStreamer enableGtk2 enableGtk3 runAccuracyTests runPerformanceTests testDataSrc;
+        inherit opencv4;
+        };
+      };
   } // lib.optionalAttrs enablePython { pythonPath = [ ]; };
 
   meta = with lib; {
     description = "Open Computer Vision Library with more than 500 algorithms";
     homepage = "https://opencv.org/";
     license = with licenses; if enableUnfree then unfree else bsd3;
-    maintainers = with maintainers; [ mdaiter basvandijk ];
+    maintainers = with maintainers; [ basvandijk ];
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/libraries/opencv/tests.nix b/pkgs/development/libraries/opencv/tests.nix
new file mode 100644
index 00000000000..5a155a9119b
--- /dev/null
+++ b/pkgs/development/libraries/opencv/tests.nix
@@ -0,0 +1,70 @@
+{ opencv4
+, testDataSrc
+, stdenv
+, lib
+, runCommand
+, gst_all_1
+, runAccuracyTests
+, runPerformanceTests
+, enableGStreamer
+, enableGtk2
+, enableGtk3
+, xvfb-run
+}:
+let
+  testNames = [
+    "calib3d"
+    "core"
+    "features2d"
+    "flann"
+    "imgcodecs"
+    "imgproc"
+    "ml"
+    "objdetect"
+    "photo"
+    "stitching"
+    "video"
+    #"videoio" # - a lot of GStreamer warnings and failed tests
+    #"dnn" #- some caffe tests failed, probably because github workflow also downloads additional models
+  ] ++ lib.optionals (!stdenv.isAarch64 && enableGStreamer) [ "gapi" ]
+  ++ lib.optionals (enableGtk2 || enableGtk3) [ "highgui" ];
+  perfTestNames = [
+    "calib3d"
+    "core"
+    "features2d"
+    "imgcodecs"
+    "imgproc"
+    "objdetect"
+    "photo"
+    "stitching"
+    "video"
+  ] ++ lib.optionals (!stdenv.isAarch64 && enableGStreamer) [ "gapi" ];
+  testRunner = if stdenv.isDarwin then "" else "${lib.getExe xvfb-run} -a ";
+  testsPreparation = ''
+    touch $out
+    # several tests want a write access, so we have to copy files
+    tmpPath="$(mktemp -d "/tmp/opencv_extra_XXXXXX")"
+    cp -R ${testDataSrc} $tmpPath/opencv_extra
+    chmod -R +w $tmpPath/opencv_extra
+    export OPENCV_TEST_DATA_PATH="$tmpPath/opencv_extra/testdata"
+    export OPENCV_SAMPLES_DATA_PATH="${opencv4.package_tests}/samples/data"
+
+    #ignored tests because of gtest error - "Test code is not available due to compilation error with GCC 11"
+    export GTEST_FILTER="-AsyncAPICancelation/cancel*"
+  '';
+  accuracyTests = lib.optionalString runAccuracyTests ''
+    ${ builtins.concatStringsSep "\n"
+      (map (test: "${testRunner}${opencv4.package_tests}/opencv_test_${test} --test_threads=$NIX_BUILD_CORES --gtest_filter=$GTEST_FILTER" ) testNames)
+    }
+  '';
+  perfomanceTests = lib.optionalString runPerformanceTests ''
+    ${ builtins.concatStringsSep "\n"
+      (map (test: "${testRunner}${opencv4.package_tests}/opencv_perf_${test} --perf_impl=plain --perf_min_samples=10 --perf_force_samples=10 --perf_verify_sanity --skip_unstable=1 --gtest_filter=$GTEST_FILTER") perfTestNames)
+    }
+  '';
+in
+runCommand "opencv4-tests"
+{
+  nativeBuildInputs = lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ]);
+}
+  (testsPreparation + accuracyTests + perfomanceTests)
diff --git a/pkgs/development/libraries/opendbx/default.nix b/pkgs/development/libraries/opendbx/default.nix
index 0460f012424..ce8064cdc1e 100644
--- a/pkgs/development/libraries/opendbx/default.nix
+++ b/pkgs/development/libraries/opendbx/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline libmysqlclient postgresql sqlite ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "Extremely lightweight but extensible database access library written in C";
diff --git a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch b/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
deleted file mode 100644
index 2acedda0e3a..00000000000
--- a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001
-From: Pauli <pauli@openssl.org>
-Date: Fri, 11 Nov 2022 09:40:19 +1100
-Subject: [PATCH] x509: fix double locking problem
-
-This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the
-redundant flag setting.
-
-Fixes #19643
-
-Fixes LOW CVE-2022-3996
-
-Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/19652)
-
-(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5)
----
- crypto/x509/pcy_map.c | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c
-index 05406c6493fc..60dfd1e3203b 100644
---- a/crypto/x509/pcy_map.c
-+++ b/crypto/x509/pcy_map.c
-@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
- 
-     ret = 1;
-  bad_mapping:
--    if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) {
--        x->ex_flags |= EXFLAG_INVALID_POLICY;
--        CRYPTO_THREAD_unlock(x->lock);
--    }
-     sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
-     return ret;
- 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 4c322997963..75ffe5ae06a 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -10,6 +10,7 @@
 # path to openssl.cnf file. will be placed in $etc/etc/ssl/openssl.cnf to replace the default
 , conf ? null
 , removeReferencesTo
+, testers
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -19,12 +20,12 @@
 
 let
   common = { version, sha256, patches ? [], withDocs ? false, extraMeta ? {} }:
-   stdenv.mkDerivation rec {
+   stdenv.mkDerivation (finalAttrs: {
     pname = "openssl";
     inherit version;
 
     src = fetchurl {
-      url = "https://www.openssl.org/source/${pname}-${version}.tar.gz";
+      url = "https://www.openssl.org/source/${finalAttrs.pname}-${version}.tar.gz";
       inherit sha256;
     };
 
@@ -204,20 +205,27 @@ let
       fi
     '';
 
+    passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
     meta = with lib; {
       homepage = "https://www.openssl.org/";
       description = "A cryptographic library that implements the SSL and TLS protocols";
       license = licenses.openssl;
+      pkgConfigModules = [
+        "libcrypto"
+        "libssl"
+        "openssl"
+      ];
       platforms = platforms.all;
     } // extraMeta;
-  };
+  });
 
 in {
 
 
   openssl_1_1 = common {
-    version = "1.1.1s";
-    sha256 = "sha256-xawB52Dub/Dath1rK70wFGck0GPrMiGAxvGKb3Tktqo=";
+    version = "1.1.1t";
+    sha256 = "sha256-je6bJL2x3L8MPR6bAvuPa/IhZegH9Fret8lndTaFnTs=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -229,8 +237,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.7";
-    sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4=";
+    version = "3.0.8";
+    sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
@@ -241,9 +249,6 @@ in {
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
-
-       # Remove with 3.0.8 release
-       ./3.0/CVE-2022-3996.patch
     ];
 
     withDocs = true;
diff --git a/pkgs/development/libraries/physics/applgrid/default.nix b/pkgs/development/libraries/physics/applgrid/default.nix
index 512398dde9a..105a6b4953f 100644
--- a/pkgs/development/libraries/physics/applgrid/default.nix
+++ b/pkgs/development/libraries/physics/applgrid/default.nix
@@ -21,10 +21,10 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     substituteInPlace src/Makefile.in \
       --replace "-L\$(subst /libgfortran.a, ,\$(FRTLIB) )" "-L${gfortran.cc.lib}/lib"
-  '' + (if stdenv.isDarwin then ''
+  '' + (lib.optionalString stdenv.isDarwin ''
     substituteInPlace src/Makefile.in \
       --replace "gfortran -print-file-name=libgfortran.a" "gfortran -print-file-name=libgfortran.dylib"
-  '' else "");
+  '');
 
   enableParallelBuilding = false; # broken
 
diff --git a/pkgs/development/libraries/physics/clhep/default.nix b/pkgs/development/libraries/physics/clhep/default.nix
index a8d853a23b0..b3ba508220f 100644
--- a/pkgs/development/libraries/physics/clhep/default.nix
+++ b/pkgs/development/libraries/physics/clhep/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clhep";
-  version = "2.4.6.3";
+  version = "2.4.6.4";
 
   src = fetchurl {
     url = "https://proj-clhep.web.cern.ch/proj-clhep/dist1/clhep-${version}.tgz";
-    hash = "sha256-/NAH8RsQukryjQJyIrYxSNDrRP96CC7uNTvfkh+caEo=";
+    hash = "sha256-SciTMPGQPvcH08XXnBanxabyyQ/CkOIDTuODSAlInlc=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/libraries/pico-sdk/default.nix b/pkgs/development/libraries/pico-sdk/default.nix
index 991d2e661f1..8b5f33599cd 100644
--- a/pkgs/development/libraries/pico-sdk/default.nix
+++ b/pkgs/development/libraries/pico-sdk/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pico-sdk";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = pname;
     rev = version;
-    sha256 = "sha256-i3IAaNcd0EfKNvU104a776O1poDAChlx1m+nP8iFn8E=";
+    sha256 = "sha256-p69go8KXQR21szPb+R1xuonyFj+ZJDunNeoU7M3zIsE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 8da35364e2b..53d465542b2 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -109,8 +109,16 @@ let
         url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/fba7083f8ceb210c7c20aceafeb5c9a8767cf705.patch";
         hash = "sha256-aZQ4OzK0B5YPq+jQNygxPE0coG2qB0ukbYzyI8E24XM=";
       })
+
+      # backport a fix for rust-cbindgen errors in downstream packages
+      # See https://github.com/NixOS/nixpkgs/pull/211872#issuecomment-1415981135 for details.
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/caf58ecffb4dc8e2bfa7898d0ed910cf0a82d65f.patch";
+        hash = "sha256-kCQNG0j3lwT01WNfGsdUmKvDHg8tvMfS2eunPyXBV1E=";
+      })
     ];
 
+    strictDeps = true;
     nativeBuildInputs = [
       docutils
       doxygen
@@ -119,6 +127,7 @@ let
       ninja
       pkg-config
       python3
+      glib
     ];
 
     buildInputs = [
diff --git a/pkgs/development/libraries/qcoro/default.nix b/pkgs/development/libraries/qcoro/default.nix
index 4a288702e2f..fb5c7570b75 100644
--- a/pkgs/development/libraries/qcoro/default.nix
+++ b/pkgs/development/libraries/qcoro/default.nix
@@ -1,5 +1,5 @@
 { stdenv
-, gcc11Stdenv
+, gcc12Stdenv
 , lib
 , fetchFromGitHub
 , cmake
@@ -9,7 +9,7 @@
 , wrapQtAppsHook
 }:
 
-gcc11Stdenv.mkDerivation rec {
+gcc12Stdenv.mkDerivation rec {
   pname = "qcoro";
   version = "0.7.0";
 
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 2829bb0be02..7d876d884b3 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -64,6 +64,12 @@ let
         extraPrefix = "src/3rdparty/";
         hash = "sha256-MZGYeMdGzwypfKoSUaa56K3inbcGRx7he/+AFyk5ekA=";
       })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/Homebrew/formula-patches/7ae178a617d1e0eceb742557e63721af949bd28a/qt5/qt5-webengine-gcc12.patch";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/";
+        hash = "sha256-s4GsGMJTBNWw2gTJuIEP3tqT82AmTsR2mbj59m2p6rM=";
+      })
     ] ++ lib.optionals stdenv.isDarwin [
       ./qtwebengine-darwin-no-platform-check.patch
       ./qtwebengine-mac-dont-set-dsymutil-path.patch
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 19f36c337e5..0603ae077e4 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -42,7 +42,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
   qtwebengine =
     let
-      branchName = "5.15.11";
+      branchName = "5.15.12";
       rev = "v${branchName}-lts";
     in
     {
@@ -50,7 +50,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
       src = fetchgit {
         url = "https://github.com/qt/qtwebengine.git";
-        sha256 = "sha256-yrKPof18G10VjrwCn/4E/ywlpATJQZjvmVeM+9hLY0U=";
+        sha256 = "sha256-8EQqSvxw9rqf+64CIbcCb1VXhNx1GNC8eDIgLyYDyvk=";
         inherit rev branchName;
         fetchSubmodules = true;
         leaveDotGit = true;
diff --git a/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix b/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix
index b52837aa170..1c39c004447 100644
--- a/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtstyleplugin-kvantum-qt4";
-  version = "1.0.7";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "tsujan";
     repo = "Kvantum";
     rev = "V${version}";
-    hash = "sha256-Ys77z5BoeQEOYe1h5ITEuVtVn6Uug9zQjrCBxLQOrSs=";
+    hash = "sha256-5/cScJpi5Z5Z/SjizKfMTGytuEo2uUT6QtpMnn7JhKc=";
   };
 
   nativeBuildInputs = [ qmake4Hook ];
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 40b927ff0b8..79cd1b86fad 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -40,8 +40,16 @@ stdenv.mkDerivation rec {
     "tools"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move"
-    + lib.optionalString stdenv.cc.isClang "-Wno-error=unused-private-field -faligned-allocation";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    "-Wno-error=deprecated-copy"
+    "-Wno-error=pessimizing-move"
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=unused-private-field"
+    "-faligned-allocation"
+  ];
 
   cmakeFlags = [
     "-DPORTABLE=1"
diff --git a/pkgs/development/libraries/rocm-device-libs/default.nix b/pkgs/development/libraries/rocm-device-libs/default.nix
index 3fba6da7f53..fa60a4d3f9e 100644
--- a/pkgs/development/libraries/rocm-device-libs/default.nix
+++ b/pkgs/development/libraries/rocm-device-libs/default.nix
@@ -14,7 +14,7 @@ let
     else throw "Unsupported ROCm LLVM platform";
 in stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-device-libs";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/libraries/roctracer/default.nix b/pkgs/development/libraries/roctracer/default.nix
index ee844bb417b..87cf7d0819a 100644
--- a/pkgs/development/libraries/roctracer/default.nix
+++ b/pkgs/development/libraries/roctracer/default.nix
@@ -62,6 +62,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   postPatch = ''
     export HIP_DEVICE_LIB_PATH=${rocm-device-libs}/amdgcn/bitcode
   '' + lib.optionalString (!buildTests) ''
diff --git a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
index c4faadd2a5e..7144a17c18b 100644
--- a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
@@ -48,6 +48,8 @@ stdenv.mkDerivation rec {
         --replace "/etc/udev/rules.d" "lib/udev/rules.d" \
         --replace "/lib/firmware" "lib/firmware"
     done
+
+    sed '1i#include <ctime>' -i indi-duino/libfirmata/src/firmata.cpp # gcc12
   '';
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/science/math/amd-blis/default.nix b/pkgs/development/libraries/science/math/amd-blis/default.nix
index f0408730282..962e8e8e6ac 100644
--- a/pkgs/development/libraries/science/math/amd-blis/default.nix
+++ b/pkgs/development/libraries/science/math/amd-blis/default.nix
@@ -16,7 +16,7 @@
 }:
 
 let
-  threadingSuffix = if withOpenMP then "-mt" else "";
+  threadingSuffix = lib.optionalString withOpenMP "-mt";
   blasIntSize = if blas64 then "64" else "32";
 in stdenv.mkDerivation rec {
   pname = "amd-blis";
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index b9563346ada..3bf16057f83 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -6,16 +6,17 @@
 , shared ? true
 # Compile with ILP64 interface
 , blas64 ? false
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "liblapack";
   version = "3.11";
 
   src = fetchFromGitHub {
     owner = "Reference-LAPACK";
     repo = "lapack";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-AYD78u70y8cY19hmM/aDjQEzxO8u9lPWhCFxRe5cqXI=";
   };
 
@@ -40,7 +41,7 @@ stdenv.mkDerivation rec {
 
   postInstall =  let
     canonicalExtension = if stdenv.hostPlatform.isLinux
-                       then "${stdenv.hostPlatform.extensions.sharedLibrary}.${lib.versions.major version}"
+                       then "${stdenv.hostPlatform.extensions.sharedLibrary}.${lib.versions.major finalAttrs.version}"
                        else stdenv.hostPlatform.extensions.sharedLibrary;
   in lib.optionalString blas64 ''
     ln -s $out/lib/liblapack64${canonicalExtension} $out/lib/liblapack${canonicalExtension}
@@ -65,15 +66,18 @@ stdenv.mkDerivation rec {
 
   checkPhase = ''
     runHook preCheck
-    ctest ${ctestArgs}
+    ctest ${finalAttrs.ctestArgs}
     runHook postCheck
   '';
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Linear Algebra PACKage";
     homepage = "http://www.netlib.org/lapack/";
     maintainers = with maintainers; [ markuskowa ];
     license = licenses.bsd3;
+    pkgConfigModules = [ "lapack" ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/science/math/p4est-sc/default.nix b/pkgs/development/libraries/science/math/p4est-sc/default.nix
index eeb1d14b910..fbd9db6a419 100644
--- a/pkgs/development/libraries/science/math/p4est-sc/default.nix
+++ b/pkgs/development/libraries/science/math/p4est-sc/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  dbg = if debugEnable then "-dbg" else "";
+  dbg = lib.optionalString debugEnable "-dbg";
   debugEnable = p4est-sc-debugEnable;
   mpiSupport = p4est-sc-mpiSupport;
   isOpenmpi = mpiSupport && mpi.pname == "openmpi";
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
   '';
   preConfigure = ''
     echo "2.8.0" > .tarball-version
-    ${if mpiSupport then "unset CC" else ""}
+    ${lib.optionalString mpiSupport "unset CC"}
   '';
 
   configureFlags = [ "--enable-pthread=-pthread" ]
diff --git a/pkgs/development/libraries/science/math/p4est/default.nix b/pkgs/development/libraries/science/math/p4est/default.nix
index 9396a914442..a55c5fe573b 100644
--- a/pkgs/development/libraries/science/math/p4est/default.nix
+++ b/pkgs/development/libraries/science/math/p4est/default.nix
@@ -9,7 +9,7 @@
 
 let
   inherit (p4est-sc) debugEnable mpiSupport;
-  dbg = if debugEnable then "-dbg" else "";
+  dbg = lib.optionalString debugEnable "-dbg";
   withMetis = p4est-withMetis;
 in
 stdenv.mkDerivation {
diff --git a/pkgs/development/libraries/science/math/petsc/default.nix b/pkgs/development/libraries/science/math/petsc/default.nix
index ae95fefe0e6..c2fabae1c20 100644
--- a/pkgs/development/libraries/science/math/petsc/default.nix
+++ b/pkgs/development/libraries/science/math/petsc/default.nix
@@ -55,11 +55,11 @@ stdenv.mkDerivation rec {
         "--with-fc=mpif90"
         "--with-mpi=1"
       ''}
-      ${if withp4est then ''
+      ${lib.optionalString withp4est ''
         "--with-p4est=1"
         "--with-zlib-include=${zlib.dev}/include"
         "--with-zlib-lib=-L${zlib}/lib -lz"
-      '' else ""}
+      ''}
       "--with-blas=1"
       "--with-lapack=1"
     )
diff --git a/pkgs/development/libraries/science/math/sympow/default.nix b/pkgs/development/libraries/science/math/sympow/default.nix
index c31c705d39d..09ca356ccdc 100644
--- a/pkgs/development/libraries/science/math/sympow/default.nix
+++ b/pkgs/development/libraries/science/math/sympow/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitLab
+, fetchpatch
 , makeWrapper
 , which
 , autoconf
@@ -20,7 +21,14 @@ stdenv.mkDerivation rec {
     sha256 = "132l0xv00ld1svvv9wh99wfra4zzjv2885h2sq0dsl98wiyvi5zl";
   };
 
-  patches = [ ./clean-extra-logfile-output-from-pari.patch ];
+  patches = [
+    ./clean-extra-logfile-output-from-pari.patch
+    (fetchpatch {
+      name = "null-terminate-dupdirname.patch";
+      url = "https://gitlab.com/rezozer/forks/sympow/-/merge_requests/5.diff";
+      sha256 = "sha256-yKjio+qN9teL8L+mb7WOBN/iv545vRIxW20FJU37oO4=";
+    })
+  ];
 
   postUnpack = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/swiftshader/default.nix b/pkgs/development/libraries/swiftshader/default.nix
index 2c508a3735f..28aabc03682 100644
--- a/pkgs/development/libraries/swiftshader/default.nix
+++ b/pkgs/development/libraries/swiftshader/default.nix
@@ -13,6 +13,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 jq ];
   buildInputs = [ libX11 libXext zlib ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=uninitialized"
+  ];
+
   # Make sure we include the drivers and icd files in the output as the cmake
   # generated install command only puts in the spirv-tools stuff.
   installPhase = ''
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index 21fddb16562..e0c48bc6dce 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
   pname = "tbb";
   version = "2020.3";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneTBB";
diff --git a/pkgs/development/libraries/thrift/default.nix b/pkgs/development/libraries/thrift/default.nix
index 76d8cc2ff54..92063eb1400 100644
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@@ -36,11 +36,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     boost
+  ] ++ lib.optionals (!static) [
+    (python3.withPackages (ps: [ps.twisted]))
+  ];
+
+  propagatedBuildInputs = [
     libevent
     openssl
     zlib
-  ] ++ lib.optionals (!static) [
-    (python3.withPackages (ps: [ps.twisted]))
   ];
 
   postPatch = ''
@@ -66,6 +69,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/apache/thrift/commit/c41ad9d5119e9bdae1746167e77e224f390f2c42.diff";
       hash = "sha256-FkErrg/6vXTomS4AsCsld7t+Iccc55ZiDaNjJ3W1km0=";
     })
+    (fetchpatch {
+      name = "thrift-install-FindLibevent.patch"; # https://github.com/apache/thrift/pull/2726
+      url = "https://github.com/apache/thrift/commit/2ab850824f75d448f2ba14a468fb77d2594998df.diff";
+      hash = "sha256-ejMKFG/cJgoPlAFzVDPI4vIIL7URqaG06/IWdQ2NkhY=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/udns/default.nix b/pkgs/development/libraries/udns/default.nix
index da0554d49e6..518ed432b72 100644
--- a/pkgs/development/libraries/udns/default.nix
+++ b/pkgs/development/libraries/udns/default.nix
@@ -19,14 +19,10 @@ stdenv.mkDerivation rec {
   # udns uses a very custom build and hardcodes a .so name in a few places.
   # Instead of fighting with it to apply the standard dylib script, change
   # the right place in the Makefile itself.
-  postPatch =
-    if stdenv.isDarwin
-    then
-      ''
-        substituteInPlace Makefile.in \
-          --replace --soname, -install_name,$out/lib/
-      ''
-    else "";
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile.in \
+      --replace --soname, -install_name,$out/lib/
+  '';
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/unittest-cpp/default.nix b/pkgs/development/libraries/unittest-cpp/default.nix
index 6f27a71b3ee..e9f67a74f9a 100644
--- a/pkgs/development/libraries/unittest-cpp/default.nix
+++ b/pkgs/development/libraries/unittest-cpp/default.nix
@@ -1,4 +1,9 @@
-{lib, stdenv, fetchFromGitHub, cmake}:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+}:
 
 stdenv.mkDerivation rec {
   pname = "unittest-cpp";
@@ -11,6 +16,14 @@ stdenv.mkDerivation rec {
     sha256 = "0sxb3835nly1jxn071f59fwbdzmqi74j040r81fanxyw3s1azw0i";
   };
 
+  patches = [
+    # GCC12 Patch
+    (fetchpatch {
+      url = "https://github.com/unittest-cpp/unittest-cpp/pull/185/commits/f361c2a1034c02ba8059648f9a04662d6e2b5553.patch";
+      hash = "sha256-xyhV2VBelw/uktUXSZ3JBxgG+8/Mout/JiXEZVV2+2Y=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = false;
diff --git a/pkgs/development/libraries/uri/default.nix b/pkgs/development/libraries/uri/default.nix
index 980d073f128..6189fcf016d 100644
--- a/pkgs/development/libraries/uri/default.nix
+++ b/pkgs/development/libraries/uri/default.nix
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "148361pixrm94q6v04k13s1msa04bx9yc3djb0lxpa7dlw19vhcd";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=parentheses"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=nonnull"
+  ];
 
   nativeBuildInputs = [ cmake doxygen ];
 
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 7cdad40d970..4b2117503bd 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -110,6 +110,7 @@ stdenv.mkDerivation rec {
         --replace "-Wl,-fatal_warnings" ""
     ''}
     touch build/config/gclient_args.gni
+    sed '1i#include <utility>' -i src/heap/cppgc/prefinalizer-handler.h # gcc12
   '';
 
   llvmCcAndBintools = symlinkJoin { name = "llvmCcAndBintools"; paths = [ stdenv.cc llvmPackages.llvm ]; };
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 99ee89edcac..fdefeb86a04 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -64,6 +64,7 @@
 , enableGeoLocation ? true
 , withLibsecret ? true
 , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
+, testers
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -232,10 +233,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   requiredSystemFeatures = [ "big-parallel" ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Web content rendering engine, GTK port";
     homepage = "https://webkitgtk.org/";
     license = licenses.bsd2;
+    pkgConfigModules = [
+      "javascriptcoregtk-4.0"
+      "webkit2gtk-4.0"
+      "webkit2gtk-web-extension-4.0"
+    ];
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = teams.gnome.members;
     broken = stdenv.isDarwin;
diff --git a/pkgs/development/libraries/wildmidi/default.nix b/pkgs/development/libraries/wildmidi/default.nix
index 5e8adaf0c42..8877365e1dd 100644
--- a/pkgs/development/libraries/wildmidi/default.nix
+++ b/pkgs/development/libraries/wildmidi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wildmidi";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "Mindwerks";
     repo = "wildmidi";
     rev = "${pname}-${version}";
-    sha256 = "08fbbsvw6pkwwqarjwcvdp8mq4zn5sgahf025hynwc6rvf4sp167";
+    sha256 = "sha256-5El8aDpAgjrW0/4lphZEF+Hfv9Xr7J4DMk1b/Tb+0TU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK32.nix b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
index 543c6fb4e05..83154c50d3e 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK32.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
@@ -53,13 +53,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wxwidgets";
-  version = "3.2.1";
+  version = "3.2.2.1";
 
   src = fetchFromGitHub {
     owner = "wxWidgets";
     repo = "wxWidgets";
     rev = "v${version}";
-    hash = "sha256-k6td/8pF7ad7+gVm7L0jX79fHKwR7/qrOBpSFggyaI0=";
+    hash = "sha256-u+INjo9EkW433OYoCDZpw5pcW1DyF/t/J5ntLZX+6aA=";
   };
 
   # Workaround for pkgsMusl.wxGTK32 failing as:
diff --git a/pkgs/development/libraries/xgboost/default.nix b/pkgs/development/libraries/xgboost/default.nix
index bf2825b5967..4370a27012d 100644
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@@ -1,69 +1,110 @@
-{ config
-, stdenv
-, lib
-, fetchFromGitHub
-, cmake
-, gtest
-, doCheck ? true
-, cudaSupport ? config.cudaSupport or false
-, ncclSupport ? false
-, cudaPackages
-, llvmPackages
-}:
+{ config, stdenv, lib, fetchFromGitHub, cmake, gtest, doCheck ? true
+, cudaSupport ? config.cudaSupport or false, ncclSupport ? false
+, rLibrary ? false, cudaPackages, llvmPackages, R, rPackages }:
 
 assert ncclSupport -> cudaSupport;
+# Disable regular tests when building the R package
+# because 1) the R package runs its own tests and
+# 2) the R package creates a different binary shared
+# object that isn't compatible with the regular CLI
+# tests.
+assert rLibrary -> doCheck != true;
 
 stdenv.mkDerivation rec {
-  pname = "xgboost";
+  pnameBase = "xgboost";
+  # prefix with r when building the R library
+  # The R package build results in a special xgboost.so file
+  # that contains a subset of the .so file use for the CLI
+  # and python version. In general, the CRAN version from
+  # nixpkgs's r-modules should be used, but this non-standard
+  # build allows for enabling CUDA and NCCL support which aren't
+  # included in the CRAN release. Build with:
+  # nix-build -E "with (import $NIXPKGS{}); \
+  #   let \
+  #     xgb = xgboost.override{rLibrary = true; doCheck = false;}; \
+  #   in \
+  #   rWrapper.override{ packages = [ xgb ]; }"
+  pname = lib.optionalString rLibrary "r-" + pnameBase;
   version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "dmlc";
-    repo = pname;
+    repo = pnameBase;
     rev = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-unTss2byytG8KUQfg5s34YpRuHHDLo7D/ZickHhz1AE=";
   };
 
-  nativeBuildInputs = [
-    cmake
-  ] ++ lib.optionals stdenv.isDarwin [
-    llvmPackages.openmp
-  ] ++ lib.optionals cudaSupport [
-    cudaPackages.autoAddOpenGLRunpathHook
-  ];
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optionals stdenv.isDarwin [ llvmPackages.openmp ]
+    ++ lib.optionals cudaSupport [ cudaPackages.autoAddOpenGLRunpathHook ]
+    ++ lib.optionals rLibrary [ R ];
 
   buildInputs = [ gtest ] ++ lib.optional cudaSupport cudaPackages.cudatoolkit
-                ++ lib.optional ncclSupport cudaPackages.nccl;
+    ++ lib.optional ncclSupport cudaPackages.nccl;
+
+  propagatedBuildInputs = lib.optionals rLibrary [
+    rPackages.data_table
+    rPackages.jsonlite
+    rPackages.Matrix
+  ];
 
   cmakeFlags = lib.optionals doCheck [ "-DGOOGLE_TEST=ON" ]
-    ++ lib.optionals cudaSupport [ "-DUSE_CUDA=ON" "-DCUDA_HOST_COMPILER=${cudaPackages.cudatoolkit.cc}/bin/cc" ]
-    ++ lib.optionals (cudaSupport && lib.versionAtLeast cudaPackages.cudatoolkit.version "11.4.0") [ "-DBUILD_WITH_CUDA_CUB=ON" ]
-    ++ lib.optionals ncclSupport [ "-DUSE_NCCL=ON" ];
+    ++ lib.optionals cudaSupport [
+      "-DUSE_CUDA=ON"
+      "-DCUDA_HOST_COMPILER=${cudaPackages.cudatoolkit.cc}/bin/cc"
+    ] ++ lib.optionals (cudaSupport
+      && lib.versionAtLeast cudaPackages.cudatoolkit.version "11.4.0")
+    [ "-DBUILD_WITH_CUDA_CUB=ON" ]
+    ++ lib.optionals ncclSupport [ "-DUSE_NCCL=ON" ]
+    ++ lib.optionals rLibrary [ "-DR_LIB=ON" ];
+
+  preConfigure = lib.optionals rLibrary ''
+    substituteInPlace cmake/RPackageInstall.cmake.in --replace "CMD INSTALL" "CMD INSTALL -l $out/library"
+    export R_LIBS_SITE="$R_LIBS_SITE''${R_LIBS_SITE:+:}$out/library"
+  '';
 
   inherit doCheck;
 
   # By default, cmake build will run ctests with all checks enabled
   # If we're building with cuda, we run ctest manually so that we can skip the GPU tests
   checkPhase = lib.optionalString cudaSupport ''
-    ctest --force-new-ctest-process ${lib.optionalString cudaSupport "-E TestXGBoostLib"}
+    ctest --force-new-ctest-process ${
+      lib.optionalString cudaSupport "-E TestXGBoostLib"
+    }
   '';
 
-  installPhase = let
-    libname = "libxgboost${stdenv.hostPlatform.extensions.sharedLibrary}";
-  in ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r ../include $out
-    cp -r ../dmlc-core/include/dmlc $out/include
-    cp -r ../rabit/include/rabit $out/include
-    install -Dm755 ../lib/${libname} $out/lib/${libname}
-    install -Dm755 ../xgboost $out/bin/xgboost
-    runHook postInstall
+  installPhase =
+    let libname = "libxgboost${stdenv.hostPlatform.extensions.sharedLibrary}";
+    in ''
+      runHook preInstall
+      mkdir -p $out
+      cp -r ../include $out
+      cp -r ../dmlc-core/include/dmlc $out/include
+      cp -r ../rabit/include/rabit $out/include
+    '' + lib.optionalString (!rLibrary) ''
+      install -Dm755 ../lib/${libname} $out/lib/${libname}
+      install -Dm755 ../xgboost $out/bin/xgboost
+    ''
+    # the R library option builds a completely different binary xgboost.so instead of
+    # libxgboost.so, which isn't full featured for python and CLI
+    + lib.optionalString rLibrary ''
+      mkdir $out/library
+      export R_LIBS_SITE="$out/library:$R_LIBS_SITE''${R_LIBS_SITE:+:}"
+      make install -l $out/library
+    '' + ''
+      runHook postInstall
+    '';
+
+  postFixup = lib.optionalString rLibrary ''
+    if test -e $out/nix-support/propagated-build-inputs; then
+        ln -s $out/nix-support/propagated-build-inputs $out/nix-support/propagated-user-env-packages
+    fi
   '';
 
   meta = with lib; {
-    description = "Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library";
+    description =
+      "Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library";
     homepage = "https://github.com/dmlc/xgboost";
     license = licenses.asl20;
     platforms = platforms.unix;
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index 3c4dc5194e0..fd972aabceb 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.204";
+  version = "0.6.206";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MQF0mU1cpvkJ6VZE6A8J4W6DMS8RXhjLisrPkKParl4=";
+    sha256 = "sha256-9NyZaoZgHl0qyiJG2ZiarsXQy1o8fsbKGCpPBO/A1hY=";
   };
 
   vendorHash = "sha256-IR/tgqh8rS4uN5jSOcopCutbHCKHSU9icUfRhOgu4t8=";
diff --git a/pkgs/development/mobile/titaniumenv/build-app.nix b/pkgs/development/mobile/titaniumenv/build-app.nix
index e4c3062cf53..fa2eeae00b5 100644
--- a/pkgs/development/mobile/titaniumenv/build-app.nix
+++ b/pkgs/development/mobile/titaniumenv/build-app.nix
@@ -167,7 +167,7 @@ stdenv.mkDerivation ({
       echo "file binary-dist \"$(ls $out/*.apk)\"" > $out/nix-support/hydra-build-products
     ''
     else if target == "iphone" then
-      if release then ''
+      lib.optionalString release ''
         mkdir -p $out/nix-support
         echo "file binary-dist \"$(echo $out/*.ipa)\"" > $out/nix-support/hydra-build-products
 
@@ -180,7 +180,6 @@ stdenv.mkDerivation ({
           echo "doc install \"$out/$appname.html\"" >> $out/nix-support/hydra-build-products
         ''}
       ''
-      else ""
     else throw "Target: ${target} is not supported!"}
   '';
 
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
index 4c8a63a0a52..a42a9c20923 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
@@ -103,10 +103,9 @@ stdenv.mkDerivation {
       ''
         patchelf --set-interpreter ${stdenv.cc.libc}/lib/ld-linux.so.2 android/titanium_prep.linux32
       ''
-      else if stdenv.system == "x86_64-linux" then
-      ''
+      else lib.optionalString (stdenv.system == "x86_64-linux") ''
         patchelf --set-interpreter ${stdenv.cc.libc}/lib/ld-linux-x86-64.so.2 android/titanium_prep.linux64
       ''
-      else ""}
+    }
   '';
 }
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
index e51775b8c6d..a0907881d16 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
@@ -105,10 +105,9 @@ stdenv.mkDerivation {
       ''
         patchelf --set-interpreter ${stdenv.cc.libc}/lib/ld-linux.so.2 android/titanium_prep.linux32
       ''
-      else if stdenv.system == "x86_64-linux" then
-      ''
+      else lib.optionalString (stdenv.system == "x86_64-linux") ''
         patchelf --set-interpreter ${stdenv.cc.libc}/lib/ld-linux-x86-64.so.2 android/titanium_prep.linux64
       ''
-      else ""}
+    }
   '';
 }
diff --git a/pkgs/development/mobile/xcodeenv/build-app.nix b/pkgs/development/mobile/xcodeenv/build-app.nix
index 4bef0ba2db0..6120025d5e3 100644
--- a/pkgs/development/mobile/xcodeenv/build-app.nix
+++ b/pkgs/development/mobile/xcodeenv/build-app.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation ({
     # Do the building
     export LD=/usr/bin/clang # To avoid problem with -isysroot parameter that is unrecognized by the stock ld. Comparison with an impure build shows that it uses clang instead. Ugly, but it works
 
-    xcodebuild -target ${_target} -configuration ${_configuration} ${lib.optionalString (scheme != null) "-scheme ${scheme}"} -sdk ${_sdk} TARGETED_DEVICE_FAMILY="1, 2" ONLY_ACTIVE_ARCH=NO CONFIGURATION_TEMP_DIR=$TMPDIR CONFIGURATION_BUILD_DIR=$out ${if generateIPA || generateXCArchive then "-archivePath \"${name}.xcarchive\" archive" else ""} ${if release then '' PROVISIONING_PROFILE=$PROVISIONING_PROFILE OTHER_CODE_SIGN_FLAGS="--keychain $HOME/Library/Keychains/$keychainName-db"'' else ""} ${xcodeFlags}
+    xcodebuild -target ${_target} -configuration ${_configuration} ${lib.optionalString (scheme != null) "-scheme ${scheme}"} -sdk ${_sdk} TARGETED_DEVICE_FAMILY="1, 2" ONLY_ACTIVE_ARCH=NO CONFIGURATION_TEMP_DIR=$TMPDIR CONFIGURATION_BUILD_DIR=$out ${lib.optionalString (generateIPA || generateXCArchive) "-archivePath \"${name}.xcarchive\" archive"} ${lib.optionalString release '' PROVISIONING_PROFILE=$PROVISIONING_PROFILE OTHER_CODE_SIGN_FLAGS="--keychain $HOME/Library/Keychains/$keychainName-db"''} ${xcodeFlags}
 
     ${lib.optionalString release ''
       ${lib.optionalString generateIPA ''
diff --git a/pkgs/development/node-packages/overrides.nix b/pkgs/development/node-packages/overrides.nix
index 1ecf716329b..1a104904435 100644
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -268,11 +268,7 @@ final: prev: {
     nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
     postFixup = ''
       wrapProgram "$out/bin/makam" --prefix PATH : ${lib.makeBinPath [ nodejs ]}
-      ${
-        if stdenv.isLinux
-          then "patchelf --set-interpreter ${stdenv.cc.libc}/lib/ld-linux-x86-64.so.2 \"$out/lib/node_modules/makam/makam-bin-linux64\""
-          else ""
-      }
+      ${lib.optionalString stdenv.isLinux "patchelf --set-interpreter ${stdenv.cc.libc}/lib/ld-linux-x86-64.so.2 \"$out/lib/node_modules/makam/makam-bin-linux64\""}
     '';
   };
 
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index 00aef53cc1b..5366fb07867 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -24,12 +24,12 @@ let
 
 in buildPythonPackage rec {
   pname = "cython";
-  version = "0.29.32";
+  version = "0.29.33";
 
   src = fetchPypi {
     pname = "Cython";
     inherit version;
-    hash = "sha256-hzPPR1i3kwTypOOev6xekjQbzke8zrJsElQ5iy+MGvc=";
+    hash = "sha256-UEB2TEpNLOlko5XaJPDRrlgUSZXauSxrlvRMP01yKGo=";
   };
 
   nativeBuildInputs = [
@@ -46,11 +46,7 @@ in buildPythonPackage rec {
     # backport Cython 3.0 trashcan support (https://github.com/cython/cython/pull/2842) to 0.X series.
     # it does not affect Python code unless the code explicitly uses the feature.
     # trashcan support is needed to avoid stack overflows during object deallocation in sage (https://trac.sagemath.org/ticket/27267)
-    (fetchpatch {
-      name = "trashcan.patch";
-      url = "https://github.com/cython/cython/commit/f781880b6780117660b2026caadf4a6d7905722f.patch";
-      sha256 = "sha256-SnjaJdBZxm3O5gJ5Dxut6+eeVtZv+ygUUNwAwgoiFxg=";
-    })
+    ./trashcan.patch
     # The above commit introduces custom trashcan macros, as well as
     # compiler changes to use them in Cython-emitted code. The latter
     # change is still useful, but the former has been upstreamed as of
@@ -79,6 +75,7 @@ in buildPythonPackage rec {
   # doCheck = !stdenv.isDarwin;
 
   meta = {
+    changelog = "https://github.com/cython/cython/blob/${version}/CHANGES.rst";
     description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
     homepage = "https://cython.org";
     license = lib.licenses.asl20;
diff --git a/pkgs/development/python-modules/Cython/trashcan.patch b/pkgs/development/python-modules/Cython/trashcan.patch
new file mode 100644
index 00000000000..398422e76f3
--- /dev/null
+++ b/pkgs/development/python-modules/Cython/trashcan.patch
@@ -0,0 +1,354 @@
+From 1b77e35d848340f2c5f4c9b82965c25a0572d48f Mon Sep 17 00:00:00 2001
+From: Jeroen Demeyer <J.Demeyer@UGent.be>
+Date: Thu, 14 Feb 2019 10:02:41 +0100
+Subject: [PATCH] @cython.trashcan directive to enable the Python trashcan for
+ deallocations
+
+---
+ Cython/Compiler/ModuleNode.py   |  10 +++
+ Cython/Compiler/Options.py      |   2 +
+ Cython/Compiler/PyrexTypes.py   |   8 +-
+ Cython/Compiler/Symtab.py       |  18 +++-
+ Cython/Utility/ExtensionTypes.c |  43 ++++++++++
+ tests/run/trashcan.pyx          | 148 ++++++++++++++++++++++++++++++++
+ 6 files changed, 227 insertions(+), 2 deletions(-)
+ create mode 100644 tests/run/trashcan.pyx
+
+diff --git a/Cython/Compiler/ModuleNode.py b/Cython/Compiler/ModuleNode.py
+index 56845330d..3a3e8a956 100644
+--- a/Cython/Compiler/ModuleNode.py
++++ b/Cython/Compiler/ModuleNode.py
+@@ -1443,6 +1443,7 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+ 
+         is_final_type = scope.parent_type.is_final_type
+         needs_gc = scope.needs_gc()
++        needs_trashcan = scope.needs_trashcan()
+ 
+         weakref_slot = scope.lookup_here("__weakref__") if not scope.is_closure_class_scope else None
+         if weakref_slot not in scope.var_entries:
+@@ -1481,6 +1482,11 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+             # running this destructor.
+             code.putln("PyObject_GC_UnTrack(o);")
+ 
++        if needs_trashcan:
++            code.globalstate.use_utility_code(
++                UtilityCode.load_cached("PyTrashcan", "ExtensionTypes.c"))
++            code.putln("__Pyx_TRASHCAN_BEGIN(o, %s)" % slot_func_cname)
++
+         # call the user's __dealloc__
+         self.generate_usr_dealloc_call(scope, code)
+ 
+@@ -1554,6 +1560,10 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+             code.putln("(*Py_TYPE(o)->tp_free)(o);")
+             if freelist_size:
+                 code.putln("}")
++
++        if needs_trashcan:
++            code.putln("__Pyx_TRASHCAN_END")
++
+         code.putln(
+             "}")
+ 
+diff --git a/Cython/Compiler/Options.py b/Cython/Compiler/Options.py
+index d03119fca..05a728135 100644
+--- a/Cython/Compiler/Options.py
++++ b/Cython/Compiler/Options.py
+@@ -319,6 +319,7 @@ directive_types = {
+     'freelist': int,
+     'c_string_type': one_of('bytes', 'bytearray', 'str', 'unicode'),
+     'c_string_encoding': normalise_encoding_name,
++    'trashcan': bool,
+     'cpow': bool
+ }
+ 
+@@ -362,6 +363,7 @@ directive_scopes = {  # defaults to available everywhere
+     'np_pythran': ('module',),
+     'fast_gil': ('module',),
+     'iterable_coroutine': ('module', 'function'),
++    'trashcan' : ('cclass',),
+ }
+ 
+ 
+diff --git a/Cython/Compiler/PyrexTypes.py b/Cython/Compiler/PyrexTypes.py
+index c309bd04b..9231130b5 100644
+--- a/Cython/Compiler/PyrexTypes.py
++++ b/Cython/Compiler/PyrexTypes.py
+@@ -1129,6 +1129,7 @@ class PyObjectType(PyrexType):
+     is_extern = False
+     is_subclassed = False
+     is_gc_simple = False
++    builtin_trashcan = False  # builtin type using trashcan
+ 
+     def __str__(self):
+         return "Python object"
+@@ -1183,10 +1184,14 @@ class PyObjectType(PyrexType):
+ 
+ 
+ builtin_types_that_cannot_create_refcycles = set([
+-    'bool', 'int', 'long', 'float', 'complex',
++    'object', 'bool', 'int', 'long', 'float', 'complex',
+     'bytearray', 'bytes', 'unicode', 'str', 'basestring'
+ ])
+ 
++builtin_types_with_trashcan = set([
++    'dict', 'list', 'set', 'frozenset', 'tuple', 'type',
++])
++
+ 
+ class BuiltinObjectType(PyObjectType):
+     #  objstruct_cname  string           Name of PyObject struct
+@@ -1211,6 +1216,7 @@ class BuiltinObjectType(PyObjectType):
+         self.typeptr_cname = "(&%s)" % cname
+         self.objstruct_cname = objstruct_cname
+         self.is_gc_simple = name in builtin_types_that_cannot_create_refcycles
++        self.builtin_trashcan = name in builtin_types_with_trashcan
+         if name == 'type':
+             # Special case the type type, as many C API calls (and other
+             # libraries) actually expect a PyTypeObject* for type arguments.
+diff --git a/Cython/Compiler/Symtab.py b/Cython/Compiler/Symtab.py
+index 7361a55ae..f0c311ba6 100644
+--- a/Cython/Compiler/Symtab.py
++++ b/Cython/Compiler/Symtab.py
+@@ -2043,7 +2043,7 @@ class PyClassScope(ClassScope):
+ class CClassScope(ClassScope):
+     #  Namespace of an extension type.
+     #
+-    #  parent_type           CClassType
++    #  parent_type           PyExtensionType
+     #  #typeobj_cname        string or None
+     #  #objstruct_cname      string
+     #  method_table_cname    string
+@@ -2087,6 +2087,22 @@ class CClassScope(ClassScope):
+             return not self.parent_type.is_gc_simple
+         return False
+ 
++    def needs_trashcan(self):
++        # If the trashcan directive is explicitly set to False,
++        # unconditionally disable the trashcan.
++        directive = self.directives.get('trashcan')
++        if directive is False:
++            return False
++        # If the directive is set to True and the class has Python-valued
++        # C attributes, then it should use the trashcan in tp_dealloc.
++        if directive and self.has_cyclic_pyobject_attrs:
++            return True
++        # Use the trashcan if the base class uses it
++        base_type = self.parent_type.base_type
++        if base_type and base_type.scope is not None:
++            return base_type.scope.needs_trashcan()
++        return self.parent_type.builtin_trashcan
++
+     def needs_tp_clear(self):
+         """
+         Do we need to generate an implementation for the tp_clear slot? Can
+diff --git a/Cython/Utility/ExtensionTypes.c b/Cython/Utility/ExtensionTypes.c
+index dc187ab49..f359165df 100644
+--- a/Cython/Utility/ExtensionTypes.c
++++ b/Cython/Utility/ExtensionTypes.c
+@@ -119,6 +119,49 @@ static int __Pyx_PyType_Ready(PyTypeObject *t) {
+     return r;
+ }
+ 
++/////////////// PyTrashcan.proto ///////////////
++
++// These macros are taken from https://github.com/python/cpython/pull/11841
++// Unlike the Py_TRASHCAN_SAFE_BEGIN/Py_TRASHCAN_SAFE_END macros, they
++// allow dealing correctly with subclasses.
++
++// This requires CPython version >= 2.7.4
++// (or >= 3.2.4 but we don't support such old Python 3 versions anyway)
++#if CYTHON_COMPILING_IN_CPYTHON && PY_VERSION_HEX >= 0x02070400
++#define __Pyx_TRASHCAN_BEGIN_CONDITION(op, cond) \
++    do { \
++        PyThreadState *_tstate = NULL; \
++        // If "cond" is false, then _tstate remains NULL and the deallocator
++        // is run normally without involving the trashcan
++        if (cond) { \
++            _tstate = PyThreadState_GET(); \
++            if (_tstate->trash_delete_nesting >= PyTrash_UNWIND_LEVEL) { \
++                // Store the object (to be deallocated later) and jump past
++                // Py_TRASHCAN_END, skipping the body of the deallocator
++                _PyTrash_thread_deposit_object((PyObject*)(op)); \
++                break; \
++            } \
++            ++_tstate->trash_delete_nesting; \
++        }
++        // The body of the deallocator is here.
++#define __Pyx_TRASHCAN_END \
++        if (_tstate) { \
++            --_tstate->trash_delete_nesting; \
++            if (_tstate->trash_delete_later && _tstate->trash_delete_nesting <= 0) \
++                _PyTrash_thread_destroy_chain(); \
++        } \
++    } while (0);
++
++#define __Pyx_TRASHCAN_BEGIN(op, dealloc) __Pyx_TRASHCAN_BEGIN_CONDITION(op, \
++        Py_TYPE(op)->tp_dealloc == (destructor)(dealloc))
++
++#else
++// The trashcan is a no-op on other Python implementations
++// or old CPython versions
++#define __Pyx_TRASHCAN_BEGIN(op, dealloc)
++#define __Pyx_TRASHCAN_END
++#endif
++
+ /////////////// CallNextTpDealloc.proto ///////////////
+ 
+ static void __Pyx_call_next_tp_dealloc(PyObject* obj, destructor current_tp_dealloc);
+diff --git a/tests/run/trashcan.pyx b/tests/run/trashcan.pyx
+new file mode 100644
+index 000000000..93a501ff8
+--- /dev/null
++++ b/tests/run/trashcan.pyx
+@@ -0,0 +1,148 @@
++# mode: run
++
++cimport cython
++
++
++# Count number of times an object was deallocated twice. This should remain 0.
++cdef int double_deallocations = 0
++def assert_no_double_deallocations():
++    global double_deallocations
++    err = double_deallocations
++    double_deallocations = 0
++    assert not err
++
++
++# Compute x = f(f(f(...(None)...))) nested n times and throw away the result.
++# The real test happens when exiting this function: then a big recursive
++# deallocation of x happens. We are testing two things in the tests below:
++# that Python does not crash and that no double deallocation happens.
++# See also https://github.com/python/cpython/pull/11841
++def recursion_test(f, int n=2**20):
++    x = None
++    cdef int i
++    for i in range(n):
++        x = f(x)
++
++
++@cython.trashcan(True)
++cdef class Recurse:
++    """
++    >>> recursion_test(Recurse)
++    >>> assert_no_double_deallocations()
++    """
++    cdef public attr
++    cdef int deallocated
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.deallocated
++        self.deallocated = 1
++
++
++cdef class RecurseSub(Recurse):
++    """
++    >>> recursion_test(RecurseSub)
++    >>> assert_no_double_deallocations()
++    """
++    cdef int subdeallocated
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.subdeallocated
++        self.subdeallocated = 1
++
++
++@cython.freelist(4)
++@cython.trashcan(True)
++cdef class RecurseFreelist:
++    """
++    >>> recursion_test(RecurseFreelist)
++    >>> recursion_test(RecurseFreelist, 1000)
++    >>> assert_no_double_deallocations()
++    """
++    cdef public attr
++    cdef int deallocated
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.deallocated
++        self.deallocated = 1
++
++
++# Subclass of list => uses trashcan by default
++# As long as https://github.com/python/cpython/pull/11841 is not fixed,
++# this does lead to double deallocations, so we skip that check.
++cdef class RecurseList(list):
++    """
++    >>> RecurseList(42)
++    [42]
++    >>> recursion_test(RecurseList)
++    """
++    def __init__(self, x):
++        super().__init__((x,))
++
++
++# Some tests where the trashcan is NOT used. When the trashcan is not used
++# in a big recursive deallocation, the __dealloc__s of the base classs are
++# only run after the __dealloc__s of the subclasses.
++# We use this to detect trashcan usage.
++cdef int base_deallocated = 0
++cdef int trashcan_used = 0
++def assert_no_trashcan_used():
++    global base_deallocated, trashcan_used
++    err = trashcan_used
++    trashcan_used = base_deallocated = 0
++    assert not err
++
++
++cdef class Base:
++    def __dealloc__(self):
++        global base_deallocated
++        base_deallocated = 1
++
++
++# Trashcan disabled by default
++cdef class Sub1(Base):
++    """
++    >>> recursion_test(Sub1, 100)
++    >>> assert_no_trashcan_used()
++    """
++    cdef public attr
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        global base_deallocated, trashcan_used
++        trashcan_used += base_deallocated
++
++
++@cython.trashcan(True)
++cdef class Middle(Base):
++    cdef public foo
++
++
++# Trashcan disabled explicitly
++@cython.trashcan(False)
++cdef class Sub2(Middle):
++    """
++    >>> recursion_test(Sub2, 1000)
++    >>> assert_no_trashcan_used()
++    """
++    cdef public attr
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        global base_deallocated, trashcan_used
++        trashcan_used += base_deallocated
+-- 
+2.39.0
+
diff --git a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
index 9a302f5af08..56e5f8475cb 100644
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -1,7 +1,6 @@
 { lib
 , aiohttp
 , aresponses
-, asynctest
 , buildPythonPackage
 , aio-geojson-client
 , fetchFromGitHub
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     aresponses
-    asynctest
     pytest-asyncio
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
index 728a666447d..1cb11258393 100644
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@@ -2,7 +2,6 @@
 , aio-geojson-client
 , aiohttp
 , aresponses
-, asynctest
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
@@ -32,10 +31,12 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
     aresponses
-    asynctest
     pytest-asyncio
-    pytestCheckHook
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 12bdd985abb..c0d21eec563 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "13.2.0";
+  version = "13.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ACO5vp5ZMxzfY4RBvZ+vbk+fsj43Q896bar0+HNYHwE=";
+    hash = "sha256-Pca+SMuUL3XyQpLAL6SOYPnztc95WF2o0v4+5Nc5Nxg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/airthings-ble/default.nix b/pkgs/development/python-modules/airthings-ble/default.nix
index 6351fea9bd8..eda8e77e43b 100644
--- a/pkgs/development/python-modules/airthings-ble/default.nix
+++ b/pkgs/development/python-modules/airthings-ble/default.nix
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Airthings BLE devices";
     homepage = "https://github.com/vincegio/airthings-ble";
+    changelog = "https://github.com/vincegio/airthings-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ansible-doctor/default.nix b/pkgs/development/python-modules/ansible-doctor/default.nix
index d05d730a467..0ddd26b7ffb 100644
--- a/pkgs/development/python-modules/ansible-doctor/default.nix
+++ b/pkgs/development/python-modules/ansible-doctor/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-doctor";
-  version = "1.4.8";
+  version = "2.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     rev = "refs/tags/v${version}";
-    hash = "sha256-A4SqDEArnRG9SJTqU/C9TOQO2vjot+hfj2/PKB/JMfw=";
+    hash = "sha256-P2PC90coR+FpQkO+SUon72bDLTYJhZ5qbcOdCKuFFwE=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/asana/default.nix b/pkgs/development/python-modules/asana/default.nix
index 5f27e8c131b..6be8a76dece 100644
--- a/pkgs/development/python-modules/asana/default.nix
+++ b/pkgs/development/python-modules/asana/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "asana";
-  version = "3.0.0";
+  version = "3.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "asana";
     repo = "python-asana";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+lktPFCL2c79dNGgbsaFJRELmV6sJ2kiBSb8kd9XPIQ=";
+    hash = "sha256-aYWojS+SeAnFvSqyb9ceyRKhG1Hpn6/eK9xrXxQbVeA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/asf-search/default.nix b/pkgs/development/python-modules/asf-search/default.nix
index b0d2b1f7238..686a9e92ceb 100644
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@@ -1,17 +1,19 @@
 { lib
 , buildPythonPackage
-, dateparser
 , fetchFromGitHub
+, pythonOlder
+, requests
+, shapely
+, python-dateutil
+, pytz
 , importlib-metadata
 , numpy
+, dateparser
+, jinja2
+, remotezip
 , pytestCheckHook
-, python-dateutil
-, pythonOlder
-, pytz
-, requests
 , requests-mock
-, shapely
-, wktutils
+, defusedxml
 }:
 
