summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.editorconfig5
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml4
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md3
-rw-r--r--pkgs/applications/audio/caudec/default.nix4
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix4
-rw-r--r--pkgs/applications/audio/guitarix/default.nix2
-rw-r--r--pkgs/applications/blockchains/bisq-desktop/default.nix3
-rw-r--r--pkgs/applications/editors/oni2/common.nix1
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix1
-rw-r--r--pkgs/applications/graphics/geeqie/default.nix4
-rw-r--r--pkgs/applications/graphics/sane/backends/brscan4/default.nix4
-rw-r--r--pkgs/applications/graphics/sane/backends/brscan5/default.nix4
-rw-r--r--pkgs/applications/networking/bee/bee.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/linphone/default.nix2
-rw-r--r--pkgs/applications/networking/mailreaders/meli/default.nix3
-rw-r--r--pkgs/applications/networking/mailreaders/notmuch-bower/default.nix4
-rw-r--r--pkgs/applications/office/bookworm/default.nix2
-rw-r--r--pkgs/applications/science/biology/quast/default.nix4
-rw-r--r--pkgs/applications/science/biology/tebreak/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/alacritty/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix10
-rw-r--r--pkgs/applications/video/clickshare-csc1/default.nix2
-rw-r--r--pkgs/applications/video/kodi/unwrapped.nix4
-rw-r--r--pkgs/applications/video/peek/default.nix2
-rw-r--r--pkgs/applications/window-managers/wmfs/default.nix6
-rw-r--r--pkgs/build-support/docker/default.nix3
-rw-r--r--pkgs/build-support/fetchfirefoxaddon/default.nix4
-rw-r--r--pkgs/build-support/fetchnextcloudapp/default.nix7
-rw-r--r--pkgs/build-support/writers/default.nix4
-rw-r--r--pkgs/desktops/cdesktopenv/default.nix4
-rw-r--r--pkgs/development/compilers/bupc/default.nix1
-rw-r--r--pkgs/development/compilers/chez/default.nix2
-rw-r--r--pkgs/development/compilers/opendylan/bin.nix4
-rw-r--r--pkgs/development/compilers/squeak/default.nix4
-rw-r--r--pkgs/development/compilers/swift/default.nix6
-rw-r--r--pkgs/development/coq-modules/flocq/default.nix4
-rw-r--r--pkgs/development/interpreters/guile/1.8.nix1
-rw-r--r--pkgs/development/interpreters/guile/2.0.nix1
-rw-r--r--pkgs/development/interpreters/guile/2.2.nix1
-rw-r--r--pkgs/development/interpreters/guile/3.0.nix1
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh3
-rw-r--r--pkgs/development/interpreters/python/wrapper.nix4
-rw-r--r--pkgs/development/libraries/at-spi2-core/default.nix4
-rw-r--r--pkgs/development/libraries/dbus/default.nix7
-rw-r--r--pkgs/development/libraries/gecode/3.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix12
-rw-r--r--pkgs/development/libraries/glibc/default.nix11
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix8
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/devtools/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ges/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/libav/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/rtsp-server/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ugly/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/vaapi/default.nix4
-rw-r--r--pkgs/development/libraries/hyperscan/default.nix4
-rw-r--r--pkgs/development/libraries/libarchive/default.nix27
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/libpqxx/default.nix4
-rw-r--r--pkgs/development/libraries/libvdpau/default.nix4
-rw-r--r--pkgs/development/libraries/libxsmm/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/physics/cernlib/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebengine.nix4
-rw-r--r--pkgs/development/libraries/science/math/liblapack/default.nix13
-rw-r--r--pkgs/development/python-modules/XlsxWriter/default.nix4
-rw-r--r--pkgs/development/python-modules/pandas/default.nix2
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix5
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix2
-rw-r--r--pkgs/development/python-modules/pync/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel_4/default.nix1
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel_5/default.nix1
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix7
-rw-r--r--pkgs/development/tools/build-managers/redo-apenwarr/default.nix3
-rw-r--r--pkgs/development/tools/krankerl/default.nix2
-rw-r--r--pkgs/development/tools/misc/universal-ctags/default.nix2
-rw-r--r--pkgs/development/tools/rust/cbindgen/default.nix8
-rw-r--r--pkgs/development/tools/vala-language-server/default.nix2
-rw-r--r--pkgs/misc/drivers/epson-workforce-635-nx625-series/default.nix4
-rw-r--r--pkgs/misc/openrussian-cli/default.nix4
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix1
-rw-r--r--pkgs/os-specific/linux/device-tree/default.nix4
-rw-r--r--pkgs/os-specific/linux/ell/default.nix7
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix4
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/multipath-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix4
-rw-r--r--pkgs/servers/foundationdb/vsmake.nix4
-rw-r--r--pkgs/servers/monitoring/net-snmp/default.nix4
-rw-r--r--pkgs/servers/nosql/cassandra/generic.nix3
-rw-r--r--pkgs/servers/pulseaudio/default.nix13
-rw-r--r--pkgs/tools/filesystems/irods/common.nix4
-rw-r--r--pkgs/tools/filesystems/irods/default.nix5
-rw-r--r--pkgs/tools/filesystems/zkfuse/default.nix3
-rw-r--r--pkgs/tools/graphics/feedgnuplot/default.nix4
-rw-r--r--pkgs/tools/graphics/gnuplot/default.nix4
-rw-r--r--pkgs/tools/graphics/graphviz/default.nix17
-rw-r--r--pkgs/tools/misc/bat-extras/default.nix6
-rw-r--r--pkgs/tools/misc/idutils/default.nix4
-rw-r--r--pkgs/tools/misc/man-db/default.nix25
-rw-r--r--pkgs/tools/misc/phoronix-test-suite/default.nix4
-rw-r--r--pkgs/tools/misc/tlp/default.nix2
-rw-r--r--pkgs/tools/networking/curl/default.nix11
-rw-r--r--pkgs/tools/networking/networkmanager/l2tp/default.nix4
-rw-r--r--pkgs/tools/networking/ntopng/default.nix4
-rw-r--r--pkgs/tools/security/munge/default.nix4
-rw-r--r--pkgs/tools/text/cmigemo/default.nix4
-rw-r--r--pkgs/tools/text/groff/default.nix12
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix19
-rw-r--r--pkgs/top-level/perl-packages.nix1
-rw-r--r--pkgs/top-level/python-packages.nix2
117 files changed, 256 insertions, 291 deletions
diff --git a/.editorconfig b/.editorconfig
index 17f92c50d16..3c7962ab4d8 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -55,6 +55,11 @@ trim_trailing_whitespace = unset
 [*.lock]
 indent_size = unset
 
+# trailing whitespace is an actual syntax element of classic Markdown/
+# CommonMark to enforce a line break
+[*.md]
+trim_trailing_whitespace = unset
+
 [eggs.nix]
 trim_trailing_whitespace = unset
 
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 2046e2449cc..eb7ad6025da 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -74,6 +74,10 @@
         </para>
       </listitem>
       <listitem>
+<literallayout>Pulseaudio has been upgraded to version 15.0 and now optionally <link xlink:href="https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters">supports additional Bluetooth audio codecs</link> like aptX or LDAC, with codec switching support being available in <literal>pavucontrol</literal>. This feature is disabled by default but can be enabled by using <literal>hardware.pulseaudio.package = pkgs.pulseaudioFull;</literal>.
+Existing 3rd party modules that provided similar functionality, like <literal>pulseaudio-modules-bt</literal> or <literal>pulseaudio-hsphfpd</literal> are deprecated and have been removed.</literallayout>
+      </listitem>
+      <listitem>
         <para>
           The new
           <link xlink:href="https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook"><literal>postgresqlTestHook</literal></link>
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 9674eb66a4c..dffa9b4aec8 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -27,6 +27,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Systemd has been upgraded to the version 250.
 
+- Pulseaudio has been upgraded to version 15.0 and now optionally [supports additional Bluetooth audio codecs](https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters) like aptX or LDAC, with codec switching support being available in `pavucontrol`. This feature is disabled by default but can be enabled by using `hardware.pulseaudio.package = pkgs.pulseaudioFull;`.  
+  Existing 3rd party modules that provided similar functionality, like `pulseaudio-modules-bt` or `pulseaudio-hsphfpd` are deprecated and have been removed.
+
 - The new [`postgresqlTestHook`](https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook) runs a PostgreSQL server for the duration of package checks.
 
 - [`kops`](https://kops.sigs.k8s.io) defaults to 1.22.4, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. This will increase security by default, but may break some types of workloads. See the [release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) for details.
diff --git a/pkgs/applications/audio/caudec/default.nix b/pkgs/applications/audio/caudec/default.nix
index a595f285c68..8b76425f687 100644
--- a/pkgs/applications/audio/caudec/default.nix
+++ b/pkgs/applications/audio/caudec/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, bash, bc, findutils, flac, lame, opusTools, procps, sox }:
+{ lib, stdenv, fetchurl, makeWrapper, bc, findutils, flac, lame, opusTools, procps, sox }:
 
 stdenv.mkDerivation rec {
   pname = "caudec";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     patchShebangs ./install.sh
   '';
 
-  nativeBuildInputs = [ bash makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     ./install.sh --prefix=$out/bin
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index ad57b6a690f..828c415ac5f 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.2.3";
+  version = "2.2.5";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
+    sha256 = "sha256-aR8TLxl6OziP+DMSNro0DB/UtvzXDeDYQ3o/iy70XD4=";
   };
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
diff --git a/pkgs/applications/audio/guitarix/default.nix b/pkgs/applications/audio/guitarix/default.nix
index b6ce0daef0d..724280fbcdd 100644
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@@ -108,6 +108,8 @@ stdenv.mkDerivation rec {
     "--install-roboto-font"
   ] ++ optional optimizationSupport "--optimization";
 
+  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
+
   meta = with lib; {
     description = "A virtual guitar amplifier for Linux running with JACK";
     longDescription = ''
diff --git a/pkgs/applications/blockchains/bisq-desktop/default.nix b/pkgs/applications/blockchains/bisq-desktop/default.nix
index 869f8dcad05..b8c878755ef 100644
--- a/pkgs/applications/blockchains/bisq-desktop/default.nix
+++ b/pkgs/applications/blockchains/bisq-desktop/default.nix
@@ -10,7 +10,6 @@
 , writeScript
 , bash
 , tor
-, gnutar
 , zip
 , xz
 }:
@@ -42,7 +41,7 @@ stdenv.mkDerivation rec {
     sha256 = "09bpkmn22kal3cxg8sil02wy2f2gplsbdkp4viagn0jppma02jid";
   };
 
