summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/hooks/meson.section.md83
-rw-r--r--lib/systems/default.nix100
-rw-r--r--pkgs/applications/blockchains/zcash/default.nix4
-rw-r--r--pkgs/applications/misc/effitask/default.nix3
-rw-r--r--pkgs/applications/networking/sync/rsync/default.nix6
-rw-r--r--pkgs/applications/networking/sync/rsync/rsync-fortified-strlcpy-fix.patch49
-rw-r--r--pkgs/applications/window-managers/cosmic/applets/default.nix6
-rw-r--r--pkgs/applications/window-managers/cosmic/panel/default.nix6
-rw-r--r--pkgs/applications/window-managers/cosmic/settings/default.nix2
-rw-r--r--pkgs/build-support/rust/build-rust-crate/build-crate.nix3
-rw-r--r--pkgs/build-support/rust/build-rust-crate/configure-crate.nix10
-rw-r--r--pkgs/build-support/rust/build-rust-crate/default.nix11
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix5
-rw-r--r--pkgs/build-support/rust/build-rust-package/sysroot/default.nix4
-rw-r--r--pkgs/build-support/rust/hooks/default.nix6
-rw-r--r--pkgs/build-support/rust/lib/default.nix127
-rw-r--r--pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh2
-rw-r--r--pkgs/by-name/cm/cmake/001-search-path.diff (renamed from pkgs/development/tools/build-managers/cmake/001-search-path.diff)0
-rw-r--r--pkgs/by-name/cm/cmake/002-application-services.diff (renamed from pkgs/development/tools/build-managers/cmake/002-application-services.diff)0
-rw-r--r--pkgs/by-name/cm/cmake/003-libuv-application-services.diff (renamed from pkgs/development/tools/build-managers/cmake/003-libuv-application-services.diff)0
-rw-r--r--pkgs/by-name/cm/cmake/004-cygwin.diff (renamed from pkgs/development/tools/build-managers/cmake/004-cygwin.diff)0
-rw-r--r--pkgs/by-name/cm/cmake/005-remove-systemconfiguration-dep.diff (renamed from pkgs/development/tools/build-managers/cmake/005-remove-systemconfiguration-dep.diff)29
-rw-r--r--pkgs/by-name/cm/cmake/006-darwin-always-set-runtime-c-flag.diff (renamed from pkgs/development/tools/build-managers/cmake/006-darwin-always-set-runtime-c-flag.diff)0
-rw-r--r--pkgs/by-name/cm/cmake/check-pc-files-hook.sh (renamed from pkgs/development/tools/build-managers/cmake/check-pc-files-hook.sh)0
-rw-r--r--pkgs/by-name/cm/cmake/package.nix (renamed from pkgs/development/tools/build-managers/cmake/default.nix)65
-rwxr-xr-xpkgs/by-name/cm/cmake/setup-hook.sh (renamed from pkgs/development/tools/build-managers/cmake/setup-hook.sh)0
-rw-r--r--pkgs/by-name/me/meson/001-fix-rpath.patch (renamed from pkgs/development/tools/build-managers/meson/fix-rpath.patch)0
-rw-r--r--pkgs/by-name/me/meson/002-clear-old-rpath.patch (renamed from pkgs/development/tools/build-managers/meson/clear-old-rpath.patch)0
-rw-r--r--pkgs/by-name/me/meson/003-more-env-vars.patch (renamed from pkgs/development/tools/build-managers/meson/more-env-vars.patch)0
-rw-r--r--pkgs/by-name/me/meson/004-gir-fallback-path.patch (renamed from pkgs/development/tools/build-managers/meson/gir-fallback-path.patch)0
-rw-r--r--pkgs/by-name/me/meson/005-boost-Do-not-add-system-paths-on-nix.patch (renamed from pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch)0
-rw-r--r--pkgs/by-name/me/meson/006-disable-bitcode.patch (renamed from pkgs/development/tools/build-managers/meson/disable-bitcode.patch)0
-rw-r--r--pkgs/by-name/me/meson/emulator-hook.sh (renamed from pkgs/development/tools/build-managers/meson/emulator-hook.sh)0
-rw-r--r--pkgs/by-name/me/meson/package.nix (renamed from pkgs/development/tools/build-managers/meson/default.nix)126
-rw-r--r--pkgs/by-name/me/meson/setup-hook.sh87
-rw-r--r--pkgs/desktops/gnome/core/gnome-tour/default.nix12
-rw-r--r--pkgs/development/compilers/gcc/default.nix4
-rw-r--r--pkgs/development/compilers/go/1.21.nix4
-rw-r--r--pkgs/development/compilers/mrustc/bootstrap.nix6
-rw-r--r--pkgs/development/compilers/rust/bootstrap.nix4
-rw-r--r--pkgs/development/compilers/rust/cargo.nix4
-rw-r--r--pkgs/development/compilers/rust/rustc.nix38
-rw-r--r--pkgs/development/interpreters/python/catch_conflicts/catch_conflicts.py30
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix10
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix5
-rw-r--r--pkgs/development/libraries/glibc/0001-aarch64-math-vector.h-add-NVCC-include-guard.patch37
-rw-r--r--pkgs/development/libraries/glibc/common.nix14
-rw-r--r--pkgs/development/libraries/gpgme/default.nix4
-rw-r--r--pkgs/development/libraries/grpc/default.nix27
-rw-r--r--pkgs/development/libraries/gstreamer/rs/default.nix11
-rw-r--r--pkgs/development/libraries/libaom/default.nix13
-rw-r--r--pkgs/development/libraries/libdovi/default.nix10
-rw-r--r--pkgs/development/libraries/libimagequant/default.nix7
-rw-r--r--pkgs/development/libraries/libnsl/default.nix4
-rw-r--r--pkgs/development/libraries/libpfm/default.nix33
-rw-r--r--pkgs/development/libraries/libpfm/fix-windows.patch18
-rw-r--r--pkgs/development/libraries/librsvg/default.nix3
-rw-r--r--pkgs/development/libraries/liburing/default.nix16
-rw-r--r--pkgs/development/libraries/mesa/default.nix22
-rw-r--r--pkgs/development/libraries/ncurses/default.nix9
-rw-r--r--pkgs/development/libraries/oniguruma/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/default.nix4
-rw-r--r--pkgs/development/libraries/re2/default.nix4
-rw-r--r--pkgs/development/libraries/relibc/default.nix2
-rw-r--r--pkgs/development/libraries/rustc-demangle/default.nix4
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/python-modules/deal/default.nix8
-rw-r--r--pkgs/development/python-modules/grpcio-health-checking/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-status/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-testing/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/icontract/default.nix7
-rw-r--r--pkgs/development/python-modules/mocket/default.nix86
-rw-r--r--pkgs/development/python-modules/orjson/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest-datadir/default.nix19
-rw-r--r--pkgs/development/python-modules/pytest/default.nix9
-rw-r--r--pkgs/development/python-modules/typeguard/default.nix8
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/analysis/valgrind/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/setup-hook.sh71
-rw-r--r--pkgs/development/tools/build-managers/scons/3.1.2.nix38
-rw-r--r--pkgs/development/tools/build-managers/scons/4.1.0.nix50
-rw-r--r--pkgs/development/tools/build-managers/scons/4.5.2.nix54
-rw-r--r--pkgs/development/tools/build-managers/scons/common.nix62
-rw-r--r--pkgs/development/tools/build-managers/scons/default.nix20
-rw-r--r--pkgs/development/tools/lalrpop/default.nix3
-rw-r--r--pkgs/development/tools/rust/cargo-benchcmp/default.nix3
-rw-r--r--pkgs/development/tools/rust/cargo-watch/default.nix3
-rw-r--r--pkgs/development/web/deno/librusty_v8.nix5
-rw-r--r--pkgs/development/web/deno/update/librusty_v8.ts5
-rw-r--r--pkgs/development/web/edge-runtime/librusty_v8.nix5
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/procps-ng/v3-CVE-2023-4016.patch63
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix4
-rw-r--r--pkgs/os-specific/linux/usbutils/default.nix4
-rw-r--r--pkgs/servers/http/router/librusty_v8.nix5
-rw-r--r--pkgs/servers/matrix-synapse/matrix-hookshot/default.nix3
-rw-r--r--pkgs/servers/nosql/mongodb/mongodb.nix16
-rw-r--r--pkgs/servers/windmill/default.nix4
-rw-r--r--pkgs/stdenv/darwin/make-bootstrap-tools.nix2
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix2
-rw-r--r--pkgs/stdenv/generic/setup.sh72
-rw-r--r--pkgs/tools/compression/bzip2/default.nix11
-rw-r--r--pkgs/tools/compression/zstd/default.nix5
-rw-r--r--pkgs/tools/misc/halp/default.nix3
-rw-r--r--pkgs/tools/misc/hdf5/default.nix4
-rw-r--r--pkgs/tools/system/zram-generator/default.nix3
-rw-r--r--pkgs/tools/video/rav1e/default.nix9
-rw-r--r--pkgs/top-level/all-packages.nix24
-rw-r--r--pkgs/top-level/packages-config.nix1
-rw-r--r--pkgs/top-level/python-packages.nix4
111 files changed, 1105 insertions, 725 deletions
diff --git a/doc/hooks/meson.section.md b/doc/hooks/meson.section.md
index a4b8da1d46c..3a7fb503208 100644
--- a/doc/hooks/meson.section.md
+++ b/doc/hooks/meson.section.md
@@ -1,50 +1,83 @@
 # Meson {#meson}
 
-Overrides the configure, check, and install phases to run `meson setup`, `meson test`, and `meson install`.
+[Meson](https://mesonbuild.com/) is an open source meta build system meant to be
+fast and user-friendly.
 
-Meson is a meta-build system so you will need a secondary build system to run the generated build files in build phase. In Nixpkgs context, you will want to accompany Meson with ninja, which provides a [setup hook](#ninja) registering a ninja-based build phase.
+In Nixpkgs, meson comes with a setup hook that overrides the configure, check,
+and install phases.
 
-By default, `enableParallelBuilding` is enabled as Meson supports parallel building almost everywhere.
+Being a meta build system, meson needs an accompanying backend. In the context
+of Nixpkgs, the typical companion backend is [Ninja](#ninja), that provides a
+setup hook registering ninja-based build and install phases.
 
-## Variables controlling Meson {#variables-controlling-meson}
+## Variables controlling Meson {#meson-variables-controlling}
 
-### `mesonFlags` {#mesonflags}
+### Meson Exclusive Variables {#meson-exclusive-variables}
 
-Controls the flags passed to `meson setup`.
+#### `mesonFlags` {#meson-flags}
 
-### `mesonCheckFlags` {#mesoncheckflags}
+Controls the flags passed to `meson setup` during configure phase.
 
-Controls the flags passed to `meson test`.
+#### `mesonWrapMode` {#meson-wrap-mode}
 
-### `mesonInstallFlags` {#mesoninstallflags}
+Which value is passed as
+[`-Dwrap_mode=`](https://mesonbuild.com/Builtin-options.html#core-options)
+to. In Nixpkgs the default value is `nodownload`, so that no subproject will be
+downloaded (since network access is already disabled during deployment in
+Nixpkgs).
 
-Controls the flags passed to `meson install`.
+Note: Meson allows pre-population of subprojects that would otherwise be
+downloaded.
 