 buildPythonPackage rec {
@@ -29,25 +31,25 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    dateparser
-    importlib-metadata
-    numpy
-    python-dateutil
-    pytz
     requests
     shapely
-    wktutils
+    python-dateutil
+    pytz
+    importlib-metadata
+    numpy
+    dateparser
+    jinja2
+    remotezip
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    requests-mock
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "WKTUtils==" "WKTUtils>="
-  '';
+  checkInputs = [
+    requests-mock
+    defusedxml
+  ];
 
   pythonImportsCheck = [
     "asf_search"
diff --git a/pkgs/development/python-modules/atc-ble/default.nix b/pkgs/development/python-modules/atc-ble/default.nix
index 947f5db4b31..187aaeeb99a 100644
--- a/pkgs/development/python-modules/atc-ble/default.nix
+++ b/pkgs/development/python-modules/atc-ble/default.nix
@@ -19,10 +19,15 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-rwOFKxUlbbNIDJRdCmZpHstXwxcTnvlExgcVDdGbIVY=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=atc_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -37,11 +42,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=atc_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   pythonImportsCheck = [
     "atc_ble"
   ];
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for ATC devices with custom firmware";
     homepage = "https://github.com/Bluetooth-Devices/atc-ble";
+    changelog = "https://github.com/Bluetooth-Devices/atc-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/awswrangler/default.nix b/pkgs/development/python-modules/awswrangler/default.nix
new file mode 100644
index 00000000000..f1b937f3ecd
--- /dev/null
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@@ -0,0 +1,88 @@
+{ backoff
+, sparqlwrapper
+, boto3
+, buildPythonPackage
+, fetchFromGitHub
+, gremlinpython
+, jsonpath-ng
+, lib
+, moto
+, openpyxl
+, opensearch-py
+, pandas
+, pg8000
+, poetry-core
+, progressbar2
+, pyarrow
+, pymysql
+, pyodbc
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, redshift-connector
+, requests-aws4auth
+}:
+
+buildPythonPackage rec {
+  pname = "awswrangler";
+  version = "2.19.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7.1";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-sdk-pandas";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xUEytEgr/djfnoOowLxAZmbPkMS+vU0fuPY7JxZXEe0=";
+  };
+
+  nativeBuildInputs = [ poetry-core pythonRelaxDepsHook ];
+
+  propagatedBuildInputs = [
+    backoff
+    boto3
+    gremlinpython
+    jsonpath-ng
+    openpyxl
+    opensearch-py
+    pandas
+    pg8000
+    progressbar2
+    pyarrow
+    pymysql
+    redshift-connector
+    requests-aws4auth
+  ];
+
+  pythonRelaxDeps = [
+    "gremlinpython"
+    "numpy"
+    "pandas"
+    "pg8000"
+  ];
+
+  nativeCheckInputs = [ moto pytestCheckHook ];
+
+  pytestFlagsArray = [
+    # Subset of tests that run in upstream CI (many others require credentials)
+    # https://github.com/aws/aws-sdk-pandas/blob/2b7c62ac0762b1303149bb3c03979791479ba4f9/.github/workflows/minimal-tests.yml
+    "tests/test_metadata.py"
+    "tests/test_session.py"
+    "tests/test_utils.py"
+    "tests/test_moto.py"
+  ];
+
+  passthru.optional-dependencies = {
+    sqlserver = [ pyodbc ];
+    sparql = [ sparqlwrapper ];
+  };
+
+  meta = {
+    description = "Pandas on AWS";
+    homepage = "https://github.com/aws/aws-sdk-pandas";
+    changelog = "https://github.com/aws/aws-sdk-pandas/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mcwitt ];
+  };
+}
diff --git a/pkgs/development/python-modules/btrees/default.nix b/pkgs/development/python-modules/btrees/default.nix
index 69c663f9ce0..308bba80b31 100644
--- a/pkgs/development/python-modules/btrees/default.nix
+++ b/pkgs/development/python-modules/btrees/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "btrees";
-  version = "4.11.3";
+  version = "5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "BTrees";
     inherit version;
-    hash = "sha256-kIUAsCD/mJsAlG+Kb2Vz84qbGAjQd+UuPc8Ej7FwwTo=";
+    hash = "sha256-/d+KTcwCU+OQJ7qzgKLiDUeuNwoySFQW8qZq2a4aQ/o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 44d6e6f9783..bcdd7614ecd 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -56,6 +56,8 @@ buildPythonPackage rec {
     "ignore::DeprecationWarning"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTests = [
     # Tests often fail with StopIteration
     "test_isolat"
diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index 8c5be6384f3..1a0ef99e749 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools ];
   propagatedBuildInputs = [
-    cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
+    setuptools cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
   ] ++ lib.optionals (pythonOlder "3.11") [ rtoml ];
 
   pythonImportsCheck = [ "bundlewrap" ];
diff --git a/pkgs/development/python-modules/certomancer/default.nix b/pkgs/development/python-modules/certomancer/default.nix
index 4fbe2ecd379..767071a75ef 100644
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "certomancer";
-  version = "0.8.2";
+  version = "0.9.1";
   format = "setuptools";
   disabled = pythonOlder "3.7";
 
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "MatthiasValvekens";
     repo = "certomancer";
     rev = version;
-    sha256 = "sha256-H43NlFNTwZtedHsB7c62MocwQVOi5JjVJxRcZY+Wn7Y=";
+    sha256 = "4v2e46ZrzhKXpMULj0vmDRoLOypi030eaADAYjLMg5M=";
   };
 
   propagatedBuildInputs = [
@@ -43,9 +43,7 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace ", 'pytest-runner'" "" \
-      --replace "pyhanko-certvalidator==0.19.2" "pyhanko-certvalidator==0.19.5"
+    substituteInPlace setup.py --replace ", 'pytest-runner'" ""
   '';
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/chart-studio/default.nix b/pkgs/development/python-modules/chart-studio/default.nix
index 966daaf1ea1..c988ab49a75 100644
--- a/pkgs/development/python-modules/chart-studio/default.nix
+++ b/pkgs/development/python-modules/chart-studio/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "chart-studio";
-  version = "5.11.0";
+  version = "5.13.0";
 
   # chart-studio was split from plotly
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-Reti8tvBpBxpfNjnZs8wWuS76oEWIKPCxzSdTEO+ykA=";
+    sha256 = "sha256-j4n5goW2Iu5Z1+Gta1Ar34WXaF8ryUKs5P+6Onhmyh0=";
   };
 
   sourceRoot = "source/packages/python/chart-studio";
diff --git a/pkgs/development/python-modules/clustershell/default.nix b/pkgs/development/python-modules/clustershell/default.nix
index b38d61f6fa0..e1bd8e4f8b7 100644
--- a/pkgs/development/python-modules/clustershell/default.nix
+++ b/pkgs/development/python-modules/clustershell/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "ClusterShell";
-  version = "1.9";
+  version = "1.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-A0arNKF9jPRj3GnnOBHG8xDD2YEPpMrPRbZEaKg8FHQ=";
+    sha256 = "sha256-bwqzyhQbUI2gPOGb1S8eXo0pdz/DBi1782RQqCIH7Bs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/coconut/default.nix b/pkgs/development/python-modules/coconut/default.nix
index c51dd9ecc95..0dc799d7ea2 100644
--- a/pkgs/development/python-modules/coconut/default.nix
+++ b/pkgs/development/python-modules/coconut/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "coconut";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "evhub";
     repo = "coconut";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-zDMcQPAYlxid3fcMT8kRzE+LN1dxUVWjkg8pdVtmwZg=";
+    sha256 = "sha256-+OrVNtre7kAfU5L7/6DadZxFNWVt5raF6HLGXHHpOvE=";
   };
 
   propagatedBuildInputs = [ cpyparsing ipykernel mypy pygments prompt-toolkit watchdog ];
diff --git a/pkgs/development/python-modules/collections-extended/default.nix b/pkgs/development/python-modules/collections-extended/default.nix
index c4d20c23d3f..d1545d36b37 100644
--- a/pkgs/development/python-modules/collections-extended/default.nix
+++ b/pkgs/development/python-modules/collections-extended/default.nix
@@ -5,6 +5,7 @@
 , poetry-core
 , pytestCheckHook
 , pythonOlder
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
@@ -12,7 +13,8 @@ buildPythonPackage rec {
   version = "2.0.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  # https://github.com/mlenzen/collections-extended/issues/198
+  disabled = pythonOlder "3.6" || pythonAtLeast "3.11";
 
   src = fetchFromGitHub {
     owner = "mlenzen";
diff --git a/pkgs/development/python-modules/cot/default.nix b/pkgs/development/python-modules/cot/default.nix
index 9b7914e5b9c..ed40735a206 100644
--- a/pkgs/development/python-modules/cot/default.nix
+++ b/pkgs/development/python-modules/cot/default.nix
@@ -66,6 +66,10 @@ buildPythonPackage rec {
     "TestVMDKConversion"
     # CLI test fails with AssertionError
     "test_help"
+    # Failing TestCOTDeployESXi tests
+    "test_serial_fixup_stubbed"
+    "test_serial_fixup_stubbed_create"
+    "test_serial_fixup_stubbed_vm_not_found"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_serial_fixup_invalid_host"
   ];
diff --git a/pkgs/development/python-modules/cvxopt/default.nix b/pkgs/development/python-modules/cvxopt/default.nix
index c546d11ec3f..d47debe407e 100644
--- a/pkgs/development/python-modules/cvxopt/default.nix
+++ b/pkgs/development/python-modules/cvxopt/default.nix
@@ -51,16 +51,16 @@ buildPythonPackage rec {
     export CVXOPT_SUITESPARSE_INC_DIR=${lib.getDev suitesparse}/include
   '' + lib.optionalString withGsl ''
     export CVXOPT_BUILD_GSL=1
-    export CVXOPT_GSL_LIB_DIR=${gsl}/lib
-    export CVXOPT_GSL_INC_DIR=${gsl}/include
+    export CVXOPT_GSL_LIB_DIR=${lib.getLib gsl}/lib
+    export CVXOPT_GSL_INC_DIR=${lib.getDev gsl}/include
   '' + lib.optionalString withGlpk ''
     export CVXOPT_BUILD_GLPK=1
-    export CVXOPT_GLPK_LIB_DIR=${glpk}/lib
-    export CVXOPT_GLPK_INC_DIR=${glpk}/include
+    export CVXOPT_GLPK_LIB_DIR=${lib.getLib glpk}/lib
+    export CVXOPT_GLPK_INC_DIR=${lib.getDev glpk}/include
   '' + lib.optionalString withFftw ''
     export CVXOPT_BUILD_FFTW=1
-    export CVXOPT_FFTW_LIB_DIR=${fftw}/lib
-    export CVXOPT_FFTW_INC_DIR=${fftw.dev}/include
+    export CVXOPT_FFTW_LIB_DIR=${lib.getLib fftw}/lib
+    export CVXOPT_FFTW_INC_DIR=${lib.getDev fftw}/include
   '';
 
   nativeCheckInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index f859a43bd1e..a43f1a5afb5 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, arrow-cpp
 , bokeh
 , buildPythonPackage
 , click
@@ -70,13 +71,14 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    fastparquet
-    pyarrow
     pytestCheckHook
     pytest-rerunfailures
     pytest-xdist
     scipy
     zarr
+  ] ++ lib.optionals (!arrow-cpp.meta.broken) [ # support is sparse on aarch64
+    fastparquet
+    pyarrow
   ];
 
   dontUseSetuptoolsCheck = true;
diff --git a/pkgs/development/python-modules/datafusion/Cargo.lock.patch b/pkgs/development/python-modules/datafusion/Cargo.lock.patch
deleted file mode 100644
index e4e5eca8af4..00000000000
--- a/pkgs/development/python-modules/datafusion/Cargo.lock.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index fa84a54c..3d790e1c 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -57,9 +57,9 @@ checksum = "be4dc07131ffa69b8072d35f5007352af944213cde02545e2103680baed38fcd"
- 
- [[package]]
- name = "arrow"
--version = "6.0.0"
-+version = "6.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "337e668497751234149fd607f5cb41a6ae7b286b6329589126fe67f0ac55d637"
-+checksum = "216c6846a292bdd93c2b93c1baab58c32ff50e2ab5e8d50db333ab518535dd8b"
- dependencies = [
-  "bitflags",
-  "chrono",
-@@ -212,9 +212,9 @@ dependencies = [
- 
- [[package]]
- name = "comfy-table"
--version = "4.1.1"
-+version = "5.0.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "11e95a3e867422fd8d04049041f5671f94d53c32a9dcd82e2be268714942f3f3"
-+checksum = "c42350b81f044f576ff88ac750419f914abb46a03831bb1747134344ee7a4e64"
- dependencies = [
-  "strum",
-  "strum_macros",
-@@ -279,7 +279,7 @@ dependencies = [
- 
- [[package]]
- name = "datafusion"
--version = "5.1.0"
-+version = "6.0.0"
- dependencies = [
-  "ahash",
-  "arrow",
-@@ -310,7 +310,7 @@ dependencies = [
- 
- [[package]]
- name = "datafusion-python"
--version = "0.3.0"
-+version = "0.4.0"
- dependencies = [
-  "datafusion",
-  "pyo3",
-@@ -877,9 +877,9 @@ dependencies = [
- 
- [[package]]
- name = "parquet"
--version = "6.0.0"
-+version = "6.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d263b9b59ba260518de9e57bd65931c3f765fea0fabacfe84f40d6fde38e841a"
-+checksum = "788d9953f4cfbe9db1beff7bebd54299d105e34680d78b82b1ddc85d432cac9d"
- dependencies = [
-  "arrow",
-  "base64",
-@@ -1228,15 +1228,15 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
- 
- [[package]]
- name = "strum"
--version = "0.21.0"
-+version = "0.22.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "aaf86bbcfd1fa9670b7a129f64fc0c9fcbbfe4f1bc4210e9e98fe71ffc12cde2"
-+checksum = "f7ac893c7d471c8a21f31cfe213ec4f6d9afeed25537c772e08ef3f005f8729e"
- 
- [[package]]
- name = "strum_macros"
--version = "0.21.1"
-+version = "0.22.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d06aaeeee809dbc59eb4556183dd927df67db1540de5be8d3ec0b6636358a5ec"
-+checksum = "339f799d8b549e3744c7ac7feb216383e4005d94bdb22561b3ab8f3b808ae9fb"
- dependencies = [
-  "heck",
-  "proc-macro2",
diff --git a/pkgs/development/python-modules/datafusion/default.nix b/pkgs/development/python-modules/datafusion/default.nix
index fb991dabf3d..84afbfc3a1c 100644
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -5,54 +5,42 @@
 , fetchPypi
 , fetchFromGitHub
 , rustPlatform
-, maturin
 , pytestCheckHook
 , libiconv
 , numpy
 , pandas
 , pyarrow
-, pytest
 }:
+
 let
-  # le sigh, the perils of unrelated versions of software living in the same
-  # repo: there's no obvious way to map the top level source repo
-  # (arrow-datafusion) version to the version of contained repo
-  # (arrow-datafusion/python)
-  #
-  # A commit hash will do in a pinch, and ultimately the sha256 has the final
-  # say of what the content is when building
-  cargoLock = fetchurl {
-    url = "https://raw.githubusercontent.com/apache/arrow-datafusion/6.0.0/python/Cargo.lock";
-    sha256 = "sha256-xiv3drEU5jOGsEIh0U01ZQ1NBKobxO2ctp4mxy9iigw=";
+  arrow-testing = fetchFromGitHub {
+    owner = "apache";
+    repo = "arrow-testing";
+    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
+    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
   };
 
-  postUnpack = ''
-    cp "${cargoLock}" $sourceRoot/Cargo.lock
-    chmod u+w $sourceRoot/Cargo.lock
-  '';
+  parquet-testing = fetchFromGitHub {
+    owner = "apache";
+    repo = "parquet-testing";
+    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
+    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
+  };
 in
+
 buildPythonPackage rec {
   pname = "datafusion";
-  version = "0.4.0";
+  version = "0.7.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-+YqogteKfNhtI2QbVXv/5CIWm3PcOH653dwONm5ZcL8=";
+    sha256 = "sha256-XYXZMorPs2Ue7E38DASd4rmxvX0wlx8A6sCpAbYUh4I=";
   };
 
-  inherit postUnpack;
-
-  # TODO: remove the patch hacking and postUnpack hooks after
-  # https://github.com/apache/arrow-datafusion/pull/1508 is merged
-  #
-  # the lock file isn't up to date as of 6.0.0 so we need to patch the source
-  # lockfile and the vendored cargo deps lockfile
-  patches = [ ./Cargo.lock.patch ];
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src pname version postUnpack;
-    sha256 = "sha256-JGyDxpfBXzduJaMF1sbmRm7KJajHYdVSj+WbiSETiY0=";
-    patches = [ ./Cargo.lock.patch ];
+    inherit src pname version;
+    sha256 = "sha256-6mPdKwsEN09Gf4eNsd/v3EBHVezHmff/KYB2lsXgzcA=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -68,13 +56,18 @@ buildPythonPackage rec {
     pyarrow
   ];
 
-  nativeCheckInputs = [ pytest ];
+  nativeCheckInputs = [ pytestCheckHook ];
   pythonImportsCheck = [ "datafusion" ];
+  pytestFlagsArray = [ "--pyargs" pname ];
+
+  preCheck = ''
+    pushd $TMPDIR
+    ln -s ${arrow-testing} ./testing
+    ln -s ${parquet-testing} ./parquet
+  '';
 
-  checkPhase = ''
-    runHook preCheck
-    pytest --pyargs "${pname}"
-    runHook postCheck
+  postCheck = ''
+    popd
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index f881ed5221a..f54562742b1 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "3.2.16";
+  version = "3.2.17";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Django";
     inherit version;
-    hash = "sha256-OtwoUSQkRySjlPqbmDnMjNEW+vfRWVVMQ+zaqM3wuU0=";
+    hash = "sha256-ZEKINB8G6+STjuxoAba9WaZTSnjkrt3ioVMHXREUOJQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/drf-yasg/default.nix b/pkgs/development/python-modules/drf-yasg/default.nix
index eca45373fab..4853e7eb082 100644
--- a/pkgs/development/python-modules/drf-yasg/default.nix
+++ b/pkgs/development/python-modules/drf-yasg/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "drf-yasg";
-  version = "1.21.4";
+  version = "1.21.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iHyfeeZPRqpIl0I05hApsb6msS6mKKj8ijaXWJrdHT4=";
+    sha256 = "sha256-zu8MO13EOJeBr9eG5tw2l68qL+DYck7h9jfCPXW7xbI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index fec7fac990c..3e9430ef318 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -1,29 +1,46 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder, cython
-, attrs, click, cligj, click-plugins, six, munch, enum34
-, pytestCheckHook, boto3, mock, giflib, pytz
-, gdal, certifi
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, cython
+, gdal
+, setuptools
+, attrs
+, certifi
+, click
+, click-plugins
+, cligj
+, munch
+, shapely
+, boto3
+, pytestCheckHook
+, pytz
 }:
 
 buildPythonPackage rec {
   pname = "fiona";
-  version = "1.9.0";
+  version = "1.9.1";
 
-  src = fetchPypi {
-    pname = "Fiona";
-    inherit version;
-    hash = "sha256-bkh8v7pahJ+98G5FFp/X4fFmL0Tz1xerS5RgRrJFfq4=";
-  };
+  disabled = pythonOlder "3.7";
+
+  format = "pyproject";
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+  src = fetchFromGitHub {
+    owner = "Toblerity";
+    repo = "Fiona";
+    rev = "refs/tags/${version}";
+    hash = "sha256-2CGLkgnpCAh9G+ILol5tmRj9S6/XeKk8eLzGEODiyP8=";
+  };
 
   nativeBuildInputs = [
     cython
     gdal # for gdal-config
+    setuptools
   ];
 
   buildInputs = [
     gdal
-  ] ++ lib.optionals stdenv.cc.isClang [ giflib ];
+  ];
 
   propagatedBuildInputs = [
     attrs
@@ -31,32 +48,33 @@ buildPythonPackage rec {
     click
     cligj
     click-plugins
-    six
     munch
-    pytz
-  ] ++ lib.optional (!isPy3k) enum34;
+    setuptools
+  ];
+
+  passthru.optional-dependencies = {
+    calc = [ shapely ];
+    s3 = [ boto3 ];
+  };
 
   nativeCheckInputs = [
     pytestCheckHook
-    boto3
-  ] ++ lib.optional (pythonOlder "3.4") mock;
+    pytz
+  ] ++ passthru.optional-dependencies.s3;
 
   preCheck = ''
     rm -r fiona # prevent importing local fiona
-    # disable gdal deprecation warnings
-    export GDAL_ENABLE_DEPRECATED_DRIVER_GTM=YES
   '';
 
   disabledTests = [
     # Some tests access network, others test packaging
     "http" "https" "wheel"
-    # https://github.com/Toblerity/Fiona/issues/1164
-    "test_no_append_driver_cannot_append"
   ];
 
   pythonImportsCheck = [ "fiona" ];
 
   meta = with lib; {
+    changelog = "https://github.com/Toblerity/Fiona/blob/${src.rev}/CHANGES.txt";
     description = "OGR's neat, nimble, no-nonsense API for Python";
     homepage = "https://fiona.readthedocs.io/";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/fpylll/default.nix b/pkgs/development/python-modules/fpylll/default.nix
index fb2d0b16688..e1c22cd5788 100644
--- a/pkgs/development/python-modules/fpylll/default.nix
+++ b/pkgs/development/python-modules/fpylll/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , buildPythonPackage
 , pkgconfig
 , gmp
@@ -16,23 +15,15 @@
 
 buildPythonPackage rec {
   pname = "fpylll";
-  version = "0.5.7";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "fplll";
     repo = "fpylll";
     rev = version;
-    sha256 = "sha256-iUPreJ8BSB8LDisbJis0xn8ld6+Nf9Z4AP8SWJlCfZg=";
+    sha256 = "sha256-T6l6hKzRDevlLyLu5H+bnEdl0OhsPer1coCDiftbPAk=";
   };
 
-  patches = [
-   (fetchpatch {
-     name = "remove-strategies-doctest.patch";
-     url = "https://github.com/fplll/fpylll/commit/3edffcd189e9d827a322d83b0f84d32e5f067442.patch";
-     sha256 = "sha256-U7qOIbVzUNwYmjOPryjnE3J+MX/vMwm3T0UyOZ5ylLc=";
-   })
-  ];
-
   buildInputs = [
     gmp
     pari
diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index a8578492fb2..64cdac603e0 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.17.2";
+  version = "2.17.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VDhWYfAdU2PPzjSIhh0XMEnt9krogXV1fNTAFk6R3WM=";
+    hash = "sha256-sYF6yV/VENn11V74vWU2p/pSkPAfYPtW2l1TdHTSR2g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/h5py/default.nix b/pkgs/development/python-modules/h5py/default.nix
index c956d139942..9e38225571d 100644
--- a/pkgs/development/python-modules/h5py/default.nix
+++ b/pkgs/development/python-modules/h5py/default.nix
@@ -46,7 +46,7 @@ in buildPythonPackage rec {
     ${lib.optionalString mpiSupport "export OMPI_MCA_rmaps_base_oversubscribe=yes"}
   '';
 
-  preBuild = if mpiSupport then "export CC=${mpi}/bin/mpicc" else "";
+  preBuild = lib.optionalString mpiSupport "export CC=${mpi}/bin/mpicc";
 
   nativeBuildInputs = [
     cython
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index f019174f8dd..df56ad4b8c8 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.2.7";
+  version = "2023.2.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-1y4KdbXMa+25BQTAuLxfpXoQzoqJN8muldb/3b6IoMo=";
+    sha256 = "sha256-nlsmGIg4qBVDU7vjgl8aP9zkZgJCk3lAijFhQ+2pU80=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hangups/default.nix b/pkgs/development/python-modules/hangups/default.nix
deleted file mode 100644
index aa61baa1b48..00000000000
--- a/pkgs/development/python-modules/hangups/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ lib
-, buildPythonPackage
-, pythonOlder
-, fetchFromGitHub
-, configargparse
-, aiohttp
-, async-timeout
-, appdirs
-, readlike
-, requests
-, reparser
-, protobuf
-, urwid
-, mechanicalsoup
-, httpretty
-, pytestCheckHook
-}:
-
-buildPythonPackage rec {
-  pname = "hangups";
-  version = "0.4.18";
-
-  disabled = pythonOlder "3.6";
-
-  src = fetchFromGitHub {
-    owner = "tdryer";
-    repo = "hangups";
-    rev = "v${version}";
-    hash = "sha256-vq1OrOUPMQtezBFlisP2f/bvvYprDjhOuwUcT8rmIvw=";
-  };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "protobuf>=3.1.0,<4" "protobuf" \
-      --replace "MechanicalSoup>=0.6.0,<0.13" "MechanicalSoup"
-  '';
-
-  propagatedBuildInputs = [
-    configargparse
-    aiohttp
-    async-timeout
-    appdirs
-    readlike
-    requests
-    reparser
-    protobuf
-    urwid
-    mechanicalsoup
-  ];
-
-  nativeCheckInputs = [
-    httpretty
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [
-    "hangups"
-    "hangups.client"
-    "hangups.event"
-    "hangups.parsers"
-    "hangups.user"
-  ];
-
-  meta = with lib; {
-    description = "The first third-party instant messaging client for Google Hangouts";
-    homepage = "https://github.com/tdryer/hangups";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
-  };
-}
diff --git a/pkgs/development/python-modules/hatch-requirements-txt/default.nix b/pkgs/development/python-modules/hatch-requirements-txt/default.nix
index b68506ecd35..af74b15b021 100644
--- a/pkgs/development/python-modules/hatch-requirements-txt/default.nix
+++ b/pkgs/development/python-modules/hatch-requirements-txt/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, hatch
 , hatchling
 , packaging
 , pytestCheckHook
@@ -20,7 +19,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    hatch
+    hatchling
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hist/default.nix b/pkgs/development/python-modules/hist/default.nix
new file mode 100644
index 00000000000..df7f447a044
--- /dev/null
+++ b/pkgs/development/python-modules/hist/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, boost-histogram
+, histoprint
+, hatchling
+, hatch-vcs
+, numpy
+, pytestCheckHook
+, pytest-mpl
+}:
+
+buildPythonPackage rec {
+  pname = "hist";
+  version = "2.6.3";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "dede097733d50b273af9f67386e6dcccaab77e900ae702e1a9408a856e217ce9";
+  };
+
+  buildInputs = [
+    hatchling
+    hatch-vcs
+  ];
+
+  propagatedBuildInputs = [
+    boost-histogram
+    histoprint
+    numpy
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-mpl
+  ];
+
+  meta = with lib; {
+    description = "Histogramming for analysis powered by boost-histogram";
+    homepage = "https://hist.readthedocs.io/en/latest/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/histoprint/default.nix b/pkgs/development/python-modules/histoprint/default.nix
new file mode 100644
index 00000000000..3c65fbf0eb8
--- /dev/null
+++ b/pkgs/development/python-modules/histoprint/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, click
+, numpy
+, setuptools
+, setuptools-scm
+, uhi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "histoprint";
+  version = "2.4.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "328f789d186e3bd76882d57b5aad3fa08c7870a856cc83bcdbad9f4aefbda94d";
+  };
+
+  buildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    click
+    numpy
+    uhi
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Pretty print histograms to the console";
+    homepage = "https://github.com/scikit-hep/histoprint";
+    license = licenses.mit;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/holoviews/default.nix b/pkgs/development/python-modules/holoviews/default.nix
index 8f109053b5e..b60343dfc68 100644
--- a/pkgs/development/python-modules/holoviews/default.nix
+++ b/pkgs/development/python-modules/holoviews/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "holoviews";
-  version = "1.15.3";
+  version = "1.15.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pFiRzSuPzUCHQs//81HJKPv0zx730fBEQsfYeG7o6ZQ=";
+    hash = "sha256-StwTN1DmDnNiZ+3iF2NW5qMDFDiwkTZ8tPKzhN6ZrgM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
index 30e14717273..06f7946b1ef 100644
--- a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
+++ b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-bluetooth";
-  version = "1.9.2";
+  version = "1.9.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-8RGwWx/I6Log7qyGiP+LAWC1GCG2A7UEXnO5fGoTsb4=";
+    hash = "sha256-7wZocfTYTwTBwm61hKmIS4xlHq2nSvC6p8SlklnHq4M=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ibeacon-ble/default.nix b/pkgs/development/python-modules/ibeacon-ble/default.nix
index 7b9910559b4..1f0f799d587 100644
--- a/pkgs/development/python-modules/ibeacon-ble/default.nix
+++ b/pkgs/development/python-modules/ibeacon-ble/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-iYgGflM0IpSIMNgPpJAFAl9FYoMfRinM3sP6VRcBSMc=";
   };
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for iBeacon BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/ibeacon-ble";
+    changelog = "https://github.com/Bluetooth-Devices/ibeacon-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index a49f7c684aa..173991f04df 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -16,6 +16,7 @@
 , geoalchemy2
 , geopandas
 , graphviz-nox
+, hypothesis
 , lz4
 , multipledispatch
 , numpy
@@ -30,8 +31,9 @@
 , pymysql
 , pyspark
 , pytest-benchmark
-, pytest-randomly
 , pytest-mock
+, pytest-randomly
+, pytest-snapshot
 , pytest-xdist
 , python
 , pytz
@@ -62,7 +64,7 @@ in
 
 buildPythonPackage rec {
   pname = "ibis-framework";
-  version = "3.2.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -71,10 +73,12 @@ buildPythonPackage rec {
     repo = "ibis";
     owner = "ibis-project";
     rev = version;
-    hash = "sha256-YRP1nGJs4btqXQirm0GfEDKNPCVXexVrwQ6sE8JtD2o=";
+    hash = "sha256-G3kMd6Jyib7ZXHFP6t2CEPlDD5n5zHE2jq/0he3U4Nk=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   propagatedBuildInputs = [
     atpublic
@@ -95,29 +99,31 @@ buildPythonPackage rec {
     pytestCheckHook
     click
     filelock
+    hypothesis
     pytest-benchmark
     pytest-mock
     pytest-randomly
+    pytest-snapshot
     pytest-xdist
     rsync
   ] ++ lib.concatMap (name: passthru.optional-dependencies.${name}) testBackends;
 
-  preBuild = ''
-    # setup.py exists only for developer convenience and is automatically generated
-    # it gets in the way in nixpkgs so we remove it
-    rm setup.py
-  '';
-
   pytestFlagsArray = [
     "--dist=loadgroup"
     "-m"
     "'${lib.concatStringsSep " or " testBackends} or core'"
-    # this test fails on nixpkgs datafusion version (0.4.0), but works on
-    # datafusion 0.6.0
-    "-k"
-    "'not datafusion-no_op'"
   ];
 
+  # remove when sqlalchemy backend no longer uses deprecated methods
+  SQLALCHEMY_SILENCE_UBER_WARNING = 1;
+
+  # patch out tests that check formatting with black
+  postPatch = ''
+    find ibis/tests -type f -name '*.py' -exec sed -i \
+      -e '/^ *assert_decompile_roundtrip/d' \
+      -e 's/^\( *\)code = ibis.decompile(expr, format=True)/\1code = ibis.decompile(expr)/g' {} +
+  '';
+
   preCheck = ''
     set -eo pipefail
 
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 2d705352d1b..061b20a835d 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "2.5.17";
+  version = "2.5.18";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-urviMomTJdbublr2nCj25R/xbs/pEsRKWxmklneTjOQ=";
+    sha256 = "sha256-Pf9/mjbyC859WT8ZreFq5u6YER/tRgsQuqIgt6mdPqE=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/iminuit/default.nix b/pkgs/development/python-modules/iminuit/default.nix
index eebeb17bb7e..97c224a39ac 100644
--- a/pkgs/development/python-modules/iminuit/default.nix
+++ b/pkgs/development/python-modules/iminuit/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "iminuit";
-  version = "2.18.0";
+  version = "2.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fuLGoLzaxYGzj66NDzQ/3uVfkfH2psyWQ/z7zGwtw+Y=";
+    hash = "sha256-9NHLrM8RXNxIZpaPZJ8qN3lKXA3gGN6BVqp0VWNQpUw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/inkbird-ble/default.nix b/pkgs/development/python-modules/inkbird-ble/default.nix
index 4c39d264ce7..fc5eb2d12ba 100644
--- a/pkgs/development/python-modules/inkbird-ble/default.nix
+++ b/pkgs/development/python-modules/inkbird-ble/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-re5HjPtssFkpcltCr0HEJmJyHbXJdkr2wDgaAHfy2Tk=";
   };
 
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Inkbird BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/inkbird-ble";
+    changelog = "https://github.com/Bluetooth-Devices/inkbird-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/inquirer/default.nix b/pkgs/development/python-modules/inquirer/default.nix
index a0a37ce92f8..3ea584fbc03 100644
--- a/pkgs/development/python-modules/inquirer/default.nix
+++ b/pkgs/development/python-modules/inquirer/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 
 # native
 , poetry-core
@@ -18,14 +19,16 @@
 
 buildPythonPackage rec {
   pname = "inquirer";
-  version = "3.1.1";
+  version = "3.1.2";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub rec {
     owner = "magmax";
     repo = "python-inquirer";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-gDJqD0IHshyGw9MmMtYjkkpvYklRLgPd6EtLVqi2I/o=";
+    hash = "sha256-7kq0sZzPeCX7TA5Cl2rg6Uw+9jLz335a+tOrO0+Cyas=";
   };
 
   nativeBuildInputs = [
@@ -44,10 +47,16 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+
+  pythonImportsCheck = [
+    "inquirer"
+  ];
+
   meta = with lib; {
-    homepage = "https://github.com/magmax/python-inquirer";
     description = "A collection of common interactive command line user interfaces, based on Inquirer.js";
+    homepage = "https://github.com/magmax/python-inquirer";
+    changelog = "https://github.com/magmax/python-inquirer/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = [ maintainers.mmahut ];
+    maintainers = with maintainers; [ mmahut ];
   };
 }
diff --git a/pkgs/development/python-modules/kegtron-ble/default.nix b/pkgs/development/python-modules/kegtron-ble/default.nix
index 315054b10de..e5ddcf01be1 100644
--- a/pkgs/development/python-modules/kegtron-ble/default.nix
+++ b/pkgs/development/python-modules/kegtron-ble/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-O5I5shW8nL2RAQptS2Bp/GI/4L6o0xXXmwYvRq0MM8o=";
   };
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Kegtron BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/kegtron-ble";
+    changelog = "https://github.com/Bluetooth-Devices/kegtron-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/led-ble/default.nix b/pkgs/development/python-modules/led-ble/default.nix
index 53ae154857a..a75bc1f59ab 100644
--- a/pkgs/development/python-modules/led-ble/default.nix
+++ b/pkgs/development/python-modules/led-ble/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-XAb/tJPUe/sNvcU7t63inMPBIz+AREioWXBuQa/c9T0=";
   };
 
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for LED BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/led-ble";
+    changelog = "https://github.com/Bluetooth-Devices/led-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/lightning/default.nix b/pkgs/development/python-modules/lightning/default.nix
deleted file mode 100644
index f6d21f95dbf..00000000000
--- a/pkgs/development/python-modules/lightning/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pytest
-, jinja2
-, matplotlib
-, numpy
-, requests
-, six
-}:
-
-buildPythonPackage rec {
-  version = "1.2.1";
-  pname = "lightning-python";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "3987d7d4a634bdb6db9bcf212cf4d2f72bab5bc039f4f6cbc02c9d01c4ade792";
-  };
-
-  buildInputs = [ pytest ];
-  propagatedBuildInputs = [ jinja2 matplotlib numpy requests six ];
-
-  meta = with lib; {
-    description = "A Python client library for the Lightning data visualization server";
-    homepage = "http://lightning-viz.org";
-    license = licenses.mit;
-  };
-
-}
diff --git a/pkgs/development/python-modules/limnoria/default.nix b/pkgs/development/python-modules/limnoria/default.nix
index 428b199294c..6f07c885486 100644
--- a/pkgs/development/python-modules/limnoria/default.nix
+++ b/pkgs/development/python-modules/limnoria/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "limnoria";
-  version = "2023.1.12";
+  version = "2023.1.28";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-V3DkIsnVv/HekWuOnIKnMHhccDGWun7mF7AcBSEsy6o=";
+    hash = "sha256-yIKJAW5hb7EOUiS7G+Q4QAESfG4dbfqHScaQBKLMkeM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mediapy/default.nix b/pkgs/development/python-modules/mediapy/default.nix
index 44190b11e59..333f55ce422 100644
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ ipython matplotlib numpy pillow ];
 
+  format = "flit";
+
   pythonImportsCheck = [ "mediapy" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/moat-ble/default.nix b/pkgs/development/python-modules/moat-ble/default.nix
index 5131fd04860..2e55edd7aed 100644
--- a/pkgs/development/python-modules/moat-ble/default.nix
+++ b/pkgs/development/python-modules/moat-ble/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-dy1Fm0Z1PUsPY8QTiXUcWSi+csFnTUsobSkA92m06QI=";
   };
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Moat BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/moat-ble";
+    changelog = "https://github.com/Bluetooth-Devices/moat-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/mox3/default.nix b/pkgs/development/python-modules/mox3/default.nix
index 3aa8b02dc10..2cdfd2c0c74 100644
--- a/pkgs/development/python-modules/mox3/default.nix
+++ b/pkgs/development/python-modules/mox3/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, pythonAtLeast
 , subunit
 , testrepository
 , testtools
@@ -13,7 +14,7 @@
 buildPythonPackage rec {
   pname = "mox3";
   version = "1.1.0";
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.6" || pythonAtLeast "3.11";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/n3fit/default.nix b/pkgs/development/python-modules/n3fit/default.nix
new file mode 100644
index 00000000000..5c8b06b74a6
--- /dev/null
+++ b/pkgs/development/python-modules/n3fit/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, hyperopt
+, keras
+, nnpdf
+, psutil
+, tensorflow
+, validphys2
+}:
+
+buildPythonPackage rec {
+  pname = "n3fit";
+  version = "4.0";
+  format = "setuptools";
+
+  inherit (nnpdf) src;
+
+  prePatch = ''
+    cd n3fit
+  '';
+
+  postPatch = ''
+    substituteInPlace src/n3fit/version.py \
+      --replace '= __give_git()' '= "'$version'"'
+  '';
+
+  propagatedBuildInputs = [
+    hyperopt
+    keras
+    psutil
+    tensorflow
+    validphys2
+  ];
+
+  postInstall = ''
+    for prog in "$out"/bin/*; do
+      wrapProgram "$prog" --set PYTHONPATH "$PYTHONPATH:$(toPythonPath "$out")"
+    done
+  '';
+
+  doCheck = false; # no tests
+  pythonImportsCheck = [ "n3fit" ];
+
+  meta = with lib; {
+    description = "NNPDF fitting framework";
+    homepage = "https://docs.nnpdf.science";
+    inherit (nnpdf.meta) license;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/nipy/default.nix b/pkgs/development/python-modules/nipy/default.nix
index d5e399701dc..9f600bdf86a 100644
--- a/pkgs/development/python-modules/nipy/default.nix
+++ b/pkgs/development/python-modules/nipy/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, cython
 , nose
 , matplotlib
 , nibabel
@@ -21,9 +22,14 @@ buildPythonPackage rec {
     sha256 = "a8a2c97ce854fece4aced5a6394b9fdca5846150ad6d2a36b86590924af3c848";
   };
 
+  nativeBuildInputs = [ cython ];
   buildInputs = lib.optionals doCheck [ nose ];
   propagatedBuildInputs = [ matplotlib nibabel numpy scipy sympy ];
 
+  preBuild = ''
+    make recythonize
+  '';
+
   checkPhase = ''    # wants to be run in a different directory
     mkdir nosetests
     cd nosetests
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
index b21f343db32..e3cd5bb0923 100644
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -1,35 +1,42 @@
 { lib
 , buildPythonPackage
+, python3
 , bash
 , cmake
-, fetchPypi
+, fetchFromGitHub
+, gtest
 , isPy27
 , nbval
 , numpy
 , protobuf
+, pybind11
 , pytestCheckHook
 , six
 , tabulate
 , typing-extensions
 , pythonRelaxDepsHook
-, pytest-runner
 }:
 
-buildPythonPackage rec {
+let
+  gtestStatic = gtest.override { static = true; };
+in buildPythonPackage rec {
   pname = "onnx";
   version = "1.13.0";
   format = "setuptools";
 
   disabled = isPy27;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-QQs5lQNnhX+XtlCTaB/iSVouI9Y3d6is6vlsVqFtFm4=";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-D8POBAkZVr0O5i4qsSuYRkDfL8WsDTqzgNACmmkFwGs=";
   };
 
   nativeBuildInputs = [
     cmake
     pythonRelaxDepsHook
+    pybind11
   ];
 
   pythonRelaxDeps = [ "protobuf" ];
@@ -44,30 +51,36 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     nbval
     pytestCheckHook
-    pytest-runner
     tabulate
   ];
 
   postPatch = ''
     chmod +x tools/protoc-gen-mypy.sh.in
     patchShebangs tools/protoc-gen-mypy.sh.in
+
+    substituteInPlace setup.py \
+      --replace 'setup_requires.append("pytest-runner")' ""
+
+    # prevent from fetching & building own gtest
+    substituteInPlace CMakeLists.txt \
+      --replace 'include(googletest)' ""
+    substituteInPlace cmake/unittest.cmake \
+      --replace 'googletest)' ')'
   '';
 
-  # Set CMAKE_INSTALL_LIBDIR to lib explicitly, because otherwise it gets set
-  # to lib64 and cmake incorrectly looks for the protobuf library in lib64
   preConfigure = ''
+    # Set CMAKE_INSTALL_LIBDIR to lib explicitly, because otherwise it gets set
+    # to lib64 and cmake incorrectly looks for the protobuf library in lib64
     export CMAKE_ARGS="-DCMAKE_INSTALL_LIBDIR=lib -DONNX_USE_PROTOBUF_SHARED_LIBS=ON"
+  '' + lib.optionalString doCheck ''
+    export CMAKE_ARGS+=" -Dgoogletest_STATIC_LIBRARIES=${gtestStatic}/lib/libgtest.a -Dgoogletest_INCLUDE_DIRS=${lib.getDev gtestStatic}/include"
+    export ONNX_BUILD_TESTS=1
   '';
 
   preBuild = ''
     export MAX_JOBS=$NIX_BUILD_CORES
   '';
 
-  disabledTestPaths = [
-    # Unexpected output fields from running code: {'stderr'}
-    "onnx/examples/np_array_tensorproto.ipynb"
-  ];
-
   # The executables are just utility scripts that aren't too important
   postInstall = ''
     rm -r $out/bin
@@ -76,6 +89,35 @@ buildPythonPackage rec {
   # The setup.py does all the configuration
   dontUseCmakeConfigure = true;
 
+  doCheck = true;
+  preCheck = ''
+    export HOME=$(mktemp -d)
+
+    # detecting source dir as a python package confuses pytest
+    mv onnx/__init__.py onnx/__init__.py.hidden
+  '';
+  pytestFlagsArray = [ "onnx/test" "onnx/examples" ];
+  disabledTests = [
+    # attempts to fetch data from web
+    "test_bvlc_alexnet_cpu"
+    "test_densenet121_cpu"
+    "test_inception_v1_cpu"
+    "test_inception_v2_cpu"
+    "test_resnet50_cpu"
+    "test_shufflenet_cpu"
+    "test_squeezenet_cpu"
+    "test_vgg19_cpu"
+    "test_zfnet512_cpu"
+  ];
+  disabledTestPaths = [
+    # Unexpected output fields from running code: {'stderr'}
+    "onnx/examples/np_array_tensorproto.ipynb"
+  ];
+  postCheck = ''
+    # run "cpp" tests
+    .setuptools-cmake-build/onnx_gtests
+  '';
+
   pythonImportsCheck = [
     "onnx"
   ];
diff --git a/pkgs/development/python-modules/optuna/default.nix b/pkgs/development/python-modules/optuna/default.nix
index c921feadd0e..dc07fcffac2 100644
--- a/pkgs/development/python-modules/optuna/default.nix
+++ b/pkgs/development/python-modules/optuna/default.nix
@@ -70,10 +70,10 @@ buildPythonPackage rec {
     typing
   ];
 
-  configurePhase = if !(pythonOlder "3.5") then ''
+  configurePhase = lib.optionalString (! pythonOlder "3.5") ''
     substituteInPlace setup.py \
       --replace "'typing'," ""
-  '' else "";
+  '';
 
   checkPhase = ''
     pytest --ignore tests/test_cli.py \
diff --git a/pkgs/development/python-modules/oralb-ble/default.nix b/pkgs/development/python-modules/oralb-ble/default.nix
index c0f2840763e..689cd790336 100644
--- a/pkgs/development/python-modules/oralb-ble/default.nix
+++ b/pkgs/development/python-modules/oralb-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "oralb-ble";
-  version = "0.17.4";
+  version = "0.17.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-KvvcyeYXBtV/sUKMv+1xoXH9ALUX46EWS/STFZkCnUQ=";
+    hash = "sha256-Lwrr5XzU2pbx3cYkvYtHgXFhGnz3cMBnNFWCpuY3ltg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oslo-log/default.nix b/pkgs/development/python-modules/oslo-log/default.nix
index d981114b730..7d8443a14b3 100644
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "oslo-log";
-  version = "5.0.2";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "oslo.log";
     inherit version;
-    hash = "sha256-5F5zEqpxUooWc2zkUVK+PxrxI/XvYqqB2gRoBVhPzKM=";
+    hash = "sha256-9qw3r5WRjgXXod19CwVSuosisuQwhi6zNt5ZLSXITyk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index f23521ea214..47ef2faea96 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pytestCheckHook, p7zip,
+{ lib, buildPythonPackage, fetchFromGitHub, fetchurl, pytestCheckHook, p7zip,
   cabextract, zip, lzip, zpaq, gnutar, gnugrep, diffutils, file,
   gzip, bzip2, xz}:
 
@@ -6,6 +6,17 @@
 # it will still use unrar if present in the path
 
 let
+  # FIXME: backport a patch in `file` that seemingly only affects this package
+  # Revert when fix to main package makes it through staging.
+  file' = file.overrideAttrs(old: {
+    patches = (old.patches or []) ++ [
+      (fetchurl {
+        url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-apps/file/files/file-5.44-decompress-empty.patch?h=dfc57da515a2aaf085bea68267cc727f1bfaa691";
+        hash = "sha256-fUzRQAlLWczBmR5iA1Gk66mHjP40MJcMdgCtm2+u1SQ=";
+      })
+    ];
+  });
+
   compression-utilities = [
     p7zip
     gnutar
@@ -17,7 +28,7 @@ let
     gnugrep
     diffutils
     bzip2
-    file
+    file'
     xz
   ];
 in
diff --git a/pkgs/development/python-modules/pc-ble-driver-py/default.nix b/pkgs/development/python-modules/pc-ble-driver-py/default.nix
index b9f8486aa5d..61072507e29 100644
--- a/pkgs/development/python-modules/pc-ble-driver-py/default.nix
+++ b/pkgs/development/python-modules/pc-ble-driver-py/default.nix
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "NordicSemiconductor";
     repo = "pc-ble-driver-py";
-    rev = "v${version}";
-    sha256 = "sha256-brC33ar2Jq3R2xdrklvVsQKf6pcnKwD25PO4TIvXgTg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-brC33ar2Jq3R2xdrklvVsQKf6pcnKwD25PO4TIvXgTg=";
   };
 
   nativeBuildInputs = [
@@ -57,8 +57,9 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Bluetooth Low Energy nRF5 SoftDevice serialization";
     homepage = "https://github.com/NordicSemiconductor/pc-ble-driver-py";
+    changelog = "https://github.com/NordicSemiconductor/pc-ble-driver-py/releases/tag/v${version}";
     license = licenses.unfreeRedistributable;
-    platforms = platforms.unix;
     maintainers = with maintainers; [ gebner ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/pefile/default.nix b/pkgs/development/python-modules/pefile/default.nix
index b1707670e76..55bd8c0cc07 100644
--- a/pkgs/development/python-modules/pefile/default.nix
+++ b/pkgs/development/python-modules/pefile/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pefile";
-  version = "2022.5.30";
+  version = "2023.2.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "erocarrera";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Cv20hJsErHFSuS5Q1kqLNp4DAsPXv/eFhaU9oYECSeI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lD8GpNl+cVNYTZUKFRF1/2kDwEbn/ekRBNBTYuFmFW0=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Multi-platform Python module to parse and work with Portable Executable (aka PE) files";
     homepage = "https://github.com/erocarrera/pefile";
+    changelog = "https://github.com/erocarrera/pefile/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ pamplemousse ];
   };
diff --git a/pkgs/development/python-modules/primer3/default.nix b/pkgs/development/python-modules/primer3/default.nix
index 14c96e5734a..d3d44259fef 100644
--- a/pkgs/development/python-modules/primer3/default.nix
+++ b/pkgs/development/python-modules/primer3/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "primer3";
-  version = "0.6.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "libnano";
     repo = "primer3-py";
-    rev = version;
-    sha256 = "1glybwp9w2m1ydvaphr41gj31d8fvlh40s35galfbjqa563si72g";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-o9B8TN3mOchOO7dz34mI3NDtIhHSlA9+lMNsYcxhTE0=";
   };
 
   nativeBuildInputs = [ cython ]
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index a862fa69a9a..a330a939287 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , python
+, pythonAtLeast
 , pythonOlder
 , arrow-cpp
 , cffi
@@ -17,18 +18,15 @@
 , pkg-config
 , scipy
 , setuptools-scm
-, six
 }:
 
 let
   zero_or_one = cond: if cond then 1 else 0;
-
-  _arrow-cpp = arrow-cpp.override { python3 = python; };
 in
 
 buildPythonPackage rec {
   pname = "pyarrow";
-  inherit (_arrow-cpp) version src;
+  inherit (arrow-cpp) version src;
 
   disabled = pythonOlder "3.7";
 
