summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/stdenv/stdenv.chapter.md8
-rw-r--r--lib/systems/doubles.nix2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/databases/redis.nix2
-rw-r--r--nixos/modules/services/games/terraria.nix4
-rw-r--r--nixos/modules/services/misc/gitlab.nix2
-rw-r--r--nixos/modules/services/misc/matrix-synapse.nix2
-rw-r--r--nixos/modules/services/networking/firefox/sync-server.nix2
-rw-r--r--nixos/modules/services/networking/git-daemon.nix2
-rw-r--r--nixos/modules/services/networking/globalprotect-vpn.nix43
-rw-r--r--nixos/modules/services/networking/monero.nix2
-rw-r--r--nixos/modules/services/web-apps/discourse.nix2
-rw-r--r--nixos/modules/services/web-servers/darkhttpd.nix2
-rw-r--r--nixos/modules/services/web-servers/lighttpd/default.nix2
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/kbd-setfont-decompress.nix21
-rw-r--r--pkgs/applications/audio/jamulus/default.nix4
-rw-r--r--pkgs/applications/graphics/ImageMagick/7.0.nix4
-rw-r--r--pkgs/applications/graphics/graphicsmagick/default.nix12
-rw-r--r--pkgs/applications/networking/mailreaders/claws-mail/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix14
-rw-r--r--pkgs/applications/window-managers/sway/bg.nix3
-rw-r--r--pkgs/build-support/bintools-wrapper/ld-wrapper.sh35
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh15
-rw-r--r--pkgs/build-support/wrapper-common/utils.bash35
-rw-r--r--pkgs/data/misc/cacert/default.nix4
-rw-r--r--pkgs/data/misc/shared-mime-info/default.nix41
-rw-r--r--pkgs/data/misc/tzdata/default.nix10
-rw-r--r--pkgs/development/compilers/rust/make-rust-platform.nix2
-rw-r--r--pkgs/development/interpreters/php/generic.nix2
-rw-r--r--pkgs/development/interpreters/spidermonkey/78.nix14
-rw-r--r--pkgs/development/libraries/acl/default.nix4
-rw-r--r--pkgs/development/libraries/expat/default.nix16
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/default.nix18
-rw-r--r--pkgs/development/libraries/glibc/2.32-master.patch.gzbin65492 -> 66850 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix6
-rw-r--r--pkgs/development/libraries/gnutls/default.nix15
-rw-r--r--pkgs/development/libraries/gnutls/fix-gnulib-tests-arm.patch45
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix52
-rw-r--r--pkgs/development/libraries/libaom/default.nix4
-rw-r--r--pkgs/development/libraries/libass/default.nix4
-rw-r--r--pkgs/development/libraries/libedit/default.nix4
-rw-r--r--pkgs/development/libraries/libidn/default.nix14
-rw-r--r--pkgs/development/libraries/libimagequant/default.nix4
-rw-r--r--pkgs/development/libraries/libnftnl/default.nix4
-rw-r--r--pkgs/development/libraries/libpcap/default.nix4
-rw-r--r--pkgs/development/libraries/libpsl/default.nix8
-rw-r--r--pkgs/development/libraries/librsvg/default.nix4
-rw-r--r--pkgs/development/libraries/libtasn1/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix7
-rw-r--r--pkgs/development/libraries/nettle/default.nix4
-rw-r--r--pkgs/development/libraries/nss/default.nix6
-rw-r--r--pkgs/development/libraries/openssl/default.nix2
-rw-r--r--pkgs/development/libraries/popt/default.nix8
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix6
-rw-r--r--pkgs/development/libraries/sqlite/default.nix9
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/webrtc-audio-processing/default.nix2
-rw-r--r--pkgs/development/libraries/webrtc-audio-processing/enable-riscv.patch18
-rw-r--r--pkgs/development/python-modules/certifi/default.nix25
-rw-r--r--pkgs/development/python-modules/django/2.nix4
-rw-r--r--pkgs/development/python-modules/django/3.nix4
-rw-r--r--pkgs/development/python-modules/html-sanitizer/default.nix26
-rw-r--r--pkgs/development/python-modules/markdown/default.nix25
-rw-r--r--pkgs/development/python-modules/pytest-cov/default.nix15
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/urllib3/default.nix4
-rw-r--r--pkgs/development/tools/ginkgo/default.nix4
-rw-r--r--pkgs/games/gemrb/default.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix122
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix19
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix7
-rw-r--r--pkgs/os-specific/linux/kbd/default.nix15
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix4
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/default.nix20
-rw-r--r--pkgs/servers/x11/xorg/default.nix687
-rwxr-xr-xpkgs/servers/x11/xorg/generate-expr-from-tarballs.pl10
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix2
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list8
-rw-r--r--pkgs/stdenv/adapters.nix2
-rw-r--r--pkgs/test/cc-wrapper/default.nix3
-rw-r--r--pkgs/tools/compression/lz4/default.nix13
-rw-r--r--pkgs/tools/compression/zstd/default.nix4
-rw-r--r--pkgs/tools/graphics/gnuplot/default.nix4
-rw-r--r--pkgs/tools/graphics/graphviz/base.nix9
-rw-r--r--pkgs/tools/misc/coreutils/default.nix11
-rw-r--r--pkgs/tools/misc/goreleaser/default.nix6
-rw-r--r--pkgs/tools/networking/burpsuite/default.nix4
-rw-r--r--pkgs/tools/networking/curl/CVE-2021-22897.patch64
-rw-r--r--pkgs/tools/networking/curl/CVE-2021-22898.patch25
-rw-r--r--pkgs/tools/networking/curl/CVE-2021-22901.patch437
-rw-r--r--pkgs/tools/networking/curl/default.nix6
-rw-r--r--pkgs/tools/networking/globalprotect-openconnect/default.nix43
-rw-r--r--pkgs/tools/networking/openconnect/default.nix18
-rw-r--r--pkgs/tools/networking/vpnc-scripts/default.nix41
-rw-r--r--pkgs/tools/security/gau/default.nix6
-rw-r--r--pkgs/tools/security/rhash/default.nix13
-rw-r--r--pkgs/tools/system/gptfdisk/default.nix4
-rw-r--r--pkgs/tools/typesetting/asciidoc/default.nix4
-rw-r--r--pkgs/tools/video/rav1e/default.nix10
-rw-r--r--pkgs/top-level/all-packages.nix13
-rw-r--r--pkgs/top-level/perl-packages.nix2
-rw-r--r--pkgs/top-level/php-packages.nix2
-rw-r--r--pkgs/top-level/static.nix14
108 files changed, 1721 insertions, 635 deletions
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 4daeaf7c8c2..7219b5e80f7 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -463,6 +463,12 @@ The prefix under which the package must be installed, passed via the `--prefix`
 
 The key to use when specifying the prefix. By default, this is set to `--prefix=` as that is used by the majority of packages.
 
+##### `dontAddStaticConfigureFlags`
+
+By default, when building statically, stdenv will try to add build system appropriate configure flags to try to enable static builds.
+
+If this is undesirable, set this variable to true.
+
 ##### `dontAddDisableDepTrack` {#var-stdenv-dontAddDisableDepTrack}
 
 By default, the flag `--disable-dependency-tracking` is added to the configure flags to speed up Automake-based builds. If this is undesirable, set this variable to true.
@@ -475,7 +481,7 @@ By default, the configure phase applies some special hackery to all files called
 
 By default, when the configure script has `--enable-static`, the option `--disable-static` is added to the configure flags.
 
-If this is undesirable, set this variable to true.
+If this is undesirable, set this variable to true.  It is automatically set to true when building statically, for example through `pkgsStatic`.
 
 ##### `configurePlatforms` {#var-stdenv-configurePlatforms}
 
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index c6d90ba9850..61ba7dad7cc 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -96,5 +96,5 @@ in {
 
   embedded      = filterDoubles predicates.isNone;
 
-  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "armv7a-linux" "aarch64-linux" "powerpc64-linux" "powerpc64le-linux" "aarch64-darwin"];
+  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "armv7a-linux" "aarch64-linux" "powerpc64-linux" "powerpc64le-linux" "aarch64-darwin" "riscv64-linux"];
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1a4c2fb719d..625bbeb3bcd 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -696,6 +696,7 @@
   ./services/networking/gdomap.nix
   ./services/networking/ghostunnel.nix
   ./services/networking/git-daemon.nix
+  ./services/networking/globalprotect-vpn.nix
   ./services/networking/gnunet.nix
   ./services/networking/go-neb.nix
   ./services/networking/go-shadowsocks2.nix
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index c4d51958e23..9c0740f28c9 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -52,7 +52,7 @@ in {
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 6379;
         description = "The port for Redis to listen to.";
       };
diff --git a/nixos/modules/services/games/terraria.nix b/nixos/modules/services/games/terraria.nix
index 9e8e5ae8759..7312c7e6b63 100644
--- a/nixos/modules/services/games/terraria.nix
+++ b/nixos/modules/services/games/terraria.nix
@@ -42,7 +42,7 @@ in
       };
 
       port = mkOption {
-        type        = types.int;
+        type        = types.port;
         default     = 7777;
         description = ''
           Specifies the port to listen on.
@@ -50,7 +50,7 @@ in
       };
 
       maxPlayers = mkOption {
-        type        = types.int;
+        type        = types.ints.u8;
         default     = 255;
         description = ''
           Sets the max number of players (between 1 and 255).
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index b4fc4bf4b2c..56f0f50c1dd 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -462,7 +462,7 @@ in {
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8080;
         description = ''
           GitLab server port for copy-paste URLs, e.g. 80 or 443 if you're
diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix
index eedb44fbe12..3c734a94819 100644
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@@ -238,7 +238,7 @@ in {
         type = types.listOf (types.submodule {
           options = {
             port = mkOption {
-              type = types.int;
+              type = types.port;
               example = 8448;
               description = ''
                 The port to listen for HTTP(S) requests on.
diff --git a/nixos/modules/services/networking/firefox/sync-server.nix b/nixos/modules/services/networking/firefox/sync-server.nix
index 6842aa73561..24f76864953 100644
--- a/nixos/modules/services/networking/firefox/sync-server.nix
+++ b/nixos/modules/services/networking/firefox/sync-server.nix
@@ -67,7 +67,7 @@ in
       };
 
       listen.port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 5000;
         description = ''
           Port on which the sync server listen to.
diff --git a/nixos/modules/services/networking/git-daemon.nix b/nixos/modules/services/networking/git-daemon.nix
index 52c895215fb..98f80dd4bc4 100644
--- a/nixos/modules/services/networking/git-daemon.nix
+++ b/nixos/modules/services/networking/git-daemon.nix
@@ -74,7 +74,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 9418;
         description = "Port to listen on.";
       };
diff --git a/nixos/modules/services/networking/globalprotect-vpn.nix b/nixos/modules/services/networking/globalprotect-vpn.nix
new file mode 100644
index 00000000000..80183f55d32
--- /dev/null
+++ b/nixos/modules/services/networking/globalprotect-vpn.nix
@@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.globalprotect;
+
+  execStart = if cfg.csdWrapper == null then
+      "${pkgs.globalprotect-openconnect}/bin/gpservice"
+    else
+      "${pkgs.globalprotect-openconnect}/bin/gpservice --csd-wrapper=${cfg.csdWrapper}";
+in
+
+{
+  options.services.globalprotect = {
+    enable = mkEnableOption "globalprotect";
+
+    csdWrapper = mkOption {
+      description = ''
+        A script that will produce a Host Integrity Protection (HIP) report,
+        as described at <link xlink:href="https://www.infradead.org/openconnect/hip.html" />
+      '';
+      default = null;
+      example = literalExample "\${pkgs.openconnect}/libexec/openconnect/hipreport.sh";
+      type = types.nullOr types.path;
+    };
+  };
+
+  config = {
+    services.dbus.packages = [ pkgs.globalprotect-openconnect ];
+
+    systemd.services.gpservice = {
+      description = "GlobalProtect openconnect DBus service";
+      serviceConfig = {
+        Type="dbus";
+        BusName="com.yuezk.qt.GPService";
+        ExecStart=execStart;
+      };
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/monero.nix b/nixos/modules/services/networking/monero.nix
index 952d1d47ca6..9a9084e4ce1 100644
--- a/nixos/modules/services/networking/monero.nix
+++ b/nixos/modules/services/networking/monero.nix
@@ -110,7 +110,7 @@ in
       };
 
       rpc.port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 18081;
         description = ''
           Port the RPC server will bind to.
diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix
index 49958fc6190..9c7166f381a 100644
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -356,7 +356,7 @@ in
           };
 
           port = lib.mkOption {
-            type = lib.types.int;
+            type = lib.types.port;
             default = 25;
             description = ''
               The port of the SMTP server Discourse should use to
diff --git a/nixos/modules/services/web-servers/darkhttpd.nix b/nixos/modules/services/web-servers/darkhttpd.nix
index d6649fd472d..f6b693139a1 100644
--- a/nixos/modules/services/web-servers/darkhttpd.nix
+++ b/nixos/modules/services/web-servers/darkhttpd.nix
@@ -19,7 +19,7 @@ in {
 
     port = mkOption {
       default = 80;
-      type = ints.u16;
+      type = types.port;
       description = ''
         Port to listen on.
         Pass 0 to let the system choose any free port for you.
diff --git a/nixos/modules/services/web-servers/lighttpd/default.nix b/nixos/modules/services/web-servers/lighttpd/default.nix
index d1cb8a8dc25..7a691aa7891 100644
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@@ -134,7 +134,7 @@ in
 
       port = mkOption {
         default = 80;
-        type = types.int;
+        type = types.port;
         description = ''
           TCP port number for lighttpd to bind to.
         '';
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e8c86394831..abc4d9b9b8f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -201,6 +201,7 @@ in
   jitsi-meet = handleTest ./jitsi-meet.nix {};
   k3s = handleTest ./k3s.nix {};
   kafka = handleTest ./kafka.nix {};
+  kbd-setfont-decompress = handleTest ./kbd-setfont-decompress.nix {};
   keepalived = handleTest ./keepalived.nix {};
   keepassxc = handleTest ./keepassxc.nix {};
   kerberos = handleTest ./kerberos/default.nix {};
diff --git a/nixos/tests/kbd-setfont-decompress.nix b/nixos/tests/kbd-setfont-decompress.nix
new file mode 100644
index 00000000000..c3a495afac8
--- /dev/null
+++ b/nixos/tests/kbd-setfont-decompress.nix
@@ -0,0 +1,21 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+{
+  name = "kbd-setfont-decompress";
+
+  meta.maintainers = with lib.maintainers; [ oxalica ];
+
+  machine = { ... }: {};
+
+  testScript = ''
+    machine.succeed("gzip -cd ${pkgs.terminus_font}/share/consolefonts/ter-v16b.psf.gz >font.psf")
+    machine.succeed("gzip <font.psf >font.psf.gz")
+    machine.succeed("bzip2 <font.psf >font.psf.bz2")
+    machine.succeed("xz <font.psf >font.psf.xz")
+    machine.succeed("zstd <font.psf >font.psf.zst")
+    # setfont returns 0 even on error.
+    assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.gz  2>&1") == ""
+    assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.bz2 2>&1") == ""
+    assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.xz  2>&1") == ""
+    assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.zst 2>&1") == ""
+  '';
+})
diff --git a/pkgs/applications/audio/jamulus/default.nix b/pkgs/applications/audio/jamulus/default.nix
index bf054b118e1..185df48ff6f 100644
--- a/pkgs/applications/audio/jamulus/default.nix
+++ b/pkgs/applications/audio/jamulus/default.nix
@@ -3,12 +3,12 @@
 
 mkDerivation rec {
   pname = "jamulus";
-  version = "3.7.0";
+  version = "3.8.0";
   src = fetchFromGitHub {
     owner = "jamulussoftware";
     repo = "jamulus";
     rev = "r${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-8zCPT0jo4ExgmZWxGinumv3JauH4csM9DtuHmOiJQAM=";
+    sha256 = "sha256-Ni6N7XW34OFNuEkqBEgMcYGmIqb+UZ0uhLt/shRkWRs=";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index d7840a78bb4..e2fdb19127d 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -18,13 +18,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.0.11-12";
+  version = "7.1.0-0";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-vTCfpHcja0z/aplcunUDlg/90EbfrR/xQ9bzdG0n2RY=";
+    sha256 = "sha256-TmyJMzj5tHMrVm6xRguZmXIg7c6mHmqusMMdJAHNqNg=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/graphics/graphicsmagick/default.nix b/pkgs/applications/graphics/graphicsmagick/default.nix
index 583dcf7c618..13752bfc05d 100644
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, bzip2, freetype, graphviz, ghostscript
 , libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
-, libwebp, quantumdepth ? 8, fixDarwinDylibNames }:
+, libwebp, quantumdepth ? 8, fixDarwinDylibNames, nukeReferences }:
 
 stdenv.mkDerivation rec {
   pname = "graphicsmagick";
@@ -27,8 +27,14 @@ stdenv.mkDerivation rec {
       zlib libtool libwebp
     ];
 
-  nativeBuildInputs = [ xz ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [ xz nukeReferences ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+  # Remove CFLAGS from the binaries to avoid closure bloat.
+  # In the past we have had -dev packages in the closure of the binaries soley due to the string references.
+  postConfigure = ''
+    nuke-refs ./magick/magick_config.h
+  '';
 
   postInstall = ''
     sed -i 's/-ltiff.*'\'/\'/ $out/bin/*
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/default.nix b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
index 4a13cf68a88..e28680c245f 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@@ -21,7 +21,7 @@
 , enableLdap ? true, openldap
 , enableNetworkManager ? true, networkmanager
 , enableLibetpan ? true, libetpan
-, enableValgrind ? true, valgrind
+, enableValgrind ? !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind, valgrind
 , enableSvg ? true, librsvg
 
 # Configure claws-mail's plugins
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 53ac8a0d1a0..886f293d105 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.31.1";
+  version = "2.32.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "10367n5sv4nsgaxy486pbp7nscx34vjk8vrb06jm9ffm8ix42qcz";
+    sha256 = "08rnm3ipjqdd2n31dw7mxl3iv9g4nxgc409krmz892a37kd43a38";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -290,11 +290,13 @@ stdenv.mkDerivation {
       fi
     }
 
-    # Shared permissions are forbidden in sandbox builds.
-    disable_test t0001-init shared
+    # Shared permissions are forbidden in sandbox builds:
+    substituteInPlace t/test-lib.sh \
+      --replace "test_set_prereq POSIXPERM" ""
+    # TODO: Investigate while these still fail (without POSIXPERM):
+    disable_test t0001-init 'shared overrides system'
+    disable_test t0001-init 'init honors global core.sharedRepository'
     disable_test t1301-shared-repo
-    disable_test t5324-split-commit-graph 'split commit-graph respects core.sharedrepository'
-    disable_test t4129-apply-samemode 'do not use core.sharedRepository for working tree files'
 
     # Our patched gettext never fallbacks
     disable_test t0201-gettext-fallbacks
diff --git a/pkgs/applications/window-managers/sway/bg.nix b/pkgs/applications/window-managers/sway/bg.nix
index 57b81c7831c..c2740530791 100644
--- a/pkgs/applications/window-managers/sway/bg.nix
+++ b/pkgs/applications/window-managers/sway/bg.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , meson, ninja, pkg-config, scdoc
 , wayland, wayland-protocols, cairo, gdk-pixbuf
+, wayland-scanner
 }:
 
 stdenv.mkDerivation rec {
@@ -14,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "1lmqz5bmig90gq2m7lwf02d2g7z4hzf8fhqz78c8vk92c6p4xwbc";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config scdoc ];
+  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
   buildInputs = [ wayland wayland-protocols cairo gdk-pixbuf ];
 
   mesonFlags = [
diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index e54dd6f4714..2f96480f80c 100644
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -20,15 +20,25 @@ if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-setDynamicLinker=1
 
 # Optionally filter out paths not refering to the store.
 expandResponseParams "$@"
+
+# NIX_LINK_TYPE is set if ld has been called through our cc wrapper. We take
+# advantage of this to avoid both recalculating it, and also repeating other
+# processing cc wrapper has already done.
+if [[ -n "${NIX_LINK_TYPE_@suffixSalt@:-}" ]]; then
+    linkType=$NIX_LINK_TYPE_@suffixSalt@
+else
+    linkType=$(checkLinkType "$@")
+fi
+
 if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
-        && ( -z "$NIX_IGNORE_LD_THROUGH_GCC_@suffixSalt@" || -z "${NIX_LDFLAGS_SET_@suffixSalt@:-}" ) ]]; then
+        && ( -z "$NIX_IGNORE_LD_THROUGH_GCC_@suffixSalt@" || -z "${NIX_LINK_TYPE_@suffixSalt@:-}" ) ]]; then
     rest=()
     nParams=${#params[@]}
     declare -i n=0
+
     while (( "$n" < "$nParams" )); do
         p=${params[n]}
         p2=${params[n+1]:-} # handle `p` being last one
@@ -48,11 +58,6 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
             # Our ld is not built with sysroot support (Can we fix that?)
             :
         else
-            if [[ "$p" = -static || "$p" = -static-pie ]]; then
-                # Using a dynamic linker for static binaries can lead to crashes.
-                # This was observed for rust binaries.
-                setDynamicLinker=0
-            fi
             rest+=("$p")
         fi
         n+=1
@@ -61,22 +66,24 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
     params=(${rest+"${rest[@]}"})
 fi
 
+
 source @out@/nix-support/add-hardening.sh
 
 extraAfter=()
 extraBefore=(${hardeningLDFlags[@]+"${hardeningLDFlags[@]}"})
 
-if [ -z "${NIX_LDFLAGS_SET_@suffixSalt@:-}" ]; then
-    extraAfter+=($NIX_LDFLAGS_@suffixSalt@)
-    extraBefore+=($NIX_LDFLAGS_BEFORE_@suffixSalt@)
+if [ -z "${NIX_LINK_TYPE_@suffixSalt@:-}" ]; then
+    extraAfter+=($(filterRpathFlags "$linkType" $NIX_LDFLAGS_@suffixSalt@))
+    extraBefore+=($(filterRpathFlags "$linkType" $NIX_LDFLAGS_BEFORE_@suffixSalt@))
+
     # By adding dynamic linker to extraBefore we allow the users set their
     # own dynamic linker as NIX_LD_FLAGS will override earlier set flags
-    if [[ "$setDynamicLinker" = 1 && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
+    if [[ "$linkType" == dynamic && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
         extraBefore+=("-dynamic-linker" "$NIX_DYNAMIC_LINKER_@suffixSalt@")
     fi
 fi
 
-extraAfter+=($NIX_LDFLAGS_AFTER_@suffixSalt@)
+extraAfter+=($(filterRpathFlags "$linkType" $NIX_LDFLAGS_AFTER_@suffixSalt@))
 
 # These flags *must not* be pulled up to -Wl, flags, so they can't go in
 # add-flags.sh. They must always be set, so must not be disabled by
@@ -173,7 +180,7 @@ do
     prev="$p"
 done
 
-if [[ "$link32" = "1" && "$setDynamicLinker" = 1 && -e "@out@/nix-support/dynamic-linker-m32" ]]; then
+if [[ "$link32" == "1" && "$linkType" == dynamic && -e "@out@/nix-support/dynamic-linker-m32" ]]; then
     # We have an alternate 32-bit linker and we're producing a 32-bit ELF, let's
     # use it.
     extraAfter+=(
@@ -183,7 +190,7 @@ if [[ "$link32" = "1" && "$setDynamicLinker" = 1 && -e "@out@/nix-support/dynami
 fi
 
 # Add all used dynamic libraries to the rpath.
-if [ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 ]; then
+if [[ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 && "$linkType" != static-pie ]]; then
     # For each directory in the library search path (-L...),
     # see if it contains a dynamic library used by a -l... flag.  If
     # so, add the directory to the rpath.
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 2e62aef4604..aa25de33641 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -29,9 +29,10 @@ cc1=0
 cxxInclude=1
 cxxLibrary=1
 cInclude=1
-setDynamicLinker=1
 
 expandResponseParams "$@"
+linkType=$(checkLinkType "$@")
+
 declare -i n=0
 nParams=${#params[@]}
 while (( "$n" < "$nParams" )); do
@@ -60,8 +61,6 @@ while (( "$n" < "$nParams" )); do
         cxxInclude=0
     elif [ "$p" = -nostdinc++ ]; then
         cxxInclude=0
-    elif [[ "$p" = -static || "$p" = -static-pie ]]; then
-        setDynamicLinker=0
     elif [[ "$p" != -?* ]]; then
         # A dash alone signifies standard input; it is not a flag
         nonFlagArgs=1
@@ -151,24 +150,24 @@ if [ "$dontLink" != 1 ]; then
 