-### `mesonInstallTags` {#mesoninstalltags}
+#### `mesonBuildType` {#meson-build-type}
 
-Tags specified here will be passed to Meson as via `--tags` during
-installation and controls which components will be installed.
+Which value is passed as
+[`--buildtype`](https://mesonbuild.com/Builtin-options.html#core-options) to
+`meson setup` during configure phase. In Nixpkgs the default value is `plain`.
 
-### `mesonBuildType` {#mesonbuildtype}
+#### `mesonAutoFeatures` {#meson-auto-features}
 
-Which [`--buildtype`](https://mesonbuild.com/Builtin-options.html#core-options) to pass to `meson setup`. We default to `plain`.
+Which value is passed as
+[`-Dauto_features=`](https://mesonbuild.com/Builtin-options.html#core-options)
+to `meson setup` during configure phase. In Nixpkgs the default value is
+`enabled`, meaning that every feature declared as "auto" by the meson scripts
+will be enabled.
 
-### `mesonAutoFeatures` {#mesonautofeatures}
+#### `mesonCheckFlags` {#meson-check-flags}
 
-What value to set [`-Dauto_features=`](https://mesonbuild.com/Builtin-options.html#core-options) to. We default to `enabled`.
+Controls the flags passed to `meson test` during check phase.
 
-### `mesonWrapMode` {#mesonwrapmode}
+#### `mesonInstallFlags` {#meson-install-flags}
 
-What value to set [`-Dwrap_mode=`](https://mesonbuild.com/Builtin-options.html#core-options) to. We default to `nodownload` as we disallow network access.
+Controls the flags passed to `meson install` during install phase.
 
-### `dontUseMesonConfigure` {#dontusemesonconfigure}
+#### `mesonInstallTags` {#meson-install-tags}
 
-Disables using Meson’s `configurePhase`.
+A list of installation tags passed to Meson's commandline option
+[`--tags`](https://mesonbuild.com/Installing.html#installation-tags) during
+install phase.
 
-### `dontUseMesonCheck` {#dontusemesoncheck}
+Note: `mesonInstallTags` should be a list of strings, that will be converted to
+a comma-separated string that is recognized to `--tags`.
+Example: `mesonInstallTags = [ "emulator" "assembler" ];` will be converted to
+`--tags emulator,assembler`.
 
-Disables using Meson’s `checkPhase`.
+#### `dontUseMesonConfigure` {#dont-use-meson-configure}
 
-### `dontUseMesonInstall` {#dontusemesoninstall}
+When set to true, don't use the predefined `mesonConfigurePhase`.
 
-Disables using Meson’s `installPhase`.
+#### `dontUseMesonCheck` {#dont-use-meson-check}
+
+When set to true, don't use the predefined `mesonCheckPhase`.
+
+#### `dontUseMesonInstall` {#dont-use-meson-install}
+
+When set to true, don't use the predefined `mesonInstallPhase`.
+
+### Honored variables {#meson-honored-variables}
+
+The following variables commonly used by `stdenv.mkDerivation` are honored by
+Meson setup hook.
+
+- `prefixKey`
+- `enableParallelBuilding`
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 2790ea08d97..ada8c66e361 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -43,6 +43,10 @@ rec {
   elaborate = args': let
     args = if lib.isString args' then { system = args'; }
            else args';
+
+    # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
+    rust = assert !(args ? rust && args ? rustc); args.rust or args.rustc or {};
+
     final = {
       # Prefer to parse `config` as it is strictly more informative.
       parsed = parse.mkSystemFromString (if args ? config then args.config else args.system);
@@ -159,9 +163,101 @@ rec {
         ({
           linux-kernel = args.linux-kernel or {};
           gcc = args.gcc or {};
-          rustc = args.rustc or {};
         } // platforms.select final)
-        linux-kernel gcc rustc;
+        linux-kernel gcc;
+
+      # TODO: remove after 23.05 is EOL, with an error pointing to the rust.* attrs.
+      rustc = args.rustc or {};
+
+      rust = rust // {
+        # Once args.rustc.platform.target-family is deprecated and
+        # removed, there will no longer be any need to modify any
+        # values from args.rust.platform, so we can drop all the
+        # "args ? rust" etc. checks, and merge args.rust.platform in
+        # /after/.
+        platform = rust.platform or {} // {
+          # https://doc.rust-lang.org/reference/conditional-compilation.html#target_arch
+          arch =
+            /**/ if rust ? platform then rust.platform.arch
+            else if final.isAarch32 then "arm"
+            else if final.isMips64  then "mips64"     # never add "el" suffix
+            else if final.isPower64 then "powerpc64"  # never add "le" suffix
+            else final.parsed.cpu.name;
+
+          # https://doc.rust-lang.org/reference/conditional-compilation.html#target_os
+          os =
+            /**/ if rust ? platform then rust.platform.os or "none"
+            else if final.isDarwin then "macos"
+            else final.parsed.kernel.name;
+
+          # https://doc.rust-lang.org/reference/conditional-compilation.html#target_family
+          target-family =
+            /**/ if args ? rust.platform.target-family then args.rust.platform.target-family
+            else if args ? rustc.platform.target-family
+            then
+              (
+                # Since https://github.com/rust-lang/rust/pull/84072
+                # `target-family` is a list instead of single value.
+                let
+                  f = args.rustc.platform.target-family;
+                in
+                  if builtins.isList f then f else [ f ]
+              )
+            else lib.optional final.isUnix "unix"
+                 ++ lib.optional final.isWindows "windows";
+
+          # https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
+          vendor = let
+            inherit (final.parsed) vendor;
+          in rust.platform.vendor or {
+            "w64" = "pc";
+          }.${vendor.name} or vendor.name;
+        };
+
+        # The name of the rust target, even if it is custom. Adjustments are
+        # because rust has slightly different naming conventions than we do.
+        rustcTarget = let
+          inherit (final.parsed) cpu kernel abi;
+          cpu_ = rust.platform.arch or {
+            "armv7a" = "armv7";
+            "armv7l" = "armv7";
+            "armv6l" = "arm";
+            "armv5tel" = "armv5te";
+            "riscv64" = "riscv64gc";
+          }.${cpu.name} or cpu.name;
+          vendor_ = final.rust.platform.vendor;
+        in rust.config
+          or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
+
+        # The name of the rust target if it is standard, or the json file
+        # containing the custom target spec.
+        rustcTargetSpec =
+          /**/ if rust ? platform
+          then builtins.toFile (final.rust.rustcTarget + ".json") (builtins.toJSON rust.platform)
+          else final.rust.rustcTarget;
+
+        # The name of the rust target if it is standard, or the
+        # basename of the file containing the custom target spec,
+        # without the .json extension.
+        #
+        # This is the name used by Cargo for target subdirectories.
+        cargoShortTarget =
+          lib.removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
+
+        # When used as part of an environment variable name, triples are
+        # uppercased and have all hyphens replaced by underscores:
+        #
+        # https://github.com/rust-lang/cargo/pull/9169
+        # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
+        cargoEnvVarTarget =
+          lib.strings.replaceStrings ["-"] ["_"]
+            (lib.strings.toUpper final.rust.cargoShortTarget);
+
+        # True if the target is no_std
+        # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
+        isNoStdTarget =
+          builtins.any (t: lib.hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
+      };
 
       linuxArch =
         if final.isAarch32 then "arm"
diff --git a/pkgs/applications/blockchains/zcash/default.nix b/pkgs/applications/blockchains/zcash/default.nix
index c07f94e5bae..dbada09c1b6 100644
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@@ -1,5 +1,5 @@
 { autoreconfHook, boost180, cargo, coreutils, curl, cxx-rs, db62, fetchFromGitHub
-, git, hexdump, lib, libevent, libsodium, makeWrapper, rust, rustPlatform
+, git, hexdump, lib, libevent, libsodium, makeWrapper, rustPlatform
 , pkg-config, Security, stdenv, testers, tl-expected, utf8cpp, util-linux, zcash, zeromq
 }:
 
@@ -57,7 +57,7 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
   configureFlags = [
     "--disable-tests"
     "--with-boost-libdir=${lib.getLib boost180}/lib"
-    "RUST_TARGET=${rust.toRustTargetSpec stdenv.hostPlatform}"
+    "RUST_TARGET=${stdenv.hostPlatform.rust.rustcTargetSpec}"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/effitask/default.nix b/pkgs/applications/misc/effitask/default.nix
index a380a06741e..50172b9d1cb 100644
--- a/pkgs/applications/misc/effitask/default.nix
+++ b/pkgs/applications/misc/effitask/default.nix
@@ -5,7 +5,6 @@
 , openssl
 , gtk3
 , stdenv
-, rust
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   # default installPhase don't install assets
   installPhase = ''
     runHook preInstall
-    make install PREFIX="$out" TARGET="target/${rust.toRustTarget stdenv.hostPlatform}/release/effitask"
+    make install PREFIX="$out" TARGET="target/${stdenv.hostPlatform.rust.rustcTarget}/release/effitask"
     runHook postInstall
   '';
 
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index 9df26b6bb84..1baf1c40eb1 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -30,6 +30,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ perl ];
 
+  patches = [
+    # https://github.com/WayneD/rsync/issues/511#issuecomment-1774612577
+    # original source: https://build.opensuse.org/package/view_file/network/rsync/rsync-fortified-strlcpy-fix.patch?expand=1&rev=3f8dd2f4a404c96c0f69176e60893714
+    ./rsync-fortified-strlcpy-fix.patch
+  ];
+
   buildInputs = [ libiconv zlib popt ]
     ++ lib.optional enableACLs acl
     ++ lib.optional enableZstd zstd
diff --git a/pkgs/applications/networking/sync/rsync/rsync-fortified-strlcpy-fix.patch b/pkgs/applications/networking/sync/rsync/rsync-fortified-strlcpy-fix.patch
new file mode 100644
index 00000000000..296445b4bb5
--- /dev/null
+++ b/pkgs/applications/networking/sync/rsync/rsync-fortified-strlcpy-fix.patch
@@ -0,0 +1,49 @@
+From 1f83963f59960150e8c46112daa8411324c1f209 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Fri, 18 Aug 2023 08:26:20 +0200
+Subject: [PATCH] exclude: fix crashes with fortified strlcpy()
+
+Fortified (-D_FORTIFY_SOURCE=2 for gcc) builds make strlcpy() crash when
+its third parameter (size) is larger than the buffer:
+  $ rsync -FFXHav '--filter=merge global-rsync-filter' Align-37-43/ xxx
+  sending incremental file list
+  *** buffer overflow detected ***: terminated
+
+It's in the exclude code in setup_merge_file():
+  strlcpy(y, save, MAXPATHLEN);
+
+Note the 'y' pointer was incremented, so it no longer points to memory
+with MAXPATHLEN "owned" bytes.
+
+Fix it by remembering the number of copied bytes into the 'save' buffer
+and use that instead of MAXPATHLEN which is clearly incorrect.
+
+Fixes #511.
+---
+ exclude.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/exclude.c b/exclude.c
+index ffe55b167..1a5de3b9e 100644
+--- a/exclude.c
++++ b/exclude.c
+@@ -720,7 +720,8 @@ static BOOL setup_merge_file(int mergelist_num, filter_rule *ex,
+ 	parent_dirscan = True;
+ 	while (*y) {
+ 		char save[MAXPATHLEN];
+-		strlcpy(save, y, MAXPATHLEN);
++		/* copylen is strlen(y) which is < MAXPATHLEN. +1 for \0 */
++		size_t copylen = strlcpy(save, y, MAXPATHLEN) + 1;
+ 		*y = '\0';
+ 		dirbuf_len = y - dirbuf;
+ 		strlcpy(x, ex->pattern, MAXPATHLEN - (x - buf));
+@@ -734,7 +735,7 @@ static BOOL setup_merge_file(int mergelist_num, filter_rule *ex,
+ 			lp->head = NULL;
+ 		}
+ 		lp->tail = NULL;
+-		strlcpy(y, save, MAXPATHLEN);
++		strlcpy(y, save, copylen);
+ 		while ((*x++ = *y++) != '/') {}
+ 	}
+ 	parent_dirscan = False;
+
diff --git a/pkgs/applications/window-managers/cosmic/applets/default.nix b/pkgs/applications/window-managers/cosmic/applets/default.nix
index f64f6b31247..87da5b580e2 100644
--- a/pkgs/applications/window-managers/cosmic/applets/default.nix
+++ b/pkgs/applications/window-managers/cosmic/applets/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rust, rustPlatform
+{ lib, stdenv, fetchFromGitHub, rustPlatform
 , cargo, just, pkg-config, util-linuxMinimal
 , dbus, glib, libxkbcommon, pulseaudio, wayland
 }:
@@ -41,11 +41,11 @@ rustPlatform.buildRustPackage {
 
   justFlags = [
     "--set" "prefix" (placeholder "out")
-    "--set" "target" "${rust.lib.toRustTargetSpecShort stdenv.hostPlatform}/release"
+    "--set" "target" "${stdenv.hostPlatform.rust.cargoShortTarget}/release"
   ];
 