@@ -41,13 +39,14 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  buildInputs = [ arrow-cpp ];
+
   propagatedBuildInputs = [
     cffi
     cloudpickle
     fsspec
     numpy
     scipy
-    six
   ];
 
   nativeCheckInputs = [
@@ -60,20 +59,24 @@ buildPythonPackage rec {
   PYARROW_BUILD_TYPE = "release";
 
   PYARROW_WITH_DATASET = zero_or_one true;
-  PYARROW_WITH_FLIGHT = zero_or_one _arrow-cpp.enableFlight;
+  PYARROW_WITH_FLIGHT = zero_or_one arrow-cpp.enableFlight;
   PYARROW_WITH_HDFS = zero_or_one true;
   PYARROW_WITH_PARQUET = zero_or_one true;
-  PYARROW_WITH_PLASMA = zero_or_one (!stdenv.isDarwin);
-  PYARROW_WITH_S3 = zero_or_one _arrow-cpp.enableS3;
+  PYARROW_WITH_PARQUET_ENCRYPTION = zero_or_one true;
+  # Plasma is deprecated since arrow 10.0.0
+  PYARROW_WITH_PLASMA = zero_or_one false;
+  PYARROW_WITH_S3 = zero_or_one arrow-cpp.enableS3;
+  PYARROW_WITH_GCS = zero_or_one arrow-cpp.enableGcs;
+  PYARROW_BUNDLE_ARROW_CPP_HEADERS = zero_or_one false;
 
   PYARROW_CMAKE_OPTIONS = [
     "-DCMAKE_INSTALL_RPATH=${ARROW_HOME}/lib"
   ];
 
-  ARROW_HOME = _arrow-cpp;
-  PARQUET_HOME = _arrow-cpp;
+  ARROW_HOME = arrow-cpp;
+  PARQUET_HOME = arrow-cpp;
 
-  ARROW_TEST_DATA = lib.optionalString doCheck _arrow-cpp.ARROW_TEST_DATA;
+  ARROW_TEST_DATA = lib.optionalString doCheck arrow-cpp.ARROW_TEST_DATA;
 
   doCheck = true;
 
@@ -85,6 +88,13 @@ buildPythonPackage rec {
     export PYARROW_PARALLEL=$NIX_BUILD_CORES
   '';
 
+  postInstall = ''
+    # copy the pyarrow C++ header files to the appropriate location
+    pyarrow_include="$out/${python.sitePackages}/pyarrow/include"
+    mkdir -p "$pyarrow_include/arrow/python"
+    find "$PWD/pyarrow/src/arrow" -type f -name '*.h' -exec cp {} "$pyarrow_include/arrow/python" \;
+  '';
+
   pytestFlagsArray = [
     # Deselect a single test because pyarrow prints a 2-line error message where
     # only a single line is expected. The additional line of output comes from
@@ -102,6 +112,8 @@ buildPythonPackage rec {
     "--deselect=pyarrow/tests/test_pandas.py::test_threaded_pandas_import"
     # Flaky test, works locally but not on Hydra
     "--deselect=pyarrow/tests/test_csv.py::TestThreadedCSVTableRead::test_cancellation"
+    # expects arrow-cpp headers to be bundled
+    "--deselect=pyarrow/tests/test_cpp_internals.py::test_pyarrow_include"
   ] ++ lib.optionals stdenv.isDarwin [
     # Requires loopback networking
     "--deselect=pyarrow/tests/test_ipc.py::test_socket_"
@@ -109,8 +121,18 @@ buildPythonPackage rec {
     "--deselect=pyarrow/tests/test_flight.py::test_large_descriptor"
     "--deselect=pyarrow/tests/test_flight.py::test_large_metadata_client"
     "--deselect=pyarrow/tests/test_flight.py::test_none_action_side_effect"
+    # fails to compile
+    "--deselect=pyarrow/tests/test_cython.py::test_cython_api"
+  ] ++ lib.optionals (pythonAtLeast "3.11") [
+    # Repr output is printing number instead of enum name so these tests fail
+    "--deselect=pyarrow/tests/test_fs.py::test_get_file_info"
+  ] ++ lib.optionals stdenv.isLinux [
+    # this test requires local networking
+    "--deselect=pyarrow/tests/test_fs.py::test_filesystem_from_uri_gcs"
   ];
 
+  disabledTests = [ "GcsFileSystem" ];
+
   dontUseSetuptoolsCheck = true;
 
   preCheck = ''
@@ -125,7 +147,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [
     "pyarrow"
-  ] ++ map (module: "pyarrow.${module}") ([
+  ] ++ map (module: "pyarrow.${module}") [
     "compute"
     "csv"
     "dataset"
@@ -135,9 +157,7 @@ buildPythonPackage rec {
     "hdfs"
     "json"
     "parquet"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "plasma"
-  ]);
+  ];
 
   meta = with lib; {
     description = "A cross-language development platform for in-memory data";
diff --git a/pkgs/development/python-modules/pyls-black/default.nix b/pkgs/development/python-modules/pyls-black/default.nix
deleted file mode 100644
index 3e12fbdf979..00000000000
--- a/pkgs/development/python-modules/pyls-black/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, black
-, toml
-, pytestCheckHook
-, python-language-server
-, isPy3k
-}:
-
-buildPythonPackage rec {
-  pname = "pyls-black";
-  version = "0.4.7";
-
-  src = fetchFromGitHub {
-    owner = "rupert";
-    repo = "pyls-black";
-    rev = "v${version}";
-    sha256 = "0bkhfnlik89j3yamr20br4wm8975f20v33wabi2nyxvj10whr5dj";
-  };
-
-  disabled = !isPy3k;
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  propagatedBuildInputs = [ black toml python-language-server ];
-
-  meta = with lib; {
-    homepage = "https://github.com/rupert/pyls-black";
-    description = "Black plugin for the Python Language Server";
-    license = licenses.mit;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/pyflunearyou/default.nix b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
index cd04d00ee32..ff2a4a4323c 100644
--- a/pkgs/development/python-modules/pyflunearyou/default.nix
+++ b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
@@ -1,7 +1,6 @@
 { lib
 , aiohttp
 , aresponses
-, aiocache
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
@@ -9,39 +8,29 @@
 , pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
-, pythonRelaxDepsHook
-, msgpack
 , ujson
 }:
 
 buildPythonPackage rec {
-  pname = "pyflunearyou";
-  version = "2021.10.0";
+  pname = "pyoutbreaksnearme";
+  version = "2022.10.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-Q65OSE4qckpvaIvZULBR434i7hwuVM97eSq1Blb1oIU=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-D7oXkKDSg+yF+j1WyG/VVY12hLU6oyhEtxLrF6IkMSA=";
   };
 
-  pythonRelaxDeps = [
-    "aiocache"
-    "ujson"
-  ];
-
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
     aiohttp
-    aiocache
-    msgpack
     ujson
   ];
 
@@ -58,12 +47,13 @@ buildPythonPackage rec {
   ];
 
   pythonImportsCheck = [
-    "pyflunearyou"
+    "pyoutbreaksnearme"
   ];
 
   meta = with lib; {
-    description = "Python library for retrieving UV-related information from Flu Near You";
-    homepage = "https://github.com/bachya/pyflunearyou";
+    description = "Library for retrieving data from for Outbreaks Near Me";
+    homepage = "https://github.com/bachya/pyoutbreaksnearme";
+    changelog = "https://github.com/bachya/pyoutbreaksnearme/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 49e6abffd54..5cf5dd79103 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.7.3";
+  version = "1.7.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hmi6cOBHbcxzA10vQt6fxB8qHrr4My5JFmucV5QCUVg=";
+    hash = "sha256-I115lMEg/baWuUZThfisNYSck/QdiYecjhhRqgSkLB8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index 1c69f426b16..feae8490130 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -37,6 +37,12 @@ buildPythonPackage rec {
     toml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
+  disabledTests = [
+    "test_wait_raise_assertion_false" # racy
+  ];
+
   pythonImportsCheck = [
     "pytest_httpserver"
   ];
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index a0e9bb1fb2a..c6e8b7e915d 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -1,23 +1,31 @@
-{ lib, buildPythonPackage, pythonOlder, fetchPypi, pytest, mock }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, setuptools
+, packaging
+, pytest
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "10.3";
+  version = "11.0";
+  format = "pyproject";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2CRNeZ+Jpu215XMB3a6ztvENZpFjjVHoCzcTEVkuKMY=";
+    hash = "sha256-zuWeTm8Nc65j+6CZhlMUupuRW3GTSVQREPoBL/tu+xM=";
   };
 
-  buildInputs = [ pytest ];
+  nativeBuildInputs = [ setuptools ];
 
-  nativeCheckInputs = [ mock pytest ];
+  buildInputs = [ pytest ];
+  propagatedBuildInputs = [ packaging ];
 
-  checkPhase = ''
-    py.test test_pytest_rerunfailures.py
-  '';
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Pytest plugin to re-run tests to eliminate flaky failures";
diff --git a/pkgs/development/python-modules/python-magic/default.nix b/pkgs/development/python-modules/python-magic/default.nix
index 725849fee07..358a647d52d 100644
--- a/pkgs/development/python-modules/python-magic/default.nix
+++ b/pkgs/development/python-modules/python-magic/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , file
 , pytestCheckHook
@@ -23,6 +24,11 @@ buildPythonPackage rec {
       src = ./libmagic-path.patch;
       libmagic = "${file}/lib/libmagic${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
+    (fetchpatch {
+      name = "update-test-for-upstream-added-gzip-extensions.patch";
+      url = "https://github.com/ahupp/python-magic/commit/4ffcd59113fa26d7c2e9d5897b1eef919fd4b457.patch";
+      hash = "sha256-67GpjlGiR4/os/iZ69V+ZziVLpjmid+7t+gQ2aQy9I0=";
+    })
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
index 8c43d7a4ca2..ade6acd85d4 100644
--- a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
+++ b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "python-mpv-jsonipc";
-  version = "1.1.11";
+  version = "1.1.14";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = "python-mpv-jsonipc";
     rev = "v${version}";
-    sha256 = "034vc2j54dciiq80k7jn6kx4g7i58sjk0ykma039k5rihj2rblpk";
+    sha256 = "sha256-kOC6FsLYTVx/cCL8AZuGkKarHqAESjJA+2BUagbiy3A=";
   };
 
   # 'mpv-jsonipc' does not have any tests
diff --git a/pkgs/development/python-modules/python-utils/default.nix b/pkgs/development/python-modules/python-utils/default.nix
index 5a5ac9f772a..ac69e15ec77 100644
--- a/pkgs/development/python-modules/python-utils/default.nix
+++ b/pkgs/development/python-modules/python-utils/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , loguru
@@ -10,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "python-utils";
-  version = "3.4.5";
+  version = "3.5.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +20,7 @@ buildPythonPackage rec {
     owner = "WoLpH";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-O/+jvdzzxUFaQdAfUM9p40fPPDNN+stTauCD993HH6Y=";
+    hash = "sha256-FFBWkq7ct4JWSTH4Ldg+pbG/BAiW33puB7lqFPBjptw=";
   };
 
   postPatch = ''
@@ -47,6 +48,11 @@ buildPythonPackage rec {
     "_python_utils_tests"
   ];
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # Flaky tests on darwin
+    "test_timeout_generator"
+  ];
+
   meta = with lib; {
     description = "Module with some convenient utilities";
     homepage = "https://github.com/WoLpH/python-utils";
diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index e162a4a6cb6..b8594e51f83 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2022.7";
+  version = "2022.7.1";
 
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fM+ue0ssBnRkpnM8YmFnP9uP0b6QVGA5a5egc+n6aDo=";
+    hash = "sha256-AaBoHEuWhKKDBGFeulXRqzGuAL9o7BV+w3CKgYLbvNA=";
   };
 
   nativeCheckInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/pyvo/default.nix b/pkgs/development/python-modules/pyvo/default.nix
index 634db03a3a2..64798acad2e 100644
--- a/pkgs/development/python-modules/pyvo/default.nix
+++ b/pkgs/development/python-modules/pyvo/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , astropy
 , pillow
 , pythonOlder
@@ -22,6 +23,14 @@ buildPythonPackage rec {
     sha256 = "sha256-R2ttLoFd6Ic0KZl49dzN5NtWAqPpXRaeki6X8CRGsCw=";
   };
 
+  patches = [
+    # Backport Python 3.11 support.
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/astropy/pyvo/pull/385.patch";
+      sha256 = "IHf3W9fIT8XFvyM41PUiJkt1j+B3RkX3TS4FOnRUMDk=";
+    })
+  ];
+
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyweatherflowrest/default.nix b/pkgs/development/python-modules/pyweatherflowrest/default.nix
index b1384496325..c03a4d01b17 100644
--- a/pkgs/development/python-modules/pyweatherflowrest/default.nix
+++ b/pkgs/development/python-modules/pyweatherflowrest/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyweatherflowrest";
-  version = "1.0.8";
+  version = "1.0.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "briis";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1swyqdnvhwaigqhjn5a22gi8if4bl8alfrigln4qa0jl9z03kg09";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LFA1GJCYFIWl7/YblRrYgAB4lbELpzhCJyjB8aCkJ/E=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to get data from WeatherFlow Weather Stations";
     homepage = "https://github.com/briis/pyweatherflowrest";
+    changelog = "https://github.com/briis/pyweatherflowrest/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/qingping-ble/default.nix b/pkgs/development/python-modules/qingping-ble/default.nix
index 21053b8c75b..8140226b4dd 100644
--- a/pkgs/development/python-modules/qingping-ble/default.nix
+++ b/pkgs/development/python-modules/qingping-ble/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-vfezalq3x9KAMtwixUkIVQIwBO2zd+BDl+JwdRqBn7w=";
   };
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Qingping BLE devices";
     homepage = "https://github.com/bluetooth-devices/qingping-ble";
+    changelog = "https://github.com/Bluetooth-Devices/qingping-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/quantiphy/default.nix b/pkgs/development/python-modules/quantiphy/default.nix
index 38ff4bc434f..b05a0428f97 100644
--- a/pkgs/development/python-modules/quantiphy/default.nix
+++ b/pkgs/development/python-modules/quantiphy/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "quantiphy";
-  version = "2.18";
+  version = "2.19";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "KenKundert";
     repo = "quantiphy";
     rev = "v${version}";
-    hash = "sha256-KXZQTal5EQDrMNV9QKeuLeYYDaMfAJlEDEagq2XG9/Q=";
+    hash = "sha256-oSWq/D1EX6mxUDElfujyOSEtql0csAm72u2B5RuQddE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/raincloudy/default.nix b/pkgs/development/python-modules/raincloudy/default.nix
index da4a3846a95..6a223bb4fb7 100644
--- a/pkgs/development/python-modules/raincloudy/default.nix
+++ b/pkgs/development/python-modules/raincloudy/default.nix
@@ -1,12 +1,18 @@
 { lib
+, aiohttp
+, aioresponses
 , beautifulsoup4
 , buildPythonPackage
 , fetchFromGitHub
 , html5lib
+, pytest-asyncio
+, pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
 , requests
 , requests-mock
+, setuptools
+, setuptools-scm
 , urllib3
 }:
 
@@ -24,7 +30,25 @@ buildPythonPackage rec {
     hash = "sha256-qCkBVirM09iA1sXiOB9FJns8bHjQq7rRk8XbRWrtBDI=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  postPatch = ''
+    # https://github.com/vanstinator/raincloudy/pull/60
+    substituteInPlace setup.py \
+      --replace "bs4" "beautifulsoup4" \
+
+    # fix raincloudy.aio package discovery, by relying on
+    # autodiscovery instead.
+    sed -i '/packages=/d' setup.py
+  '';
+
   propagatedBuildInputs = [
+    aiohttp
     requests
     beautifulsoup4
     urllib3
@@ -32,19 +56,16 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    aioresponses
+    pytest-asyncio
+    pytest-aiohttp
     pytestCheckHook
     requests-mock
   ];
 
-  postPatch = ''
-    # https://github.com/vanstinator/raincloudy/pull/60
-    substituteInPlace setup.py \
-      --replace "bs4" "beautifulsoup4" \
-      --replace "html5lib==1.0.1" "html5lib"
-  '';
-
   pythonImportsCheck = [
     "raincloudy"
+    "raincloudy.aio"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/rapt-ble/default.nix b/pkgs/development/python-modules/rapt-ble/default.nix
new file mode 100644
index 00000000000..7c4f104c8cd
--- /dev/null
+++ b/pkgs/development/python-modules/rapt-ble/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, bluetooth-data-tools
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "rapt-ble";
+  version = "0.1.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "sairon";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-upTtVqxVHrqLSGTSGCiCVlDa2NEuuqe+0W2DM+UhTnc=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=rapt_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-data-tools
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "rapt_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for RAPT Pill hydrometer BLE devices";
+    homepage = "https://github.com/sairon/rapt-ble";
+    changelog = "https://github.com/sairon/rapt-ble/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/remotezip/default.nix b/pkgs/development/python-modules/remotezip/default.nix
new file mode 100644
index 00000000000..5a79b68e6b8
--- /dev/null
+++ b/pkgs/development/python-modules/remotezip/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, requests
+, tabulate
+, pytestCheckHook
+, requests-mock
+}:
+
+buildPythonPackage {
+  pname = "remotezip";
+  version = "0.12.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "gtsystem";
+    repo = "python-remotezip";
+    # upstream does not tag releases, determined with git blame
+    # pypi archive lacks files for tests
+    rev = "da62e115bdb2071ad08a8c91f7ae48f2c1827e0c";
+    hash = "sha256-su4dlV8KZuewf/yGdTnGHK9hNLHwGe10ditmFcne4Us=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    tabulate
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    requests-mock
+  ];
+
+  pythonImportsCheck = [
+    "remotezip"
+  ];
+
+  meta = with lib; {
+    description = "Python module to access single members of a zip archive without downloading the full content";
+    homepage = "https://github.com/gtsystem/python-remotezip";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 7f9091d87f1..13bc07faed3 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -67,6 +67,8 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
+  requiredSystemFeatures = [ "big-parallel" ]; # the tests need lots of CPU time
+
   passthru = {
     blas = numpy.blas;
   };
diff --git a/pkgs/development/python-modules/sensorpro-ble/default.nix b/pkgs/development/python-modules/sensorpro-ble/default.nix
index df3be2b3fe4..4c8412e7f93 100644
--- a/pkgs/development/python-modules/sensorpro-ble/default.nix
+++ b/pkgs/development/python-modules/sensorpro-ble/default.nix
@@ -19,10 +19,15 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-Zqa6qa0Jw79Iu4VEw6KN0GsZcC1X7OpiYUiyT4zwKyY=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=sensorpro_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -37,11 +42,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=sensorpro_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   pythonImportsCheck = [
     "sensorpro_ble"
   ];
diff --git a/pkgs/development/python-modules/sqlglot/default.nix b/pkgs/development/python-modules/sqlglot/default.nix
index 05dfba94972..3d12618b8e4 100644
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@@ -5,10 +5,11 @@
 , pytestCheckHook
 , python-dateutil
 , duckdb
+, pyspark
 }:
 buildPythonPackage rec {
   pname = "sqlglot";
-  version = "6.0.7";
+  version = "10.5.2";
 
   disabled = pythonOlder "3.8";
 
@@ -16,12 +17,15 @@ buildPythonPackage rec {
     repo = "sqlglot";
     owner = "tobymao";
     rev = "v${version}";
-    hash = "sha256-7PBhf9NN/mCi92xSkB9ygfmfxTyOYaEyrNvL309sG5Y=";
+    hash = "sha256-ZFc2aOhCTRFlrzgnYDSdIZxRqKZ8FvkYSZRU0OMHI34=";
   };
 
   propagatedBuildInputs = [ python-dateutil ];
 
-  nativeCheckInputs = [ pytestCheckHook duckdb ];
+  nativeCheckInputs = [ pytestCheckHook duckdb pyspark ];
+
+  # these integration tests assume a running Spark instance
+  disabledTestPaths = [ "tests/dataframe/integration" ];
 
   pythonImportsCheck = [ "sqlglot" ];
 
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 8082fd9267b..bbc7087ba2c 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -75,7 +75,7 @@ let
   tfFeature = x: if x then "1" else "0";
 
   version = "2.11.0";
-  variant = if cudaSupport then "-gpu" else "";
+  variant = lib.optionalString cudaSupport "-gpu";
   pname = "tensorflow${variant}";
 
   pythonEnv = python.withPackages (_:
diff --git a/pkgs/development/python-modules/thermopro-ble/default.nix b/pkgs/development/python-modules/thermopro-ble/default.nix
index ad934e71e36..1a07edc441d 100644
--- a/pkgs/development/python-modules/thermopro-ble/default.nix
+++ b/pkgs/development/python-modules/thermopro-ble/default.nix
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Thermopro BLE devices";
     homepage = "https://github.com/bluetooth-devices/thermopro-ble";
+    changelog = "https://github.com/Bluetooth-Devices/thermopro-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index c64f36c8df3..f1a8e72a591 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -111,6 +111,15 @@ in buildPythonPackage rec {
     # base is 10.12. Until we upgrade, we can fall back on the older
     # pthread support.
     ./pthreadpool-disable-gcd.diff
+  ] ++ [
+    # PyTorch fails to build on gcc 12 due to gloo
+    # https://github.com/pytorch/pytorch/issues/77614
+    (fetchpatch {
+      url = "https://github.com/facebookincubator/gloo/commit/4a5e339b764261d20fc409071dc7a8b8989aa195.patch";
+      stripLen = 1;
+      extraPrefix = "third_party/gloo/";
+      hash = "sha256-UxR1r7F6g76BWj3GBIrSy5t+YZDCWy6mMddwx+hon5w=";
+    })
   ];
 
   postPatch = lib.optionalString rocmSupport ''
@@ -204,7 +213,11 @@ in buildPythonPackage rec {
   #
   # Also of interest: pytorch ignores CXXFLAGS uses CFLAGS for both C and C++:
   # https://github.com/pytorch/pytorch/blob/v1.11.0/setup.py#L17
-  NIX_CFLAGS_COMPILE = lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ];
+  NIX_CFLAGS_COMPILE = lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ]
+  # Suppress gcc regression: avx512 math function raises uninitialized variable warning
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105593
+  # See also: Fails to compile with GCC 12.1.0 https://github.com/pytorch/pytorch/issues/77939
+  ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=maybe-uninitialized" "-Wno-error=uninitialized" ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/python-modules/types-protobuf/default.nix b/pkgs/development/python-modules/types-protobuf/default.nix
index 862b8ff805c..967d08fc0d7 100644
--- a/pkgs/development/python-modules/types-protobuf/default.nix
+++ b/pkgs/development/python-modules/types-protobuf/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-protobuf";
-  version = "4.21.0.2";
+  version = "4.21.0.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ffSD00rT/LH6f/8Qc1YNWWyawfQZz6hRsiDJqTOGyZg=";
+    sha256 = "sha256-gZp8Z+aUduOcPwyYcbu57oIxNkXTF7ba62CslaMJ29M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/uhi/default.nix b/pkgs/development/python-modules/uhi/default.nix
new file mode 100644
index 00000000000..948f2108d26
--- /dev/null
+++ b/pkgs/development/python-modules/uhi/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, hatchling
+, hatch-vcs
+, numpy
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "uhi";
+  version = "0.3.3";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "800caf3a5f1273b08bcc3bb4b49228fe003942e23423812b0110546aad9a24be";
+  };
+
+  buildInputs = [
+    hatchling
+    hatch-vcs
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Universal Histogram Interface";
+    homepage = "https://uhi.readthedocs.io/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/validobj/default.nix b/pkgs/development/python-modules/validobj/default.nix
index be42bfc0792..b50cd5eb831 100644
--- a/pkgs/development/python-modules/validobj/default.nix
+++ b/pkgs/development/python-modules/validobj/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "validobj";
-  version = "0.6";
+  version = "0.7";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-BvnHn0Erk87Ce3tYwYf0tBwRJMrG19Af/Y568VJ02uo=";
+    sha256 = "cbij55HZKVLO3MLoDTtFT2YYNVZwbNaYEk+35gIcGdo=";
   };
 
   nativeBuildInputs = [ flit ];
diff --git a/pkgs/development/python-modules/validphys2/default.nix b/pkgs/development/python-modules/validphys2/default.nix
index c417cb47e2d..38debb91be1 100644
--- a/pkgs/development/python-modules/validphys2/default.nix
+++ b/pkgs/development/python-modules/validphys2/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace src/validphys/version.py \
-      --replace '= __give_git()' '= "${version}"'
+      --replace '= __give_git()' '= "'$version'"'
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/versioningit/default.nix b/pkgs/development/python-modules/versioningit/default.nix
index 480b72e2e5d..74a29ae175e 100644
--- a/pkgs/development/python-modules/versioningit/default.nix
+++ b/pkgs/development/python-modules/versioningit/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "versioningit";
-  version = "2.1.0";
+  version = "2.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-c/KWXjDS6/1/+ra/JjaPIjdXBiLdKknH+8GZXenGdtY=";
+    hash = "sha256-6xjnunJoqIC/HM/pLlNOlqs04Dl/KNy8s/wNpPaltr0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/vowpalwabbit/default.nix b/pkgs/development/python-modules/vowpalwabbit/default.nix
index 40303c29f9c..e50a91c0603 100644
--- a/pkgs/development/python-modules/vowpalwabbit/default.nix
+++ b/pkgs/development/python-modules/vowpalwabbit/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonPackage rec {
   pname = "vowpalwabbit";
-  version = "9.6.0";
+  version = "9.7.0";
 
   src = fetchPypi{
     inherit pname version;
-    sha256 = "sha256-LHs98lccPjub5GDPB3dxtkOYCDxri04CVpSSsypa4xI=";
+    sha256 = "sha256-O3WnG3JQ7CEHMPYTmE9pgnS8YZs717P6wBKBnXIvvFI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch b/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
index 93db54b0c6e..8e70f0069d6 100644
--- a/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
+++ b/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
@@ -20,18 +20,15 @@ name that has the same encoding in each normal form.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
-index 651c034..9b94ac8 100644
+index 5a6db16..42cf121 100644
 --- a/tests/test_bdist_wheel.py
 +++ b/tests/test_bdist_wheel.py
-@@ -58,7 +58,7 @@ def test_unicode_record(wheel_paths):
+@@ -69,7 +69,7 @@ def test_unicode_record(wheel_paths):
      with ZipFile(path) as zf:
-         record = zf.read('unicode.dist-0.1.dist-info/RECORD')
+         record = zf.read("unicode.dist-0.1.dist-info/RECORD")
  
--    assert u'åäö_日本語.py'.encode('utf-8') in record
-+    assert u'æɐø_日本價.py'.encode('utf-8') in record
+-    assert "åäö_日本語.py".encode() in record
++    assert "æɐø_日本價.py".encode() in record
  
  
- def test_licenses_default(dummy_dist, monkeypatch, tmpdir):
--- 
-2.17.2 (Apple Git-113)
-
+ UTF8_PKG_INFO = """\
diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 8735a37b21f..3be508a0ec5 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.37.1";
+  version = "0.38.4";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-JlTmUPY3yo/uROyd3nW1dJa23zbLhgQTwcmqZkPOrHs=";
+    hash = "sha256-yZLU0t/nz6kfnnoLL15bybOxN4+SJUaTJsCpGffl1QU=";
     name = "${pname}-${version}-source";
     postFetch = ''
       cd $out
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 7815a36396b..8dfbd418157 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.16.1";
+  version = "0.16.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-JsrOt6LmmhJZ4MBwLVKKt3IMbvAnxJx70AZROhb9gbc=";
+    hash = "sha256-yk3rEOcHIEZLz3qKxeGzHuVUWWxG3GhSt9vc0pXcanQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index 3e2de3d2afc..46f1904faf2 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "1.12.8";
+  version = "1.12.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-04Xl2TBs9RL+KWmJgUY+PDoYN4AAvrcWP7TJBEu5lNU=";
+    hash = "sha256-CO+plbsZzQkxtvz8N3QP71P2V1wPdyp1oeW/424mZks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch b/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
new file mode 100644
index 00000000000..93db54b0c6e
--- /dev/null
+++ b/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
@@ -0,0 +1,37 @@
+From 5879a4bbc34d1eb25e160b15b2f5a4f10eac6bd2 Mon Sep 17 00:00:00 2001
+From: toonn <toonn@toonn.io>
+Date: Mon, 13 Sep 2021 18:07:26 +0200
+Subject: [PATCH] =?UTF-8?q?tests:=20Rename=20a=CC=8Aa=CC=88o=CC=88=5F?=
+ =?UTF-8?q?=E6=97=A5=E6=9C=AC=E8=AA=9E.py=20=3D>=20=C3=A6=C9=90=C3=B8=5F?=
+ =?UTF-8?q?=E6=97=A5=E6=9C=AC=E5=83=B9.py?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+`åäö_日本語.py` normalizes differently in NFC and NFD normal forms. This
+means a hash generated for the source directory can differ depending on
+whether or not the filesystem is normalizing and which normal form it
+uses.
+
+By renaming the file to `æɐø_日本價.py` we avoid this issue by using a
+name that has the same encoding in each normal form.
+---
+ tests/test_bdist_wheel.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
+index 651c034..9b94ac8 100644
+--- a/tests/test_bdist_wheel.py
++++ b/tests/test_bdist_wheel.py
+@@ -58,7 +58,7 @@ def test_unicode_record(wheel_paths):
+     with ZipFile(path) as zf:
+         record = zf.read('unicode.dist-0.1.dist-info/RECORD')
+ 
+-    assert u'åäö_日本語.py'.encode('utf-8') in record
++    assert u'æɐø_日本價.py'.encode('utf-8') in record
+ 
+ 
+ def test_licenses_default(dummy_dist, monkeypatch, tmpdir):
+-- 
+2.17.2 (Apple Git-113)
+
diff --git a/pkgs/development/python2-modules/wheel/default.nix b/pkgs/development/python2-modules/wheel/default.nix
new file mode 100644
index 00000000000..8735a37b21f
--- /dev/null
+++ b/pkgs/development/python2-modules/wheel/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, bootstrapped-pip
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "wheel";
+  version = "0.37.1";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-JlTmUPY3yo/uROyd3nW1dJa23zbLhgQTwcmqZkPOrHs=";
+    name = "${pname}-${version}-source";
+    postFetch = ''
+      cd $out
+      mv tests/testdata/unicode.dist/unicodedist/åäö_日本語.py \
+        tests/testdata/unicode.dist/unicodedist/æɐø_日本價.py
+      patch -p1 < ${./0001-tests-Rename-a-a-o-_-.py-_-.py.patch}
+    '';
+  };
+
+  nativeBuildInputs = [
+    bootstrapped-pip
+    setuptools
+  ];
+
+  # No tests in archive
+  doCheck = false;
+  pythonImportsCheck = [ "wheel" ];
+
+  # We add this flag to ignore the copy installed by bootstrapped-pip
+  pipInstallFlags = [ "--ignore-installed" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pypa/wheel";
+    description = "A built-package format for Python";
+    longDescription = ''
+      This library is the reference implementation of the Python wheel packaging standard,
+      as defined in PEP 427.
+
+      It has two different roles:
+
+      - A setuptools extension for building wheels that provides the bdist_wheel setuptools command
+      - A command line tool for working with wheel files
+
+      It should be noted that wheel is not intended to be used as a library,
+      and as such there is no stable, public API.
+    '';
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ siriobalmelli ];
+  };
+}
diff --git a/pkgs/development/ruby-modules/bundled-common/default.nix b/pkgs/development/ruby-modules/bundled-common/default.nix
index 4672bad4ca4..aa903a5637c 100644
--- a/pkgs/development/ruby-modules/bundled-common/default.nix
+++ b/pkgs/development/ruby-modules/bundled-common/default.nix
@@ -66,9 +66,8 @@ let
     name;
 
   copyIfBundledByPath = { bundledByPath ? false, ...}:
-  (if bundledByPath then
-      assert gemFiles.gemdir != null; "cp -a ${gemFiles.gemdir}/* $out/" #*/
-    else ""
+  (lib.optionalString bundledByPath (
+      assert gemFiles.gemdir != null; "cp -a ${gemFiles.gemdir}/* $out/") #*/
   );
 
   maybeCopyAll = pkgname: if pkgname == null then "" else
diff --git a/pkgs/development/tools/analysis/rr/default.nix b/pkgs/development/tools/analysis/rr/default.nix
index e9437d718cf..40a7909f34a 100644
--- a/pkgs/development/tools/analysis/rr/default.nix
+++ b/pkgs/development/tools/analysis/rr/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace src/Command.cc --replace '_BSD_SOURCE' '_DEFAULT_SOURCE'
     sed '7i#include <math.h>' -i src/Scheduler.cc
+    sed '1i#include <ctime>' -i src/test-monitor/test-monitor.cc
     patchShebangs .
   '';
 
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index bb3d37f4f87..df6a7976de3 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.44.1";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-O758CU70NqRFlbtiy5cmfIHiHdQLxH88BHNZLQVvZ+M=";
+    sha256 = "sha256-tsnW6KoLHEWd/uDZrK2cnVZ2IWftoxZ5zGdYhRdUp9Q=";
   };
 
-  vendorSha256 = "sha256-4ODf6Er7V5KsVUdWjqjv+dfH84PPR+5T29V1AJluoJA=";
+  vendorSha256 = "sha256-crGs7j9hAnGCCFjhigIJVpTM0rr9WgvBq3/ZGt6hwqQ=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 3bec558803b..9949ec7ec7c 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Fix build on ELFv2 powerpc64
+    # https://bugs.kde.org/show_bug.cgi?id=398883
+    (fetchurl {
+      url = "https://github.com/void-linux/void-packages/raw/3e16b4606235885463fc9ab45b4c120f1a51aa28/srcpkgs/valgrind/patches/elfv2-ppc64-be.patch";
+      sha256 = "NV/F+5aqFZz7+OF5oN5MUTpThv4H5PEY9sBgnnWohQY=";
+    })
     # Fix checks on Musl.
     # https://bugs.kde.org/show_bug.cgi?id=453929
     (fetchpatch {
diff --git a/pkgs/development/tools/bbin/default.nix b/pkgs/development/tools/bbin/default.nix
index 606633fd3a1..d0956845092 100644
--- a/pkgs/development/tools/bbin/default.nix
+++ b/pkgs/development/tools/bbin/default.nix
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation rec {
     mkdir -p $out/share
     cp -r docs $out/share/docs
     wrapProgram $out/bin/bbin \
-      --prefix PATH : "${lib.makeBinPath [ babashka graalvm17-ce ]}"
+      --prefix PATH : "${lib.makeBinPath [ babashka babashka.graalvmDrv ]}"
 
     runHook postInstall
   '';
diff --git a/pkgs/development/tools/bpf-linker/default.nix b/pkgs/development/tools/bpf-linker/default.nix
index d1839eb86fa..49780a7772e 100644
--- a/pkgs/development/tools/bpf-linker/default.nix
+++ b/pkgs/development/tools/bpf-linker/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , rustPlatform
 , fetchFromGitHub
-, llvmPackages_14
+, llvmPackages_15
 , zlib
 , ncurses
 , libxml2
@@ -10,21 +10,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bpf-linker";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "aya-rs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jYuBk78aGQLUeNF6d6kjGPuMxEF22XJquHcs23WVGm0=";
+    hash = "sha256-LEZ2to1bzJ/H/XYytuh/7NT7+04aI8chpKIFxxVzM+4=";
   };
 
-  cargoHash = "sha256-X8EVpOxDHwE/wj/gly/wdZ6tsrMrz3kkDe9gEPbk6iw=";
+  cargoHash = "sha256-s8cW7lXtvgemuQueTtAywewnDVJ/WDcz8SBqsC/tO80=";
 
   buildNoDefaultFeatures = true;
   buildFeatures = [ "system-llvm" ];
 
-  nativeBuildInputs = [ llvmPackages_14.llvm ];
+  nativeBuildInputs = [ llvmPackages_15.llvm ];
   buildInputs = [ zlib ncurses libxml2 ];
 
   # fails with: couldn't find crate `core` with expected target triple bpfel-unknown-none
diff --git a/pkgs/development/tools/build-managers/bear/default.nix b/pkgs/development/tools/build-managers/bear/default.nix
index b371a1f1115..90e5098a364 100644
--- a/pkgs/development/tools/build-managers/bear/default.nix
+++ b/pkgs/development/tools/build-managers/bear/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bear";
-  version = "3.0.21";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "rizsotto";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wT3s8CjgFPKrJiMWHWsvmUQwpuuS4figJZUXJn3RclU=";
+    sha256 = "sha256-b9QeXUdvXoJNFxi7i2IVq7Xeyo5T54A0Sl9BvAV25JM=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/tools/build-managers/cmake/002-application-services.diff b/pkgs/development/tools/build-managers/cmake/002-application-services.diff
index 7c77336b41b..56f7cd266b7 100644
--- a/pkgs/development/tools/build-managers/cmake/002-application-services.diff
+++ b/pkgs/development/tools/build-managers/cmake/002-application-services.diff
@@ -1,20 +1,18 @@
-diff --git a/Source/CMakeLists.txt b/Source/CMakeLists.txt
-index 9a18184fd3..278d146dd1 100644
---- a/Source/CMakeLists.txt
-+++ b/Source/CMakeLists.txt
-@@ -933,7 +933,6 @@ endif()
+diff -Naur cmake-3.25.1-old/Source/CMakeLists.txt cmake-3.25.1-new/Source/CMakeLists.txt
+--- cmake-3.25.1-old/Source/CMakeLists.txt	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Source/CMakeLists.txt	2022-12-19 01:00:08.412064304 -0300
+@@ -916,7 +916,6 @@
  # On Apple we need CoreFoundation and CoreServices
  if(APPLE)
-   target_link_libraries(CMakeLib "-framework CoreFoundation")
--  target_link_libraries(CMakeLib "-framework CoreServices")
+   target_link_libraries(CMakeLib PUBLIC "-framework CoreFoundation")
+-  target_link_libraries(CMakeLib PUBLIC "-framework CoreServices")
  endif()
  
  if(WIN32 AND NOT UNIX)
-diff --git a/Source/cmGlobalXCodeGenerator.cxx b/Source/cmGlobalXCodeGenerator.cxx
-index 77403b076a..d5aac95e1e 100644
---- a/Source/cmGlobalXCodeGenerator.cxx
-+++ b/Source/cmGlobalXCodeGenerator.cxx
-@@ -49,10 +49,6 @@ struct cmLinkImplementation;
+diff -Naur cmake-3.25.1-old/Source/cmGlobalXCodeGenerator.cxx cmake-3.25.1-new/Source/cmGlobalXCodeGenerator.cxx
+--- cmake-3.25.1-old/Source/cmGlobalXCodeGenerator.cxx	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Source/cmGlobalXCodeGenerator.cxx	2022-12-19 01:00:56.065135169 -0300
+@@ -56,10 +56,6 @@
  
  #if !defined(CMAKE_BOOTSTRAP) && defined(__APPLE__)
  #  include <CoreFoundation/CoreFoundation.h>
@@ -25,19 +23,17 @@ index 77403b076a..d5aac95e1e 100644
  #endif
  
  #if !defined(CMAKE_BOOTSTRAP)
-diff --git a/Utilities/cmlibarchive/CMakeLists.txt b/Utilities/cmlibarchive/CMakeLists.txt
-index 79452ffff6..a848731b7e 100644
---- a/Utilities/cmlibarchive/CMakeLists.txt
-+++ b/Utilities/cmlibarchive/CMakeLists.txt
-@@ -2013,11 +2013,6 @@ IF(ENABLE_TEST)
+diff -Naur cmake-3.25.1-old/Utilities/cmlibarchive/CMakeLists.txt cmake-3.25.1-new/Utilities/cmlibarchive/CMakeLists.txt
+--- cmake-3.25.1-old/Utilities/cmlibarchive/CMakeLists.txt	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Utilities/cmlibarchive/CMakeLists.txt	2022-12-19 01:01:43.392205981 -0300
+@@ -2041,10 +2041,6 @@
+   ADD_CUSTOM_TARGET(run_all_tests)
  ENDIF(ENABLE_TEST)
- ENDIF()
  
 -# We need CoreServices on Mac OS.
 -IF(APPLE)
 -  LIST(APPEND ADDITIONAL_LIBS "-framework CoreServices")
 -ENDIF(APPLE)
--
+ 
  add_subdirectory(libarchive)
  IF(0) # CMake does not build libarchive's command-line tools.
- add_subdirectory(cat)
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 0a1e191ba36..2aff749ebcb 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -40,11 +40,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.24.3";
+  version = "3.25.1";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-tTqhD6gr/4TM21kGWSe3LTvuSfTYYmEkn8CYSzs2cpE=";
+    sha256 = "sha256-HFEdCVFq9JNpTtm68TxVlHo2OJZ01lei1eDM7caykdg=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 5591b163423..d0306dd33a4 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,19 +1,26 @@
 { lib
+, stdenv
 , fetchpatch
 , installShellFiles
 , ninja
 , pkg-config
 , python3
+, zlib
+, coreutils
 , substituteAll
+, Foundation
+, OpenGL
+, AppKit
+, Cocoa
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "0.64.1";
+  version = "1.0.0";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Oo4DDCM094IIX4FicGLMbUpnce3zHgVf/jdPnmsImrk=";
+    hash = "sha256-qlCkukVXwl59SERqv96FeVfc31g4X/++Zwug6O+szgU=";
   };
 
   patches = [
@@ -61,17 +68,38 @@ python3.pkgs.buildPythonApplication rec {
         "docs/yaml/objects/dep.yaml"
       ];
     })
-  ];
+
+    # tests: avoid unexpected failure when cmake is not installed
+    # https://github.com/mesonbuild/meson/pull/11321
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/a38ad3039d0680f3ac34a6dc487776c79c48acf3.patch";
+      hash = "sha256-9YaXwc+F3Pw4BjuOXqva4MD6DAxX1k5WLbn0xzwuEmw=";
+    })
+  ]
+    # Nixpkgs cctools does not have bitcode support.
+    ++ lib.optional stdenv.isDarwin ./disable-bitcode.patch;
+
+  postPatch = if stdenv.isDarwin then ''
+    rm -r 'test cases/osx/7 bitcode'
+  '' else null;
 
   setupHook = ./setup-hook.sh;
 
-  # Meson included tests since 0.45, however they fail in Nixpkgs because they
-  # require a typical building environment (including C compiler and stuff).
-  # Just for the sake of documentation, the next lines are maintained here.
-  doCheck = false;
   nativeCheckInputs = [ ninja pkg-config ];
+  checkInputs = [ zlib ]
+    ++ lib.optionals stdenv.isDarwin [ Foundation OpenGL AppKit Cocoa ];
   checkPhase = ''
-    python ./run_project_tests.py
+    patchShebangs "test cases"
+    substituteInPlace "test cases/native/8 external program shebang parsing/script.int.in" \
+      --replace /usr/bin/env ${coreutils}/bin/env
+    # requires git, creating cyclic dependency
+    rm -r "test cases/common/66 vcstag"
+    # requires glib, creating cyclic dependency
+    rm -r "test cases/linuxlike/6 subdir include order"
+    rm -r "test cases/linuxlike/9 compiler checks with dependencies"
+    # requires static zlib, see #66461
+    rm -r "test cases/linuxlike/14 static dynamic linkage"
+    HOME="$TMPDIR" python ./run_project_tests.py
   '';
 
   postFixup = ''
@@ -84,6 +112,9 @@ python3.pkgs.buildPythonApplication rec {
 
     # Do not propagate Python
     rm $out/nix-support/propagated-build-inputs
+
+    substituteInPlace "$out/share/bash-completion/completions/meson" \
+      --replace "python3 -c " "${python3.interpreter} -c "
   '';
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/build-managers/meson/disable-bitcode.patch b/pkgs/development/tools/build-managers/meson/disable-bitcode.patch
new file mode 100644
index 00000000000..a72997c1043
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/disable-bitcode.patch
@@ -0,0 +1,24 @@
+--- a/mesonbuild/compilers/mixins/clang.py
++++ b/mesonbuild/compilers/mixins/clang.py
+@@ -56,10 +56,6 @@ class ClangCompiler(GnuLikeCompiler):
+             {OptionKey('b_colorout'), OptionKey('b_lto_threads'), OptionKey('b_lto_mode'), OptionKey('b_thinlto_cache'),
+              OptionKey('b_thinlto_cache_dir')})
+ 
+-        # TODO: this really should be part of the linker base_options, but
+-        # linkers don't have base_options.
+-        if isinstance(self.linker, AppleDynamicLinker):
+-            self.base_options.add(OptionKey('b_bitcode'))
+         # All Clang backends can also do LLVM IR
+         self.can_compile_suffixes.add('ll')
+ 
+--- a/mesonbuild/linkers/linkers.py
++++ b/mesonbuild/linkers/linkers.py
+@@ -785,7 +785,7 @@ class AppleDynamicLinker(PosixDynamicLinkerMixin, DynamicLinker):
+         return self._apply_prefix('-headerpad_max_install_names')
+ 
+     def bitcode_args(self) -> T.List[str]:
+-        return self._apply_prefix('-bitcode_bundle')
++        raise MesonException('Nixpkgs cctools does not support bitcode bundles')
+ 
+     def fatal_warnings(self) -> T.List[str]:
+         return self._apply_prefix('-fatal_warnings')
diff --git a/pkgs/development/tools/build-managers/waf/default.nix b/pkgs/development/tools/build-managers/waf/default.nix
index 8fcb5f2dbac..4e42927d029 100644
--- a/pkgs/development/tools/build-managers/waf/default.nix
+++ b/pkgs/development/tools/build-managers/waf/default.nix
@@ -8,13 +8,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "waf";
-  version = "2.0.24";
+  version = "2.0.25";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "${pname}-${version}";
-    sha256 = "sha256-nunPDYAy0yfDJpsc+E8SyyFLny19wwrVzxeUOhh7nc4=";
+    sha256 = "sha256-wqZEAfGRHhcd7Xm2pQ0FTjZGfuPafRrZAUdpc7ACoEA=";
   };
 
   nativeBuildInputs = [ python3 ensureNewerSourcesForZipFilesHook ];
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 30d22bc183d..e5f017de1e1 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -5,19 +5,19 @@
 }:
 buildGoModule rec {
   pname = "coder";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3rGpyJzGkZYUEvKKDzj2I5sqrUImmmX7cXWM9UClPLY=";
+    hash = "sha256-FHBaefwSGZXwn1jdU7zK8WhwjarknvyeUJTlhmk/hPM=";
   };
 
   # integration tests require network access
   doCheck = false;
 
-  vendorHash = "sha256-bb9jBno7elO6qKGjacpX3rxgrpJpGpTxMQtdBYjBzMk=";
+  vendorHash = "sha256-+AvmJkZCFovE2+5Lg98tUvA7f2kBHUMzhl5IyrEGuy8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 20ba407e3d0..fbdcbcde7c4 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.9.0";
+  version = "7.9.1";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "sha256-YatN0VG3oEUK+vzJzthRnX+EkvUgKq2uIunAoPMoRag=";
+    sha256 = "sha256-ySyarky92+VSo/KzQFrWeh35KDMTQDV34F5iFrARHJs=";
   };
 
-  vendorSha256 = "sha256-nX0r/7V+rgJb3/9O91QskYzBpWXIca7m3Do1QtGuHgg=";
+  vendorHash = "sha256-Oy1wP82ZhdpGHs/gpfdveOK/jI9yuo0D3JtxjLg+W/w=";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/development/tools/cosmoc/default.nix b/pkgs/development/tools/cosmoc/default.nix
deleted file mode 100644
index e64cf02e9f7..00000000000
--- a/pkgs/development/tools/cosmoc/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ stdenv, lib, cosmopolitan }:
-
-stdenv.mkDerivation {
-  pname = "cosmoc";
-  inherit (cosmopolitan) version;
-
-  doInstallCheck = true;
-  dontUnpack = true;
-  dontBuild = true;
-
-  # compiler arguments based on upstream README.md
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    cat <<EOF >$out/bin/cosmoc
-    #!${stdenv.shell}
-    exec ${stdenv.cc}/bin/${stdenv.cc.targetPrefix}gcc \
-      -Os -static -nostdlib -nostdinc -fno-pie -no-pie -mno-red-zone \
-      -fno-omit-frame-pointer -pg -mnop-mcount -mno-tls-direct-seg-refs \
-      "\$@" \
-      -fuse-ld=bfd -Wl,-T,${cosmopolitan}/lib/ape.lds -Wl,--gc-sections \
-      -include ${cosmopolitan}/include/cosmopolitan.h \
-      ${cosmopolitan}/lib/{crt.o,ape-no-modify-self.o,cosmopolitan.a}
-    EOF
-    chmod +x $out/bin/cosmoc
-    runHook postInstall
-  '';
-
-  installCheckPhase = ''
-    printf 'main() { printf("hello world\\n"); }\n' >hello.c
-    $out/bin/cosmoc hello.c
-    ./a.out
-  '';
-
-  meta = with lib; {
-    homepage = "https://justine.lol/cosmopolitan/";
-    description = "compiler for Cosmopolitan C programs";
-    license = licenses.mit;
-    maintainers = teams.cosmopolitan.members;
-  };
-}
diff --git a/pkgs/development/tools/cosmocc/default.nix b/pkgs/development/tools/cosmocc/default.nix
new file mode 100644
index 00000000000..71028d1a196
--- /dev/null
+++ b/pkgs/development/tools/cosmocc/default.nix
@@ -0,0 +1,35 @@
+{ runCommand, lib, cosmopolitan }:
+
+let
+  cosmocc =
+    runCommand "cosmocc"
+      {
+        pname = "cosmocc";
+        inherit (cosmopolitan) version;
+
+        meta = with lib; {
+          homepage = "https://justine.lol/cosmopolitan/";
+          description = "compilers for Cosmopolitan C/C++ programs";
+          license = licenses.mit;
+          maintainers = teams.cosmopolitan.members;
+        };
+        passthru.tests = {
+          cc = runCommand "c-test" { } ''
+            cat > hello.c << END
+            #include <stdio.h>
+            int main() {
+              printf("Hello world!\n");
+              return 0;
+            }
+            END
+            ${cosmocc}/bin/cosmocc hello.c
+            ./a.out > $out
+          '';
+        };
+      } ''
+      mkdir -p $out/bin
+      install ${cosmopolitan.dist}/tool/scripts/{cosmocc,cosmoc++} $out/bin
+      sed 's|/opt/cosmo\([ /]\)|${cosmopolitan.dist}\1|g' -i $out/bin/*
+    '';
+in
+cosmocc
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 0df5d285ff1..c204e91b276 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.17.7";
+  version = "0.17.8";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-dfXDGXn8Az6JRTcYB/gZgHLxQUKgsWhRXl2h0RqVZ4w=";
+    hash = "sha256-UJIbx0UkpHYMgDr+1dbNoMLrY5hWs0E2Ehu3txG/80E=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/gci/default.nix b/pkgs/development/tools/gci/default.nix
index 170b9c41dc9..0dfd153e219 100644
--- a/pkgs/development/tools/gci/default.nix
+++ b/pkgs/development/tools/gci/default.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "gci";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "daixiang0";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qWEEcIbTgYmGVnnTW+hM8e8nw5VLWN1TwzdUIZrxF3s=";
+    sha256 = "sha256-VbN4lRK+6stOApMEdtX32JhKGkCSrafMJbizpWmHRXA=";
   };
 