     # Add the flags that should only be passed to the compiler when
     # linking.
-    extraAfter+=($NIX_CFLAGS_LINK_@suffixSalt@)
+    extraAfter+=($(filterRpathFlags "$linkType" $NIX_CFLAGS_LINK_@suffixSalt@))
 
     # Add the flags that should be passed to the linker (and prevent
     # `ld-wrapper' from adding NIX_LDFLAGS_@suffixSalt@ again).
-    for i in $NIX_LDFLAGS_BEFORE_@suffixSalt@; do
+    for i in $(filterRpathFlags "$linkType" $NIX_LDFLAGS_BEFORE_@suffixSalt@); do
         extraBefore+=("-Wl,$i")
     done
-    if [[ "$setDynamicLinker" = 1 && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
+    if [[ "$linkType" == dynamic && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
         extraBefore+=("-Wl,-dynamic-linker=$NIX_DYNAMIC_LINKER_@suffixSalt@")
     fi
-    for i in $NIX_LDFLAGS_@suffixSalt@; do
+    for i in $(filterRpathFlags "$linkType" $NIX_LDFLAGS_@suffixSalt@); do
         if [ "${i:0:3}" = -L/ ]; then
             extraAfter+=("$i")
         else
             extraAfter+=("-Wl,$i")
         fi
     done
-    export NIX_LDFLAGS_SET_@suffixSalt@=1
+    export NIX_LINK_TYPE_@suffixSalt@=$linkType
 fi
 
 # As a very special hack, if the arguments are just `-v', then don't
diff --git a/pkgs/build-support/wrapper-common/utils.bash b/pkgs/build-support/wrapper-common/utils.bash
index f773270f7de..cb3552ebc54 100644
--- a/pkgs/build-support/wrapper-common/utils.bash
+++ b/pkgs/build-support/wrapper-common/utils.bash
@@ -129,3 +129,38 @@ expandResponseParams() {
         fi
     done
 }
+
+checkLinkType() {
+    local arg mode
+    type="dynamic"
+    for arg in "$@"; do
+        if [[ "$arg" = -static ]]; then
+            type="static"
+        elif [[ "$arg" = -static-pie ]]; then
+            type="static-pie"
+        fi
+    done
+    echo "$type"
+}
+
+# When building static-pie executables we cannot have rpath
+# set. At least glibc requires rpath to be empty
+filterRpathFlags() {
+    local linkType=$1 ret="" i
+    shift
+
+    if [[ "$linkType" == "static-pie" ]]; then
+        while [[ "$#" -gt 0 ]]; do
+            i="$1"; shift 1
+            if [[ "$i" == -rpath ]]; then
+                # also skip its argument
+                shift
+            else
+                ret+="$i "
+            fi
+        done
+    else
+        ret=$@
+    fi
+    echo $ret
+}
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 17bb30a54b8..b4a8ebc4ef2 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -10,7 +10,7 @@
 with lib;
 
 let
-  version = "3.63";
+  version = "3.66";
 
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 in
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
-    sha256 = "0892xbjcaw6g4rd2rs4qa37nbda248cjrgxa4faaw0licbpjyb8q";
+    sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
   };
 
   certdata2pem = fetchurl {
diff --git a/pkgs/data/misc/shared-mime-info/default.nix b/pkgs/data/misc/shared-mime-info/default.nix
index c69a9802c0c..a2e301f40ec 100644
--- a/pkgs/data/misc/shared-mime-info/default.nix
+++ b/pkgs/data/misc/shared-mime-info/default.nix
@@ -1,8 +1,11 @@
-{ lib, stdenv
-, fetchurl
+{ stdenv
+, lib
+, fetchFromGitLab
+, fetchpatch
+, meson
+, ninja
 , pkg-config
 , gettext
-, perlPackages
 , itstool
 , libxml2
 , glib
@@ -10,31 +13,47 @@
 
 stdenv.mkDerivation rec {
   pname = "shared-mime-info";
-  version = "1.13.1";
+  version = "2.1";
 
-  src = fetchurl {
-    url = "https://gitlab.freedesktop.org/xdg/${pname}/uploads/5349e18c86eb96eee258a5c1f19122d0/${pname}-${version}.tar.xz";
-    sha256 = "1bic8z5nz08qxv1x6zlxnx2j4cmlzm12kygrn3rrh1djqxdhma3f";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "xdg";
+    repo = pname;
+    rev = version;
+    sha256 = "07bxv44p43pqq4ymfnyy50yli7lwdqymhvclna42rkn1cazq3vb5";
   };
 
+  patches = [
+    # xmlto is only used for building the docs, which are not installed anyways.
+    (fetchpatch {
+      name = "xmlto-optional.patch";
+      url = "https://gitlab.freedesktop.org/xdg/shared-mime-info/-/merge_requests/110.patch";
+      sha256 = "0p5gxlcmn8ji5bc7pd105s1halqwa1d28lfx9yj43rn6mav7allx";
+    })
+  ];
+
   nativeBuildInputs = [
+    meson
+    ninja
     pkg-config
     gettext
     itstool
-  ] ++ (with perlPackages; [
-    perl XMLParser
-  ]);
+  ];
 
   buildInputs = [
     libxml2
     glib
   ];
 
+  mesonFlags = [
+    "-Dupdate-mimedb=true"
+  ];
+
   meta = with lib; {
     description = "A database of common MIME types";
     homepage = "http://freedesktop.org/wiki/Software/shared-mime-info";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = [ maintainers.mimame ];
+    maintainers = teams.freedesktop.members ++ [ maintainers.mimame ];
   };
 }
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 7ab25da3cc4..aa3d9e787b6 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2020f";
+  version = "2021a";
 
   srcs =
     [ (fetchurl {
         url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-        sha256 = "10b8cr55x6ji14n3kqkn3avj1s9b79b8gszh81fxrrisij8k248j";
+        sha256 = "022fn6gkmp7pamlgab04x0dm5hnyn2m2fcnyr3pvm36612xd5rrr";
       })
       (fetchurl {
         url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-        sha256 = "1i998crd9fxdfhv4jd241j1arx0ng7j7cvczpmj4y5j5fwmfmvng";
+        sha256 = "1l02b0jiwp3fl0xd6227i69d26rmx3yrnq0ssq9vvdmm4jhvyipb";
       })
     ];
 
@@ -68,6 +68,10 @@ stdenv.mkDerivation rec {
     homepage = "http://www.iana.org/time-zones";
     description = "Database of current and historical time zones";
     changelog = "https://github.com/eggert/tz/blob/${version}/NEWS";
+    license = with licenses; [
+      bsd3 # tzcode
+      publicDomain # tzdata
+    ];
     platforms = platforms.all;
     maintainers = with maintainers; [ fpletz ];
   };
diff --git a/pkgs/development/compilers/rust/make-rust-platform.nix b/pkgs/development/compilers/rust/make-rust-platform.nix
index 53ce0391e45..b7379ac6772 100644
--- a/pkgs/development/compilers/rust/make-rust-platform.nix
+++ b/pkgs/development/compilers/rust/make-rust-platform.nix
@@ -8,10 +8,12 @@ rec {
   };
 
   fetchCargoTarball = buildPackages.callPackage ../../../build-support/rust/fetchCargoTarball.nix {
+    git = buildPackages.gitMinimal;
     inherit cargo;
   };
 
   buildRustPackage = callPackage ../../../build-support/rust {
+    git = buildPackages.gitMinimal;
     inherit cargoBuildHook cargoCheckHook cargoInstallHook cargoSetupHook
       fetchCargoTarball importCargoLock rustc;
   };
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index d86ea48afe1..c139e17ff0f 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -28,7 +28,7 @@ let
     , embedSupport ? false
     , ipv6Support ? true
     , systemdSupport ? stdenv.isLinux
-    , valgrindSupport ? !stdenv.isDarwin
+    , valgrindSupport ? !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind
     , ztsSupport ? apxs2Support
     }@args:
 
diff --git a/pkgs/development/interpreters/spidermonkey/78.nix b/pkgs/development/interpreters/spidermonkey/78.nix
index 23f24ca8ba4..9b81dcc55e7 100644
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , autoconf213
 , pkg-config
 , perl
@@ -20,13 +21,22 @@
 
 stdenv.mkDerivation rec {
   pname = "spidermonkey";
-  version = "78.8.0";
+  version = "78.11.0";
 
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha256 = "0451hhjrj9hb6limxim7sbhvw4gs6dd2gmnfxjjx07z3wbgdzwhw";
+    sha256 = "0zjpzkxx3wc2840d7q4b9lnkj1kwk1qps29s9c83jf5y6xclnf9q";
   };
 
+  patches = [
+    # Fix build failure on armv7l using Debian patch
+    # Upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1526653
+    (fetchpatch {
+      url = "https://salsa.debian.org/mozilla-team/firefox/commit/fd6847c9416f9eebde636e21d794d25d1be8791d.patch";
+      sha256 = "02b7zwm6vxmk61aj79a6m32s1k5sr0hwm3q1j4v6np9jfyd10g1j";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
   setOutputFlags = false; # Configure script only understands --includedir
 
diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index e0b1f05516c..936e793cafe 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -6,11 +6,11 @@
 # files.
 
 stdenv.mkDerivation rec {
-  name = "acl-2.3.0";
+  name = "acl-2.3.1";
 
   src = fetchurl {
     url = "mirror://savannah/acl/${name}.tar.gz";
-    sha256 = "sha256-vTj9u7A8eTdK9RRn6+VJfLwDNbgld/MMlRpBqVtTMAk=";
+    sha256 = "sha256-dgxhxokBs3/dXu/ur0wMeia9/disdHoe3/HODiQ8Ea8=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index ba9fb2b177d..fe30b701ed0 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -5,14 +5,13 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let
-  version = "2.2.10";
-in stdenv.mkDerivation rec {
-  name = "expat-${version}";
+stdenv.mkDerivation rec {
+  pname = "expat";
+  version = "2.4.1";
 
   src = fetchurl {
-    url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${name}.tar.xz";
-    sha256 = "sha256-Xf5Tj4tbY/A+mO2sUg19mmpNIuSC5cltTQb8xUhcJfI=";
+    url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
+    sha256 = "sha256-zwMtDbqbkoY2VI4ysyei1msaq2PE9KE90TLC0dLy+2o=";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
@@ -25,12 +24,11 @@ in stdenv.mkDerivation rec {
   doCheck = true; # not cross;
 
   preCheck = ''
-    patchShebangs ./run.sh
-    patchShebangs ./test-driver-wrapper.sh
+    patchShebangs ./configure ./run.sh ./test-driver-wrapper.sh
   '';
 
   meta = with lib; {
-    homepage = "http://www.libexpat.org/";
+    homepage = "https://libexpat.github.io/";
     description = "A stream-oriented XML parser library written in C";
     platforms = platforms.all;
     license = licenses.mit; # expat version
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index fd2d62a032c..7f63d5f67e7 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -22,11 +22,16 @@
 , lib
 }:
 
+let
+  withGtkDoc = stdenv.buildPlatform == stdenv.hostPlatform;
+in
 stdenv.mkDerivation rec {
   pname = "gdk-pixbuf";
   version = "2.42.6";
 
-  outputs = [ "out" "dev" "man" "devdoc" "installedTests" ];
+  outputs = [ "out" "dev" "man" ]
+    ++ lib.optional withGtkDoc "devdoc"
+    ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) "installedTests";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
@@ -63,8 +68,8 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
-    "-Dintrospection=${if gobject-introspection != null then "enabled" else "disabled"}"
+    "-Dgtk_doc=${lib.boolToString withGtkDoc}"
+    "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
     "-Dgio_sniffing=false"
   ];
 
@@ -85,9 +90,6 @@ stdenv.mkDerivation rec {
       moveToOutput "bin" "$dev"
       moveToOutput "bin/gdk-pixbuf-thumbnailer" "$out"
 
-      # So that devhelp can find this.
-      mkdir -p "$devdoc/share/devhelp"
-      mv "$out/share/doc" "$devdoc/share/devhelp/books"
     '' + lib.optionalString stdenv.isDarwin ''
       # meson erroneously installs loaders with .dylib extension on Darwin.
       # Their @rpath has to be replaced before gdk-pixbuf-query-loaders looks at them.
@@ -98,6 +100,10 @@ stdenv.mkDerivation rec {
     '' + lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
       # We need to install 'loaders.cache' in lib/gdk-pixbuf-2.0/2.10.0/
       $dev/bin/gdk-pixbuf-query-loaders --update-cache
+    '' + lib.optionalString withGtkDoc ''
+      # So that devhelp can find this.
+      mkdir -p "$devdoc/share/devhelp"
+      mv "$out/share/doc" "$devdoc/share/devhelp/books"
     '';
 
   # The fixDarwinDylibNames hook doesn't patch binaries.
diff --git a/pkgs/development/libraries/glibc/2.32-master.patch.gz b/pkgs/development/libraries/glibc/2.32-master.patch.gz
index 2fda4294130..8ea998b5bea 100644
--- a/pkgs/development/libraries/glibc/2.32-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.32-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 888548d79f0..93f8f7a8641 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -42,7 +42,7 @@
 
 let
   version = "2.32";
-  patchSuffix = "-46";
+  patchSuffix = "-48";
   sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in
 
@@ -61,7 +61,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.32/master && git describe
-          glibc-2.32-46-g1799ac8eab
+          glibc-2.32-48-g16949aeaa0
           $ git show --minimal --reverse glibc-2.32.. | gzip -9n --rsyncable - > 2.32-master.patch.gz
 
          To compare the archive contents zdiff can be used.
@@ -153,6 +153,8 @@ stdenv.mkDerivation ({
       "--enable-add-ons"
       "--sysconfdir=/etc"
       "--enable-stackguard-randomization"
+      "--enable-static-pie"
+      "--enable-bind-now"
       (lib.withFeatureAs withLinuxHeaders "headers" "${linuxHeaders}/include")
       (lib.enableFeature profilingLibraries "profile")
     ] ++ lib.optionals withLinuxHeaders [
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 2d9d280ba75..4c4094987dd 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -8,23 +8,22 @@
 
 assert guileBindings -> guile != null;
 let
-  version = "3.7.1";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
   # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
-  doCheck = !stdenv.isFreeBSD && !stdenv.isDarwin && lib.versionAtLeast version "3.4"
+  doCheck = !stdenv.isFreeBSD && !stdenv.isDarwin
       && stdenv.buildPlatform == stdenv.hostPlatform;
 
   inherit (stdenv.hostPlatform) isDarwin;
 in
 
-stdenv.mkDerivation {
-  name = "gnutls-${version}";
-  inherit version;
+stdenv.mkDerivation rec {
+  pname = "gnutls";
+  version = "3.7.2";
 
   src = fetchurl {
-    url = "mirror://gnupg/gnutls/v3.7/gnutls-${version}.tar.xz";
-    sha256 = "0vxcbig87sdc73h58pmcpbi4al1zgcxid1jn67mhcpna7sbdfxrp";
+    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
+    sha256 = "646e6c5a9a185faa4cea796d378a1ba8e1148dbb197ca6605f95986a25af2752";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -42,7 +41,7 @@ stdenv.mkDerivation {
   #  - trust-store: default trust store path (/etc/ssl/...) is missing in sandbox (3.5.11)
   #  - psk-file: no idea; it broke between 3.6.3 and 3.6.4
   # Change p11-kit test to use pkg-config to find p11-kit
-  postPatch = lib.optionalString (lib.versionAtLeast version "3.6") ''
+  postPatch = ''
     sed '2iexit 77' -i tests/{pkgconfig,fastopen}.sh
     sed '/^void doit(void)/,/^{/ s/{/{ exit(77);/' -i tests/{trust-store,psk-file}.c
     sed 's:/usr/lib64/pkcs11/ /usr/lib/pkcs11/ /usr/lib/x86_64-linux-gnu/pkcs11/:`pkg-config --variable=p11_module_path p11-kit-1`:' -i tests/p11-kit-trust.sh
diff --git a/pkgs/development/libraries/gnutls/fix-gnulib-tests-arm.patch b/pkgs/development/libraries/gnutls/fix-gnulib-tests-arm.patch
deleted file mode 100644
index 5a222a9cb88..00000000000
--- a/pkgs/development/libraries/gnutls/fix-gnulib-tests-arm.patch
+++ /dev/null
@@ -1,45 +0,0 @@
->From 175e0bc72808d564074c4adcc72aeadb74adfcc6 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Thu, 27 Aug 2020 17:52:58 -0700
-Subject: [PATCH] perror, strerror_r: remove unportable tests
-
-Problem reported by Florian Weimer in:
-https://lists.gnu.org/r/bug-gnulib/2020-08/msg00220.html
-* tests/test-perror2.c (main):
-* tests/test-strerror_r.c (main): Omit unportable tests.
----
- tests/test-perror2.c    | 3 ---
- tests/test-strerror_r.c | 3 ---
- 2 files changed, 6 deletions(-)
-
-diff --git a/gl/tests/test-perror2.c b/gl/tests/test-perror2.c
-index 1d14eda7b..c6214dd25 100644
---- a/gl/tests/test-perror2.c
-+++ b/gl/tests/test-perror2.c
-@@ -79,9 +79,6 @@ main (void)
-     errno = -5;
-     perror ("");
-     ASSERT (!ferror (stderr));
--    ASSERT (msg1 == msg2 || msg1 == msg4 || STREQ (msg1, str1));
--    ASSERT (msg2 == msg4 || STREQ (msg2, str2));
--    ASSERT (msg3 == msg4 || STREQ (msg3, str3));
-     ASSERT (STREQ (msg4, str4));
- 
-     free (str1);
-diff --git a/gl/tests/test-strerror_r.c b/gl/tests/test-strerror_r.c
-index b11d6fd9f..c1dbcf837 100644
---- a/gl/tests/test-strerror_r.c
-+++ b/gl/tests/test-strerror_r.c
-@@ -165,9 +165,6 @@ main (void)
- 
-     strerror_r (EACCES, buf, sizeof buf);
-     strerror_r (-5, buf, sizeof buf);
--    ASSERT (msg1 == msg2 || msg1 == msg4 || STREQ (msg1, str1));
--    ASSERT (msg2 == msg4 || STREQ (msg2, str2));
--    ASSERT (msg3 == msg4 || STREQ (msg3, str3));
-     ASSERT (STREQ (msg4, str4));
- 
-     free (str1);
--- 
-2.17.1
-
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index d2287526278..db142286fe4 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -1,30 +1,44 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, glib, freetype, cairo, libintl
-, meson, ninja
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, glib
+, freetype
+, fontconfig
+, libintl
+, meson
+, ninja
 , gobject-introspection
-, icu, graphite2, harfbuzz # The icu variant uses and propagates the non-icu one.
-, ApplicationServices, CoreText
+, icu
+, graphite2
+, harfbuzz # The icu variant uses and propagates the non-icu one.
+, ApplicationServices
+, CoreText
 , withCoreText ? false
 , withIcu ? false # recommended by upstream as default, but most don't needed and it's big
 , withGraphite2 ? true # it is small and major distros do include it
 , python3
-, gtk-doc, docbook-xsl-nons, docbook_xml_dtd_43
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_43
 }:
 
 let
-  version = "2.8.0";
+  version = "2.8.1";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
+  isNativeCompilation = stdenv.buildPlatform == stdenv.hostPlatform;
 in
 
 stdenv.mkDerivation {
   name = "harfbuzz${optionalString withIcu "-icu"}-${version}";
 
   src = fetchFromGitHub {
-    owner  = "harfbuzz";
-    repo   = "harfbuzz";
-    rev    = version;
-    sha256 = "sha256-JnvOFGK2HWIpzuwgZtyt0IfKfnoXD1LMeVb3RzMmyY4=";
+    owner = "harfbuzz";
+    repo = "harfbuzz";
+    rev = version;
+    sha256 = "107l9jhvwy6pnq5032kr7r21md65qg09j7iikr4jihf9pvh7gn5w";
   };
 
   postPatch = ''
@@ -40,9 +54,17 @@ stdenv.mkDerivation {
   outputBin = "dev";
 
   mesonFlags = [
+    # upstream recommends cairo, but it is only used for development purposes
+    # and is not part of the library.
+    # Cairo causes transitive (build) dependencies on various X11 or other
+    # GUI-related libraries, so it shouldn't be re-added lightly.
+    (mesonFeatureFlag "cairo" false)
+    # chafa is only used in a development utility, not in the library
+    (mesonFeatureFlag "chafa" false)
+    (mesonFeatureFlag "coretext" withCoreText)
     (mesonFeatureFlag "graphite" withGraphite2)
     (mesonFeatureFlag "icu" withIcu)
-    (mesonFeatureFlag "coretext" withCoreText)
+    (mesonFeatureFlag "introspection" isNativeCompilation)
   ];
 
   nativeBuildInputs = [
@@ -57,11 +79,11 @@ stdenv.mkDerivation {
     docbook_xml_dtd_43
   ];
 
-  buildInputs = [ glib freetype cairo ] # recommended by upstream
-    ++ lib.optionals withCoreText [ ApplicationServices CoreText ];
+  buildInputs = [ glib freetype ]
+    ++ lib.optionals withCoreText [ ApplicationServices CoreText ]
+    ++ lib.optionals isNativeCompilation [ gobject-introspection ];
 
-  propagatedBuildInputs = []
-    ++ optional withGraphite2 graphite2
+  propagatedBuildInputs = optional withGraphite2 graphite2
     ++ optionals withIcu [ icu harfbuzz ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 83f5de4d013..ef76f61efa9 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "1v3i34jmbz1p3x8msj3vx46nl6jdzxbkr2lfbh06vard8adb16il";
+    sha256 = "11fy2xw35ladkjcz71samhcpqlqr3y0n1n17nk90i13aydrll66f";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/libass/default.nix b/pkgs/development/libraries/libass/default.nix
index 3a8c2a2655a..afc99220534 100644
--- a/pkgs/development/libraries/libass/default.nix
+++ b/pkgs/development/libraries/libass/default.nix
@@ -1,13 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, yasm
 , freetype, fribidi, harfbuzz
-, encaSupport ? true, enca ? null # enca support
 , fontconfigSupport ? true, fontconfig ? null # fontconfig support
 , rasterizerSupport ? false # Internal rasterizer
 , largeTilesSupport ? false # Use larger tiles in the rasterizer
 , libiconv
 }:
 
-assert encaSupport -> enca != null;
 assert fontconfigSupport -> fontconfig != null;
 
 let
@@ -25,7 +23,6 @@ stdenv.mkDerivation rec {
   };
 
   configureFlags = [
-    (mkFlag encaSupport "enca")
     (mkFlag fontconfigSupport "fontconfig")
     (mkFlag rasterizerSupport "rasterizer")
     (mkFlag largeTilesSupport "large-tiles")
@@ -34,7 +31,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config yasm ];
 
   buildInputs = [ freetype fribidi harfbuzz ]
-    ++ optional encaSupport enca
     ++ optional fontconfigSupport fontconfig
     ++ optional stdenv.isDarwin libiconv;
 
diff --git a/pkgs/development/libraries/libedit/default.nix b/pkgs/development/libraries/libedit/default.nix
index dc5a384569c..daf0f292841 100644
--- a/pkgs/development/libraries/libedit/default.nix
+++ b/pkgs/development/libraries/libedit/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libedit";
-  version = "20210216-3.1";
+  version = "20210522-3.1";
 
   src = fetchurl {
     url = "https://thrysoee.dk/editline/${pname}-${version}.tar.gz";
-    sha256 = "sha256-IoP3QdKquTXIxSwEtXv5UtAsLALmURcvisgR93sfx3o=";
+    sha256 = "sha256-AiC8IEfpJ8DBmE7197TrKpRppbe/ErpXPKOyPKAru28=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libidn/default.nix b/pkgs/development/libraries/libidn/default.nix
index afe5e550b33..15d7ca33025 100644
--- a/pkgs/development/libraries/libidn/default.nix
+++ b/pkgs/development/libraries/libidn/default.nix
@@ -1,24 +1,20 @@
 { fetchurl, lib, stdenv, libiconv }:
 
 stdenv.mkDerivation rec {
-  name = "libidn-1.36";
+  pname = "libidn";
+  version = "1.37";
 
   src = fetchurl {
-    url = "mirror://gnu/libidn/${name}.tar.gz";
-    sha256 = "0f20n634whpmdwr81c2r0vxxjwchgkvhsr1i8s2bm0ad6h473dhl";
+    url = "mirror://gnu/libidn/${pname}-${version}.tar.gz";
+    sha256 = "1hljls9rkilh04dwiwg388wk8djkac8idijrdysqq2nqbh6rg3iw";
   };
 