   # Force linking to libwayland-client, which is always dlopen()ed.
-  "CARGO_TARGET_${rust.toRustTargetForUseInEnvVars stdenv.hostPlatform}_RUSTFLAGS" =
+  "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
     map (a: "-C link-arg=${a}") [
       "-Wl,--push-state,--no-as-needed"
       "-lwayland-client"
diff --git a/pkgs/applications/window-managers/cosmic/panel/default.nix b/pkgs/applications/window-managers/cosmic/panel/default.nix
index 7908eeb3057..e5000fe184e 100644
--- a/pkgs/applications/window-managers/cosmic/panel/default.nix
+++ b/pkgs/applications/window-managers/cosmic/panel/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cargo, just, pkg-config, rust, rustPlatform
+{ lib, stdenv, fetchFromGitHub, cargo, just, pkg-config, rustPlatform
 , libglvnd, libxkbcommon, wayland
 }:
 
@@ -33,11 +33,11 @@ rustPlatform.buildRustPackage {
 
   justFlags = [
     "--set" "prefix" (placeholder "out")
-    "--set" "bin-src" "target/${rust.lib.toRustTargetSpecShort stdenv.hostPlatform}/release/cosmic-panel"
+    "--set" "bin-src" "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-panel"
   ];
 
   # Force linking to libEGL, which is always dlopen()ed.
-  "CARGO_TARGET_${rust.toRustTargetForUseInEnvVars stdenv.hostPlatform}_RUSTFLAGS" =
+  "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
     map (a: "-C link-arg=${a}") [
       "-Wl,--push-state,--no-as-needed"
       "-lEGL"
diff --git a/pkgs/applications/window-managers/cosmic/settings/default.nix b/pkgs/applications/window-managers/cosmic/settings/default.nix
index dcb454b3f82..0e355003713 100644
--- a/pkgs/applications/window-managers/cosmic/settings/default.nix
+++ b/pkgs/applications/window-managers/cosmic/settings/default.nix
@@ -62,7 +62,7 @@ rustPlatform.buildRustPackage rec {
     (placeholder "out")
     "--set"
     "bin-src"
-    "target/${rust.lib.toRustTargetSpecShort stdenv.hostPlatform}/release/cosmic-settings"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-settings"
   ];
 
   postInstall = ''
diff --git a/pkgs/build-support/rust/build-rust-crate/build-crate.nix b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
index 944434472b0..e842b6a3f50 100644
--- a/pkgs/build-support/rust/build-rust-crate/build-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , mkRustcDepArgs, mkRustcFeatureArgs, needUnstableCLI
-, rust
 }:
 
 { crateName,
@@ -21,7 +20,7 @@
         (mkRustcDepArgs dependencies crateRenames)
         (mkRustcFeatureArgs crateFeatures)
       ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-        "--target" (rust.toRustTargetSpec stdenv.hostPlatform)
+        "--target" stdenv.hostPlatform.rust.rustcTargetSpec
       ] ++ lib.optionals (needUnstableCLI dependencies) [
         "-Z" "unstable-options"
       ] ++ extraRustcOpts
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index 60310f17874..a6f2528a82b 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, rust, echo_colored, noisily, mkRustcDepArgs, mkRustcFeatureArgs }:
+{ lib, stdenv, echo_colored, noisily, mkRustcDepArgs, mkRustcFeatureArgs }:
 {
   build
 , buildDependencies
@@ -124,8 +124,8 @@ in ''
   export CARGO_PKG_AUTHORS="${authors}"
   export CARGO_PKG_DESCRIPTION="${crateDescription}"
 
-  export CARGO_CFG_TARGET_ARCH=${rust.toTargetArch stdenv.hostPlatform}
-  export CARGO_CFG_TARGET_OS=${rust.toTargetOs stdenv.hostPlatform}
+  export CARGO_CFG_TARGET_ARCH=${stdenv.hostPlatform.rust.platform.arch}
+  export CARGO_CFG_TARGET_OS=${stdenv.hostPlatform.rust.platform.os}
   export CARGO_CFG_TARGET_FAMILY="unix"
   export CARGO_CFG_UNIX=1
   export CARGO_CFG_TARGET_ENV="gnu"
@@ -136,8 +136,8 @@ in ''
   export CARGO_MANIFEST_DIR=$(pwd)
   export DEBUG="${toString (!release)}"
   export OPT_LEVEL="${toString optLevel}"
-  export TARGET="${rust.toRustTargetSpec stdenv.hostPlatform}"
-  export HOST="${rust.toRustTargetSpec stdenv.buildPlatform}"
+  export TARGET="${stdenv.hostPlatform.rust.rustcTargetSpec}"
+  export HOST="${stdenv.buildPlatform.rust.rustcTargetSpec}"
   export PROFILE=${if release then "release" else "debug"}
   export OUT_DIR=$(pwd)/target/build/${crateName}.out
   export CARGO_PKG_VERSION_MAJOR=${lib.elemAt version 0}
diff --git a/pkgs/build-support/rust/build-rust-crate/default.nix b/pkgs/build-support/rust/build-rust-crate/default.nix
index d977fb9f7c2..d569142af66 100644
--- a/pkgs/build-support/rust/build-rust-crate/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/default.nix
@@ -10,7 +10,6 @@
 , fetchCrate
 , pkgsBuildBuild
 , rustc
-, rust
 , cargo
 , jq
 , libiconv
@@ -71,18 +70,14 @@ let
   inherit (import ./log.nix { inherit lib; }) noisily echo_colored;
 
   configureCrate = import ./configure-crate.nix {
-    inherit lib stdenv rust echo_colored noisily mkRustcDepArgs mkRustcFeatureArgs;
+    inherit lib stdenv echo_colored noisily mkRustcDepArgs mkRustcFeatureArgs;
   };
 
   buildCrate = import ./build-crate.nix {
-    inherit lib stdenv mkRustcDepArgs mkRustcFeatureArgs needUnstableCLI rust;
+    inherit lib stdenv mkRustcDepArgs mkRustcFeatureArgs needUnstableCLI;
   };
 
   installCrate = import ./install-crate.nix { inherit stdenv; };
-
-  # Allow access to the rust attribute set from inside buildRustCrate, which
-  # has a parameter that shadows the name.
-  rustAttrs = rust;
 in
 
   /* The overridable pkgs.buildRustCrate function.
@@ -310,7 +305,7 @@ crate_: lib.makeOverridable
           depsMetadata = lib.foldl' (str: dep: str + dep.metadata) "" (dependencies ++ buildDependencies);
           hashedMetadata = builtins.hashString "sha256"
             (crateName + "-" + crateVersion + "___" + toString (mkRustcFeatureArgs crateFeatures) +
-              "___" + depsMetadata + "___" + rustAttrs.toRustTarget stdenv.hostPlatform);
+              "___" + depsMetadata + "___" + stdenv.hostPlatform.rust.rustcTarget);
         in
         lib.substring 0 10 hashedMetadata;
 
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 0b28121a5b7..cf2ddbd084b 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -1,7 +1,6 @@
 { lib
 , importCargoLock
 , fetchCargoTarball
-, rust
 , stdenv
 , callPackage
 , cargoBuildHook
@@ -78,13 +77,13 @@ let
       sha256 = args.cargoSha256;
     } // depsExtraArgs);
 
-  target = rust.toRustTargetSpec stdenv.hostPlatform;
+  target = stdenv.hostPlatform.rust.rustcTargetSpec;
   targetIsJSON = lib.hasSuffix ".json" target;
   useSysroot = targetIsJSON && !__internal_dontAddSysroot;
 
   sysroot = callPackage ./sysroot { } {
     inherit target;
-    shortTarget = rust.lib.toRustTargetSpecShort stdenv.hostPlatform;
+    shortTarget = stdenv.hostPlatform.rust.cargoShortTarget;
     RUSTFLAGS = args.RUSTFLAGS or "";
     originalCargoToml = src + /Cargo.toml; # profile info is later extracted
   };
diff --git a/pkgs/build-support/rust/build-rust-package/sysroot/default.nix b/pkgs/build-support/rust/build-rust-package/sysroot/default.nix
index a6d53056d9c..bb95b7bdc35 100644
--- a/pkgs/build-support/rust/build-rust-package/sysroot/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/sysroot/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, rust, rustPlatform, buildPackages }:
+{ lib, stdenv, rustPlatform, buildPackages }:
 
 { shortTarget, originalCargoToml, target, RUSTFLAGS }:
 
@@ -26,7 +26,7 @@ in rustPlatform.buildRustPackage {
     done
 
     export RUST_SYSROOT=$(rustc --print=sysroot)
-    host=${rust.toRustTarget stdenv.buildPlatform}
+    host=${stdenv.buildPlatform.rust.rustcTarget}
     cp -r $RUST_SYSROOT/lib/rustlib/$host $out
   '';
 
diff --git a/pkgs/build-support/rust/hooks/default.nix b/pkgs/build-support/rust/hooks/default.nix
index 205d085d350..7703ff4abad 100644
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@@ -13,7 +13,7 @@
 # This confusingly-named parameter indicates the *subdirectory of
 # `target/` from which to copy the build artifacts.  It is derived
 # from a stdenv platform (or a JSON file).
-, target ? rust.lib.toRustTargetSpecShort stdenv.hostPlatform
+, target ? stdenv.hostPlatform.rust.cargoShortTarget
 }:
 