-  nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg gnutar zip xz ];
+  nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg zip xz ];
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/applications/editors/oni2/common.nix b/pkgs/applications/editors/oni2/common.nix
index e049c3ae641..6cd4ddca4a1 100644
--- a/pkgs/applications/editors/oni2/common.nix
+++ b/pkgs/applications/editors/oni2/common.nix
@@ -95,7 +95,6 @@ in stdenv.mkDerivation (rec {
     clang
     makeWrapper
     nodePackages.esy
-    bash
     perl
     which
     nasm
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix
index d4200c33552..8aa121cbe20 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix
@@ -43,7 +43,6 @@ in ((vscode-utils.override { stdenv = gccStdenv; }).buildVscodeMarketplaceExtens
   };
 }).overrideAttrs({ nativeBuildInputs ? [], buildInputs ? [], ... }: {
   nativeBuildInputs = nativeBuildInputs ++ [
-    bash
     jq
     autoPatchelfHook
     makeWrapper
diff --git a/pkgs/applications/graphics/geeqie/default.nix b/pkgs/applications/graphics/geeqie/default.nix
index 98103efab64..ba5237f21f3 100644
--- a/pkgs/applications/graphics/geeqie/default.nix
+++ b/pkgs/applications/graphics/geeqie/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, autoconf, automake, gettext, intltool
 , gtk3, lcms2, exiv2, libchamplain, clutter-gtk, ffmpegthumbnailer, fbida
-, wrapGAppsHook, fetchpatch, bash, doxygen
+, wrapGAppsHook, fetchpatch, doxygen
 , nix-update-script
 }:
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs =
     [ pkg-config autoconf automake gettext intltool
-      wrapGAppsHook bash doxygen
+      wrapGAppsHook doxygen
     ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/sane/backends/brscan4/default.nix b/pkgs/applications/graphics/sane/backends/brscan4/default.nix
index 6fcb5830556..93d40374607 100644
--- a/pkgs/applications/graphics/sane/backends/brscan4/default.nix
+++ b/pkgs/applications/graphics/sane/backends/brscan4/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, callPackage, patchelf, makeWrapper, coreutils, libusb-compat-0_1 }:
+{ stdenv, lib, fetchurl, callPackage, patchelf, makeWrapper, libusb-compat-0_1 }:
 let
   myPatchElf = file: with lib; ''
     patchelf --set-interpreter \
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     tar xfvz data.tar.gz
   '';
 
-  nativeBuildInputs = [ makeWrapper patchelf coreutils udevRules ];
+  nativeBuildInputs = [ makeWrapper patchelf udevRules ];
   buildInputs = [ libusb-compat-0_1 ];
   dontBuild = true;
 
diff --git a/pkgs/applications/graphics/sane/backends/brscan5/default.nix b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
index 9f76a0dd0b7..219d435a81a 100644
--- a/pkgs/applications/graphics/sane/backends/brscan5/default.nix
+++ b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, callPackage, patchelf, makeWrapper, coreutils, libusb1, avahi-compat, glib, libredirect, nixosTests }:
+{ stdenv, lib, fetchurl, callPackage, patchelf, makeWrapper, libusb1, avahi-compat, glib, libredirect, nixosTests }:
 let
   myPatchElf = file: with lib; ''
     patchelf --set-interpreter \
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     tar xfv data.tar.xz
   '';
 
-  nativeBuildInputs = [ makeWrapper patchelf coreutils ];
+  nativeBuildInputs = [ makeWrapper patchelf ];
   buildInputs = [ libusb1 avahi-compat stdenv.cc.cc glib ];
   dontBuild = true;
 
diff --git a/pkgs/applications/networking/bee/bee.nix b/pkgs/applications/networking/bee/bee.nix
index d2f1740a573..fd6177c4647 100644
--- a/pkgs/applications/networking/bee/bee.nix
+++ b/pkgs/applications/networking/bee/bee.nix
@@ -1,4 +1,4 @@
-{ version ? "release", lib, fetchFromGitHub, buildGoModule, coreutils }:
+{ version ? "release", lib, fetchFromGitHub, buildGoModule }:
 
 let
 
@@ -39,8 +39,6 @@ buildGoModule {
     inherit (versionSpec) rev sha256;
   };
 
-  nativeBuildInputs = [ coreutils ];
-
   subPackages = [ "cmd/bee" ];
 
   # no symbol table, no debug info, and pass the commit for the version string
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 6f0c16f74b8..3b22761cbc0 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -7,7 +7,7 @@
 # Native build inputs:
 , ninja, pkg-config
 , python3, perl
-, gnutar, which
+, which
 , llvmPackages
 # postPatch:
 , pkgsBuildHost
@@ -126,7 +126,7 @@ let
     nativeBuildInputs = [
       ninja pkg-config
       python3WithPackages perl
-      gnutar which
+      which
       llvmPackages.bintools
     ];
 
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index e43251be80c..613c04ddf21 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -24,7 +24,6 @@
 # build time
 , autoconf
 , cargo
-, gnused
 , makeWrapper
 , nodejs
 , perl
@@ -208,7 +207,6 @@ buildStdenv.mkDerivation ({
   nativeBuildInputs = [
     autoconf
     cargo
-    gnused
     llvmPackages.llvm # llvm-objdump
     makeWrapper
     nodejs
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index 5234c95bd6a..3b11f7fc1a8 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -13,7 +13,6 @@
 , ffmpeg
 , gdk-pixbuf
 , glib
-, gnused
 , graphviz
 , gtk2
 , intltool
@@ -143,7 +142,6 @@ mkDerivation rec {
     bcunit
 
     cmake
-    gnused
     graphviz
     intltool
     makeWrapper
diff --git a/pkgs/applications/networking/mailreaders/meli/default.nix b/pkgs/applications/networking/mailreaders/meli/default.nix
index d4076c88bb8..160065effef 100644
--- a/pkgs/applications/networking/mailreaders/meli/default.nix
+++ b/pkgs/applications/networking/mailreaders/meli/default.nix
@@ -6,7 +6,6 @@
 , dbus
 , sqlite
 , file
-, gzip
 , makeWrapper
 , notmuch
   # Build with support for notmuch backend
@@ -25,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-ZE653OtXyZ9454bKPApmuL2kVko/hGBWEAya1L1KIoc=";
 
-  nativeBuildInputs = [ pkg-config gzip makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
 
   buildInputs = [ openssl dbus sqlite ] ++ lib.optional withNotmuch notmuch;
 
diff --git a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
index feca7bd2018..46115f4a56d 100644
--- a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, gawk, mercury, pandoc, ncurses, gpgme }:
+{ lib, stdenv, fetchFromGitHub, mercury, pandoc, ncurses, gpgme }:
 
 stdenv.mkDerivation rec {
   pname = "notmuch-bower";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0r5s16pc3ym5nd33lv9ljv1p1gpb7yysrdni4g7w7yvjrnwk35l6";
   };
 
-  nativeBuildInputs = [ gawk mercury pandoc ];
+  nativeBuildInputs = [ mercury pandoc ];
 
   buildInputs = [ ncurses gpgme ];
 
diff --git a/pkgs/applications/office/bookworm/default.nix b/pkgs/applications/office/bookworm/default.nix
index 9cdbd14e105..c30b9ede2bb 100644
--- a/pkgs/applications/office/bookworm/default.nix
+++ b/pkgs/applications/office/bookworm/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , appstream
-, bash
 , coreutils
 , curl
 , desktop-file-utils
@@ -40,7 +39,6 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    bash
     meson
     ninja
     pkg-config
diff --git a/pkgs/applications/science/biology/quast/default.nix b/pkgs/applications/science/biology/quast/default.nix
index 553fb1de539..ed3fc116dda 100644
--- a/pkgs/applications/science/biology/quast/default.nix
+++ b/pkgs/applications/science/biology/quast/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python3Packages, zlib, bash, coreutils }:
+{ lib, stdenv, fetchurl, python3Packages, zlib, bash }:
 
 let
   pythonPackages = python3Packages;
@@ -16,8 +16,6 @@ pythonPackages.buildPythonApplication rec {
 
   pythonPath = with pythonPackages; [ simplejson joblib setuptools matplotlib ];
 
-  nativeBuildInputs = [ coreutils ];
-
   buildInputs = [ zlib ] ++ pythonPath;
 
   dontConfigure = true;
diff --git a/pkgs/applications/science/biology/tebreak/default.nix b/pkgs/applications/science/biology/tebreak/default.nix
index e56d91dc2cd..a046aee1c6c 100644
--- a/pkgs/applications/science/biology/tebreak/default.nix
+++ b/pkgs/applications/science/biology/tebreak/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, last, exonerate, minia, python3, bwa
-, samtools, findutils }:
+, samtools }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "tebreak";
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "13mgh775d8hkl340923lfwwm4r5ps70girn8d6wgfxzwzxylz8iz";
   };
 
-  nativeBuildInputs = [ findutils python3.pkgs.cython ];
+  nativeBuildInputs = [ python3.pkgs.cython ];
   propagatedBuildInputs = with python3.pkgs; [
     pysam
     scipy
diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index e6762f543cb..32d1286ab1b 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -6,7 +6,6 @@
 , nixosTests
 
 , cmake
-, gzip
 , installShellFiles
 , makeWrapper
 , ncurses
@@ -68,7 +67,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     cmake
-    gzip
     installShellFiles
     makeWrapper
     ncurses
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 262cd332c66..c09de996851 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -13,7 +13,7 @@
 , pythonSupport ? true
 , withpcre2 ? true
 , sendEmailSupport ? false
-, darwin
+, Security, CoreServices
 , nixosTests
 , withLibsecret ? false
 , pkg-config, glib, libsecret
@@ -26,7 +26,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.35.3";
+  version = "2.36.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-FenbT5vy7Z//MMtioAxcfAkBAV9asEjNtOiwTd7gD6I=";
+    sha256 = "sha256-r16/wWWEZPXQ1For/YhMk1+2B6EMwCHZW8gHeIYcwdM=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -79,7 +79,7 @@ stdenv.mkDerivation {
     ++ lib.optionals perlSupport [ perlPackages.perl ]
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
-    ++ lib.optionals stdenv.isDarwin [ darwin.Security ]
+    ++ lib.optionals stdenv.isDarwin [ Security CoreServices ]
     ++ lib.optionals withLibsecret [ pkg-config glib libsecret ];
 
   # required to support pthread_cancel()
@@ -354,6 +354,8 @@ stdenv.mkDerivation {
     disable_test t9902-completion
     # not ok 1 - populate workdir (with 2.33.1 on x86_64-darwin)
     disable_test t5003-archive-zip
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    disable_test t7527-builtin-fsmonitor
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     # Test fails (as of 2.17.0, musl 1.1.19)
     disable_test t3900-i18n-commit
diff --git a/pkgs/applications/video/clickshare-csc1/default.nix b/pkgs/applications/video/clickshare-csc1/default.nix
index 09b24663080..ce63b924030 100644
--- a/pkgs/applications/video/clickshare-csc1/default.nix
+++ b/pkgs/applications/video/clickshare-csc1/default.nix
@@ -4,7 +4,6 @@
 , alsa-lib
 , autoPatchelfHook
 , binutils-unwrapped
-, gnutar
 , libav_0_8
 , libnotify
 , libresample
@@ -35,7 +34,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoPatchelfHook
     binutils-unwrapped
-    gnutar
     rpmextract
     unzip
   ];
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index 47f3e0a9d99..a37e5c92e24 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, makeWrapper
-, pkg-config, cmake, gnumake, yasm, python3Packages
+, pkg-config, cmake, yasm, python3Packages
 , libgcrypt, libgpg-error, libunistring
 , boost, avahi, lame
 , gettext, pcre-cpp, yajl, fribidi, which
@@ -169,7 +169,7 @@ in stdenv.mkDerivation {
       doxygen
       makeWrapper
       which
-      pkg-config gnumake
+      pkg-config
       autoconf automake libtool # still needed for some components. Check if that is the case with 19.0
       jre_headless yasm gettext python3Packages.python flatbuffers
 
diff --git a/pkgs/applications/video/peek/default.nix b/pkgs/applications/video/peek/default.nix
index 27064077a9f..c39363ee363 100644
--- a/pkgs/applications/video/peek/default.nix
+++ b/pkgs/applications/video/peek/default.nix
@@ -10,7 +10,6 @@
 , appstream-glib
 , pkg-config
 , txt2man
-, gzip
 , vala
 , wrapGAppsHook
 , gsettings-desktop-schemas
@@ -50,7 +49,6 @@ stdenv.mkDerivation rec {
     appstream-glib
     desktop-file-utils
     gettext
-    gzip
     meson
     ninja
     libxml2
diff --git a/pkgs/applications/window-managers/wmfs/default.nix b/pkgs/applications/window-managers/wmfs/default.nix
index 83c7d787d88..9169aea4f51 100644
--- a/pkgs/applications/window-managers/wmfs/default.nix
+++ b/pkgs/applications/window-managers/wmfs/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, gnumake,
+{ lib, stdenv, fetchFromGitHub,
   libX11, libXinerama, libXrandr, libXpm, libXft, imlib2 }:
 stdenv.mkDerivation {
   pname = "wmfs";
@@ -12,10 +12,6 @@ stdenv.mkDerivation {
     rev = "b7b8ff812d28c79cb22a73db2739989996fdc6c2";
   };
 