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];
 
-  # broken with gcc-7
-  #doCheck = !stdenv.isDarwin && !stdenv.hostPlatform.isMusl;
-
   hardeningDisable = [ "format" ];
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  doCheck = false; # fails
-
   meta = {
     homepage = "https://www.gnu.org/software/libidn/";
     description = "Library for internationalized domain names";
@@ -42,6 +38,6 @@ stdenv.mkDerivation rec {
     repositories.git = "git://git.savannah.gnu.org/libidn.git";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.all;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ lsix ];
   };
 }
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index bc649241872..8a575141148 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libimagequant";
-  version = "2.14.1";
+  version = "2.15.1";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    sha256 = "sha256-yWtwBTAs6dlrZz3Bd/4DUb488IJsahPKwjluukTlv/o=";
+    sha256 = "sha256-ElMwLeUdrJeJJ9YoieCF/CUNcNMwj5WcjXmMW/nMyAw=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 44f0f8d62ec..276ee52ed54 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.9";
+  version = "1.2.0";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    sha256 = "16jbp4fs5dz2yf4c3bl1sb48x9x9wi1chv39zwmfgya1k9pimcp9";
+    sha256 = "1xblq1cbcxhr6qmjpy98i1qdza148idgz99vbhjc7s4vzvfizc4h";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index a44fde01860..f3d3587c14f 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -4,11 +4,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libpcap";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchurl {
     url = "https://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-jRK0JiPu7+6HLxI70NyF1TWwDfTULoZfmTxA97/JKx4=";
+    sha256 = "sha256-7ShfSsyvBTRPkJdXV7Pb/ncrpB0cQBwmSLf6RbcRvdQ=";
   };
 
   nativeBuildInputs = [ flex bison ]
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index e68219f6348..85afe93ea7a 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -14,7 +14,9 @@
 , publicsuffix-list
 }:
 
-stdenv.mkDerivation rec {
+let
+  enableValgrindTests = !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind;
+in stdenv.mkDerivation rec {
   pname = "libpsl";
   version = "0.21.0";
 
@@ -32,7 +34,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     libxslt
-  ] ++ lib.optionals (!stdenv.isDarwin) [
+  ] ++ lib.optionals enableValgrindTests [
     valgrind
   ];
 
@@ -60,7 +62,7 @@ stdenv.mkDerivation rec {
     "--with-psl-distfile=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
     "--with-psl-file=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
     "--with-psl-testfile=${publicsuffix-list}/share/publicsuffix/test_psl.txt"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
+  ] ++ lib.optionals enableValgrindTests [
     "--enable-valgrind-tests"
   ];
 
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 02cd9accbaf..c5e4b6e8215 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librsvg";
-  version = "2.50.5";
+  version = "2.50.6";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0wlj5g1jgp93sj3rr6qspj282whz13ahnv8ca99d7zilq9s1aw1j";
+    sha256 = "iAdJGZOoevVgxdP1I7jUpLugxQilYPH5NxdytRR3rFc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libtasn1/default.nix b/pkgs/development/libraries/libtasn1/default.nix
index 2239d7311f5..4d7b57c1f08 100644
--- a/pkgs/development/libraries/libtasn1/default.nix
+++ b/pkgs/development/libraries/libtasn1/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, perl, texinfo }:
 
 stdenv.mkDerivation rec {
-  name = "libtasn1-4.16.0";
+  name = "libtasn1-4.17.0";
 
   src = fetchurl {
     url = "mirror://gnu/libtasn1/${name}.tar.gz";
-    sha256 = "179jskl7dmfp1rd2khkzmlibzgki4wi6hvmmwfv7q49r728b03qf";
+    sha256 = "sha256-7OdVHOp5IrjhDX68cLwiSNH91zNRZGotao1oqUIcRaU=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 3c7ea16b26a..0e24d27b0d7 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -10,7 +10,7 @@
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
 , OpenGL, Xplugin
-, withValgrind ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32, valgrind-light
+, withValgrind ? !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind-light, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
 , enableOSMesa ? stdenv.isLinux
 }:
@@ -64,6 +64,11 @@ self = stdenv.mkDerivation {
       url = "https://gitlab.freedesktop.org/mesa/mesa/commit/aebbf819df6d1e.patch";
       sha256 = "17248hyzg43d73c86p077m4lv1pkncaycr3l27hwv9k4ija9zl8q";
     })
+    (fetchpatch {
+      name = "add-riscv-default-selections.patch";
+      url = "https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/11346.patch";
+      sha256 = "1nwqslr1g6m83i0r40710havkyf03yxkgaiwgxz2zlw2xkbrnzw0";
+    })
   ] ++ optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # Fix aarch64-darwin build, remove when upstreaam supports it out of the box.
     # See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/1020
diff --git a/pkgs/development/libraries/nettle/default.nix b/pkgs/development/libraries/nettle/default.nix
index 3eec9c97ff1..0e3c18c0ac3 100644
--- a/pkgs/development/libraries/nettle/default.nix
+++ b/pkgs/development/libraries/nettle/default.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix rec {
-  version = "3.7.2";
+  version = "3.7.3";
 
   src = fetchurl {
     url = "mirror://gnu/nettle/nettle-${version}.tar.gz";
-    sha256 = "0qpi1qp3bcvqdsaxy2pzg530db95x8qjahkynxgwvr6dy5760ald";
+    sha256 = "1w5wwc3q0r97d2ifhx77cw7y8s20bm8x52is9j93p2h47yq5w7v6";
   };
 }
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 962204268d7..3448527e17a 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -18,7 +18,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.64";
+  version = "3.66";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "09hivz4qf3dw7m21lshw34l0yncinwn4ax5w3rpkm71f2wkm85yk";
+    sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -106,7 +106,7 @@ in stdenv.mkDerivation rec {
     runHook postBuild
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
+  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" " + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 77a6b513ee6..d4be8cc2428 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -96,6 +96,8 @@ let
           throw "Not sure what configuration to use for ${stdenv.hostPlatform.config}"
       );
 
+    # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags.
+    dontAddStaticConfigureFlags = true;
     configureFlags = [
       "shared" # "shared" builds both shared and static libraries
       "--libdir=lib"
diff --git a/pkgs/development/libraries/popt/default.nix b/pkgs/development/libraries/popt/default.nix
index 92c143f2417..307408e4db1 100644
--- a/pkgs/development/libraries/popt/default.nix
+++ b/pkgs/development/libraries/popt/default.nix
@@ -1,11 +1,11 @@
-{lib, stdenv, fetchurl}:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "popt";
   version = "1.18";
 
   src = fetchurl {
-    url = "mirror://debian/pool/main/p/popt/popt_${version}.orig.tar.gz";
+    url = "https://ftp.osuosl.org/pub/rpm/popt/releases/popt-1.x/popt-${version}.tar.gz";
     sha256 = "1lf5zlj5rbg6s4bww7hbhpca97prgprnarx978vcwa0bl81vqnai";
   };
 
@@ -17,8 +17,10 @@ stdenv.mkDerivation rec {
   doCheck = false; # fails
 
   meta = with lib; {
+    homepage = "https://github.com/rpm-software-management/popt";
     description = "Command line option parsing library";
-    platforms = platforms.unix;
+    maintainers = with maintainers; [ qyliss ];
     license = licenses.mit;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index ccb37d295bf..8c52a3d4fd1 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -17,6 +17,10 @@
 , target ? null
 # Select whether DYNAMIC_ARCH is enabled or not.
 , dynamicArch ? null
+# enable AVX512 optimized kernels.
+# These kernels have been a source of trouble in the past.
+# Use with caution.
+, enableAVX512 ? false
 , enableStatic ? stdenv.hostPlatform.isStatic
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
@@ -71,6 +75,7 @@ let
       BINARY = 64;
       TARGET = setTarget "ATHLON";
       DYNAMIC_ARCH = setDynamicArch true;
+      NO_AVX512 = !enableAVX512;
       USE_OPENMP = false;
       MACOSX_DEPLOYMENT_TARGET = "10.7";
     };
@@ -79,6 +84,7 @@ let
       BINARY = 64;
       TARGET = setTarget "ATHLON";
       DYNAMIC_ARCH = setDynamicArch true;
+      NO_AVX512 = !enableAVX512;
       USE_OPENMP = !stdenv.hostPlatform.isMusl;
     };
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 50b52b905a9..e2331d89751 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -12,12 +12,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.35.2";
+  version = "3.35.5";
 
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2021/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "1bfczv5006ycwr1vw7xbq7cmys0jvfr8awmx7wi1b40zyj0yss8j";
+    sha256 = "9StypcMZw+UW7XqS4SMTmm6Hrwii3EPXdXck9hMubbA=";
   };
 
   outputs = [ "bin" "dev" "out" ];
@@ -25,6 +25,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib ] ++ optionals interactive [ readline ncurses ];
 
+  # required for aarch64 but applied for all arches for simplicity
+  preConfigure = ''
+    patchShebangs configure
+  '';
+
   configureFlags = [ "--enable-threadsafe" ] ++ optional interactive "--enable-readline";
 
   NIX_CFLAGS_COMPILE = toString [
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 45bcda727ed..6c89a8496e8 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,11 +4,11 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.35.2";
+    version = "3.35.5";
 
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2021/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "00w7qggrdxpcrs4rfpqkjhcghi8pcx6zzjim9wlz6vsrxlr9dwva";
+      sha256 = "049vdpk50sba786345ibmlxnkzk5zp4xj859658ancswb6jyrgpl";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/webrtc-audio-processing/default.nix b/pkgs/development/libraries/webrtc-audio-processing/default.nix
index efd2ce3b1fc..d757789fc26 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/default.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1gsx7k77blfy171b6g3m0k0s0072v6jcawhmx1kjs9w5zlwdkzd0";
   };
 
+  patches = [ ./enable-riscv.patch ];
+
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices ]);
 
   patchPhase = lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/development/libraries/webrtc-audio-processing/enable-riscv.patch b/pkgs/development/libraries/webrtc-audio-processing/enable-riscv.patch
new file mode 100644
index 00000000000..d61c33548a7
--- /dev/null
+++ b/pkgs/development/libraries/webrtc-audio-processing/enable-riscv.patch
@@ -0,0 +1,18 @@
+diff --git a/webrtc/typedefs.h b/webrtc/typedefs.h
+index d875490..ce1f3e8 100644
+--- a/webrtc/typedefs.h
++++ b/webrtc/typedefs.h
+@@ -26,6 +26,13 @@
+ #elif defined(__aarch64__)
+ #define WEBRTC_ARCH_64_BITS
+ #define WEBRTC_ARCH_LITTLE_ENDIAN
++#elif defined(__riscv) || defined(__riscv__)
++#define WEBRTC_ARCH_LITTLE_ENDIAN
++#if __riscv_xlen == 64
++#define WEBRTC_ARCH_64_BITS
++#else
++#define WEBRTC_ARCH_32_BITS
++#endif
+ #elif defined(_M_IX86) || defined(__i386__)
+ #define WEBRTC_ARCH_X86_FAMILY
+ #define WEBRTC_ARCH_X86
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index eac32816cac..d0ae968b0be 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -1,25 +1,30 @@
 { lib
-, fetchPypi
 , buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2020.12.5";
+  version = "2021.05.30";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "177mdbw0livdjvp17sz6wsfrc32838m9y59v871gpgv2888raj8s";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = "python-certifi";
+    rev = version;
+    sha256 = "1i4ljsc47iac6kl1w4w6x0qia08s9z394z9lbyzc05pm7y8a3cmj";
   };
 
-  pythonImportsCheck = [ "certifi" ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "certifi" ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://certifi.io/";
     description = "Python package for providing Mozilla's CA Bundle";
-    license = lib.licenses.isc;
-    maintainers = with lib.maintainers; [ koral ];
+    license = licenses.isc;
+    maintainers = with maintainers; [ koral ];
   };
 }
diff --git a/pkgs/development/python-modules/django/2.nix b/pkgs/development/python-modules/django/2.nix
index e0d3cd12f8f..67946ab0d72 100644
--- a/pkgs/development/python-modules/django/2.nix
+++ b/pkgs/development/python-modules/django/2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.22";
+  version = "2.2.24";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "db2214db1c99017cbd971e58824e6f424375154fe358afc30e976f5b99fc6060";
+    sha256 = "1dvx3x85lggm91x7mpvaf9nmpxyz7r97pbpnmr2k1qfy0c7gyf9k";
   };
 
   patches = lib.optional withGdal
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index 321582946b3..ae6187e207e 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "3.2.2";
+  version = "3.2.4";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0a1d195ad65c52bf275b8277b3d49680bd1137a5f55039a806f25f6b9752ce3d";
+    sha256 = "15pjwyvrx4n8gi8n51b14wp54bg4jqapr25p52597zn6ikdxijb6";
   };
 
   patches = lib.optional withGdal
diff --git a/pkgs/development/python-modules/html-sanitizer/default.nix b/pkgs/development/python-modules/html-sanitizer/default.nix
index 17783f38d1f..546f1acad09 100644
--- a/pkgs/development/python-modules/html-sanitizer/default.nix
+++ b/pkgs/development/python-modules/html-sanitizer/default.nix
@@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchFromGitHub, lxml, beautifulsoup4, pytest, pytestrunner }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, lxml
+, beautifulsoup4
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "html-sanitizer";
@@ -11,11 +17,23 @@ buildPythonPackage rec {
     sha256 = "0nnv34924r0yn01rwlk749j5ijy7yxyj302s1i57yjrkqr3zlvas";
   };
 
-  propagatedBuildInputs = [ lxml beautifulsoup4 ];
+  propagatedBuildInputs = [
+    lxml
+    beautifulsoup4
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "html_sanitizer/tests.py" ];
+
+  pythonImportsCheck = [ "html_sanitizer" ];
 
   meta = with lib; {
-    description = "An  allowlist-based and very opinionated HTML sanitizer that can be used both for untrusted and trusted sources.";
+    description = "Allowlist-based and very opinionated HTML sanitizer";
     homepage = "https://github.com/matthiask/html-sanitizer";
-    license = licenses.bsd3;
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/markdown/default.nix b/pkgs/development/python-modules/markdown/default.nix
index c0175a2e888..c1eff88b926 100644
--- a/pkgs/development/python-modules/markdown/default.nix
+++ b/pkgs/development/python-modules/markdown/default.nix
@@ -1,36 +1,37 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, setuptools
-, nose
-, pyyaml
 , pythonOlder
+, fetchPypi
 , importlib-metadata
-, isPy3k
+, pyyaml
+, python
 }:
 
 buildPythonPackage rec {
   pname = "Markdown";
   version = "3.3.4";
 
+  disabled = pythonOlder "3.6";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "31b5b491868dcc87d6c24b7e3d19a0d730d59d3e46f4eea6430a321bed387a49";
   };
 
-  propagatedBuildInputs = [
-    setuptools
-  ] ++ lib.optionals (pythonOlder "3.8") [
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ];
 
-  disabled = !isPy3k;
+  checkInputs = [ pyyaml ];
 
-  checkInputs = [ nose pyyaml ];
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover
+  '';
 
-  meta = {
+  meta = with lib; {
     description = "A Python implementation of John Gruber's Markdown with Extension support";
     homepage = "https://github.com/Python-Markdown/markdown";
-    license = lib.licenses.bsd3;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/pytest-cov/default.nix b/pkgs/development/python-modules/pytest-cov/default.nix
index a41c26b753b..d0beff8a5cd 100644
--- a/pkgs/development/python-modules/pytest-cov/default.nix
+++ b/pkgs/development/python-modules/pytest-cov/default.nix
@@ -1,16 +1,21 @@
-{ lib, buildPythonPackage, fetchPypi
-, pytest, coverage }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytest
+, coverage
+}:
 
 buildPythonPackage rec {
   pname = "pytest-cov";
-  version = "2.11.1";
+  version = "2.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "359952d9d39b9f822d9d29324483e7ba04a3a17dd7d05aa6beb7ea01e359e5f7";
+    sha256 = "sha256-JhzuuMIntyYkmzdrhSa2APOGZ+4xT5EDU/oxjKoB9Nc=";
   };
 
   buildInputs = [ pytest ];
+
   propagatedBuildInputs = [ coverage ];
 
   # xdist related tests fail with the following error
@@ -22,6 +27,8 @@ buildPythonPackage rec {
     py.test tests
   '';
 
+  pythonImportsCheck = [ "pytest_cov" ];
+
   meta = with lib; {
     description = "Plugin for coverage reporting with support for both centralised and distributed testing, including subprocesses and multiprocessing";
     homepage = "https://github.com/pytest-dev/pytest-cov";
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 5eb1a19c891..605334adf0c 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.4.16";
+  version = "1.4.18";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15yl9frbxsq90hq5b8znqy34fg5kqdw1jjw933kz709rbpxw4lzd";
+    sha256 = "0k3yfarfa0hcc0bza6nccy685gnmq6gikynqayrvddx6y7si0lnj";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 35cb0b25564..eec8e284c0e 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -19,11 +19,11 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "1.26.4";
+  version = "1.26.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0dw9w9bs3hmr5dp3r3h43jyzzb1g1046ag7lj8pqf58i4kvj3c77";
+    sha256 = "sha256-p6zQl3ElMl9Ra9qXNfpxQrkJqNAeiy5MgQjQmE5uAJg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/ginkgo/default.nix b/pkgs/development/tools/ginkgo/default.nix
index 833f87e4a02..0f54d7ca53e 100644
--- a/pkgs/development/tools/ginkgo/default.nix
+++ b/pkgs/development/tools/ginkgo/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "1.16.2";
+  version = "1.16.3";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-u2roJsZZ5oG2dHo4kmSsoySjm1HRQJ659+D2M+LezCc=";
+    sha256 = "sha256-MDxDDZaNgjZz98lAoIIpWbIg7Cr/6kohSh+WL/1Ljyo=";
   };
   vendorSha256 = "sha256-tS8YCGVOsfQp02vY6brmE3pxi70GG9DYcp1JDkcVG9Y=";
   doCheck = false;
diff --git a/pkgs/games/gemrb/default.nix b/pkgs/games/gemrb/default.nix
index 9c5744f7291..d88103eba17 100644
--- a/pkgs/games/gemrb/default.nix
+++ b/pkgs/games/gemrb/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gemrb";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "gemrb";
     repo = "gemrb";
     rev = "v${version}";
-    sha256 = "14j9mhrbi4gnrbv25nlsvcxzkylijzrnwbqqnrg7pr452lb3srpb";
+    sha256 = "sha256-bUo+GP3r4jUjjo0FnDrif/5P2WpiIW0lJ96m+7goO/A=";
   };
 
   # TODO: make libpng, libvorbis, sdl_mixer, freetype, vlc, glew (and other gl
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  # TODO: add proper OpenGL support. We are currently (0.8.7) getting a shader
+  # TODO: add proper OpenGL support. We are currently (0.8.8) getting a shader
   # error on execution when enabled.
   cmakeFlags = [
     "-DLAYOUT=opt"
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 479ab92c797..bb0984d9738 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -113,7 +113,7 @@ in lib.makeScopeWithSplicing
   makeMinimal = mkDerivation {
     path = "tools/make";
     sha256 = "0fh0nrnk18m613m5blrliq2aydciv51qhc0ihsj4k63incwbk90n";
-    version = "9.1";
+    version = "9.2";
 
     buildInputs = with self; [];
     nativeBuildInputs = with buildPackages.netbsd; [ bsdSetupHook ];
@@ -145,7 +145,7 @@ in lib.makeScopeWithSplicing
   };
 
   compat = mkDerivation (let
-    version = "9.1";
+    version = "9.2";
     commonDeps = [ zlib ];
   in {
     path = "tools/compat";
@@ -216,9 +216,9 @@ in lib.makeScopeWithSplicing
         --subst-var-by version ${version}
     '';
     extraPaths = with self; [ include.src libc.src libutil.src
-      (fetchNetBSD "external/bsd/flex" "9.1" "0h98jpfj7vx5zh7vd7bk6b1hmzgkcb757a8j6d9zgygxxv13v43m")
-      (fetchNetBSD "sys/sys" "9.1" "1xx633pvmdgdb0h1x0bw1rvkc63h29ziwh51166rc3q5bil7y01n")
-      (fetchNetBSD "common/include/rpc/types.h" "9.1" "0n2df12mlc3cbc48jxq35yzl1y7ghgpykvy7jnfh898rdhac7m9a")
+      (fetchNetBSD "external/bsd/flex" "9.2" "0h98jpfj7vx5zh7vd7bk6b1hmzgkcb757a8j6d9zgygxxv13v43m")
+      (fetchNetBSD "sys/sys" "9.2" "0zawhw51klaigqqwkx0lzrx3mim2jywrc24cm7c66qsf1im9awgd")
+      (fetchNetBSD "common/include/rpc/types.h" "9.2" "0n2df12mlc3cbc48jxq35yzl1y7ghgpykvy7jnfh898rdhac7m9a")
     ] ++ libutil.extraPaths ++ _mainLibcExtraPaths;
   });
 