 {
@@ -65,10 +65,10 @@
         diff = "${lib.getBin buildPackages.diffutils}/bin/diff";
 
         cargoConfig = ''
-          [target."${rust.toRustTarget stdenv.buildPlatform}"]
+          [target."${stdenv.buildPlatform.rust.rustcTarget}"]
           "linker" = "${rust.envVars.ccForBuild}"
           ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
-            [target."${rust.toRustTarget stdenv.hostPlatform}"]
+            [target."${stdenv.hostPlatform.rust.rustcTarget}"]
             "linker" = "${rust.envVars.ccForHost}"
           ''}
           "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
diff --git a/pkgs/build-support/rust/lib/default.nix b/pkgs/build-support/rust/lib/default.nix
index ceca7323176..dad8ab52823 100644
--- a/pkgs/build-support/rust/lib/default.nix
+++ b/pkgs/build-support/rust/lib/default.nix
@@ -5,89 +5,6 @@
 }:
 
 rec {
-  # https://doc.rust-lang.org/reference/conditional-compilation.html#target_arch
-  toTargetArch = platform:
-    /**/ if platform ? rustc.platform then platform.rustc.platform.arch
-    else if platform.isAarch32 then "arm"
-    else if platform.isMips64  then "mips64"     # never add "el" suffix
-    else if platform.isPower64 then "powerpc64"  # never add "le" suffix
-    else platform.parsed.cpu.name;
-
-  # https://doc.rust-lang.org/reference/conditional-compilation.html#target_os
-  toTargetOs = platform:
-    /**/ if platform ? rustc.platform then platform.rustc.platform.os or "none"
-    else if platform.isDarwin then "macos"
-    else platform.parsed.kernel.name;
-
-  # https://doc.rust-lang.org/reference/conditional-compilation.html#target_family
-  toTargetFamily = platform:
-    if platform ? rustc.platform.target-family
-    then
-      (
-        # Since https://github.com/rust-lang/rust/pull/84072
-        # `target-family` is a list instead of single value.
-        let
-          f = platform.rustc.platform.target-family;
-        in
-        if builtins.isList f then f else [ f ]
-      )
-    else lib.optional platform.isUnix "unix"
-      ++ lib.optional platform.isWindows "windows";
-
-  # https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
-  toTargetVendor = platform: let
-    inherit (platform.parsed) vendor;
-  in platform.rustc.platform.vendor or {
-    "w64" = "pc";
-  }.${vendor.name} or vendor.name;
-
-  # Returns the name of the rust target, even if it is custom. Adjustments are
-  # because rust has slightly different naming conventions than we do.
-  toRustTarget = platform: let
-    inherit (platform.parsed) cpu kernel abi;
-    cpu_ = platform.rustc.platform.arch or {
-      "armv7a" = "armv7";
-      "armv7l" = "armv7";
-      "armv6l" = "arm";
-      "armv5tel" = "armv5te";
-      "riscv64" = "riscv64gc";
-    }.${cpu.name} or cpu.name;
-    vendor_ = toTargetVendor platform;
-  in platform.rustc.config
-    or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
-
-  # Returns the name of the rust target if it is standard, or the json file
-  # containing the custom target spec.
-  toRustTargetSpec = platform:
-    if platform ? rustc.platform
-    then builtins.toFile (toRustTarget platform + ".json") (builtins.toJSON platform.rustc.platform)
-    else toRustTarget platform;
-
-  # Returns the name of the rust target if it is standard, or the
-  # basename of the file containing the custom target spec, without
-  # the .json extension.
-  #
-  # This is the name used by Cargo for target subdirectories.
-  toRustTargetSpecShort = platform:
-    lib.removeSuffix ".json"
-      (baseNameOf "${toRustTargetSpec platform}");
-
-  # When used as part of an environment variable name, triples are
-  # uppercased and have all hyphens replaced by underscores:
-  #
-  # https://github.com/rust-lang/cargo/pull/9169
-  # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
-  #
-  toRustTargetForUseInEnvVars = platform:
-    lib.strings.replaceStrings ["-"] ["_"]
-      (lib.strings.toUpper
-        (toRustTargetSpecShort platform));
-
-  # Returns true if the target is no_std
-  # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
-  IsNoStdTarget = platform: let rustTarget = toRustTarget platform; in
-    builtins.any (t: lib.hasInfix t rustTarget) ["-none" "nvptx" "switch" "-uefi"];
-
   # These environment variables must be set when using `cargo-c` and
   # several other tools which do not deal well with cross
   # compilation.  The symptom of the problem they fix is errors due
@@ -107,12 +24,12 @@ rec {
     ccForTarget = "${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc";
     cxxForTarget = "${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++";
 
-    rustBuildPlatform = toRustTarget stdenv.buildPlatform;
-    rustBuildPlatformSpec = toRustTargetSpec stdenv.buildPlatform;
-    rustHostPlatform = toRustTarget stdenv.hostPlatform;
-    rustHostPlatformSpec = toRustTargetSpec stdenv.hostPlatform;
-    rustTargetPlatform = toRustTarget stdenv.targetPlatform;
-    rustTargetPlatformSpec = toRustTargetSpec stdenv.targetPlatform;
+    rustBuildPlatform = stdenv.buildPlatform.rust.rustcTarget;
+    rustBuildPlatformSpec = stdenv.buildPlatform.rust.rustcTargetSpec;
+    rustHostPlatform = stdenv.hostPlatform.rust.rustcTarget;
+    rustHostPlatformSpec = stdenv.hostPlatform.rust.rustcTargetSpec;
+    rustTargetPlatform = stdenv.targetPlatform.rust.rustcTarget;
+    rustTargetPlatformSpec = stdenv.targetPlatform.rust.rustcTargetSpec;
   in {
     inherit
       ccForBuild  cxxForBuild  rustBuildPlatform   rustBuildPlatformSpec
@@ -131,20 +48,34 @@ rec {
     # the following lines when rustTargetPlatform collides with
     # rustHostPlatform.
     + lib.optionalString (rustTargetPlatform != rustHostPlatform) ''
-      "CC_${toRustTargetForUseInEnvVars stdenv.targetPlatform}=${ccForTarget}" \
-      "CXX_${toRustTargetForUseInEnvVars stdenv.targetPlatform}=${cxxForTarget}" \
-      "CARGO_TARGET_${toRustTargetForUseInEnvVars stdenv.targetPlatform}_LINKER=${ccForTarget}" \
+      "CC_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${ccForTarget}" \
+      "CXX_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${cxxForTarget}" \
+      "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForTarget}" \
     '' + ''
-      "CC_${toRustTargetForUseInEnvVars stdenv.hostPlatform}=${ccForHost}" \
-      "CXX_${toRustTargetForUseInEnvVars stdenv.hostPlatform}=${cxxForHost}" \
-      "CARGO_TARGET_${toRustTargetForUseInEnvVars stdenv.hostPlatform}_LINKER=${ccForHost}" \
+      "CC_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${ccForHost}" \
+      "CXX_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${cxxForHost}" \
+      "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForHost}" \
     '' + ''
-      "CC_${toRustTargetForUseInEnvVars stdenv.buildPlatform}=${ccForBuild}" \
-      "CXX_${toRustTargetForUseInEnvVars stdenv.buildPlatform}=${cxxForBuild}" \
-      "CARGO_TARGET_${toRustTargetForUseInEnvVars stdenv.buildPlatform}_LINKER=${ccForBuild}" \
+      "CC_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${ccForBuild}" \
+      "CXX_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${cxxForBuild}" \
+      "CARGO_TARGET_${stdenv.buildPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForBuild}" \
       "CARGO_BUILD_TARGET=${rustBuildPlatform}" \
       "HOST_CC=${buildPackages.stdenv.cc}/bin/cc" \
       "HOST_CXX=${buildPackages.stdenv.cc}/bin/c++" \
     '';
   };
+} // lib.mapAttrs (old: new: platform:
+  # TODO: enable warning after 23.05 is EOL.
+  # lib.warn "`rust.${old} platform` is deprecated. Use `platform.rust.${new}` instead."
+    lib.getAttrFromPath new platform.rust)
+{
+  toTargetArch = [ "platform" "arch" ];
+  toTargetOs = [ "platform" "os" ];
+  toTargetFamily = [ "platform" "target-family" ];
+  toTargetVendor = [ "platform" "vendor" ];
+  toRustTarget = [ "rustcTarget" ];
+  toRustTargetSpec = [ "rustcTargetSpec" ];
+  toRustTargetSpecShort = [ "cargoShortTarget" ];
+  toRustTargetForUseInEnvVars = [ "cargoEnvVarTarget" ];
+  IsNoStdTarget = [ "isNoStdTarget" ];
 }
diff --git a/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh b/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
index 55e196e654d..e103fe77d9b 100644
--- a/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
+++ b/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
@@ -36,5 +36,5 @@ fixDarwinDylibNames() {
 
 fixDarwinDylibNamesIn() {
     local dir="$1"
-    fixDarwinDylibNames $(find "$dir" -name "*.dylib")
+    fixDarwinDylibNames $(find "$dir" -name "*.dylib" -o -name "*.so" -o -name "*.so.*")
 }
diff --git a/pkgs/development/tools/build-managers/cmake/001-search-path.diff b/pkgs/by-name/cm/cmake/001-search-path.diff
index 04ab0847a70..04ab0847a70 100644
--- a/pkgs/development/tools/build-managers/cmake/001-search-path.diff
+++ b/pkgs/by-name/cm/cmake/001-search-path.diff
diff --git a/pkgs/development/tools/build-managers/cmake/002-application-services.diff b/pkgs/by-name/cm/cmake/002-application-services.diff
index 56f7cd266b7..56f7cd266b7 100644
--- a/pkgs/development/tools/build-managers/cmake/002-application-services.diff
+++ b/pkgs/by-name/cm/cmake/002-application-services.diff
diff --git a/pkgs/development/tools/build-managers/cmake/003-libuv-application-services.diff b/pkgs/by-name/cm/cmake/003-libuv-application-services.diff
index 6607a9c6ed1..6607a9c6ed1 100644
--- a/pkgs/development/tools/build-managers/cmake/003-libuv-application-services.diff
+++ b/pkgs/by-name/cm/cmake/003-libuv-application-services.diff
diff --git a/pkgs/development/tools/build-managers/cmake/004-cygwin.diff b/pkgs/by-name/cm/cmake/004-cygwin.diff
index 982aba17e87..982aba17e87 100644
--- a/pkgs/development/tools/build-managers/cmake/004-cygwin.diff
+++ b/pkgs/by-name/cm/cmake/004-cygwin.diff
diff --git a/pkgs/development/tools/build-managers/cmake/005-remove-systemconfiguration-dep.diff b/pkgs/by-name/cm/cmake/005-remove-systemconfiguration-dep.diff
index 76aa91cff92..ffd3077d301 100644
--- a/pkgs/development/tools/build-managers/cmake/005-remove-systemconfiguration-dep.diff
+++ b/pkgs/by-name/cm/cmake/005-remove-systemconfiguration-dep.diff
@@ -1,6 +1,7 @@
---- a/Utilities/cmcurl/CMakeLists.txt
-+++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -391,13 +391,6 @@ if(ENABLE_IPV6 AND NOT WIN32)
+diff -Naur cmake-3.27.7/Utilities/cmcurl/CMakeLists.txt cmake-3.27.7-new/Utilities/cmcurl/CMakeLists.txt
+--- cmake-3.27.7/Utilities/cmcurl/CMakeLists.txt	2023-10-06 10:08:35.000000000 -0300
++++ cmake-3.27.7-new/Utilities/cmcurl/CMakeLists.txt	2023-10-22 21:51:09.231609901 -0300
+@@ -414,13 +414,6 @@
  
    if(CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND NOT ENABLE_ARES)
      set(use_core_foundation ON)
@@ -14,9 +15,10 @@
    endif()
  endif()
  