-  vendorSha256 = "sha256-dlt+i/pEP3RzW4JwndKTU7my2Nn7/2rLFlk8n1sFR60=";
+  vendorHash = "sha256-dlt+i/pEP3RzW4JwndKTU7my2Nn7/2rLFlk8n1sFR60=";
 
   meta = with lib; {
     description = "Controls golang package import order and makes it always deterministic";
diff --git a/pkgs/development/tools/glslviewer/default.nix b/pkgs/development/tools/glslviewer/default.nix
index fcebe93aaa2..06016bec25b 100644
--- a/pkgs/development/tools/glslviewer/default.nix
+++ b/pkgs/development/tools/glslviewer/default.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
     sha256 = "0v7x93b61ama0gmzlx1zc56jgi7bvzsfvbkfl82xzwf2h5g1zni7";
   };
 
+  postPatch = ''
+    sed '1i#include <cstring>' -i src/tools/text.cpp # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config ensureNewerSourcesForZipFilesHook python3Packages.six ];
   buildInputs = [
     glfw libGLU glfw libXrandr libXdamage
diff --git a/pkgs/development/tools/jbang/default.nix b/pkgs/development/tools/jbang/default.nix
index 2a1197cae0c..0eeeba6fa76 100644
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:
 
 stdenv.mkDerivation rec {
-  version = "0.102.0";
+  version = "0.103.0";
   pname = "jbang";
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-5T0MQ1b1kA7MVm2drNbUdK6CitTjT76ORPN/BJmsmsM=";
+    sha256 = "sha256-81Le1xVftyQkt5Jm2JXRxID/ySNS1Tcl+BRIsDYeg1k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/konstraint/default.nix b/pkgs/development/tools/konstraint/default.nix
index cbb8b38d80d..61fe400586c 100644
--- a/pkgs/development/tools/konstraint/default.nix
+++ b/pkgs/development/tools/konstraint/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "konstraint";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "plexsystems";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mNritx2YY6x5lwnOWrraHzddRZqEySDOWGOqdmqUyIs=";
+    sha256 = "sha256-GDHpITuDdZBphkjQGcnhN7H6yHA9CsyVBkinFsM2RrA=";
   };
-  vendorSha256 = "sha256-pqGayeo4JkleZaoZfZW6agbMrK+57tYriKCWXGveoUs=";
+  vendorHash = "sha256-Ou73kXEcyxXW6u0dUBvx9alJrloc/CUm1VWKphCUPCg=";
 
   # Exclude go within .github folder
   excludedPackages = ".github";
diff --git a/pkgs/development/tools/kustomize/kustomize-sops.nix b/pkgs/development/tools/kustomize/kustomize-sops.nix
index 28c80444650..6136c5b6cb2 100644
--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kustomize-sops";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "viaduct-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8CZcPZLainc7iRZ5Ul27QxW3oK7sikCjzCBEkfCeNUc=";
+    sha256 = "sha256-piCsae2B+FC+wi/vCCtPY76O4eMXJeNufFo31QkHCAU=";
   };
 
-  vendorHash = "sha256-GBjMN6pyB+48e5LNqLBbh6a5fC9P0T53CZUPGNcbBDc=";
+  vendorHash = "sha256-vTP2wM7MqiSfP+3Gd0Ab5t0al5xL8rw3kl7bOT19zU4=";
 
   installPhase = ''
     mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
diff --git a/pkgs/development/tools/language-servers/lua-language-server/default.nix b/pkgs/development/tools/language-servers/lua-language-server/default.nix
index d260e7601e2..04b5fd6e1e0 100644
--- a/pkgs/development/tools/language-servers/lua-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/lua-language-server/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lua-language-server";
-  version = "3.6.10";
+  version = "3.6.11";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     rev = version;
-    sha256 = "sha256-QnkWEf1Uv+CZwEyv1b3WMPvaOZEn+mKH5w3CPyw02CQ=";
+    sha256 = "sha256-NMybClvpTLad7xnd8uPhUHmv6fvaYIKkFHsv7SSDi2M=";
     fetchSubmodules = true;
   };
 
@@ -77,6 +77,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A language server that offers Lua language support";
     homepage = "https://github.com/luals/lua-language-server";
+    changelog = "https://github.com/LuaLS/lua-language-server/blob/${version}/changelog.md";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda sei40kr ];
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/development/tools/lightningcss/default.nix b/pkgs/development/tools/lightningcss/default.nix
index c2bb6828bc2..132faaa4aee 100644
--- a/pkgs/development/tools/lightningcss/default.nix
+++ b/pkgs/development/tools/lightningcss/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lightningcss";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "parcel-bundler";
     repo = "lightningcss";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-JULVX5gyMJhnBwGQxmMObtUaenu37rIE5yDbA5fHsCY=";
+    sha256 = "sha256-ncZ1tof8InP+8KLTQ2YOwaD/liwU1LNZkllBm53VYNo=";
   };
 
-  cargoHash = "sha256-PQbN0qsCf4eia5sD71ltP7Y955smZPwkof+uEQATvNQ=";
+  cargoHash = "sha256-xxR80iizEej1vAzItaoqQnJDZ62dxPOeEdaUpgqhG7I=";
 
   buildFeatures = [
     "cli"
diff --git a/pkgs/development/tools/misc/binutils/build-components-separately.patch b/pkgs/development/tools/misc/binutils/build-components-separately.patch
deleted file mode 100644
index 0b4162d8488..00000000000
--- a/pkgs/development/tools/misc/binutils/build-components-separately.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-diff --git a/bfd/configure.ac b/bfd/configure.ac
-index fec067b2135..377e1f5443f 100644
---- a/bfd/configure.ac
-+++ b/bfd/configure.ac
-@@ -292,30 +292,16 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
- 
- LT_LIB_M
- 
--# When building a shared libbfd, link against the pic version of libiberty
--# so that apps that use libbfd won't need libiberty just to satisfy any
--# libbfd references.
--# We can't do that if a pic libiberty is unavailable since including non-pic
--# code would insert text relocations into libbfd.
- SHARED_LIBADD=
--SHARED_LDFLAGS=
-+SHARED_LDFLAGS=-liberty
- if test "$enable_shared" = "yes"; then
--changequote(,)dnl
--  x=`sed -n -e 's/^[ 	]*PICFLAG[ 	]*=[ 	]*//p' < ../libiberty/Makefile | sed -n '$p'`
--changequote([,])dnl
--  if test -n "$x"; then
--    SHARED_LIBADD="-L`pwd`/../libiberty/pic -liberty"
--  fi
--fi
--
- SHARED_LIBADD="$SHARED_LIBADD $LIBINTL"
- 
--if test "$enable_shared" = "yes"; then
-   case "${host}" in
-   # More hacks to build DLLs on Windows.
-   *-*-cygwin*)
-     SHARED_LDFLAGS="-no-undefined"
--    SHARED_LIBADD="-L`pwd`/../libiberty -liberty $SHARED_LIBADD -lcygwin -lkernel32"
-+    SHARED_LIBADD="-liberty $SHARED_LIBADD -lcygwin -lkernel32"
-   ;;
-   esac
- 
-diff --git a/opcodes/Makefile.am b/opcodes/Makefile.am
-index 0e04b4c05c4..848a02662e7 100644
---- a/opcodes/Makefile.am
-+++ b/opcodes/Makefile.am
-@@ -51,7 +51,7 @@ libopcodes_la_LDFLAGS += -rpath $(rpath_bfdlibdir)
- endif
- 
- # This is where bfd.h lives.
--BFD_H = ../bfd/bfd.h
-+BFD_H = $(BFDDIR)/bfd.h
- 
- BUILD_LIBS = @BUILD_LIBS@
- BUILD_LIB_DEPS = @BUILD_LIB_DEPS@
-@@ -303,7 +303,7 @@ OFILES = @BFD_MACHINES@
- # development.sh is used to determine -Werror default.
- CONFIG_STATUS_DEPENDENCIES = $(BFDDIR)/development.sh
- 
--AM_CPPFLAGS = -I. -I$(srcdir) -I../bfd -I$(INCDIR) -I$(BFDDIR) @HDEFINES@ @INCINTL@
-+AM_CPPFLAGS = -I. -I$(srcdir) -I$(INCDIR) -I$(BFDDIR) @HDEFINES@ @INCINTL@
- 
- disassemble.lo: disassemble.c
- if am__fastdepCC
-@@ -327,9 +327,18 @@ libopcodes_la_SOURCES =  dis-buf.c disassemble.c dis-init.c
--libopcodes_la_DEPENDENCIES = $(OFILES) @SHARED_DEPENDENCIES@
-+libopcodes_la_DEPENDENCIES = $(OFILES) @SHARED_DEPENDENCIES@ libtool-soversion
- libopcodes_la_LIBADD = $(OFILES) @SHARED_LIBADD@
--libopcodes_la_LDFLAGS += -release `cat ../bfd/libtool-soversion` @SHARED_LDFLAGS@
-+libopcodes_la_LDFLAGS += -release `cat libtool-soversion` @SHARED_LDFLAGS@
- # Allow dependency tracking to work on all the source files.
- EXTRA_libopcodes_la_SOURCES = $(LIBOPCODES_CFILES)
- 
-+libtool-soversion:
-+	@echo "creating $@"
-+	bfd_soversion="$(VERSION)" ;\
-+	. $(BFDDIR)/development.sh ;\
-+	if test "$$development" = true ; then \
-+	  bfd_soversion="$(VERSION).$${bfd_version_date}" ;\
-+	fi ;\
-+	echo "$${bfd_soversion}" > $@
-+
- # libtool will build .libs/libopcodes.a.  We create libopcodes.a in
- # the build directory so that we don't have to convert all the
- # programs that use libopcodes.a simultaneously.  This is a hack which
-diff --git a/opcodes/configure.ac b/opcodes/configure.ac
-index e564f067334..5da62a3d58b 100644
---- a/opcodes/configure.ac
-+++ b/opcodes/configure.ac
-@@ -98,6 +98,8 @@ BFD_64_BIT
- AC_SUBST(HDEFINES)
- AC_PROG_INSTALL
- 
-+GCC_HEADER_STDINT(bfd_stdint.h)
-+
- AC_CHECK_DECLS([basename, stpcpy])
- 
- # Check if sigsetjmp is available.  Using AC_CHECK_FUNCS won't do
-@@ -148,44 +150,21 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
- 
- LT_LIB_M
- 
--#Libs for generator progs
--if test "x$cross_compiling" = "xno"; then
--  BUILD_LIBS=../libiberty/libiberty.a
--  BUILD_LIB_DEPS=$BUILD_LIBS
--else
--  # if cross-compiling, assume that the system provides -liberty
--  # and that the version is compatible with new headers.
--  BUILD_LIBS=-liberty
--  BUILD_LIB_DEPS=
--fi
--BUILD_LIBS="$BUILD_LIBS $LIBINTL"
--BUILD_LIB_DEPS="$BUILD_LIB_DEPS $LIBINTL_DEP"
-+BUILD_LIBS="-liberty $LIBINTL"
-+BUILD_LIB_DEPS="$LIBINTL_DEP"
- 
- AC_SUBST(BUILD_LIBS)
- AC_SUBST(BUILD_LIB_DEPS)
- 
- # Horrible hacks to build DLLs on Windows and a shared library elsewhere.
- SHARED_LDFLAGS=
--SHARED_LIBADD=
-+SHARED_LIBADD=-liberty
- SHARED_DEPENDENCIES=
--if test "$enable_shared" = "yes"; then
--# When building a shared libopcodes, link against the pic version of libiberty
--# so that apps that use libopcodes won't need libiberty just to satisfy any
--# libopcodes references.
--# We can't do that if a pic libiberty is unavailable since including non-pic
--# code would insert text relocations into libopcodes.
- # Note that linking against libbfd as we do here, which is itself linked
- # against libiberty, may not satisfy all the libopcodes libiberty references
- # since libbfd may not pull in the entirety of libiberty.
- # Also, jam libintl into the right place in all of this: after libiberty,
- # which uses it, but before -lcygwin, which it uses.
--changequote(,)dnl
--  x=`sed -n -e 's/^[ 	]*PICFLAG[ 	]*=[ 	]*//p' < ../libiberty/Makefile | sed -n '$p'`
--changequote([,])dnl
--  if test -n "$x"; then
--    SHARED_LIBADD="-L`pwd`/../libiberty/pic -liberty"
--  fi
--fi
- 
- SHARED_LIBADD="$SHARED_LIBADD $LIBINTL"
- 
-@@ -193,11 +172,10 @@ if test "$enable_shared" = "yes"; then
-   case "${host}" in
-     *-*-cygwin*)
-       SHARED_LDFLAGS="-no-undefined"
--      SHARED_LIBADD="-L`pwd`/../bfd -lbfd -L`pwd`/../libiberty -liberty $SHARED_LIBADD"
-+      SHARED_LIBADD="-lbfd -liberty $SHARED_LIBADD"
-       ;;
-     *)
--      SHARED_LIBADD="../bfd/libbfd.la ${SHARED_LIBADD}"
--      SHARED_DEPENDENCIES="../bfd/libbfd.la"
-+      SHARED_LIBADD="-lbfd ${SHARED_LIBADD}"
-       ;;
-   esac
- 
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 39e852a60bb..208b404f1ea 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -31,12 +31,12 @@ assert enableGold -> withGold stdenv.targetPlatform;
 let
   inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-  version = "2.39";
+  version = "2.40";
 
   srcs = {
     normal = fetchurl {
       url = "mirror://gnu/binutils/binutils-${version}.tar.bz2";
-      sha256 = "sha256-2iSoT+8iAQLdJAQt8G/eqFHCYUpTd/hu/6KPM7exYUg=";
+      hash = "sha256-+CmOsVOks30RLpRapcsoUAQLzyaj6mW1pxXIOv4F5Io=";
     };
     vc4-none = fetchFromGitHub {
       owner = "itszor";
@@ -84,12 +84,10 @@ stdenv.mkDerivation (finalAttrs: {
     # cross-compiling.
     ./always-search-rpath.patch
 
-    # Upstream backport of https://sourceware.org/PR29451:
-    # Don't emit 0-sized debug entries for objects without size.
-    # Without the change elfutils on i686-linux fail dwarf validity test:
-    #    https://sourceware.org/PR29450
-    # Remove once 2.40 releases.
-    ./gas-dwarf-zero-PR29451.patch
+    # Avoid `lib -> out -> lib` reference. Normally `bfd-plugins` does
+    # not need to know binutils' BINDIR at all. It's an absolute path
+    # where libraries are stored.
+    ./plugins-no-BINDIR.patch
   ]
   ++ lib.optional targetPlatform.isiOS ./support-ios.patch
   # Adds AVR-specific options to "size" for compatibility with Atmel's downstream distribution
@@ -105,7 +103,15 @@ stdenv.mkDerivation (finalAttrs: {
       else ./mips64-default-n64.patch)
   ;
 
-  outputs = [ "out" "info" "man" ];
+  outputs = [ "out" "info" "man" "dev" ]
+  # Ideally we would like to always install 'lib' into a separate
+  # target. Unfortunately cross-compiled binutils installs libraries
+  # across both `$lib/lib/` and `$out/$target/lib` with a reference
+  # from $out to $lib. Probably a binutils bug: all libraries should go
+  # to $lib as binutils does not build target libraries. Let's make our
+  # life slightly simpler by installing everything into $out for
+  # cross-binutils.
+  ++ lib.optionals (targetPlatform == hostPlatform) [ "lib" ];
 
   strictDeps = true;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -196,8 +202,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Unconditionally disable:
     # - musl target needs porting: https://sourceware.org/PR29477
-    # - all targets rely on javac: https://sourceware.org/PR29479
     "--disable-gprofng"
+
+    # By default binutils searches $libdir for libraries. This brings in
+    # libbfd and libopcodes into a default visibility. Drop default lib
+    # path to force users to declare their use of these libraries.
+    "--with-lib-path=:"
   ]
   ++ lib.optionals withAllTargets [ "--enable-targets=all" ]
   ++ lib.optionals enableGold [ "--enable-gold" "--enable-plugins" ]
@@ -218,10 +228,26 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  # For the same reason we don't split "lib" output we undo the $target/
+  # prefix for installed headers and libraries we link:
+  #   $out/$host/$target/lib/*     to $out/lib/
+  #   $out/$host/$target/include/* to $dev/include/*
+  # TODO(trofi): fix installation paths upstream so we could remove this
+  # code and have "lib" output unconditionally.
+  postInstall = lib.optionalString (hostPlatform.config != targetPlatform.config) ''
+    ln -s $out/${hostPlatform.config}/${targetPlatform.config}/lib/*     $out/lib/
+    ln -s $out/${hostPlatform.config}/${targetPlatform.config}/include/* $dev/include/
+  '';
+
   passthru = {
     inherit targetPrefix;
     hasGold = enableGold;
     isGNU = true;
+    # Having --enable-plugins is not enough, system has to support
+    # dlopen() or equivalent. See config/plugins.m4 and configure.ac
+    # (around PLUGINS) for cases that support or not support plugins.
+    # No platform specific filters yet here.
+    hasPluginAPI = enableGold;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch b/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch
deleted file mode 100644
index 5f1293f8f73..00000000000
--- a/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=d7abcbcea5ddd40a3bf28758b62f35933c59f996
-
-Don't emit 0-sized debug entries for objects without size.
-Without the change elfutils on i686-linux fail dwarf validity test:
-    https://sourceware.org/PR29450
---- a/gas/dwarf2dbg.c
-+++ b/gas/dwarf2dbg.c
-@@ -2882,6 +2882,7 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	{
- 	  const char *name;
- 	  size_t len;
-+	  expressionS size = { .X_op = O_constant };
- 
- 	  /* Skip warning constructs (see above).  */
- 	  if (symbol_get_bfdsym (symp)->flags & BSF_WARNING)
-@@ -2895,6 +2896,18 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	  if (!S_IS_DEFINED (symp) || !S_IS_FUNCTION (symp))
- 	    continue;
- 
-+#if defined (OBJ_ELF) /* || defined (OBJ_MAYBE_ELF) */
-+	  size.X_add_number = S_GET_SIZE (symp);
-+	  if (size.X_add_number == 0 && IS_ELF
-+	      && symbol_get_obj (symp)->size != NULL)
-+	    {
-+	      size.X_op = O_add;
-+	      size.X_op_symbol = make_expr_symbol (symbol_get_obj (symp)->size);
-+	    }
-+#endif
-+	  if (size.X_op == O_constant && size.X_add_number == 0)
-+	    continue;
-+
- 	  subseg_set (str_seg, 0);
- 	  name_sym = symbol_temp_new_now_octets ();
- 	  name = S_GET_NAME (symp);
-@@ -2920,29 +2933,17 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	  emit_expr (&exp, sizeof_address);
- 
- 	  /* DW_AT_high_pc */
--	  exp.X_op = O_constant;
--#if defined (OBJ_ELF) /* || defined (OBJ_MAYBE_ELF) */
--	  exp.X_add_number = S_GET_SIZE (symp);
--	  if (exp.X_add_number == 0 && IS_ELF
--	      && symbol_get_obj (symp)->size != NULL)
--	    {
--	      exp.X_op = O_add;
--	      exp.X_op_symbol = make_expr_symbol (symbol_get_obj (symp)->size);
--	    }
--#else
--	  exp.X_add_number = 0;
--#endif
- 	  if (DWARF2_VERSION < 4)
- 	    {
--	      if (exp.X_op == O_constant)
--		exp.X_op = O_symbol;
--	      exp.X_add_symbol = symp;
--	      emit_expr (&exp, sizeof_address);
-+	      if (size.X_op == O_constant)
-+		size.X_op = O_symbol;
-+	      size.X_add_symbol = symp;
-+	      emit_expr (&size, sizeof_address);
- 	    }
--	  else if (exp.X_op == O_constant)
--	    out_uleb128 (exp.X_add_number);
-+	  else if (size.X_op == O_constant)
-+	    out_uleb128 (size.X_add_number);
- 	  else
--	    emit_leb128_expr (symbol_get_value_expression (exp.X_op_symbol), 0);
-+	    emit_leb128_expr (symbol_get_value_expression (size.X_op_symbol), 0);
- 	}
- 
-       /* End of children.  */
diff --git a/pkgs/development/tools/misc/binutils/libbfd.nix b/pkgs/development/tools/misc/binutils/libbfd.nix
index 16737a7b5ee..dca62b82eea 100644
--- a/pkgs/development/tools/misc/binutils/libbfd.nix
+++ b/pkgs/development/tools/misc/binutils/libbfd.nix
@@ -1,45 +1,22 @@
 { lib, stdenv
-, buildPackages
-, gnu-config, autoreconfHook, bison, binutils-unwrapped, texinfo
-, libiberty, libintl, zlib
+, binutils-unwrapped-all-targets
 }:
 
 stdenv.mkDerivation {
   pname = "libbfd";
-  inherit (binutils-unwrapped) version src;
-
-  outputs = [ "out" "dev" ];
-
-  patches = binutils-unwrapped.patches ++ [
-    ./build-components-separately.patch
+  inherit (binutils-unwrapped-all-targets) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontInstall = true;
+  propagatedBuildInputs = [
+    binutils-unwrapped-all-targets.dev
+    binutils-unwrapped-all-targets.lib
   ];
 
-  # We just want to build libbfd
-  postPatch = ''
-    cd bfd
-  '';
-
-  postAutoreconf = ''
-    echo "Updating config.guess and config.sub from ${gnu-config}"
-    cp -f ${gnu-config}/config.{guess,sub} ../
-  '';
-
-  # We update these ourselves
-  dontUpdateAutotoolsGnuConfigScripts = true;
-
-  strictDeps = true;
-  nativeBuildInputs = [ autoreconfHook bison texinfo ];
-  buildInputs = [ libiberty zlib ] ++ lib.optionals stdenv.isDarwin [ libintl ];
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  configurePlatforms = [ "build" "host" ];
-  configureFlags = [
-    "--enable-targets=all" "--enable-64-bit-bfd"
-    "--enable-install-libbfd"
-    "--with-system-zlib"
-  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared";
-
-  enableParallelBuilding = true;
+  passthru = {
+    inherit (binutils-unwrapped-all-targets) dev hasPluginAPI;
+  };
 
   meta = with lib; {
     description = "A library for manipulating containers of machine code";
diff --git a/pkgs/development/tools/misc/binutils/libopcodes.nix b/pkgs/development/tools/misc/binutils/libopcodes.nix
index e4b6cec41b4..e067282a0e5 100644
--- a/pkgs/development/tools/misc/binutils/libopcodes.nix
+++ b/pkgs/development/tools/misc/binutils/libopcodes.nix
@@ -1,38 +1,22 @@
-{ lib, stdenv, buildPackages
-, autoreconfHook, bison, binutils-unwrapped
-, libiberty, libbfd
+{ lib, stdenv
+, binutils-unwrapped-all-targets
 }:
 
 stdenv.mkDerivation {
   pname = "libopcodes";
-  inherit (binutils-unwrapped) version src;
-
-  outputs = [ "out" "dev" ];
-
-  patches = binutils-unwrapped.patches ++ [
-    ./build-components-separately.patch
+  inherit (binutils-unwrapped-all-targets) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontInstall = true;
+  propagatedBuildInputs = [
+    binutils-unwrapped-all-targets.dev
+    binutils-unwrapped-all-targets.lib
   ];
 
-  # We just want to build libopcodes
-  postPatch = ''
-    cd opcodes
-    find . ../include/opcode -type f -exec sed {} -i -e 's/"bfd.h"/<bfd.h>/' \;
-  '';
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ autoreconfHook bison ];
-  buildInputs = [ libiberty ];
-  # dis-asm.h includes bfd.h
-  propagatedBuildInputs = [ libbfd ];
-
-  configurePlatforms = [ "build" "host" ];
-  configureFlags = [
-    "--enable-targets=all" "--enable-64-bit-bfd"
-    "--enable-install-libbfd"
-    "--enable-shared"
-  ];
-
-  enableParallelBuilding = true;
+  passthru = {
+    inherit (binutils-unwrapped-all-targets) dev hasPluginAPI;
+  };
 
   meta = with lib; {
     description = "A library from binutils for manipulating machine code";
diff --git a/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch b/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch
new file mode 100644
index 00000000000..562aad33ecc
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch
@@ -0,0 +1,25 @@
+Avoid `lib -> out -> lib` reference. Normally `bfd-plugins` does not
+need to know binutils' BINDIR at all. It's an absolute path where
+libraries are stored.
+--- a/bfd/plugin.c
++++ b/bfd/plugin.c
+@@ -493,7 +493,7 @@ build_plugin_list (bfd *abfd)
+      when configuring binutils using --libdir.  Search in the proper
+      path first, then the old one for backwards compatibility.  */
+   static const char *path[]
+-    = { LIBDIR "/bfd-plugins", BINDIR "/../lib/bfd-plugins" };
++    = { LIBDIR "/bfd-plugins", };
+   struct stat last_st;
+   unsigned int i;
+ 
+@@ -508,9 +508,7 @@ build_plugin_list (bfd *abfd)
+   last_st.st_ino = 0;
+   for (i = 0; i < sizeof (path) / sizeof (path[0]); i++)
+     {
+-      char *plugin_dir = make_relative_prefix (plugin_program_name,
+-					       BINDIR,
+-					       path[i]);
++      char *plugin_dir = xstrdup (path[i]);
+       if (plugin_dir)
+ 	{
+ 	  struct stat st;
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index b657a9ded93..741edcc7487 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.23334";
+  version = "0.1.23391";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1+PcjameB9/1MoyM0RAxrhuE649INyLlhgxA5xJQ9Pw=";
+    sha256 = "sha256-mTqrckoYbxtlwonXp6mtbXSpmVB3WfSXaOkyycBVjx0=";
   };
 
-  vendorHash = "sha256-E24b8PUA1Hy+OepQe2n6TecCMKKicdr5KUdiJ663Td0=";
+  vendorHash = "sha256-7k5jmXvNtxezialavNz8NM7esl2vpXcjRW2n/9GAycs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index 6c2799cfadf..5c7720a2024 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -36,8 +36,11 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    wrapProgram "$out/bin/runtest" \
-      --prefix PATH ":" "${expect}/bin"
+    # 'runtest' and 'dejagnu' look up 'expect' in their 'bin' path
+    # first. We avoid use of 'wrapProgram' here because  wrapping
+    # of shell scripts does not preserve argv[0] for schell scripts:
+    #   https://sourceware.org/PR30052#c5
+    ln -s ${expect}/bin/expect $out/bin/expect
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/distcc/default.nix b/pkgs/development/tools/misc/distcc/default.nix
index 27ff1b5e69d..b7270f79c43 100644
--- a/pkgs/development/tools/misc/distcc/default.nix
+++ b/pkgs/development/tools/misc/distcc/default.nix
@@ -27,10 +27,10 @@ let
                             CXXFLAGS="-O2 -fno-strict-aliasing"
           --mandir=$out/share/man
                             ${if sysconfDir == "" then "" else "--sysconfdir=${sysconfDir}"}
-                            ${if static then "LDFLAGS=-static" else ""}
-                            --with${if static == true || popt == null then "" else "out"}-included-popt
-                            --with${if avahi != null then "" else "out"}-avahi
-                            --with${if gtk3 != null then "" else "out"}-gtk
+                            ${lib.optionalString static "LDFLAGS=-static"}
+                            ${lib.withFeature (static == true || popt == null) "included-popt"}
+                            ${lib.withFeature (avahi != null) "avahi"}
+                            ${lib.withFeature (gtk3 != null) "gtk"}
                             --without-gnome
                             --enable-rfc2553
                             --disable-Werror   # a must on gcc 4.6
diff --git a/pkgs/development/tools/misc/edb/default.nix b/pkgs/development/tools/misc/edb/default.nix
index ec65ca62fa3..2203863264f 100644
--- a/pkgs/development/tools/misc/edb/default.nix
+++ b/pkgs/development/tools/misc/edb/default.nix
@@ -30,6 +30,8 @@ mkDerivation rec {
 
     # Change default optional terminal program path to one that is more likely to work on NixOS.
     substituteInPlace ./src/Configuration.cpp --replace "/usr/bin/xterm" "xterm";
+
+    sed '1i#include <memory>' -i include/{RegisterViewModelBase,State,IState}.h # gcc12
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/gperf/default.nix b/pkgs/development/tools/misc/gperf/default.nix
index 71b0bbd0b0d..d836e5a973a 100644
--- a/pkgs/development/tools/misc/gperf/default.nix
+++ b/pkgs/development/tools/misc/gperf/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qispg6i508rq8pkajh26cznwimbnj06wq9sd85vg95v8nwld1aq";
   };
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "Perfect hash function generator";
 
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 1d25dc8c6e0..5c54941b907 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "help2man";
-  version = "1.49.2";
+  version = "1.49.3";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ni4OITp+CjYkTu1iBNkCtlBGAqV4tuzRUmixRU3q3TY=";
+    url = "mirror://gnu/help2man/help2man-${version}.tar.xz";
+    sha256 = "sha256-TX5P3vLspq/geiaCFRzqeHgeCk6PliIULZ9wwIOi/U8=";
   };
 
   strictDeps = true;
@@ -25,9 +25,9 @@ stdenv.mkDerivation rec {
     "--enable-nls"
   ];
 
-  doCheck = false;                                # target `check' is missing
+  doCheck = false; # target `check' is missing
 
-  patches = if stdenv.hostPlatform.isCygwin then [ ./1.40.4-cygwin-nls.patch ] else null;
+  patches = lib.optional stdenv.hostPlatform.isCygwin ./1.40.4-cygwin-nls.patch;
 
   # We don't use makeWrapper here because it uses substitutions our
   # bootstrap shell can't handle.
@@ -36,8 +36,7 @@ stdenv.mkDerivation rec {
     cat > $out/bin/help2man <<EOF
     #! $SHELL -e
     export PERL5LIB=\''${PERL5LIB:+:}${perlPackages.LocaleGettext}/${perlPackages.perl.libPrefix}
-    ${lib.optionalString stdenv.hostPlatform.isCygwin
-        ''export PATH=\''${PATH:+:}${gettext}/bin''}
+    ${lib.optionalString stdenv.hostPlatform.isCygwin ''export PATH=\''${PATH:+:}${gettext}/bin''}
     exec -a \$0 $out/bin/.help2man-wrapped "\$@"
     EOF
     chmod +x $out/bin/help2man
@@ -45,14 +44,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Generate man pages from `--help' output";
-
-    longDescription =
-      '' help2man produces simple manual pages from the ‘--help’ and
-         ‘--version’ output of other commands.
-      '';
-
+    longDescription = ''
+      help2man produces simple manual pages from the ‘--help’ and ‘--version’ output of other commands.
+    '';
     homepage = "https://www.gnu.org/software/help2man/";
-
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = with maintainers; [ pSub ];
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index 017367e90ba..2faefedd665 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -6,13 +6,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.96.5";
+  version = "4.98.0";
 
   src = fetchFromGitHub {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    hash = "sha256-3ZEGCKc7inbqcE4LuhfKON3C8LebVOlZPEhOHVgx8Lo=";
+    sha256 = "sha256-DQLY0a0sOCZFEJA4Y4b18OcWZw47RyqKZ0mVG0CDVTI=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/misc/lsof/no-build-info.patch b/pkgs/development/tools/misc/lsof/no-build-info.patch
index c433fd6e08f..3c518896b04 100644
--- a/pkgs/development/tools/misc/lsof/no-build-info.patch
+++ b/pkgs/development/tools/misc/lsof/no-build-info.patch
@@ -1,6 +1,6 @@
---- a/usage.c	2018-02-14 15:20:32.000000000 +0100
-+++ b/usage.c	2018-10-08 21:57:45.718560869 +0200
-@@ -930,24 +930,6 @@
+--- a/usage.c
++++ b/usage.c
+@@ -931,24 +931,6 @@ usage(err, fh, version)
  		(void) fprintf(stderr, "    configuration info: %s\n", cp);
  #endif	/* defined(LSOF_CINFO) */
  
@@ -19,22 +19,22 @@
 -		    cp1 ? cp1 : "",
 -		    (cp && cp1) ? "@" : "",
 -		    cp  ? cp  : ""
--		);
+-		    );
 -	    }
 -
  #if	defined(LSOF_BLDCMT)
  	    if ((cp = isnullstr(LSOF_BLDCMT)))
  		(void) fprintf(stderr, "    builder's comment: %s\n", cp);
-@@ -959,12 +939,8 @@
+@@ -958,12 +940,6 @@ usage(err, fh, version)
  		(void) fprintf(stderr, "    compiler: %s\n", cp);
  	    if ((cp = isnullstr(LSOF_CCV)))
  		(void) fprintf(stderr, "    compiler version: %s\n", cp);
 -	    if ((cp = isnullstr(LSOF_CCFLAGS)))
 -		(void) fprintf(stderr, "    compiler flags: %s\n", cp);
- 	    if ((cp = isnullstr(LSOF_LDFLAGS)))
- 		(void) fprintf(stderr, "    loader flags: %s\n", cp);
+-	    if ((cp = isnullstr(LSOF_LDFLAGS)))
+-		(void) fprintf(stderr, "    loader flags: %s\n", cp);
 -	    if ((cp = isnullstr(LSOF_SYSINFO)))
 -		(void) fprintf(stderr, "    system info: %s\n", cp);
- 	    (void) report_SECURITY("    ", ".\n");
- 	    (void) report_WARNDEVACCESS("    ", "are", ".\n");
- 	    (void) report_HASKERNIDCK("    K", "is");
+ 	    // display configurations that might affect output
+ 	    char *features[] = {
+ #if	defined(HASEFFNLINK)
diff --git a/pkgs/development/tools/misc/pahole/default.nix b/pkgs/development/tools/misc/pahole/default.nix
index ec9fb436f76..39b6baabc83 100644
--- a/pkgs/development/tools/misc/pahole/default.nix
+++ b/pkgs/development/tools/misc/pahole/default.nix
@@ -2,11 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pahole";
-  version = "1.24";
+  # Need a revision that supports DW_TAG_unspecified_type(0x3b).
+  # Was added after 1.24 release in a series of changes.
+  # Can switch back to release tags once 1.25 is cut.
+  version = "1.24-unstable-2022-11-24";
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/devel/pahole/pahole.git";
-    rev = "v${version}";
-    sha256 = "sha256-OPseVKt5kIKgK096+ufKrWMS1E/7Z0uxNqCMN6wKfKg=";
+    rev = "02d67c51765dfbd5893087da63744c864c7cc9e0";
+    hash = "sha256-hKc8UKxPtEM2zlYmolSt1pXJKNRt4wC/Uf+dP/Sb7+s=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/tools/misc/saleae-logic-2/default.nix b/pkgs/development/tools/misc/saleae-logic-2/default.nix
index 1c049eac7aa..6eeb47df10a 100644
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools }:
 let
   name = "saleae-logic-2";
-  version = "2.4.3";
+  version = "2.4.6";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    hash = "sha256-xF87Q1K25/9pUYt660RY2RCIC6u2m2ArBQb2nWhiKvw=";
+    hash = "sha256-FYLjg4lzr8M22r4yoKfMIAx2HKGi2fcD28AaV1ChkLk=";
   };
   desktopItem = makeDesktopItem {
     inherit name;
diff --git a/pkgs/development/tools/ocaml/ocaml-top/default.nix b/pkgs/development/tools/ocaml/ocaml-top/default.nix
index 095af776914..18ea26ca22a 100644
--- a/pkgs/development/tools/ocaml/ocaml-top/default.nix
+++ b/pkgs/development/tools/ocaml/ocaml-top/default.nix
@@ -2,13 +2,13 @@
 
 with ocamlPackages; buildDunePackage rec {
   pname = "ocaml-top";
-  version = "1.2.0-rc";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "OCamlPro";
     repo = "ocaml-top";
     rev = version;
-    sha256 = "sha256-ZXnPnPvJmHshkTwYWeBojrgJYAF/R6vUo0XkvVMFSeQ=";
+    hash = "sha256-xmPGGB/zUpfeAxUIhR1PhfoESAJq7sTpqHuf++EH3Lw=";
   };
 
   nativeBuildInputs = [ ocp-build ];
@@ -19,11 +19,6 @@ with ocamlPackages; buildDunePackage rec {
     ocp-build -init
   '';
 
-  postPatch = ''
-    substituteInPlace src/completion.ml \
-      --replace 'LibIndex.load ' 'LibIndex.load ~qualify:false '
-  '';
-
   meta = {
     homepage = "https://www.typerex.org/ocaml-top.html";
     license = lib.licenses.gpl3;
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 526f52c8678..10d99906b40 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "14.2.5";
+  version = "14.2.7";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XhpahA2BPtZeymNwlZ40FzLC5biThBBLna28zRw81Bw=";
+    hash = "sha256-x+hSsN/STJYbyGRCQJ70T3FMKfe1aJaqiK+KT0eNpwE=";
   };
 
-  vendorHash = "sha256-ehG71B351u+LoXDuKQkuEdEpUdHslVU2HcPKUz6FAnQ=";
+  vendorHash = "sha256-rLPL2kGIPR/paY3mLXsqMgvTe7EgQPmg3EqXrLjlFPk=";
 
   sourceRoot = "source/src";
 
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 13ba669bb4f..8fcb696ac7f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -60,7 +60,7 @@ let
         buildGrammar {
           language = grammar.language or name;
           inherit version;
-          src = grammar.src or fetchGrammar grammar;
+          src = grammar.src or (fetchGrammar grammar);
           location = grammar.location or null;
         };
       grammars' = import ./grammars { inherit lib; } // extraGrammars;
diff --git a/pkgs/development/tools/picotool/default.nix b/pkgs/development/tools/picotool/default.nix
index f76e0287b56..ecd80d62604 100644
--- a/pkgs/development/tools/picotool/default.nix
+++ b/pkgs/development/tools/picotool/default.nix
@@ -2,25 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "picotool";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = pname;
     rev = version;
-    sha256 = "sha256-YjDHoRcDoezyli42bJ0bnfjdNNY8l6ZilrxhOudqvwE=";
+    sha256 = "sha256-KP5Cq6pYKQI5dV6S4lLapu9EcwAgLgYpK0qreNDZink=";
   };
 
   buildInputs = [ libusb1 pico-sdk ];
   nativeBuildInputs = [ cmake pkg-config ];
   cmakeFlags = [ "-DPICO_SDK_PATH=${pico-sdk}/lib/pico-sdk" ];
 
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 ./picotool -t $out/bin
-    runHook postInstall
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/raspberrypi/picotool";
     description = "Tool for interacting with a RP2040 device in BOOTSEL mode, or with a RP2040 binary";
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix b/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
index dd1e2640a52..424e93c9344 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
@@ -151,7 +151,7 @@ let
         (builtins.filter
           ({ prefix, path }: "NETRC" == prefix)
           builtins.nixPath);
-      netrc_file = if (pathParts != [ ]) then (builtins.head pathParts).path else "";
+      netrc_file = lib.optionalString (pathParts != [ ]) (builtins.head pathParts).path;
     in
     pkgs.runCommand file
       {
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index 36a66d091ae..60a45f606f6 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -457,9 +457,9 @@ lib.composeManyExtensions [
 
         preConfigure = lib.concatStringsSep "\n" [
           (old.preConfigure or "")
-          (if (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) then ''
+          (lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) ''
             MACOSX_DEPLOYMENT_TARGET=10.16
-          '' else "")
+          '')
         ];
 
         preBuild = old.preBuild or "" + ''
@@ -720,7 +720,7 @@ lib.composeManyExtensions [
                 (old.propagatedBuildInputs or [ ])
                 ++ lib.optionals mpiSupport [ self.mpi4py self.openssh ]
               ;
-              preBuild = if mpiSupport then "export CC=${mpi}/bin/mpicc" else "";
+              preBuild = lib.optionalString mpiSupport "export CC=${mpi}/bin/mpicc";
               HDF5_DIR = "${pkgs.hdf5}";
               HDF5_MPI = if mpiSupport then "ON" else "OFF";
               # avoid strict pinning of numpy
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index 84f1670e6df..8799fbd62d3 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -19,6 +19,7 @@ let
     nativeBuildInputs = [ pkg-config cpio python3 python3.pkgs.setuptools ];
     buildInputs = [ elfutils gettext ];
     enableParallelBuilding = true;
+    NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ]; # Needed with GCC 12
   };
 
   ## a kernel build dir as expected by systemtap
diff --git a/pkgs/development/tools/rust/cargo-semver-checks/default.nix b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
index 359f5dbe64d..1f26f23e15c 100644
--- a/pkgs/development/tools/rust/cargo-semver-checks/default.nix
+++ b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.17.1";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zObflf9BKq24km54LW7It4Lvff0OKYNDb02uatdX7g4=";
+    sha256 = "sha256-ugcmsm1j2a1wOnUe9u70yoRXALCmtXSnb80N4B4IUWE=";
   };
 
-  cargoSha256 = "sha256-itL6WpM4OLn4mzdB0ytM2J7F1fRDrXwCaI/8WdLo6y0=";
+  cargoSha256 = "sha256-PxnPCevjVvmFMlmYv6qwIBZk2MThz65hgUyVhm2tzlc=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -29,9 +29,9 @@ rustPlatform.buildRustPackage rec {
 
   checkFlags = [
     # requires nightly version of cargo-rustdoc
-    "--skip=dump::tests"
     "--skip=query::tests"
     "--skip=verify_binary_contains_lints"
+    "--skip=rustdoc_cmd::tests"
   ];
 
   # use system openssl
diff --git a/pkgs/development/tools/squawk/correct-Cargo.lock.patch b/pkgs/development/tools/squawk/correct-Cargo.lock.patch
new file mode 100644
index 00000000000..431f004d2d7
--- /dev/null
+++ b/pkgs/development/tools/squawk/correct-Cargo.lock.patch
@@ -0,0 +1,13 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index d5803a8..384224d 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1585,7 +1585,7 @@ checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+ 
+ [[package]]
+ name = "squawk"
+-version = "0.19.0"
++version = "0.20.0"
+ dependencies = [
+  "atty",
+  "base64 0.12.3",
diff --git a/pkgs/development/tools/squawk/default.nix b/pkgs/development/tools/squawk/default.nix
new file mode 100644
index 00000000000..9649625c173
--- /dev/null
+++ b/pkgs/development/tools/squawk/default.nix
@@ -0,0 +1,67 @@
+{ darwin
+, fetchFromGitHub
+, lib
+, libiconv
+, libpg_query
+, openssl
+, pkg-config
+, rustPlatform
+, stdenv
+}:
+let
+  # The query parser produces a slightly different AST between major versions
+  # and Squawk is not capable of handling >=14 correctly yet.
+  libpg_query13 = libpg_query.overrideAttrs (_: rec {
+    version = "13-2.2.0";
+    src = fetchFromGitHub {
+      owner = "pganalyze";
+      repo = "libpg_query";
+      rev = version;
+      hash = "sha256-gEkcv/j8ySUYmM9lx1hRF/SmuQMYVHwZAIYOaCQWAFs=";
+    };
+  });
+in
+rustPlatform.buildRustPackage rec {
+  pname = "squawk";
+  version = "0.20.0";
+
+  src = fetchFromGitHub {
+    owner = "sbdchd";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-v9F+HfscX4dIExIP1YvxOldZPPtmxh8lO3SREu6M+C0=";
+  };
+
+  cargoHash = "sha256-kSaQxqom8LSCOQBoIZ1iv+q2+Ih8l61L97xXv5c4a0k=";
+
+  cargoPatches = [
+    ./correct-Cargo.lock.patch
+  ];
+
+  patches = [
+    ./fix-postgresql-version-in-snapshot-test.patch
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = lib.optionals (!stdenv.isDarwin) [
+    libiconv
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    CoreFoundation
+    Security
+  ]);
+
+  LIBPG_QUERY_PATH = libpg_query13;
+
+  meta = with lib; {
+    description = "Linter for PostgreSQL, focused on migrations";
+    homepage = "https://squawkhq.com/";
+    changelog = "https://github.com/sbdchd/squawk/blob/v${version}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ andrewsmith ];
+  };
+}
diff --git a/pkgs/development/tools/squawk/fix-postgresql-version-in-snapshot-test.patch b/pkgs/development/tools/squawk/fix-postgresql-version-in-snapshot-test.patch
new file mode 100644
index 00000000000..205fd3dba97
--- /dev/null
+++ b/pkgs/development/tools/squawk/fix-postgresql-version-in-snapshot-test.patch
@@ -0,0 +1,13 @@
+diff --git a/parser/src/snapshots/squawk_parser__parse__tests__parse_sql_query_json.snap b/parser/src/snapshots/squawk_parser__parse__tests__parse_sql_query_json.snap
+index 7273b74..ae94927 100644
+--- a/parser/src/snapshots/squawk_parser__parse__tests__parse_sql_query_json.snap
++++ b/parser/src/snapshots/squawk_parser__parse__tests__parse_sql_query_json.snap
+@@ -133,7 +133,7 @@ Ok(
+             }),
+         ]),
+         "version": Number(
+-            130003,
++            130008,
+         ),
+     }),
+ )
diff --git a/pkgs/development/tools/wgo/default.nix b/pkgs/development/tools/wgo/default.nix
new file mode 100644
index 00000000000..3440c0f947e
--- /dev/null
+++ b/pkgs/development/tools/wgo/default.nix
@@ -0,0 +1,27 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "wgo";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "bokwoon95";
+    repo = "wgo";
+    rev = "v${version}";
+    hash = "sha256-kfa3Lm2oJomhoHbtSPLylRr+BFGV/y7xqSIv3xHHg3Q=";
+  };
+
+  vendorSha256 = "sha256-jxyO3MGrC+y/jJuwur/+tLIsbxGnT57ZXYzaf1lCv7A=";
+
+  ldflags = [ "-s" "-w" ];
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Live reload for Go apps";
+    homepage = "https://github.com/bokwoon95/wgo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bokwoon95 ];
+  };
+}
+
diff --git a/pkgs/development/tools/wlcs/default.nix b/pkgs/development/tools/wlcs/default.nix
index 7a5470a3342..4ec4403987a 100644
--- a/pkgs/development/tools/wlcs/default.nix
+++ b/pkgs/development/tools/wlcs/default.nix
@@ -42,6 +42,11 @@ stdenv.mkDerivation rec {
     wayland
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
   };
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index fa6dcbf28a7..86accf5977b 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
diff --git a/pkgs/games/cataclysm-dda/stable.nix b/pkgs/games/cataclysm-dda/stable.nix
index 3bf2f884ab3..da84422308c 100644
--- a/pkgs/games/cataclysm-dda/stable.nix
+++ b/pkgs/games/cataclysm-dda/stable.nix
@@ -44,6 +44,11 @@ let
       "VERSION=${version}"
     ];
 
+    NIX_CFLAGS_COMPILE = [
+      # Needed with GCC 12
+      "-Wno-error=array-bounds"
+    ];
+
     meta = common.meta // {
       maintainers = with lib.maintainers;
         common.meta.maintainers ++ [ skeidel ];
diff --git a/pkgs/games/cdogs-sdl/default.nix b/pkgs/games/cdogs-sdl/default.nix
index 23eb6e96dcb..a4943187dd6 100644
--- a/pkgs/games/cdogs-sdl/default.nix
+++ b/pkgs/games/cdogs-sdl/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
     "-DCMAKE_C_FLAGS=-Wno-error=array-bounds"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake
diff --git a/pkgs/games/eboard/default.nix b/pkgs/games/eboard/default.nix
index 293811e9b04..81bc6d365a0 100644
--- a/pkgs/games/eboard/default.nix
+++ b/pkgs/games/eboard/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
   '';
 
   NIX_CFLAGS_COMPILE = "-fpermissive";
-  NIX_LDFLAGS = "-ldl";
 
   meta = {
     homepage = "http://www.bergo.eng.br/eboard/";
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index a65ce6bac0d..41dd9625adb 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -202,7 +202,7 @@ let
           --run "$out/share/factorio/update-config.sh"               \
           --argv0 ""                                                 \
           --add-flags "-c \$HOME/.factorio/config.cfg"               \
-          ${if mods!=[] then "--add-flags --mod-directory=${modDir}" else ""}
+          ${lib.optionalString (mods!=[]) "--add-flags --mod-directory=${modDir}"}
 
           # TODO Currently, every time a mod is changed/added/removed using the
           # modlist, a new derivation will take up the entire footprint of the
diff --git a/pkgs/games/gimx/default.nix b/pkgs/games/gimx/default.nix
index 785d38a759a..410228c4f02 100644
--- a/pkgs/games/gimx/default.nix
+++ b/pkgs/games/gimx/default.nix
@@ -38,6 +38,14 @@ in stdenv.mkDerivation rec {
   '';
 
   makeFlags = [ "build-core" ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=use-after-free"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/games/liquidwar/default.nix b/pkgs/games/liquidwar/default.nix
index e012886c884..9d9e4243452 100644
--- a/pkgs/games/liquidwar/default.nix
+++ b/pkgs/games/liquidwar/default.nix
@@ -30,11 +30,15 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE =
-    "-Wno-error=deprecated-declarations" +
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ] ++ [
+    "-Wno-error=deprecated-declarations"
     # Avoid GL_GLEXT_VERSION double definition
     " -DNO_SDL_GLEXT"
-  ;
+  ];
 
   # To avoid problems finding SDL_types.h.
   configureFlags = [ "CFLAGS=-I${lib.getDev SDL}/include/SDL" ];
diff --git a/pkgs/games/oilrush/default.nix b/pkgs/games/oilrush/default.nix
index b78baee725d..947b7141b57 100644
--- a/pkgs/games/oilrush/default.nix
+++ b/pkgs/games/oilrush/default.nix
@@ -14,8 +14,7 @@ stdenv.mkDerivation {
     fetchurl { inherit url sha256; };
   shell = stdenv.shell;
   arch = if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
-         else if stdenv.hostPlatform.system == "i686-linux" then "x86"
-         else "";
+         else lib.optionalString (stdenv.hostPlatform.system == "i686-linux") "x86";
   unpackPhase = ''
     mkdir oilrush
     cd oilrush
diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
index 389f59f91a6..8df88c92ff1 100644
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@@ -63,6 +63,10 @@ mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    sed '1i#include <memory>' -i components/myguiplatform/myguidatamanager.cpp # gcc12
+  '';
+
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
 
   buildInputs = [
diff --git a/pkgs/games/openrct2/default.nix b/pkgs/games/openrct2/default.nix
index d474b0eae92..10914d41077 100644
--- a/pkgs/games/openrct2/default.nix
+++ b/pkgs/games/openrct2/default.nix
@@ -94,6 +94,11 @@ stdenv.mkDerivation {
     "-DDOWNLOAD_TITLE_SEQUENCES=OFF"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   postUnpack = ''
     cp -r ${objects-src}         $sourceRoot/data/object
     cp -r ${title-sequences-src} $sourceRoot/data/sequence
diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 752181581f3..1b022ff6e14 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
 