-  nativeBuildInputs = [
-    gnumake
-  ];
-
   buildInputs = [
     imlib2
     libX11
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 5a4e30ede8a..75e0d52d921 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -8,7 +8,6 @@
 , fakechroot
 , fakeNss
 , fakeroot
-, findutils
 , go
 , jq
 , jshon
@@ -556,7 +555,7 @@ rec {
           };
       result = runCommand "docker-image-${baseName}.tar.gz"
         {
-          nativeBuildInputs = [ jshon pigz coreutils findutils jq moreutils ];
+          nativeBuildInputs = [ jshon pigz jq moreutils ];
           # Image name must be lowercase
           imageName = lib.toLower name;
           imageTag = if tag == null then "" else tag;
diff --git a/pkgs/build-support/fetchfirefoxaddon/default.nix b/pkgs/build-support/fetchfirefoxaddon/default.nix
index 79014fd23c4..0fa51e69840 100644
--- a/pkgs/build-support/fetchfirefoxaddon/default.nix
+++ b/pkgs/build-support/fetchfirefoxaddon/default.nix
@@ -1,4 +1,4 @@
-{stdenv, lib, coreutils, unzip, jq, zip, fetchurl,writeScript,  ...}:
+{stdenv, unzip, jq, zip, fetchurl,writeScript,  ...}:
 
 {
   name
@@ -40,5 +40,5 @@ stdenv.mkDerivation {
     zip -r -q -FS "$out/$UUID.xpi" *
     rm -r "$out/$UUID"
   '';
-  nativeBuildInputs = [ coreutils unzip zip jq  ];
+  nativeBuildInputs = [ unzip zip jq  ];
 }
diff --git a/pkgs/build-support/fetchnextcloudapp/default.nix b/pkgs/build-support/fetchnextcloudapp/default.nix
index 7fe5b35e259..094228ad3aa 100644
--- a/pkgs/build-support/fetchnextcloudapp/default.nix
+++ b/pkgs/build-support/fetchnextcloudapp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, gnutar, findutils, fetchurl, ... }:
+{ stdenv, fetchurl, ... }:
 { name
 , url
 , version
@@ -13,11 +13,6 @@ stdenv.mkDerivation {
     inherit url sha256;
   };
 
-  nativeBuildInputs = [
-    gnutar
-    findutils
-  ];
-
   unpackPhase = ''
     tar -xzpf $src
   '';
diff --git a/pkgs/build-support/writers/default.nix b/pkgs/build-support/writers/default.nix
index 2eb021236f9..cf9362ca072 100644
--- a/pkgs/build-support/writers/default.nix
+++ b/pkgs/build-support/writers/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, config, buildPackages, lib, stdenv, libiconv, mkNugetDeps, mkNugetSource, gawk, gnused, gixy }:
+{ pkgs, config, buildPackages, lib, stdenv, libiconv, mkNugetDeps, mkNugetSource, gixy }:
 
 let
   aliases = if config.allowAliases then (import ./aliases.nix lib) else prev: {};
@@ -205,7 +205,7 @@ let
   writeNginxConfig = name: text: pkgs.runCommandLocal name {
     inherit text;
     passAsFile = [ "text" ];
-    nativeBuildInputs = [ gawk gnused gixy ];
+    nativeBuildInputs = [ gixy ];
   } /* sh */ ''
     # nginx-config-formatter has an error - https://github.com/1connect/nginx-config-formatter/issues/16
     awk -f ${awkFormatNginx} "$textPath" | sed '/^\s*$/d' > $out
diff --git a/pkgs/desktops/cdesktopenv/default.nix b/pkgs/desktops/cdesktopenv/default.nix
index b506ed3663b..8039caa74be 100644
--- a/pkgs/desktops/cdesktopenv/default.nix
+++ b/pkgs/desktops/cdesktopenv/default.nix
@@ -3,7 +3,7 @@
 , xorgproto, libX11, bison, ksh, perl, gnum4
 , libXinerama, libXt, libXext, libtirpc, motif, libXft, xbitmaps
 , libjpeg, libXmu, libXdmcp, libXScrnSaver, symlinkJoin, bdftopcf
-, ncompress, mkfontdir, tcl, libXaw, gcc, glibcLocales, gawk
+, ncompress, mkfontdir, tcl, libXaw, gcc, glibcLocales
 , autoPatchelfHook, libredirect, makeWrapper, xset, xrdb, fakeroot
 , rpcsvc-proto }:
 
@@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
     libjpeg libXmu libXdmcp libXScrnSaver tcl libXaw ksh
   ];
   nativeBuildInputs = [
-    bison ncompress gawk autoPatchelfHook makeWrapper fakeroot
+    bison ncompress autoPatchelfHook makeWrapper fakeroot
     rpcsvc-proto
   ];
   # build fails otherwise
diff --git a/pkgs/development/compilers/bupc/default.nix b/pkgs/development/compilers/bupc/default.nix
index 94256ed4373..07395ed5ae1 100644
--- a/pkgs/development/compilers/bupc/default.nix
+++ b/pkgs/development/compilers/bupc/default.nix
@@ -16,7 +16,6 @@ stdenv.mkDerivation rec {
   # Used during the configure phase
   ENVCMD = "${coreutils}/bin/env";
 
-  nativeBuildInputs = [ coreutils ];
   buildInputs = [ perl ];
 
   meta = with lib; {
diff --git a/pkgs/development/compilers/chez/default.nix b/pkgs/development/compilers/chez/default.nix
index b4244b77d10..67fa1efd2a6 100644
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ coreutils ] ++ lib.optional stdenv.isDarwin cctools;
+  nativeBuildInputs = lib.optional stdenv.isDarwin cctools;
   buildInputs = [ ncurses libiconv libX11 libuuid ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/opendylan/bin.nix b/pkgs/development/compilers/opendylan/bin.nix
index f105707f933..6e404f37ae9 100644
--- a/pkgs/development/compilers/opendylan/bin.nix
+++ b/pkgs/development/compilers/opendylan/bin.nix
@@ -1,6 +1,6 @@
 # Binaries provided by Open Dylan to be used to bootstrap from source.
 # The binaries can also be used as is.
-{lib, stdenv, fetchurl, patchelf, boehmgc, gnused, gcc, makeWrapper}:
+{lib, stdenv, fetchurl, patchelf, boehmgc, gcc, makeWrapper}:
 
 stdenv.mkDerivation rec {
   pname = "opendylan";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     }
     else throw "platform ${stdenv.hostPlatform.system} not supported.";
 
-  nativeBuildInputs = [ patchelf boehmgc gnused makeWrapper ];
+  nativeBuildInputs = [ patchelf boehmgc makeWrapper ];
 
   buildCommand = ''
     mkdir -p "$out"
diff --git a/pkgs/development/compilers/squeak/default.nix b/pkgs/development/compilers/squeak/default.nix
index 158c2639f11..55abcbc64dd 100644
--- a/pkgs/development/compilers/squeak/default.nix
+++ b/pkgs/development/compilers/squeak/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, fetchzip
-, autoconf, automake, autoreconfHook, bash, clang, dos2unix, file, gzip, perl
+, autoconf, automake, autoreconfHook, clang, dos2unix, file, perl
 , pkg-config
 , alsa-lib, coreutils, freetype, glib, glibc, gnugrep, libpulseaudio, libtool
 , libuuid, openssl, pango, xorg
@@ -75,11 +75,9 @@ in stdenv.mkDerivation {
     autoconf
     automake
     autoreconfHook
-    bash
     clang
     dos2unix
     file
-    gzip
     perl
     pkg-config
   ];
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index f47d4cd818f..d09f7b77b72 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -10,7 +10,6 @@
 , pkg-config
 , sqlite
 , swig
-, bash
 , libxml2
 , clang_10
 , python3
@@ -29,7 +28,6 @@
 , libgit2
 , fetchFromGitHub
 , fetchpatch
-, findutils
 , makeWrapper
 , gnumake
 , file
@@ -188,12 +186,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     autoconf
     automake
-    bash
     cmake
-    coreutils
-    findutils
     git
-    gnumake
     libtool
     makeWrapper
     ninja
diff --git a/pkgs/development/coq-modules/flocq/default.nix b/pkgs/development/coq-modules/flocq/default.nix
index ca82bbbed06..f13aec883e7 100644
--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@@ -1,4 +1,4 @@
-{ lib, bash, which, autoconf, automake,
+{ lib, which, autoconf, automake,
   mkCoqDerivation, coq, version ? null }:
 
 with lib; mkCoqDerivation {
@@ -16,7 +16,7 @@ with lib; mkCoqDerivation {
   release."2.6.1".sha256 = "0q5a038ww5dn72yvwn5298d3ridkcngb1dik8hdyr3xh7gr5qibj";
   releaseRev = v: "flocq-${v}";
 