---- a/Utilities/cmcurl/lib/curl_setup.h
-+++ b/Utilities/cmcurl/lib/curl_setup.h
-@@ -257,11 +257,7 @@
+diff -Naur cmake-3.27.7/Utilities/cmcurl/lib/curl_setup.h cmake-3.27.7-new/Utilities/cmcurl/lib/curl_setup.h
+--- cmake-3.27.7/Utilities/cmcurl/lib/curl_setup.h	2023-10-06 10:08:35.000000000 -0300
++++ cmake-3.27.7-new/Utilities/cmcurl/lib/curl_setup.h	2023-10-22 21:52:00.214748294 -0300
+@@ -260,11 +260,7 @@
   * performing this task will result in a synthesized IPv6 address.
   */
  #if defined(__APPLE__) && !defined(USE_ARES)
@@ -28,9 +30,10 @@
  #endif
  
  #ifdef USE_LWIPSOCK
---- a/Utilities/cmcurl/lib/hostip.c
-+++ b/Utilities/cmcurl/lib/hostip.c
-@@ -68,10 +68,6 @@
+diff -Naur cmake-3.27.7/Utilities/cmcurl/lib/hostip.c cmake-3.27.7-new/Utilities/cmcurl/lib/hostip.c
+--- cmake-3.27.7/Utilities/cmcurl/lib/hostip.c	2023-10-06 10:08:35.000000000 -0300
++++ cmake-3.27.7-new/Utilities/cmcurl/lib/hostip.c	2023-10-22 21:53:29.249989934 -0300
+@@ -67,10 +67,6 @@
  #include "curl_memory.h"
  #include "memdebug.h"
  
@@ -38,10 +41,10 @@
 -#include <SystemConfiguration/SCDynamicStoreCopySpecific.h>
 -#endif
 -
- #if defined(CURLRES_SYNCH) && \
-     defined(HAVE_ALARM) && defined(SIGALRM) && defined(HAVE_SIGSETJMP)
- /* alarm-based timeouts can only be used with all the dependencies satisfied */
-@@ -661,23 +657,6 @@ enum resolve_t Curl_resolv(struct Curl_easy *data,
+ #if defined(CURLRES_SYNCH) &&                   \
+   defined(HAVE_ALARM) &&                        \
+   defined(SIGALRM) &&                           \
+@@ -743,23 +739,6 @@
          return CURLRESOLV_ERROR;
      }
  
diff --git a/pkgs/development/tools/build-managers/cmake/006-darwin-always-set-runtime-c-flag.diff b/pkgs/by-name/cm/cmake/006-darwin-always-set-runtime-c-flag.diff
index dc10e6b3423..dc10e6b3423 100644
--- a/pkgs/development/tools/build-managers/cmake/006-darwin-always-set-runtime-c-flag.diff
+++ b/pkgs/by-name/cm/cmake/006-darwin-always-set-runtime-c-flag.diff
diff --git a/pkgs/development/tools/build-managers/cmake/check-pc-files-hook.sh b/pkgs/by-name/cm/cmake/check-pc-files-hook.sh
index 94d1b7b5355..94d1b7b5355 100644
--- a/pkgs/development/tools/build-managers/cmake/check-pc-files-hook.sh
+++ b/pkgs/by-name/cm/cmake/check-pc-files-hook.sh
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/by-name/cm/cmake/package.nix
index 00715130a00..a5731479150 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -16,11 +16,17 @@
 , texinfo
 , xz
 , zlib
-, isBootstrap ? false
-, useOpenSSL ? !isBootstrap
-, useSharedLibraries ? (!isBootstrap && !stdenv.isCygwin)
+, isBootstrap ? null
+, isMinimalBuild ? (
+  if isBootstrap != null
+  then lib.warn
+    "isBootstrap argument is deprecated and will be removed; use isMinimalBuild instead"
+    isBootstrap
+  else false)
+, useOpenSSL ? !isMinimalBuild
+, useSharedLibraries ? (!isMinimalBuild && !stdenv.isCygwin)
 , uiToolkits ? [] # can contain "ncurses" and/or "qt5"
-, buildDocs ? !(isBootstrap || (uiToolkits == []))
+, buildDocs ? !(isMinimalBuild || (uiToolkits == []))
 , darwin
 , libsForQt5
 }:
@@ -34,17 +40,17 @@ in
 # Accepts only "ncurses" and "qt5" as possible uiToolkits
 assert lib.subtractLists [ "ncurses" "qt5" ] uiToolkits == [];
 # Minimal, bootstrap cmake does not have toolkits
-assert isBootstrap -> (uiToolkits == []);
+assert isMinimalBuild -> (uiToolkits == []);
 stdenv.mkDerivation (finalAttrs: {
   pname = "cmake"
-    + lib.optionalString isBootstrap "-boot"
+    + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.26.4";
+  version = "3.27.7";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-MTtogMKRvU/jHAqlHW5iZZKCpSHmlfMNXMDSWrvVwgg=";
+    hash = "sha256-CPcaEGA2vwUfaSdg75VYwFd8Qqw56Wugl+dmK9QVjY4=";
   };
 
   patches = [
@@ -57,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional stdenv.isCygwin ./004-cygwin.diff
   # Derived from https://github.com/curl/curl/commit/31f631a142d855f069242f3e0c643beec25d1b51
-  ++ lib.optional (stdenv.isDarwin && isBootstrap) ./005-remove-systemconfiguration-dep.diff
+  ++ lib.optional (stdenv.isDarwin && isMinimalBuild) ./005-remove-systemconfiguration-dep.diff
   # On Darwin, always set CMAKE_SHARED_LIBRARY_RUNTIME_C_FLAG.
   ++ lib.optional stdenv.isDarwin ./006-darwin-always-set-runtime-c-flag.diff;
 
@@ -90,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional useOpenSSL openssl
   ++ lib.optional cursesUI ncurses
   ++ lib.optional qt5UI qtbase
-  ++ lib.optional (stdenv.isDarwin && !isBootstrap) SystemConfiguration;
+  ++ lib.optional (stdenv.isDarwin && !isMinimalBuild) SystemConfiguration;
 
   propagatedBuildInputs = lib.optional stdenv.isDarwin ps;
 
@@ -104,12 +110,23 @@ stdenv.mkDerivation (finalAttrs: {
     configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags"
   '';
 
+  # The configuration script is not autoconf-based, although being similar;
+  # triples and other interesting info are passed via CMAKE_* environment
+  # variables and commandline switches
+  configurePlatforms = [ ];
+
   configureFlags = [
     "CXXFLAGS=-Wno-elaborated-enum-base"
     "--docdir=share/doc/${finalAttrs.pname}-${finalAttrs.version}"
   ] ++ (if useSharedLibraries
-        then [ "--no-system-jsoncpp" "--system-libs" ]
-        else [ "--no-system-libs" ]) # FIXME: cleanup
+        then [
+          "--no-system-cppdap"
+          "--no-system-jsoncpp"
+          "--system-libs"
+        ]
+        else [
+          "--no-system-libs"
+        ]) # FIXME: cleanup
   ++ lib.optional qt5UI "--qt-gui"
   ++ lib.optionals buildDocs [
     "--sphinx-build=${sphinx}/bin/sphinx-build"
@@ -129,15 +146,17 @@ stdenv.mkDerivation (finalAttrs: {
     # Unfortunately cmake seems to expect absolute paths for ar, ranlib, and
     # strip. Otherwise they are taken to be relative to the source root of the
     # package being built.
-    "-DCMAKE_CXX_COMPILER=${stdenv.cc.targetPrefix}c++"
-    "-DCMAKE_C_COMPILER=${stdenv.cc.targetPrefix}cc"
-    "-DCMAKE_AR=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
-    "-DCMAKE_RANLIB=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ranlib"
-    "-DCMAKE_STRIP=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip"
-
-    "-DCMAKE_USE_OPENSSL=${if useOpenSSL then "ON" else "OFF"}"
-    # Avoid depending on frameworks.
-    "-DBUILD_CursesDialog=${if cursesUI then "ON" else "OFF"}"
+    (lib.cmakeFeature "CMAKE_CXX_COMPILER" "${stdenv.cc.targetPrefix}c++")
+    (lib.cmakeFeature "CMAKE_C_COMPILER" "${stdenv.cc.targetPrefix}cc")
+    (lib.cmakeFeature "CMAKE_AR"
+      "${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar")
+    (lib.cmakeFeature "CMAKE_RANLIB"
+      "${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ranlib")
+    (lib.cmakeFeature "CMAKE_STRIP"
+      "${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip")
+
+    (lib.cmakeBool "CMAKE_USE_OPENSSL" useOpenSSL)
+    (lib.cmakeBool "BUILD_CursesDialog" cursesUI)
   ];
 
   # make install attempts to use the just-built cmake
@@ -148,10 +167,6 @@ stdenv.mkDerivation (finalAttrs: {
   dontUseCmakeConfigure = true;
   enableParallelBuilding = true;
 
-  # This isn't an autoconf configure script; triples are passed via
-  # CMAKE_SYSTEM_NAME, etc.
-  configurePlatforms = [ ];
-
   doCheck = false; # fails
 
   meta = {
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/by-name/cm/cmake/setup-hook.sh
index b28ed42b689..b28ed42b689 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/by-name/cm/cmake/setup-hook.sh
diff --git a/pkgs/development/tools/build-managers/meson/fix-rpath.patch b/pkgs/by-name/me/meson/001-fix-rpath.patch
index 29bec7903ca..29bec7903ca 100644
--- a/pkgs/development/tools/build-managers/meson/fix-rpath.patch
+++ b/pkgs/by-name/me/meson/001-fix-rpath.patch
diff --git a/pkgs/development/tools/build-managers/meson/clear-old-rpath.patch b/pkgs/by-name/me/meson/002-clear-old-rpath.patch
index f1e3c76e8b5..f1e3c76e8b5 100644
--- a/pkgs/development/tools/build-managers/meson/clear-old-rpath.patch
+++ b/pkgs/by-name/me/meson/002-clear-old-rpath.patch
diff --git a/pkgs/development/tools/build-managers/meson/more-env-vars.patch b/pkgs/by-name/me/meson/003-more-env-vars.patch
index e4ad4355042..e4ad4355042 100644
--- a/pkgs/development/tools/build-managers/meson/more-env-vars.patch
+++ b/pkgs/by-name/me/meson/003-more-env-vars.patch
diff --git a/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch b/pkgs/by-name/me/meson/004-gir-fallback-path.patch
index e6d74026527..e6d74026527 100644
--- a/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
+++ b/pkgs/by-name/me/meson/004-gir-fallback-path.patch
diff --git a/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch b/pkgs/by-name/me/meson/005-boost-Do-not-add-system-paths-on-nix.patch
index 0a2eda9de9a..0a2eda9de9a 100644
--- a/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
+++ b/pkgs/by-name/me/meson/005-boost-Do-not-add-system-paths-on-nix.patch
diff --git a/pkgs/development/tools/build-managers/meson/disable-bitcode.patch b/pkgs/by-name/me/meson/006-disable-bitcode.patch
index a72997c1043..a72997c1043 100644
--- a/pkgs/development/tools/build-managers/meson/disable-bitcode.patch
+++ b/pkgs/by-name/me/meson/006-disable-bitcode.patch
diff --git a/pkgs/development/tools/build-managers/meson/emulator-hook.sh b/pkgs/by-name/me/meson/emulator-hook.sh
index 4f08087cf5f..4f08087cf5f 100644
--- a/pkgs/development/tools/build-managers/meson/emulator-hook.sh
+++ b/pkgs/by-name/me/meson/emulator-hook.sh
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/by-name/me/meson/package.nix
index 6674fbe7819..6239927848a 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -3,19 +3,19 @@
 , fetchFromGitHub
 , fetchpatch
 , installShellFiles
+, coreutils
+, darwin
+, libxcrypt
 , ninja
 , pkg-config
 , python3
-, zlib
-, coreutils
 , substituteAll
-, Foundation
-, OpenGL
-, AppKit
-, Cocoa
-, libxcrypt
+, zlib
 }:
 