-  NIX_CFLAGS_COMPILE = if isMobile then "-DSTYLUS_BASED" else "";
+  NIX_CFLAGS_COMPILE = lib.optionalString isMobile "-DSTYLUS_BASED";
 
   buildInputs = [ gtk3 libX11 ];
 
diff --git a/pkgs/games/stepmania/default.nix b/pkgs/games/stepmania/default.nix
index 2445ee9096c..6cb7a23dff5 100644
--- a/pkgs/games/stepmania/default.nix
+++ b/pkgs/games/stepmania/default.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
     ./0001-fix-build-with-ffmpeg-4.patch
   ];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i src/arch/ArchHooks/ArchHooks.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake nasm ];
 
   buildInputs = [
diff --git a/pkgs/games/supertux/default.nix b/pkgs/games/supertux/default.nix
index 679500f974c..857617bc4bf 100644
--- a/pkgs/games/supertux/default.nix
+++ b/pkgs/games/supertux/default.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
     sha256 = "1xkr3ka2sxp5s0spp84iv294i29s1vxqzazb6kmjc0n415h0x57p";
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i external/partio_zip/zip_manager.hpp # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config cmake ];
 
   buildInputs = [
diff --git a/pkgs/games/zod/default.nix b/pkgs/games/zod/default.nix
index 737fed1e7f6..e0c2031dde2 100644
--- a/pkgs/games/zod/default.nix
+++ b/pkgs/games/zod/default.nix
@@ -22,6 +22,9 @@ let
     url = "mirror://sourceforge/zod/linux_releases/zod_linux-${version}.tar.gz";
     sha256 = "017v96aflrv07g8j8zk9mq8f8rqxl5228rjff5blq8dxpsv1sx7h";
   };
+  postPatch = ''
+    sed '1i#include <ctime>' -i zod_src/common.cpp # gcc12
+  '';
   nativeBuildInputs = [
     makeWrapper
   ];
@@ -37,7 +40,7 @@ let
   hardeningDisable = [ "format" ];
   NIX_LDFLAGS = "-L${libmysqlclient}/lib/mysql";
   zod_engine = stdenv.mkDerivation {
-    inherit version src nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
+    inherit version src postPatch nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
     pname = "${name}-engine";
     enableParallelBuilding = true;
     preBuild = "cd zod_src";
@@ -48,7 +51,7 @@ let
     '';
   };
   zod_map_editor = stdenv.mkDerivation {
-    inherit version src nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
+    inherit version src postPatch nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
     pname = "${name}-map_editor";
     enableParallelBuilding = true;
     preBuild = "cd zod_src";
diff --git a/pkgs/misc/cups/drivers/samsung/4.01.17.nix b/pkgs/misc/cups/drivers/samsung/4.01.17.nix
index 33470301747..eaba99839f6 100644
--- a/pkgs/misc/cups/drivers/samsung/4.01.17.nix
+++ b/pkgs/misc/cups/drivers/samsung/4.01.17.nix
@@ -23,7 +23,7 @@
 # to see what will break when upgrading. Consider a new versioned attribute.
 let
   installationPath = if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64" else "i386";
-  appendPath = if stdenv.hostPlatform.system == "x86_64-linux" then "64" else "";
+  appendPath = lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux") "64";
   libPath = lib.makeLibraryPath [ cups libusb-compat-0_1 ] + ":$out/lib:${stdenv.cc.cc.lib}/lib${appendPath}";
 in stdenv.mkDerivation rec {
   pname = "samsung-UnifiedLinuxDriver";
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 441f3ccb37f..fce51aabd26 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -10,6 +10,8 @@
 
 # Extra options
 , prefix ? ""
+
+, testers
 }:
 
 with lib;
@@ -25,7 +27,7 @@ let
   optAlsaLib = if libOnly then null else shouldUsePkg alsa-lib;
   optLibopus = shouldUsePkg libopus;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "${prefix}jack2";
   version = "1.9.19";
 
@@ -63,11 +65,14 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/jack_control --set PYTHONPATH $PYTHONPATH
   '');
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = {
     description = "JACK audio connection kit, version 2 with jackdbus";
     homepage = "https://jackaudio.org";
     license = licenses.gpl2Plus;
+    pkgConfigModules = [ "jack" ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ goibhniu ];
   };
-}
+})
diff --git a/pkgs/misc/jackaudio/jack1.nix b/pkgs/misc/jackaudio/jack1.nix
index ba77e9c3c91..4e7375a2691 100644
--- a/pkgs/misc/jackaudio/jack1.nix
+++ b/pkgs/misc/jackaudio/jack1.nix
@@ -2,6 +2,8 @@
 
 # Optional Dependencies
 , alsa-lib ? null, db ? null, libuuid ? null, libffado ? null, celt ? null
+
+, testers
 }:
 
 let
@@ -13,12 +15,12 @@ let
   optLibffado = shouldUsePkg libffado;
   optCelt = shouldUsePkg celt;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jack1";
   version = "0.125.0";
 
   src = fetchurl {
-    url = "https://jackaudio.org/downloads/jack-audio-connection-kit-${version}.tar.gz";
+    url = "https://jackaudio.org/downloads/jack-audio-connection-kit-${finalAttrs.version}.tar.gz";
     sha256 = "0i6l25dmfk2ji2lrakqq9icnwjxklgcjzzk65dmsff91z2zva5rm";
   };
 
@@ -30,11 +32,14 @@ stdenv.mkDerivation rec {
   buildInputs = [ optAlsaLib optDb optLibffado optCelt ];
   propagatedBuildInputs = [ optLibuuid ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "JACK audio connection kit";
     homepage = "https://jackaudio.org";
     license = with licenses; [ gpl2 lgpl21 ];
+    pkgConfigModules = [ "jack" ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/misc/source-and-tags/default.nix b/pkgs/misc/source-and-tags/default.nix
index 966a451c060..88ed7a47725 100644
--- a/pkgs/misc/source-and-tags/default.nix
+++ b/pkgs/misc/source-and-tags/default.nix
@@ -59,7 +59,7 @@
                     # without this creating tag files for lifted-base fails
                     export LC_ALL=en_US.UTF-8
                     export LANG=en_US.UTF-8
-                    ${if stdenv.isLinux then "export LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive;" else ""}
+                    ${lib.optionalString stdenv.isLinux "export LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive;"}
 
                     ${toString hasktags}/bin/hasktags --ignore-close-implementation --ctags .
                     mv tags \$TAG_FILE
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 42d7021f345..a3600587250 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -92,16 +92,6 @@ let
 
     passAsFile = [ "extraConfig" ];
 
-    # Workaround '-idirafter' ordering bug in staging-next:
-    #   https://github.com/NixOS/nixpkgs/pull/210004
-    # where libc '-idirafter' gets added after user's idirafter and
-    # breaks.
-    # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-    preConfigure = ''
-      export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] buildPackages.stdenv.hostPlatform.config}=$(< ${buildPackages.stdenv.cc}/nix-support/libc-cflags)
-      export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"]               stdenv.hostPlatform.config}=$(<               ${stdenv.cc}/nix-support/libc-cflags)
-    '';
-
     configurePhase = ''
       runHook preConfigure
 
diff --git a/pkgs/os-specific/darwin/xcode/default.nix b/pkgs/os-specific/darwin/xcode/default.nix
index 6d1929ef982..ec98a0b1cfb 100644
--- a/pkgs/os-specific/darwin/xcode/default.nix
+++ b/pkgs/os-specific/darwin/xcode/default.nix
@@ -41,31 +41,44 @@ let requireXcode = version: sha256:
   in app.overrideAttrs ( oldAttrs: oldAttrs // { inherit meta; });
 
 in lib.makeExtensible (self: {
-  xcode_8_1 = requireXcode "8.1" "18xjvfipwzia66gm3r9p770xdd4r375vak7chw5vgqnv9yyjiq2n";
-  xcode_8_2 = requireXcode "8.2" "13nd1zsfqcp9hwp15hndr0rsbb8rgprrz7zr2ablj4697qca06m2";
-  xcode_9_1 = requireXcode "9.1" "0ab1403wy84ys3yn26fj78cazhpnslmh3nzzp1wxib3mr1afjvic";
-  xcode_9_2 = requireXcode "9.2" "1bgfgdp266cbbqf2axcflz92frzvhi0qw0jdkcw6r85kdpc8dj4c";
-  xcode_9_3 = requireXcode "9.3" "12m9kb4759s2ky42b1vf7y38qqxn2j99s99adzc6ljnmy26ii12w";
-  xcode_9_4 = requireXcode "9.4" "00az1cf9pm8zmvzs6yq04prdmxp8xi3ymxw94jjh4mh7hlbkhcb7";
-  xcode_9_4_1 = requireXcode "9.4.1" "0y9kphj86c14jl6aibv57sd7ln0w06vdhzm8ysp0s98rfgyq2lbw";
-  xcode_10_1 = requireXcode "10.1" "1ssdbg4v8r11fjf4jl38pwyry2aia1qihbxyxapz0v0n5gfnp05v";
-  xcode_10_2 = requireXcode "10.2" "1xzybl1gvb3q5qwlwchanzpws4sb70i3plf0vrzvlfdp2hsb3pg7";
-  xcode_10_2_1 = requireXcode "10.2.1" "11sdb54nr0x7kp987qq839x6k5gdx7vqdxjiy5xm5279n1n47bmg";
-  xcode_10_3 = requireXcode "10.3" "1i628vfn6zad81fsz3zpc6z15chhskvyp8qnajp2wnpzvrwl6ngb";
-  xcode_11 = requireXcode "11" "1r03j3kkp4blfp2kqpn538w3dx57ms930fj8apjkq6dk7fv3jcqh";
-  xcode_11_1 = requireXcode "11.1" "1c2gzc4jhhx5a7ncg19sh1r99izhipybaqxl1ll52x5y8689awc1";
-  xcode_11_2 = requireXcode "11.2" "1lm3q8zpvm184246h5j9mw4c1y9kk9sxnr3j98kfm0312n0l98gj";
-  xcode_11_3 = requireXcode "11.3" "04rv6xlywy8xqfx9ma8ygsdw4yhckk2mq0qnklxnfly899iw4wza";
-  xcode_11_3_1 = requireXcode "11.3.1" "1p6nicj91kr6ad3rmycahd1i7z4hj7ccjs93ixsiximjzaahx3q4";
-  xcode_11_4 = requireXcode "11.4" "065rpb3rdk19nv3rwyf9bk32ccbd0lld12gj12l89cyg65mhpyy7";
-  xcode_11_5 = requireXcode "11.5" "1dizazq9nz1vjkc5gy7dd4x760mkfjiifk1hf6d9mscchdq8rfkw";
-  xcode_11_6 = requireXcode "11.6" "1y4fhw1kiphzxdb4wpv697z5r0algvaldwq5iqv266797rnfql4x";
-  xcode_11_7 = requireXcode "11.7" "0422rdc4j5qwyk59anbybxyfv0p26x0xryszm0wd8i44g66smlmj";
-  xcode_12 = requireXcode "12" "1w3xm268pyn5m04wv22invd5kr2k4jqllgrzapv6n1sxxynxrh8z";
-  xcode_12_0_1 = requireXcode "12.0.1" "1p6vd5ai0hh3cq6aflh4h21ar0shxnz8wlkaxwq7liwsdmkwzbl0";
-  xcode_12_1 = requireXcode "12.1" "1widy74dk43wx8iqgd7arzf6q4kzdmaz8pfwymzs8chnq9dqr3wp";
-  xcode_12_2 = requireXcode "12.2" "17i0wf4pwrxwfgjw7rpw9mcd59nkmys1k5h2rqsw81snzyxy9j0v";
-  xcode_12_3 = requireXcode "12.3" "0kwf1y4llysf1p0nsbqyzccn7d77my0ldagr5fi3by4k0xy3d189";
+  xcode_8_1 = requireXcode "8.1" "sha256-VuAovU/b4rcLh+xMtcsZmbTWwTk35VGfMSp+fqPbsqM=";
+  xcode_8_2 = requireXcode "8.2" "sha256-ohqgGD7JEEmXEvmfn/N9Ga2lM8jNwhIuh+ky7PQPzY4=";
+  xcode_9_1 = requireXcode "9.1" "sha256-LG7pVMh1rNh5uP/bASvV9sKvGDrSGWH90J4gzwcgYSk=";
+  xcode_9_2 = requireXcode "9.2" "sha256-jMiG2G2zoGw4m00CjkGE+2cn0qeOdSUcXosZI2577q0=";
+  xcode_9_3 = requireXcode "9.3" "sha256-XIQYjfDVSmrYbyolnZIUtmOMhj9uhyWIn0KncsiaqYo=";
+  xcode_9_4 = requireXcode "9.4" "sha256-ZzE4F4UHVgKlJIn36kfs6Pba8iUAe6P/rh/VmxwLXwE=";
+  xcode_9_4_1 = requireXcode "9.4.1" "sha256-fFGB/XMZJQ2u9qh+2LYBHFh6mj5lr6gMlSQwgyS8M3k=";
+  xcode_10_1 = requireXcode "10.1" "sha256-u4Br3SsWbPCv6r4vGHFQUQmfPb9oUEmcdCFktMlbTes=";
+  xcode_10_2 = requireXcode "10.2" "sha256-592xNBS3Obp/3sDROyI4SxPN77cKMk45Lnis/QJd/vc=";
+  xcode_10_2_1 = requireXcode "10.2.1" "sha256-r65DbLDpiFJ78VH2hvfp7ZVpehoI44PSnaeDbElZTYc=";
+  xcode_10_3 = requireXcode "10.3" "sha256-61lDed7/Wi6uVBaj6/fUELISvmH3j69dQE19Y91GwsQ=";
+  xcode_11 = requireXcode "11" "sha256-EDM5tjuzGTzlVUg6MJKup/Q2OBrFXjzFdXSRO+eQA+Q=";
+  xcode_11_1 = requireXcode "11.1" "sha256-gXGVkEG+dFEoDbRjtfyN8MeUcoA6hcfsUaVDKAn7T7A=";
+  xcode_11_2 = requireXcode "11.2" "sha256-8qFEgRVhgOomSnJk23WaM/nACK9JFmiIICjUfT/Co9I=";
+  xcode_11_3 = requireXcode "11.3" "sha256-6nPCY0rIU2c7nRYDXMWcDHrCm34eqZq6wx157mk3OxM=";
+  xcode_11_3_1 = requireXcode "11.3.1" "sha256-BI8Olfqyxh51jyNpydiRkPwTQ4OK+ZpHUybPkCSL1tw=";
+  xcode_11_4 = requireXcode "11.4" "sha256-x/sLazHPs4SoCPKJ0CgFbTEmxlzJeZ7HtinMlse6uRg=";
+  xcode_11_5 = requireXcode "11.5" "sha256-fLqMcIOM6ZqacTBMF6N0swJzOmnt+FfYlDt8m/BXP7Y=";
+  xcode_11_6 = requireXcode "11.6" "sha256-nVDsbD7pGCM2jgXzRtV+VIFc/klmX05W6x/eOAOHjvg=";
+  xcode_11_7 = requireXcode "11.7" "sha256-stKqjXmERNQ4qF/73EE34oLtfF9+WZXK9BwXSVjLQhA=";
+  xcode_12 = requireXcode "12" "sha256-H8Hcre9dB2v2VT8/SrEkU+RZ2rZRiM0JqMX6i4yoffA=";
+  xcode_12_0_1 = requireXcode "12.0.1" "sha256-gK7PZ22aR3ow72pSjr7tUIOsgoAEUqcMZgNCEFVp29w=";
+  xcode_12_1 = requireXcode "12.1" "sha256-l4+MW8IWMqR/9dxd9FVtfxJs3M/qtIcj6nyQ2cjxLfI=";
+  xcode_12_2 = requireXcode "12.2" "sha256-G8jku/9WB8Q1zgKWGbSv06bSWE385sPlc7xnfonjIJ4=";
+  xcode_12_3 = requireXcode "12.3" "sha256-CYU2fAeT+DWiK/mpRoGv57RjGfseL23BDU57SokPjk8=";
+  xcode_12_4 = requireXcode "12.4" "sha256-Qw4j+XFry85/AviHQVhjjjKLAfmRNNwMGN5G8FheJwQ=";
+  xcode_12_5 = requireXcode "12.5" "sha256-xiGffnV0P9Ojd6IrJSXILUX4oznPif7zm00WAksn3qU=";
+  xcode_12_5_1 = requireXcode "12.5.1" "sha256-zL0kS86ZzBkIrKLPKvWguDvXj9Tqbr7uR/VZaT/uZ9A=";
+  xcode_13 = requireXcode "13" "sha256-uTY6d5DBu4OOQLkxs3ExDfLXh50rE2LLlqtCbk3Qn6E=";
+  xcode_13_1 = requireXcode "13.1" "sha256-vd+4eFVaAyvXsdaExcfbDZSXOwkpt+rEbkBYSMjdUEA=";
+  xcode_13_2 = requireXcode "13.2" "sha256-guJXm/QnMfvUZwAcJwoy0QeO+DpDcUhs8AxVKvm9tYQ=";
+  xcode_13_2_1 = requireXcode "13.2.1" "sha256-r832Uu+Q8utK4zN0CtwiMCvMYT5HstWInyq4cNIaZJM=";
+  xcode_13_3 = requireXcode "13.3" "sha256-p2zaWMpmUeNHQtYOOaVdhCt3cgapvzL3l73/J+UwzCE=";
+  xcode_13_3_1 = requireXcode "13.3.1" "sha256-j71vpJVJpyj/IOlL+4+5lYgOlhf/zn+7ExIHbxL51cQ=";
+  xcode_13_4 = requireXcode "13.4" "sha256-IY1coss90GlBeJg/HQPMU8v2rOOxsqlY5q+2Qxe8nnY=";
+  xcode_13_4_1 = requireXcode "13.4.1" "sha256-Jk8fLgvnODoIhuVJqfV0KrpBBL40fRrHJbFmm44NRKE=";
+  xcode_14 = requireXcode "14" "sha256-E+wjPgQx/lbYAsauksdmGsygL5VPBA8R9pHB93eA7T0=";
+  xcode_14_1 = requireXcode "14.1" "sha256-QJGAUVIhuDYyzDNttBPv5lIGOfvkYqdOFSUAr5tlkfs=";
   xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "12.3")}";
 })
 
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
index d8fc4648029..560f2bf3014 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.7.2";
+  version = "1.2.8";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ijW3IY5Q8qLHk0LQ3pje2BQ5zhnhKAk4Xsm+lZbefC8=";
+    hash = "sha256-GrAbdOM0JcqZwuNsCET9aIgnMZO9iYJA/o+TrMvL80c=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
index 512fe605b6e..4568ecf1e7a 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-ucm-conf";
-  version = "1.2.7.1";
+  version = "1.2.8";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    hash = "sha256-rFsqEnV4Pv8H4cs0w2xsWYd0JnmjQAN1B8BKncHSLKw=";
+    hash = "sha256-/uSnN4MP0l+WnYPaRqKyMb6whu/ZZvzAfSJeeCMmCug=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index 2a98aa82ebb..9c41a217bad 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -85,6 +85,11 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
+  # Flag needed by GCC 12 but unrecognized by GCC 9 (aarch64-linux default now)
+  NIX_CFLAGS_COMPILE = lib.optionals (with stdenv; cc.isGNU && lib.versionAtLeast cc.version "12") [
+    "-Wno-error=mismatched-new-delete"
+  ];
+
   patchPhase = ''
     patchShebangs scripts
 
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index 886bf3e6fee..8312d64acdd 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -31,7 +31,6 @@ stdenv.mkDerivation {
 
   preBuild = ''
     substituteInPlace Makefile \
-      --replace "\$(shell uname -r)" "${kernel.modDirVersion}" \
       --replace "/lib/modules" "${kernel.dev}/lib/modules"
   '';
 
diff --git a/pkgs/os-specific/linux/dracut/default.nix b/pkgs/os-specific/linux/dracut/default.nix
index 583bd4115ac..c6bf684f7fc 100644
--- a/pkgs/os-specific/linux/dracut/default.nix
+++ b/pkgs/os-specific/linux/dracut/default.nix
@@ -10,24 +10,17 @@
 , bash
 , kmod
 , binutils
-, busybox
 , bzip2
 , coreutils
 , cpio
 , findutils
-, glibc
 , gnugrep
 , gnused
 , gnutar
 , gzip
-, kbd
-, lvm2
 , lz4
 , lzop
-, procps
-, rng-tools
 , squashfsTools
-, systemd
 , util-linux
 , xz
 , zstd
@@ -76,23 +69,16 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/dracut --prefix PATH : ${lib.makeBinPath [
       coreutils
       util-linux
-    ]} --prefix DRACUT_PATH : ${lib.makeBinPath [
+    ]} --suffix DRACUT_PATH : ${lib.makeBinPath [
       bash
       binutils
       coreutils
       findutils
-      glibc
       gnugrep
       gnused
       gnutar
-      kbd
-      lvm2
-      procps
-      rng-tools
-      squashfsTools
-      systemd
+      stdenv.cc.libc  # for ldd command
       util-linux
-      busybox
     ]}
     wrapProgram $out/bin/dracut-catimages --set PATH ${lib.makeBinPath [
       coreutils
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index e882ddd69b4..a2229a0a60c 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -33,5 +33,8 @@ stdenvNoCC.mkDerivation rec {
     priority = 6; # give precedence to kernel firmware
   };
 
-  passthru = { inherit version; };
+  passthru = {
+    inherit version;
+    updateScript = ./update.sh;
+  };
 }
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 8fb82683370..d7a13faf4a0 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.364";
+  version = "0.366";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-9fGYoyj7vN3j72H+6jv/R0MaWPZ+4UNQhCSWnZRZZS4=";
+    sha256 = "sha256-Qn5fx4EiE4bGmPaMcB3ne0wS5ZRRgZC+cYEH5HCRQ7g=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index a116aef7920..6aa369e4eb4 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ipset";
-  version = "7.15";
+  version = "7.17";
 
   src = fetchurl {
     url = "https://ipset.netfilter.org/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ClVFqq22QBQsH4iNNmp43fhyR5mWf6IGhqcAU71iF1E=";
+    sha256 = "sha256-vknJ/0id1mEMrWVB50PDOE6slunyRwfaezkp2PKsZNg=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index 198cd868164..efc64e81af5 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -65,8 +65,8 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
   GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
   GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 310178b9a1f..18c32930f36 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -57,8 +57,12 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [ perl libelf ]
-    ++ optional (lib.versionAtLeast version "5.13") zstd;
+  moduleBuildDependencies = [
+    perl
+    libelf
+    # module makefiles often run uname commands to find out the kernel version
+    (buildPackages.deterministic-uname.override { inherit modDirVersion; })
+  ] ++ optional (lib.versionAtLeast version "5.13") zstd;
 
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
     let
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index c8ed8283ab3..7a0fabf9d46 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -94,12 +94,11 @@ stdenv.mkDerivation rec {
   NIX_DONT_SET_RPATH = true;
 
   preBuild = ''
-    ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
+    ${lib.optionalString (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32)
     "# the -x c flag is required since the file extension confuses gcc
     # that detect the file as a linker script.
     $CC -x c -c ${stack_chk_fail_local_c} -o __stack_chk_fail_local.o
     $AR r libssp_nonshared.a __stack_chk_fail_local.o"
-      else ""
     }
   '';
 
diff --git a/pkgs/os-specific/linux/mxu11x0/default.nix b/pkgs/os-specific/linux/mxu11x0/default.nix
index ee29180a8d9..17d0c693820 100644
--- a/pkgs/os-specific/linux/mxu11x0/default.nix
+++ b/pkgs/os-specific/linux/mxu11x0/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
 
   version = mxu_version + "-${kernel.version}";
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   preBuild = ''
-    sed -i -e "s/\$(uname -r).*/${kernel.modDirVersion}/g" driver/mxconf
-    sed -i -e "s/\$(shell uname -r).*/${kernel.modDirVersion}/g" driver/Makefile
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/mxconf
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/Makefile
   '';
diff --git a/pkgs/os-specific/linux/ocf-resource-agents/default.nix b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
index 8d7f2b52714..976c5f1779d 100644
--- a/pkgs/os-specific/linux/ocf-resource-agents/default.nix
+++ b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
@@ -42,6 +42,11 @@ let
       python3
     ];
 
+    NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+      # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+      "-Wno-error=maybe-uninitialized"
+    ];
+
     meta = with lib; {
       homepage = "https://github.com/ClusterLabs/resource-agents";
       description = "Combined repository of OCF agents from the RHCS and Linux-HA projects";
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index 3aeef462556..7cb364597bb 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -25,6 +25,7 @@ in stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
     dpdk_19_11
     libconfig
@@ -38,6 +39,12 @@ in stdenv.mkDerivation rec {
     libbpf
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
   # binaries will segfault otherwise
   dontStrip = true;
 
diff --git a/pkgs/os-specific/linux/pcmciautils/default.nix b/pkgs/os-specific/linux/pcmciautils/default.nix
index bca58bd808e..b5f9d8a0a2c 100644
--- a/pkgs/os-specific/linux/pcmciautils/default.nix
+++ b/pkgs/os-specific/linux/pcmciautils/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
       s,/etc/pcmcia,$out&,;
     " src/{startup.c,pcmcia-check-broken-cis.c} # fix-color */
   ''
-  + (if firmware == [] then ''sed -i "s,STARTUP = true,STARTUP = false," Makefile'' else "")
-  + (if configOpts == null then "" else "ln -sf ${configOpts} ./config/config.opts")
+  + (lib.optionalString (firmware == []) ''sed -i "s,STARTUP = true,STARTUP = false," Makefile'')
+  + (lib.optionalString (configOpts != null) "ln -sf ${configOpts} ./config/config.opts")
   ;
 
   makeFlags = [ "LEX=flex" ];
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 20db1cdd74f..60a55096b44 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -46,6 +46,12 @@ stdenv.mkDerivation rec {
   RTE_SDK = dpdk;
   GUI = lib.optionalString withGtk "true";
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ];
+
   # requires symbols from this file
   NIX_LDFLAGS = "-lrte_net_bond";
 
diff --git a/pkgs/os-specific/linux/projecteur/default.nix b/pkgs/os-specific/linux/projecteur/default.nix
index 63de7453935..ecb0fe535d3 100644
--- a/pkgs/os-specific/linux/projecteur/default.nix
+++ b/pkgs/os-specific/linux/projecteur/default.nix
@@ -13,6 +13,10 @@ mkDerivation rec {
     sha256 = "sha256-kg6oYtJ4H5A6RNATBg+XvMfCb9FlhEBFjfxamGosMQg=";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i src/device.h # gcc12
+  '';
+
   buildInputs = [ qtbase qtgraphicaleffects ];
   nativeBuildInputs = [ wrapQtAppsHook cmake pkg-config ];
 
diff --git a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
index 0f2e00c8382..ecfd6a87e6b 100644
--- a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
@@ -14,7 +14,6 @@ stdenv.mkDerivation {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -30,9 +29,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ bc ];
-
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
 
   preInstall = ''
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index e50129f1e2b..a89eb3702e8 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation rec {
 
   prePatch = ''
     substituteInPlace ./Makefile --replace /lib/modules/ "${kernel.dev}/lib/modules/"
-    substituteInPlace ./Makefile --replace '$(shell uname -r)' "${kernel.modDirVersion}"
     substituteInPlace ./Makefile --replace /sbin/depmod \#
     substituteInPlace ./Makefile --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8723ds/default.nix b/pkgs/os-specific/linux/rtl8723ds/default.nix
index 4aa408eec41..be4b954c1b6 100644
--- a/pkgs/os-specific/linux/rtl8723ds/default.nix
+++ b/pkgs/os-specific/linux/rtl8723ds/default.nix
@@ -13,8 +13,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
@@ -25,7 +24,6 @@ stdenv.mkDerivation {
   postPatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace "/sbin/depmod" "#" \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index 84ad6a314e1..bd682ec5933 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -11,21 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-25NaMQq9H6mqVynNQJXpqISAslxfEVSt3ELzG7s4mV4=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" "format" ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index dd0b32c5380..d8825f01897 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821au/default.nix b/pkgs/os-specific/linux/rtl8821au/default.nix
index 6a0da0c5e19..7ba338d3785 100644
--- a/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -11,8 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wx7xQBCfLu3UWB7ghp8dZ7OB2MFd5i8X0/ygyvW2K50=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
 
@@ -20,7 +19,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
@@ -30,7 +28,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
index 674af264c39..476bce22fb1 100644
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -24,7 +24,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index edc2d5bc44c..35b068fd8d0 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl88x2bu/default.nix b/pkgs/os-specific/linux/rtl88x2bu/default.nix
index 38ded6041f5..d3560aca91a 100644
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
index 80c14a0b383..a2f7ca0e815 100644
--- a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
@@ -14,14 +14,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-JUyUOqLMD9nSo6i87K/6Ljp+pWSqSBz/IZiFWu03rQw=";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index e871d6618c3..b03f3c3c16c 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -131,7 +131,7 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "252.4";
+  version = "252.5";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -148,7 +148,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-8ejSEt3QyCSARGGVbXWac2dB9jdUpC4eX2rN0iENQX0=";
+    hash = "sha256-cNZRTuYFMR1z6KpELeQoJahMhRl4fKuRuc3xXH3KzlM=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
diff --git a/pkgs/os-specific/linux/vmware/default.nix b/pkgs/os-specific/linux/vmware/default.nix
index 162ae766a84..73c579288bc 100644
--- a/pkgs/os-specific/linux/vmware/default.nix
+++ b/pkgs/os-specific/linux/vmware/default.nix
@@ -20,14 +20,12 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace Makefile \
       --replace '/lib/modules/$(VM_UNAME)/misc' "$out/lib/modules/${kernel.modDirVersion}/misc" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/modinfo "${kmod}/bin/modinfo" \
       --replace 'test -z "$(DESTDIR)"' "0"
 
     for module in "vmmon-only" "vmnet-only"; do
       substituteInPlace "./$module/Makefile" \
         --replace '/lib/modules/' "${kernel.dev}/lib/modules/" \
-        --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
         --replace /bin/grep "${gnugrep}/bin/grep"
     done
   '';
diff --git a/pkgs/os-specific/windows/wxMSW-2.8/default.nix b/pkgs/os-specific/windows/wxMSW-2.8/default.nix
index bf1e73f67b9..091897b6934 100644
--- a/pkgs/os-specific/windows/wxMSW-2.8/default.nix
+++ b/pkgs/os-specific/windows/wxMSW-2.8/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     (if compat24 then "--enable-compat24" else "--disable-compat24")
     (if compat26 then "--enable-compat26" else "--disable-compat26")
     "--disable-precomp-headers"
-    (if unicode then "--enable-unicode" else "")
+    (lib.optionalString unicode "--enable-unicode")
     "--with-opengl"
   ];
 
diff --git a/pkgs/servers/computing/storm/default.nix b/pkgs/servers/computing/storm/default.nix
index fbbda3837b9..d4669488901 100644
--- a/pkgs/servers/computing/storm/default.nix
+++ b/pkgs/servers/computing/storm/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
        -e 's|java.library.path: .*|java.library.path: "${lib.concatStringsSep ":" extraLibraryPaths}"|' \
        -e 's|storm.log4j2.conf.dir: .*|storm.log4j2.conf.dir: "conf/log4j2"|' \
       defaults.yaml
-    ${if confFile != "" then "cat ${confFile} >> defaults.yaml" else ""}
+    ${lib.optionalString (confFile != "") "cat ${confFile} >> defaults.yaml"}
     mv defaults.yaml $out/conf;
 
     # Link to extra jars
diff --git a/pkgs/servers/foundationdb/cmake.nix b/pkgs/servers/foundationdb/cmake.nix
index 9d65198c8ce..436f0a7fc4d 100644
--- a/pkgs/servers/foundationdb/cmake.nix
+++ b/pkgs/servers/foundationdb/cmake.nix
@@ -60,6 +60,11 @@ let
             (lib.optionalString (!useClang) "-DUSE_LD=GOLD")
           ];
 
+        NIX_CFLAGS_COMPILE = [
+          # Needed with GCC 12
+          "-Wno-error=missing-template-keyword"
+        ];
+
         inherit patches;
 
         # fix up the use of the very weird and custom 'fdb_install' command by just
diff --git a/pkgs/servers/gemini/molly-brown/default.nix b/pkgs/servers/gemini/molly-brown/default.nix
index 354412a4b73..351f54f21d4 100644
--- a/pkgs/servers/gemini/molly-brown/default.nix
+++ b/pkgs/servers/gemini/molly-brown/default.nix
@@ -1,19 +1,18 @@
-{ lib, buildGoPackage, fetchgit, nixosTests }:
+{ lib, buildGoModule, fetchgit, nixosTests }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "molly-brown";
-  version = "unstable-2020-08-19";
-  rev = "48f9a206c03c0470e1c132b9667c6daa3583dada";
-
-  goPackagePath = "tildegit.org/solderpunk/molly-brown";
+  version = "unstable-2023-02-10";
 
   src = fetchgit {
-    inherit rev;
     url = "https://tildegit.org/solderpunk/molly-brown.git";
-    sha256 = "1w79a25mbgav95p78fkdm9j62chwwpkqv0m2wmh5my03yq398gya";
+    rev = "56d8dde14abc90b784b7844602f12100af9756e0";
+    hash = "sha256-kfopRyCrDaiVjKYseyWacIT9MJ8PzB8LAs6YMgYqCrs=";
   };
 
-  goDeps = ./deps.nix;
+  vendorHash = "sha256-czfHnXS9tf5vQQNXhWH7DStmhsorSc4Di/yZuv4LHRk=";
+
+  ldflags = [ "-s" "-w" ];
 
   passthru.tests.basic = nixosTests.molly-brown;
 
diff --git a/pkgs/servers/gemini/molly-brown/deps.nix b/pkgs/servers/gemini/molly-brown/deps.nix
deleted file mode 100644
index 95427e8f790..00000000000
--- a/pkgs/servers/gemini/molly-brown/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-]
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 8abe197bee7..3a171c41725 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.2.3";
+  version = "2023.2.4";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 921a6dccbc1..9811d52a8db 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -270,7 +270,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.2.3";
+  hassVersion = "2023.2.4";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -288,7 +288,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-cRdxlmlgkKTnrtqGQPbSpBLHf+vfI9T6sdETcGshN9M=";
+    hash = "sha256-Lt/t4S6To0MvdvmdKir7VytrNXPGhC7sMfjQmgox5XY=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 971e04dcd36..d09c98ef2a2 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -351,8 +351,8 @@ let self = {
     name = "njs";
     src = fetchhg {
       url = "https://hg.nginx.org/njs";
-      rev = "0.7.8";
-      sha256 = "sha256-jsR8EOeW8tAo2utKznuUaCG4hK0oU0ZJSnnGmI5HUDk=";
+      rev = "0.7.10";
+      sha256 = "sha256-/yKzY+BUFxLk8bWo+mqKfRVRsC2moe+WvhaRYIGdr6Y=";
       name = "nginx-njs";
     };
 
diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 508a3319d63..c4a3a918d30 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "libreddit";
-  version = "0.29.1";
+  version = "0.29.2";
 
   src = fetchFromGitHub {
     owner = "libreddit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-W/vUOioZpA2UYPyJOVTGC1mek574m48NKQXG2o7emjU=";
+    hash = "sha256-YCjH0K84sPgQ9MtA5IUHoGCxrAzRSu4KIuk2qPyhaM4=";
   };
 
-  cargoHash = "sha256-WrkUW9fV69RswS3qBMqBGxNBq6W4eJmJaTrEDp9byrM=";
+  cargoHash = "sha256-VsQckZm8ySmbpn1uSgxWqZ+cc+NnUDNBmSsj4MHdQtk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
diff --git a/pkgs/servers/mail/exim/default.nix b/pkgs/servers/mail/exim/default.nix
index cd407ef37ec..1a911668a54 100644
--- a/pkgs/servers/mail/exim/default.nix
+++ b/pkgs/servers/mail/exim/default.nix
@@ -64,8 +64,8 @@ stdenv.mkDerivation rec {
       ${lib.optionalString enableMySQL ''
         s:^# \(LOOKUP_MYSQL=yes\)$:\1:
         s:^# \(LOOKUP_MYSQL_PC=libmysqlclient\)$:\1:
-        s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -ldl -lm -lpthread -lz:
-        s:^# \(LOOKUP_LIBS\)=.*:\1=-lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -ldl -lm -lpthread -lz:
+        s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -lm -lpthread -lz:
+        s:^# \(LOOKUP_LIBS\)=.*:\1=-lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -lm -lpthread -lz:
         s:^# \(LOOKUP_INCLUDE\)=.*:\1=-I${libmysqlclient.dev}/include/mysql/:
       ''}
       ${lib.optionalString enableAuthDovecot ''
diff --git a/pkgs/servers/mail/vsmtp/default.nix b/pkgs/servers/mail/vsmtp/default.nix
index 93b85cee6bb..63447dffb30 100644
--- a/pkgs/servers/mail/vsmtp/default.nix
+++ b/pkgs/servers/mail/vsmtp/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "vsmtp";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "viridIT";
     repo = "vsmtp";
     rev = "v${version}";
-    hash = "sha256-FI4BvU+83nTzRLJQZ1l1eOn41ZeA62Db+p3d//5o0Wk=";
+    hash = "sha256-iyjtSeus1gctylYfXAEqpwZNPg/KU/lXv82Wi0h5mAM=";
   };
 
-  cargoHash = "sha256-Qhhh0riM1qeD3/JZINvY0t5fEOj+prI0fyXagdR43sc=";
+  cargoHash = "sha256-N4cxAFAFtYnd1/wdomm0VYosDY5uy+0z9pRGThSMbG4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 55d6bd68135..9253b93945b 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -12,20 +12,20 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.76.0";
+  version = "1.77.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-kPc6T8yLe1TDxPKLnK/TcU+RUxAVIq8qsr5JQXCXyjM=";
+    hash = "sha256-//1BTiNH3n2eNjwOADb1OB7xp5QsH6arV5Pg3B7y3r0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-tXtnVYH9uWu0nHHx53PgML92NWl3qcAcnFKhiijvQBc=";
+    hash = "sha256-B9Z+7VtbbX/S01aaMFHgXH60sg8Lmwku2XPRnpMpwjo=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/monitoring/nagios/default.nix b/pkgs/servers/monitoring/nagios/default.nix
index a58ec2bf7b2..edf82742bc5 100644
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--localstatedir=/var/lib/nagios" ];
   buildFlags = [ "all" ];
-  CFLAGS = "-ldl";
 
   # Do not create /var directories
   preInstall = ''
diff --git a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
index 5f951f308dd..17775b491c6 100644
--- a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "artifactory_exporter";
-  version = "1.11.0";
+  version = "1.12.0";
   rev = "v${version}";
 
   src = fetchFromGitHub {
     owner = "peimanja";
     repo = pname;
     rev = rev;
-    hash = "sha256-dUAIPS2o+uvCGX32AgknynT0Mzzbq/7SeNmKN0Xc69o=";
+    hash = "sha256-EFjWDoWPePbPX9j4vuI41TAlGcFRlUyPpSvJriZdR0U=";
   };
 
   vendorHash = "sha256-5yzBKgjJCv4tgdBS6XmZUq1ebbka0LOuv6BARWO7kQg=";
diff --git a/pkgs/servers/monitoring/uptime-kuma/default.nix b/pkgs/servers/monitoring/uptime-kuma/default.nix
index fa1b4dc2669..a5e11ac8a10 100644
--- a/pkgs/servers/monitoring/uptime-kuma/default.nix
+++ b/pkgs/servers/monitoring/uptime-kuma/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "uptime-kuma";
-  version = "1.19.6";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "louislam";
     repo = "uptime-kuma";
     rev = version;
-    sha256 = "sha256-Hk0me4VPP8vKp4IhzQKjjhM2BWLGSHnN7JiDJu2WlE8=";
+    sha256 = "sha256-dMjhCsTjXOwxhvJeL25KNkFhRCbCuxG7Ccz8mP7P38A=";
   };
 
-  npmDepsHash = "sha256-lVMPxUe+W/FlFQS2L+/UfpC21pIKJE89clmJywSv7w4=";
+  npmDepsHash = "sha256-Ks6KYHP6+ym9PGJ1a5nMxT7JXZyknHeaCmAkjJuCTXU=";
 
   patches = [
     # Fixes the permissions of the database being not set correctly
diff --git a/pkgs/servers/moonraker/default.nix b/pkgs/servers/moonraker/default.nix
index c46568d24da..73595e6909c 100644
--- a/pkgs/servers/moonraker/default.nix
+++ b/pkgs/servers/moonraker/default.nix
@@ -20,13 +20,13 @@ let
   ]);
 in stdenvNoCC.mkDerivation rec {
   pname = "moonraker";
-  version = "unstable-2022-04-23";
+  version = "unstable-2022-11-18";
 
   src = fetchFromGitHub {
     owner = "Arksine";
     repo = "moonraker";
-    rev = "cd520ba91728abb5a3d959269fbd8e4f40d1eb0b";
-    sha256 = "sha256-sopX9t+LjYldx+syKwU3I0x/VYy4hLyXfitG0uumayE=";
+    rev = "362bc1a3d3ad397416f7fc48b8efe33837428b90";
+    sha256 = "sha256-cebRHOx2hg470jM1CoQAk13Whv+KN2qx97BTlpjxSZg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index 41a5d6bca7c..c89d3f789e1 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ferretdb";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    sha256 = "sha256-+tmClWkW3uhBXuQzuSMJnzeA1rrkpLV0QLCzcKhbThw=";
+    sha256 = "sha256-iqoz7axU5U6MdRl8I2vS3Nh37XZZPI4bRb3oFxpQs6M=";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ buildGoModule rec {
     echo nixpkgs     > build/version/package.txt
   '';
 
-  vendorSha256 = "sha256-43FxDRcif8FDHyXdNL/FJEt5ZnCQ8r7d5Red3l9442Q=";
+  vendorSha256 = "sha256-qtxR1vk/EZZmCRP1Z+EFObfMbQXKiRaSiI1Dsv268b8=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/servers/nosql/influxdb/default.nix b/pkgs/servers/nosql/influxdb/default.nix
index 185c246e6fa..a80975926e8 100644
--- a/pkgs/servers/nosql/influxdb/default.nix
+++ b/pkgs/servers/nosql/influxdb/default.nix
@@ -33,7 +33,7 @@ let
       Version: ${libflux_version}
       Description: Library for the InfluxData Flux engine
       Cflags: -I/out/include
-      Libs: -L/out/lib -lflux -ldl -lpthread
+      Libs: -L/out/lib -lflux -lpthread
     '';
     passAsFile = [ "pkgcfg" ];
     postInstall = ''
diff --git a/pkgs/servers/nosql/influxdb2/default.nix b/pkgs/servers/nosql/influxdb2/default.nix
index 41bba89996b..4f86cc4da53 100644
--- a/pkgs/servers/nosql/influxdb2/default.nix
+++ b/pkgs/servers/nosql/influxdb2/default.nix
@@ -51,7 +51,7 @@ let
       Version: ${libflux_version}
       Description: Library for the InfluxData Flux engine
       Cflags: -I/out/include
-      Libs: -L/out/lib -lflux -ldl -lpthread
+      Libs: -L/out/lib -lflux -lpthread
     '';
     passAsFile = [ "pkgcfg" ];
     postInstall = ''
diff --git a/pkgs/servers/openafs/1.8/default.nix b/pkgs/servers/openafs/1.8/default.nix
index d6e2f20ecdb..8ebed1c2746 100644
--- a/pkgs/servers/openafs/1.8/default.nix
+++ b/pkgs/servers/openafs/1.8/default.nix
@@ -89,7 +89,6 @@ stdenv.mkDerivation {
     )
   '' + optionalString withTsm ''
     export XBSA_CFLAGS="-Dxbsa -DNEW_XBSA -I${tsm-client}/lib64/sample -DXBSA_TSMLIB=\\\"${tsm-client}/lib64/libApiTSM64.so\\\""
-    export XBSA_XLIBS="-ldl"
   '';
 
   buildFlags = [ "all_nolibafs" ];
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index ed163f2547d..cddda5d399f 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bzip2 libxml2 libzip boost lua luabind tbb expat ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+    "-Wno-error=uninitialized"
+  ];
+
   postInstall = "mkdir -p $out/share/osrm-backend && cp -r ../profiles $out/share/osrm-backend/profiles";
 
   meta = {
diff --git a/pkgs/servers/pounce/default.nix b/pkgs/servers/pounce/default.nix
index e03d6e6827a..7ad43825b15 100644
--- a/pkgs/servers/pounce/default.nix
+++ b/pkgs/servers/pounce/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pounce";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchzip {
     url = "https://git.causal.agency/pounce/snapshot/pounce-${version}.tar.gz";
-    sha256 = "17vmbfr7ika6kmq9jqa3rpd4cr71arapav7hlmggnj7a9yw5b9mg";
+    sha256 = "sha256-6PGiaU5sOwqO4V2PKJgIi3kI2jXsBOldEH51D7Sx9tg=";
   };
 
   buildInputs = [ libressl libxcrypt ];
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 57977ebf409..0c15e21f5a3 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -36,7 +36,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "${if libOnly then "lib" else ""}pulseaudio";
+  pname = "${lib.optionalString libOnly "lib"}pulseaudio";
   version = "16.1";
 
   src = fetchurl {
diff --git a/pkgs/servers/roapi/http.nix b/pkgs/servers/roapi/http.nix
index 775850ea32e..7edc3dd89b2 100644
--- a/pkgs/servers/roapi/http.nix
+++ b/pkgs/servers/roapi/http.nix
@@ -5,7 +5,7 @@
 let
   pname = "roapi-http";
   version = "0.6.0";
-  target = if stdenv.isDarwin then "apple-darwin" else "";
+  target = lib.optionalString stdenv.isDarwin "apple-darwin";
 in
 # TODO build from source, currently compilation fails on darwin on snmalloc with
 #  ./mem/../ds/../pal/pal_apple.h:277:64: error: use of undeclared identifier 'kCCSuccess'
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 93df798c8bc..c5e08b8279a 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -207,45 +207,45 @@ let
 in self: {
 
   postgresql_11 = self.callPackage generic {
-    version = "11.18";
+    version = "11.19";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    hash = "sha256-0k8g78UukYrPvMoh6c6ijg4mO4RqDECPz6w7PEoPdQQ=";
+    hash = "sha256-ExCeK3HxE5QFwnIB2jczphrOcu4cIo2cnwMg4GruFMI=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.13";
+    version = "12.14";
     psqlSchema = "12";
-    hash = "sha256-tsYjBGr0VI8RqEtAeTTWddEe0HDHk9FbBGg79fMi4C0=";
+    hash = "sha256-eFYQI304LIQtNW40cTjljAb/6uJA5swLUqxevMMNBD4=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.9";
+    version = "13.10";
     psqlSchema = "13";
-    hash = "sha256-7xlmwKXkn77TNwrSgkkoy2sRZGF67q4WBtooP38zpBU=";
+    hash = "sha256-W7z1pW2FxE86iwWPtGhi/0nLyRg00H4pXQLm3jwhbfI=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.6";
+    version = "14.7";
     psqlSchema = "14";
-    hash = "sha256-UIhA/BgJ05q3InTV8Tfau5/X+0+TPaQWiu67IAae3yI=";
+    hash = "sha256-zvYPAJj6gQHBVG9CVORbcir1QxM3lFs3ryBwB2MNszE=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
   };
 
   postgresql_15 = self.callPackage generic {
-    version = "15.1";
+    version = "15.2";
     psqlSchema = "15";
-    hash = "sha256-ZP3yPXNK+tDf5Ad9rKlqxR3NaX5ori09TKbEXLFOIa4=";
+    hash = "sha256-maIXH8PWtbX1a3V6ejy4XVCaOOQnOAXe8jlB7SuEaMc=";
     this = self.postgresql_15;
     thisAttr = "postgresql_15";
     inherit self;
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 833d31de401..325632da48c 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -78,6 +78,9 @@ in stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = [
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-truncation"
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but unrecognized with GCC 9
+    "-Wno-error=use-after-free"
   ];
 
   configureFlags = [
diff --git a/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix b/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
index 19d23531f6b..a60c0685418 100644
--- a/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
+++ b/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
@@ -5,4 +5,10 @@
     url = "https://storage.googleapis.com/${name}/${name}-stable/${version}/${name}-${version}-wordpress.zip";
     hash = "sha256-XsNFxVL0LF+OHlsqjjTV41x9ERLwMDq9BnKKP3Px2aI=";
   };
+  themes.geist = fetchzip rec {
+    name = "geist";
+    version = "2.0.3";
+    url = "https://github.com/christophery/geist/archive/refs/tags/${version}.zip";
+    hash = "sha256-c85oRhqu5E5IJlpgqKJRQITur1W7x40obOvHZbPevzU=";
+  };
 }
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 0907d814171..e46d8e750a0 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -22,18 +22,18 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  bdftopcf = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
+  bdftopcf = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
     pname = "bdftopcf";
-    version = "1.1";
+    version = "1.1.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/bdftopcf-1.1.tar.bz2";
-      sha256 = "18hiscgljrz10zjcws25bis32nyrg3hzgmiq6scrh7izqmgz0kab";
+      url = "https://xorg.freedesktop.org/archive/individual/util/bdftopcf-1.1.1.tar.xz";
+      sha256 = "026rzs92h9jsc7r0kvvyvwhm22q0805gp38rs14x6ghg7kam7j8i";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ ];
+    buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
@@ -178,11 +178,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontalias = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
     pname = "font-alias";
-    version = "1.0.3";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/font/font-alias-1.0.3.tar.bz2";
-      sha256 = "16ic8wfwwr3jicaml7b5a0sk6plcgc1kg84w02881yhwmqm3nicb";
+      url = "mirror://xorg/individual/font/font-alias-1.0.4.tar.bz2";
+      sha256 = "0xjjjindczv3g7m1597l0x19zz75xy70wh5garghz61fpzl1l4gk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -890,18 +890,18 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libxcb, xtrans }: stdenv.mkDerivation {
+  libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpthreadstubs, libxcb, xtrans }: stdenv.mkDerivation {
     pname = "libX11";
-    version = "1.8.1";
+    version = "1.8.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.8.1.tar.xz";
-      sha256 = "1xyry8i7zqmlkvpbyyqwi18rrdw6ycczlvfp63rh2570pfhimi0v";
+      url = "mirror://xorg/individual/lib/libX11-1.8.3.tar.xz";
+      sha256 = "1gc5cnfys48m1y9y1cidph89fww5c209qff93phbidh68346a5g3";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ xorgproto libxcb xtrans ];
+    buildInputs = [ xorgproto libpthreadstubs libxcb xtrans ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
@@ -1516,11 +1516,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   lndir = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
     pname = "lndir";
-    version = "1.0.3";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/util/lndir-1.0.3.tar.bz2";
-      sha256 = "0pdngiy8zdhsiqx2am75yfcl36l7kd7d7nl0rss8shcdvsqgmx29";
+      url = "mirror://xorg/individual/util/lndir-1.0.4.tar.xz";
+      sha256 = "11syg5hx3f7m1d2p7zw717lryk819h6wk8h4vmapfdxvsflkfd1y";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3436,11 +3436,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xset = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, libXmu, xorgproto, libXxf86misc }: stdenv.mkDerivation {
     pname = "xset";
-    version = "1.2.4";
+    version = "1.2.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xset-1.2.4.tar.bz2";
-      sha256 = "0my987wjvra7l92ry6q44ky383yg3phzxhdbn3lqhapm1ll9bzg4";
+      url = "mirror://xorg/individual/app/xset-1.2.5.tar.xz";
+      sha256 = "0bsyyx3k32k9vpb8x3ks7hlfr03nm0i14fv3cg6n4f2vcdajsscz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index b0530977f7e..d0a2ec88121 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -184,6 +184,7 @@ self: super:
     propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ xorg.libSM ];
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     CPP = if stdenv.isDarwin then "clang -E -" else "${stdenv.cc.targetPrefix}cc -E -";
+    outputDoc = "devdoc";
     outputs = [ "out" "dev" "devdoc" ];
   });
 