@@ -231,7 +231,7 @@ in lib.makeScopeWithSplicing
     xinstall "$@"
   ''; in mkDerivation {
     path = "usr.bin/xinstall";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1f6pbz3qv1qcrchdxif8p5lbmnwl8b9nq615hsd3cyl4avd5bfqj";
     extraPaths = with self; [ mtree.src make.src ];
     nativeBuildInputs = with buildPackages.netbsd; [
@@ -257,15 +257,15 @@ in lib.makeScopeWithSplicing
     pname = "fts";
     path = "include/fts.h";
     sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
-    version = "9.1";
+    version = "9.2";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
     ];
     propagatedBuildInputs = with self; compatIfNeeded;
     extraPaths = with self; [
-      (fetchNetBSD "lib/libc/gen/fts.c" "9.1" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
-      (fetchNetBSD "lib/libc/include/namespace.h" "9.1" "0kksr3pdwdc1cplqf5z12ih4cml6l11lqrz91f7hjjm64y7785kc")
-      (fetchNetBSD "lib/libc/gen/fts.3" "9.1" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
+      (fetchNetBSD "lib/libc/gen/fts.c" "9.2" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
+      (fetchNetBSD "lib/libc/include/namespace.h" "9.2" "0kksr3pdwdc1cplqf5z12ih4cml6l11lqrz91f7hjjm64y7785kc")
+      (fetchNetBSD "lib/libc/gen/fts.3" "9.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
     ];
     skipIncludesPhase = true;
     buildPhase = ''
@@ -292,7 +292,7 @@ in lib.makeScopeWithSplicing
   # Don't add this to nativeBuildInputs directly.  Use statHook instead.
   stat = mkDerivation {
     path = "usr.bin/stat";
-    version = "9.1";
+    version = "9.2";
     sha256 = "18nqwlndfc34qbbgqx5nffil37jfq9aw663ippasfxd2hlyc106x";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -314,7 +314,7 @@ in lib.makeScopeWithSplicing
 
   tsort = mkDerivation {
     path = "usr.bin/tsort";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1dqvf9gin29nnq3c4byxc7lfd062pg7m84843zdy6n0z63hnnwiq";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -325,7 +325,7 @@ in lib.makeScopeWithSplicing
 
   lorder = mkDerivation {
     path = "usr.bin/lorder";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0rjf9blihhm0n699vr2bg88m4yjhkbxh6fxliaay3wxkgnydjwn2";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -342,8 +342,8 @@ in lib.makeScopeWithSplicing
   ##
   make = mkDerivation {
     path = "usr.bin/make";
-    sha256 = "09szl3lp9s081h7f3nci5h9zc78wlk9a6g18mryrznrss90q9ngx";
-    version = "9.1";
+    sha256 = "0vi73yicbmbp522qzqvd979cx6zm5jakhy77xh73c1kygf8klccs";
+    version = "9.2";
     postPatch = ''
       # make needs this to pick up our sys make files
       export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
@@ -361,39 +361,39 @@ in lib.makeScopeWithSplicing
       make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
     '';
     extraPaths = [
-      (fetchNetBSD "share/mk" "9.1" "0qi3ypd5dsxk2c33885fsn68a550nibsxb1jwf5w6bfrvcblzn2z")
+      (fetchNetBSD "share/mk" "9.2" "0w9x77cfnm6zwy40slradzi0ip9gz80x6lk7pvnlxzsr2m5ra5sy")
     ];
   };
 
   mtree = mkDerivation {
     path = "usr.sbin/mtree";
-    version = "9.1";
+    version = "9.2";
     sha256 = "04p7w540vz9npvyb8g8hcf2xa05phn1y88hsyrcz3vwanvpc0yv9";
     extraPaths = with self; [ mknod.src ];
   };
 
   mknod = mkDerivation {
     path = "sbin/mknod";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1d9369shzwgixz3nph991i8q5vk7hr04py3n9avbfbhzy4gndqs2";
   };
 
   getent = mkDerivation {
     path = "usr.bin/getent";
     sha256 = "1qngywcmm0y7nl8h3n8brvkxq4jw63szbci3kc1q6a6ndhycbbvr";
-    version = "9.1";
+    version = "9.2";
     patches = [ ./getent.patch ];
   };
 
   getconf = mkDerivation {
     path = "usr.bin/getconf";
     sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
-    version = "9.1";
+    version = "9.2";
   };
 
   locale = mkDerivation {
     path = "usr.bin/locale";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
     patches = [ ./locale.patch ];
     NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
@@ -401,31 +401,31 @@ in lib.makeScopeWithSplicing
 
   rpcgen = mkDerivation {
     path = "usr.bin/rpcgen";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1kfgfx54jg98wbg0d95p0rvf4w0302v8fz724b0bdackdsrd4988";
   };
 
   genassym = mkDerivation {
     path = "usr.bin/genassym";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1acl1dz5kvh9h5806vkz2ap95rdsz7phmynh5i3x5y7agbki030c";
   };
 
   gencat = mkDerivation {
     path = "usr.bin/gencat";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0gd463x1hg36bhr7y0xryb5jyxk0z0g7xvy8rgk82nlbnlnsbbwb";
   };
 
   nbperf = mkDerivation {
     path = "usr.bin/nbperf";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1nxc302vgmjhm3yqdivqyfzslrg0vjpbss44s74rcryrl19mma9r";
   };
 
   tic = mkDerivation {
     path = "tools/tic";
-    version = "9.1";
+    version = "9.2";
     sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
     HOSTPROG = "tic";
     buildInputs = with self; compatIfNeeded;
@@ -437,29 +437,29 @@ in lib.makeScopeWithSplicing
     makeFlags = [ "TOOLDIR=$(out)" ];
     extraPaths = with self; [
       libterminfo.src
-      (fetchNetBSD "usr.bin/tic" "9.1" "1mwdfg7yx1g43ss378qsgl5rqhsxskqvsd2mqvrn38qw54i8v5i1")
-      (fetchNetBSD "tools/Makefile.host" "9.1" "15b4ab0n36lqj00j5lz2xs83g7l8isk3wx1wcapbrn66qmzz2sxy")
+      (fetchNetBSD "usr.bin/tic" "9.2" "1mwdfg7yx1g43ss378qsgl5rqhsxskqvsd2mqvrn38qw54i8v5i1")
+      (fetchNetBSD "tools/Makefile.host" "9.2" "15b4ab0n36lqj00j5lz2xs83g7l8isk3wx1wcapbrn66qmzz2sxy")
     ];
   };
 
   uudecode = mkDerivation {
     path = "usr.bin/uudecode";
-    version = "9.1";
+    version = "9.2";
     sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
     NIX_CFLAGS_COMPILE = lib.optional stdenv.isLinux "-DNO_BASE64";
   };
 
   cksum = mkDerivation {
     path = "usr.bin/cksum";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0msfhgyvh5c2jmc6qjnf12c378dhw32ffsl864qz4rdb2b98rfcq";
     meta.platforms = lib.platforms.netbsd;
   };
 
   config = mkDerivation {
     path = "usr.bin/config";
-    version = "9.1";
-    sha256 = "08mqq0izd9550dwk181smni51cbiim7rwp208phf25c4mqzaznf4";
+    version = "9.2";
+    sha256 = "1yz3n4hncdkk6kp595fh2q5lg150vpqg8iw2dccydkyw4y3hgsjj";
     NIX_CFLAGS_COMPILE = [ "-DMAKE_BOOTSTRAP" ];
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -477,8 +477,8 @@ in lib.makeScopeWithSplicing
   ##
   include = mkDerivation {
     path = "include";
-    version = "9.1";
-    sha256 = "127kj61prvj3klc2an5rpgavgah2g6igfgprl45255i264wyg8v3";
+    version = "9.2";
+    sha256 = "0nxnmj4c8s3hb9n3fpcmd0zl3l1nmhivqgi9a35sis943qvpgl9h";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
       makeMinimal
@@ -491,13 +491,13 @@ in lib.makeScopeWithSplicing
     makeFlags = [ "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp" ];
   };
 
-  common = fetchNetBSD "common" "9.1" "000n9frjm02h1bdwhb9rbr7wphs8vrj7n09l3v9hhnqrkn7nhy30";
+  common = fetchNetBSD "common" "9.2" "1pfylz9r3ap5wnwwbwczbfjb1m5qdyspzbnmxmcdkpzz2zgj64b9";
 
   sys-headers = mkDerivation {
     pname = "sys-headers";
     path = "sys";
-    version = "9.1";
-    sha256 = "03sv6d7nvnkas4m5z87zxh1rpmggr91ls7di88fwc3cwd3mg3iyx";
+    version = "9.2";
+    sha256 = "03s18q8d9giipf05bx199fajc2qwikji0djz7hw63d2lya6bfnpj";
 
     # Fix this error when building bootia32.efi and bootx64.efi:
     # error: PHDR segment not covered by LOAD segment
@@ -549,7 +549,7 @@ in lib.makeScopeWithSplicing
   };
 
   headers = symlinkJoin {
-    name = "netbsd-headers-9.1";
+    name = "netbsd-headers-9.2";
     paths = with self; [
       include
       sys-headers
@@ -566,7 +566,7 @@ in lib.makeScopeWithSplicing
   ##
   libutil = mkDerivation {
     path = "lib/libutil";
-    version = "9.1";
+    version = "9.2";
     sha256 = "02gm5a5zhh8qp5r5q5r7x8x6x50ir1i0ncgsnfwh1vnrz6mxbq7z";
     extraPaths = with self; [ common libc.src sys.src ];
     nativeBuildInputs = with buildPackages.netbsd; [
@@ -580,7 +580,7 @@ in lib.makeScopeWithSplicing
 
   libedit = mkDerivation {
     path = "lib/libedit";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1wqhngraxwqk4jgrf5f18jy195yrp7c06n1gf31pbplq79mg1bcj";
     buildInputs = with self; [ libterminfo libcurses ];
     propagatedBuildInputs = with self; compatIfNeeded;
@@ -601,7 +601,7 @@ in lib.makeScopeWithSplicing
 
   libterminfo = mkDerivation {
     path = "lib/libterminfo";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0pq05k3dj0dfsczv07frnnji92mazmy2qqngqbx2zgqc1x251414";
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -621,13 +621,13 @@ in lib.makeScopeWithSplicing
       make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share install
     '';
     extraPaths = with self; [
-      (fetchNetBSD "share/terminfo" "9.1" "1vh9rl4w8118a9qdpblfxmv1wkpm83rm9gb4rzz5bpm56i6d7kk7")
+      (fetchNetBSD "share/terminfo" "9.2" "1vh9rl4w8118a9qdpblfxmv1wkpm83rm9gb4rzz5bpm56i6d7kk7")
     ];
   };
 
   libcurses = mkDerivation {
     path = "lib/libcurses";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
     buildInputs = with self; [ libterminfo ];
     NIX_CFLAGS_COMPILE = [
@@ -649,20 +649,20 @@ in lib.makeScopeWithSplicing
 
   column = mkDerivation {
     path = "usr.bin/column";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0r6b0hjn5ls3j3sv6chibs44fs32yyk2cg8kh70kb4cwajs4ifyl";
   };
 
   libossaudio = mkDerivation {
     path = "lib/libossaudio";
-    version = "9.1";
+    version = "9.2";
     sha256 = "16l3bfy6dcwqnklvh3x0ps8ld1y504vf57v9rx8f9adzhb797jh0";
     meta.platforms = lib.platforms.netbsd;
   };
 
   librpcsvc = mkDerivation {
     path = "lib/librpcsvc";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1q34pfiyjbrgrdqm46jwrsqms49ly6z3b0xh1wg331zga900vq5n";
     makeFlags = [ "INCSDIR=$(out)/include/rpcsvc" ];
     meta.platforms = lib.platforms.netbsd;
@@ -675,7 +675,7 @@ in lib.makeScopeWithSplicing
 
   librt = mkDerivation {
     path = "lib/librt";
-    version = "9.1";
+    version = "9.2";
     sha256 = "07f8mpjcqh5kig5z5sp97fg55mc4dz6aa1x5g01nv2pvbmqczxc6";
     meta.platforms = lib.platforms.netbsd;
     extraPaths = with self; [ libc.src ] ++ libc.extraPaths;
@@ -687,7 +687,7 @@ in lib.makeScopeWithSplicing
 
   libcrypt = mkDerivation {
     path = "lib/libcrypt";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0siqan1wdqmmhchh2n8w6a8x1abbff8n4yb6jrqxap3hqn8ay54g";
     SHLIBINSTALLDIR = "$(out)/lib";
     meta.platforms = lib.platforms.netbsd;
@@ -696,7 +696,7 @@ in lib.makeScopeWithSplicing
   libpthread-headers = mkDerivation {
     pname = "libpthread-headers";
     path = "lib/libpthread";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0mlmc31k509dwfmx5s2x010wxjc44mr6y0cbmk30cfipqh8c962h";
     installPhase = "includesPhase";
     dontBuild = true;
@@ -716,7 +716,7 @@ in lib.makeScopeWithSplicing
 
   libresolv = mkDerivation {
     path = "lib/libresolv";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1am74s74mf1ynwz3p4ncjkg63f78a1zjm983q166x4sgzps15626";
     meta.platforms = lib.platforms.netbsd;
     extraPaths = with self; [ libc.src ];
@@ -724,7 +724,7 @@ in lib.makeScopeWithSplicing
 
   libm = mkDerivation {
     path = "lib/libm";
-    version = "9.1";
+    version = "9.2";
     sha256 = "1apwfr26shdmbqqnmg7hxf7bkfxw44ynqnnnghrww9bnhqdnsy92";
     SHLIBINSTALLDIR = "$(out)/lib";
     meta.platforms = lib.platforms.netbsd;
@@ -733,7 +733,7 @@ in lib.makeScopeWithSplicing
 
   i18n_module = mkDerivation {
     path = "lib/i18n_module";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0w6y5v3binm7gf2kn7y9jja8k18rhnyl55cvvfnfipjqdxvxd9jd";
     meta.platforms = lib.platforms.netbsd;
     extraPaths = with self; [ libc.src ];
@@ -741,7 +741,7 @@ in lib.makeScopeWithSplicing
 
   csu = mkDerivation {
     path = "lib/csu";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0al5jfazvhlzn9hvmnrbchx4d0gm282hq5gp4xs2zmj9ycmf6d03";
     meta.platforms = lib.platforms.netbsd;
     nativeBuildInputs = with buildPackages.netbsd; [
@@ -756,7 +756,7 @@ in lib.makeScopeWithSplicing
 
   ld_elf_so = mkDerivation {
     path  = "libexec/ld.elf_so";
-    version = "9.1";
+    version = "9.2";
     sha256 = "0ia9mqzdljly0vqfwflm5mzz55k7qsr4rw2bzhivky6k30vgirqa";
     meta.platforms = lib.platforms.netbsd;
     LIBC_PIC = "${self.libc}/lib/libc_pic.a";
@@ -775,12 +775,12 @@ in lib.makeScopeWithSplicing
 
   libc = mkDerivation {
     path = "lib/libc";
-    version = "9.1";
-    sha256 = "0jg6kpi1xn4wvlqpwnkcv8655hxi0nhcxbk8lzbj7mlr6srxci8j";
+    version = "9.2";
+    sha256 = "1y9c13igg0kai07sqvf9cm6yqmd8lhfd8hq3q7biilbgs1l99as3";
     USE_FORT = "yes";
     MKPROFILE = "no";
     extraPaths = with self; _mainLibcExtraPaths ++ [
-      (fetchNetBSD "external/bsd/jemalloc" "9.1" "0cq704swa0h2yxv4gc79z2lwxibk9k7pxh3q5qfs7axx3jx3n8kb")
+      (fetchNetBSD "external/bsd/jemalloc" "9.2" "0cq704swa0h2yxv4gc79z2lwxibk9k7pxh3q5qfs7axx3jx3n8kb")
     ];
     nativeBuildInputs = with buildPackages.netbsd; [
       bsdSetupHook
@@ -846,7 +846,7 @@ in lib.makeScopeWithSplicing
   dict = mkDerivation {
     path = "share/dict";
     noCC = true;
-    version = "9.1";
+    version = "9.2";
     sha256 = "0svfc0byk59ri37pyjslv4c4rc7zw396r73mr593i78d39q5g3ad";
     makeFlags = [ "BINDIR=$(out)/share" ];
   };
@@ -854,7 +854,7 @@ in lib.makeScopeWithSplicing
   misc = mkDerivation {
     path = "share/misc";
     noCC = true;
-    version = "9.1";
+    version = "9.2";
     sha256 = "1j2cdssdx6nncv8ffj7f7ybl7m9hadjj8vm8611skqdvxnjg6nbc";
     makeFlags = [ "BINDIR=$(out)/share" ];
   };
@@ -862,8 +862,8 @@ in lib.makeScopeWithSplicing
   man = mkDerivation {
     path = "share/man";
     noCC = true;
-    version = "9.1";
-    sha256 = "14sfvz9a5x0kmr9ywsdz09jhw8r1cmhq45wrrz2xwy09b8ykhip6";
+    version = "9.2";
+    sha256 = "1l4lmj4kmg8dl86x94sr45w0xdnkz8dn4zjx0ipgr9bnq98663zl";
     makeFlags = [ "FILESDIR=$(out)/share" ];
   };
   #
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
index 2511c88f3f1..7d2615824a6 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
@@ -1,24 +1,21 @@
-{ lib, stdenv, fetchurl, fetchpatch, alsa-ucm-conf, alsa-topology-conf }:
+{ lib
+, stdenv
+, fetchurl
+, alsa-topology-conf
+, alsa-ucm-conf
+}:
 
 stdenv.mkDerivation rec {
   pname = "alsa-lib";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-91VL4aVs3/RotY/BwpuVtkhkxZADjdMJx6l4xxFpCPc=";
+    sha256 = "067ga0l6zr782kw8jdsqvbb20pcgnl0vkpnnz2n36fq8ii58k4lh";
   };
 
   patches = [
     ./alsa-plugin-conf-multilib.patch
-    (fetchpatch {
-      # plucked from upstream master, delete in next release
-      # without this patch alsa 1.2.4 fails to compile against musl-libc
-      # due to an overly conservative ifdef gate in a new feature
-      name = "fix-dlo.patch";
-      url = "https://github.com/alsa-project/alsa-lib/commit/ad8c8e5503980295dd8e5e54a6285d2d7e32eb1e.patch";
-      sha256 = "QQP4C1dSnJP1MNKt2el7Wn3KmtwtYzvyIHWdrHs+Jw4=";
-    })
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix
index 684ecc23688..747979b1037 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-plugins";
-  version = "1.2.2";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://alsa/plugins/${pname}-${version}.tar.bz2";
-    sha256 = "0z9k3ssbfk2ky2w13avgyf202j1drsz9sv3834bp33cj1i2hc3qw";
+    sha256 = "086z2g2f95570vfvp9d5bakib4k18fb4bszf3lgx3j6j6f2gkvj2";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix
index 2328fea91fd..97960f833e1 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "alsa-topology-conf-${version}";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${name}.tar.bz2";
-    sha256 = "01zdg6q4s6d01k39z96wi4vbhrfw1i2g4yi5dijwfk6a5vjfdq2m";
+    sha256 = "sha256-i/qDBspj4dDL6AvphGYCc7kb1bfdCACmxapx3YyNd1w=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
index d667cd3d51b..d87f3eebb84 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "alsa-ucm-conf-${version}";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${name}.tar.bz2";
-    sha256 = "0h6kzi1cfdqyxp4pwpqh5wb89c8s9wrgix315bvamffwfxf56frc";
+    sha256 = "sha256-CTrj2Fpeb9LNHMJ/7aQA1xkTgvuLXl4jSXKGyHwVB6U=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
index ae2a9f21a6d..37bda86b0a6 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-utils";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://alsa/utils/${pname}-${version}.tar.bz2";
-    sha256 = "09m4dnn4kplawprd2bl15nwa0b4r1brab3x44ga7f1fyk7aw5zwq";
+    sha256 = "15wrl7jsprpcqdk01a3hdh2lak5jhp5jgflkr80h1crqb3q0m5q9";
   };
 
   nativeBuildInputs = [ gettext makeWrapper ];
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
   installFlags = [ "ASOUND_STATE_DIR=$(TMPDIR)/dummy" ];
 
   postFixup = ''
-    wrapProgram $out/bin/alsa-info.sh --prefix PATH : "${lib.makeBinPath [ which pciutils ]}"
+    mv $out/bin/alsa-info.sh $out/bin/alsa-info
+    wrapProgram $out/bin/alsa-info --prefix PATH : "${lib.makeBinPath [ which pciutils ]}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index 467de4b029a..c7a59e59cab 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -8,6 +8,10 @@
 , check
 , pam
 , coreutils
+, gzip
+, bzip2
+, xz
+, zstd
 }:
 
 stdenv.mkDerivation rec {
@@ -38,6 +42,13 @@ stdenv.mkDerivation rec {
       mv fgGIod/trf{,-fgGIod}.map
       mv colemak/{en-latin9,colemak}.map
       popd
+
+      # Fix paths to decompressors. Trailing space to avoid replacing `xz` in `".xz"`.
+      substituteInPlace src/libkbdfile/kbdfile.c \
+        --replace 'gzip '  '${gzip}/bin/gzip ' \
+        --replace 'bzip2 ' '${bzip2.bin}/bin/bzip2 ' \
+        --replace 'xz '    '${xz.bin}/bin/xz ' \
+        --replace 'zstd '  '${zstd.bin}/bin/zstd '
     '';
 
   postInstall = ''
@@ -50,7 +61,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ check pam ];
   nativeBuildInputs = [ autoreconfHook pkg-config flex ];
 
-  passthru.tests = nixosTests.keymap;
+  passthru.tests = {
+    inherit (nixosTests) keymap kbd-setfont-decompress;
+  };
 
   meta = with lib; {
     homepage = "https://kbd-project.org/";
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index bb5e3f51964..f5fdee14c15 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -10,12 +10,12 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "0.9.8";
+  version = "0.9.9";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    sha256 = "1r4g22grhd4s1918wws9vggb8821sv4kkj8197ygxr6sar301z30";
+    sha256 = "1d7iwc8xlyfsbgn6qx1sdfcq7jhpl8wpfj39hcd06y8dzp3jvvvn";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index dff451a01d3..25a8f3bdafa 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -3,7 +3,7 @@
 } :
 
 let
-  version = "34.0";
+  version = "35.0";
 
 in stdenv.mkDerivation {
   pname = "rdma-core";
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "sha256-2HFtj595sDmWqAewIMwKMaiSDVVWKdQA9l0QsPcw8qA=";
+    sha256 = "0ra0m1s0029qgcq0li7md6pkri7pcc4iy3cd6jrrqs9c6n1clnnd";
   };
 