-  nativeBuildInputs = [ bash which autoconf ];
+  nativeBuildInputs = [ which autoconf ];
   mlPlugin = true;
   useMelquiondRemake.logpath = "Flocq";
 
diff --git a/pkgs/development/interpreters/guile/1.8.nix b/pkgs/development/interpreters/guile/1.8.nix
index c8e15be2c01..f30270fcc83 100644
--- a/pkgs/development/interpreters/guile/1.8.nix
+++ b/pkgs/development/interpreters/guile/1.8.nix
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile_1_8;
   nativeBuildInputs = [
-    gawk
     makeWrapper
     pkg-config
   ];
diff --git a/pkgs/development/interpreters/guile/2.0.nix b/pkgs/development/interpreters/guile/2.0.nix
index 8214ca2adcd..73fb564077a 100644
--- a/pkgs/development/interpreters/guile/2.0.nix
+++ b/pkgs/development/interpreters/guile/2.0.nix
@@ -42,7 +42,6 @@ builder rec {
 
   nativeBuildInputs = [
     makeWrapper
-    gawk
     pkg-config
   ];
   buildInputs = [
diff --git a/pkgs/development/interpreters/guile/2.2.nix b/pkgs/development/interpreters/guile/2.2.nix
index 04c60e80e8f..31803d9c166 100644
--- a/pkgs/development/interpreters/guile/2.2.nix
+++ b/pkgs/development/interpreters/guile/2.2.nix
@@ -40,7 +40,6 @@ builder rec {
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile;
   nativeBuildInputs = [
-    gawk
     makeWrapper
     pkg-config
   ];
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index d0f5aa5573b..380e983ab6f 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -40,7 +40,6 @@ builder rec {
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile;
   nativeBuildInputs = [
-    gawk
     makeWrapper
     pkg-config
   ];
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index cc037744925..89a95e98219 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -11,6 +11,9 @@ setuptoolsBuildPhase() {
     if [ -n "$setupPyGlobalFlags" ]; then
         args+="$setupPyGlobalFlags"
     fi
+    if [ -n "$enableParallelBuilding" ]; then
+        setupPyBuildFlags+="--parallel $NIX_BUILD_CORES"
+    fi
     if [ -n "$setupPyBuildFlags" ]; then
         args+="build_ext $setupPyBuildFlags"
     fi
diff --git a/pkgs/development/interpreters/python/wrapper.nix b/pkgs/development/interpreters/python/wrapper.nix
index 514930db359..b36662335ab 100644
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildEnv, makeWrapper
+{ lib, stdenv, buildEnv, makeBinaryWrapper
 
 # manually pased
 , python
@@ -27,7 +27,7 @@ let
     inherit ignoreCollisions;
     extraOutputsToInstall = [ "out" ] ++ extraOutputsToInstall;
 
-    nativeBuildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeBinaryWrapper ];
 
     postBuild = ''
       if [ -L "$out/bin" ]; then
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index 675c930d9ed..606ff2b3404 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.44.0";
+  version = "2.44.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "fu488oWwiQYP1rblGz6yys91LMo6CCx/TCxauEHlE1M=";
+    sha256 = "S+sjJwumz3yvILWXNU11GU2Jr7adLvzxX0JxaIum90Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a3c5bbbf70b..6e3a6ed5b30 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -43,6 +43,13 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/dbus/dbus/-/commit/6bfaea0707ba1a7788c4b6d30c18fb094f3a1dd4.patch";
       sha256 = "1d8ay55n2ksw5faqx3hsdpfni3xl3gq9hnjl65073xcfnx67x8d2";
     })
+
+    # Fix dbus-daemon crashing when running tests due to long XDG_DATA_DIRS.
+    # https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/302
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/dbus/dbus/-/commit/b551b3e9737958216a1a9d359150a4110a9d0549.patch";
+      sha256 = "kOVjlklZzKvBZXmmrE1UiO4XWRoBLViGwdn6/eDH+DY=";
+    })
   ] ++ (lib.optional stdenv.isSunOS ./implement-getgrouplist.patch);
 
   postPatch = ''
diff --git a/pkgs/development/libraries/gecode/3.nix b/pkgs/development/libraries/gecode/3.nix
index 5c660a99ef8..3cf5d590fa8 100644
--- a/pkgs/development/libraries/gecode/3.nix
+++ b/pkgs/development/libraries/gecode/3.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, bash, perl }:
+{ lib, stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
   pname = "gecode";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0k45jas6p3cyldgyir1314ja3174sayn2h2ly3z9b4dl3368pk77";
   };
 
-  nativeBuildInputs = [ bash perl ];
+  nativeBuildInputs = [ perl ];
 
   preConfigure = "patchShebangs configure";
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 97da2a7c3be..2c02bac92d2 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -45,23 +45,15 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.72.0";
+  version = "2.72.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "177w1MTnpi4I77jl8lKgE1cAe5WIqH/ytGOjhXAR950=";
+    sha256 = "wH5XFHslTO+SzoCgN43AwCpDWOfeRwLp9AMGl4EJX+I=";
   };
 
   patches = optionals stdenv.isDarwin [
     ./darwin-compilation.patch
-
-    # Fix Inkscape compilation with clang++
-    # https://gitlab.gnome.org/GNOME/glib/-/issues/2625
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/97d39b745ff1f621424f68a41ce0a7c5bb554c87.patch";
-      sha256 = "wftuyf3ExFfrISngCQpEUpIGfHCCLXeYv/PEb/TE6a8=";
-      revert = true;
-    })
   ] ++ optionals stdenv.hostPlatform.isMusl [
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 65a622f0467..ba782321559 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -40,13 +40,10 @@ callPackage ./common.nix { inherit stdenv; } {
       makeFlagsArray+=("bindir=$bin/bin" "sbindir=$bin/sbin" "rootsbindir=$bin/sbin")
     '';
 
-    # The stackprotector and fortify hardening flags are autodetected by glibc
-    # and enabled by default if supported. Setting it for every gcc invocation
-    # does not work.
-    hardeningDisable = [ "stackprotector" "fortify" ]
-    # XXX: Not actually musl-speciic but since only musl enables pie by default,
-    #      limit rebuilds by only disabling pie w/musl
-      ++ lib.optional stdenv.hostPlatform.isMusl "pie";
+    # The pie, stackprotector and fortify hardening flags are autodetected by
+    # glibc and enabled by default if supported. Setting it for every gcc
+    # invocation does not work.
+    hardeningDisable = [ "fortify" "pie" "stackprotector" ];
 
     NIX_CFLAGS_COMPILE = lib.concatStringsSep " "
       (builtins.concatLists [
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 0e17e13e581..758c4b091cd 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -84,6 +84,7 @@
 , libxml2
 , srt
 , vo-aacenc
+, libfreeaptx
 , VideoToolbox
 , AudioToolbox
 , AVFoundation
@@ -96,13 +97,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.20.0";
+  version = "1.20.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-AVuNTZo5Xr9ETUCHaGeiA03TMEs61IvDoN0MHucdwR0=";
+    sha256 = "0j1q89dl8369djibc5p27lyj8y8p4maplmdzlryvrw0ib77w5lq9";
   };
 
   nativeBuildInputs = [
@@ -170,6 +171,7 @@ stdenv.mkDerivation rec {
     libintl
     srt
     vo-aacenc
+    libfreeaptx
   ] ++ lib.optionals enableZbar [
     zbar
   ] ++ lib.optionals faacSupport [
@@ -261,7 +263,7 @@ stdenv.mkDerivation rec {
     "-Disac=disabled" # depends on `webrtc-audio-coding-1` not compatible with 0.3
     "-Dgs=disabled" # depends on `google-cloud-cpp`
     "-Donnx=disabled" # depends on `libonnxruntime` not packaged in nixpkgs as of writing
-    "-Dopenaptx=disabled" # depends on older version of `libopenaptx` due to licensing conflict https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/2235
+    "-Dopenaptx=enabled" # since gstreamer-1.20.1 `libfreeaptx` is supported for circumventing the dubious license conflict with `libopenaptx`
   ]
   ++ lib.optionals (!stdenv.isLinux) [
     "-Dva=disabled" # see comment on `libva` in `buildInputs`
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 82d90845677..a6942445fc5 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-base";
-  version = "1.20.0";
+  version = "1.20.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-TLZvzPcwsQN+ZTOGLCEomQkSpttOW70U4O+RRFDrTHw=";
+    sha256 = "0162ly7pscymq6bsf1d5fva2k9s16zvfwyi1q6z4yfd97d0sdn4n";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index fa118834773..dcb4fcaef93 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer";
-  version = "1.20.0";
+  version = "1.20.1";
 
   outputs = [
     "bin"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-7fS///hVkdT/97Ibue1/D+q8EjrEpO/ynnPLzkVPnbc=";
+    sha256 = "0cghi6n4nhdbajz3wqcgbh5xm94myvnqgsi9g2bz9n1s9904l2fy";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index aa92410e0e4..31c25648cc7 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-afyHVuydk+XFJYyZCIQ08gPpH9vFryjR8sWD/YGbeh0=";
+    sha256 = "0asbapgf485h2gqq0sn9c4qknwi0ccpraf1685ixp2sv23pwgwc1";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 4630ce6d0ce..50acba29d67 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.20.0";
+  version = "1.20.1";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-+Detz0Bz0ZpZCJhOh5zQOfQZLKNo5x056MzYpWuf7t8=";
+    sha256 = "1ps887yyj6jkj8a2613n43b4fbvynxwryinxvavi00cfnlhipkka";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 3b686e4c7f5..a51936591a5 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -48,13 +48,13 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch64);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.20.0";
+  version = "1.20.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-LRGcFauMnnn4zTxr9YL/egULKMyuUqtIZeGhRkmRZZw=";
+    sha256 = "1al4f35mx41cy2h6agvmsqkjfchsyfs0iyxzpv6pnl0xh9pqfriw";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 0d9f22d7d65..31e127db083 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Xu5e2NUIKjG1AESOQVNcci7jDNX4Ik8ymCu6ui7t7xc=";
+    sha256 = "1iwz7928yi48xia5kfkj54x5dfmhbj25g9125vainpmp6fv1z9wi";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 80190200c26..679560e8ee1 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-wgn17ZBtpxP91EqIROkJqmyK89+2MCWbCSz7d6d1WEM=";
+    sha256 = "028maajlvfn96v3gqk2ws1k6w9hjfk7dsxnm84d73pnpi99bqia7";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 05133271f84..be8aaf5606e 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.20.0";
+  version = "1.20.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-To3LXSZVLwpJN/a8Ynm9kHD1XKauDqoy1y0mTEQAHC4=";
+    sha256 = "06fvgyjwcf4paqxgp1xmgd0d0glkxys7n818526k10wrw92m20s2";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index c8b6230cd59..1f144b6985f 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-95pHNG39XlheBj53B45fxJiwbe6JW/y/R9iGP8rJ6jI=";
+    sha256 = "0dqiy8mhcpq3yla8dk69pkjid7hiv98ykvwskb4pk45g6z2zdyw7";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/hyperscan/default.nix b/pkgs/development/libraries/hyperscan/default.nix
index 10a53ff1d98..0e45b277a32 100644
--- a/pkgs/development/libraries/hyperscan/default.nix
+++ b/pkgs/development/libraries/hyperscan/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, ragel, python3
-, coreutils, gnused, util-linux, fetchpatch
+, util-linux, fetchpatch
 , boost
 , withStatic ? false # build only shared libs by default, build static+shared if true
 }:
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     cmake ragel python3
     # Consider simply using busybox for these
     # Need at least: rev, sed, cut, nm
-    coreutils gnused util-linux
+    util-linux
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 240371917f1..76e5a32316d 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -37,6 +37,24 @@ stdenv.mkDerivation rec {
     hash = "sha256-G4wL5DDbX0FqaA4cnOlVLZ25ObN8dNsRtxyas29tpDA=";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile.am --replace '/bin/pwd' "$(type -P pwd)"
+
+    declare -a skip_tests=(
+      # test won't work in nix sandbox
+      'test_write_disk_perms'
+      # can't be sure builder will have sparse-capable fs
+      'test_sparse_basic'
+      # can't even be sure builder will have hardlink-capable fs
+      'test_write_disk_hardlink'
+    )
+
+    for test_name in "''${skip_tests[@]}" ; do
+      sed -i "/$test_name/d" Makefile.am
+      rm "libarchive/test/$test_name.c"
+    done
+  '';
+
   outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [
@@ -60,17 +78,12 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optional (!xarSupport) "--without-xml2";
 