@@ -591,6 +592,7 @@ self: super:
 
   xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
     buildInputs =  attrs.buildInputs ++ [ mesa mesa.driversdev llvm ]; # for libxatracker
+    NIX_CFLAGS_COMPILE = [ "-Wno-error=address" ]; # gcc12
     meta = attrs.meta // {
       platforms = ["i686-linux" "x86_64-linux"];
     };
@@ -861,6 +863,11 @@ self: super:
             url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/ccdd431cd8f1cabae9d744f0514b6533c438908c.diff";
             sha256 = "sha256-IGPsjS7KgRPLrs1ImBXvIFCa8Iu5ZiAHRZvHlBYP8KQ=";
           })
+          (fetchpatch {
+            name = "CVE-2023-0494.diff";
+            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec.diff";
+            sha256 = "sha256-/+IuGk09OYVEIB/Y+DTKf7kfHyukEFX/6u1FDIGJieY=";
+          })
         ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
         propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
@@ -886,6 +893,11 @@ self: super:
           "--disable-tls"
         ];
 
+        NIX_CFLAGS_COMPILE = [
+          # Needed with GCC 12
+          "-Wno-error=array-bounds"
+        ];
+
         postInstall = ''
           rm -fr $out/share/X11/xkb/compiled # otherwise X will try to write in it
           ( # assert() keeps runtime reference xorgserver-dev in xf86-video-intel and others
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 9a82416d305..dd09fbba34f 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -8,7 +8,7 @@ https://xcb.freedesktop.org/dist/xcb-util-keysyms-0.4.0.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-renderutil-0.3.9.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-wm-0.4.1.tar.bz2
 mirror://xorg/individual/app/appres-1.0.5.tar.bz2
-mirror://xorg/individual/app/bdftopcf-1.1.tar.bz2
+https://xorg.freedesktop.org/archive/individual/util/bdftopcf-1.1.1.tar.xz
 mirror://xorg/individual/app/bitmap-1.0.9.tar.gz
 mirror://xorg/individual/app/editres-1.0.7.tar.bz2
 mirror://xorg/individual/app/fonttosfnt-1.2.2.tar.bz2
@@ -64,7 +64,7 @@ mirror://xorg/individual/app/xprop-1.2.6.tar.xz
 mirror://xorg/individual/app/xrandr-1.5.1.tar.xz
 mirror://xorg/individual/app/xrdb-1.2.1.tar.bz2
 mirror://xorg/individual/app/xrefresh-1.0.6.tar.bz2
-mirror://xorg/individual/app/xset-1.2.4.tar.bz2
+mirror://xorg/individual/app/xset-1.2.5.tar.xz
 mirror://xorg/individual/app/xsetroot-1.1.2.tar.bz2
 mirror://xorg/individual/app/xsm-1.0.4.tar.bz2
 mirror://xorg/individual/app/xstdcmap-1.0.4.tar.bz2
@@ -135,7 +135,7 @@ mirror://xorg/individual/font/font-adobe-75dpi-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.4.tar.bz2
-mirror://xorg/individual/font/font-alias-1.0.3.tar.bz2
+mirror://xorg/individual/font/font-alias-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-arabic-misc-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-bh-100dpi-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-bh-75dpi-1.0.3.tar.bz2
@@ -174,7 +174,7 @@ mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.8.1.tar.xz
+mirror://xorg/individual/lib/libX11-1.8.3.tar.xz
 mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2
 mirror://xorg/individual/lib/libxcb-1.14.tar.xz
@@ -213,7 +213,7 @@ mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
 mirror://xorg/individual/proto/xorgproto-2021.5.tar.bz2
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
 mirror://xorg/individual/util/imake-1.0.8.tar.bz2
-mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
+mirror://xorg/individual/util/lndir-1.0.4.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2
 mirror://xorg/individual/util/util-macros-1.19.3.tar.bz2
 mirror://xorg/individual/util/xorg-cf-files-1.0.7.tar.bz2
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 1b787e56076..932e81a5177 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
+  separateDebugInfo = true;
+
   NIX_CFLAGS_COMPILE = ''
     -DSYS_BASHRC="/etc/bashrc"
     -DSYS_BASH_LOGOUT="/etc/bash_logout"
@@ -52,13 +54,14 @@ stdenv.mkDerivation rec {
 
   patchFlags = [ "-p0" ];
 
-  patches = upstreamPatches
-    ++ [ ./pgrp-pipe-5.patch ]
-    ++ lib.optional stdenv.hostPlatform.isStatic (fetchurl {
+  patches = upstreamPatches ++ [
+    ./pgrp-pipe-5.patch
+    (fetchurl {
       name = "fix-static.patch";
       url = "https://cgit.freebsd.org/ports/plain/shells/bash/files/patch-configure?id=3e147a1f594751a68fea00a28090d0792bee0b51";
       sha256 = "XHFMQ6eXTReNoywdETyrfQEv1rKF8+XFbQZP4YoVKFk=";
-    });
+    })
+  ];
 
   configureFlags = [
     (if interactive then "--with-installed-readline" else "--disable-readline")
diff --git a/pkgs/shells/hilbish/default.nix b/pkgs/shells/hilbish/default.nix
index c1980309e1f..20e1331dbcb 100644
--- a/pkgs/shells/hilbish/default.nix
+++ b/pkgs/shells/hilbish/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "hilbish";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "Rosettea";
     repo = "Hilbish";
     rev = "v${version}";
-    sha256 = "sha256-5GPJVusF3/WbEE5VH45Wyxq40wbNxgjO8QI2cLMpdN0=";
+    sha256 = "sha256-iXDBo3bcmjsDy+iUREpg+sDTFN2LeF7jA+mg62LKeIs=";
     fetchSubmodules = true;
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-Kiy1JR3X++naY2XNLpnGujrNQt7qlL0zxv8E96cHmHo=";
+  vendorHash = "sha256-Kiy1JR3X++naY2XNLpnGujrNQt7qlL0zxv8E96cHmHo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 46929315f07..6cc6271eedb 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -736,6 +736,7 @@ rec {
         pcre.out
         gettext
         binutils.bintools
+        binutils.bintools.lib
         darwin.binutils
         darwin.binutils.bintools
         curl.out
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 9d99be2a020..dd7825a409e 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -242,7 +242,7 @@ let
       remediationMsg = (builtins.getAttr reason remediation) attrs;
       msg = if inHydra then "Warning while evaluating ${getName attrs}: «${reason}»: ${errormsg}"
         else "Package ${getName attrs} in ${pos_str meta} ${errormsg}, continuing anyway."
-             + (if remediationMsg != "" then "\n${remediationMsg}" else "");
+             + (lib.optionalString (remediationMsg != "") "\n${remediationMsg}");
       isEnabled = lib.findFirst (x: x == reason) null showWarnings;
     in if isEnabled != null then builtins.trace msg true else true;
 
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 08bd836e10e..3d60934557c 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -173,6 +173,13 @@ let
   separateDebugInfo' = separateDebugInfo && stdenv.hostPlatform.isLinux && !(stdenv.hostPlatform.useLLVM or false);
   outputs' = outputs ++ lib.optional separateDebugInfo' "debug";
 
+  # Turn a derivation into its outPath without a string context attached.
+  # See the comment at the usage site.
+  unsafeDerivationToUntrackedOutpath = drv:
+    if lib.isDerivation drv
+    then builtins.unsafeDiscardStringContext drv.outPath
+    else drv;
+
   noNonNativeDeps = builtins.length (depsBuildTarget ++ depsBuildTargetPropagated
                                   ++ depsHostHost ++ depsHostHostPropagated
                                   ++ buildInputs ++ propagatedBuildInputs
@@ -444,6 +451,40 @@ else let
         "/bin/sh"
       ];
       __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
+    } //
+    # If we use derivations directly here, they end up as build-time dependencies.
+    # This is especially problematic in the case of disallowed*, since the disallowed
+    # derivations will be built by nix as build-time dependencies, while those
+    # derivations might take a very long time to build, or might not even build
+    # successfully on the platform used.
+    # We can improve on this situation by instead passing only the outPath,
+    # without an attached string context, to nix. The out path will be a placeholder
+    # which will be replaced by the actual out path if the derivation in question
+    # is part of the final closure (and thus needs to be built). If it is not
+    # part of the final closure, then the placeholder will be passed along,
+    # but in that case we know for a fact that the derivation is not part of the closure.
+    # This means that passing the out path to nix does the right thing in either
+    # case, both for disallowed and allowed references/requisites, and we won't
+    # build the derivation if it wouldn't be part of the closure, saving time and resources.
+    # While the problem is less severe for allowed*, since we want the derivation
+    # to be built eventually, we would still like to get the error early and without
+    # having to wait while nix builds a derivation that might not be used.
+    # See also https://github.com/NixOS/nix/issues/4629
+    lib.optionalAttrs (attrs ? disallowedReferences) {
+      disallowedReferences =
+        map unsafeDerivationToUntrackedOutpath attrs.disallowedReferences;
+    } //
+    lib.optionalAttrs (attrs ? disallowedRequisites) {
+      disallowedRequisites =
+        map unsafeDerivationToUntrackedOutpath attrs.disallowedRequisites;
+    } //
+    lib.optionalAttrs (attrs ? allowedReferences) {
+      allowedReferences =
+        lib.mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedReferences;
+    } //
+    lib.optionalAttrs (attrs ? allowedRequisites) {
+      allowedRequisites =
+        lib.mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedRequisites;
     };
 
   validity = checkMeta { inherit meta attrs; };
@@ -528,6 +569,12 @@ lib.extendDerivation
        # them as runtime dependencies (since Nix greps for store paths
        # through $out to find them)
        args = [ "-c" "export > $out" ];
+
+       # inputDerivation produces the inputs; not the outputs, so any
+       # restrictions on what used to be the outputs don't serve a purpose
+       # anymore.
+       disallowedReferences = [ ];
+       disallowedRequisites = [ ];
      });
 
      inherit meta passthru overrideAttrs;
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index b1b982ecdff..cbf2a2ceb8d 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -992,13 +992,22 @@ stripHash() {
 unpackCmdHooks+=(_defaultUnpack)
 _defaultUnpack() {
     local fn="$1"
+    local destination
 
     if [ -d "$fn" ]; then
 
+        destination="$(stripHash "$fn")"
+
+        if [ -e "$destination" ]; then
+            echo "Cannot copy $fn to $destination: destination already exists!"
+            echo "Did you specify two \"srcs\" with the same \"name\"?"
+            return 1
+        fi
+
         # We can't preserve hardlinks because they may have been
         # introduced by store optimization, which might break things
         # in the build.
-        cp -pr --reflink=auto -- "$fn" "$(stripHash "$fn")"
+        cp -pr --reflink=auto -- "$fn" "$destination"
 
     else
 
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 5c7dfcceec6..87819073828 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -104,8 +104,8 @@ let
     ''
       export NIX_ENFORCE_PURITY="''${NIX_ENFORCE_PURITY-1}"
       export NIX_ENFORCE_NO_NATIVE="''${NIX_ENFORCE_NO_NATIVE-1}"
-      ${if system == "x86_64-linux" then "NIX_LIB64_IN_SELF_RPATH=1" else ""}
-      ${if system == "mipsel-linux" then "NIX_LIB32_IN_SELF_RPATH=1" else ""}
+      ${lib.optionalString (system == "x86_64-linux") "NIX_LIB64_IN_SELF_RPATH=1"}
+      ${lib.optionalString (system == "mipsel-linux") "NIX_LIB32_IN_SELF_RPATH=1"}
     '';
 
 
diff --git a/pkgs/test/stdenv/hooks.nix b/pkgs/test/stdenv/hooks.nix
index 7f25d7dbd2d..3d72efae6c4 100644
--- a/pkgs/test/stdenv/hooks.nix
+++ b/pkgs/test/stdenv/hooks.nix
@@ -23,19 +23,29 @@
     };
   make-symlinks-relative = stdenv.mkDerivation {
     name = "test-make-symlinks-relative";
+    outputs = [ "out" "man" ];
     buildCommand = ''
       mkdir -p $out/{bar,baz}
+      mkdir -p $man/share/{x,y}
       source1="$out/bar/foo"
       destination1="$out/baz/foo"
+      source2="$man/share/x/file1"
+      destination2="$man/share/y/file2"
       echo foo > $source1
+      echo foo > $source2
       ln -s $source1 $destination1
+      ln -s $source2 $destination2
       echo "symlink before patching: $(readlink $destination1)"
+      echo "symlink before patching: $(readlink $destination2)"
 
-      _makeSymlinksRelative
+      _makeSymlinksRelativeInAllOutputs
 
       echo "symlink after patching: $(readlink $destination1)"
       ([[ -e $destination1 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
       ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
+      echo "symlink after patching: $(readlink $destination2)"
+      ([[ -e $destination2 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      ([[ $(readlink $destination2) == "../x/file1" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
     '';
   };
   move-docs = stdenv.mkDerivation {
diff --git a/pkgs/tools/X11/sunpaper/default.nix b/pkgs/tools/X11/sunpaper/default.nix
index 419aa046909..9f760bb4a93 100644
--- a/pkgs/tools/X11/sunpaper/default.nix
+++ b/pkgs/tools/X11/sunpaper/default.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sunpaper";
-  version = "unstable-2022-04-01";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "hexive";
     repo = "sunpaper";
-    rev = "8d518dfddb5e80215ef3b884ff009df1d4bb74c2";
-    sha256 = "sCG7igD2ZwfHoRpR3Kw7dAded4hG2RbMLR/9nH+nZh8=";
+    rev = "v${version}";
+    sha256 = "sha256-8s7SS79wCS0nRR7IpkshP5QWJqqKEeBu6EtFPDM+2cM=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 33cb045a4ae..8009118be6b 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -25,14 +25,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.9.21"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.9.23"; # N.B: if you change this, check if overrides are still up-to-date
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     rev = version;
-    hash = "sha256-/CMV6eCNm2gF9HhdoTo2TUUy7I4NF9Fb+6l2biGIbkE=";
+    hash = "sha256-OaZ8Eax8XE4xGs5yHh+1P8mwEfHkFNEtY6ZGLQc8Thk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/admin/google-cloud-sdk/components.nix b/pkgs/tools/admin/google-cloud-sdk/components.nix
index 72d293de211..e43e945455a 100644
--- a/pkgs/tools/admin/google-cloud-sdk/components.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/components.nix
@@ -100,9 +100,7 @@ let
         pname = component.id;
         version = component.version.version_string;
         src =
-          if lib.hasAttrByPath [ "data" "source" ] component
-          then "${baseUrl}/${component.data.source}"
-          else "";
+          lib.optionalString (lib.hasAttrByPath [ "data" "source" ] component) "${baseUrl}/${component.data.source}";
         sha256 = lib.attrByPath [ "data" "checksum" ] "" component;
         dependencies = builtins.map (dep: builtins.getAttr dep components) component.dependencies;
         platforms =
@@ -137,12 +135,12 @@ let
     }: stdenv.mkDerivation {
       inherit pname version snapshot;
       src =
-        if src != "" then
-          builtins.fetchurl
+        lib.optionalString (src != "")
+          (builtins.fetchurl
             {
               url = src;
               inherit sha256;
-            } else "";
+            }) ;
       dontUnpack = true;
       installPhase = ''
         mkdir -p $out/google-cloud-sdk/.install
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index e4933986176..2c282514d33 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-77X+AvHFWfYYIio3c+EYf11jg/1IbYhNUweRIDHMOZw=";
   };
 
-
   patches = [
     (fetchpatch {
       url = "https://patch-diff.githubusercontent.com/raw/TigerVNC/tigervnc/pull/1383.patch";
@@ -65,6 +64,10 @@ stdenv.mkDerivation rec {
     "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "out"}/bin"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=array-bounds"
+  ];
+
   postBuild = lib.optionalString stdenv.isLinux ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=int-to-pointer-cast -Wno-error=pointer-to-int-cast"
     export CXXFLAGS="$CXXFLAGS -fpermissive"
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index e68b565d058..ca0f9a961a1 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.37.1";
+  version = "0.37.2";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4kjsNaiXnmJk88ivVnpTemOOc/asKrcZLGpO8gtV0J8=";
+    sha256 = "sha256-k5S0ttOhI+vjiGJpIPVi9ro6n3f2Cxe7HiADvs14Zuo=";
   };
   # hash missmatch on across linux and darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-qI29Qb8im9Xii83ayG1jZtZsrsAT0JQOcuKOM7VYro0=";
+  vendorSha256 = "sha256-EJw5DxiBF+gw5X+vqrnZsNCm2umOHEq6GeQ5V/Z0DrE=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/archivers/arc_unpacker/default.nix b/pkgs/tools/archivers/arc_unpacker/default.nix
index ab018fde3d6..2ade0f88a8d 100644
--- a/pkgs/tools/archivers/arc_unpacker/default.nix
+++ b/pkgs/tools/archivers/arc_unpacker/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp tests/test_support/catch.h
+    sed '1i#include <limits>' -i src/dec/eagls/pak_archive_decoder.cc # gcc12
   '';
 
   checkPhase = ''
diff --git a/pkgs/tools/audio/mpris-scrobbler/default.nix b/pkgs/tools/audio/mpris-scrobbler/default.nix
index 35685fd5fb2..0c051047c0f 100644
--- a/pkgs/tools/audio/mpris-scrobbler/default.nix
+++ b/pkgs/tools/audio/mpris-scrobbler/default.nix
@@ -53,14 +53,17 @@ stdenv.mkDerivation rec {
     "-Dversion=${version}"
   ];
 
-  NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+  ] ++ lib.optionals stdenv.isDarwin [
     "-Wno-sometimes-uninitialized"
     "-Wno-tautological-pointer-compare"
   ] ++ lib.optionals stdenv.isLinux [
     "-Wno-array-bounds"
     "-Wno-free-nonheap-object"
     "-Wno-stringop-truncation"
-  ]);
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/tools/compression/brotli/default.nix b/pkgs/tools/compression/brotli/default.nix
index dfac5af0980..3d15cbd395c 100644
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@@ -4,18 +4,19 @@
 , cmake
 , fetchpatch
 , staticOnly ? stdenv.hostPlatform.isStatic
+, testers
 }:
 
 # ?TODO: there's also python lib in there
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "brotli";
   version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brotli";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "z6Dhrabav1MDQ4rAcXaDv0aN+qOoh9cvoXZqEWBB13c=";
   };
 
@@ -55,6 +56,8 @@ stdenv.mkDerivation rec {
     cp ../docs/*.3 $out/share/man/man3/
   '';
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "https://github.com/google/brotli";
     description = "A generic-purpose lossless compression algorithm and tool";
@@ -72,6 +75,10 @@ stdenv.mkDerivation rec {
       '';
     license = licenses.mit;
     maintainers = with maintainers; [ freezeboy ];
+    pkgConfigModules = [
+      "libbrotlidec"
+      "libbrotlienc"
+    ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 6a489779cb0..40df92b4d53 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -8,6 +8,15 @@
 , buildContrib ? stdenv.hostPlatform == stdenv.buildPlatform
 , doCheck ? stdenv.hostPlatform == stdenv.buildPlatform
 , nix-update-script
+
+# for passthru.tests
+, libarchive
+, rocksdb
+, arrow-cpp
+, libzip
+, curl
+, python3Packages
+, haskellPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -91,6 +100,14 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = nix-update-script { };
+    tests = {
+      inherit libarchive rocksdb arrow-cpp;
+      libzip = libzip.override { withZstd = true; };
+      curl = curl.override { zstdSupport = true; };
+      python-zstd = python3Packages.zstd;
+      haskell-zstd = haskellPackages.zstd;
+      haskell-hs-zstd = haskellPackages.hs-zstd;
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index a620a07d475..b9bed9cc20c 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -24,7 +24,11 @@ in stdenv.mkDerivation rec {
   pname = "blobfuse";
   inherit version src;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=catch-value"
+  ];
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse boost cpplite ];
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index d9ec176220b..e2677957e9c 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, runCommand, fetchurl
+{ lib, stdenv, runCommand, fetchurl, fetchpatch
 , ensureNewerSourcesHook
 , cmake, pkg-config
 , which, git
@@ -152,6 +152,21 @@ in rec {
 
     patches = [
       ./0000-fix-SPDK-build-env.patch
+      # pacific: include/buffer: include <memory>
+      # fixes build with gcc 12
+      # https://github.com/ceph/ceph/pull/47295
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/df88789a38c053513d3b2a9b7d12a952fc0c9042.patch";
+        hash = "sha256-je65kBfa5hR0ZKo6ZI10XmD5ZUbKj5rxlGxxI9ZJVfo=";
+      })
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/2abcbe4e47705e6e0fcc7d9d9b75625f563199af.patch";
+        hash = "sha256-8sWQKoZNHuGuhzX/F+3fY4+kjsrwsfoMdVpfVSj2x5w=";
+      })
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/13dc077cf6c65a3b8c4f13d896847b9964b3fcbb.patch";
+        hash = "sha256-byfiZh9OJrux/y5m3QCPg0LET6q33ZDXmp/CN+yOSQQ=";
+      })
     ];
 
     nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
index 5a917602c43..e1edac0c610 100644
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "httm";
-  version = "0.20.5";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "kimono-koans";
     repo = pname;
     rev = version;
-    sha256 = "sha256-8SizRNjA+lvp8ZD14SoRcymhYmJXlwoeZQjrekIbdL4=";
+    sha256 = "sha256-uSCFm6aWNPFPcja+KB6TU7iVVYkDdD82pFjA9dOpSs8=";
   };
 
-  cargoHash = "sha256-tXV1G0qWN0jLOKlnZfHHlOZw+wUItLzQtSg4o2f96u0=";
+  cargoHash = "sha256-uxtZ+aUUhfWGCLysOcWi5En1eRui8Ja+nyD3S2WEWQM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/filesystems/idsk/default.nix b/pkgs/tools/filesystems/idsk/default.nix
index 39052ecba93..34a32c4a6df 100644
--- a/pkgs/tools/filesystems/idsk/default.nix
+++ b/pkgs/tools/filesystems/idsk/default.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-std=c++14"
+  ];
+
   installPhase = ''
     mkdir -p $out/bin
     cp iDSK $out/bin
diff --git a/pkgs/tools/filesystems/rmfuse/default.nix b/pkgs/tools/filesystems/rmfuse/default.nix
index 78bc6bd55c4..ace05d06166 100644
--- a/pkgs/tools/filesystems/rmfuse/default.nix
+++ b/pkgs/tools/filesystems/rmfuse/default.nix
@@ -1,44 +1,49 @@
-{ poetry2nix, pkgs, lib }:
+{ lib
+, python3
+, fetchFromGitHub
+}:
 
-let
-  pythonPackages = (poetry2nix.mkPoetryPackages {
-    projectDir = ./.;
-    overrides = [
-      poetry2nix.defaultPoetryOverrides
-      (import ./poetry-git-overlay.nix { inherit pkgs; })
-      (self: super: {
+python3.pkgs.buildPythonApplication rec {
+  pname = "rmfuse";
+  version = "unstable-2021-06-06";
 
-        rmfuse = super.rmfuse.overridePythonAttrs(old: {
-          meta = old.meta // {
-            description = "RMfuse provides access to your reMarkable Cloud files in the form of a FUSE filesystem.";
-            longDescription = ''
-              RMfuse provides access to your reMarkable Cloud files in the form of a FUSE filesystem. These files are exposed either in their original format, or as PDF files that contain your annotations. This lets you manage files in the reMarkable Cloud using the same tools you use on your local system.
-            '';
-            license = lib.licenses.mit;
-            homepage = "https://github.com/rschroll/rmfuse";
-            maintainers = [ lib.maintainers.adisbladis ];
-          };
-        });
+  format = "pyproject";
 
-        reportlab = let
-          ft = pkgs.freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; });
-        in super.reportlab.overridePythonAttrs(old: {
-          postPatch = ''
-            substituteInPlace setup.py \
-              --replace "mif = findFile(d,'ft2build.h')" "mif = findFile('${lib.getDev ft}','ft2build.h')"
-          '';
+  src = fetchFromGitHub {
+    owner = "rschroll";
+    repo = "rmfuse";
+    rev = "3796b8610c8a965a60a417fc0bf8ea5200b71fd2";
+    hash = "sha256-W3kS6Kkmp8iWMOYFL7r1GyjSQvFotBXQCuTMK0vyHQ8=";
+  };
 
-          NIX_CFLAGS_COMPILE = "-I${pkgs.freetype}/include/freetype2";
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'bidict = "^' 'bidict = ">='
+  '';
 
-          nativeBuildInputs = old.nativeBuildInputs ++ [
-            pkgs.pkg-config
-          ];
-          buildInputs = old.buildInputs ++ [
-            pkgs.freetype
-          ];
-        });
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
 
-      })
-    ];
-  }).python.pkgs;
-in pythonPackages.rmfuse
+  propagatedBuildInputs = with python3.pkgs; [
+    bidict
+    rmrl
+    rmcl
+    pyfuse3
+    xdg
+  ];
+
+  meta = {
+    description = "FUSE access to the reMarkable Cloud";
+    homepage = "https://github.com/rschroll/rmfuse";
+    license = lib.licenses.mit;
+    longDescription = ''
+      RMfuse provides access to your reMarkable Cloud files in the form of a
+      FUSE filesystem. These files are exposed either in their original format,
+      or as PDF files that contain your annotations. This lets you manage files
+      in the reMarkable Cloud using the same tools you use on your local
+      system.
+    '';
+    maintainers = with lib.maintainers; [ adisbladis ];
+  };
+}
diff --git a/pkgs/tools/filesystems/rmfuse/poetry-git-overlay.nix b/pkgs/tools/filesystems/rmfuse/poetry-git-overlay.nix
deleted file mode 100644
index 2ee4f805fb2..00000000000
--- a/pkgs/tools/filesystems/rmfuse/poetry-git-overlay.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ pkgs }:
-self: super: {
-
-  rmfuse = super.rmfuse.overridePythonAttrs (
-    _: {
-      src = pkgs.fetchgit {
-        url = "https://github.com/rschroll/rmfuse.git";
-        rev = "3796b8610c8a965a60a417fc0bf8ea5200b71fd2";
-        sha256 = "03qxy95jpk741b81bd38y51d4a0vynx2y1g662bci9r6m7l14yav";
-      };
-    }
-  );
-
-}
diff --git a/pkgs/tools/filesystems/rmfuse/poetry.lock b/pkgs/tools/filesystems/rmfuse/poetry.lock
deleted file mode 100644
index 4c588fc99e9..00000000000
--- a/pkgs/tools/filesystems/rmfuse/poetry.lock
+++ /dev/null
@@ -1,596 +0,0 @@
-[[package]]
-name = "anyio"
-version = "2.2.0"
-description = "High level compatibility layer for multiple asynchronous event loop implementations"
-category = "main"
-optional = false
-python-versions = ">=3.6.2"
-
-[package.dependencies]
-idna = ">=2.8"
-sniffio = ">=1.1"
-
-[package.extras]
-curio = ["curio (>=1.4)"]
-doc = ["sphinx-rtd-theme", "sphinx-autodoc-typehints (>=1.2.0)"]
-test = ["coverage[toml] (>=4.5)", "hypothesis (>=4.0)", "pytest (>=6.0)", "trustme", "uvloop (<0.15)", "uvloop (>=0.15)"]
-trio = ["trio (>=0.16)"]
-
-[[package]]
-name = "asks"
-version = "2.4.12"
-description = "asks - async http"
-category = "main"
-optional = false
-python-versions = ">= 3.6.2"
-
-[package.dependencies]
-anyio = ">=2.0,<3.0"
-async_generator = "*"
-h11 = "*"
-
-[[package]]
-name = "async-generator"
-version = "1.10"
-description = "Async generators and context managers for Python 3.5+"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[[package]]
-name = "attrs"
-version = "21.4.0"
-description = "Classes Without Boilerplate"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-
-[package.extras]
-dev = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface", "furo", "sphinx", "sphinx-notfound-page", "pre-commit", "cloudpickle"]
-docs = ["furo", "sphinx", "zope.interface", "sphinx-notfound-page"]
-tests = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface", "cloudpickle"]
-tests_no_zope = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "cloudpickle"]
-
-[[package]]
-name = "bidict"
-version = "0.21.4"
-description = "The bidirectional mapping library for Python."
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[[package]]
-name = "cffi"
-version = "1.15.0"
-description = "Foreign Function Interface for Python calling C code."
-category = "main"
-optional = false
-python-versions = "*"
-
-[package.dependencies]
-pycparser = "*"
-
-[[package]]
-name = "cssselect2"
-version = "0.6.0"
-description = "CSS selectors for Python ElementTree"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.dependencies]
-tinycss2 = "*"
-webencodings = "*"
-
-[package.extras]
-doc = ["sphinx", "sphinx-rtd-theme"]
-test = ["pytest", "pytest-cov", "pytest-flake8", "pytest-isort", "coverage"]
-
-[[package]]
-name = "h11"
-version = "0.13.0"
-description = "A pure-Python, bring-your-own-I/O implementation of HTTP/1.1"
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[[package]]
-name = "idna"
-version = "3.3"
-description = "Internationalized Domain Names in Applications (IDNA)"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[[package]]
-name = "lxml"
-version = "4.9.0"
-description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
-
-[package.extras]
-cssselect = ["cssselect (>=0.7)"]
-html5 = ["html5lib"]
-htmlsoup = ["beautifulsoup4"]
-source = ["Cython (>=0.29.7)"]
-
-[[package]]
-name = "outcome"
-version = "1.1.0"
-description = "Capture the outcome of Python function calls."
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[package.dependencies]
-attrs = ">=19.2.0"
-
-[[package]]
-name = "pdfrw"
-version = "0.4"
-description = "PDF file reader/writer library"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "pillow"
-version = "9.1.1"
-description = "Python Imaging Library (Fork)"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.extras]
-docs = ["olefile", "sphinx (>=2.4)", "sphinx-copybutton", "sphinx-issues (>=3.0.1)", "sphinx-removed-in", "sphinx-rtd-theme (>=1.0)", "sphinxext-opengraph"]
-tests = ["check-manifest", "coverage", "defusedxml", "markdown2", "olefile", "packaging", "pyroma", "pytest", "pytest-cov", "pytest-timeout"]
-
-[[package]]
-name = "pycparser"
-version = "2.21"
-description = "C parser in Python"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
-
-[[package]]
-name = "pyfuse3"
-version = "3.2.1"
-description = "Python 3 bindings for libfuse 3 with async I/O support"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[package.dependencies]
-trio = ">=0.15"
-
-[[package]]
-name = "reportlab"
-version = "3.6.9"
-description = "The Reportlab Toolkit"
-category = "main"
-optional = false
-python-versions = ">=3.7, <4"
-
-[package.dependencies]
-pillow = ">=4.0.0"
-
-[package.extras]
-rlpycairo = ["rlPyCairo (>=0.0.5)"]
-
-[[package]]
-name = "rmcl"
-version = "0.4.2"
-description = "reMarkable Cloud Library"
-category = "main"
-optional = false
-python-versions = ">=3.7,<4.0"
-
-[package.dependencies]
-asks = ">=2.4.12,<3.0.0"
-trio = ">=0.18.0,<0.19.0"
-xdg = ">=5.0.1,<6.0.0"
-
-[[package]]
-name = "rmfuse"
-version = "0.2.3"
-description = ""
-category = "main"
-optional = false
-python-versions = "^3.7"
-develop = false
-
-[package.dependencies]
-bidict = "^0.21.2"
-pyfuse3 = {version = "^3.2.0", optional = true}
-rmcl = "^0.4.2"
-rmrl = "^0.2.1"
-xdg = "^5.0.1"
-
-[package.extras]
-pyfuse3 = ["pyfuse3 (>=3.2.0,<4.0.0)"]
-llfuse = ["llfuse (>=1.4.1,<2.0.0)"]
-
-[package.source]
-type = "git"
-url = "https://github.com/rschroll/rmfuse.git"
-reference = "master"
-resolved_reference = "3796b8610c8a965a60a417fc0bf8ea5200b71fd2"
-
-[[package]]
-name = "rmrl"
-version = "0.2.1"
-description = "Render reMarkable documents to PDF"
-category = "main"
-optional = false
-python-versions = ">=3.7,<4.0"
-
-[package.dependencies]
-pdfrw = ">=0.4,<0.5"
-reportlab = ">=3.5.59,<4.0.0"
-svglib = ">=1.0.1,<2.0.0"
-xdg = ">=5.0.1,<6.0.0"
-
-[[package]]
-name = "sniffio"
-version = "1.2.0"
-description = "Sniff out which async library your code is running under"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[[package]]
-name = "sortedcontainers"
-version = "2.4.0"
-description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "svglib"
-version = "1.3.0"
-description = "A pure-Python library for reading and converting SVG"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.dependencies]
-cssselect2 = ">=0.2.0"
-lxml = "*"
-reportlab = "*"
-tinycss2 = ">=0.6.0"
-
-[[package]]
-name = "tinycss2"
-version = "1.1.1"
-description = "A tiny CSS parser"
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[package.dependencies]
-webencodings = ">=0.4"
-
-[package.extras]
-doc = ["sphinx", "sphinx-rtd-theme"]
-test = ["pytest", "pytest-cov", "pytest-flake8", "pytest-isort", "coverage"]
-
-[[package]]
-name = "trio"
-version = "0.18.0"
-description = "A friendly Python library for async concurrency and I/O"
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[package.dependencies]
-async-generator = ">=1.9"
-attrs = ">=19.2.0"
-cffi = {version = ">=1.14", markers = "os_name == \"nt\" and implementation_name != \"pypy\""}
-idna = "*"
-outcome = "*"
-sniffio = "*"
-sortedcontainers = "*"
-
-[[package]]
-name = "webencodings"
-version = "0.5.1"
-description = "Character encoding aliases for legacy web content"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "xdg"
-version = "5.1.1"
-description = "Variables defined by the XDG Base Directory Specification"
-category = "main"
-optional = false
-python-versions = ">=3.6,<4.0"
-
-[metadata]
-lock-version = "1.1"
-python-versions = "^3.8"
-content-hash = "3da90f3013f1220c9081c0a11dac7d8cd05c5a47ebda40fbb4357e44503e99a3"
-
-[metadata.files]
-anyio = [
-    {file = "anyio-2.2.0-py3-none-any.whl", hash = "sha256:aa3da546ed17f097ca876c78024dea380a3b7fa80759abfdda59f12176a3dac8"},
-    {file = "anyio-2.2.0.tar.gz", hash = "sha256:4a41c5b3a65ed92e469d51b6fba3779301850ea2e352afcf9e36c46f21ee14a9"},
-]
-asks = [
-    {file = "asks-2.4.12.tar.gz", hash = "sha256:38de944eb350e7e4e3a918055fa8ff033da5f7b5ff385c1160a2d6b9d84783b0"},
-]
-async-generator = [
-    {file = "async_generator-1.10-py3-none-any.whl", hash = "sha256:01c7bf666359b4967d2cda0000cc2e4af16a0ae098cbffcb8472fb9e8ad6585b"},
-    {file = "async_generator-1.10.tar.gz", hash = "sha256:6ebb3d106c12920aaae42ccb6f787ef5eefdcdd166ea3d628fa8476abe712144"},
-]
-attrs = [
-    {file = "attrs-21.4.0-py2.py3-none-any.whl", hash = "sha256:2d27e3784d7a565d36ab851fe94887c5eccd6a463168875832a1be79c82828b4"},
-    {file = "attrs-21.4.0.tar.gz", hash = "sha256:626ba8234211db98e869df76230a137c4c40a12d72445c45d5f5b716f076e2fd"},
-]
-bidict = [
-    {file = "bidict-0.21.4-py3-none-any.whl", hash = "sha256:3ac67daa353ecf853a1df9d3e924f005e729227a60a8dbada31a4c31aba7f654"},
-    {file = "bidict-0.21.4.tar.gz", hash = "sha256:42c84ffbe6f8de898af6073b4be9ea7ccedcd78d3474aa844c54e49d5a079f6f"},
-]
-cffi = [
-    {file = "cffi-1.15.0-cp27-cp27m-macosx_10_9_x86_64.whl", hash = "sha256:c2502a1a03b6312837279c8c1bd3ebedf6c12c4228ddbad40912d671ccc8a962"},
-    {file = "cffi-1.15.0-cp27-cp27m-manylinux1_i686.whl", hash = "sha256:23cfe892bd5dd8941608f93348c0737e369e51c100d03718f108bf1add7bd6d0"},
-    {file = "cffi-1.15.0-cp27-cp27m-manylinux1_x86_64.whl", hash = "sha256:41d45de54cd277a7878919867c0f08b0cf817605e4eb94093e7516505d3c8d14"},
-    {file = "cffi-1.15.0-cp27-cp27m-win32.whl", hash = "sha256:4a306fa632e8f0928956a41fa8e1d6243c71e7eb59ffbd165fc0b41e316b2474"},
-    {file = "cffi-1.15.0-cp27-cp27m-win_amd64.whl", hash = "sha256:e7022a66d9b55e93e1a845d8c9eba2a1bebd4966cd8bfc25d9cd07d515b33fa6"},
-    {file = "cffi-1.15.0-cp27-cp27mu-manylinux1_i686.whl", hash = "sha256:14cd121ea63ecdae71efa69c15c5543a4b5fbcd0bbe2aad864baca0063cecf27"},
-    {file = "cffi-1.15.0-cp27-cp27mu-manylinux1_x86_64.whl", hash = "sha256:d4d692a89c5cf08a8557fdeb329b82e7bf609aadfaed6c0d79f5a449a3c7c023"},
-    {file = "cffi-1.15.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0104fb5ae2391d46a4cb082abdd5c69ea4eab79d8d44eaaf79f1b1fd806ee4c2"},
-    {file = "cffi-1.15.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:91ec59c33514b7c7559a6acda53bbfe1b283949c34fe7440bcf917f96ac0723e"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:f5c7150ad32ba43a07c4479f40241756145a1f03b43480e058cfd862bf5041c7"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:00c878c90cb53ccfaae6b8bc18ad05d2036553e6d9d1d9dbcf323bbe83854ca3"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:abb9a20a72ac4e0fdb50dae135ba5e77880518e742077ced47eb1499e29a443c"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a5263e363c27b653a90078143adb3d076c1a748ec9ecc78ea2fb916f9b861962"},
-    {file = "cffi-1.15.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f54a64f8b0c8ff0b64d18aa76675262e1700f3995182267998c31ae974fbc382"},
-    {file = "cffi-1.15.0-cp310-cp310-win32.whl", hash = "sha256:c21c9e3896c23007803a875460fb786118f0cdd4434359577ea25eb556e34c55"},
-    {file = "cffi-1.15.0-cp310-cp310-win_amd64.whl", hash = "sha256:5e069f72d497312b24fcc02073d70cb989045d1c91cbd53979366077959933e0"},
-    {file = "cffi-1.15.0-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:64d4ec9f448dfe041705426000cc13e34e6e5bb13736e9fd62e34a0b0c41566e"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2756c88cbb94231c7a147402476be2c4df2f6078099a6f4a480d239a8817ae39"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3b96a311ac60a3f6be21d2572e46ce67f09abcf4d09344c49274eb9e0bf345fc"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:75e4024375654472cc27e91cbe9eaa08567f7fbdf822638be2814ce059f58032"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:59888172256cac5629e60e72e86598027aca6bf01fa2465bdb676d37636573e8"},
-    {file = "cffi-1.15.0-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:27c219baf94952ae9d50ec19651a687b826792055353d07648a5695413e0c605"},
-    {file = "cffi-1.15.0-cp36-cp36m-win32.whl", hash = "sha256:4958391dbd6249d7ad855b9ca88fae690783a6be9e86df65865058ed81fc860e"},
-    {file = "cffi-1.15.0-cp36-cp36m-win_amd64.whl", hash = "sha256:f6f824dc3bce0edab5f427efcfb1d63ee75b6fcb7282900ccaf925be84efb0fc"},
-    {file = "cffi-1.15.0-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:06c48159c1abed75c2e721b1715c379fa3200c7784271b3c46df01383b593636"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:c2051981a968d7de9dd2d7b87bcb9c939c74a34626a6e2f8181455dd49ed69e4"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:fd8a250edc26254fe5b33be00402e6d287f562b6a5b2152dec302fa15bb3e997"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:91d77d2a782be4274da750752bb1650a97bfd8f291022b379bb8e01c66b4e96b"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:45db3a33139e9c8f7c09234b5784a5e33d31fd6907800b316decad50af323ff2"},
-    {file = "cffi-1.15.0-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:263cc3d821c4ab2213cbe8cd8b355a7f72a8324577dc865ef98487c1aeee2bc7"},
-    {file = "cffi-1.15.0-cp37-cp37m-win32.whl", hash = "sha256:17771976e82e9f94976180f76468546834d22a7cc404b17c22df2a2c81db0c66"},
-    {file = "cffi-1.15.0-cp37-cp37m-win_amd64.whl", hash = "sha256:3415c89f9204ee60cd09b235810be700e993e343a408693e80ce7f6a40108029"},
-    {file = "cffi-1.15.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:4238e6dab5d6a8ba812de994bbb0a79bddbdf80994e4ce802b6f6f3142fcc880"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:0808014eb713677ec1292301ea4c81ad277b6cdf2fdd90fd540af98c0b101d20"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:57e9ac9ccc3101fac9d6014fba037473e4358ef4e89f8e181f8951a2c0162024"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8b6c2ea03845c9f501ed1313e78de148cd3f6cad741a75d43a29b43da27f2e1e"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:10dffb601ccfb65262a27233ac273d552ddc4d8ae1bf93b21c94b8511bffe728"},
-    {file = "cffi-1.15.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:786902fb9ba7433aae840e0ed609f45c7bcd4e225ebb9c753aa39725bb3e6ad6"},
-    {file = "cffi-1.15.0-cp38-cp38-win32.whl", hash = "sha256:da5db4e883f1ce37f55c667e5c0de439df76ac4cb55964655906306918e7363c"},
-    {file = "cffi-1.15.0-cp38-cp38-win_amd64.whl", hash = "sha256:181dee03b1170ff1969489acf1c26533710231c58f95534e3edac87fff06c443"},
-    {file = "cffi-1.15.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:45e8636704eacc432a206ac7345a5d3d2c62d95a507ec70d62f23cd91770482a"},
-    {file = "cffi-1.15.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:31fb708d9d7c3f49a60f04cf5b119aeefe5644daba1cd2a0fe389b674fd1de37"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:6dc2737a3674b3e344847c8686cf29e500584ccad76204efea14f451d4cc669a"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:74fdfdbfdc48d3f47148976f49fab3251e550a8720bebc99bf1483f5bfb5db3e"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ffaa5c925128e29efbde7301d8ecaf35c8c60ffbcd6a1ffd3a552177c8e5e796"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3f7d084648d77af029acb79a0ff49a0ad7e9d09057a9bf46596dac9514dc07df"},
-    {file = "cffi-1.15.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ef1f279350da2c586a69d32fc8733092fd32cc8ac95139a00377841f59a3f8d8"},
-    {file = "cffi-1.15.0-cp39-cp39-win32.whl", hash = "sha256:2a23af14f408d53d5e6cd4e3d9a24ff9e05906ad574822a10563efcef137979a"},
-    {file = "cffi-1.15.0-cp39-cp39-win_amd64.whl", hash = "sha256:3773c4d81e6e818df2efbc7dd77325ca0dcb688116050fb2b3011218eda36139"},
-    {file = "cffi-1.15.0.tar.gz", hash = "sha256:920f0d66a896c2d99f0adbb391f990a84091179542c205fa53ce5787aff87954"},
-]
-cssselect2 = [
-    {file = "cssselect2-0.6.0-py3-none-any.whl", hash = "sha256:3a83b2a68370c69c9cd3fcb88bbfaebe9d22edeef2c22d1ff3e1ed9c7fa45ed8"},
-    {file = "cssselect2-0.6.0.tar.gz", hash = "sha256:5b5d6dea81a5eb0c9ca39f116c8578dd413778060c94c1f51196371618909325"},
-]
-h11 = [
-    {file = "h11-0.13.0-py3-none-any.whl", hash = "sha256:8ddd78563b633ca55346c8cd41ec0af27d3c79931828beffb46ce70a379e7442"},
-    {file = "h11-0.13.0.tar.gz", hash = "sha256:70813c1135087a248a4d38cc0e1a0181ffab2188141a93eaf567940c3957ff06"},
-]
-idna = [
-    {file = "idna-3.3-py3-none-any.whl", hash = "sha256:84d9dd047ffa80596e0f246e2eab0b391788b0503584e8945f2368256d2735ff"},
-    {file = "idna-3.3.tar.gz", hash = "sha256:9d643ff0a55b762d5cdb124b8eaa99c66322e2157b69160bc32796e824360e6d"},
-]
-lxml = [
-    {file = "lxml-4.9.0-cp27-cp27m-macosx_10_15_x86_64.whl", hash = "sha256:b5031d151d6147eac53366d6ec87da84cd4d8c5e80b1d9948a667a7164116e39"},
-    {file = "lxml-4.9.0-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:5d52e1173f52020392f593f87a6af2d4055dd800574a5cb0af4ea3878801d307"},
-    {file = "lxml-4.9.0-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:3af00ee88376022589ceeb8170eb67dacf5f7cd625ea59fa0977d719777d4ae8"},
-    {file = "lxml-4.9.0-cp27-cp27m-win32.whl", hash = "sha256:1057356b808d149bc14eb8f37bb89129f237df488661c1e0fc0376ca90e1d2c3"},
-    {file = "lxml-4.9.0-cp27-cp27m-win_amd64.whl", hash = "sha256:f6d23a01921b741774f35e924d418a43cf03eca1444f3fdfd7978d35a5aaab8b"},
-    {file = "lxml-4.9.0-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:56e19fb6e4b8bd07fb20028d03d3bc67bcc0621347fbde64f248e44839771756"},
-    {file = "lxml-4.9.0-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:4cd69bca464e892ea4ed544ba6a7850aaff6f8d792f8055a10638db60acbac18"},
-    {file = "lxml-4.9.0-cp310-cp310-macosx_10_15_x86_64.whl", hash = "sha256:94b181dd2777890139e49a5336bf3a9a3378ce66132c665fe8db4e8b7683cde2"},
-    {file = "lxml-4.9.0-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:607224ffae9a0cf0a2f6e14f5f6bce43e83a6fbdaa647891729c103bdd6a5593"},
-    {file = "lxml-4.9.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:11d62c97ceff9bab94b6b29c010ea5fb6831743459bb759c917f49ba75601cd0"},
-    {file = "lxml-4.9.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:70a198030d26f5e569367f0f04509b63256faa76a22886280eea69a4f535dd40"},
-    {file = "lxml-4.9.0-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:3cf816aed8125cfc9e6e5c6c31ff94278320d591bd7970c4a0233bee0d1c8790"},
-    {file = "lxml-4.9.0-cp310-cp310-win32.whl", hash = "sha256:65b3b5f12c6fb5611e79157214f3cd533083f9b058bf2fc8a1c5cc5ee40fdc5a"},
-    {file = "lxml-4.9.0-cp310-cp310-win_amd64.whl", hash = "sha256:0aa4cce579512c33373ca4c5e23c21e40c1aa1a33533a75e51b654834fd0e4f2"},
-    {file = "lxml-4.9.0-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:63419db39df8dc5564f6f103102c4665f7e4d9cb64030e98cf7a74eae5d5760d"},
-    {file = "lxml-4.9.0-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:d8e5021e770b0a3084c30dda5901d5fce6d4474feaf0ced8f8e5a82702502fbb"},
-    {file = "lxml-4.9.0-cp35-cp35m-win32.whl", hash = "sha256:f17b9df97c5ecdfb56c5e85b3c9df9831246df698f8581c6e111ac664c7c656e"},
-    {file = "lxml-4.9.0-cp35-cp35m-win_amd64.whl", hash = "sha256:75da29a0752c8f2395df0115ac1681cefbdd4418676015be8178b733704cbff2"},
-    {file = "lxml-4.9.0-cp36-cp36m-macosx_10_15_x86_64.whl", hash = "sha256:e4d020ecf3740b7312bacab2cb966bb720fd4d3490562d373b4ad91dd1857c0d"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:b71c52d69b91af7d18c13aef1b0cc3baee36b78607c711eb14a52bf3aa7c815e"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:28cf04a1a38e961d4a764d2940af9b941b66263ed5584392ef875ee9c1e360a3"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:915ecf7d486df17cc65aeefdb680d5ad4390cc8c857cf8db3fe241ed234f856a"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e564d5a771b4015f34166a05ea2165b7e283635c41b1347696117f780084b46d"},
-    {file = "lxml-4.9.0-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:c2a57755e366e0ac7ebdb3e9207f159c3bf1afed02392ab18453ce81f5ee92ee"},
-    {file = "lxml-4.9.0-cp36-cp36m-musllinux_1_1_x86_64.whl", hash = "sha256:00f3a6f88fd5f4357844dd91a1abac5f466c6799f1b7f1da2df6665253845b11"},
-    {file = "lxml-4.9.0-cp36-cp36m-win32.whl", hash = "sha256:9093a359a86650a3dbd6532c3e4d21a6f58ba2cb60d0e72db0848115d24c10ba"},
-    {file = "lxml-4.9.0-cp36-cp36m-win_amd64.whl", hash = "sha256:d1690c4d37674a5f0cdafbc5ed7e360800afcf06928c2a024c779c046891bf09"},
-    {file = "lxml-4.9.0-cp37-cp37m-macosx_10_15_x86_64.whl", hash = "sha256:6af7f51a6010748fc1bb71917318d953c9673e4ae3f6d285aaf93ef5b2eb11c1"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:eabdbe04ee0a7e760fa6cd9e799d2b020d098c580ba99107d52e1e5e538b1ecb"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:b1e22f3ee4d75ca261b6bffbf64f6f178cb194b1be3191065a09f8d98828daa9"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:53b0410b220766321759f7f9066da67b1d0d4a7f6636a477984cbb1d98483955"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:d76da27f5e3e9bc40eba6ed7a9e985f57547e98cf20521d91215707f2fb57e0f"},
-    {file = "lxml-4.9.0-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:686565ac77ff94a8965c11829af253d9e2ce3bf0d9225b1d2eb5c4d4666d0dca"},
-    {file = "lxml-4.9.0-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:b62d1431b4c40cda43cc986f19b8c86b1d2ae8918cfc00f4776fdf070b65c0c4"},
-    {file = "lxml-4.9.0-cp37-cp37m-win32.whl", hash = "sha256:4becd16750ca5c2a1b1588269322b2cebd10c07738f336c922b658dbab96a61c"},
-    {file = "lxml-4.9.0-cp37-cp37m-win_amd64.whl", hash = "sha256:e35a298691b9e10e5a5631f8f0ba605b30ebe19208dc8f58b670462f53753641"},
-    {file = "lxml-4.9.0-cp38-cp38-macosx_10_15_x86_64.whl", hash = "sha256:aa7447bf7c1a15ef24e2b86a277b585dd3f055e8890ac7f97374d170187daa97"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:612ef8f2795a89ba3a1d4c8c1af84d8453fd53ee611aa5ad460fdd2cab426fc2"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:1bfb791a8fcdbf55d1d41b8be940393687bec0e9b12733f0796668086d1a23ff"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:024684e0c5cfa121c22140d3a0898a3a9b2ea0f0fd2c229b6658af4bdf1155e5"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:81c29c8741fa07ecec8ec7417c3d8d1e2f18cf5a10a280f4e1c3f8c3590228b2"},
-    {file = "lxml-4.9.0-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:6467626fa74f96f4d80fc6ec2555799e97fff8f36e0bfc7f67769f83e59cff40"},
-    {file = "lxml-4.9.0-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:9cae837b988f44925d14d048fa6a8c54f197c8b1223fd9ee9c27084f84606143"},
-    {file = "lxml-4.9.0-cp38-cp38-win32.whl", hash = "sha256:5a49ad78543925e1a4196e20c9c54492afa4f1502c2a563f73097e2044c75190"},
-    {file = "lxml-4.9.0-cp38-cp38-win_amd64.whl", hash = "sha256:bb7c1b029e54e26e01b1d1d912fc21abb65650d16ea9a191d026def4ed0859ed"},
-    {file = "lxml-4.9.0-cp39-cp39-macosx_10_15_x86_64.whl", hash = "sha256:d0d03b9636f1326772e6854459728676354d4c7731dae9902b180e2065ba3da6"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:9af19eb789d674b59a9bee5005779757aab857c40bf9cc313cb01eafac55ce55"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:dd00d28d1ab5fa7627f5abc957f29a6338a7395b724571a8cbff8fbed83aaa82"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:754a1dd04bff8a509a31146bd8f3a5dc8191a8694d582dd5fb71ff09f0722c22"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b7679344f2270840dc5babc9ccbedbc04f7473c1f66d4676bb01680c0db85bcc"},
-    {file = "lxml-4.9.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:d882c2f3345261e898b9f604be76b61c901fbfa4ac32e3f51d5dc1edc89da3cb"},
-    {file = "lxml-4.9.0-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:4e97c8fc761ad63909198acc892f34c20f37f3baa2c50a62d5ec5d7f1efc68a1"},
-    {file = "lxml-4.9.0-cp39-cp39-win32.whl", hash = "sha256:cf9ec915857d260511399ab87e1e70fa13d6b2972258f8e620a3959468edfc32"},
-    {file = "lxml-4.9.0-cp39-cp39-win_amd64.whl", hash = "sha256:1254a79f8a67a3908de725caf59eae62d86738f6387b0a34b32e02abd6ae73db"},
-    {file = "lxml-4.9.0-pp37-pypy37_pp73-macosx_10_15_x86_64.whl", hash = "sha256:03370ec37fe562238d385e2c53089076dee53aabf8325cab964fdb04a9130fa0"},
-    {file = "lxml-4.9.0-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:f386def57742aacc3d864169dfce644a8c396f95aa35b41b69df53f558d56dd0"},
-    {file = "lxml-4.9.0-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:ea3f2e9eb41f973f73619e88bf7bd950b16b4c2ce73d15f24a11800ce1eaf276"},
-    {file = "lxml-4.9.0-pp38-pypy38_pp73-macosx_10_15_x86_64.whl", hash = "sha256:2d10659e6e5c53298e6d718fd126e793285bff904bb71d7239a17218f6a197b7"},
-    {file = "lxml-4.9.0-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:fcdf70191f0d1761d190a436db06a46f05af60e1410e1507935f0332280c9268"},
-    {file = "lxml-4.9.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:2b9c2341d96926b0d0e132e5c49ef85eb53fa92ae1c3a70f9072f3db0d32bc07"},
-    {file = "lxml-4.9.0-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:615886ee84b6f42f1bdf1852a9669b5fe3b96b6ff27f1a7a330b67ad9911200a"},
-    {file = "lxml-4.9.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:94f2e45b054dd759bed137b6e14ae8625495f7d90ddd23cf62c7a68f72b62656"},
-    {file = "lxml-4.9.0.tar.gz", hash = "sha256:520461c36727268a989790aef08884347cd41f2d8ae855489ccf40b50321d8d7"},
-]
-outcome = [
-    {file = "outcome-1.1.0-py2.py3-none-any.whl", hash = "sha256:c7dd9375cfd3c12db9801d080a3b63d4b0a261aa996c4c13152380587288d958"},
-    {file = "outcome-1.1.0.tar.gz", hash = "sha256:e862f01d4e626e63e8f92c38d1f8d5546d3f9cce989263c521b2e7990d186967"},
-]
-pdfrw = [
-    {file = "pdfrw-0.4-py2.py3-none-any.whl", hash = "sha256:758289edaa3b672e9a1a67504be73c18ec668d4e5b9d5ac9cbc0dc753d8d196b"},
-    {file = "pdfrw-0.4.tar.gz", hash = "sha256:0dc0494a0e6561b268542b28ede2280387c2728114f117d3bb5d8e4787b93ef4"},
-]
-pillow = [
-    {file = "Pillow-9.1.1-cp310-cp310-macosx_10_10_x86_64.whl", hash = "sha256:42dfefbef90eb67c10c45a73a9bc1599d4dac920f7dfcbf4ec6b80cb620757fe"},
-    {file = "Pillow-9.1.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:ffde4c6fabb52891d81606411cbfaf77756e3b561b566efd270b3ed3791fde4e"},
-    {file = "Pillow-9.1.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9c857532c719fb30fafabd2371ce9b7031812ff3889d75273827633bca0c4602"},
-    {file = "Pillow-9.1.1-cp310-cp310-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:59789a7d06c742e9d13b883d5e3569188c16acb02eeed2510fd3bfdbc1bd1530"},
-    {file = "Pillow-9.1.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4d45dbe4b21a9679c3e8b3f7f4f42a45a7d3ddff8a4a16109dff0e1da30a35b2"},
-    {file = "Pillow-9.1.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:e9ed59d1b6ee837f4515b9584f3d26cf0388b742a11ecdae0d9237a94505d03a"},
-    {file = "Pillow-9.1.1-cp310-cp310-win32.whl", hash = "sha256:b3fe2ff1e1715d4475d7e2c3e8dabd7c025f4410f79513b4ff2de3d51ce0fa9c"},
-    {file = "Pillow-9.1.1-cp310-cp310-win_amd64.whl", hash = "sha256:5b650dbbc0969a4e226d98a0b440c2f07a850896aed9266b6fedc0f7e7834108"},
-    {file = "Pillow-9.1.1-cp37-cp37m-macosx_10_10_x86_64.whl", hash = "sha256:0b4d5ad2cd3a1f0d1df882d926b37dbb2ab6c823ae21d041b46910c8f8cd844b"},
-    {file = "Pillow-9.1.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9370d6744d379f2de5d7fa95cdbd3a4d92f0b0ef29609b4b1687f16bc197063d"},
-    {file = "Pillow-9.1.1-cp37-cp37m-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b761727ed7d593e49671d1827044b942dd2f4caae6e51bab144d4accf8244a84"},
-    {file = "Pillow-9.1.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8a66fe50386162df2da701b3722781cbe90ce043e7d53c1fd6bd801bca6b48d4"},
-    {file = "Pillow-9.1.1-cp37-cp37m-win32.whl", hash = "sha256:2b291cab8a888658d72b575a03e340509b6b050b62db1f5539dd5cd18fd50578"},
-    {file = "Pillow-9.1.1-cp37-cp37m-win_amd64.whl", hash = "sha256:1d4331aeb12f6b3791911a6da82de72257a99ad99726ed6b63f481c0184b6fb9"},
-    {file = "Pillow-9.1.1-cp38-cp38-macosx_10_10_x86_64.whl", hash = "sha256:8844217cdf66eabe39567118f229e275f0727e9195635a15e0e4b9227458daaf"},
-    {file = "Pillow-9.1.1-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:b6617221ff08fbd3b7a811950b5c3f9367f6e941b86259843eab77c8e3d2b56b"},
-    {file = "Pillow-9.1.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:20d514c989fa28e73a5adbddd7a171afa5824710d0ab06d4e1234195d2a2e546"},
-    {file = "Pillow-9.1.1-cp38-cp38-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:088df396b047477dd1bbc7de6e22f58400dae2f21310d9e2ec2933b2ef7dfa4f"},
-    {file = "Pillow-9.1.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:53c27bd452e0f1bc4bfed07ceb235663a1df7c74df08e37fd6b03eb89454946a"},
-    {file = "Pillow-9.1.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:3f6c1716c473ebd1649663bf3b42702d0d53e27af8b64642be0dd3598c761fb1"},
-    {file = "Pillow-9.1.1-cp38-cp38-win32.whl", hash = "sha256:c67db410508b9de9c4694c57ed754b65a460e4812126e87f5052ecf23a011a54"},
-    {file = "Pillow-9.1.1-cp38-cp38-win_amd64.whl", hash = "sha256:f054b020c4d7e9786ae0404278ea318768eb123403b18453e28e47cdb7a0a4bf"},
-    {file = "Pillow-9.1.1-cp39-cp39-macosx_10_10_x86_64.whl", hash = "sha256:c17770a62a71718a74b7548098a74cd6880be16bcfff5f937f900ead90ca8e92"},
-    {file = "Pillow-9.1.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:f3f6a6034140e9e17e9abc175fc7a266a6e63652028e157750bd98e804a8ed9a"},
-    {file = "Pillow-9.1.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f372d0f08eff1475ef426344efe42493f71f377ec52237bf153c5713de987251"},
-    {file = "Pillow-9.1.1-cp39-cp39-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:09e67ef6e430f90caa093528bd758b0616f8165e57ed8d8ce014ae32df6a831d"},
-    {file = "Pillow-9.1.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:66daa16952d5bf0c9d5389c5e9df562922a59bd16d77e2a276e575d32e38afd1"},
-    {file = "Pillow-9.1.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:d78ca526a559fb84faaaf84da2dd4addef5edb109db8b81677c0bb1aad342601"},
-    {file = "Pillow-9.1.1-cp39-cp39-win32.whl", hash = "sha256:55e74faf8359ddda43fee01bffbc5bd99d96ea508d8a08c527099e84eb708f45"},
-    {file = "Pillow-9.1.1-cp39-cp39-win_amd64.whl", hash = "sha256:7c150dbbb4a94ea4825d1e5f2c5501af7141ea95825fadd7829f9b11c97aaf6c"},
-    {file = "Pillow-9.1.1-pp37-pypy37_pp73-macosx_10_10_x86_64.whl", hash = "sha256:769a7f131a2f43752455cc72f9f7a093c3ff3856bf976c5fb53a59d0ccc704f6"},
-    {file = "Pillow-9.1.1-pp37-pypy37_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:488f3383cf5159907d48d32957ac6f9ea85ccdcc296c14eca1a4e396ecc32098"},
-    {file = "Pillow-9.1.1-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0b525a356680022b0af53385944026d3486fc8c013638cf9900eb87c866afb4c"},
-    {file = "Pillow-9.1.1-pp38-pypy38_pp73-macosx_10_10_x86_64.whl", hash = "sha256:6e760cf01259a1c0a50f3c845f9cad1af30577fd8b670339b1659c6d0e7a41dd"},
-    {file = "Pillow-9.1.1-pp38-pypy38_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:a4165205a13b16a29e1ac57efeee6be2dfd5b5408122d59ef2145bc3239fa340"},
-    {file = "Pillow-9.1.1-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:937a54e5694684f74dcbf6e24cc453bfc5b33940216ddd8f4cd8f0f79167f765"},
-    {file = "Pillow-9.1.1-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:baf3be0b9446a4083cc0c5bb9f9c964034be5374b5bc09757be89f5d2fa247b8"},
-    {file = "Pillow-9.1.1.tar.gz", hash = "sha256:7502539939b53d7565f3d11d87c78e7ec900d3c72945d4ee0e2f250d598309a0"},
-]
-pycparser = [
-    {file = "pycparser-2.21-py2.py3-none-any.whl", hash = "sha256:8ee45429555515e1f6b185e78100aea234072576aa43ab53aefcae078162fca9"},
-    {file = "pycparser-2.21.tar.gz", hash = "sha256:e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206"},
-]
-pyfuse3 = [
-    {file = "pyfuse3-3.2.1.tar.gz", hash = "sha256:22d146dac59a8429115e9a93317975ea54b35e0278044a94d3fac5b4ad5f7e33"},
-]
-reportlab = [
-    {file = "reportlab-3.6.9-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:4ba8eebfa4383e4680d6e7e6dba9c45c1fe19bbc0a754db4d84823f1a9511e56"},
-    {file = "reportlab-3.6.9-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:37dda88dbe16dd3f4f9039464637cce66e462c0b95e5763dbd45ac5799136d3a"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:10681d89a0ca37bb4036283fb8c0efac9ac1b22265dbdf350bda0448be33e00c"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cebd0b28a0e875a9ce789514700f80659269ecf2a8fcef0aa10b8ae52b40474a"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1ec84055cf2c83783958b74eadf0e577eb0cd9088c8b5d536e9ddc0f4a9f8c70"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:90f74627cafecf3924741ab8b0690a19df4214eb56b1cfce2dc74a15c9744034"},
-    {file = "reportlab-3.6.9-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b2c2fd861f10b2cd49ccf29a31da9ad5c3b95aa437804e4fd0351ed4eb695f74"},
-    {file = "reportlab-3.6.9-cp310-cp310-win32.whl", hash = "sha256:e492e87886423192af1fafde23907bcd9d2fdccfc22f67e18aa5c73db3a380a3"},
-    {file = "reportlab-3.6.9-cp310-cp310-win_amd64.whl", hash = "sha256:d1bf9455aff37beb421a4447d89d6dd77bb46f677c0bab4eb0272cdb79faad2f"},
-    {file = "reportlab-3.6.9-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:0a7f2b7232c3ffb451b649d55c51a6dd0c8104ad7bbcfe355addf7619705e7fa"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1967dbc9930917d75c39784712a137d432dbc2e5ca9e132a2453319c2619ccff"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:32a5c5cd9625a40feec956f460355b4813bc3187c4f8dc9efd9f1a7f8f854e34"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8cb82b6d14ad4bd915acacc8f114c6a7bab8b9b1503cabb930e433ebd320f90c"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0e767cf4507ca8eed7dde8511f0889b0f19f160a2bdf9ef07742b2aaeceed9f2"},
-    {file = "reportlab-3.6.9-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6a114761ad3ba6e0cdfacf14a8fb2cb8f5713b115ca1f0c17f3cd638d0a5b4bd"},
-    {file = "reportlab-3.6.9-cp37-cp37m-win32.whl", hash = "sha256:bbaab798991863952c593c0459dcb82e0aade837675593310e13cba2ce7fb45a"},
-    {file = "reportlab-3.6.9-cp37-cp37m-win_amd64.whl", hash = "sha256:ab1ffe4ec7be99ad348791116d436610afdc7a9a02a968997f31eaa62eaadad8"},
-    {file = "reportlab-3.6.9-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:496f42840604255ce06777bc129048b3bab966213bbac4f07fbe4ceb6a2e0482"},
-    {file = "reportlab-3.6.9-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:a441afdfe31870b964bccde042d7172ed3c0077f519bbf3ed7d9d34c406b6b91"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4fbe23ac870adf90544d2014c572dba6ec4d772afad6505bb91f171ddad12839"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:de724c78f4eb1363b1195dce85a2a8806e7509b69ac5c842a714d942ea534d63"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:713574da534b6ce73d884f1574c35a565e438af4888fcc75e752f1de02e356a7"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:193671445b4885128d8800d3e416eb2fa4fd89bafae08cc9889c0752fe5ad8c2"},
-    {file = "reportlab-3.6.9-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ff0e014a3a3fe286c642ef51213c41684a156b9ed293ef205e8890bc1dbbfdc7"},
-    {file = "reportlab-3.6.9-cp38-cp38-win32.whl", hash = "sha256:23f5aed2d212096f2fe95d56f868d63f839a08bf7e389237e644d93981274222"},
-    {file = "reportlab-3.6.9-cp38-cp38-win_amd64.whl", hash = "sha256:09b2ca175129a34292399fc4c6a8b1739f6c5946368fcaa6f931d69385b2f720"},
-    {file = "reportlab-3.6.9-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:cb21666fc9edec9716553bfcfe0c30d1bbbe2731910a96f07ec65652974e5f83"},
-    {file = "reportlab-3.6.9-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:d927bf802bf53c1b5a3878a22e9be310900877984e7c436a3a99bdd19cfec4c3"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ce3a3aad287c8532f62223f5720b5504e31abe3dce52a27bd2a25f508c0d846e"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c9a5f63bc381c0f945402ef4c1bccc74a8eed28f6be6596704b1db7d82ec89fe"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:50f8e30f5410efc69b0217261b1f21912888da392a4549e79c7aaaac85f01bfa"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:15294435f786968bcdf1a7a67bcc23a136470b6ea26919497f5c76ff0f653041"},
-    {file = "reportlab-3.6.9-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e9b5e9115363545a727d8ebe7e4b94f7cf6f26113261a269d50d88b8db4eb726"},
-    {file = "reportlab-3.6.9-cp39-cp39-win32.whl", hash = "sha256:e1fc1b1f5d9d1c2e18b5e60602dfa7854b2330ba0efc312ef605abf588abea9c"},
-    {file = "reportlab-3.6.9-cp39-cp39-win_amd64.whl", hash = "sha256:92a6613af9877e3ad2a1c5a16a122514a4f9f8d9b91b1f22e7fa0fa796617b36"},
-    {file = "reportlab-3.6.9.tar.gz", hash = "sha256:5d0cc3682456ad213150f6dbffe7d47eab737d809e517c316103376be548fb84"},
-]
-rmcl = [
-    {file = "rmcl-0.4.2-py3-none-any.whl", hash = "sha256:09534999cd233e5e8db531e51aab87eee7d72aa5a2592bcf100e2d015110cf52"},
-    {file = "rmcl-0.4.2.tar.gz", hash = "sha256:58de4758e7e3cb7acbf28fcfa80f4155252afdfb191beb4ba4aa36961f66cc67"},
-]
-rmfuse = []
-rmrl = [
-    {file = "rmrl-0.2.1-py3-none-any.whl", hash = "sha256:c35b9f20494a6034a16e916d7351575efb3e3f77acabe9094453a7f6013eaa86"},
-    {file = "rmrl-0.2.1.tar.gz", hash = "sha256:c532bef4168350e6ab17cf37c6481dc12b6a78e007c073503f082f36215b71c9"},
-]
-sniffio = [
-    {file = "sniffio-1.2.0-py3-none-any.whl", hash = "sha256:471b71698eac1c2112a40ce2752bb2f4a4814c22a54a3eed3676bc0f5ca9f663"},
-    {file = "sniffio-1.2.0.tar.gz", hash = "sha256:c4666eecec1d3f50960c6bdf61ab7bc350648da6c126e3cf6898d8cd4ddcd3de"},
-]
-sortedcontainers = [
-    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
-    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
-]
-svglib = [
-    {file = "svglib-1.3.0.tar.gz", hash = "sha256:a38998b95d1bb99564dc9dffaf15e4e9453761f2790d2dd4147a4ad5fbac1078"},
-]
-tinycss2 = [
-    {file = "tinycss2-1.1.1-py3-none-any.whl", hash = "sha256:fe794ceaadfe3cf3e686b22155d0da5780dd0e273471a51846d0a02bc204fec8"},
-    {file = "tinycss2-1.1.1.tar.gz", hash = "sha256:b2e44dd8883c360c35dd0d1b5aad0b610e5156c2cb3b33434634e539ead9d8bf"},
-]
-trio = [
-    {file = "trio-0.18.0-py3-none-any.whl", hash = "sha256:a42af0634ba729cbfe8578be058750c6471dac19fbc7167ec6a3ca3f966fb424"},
-    {file = "trio-0.18.0.tar.gz", hash = "sha256:87a66ae61f27fe500c9024926a9ba482c07e1e0f56380b70a264d19c435ba076"},
-]
-webencodings = [
-    {file = "webencodings-0.5.1-py2.py3-none-any.whl", hash = "sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78"},
-    {file = "webencodings-0.5.1.tar.gz", hash = "sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923"},
-]
-xdg = [
-    {file = "xdg-5.1.1-py3-none-any.whl", hash = "sha256:865a7b56ed1d4cd2fce2ead1eddf97360843619757f473cd90b75f1817ca541d"},
-    {file = "xdg-5.1.1.tar.gz", hash = "sha256:aa619f26ccec6088b2a6018721d4ee86e602099b24644a90a8d3308a25acd06c"},
-]
diff --git a/pkgs/tools/filesystems/rmfuse/pyproject.toml b/pkgs/tools/filesystems/rmfuse/pyproject.toml
deleted file mode 100644
index e3f1767b4cf..00000000000
--- a/pkgs/tools/filesystems/rmfuse/pyproject.toml
+++ /dev/null
@@ -1,15 +0,0 @@
-[tool.poetry]
-name = "rmfuse-env"
-version = "0.1.0"
-description = ""
-authors = []
-
-[tool.poetry.dependencies]
-python = "^3.8"
-rmfuse = {git = "https://github.com/rschroll/rmfuse.git", extras = ["pyfuse3"]}
-
-[tool.poetry.dev-dependencies]
-
-[build-system]
-requires = ["poetry-core>=1.0.0"]
-build-backend = "poetry.core.masonry.api"
diff --git a/pkgs/tools/filesystems/rmfuse/update b/pkgs/tools/filesystems/rmfuse/update
deleted file mode 100755
index 77cfe9ff86d..00000000000
--- a/pkgs/tools/filesystems/rmfuse/update
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p poetry poetry2nix.cli
-set -eu
-poetry lock
-poetry2nix lock
diff --git a/pkgs/tools/graphics/argyllcms/default.nix b/pkgs/tools/graphics/argyllcms/default.nix
index 2b17fa796e8..f0602169350 100644
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
 