+let
+  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation OpenGL;
+in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
   version = "1.2.3";
@@ -28,25 +28,13 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   patches = [
-    # Meson is currently inspecting fewer variables than autoconf does, which
-    # makes it harder for us to use setup hooks, etc.  Taken from
-    # https://github.com/mesonbuild/meson/pull/6827
-    ./more-env-vars.patch
-
-    # Unlike libtool, vanilla Meson does not pass any information
-    # about the path library will be installed to to g-ir-scanner,
-    # breaking the GIR when path other than ${!outputLib}/lib is used.
-    # We patch Meson to add a --fallback-library-path argument with
-    # library install_dir to g-ir-scanner.
-    ./gir-fallback-path.patch
-
-    # In common distributions, RPATH is only needed for internal libraries so
+    # In typical distributions, RPATH is only needed for internal libraries so
     # meson removes everything else. With Nix, the locations of libraries
     # are not as predictable, therefore we need to keep them in the RPATH.
     # At the moment we are keeping the paths starting with /nix/store.
     # https://github.com/NixOS/nixpkgs/issues/31222#issuecomment-365811634
     (substituteAll {
-      src = ./fix-rpath.patch;
+      src = ./001-fix-rpath.patch;
       inherit (builtins) storeDir;
     })
 
@@ -56,50 +44,89 @@ python3.pkgs.buildPythonApplication rec {
     # But this can cause much bigger problem for Nix as it can produce
     # cut-in-half-by-\0 store path references.
     # Let’s just clear the whole rpath and hope for the best.
-    ./clear-old-rpath.patch
+    ./002-clear-old-rpath.patch
+
+    # Meson is currently inspecting fewer variables than autoconf does, which
+    # makes it harder for us to use setup hooks, etc.
+    # https://github.com/mesonbuild/meson/pull/6827
+    ./003-more-env-vars.patch
+
+    # Unlike libtool, vanilla Meson does not pass any information about the path
+    # library will be installed to to g-ir-scanner, breaking the GIR when path
+    # other than ${!outputLib}/lib is used.
+    # We patch Meson to add a --fallback-library-path argument with library
+    # install_dir to g-ir-scanner.
+    ./004-gir-fallback-path.patch
 
     # Patch out default boost search paths to avoid impure builds on
     # unsandboxed non-NixOS builds, see:
     # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
-    ./boost-Do-not-add-system-paths-on-nix.patch
+    ./005-boost-Do-not-add-system-paths-on-nix.patch
 
     # Nixpkgs cctools does not have bitcode support.
-    ./disable-bitcode.patch
+    ./006-disable-bitcode.patch
 
     # Fix passing multiple --define-variable arguments to pkg-config.
     # https://github.com/mesonbuild/meson/pull/10670
     (fetchpatch {
       url = "https://github.com/mesonbuild/meson/commit/d5252c5d4cf1c1931fef0c1c98dd66c000891d21.patch";
-      sha256 = "GiUNVul1N5Fl8mfqM7vA/r1FdKqImiDYLXMVDt77gvw=";
+      hash = "sha256-GiUNVul1N5Fl8mfqM7vA/r1FdKqImiDYLXMVDt77gvw=";
       excludes = [
         "docs/yaml/objects/dep.yaml"
       ];
     })
   ];
 
-  setupHook = ./setup-hook.sh;
+  buildInputs = lib.optionals (python3.pythonOlder "3.9") [
+    libxcrypt
+  ];
 
-  nativeCheckInputs = [ ninja pkg-config ];
-  checkInputs = [ zlib ]
-    ++ lib.optionals stdenv.isDarwin [ Foundation OpenGL AppKit Cocoa ];
-  checkPhase = ''
-    runHook preCheck
+  nativeBuildInputs = [ installShellFiles ];
 
-    patchShebangs 'test cases'
-    substituteInPlace 'test cases/native/8 external program shebang parsing/script.int.in' \
-      --replace /usr/bin/env ${coreutils}/bin/env
+  nativeCheckInputs = [
+    ninja
+    pkg-config
+  ];
+
+  checkInputs = [
+    zlib
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    AppKit
+    Cocoa
+    Foundation
+    OpenGL
+  ];
+
+  checkPhase = lib.concatStringsSep "\n" ([
+    "runHook preCheck"
+    ''
+      patchShebangs 'test cases'
+      substituteInPlace \
+        'test cases/native/8 external program shebang parsing/script.int.in' \
+          --replace /usr/bin/env ${coreutils}/bin/env
+    ''
+  ]
+  # Remove problematic tests
+  ++ (builtins.map (f: ''rm -vr "${f}";'') [
     # requires git, creating cyclic dependency
-    rm -r 'test cases/common/66 vcstag'
+    ''test cases/common/66 vcstag''
     # requires glib, creating cyclic dependency
-    rm -r 'test cases/linuxlike/6 subdir include order'
-    rm -r 'test cases/linuxlike/9 compiler checks with dependencies'
+    ''test cases/linuxlike/6 subdir include order''
+    ''test cases/linuxlike/9 compiler checks with dependencies''
     # requires static zlib, see #66461
-    rm -r 'test cases/linuxlike/14 static dynamic linkage'
+    ''test cases/linuxlike/14 static dynamic linkage''
     # Nixpkgs cctools does not have bitcode support.
-    rm -r 'test cases/osx/7 bitcode'
-    HOME="$TMPDIR" python ./run_project_tests.py
+    ''test cases/osx/7 bitcode''
+  ])
+  ++ [
+    ''HOME="$TMPDIR" python ./run_project_tests.py''
+    "runHook postCheck"
+  ]);
 
-    runHook postCheck
+  postInstall = ''
+    installShellCompletion --zsh data/shell-completions/zsh/_meson
+    installShellCompletion --bash data/shell-completions/bash/meson
   '';
 
   postFixup = ''
@@ -117,18 +144,9 @@ python3.pkgs.buildPythonApplication rec {
       --replace "python3 -c " "${python3.interpreter} -c "
   '';
 
-  buildInputs = lib.optionals (python3.pythonOlder "3.9") [
-    libxcrypt
-  ];
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = ''
-    installShellCompletion --zsh data/shell-completions/zsh/_meson
-    installShellCompletion --bash data/shell-completions/bash/meson
-  '';
+  setupHook = ./setup-hook.sh;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://mesonbuild.com";
     description = "An open source, fast and friendly build system made in Python";
     longDescription = ''
@@ -140,8 +158,8 @@ python3.pkgs.buildPythonApplication rec {
       second spent waiting for the build system to actually start compiling
       code.
     '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ mbe AndersonTorres ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
     inherit (python3.meta) platforms;
   };
 }
diff --git a/pkgs/by-name/me/meson/setup-hook.sh b/pkgs/by-name/me/meson/setup-hook.sh
new file mode 100644
index 00000000000..85849fbec73
--- /dev/null
+++ b/pkgs/by-name/me/meson/setup-hook.sh
@@ -0,0 +1,87 @@
+# shellcheck shell=bash disable=SC2206
+
+mesonConfigurePhase() {
+    runHook preConfigure
+
+    local flagsArray=()
+
+    if [ -z "${dontAddPrefix-}" ]; then
+        flagsArray+=("--prefix=$prefix")
+    fi
+
+    # See multiple-outputs.sh and meson’s coredata.py
+    flagsArray+=(
+        "--libdir=${!outputLib}/lib"
+        "--libexecdir=${!outputLib}/libexec"
+        "--bindir=${!outputBin}/bin"
+        "--sbindir=${!outputBin}/sbin"
+        "--includedir=${!outputInclude}/include"
+        "--mandir=${!outputMan}/share/man"
+        "--infodir=${!outputInfo}/share/info"
+        "--localedir=${!outputLib}/share/locale"
+        "-Dauto_features=${mesonAutoFeatures:-enabled}"
+        "-Dwrap_mode=${mesonWrapMode:-nodownload}"
+        ${crossMesonFlags}
+        "--buildtype=${mesonBuildType:-plain}"
+    )
+
+    flagsArray+=(
+        $mesonFlags
+        "${mesonFlagsArray[@]}"
+    )
+
+    echoCmd 'mesonConfigurePhase flags' "${flagsArray[@]}"
+
+    meson setup build "${flagsArray[@]}"
+    cd build || { echoCmd 'mesonConfigurePhase' "could not cd to build"; exit 1; }
+
+    if ! [[ -v enableParallelBuilding ]]; then
+        enableParallelBuilding=1
+        echoCmd 'mesonConfigurePhase' "enabled parallel building"
+    fi
+
+    if [[ ${checkPhase-ninjaCheckPhase} = ninjaCheckPhase && -z $dontUseMesonCheck ]]; then
+        checkPhase=mesonCheckPhase
+    fi
+    if [[ ${installPhase-ninjaInstallPhase} = ninjaInstallPhase && -z $dontUseMesonInstall ]]; then
+        installPhase=mesonInstallPhase
+    fi
+
+    runHook postConfigure
+}
+
+mesonCheckPhase() {
+    runHook preCheck
+
+    local flagsArray=($mesonCheckFlags "${mesonCheckFlagsArray[@]}")
+
+    echoCmd 'mesonCheckPhase flags' "${flagsArray[@]}"
+    meson test --no-rebuild "${flagsArray[@]}"
+
+    runHook postCheck
+}
+
+mesonInstallPhase() {
+    runHook preInstall
+
+    local flagsArray=()
+
+    if [[ -n "$mesonInstallTags" ]]; then
+        flagsArray+=("--tags" "${mesonInstallTags// /,}")
+    fi
+    flagsArray+=(
+        $mesonInstallFlags
+        "${mesonInstallFlagsArray[@]}"
+    )
+
+    echoCmd 'mesonInstallPhase flags' "${flagsArray[@]}"
+    meson install --no-rebuild "${flagsArray[@]}"
+
+    runHook postInstall
+}
+
+if [ -z "${dontUseMesonConfigure-}" ] && [ -z "${configurePhase-}" ]; then
+    # shellcheck disable=SC2034
+    setOutputFlags=
+    configurePhase=mesonConfigurePhase
+fi
diff --git a/pkgs/desktops/gnome/core/gnome-tour/default.nix b/pkgs/desktops/gnome/core/gnome-tour/default.nix
index c471417d616..bb658fcd448 100644
--- a/pkgs/desktops/gnome/core/gnome-tour/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-tour/default.nix
@@ -17,8 +17,6 @@
 , libadwaita
 , librsvg
 , rustc
-, rust
-, writeText
 , cargo
 }:
 
@@ -60,16 +58,6 @@ stdenv.mkDerivation rec {
     librsvg
   ];
 