   nativeBuildInputs = [ cmake pkg-config pandoc docutils ];
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 933ff6292e8..e13c23ddeee 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -196,18 +196,18 @@ let
 in self: {
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.21";
+    version = "9.6.22";
     psqlSchema = "9.6";
-    sha256 = "0d0ngpadf1i7c0i2psaxcbmiwx8334ibcsn283n9fp4853pyl3wk";
+    sha256 = "0c19kzrj5ib5ygmavf5d6qvxdwrxzzz6jz1r2dl5b815208cscix";
     this = self.postgresql_9_6;
     thisAttr = "postgresql_9_6";
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.16";
+    version = "10.17";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "1cvv8qw0gkkczqhiwx6ns7w88dwkvdz4cvb2d4ff14363f5p2p53";
+    sha256 = "0v5jahkqm6gkq67s4bac3h7297bscn2ab6y128idi73cc1qq1wjs";
     this = self.postgresql_10;
     thisAttr = "postgresql_10";
     inherit self;
@@ -215,27 +215,27 @@ in self: {
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.11";
+    version = "11.12";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "0v0qk298nxmpzpgsxcsxma328hdkyzd7fwjs0zsn6zavl5zpnq20";
+    sha256 = "016bacpmqxc676ipzc1l8zv1jj44mjz7dv7jhqazg3ibdfqxiyc7";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.6";
+    version = "12.7";
     psqlSchema = "12";
-    sha256 = "028asz92mi3706zabfs8w9z03mzyx62d1l71qy9zdwfabj6xjzfz";
+    sha256 = "15frsmsl1n2i4p76ji0wng4lvnlzw6f01br4cs5xr3n88wgp9444";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.2";
+    version = "13.3";
     psqlSchema = "13";
-    sha256 = "1z5d847jnajcfr3wa6jn52a8xjhamvwzmz18xlm5nvxqip8grmsz";
+    sha256 = "18dliq7h2l8irffhyyhdmfwx3si515q6gds3cxdjb9n7m17lbn9w";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index ed6108d5148..3a564cd9ca6 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -7,7 +7,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   appres = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "appres-1.0.5";
+    pname = "appres";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/appres-1.0.5.tar.bz2";
@@ -21,7 +22,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   bdftopcf = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "bdftopcf-1.1";
+    pname = "bdftopcf";
+    version = "1.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/bdftopcf-1.1.tar.bz2";
@@ -35,7 +37,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   bitmap = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, xbitmaps, libXmu, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "bitmap-1.0.9";
+    pname = "bitmap";
+    version = "1.0.9";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/bitmap-1.0.9.tar.gz";
@@ -49,7 +52,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   editres = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "editres-1.0.7";
+    pname = "editres";
+    version = "1.0.7";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/editres-1.0.7.tar.bz2";
@@ -63,7 +67,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   encodings = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "encodings-1.0.5";
+    pname = "encodings";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/encodings-1.0.5.tar.bz2";
@@ -77,7 +82,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontadobe100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-adobe-100dpi-1.0.3";
+    pname = "font-adobe-100dpi";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-adobe-100dpi-1.0.3.tar.bz2";
@@ -92,7 +98,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontadobe75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-adobe-75dpi-1.0.3";
+    pname = "font-adobe-75dpi";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-adobe-75dpi-1.0.3.tar.bz2";
@@ -107,7 +114,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontadobeutopia100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-adobe-utopia-100dpi-1.0.4";
+    pname = "font-adobe-utopia-100dpi";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.4.tar.bz2";
@@ -122,7 +130,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontadobeutopia75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-adobe-utopia-75dpi-1.0.4";
+    pname = "font-adobe-utopia-75dpi";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.4.tar.bz2";
@@ -137,7 +146,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontadobeutopiatype1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
-    name = "font-adobe-utopia-type1-1.0.4";
+    pname = "font-adobe-utopia-type1";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.4.tar.bz2";
@@ -152,7 +162,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontalias = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "font-alias-1.0.3";
+    pname = "font-alias";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-alias-1.0.3.tar.bz2";
@@ -166,7 +177,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontarabicmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-arabic-misc-1.0.3";
+    pname = "font-arabic-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-arabic-misc-1.0.3.tar.bz2";
@@ -181,7 +193,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbh100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bh-100dpi-1.0.3";
+    pname = "font-bh-100dpi";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bh-100dpi-1.0.3.tar.bz2";
@@ -196,7 +209,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbh75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bh-75dpi-1.0.3";
+    pname = "font-bh-75dpi";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bh-75dpi-1.0.3.tar.bz2";
@@ -211,7 +225,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbhlucidatypewriter100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bh-lucidatypewriter-100dpi-1.0.3";
+    pname = "font-bh-lucidatypewriter-100dpi";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-1.0.3.tar.bz2";
@@ -226,7 +241,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbhlucidatypewriter75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bh-lucidatypewriter-75dpi-1.0.3";
+    pname = "font-bh-lucidatypewriter-75dpi";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.3.tar.bz2";
@@ -241,7 +257,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbhttf = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bh-ttf-1.0.3";
+    pname = "font-bh-ttf";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bh-ttf-1.0.3.tar.bz2";
@@ -256,7 +273,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbhtype1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bh-type1-1.0.3";
+    pname = "font-bh-type1";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bh-type1-1.0.3.tar.bz2";
@@ -271,7 +289,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbitstream100dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bitstream-100dpi-1.0.3";
+    pname = "font-bitstream-100dpi";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bitstream-100dpi-1.0.3.tar.bz2";
@@ -286,7 +305,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbitstream75dpi = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bitstream-75dpi-1.0.3";
+    pname = "font-bitstream-75dpi";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bitstream-75dpi-1.0.3.tar.bz2";
@@ -301,7 +321,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbitstreamtype1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
-    name = "font-bitstream-type1-1.0.3";
+    pname = "font-bitstream-type1";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-bitstream-type1-1.0.3.tar.bz2";
@@ -316,7 +337,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontcronyxcyrillic = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-cronyx-cyrillic-1.0.3";
+    pname = "font-cronyx-cyrillic";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-cronyx-cyrillic-1.0.3.tar.bz2";
@@ -331,7 +353,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontcursormisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-cursor-misc-1.0.3";
+    pname = "font-cursor-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-cursor-misc-1.0.3.tar.bz2";
@@ -346,7 +369,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontdaewoomisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-daewoo-misc-1.0.3";
+    pname = "font-daewoo-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-daewoo-misc-1.0.3.tar.bz2";
@@ -361,7 +385,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontdecmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-dec-misc-1.0.3";
+    pname = "font-dec-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-dec-misc-1.0.3.tar.bz2";
@@ -376,7 +401,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontibmtype1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
-    name = "font-ibm-type1-1.0.3";
+    pname = "font-ibm-type1";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-ibm-type1-1.0.3.tar.bz2";
@@ -391,7 +417,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontisasmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-isas-misc-1.0.3";
+    pname = "font-isas-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-isas-misc-1.0.3.tar.bz2";
@@ -406,7 +433,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontjismisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-jis-misc-1.0.3";
+    pname = "font-jis-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-jis-misc-1.0.3.tar.bz2";
@@ -421,7 +449,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmicromisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-micro-misc-1.0.3";
+    pname = "font-micro-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-micro-misc-1.0.3.tar.bz2";
@@ -436,7 +465,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmisccyrillic = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-misc-cyrillic-1.0.3";
+    pname = "font-misc-cyrillic";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-misc-cyrillic-1.0.3.tar.bz2";
@@ -451,7 +481,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmiscethiopic = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
-    name = "font-misc-ethiopic-1.0.3";
+    pname = "font-misc-ethiopic";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-misc-ethiopic-1.0.3.tar.bz2";
@@ -466,7 +497,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmiscmeltho = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
-    name = "font-misc-meltho-1.0.3";
+    pname = "font-misc-meltho";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-misc-meltho-1.0.3.tar.bz2";
@@ -481,7 +513,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmiscmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-misc-misc-1.1.2";
+    pname = "font-misc-misc";
+    version = "1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-misc-misc-1.1.2.tar.bz2";
@@ -496,7 +529,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmuttmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-mutt-misc-1.0.3";
+    pname = "font-mutt-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-mutt-misc-1.0.3.tar.bz2";
@@ -511,7 +545,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontschumachermisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, fontutil, mkfontscale }: stdenv.mkDerivation {
-    name = "font-schumacher-misc-1.1.2";
+    pname = "font-schumacher-misc";
+    version = "1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-schumacher-misc-1.1.2.tar.bz2";
@@ -526,7 +561,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontscreencyrillic = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-screen-cyrillic-1.0.4";
+    pname = "font-screen-cyrillic";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-screen-cyrillic-1.0.4.tar.bz2";
@@ -541,7 +577,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontsonymisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-sony-misc-1.0.3";
+    pname = "font-sony-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-sony-misc-1.0.3.tar.bz2";
@@ -556,7 +593,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontsunmisc = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-sun-misc-1.0.3";
+    pname = "font-sun-misc";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-sun-misc-1.0.3.tar.bz2";
@@ -571,11 +609,12 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fonttosfnt = callPackage ({ stdenv, pkg-config, fetchurl, libfontenc, freetype, xorgproto }: stdenv.mkDerivation {
-    name = "fonttosfnt-1.2.1";
+    pname = "fonttosfnt";
+    version = "1.2.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/fonttosfnt-1.2.1.tar.bz2";
-      sha256 = "16r51h5wfy85wnbq3q8v8a184hb25c3ksjgix0mlcywdz7qkbj07";
+      url = "mirror://xorg/individual/app/fonttosfnt-1.2.2.tar.bz2";
+      sha256 = "0r1s43ypy0a9z6hzdq5y02s2acj965rax4flwdyylvc54ppv86qs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
@@ -585,7 +624,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontutil = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "font-util-1.3.1";
+    pname = "font-util";
+    version = "1.3.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-util-1.3.1.tar.bz2";
@@ -599,7 +639,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontwinitzkicyrillic = callPackage ({ stdenv, pkg-config, fetchurl, bdftopcf, mkfontscale }: stdenv.mkDerivation {
-    name = "font-winitzki-cyrillic-1.0.3";
+    pname = "font-winitzki-cyrillic";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.3.tar.bz2";
@@ -614,7 +655,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontxfree86type1 = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale }: stdenv.mkDerivation {
-    name = "font-xfree86-type1-1.0.4";
+    pname = "font-xfree86-type1";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/font/font-xfree86-type1-1.0.4.tar.bz2";
@@ -629,7 +671,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   gccmakedep = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "gccmakedep-1.0.3";
+    pname = "gccmakedep";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2";
@@ -643,7 +686,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   iceauth = callPackage ({ stdenv, pkg-config, fetchurl, libICE, xorgproto }: stdenv.mkDerivation {
-    name = "iceauth-1.0.8";
+    pname = "iceauth";
+    version = "1.0.8";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/iceauth-1.0.8.tar.bz2";
@@ -657,7 +701,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   ico = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "ico-1.0.5";
+    pname = "ico";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/ico-1.0.5.tar.bz2";
@@ -671,7 +716,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   imake = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
-    name = "imake-1.0.8";
+    pname = "imake";
+    version = "1.0.8";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/util/imake-1.0.8.tar.bz2";
@@ -685,7 +731,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libAppleWM = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
-    name = "libAppleWM-1.4.1";
+    pname = "libAppleWM";
+    version = "1.4.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libAppleWM-1.4.1.tar.bz2";
@@ -699,7 +746,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libFS = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xtrans }: stdenv.mkDerivation {
-    name = "libFS-1.0.8";
+    pname = "libFS";
+    version = "1.0.8";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libFS-1.0.8.tar.bz2";
@@ -713,7 +761,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libICE = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xtrans }: stdenv.mkDerivation {
-    name = "libICE-1.0.10";
+    pname = "libICE";
+    version = "1.0.10";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2";
@@ -727,7 +776,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libSM = callPackage ({ stdenv, pkg-config, fetchurl, libICE, libuuid, xorgproto, xtrans }: stdenv.mkDerivation {
-    name = "libSM-1.2.3";
+    pname = "libSM";
+    version = "1.2.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2";
@@ -741,7 +791,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libWindowsWM = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
-    name = "libWindowsWM-1.0.1";
+    pname = "libWindowsWM";
+    version = "1.0.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2";
@@ -755,11 +806,12 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libxcb, xtrans }: stdenv.mkDerivation {
-    name = "libX11-1.7.1";
+    pname = "libX11";
+    version = "1.7.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.7.1.tar.bz2";
-      sha256 = "0isxad59hvdwggbxqqjjjg3zmih9xiq4d9mdsnqbyb2nmbg46kp6";
+      url = "mirror://xorg/individual/lib/libX11-1.7.2.tar.bz2";
+      sha256 = "0v7aj8q3rlchdyfwdna7n7vgpyzyir391dlv5rwy9fxagbikbyhw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
@@ -769,7 +821,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXScrnSaver = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
-    name = "libXScrnSaver-1.2.3";
+    pname = "libXScrnSaver";
+    version = "1.2.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXScrnSaver-1.2.3.tar.bz2";
@@ -783,7 +836,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXTrap = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXt }: stdenv.mkDerivation {
-    name = "libXTrap-1.0.1";
+    pname = "libXTrap";
+    version = "1.0.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2";
@@ -797,7 +851,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXau = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
-    name = "libXau-1.0.9";
+    pname = "libXau";
+    version = "1.0.9";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2";
@@ -811,7 +866,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXaw = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXmu, libXpm, libXt }: stdenv.mkDerivation {
-    name = "libXaw-1.0.14";
+    pname = "libXaw";
+    version = "1.0.14";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2";
@@ -825,7 +881,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXaw3d = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, libXmu, libXpm, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "libXaw3d-1.6.3";
+    pname = "libXaw3d";
+    version = "1.6.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXaw3d-1.6.3.tar.bz2";
@@ -839,7 +896,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXcomposite = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXfixes }: stdenv.mkDerivation {
-    name = "libXcomposite-0.4.5";
+    pname = "libXcomposite";
+    version = "0.4.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXcomposite-0.4.5.tar.bz2";
@@ -853,7 +911,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXcursor = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXfixes, libXrender }: stdenv.mkDerivation {
-    name = "libXcursor-1.2.0";
+    pname = "libXcursor";
+    version = "1.2.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXcursor-1.2.0.tar.bz2";
@@ -867,7 +926,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXdamage = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXfixes }: stdenv.mkDerivation {
-    name = "libXdamage-1.1.5";
+    pname = "libXdamage";
+    version = "1.1.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXdamage-1.1.5.tar.bz2";
@@ -881,7 +941,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXdmcp = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
-    name = "libXdmcp-1.1.3";
+    pname = "libXdmcp";
+    version = "1.1.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXdmcp-1.1.3.tar.bz2";
@@ -895,7 +956,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXext = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "libXext-1.3.4";
+    pname = "libXext";
+    version = "1.3.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXext-1.3.4.tar.bz2";
@@ -909,11 +971,12 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXfixes = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
-    name = "libXfixes-5.0.3";
+    pname = "libXfixes";
+    version = "6.0.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXfixes-5.0.3.tar.bz2";
-      sha256 = "1miana3y4hwdqdparsccmygqr3ic3hs5jrqfzp70hvi2zwxd676y";
+      url = "mirror://xorg/individual/lib/libXfixes-6.0.0.tar.bz2";
+      sha256 = "0k2v4i4r24y3kdr5ici1qqhp69djnja919xfqp54c2rylm6s5hd7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
@@ -923,7 +986,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXfont = callPackage ({ stdenv, pkg-config, fetchurl, libfontenc, xorgproto, freetype, xtrans, zlib }: stdenv.mkDerivation {
-    name = "libXfont-1.5.4";
+    pname = "libXfont";
+    version = "1.5.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2";
@@ -937,7 +1001,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXfont2 = callPackage ({ stdenv, pkg-config, fetchurl, libfontenc, xorgproto, freetype, xtrans, zlib }: stdenv.mkDerivation {
-    name = "libXfont2-2.0.4";
+    pname = "libXfont2";
+    version = "2.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXfont2-2.0.4.tar.bz2";
@@ -951,7 +1016,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXft = callPackage ({ stdenv, pkg-config, fetchurl, fontconfig, freetype, libX11, xorgproto, libXrender }: stdenv.mkDerivation {
-    name = "libXft-2.3.3";
+    pname = "libXft";
+    version = "2.3.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXft-2.3.3.tar.bz2";
@@ -965,7 +1031,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXi = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXfixes }: stdenv.mkDerivation {
-    name = "libXi-1.7.10";
+    pname = "libXi";
+    version = "1.7.10";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXi-1.7.10.tar.bz2";
@@ -979,7 +1046,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXinerama = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto }: stdenv.mkDerivation {
-    name = "libXinerama-1.1.4";
+    pname = "libXinerama";
+    version = "1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXinerama-1.1.4.tar.bz2";
@@ -993,7 +1061,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXmu = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "libXmu-1.1.3";
+    pname = "libXmu";
+    version = "1.1.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXmu-1.1.3.tar.bz2";
@@ -1007,7 +1076,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXp = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXau, libXext }: stdenv.mkDerivation {
-    name = "libXp-1.0.3";
+    pname = "libXp";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXp-1.0.3.tar.bz2";
@@ -1021,7 +1091,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXpm = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXt, gettext }: stdenv.mkDerivation {
-    name = "libXpm-3.5.13";
+    pname = "libXpm";
+    version = "3.5.13";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXpm-3.5.13.tar.bz2";
@@ -1035,7 +1106,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXpresent = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
-    name = "libXpresent-1.0.0";
+    pname = "libXpresent";
+    version = "1.0.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2";
@@ -1049,7 +1121,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXrandr = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXrender }: stdenv.mkDerivation {
-    name = "libXrandr-1.5.2";
+    pname = "libXrandr";
+    version = "1.5.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXrandr-1.5.2.tar.bz2";
@@ -1063,7 +1136,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXrender = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
-    name = "libXrender-0.9.10";
+    pname = "libXrender";
+    version = "0.9.10";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXrender-0.9.10.tar.bz2";
@@ -1077,7 +1151,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXres = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
-    name = "libXres-1.2.1";
+    pname = "libXres";
+    version = "1.2.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXres-1.2.1.tar.bz2";
@@ -1091,7 +1166,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXt = callPackage ({ stdenv, pkg-config, fetchurl, libICE, xorgproto, libSM, libX11 }: stdenv.mkDerivation {
-    name = "libXt-1.2.1";
+    pname = "libXt";
+    version = "1.2.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXt-1.2.1.tar.bz2";
@@ -1105,7 +1181,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXtst = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXi }: stdenv.mkDerivation {
-    name = "libXtst-1.2.3";
+    pname = "libXtst";
+    version = "1.2.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2";
@@ -1119,7 +1196,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXv = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
-    name = "libXv-1.0.11";
+    pname = "libXv";
+    version = "1.0.11";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXv-1.0.11.tar.bz2";
@@ -1133,7 +1211,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXvMC = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXv }: stdenv.mkDerivation {
-    name = "libXvMC-1.0.12";
+    pname = "libXvMC";
+    version = "1.0.12";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXvMC-1.0.12.tar.bz2";
@@ -1147,7 +1226,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXxf86dga = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto }: stdenv.mkDerivation {
-    name = "libXxf86dga-1.1.5";
+    pname = "libXxf86dga";
+    version = "1.1.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXxf86dga-1.1.5.tar.bz2";
@@ -1161,7 +1241,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXxf86misc = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto }: stdenv.mkDerivation {
-    name = "libXxf86misc-1.0.4";
+    pname = "libXxf86misc";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2";
@@ -1175,7 +1256,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXxf86vm = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto }: stdenv.mkDerivation {
-    name = "libXxf86vm-1.1.4";
+    pname = "libXxf86vm";
+    version = "1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libXxf86vm-1.1.4.tar.bz2";
@@ -1189,7 +1271,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libdmx = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
-    name = "libdmx-1.1.4";
+    pname = "libdmx";
+    version = "1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libdmx-1.1.4.tar.bz2";
@@ -1203,7 +1286,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libfontenc = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, zlib }: stdenv.mkDerivation {
-    name = "libfontenc-1.1.4";
+    pname = "libfontenc";
+    version = "1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libfontenc-1.1.4.tar.bz2";
@@ -1217,7 +1301,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libpciaccess = callPackage ({ stdenv, pkg-config, fetchurl, zlib }: stdenv.mkDerivation {
-    name = "libpciaccess-0.16";
+    pname = "libpciaccess";
+    version = "0.16";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2";
@@ -1231,7 +1316,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libpthreadstubs = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "libpthread-stubs-0.4";
+    pname = "libpthread-stubs";
+    version = "0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://xcb.freedesktop.org/dist/libpthread-stubs-0.4.tar.bz2";
@@ -1245,7 +1331,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxcb = callPackage ({ stdenv, pkg-config, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python3 }: stdenv.mkDerivation {
-    name = "libxcb-1.14";
+    pname = "libxcb";
+    version = "1.14";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libxcb-1.14.tar.xz";
@@ -1259,7 +1346,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxkbfile = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
-    name = "libxkbfile-1.1.0";
+    pname = "libxkbfile";
+    version = "1.1.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libxkbfile-1.1.0.tar.bz2";
@@ -1273,7 +1361,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxshmfence = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
-    name = "libxshmfence-1.3";
+    pname = "libxshmfence";
+    version = "1.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/libxshmfence-1.3.tar.bz2";
@@ -1287,7 +1376,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   listres = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXmu, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "listres-1.0.4";
+    pname = "listres";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/listres-1.0.4.tar.bz2";
@@ -1301,7 +1391,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   lndir = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
-    name = "lndir-1.0.3";
+    pname = "lndir";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/util/lndir-1.0.3.tar.bz2";
@@ -1315,7 +1406,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   luit = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "luit-20190106";
+    pname = "luit";
+    version = "20190106";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://invisible-mirror.net/archives/luit/luit-20190106.tgz";
@@ -1329,7 +1421,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   makedepend = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
-    name = "makedepend-1.0.6";
+    pname = "makedepend";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2";
@@ -1343,7 +1436,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   mkfontscale = callPackage ({ stdenv, pkg-config, fetchurl, libfontenc, freetype, xorgproto, zlib }: stdenv.mkDerivation {
-    name = "mkfontscale-1.2.1";
+    pname = "mkfontscale";
+    version = "1.2.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/mkfontscale-1.2.1.tar.bz2";
@@ -1357,7 +1451,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   oclock = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, libX11, libXext, libXmu, libXt }: stdenv.mkDerivation {
-    name = "oclock-1.0.4";
+    pname = "oclock";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/oclock-1.0.4.tar.bz2";
@@ -1371,7 +1466,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   sessreg = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
-    name = "sessreg-1.1.2";
+    pname = "sessreg";
+    version = "1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/sessreg-1.1.2.tar.bz2";
@@ -1385,7 +1481,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   setxkbmap = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libxkbfile }: stdenv.mkDerivation {
-    name = "setxkbmap-1.3.2";
+    pname = "setxkbmap";
+    version = "1.3.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/setxkbmap-1.3.2.tar.bz2";
@@ -1399,7 +1496,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   smproxy = callPackage ({ stdenv, pkg-config, fetchurl, libICE, libSM, libXmu, libXt }: stdenv.mkDerivation {
-    name = "smproxy-1.0.6";
+    pname = "smproxy";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/smproxy-1.0.6.tar.bz2";
@@ -1413,7 +1511,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   transset = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "transset-1.0.2";
+    pname = "transset";
+    version = "1.0.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/transset-1.0.2.tar.bz2";
@@ -1427,7 +1526,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   twm = callPackage ({ stdenv, pkg-config, fetchurl, libICE, libSM, libX11, libXext, libXmu, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "twm-1.0.10";
+    pname = "twm";
+    version = "1.0.10";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/twm-1.0.10.tar.bz2";
@@ -1441,7 +1541,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   utilmacros = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "util-macros-1.19.3";
+    pname = "util-macros";
+    version = "1.19.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/util/util-macros-1.19.3.tar.bz2";
@@ -1455,7 +1556,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   viewres = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXmu, libXt }: stdenv.mkDerivation {
-    name = "viewres-1.0.5";
+    pname = "viewres";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/viewres-1.0.5.tar.bz2";
@@ -1469,7 +1571,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   x11perf = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, libXft, libXmu, xorgproto, libXrender }: stdenv.mkDerivation {
-    name = "x11perf-1.6.1";
+    pname = "x11perf";
+    version = "1.6.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/x11perf-1.6.1.tar.bz2";
@@ -1483,7 +1586,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xauth = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXau, libXext, libXmu, xorgproto }: stdenv.mkDerivation {
-    name = "xauth-1.1";
+    pname = "xauth";
+    version = "1.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xauth-1.1.tar.bz2";
@@ -1497,7 +1601,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xbacklight = callPackage ({ stdenv, pkg-config, fetchurl, libxcb, xcbutil }: stdenv.mkDerivation {
-    name = "xbacklight-1.2.3";
+    pname = "xbacklight";
+    version = "1.2.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xbacklight-1.2.3.tar.bz2";
@@ -1511,7 +1616,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xbitmaps = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "xbitmaps-1.1.2";
+    pname = "xbitmaps";
+    version = "1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/data/xbitmaps-1.1.2.tar.bz2";
@@ -1525,7 +1631,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcalc = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "xcalc-1.1.0";
+    pname = "xcalc";
+    version = "1.1.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xcalc-1.1.0.tar.bz2";
@@ -1539,7 +1646,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbproto = callPackage ({ stdenv, pkg-config, fetchurl, python3 }: stdenv.mkDerivation {
-    name = "xcb-proto-1.14.1";
+    pname = "xcb-proto";
+    version = "1.14.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz";
@@ -1553,7 +1661,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutil = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xorgproto, m4 }: stdenv.mkDerivation {
-    name = "xcb-util-0.4.0";
+    pname = "xcb-util";
+    version = "0.4.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://xcb.freedesktop.org/dist/xcb-util-0.4.0.tar.bz2";
@@ -1567,7 +1676,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutilcursor = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xcbutilimage, xcbutilrenderutil, xorgproto, m4 }: stdenv.mkDerivation {
-    name = "xcb-util-cursor-0.1.3";
+    pname = "xcb-util-cursor";
+    version = "0.1.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://xcb.freedesktop.org/dist/xcb-util-cursor-0.1.3.tar.bz2";
@@ -1581,7 +1691,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutilerrors = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xcbproto, xorgproto, m4 }: stdenv.mkDerivation {
-    name = "xcb-util-errors-1.0";
+    pname = "xcb-util-errors";
+    version = "1.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://xcb.freedesktop.org/dist/xcb-util-errors-1.0.tar.bz2";