       LINKFLAGS +=
         ${lib.concatStringsSep " " (map (x: "-L${x}/lib") buildInputs)}
-        -ldl -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
+        -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
         -ljpeg -ltiff -lpng -lssl ;
     '';
   in ''
diff --git a/pkgs/tools/graphics/libyafaray/default.nix b/pkgs/tools/graphics/libyafaray/default.nix
index db48aa678cc..22bbfddbcf5 100644
--- a/pkgs/tools/graphics/libyafaray/default.nix
+++ b/pkgs/tools/graphics/libyafaray/default.nix
@@ -26,6 +26,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-UVBA1vXOuLg4RT+BdF4rhbZ6I9ySeZX0N81gh3MH84I=";
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i \
+      include/geometry/poly_double.h include/noise/noise_generator.h # gcc12
+  '';
+
   preConfigure = ''
     NIX_CFLAGS_COMPILE+=" -isystem ${ilmbase.dev}/include/OpenEXR"
   '';
diff --git a/pkgs/tools/graphics/pikchr/default.nix b/pkgs/tools/graphics/pikchr/default.nix
index aed3d485c4a..d750d243fc3 100644
--- a/pkgs/tools/graphics/pikchr/default.nix
+++ b/pkgs/tools/graphics/pikchr/default.nix
@@ -1,6 +1,9 @@
 { lib
 , stdenv
 , fetchfossil
+, tcl
+
+, enableTcl ? true
 }:
 
 stdenv.mkDerivation {
@@ -19,14 +22,27 @@ stdenv.mkDerivation {
     substituteInPlace Makefile --replace open "test -f"
   '';
 
+  nativeBuildInputs = lib.optional enableTcl tcl.tclPackageHook;
+
+  buildInputs = lib.optional enableTcl tcl;
+
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
+  buildFlags = [ "pikchr" ] ++ lib.optional enableTcl "piktcl";
+
   installPhase = ''
+    runHook preInstall
     install -Dm755 pikchr $out/bin/pikchr
     install -Dm755 pikchr.out $out/lib/pikchr.o
     install -Dm644 pikchr.h $out/include/pikchr.h
+  '' + lib.optionalString enableTcl ''
+    cp -r piktcl $out/lib/piktcl
+  '' + ''
+    runHook postInstall
   '';
 
+  dontWrapTclBinaries = true;
+
   doCheck = true;
   checkTarget = "test";
 
diff --git a/pkgs/tools/graphics/vulkan-cts/default.nix b/pkgs/tools/graphics/vulkan-cts/default.nix
index a5581e7d6f1..003a3c18bfb 100644
--- a/pkgs/tools/graphics/vulkan-cts/default.nix
+++ b/pkgs/tools/graphics/vulkan-cts/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchurl
 , cmake
+, ffmpeg
 , libdrm
 , libglvnd
 , libffi
@@ -29,6 +30,7 @@ let
   # does not search for system-wide installations.
   # It also expects the version specified in the repository, which can be incompatible
   # with the version in nixpkgs (e.g. for SPIRV-Headers), so we don't want to patch in our packages.
+  # The revisions are extracted from https://github.com/KhronosGroup/VK-GL-CTS/blob/main/external/fetch_sources.py#L290
   amber = fetchFromGitHub {
     owner = "google";
     repo = "amber";
@@ -44,43 +46,49 @@ let
   glslang = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
-    rev = "22d39cd684d136a81778cc17a0226ffad40d1cee";
-    hash = "sha256-6LplxN7HOMK1NfeD32P5JAMpCBlouttxLEOT/XTVpLw=";
+    rev = "a0ad0d7067521fff880e36acfb8ce453421c3f25";
+    hash = "sha256-ZKkFHGitLjw5LPJW1TswIJ+KulkrS8C4G3dUF5U/F2c=";
   };
   spirv-tools = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    rev = "b930e734ea198b7aabbbf04ee1562cf6f57962f0";
-    hash = "sha256-NWpFSRoxtYWi+hLUt9gpw0YScM3shcUwv9yUmbivRb0=";
+    rev = "f98473ceeb1d33700d01e20910433583e5256030";
+    hash = "sha256-RSUmfp9QZ7yRbLdFygz9mDfrgUUT8og+ZD9/6VkghMo=";
   };
   spirv-headers = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
-    rev = "36c0c1596225e728bd49abb7ef56a3953e7ed468";
-    hash = "sha256-t1UMJnYONWOtOxc9zUgxr901QFNvqkgurjpFA8UzhYc=";
+    rev = "87d5b782bec60822aa878941e6b13c0a9a954c9b";
+    hash = "sha256-Bv10LM6YXaH2V64oqAcrps23higHzCjlIYYBob5zS4A=";
+  };
+  video-parser = fetchFromGitHub {
+    owner = "nvpro-samples";
+    repo = "vk_video_samples";
+    rev = "7d68747d3524842afaf050c5e00a10f5b8c07904";
+    hash = "sha256-L5IYDm0bLq+NlNrzozu0VQx8zL1na6AhrkjZKxOWSnU=";
   };
   vulkan-docs = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Docs";
-    rev = "135da3a538263ef0d194cab25e2bb091119bdc42";
-    hash = "sha256-VZ8JxIuOEG7IjsVcsJOcC+EQeZbd16/+czLcO9t7dY4=";
+    rev = "9a2e576a052a1e65a5d41b593e693ff02745604b";
+    hash = "sha256-DBA2FeV0G/HI8GUMtGYO52jk7wM4HMlKLDA4b+Wmo+k=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-cts";
-  version = "1.3.4.1";
+  version = "1.3.5.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "VK-GL-CTS";
     rev = "${finalAttrs.pname}-${finalAttrs.version}";
-    hash = "sha256-XUFlYdudyRqa6iupB8N5QkUpumasyLLQEWcr4M4uP1g=";
+    hash = "sha256-RPuhcLJ5Ad41SFPjJBdghcNBPIGzZBeVWTjySWOp0KA=";
   };
 
   outputs = [ "out" "lib" ];
 
   prePatch = ''
-    mkdir -p external/renderdoc/src external/spirv-headers external/vulkan-docs
+    mkdir -p external/renderdoc/src external/spirv-headers external/video-parser external/vulkan-docs
 
     cp -r ${renderdoc} external/renderdoc/src/renderdoc_app.h
 
@@ -89,11 +97,13 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r ${glslang} external/glslang/src
     cp -r ${spirv-tools} external/spirv-tools/src
     cp -r ${spirv-headers} external/spirv-headers/src
+    cp -r ${video-parser} external/video-parser/src
     cp -r ${vulkan-docs} external/vulkan-docs/src
     chmod u+w -R external
   '';
 
   buildInputs = [
+    ffmpeg
     libdrm
     libffi
     libglvnd
diff --git a/pkgs/tools/graphics/wgpu-utils/default.nix b/pkgs/tools/graphics/wgpu-utils/default.nix
index 745640bfa22..ce445ce6a00 100644
--- a/pkgs/tools/graphics/wgpu-utils/default.nix
+++ b/pkgs/tools/graphics/wgpu-utils/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wgpu-utils";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "gfx-rs";
     repo = "wgpu";
     rev = "v${version}";
-    hash = "sha256-Yfq85stS1FWahrwv+8hEFSAGr2eZHJ+/cuNYfIFRi3c=";
+    hash = "sha256-MdomiE/qHpyVFlgH5wGsFDiXIp6p1wHXsAtmlo/XfEg=";
   };
 
-  cargoHash = "sha256-R8x3QfVWyEyz7o9Jzh+XgQKYF8HZMAPwbq847j2LfqY=";
+  cargoHash = "sha256-83iQ/YcItRsTfp73xi5LZF8AyvyAXJCHuNWXgc1wHkM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index 5ebbbe1e118..5850fada2a7 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , libmnl
 , pkg-config
 , writeScript
@@ -8,13 +9,23 @@
 
 stdenv.mkDerivation rec {
   pname = "ethtool";
-  version = "6.0";
+  version = "6.1";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-1URsk95XDOaPOx6mnb+hL8/Wf8GYl/ZV0/GCMeK4GNY=";
+    sha256 = "sha256-xB/Igf+lpAQy0t2CnrRMZKSd7kgucWuqz5Jixk2qj5A=";
   };
 
+  patches = [
+    # Patch that fixes build with musl libc
+    # NOTE remove on next release, since it is applied in upstream
+    (fetchpatch {
+      name = "Fix-build-with-musl-libc.patch";
+      url = "https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/patch/marvell.c?id=41be533331fc3c6b711dbe532405782d3b8be5d1";
+      sha256 = "sha256-CItvt/eeNJkr1sOzaaHZhAnaybDutL9cT2O6XwQll+M=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 03be0c8b3be..806d1bc24bd 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "file";
-  version = "5.43";
+  version = "5.44";
 
   src = fetchurl {
     urls = [
       "https://astron.com/pub/file/${pname}-${version}.tar.gz"
       "https://distfiles.macports.org/file/${pname}-${version}.tar.gz"
     ];
-    sha256 = "sha256-jIAV6Rrg6NAyHZTHgjmJLvnbxwxK3gAIwOlYlKv7GZE=";
+    sha256 = "sha256-N1HH+6jbyDHLjXzIr/IQNUWbjOUVXviwiAon0ChHXzs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index ca12c1f2588..16db1cb2ef1 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -386,9 +386,7 @@ stdenv.mkDerivation rec {
   # save target that grub is compiled for
   grubTarget = if efiSupport
                then "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi"
-               else if inPCSystems
-                    then "${pcSystems.${stdenv.hostPlatform.system}.target}-pc"
-                    else "";
+               else lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc";
 
   doCheck = false;
   enableParallelBuilding = true;
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 2d07932dab2..e4efceea888 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -103,10 +103,7 @@ stdenv.mkDerivation rec {
   ];
 
   # save target that grub is compiled for
-  grubTarget =
-    if inPCSystems
-    then "${pcSystems.${stdenv.hostPlatform.system}.target}-pc"
-    else "";
+  grubTarget = lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc";
 
   doCheck = false;
   # On -j16 races with early header creation:
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
index 051e98862bd..3bde0466cdb 100644
--- a/pkgs/tools/misc/hdf4/default.nix
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchpatch
 , fetchurl
 , fixDarwinDylibNames
@@ -95,13 +96,15 @@ stdenv.mkDerivation rec {
     "NC_TEST-nctest"
   ];
 
-  checkPhase = let excludedTestsRegex = if (excludedTests != [])
-    then "(" + (lib.concatStringsSep "|" excludedTests) + ")"
-    else ""; in ''
-    runHook preCheck
-    ctest -E "${excludedTestsRegex}" --output-on-failure
-    runHook postCheck
-  '';
+  checkPhase =
+    let
+      excludedTestsRegex = lib.optionalString (excludedTests != [ ]) "(${lib.concatStringsSep "|" excludedTests})";
+    in
+    ''
+      runHook preCheck
+      ctest -E "${excludedTestsRegex}" --output-on-failure
+      runHook postCheck
+    '';
 
   outputs = [ "bin" "dev" "out" ];
 
@@ -117,7 +120,7 @@ stdenv.mkDerivation rec {
       szip
       javaSupport
       jdk
-    ;
+      ;
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/hoard/default.nix b/pkgs/tools/misc/hoard/default.nix
index 1eb1080c16b..f44787924d9 100644
--- a/pkgs/tools/misc/hoard/default.nix
+++ b/pkgs/tools/misc/hoard/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hoard";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "Hyde46";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WCyu6vW0l8J2Xh8OGXMXVDBs287m2nPlRHeA0j8uvlk=";
+    sha256 = "sha256-Gm3X6/g5JQJEl7wRvWcO4j5XpROhtfRJ72LNaUeZRGc=";
   };
 
   buildInputs = [ ncurses openssl ]
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-Cku9NnrjWT7VmOCryb0sbCQibG+iU9CHT3Cvd6M/9f4=";
+  cargoHash = "sha256-ZNhUqnsme1rczl3FdFBGGs+vBDFcFEELkPp0/udTfR4=";
 
   meta = with lib; {
     description = "CLI command organizer written in rust";
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 65c88eac4e8..c3a0c5aa906 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -48,16 +48,6 @@ stdenv.mkDerivation rec {
     substituteInPlace src/util/genfsimg --replace "	syslinux " "	true "
   ''; # calling syslinux on a FAT image isn't going to work
 
-  # Workaround '-idirafter' ordering bug in staging-next:
-  #   https://github.com/NixOS/nixpkgs/pull/210004
-  # where libc '-idirafter' gets added after user's idirafter and
-  # breaks.
-  # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-  preConfigure = ''
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] buildPackages.stdenv.hostPlatform.config}=$(< ${buildPackages.stdenv.cc}/nix-support/libc-cflags)
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"]               stdenv.hostPlatform.config}=$(<               ${stdenv.cc}/nix-support/libc-cflags)
-  '';
-
   # not possible due to assembler code
   hardeningDisable = [ "pic" "stackprotector" ];
 
diff --git a/pkgs/tools/misc/lockfile-progs/default.nix b/pkgs/tools/misc/lockfile-progs/default.nix
index e245a05182d..8fdee47befb 100644
--- a/pkgs/tools/misc/lockfile-progs/default.nix
+++ b/pkgs/tools/misc/lockfile-progs/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ liblockfile ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-overflow"
+  ];
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin $out/man/man1
diff --git a/pkgs/tools/misc/mpdscribble/default.nix b/pkgs/tools/misc/mpdscribble/default.nix
index dc446d3f0a1..46bf31ed667 100644
--- a/pkgs/tools/misc/mpdscribble/default.nix
+++ b/pkgs/tools/misc/mpdscribble/default.nix
@@ -28,6 +28,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3wLfQvbwx+OFrCl5vMV7Zps4e4iEYFhqPiVCo5hDqgw=";
   })];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i src/Log.cxx # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config meson ninja ];
   buildInputs = [
     libmpdclient
diff --git a/pkgs/tools/misc/noti/default.nix b/pkgs/tools/misc/noti/default.nix
index bebe77faaa7..40c060b6315 100644
--- a/pkgs/tools/misc/noti/default.nix
+++ b/pkgs/tools/misc/noti/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "noti";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "variadico";
     repo = "noti";
     rev = version;
-    sha256 = "sha256-FhVpw6PJcm0aYQBlN7AUjOkJgCzleOHXIXumSegtxfA=";
+    hash = "sha256-8CHSbKOiWNYqKBU1kqQm5t02DJq0JfoIaPsU6Ylc46E=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index f2a2adca4c7..7bfa19a2855 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.7.2";
+  version = "5.7.4";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-IwkvQ3zKdnZ0lefmRQCxD5aeMw7aFbUzfFQZG7GtXlo=";
+    sha256 = "sha256-HZ771Q1UXnRds6o3EnZMyeu7Lt3IDFVFiUTc5snU0Bo=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   postInstall = ''
+    installManPage pspg.1
     installShellCompletion --bash --cmd pspg bash-completion.sh
   '';
 
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index 7ef202202c1..6d9ff83d75f 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.18.4";
+  version = "0.18.5";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-sCnKnBxZuueH8XgXPqCLrJvS4zUbraz3mZr/2Xn+7YU=";
+    sha256 = "sha256-Y/Nn2jAkz135HxRNpeotoPRvyexG9QgtvIcTdXsj034=";
   };
 
   vendorHash = "sha256-W30f7QYgm+QyLDJICpjMn7mtUIziTR1igThEbv+Aa7M=";
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
index 5b6e6efff36..c3b5ae21f9f 100644
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.9.8r";
+  version = "0.9.8t";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-1nCO8wtARnRCanIEH1XAJBjEnW18Bhm+pcr/EeiRrzY=";
+    sha256 = "sha256-Q6kwGmxDThsaGIzSPhxd/kKz0nORf6K9lUJMU9CdIXU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index 12c411f3ef4..267272b0b66 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -13,18 +13,14 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/src";
 
-  # Workaround '-idirafter' ordering bug in staging-next:
-  #   https://github.com/NixOS/nixpkgs/pull/210004
-  # where libc '-idirafter' gets added after user's idirafter and
-  # breaks.
-  # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-  preConfigure = ''
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] stdenv.hostPlatform.config}=$(< ${stdenv.cc}/nix-support/libc-cflags)
-  '';
-
   buildInputs = [ libbfd zlib libiberty ];
   makeFlags = [ "wimboot.x86_64.efi" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   installPhase = ''
     mkdir -p $out/share/wimboot/
     cp wimboot.x86_64.efi $out/share/wimboot
diff --git a/pkgs/tools/misc/yafetch/default.nix b/pkgs/tools/misc/yafetch/default.nix
index f55926d0ae3..4ebaea963c2 100644
--- a/pkgs/tools/misc/yafetch/default.nix
+++ b/pkgs/tools/misc/yafetch/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./config.h --replace \
       "#include \"ascii/gnu.h\"" "#include \"ascii/nixos.h\""
+
+    sed '1i#include <array>' -i config.h # gcc12
   '';
 
   # Fixes installation path
diff --git a/pkgs/tools/networking/burpsuite/default.nix b/pkgs/tools/networking/burpsuite/default.nix
index 87808b4a223..5d8ab54b162 100644
--- a/pkgs/tools/networking/burpsuite/default.nix
+++ b/pkgs/tools/networking/burpsuite/default.nix
@@ -1,6 +1,6 @@
 { lib, fetchurl, jdk, buildFHSUserEnv, unzip, makeDesktopItem }:
 let
-  version = "2022.12.7";
+  version = "2023.1.2";
 
   src = fetchurl {
     name = "burpsuite.jar";
@@ -8,7 +8,7 @@ let
       "https://portswigger.net/burp/releases/download?productId=100&version=${version}&type=Jar"
       "https://web.archive.org/web/https://portswigger.net/burp/releases/download?productId=100&version=${version}&type=Jar"
     ];
-    sha256 = "2e354c2aadc58267bc282dde462d20b3aca7108077eb141d49f89a16172763cf";
+    sha256 = "620829b1a7bf9228e8671273d2f56f6dee4f16662712bcb4370923cb9d9a7540";
   };
 
   name = "burpsuite-${version}";
diff --git a/pkgs/tools/networking/dsniff/default.nix b/pkgs/tools/networking/dsniff/default.nix
index 8e641ec83e7..5d0c92f2bfb 100644
--- a/pkgs/tools/networking/dsniff/default.nix
+++ b/pkgs/tools/networking/dsniff/default.nix
@@ -60,7 +60,7 @@ in gcc9Stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook rpcsvc-proto ];
   buildInputs = [ glib pcap libtirpc libnsl ];
-  NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ldl -ltirpc";
+  NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ltirpc";
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
   postPatch = ''
     for patch in debian/patches/*.patch; do
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 4d6c54564bb..030de9840fe 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.46.1";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/itziNmIDIuj3sKpB+SEiiwvJqdH5nmTkpFdMSY5L0g=";
+    sha256 = "sha256-S2qccDzS+Kj1tEAUR4a0G/4Eu3DAF7lY7ffxU6aykVU=";
   };
 
-  vendorHash = "sha256-dU9rhYgYgP1qTPR3ykUgyg+B1bBVJwizWooyCpdpnm0=";
+  vendorHash = "sha256-ffkXNE3LkgdCGfO6K9lGxEMxT/9Q1o0m3BMtu6tDHdk=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/grpc_cli/default.nix b/pkgs/tools/networking/grpc_cli/default.nix
new file mode 100644
index 00000000000..b68ff100b70
--- /dev/null
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, automake, cmake, autoconf, curl, numactl }:
+
+stdenv.mkDerivation rec {
+  pname = "grpc_cli";
+  version = "1.46.6";
+  src = fetchFromGitHub {
+    owner = "grpc";
+    repo = "grpc";
+    rev = "v${version}";
+    hash = "sha256-UPenQh6+FBryQiOoeijsXkCZjlMzYljkg2aUtSFJFL4=";
+    fetchSubmodules = true;
+  };
+  nativeBuildInputs = [ automake cmake autoconf ];
+  buildInputs = [ curl numactl ];
+  cmakeFlags = [ "-DgRPC_BUILD_TESTS=ON" ];
+  makeFlags = [ "grpc_cli" ];
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 grpc_cli "$out/bin/grpc_cli"
+
+    runHook postInstall
+  '';
+  meta = with lib; {
+    description = "The command line tool for interacting with grpc services.";
+    homepage = "https://github.com/grpc/grpc";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ doriath ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/networking/ip2unix/default.nix b/pkgs/tools/networking/ip2unix/default.nix
index c4c03cae3a7..fabbbb40e7a 100644
--- a/pkgs/tools/networking/ip2unix/default.nix
+++ b/pkgs/tools/networking/ip2unix/default.nix
@@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "1pl8ayadxb0zzh5s26yschkjhr1xffbzzv347m88f9y0jv34d24r";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i src/dynports/dynports.cc # gcc12
+  '';
+
   nativeBuildInputs = [
     meson ninja pkg-config asciidoc libxslt.bin docbook_xml_dtd_45 docbook_xsl
     libxml2.bin docbook5 python3Packages.pytest python3Packages.pytest-timeout
diff --git a/pkgs/tools/networking/mozillavpn/default.nix b/pkgs/tools/networking/mozillavpn/default.nix
index 3763f2ce194..2702c740dda 100644
--- a/pkgs/tools/networking/mozillavpn/default.nix
+++ b/pkgs/tools/networking/mozillavpn/default.nix
@@ -21,13 +21,13 @@
 
 let
   pname = "mozillavpn";
-  version = "2.13.0";
+  version = "2.13.1";
   src = fetchFromGitHub {
     owner = "mozilla-mobile";
     repo = "mozilla-vpn-client";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-EwHuNJZpTb7oFOKKDv0zWgklUe95Th97KP9G5DqRokA=";
+    hash = "sha256-moXCtAFJyNkotYxBZSRP24tNHy5Rb6YW7mSKHDn9oXk=";
   };
 
   netfilter-go-modules = (buildGoModule {
@@ -40,19 +40,19 @@ let
     inherit src;
     name = "${pname}-${version}-extension-bridge";
     preBuild = "cd extension/bridge";
-    hash = "sha256-q6Wf+jrGjGMiDEmnErnDau6Li64Dyq8t2SN1I4rspBY=";
+    hash = "sha256-/gRP7Th2HnoEQU8psf0797Tq6md4+P5zR13z3U9xlrI=";
   };
   signatureDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}-signature";
     preBuild = "cd signature";
-    hash = "sha256-Dbu4WX2u3uDDUuZzS/hczypSFkQNnvuj2Su2X0QvSN4=";
+    hash = "sha256-IBT7qTNbGVutR90wUhm7+9tLehDfrYDHTDkBz8hD6G0=";
   };
   vpngleanDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}-vpnglean";
     preBuild = "cd vpnglean";
-    hash = "sha256-FDkziDDup+D7Bh+Wclqxn8Dhm/T2DanhjKXIAEFDhzc=";
+    hash = "sha256-vQDXsoKyawdVFIQZfH8LD+ehGk692ZcAwtou4OoqLNI=";
   };
 
 in
diff --git a/pkgs/tools/networking/networkmanager/fortisslvpn/default.nix b/pkgs/tools/networking/networkmanager/fortisslvpn/default.nix
index f7e98b2b92f..1ade86eb5d0 100644
--- a/pkgs/tools/networking/networkmanager/fortisslvpn/default.nix
+++ b/pkgs/tools/networking/networkmanager/fortisslvpn/default.nix
@@ -21,7 +21,7 @@
 stdenv.mkDerivation rec {
   pname = "NetworkManager-fortisslvpn";
   version = "1.4.0";
-  name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
+  name = "${pname}${lib.optionalString withGnome "-gnome"}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
diff --git a/pkgs/tools/networking/networkmanager/iodine/default.nix b/pkgs/tools/networking/networkmanager/iodine/default.nix
index 8c8d0dd6a32..8d09977b4e5 100644
--- a/pkgs/tools/networking/networkmanager/iodine/default.nix
+++ b/pkgs/tools/networking/networkmanager/iodine/default.nix
@@ -5,7 +5,7 @@ let
   pname = "NetworkManager-iodine";
   version = "unstable-2019-11-05";
 in stdenv.mkDerivation {
-  name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
+  name = "${pname}${lib.optionalString withGnome "-gnome"}-${version}";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
diff --git a/pkgs/tools/networking/networkmanager/l2tp/default.nix b/pkgs/tools/networking/networkmanager/l2tp/default.nix
index 11a414a8a6a..cef05f11610 100644
--- a/pkgs/tools/networking/networkmanager/l2tp/default.nix
+++ b/pkgs/tools/networking/networkmanager/l2tp/default.nix
@@ -20,7 +20,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
+  name = "${pname}${lib.optionalString withGnome "-gnome"}-${version}";
   pname = "NetworkManager-l2tp";
   version = "1.20.4";
 
diff --git a/pkgs/tools/networking/networkmanager/sstp/default.nix b/pkgs/tools/networking/networkmanager/sstp/default.nix
index 6b05dcdcd85..3e4fbb36513 100644
--- a/pkgs/tools/networking/networkmanager/sstp/default.nix
+++ b/pkgs/tools/networking/networkmanager/sstp/default.nix
@@ -20,7 +20,7 @@
 stdenv.mkDerivation rec {
   pname = "NetworkManager-sstp";
   version = "1.3.1";
-  name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
+  name = "${pname}${lib.optionalString withGnome "-gnome"}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
diff --git a/pkgs/tools/networking/openconnect/common.nix b/pkgs/tools/networking/openconnect/common.nix
index 146a2fc6ea5..e35c8d71cce 100644
--- a/pkgs/tools/networking/openconnect/common.nix
+++ b/pkgs/tools/networking/openconnect/common.nix
@@ -15,7 +15,7 @@
 , zlib
 , vpnc-scripts
 , PCSC
-, useDefaultExternalBrowser ? true
+, useDefaultExternalBrowser ? stdenv.isLinux && stdenv.buildPlatform == stdenv.hostPlatform # xdg-utils doesn't cross-compile
 , xdg-utils
 , autoreconfHook
 }:
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gmp libxml2 stoken zlib (if useOpenSSL then openssl else gnutls) ]
     ++ lib.optional stdenv.isDarwin PCSC
     ++ lib.optional stdenv.isLinux p11-kit
-    ++ lib.optional (stdenv.isLinux && useDefaultExternalBrowser) xdg-utils;
+    ++ lib.optional useDefaultExternalBrowser xdg-utils;
   nativeBuildInputs = [ pkg-config autoreconfHook ];
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/pingu/default.nix b/pkgs/tools/networking/pingu/default.nix
index 87b20daf979..ca33e486247 100644
--- a/pkgs/tools/networking/pingu/default.nix
+++ b/pkgs/tools/networking/pingu/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pingu";
-  version = "0.0.3";
+  version = "0.0.5";
 
   src = fetchFromGitHub {
     owner = "sheepla";
     repo = "pingu";
     rev = "v${version}";
-    sha256 = "sha256-KYCG3L5x0ZdcyseffB0GoKpLZ/VG/qjMDh10qrLn62Y=";
+    sha256 = "sha256-iAHj6/qaZgpTfrUZZ9qdsjiNMJ2zH0CzhR4TVSC9oLE=";
   };
 
-  vendorSha256 = "sha256-HkESF/aADGPixOeh+osFnjzhpz+/4NIsJOjpyyFF9Eg=";
+  vendorHash = "sha256-xn6la6E0C5QASXxNee1Py/rBs4ls9X/ePeg4Q1e2UyU=";
 
   meta = with lib; {
     description = "Ping command implementation in Go but with colorful output and pingu ascii art";
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index be50397bf1d..4238391fdae 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -53,6 +53,14 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lcrypt";
 
+  # This can probably be removed if version > 2.4.9, as IPX support
+  # has been removed upstream[1].  Just check whether pkgsMusl.ppp
+  # still builds.
+  #
+  # [1]: https://github.com/ppp-project/ppp/commit/c2881a6b71a36d28a89166e82820dc5e711fd775
+  NIX_CFLAGS_COMPILE =
+    lib.optionalString stdenv.hostPlatform.isMusl "-UIPX_CHANGE";
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 73ccdb43fef..9ccf68aa543 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tcpdump";
-  version = "4.99.1";
+  version = "4.99.3";
 
   src = fetchurl {
-    url = "http://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ebNphfsnAxRmGNh8Ss3j4Gi5HFU/uT8CGjN/F1/RDr4=";
+    url = "http://www.tcpdump.org/release/tcpdump-${version}.tar.gz";
+    sha256 = "sha256-rXWm7T3A2XMpRbLlSDy0Hci0tSihaTFeSZxoYZUuc7M=";
   };
 
   postPatch = ''
@@ -17,9 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libpcap ];
 
-  configureFlags = lib.optional
-    (stdenv.hostPlatform != stdenv.buildPlatform)
-    "ac_cv_linux_vers=2";
+  configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "ac_cv_linux_vers=2";
 
   meta = with lib; {
     description = "Network sniffer";
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 3d67bbb0793..bf2587d8c65 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
     "SD_NOTIFY=1"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   installFlags = [
     "sysconfdir=${placeholder "out"}/etc"
   ];
diff --git a/pkgs/tools/networking/uqmi/default.nix b/pkgs/tools/networking/uqmi/default.nix
index 17a55d86b9a..067bc51854a 100644
--- a/pkgs/tools/networking/uqmi/default.nix
+++ b/pkgs/tools/networking/uqmi/default.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ libubox json_c ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=dangling-pointer"
+  ];
+
   meta = with lib; {
     description = "Tiny QMI command line utility";
     homepage = "https://git.openwrt.org/?p=project/uqmi.git;a=summary";
diff --git a/pkgs/tools/networking/wireguard-tools/default.nix b/pkgs/tools/networking/wireguard-tools/default.nix
index b0bc3346526..6d19aea8040 100644
--- a/pkgs/tools/networking/wireguard-tools/default.nix
+++ b/pkgs/tools/networking/wireguard-tools/default.nix
@@ -7,6 +7,7 @@
 , makeWrapper
 , openresolv
 , procps
+, bash
 }:
 
 stdenv.mkDerivation rec {
@@ -24,6 +25,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  buildInputs = [ bash ];
+
   makeFlags = [
     "DESTDIR=$(out)"
     "PREFIX=/"
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index e59715e61f3..f250d6de13f 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -20,16 +20,16 @@ let
 in
 buildGoModule rec {
   pname = "xray";
-  version = "1.7.2";
+  version = "1.7.5";
 
   src = fetchFromGitHub {
     owner = "XTLS";
     repo = "Xray-core";
     rev = "v${version}";
-    sha256 = "sha256-jwCvo6+YXC471VqGWzcrnrLWOSJW2tBKa5SoynQg0Lo=";
+    sha256 = "sha256-WCku/7eczcsGiIuTy0sSQKUKXlH14TpdVg2/ZPdaiHQ=";
   };
 
-  vendorSha256 = "sha256-P2g0MqlBScm6yTnpvL5T6l9ntsb4tK9k3Civ7rTevrE=";
+  vendorSha256 = "sha256-2P7fI7fUnShsAl95mPiJgtr/eobt+DMmaoxZcox0eu8=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index 2d028a0e631..5dc3859de56 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.25.0";
+  version = "2.25.1";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Mu0/mWkdrhaybI0iAB/MuD7UTbDDC73ZMxr8kU7R23I=";
+    sha256 = "sha256-J5vAvF22NKMvvaftfVugWYAP6uM6pcyKEPqRDf+J9A4=";
   };
 
-  vendorHash = "sha256-YDV816jTLAqbSjiKXvbkwPbPCLPplH+NFN1SCVjWcbk=";
+  vendorHash = "sha256-GaESwr7rvDvjQ7zi/LbndiB2lQGmIELTx7wAJitj5kw=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/package-management/nix-index/default.nix b/pkgs/tools/package-management/nix-index/default.nix
index 87714112621..246e7c9c981 100644
--- a/pkgs/tools/package-management/nix-index/default.nix
+++ b/pkgs/tools/package-management/nix-index/default.nix
@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-index";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "bennofs";
     repo = "nix-index";
     rev = "v${version}";
-    sha256 = "sha256-TDGtnSgY897fRm1BWLlQZQa8v6Wu5/JIF4UH+1CZm4U=";
+    sha256 = "sha256-/btQP7I4zpIA0MWEQJVYnR1XhyudPnYD5Qx4vrW+Uq8=";
   };
 