-  mesonFlags =
-    let
-      # ERROR: 'rust' compiler binary not defined in cross or native file
-      crossFile = writeText "cross-file.conf" ''
-        [binaries]
-        rust = [ 'rustc', '--target', '${rust.toRustTargetSpec stdenv.hostPlatform}' ]
-      '';
-    in
-    lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
-
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index 0fe23000cc9..01f17251308 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -108,8 +108,8 @@ let inherit version;
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.isMinGW;
-    stageNameAddon = if withoutTargetLibc then "stage-static" else "stage-final";
-    crossNameAddon = optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-${stageNameAddon}-";
+    stageNameAddon = optionalString withoutTargetLibc "-nolibc";
+    crossNameAddon = optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}${stageNameAddon}-";
 
     javaAwtGtk = langJava && x11Support;
     xlibs = [
diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index 7806cf07443..c12af4db34c 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.21.3";
+  version = "1.21.4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-GG8rb4yLcE5paCGwmrIEGlwe4T3LwxVqE63PdZMe5Ig=";
+    hash = "sha256-R7Jqg9K2WjwcG8rOJztpvuSaentRaKdgTe09JqN714c=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/mrustc/bootstrap.nix b/pkgs/development/compilers/mrustc/bootstrap.nix
index a8bf26bacdf..0996702ec62 100644
--- a/pkgs/development/compilers/mrustc/bootstrap.nix
+++ b/pkgs/development/compilers/mrustc/bootstrap.nix
@@ -2,7 +2,6 @@
 , fetchurl
 , mrustc
 , mrustc-minicargo
-, rust
 , llvm_12
 , llvmPackages_12
 , libffi
@@ -74,7 +73,7 @@ stdenv.mkDerivation rec {
     "MRUSTC=${mrustc}/bin/mrustc"
     #"MINICARGO=${mrustc-minicargo}/bin/minicargo"  # FIXME: we need to rebuild minicargo locally so --manifest-overrides is applied
     "LLVM_CONFIG=${llvm_12.dev}/bin/llvm-config"
-    "RUSTC_TARGET=${rust.toRustTarget stdenv.targetPlatform}"
+    "RUSTC_TARGET=${stdenv.targetPlatform.rust.rustcTarget}"
   ];
 
   buildPhase = ''
@@ -129,7 +128,7 @@ stdenv.mkDerivation rec {
     cp run_rustc/${outputDir}/prefix/bin/rustc_binary $out/bin/rustc
 
     cp -r run_rustc/${outputDir}/prefix/lib/* $out/lib/
-    cp $out/lib/rustlib/${rust.toRustTarget stdenv.targetPlatform}/lib/*.so $out/lib/
+    cp $out/lib/rustlib/${stdenv.targetPlatform.rust.rustcTarget}/lib/*.so $out/lib/
     runHook postInstall
   '';
 
@@ -146,4 +145,3 @@ stdenv.mkDerivation rec {
     platforms = [ "x86_64-linux" ];
   };
 }
-
diff --git a/pkgs/development/compilers/rust/bootstrap.nix b/pkgs/development/compilers/rust/bootstrap.nix
index 7c0b46d5593..97ac6927025 100644
--- a/pkgs/development/compilers/rust/bootstrap.nix
+++ b/pkgs/development/compilers/rust/bootstrap.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchurl, rust, callPackage, version, hashes }:
+{ stdenv, fetchurl, callPackage, version, hashes }:
 
 let
-  platform = rust.toRustTarget stdenv.hostPlatform;
+  platform = stdenv.hostPlatform.rust.rustcTarget;
 
   src = fetchurl {
      url = "https://static.rust-lang.org/dist/rust-${version}-${platform}.tar.gz";
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 46e238ff479..8eb628aa536 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, pkgsBuildHost, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
-, installShellFiles, makeWrapper, rustPlatform, rust, rustc
+, installShellFiles, makeWrapper, rustPlatform, rustc
 , CoreFoundation, Security
 , auditable ? !cargo-auditable.meta.broken
 , cargo-auditable
@@ -116,6 +116,6 @@ rustPlatform.buildRustPackage.override {
     broken = stdenv.hostPlatform.isx86 && stdenv.buildPlatform != stdenv.hostPlatform;
   };
 }
-// lib.optionalAttrs (rust.toRustTarget stdenv.buildPlatform != rust.toRustTarget stdenv.hostPlatform) {
+// lib.optionalAttrs (stdenv.buildPlatform.rust.rustcTarget != stdenv.hostPlatform.rust.rustcTarget) {
   HOST_PKG_CONFIG_PATH="${pkgsBuildBuild.pkg-config}/bin/pkg-config";
 })
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 44c290acbd3..5f97b0f4019 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget, targetPackages
 , llvmShared, llvmSharedForBuild, llvmSharedForHost, llvmSharedForTarget, llvmPackages
 , fetchurl, file, python3
-, darwin, cargo, cmake, rust, rustc
+, darwin, cargo, cmake, rustc
 , pkg-config, openssl, xz
 , libiconv
 , which, libffi
@@ -51,7 +51,7 @@ in stdenv.mkDerivation rec {
   # but it does support checking these idiosyncratic PKG_CONFIG_${TRIPLE}
   # environment variables.
   # [1]: https://github.com/rust-lang/pkg-config-rs/issues/53
-  "PKG_CONFIG_${builtins.replaceStrings ["-"] ["_"] (rust.toRustTarget stdenv.buildPlatform)}" =
+  "PKG_CONFIG_${builtins.replaceStrings ["-"] ["_"] stdenv.buildPlatform.rust.rustcTarget}" =
     "${pkgsBuildHost.stdenv.cc.targetPrefix}pkg-config";
 
   NIX_LDFLAGS = toString (
@@ -69,9 +69,9 @@ in stdenv.mkDerivation rec {
     prefixForStdenv = stdenv: "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}";
     ccPrefixForStdenv = stdenv: "${prefixForStdenv stdenv}${if (stdenv.cc.isClang or false) then "clang" else "cc"}";
     cxxPrefixForStdenv = stdenv: "${prefixForStdenv stdenv}${if (stdenv.cc.isClang or false) then "clang++" else "c++"}";
-    setBuild  = "--set=target.${rust.toRustTarget stdenv.buildPlatform}";
-    setHost   = "--set=target.${rust.toRustTarget stdenv.hostPlatform}";
-    setTarget = "--set=target.${rust.toRustTarget stdenv.targetPlatform}";
+    setBuild  = "--set=target.${stdenv.buildPlatform.rust.rustcTarget}";
+    setHost   = "--set=target.${stdenv.hostPlatform.rust.rustcTarget}";
+    setTarget = "--set=target.${stdenv.targetPlatform.rust.rustcTarget}";
     ccForBuild  = ccPrefixForStdenv pkgsBuildBuild.targetPackages.stdenv;
     cxxForBuild  = cxxPrefixForStdenv pkgsBuildBuild.targetPackages.stdenv;
     ccForHost  = ccPrefixForStdenv pkgsBuildHost.targetPackages.stdenv;
@@ -85,23 +85,23 @@ in stdenv.mkDerivation rec {
     "--tools=rustc,rust-analyzer-proc-macro-srv"
     "--enable-rpath"
     "--enable-vendor"
-    "--build=${rust.toRustTargetSpec stdenv.buildPlatform}"
-    "--host=${rust.toRustTargetSpec stdenv.hostPlatform}"
+    "--build=${stdenv.buildPlatform.rust.rustcTargetSpec}"
+    "--host=${stdenv.hostPlatform.rust.rustcTargetSpec}"
     # std is built for all platforms in --target.
     "--target=${concatStringsSep "," ([
-      (rust.toRustTargetSpec stdenv.targetPlatform)
+      stdenv.targetPlatform.rust.rustcTargetSpec
 
     # (build!=target): When cross-building a compiler we need to add
     # the build platform as well so rustc can compile build.rs
     # scripts.
     ] ++ optionals (stdenv.buildPlatform != stdenv.targetPlatform && !fastCross) [
-      (rust.toRustTargetSpec stdenv.buildPlatform)
+      stdenv.buildPlatform.rust.rustcTargetSpec
 
     # (host!=target): When building a cross-targeting compiler we
     # need to add the host platform as well so rustc can compile
     # build.rs scripts.
     ] ++ optionals (stdenv.hostPlatform != stdenv.targetPlatform && !fastCross) [
-      (rust.toRustTargetSpec stdenv.hostPlatform)
+      stdenv.hostPlatform.rust.rustcTargetSpec
     ])}"
 
     "${setBuild}.cc=${ccForBuild}"
@@ -132,7 +132,7 @@ in stdenv.mkDerivation rec {
     "${setHost}.musl-root=${pkgsBuildHost.targetPackages.stdenv.cc.libc}"
   ] ++ optionals stdenv.targetPlatform.isMusl [
     "${setTarget}.musl-root=${pkgsBuildTarget.targetPackages.stdenv.cc.libc}"
-  ] ++ optionals (rust.IsNoStdTarget stdenv.targetPlatform) [
+  ] ++ optionals stdenv.targetPlatform.rust.isNoStdTarget [
     "--disable-docs"
   ] ++ optionals (stdenv.isDarwin && stdenv.isx86_64) [
     # https://github.com/rust-lang/rust/issues/92173
@@ -144,12 +144,12 @@ in stdenv.mkDerivation rec {
   buildPhase = if fastCross then "
     runHook preBuild
 
-    mkdir -p build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-{std,rustc}/${rust.toRustTargetSpec stdenv.hostPlatform}/release/
-    ln -s ${rustc}/lib/rustlib/${rust.toRustTargetSpec stdenv.hostPlatform}/libstd-*.so build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-std/${rust.toRustTargetSpec stdenv.hostPlatform}/release/libstd.so
-    ln -s ${rustc}/lib/rustlib/${rust.toRustTargetSpec stdenv.hostPlatform}/librustc_driver-*.so build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/librustc.so
-    ln -s ${rustc}/bin/rustc build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/rustc-main
-    touch build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-std/${rust.toRustTargetSpec stdenv.hostPlatform}/release/.libstd.stamp
-    touch build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/.librustc.stamp
+    mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/
+    ln -s ${rustc}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/libstd-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/libstd.so
+    ln -s ${rustc}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/librustc_driver-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc.so
+    ln -s ${rustc}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main
+    touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd.stamp
+    touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc.stamp
     python ./x.py --keep-stage=0 --stage=1 build library/std
 
     runHook postBuild
@@ -162,8 +162,8 @@ in stdenv.mkDerivation rec {
     mkdir -v $out/bin $doc $man
     makeWrapper ${rustc}/bin/rustc $out/bin/rustc --add-flags "--sysroot $out"
     makeWrapper ${rustc}/bin/rustdoc $out/bin/rustdoc --add-flags "--sysroot $out"
-    ln -s ${rustc}/lib/rustlib/{manifest-rust-std-,}${rust.toRustTargetSpec stdenv.hostPlatform} $out/lib/rustlib/
-    echo rust-std-${rust.toRustTargetSpec stdenv.hostPlatform} >> $out/lib/rustlib/components
+    ln -s ${rustc}/lib/rustlib/{manifest-rust-std-,}${stdenv.hostPlatform.rust.rustcTargetSpec} $out/lib/rustlib/
+    echo rust-std-${stdenv.hostPlatform.rust.rustcTargetSpec} >> $out/lib/rustlib/components
     lndir ${rustc.doc} $doc
     lndir ${rustc.man} $man
 
diff --git a/pkgs/development/interpreters/python/catch_conflicts/catch_conflicts.py b/pkgs/development/interpreters/python/catch_conflicts/catch_conflicts.py
index bb82900c65a..d5c99e64751 100644
--- a/pkgs/development/interpreters/python/catch_conflicts/catch_conflicts.py
+++ b/pkgs/development/interpreters/python/catch_conflicts/catch_conflicts.py
@@ -1,30 +1,34 @@
-import pkg_resources
+from importlib.metadata import PathDistribution
+from pathlib import Path
 import collections
 import sys
 