-  postPatch = ''
-     substituteInPlace Makefile.am --replace '/bin/pwd' 'pwd'
-  '';
-
   preBuild = lib.optionalString stdenv.isCygwin ''
     echo "#include <windows.h>" >> config.h
   '';
 
-  # 484: test_write_disk_perms FAIL
-  # TODO: how to disable it? Should it be reported upstream?
-  doCheck = false;
+  # https://github.com/libarchive/libarchive/issues/1475
+  doCheck = !stdenv.hostPlatform.isMusl;
 
   preFixup = ''
     sed -i $lib/lib/libarchive.la \
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 5c06cd282da..9cc8395b9c2 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.20.0";
+  version = "1.20.1";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     owner = "libinput";
     repo = "libinput";
     rev = version;
-    sha256 = "Ey6ItBIrf1POACp2+6R0B4KxJq5V1HoO+y4j6hZSGAE=";
+    sha256 = "eujnabUaeNEJC/tPPhwcNS9sqDIorF52RjfqKBotbmc=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libpqxx/default.nix b/pkgs/development/libraries/libpqxx/default.nix
index d7eba4c8739..d0116a742d2 100644
--- a/pkgs/development/libraries/libpqxx/default.nix
+++ b/pkgs/development/libraries/libpqxx/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, python3, gnused }:
+{ lib, stdenv, fetchFromGitHub, postgresql, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "libpqxx";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-O30czHwEDXz5xY4o3MWhmEK06OKTKMQCy0M6qwSEpy8=";
   };
 
-  nativeBuildInputs = [ gnused python3 ];
+  nativeBuildInputs = [ python3 ];
   buildInputs = [ postgresql ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index a83893b01a7..e3be4db26cd 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libvdpau";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/vdpau/libvdpau/-/archive/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "0c1zsfr6ypzwv8g9z50kdahpb7pirarq4z8avqqyyma5b9684n22";
+    sha256 = "sha256-pdUKQrjCiP68BxUatkOsjeBqGERpZcckH4m06BCCGRM=";
   };
   patches = [ ./installdir.patch ];
 
diff --git a/pkgs/development/libraries/libxsmm/default.nix b/pkgs/development/libraries/libxsmm/default.nix
index ebb402cc0dd..849aee854e2 100644
--- a/pkgs/development/libraries/libxsmm/default.nix
+++ b/pkgs/development/libraries/libxsmm/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, coreutils, gfortran, gnused
+{ lib, stdenv, fetchFromGitHub, gfortran
 , python3, util-linux, which
 
 , enableStatic ? stdenv.hostPlatform.isStatic
@@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    coreutils
     gfortran
-    gnused
     python3
     util-linux
     which
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 28e8c61bf73..1e84498d9a9 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -33,7 +33,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.0.1";
+  version = "22.0.2";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -47,7 +47,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0vs20kyq9sxh52hd242yf7nz2wzw6di8jw7s19pb6q25qn19cpy0";
+    sha256 = "11b8mcplvis7nadcwi1jf3529i2za2q1bkb7609q0rnfvihaakyz";
   };
 
   # TODO:
diff --git a/pkgs/development/libraries/physics/cernlib/default.nix b/pkgs/development/libraries/physics/cernlib/default.nix
index 7028c44b434..ca328e2bac4 100644
--- a/pkgs/development/libraries/physics/cernlib/default.nix
+++ b/pkgs/development/libraries/physics/cernlib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gfortran, gnumake, imake, makedepend, motif, xorg }:
+{ lib, stdenv, fetchurl, gfortran, imake, makedepend, motif, xorg }:
 
 stdenv.mkDerivation rec {
   version = "2006";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = with xorg; [ gfortran motif libX11 libXft libXt ];
-  nativeBuildInputs = [ gnumake imake makedepend ];
+  nativeBuildInputs = [ imake makedepend ];
   sourceRoot = ".";
 
   patches = [ ./patch.patch ./0001-Use-strerror-rather-than-sys_errlist-to-fix-compilat.patch ];
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index ce087d49b5f..ece389b98ea 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -1,7 +1,7 @@
 { qtModule
 , qtdeclarative, qtquickcontrols, qtlocation, qtwebchannel
 
-, bison, coreutils, flex, git, gperf, ninja, pkg-config, python2, which
+, bison, flex, git, gperf, ninja, pkg-config, python2, which
 , nodejs, qtbase, perl
 
 , xorg, libXcursor, libXScrnSaver, libXrandr, libXtst
@@ -30,7 +30,7 @@ qtModule {
   pname = "qtwebengine";
   qtInputs = [ qtdeclarative qtquickcontrols qtlocation qtwebchannel ];
   nativeBuildInputs = [
-    bison coreutils flex git gperf ninja pkg-config python2 which gn nodejs
+    bison flex git gperf ninja pkg-config python2 which gn nodejs
   ] ++ lib.optional stdenv.isDarwin xcbuild;
   doCheck = true;
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index 9f481961e5b..05470f61dd3 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , gfortran
 , cmake
 , shared ? true
@@ -11,23 +10,15 @@
 
 stdenv.mkDerivation rec {
   pname = "liblapack";
-  version = "3.10.0";
+  version = "3.10.1";
 
   src = fetchFromGitHub {
     owner = "Reference-LAPACK";
     repo = "lapack";
     rev = "v${version}";
-    sha256 = "sha256-ewYUM+M7jDO5LLnB4joiKkqgXjEDmWbFZbgad8x98gc=";
+    sha256 = "07wwydw72gl4fhfqcyc8sbz7ynm0i23pggyfqn0r9a29g7qh8bqs";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2021-4048.patch";
-      url = "https://github.com/Reference-LAPACK/lapack/commit/0631b6beaed60ba118b0b027c0f8d35397bf5df0.patch";
-      sha256 = "1bqjw3f6ak9iz97y7ckn0rrfcgrzbn9prgfasl489qpxgzp2kjh8";
-    })
-  ];
-
   nativeBuildInputs = [ gfortran cmake ];
 
   # Configure stage fails on aarch64-darwin otherwise, due to either clang 11 or gfortran 10.
diff --git a/pkgs/development/python-modules/XlsxWriter/default.nix b/pkgs/development/python-modules/XlsxWriter/default.nix
index 5096f37e302..747887f2eaa 100644
--- a/pkgs/development/python-modules/XlsxWriter/default.nix
+++ b/pkgs/development/python-modules/XlsxWriter/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "xlsxwriter";
-  version = "3.0.2";
+  version = "3.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "jmcnamara";
     repo = "XlsxWriter";
     rev = "RELEASE_${version}";
-    hash = "sha256-I87/8OhMoI9/BRXdmTZ1Ul+d+/x+Kg/9CuqMgTsP8Eo=";
+    hash = "sha256-9fIxNkOdM+Bz1F9AWq02H3LLQnefxGSAtp9kM2OtJ9M=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 70919715eef..5188ce63795 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -122,6 +122,8 @@ buildPythonPackage rec {
     export PATH=$(pwd):$PATH
   '';
 
+  enableParallelBuilding = true;
+
   pythonImportsCheck = [ "pandas" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 8627ca53d54..9333055ccdc 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wBvEWQlZhHoSCMbGgYtB3alWBLA8mA8Mz6JPLhXa3Pc=";
+    hash = "sha256-O3bkexUBa+gfiJEM6KSR8y/iVqHqlCFmz/9EghxdIpw=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -66,6 +66,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/pybind/pybind11";
+    changelog = "https://github.com/pybind/pybind11/blob/${src.rev}/docs/changelog.rst";
     description = "Seamless operability between C++11 and Python";
     longDescription = ''
       Pybind11 is a lightweight header-only library that exposes
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 8ac9eeca2a8..aac95982cea 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -43,6 +43,8 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
   '';
 
+  enableParallelBuilding = true;
+
   pythonImportsCheck = [ "pydantic" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pync/default.nix b/pkgs/development/python-modules/pync/default.nix
index f01bfa33186..43161880e26 100644
--- a/pkgs/development/python-modules/pync/default.nix
+++ b/pkgs/development/python-modules/pync/default.nix
@@ -3,7 +3,6 @@
 , fetchPypi
 , python-dateutil
 , pkgs
-, coreutils
 , which
 }:
 
@@ -16,7 +15,6 @@ buildPythonPackage rec {
     sha256 = "38b9e61735a3161f9211a5773c5f5ea698f36af4ff7f77fa03e8d1ff0caa117f";
   };
 
-  nativeBuildInputs = [ coreutils ];
   checkInputs = [ which ];
   propagatedBuildInputs = [ python-dateutil ];
 
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
index 15b1a017c49..593a48a0fd9 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
@@ -523,7 +523,6 @@ stdenv.mkDerivation rec {
   # when a command can’t be found in a bazel build, you might also
   # need to add it to `defaultShellPath`.
   nativeBuildInputs = [
-    coreutils
     installShellFiles
     makeWrapper
     python3
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
index ce0c30d42ff..296d0bb4830 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
@@ -518,7 +518,6 @@ stdenv.mkDerivation rec {
   # when a command can’t be found in a bazel build, you might also
   # need to add it to `defaultShellPath`.
   nativeBuildInputs = [
-    coreutils
     installShellFiles
     makeWrapper
     python3
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index d8c92bc82d6..f62bb22314d 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -58,6 +58,13 @@ python3.pkgs.buildPythonApplication rec {
     # unsandboxed non-NixOS builds, see:
     # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
     ./boost-Do-not-add-system-paths-on-nix.patch
+
+    # https://github.com/mesonbuild/meson/pull/9841
+    # cross-compilation fix
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/266e8acb5807b38a550cb5145cea0e19545a21d7.patch";
+      sha256 = "sha256-1GdKsm2xvq2GxTNeTyBH5O73hxboL0YI+w2BCoUeWXM=";
+    })
   ] ++ lib.optionals withDarwinFrameworksGtkDocPatch [
     # Fix building gtkdoc for GLib
     # https://github.com/mesonbuild/meson/pull/10186
diff --git a/pkgs/development/tools/build-managers/redo-apenwarr/default.nix b/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
index 460ee004147..e8ea9a91f45 100644
--- a/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
+++ b/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, python3, fetchFromGitHub, which, findutils, coreutils
+{ stdenv, lib, python3, fetchFromGitHub, which, coreutils
 , perl, installShellFiles
 , doCheck ? true
 }: stdenv.mkDerivation rec {
@@ -52,7 +52,6 @@
     python3
     (with python3.pkgs; [ beautifulsoup4 markdown ])
     which
-    findutils
     installShellFiles
   ];
 
diff --git a/pkgs/development/tools/krankerl/default.nix b/pkgs/development/tools/krankerl/default.nix
index 0061ca60bfc..d78fef8463d 100644
--- a/pkgs/development/tools/krankerl/default.nix
+++ b/pkgs/development/tools/krankerl/default.nix
@@ -6,7 +6,6 @@
 , dbus
 , sqlite
 , file
-, gzip
 , makeWrapper
 }:
 
@@ -25,7 +24,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    gzip
     makeWrapper
   ];
 
diff --git a/pkgs/development/tools/misc/universal-ctags/default.nix b/pkgs/development/tools/misc/universal-ctags/default.nix
index 51ea6302743..240d8a1f10d 100644
--- a/pkgs/development/tools/misc/universal-ctags/default.nix
+++ b/pkgs/development/tools/misc/universal-ctags/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ autoreconfHook coreutils pkg-config python3Packages.docutils ];
+  nativeBuildInputs = [ autoreconfHook pkg-config python3Packages.docutils ];
   buildInputs = [ jansson ] ++ lib.optional stdenv.isDarwin libiconv;
 