-  cargoSha256 = "sha256-z1lLpZBD4HjO6gLw96wbucfchRgZs26Q8Gl+hpUB1xo=";
+  cargoSha256 = "sha256-CzLBOLtzIYqdWjTDKHVnc1YXXyj1HqvXzoFYHS0qxog=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl curl sqlite ]
diff --git a/pkgs/tools/package-management/repro-get/default.nix b/pkgs/tools/package-management/repro-get/default.nix
index 18eb021d3ef..42b000658c8 100644
--- a/pkgs/tools/package-management/repro-get/default.nix
+++ b/pkgs/tools/package-management/repro-get/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "repro-get";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "reproducible-containers";
     repo = "repro-get";
     rev = "v${version}";
-    sha256 = "sha256-3cvKHwAyPYwR5VlhpPJH+3BK9Kw7dTGOPN1q2RnwsG0=";
+    sha256 = "sha256-2B4jNP58t+cfeHi5pICtB9+NwujRzkhl1d/cPkWlNrk=";
   };
 
-  vendorSha256 = "sha256-ebvtPc0QiP7fNiWYjd7iLG/4iH4DqWV/eaDHvmV/H3Y=";
+  vendorHash = "sha256-GM8sKIZb2G9dBj2RoRO80hQrv8D+hHYo0O9FbBuK780=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix
index c25db9e2d39..7817329f06d 100644
--- a/pkgs/tools/security/aflplusplus/default.nix
+++ b/pkgs/tools/security/aflplusplus/default.nix
@@ -51,6 +51,11 @@ let
         --replace '"clang++"' '"clang++-UNSUPPORTED"'
     '';
 
+    NIX_CFLAGS_COMPILE = [
+      # Needed with GCC 12
+      "-Wno-error=use-after-free"
+    ];
+
     makeFlags = [ "PREFIX=$(out)" ];
     buildPhase = ''
       common="$makeFlags -j$NIX_BUILD_CORES"
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index edb10f384bd..b897fe61871 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -40,6 +40,11 @@ python3.pkgs.buildPythonApplication rec {
     mkdir -p $CHIPSEC_BUILD_LIB/chipsec/helper/linux
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=dangling-pointer"
+  ];
+
   preInstall = lib.optionalString withDriver ''
     mkdir -p $out/${python3.pkgs.python.sitePackages}/drivers/linux
     mv $CHIPSEC_BUILD_LIB/chipsec/helper/linux/chipsec.ko \
diff --git a/pkgs/tools/security/enc/default.nix b/pkgs/tools/security/enc/default.nix
new file mode 100644
index 00000000000..00d6d0211f8
--- /dev/null
+++ b/pkgs/tools/security/enc/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, git
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "enc";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "life4";
+    repo = "enc";
+    rev = "v${version}";
+    sha256 = "Tt+J/MnYJNewSl5UeewS0b47NGW2yzfcVHA5+9UQWSs=";
+  };
+  vendorSha256 = "lB6GkE6prfBG7OCOJ1gm23Ee5+nAgmJg8I9Nqe1fsRw=";
+
+  proxyVendor = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  subPackages = ".";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/life4/enc/version.GitCommit=${version}"
+  ];
+
+  nativeCheckInputs = [ git ];
+
+  postInstall = ''
+    installShellCompletion --cmd enc \
+      --bash <($out/bin/enc completion bash) \
+      --fish <($out/bin/enc completion fish) \
+      --zsh <($out/bin/enc completion zsh)
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/life4/enc";
+    changelog = "https://github.com/life4/enc/releases/tag/v${version}";
+    description = "A modern and friendly alternative to GnuPG";
+    longDescription = ''
+      Enc is a CLI tool for encryption, a modern and friendly alternative to GnuPG.
+      It is easy to use, secure by default and can encrypt and decrypt files using password or encryption keys,
+      manage and download keys, and sign data.
+      Our goal was to make encryption available to all engineers without the need to learn a lot of new words, concepts,
+      and commands. It is the most beginner-friendly CLI tool for encryption, and keeping it that way is our top priority.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ rvnstn ];
+  };
+}
diff --git a/pkgs/tools/security/erosmb/default.nix b/pkgs/tools/security/erosmb/default.nix
index 90165b65816..b7984feac51 100644
--- a/pkgs/tools/security/erosmb/default.nix
+++ b/pkgs/tools/security/erosmb/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "erosmb";
-  version = "0.1.4";
+  version = "0.1.5";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "viktor02";
     repo = "EroSmb";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ThJwBKpxoTwHP84OlVKH62gQ3kfv83J8HNs5Mizi8Ck=";
+    hash = "sha256-9Zs5Z+3JiBiJkV9Ixl5pPmLv0dUT59CT0UkQDsmneWc=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/24.nix
index 0f56c4a8c15..c1f2825e8e9 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -12,11 +12,11 @@ assert guiSupport -> enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.3.7";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-7hY6X7nsmf/BsY5l+u+NCGgAxXE9FaZyq1fTeZ2oNmk=";
+    sha256 = "sha256-HXkVjdAdmSQx3S4/rLif2slxJ/iXhOosthDGAPsMFIM=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -30,19 +30,13 @@ stdenv.mkDerivation rec {
   patches = [
     ./fix-libusb-include-path.patch
     ./tests-add-test-cases-for-import-without-uid.patch
-    ./allow-import-of-previously-known-keys-even-without-UI.patch
+    # TODO: Refresh patch? Doesn't apply on 2.4.0
+    #./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
 
     # Patch for DoS vuln from https://seclists.org/oss-sec/2022/q3/27
     ./v3-0001-Disallow-compressed-signatures-and-certificates.patch
 
-    # Fix regression when using YubiKey devices as smart cards.
-    # See https://dev.gnupg.org/T6070 for details.
-    # Committed upstream, remove this patch when updating to the next release.
-    (fetchpatch {
-      url = "https://dev.gnupg.org/rGf34b9147eb3070bce80d53febaa564164cd6c977?diff=1";
-      sha256 = "sha256-J/PLSz8yiEgtGv+r3BTGTHrikV70AbbHQPo9xbjaHFE=";
-    })
   ];
   postPatch = ''
     sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index c4e910aa035..7f7a1853473 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -13,18 +13,18 @@
 
 buildGoModule rec {
   pname = "gopass";
-  version = "1.15.3";
+  version = "1.15.4";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
   src = fetchFromGitHub {
     owner = "gopasspw";
-    repo = pname;
+    repo = "gopass";
     rev = "v${version}";
-    hash = "sha256-xXXlpr+qwks+hWTPMu9xJVIamLriipzm0XQqOpg8Ipw=";
+    hash = "sha256-Jm5H36DI6Mqdnm34+GUMEYxEefXLxgnwWo4fhKOayxY=";
   };
 
-  vendorHash = "sha256-Tb7eIv2G/VfRP1J6taJjAOtZQakA2pcocZ9kZemcZo0=";
+  vendorHash = "sha256-IJSEU6a3AhA/cVTWXhVtNtvA/D0hyRlqL7pec1Tlyio=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/gopass/git-credential.nix b/pkgs/tools/security/gopass/git-credential.nix
index 9e585e27dc2..f0632291a9a 100644
--- a/pkgs/tools/security/gopass/git-credential.nix
+++ b/pkgs/tools/security/gopass/git-credential.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "git-credential-gopass";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
-    repo = pname;
+    repo = "git-credential-gopass";
     rev = "v${version}";
-    hash = "sha256-x8hf1cZw+Hhizp8/vA8qJ+A6ERJUenjMeiuW8IFb/N0=";
+    hash = "sha256-S97KQ/yCyE1wBDao5KBKWPvoH+DmwpEJRiB6uJCGyFA=";
   };
 
-  vendorHash = "sha256-YZoz7B12/VhWZRTDEVs2P36FrZoZs4OdPJMkR9H7D5I=";
+  vendorHash = "sha256-MLnfTdYR4/1qtnNCUs0TwGf5wMqE+V8jNCefeClQKfw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/gopass/hibp.nix b/pkgs/tools/security/gopass/hibp.nix
index c6db9a1d652..d28db3bca2e 100644
--- a/pkgs/tools/security/gopass/hibp.nix
+++ b/pkgs/tools/security/gopass/hibp.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gopass-hibp";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
-    repo = pname;
+    repo = "gopass-hibp";
     rev = "v${version}";
-    hash = "sha256-KqW1q3CnniNeQFypeZ6x/ov58SOMfAX5P2MMDKjMYBg=";
+    hash = "sha256-tqZVzYO3yKyUxfC+pxG+QuW9GBoPBteOdJMchepZ1jo=";
   };
 
-  vendorHash = "sha256-w1Kxocrwcgn0g6ZBJ7obHraHK397bJltUFkm+/p4H5Y=";
+  vendorHash = "sha256-48KwEcB5KRUwrKCuyNhhuSVRXE3U5/yVYE2xO05AeF8=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/gopass/jsonapi.nix b/pkgs/tools/security/gopass/jsonapi.nix
index f82b00fd201..7ce9c4cc870 100644
--- a/pkgs/tools/security/gopass/jsonapi.nix
+++ b/pkgs/tools/security/gopass/jsonapi.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "gopass-jsonapi";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
-    repo = pname;
+    repo = "gopass-jsonapi";
     rev = "v${version}";
-    hash = "sha256-5thMhZr/ZlMHMKS2ZOyuua1ZfQ2od7QGSDBQsVsf9Os=";
+    hash = "sha256-gizUFoe+oAmEKHMlua/zsR+fUltGw2cp98XAgXzCm0U=";
   };
 
-  vendorHash = "sha256-Gt5nd+3BkNQrdcq5+a70rdBXvCang/2ayZuyyZWON64=";
+  vendorHash = "sha256-vMrP6rC0uPsRyFZdU2E9mPp031eob+36NcGueNP1Y7o=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/gopass/summon.nix b/pkgs/tools/security/gopass/summon.nix
index dc9646ce91d..abb8eb653c5 100644
--- a/pkgs/tools/security/gopass/summon.nix
+++ b/pkgs/tools/security/gopass/summon.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gopass-summon-provider";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
-    repo = pname;
+    repo = "gopass-summon-provider";
     rev = "v${version}";
-    hash = "sha256-YnCX+DDZoKbiwbT8lNvAh0ANNCtEPvaLr9LCvLX8nwo=";
+    hash = "sha256-gwvrwLJTh58PiRsEC3juhnA/q6cX3nRh/hiunKnPvDQ=";
   };
 
-  vendorHash = "sha256-YZoz7B12/VhWZRTDEVs2P36FrZoZs4OdPJMkR9H7D5I=";
+  vendorHash = "sha256-MLnfTdYR4/1qtnNCUs0TwGf5wMqE+V8jNCefeClQKfw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/opencryptoki/default.nix b/pkgs/tools/security/opencryptoki/default.nix
index 140f032a5fd..dcb1c0bb0cb 100644
--- a/pkgs/tools/security/opencryptoki/default.nix
+++ b/pkgs/tools/security/opencryptoki/default.nix
@@ -1,18 +1,36 @@
-{ lib, stdenv, fetchFromGitHub, openssl, trousers, autoreconfHook, libtool, bison, flex }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, bison
+, flex
+, openldap
+, openssl
+, trousers
+}:
 
 stdenv.mkDerivation rec {
   pname = "opencryptoki";
-  version = "3.8.2";
+  version = "3.19.0";
 
   src = fetchFromGitHub {
     owner = "opencryptoki";
     repo = "opencryptoki";
     rev = "v${version}";
-    sha256 = "1rf7cmibmx636vzv7p54g212478a8wim2lfjf2861hfd0m96nv4l";
+    hash = "sha256-ym13I34H3d1JuVBnItkceUbqpjYFhD+mPgWYHPetF7Y=";
   };
 
-  nativeBuildInputs = [ autoreconfHook libtool bison flex ];
-  buildInputs = [ openssl trousers ];
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+  ];
+
+  buildInputs = [
+    openldap
+    openssl
+    trousers
+  ];
 
   postPatch = ''
     substituteInPlace configure.ac \
@@ -20,18 +38,22 @@ stdenv.mkDerivation rec {
       --replace "groupadd" "true" \
       --replace "chmod" "true" \
       --replace "chgrp" "true"
-    substituteInPlace usr/lib/Makefile.am --replace "DESTDIR" "out"
   '';
 
   configureFlags = [
-    "--prefix=$(out)"
+    "--prefix="
     "--disable-ccatok"
     "--disable-icatok"
   ];
 
   enableParallelBuilding = true;
 
+  installFlags = [
+    "DESTDIR=${placeholder "out"}"
+  ];
+
   meta = with lib; {
+    changelog   = "https://github.com/opencryptoki/opencryptoki/blob/${src.rev}/ChangeLog";
     description = "PKCS#11 implementation for Linux";
     homepage    = "https://github.com/opencryptoki/opencryptoki";
     license     = licenses.cpl10;
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 42a4e1ccb75..5c2a2e9b0d8 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "sha256-P/mQoW4lG6U83WEjn5urpFa7q5mN+XOrIOkzf2pslwQ=";
+    sha256 = "sha256-ZNk9bmZwD1aUY3fYT5Qngoq+9qXgvH/nWSWc30st7nE=";
   };
 
-  vendorSha256 = "sha256-Z1iwJXbnSqIu/zo7iKLnh0yy1Dh0e5HwXoBkkt9xaqA=";
+  vendorHash = "sha256-sPpTB3N1w0JppHcwdyLYwSxjzzUAJcBJ5zJ2u4rXXkQ=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 88f39e8a63e..98ac2254fb6 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -29,7 +29,11 @@ stdenv.mkDerivation rec {
     "iasl"
   ];
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  NIX_CFLAGS_COMPILE = [
+    "-O3"
+    # Needed with GCC 12
+    "-Wno-dangling-pointer"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/system/ddrescue/default.nix b/pkgs/tools/system/ddrescue/default.nix
index 829d249da5b..d18225a93b9 100644
--- a/pkgs/tools/system/ddrescue/default.nix
+++ b/pkgs/tools/system/ddrescue/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ddrescue";
-  version = "1.26";
+  version = "1.27";
 
   src = fetchurl {
     url = "mirror://gnu/ddrescue/ddrescue-${version}.tar.lz";
-    sha256 = "sha256-5RPNOpDZgQ392RGX1AqkD23wFZe/tez9+yBd4RJ8VR8=";
+    sha256 = "sha256-OMgMmMWkTxXlNmPkUQCX/WjW7CB1jv3zqSUDfBgyMus=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index de4acffa63e..0e746b0d07a 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i lib/src/facts/glib/load_average_resolver.cc # gcc12
+  '';
+
   CXXFLAGS = lib.optionalString stdenv.cc.isGNU "-fpermissive -Wno-error=catch-value";
   NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lblkid";
 
diff --git a/pkgs/tools/system/kanata/default.nix b/pkgs/tools/system/kanata/default.nix
index 2ef4d13c366..d9b1bc06b20 100644
--- a/pkgs/tools/system/kanata/default.nix
+++ b/pkgs/tools/system/kanata/default.nix
@@ -1,4 +1,5 @@
 { fetchFromGitHub
+, fetchpatch
 , lib
 , rustPlatform
 , withCmd ? false
@@ -6,16 +7,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kanata";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "jtroo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/v3P5C0F/FVPJqJ38dzSnAc7ua2fOs3BeX9BDoQ8bDw=";
+    sha256 = "sha256-mQSbsJ+3mKoDMg0ewwR7UvXUq+5WA9aTPKWCaTz8nDE=";
   };
 
-  cargoHash = "sha256-KXsW0fgbBy0tf/He0vH9Xq8yGuz77H/jeIabgw3ppy8=";
+  cargoHash = "sha256-Pu96OGfnXNaIse/IcwFJWxGMlKOVhZ6DtvgXJkHh+Ao=";
+
+  cargoPatches = [
+    (fetchpatch {
+      name = "serialize-cfg-parsing-tests-for-1.2.0.patch";
+      url = "https://github.com/jtroo/kanata/commit/9ef1e80fbcb40402262e08bd9196d000f73f686d.patch";
+      hash = "sha256-/FhyaYx4usDjGoVfRktf9dtwjY4oXdMQKqxLz00/NPY=";
+    })
+  ];
 
   buildFeatures = lib.optional withCmd "cmd";
 
diff --git a/pkgs/tools/system/rocm-smi/default.nix b/pkgs/tools/system/rocm-smi/default.nix
index 47542d25370..d7e23a9acb0 100644
--- a/pkgs/tools/system/rocm-smi/default.nix
+++ b/pkgs/tools/system/rocm-smi/default.nix
@@ -17,6 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-nkidiDNNU6MGhne9EbYClkODJZw/zZu3LWzlniJKyJE=";
   };
 
+  postPatch = ''
+    sed '1i#include <cstring>' -i src/rocm_smi{,_gpu_metrics}.cc # since gcc12 probably
+  '';
+
   nativeBuildInputs = [ cmake wrapPython ];
 
   patches = [ ./cmake.patch ];
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index 53cb9b876f4..27614de6b28 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.1.6";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bPEEL4t5R/2DnO1IKaTV5NIfT+RL9MVRuoBLlsSPJgM=";
+    hash = "sha256-1AFioXDIh+qQYhhIaQky2SkGd+amnYdOeoNDU+1+poI=";
   };
 
-  vendorHash = "sha256-IKISxtAo9zKV6nLGAUNjtNb/YzRK2QO7Wa4RSNthzPU=";
+  vendorHash = "sha256-PtKKGHzxshahecbfvvo1nGCseap4o8r8raBpFDUSbx4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/dos2unix/default.nix b/pkgs/tools/text/dos2unix/default.nix
index 6a0c5fc57ee..c6c92b876ff 100644
--- a/pkgs/tools/text/dos2unix/default.nix
+++ b/pkgs/tools/text/dos2unix/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dos2unix";
-  version = "7.4.3";
+  version = "7.4.4";
 
   src = fetchurl {
     url = "https://waterlan.home.xs4all.nl/dos2unix/${pname}-${version}.tar.gz";
-    sha256 = "sha256-to20GVba+TOChCOqMFEOAMEtKe9ZFucV6NTmlP5mynI=";
+    sha256 = "sha256-KKhB2wvVgn1kXKup2AFeOnGYPcbjmAcLUofuE3rkQ24=";
   };
 
   nativeBuildInputs = [ perl gettext ];
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index a38251557c0..215f7e7d25b 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -5,6 +5,7 @@
 , autoreconfHook
 , pkg-config
 , texinfo
+, bison
 , bash
 }:
 
@@ -51,7 +52,9 @@ stdenv.mkDerivation rec {
   '';
 
   strictDeps = true;
-  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
+  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ]
+    # Required due to the patch that changes .ypp files.
+    ++ lib.optional (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "9") bison;
   buildInputs = [ perl bash ]
     ++ lib.optionals enableGhostscript [ ghostscript ]
     ++ lib.optionals enableHtml [ psutils netpbm ];
diff --git a/pkgs/tools/text/justify/default.nix b/pkgs/tools/text/justify/default.nix
index 1e18e22db8e..86de7365663 100644
--- a/pkgs/tools/text/justify/default.nix
+++ b/pkgs/tools/text/justify/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-406OhJt2Ila/LIhfqJXhbFqFxJJiRyMVI4/VK8Y43kc=";
   };
 
+  postPatch = ''
+    sed '1i#include <algorithm>' -i src/stringHelper.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   installPhase = ''
diff --git a/pkgs/tools/text/mdbook-katex/default.nix b/pkgs/tools/text/mdbook-katex/default.nix
index ded440fb79c..7b7062a7526 100644
--- a/pkgs/tools/text/mdbook-katex/default.nix
+++ b/pkgs/tools/text/mdbook-katex/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-katex";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-DZ+5rYRHS5m4Alw6/Ak98UH2FD3EPBGDtB+vD0v8EMk=";
+    hash = "sha256-LeI46x5M2ZYUOIxuj9bCNwwucRLvoOkdRhsowmVxS68=";
   };
 
-  cargoHash = "sha256-i6u7kriLFgMSJDfA6JRjTLc3Oi8GfHjE7wEJbTLnMN8=";
+  cargoHash = "sha256-pEwPnE2EpS+0bw3/SSKOCy8R5xUiG6mBMoup6wbrf+0=";
 
   OPENSSL_DIR = "${lib.getDev openssl}";
   OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
diff --git a/pkgs/tools/text/mdbook-pdf/default.nix b/pkgs/tools/text/mdbook-pdf/default.nix
index 020ebdc0ca3..d94382524b9 100644
--- a/pkgs/tools/text/mdbook-pdf/default.nix
+++ b/pkgs/tools/text/mdbook-pdf/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-pdf";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-v57Geqd1YCzR9oM97K+Y9OdeokzNc4Kbh0sDP0+vxjU=";
+    hash = "sha256-822RQKgedxQ+VFNDv20tFUc2Xl56Ivub+/EXNrLRfGM=";
   };
 
-  cargoHash = "sha256-mZUif1qBREM/5GYJU9m20p3rC3fnbZELcEKatwhoQEU=";
+  cargoHash = "sha256-mX2EKjuWM1KW8DXFdYFKQfASjdqZCW78F1twZNQQr7o=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/text/qgrep/default.nix b/pkgs/tools/text/qgrep/default.nix
index 032e9474128..4145ec656d2 100644
--- a/pkgs/tools/text/qgrep/default.nix
+++ b/pkgs/tools/text/qgrep/default.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices CoreFoundation ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=mismatched-new-delete"
+  ];
+
   postPatch = lib.optionalString stdenv.isAarch64 ''
     substituteInPlace Makefile \
       --replace "-msse2" "" --replace "-DUSE_SSE2" ""
diff --git a/pkgs/tools/text/tab/default.nix b/pkgs/tools/text/tab/default.nix
index 0802f7b9836..0ddd7509c9f 100644
--- a/pkgs/tools/text/tab/default.nix
+++ b/pkgs/tools/text/tab/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AhgWeV/ojB8jM16A5ggrOD1YjWfRVcoQbkd3S2bgdyE=";
   };
 
+  # gcc12; see https://github.com/ivan-tkatchev/tab/commit/673bdac998
+  postPatch = ''
+    sed '1i#include <cstring>' -i deps.h
+  '';
+
   nativeCheckInputs = [ python3 ];
 
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/tools/text/unoconv/default.nix b/pkgs/tools/text/unoconv/default.nix
index 9f3375c7e41..50cd3d9411e 100644
--- a/pkgs/tools/text/unoconv/default.nix
+++ b/pkgs/tools/text/unoconv/default.nix
@@ -26,9 +26,9 @@ stdenv.mkDerivation rec {
   postInstall = ''
     sed -i "s|/usr/bin/env python.*|${python3}/bin/${python3.executable}|" "$out/bin/unoconv"
     wrapProgram "$out/bin/unoconv" --set UNO_PATH "${libreoffice-unwrapped}/lib/libreoffice/program/"
-  '' + (if installSymlinks then ''
+  '' + lib.optionalString installSymlinks ''
     make install-links prefix="$out"
-  '' else "");
+  '';
 
   meta = with lib; {
     description = "Convert between any document format supported by LibreOffice/OpenOffice";
diff --git a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
index 61150fa8b7c..c02ca35296e 100644
--- a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
+++ b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
@@ -2,37 +2,47 @@
 1itl: { # no indentation
 $a}
 
-# trash packages we don't want
-/^name .*\./,/^$/d
-
-# quote package names, as some start with a number :-/
-s/^name (.*)/name "\1"/
-
-# extract revision
-s/^revision ([0-9]*)$/  revision = \1;/p
-
 # form an attrmap per package
-/^name /s/^name (.*)/\1 = {/p
-/^$/,1i};
-
-# extract hashes of *.tar.xz
-s/^containerchecksum (.*)/  sha512.run = "\1";/p
-s/^doccontainerchecksum (.*)/  sha512.doc = "\1";/p
-s/^srccontainerchecksum (.*)/  sha512.source = "\1";/p
-/^runfiles /i\  hasRunfiles = true;
-
-# number of path components to strip, defaulting to 1 ("texmf-dist/")
-/^relocated 1/i\  stripPrefix = 0;
-
-# extract version and clean unwanted chars from it
-/^catalogue-version/y/ \/~/_--/
-/^catalogue-version/s/[\#,:\(\)]//g
-s/^catalogue-version_(.*)/  version = "\1";/p
-
-# extract deps
-s/^depend ([^.]*)$/  deps."\1" = tl."\1";/p
-
-# extract hyphenation patterns and formats
-# (this may create duplicate lines, use uniq to remove them)
-/^execute\sAddHyphen/i\  hasHyphens = true;
-/^execute\sAddFormat/i\  hasFormats = true;
+# ignore packages whose name contains "." (such as binaries)
+/^name ([^.]+)$/,/^$/{
+  # quote package names, as some start with a number :-/
+  s/^name (.*)$/"\1" = {/p
+  /^$/,1i};
+
+  # extract revision
+  s/^revision ([0-9]*)$/  revision = \1;/p
+
+  # extract hashes of *.tar.xz
+  s/^containerchecksum (.*)/  sha512.run = "\1";/p
+  s/^doccontainerchecksum (.*)/  sha512.doc = "\1";/p
+  s/^srccontainerchecksum (.*)/  sha512.source = "\1";/p
+  /^runfiles /i\  hasRunfiles = true;
+
+  # number of path components to strip, defaulting to 1 ("texmf-dist/")
+  /^relocated 1/i\  stripPrefix = 0;
+
+  # extract version and clean unwanted chars from it
+  /^catalogue-version/y/ \/~/_--/
+  /^catalogue-version/s/[\#,:\(\)]//g
+  s/^catalogue-version_(.*)/  version = "\1";/p
+
+  # extract deps
+  /^depend [^.]+$/{
+    s/^depend (.+)$/  deps."\1" = tl."\1";/
+
+    # loop through following depend lines
+    :next
+      h ; N     # save & read next line
+      s/\ndepend (.+)\.(.+)$//
+      s/\ndepend (.+)$/\n  deps."\1" = tl."\1";/
+      t next    # loop if the previous lines matched
+
+    x; p; x     # print saved deps
+    s/^.*\n//   # remove deps, resume processing
+  }
+
+  # extract hyphenation patterns and formats
+  # (this may create duplicate lines, use uniq to remove them)
+  /^execute\sAddHyphen/i\  hasHyphens = true;
+  /^execute\sAddFormat/i\  hasFormats = true;
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e21c1487496..c7324ef60e7 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -380,6 +380,7 @@ mapAliases ({
   docker_compose = throw "'docker_compose' has been renamed to/replaced by 'docker-compose'"; # Converted to throw 2022-02-22
   docker-compose_2 = throw "'docker-compose_2' has been renamed to 'docker-compose'"; # Added 2022-06-05
   docker-edge = throw "'docker-edge' has been removed, it was an alias for 'docker'"; # Added 2022-06-05
+  dolphin-emu-beta = dolphin-emu; # Added 2023-02-11
   dolphinEmu = dolphin-emu; # Added 2021-11-10
   dolphinEmuMaster = dolphin-emu-beta; # Added 2021-11-10
   dot-http = throw "'dot-http' has been removed: abandoned by upstream. Use hurl instead."; # Added 2023-01-16
@@ -806,6 +807,7 @@ mapAliases ({
   libpulseaudio-vanilla = libpulseaudio; # Added 2022-04-20
   libqmatrixclient = throw "libqmatrixclient was renamed to libquotient"; # Added 2020-04-09
   libqrencode = throw "'libqrencode' has been renamed to/replaced by 'qrencode'"; # Converted to throw 2022-02-22
+  libraw_unstable = throw "'libraw_unstable' has been removed, please use libraw"; # Added 2023-01-30
   librdf = lrdf; # Added 2020-03-22
   librecad2 = throw "'librecad2' has been renamed to/replaced by 'librecad'"; # Converted to throw 2022-02-22
   libressl_3_2 = throw "'libressl_3_2' has reached end-of-life "; # Added 2022-03-19
@@ -1272,6 +1274,7 @@ mapAliases ({
   pulseaudioLight = throw "'pulseaudioLight' has been renamed to/replaced by 'pulseaudio'"; # Converted to throw 2022-02-22
   pulseeffects = throw "Use pulseeffects-legacy if you use PulseAudio and easyeffects if you use PipeWire"; # Added 2021-02-13
   pulseeffects-pw = easyeffects; # Added 2021-07-07
+  pyls-black = throw "pyls-black has been removed from nixpkgs. Use python-lsp-black instead."; # Added 2023-01-09
   py-wmi-client = throw "py-wmi-client has been removed: abandoned by upstream"; # Added 2022-04-26
   pydb = throw "pydb has been removed: abandoned by upstream"; # Added 2022-04-22
   pyIRCt = throw "pyIRCt has been removed from nixpkgs as it is unmaintained and python2-only";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 83f0e16fabc..8c5cae91ff1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1252,7 +1252,6 @@ with pkgs;
 
   arc_unpacker = callPackage ../tools/archivers/arc_unpacker {
     boost = boost16x; # checkPhase fails with Boost 1.77
-    stdenv = gcc10StdenvCompat;
   };
 
   adminer = callPackage ../servers/adminer { };
@@ -1912,7 +1911,7 @@ with pkgs;
   git-town = callPackage ../applications/version-management/git-town { };
 
   git-trim = callPackage ../applications/version-management/git-trim {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk_11_0.frameworks) IOKit CoreFoundation;
   };
 
   git-up = callPackage ../applications/version-management/git-up {
@@ -2279,9 +2278,7 @@ with pkgs;
 
   ### APPLICATIONS/EMULATORS/DOLPHIN-EMU
 
-  dolphin-emu = callPackage ../applications/emulators/dolphin-emu { };
-
-  dolphin-emu-beta = qt6Packages.callPackage ../applications/emulators/dolphin-emu/master.nix {
+  dolphin-emu = qt6Packages.callPackage ../applications/emulators/dolphin-emu {
     inherit (darwin.apple_sdk_11_0.frameworks) CoreBluetooth ForceFeedback IOKit OpenGL VideoToolbox;
     inherit (darwin) moltenvk;
     stdenv =
@@ -2550,7 +2547,7 @@ with pkgs;
 
   writefreely = callPackage ../applications/misc/writefreely { };
 
-  iqueue = callPackage ../development/libraries/iqueue { stdenv = gcc10StdenvCompat; };
+  iqueue = callPackage ../development/libraries/iqueue { };
 
   lifecycled = callPackage ../tools/misc/lifecycled { };
 
@@ -4924,11 +4921,11 @@ with pkgs;
   };
 
   hyprland = callPackage ../applications/window-managers/hyprwm/hyprland {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   hyprpaper = callPackage ../applications/window-managers/hyprwm/hyprpaper {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   hysteria = callPackage ../tools/networking/hysteria { };
@@ -5148,7 +5145,9 @@ with pkgs;
 
   merriweather-sans = callPackage ../data/fonts/merriweather-sans { };
 
-  meson = callPackage ../development/tools/build-managers/meson { };
+  meson = callPackage ../development/tools/build-managers/meson {
+    inherit (darwin.apple_sdk.frameworks) Foundation OpenGL AppKit Cocoa;
+  };
 
   # while building documentation meson may want to run binaries for host
   # which needs an emulator
@@ -5665,6 +5664,8 @@ with pkgs;
 
   sqlint = callPackage ../development/tools/sqlint { };
 
+  squawk = callPackage ../development/tools/squawk { };
+
   antibody = callPackage ../shells/zsh/antibody { };
 
   antigen = callPackage ../shells/zsh/antigen { };
@@ -7041,6 +7042,8 @@ with pkgs;
     boost = boost172;
   };
 
+  enc = callPackage ../tools/security/enc { };
+
   endlessh = callPackage ../servers/endlessh { };
 
   endlessh-go = callPackage ../servers/endlessh-go { };
@@ -7732,6 +7735,8 @@ with pkgs;
 
   gnucap = callPackage ../applications/science/electronics/gnucap { };
 
+  gnu-cim = callPackage ../development/compilers/gnu-cim { };
+
   gnu-cobol = callPackage ../development/compilers/gnu-cobol { };
 
   gnuclad = callPackage ../applications/graphics/gnuclad { };
@@ -7749,11 +7754,11 @@ with pkgs;
   gnupg1orig = callPackage ../tools/security/gnupg/1.nix { };
   gnupg1compat = callPackage ../tools/security/gnupg/1compat.nix { };
   gnupg1 = gnupg1compat;    # use config.packageOverrides if you prefer original gnupg1
-  gnupg23 = callPackage ../tools/security/gnupg/23.nix {
+  gnupg24 = callPackage ../tools/security/gnupg/24.nix {
     guiSupport = stdenv.isDarwin;
     pinentry = if stdenv.isDarwin then pinentry_mac else pinentry-gtk2;
   };
-  gnupg = gnupg23;
+  gnupg = gnupg24;
 
   gnupg-pkcs11-scd = callPackage ../tools/security/gnupg-pkcs11-scd { };
 
@@ -7940,6 +7945,8 @@ with pkgs;
 
   grpcurl = callPackage ../tools/networking/grpcurl { };
 
+  grpc_cli = callPackage ../tools/networking/grpc_cli { };
+
   grpc-gateway = callPackage ../development/tools/grpc-gateway { };
 
   grpcui = callPackage ../tools/networking/grpcui { };
@@ -9782,7 +9789,13 @@ with pkgs;
     pythonPackages = python3Packages;
   };
 
-  mirakurun = callPackage ../applications/video/mirakurun { };
+  mirakurun = callPackage ../applications/video/mirakurun {
+    yarn = yarn.override { nodejs = nodejs-16_x; };
+    inherit (callPackage ../development/tools/yarn2nix-moretea/yarn2nix {
+      nodejs = nodejs-16_x;
+      yarn = yarn.override { nodejs = nodejs-16_x; };
+    }) mkYarnPackage;
+  };
 
   miredo = callPackage ../tools/networking/miredo { };
 
@@ -10990,8 +11003,7 @@ with pkgs;
 
   pocketbase = callPackage ../servers/pocketbase { };
 
-  podman = callPackage ../applications/virtualization/podman/wrapper.nix { };
-  podman-unwrapped = callPackage ../applications/virtualization/podman { };
+  podman = callPackage ../applications/virtualization/podman { };
 
   podman-compose = python3Packages.callPackage ../applications/virtualization/podman-compose {};
 
@@ -14312,7 +14324,7 @@ with pkgs;
       num =
         if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
         else if (stdenv.targetPlatform.isAarch64 && stdenv.isLinux) then 9
-        else 11;
+        else 12;
       numS = toString num;
     in {
       gcc = pkgs.${"gcc${numS}"};
@@ -14350,7 +14362,8 @@ with pkgs;
   gcc11Stdenv = overrideCC gccStdenv buildPackages.gcc11;
   gcc12Stdenv = overrideCC gccStdenv buildPackages.gcc12;
 
-  gcc10StdenvCompat = if stdenv.cc.isGNU && lib.versions.major stdenv.cc.version == "11" then gcc10Stdenv else stdenv;
+  # Meant for packages that fail with newer than gcc10.
+  gcc10StdenvCompat = if stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11" then gcc10Stdenv else stdenv;
 
   # This is not intended for use in nixpkgs but for providing a faster-running
   # compiler to nixpkgs users by building gcc with reproducibility-breaking
@@ -15005,11 +15018,10 @@ with pkgs;
     recurseIntoAttrs (callPackage ../development/compilers/graalvm/community-edition {
       inherit (darwin.apple_sdk.frameworks) Foundation;
     });
+  graalvm-ce = graalvm11-ce;
   graalvm11-ce = graalvmCEPackages.graalvm11-ce;
   graalvm17-ce = graalvmCEPackages.graalvm17-ce;
-  buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image {
-    graalvm = graalvm11-ce;
-  };
+  buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image { };
 
   openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt { };
 
@@ -15278,7 +15290,7 @@ with pkgs;
   mitama-cpp-result = callPackage ../development/libraries/mitama-cpp-result { };
 
   mitscheme = callPackage ../development/compilers/mit-scheme
-    { stdenv = gcc10StdenvCompat; texLive = texlive.combine { inherit (texlive) scheme-small epsf texinfo; }; };
+    { texLive = texlive.combine { inherit (texlive) scheme-small epsf texinfo; }; };
 
   mitschemeX11 = mitscheme.override {
     enableX11 = true;
@@ -15658,13 +15670,13 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_66 = callPackage ../development/compilers/rust/1_66.nix {
+  rust_1_67 = callPackage ../development/compilers/rust/1_67.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
-    llvm_14 = llvmPackages_14.libllvm;
+    llvm_15 = llvmPackages_15.libllvm;
     # https://github.com/NixOS/nixpkgs/issues/201254
     stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;
   };
-  rust = rust_1_66;
+  rust = rust_1_67;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -15673,8 +15685,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_66 = rust_1_66.packages.stable;
-  rustPackages = rustPackages_1_66;
+  rustPackages_1_67 = rust_1_67.packages.stable;
+  rustPackages = rustPackages_1_67;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -17203,13 +17215,9 @@ with pkgs;
     libc = preLibcCrossHeaders;
   };
 
-  libbfd = callPackage ../development/tools/misc/binutils/libbfd.nix {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  libbfd = callPackage ../development/tools/misc/binutils/libbfd.nix { };
 
-  libopcodes = callPackage ../development/tools/misc/binutils/libopcodes.nix {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  libopcodes = callPackage ../development/tools/misc/binutils/libopcodes.nix { };
 
   # Held back 2.38 release. Remove once all dependencies are ported to 2.39.
   binutils-unwrapped_2_38 = callPackage ../development/tools/misc/binutils/2.38 {
@@ -17541,6 +17549,7 @@ with pkgs;
 
   libgcc = callPackage ../development/libraries/gcc/libgcc {
     stdenvNoLibs = gccStdenvNoLibs; # cannot be built with clang it seems
+    gcc = gcc11; # fails to build with gcc12
   };
 
   # This is for e.g. LLVM libraries on linux.
@@ -19285,7 +19294,7 @@ with pkgs;
 
   cog = callPackage ../development/web/cog { };
 
-  cosmoc = callPackage ../development/tools/cosmoc { };
+  cosmocc = callPackage ../development/tools/cosmocc { };
 
   cosmopolitan = callPackage ../development/libraries/cosmopolitan { };
 
@@ -19458,6 +19467,7 @@ with pkgs;
 
   eccodes = callPackage ../development/libraries/eccodes {
     pythonPackages = python3Packages;
+    stdenv = if stdenv.isDarwin then gccStdenv else stdenv;
   };
 
   eclib = callPackage ../development/libraries/eclib {};
@@ -19560,30 +19570,28 @@ with pkgs;
 
   linbox = callPackage ../development/libraries/linbox { };
 
-  ffmpeg_4-headless = callPackage ../development/libraries/ffmpeg/4.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
-
-    sdlSupport = false;
-    vdpauSupport = false;
-    pulseaudioSupport = false;
-    libva = libva-minimal;
-  };
-
   ffmpeg_4 = callPackage ../development/libraries/ffmpeg/4.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
+    inherit (darwin.apple_sdk.frameworks)
+      Cocoa CoreServices CoreAudio CoreMedia AVFoundation MediaToolbox
+      VideoDecodeAcceleration VideoToolbox;
   };
-
-  ffmpeg_5-headless = callPackage ../development/libraries/ffmpeg/5.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
-
-    sdlSupport = false;
-    vdpauSupport = false;
-    pulseaudioSupport = false;
-    libva = libva-minimal;
+  ffmpeg_4-headless = ffmpeg_4.override {
+    ffmpegVariant = "headless";
+  };
+  ffmpeg_4-full = ffmpeg.override {
+    ffmpegVariant = "full";
   };
 
   ffmpeg_5 = callPackage ../development/libraries/ffmpeg/5.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
+    inherit (darwin.apple_sdk.frameworks)
+      Cocoa CoreServices CoreAudio CoreMedia AVFoundation MediaToolbox
+      VideoDecodeAcceleration VideoToolbox;
+  };
+  ffmpeg_5-headless = ffmpeg_5.override {
+    ffmpegVariant = "headless";
+  };
+  ffmpeg_5-full = ffmpeg_5.override {
+    ffmpegVariant = "full";
   };
 
   # Aliases
@@ -19592,26 +19600,8 @@ with pkgs;
   # Packages which use ffmpeg as a library, should pin to the relevant major
   # version number which the upstream support.
   ffmpeg = ffmpeg_4;
-
   ffmpeg-headless = ffmpeg_4-headless;
-
-  ffmpeg-full = callPackage ../development/libraries/ffmpeg-full {
-    svt-av1 = if stdenv.isAarch64 then null else svt-av1;
-    rtmpdump = null; # Prefer the built-in RTMP implementation
-    # The following need to be fixed on Darwin
-    libjack2 = if stdenv.isDarwin then null else libjack2;
-    libmodplug = if stdenv.isDarwin then null else libmodplug;
-    libmfx = if stdenv.isDarwin then null else intel-media-sdk;
-    libpulseaudio = if stdenv.isDarwin then null else libpulseaudio;
-    samba = if stdenv.isDarwin then null else samba;
-    inherit (darwin.apple_sdk.frameworks)
-      Cocoa CoreServices CoreAudio AVFoundation MediaToolbox
-      VideoDecodeAcceleration VideoToolbox;
-  };
-
-  ffmpeg_5-full = ffmpeg-full.override {
-    ffmpeg = ffmpeg_5;
-  };
+  ffmpeg-full = ffmpeg_4-full;
 
   ffmpegthumbnailer = callPackage ../development/libraries/ffmpegthumbnailer { };
 
@@ -19674,7 +19664,6 @@ with pkgs;
 
   freeimage = callPackage ../development/libraries/freeimage {
     inherit (darwin) autoSignDarwinBinariesHook;
-    libraw = libraw_unstable;
   };
 
   freetts = callPackage ../development/libraries/freetts {
@@ -20626,7 +20615,7 @@ with pkgs;
   lmdbxx = callPackage ../development/libraries/lmdbxx { };
 
   lemon-graph = callPackage ../development/libraries/lemon-graph {
-    stdenv = if stdenv.isLinux then gcc11Stdenv else stdenv;
+    stdenv = if stdenv.isLinux then gcc12Stdenv else stdenv;
   };
 
   levmar = callPackage ../development/libraries/levmar { };
@@ -23637,7 +23626,10 @@ with pkgs;
 
   vte = callPackage ../development/libraries/vte {
     # Needs GCC ≥10 but aarch64 defaults to GCC 9.
-    stdenv = clangStdenv;
+    stdenv =
+      if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU
+      then clangStdenv
+      else stdenv;
   };
 
   vte-gtk4 = vte.override {
@@ -25842,7 +25834,7 @@ with pkgs;
   };
 
   btop = callPackage ../tools/system/btop {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   nmon = callPackage ../os-specific/linux/nmon { };
@@ -26111,7 +26103,6 @@ with pkgs;
   };
 
   libraw = callPackage ../development/libraries/libraw { };
-  libraw_unstable = callPackage ../development/libraries/libraw/unstable.nix { };
 
   libraw1394 = callPackage ../development/libraries/libraw1394 { };
 
@@ -26445,7 +26436,7 @@ with pkgs;
 
   pipework = callPackage ../os-specific/linux/pipework { };
 
-  pktgen = callPackage ../os-specific/linux/pktgen { stdenv = gcc10StdenvCompat; };
+  pktgen = callPackage ../os-specific/linux/pktgen { };
 
   plymouth = callPackage ../os-specific/linux/plymouth { };
 
@@ -26621,7 +26612,7 @@ with pkgs;
     # break some cyclic dependencies
     util-linux = util-linuxMinimal;
     # provide a super minimal gnupg used for systemd-machined
-    gnupg = callPackage ../tools/security/gnupg/23.nix {
+    gnupg = gnupg.override {
       enableMinimal = true;
       guiSupport = false;
     };
@@ -30422,6 +30413,16 @@ with pkgs;
     inherit (perlPackages.override { pkgs = pkgs // { imagemagick = imagemagickBig;}; }) ImageMagick;
   };
 
+  ikiwiki-full = ikiwiki.override {
+    bazaarSupport = false;      # tests broken
+    cvsSupport = true;
+    docutilsSupport = true;
+    gitSupport = true;
+    mercurialSupport = true;
+    monotoneSupport = true;
+    subversionSupport = true;
+  };
+
   iksemel = callPackage ../development/libraries/iksemel {
     texinfo = texinfo6_7; # Uses @setcontentsaftertitlepage, removed in 6.8.
   };
@@ -32112,9 +32113,7 @@ with pkgs;
 
   pavucontrol = callPackage ../applications/audio/pavucontrol { };
 
-  paraview = libsForQt5.callPackage ../applications/graphics/paraview {
-    python3 = python39;
-  };
+  paraview = libsForQt5.callPackage ../applications/graphics/paraview { };
 
   parlatype = callPackage ../applications/audio/parlatype { };
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index b067f5cbbc1..f9aa50a01d7 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -182,9 +182,12 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   inherit (pkgs.callPackages ../os-specific/darwin/xcode { })
     xcode_8_1 xcode_8_2
-    xcode_9_1 xcode_9_2 xcode_9_4 xcode_9_4_1
-    xcode_10_2 xcode_10_2_1 xcode_10_3
-    xcode_11
+    xcode_9_1 xcode_9_2 xcode_9_3 xcode_9_4 xcode_9_4_1
+    xcode_10_1 xcode_10_2 xcode_10_2_1 xcode_10_3
+    xcode_11 xcode_11_1 xcode_11_2 xcode_11_3_1 xcode_11_4 xcode_11_5 xcode_11_6 xcode_11_7
+    xcode_12 xcode_12_0_1 xcode_12_1 xcode_12_2 xcode_12_3 xcode_12_4 xcode_12_5 xcode_12_5_1
+    xcode_13 xcode_13_1 xcode_13_2 xcode_13_3 xcode_13_3_1 xcode_13_4 xcode_13_4_1
+    xcode_14 xcode_14_1
     xcode;
 
   CoreSymbolication = callPackage ../os-specific/darwin/CoreSymbolication { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 04da6d141ee..adf13052e99 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -102,6 +102,7 @@ mapAliases ({
   grpc_google_iam_v1 = grpc-google-iam-v1; # added 2021-08-21
   ha-av = throw "ha-av was removed, because it is no longer maintained"; # added 2022-04-06
   HAP-python = hap-python; # added 2021-06-01
+  hangups = throw "hangups was removed because Google Hangouts has been shut down"; # added 2023-02-13
   hbmqtt = throw "hbmqtt was removed because it is no longer maintained"; # added 2021-11-07
   hdlparse = throw "hdlparse has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-01-18
   hyperkitty = throw "Please use pkgs.mailmanPackages.hyperkitty"; # added 2022-04-29
@@ -156,6 +157,7 @@ mapAliases ({
   pycallgraph = throw "pycallgraph has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-01-18
   pychef = throw "pychef has been removed because it's been archived upstream and abandoned since 2017."; # added 2022-11-14
   pycryptodome-test-vectors = throw "pycryptodome-test-vectors has been removed because it is an internal package to pycryptodome"; # added 2022-05-28
+  pyflunearyou = pyoutbreaksnearme; # added 2023-02-11
   pyialarmxr = pyialarmxr-homeassistant; # added 2022-06-07
   pyialarmxr-homeassistant = throw "The package was removed together with the component support in home-assistant 2022.7.0"; # added 2022-07-07
   PyICU = pyicu; # Added 2022-12-22
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3710c88a2f6..267ceb9b858 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -853,6 +853,8 @@ self: super: with self; {
 
   awslambdaric = callPackage ../development/python-modules/awslambdaric { };
 
+  awswrangler = callPackage ../development/python-modules/awswrangler { };
+
   axis = callPackage ../development/python-modules/axis { };
 
   azure-appconfiguration = callPackage ../development/python-modules/azure-appconfiguration { };
@@ -4240,8 +4242,6 @@ self: super: with self; {
 
   handout = callPackage ../development/python-modules/handout { };
 
-  hangups = callPackage ../development/python-modules/hangups { };
-
   hap-python = callPackage ../development/python-modules/hap-python { };
 
   hass-nabucasa = callPackage ../development/python-modules/hass-nabucasa { };
@@ -4336,6 +4336,10 @@ self: super: with self; {
 
   hiro = callPackage ../development/python-modules/hiro { };
 
+  hist = callPackage ../development/python-modules/hist { };
+
+  histoprint = callPackage ../development/python-modules/histoprint { };
+
   hiyapyco = callPackage ../development/python-modules/hiyapyco { };
 
   hjson = callPackage ../development/python-modules/hjson { };
@@ -5458,8 +5462,6 @@ self: super: with self; {
 
   lightgbm = callPackage ../development/python-modules/lightgbm { };
 
-  lightning = callPackage ../development/python-modules/lightning { };
-
   lightning-utilities  = callPackage ../development/python-modules/lightning-utilities { };
 
   lightparam = callPackage ../development/python-modules/lightparam { };
@@ -6192,6 +6194,8 @@ self: super: with self; {
 
   myst-parser = callPackage ../development/python-modules/myst-parser { };
 
+  n3fit = callPackage ../development/python-modules/n3fit { };
+
   nad-receiver = callPackage ../development/python-modules/nad-receiver { };
 
   nagiosplugin = callPackage ../development/python-modules/nagiosplugin { };
@@ -7267,6 +7271,8 @@ self: super: with self; {
 
   pyorthanc = callPackage ../development/python-modules/pyorthanc { };
 
+  pyoutbreaksnearme = callPackage ../development/python-modules/pyoutbreaksnearme { };
+
   pyoverkiz = callPackage ../development/python-modules/pyoverkiz { };
 
   pyownet = callPackage ../development/python-modules/pyownet { };
@@ -8059,8 +8065,6 @@ self: super: with self; {
 
   pyflume = callPackage ../development/python-modules/pyflume { };
 
-  pyflunearyou = callPackage ../development/python-modules/pyflunearyou { };
-
   pyfma = callPackage ../development/python-modules/pyfma { };
 
   pyfribidi = callPackage ../development/python-modules/pyfribidi { };
@@ -8309,8 +8313,6 @@ self: super: with self; {
 
   pylsqpack = callPackage ../development/python-modules/pylsqpack { };
 
-  pyls-black = callPackage ../development/python-modules/pyls-black { };
-
   pyls-flake8 = callPackage ../development/python-modules/pyls-flake8 { };
 
   pyls-isort = callPackage ../development/python-modules/pyls-isort { };
@@ -9853,6 +9855,8 @@ self: super: with self; {
 
   rapidfuzz-capi = callPackage ../development/python-modules/rapidfuzz-capi { };
 
+  rapt-ble = callPackage ../development/python-modules/rapt-ble { };
+
   rarfile = callPackage ../development/python-modules/rarfile {
     inherit (pkgs) libarchive;
   };
@@ -9943,6 +9947,8 @@ self: super: with self; {
 
   remote-pdb = callPackage ../development/python-modules/remote-pdb { };
 
+  remotezip = callPackage ../development/python-modules/remotezip { };
+
   renault-api = callPackage ../development/python-modules/renault-api { };
 
   rencode = callPackage ../development/python-modules/rencode { };
@@ -11897,6 +11903,8 @@ self: super: with self; {
     inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices;
   };
 
+  uhi = callPackage ../development/python-modules/uhi { };
+
   ujson = callPackage ../development/python-modules/ujson { };
 
   ukkonen = callPackage ../development/python-modules/ukkonen { };
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 83a90a2a5e6..a79dc31ed9d 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -83,6 +83,8 @@ with self; with super; {
     doCheck = false;  # circular dependency with pytest
   });
 
+  wheel = callPackage ../development/python2-modules/wheel { };
+
   zeek = disabled super.zeek;
 
   zipp = callPackage ../development/python2-modules/zipp { };
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index f8139b7dab5..6366b2f2be3 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -116,6 +116,8 @@ in (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdParty // kdeGea
 
   kquickimageedit = callPackage ../development/libraries/kquickimageedit { };
 
+  kuserfeedback = callPackage ../development/libraries/kuserfeedback { };
+
   kweathercore = libsForQt5.callPackage ../development/libraries/kweathercore { };
 
   ldutils = callPackage ../development/libraries/ldutils { };