@@ -1595,7 +1706,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutilimage = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xcbutil, xorgproto, m4 }: stdenv.mkDerivation {
-    name = "xcb-util-image-0.4.0";
+    pname = "xcb-util-image";
+    version = "0.4.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://xcb.freedesktop.org/dist/xcb-util-image-0.4.0.tar.bz2";
@@ -1609,7 +1721,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutilkeysyms = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xorgproto, m4 }: stdenv.mkDerivation {
-    name = "xcb-util-keysyms-0.4.0";
+    pname = "xcb-util-keysyms";
+    version = "0.4.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://xcb.freedesktop.org/dist/xcb-util-keysyms-0.4.0.tar.bz2";
@@ -1623,7 +1736,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutilrenderutil = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xorgproto, m4 }: stdenv.mkDerivation {
-    name = "xcb-util-renderutil-0.3.9";
+    pname = "xcb-util-renderutil";
+    version = "0.3.9";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://xcb.freedesktop.org/dist/xcb-util-renderutil-0.3.9.tar.bz2";
@@ -1637,7 +1751,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutilwm = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xorgproto, m4 }: stdenv.mkDerivation {
-    name = "xcb-util-wm-0.4.1";
+    pname = "xcb-util-wm";
+    version = "0.4.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "https://xcb.freedesktop.org/dist/xcb-util-wm-0.4.1.tar.bz2";
@@ -1651,7 +1766,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xclock = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXft, libxkbfile, libXmu, xorgproto, libXrender, libXt }: stdenv.mkDerivation {
-    name = "xclock-1.0.9";
+    pname = "xclock";
+    version = "1.0.9";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xclock-1.0.9.tar.bz2";
@@ -1665,7 +1781,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcmsdb = callPackage ({ stdenv, pkg-config, fetchurl, libX11 }: stdenv.mkDerivation {
-    name = "xcmsdb-1.0.5";
+    pname = "xcmsdb";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xcmsdb-1.0.5.tar.bz2";
@@ -1679,7 +1796,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcompmgr = callPackage ({ stdenv, pkg-config, fetchurl, libXcomposite, libXdamage, libXext, libXfixes, libXrender }: stdenv.mkDerivation {
-    name = "xcompmgr-1.1.8";
+    pname = "xcompmgr";
+    version = "1.1.8";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xcompmgr-1.1.8.tar.bz2";
@@ -1693,7 +1811,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xconsole = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt }: stdenv.mkDerivation {
-    name = "xconsole-1.0.7";
+    pname = "xconsole";
+    version = "1.0.7";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xconsole-1.0.7.tar.bz2";
@@ -1707,7 +1826,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcursorgen = callPackage ({ stdenv, pkg-config, fetchurl, libpng, libX11, libXcursor }: stdenv.mkDerivation {
-    name = "xcursorgen-1.0.7";
+    pname = "xcursorgen";
+    version = "1.0.7";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xcursorgen-1.0.7.tar.bz2";
@@ -1721,7 +1841,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcursorthemes = callPackage ({ stdenv, pkg-config, fetchurl, libXcursor }: stdenv.mkDerivation {
-    name = "xcursor-themes-1.0.6";
+    pname = "xcursor-themes";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/data/xcursor-themes-1.0.6.tar.bz2";
@@ -1735,7 +1856,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xdm = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXau, libXaw, libXdmcp, libXext, libXft, libXinerama, libXmu, libXpm, xorgproto, libXrender, libXt }: stdenv.mkDerivation {
-    name = "xdm-1.1.12";
+    pname = "xdm";
+    version = "1.1.12";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xdm-1.1.12.tar.bz2";
@@ -1749,7 +1871,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xdpyinfo = callPackage ({ stdenv, pkg-config, fetchurl, libdmx, libX11, libxcb, libXcomposite, libXext, libXi, libXinerama, xorgproto, libXrender, libXtst, libXxf86dga, libXxf86misc, libXxf86vm }: stdenv.mkDerivation {
-    name = "xdpyinfo-1.3.2";
+    pname = "xdpyinfo";
+    version = "1.3.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xdpyinfo-1.3.2.tar.bz2";
@@ -1763,7 +1886,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xdriinfo = callPackage ({ stdenv, pkg-config, fetchurl, libGL, xorgproto, libX11 }: stdenv.mkDerivation {
-    name = "xdriinfo-1.0.6";
+    pname = "xdriinfo";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xdriinfo-1.0.6.tar.bz2";
@@ -1777,7 +1901,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xev = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, libXrandr }: stdenv.mkDerivation {
-    name = "xev-1.2.3";
+    pname = "xev";
+    version = "1.2.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xev-1.2.3.tar.bz2";
@@ -1791,7 +1916,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xeyes = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, libXmu, xorgproto, libXrender, libXt }: stdenv.mkDerivation {
-    name = "xeyes-1.1.2";
+    pname = "xeyes";
+    version = "1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xeyes-1.1.2.tar.bz2";
@@ -1805,7 +1931,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputevdev = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libevdev, udev, mtdev, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-input-evdev-2.10.6";
+    pname = "xf86-input-evdev";
+    version = "2.10.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2";
@@ -1819,7 +1946,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputjoystick = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-input-joystick-1.6.3";
+    pname = "xf86-input-joystick";
+    version = "1.6.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-input-joystick-1.6.3.tar.bz2";
@@ -1833,7 +1961,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputkeyboard = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-input-keyboard-1.9.0";
+    pname = "xf86-input-keyboard";
+    version = "1.9.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-input-keyboard-1.9.0.tar.bz2";
@@ -1847,7 +1976,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputlibinput = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libinput, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-input-libinput-1.0.1";
+    pname = "xf86-input-libinput";
+    version = "1.0.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-input-libinput-1.0.1.tar.bz2";
@@ -1861,7 +1991,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputmouse = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-input-mouse-1.9.3";
+    pname = "xf86-input-mouse";
+    version = "1.9.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-input-mouse-1.9.3.tar.bz2";
@@ -1875,7 +2006,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputsynaptics = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libevdev, libX11, libXi, xorgserver, libXtst }: stdenv.mkDerivation {
-    name = "xf86-input-synaptics-1.9.1";
+    pname = "xf86-input-synaptics";
+    version = "1.9.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-input-synaptics-1.9.1.tar.bz2";
@@ -1889,7 +2021,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputvmmouse = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, udev, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-input-vmmouse-13.1.0";
+    pname = "xf86-input-vmmouse";
+    version = "13.1.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-input-vmmouse-13.1.0.tar.bz2";
@@ -1903,7 +2036,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputvoid = callPackage ({ stdenv, pkg-config, fetchurl, xorgserver, xorgproto }: stdenv.mkDerivation {
-    name = "xf86-input-void-1.4.1";
+    pname = "xf86-input-void";
+    version = "1.4.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-input-void-1.4.1.tar.bz2";
@@ -1917,7 +2051,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoamdgpu = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, mesa, libGL, libdrm, udev, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-amdgpu-19.1.0";
+    pname = "xf86-video-amdgpu";
+    version = "19.1.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-amdgpu-19.1.0.tar.bz2";
@@ -1931,7 +2066,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoapm = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-apm-1.3.0";
+    pname = "xf86-video-apm";
+    version = "1.3.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-apm-1.3.0.tar.bz2";
@@ -1945,7 +2081,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoark = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-ark-0.7.5";
+    pname = "xf86-video-ark";
+    version = "0.7.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-ark-0.7.5.tar.bz2";
@@ -1959,7 +2096,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoast = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-ast-1.1.5";
+    pname = "xf86-video-ast";
+    version = "1.1.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-ast-1.1.5.tar.bz2";
@@ -1973,7 +2111,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoati = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, mesa, libGL, libdrm, udev, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-ati-19.1.0";
+    pname = "xf86-video-ati";
+    version = "19.1.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-ati-19.1.0.tar.bz2";
@@ -1987,7 +2126,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videochips = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-chips-1.4.0";
+    pname = "xf86-video-chips";
+    version = "1.4.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-chips-1.4.0.tar.bz2";
@@ -2001,7 +2141,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videocirrus = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-cirrus-1.5.3";
+    pname = "xf86-video-cirrus";
+    version = "1.5.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-cirrus-1.5.3.tar.bz2";
@@ -2015,7 +2156,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videodummy = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-dummy-0.3.8";
+    pname = "xf86-video-dummy";
+    version = "0.3.8";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-dummy-0.3.8.tar.bz2";
@@ -2029,7 +2171,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videofbdev = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-fbdev-0.5.0";
+    pname = "xf86-video-fbdev";
+    version = "0.5.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-fbdev-0.5.0.tar.bz2";
@@ -2043,7 +2186,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videogeode = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-geode-2.11.19";
+    pname = "xf86-video-geode";
+    version = "2.11.19";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-geode-2.11.19.tar.bz2";
@@ -2057,7 +2201,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoglide = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-glide-1.2.2";
+    pname = "xf86-video-glide";
+    version = "1.2.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-glide-1.2.2.tar.bz2";
@@ -2071,7 +2216,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoglint = callPackage ({ stdenv, pkg-config, fetchurl, libpciaccess, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-glint-1.2.9";
+    pname = "xf86-video-glint";
+    version = "1.2.9";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-glint-1.2.9.tar.bz2";
@@ -2085,7 +2231,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoi128 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-i128-1.4.0";
+    pname = "xf86-video-i128";
+    version = "1.4.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-i128-1.4.0.tar.bz2";
@@ -2099,7 +2246,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoi740 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-i740-1.4.0";
+    pname = "xf86-video-i740";
+    version = "1.4.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-i740-1.4.0.tar.bz2";
@@ -2113,7 +2261,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videointel = callPackage ({ stdenv, pkg-config, fetchurl, cairo, xorgproto, libdrm, libpng, udev, libpciaccess, libX11, xcbutil, libxcb, libXcursor, libXdamage, libXext, libXfixes, xorgserver, libXrandr, libXrender, libxshmfence, libXtst, libXvMC }: stdenv.mkDerivation {
-    name = "xf86-video-intel-2.99.917";
+    pname = "xf86-video-intel";
+    version = "2.99.917";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-intel-2.99.917.tar.bz2";
@@ -2127,7 +2276,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videomach64 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-mach64-6.9.6";
+    pname = "xf86-video-mach64";
+    version = "6.9.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-mach64-6.9.6.tar.bz2";
@@ -2141,7 +2291,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videomga = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-mga-2.0.0";
+    pname = "xf86-video-mga";
+    version = "2.0.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-mga-2.0.0.tar.bz2";
@@ -2155,7 +2306,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoneomagic = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-neomagic-1.3.0";
+    pname = "xf86-video-neomagic";
+    version = "1.3.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-neomagic-1.3.0.tar.bz2";
@@ -2169,7 +2321,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videonewport = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-newport-0.2.4";
+    pname = "xf86-video-newport";
+    version = "0.2.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-newport-0.2.4.tar.bz2";
@@ -2183,7 +2336,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videonouveau = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, udev, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-nouveau-1.0.17";
+    pname = "xf86-video-nouveau";
+    version = "1.0.17";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-nouveau-1.0.17.tar.bz2";
@@ -2197,7 +2351,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videonv = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-nv-2.1.21";
+    pname = "xf86-video-nv";
+    version = "2.1.21";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-nv-2.1.21.tar.bz2";
@@ -2211,7 +2366,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoomap = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-omap-0.4.5";
+    pname = "xf86-video-omap";
+    version = "0.4.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-omap-0.4.5.tar.bz2";
@@ -2225,7 +2381,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoopenchrome = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, udev, libpciaccess, libX11, libXext, xorgserver, libXvMC }: stdenv.mkDerivation {
-    name = "xf86-video-openchrome-0.6.0";
+    pname = "xf86-video-openchrome";
+    version = "0.6.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-openchrome-0.6.0.tar.bz2";
@@ -2239,7 +2396,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoqxl = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, udev, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-qxl-0.1.5";
+    pname = "xf86-video-qxl";
+    version = "0.1.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-qxl-0.1.5.tar.bz2";
@@ -2253,7 +2411,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videor128 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-r128-6.11.0";
+    pname = "xf86-video-r128";
+    version = "6.11.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-r128-6.11.0.tar.bz2";
@@ -2267,7 +2426,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videorendition = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-rendition-4.2.7";
+    pname = "xf86-video-rendition";
+    version = "4.2.7";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-rendition-4.2.7.tar.bz2";
@@ -2281,7 +2441,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videos3virge = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-s3virge-1.11.0";
+    pname = "xf86-video-s3virge";
+    version = "1.11.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-s3virge-1.11.0.tar.bz2";
@@ -2295,7 +2456,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videosavage = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-savage-2.3.9";
+    pname = "xf86-video-savage";
+    version = "2.3.9";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-savage-2.3.9.tar.bz2";
@@ -2309,7 +2471,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videosiliconmotion = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-siliconmotion-1.7.9";
+    pname = "xf86-video-siliconmotion";
+    version = "1.7.9";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-siliconmotion-1.7.9.tar.bz2";
@@ -2323,7 +2486,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videosis = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-sis-0.11.0";
+    pname = "xf86-video-sis";
+    version = "0.11.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-sis-0.11.0.tar.bz2";
@@ -2337,7 +2501,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videosisusb = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-sisusb-0.9.7";
+    pname = "xf86-video-sisusb";
+    version = "0.9.7";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-sisusb-0.9.7.tar.bz2";
@@ -2351,7 +2516,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videosuncg6 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-suncg6-1.1.2";
+    pname = "xf86-video-suncg6";
+    version = "1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-suncg6-1.1.2.tar.bz2";
@@ -2365,7 +2531,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videosunffb = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-sunffb-1.2.2";
+    pname = "xf86-video-sunffb";
+    version = "1.2.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-sunffb-1.2.2.tar.bz2";
@@ -2379,7 +2546,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videosunleo = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-sunleo-1.2.2";
+    pname = "xf86-video-sunleo";
+    version = "1.2.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-sunleo-1.2.2.tar.bz2";
@@ -2393,7 +2561,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videotdfx = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-tdfx-1.5.0";
+    pname = "xf86-video-tdfx";
+    version = "1.5.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-tdfx-1.5.0.tar.bz2";
@@ -2407,7 +2576,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videotga = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-tga-1.2.2";
+    pname = "xf86-video-tga";
+    version = "1.2.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-tga-1.2.2.tar.bz2";
@@ -2421,7 +2591,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videotrident = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-trident-1.3.8";
+    pname = "xf86-video-trident";
+    version = "1.3.8";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-trident-1.3.8.tar.bz2";
@@ -2435,7 +2606,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videov4l = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-v4l-0.3.0";
+    pname = "xf86-video-v4l";
+    version = "0.3.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-v4l-0.3.0.tar.bz2";
@@ -2449,7 +2621,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videovboxvideo = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-vboxvideo-1.0.0";
+    pname = "xf86-video-vboxvideo";
+    version = "1.0.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-vboxvideo-1.0.0.tar.bz2";
@@ -2463,7 +2636,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videovesa = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-vesa-2.5.0";
+    pname = "xf86-video-vesa";
+    version = "2.5.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-vesa-2.5.0.tar.bz2";
@@ -2477,7 +2651,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videovmware = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, udev, libpciaccess, libX11, libXext, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-vmware-13.3.0";
+    pname = "xf86-video-vmware";
+    version = "13.3.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-vmware-13.3.0.tar.bz2";
@@ -2491,7 +2666,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videovoodoo = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-voodoo-1.2.5";
+    pname = "xf86-video-voodoo";
+    version = "1.2.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-voodoo-1.2.5.tar.bz2";
@@ -2505,7 +2681,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videowsfb = callPackage ({ stdenv, pkg-config, fetchurl, xorgserver, xorgproto }: stdenv.mkDerivation {
-    name = "xf86-video-wsfb-0.4.0";
+    pname = "xf86-video-wsfb";
+    version = "0.4.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2";
@@ -2519,7 +2696,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoxgi = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-video-xgi-1.6.1";
+    pname = "xf86-video-xgi";
+    version = "1.6.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/driver/xf86-video-xgi-1.6.1.tar.bz2";
@@ -2533,7 +2711,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xfd = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, fontconfig, libXaw, libXft, libXmu, xorgproto, libXrender, libXt, gettext }: stdenv.mkDerivation {
-    name = "xfd-1.1.3";
+    pname = "xfd";
+    version = "1.1.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xfd-1.1.3.tar.bz2";
@@ -2547,7 +2726,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xfontsel = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, libXt }: stdenv.mkDerivation {
-    name = "xfontsel-1.0.6";
+    pname = "xfontsel";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xfontsel-1.0.6.tar.bz2";
@@ -2561,7 +2741,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xfs = callPackage ({ stdenv, pkg-config, fetchurl, libXfont2, xorgproto, xtrans }: stdenv.mkDerivation {
-    name = "xfs-1.2.0";
+    pname = "xfs";
+    version = "1.2.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xfs-1.2.0.tar.bz2";
@@ -2575,7 +2756,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xfsinfo = callPackage ({ stdenv, pkg-config, fetchurl, libFS, xorgproto }: stdenv.mkDerivation {
-    name = "xfsinfo-1.0.6";
+    pname = "xfsinfo";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xfsinfo-1.0.6.tar.bz2";
@@ -2589,7 +2771,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xgamma = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, libXxf86vm }: stdenv.mkDerivation {
-    name = "xgamma-1.0.6";
+    pname = "xgamma";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xgamma-1.0.6.tar.bz2";
@@ -2603,7 +2786,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xgc = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt }: stdenv.mkDerivation {
-    name = "xgc-1.0.5";
+    pname = "xgc";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xgc-1.0.5.tar.bz2";
@@ -2617,7 +2801,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xhost = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXau, libXmu, xorgproto }: stdenv.mkDerivation {
-    name = "xhost-1.0.8";
+    pname = "xhost";
+    version = "1.0.8";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xhost-1.0.8.tar.bz2";
@@ -2631,7 +2816,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xinit = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "xinit-1.4.1";
+    pname = "xinit";
+    version = "1.4.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xinit-1.4.1.tar.bz2";
@@ -2645,7 +2831,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xinput = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXi, libXinerama, libXrandr }: stdenv.mkDerivation {
-    name = "xinput-1.6.3";
+    pname = "xinput";
+    version = "1.6.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xinput-1.6.3.tar.bz2";
@@ -2659,7 +2846,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkbcomp = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libxkbfile, xorgproto }: stdenv.mkDerivation {
-    name = "xkbcomp-1.4.5";
+    pname = "xkbcomp";
+    version = "1.4.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xkbcomp-1.4.5.tar.bz2";
@@ -2673,7 +2861,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkbevd = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libxkbfile }: stdenv.mkDerivation {
-    name = "xkbevd-1.1.4";
+    pname = "xkbevd";
+    version = "1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xkbevd-1.1.4.tar.bz2";
@@ -2687,7 +2876,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkbprint = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libxkbfile, xorgproto }: stdenv.mkDerivation {
-    name = "xkbprint-1.0.4";
+    pname = "xkbprint";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xkbprint-1.0.4.tar.bz2";
@@ -2701,7 +2891,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkbutils = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXaw, libXt }: stdenv.mkDerivation {
-    name = "xkbutils-1.0.4";
+    pname = "xkbutils";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xkbutils-1.0.4.tar.bz2";
@@ -2715,11 +2906,12 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkeyboardconfig = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, python3 }: stdenv.mkDerivation {
-    name = "xkeyboard-config-2.31";
+    pname = "xkeyboard-config";
+    version = "2.33";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.31.tar.bz2";
-      sha256 = "18xddaxh83zm698syh50w983jg6b7b8zgv0dfaf7ha485hgihi6s";
+      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.33.tar.bz2";
+      sha256 = "1g6kn7l0mixw50kgn7d97gwv1990c5rczr2x776q3xywss8dfzv5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config python3 ];
@@ -2729,7 +2921,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkill = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXmu, xorgproto }: stdenv.mkDerivation {
-    name = "xkill-1.0.5";
+    pname = "xkill";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xkill-1.0.5.tar.bz2";
@@ -2743,7 +2936,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xload = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, gettext }: stdenv.mkDerivation {
-    name = "xload-1.1.3";
+    pname = "xload";
+    version = "1.1.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xload-1.1.3.tar.bz2";
@@ -2757,7 +2951,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xlsatoms = callPackage ({ stdenv, pkg-config, fetchurl, libxcb }: stdenv.mkDerivation {
-    name = "xlsatoms-1.1.3";
+    pname = "xlsatoms";
+    version = "1.1.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xlsatoms-1.1.3.tar.bz2";
@@ -2771,7 +2966,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xlsclients = callPackage ({ stdenv, pkg-config, fetchurl, libxcb }: stdenv.mkDerivation {
-    name = "xlsclients-1.1.4";
+    pname = "xlsclients";
+    version = "1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xlsclients-1.1.4.tar.bz2";
@@ -2785,7 +2981,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xlsfonts = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "xlsfonts-1.0.6";
+    pname = "xlsfonts";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xlsfonts-1.0.6.tar.bz2";
@@ -2799,7 +2996,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xmag = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, libXt }: stdenv.mkDerivation {
-    name = "xmag-1.0.6";
+    pname = "xmag";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xmag-1.0.6.tar.bz2";
@@ -2813,7 +3011,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xmessage = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt }: stdenv.mkDerivation {
-    name = "xmessage-1.0.5";
+    pname = "xmessage";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xmessage-1.0.5.tar.bz2";
@@ -2827,7 +3026,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xmodmap = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "xmodmap-1.0.10";
+    pname = "xmodmap";
+    version = "1.0.10";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xmodmap-1.0.10.tar.bz2";
@@ -2841,7 +3041,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xmore = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt }: stdenv.mkDerivation {
-    name = "xmore-1.0.3";
+    pname = "xmore";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xmore-1.0.3.tar.bz2";
@@ -2855,7 +3056,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgcffiles = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "xorg-cf-files-1.0.6";
+    pname = "xorg-cf-files";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/util/xorg-cf-files-1.0.6.tar.bz2";
@@ -2869,7 +3071,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgdocs = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "xorg-docs-1.7.1";
+    pname = "xorg-docs";
+    version = "1.7.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2";
@@ -2882,22 +3085,24 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xorgproto = callPackage ({ stdenv, pkg-config, fetchurl, libXt }: stdenv.mkDerivation {
-    name = "xorgproto-2021.3";
+  xorgproto = callPackage ({ stdenv, pkg-config, fetchurl, libXt, python3 }: stdenv.mkDerivation {
+    pname = "xorgproto";
+    version = "2021.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/proto/xorgproto-2021.3.tar.bz2";
-      sha256 = "0dypp7cvjf0rvwa7cn1zp7djw5ynhs1rwk9p0r1vczbwzha2nwsc";
+      url = "mirror://xorg/individual/proto/xorgproto-2021.4.tar.bz2";
+      sha256 = "1gwz8lhvczjinndrq2jb0swfvhk7p65rprkwiqwlp132041mfl8g";
     };
     hardeningDisable = [ "bindnow" "relro" ];
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config python3 ];
     buildInputs = [ libXt ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgserver = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
-    name = "xorg-server-1.20.11";
+    pname = "xorg-server";
+    version = "1.20.11";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/xserver/xorg-server-1.20.11.tar.bz2";
@@ -2911,7 +3116,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgsgmldoctools = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "xorg-sgml-doctools-1.11";
+    pname = "xorg-sgml-doctools";
+    version = "1.11";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2";
@@ -2925,7 +3131,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xpr = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXmu, xorgproto }: stdenv.mkDerivation {
-    name = "xpr-1.0.5";
+    pname = "xpr";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xpr-1.0.5.tar.bz2";
@@ -2939,7 +3146,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xprop = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "xprop-1.2.5";
+    pname = "xprop";
+    version = "1.2.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xprop-1.2.5.tar.bz2";
@@ -2953,7 +3161,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xrandr = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, libXrandr, libXrender }: stdenv.mkDerivation {
-    name = "xrandr-1.5.1";
+    pname = "xrandr";
+    version = "1.5.1";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xrandr-1.5.1.tar.xz";
@@ -2967,7 +3176,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xrdb = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXmu, xorgproto }: stdenv.mkDerivation {
-    name = "xrdb-1.2.0";
+    pname = "xrdb";
+    version = "1.2.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xrdb-1.2.0.tar.bz2";
@@ -2981,7 +3191,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xrefresh = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "xrefresh-1.0.6";
+    pname = "xrefresh";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xrefresh-1.0.6.tar.bz2";
@@ -2995,7 +3206,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xset = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, libXmu, xorgproto, libXxf86misc }: stdenv.mkDerivation {
-    name = "xset-1.2.4";
+    pname = "xset";
+    version = "1.2.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xset-1.2.4.tar.bz2";
@@ -3009,7 +3221,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xsetroot = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xbitmaps, libXcursor, libXmu, xorgproto }: stdenv.mkDerivation {
-    name = "xsetroot-1.1.2";
+    pname = "xsetroot";
+    version = "1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xsetroot-1.1.2.tar.bz2";
@@ -3023,7 +3236,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xsm = callPackage ({ stdenv, pkg-config, fetchurl, libICE, libSM, libX11, libXaw, libXt }: stdenv.mkDerivation {
-    name = "xsm-1.0.4";
+    pname = "xsm";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xsm-1.0.4.tar.bz2";
@@ -3037,7 +3251,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xstdcmap = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXmu, xorgproto }: stdenv.mkDerivation {
-    name = "xstdcmap-1.0.4";
+    pname = "xstdcmap";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xstdcmap-1.0.4.tar.bz2";
@@ -3051,7 +3266,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xtrans = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
-    name = "xtrans-1.4.0";
+    pname = "xtrans";
+    version = "1.4.0";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/lib/xtrans-1.4.0.tar.bz2";
@@ -3065,7 +3281,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xtrap = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXt, libXTrap }: stdenv.mkDerivation {
-    name = "xtrap-1.0.3";
+    pname = "xtrap";
+    version = "1.0.3";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xtrap-1.0.3.tar.bz2";
@@ -3079,7 +3296,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xvinfo = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, libXv }: stdenv.mkDerivation {
-    name = "xvinfo-1.1.4";
+    pname = "xvinfo";
+    version = "1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xvinfo-1.1.4.tar.bz2";
@@ -3093,7 +3311,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xwd = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "xwd-1.0.7";
+    pname = "xwd";
+    version = "1.0.7";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xwd-1.0.7.tar.bz2";
@@ -3107,7 +3326,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xwininfo = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libxcb, xorgproto }: stdenv.mkDerivation {
-    name = "xwininfo-1.1.4";
+    pname = "xwininfo";
+    version = "1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xwininfo-1.1.4.tar.bz2";
@@ -3121,7 +3341,8 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xwud = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
-    name = "xwud-1.0.5";
+    pname = "xwud";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
       url = "mirror://xorg/individual/app/xwud-1.0.5.tar.bz2";
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 6ec75517147..e18479c0d7a 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -17,6 +17,7 @@ use File::Temp;
 my %pkgURLs;
 my %pkgHashes;
 my %pkgNames;
+my %pkgVersions;
 my %pkgRequires;
 my %pkgNativeRequires;
 