   # to generate makefile.in
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index a4f02023bb0..347534329b1 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-cbindgen";
-  version = "0.21.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "eqrion";
     repo = "cbindgen";
     rev = "v${version}";
-    sha256 = "sha256-WvCGAjFxjaql/y35QfHyHvwbEL4pKtlc3JO2NecqQCM=";
+    hash = "sha256-yux5VpN8UqBscu5TyojlZmu4q2uz8b9Tu++eNlPUj/M=";
   };
 
-  cargoSha256 = "sha256-Kl2/u+ttPn1k7f3+XRCord4u+c4QZ80/Okb40XeyeIk=";
+  cargoSha256 = "sha256:1838dsmaqdlbd3j040bdy1fvl3z77xmcz73r11qmnqsga4yva6d7";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
@@ -33,6 +33,6 @@ rustPlatform.buildRustPackage rec {
     description = "A project for generating C bindings from Rust code";
     homepage = "https://github.com/eqrion/cbindgen";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ hexa ];
   };
 }
diff --git a/pkgs/development/tools/vala-language-server/default.nix b/pkgs/development/tools/vala-language-server/default.nix
index fc7af672664..f69f6db863c 100644
--- a/pkgs/development/tools/vala-language-server/default.nix
+++ b/pkgs/development/tools/vala-language-server/default.nix
@@ -6,7 +6,6 @@
 , pkg-config
 , scdoc
 , gnome-builder
-, gnused
 , glib
 , libgee
 , json-glib
@@ -37,7 +36,6 @@ stdenv.mkDerivation rec {
     pkg-config
     scdoc
     # GNOME Builder Plugin
-    gnused
     gnome-builder
   ];
 
diff --git a/pkgs/misc/drivers/epson-workforce-635-nx625-series/default.nix b/pkgs/misc/drivers/epson-workforce-635-nx625-series/default.nix
index 73d88ad19c2..7a467ac1ad3 100644
--- a/pkgs/misc/drivers/epson-workforce-635-nx625-series/default.nix
+++ b/pkgs/misc/drivers/epson-workforce-635-nx625-series/default.nix
@@ -1,5 +1,5 @@
 {
-  autoreconfHook, cups, gzip, libjpeg, rpmextract,
+  autoreconfHook, cups, libjpeg, rpmextract,
   fetchurl, lib, stdenv
 }:
 
@@ -22,7 +22,7 @@ in stdenv.mkDerivation rec {
   };
   sourceRoot = srcdirs.filter;
 
-  nativeBuildInputs = [ autoreconfHook gzip rpmextract ];
+  nativeBuildInputs = [ autoreconfHook rpmextract ];
   buildInputs = [ cups libjpeg ];
 
   unpackPhase = ''
diff --git a/pkgs/misc/openrussian-cli/default.nix b/pkgs/misc/openrussian-cli/default.nix
index 4f30fd91896..e7b3d1c496d 100644
--- a/pkgs/misc/openrussian-cli/default.nix
+++ b/pkgs/misc/openrussian-cli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, gnumake, pkg-config, wget, unzip, gawk
+{ stdenv, lib, fetchFromGitHub, pkg-config, wget, unzip
 , sqlite, which, lua, installShellFiles, makeWrapper
 }:
 let
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    gnumake pkg-config wget unzip gawk sqlite which installShellFiles makeWrapper
+    pkg-config wget unzip sqlite which installShellFiles makeWrapper
   ];
 
   buildInputs = [ luaEnv ];
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index a7afd838624..f7a2c0c52a9 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -192,7 +192,6 @@ let
     nativeBuildInputs = [
       pkg-config
       libapparmor
-      gawk
       which
     ];
 
diff --git a/pkgs/os-specific/linux/device-tree/default.nix b/pkgs/os-specific/linux/device-tree/default.nix
index 13c609cdf7d..88791a1fb1d 100644
--- a/pkgs/os-specific/linux/device-tree/default.nix
+++ b/pkgs/os-specific/linux/device-tree/default.nix
@@ -1,9 +1,9 @@
-{ lib, stdenvNoCC, dtc, findutils }:
+{ lib, stdenvNoCC, dtc }:
 
 with lib; {
   applyOverlays = (base: overlays': stdenvNoCC.mkDerivation {
     name = "device-tree-overlays";
-    nativeBuildInputs = [ dtc findutils ];
+    nativeBuildInputs = [ dtc ];
     buildCommand = let
       overlays = toList overlays';
     in ''
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index d79201cc4cd..43b65f5ae7b 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.49";
+  version = "0.50";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-/5ivelqRDvJuPVJqMs27VJUIq7/Dw6ROt/cmjSo309s=";
+    sha256 = "sha256-LQAbE/pAKjVFsn9FjIbvY6sTBcVBdi4LCOnDVZ/WGV0=";
   };
 
   nativeBuildInputs = [
@@ -31,11 +31,12 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with lib; {
-    homepage = "https://01.org/ell";
+    homepage = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     description = "Embedded Linux Library";
     longDescription = ''
       The Embedded Linux* Library (ELL) provides core, low-level functionality for system daemons. It typically has no dependencies other than the Linux kernel, C standard library, and libdl (for dynamic linking). While ELL is designed to be efficient and compact enough for use on embedded Linux platforms, it is not limited to resource-constrained systems.
     '';
+    changelog = "https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ChangeLog?h=${version}";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ mic92 dtzWill maxeaubrey ];
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 83359844887..0c1514d01c2 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -81,12 +81,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.16"; in
+  linuxHeaders = let version = "5.17"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "1fq86dbx2p124vi4j8nan68gj4zyw4xnqh4jxq9aqsdvi24pwz82";
+        sha256 = "1cdi43x4c3l4chznh57gm55szycj4wjlxl1dss1ilnfvvmhyypsm";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 220f09ed8b5..aeb8d8d0902 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, gawk, python3Minimal, zlib, pahole
+, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole
 , writeTextFile
 }:
 
@@ -320,7 +320,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
   enableParallelBuilding = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr gawk zstd python3Minimal ]
+  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
       ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
       ++ optional  (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") libelf
       # Removed util-linuxMinimal since it should not be a dependency.
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 615f376d79d..ad01a83ac93 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -6,11 +6,11 @@ stdenv.mkDerivation rec {
   pname = "libcap-ng";
   # When updating make sure to test that the version with
   # all of the python bindings still works
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchurl {
     url = "${meta.homepage}/${pname}-${version}.tar.gz";
-    sha256 = "1sasp1n154aqy9fz0knlb966svm7xg1zjhg1vr4q839bgjvq7h2j";
+    sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
   };
 
   nativeBuildInputs = [ swig ];
diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix
index 184d2e1fe6e..437fe9bd1bd 100644
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, perl, lvm2, libaio, gzip, readline, systemd, liburcu, json_c, kmod, nixosTests }:
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, perl, lvm2, libaio, readline, systemd, liburcu, json_c, kmod, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "multipath-tools";
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
       $(find * -name Makefile\*)
   '';
 
-  nativeBuildInputs = [ gzip pkg-config perl ];
+  nativeBuildInputs = [ pkg-config perl ];
   buildInputs = [ systemd lvm2 libaio readline liburcu json_c ];
 
   makeFlags = [
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index 5389caaa33f..127c6fc9c03 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sysstat";
-  version = "12.4.4";
+  version = "12.4.5";
 
   src = fetchurl {
     url = "http://pagesperso-orange.fr/sebastien.godard/sysstat-${version}.tar.xz";
-    sha256 = "sha256-lRLnR54E+S4lHFxrS9lLj2Q9ISvQ6Yao6k0Uem6UPSQ=";
+    sha256 = "sha256-70RazqMBu7mW5BCEL2KQqNBJ6ITUhoz+9+hdwEt+7ls=";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/servers/foundationdb/vsmake.nix b/pkgs/servers/foundationdb/vsmake.nix
index 776e724c9c6..284dc9fb3bd 100644
--- a/pkgs/servers/foundationdb/vsmake.nix
+++ b/pkgs/servers/foundationdb/vsmake.nix
@@ -3,7 +3,7 @@
 # (which will eventually become the default version.)
 { gcc6Stdenv, lib, fetchurl, fetchFromGitHub
 
-, which, findutils, m4, gawk
+, which, m4
 , python2, openjdk, mono, libressl
 , ...
 }:
@@ -51,7 +51,7 @@ let
           inherit rev sha256;
         };
 
-        nativeBuildInputs = [ python2 openjdk gawk which m4 findutils mono ];
+        nativeBuildInputs = [ python2 openjdk which m4 mono ];
         buildInputs = [ libressl boost ];
 
         inherit patches;
diff --git a/pkgs/servers/monitoring/net-snmp/default.nix b/pkgs/servers/monitoring/net-snmp/default.nix
index 432542a1120..5e7aa35d622 100644
--- a/pkgs/servers/monitoring/net-snmp/default.nix
+++ b/pkgs/servers/monitoring/net-snmp/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, autoreconfHook, removeReferencesTo
-, file, openssl, perl, perlPackages, nettools, gnused
+, file, openssl, perl, perlPackages, nettools
 , withPerlTools ? false }: let
 
   perlWithPkgs = perl.withPackages (ps: with ps; [
@@ -44,7 +44,7 @@ in stdenv.mkDerivation rec {
     substituteInPlace testing/fulltests/support/simple_TESTCONF.sh --replace "/bin/netstat" "${nettools}/bin/netstat"
   '';
 
-  nativeBuildInputs = [ autoreconfHook nettools removeReferencesTo gnused file ];
+  nativeBuildInputs = [ autoreconfHook nettools removeReferencesTo file ];
   buildInputs = [ openssl ]
     ++ lib.optional withPerlTools perlWithPkgs;
 
diff --git a/pkgs/servers/nosql/cassandra/generic.nix b/pkgs/servers/nosql/cassandra/generic.nix
index 9d62279e74e..6a6aa65395c 100644
--- a/pkgs/servers/nosql/cassandra/generic.nix
+++ b/pkgs/servers/nosql/cassandra/generic.nix
@@ -9,7 +9,6 @@
 , procps
 , which
 , jre
-, coreutils
 , nixosTests
   # generation is the attribute version suffix such as 3_11 in pkgs.cassandra_3_11
 , generation
@@ -41,7 +40,7 @@ stdenv.mkDerivation rec {
     url = "mirror://apache/cassandra/${version}/apache-cassandra-${version}-bin.tar.gz";
   };
 
-  nativeBuildInputs = [ makeWrapper coreutils ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index b0ccd5f7635..95a454850b6 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -4,7 +4,8 @@
 , avahi, libjack2, libasyncns, lirc, dbus
 , sbc, bluez5, udev, openssl, fftwFloat
 , soxr, speexdsp, systemd, webrtc-audio-processing
-, check, meson, ninja, m4
+, gst_all_1
+, check, meson, ninja, m4, wrapGAppsHook
 
 , x11Support ? false
 
@@ -19,6 +20,7 @@
 , airtunesSupport ? false
 
 , bluetoothSupport ? true
+, advancedBluetoothCodecs ? false
 
 , remoteControlSupport ? false
 
@@ -48,7 +50,9 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ pkg-config meson ninja makeWrapper perlPackages.perl perlPackages.XMLParser m4 ]
-    ++ lib.optionals stdenv.isLinux [ glib ];
+    ++ lib.optionals stdenv.isLinux [ glib ]
+    # gstreamer plugin discovery requires wrapping
+    ++ lib.optional (bluetoothSupport && advancedBluetoothCodecs) wrapGAppsHook;
 
   propagatedBuildInputs =
     lib.optionals stdenv.isLinux [ libcap ];
@@ -65,6 +69,8 @@ stdenv.mkDerivation rec {
       ++ lib.optionals stdenv.isLinux [ alsa-lib udev ]
       ++ lib.optional airtunesSupport openssl
       ++ lib.optionals bluetoothSupport [ bluez5 sbc ]
+      # aptX and LDAC codecs are in gst-plugins-bad so far, rtpldacpay is in -good
+      ++ lib.optionals (bluetoothSupport && advancedBluetoothCodecs) (builtins.attrValues { inherit (gst_all_1) gst-plugins-bad gst-plugins-good gst-plugins-base gstreamer; })
       ++ lib.optional remoteControlSupport lirc
       ++ lib.optional zeroconfSupport  avahi
   );
@@ -74,7 +80,8 @@ stdenv.mkDerivation rec {
     "-Dasyncns=${if !libOnly then "enabled" else "disabled"}"
     "-Davahi=${if zeroconfSupport then "enabled" else "disabled"}"
     "-Dbluez5=${if !libOnly then "enabled" else "disabled"}"
-    "-Dbluez5-gstreamer=disabled"
+    # advanced bluetooth audio codecs are provided by gstreamer
+    "-Dbluez5-gstreamer=${if (!libOnly && bluetoothSupport && advancedBluetoothCodecs) then "enabled" else "disabled"}"
     "-Ddatabase=simple"
     "-Ddoxygen=false"
     "-Delogind=disabled"
diff --git a/pkgs/tools/filesystems/irods/common.nix b/pkgs/tools/filesystems/irods/common.nix
index a7fdf9e2fb2..0bc16aa7fc5 100644
--- a/pkgs/tools/filesystems/irods/common.nix
+++ b/pkgs/tools/filesystems/irods/common.nix
@@ -1,11 +1,11 @@
-{ lib, stdenv, bzip2, zlib, autoconf, automake, cmake, gnumake, help2man, texinfo, libtool, cppzmq, libarchive
+{ lib, stdenv, bzip2, zlib, autoconf, automake, cmake, help2man, texinfo, libtool, cppzmq, libarchive
 , avro-cpp, boost, jansson, zeromq, openssl, pam, libiodbc, libkrb5, gcc, libcxx, which, catch2, nanodbc, fmt
 , nlohmann_json, spdlog }:
 
 # Common attributes of irods packages
 
 {
-  nativeBuildInputs = [ autoconf automake cmake gnumake help2man texinfo which gcc ];
+  nativeBuildInputs = [ autoconf automake cmake help2man texinfo which gcc ];
   buildInputs = [ bzip2 zlib libtool cppzmq libarchive avro-cpp jansson zeromq openssl pam libiodbc libkrb5 boost
                   libcxx catch2 nanodbc fmt nlohmann_json spdlog ];
 
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index 7931911b65f..afe1f2ffcd9 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, bzip2, zlib, autoconf, automake, cmake, gnumake, help2man, texinfo, libtool, cppzmq
+{ lib, stdenv, fetchFromGitHub, bzip2, zlib, autoconf, automake, cmake, help2man, texinfo, libtool, cppzmq
 , libarchive, avro-cpp_llvm, boost, jansson, zeromq, openssl, pam, libiodbc, libkrb5, gcc, libcxx, which, catch2
 , nanodbc_llvm, fmt, nlohmann_json, spdlog }:
 
@@ -8,7 +8,7 @@ let
 in
 let
   common = import ./common.nix {
-    inherit lib stdenv bzip2 zlib autoconf automake cmake gnumake
+    inherit lib stdenv bzip2 zlib autoconf automake cmake
       help2man texinfo libtool cppzmq libarchive jansson
       zeromq openssl pam libiodbc libkrb5 gcc libcxx
       boost avro-cpp which catch2 nanodbc fmt nlohmann_json
@@ -99,4 +99,3 @@ rec {
     };
   });
 }
-
diff --git a/pkgs/tools/filesystems/zkfuse/default.nix b/pkgs/tools/filesystems/zkfuse/default.nix
index 14938113a1e..98c9ae525f4 100644
--- a/pkgs/tools/filesystems/zkfuse/default.nix
+++ b/pkgs/tools/filesystems/zkfuse/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , autoreconfHook
-, gnused
 , boost
 , fuse
 , log4cxx
@@ -15,7 +14,7 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "apache-${zookeeper.pname}-${version}/zookeeper-contrib/zookeeper-contrib-zkfuse";
 
-  nativeBuildInputs = [ autoreconfHook gnused ];
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ zookeeper_mt log4cxx boost fuse ];
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/feedgnuplot/default.nix b/pkgs/tools/graphics/feedgnuplot/default.nix
index 51d3e1e868d..a205f03f079 100644
--- a/pkgs/tools/graphics/feedgnuplot/default.nix
+++ b/pkgs/tools/graphics/feedgnuplot/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, makeWrapper, gawk
+{ lib, fetchFromGitHub, makeWrapper
 , makeFontsConf, freefont_ttf, gnuplot, perl, perlPackages
 , stdenv, shortenPerlShebang
 }:
@@ -22,7 +22,7 @@ perlPackages.buildPerlPackage rec {
 
   outputs = [ "out" ];
 
-  nativeBuildInputs = [ makeWrapper gawk ] ++ lib.optional stdenv.isDarwin shortenPerlShebang;
+  nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin shortenPerlShebang;
 
   buildInputs = [ gnuplot perl ]
     ++ (with perlPackages; [ ListMoreUtils IPCRun StringShellQuote ]);
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index c6c90442ddc..e29e259b134 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -21,11 +21,11 @@ let
 in
 (if withQt then mkDerivation else stdenv.mkDerivation) rec {
   pname = "gnuplot";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnuplot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-5Xx14TGBM5UdMqg7zcSv8X/tKHIsTnHyMFz8KuHK57o=";
+    sha256 = "sha256-UfiburkPltNUP5UjU2jRiOseJu2ilpEiVqvNNTW9TYQ=";
   };
 
   nativeBuildInputs = [ makeWrapper pkg-config texinfo ] ++ lib.optional withQt qttools;
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index e2c5f9f63fc..924ac901f6a 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -16,7 +16,6 @@
 , pango
 , bash
 , bison
-, fetchpatch
 , xorg
 , ApplicationServices
 , python3
@@ -28,26 +27,16 @@ let
 in
 stdenv.mkDerivation {
   pname = "graphviz";
-  version = "2.49.3";
+  version = "2.50.0";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     # use rev as tags have disappeared before
-    rev = "3425dae078262591d04fec107ec71ab010651852";
-    sha256 = "1qvyjly7r1ihacdvxq0r59l4csr09sc05palpshzqsiz2wb1izk0";
+    rev = "ca43e4c6a217650447e2928c2e9cb493c73ebd7d";
+    sha256 = "1psfgr8y4hh9yyzl04f7xbqb2y9k1xbja051j6b06q9dx7bmkmky";
   };
 
-  patches = [
-    # Fix cross.
-    # https://gitlab.com/graphviz/graphviz/-/merge_requests/2281
-    # Remove when version > 2.49.3.
-    (fetchpatch {
-      url = "https://gitlab.com/graphviz/graphviz/-/commit/0cdb89acbb0caf5baf3d04a8821c9d0dfe065ea8.patch";
-      sha256 = "130mqlxzhzaz3vp4ccaq7z7fd9q6vjxmimz70g8y818igsbb13rf";
-    })
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/tools/misc/bat-extras/default.nix b/pkgs/tools/misc/bat-extras/default.nix
index 318cdfd2246..76e2906a942 100644
--- a/pkgs/tools/misc/bat-extras/default.nix
+++ b/pkgs/tools/misc/bat-extras/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, bash, makeWrapper, bat
+{ lib, stdenv, fetchFromGitHub, makeWrapper, bat
 # batdiff, batgrep, and batwatch
 , coreutils
 , getconf
@@ -35,7 +35,7 @@ let
     };
 
     # bat needs to be in the PATH during building so EXECUTABLE_BAT picks it up
-    nativeBuildInputs = [ bash bat ];
+    nativeBuildInputs = [ bat ];
 
     dontConfigure = true;
 
@@ -95,7 +95,7 @@ let
 
       src = core;
 
-      nativeBuildInputs = [ bash makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
       # Make the dependencies available to the tests.
       buildInputs = dependencies;
 
diff --git a/pkgs/tools/misc/idutils/default.nix b/pkgs/tools/misc/idutils/default.nix
index e43ab2ae879..6a4fa896161 100644
--- a/pkgs/tools/misc/idutils/default.nix
+++ b/pkgs/tools/misc/idutils/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, emacs, gnulib, autoconf, bison, automake, gettext, gperf, texinfo, perl, rsync, gawk}:
+{ fetchurl, lib, stdenv, emacs, gnulib, autoconf, bison, automake, gettext, gperf, texinfo, perl, rsync}:
 
 stdenv.mkDerivation rec {
   pname = "idutils";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     '';
 
   buildInputs = lib.optional stdenv.isLinux emacs;
-  nativeBuildInputs = [ gnulib autoconf bison automake gettext gperf texinfo perl rsync gawk ];
+  nativeBuildInputs = [ gnulib autoconf bison automake gettext gperf texinfo perl rsync ];
 
   doCheck = !stdenv.isDarwin;
 
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 4f08f9e63b8..8992e9ff0da 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "doc" ];
   outputMan = "out"; # users will want `man man` to work
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook groff makeWrapper pkg-config zstd ];
   buildInputs = [ libpipeline db groff ]; # (Yes, 'groff' is both native and build input)
   checkInputs = [ libiconv /* for 'iconv' binary */ ];
@@ -41,12 +42,6 @@ stdenv.mkDerivation rec {
 
     # Add mandb locations for the above
     echo "MANDB_MAP	/nix/var/nix/profiles/default/share/man	/var/cache/man/nixpkgs" >> src/man_db.conf.in
-
-    # use absolute paths to reference programs, otherwise artifacts will have undeclared dependencies
-    for f in configure.ac m4/man-check-progs.m4 m4/man-po4a.m4; do
-      substituteInPlace $f \
-        --replace AC_CHECK_PROGS AC_PATH_PROGS
-    done
   '';
 
   configureFlags = [
@@ -72,21 +67,15 @@ stdenv.mkDerivation rec {
     # (multi-call binary). `apropos` is actually just a symlink to whatis. So we need to
     # make sure that we don't wrap symlinks (since that changes argv[0] to the -wrapped name)
     find "$out/bin" -type f | while read file; do
-      wrapProgram "$file" --prefix PATH : "${groff}/bin"
+      wrapProgram "$file" \
+        --prefix PATH : "${lib.getBin groff}/bin" \
+        --prefix PATH : "${lib.getBin zstd}/bin"
     done
   '';
 