@@ -73,8 +74,12 @@ while (<>) {
         next;
     }
 
+    # split by first occurence of hyphen followd by only numbers ends line or another hyphen follows
+    my ($name, $version) = split(/-(?=[.0-9]+(?:$|-))/, $pkgName, 2);
+
     $pkgURLs{$pkg} = $tarball;
-    $pkgNames{$pkg} = $pkgName;
+    $pkgNames{$pkg} = $name;
+    $pkgVersions{$pkg} = $version;
 
     my $cachePath = catdir($downloadCache, basename($tarball));
     my $hash;
@@ -303,7 +308,8 @@ foreach my $pkg (sort (keys %pkgURLs)) {
     print OUT <<EOF
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   $pkg = callPackage ({ $argumentsStr }: stdenv.mkDerivation {
-    name = "$pkgNames{$pkg}";
+    pname = "$pkgNames{$pkg}";
+    version = "$pkgVersions{$pkg}";
     builder = ./builder.sh;
     src = fetchurl {
       url = "$pkgURLs{$pkg}";
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 1d11bfb3a35..75d9b399caf 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -668,7 +668,7 @@ self: super:
           ( # assert() keeps runtime reference xorgserver-dev in xf86-video-intel and others
             cd "$dev"
             for f in include/xorg/*.h; do
-              sed "1i#line 1 \"${attrs.name}/$f\"" -i "$f"
+              sed "1i#line 1 \"${attrs.pname}-${attrs.version}/$f\"" -i "$f"
             done
           )
         '';
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index e9249180358..963eb34007a 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -75,7 +75,7 @@ mirror://xorg/individual/app/xwininfo-1.1.4.tar.bz2
 mirror://xorg/individual/app/xwud-1.0.5.tar.bz2
 mirror://xorg/individual/data/xbitmaps-1.1.2.tar.bz2
 mirror://xorg/individual/data/xcursor-themes-1.0.6.tar.bz2
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.31.tar.bz2
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.33.tar.bz2
 mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2
 mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
@@ -175,7 +175,7 @@ mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.7.1.tar.bz2
+mirror://xorg/individual/lib/libX11-1.7.2.tar.bz2
 mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2
 mirror://xorg/individual/lib/libXaw3d-1.6.3.tar.bz2
@@ -185,7 +185,7 @@ mirror://xorg/individual/lib/libXcursor-1.2.0.tar.bz2
 mirror://xorg/individual/lib/libXdamage-1.1.5.tar.bz2
 mirror://xorg/individual/lib/libXdmcp-1.1.3.tar.bz2
 mirror://xorg/individual/lib/libXext-1.3.4.tar.bz2
-mirror://xorg/individual/lib/libXfixes-5.0.3.tar.bz2
+mirror://xorg/individual/lib/libXfixes-6.0.0.tar.bz2
 mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
 mirror://xorg/individual/lib/libXfont2-2.0.4.tar.bz2
 mirror://xorg/individual/lib/libXft-2.3.3.tar.bz2
@@ -211,7 +211,7 @@ mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.4.tar.bz2
 mirror://xorg/individual/lib/xtrans-1.4.0.tar.bz2
 mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
-mirror://xorg/individual/proto/xorgproto-2021.3.tar.bz2
+mirror://xorg/individual/proto/xorgproto-2021.4.tar.bz2
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
 mirror://xorg/individual/util/imake-1.0.8.tar.bz2
 mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index d8f73d5a7e3..a8e984d6174 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -44,6 +44,7 @@ rec {
       then throw "Cannot build fully static binaries on Darwin/macOS"
       else stdenv'.mkDerivation (args // {
         NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "") + " -static";
+      } // pkgs.lib.optionalAttrs (!(args.dontAddStaticConfigureFlags or false)) {
         configureFlags = (args.configureFlags or []) ++ [
             "--disable-shared" # brrr...
           ];
@@ -56,6 +57,7 @@ rec {
   makeStaticLibraries = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
         dontDisableStatic = true;
+      } // pkgs.lib.optionalAttrs (!(args.dontAddStaticConfigureFlags or false)) {
         configureFlags = (args.configureFlags or []) ++ [
           "--enable-static"
           "--disable-shared"
diff --git a/pkgs/test/cc-wrapper/default.nix b/pkgs/test/cc-wrapper/default.nix
index d82ba296e2f..b483372dea0 100644
--- a/pkgs/test/cc-wrapper/default.nix
+++ b/pkgs/test/cc-wrapper/default.nix
@@ -35,8 +35,7 @@ in stdenv.mkDerivation {
       printf "checking whether compiler builds valid static C binaries... " >&2
       $CC ${staticLibc} -static -o cc-static ${./cc-main.c}
       ./cc-static
-      # our glibc does not have pie enabled yet.
-      ${lib.optionalString (stdenv.hostPlatform.isMusl && stdenv.cc.isGNU) ''
+      ${lib.optionalString (stdenv.cc.isGNU && lib.versionAtLeast (lib.getVersion stdenv.cc.name) "8.0.0") ''
         printf "checking whether compiler builds valid static pie C binaries... " >&2
         $CC ${staticLibc} -static-pie -o cc-static-pie ${./cc-main.c}
         ./cc-static-pie
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index e2bb98a4b80..94f739a6c53 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -14,6 +14,19 @@ stdenv.mkDerivation rec {
     owner = pname;
   };
 
+  patches = [
+    (fetchpatch { # https://github.com/lz4/lz4/pull/972
+      name = "CVE-2021-3520.patch";
+      url = "https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7.patch";
+      sha256 = "0r1cwpqdkdc8im0pf2r5jp7mwwn69xcw405rrk7rc0mpjcp5ydfk";
+    })
+    (fetchpatch { # https://github.com/lz4/lz4/pull/973
+      name = "avoid-null-pointer-dereference.patch";
+      url = "https://github.com/lz4/lz4/commit/29a6a1f4941e7243241fe00d6c13b749fd6b60c2.patch";
+      sha256 = "0v5yl5hd3qrfm3xm7m06j4b21qwllb4cqkjn2az7x1vnzqgpf8y7";
+    })
+  ];
+
   # TODO(@Ericson2314): Separate binaries and libraries
   outputs = [ "bin" "out" "dev" ];
 
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index e890518a45a..a89453b55f4 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zstd";
-  version = "1.4.9";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "zstd";
     rev = "v${version}";
-    sha256 = "18alxnym54gswsmsr5ra82q4k1q5fyzsyx0jykb2sk2nkpvx7334";
+    sha256 = "0icc0x89c35rq5bxd4d241vqxnz2i1qj2wwy01xls63p0z93brj7";
   };
 
   nativeBuildInputs = [ cmake ]
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 2ad99c727d9..b46fd88ab99 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -20,11 +20,11 @@ let
 in
 (if withQt then mkDerivation else stdenv.mkDerivation) rec {
   pname = "gnuplot";
-  version = "5.4.1";
+  version = "5.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnuplot/${pname}-${version}.tar.gz";
-    sha256 = "03jrqs5lvxmbbz2c4g17dn2hrxqwd3hfadk9q8wbkbkyas2h8sbb";
+    sha256 = "sha256-5Xx14TGBM5UdMqg7zcSv8X/tKHIsTnHyMFz8KuHK57o=";
   };
 
   nativeBuildInputs = [ makeWrapper pkg-config texinfo ] ++ lib.optional withQt qttools;
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix
index 000e2b28089..1a387042b2d 100644
--- a/pkgs/tools/graphics/graphviz/base.nix
+++ b/pkgs/tools/graphics/graphviz/base.nix
@@ -21,7 +21,14 @@ let
     buildCommand = "sed s/dot_root/agroot/g ${raw_patch} > $out";
   };
   # 2.42 has the patch included
-  patches = optional (lib.versionOlder version "2.42") patchToUse;
+  patches = optional (lib.versionOlder version "2.42") patchToUse
+  ++ optionals (lib.versionOlder version "2.46.0") [
+    (fetchpatch {
+      name = "CVE-2020-18032.patch";
+      url = "https://gitlab.com/graphviz/graphviz/-/commit/784411ca3655c80da0f6025ab20634b2a6ff696b.patch";
+      sha256 = "1nkw9ism8lkfvxsp5fh95i2l5s5cbjsidbb3g1kjfv10rxkyb41m";
+    })
+  ];
 in
 
 stdenv.mkDerivation {
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index bfe5c5c5045..0b2b03ba8db 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -68,6 +68,12 @@ stdenv.mkDerivation (rec {
     for f in gnulib-tests/{test-chown.c,test-fchownat.c,test-lchown.c}; do
       echo "int main() { return 77; }" > "$f"
     done
+
+    # tests try to access user 1000 which is forbidden in sandbox
+    sed '2i print "Skipping id uid test"; exit 77' -i ./tests/id/uid.sh
+    sed '2i print "Skipping id zero test"; exit 77' -i ./tests/id/zero.sh
+    sed '2i print "Skipping misc help-versiob test"; exit 77' -i ./tests/misc/help-version.sh
+    sed '2i print "Skipping chown separator test"; exit 77' -i ./tests/chown/separator.sh
   '' + optionalString (stdenv.hostPlatform.libc == "musl") (lib.concatStringsSep "\n" [
     ''
       echo "int main() { return 77; }" > gnulib-tests/test-parse-datetime.c
@@ -136,20 +142,15 @@ stdenv.mkDerivation (rec {
   meta = {
     homepage = "https://www.gnu.org/software/coreutils/";
     description = "The basic file, shell and text manipulation utilities of the GNU operating system";
-
     longDescription = ''
       The GNU Core Utilities are the basic file, shell and text
       manipulation utilities of the GNU operating system.  These are
       the core utilities which are expected to exist on every
       operating system.
     '';
-
     license = licenses.gpl3Plus;
-
     platforms = platforms.unix ++ platforms.windows;
-
     priority = 10;
-
     maintainers = [ maintainers.eelco ];
   };
 } // optionalAttrs stdenv.hostPlatform.isMusl {
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index a5c3fbad32d..19840144cda 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "0.166.2";
+  version = "0.168.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+8hh4BR6sTpQyNeiaXgcp/ezPptvbZESky6VAAg1dfI=";
+    sha256 = "sha256-+WDKpkjUlwR39nVB99saSB03NScPzPiyR8xvRBfASTQ=";
   };
 
-  vendorSha256 = "sha256-PkSvdpP9SuftxdcZMA5xG1zSb87e1Ui/oX+HdLBEW0E=";
+  vendorSha256 = "sha256-W/G5AMfYyA9adVFOT/IXI+Bds/6osBOrQ6CtgeHZ8R8=";
 
   buildFlagsArray = [
     "-ldflags="
diff --git a/pkgs/tools/networking/burpsuite/default.nix b/pkgs/tools/networking/burpsuite/default.nix
index a42746c6fa2..53d1a3d4f23 100644
--- a/pkgs/tools/networking/burpsuite/default.nix
+++ b/pkgs/tools/networking/burpsuite/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "burpsuite";
-  version = "2021.5.1";
+  version = "2021.6";
 
   src = fetchurl {
     name = "burpsuite.jar";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
       "https://portswigger.net/Burp/Releases/Download?productId=100&version=${version}&type=Jar"
       "https://web.archive.org/web/https://portswigger.net/Burp/Releases/Download?productId=100&version=${version}&type=Jar"
     ];
-    sha256 = "sha256-nPz6IZpXCyg6cg2nuyqK2f5BI4dNb5tA2NriH3ZC198=";
+    sha256 = "sha256-DPUi/KRnJkwrc7KMq10+LE6+MX9yJLgrgIHKhlfL+vc=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/curl/CVE-2021-22897.patch b/pkgs/tools/networking/curl/CVE-2021-22897.patch
new file mode 100644
index 00000000000..a4888879503
--- /dev/null
+++ b/pkgs/tools/networking/curl/CVE-2021-22897.patch
@@ -0,0 +1,64 @@
+From bbb71507b7bab52002f9b1e0880bed6a32834511 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 23 Apr 2021 10:54:10 +0200
+Subject: [PATCH] schannel: don't use static to store selected ciphers
+
+CVE-2021-22897
+
+Bug: https://curl.se/docs/CVE-2021-22897.html
+---
+ lib/vtls/schannel.c | 9 +++++----
+ lib/vtls/schannel.h | 3 +++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
+index 8c25ac5dd5a5..dba7072273a9 100644
+--- a/lib/vtls/schannel.c
++++ b/lib/vtls/schannel.c
+@@ -328,12 +328,12 @@ get_alg_id_by_name(char *name)
+ }
+ 
+ static CURLcode
+-set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers)
++set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
++                int *algIds)
+ {
+   char *startCur = ciphers;
+   int algCount = 0;
+-  static ALG_ID algIds[45]; /*There are 45 listed in the MS headers*/
+-  while(startCur && (0 != *startCur) && (algCount < 45)) {
++  while(startCur && (0 != *startCur) && (algCount < NUMOF_CIPHERS)) {
+     long alg = strtol(startCur, 0, 0);
+     if(!alg)
+       alg = get_alg_id_by_name(startCur);
+@@ -593,7 +593,8 @@ schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn,
+     }
+ 
+     if(SSL_CONN_CONFIG(cipher_list)) {
+-      result = set_ssl_ciphers(&schannel_cred, SSL_CONN_CONFIG(cipher_list));
++      result = set_ssl_ciphers(&schannel_cred, SSL_CONN_CONFIG(cipher_list),
++                               BACKEND->algIds);
+       if(CURLE_OK != result) {
+         failf(data, "Unable to set ciphers to passed via SSL_CONN_CONFIG");
+         return result;
+diff --git a/lib/vtls/schannel.h b/lib/vtls/schannel.h
+index 2952caa1a5a1..77853aa30f96 100644
+--- a/lib/vtls/schannel.h
++++ b/lib/vtls/schannel.h
+@@ -71,6 +71,8 @@ CURLcode Curl_verify_certificate(struct Curl_easy *data,
+ #endif
+ #endif
+ 
++#define NUMOF_CIPHERS 45 /* There are 45 listed in the MS headers */
++
+ struct Curl_schannel_cred {
+   CredHandle cred_handle;
+   TimeStamp time_stamp;
+@@ -102,6 +104,7 @@ struct ssl_backend_data {
+ #ifdef HAS_MANUAL_VERIFY_API
+   bool use_manual_cred_validation; /* true if manual cred validation is used */
+ #endif
++  ALG_ID algIds[NUMOF_CIPHERS];
+ };
+ #endif /* EXPOSE_SCHANNEL_INTERNAL_STRUCTS */
+ 
diff --git a/pkgs/tools/networking/curl/CVE-2021-22898.patch b/pkgs/tools/networking/curl/CVE-2021-22898.patch
new file mode 100644
index 00000000000..ea4d2cb37e8
--- /dev/null
+++ b/pkgs/tools/networking/curl/CVE-2021-22898.patch
@@ -0,0 +1,25 @@
+From 39ce47f219b09c380b81f89fe54ac586c8db6bde Mon Sep 17 00:00:00 2001
+From: Harry Sintonen <sintonen@iki.fi>
+Date: Fri, 7 May 2021 13:09:57 +0200
+Subject: [PATCH] telnet: check sscanf() for correct number of matches
+
+CVE-2021-22898
+
+Bug: https://curl.se/docs/CVE-2021-22898.html
+---
+ lib/telnet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/telnet.c b/lib/telnet.c
+index 26e0658ba9cc..fdd137fb0c04 100644
+--- a/lib/telnet.c
++++ b/lib/telnet.c
+@@ -922,7 +922,7 @@ static void suboption(struct Curl_easy *data)
+         size_t tmplen = (strlen(v->data) + 1);
+         /* Add the variable only if it fits */
+         if(len + tmplen < (int)sizeof(temp)-6) {
+-          if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
++          if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
+             msnprintf((char *)&temp[len], sizeof(temp) - len,
+                       "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
+                       CURL_NEW_ENV_VALUE, varval);
diff --git a/pkgs/tools/networking/curl/CVE-2021-22901.patch b/pkgs/tools/networking/curl/CVE-2021-22901.patch
new file mode 100644
index 00000000000..6bd70aa41b1
--- /dev/null
+++ b/pkgs/tools/networking/curl/CVE-2021-22901.patch
@@ -0,0 +1,437 @@
+Based on upstream 7f4a9a9b2a49547eae24d2e19bc5c346e9026479, modified by ris to
+apply without 0c55fbab45bedb761766109d41c3da49c4bc66c6
+
+diff --git a/lib/multi.c b/lib/multi.c
+index 54365f399e9b..1b3e261c682a 100644
+--- a/lib/multi.c
++++ b/lib/multi.c
+@@ -878,8 +878,10 @@ bool Curl_multiplex_wanted(const struct Curl_multi *multi)
+ void Curl_detach_connnection(struct Curl_easy *data)
+ {
+   struct connectdata *conn = data->conn;
+-  if(conn)
++  if(conn) {
+     Curl_llist_remove(&conn->easyq, &data->conn_queue, NULL);
++    Curl_ssl_detach_conn(data, conn);
++  }
+   data->conn = NULL;
+ }
+ 
+@@ -896,6 +898,7 @@ void Curl_attach_connnection(struct Curl_easy *data,
+   data->conn = conn;
+   Curl_llist_insert_next(&conn->easyq, conn->easyq.tail, data,
+                          &data->conn_queue);
++  Curl_ssl_associate_conn(data, conn);
+ }
+ 
+ static int waitconnect_getsock(struct connectdata *conn,
+diff --git a/lib/vtls/gskit.c b/lib/vtls/gskit.c
+index c648f624579b..ca953769d1ba 100644
+--- a/lib/vtls/gskit.c
++++ b/lib/vtls/gskit.c
+@@ -1304,7 +1304,9 @@ const struct Curl_ssl Curl_ssl_gskit = {
+   Curl_none_set_engine_default,   /* set_engine_default */
+   Curl_none_engines_list,         /* engines_list */
+   Curl_none_false_start,          /* false_start */
+-  NULL                            /* sha256sum */
++  NULL,                           /* sha256sum */
++  NULL,                           /* associate_connection */
++  NULL                            /* disassociate_connection */
+ };
+ 
+ #endif /* USE_GSKIT */
+diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
+index a10c0dbcca05..ecde5c44deeb 100644
+--- a/lib/vtls/gtls.c
++++ b/lib/vtls/gtls.c
+@@ -1656,7 +1656,9 @@ const struct Curl_ssl Curl_ssl_gnutls = {
+   Curl_none_set_engine_default,  /* set_engine_default */
+   Curl_none_engines_list,        /* engines_list */
+   Curl_none_false_start,         /* false_start */
+-  gtls_sha256sum                 /* sha256sum */
++  gtls_sha256sum,                /* sha256sum */
++  NULL,                          /* associate_connection */
++  NULL                           /* disassociate_connection */
+ };
+ 
+ #endif /* USE_GNUTLS */
+diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
+index ca77de58667c..3a0be0f04b4f 100644
+--- a/lib/vtls/mbedtls.c
++++ b/lib/vtls/mbedtls.c
+@@ -1093,7 +1093,9 @@ const struct Curl_ssl Curl_ssl_mbedtls = {
+   Curl_none_set_engine_default,     /* set_engine_default */
+   Curl_none_engines_list,           /* engines_list */
+   Curl_none_false_start,            /* false_start */
+-  mbedtls_sha256sum                 /* sha256sum */
++  mbedtls_sha256sum,                /* sha256sum */
++  NULL,                             /* associate_connection */
++  NULL                              /* disassociate_connection */
+ };
+ 
+ #endif /* USE_MBEDTLS */
+diff --git a/lib/vtls/mesalink.c b/lib/vtls/mesalink.c
+index f16c77c27fe0..bf8600d3230b 100644
+--- a/lib/vtls/mesalink.c
++++ b/lib/vtls/mesalink.c
+@@ -666,7 +666,9 @@ const struct Curl_ssl Curl_ssl_mesalink = {
+   Curl_none_set_engine_default,  /* set_engine_default */
+   Curl_none_engines_list,        /* engines_list */
+   Curl_none_false_start,         /* false_start */
+-  NULL                           /* sha256sum */
++  NULL,                          /* sha256sum */
++  NULL,                          /* associate_connection */
++  NULL                           /* disassociate_connection */
+ };
+ 
+ #endif
+diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
+index 2aa4bdaa134f..1582b1e580a9 100644
+--- a/lib/vtls/nss.c
++++ b/lib/vtls/nss.c
+@@ -2465,7 +2465,9 @@ const struct Curl_ssl Curl_ssl_nss = {
+   Curl_none_set_engine_default, /* set_engine_default */
+   Curl_none_engines_list,       /* engines_list */
+   nss_false_start,              /* false_start */
+-  nss_sha256sum                 /* sha256sum */
++  nss_sha256sum,                /* sha256sum */
++  NULL,                         /* associate_connection */
++  NULL                          /* disassociate_connection */
+ };
+ 
+ #endif /* USE_NSS */
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 1521600dd5f6..ebd7abc3b4ac 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -240,6 +240,10 @@ struct ssl_backend_data {
+ #endif
+ };
+ 
++static void ossl_associate_connection(struct Curl_easy *data,
++                                      struct connectdata *conn,
++                                      int sockindex);
++
+ /*
+  * Number of bytes to read from the random number seed file. This must be
+  * a finite value (because some entropy "files" like /dev/urandom have
+@@ -2581,6 +2585,7 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
+   curl_socket_t sockfd = conn->sock[sockindex];
+   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
+   ctx_option_t ctx_options = 0;
++  void *ssl_sessionid = NULL;
+ 
+ #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
+   bool sni;
+@@ -3225,46 +3230,23 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
+   }
+ #endif
+ 
+-  /* Check if there's a cached ID we can/should use here! */
+-  if(SSL_SET_OPTION(primary.sessionid)) {
+-    void *ssl_sessionid = NULL;
+-    int data_idx = ossl_get_ssl_data_index();
+-    int connectdata_idx = ossl_get_ssl_conn_index();
+-    int sockindex_idx = ossl_get_ssl_sockindex_index();
+-    int proxy_idx = ossl_get_proxy_index();
+-
+-    if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
+-       proxy_idx >= 0) {
+-      /* Store the data needed for the "new session" callback.
+-       * The sockindex is stored as a pointer to an array element. */
+-      SSL_set_ex_data(backend->handle, data_idx, data);
+-      SSL_set_ex_data(backend->handle, connectdata_idx, conn);
+-      SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
+-#ifndef CURL_DISABLE_PROXY
+-      SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
+-                      NULL);
+-#else
+-      SSL_set_ex_data(backend->handle, proxy_idx, NULL);
+-#endif
+-
+-    }
++  ossl_associate_connection(data, conn, sockindex);
+ 
+-    Curl_ssl_sessionid_lock(data);
+-    if(!Curl_ssl_getsessionid(data, conn, SSL_IS_PROXY() ? TRUE : FALSE,
+-                              &ssl_sessionid, NULL, sockindex)) {
+-      /* we got a session id, use it! */
+-      if(!SSL_set_session(backend->handle, ssl_sessionid)) {
+-        Curl_ssl_sessionid_unlock(data);
+-        failf(data, "SSL: SSL_set_session failed: %s",
+-              ossl_strerror(ERR_get_error(), error_buffer,
+-                            sizeof(error_buffer)));
+-        return CURLE_SSL_CONNECT_ERROR;
+-      }
+-      /* Informational message */
+-      infof(data, "SSL re-using session ID\n");
++  Curl_ssl_sessionid_lock(data);
++  if(!Curl_ssl_getsessionid(data, conn, SSL_IS_PROXY() ? TRUE : FALSE,
++                            &ssl_sessionid, NULL, sockindex)) {
++    /* we got a session id, use it! */
++    if(!SSL_set_session(backend->handle, ssl_sessionid)) {
++      Curl_ssl_sessionid_unlock(data);
++      failf(data, "SSL: SSL_set_session failed: %s",
++            ossl_strerror(ERR_get_error(), error_buffer,
++                          sizeof(error_buffer)));
++      return CURLE_SSL_CONNECT_ERROR;
+     }
+-    Curl_ssl_sessionid_unlock(data);
++    /* Informational message */
++    infof(data, "SSL re-using session ID\n");
+   }
++  Curl_ssl_sessionid_unlock(data);
+ 
+ #ifndef CURL_DISABLE_PROXY
+   if(conn->proxy_ssl[sockindex].use) {
+@@ -4498,6 +4480,90 @@ static void *ossl_get_internals(struct ssl_connect_data *connssl,
+          (void *)backend->ctx : (void *)backend->handle;
+ }
+ 
++static void ossl_associate_connection(struct Curl_easy *data,
++                                      struct connectdata *conn,
++                                      int sockindex)
++{
++  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
++  struct ssl_backend_data *backend = connssl->backend;
++
++  /* If we don't have SSL context, do nothing. */
++  if(!backend->handle)
++    return;
++
++  if(SSL_SET_OPTION(primary.sessionid)) {
++    int data_idx = ossl_get_ssl_data_index();
++    int connectdata_idx = ossl_get_ssl_conn_index();
++    int sockindex_idx = ossl_get_ssl_sockindex_index();
++    int proxy_idx = ossl_get_proxy_index();
++
++    if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
++       proxy_idx >= 0) {
++      /* Store the data needed for the "new session" callback.
++       * The sockindex is stored as a pointer to an array element. */
++      SSL_set_ex_data(backend->handle, data_idx, data);
++      SSL_set_ex_data(backend->handle, connectdata_idx, conn);
++      SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
++#ifndef CURL_DISABLE_PROXY
++      SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
++                      NULL);
++#else
++      SSL_set_ex_data(backend->handle, proxy_idx, NULL);
++#endif
++    }
++  }
++}
++
++/*
++ * Starting with TLS 1.3, the ossl_new_session_cb callback gets called after
++ * the handshake. If the transfer that sets up the callback gets killed before
++ * this callback arrives, we must make sure to properly clear the data to
++ * avoid UAF problems. A future optimization could be to instead store another
++ * transfer that might still be using the same connection.
++ */
++
++static void ossl_disassociate_connection(struct Curl_easy *data,
++                                         int sockindex)
++{
++  struct connectdata *conn = data->conn;
++  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
++  struct ssl_backend_data *backend = connssl->backend;
++
++  /* If we don't have SSL context, do nothing. */
++  if(!backend->handle)
++    return;
++
++  if(SSL_SET_OPTION(primary.sessionid)) {
++    bool isproxy = FALSE;
++    bool incache;
++    void *old_ssl_sessionid = NULL;
++    int data_idx = ossl_get_ssl_data_index();
++    int connectdata_idx = ossl_get_ssl_conn_index();
++    int sockindex_idx = ossl_get_ssl_sockindex_index();
++    int proxy_idx = ossl_get_proxy_index();
++
++    if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
++       proxy_idx >= 0) {
++      /* Invalidate the session cache entry, if any */
++      isproxy = SSL_get_ex_data(backend->handle, proxy_idx) ? TRUE : FALSE;
++
++      /* Disable references to data in "new session" callback to avoid
++       * accessing a stale pointer. */
++      SSL_set_ex_data(backend->handle, data_idx, NULL);
++      SSL_set_ex_data(backend->handle, connectdata_idx, NULL);
++      SSL_set_ex_data(backend->handle, sockindex_idx, NULL);
++      SSL_set_ex_data(backend->handle, proxy_idx, NULL);
++    }
++
++    Curl_ssl_sessionid_lock(data);
++    incache = !(Curl_ssl_getsessionid(data, conn, isproxy,
++                                      &old_ssl_sessionid, NULL, sockindex));
++    if(incache)
++      Curl_ssl_delsessionid(data, old_ssl_sessionid);
++    Curl_ssl_sessionid_unlock(data);
++  }
++}
++
+ const struct Curl_ssl Curl_ssl_openssl = {
+   { CURLSSLBACKEND_OPENSSL, "openssl" }, /* info */
+ 
+@@ -4533,10 +4599,12 @@ const struct Curl_ssl Curl_ssl_openssl = {
+   ossl_engines_list,        /* engines_list */
+   Curl_none_false_start,    /* false_start */
+ #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
+-  ossl_sha256sum            /* sha256sum */
++  ossl_sha256sum,           /* sha256sum */
+ #else
+-  NULL                      /* sha256sum */
++  NULL,                     /* sha256sum */
+ #endif
++  ossl_associate_connection, /* associate_connection */
++  ossl_disassociate_connection /* disassociate_connection */
+ };
+ 
+ #endif /* USE_OPENSSL */
+diff --git a/lib/vtls/rustls.c b/lib/vtls/rustls.c
+index 9dfbd2c3c4c2..161f3bf51d75 100644
+--- a/lib/vtls/rustls.c
++++ b/lib/vtls/rustls.c
+@@ -604,7 +604,9 @@ const struct Curl_ssl Curl_ssl_rustls = {
+   Curl_none_set_engine_default,    /* set_engine_default */
+   Curl_none_engines_list,          /* engines_list */
+   Curl_none_false_start,           /* false_start */
+-  NULL                             /* sha256sum */
++  NULL,                            /* sha256sum */
++  NULL,                            /* associate_connection */
++  NULL                             /* disassociate_connection */
+ };
+ 
+ #endif /* USE_RUSTLS */
+diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
+index dba7072273a9..2bcf11db2576 100644
+--- a/lib/vtls/schannel.c
++++ b/lib/vtls/schannel.c
+@@ -329,7 +329,7 @@ get_alg_id_by_name(char *name)
+ 
+ static CURLcode
+ set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
+-                int *algIds)
++                ALG_ID *algIds)
+ {
+   char *startCur = ciphers;
+   int algCount = 0;
+@@ -2433,7 +2433,9 @@ const struct Curl_ssl Curl_ssl_schannel = {
+   Curl_none_set_engine_default,      /* set_engine_default */
+   Curl_none_engines_list,            /* engines_list */
+   Curl_none_false_start,             /* false_start */
+-  schannel_sha256sum                 /* sha256sum */
++  schannel_sha256sum,                /* sha256sum */
++  NULL,                              /* associate_connection */
++  NULL                               /* disassociate_connection */
+ };
+ 
+ #endif /* USE_SCHANNEL */
+diff --git a/lib/vtls/sectransp.c b/lib/vtls/sectransp.c
+index 4276b89cfb3a..8b1e84ed7715 100644
+--- a/lib/vtls/sectransp.c
++++ b/lib/vtls/sectransp.c
+@@ -3453,6 +3453,8 @@ const struct Curl_ssl Curl_ssl_sectransp = {
+   Curl_none_engines_list,             /* engines_list */
+   sectransp_false_start,              /* false_start */
+   sectransp_sha256sum                 /* sha256sum */
++  NULL,                               /* associate_connection */
++  NULL                                /* disassociate_connection */
+ };
+ 
+ #ifdef __clang__
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index d63fd5c76386..65f4f773dd63 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -586,6 +586,25 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
+   return CURLE_OK;
+ }
+ 
++void Curl_ssl_associate_conn(struct Curl_easy *data,
++                             struct connectdata *conn)
++{
++  if(Curl_ssl->associate_connection) {
++    Curl_ssl->associate_connection(data, conn, FIRSTSOCKET);
++    if(conn->sock[SECONDARYSOCKET] && conn->bits.sock_accepted)
++      Curl_ssl->associate_connection(data, conn, SECONDARYSOCKET);
++  }
++}
++
++void Curl_ssl_detach_conn(struct Curl_easy *data,
++                          struct connectdata *conn)
++{
++  if(Curl_ssl->disassociate_connection) {
++    Curl_ssl->disassociate_connection(data, FIRSTSOCKET);
++    if(conn->sock[SECONDARYSOCKET] && conn->bits.sock_accepted)
++      Curl_ssl->disassociate_connection(data, SECONDARYSOCKET);
++  }
++}
+ 
+ void Curl_ssl_close_all(struct Curl_easy *data)
+ {
+@@ -1214,7 +1233,9 @@ static const struct Curl_ssl Curl_ssl_multi = {
+   Curl_none_set_engine_default,      /* set_engine_default */
+   Curl_none_engines_list,            /* engines_list */
+   Curl_none_false_start,             /* false_start */
+-  NULL                               /* sha256sum */
++  NULL,                              /* sha256sum */
++  NULL,                              /* associate_connection */
++  NULL                               /* disassociate_connection */
+ };
+ 
+ const struct Curl_ssl *Curl_ssl =
+diff --git a/lib/vtls/vtls.h b/lib/vtls/vtls.h
+index a22d526ca810..7f93e7aedb21 100644
+--- a/lib/vtls/vtls.h
++++ b/lib/vtls/vtls.h
+@@ -84,6 +84,11 @@ struct Curl_ssl {
+   bool (*false_start)(void);
+   CURLcode (*sha256sum)(const unsigned char *input, size_t inputlen,
+                     unsigned char *sha256sum, size_t sha256sumlen);
++
++  void (*associate_connection)(struct Curl_easy *data,
++                               struct connectdata *conn,
++                               int sockindex);
++  void (*disassociate_connection)(struct Curl_easy *data, int sockindex);
+ };
+ 
+ #ifdef USE_SSL
+@@ -283,6 +288,11 @@ bool Curl_ssl_cert_status_request(void);
+ 
+ bool Curl_ssl_false_start(void);
+ 
++void Curl_ssl_associate_conn(struct Curl_easy *data,
++                             struct connectdata *conn);
++void Curl_ssl_detach_conn(struct Curl_easy *data,
++                          struct connectdata *conn);
++
+ #define SSL_SHUTDOWN_TIMEOUT 10000 /* ms */
+ 
+ #else /* if not USE_SSL */
+@@ -309,6 +319,8 @@ bool Curl_ssl_false_start(void);
+ #define Curl_ssl_cert_status_request() FALSE
+ #define Curl_ssl_false_start() FALSE
+ #define Curl_ssl_tls13_ciphersuites() FALSE
++#define Curl_ssl_associate_conn(a,b) Curl_nop_stmt
++#define Curl_ssl_detach_conn(a,b) Curl_nop_stmt
+ #endif
+ 
+ #endif /* HEADER_CURL_VTLS_H */
+diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
+index 02fcd236697e..60e27e366252 100644
+--- a/lib/vtls/wolfssl.c
++++ b/lib/vtls/wolfssl.c
+@@ -1125,7 +1125,9 @@ const struct Curl_ssl Curl_ssl_wolfssl = {
+   Curl_none_set_engine_default,    /* set_engine_default */
+   Curl_none_engines_list,          /* engines_list */
+   Curl_none_false_start,           /* false_start */
+-  wolfssl_sha256sum                /* sha256sum */
++  wolfssl_sha256sum,               /* sha256sum */
++  NULL,                            /* associate_connection */
++  NULL                             /* disassociate_connection */
+ };
+ 
+ #endif
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 05b91bfba05..984a6ecaaef 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -52,6 +52,12 @@ stdenv.mkDerivation rec {
     sha256 = "1scmfrp0c27pkd7yva9k50miprjpsyfbb33apx72qc9igm6ii3ks";
   };
 