-  postFixup = lib.optionalString (buildPackages.groff != groff) ''
-    # Check to make sure none of the outputs depend on build-time-only groff:
-    for outName in $outputs; do
-      out=''${!outName}
-      echo "Checking $outName(=$out) for references to build-time groff..."
-      if grep -r '${buildPackages.groff}' $out; then
-        echo "Found an erroneous dependency on groff ^^^" >&2
-        exit 1
-      fi
-    done
-  '';
+  disallowedReferences = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    buildPackages.groff
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/misc/phoronix-test-suite/default.nix b/pkgs/tools/misc/phoronix-test-suite/default.nix
index 821cf8d21d5..d6171bda5d8 100644
--- a/pkgs/tools/misc/phoronix-test-suite/default.nix
+++ b/pkgs/tools/misc/phoronix-test-suite/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, php, which, gnused, makeWrapper, gnumake, gcc, callPackage }:
+{ lib, stdenv, fetchurl, php, which, makeWrapper, gnumake, gcc, callPackage }:
 
 stdenv.mkDerivation rec {
   pname = "phoronix-test-suite";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ php ];
-  nativeBuildInputs = [ which gnused makeWrapper ];
+  nativeBuildInputs = [ which makeWrapper ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/tools/misc/tlp/default.nix b/pkgs/tools/misc/tlp/default.nix
index 151b8292a59..cbcc2ba38d2 100644
--- a/pkgs/tools/misc/tlp/default.nix
+++ b/pkgs/tools/misc/tlp/default.nix
@@ -40,7 +40,7 @@
   ];
 
   buildInputs = [ perl ];
-  nativeBuildInputs = [ makeWrapper gnused ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # XXX: While [1] states that DESTDIR should not be used, and that the correct
   # variable to set is, in fact, PREFIX, tlp thinks otherwise. The Makefile for
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 7c7f301552e..a4056fd28a9 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -108,11 +108,6 @@ stdenv.mkDerivation rec {
   configureFlags = [
       # Build without manual
       "--disable-manual"
-      # Disable default CA bundle, use NIX_SSL_CERT_FILE or fallback
-      # to nss-cacert from the default profile.
-      # https://github.com/curl/curl/issues/8696 - fallback is not supported by HTTP3
-      (if http3Support then "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt" else "--without-ca-bundle")
-      "--without-ca-path"
       (lib.enableFeature c-aresSupport "ares")
       (lib.enableFeature ldapSupport "ldap")
       (lib.enableFeature ldapSupport "ldaps")
@@ -136,6 +131,12 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isWindows [
       "--disable-shared"
       "--enable-static"
+    ] ++ lib.optionals stdenv.isDarwin [
+      # Disable default CA bundle, use NIX_SSL_CERT_FILE or fallback to nss-cacert from the default profile.
+      # Without this curl might detect /etc/ssl/cert.pem at build time on macOS, causing curl to ignore NIX_SSL_CERT_FILE.
+      # https://github.com/curl/curl/issues/8696 - fallback is not supported by HTTP3
+      (if http3Support then "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt" else "--without-ca-bundle")
+      "--without-ca-path"
     ];
 
   CXX = "${stdenv.cc.targetPrefix}c++";
diff --git a/pkgs/tools/networking/networkmanager/l2tp/default.nix b/pkgs/tools/networking/networkmanager/l2tp/default.nix
index 88ccad59bd1..889f1565959 100644
--- a/pkgs/tools/networking/networkmanager/l2tp/default.nix
+++ b/pkgs/tools/networking/networkmanager/l2tp/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, substituteAll, fetchFromGitHub, autoreconfHook, libtool, intltool, pkg-config
-, file, findutils
+, file
 , gtk3, networkmanager, ppp, xl2tpd, strongswan, libsecret
 , withGnome ? true, libnma, glib }:
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ networkmanager ppp glib ]
     ++ lib.optionals withGnome [ gtk3 libsecret libnma ];
 
-  nativeBuildInputs = [ autoreconfHook libtool intltool pkg-config file findutils ];
+  nativeBuildInputs = [ autoreconfHook libtool intltool pkg-config file ];
 
   preConfigure = ''
     intltoolize -f
diff --git a/pkgs/tools/networking/ntopng/default.nix b/pkgs/tools/networking/ntopng/default.nix
index 652ad4e2886..d5700c42534 100644
--- a/pkgs/tools/networking/ntopng/default.nix
+++ b/pkgs/tools/networking/ntopng/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, bash, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, autoreconfHook
 , zeromq, ndpi, json_c, openssl, libpcap, libcap, curl, libmaxminddb
 , rrdtool, sqlite, libmysqlclient, expat, net-snmp
 }:
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ bash autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [
     zeromq ndpi json_c openssl libpcap curl libmaxminddb rrdtool sqlite
diff --git a/pkgs/tools/security/munge/default.nix b/pkgs/tools/security/munge/default.nix
index 01e208958a5..2c242f256d3 100644
--- a/pkgs/tools/security/munge/default.nix
+++ b/pkgs/tools/security/munge/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, gawk, gnused, libgcrypt, zlib, bzip2 }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, libgcrypt, zlib, bzip2 }:
 
 stdenv.mkDerivation rec {
   pname = "munge";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "15h805rwcb9f89dyrkxfclzs41n3ff8x7cc1dbvs8mb0ds682c4j";
   };
 
-  nativeBuildInputs = [ autoreconfHook gawk gnused ];
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libgcrypt zlib bzip2 ];
 
   preAutoreconf = ''
diff --git a/pkgs/tools/text/cmigemo/default.nix b/pkgs/tools/text/cmigemo/default.nix
index 92be45bbd9d..8bd60b516fd 100644
--- a/pkgs/tools/text/cmigemo/default.nix
+++ b/pkgs/tools/text/cmigemo/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, buildPackages
-, gzip, libiconv, nkf, perl, which
+, libiconv, nkf, perl, which
 , skk-dicts
 }:
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     sha256 = "0xrblwhaf70m0knkd5584iahaq84rlk0926bhdsrzmakpw77hils";
   };
 
-  nativeBuildInputs = [ gzip libiconv nkf perl which ];
+  nativeBuildInputs = [ libiconv nkf perl which ];
 
   postUnpack = ''
     cp ${skk-dicts}/share/SKK-JISYO.L source/dict/
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index cb57fb2bb07..100c2b43907 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -5,6 +5,7 @@
 , autoreconfHook
 , pkg-config
 , texinfo
+, bash
 }:
 
 stdenv.mkDerivation rec {
@@ -18,6 +19,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "doc" "info" "perl" ];
 
+  # Parallel build is failing for missing depends. Known upstream as:
+  #   https://savannah.gnu.org/bugs/?62084
   enableParallelBuilding = false;
 
   patches = [
@@ -31,7 +34,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  postPatch = lib.optionalString (psutils != null) ''
+  postPatch = ''
+    # BASH_PROG gets replaced with a path to the build bash which doesn't get automatically patched by patchShebangs
+    substituteInPlace contrib/gdiffmk/gdiffmk.sh \
+      --replace "@BASH_PROG@" "/bin/sh"
+  '' + lib.optionalString (psutils != null) ''
     substituteInPlace src/preproc/html/pre-html.cpp \
       --replace "psselect" "${psutils}/bin/psselect"
   '' + lib.optionalString (netpbm != null) ''
@@ -45,7 +52,8 @@ stdenv.mkDerivation rec {
       --replace "@PNMTOPS_NOSETPAGE@" "${lib.getBin netpbm}/bin/pnmtops -nosetpage"
   '';
 
-  buildInputs = [ ghostscript psutils netpbm perl ];
+  strictDeps = true;
+  buildInputs = [ ghostscript psutils netpbm perl bash ];
   nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
 
   # Builds running without a chroot environment may detect the presence
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 57b3bf8fc40..a2615b7292b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -662,6 +662,7 @@ mapAliases ({
   libmsgpack = throw "'libmsgpack' has been renamed to/replaced by 'msgpack'"; # Converted to throw 2022-02-22
   libosmpbf = throw "libosmpbf was removed because it is no longer required by osrm-backend";
   libpng_apng = throw "libpng_apng has been removed, because it is equivalent to libpng"; # Added 2021-03-21
+  libpulseaudio-vanilla = libpulseaudio; # Added 2022-04-20
   libqmatrixclient = throw "libqmatrixclient was renamed to libquotient"; # Added 2020-04-09
   libqrencode = throw "'libqrencode' has been renamed to/replaced by 'qrencode'"; # Converted to throw 2022-02-22
   librdf = lrdf; # Added 2020-03-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a6783dba044..80bc32f334b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22079,9 +22079,9 @@ with pkgs;
 
   hsphfpd = callPackage ../servers/pulseaudio/hsphfpd.nix { };
 
-  pulseaudio = callPackage ../servers/pulseaudio ({
+  pulseaudio = callPackage ../servers/pulseaudio {
     inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit Cocoa;
-  });
+  };
 
   qpaeq = libsForQt5.callPackage ../servers/pulseaudio/qpaeq.nix { };
 
@@ -22090,26 +22090,20 @@ with pkgs;
     jackaudioSupport = true;
     airtunesSupport = true;
     bluetoothSupport = true;
+    advancedBluetoothCodecs = true;
     remoteControlSupport = true;
     zeroconfSupport = true;
   };
 
-  # libpulse implementations
-  libpulseaudio-vanilla = pulseaudio.override {
+  libpulseaudio = pulseaudio.override {
     libOnly = true;
   };
 
   apulse = callPackage ../misc/apulse { };
 
-  libpressureaudio = callPackage ../misc/apulse/pressureaudio.nix {
-    libpulseaudio = libpulseaudio-vanilla; # headers only
-  };
-
-  libcardiacarrest = callPackage ../misc/libcardiacarrest {
-    libpulseaudio = libpulseaudio-vanilla; # meta only
-  };
+  libpressureaudio = callPackage ../misc/apulse/pressureaudio.nix { };
 
-  libpulseaudio = libpulseaudio-vanilla;
+  libcardiacarrest = callPackage ../misc/libcardiacarrest { };
 
   easyeffects = callPackage ../applications/audio/easyeffects { };
 
@@ -26581,6 +26575,7 @@ with pkgs;
   };
 
   git = callPackage ../applications/version-management/git-and-tools/git {
+    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
     perlLibs = [perlPackages.LWP perlPackages.URI perlPackages.TermReadKey];
     smtpPerlLibs = [
       perlPackages.libnet perlPackages.NetSMTPSSL
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 692bb74fb8d..72568265a82 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17146,7 +17146,6 @@ let
       sha256 = "0xl8lcv9gfv0nn8vrrxa4az359whqdhmzw4r51nn3add8pn3s9ip";
     };
     buildInputs = [ pkgs.zookeeper_mt ];
-    nativeBuildInputs = [ pkgs.gnused ];
     # fix "error: format not a string literal and no format arguments [-Werror=format-security]"
     hardeningDisable = [ "format" ];
     # Make the async API accessible
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7a703876eb6..2cbe36ee8f5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7470,7 +7470,7 @@ in {
   pynanoleaf = callPackage ../development/python-modules/pynanoleaf { };
 
   pync = callPackage ../development/python-modules/pync {
-    inherit (pkgs) coreutils which;
+    inherit (pkgs) which;
   };
 
   pynello = callPackage ../development/python-modules/pynello { };