+  patches = [
+    ./CVE-2021-22897.patch
+    ./CVE-2021-22898.patch
+    ./CVE-2021-22901.patch
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/pkgs/tools/networking/globalprotect-openconnect/default.nix b/pkgs/tools/networking/globalprotect-openconnect/default.nix
new file mode 100644
index 00000000000..d61668f7b65
--- /dev/null
+++ b/pkgs/tools/networking/globalprotect-openconnect/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, lib, fetchFromGitHub
+, qmake, qtwebsockets, qtwebengine, wrapQtAppsHook, openconnect
+}:
+
+stdenv.mkDerivation rec {
+  pname = "globalprotect-openconnect";
+  version = "1.2.6";
+
+  src = fetchFromGitHub {
+    owner = "yuezk";
+    repo = "GlobalProtect-openconnect";
+    rev = "c14a6ad1d2b62f8d297bc4cfbcb1dcea4d99112f";
+    fetchSubmodules = true;
+    sha256 = "1zkc3vk1j31n2zs5ammzv23dah7x163gfrzz222ynbkvsccrhzrk";
+  };
+
+  nativeBuildInputs = [ qmake wrapQtAppsHook ];
+
+  buildInputs = [ openconnect qtwebsockets qtwebengine ];
+
+  patchPhase = ''
+    for f in GPClient/GPClient.pro \
+      GPClient/com.yuezk.qt.gpclient.desktop \
+      GPService/GPService.pro \
+      GPService/dbus/com.yuezk.qt.GPService.service \
+      GPService/systemd/gpservice.service; do
+        substituteInPlace $f \
+          --replace /usr $out \
+          --replace /etc $out/lib;
+    done;
+
+    substituteInPlace GPService/gpservice.h \
+      --replace /usr/local/bin/openconnect ${openconnect}/bin/openconnect;
+  '';
+
+  meta = with lib; {
+    description = "GlobalProtect VPN client (GUI) for Linux based on OpenConnect that supports SAML auth mode";
+    homepage = "https://github.com/yuezk/GlobalProtect-openconnect";
+    license = licenses.gpl3Only;
+    maintainers = [ maintainers.jerith666 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 8afe546c459..0e1da29320f 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -8,8 +8,8 @@
 , libxml2
 , stoken
 , zlib
-, fetchgit
-, darwin
+, vpnc-scripts
+, PCSC
 , head ? false
   , fetchFromGitLab
   , autoreconfHook
@@ -17,13 +17,7 @@
 
 assert (openssl != null) == (gnutls == null);
 
-let vpnc = fetchgit {
-  url = "git://git.infradead.org/users/dwmw2/vpnc-scripts.git";
-  rev = "c0122e891f7e033f35f047dad963702199d5cb9e";
-  sha256 = "11b1ls012mb704jphqxjmqrfbbhkdjb64j2q4k8wb5jmja8jnd14";
-};
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "openconnect${lib.optionalString head "-head"}";
   version = if head then "2021-05-05" else "8.10";
 
@@ -42,19 +36,19 @@ in stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   configureFlags = [
-    "--with-vpnc-script=${vpnc}/vpnc-script"
+    "--with-vpnc-script=${vpnc-scripts}/bin/vpnc-script"
     "--disable-nls"
     "--without-openssl-version-check"
   ];
 
   buildInputs = [ openssl gnutls gmp libxml2 stoken zlib ]
-    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.PCSC;
+    ++ lib.optional stdenv.isDarwin PCSC;
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional head autoreconfHook;
 
   meta = with lib; {
     description = "VPN Client for Cisco's AnyConnect SSL VPN";
-    homepage = "http://www.infradead.org/openconnect/";
+    homepage = "https://www.infradead.org/openconnect/";
     license = licenses.lgpl21Only;
     maintainers = with maintainers; [ pradeepchhetri tricktron ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
diff --git a/pkgs/tools/networking/vpnc-scripts/default.nix b/pkgs/tools/networking/vpnc-scripts/default.nix
new file mode 100644
index 00000000000..734c6d9f4ec
--- /dev/null
+++ b/pkgs/tools/networking/vpnc-scripts/default.nix
@@ -0,0 +1,41 @@
+{ lib, stdenv, fetchgit
+, makeWrapper
+, nettools, gawk, systemd, openresolv, coreutils, gnugrep
+}:
+
+stdenv.mkDerivation {
+  pname = "vpnc-scripts";
+  version = "unstable-2021-03-21";
+  src = fetchgit {
+    url = "git://git.infradead.org/users/dwmw2/vpnc-scripts.git";
+    rev = "8fff06090ed193c4a7285e9a10b42e6679e8ecf3";
+    sha256 = "14bzzpwz7kdmlbx825h6s4jjdml9q6ziyrq8311lp8caql68qdq1";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp vpnc-script $out/bin
+  '';
+
+  preFixup = ''
+    substituteInPlace $out/bin/vpnc-script \
+      --replace "which" "type -P"
+  '' + lib.optionalString stdenv.isLinux ''
+    substituteInPlace $out/bin/vpnc-script \
+      --replace "/sbin/resolvconf" "${openresolv}/bin/resolvconf" \
+      --replace "/usr/bin/resolvectl" "${systemd}/bin/resolvectl"
+  '' + ''
+    wrapProgram $out/bin/vpnc-script \
+      --prefix PATH : "${lib.makeBinPath ([ nettools gawk coreutils gnugrep ] ++ lib.optionals stdenv.isLinux [ openresolv ])}"
+  '';
+
+  meta = with lib; {
+    description = "script for vpnc to configure the network routing and name service";
+    homepage = "https://www.infradead.org/openconnect/";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ jerith666 ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
diff --git a/pkgs/tools/security/gau/default.nix b/pkgs/tools/security/gau/default.nix
index 46498e49cff..fec4e4e013b 100644
--- a/pkgs/tools/security/gau/default.nix
+++ b/pkgs/tools/security/gau/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gau";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "lc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1srbql603vvlxc6p1ibw0982icdq9kcr1iamxlr8bmgldbm8215w";
+    sha256 = "sha256-hUIUDDP9NtMmJXj5GCD/ISUUcx5prKCVVFztff9txoU=";
   };
 
-  vendorSha256 = "17ag2wvaxv2dyx3yx3fvlf36ww4a44660pn4gvpbrwacsan9as5s";
+  vendorSha256 = "sha256-WMoFbqtBMcjTWX51mEMzpgDEAndCElldNqjG27yXd2w=";
 
   meta = with lib; {
     description = "Tool to fetch known URLs";
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index c602ec622cd..68bf35a751e 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, which }:
+{ lib, stdenv, fetchFromGitHub, which
+, enableStatic ? stdenv.hostPlatform.isStatic
+}:
 
 stdenv.mkDerivation rec {
   version = "1.4.1";
@@ -14,13 +16,20 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ which ];
 
   # configure script is not autotools-based, doesn't support these options
+  dontAddStaticConfigureFlags = true;
   configurePlatforms = [ ];
+  configureFlags = [
+    "--ar=${stdenv.cc.targetPrefix}ar"
+    (lib.enableFeature enableStatic "static")
+    (lib.enableFeature enableStatic "lib-static")
+  ];
 
   doCheck = true;
 
   checkTarget = "test-full";
 
-  installTargets = [ "install" "install-lib-shared" "install-lib-so-link" "install-lib-headers" ];
+  installTargets = [ "install" "install-lib-headers" ]
+    ++ lib.optional (!enableStatic) "install-lib-so-link";
 
   meta = with lib; {
     homepage = "http://rhash.sourceforge.net/";
diff --git a/pkgs/tools/system/gptfdisk/default.nix b/pkgs/tools/system/gptfdisk/default.nix
index bf6589eb66b..0e7aff32bf0 100644
--- a/pkgs/tools/system/gptfdisk/default.nix
+++ b/pkgs/tools/system/gptfdisk/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gptfdisk";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchurl {
     # https://www.rodsbooks.com/gdisk/${name}.tar.gz also works, but the home
     # page clearly implies a preference for using SourceForge's bandwidth:
     url = "mirror://sourceforge/gptfdisk/${pname}-${version}.tar.gz";
-    sha256 = "sha256-dUAEt/hbJ5KHx6w8BGmx1+Dq4EOpei5YewVgyl84KMA=";
+    sha256 = "sha256-ldGYVvAE2rxLjDQrJhLo0KnuvdUgBClxiDafFS6dxt8=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/typesetting/asciidoc/default.nix b/pkgs/tools/typesetting/asciidoc/default.nix
index 6716d764d5d..ce3b142fbc5 100644
--- a/pkgs/tools/typesetting/asciidoc/default.nix
+++ b/pkgs/tools/typesetting/asciidoc/default.nix
@@ -146,7 +146,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "asciidoc";
-  version = "9.0.4";
+  version = "9.1.0";
 
   # Note: a substitution to improve reproducibility should be updated once 10.0.0 is
   # released. See the comment in `patchPhase` for more information.
@@ -154,7 +154,7 @@ stdenv.mkDerivation rec {
     owner = "asciidoc";
     repo = "asciidoc-py3";
     rev = version;
-    sha256 = "1gspxw5i0axymxdjzj5rmhf10gyl2gqr666gz141nv042l9dm5vi";
+    sha256 = "1clf1axkns23wfmh48xfspzsnw04pjh4mq1pshpzvj0cwxhz0yaq";
   };
 
   nativeBuildInputs = [ python3 unzip autoreconfHook ];
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 17c1b39a92c..53e139cde3b 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -1,6 +1,8 @@
-{ stdenv, rustPlatform, fetchurl, fetchFromGitHub, lib, nasm, cargo-c, libiconv }:
+{ stdenv, rustPlatform, rust, fetchurl, fetchFromGitHub, lib, nasm, cargo-c, libiconv }:
 
-rustPlatform.buildRustPackage rec {
+let
+  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
+in rustPlatform.buildRustPackage rec {
   pname = "rav1e";
   version = "0.4.1";
 
@@ -31,11 +33,11 @@ rustPlatform.buildRustPackage rec {
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
 
   postBuild = ''
-    cargo cbuild --release --frozen --prefix=${placeholder "out"}
+    cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
   postInstall = ''
-    cargo cinstall --release --frozen --prefix=${placeholder "out"}
+    cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1b6e44c08ce..e5668a3a84c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9576,6 +9576,8 @@ in
 
   vpnc = callPackage ../tools/networking/vpnc { };
 
+  vpnc-scripts = callPackage ../tools/networking/vpnc-scripts { };
+
   vpn-slice = python3Packages.callPackage ../tools/networking/vpn-slice { };
 
   vp = callPackage ../applications/misc/vp {
@@ -9588,18 +9590,23 @@ in
   openconnect = openconnect_gnutls;
 
   openconnect_openssl = callPackage ../tools/networking/openconnect {
+    inherit (darwin.apple_sdk.frameworks) PCSC;
     gnutls = null;
   };
 
   openconnect_gnutls = callPackage ../tools/networking/openconnect {
+    inherit (darwin.apple_sdk.frameworks) PCSC;
     openssl = null;
   };
 
   openconnect_head = callPackage ../tools/networking/openconnect {
+    inherit (darwin.apple_sdk.frameworks) PCSC;
     head = true;
     openssl = null;
   };
 
+  globalprotect-openconnect = libsForQt5.callPackage ../tools/networking/globalprotect-openconnect { };
+
   ding-libs = callPackage ../tools/misc/ding-libs { };
 
   sssd = callPackage ../os-specific/linux/sssd {
@@ -11507,6 +11514,8 @@ in
   llvm_5  = llvmPackages_5.llvm;
 
   llvmPackages = let
+    latest_version = lib.toInt
+      (lib.versions.major llvmPackages_latest.llvm.version);
     # This returns the minimum supported version for the platform. The
     # assumption is that or any later version is good.
     choose = platform:
@@ -11515,7 +11524,7 @@ in
       else if platform.isAndroid then 12
       else if platform.isLinux then (if platform.isRiscV then 11 else 7)
       else if platform.isWasm then 8
-      else 11; # latest
+      else latest_version;
     # We take the "max of the mins". Why? Since those are lower bounds of the
     # supported version set, this is like intersecting those sets and then
     # taking the min bound of that.
@@ -11575,7 +11584,7 @@ in
     stdenv = gcc7Stdenv;
   }));
 
-  llvmPackages_latest = llvmPackages_11;
+  llvmPackages_latest = llvmPackages_12;
 
   llvmPackages_rocm = recurseIntoAttrs (callPackage ../development/compilers/llvm/rocm { });
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8b5298059f1..f67e28a1dc9 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8092,7 +8092,7 @@ let
       sha256 = "0wm87gpagb35d7c4nyaf9z3ry0jb3g5xpyjfzcxqcfxyj2zy9ip2";
     };
     doCheck = false; # Failed test 'desktop file is the right one'
-    buildInputs = [ FileBaseDir FileDesktopEntry ];
+    buildInputs = [ FileBaseDir FileDesktopEntry EncodeLocale ];
   };
 
   FileMMagic = buildPerlPackage {
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 5575c1d429c..744e40c95dd 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -364,7 +364,7 @@ lib.makeScope pkgs.newScope (self: with self; {
       # oci8 (7.4, 7.3, 7.2)
       # odbc (7.4, 7.3, 7.2)
       { name = "opcache";
-        buildInputs = [ pcre2 ] ++ lib.optionals (!stdenv.isDarwin && lib.versionAtLeast php.version "8.0") [
+        buildInputs = [ pcre2 ] ++ lib.optionals (lib.versionAtLeast php.version "8.0" && !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind) [
           valgrind.dev
         ];
         patches = lib.optionals (lib.versionOlder php.version "7.4") [
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index 32559c0e799..0c9af250e87 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -50,14 +50,10 @@ self: super: let
     # ++ optional (super.stdenv.hostPlatform.libc == "glibc") ((flip overrideInStdenv) [ self.stdenv.glibc.static ])
   ;
 
-  removeUnknownConfigureFlags = f: with self.lib;
-    remove "--disable-shared"
-    (remove "--enable-static" f);
-
   ocamlFixPackage = b:
     b.overrideAttrs (o: {
       configurePlatforms = [ ];
-      configureFlags = removeUnknownConfigureFlags (o.configureFlags or [ ]);
+      dontAddStaticConfigureFlags = true;
       buildInputs = o.buildInputs ++ o.nativeBuildInputs or [ ];
       propagatedNativeBuildInputs = o.propagatedBuildInputs or [ ];
     });
@@ -75,7 +71,8 @@ self: super: let
         preConfigure = ''
           configureFlagsArray+=("-cc" "$CC" "-as" "$AS" "-partialld" "$LD -r")
         '';
-        configureFlags = (removeUnknownConfigureFlags o.configureFlags) ++ [
+        dontAddStaticConfigureFlags = true;
+        configureFlags = [
           "--no-shared-libs"
           "-host ${o.stdenv.hostPlatform.config}"
           "-target ${o.stdenv.targetPlatform.config}"
@@ -124,11 +121,6 @@ in {
     if set ? overrideScope' then set.overrideScope' ocamlStaticAdapter else set
   ) super.ocaml-ng;
 
-  openssl = super.openssl_1_1.overrideAttrs (o: {
-    # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags.
-    configureFlags = (removeUnknownConfigureFlags o.configureFlags);
-  });
-
   perl = super.perl.override {
     # Don’t use new stdenv zlib because
     # it doesn’t like the --disable-shared flag