+
 do_abort = False
 packages = collections.defaultdict(list)
 
-for f in sys.path:
-    for req in pkg_resources.find_distributions(f):
-        if req not in packages[req.project_name]:
-            # some exceptions inside buildPythonPackage
-            if req.project_name in ['setuptools', 'pip', 'wheel']:
-                continue
-            packages[req.project_name].append(req)
+
+for path in sys.path:
+    for dist_info in Path(path).glob("*.dist-info"):
+        dist = PathDistribution(dist_info)
+
+        packages[dist._normalized_name].append(
+            f"{dist._normalized_name} {dist.version} ({dist._path})"
+        )
 
 
 for name, duplicates in packages.items():
     if len(duplicates) > 1:
         do_abort = True
         print("Found duplicated packages in closure for dependency '{}': ".format(name))
-        for dup in duplicates:
-            print("  " + repr(dup))
+        for duplicate in duplicates:
+            print(f"\t{duplicate}")
 
 if do_abort:
     print("")
     print(
-        'Package duplicates found in closure, see above. Usually this '
-        'happens if two packages depend on different version '
-        'of the same dependency.')
+        "Package duplicates found in closure, see above. Usually this "
+        "happens if two packages depend on different version "
+        "of the same dependency."
+    )
     sys.exit(1)
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 42244dabb0d..f7cc10274ae 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -107,7 +107,7 @@ in {
     makePythonHook {
       name = "python-catch-conflicts-hook";
       substitutions = {
-        inherit pythonInterpreter pythonSitePackages setuptools;
+        inherit pythonInterpreter pythonSitePackages;
         catchConflicts=../catch_conflicts/catch_conflicts.py;
       };
     } ./python-catch-conflicts-hook.sh) {};
@@ -183,16 +183,14 @@ in {
       };
     } ./setuptools-check-hook.sh) {};
 
-    setuptoolsRustBuildHook = callPackage ({ makePythonHook, setuptools-rust, rust }:
+    setuptoolsRustBuildHook = callPackage ({ makePythonHook, setuptools-rust }:
       makePythonHook {
         name = "setuptools-rust-setup-hook";
         propagatedBuildInputs = [ setuptools-rust ];
         substitutions = {
           pyLibDir = "${python}/lib/${python.libPrefix}";
-          cargoBuildTarget = rust.toRustTargetSpec stdenv.hostPlatform;
-          cargoLinkerVar = lib.toUpper (
-              builtins.replaceStrings ["-"] ["_"] (
-                rust.toRustTarget stdenv.hostPlatform));
+          cargoBuildTarget = stdenv.hostPlatform.rust.rustcTargetSpec;
+          cargoLinkerVar = stdenv.hostPlatform.rust.cargoEnvVarTarget;
           targetLinker = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
         };
       } ./setuptools-rust-hook.sh) {};
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index f0818da2a53..8e9e35dae59 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.21";
+  version = "3.4.22";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-oIz9sT+ZfKh1HZc3Fg300EQpSfNsG7fZZB/ilcKXEIA=";
+    hash = "sha256-gD+nd3bRHT0btWOCZhbIERJEJeAzGtH9mDxBRARqYVY=";
   };
 
   patches = [
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/rubygems/rubygems/blob/v${version}/CHANGELOG.md";
     homepage = "https://rubygems.org/";
     license = with licenses; [ mit /* or */ ruby ];
+    mainProgram = "gem";
     maintainers = with maintainers; [ zimbatm ];
   };
 }
diff --git a/pkgs/development/libraries/glibc/0001-aarch64-math-vector.h-add-NVCC-include-guard.patch b/pkgs/development/libraries/glibc/0001-aarch64-math-vector.h-add-NVCC-include-guard.patch
new file mode 100644
index 00000000000..234bc1943c9
--- /dev/null
+++ b/pkgs/development/libraries/glibc/0001-aarch64-math-vector.h-add-NVCC-include-guard.patch
@@ -0,0 +1,37 @@
+From 44d0a3a9bd8c6fe59f6ccb44206a50a900bfcf4a Mon Sep 17 00:00:00 2001
+From: Connor Baker <connor.baker@tweag.io>
+Date: Tue, 31 Oct 2023 14:30:24 +0000
+Subject: [PATCH] aarch64/math-vector.h: add NVCC include guard
+
+---
+ sysdeps/aarch64/fpu/bits/math-vector.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sysdeps/aarch64/fpu/bits/math-vector.h b/sysdeps/aarch64/fpu/bits/math-vector.h
+index 7c200599c1..583a426494 100644
+--- a/sysdeps/aarch64/fpu/bits/math-vector.h
++++ b/sysdeps/aarch64/fpu/bits/math-vector.h
+@@ -25,17 +25,17 @@
+ /* Get default empty definitions for simd declarations.  */
+ #include <bits/libm-simd-decl-stubs.h>
+ 
+-#if __GNUC_PREREQ(9, 0)
++#if __GNUC_PREREQ(9, 0) && !defined(__CUDACC__)
+ #  define __ADVSIMD_VEC_MATH_SUPPORTED
+ typedef __Float32x4_t __f32x4_t;
+ typedef __Float64x2_t __f64x2_t;
+-#elif __glibc_clang_prereq(8, 0)
++#elif __glibc_clang_prereq(8, 0) && !defined(__CUDACC__)
+ #  define __ADVSIMD_VEC_MATH_SUPPORTED
+ typedef __attribute__ ((__neon_vector_type__ (4))) float __f32x4_t;
+ typedef __attribute__ ((__neon_vector_type__ (2))) double __f64x2_t;
+ #endif
+ 
+-#if __GNUC_PREREQ(10, 0) || __glibc_clang_prereq(11, 0)
++#if (__GNUC_PREREQ(10, 0) || __glibc_clang_prereq(11, 0)) && !defined(__CUDACC__)
+ #  define __SVE_VEC_MATH_SUPPORTED
+ typedef __SVFloat32_t __sv_f32_t;
+ typedef __SVFloat64_t __sv_f64_t;
+-- 
+2.42.0
+
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 646242de611..3e17817c0ba 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -97,6 +97,18 @@ stdenv.mkDerivation ({
       */
       ./reenable_DT_HASH.patch
     ]
+    /* NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost
+       every HPC piece of software, without this patch CUDA compilation on ARM
+       is effectively broken. See
+       https://forums.developer.nvidia.com/t/nvcc-fails-to-build-with-arm-neon-instructions-cpp-vs-cu/248355/2.
+    */
+    ++ (
+      let
+        isAarch64 = stdenv.buildPlatform.isAarch64 || stdenv.hostPlatform.isAarch64;
+        isLinux = stdenv.buildPlatform.isLinux || stdenv.hostPlatform.isLinux;
+      in
+      lib.optional (isAarch64 && isLinux) ./0001-aarch64-math-vector.h-add-NVCC-include-guard.patch
+    )
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
     ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
 
@@ -276,7 +288,7 @@ stdenv.mkDerivation ({
 
     license = licenses.lgpl2Plus;
 
-    maintainers = with maintainers; [ eelco ma27 ];
+    maintainers = with maintainers; [ eelco ma27 connorbaker ];
     platforms = platforms.linux;
   } // (args.meta or {});
 })
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 0cfe4c79458..4dec79e0e2d 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -26,11 +26,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-lVHjcIGtO96BAYoNJPJFw/ggaZBUlZj7Mal6aDgKe3E=";
+    hash = "sha256-BD4u/hi0rSK5bUNN3nY/vtMs+NbCINxp3w0P+53Gb8Y=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 84c3abd575c..daf3bad132d 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.57.0"; # N.B: if you change this, please update:
+  version = "1.59.1"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-ZPhPi4ODAAohCySVKeypaDID4ZUXvnfidOGK5EMXvh4=";
+    hash = "sha256-4bou7oFQOgyxjFqJdmiFT8xEMCsOap9v34W6SPrT4WQ=";
     fetchSubmodules = true;
   };
 
@@ -37,14 +37,8 @@ stdenv.mkDerivation rec {
     (fetchpatch {
       # armv6l support, https://github.com/grpc/grpc/pull/21341
       name = "grpc-link-libatomic.patch";
-      url = "https://github.com/lopsided98/grpc/commit/164f55260262c816e19cd2c41b564486097d62fe.patch";
-      hash = "sha256-d6kMyjL5ZnEnEz4XZfRgXJBH53gp1r7q1tlwh+HM6+Y=";
-    })
-    # Fix generated CMake config file
-    # FIXME: remove when merged
-    (fetchpatch {
-      url = "https://github.com/grpc/grpc/pull/33361/commits/117dc80eb43021dd5619023ef6d02d0d6ec7ae7a.patch";
-      hash = "sha256-VBk3ZD5h9uOQVN0st+quUQK/wXqvfFNk8G8AN4f2MQo=";
+      url = "https://github.com/lopsided98/grpc/commit/a9b917666234f5665c347123d699055d8c2537b2.patch";
+      hash = "sha256-Lm0GQsz/UjBbXXEE14lT0dcRzVmCKycrlrdBJj+KLu8=";
     })
   ];
 
@@ -95,13 +89,12 @@ stdenv.mkDerivation rec {
     export LD_LIBRARY_PATH=$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
   '';
 
-  env.NIX_CFLAGS_COMPILE = lib.concatStringsSep " " (
-    lib.optionals stdenv.cc.isClang [
-      "-Wno-error=unknown-warning-option"
-    ] ++ lib.optionals stdenv.isAarch64 [
-      "-Wno-error=format-security"
-    ]
-  );
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-Wno-error"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Workaround for https://github.com/llvm/llvm-project/issues/48757
+    "-Wno-elaborated-enum-base"
+  ]);
 
   enableParallelBuilds = true;
 
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index e0d324936dd..ee467f965c8 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -2,13 +2,11 @@
 , stdenv
 , fetchFromGitLab
 , fetchpatch
-, writeText
 , rustPlatform
 , meson
 , ninja
 , python3
 , pkg-config
-, rust
 , rustc
 , cargo
 , cargo-c
@@ -205,14 +203,7 @@ stdenv.mkDerivation rec {
   ) ++ [
     (lib.mesonOption "sodium-source" "system")
     (lib.mesonEnable "doc" enableDocumentation)
-  ] ++ (let
-    crossFile = writeText "cross-file.conf" ''
-      [binaries]
-      rust = [ 'rustc', '--target', '${rust.toRustTargetSpec stdenv.hostPlatform}' ]
-    '';
-  in lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "--cross-file=${crossFile}"
-  ]);
+  ];
 
   # turn off all auto plugins since we use a list of plugins we generate
   mesonAutoFeatures = "disabled";
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 6be0370a177..c5e40babfd6 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, fetchzip, yasm, perl, cmake, pkg-config, python3
 , enableButteraugli ? true, libjxl
 , enableVmaf ? true, libvmaf
+, gitUpdater
 }:
 
 let
@@ -8,11 +9,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.6.1";
+  version = "3.7.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "sha256-U7hmKdpjTtqStM4UIjCvgJ2swpZ1x0Px1Q9+gSHbaeQ=";
+    hash = "sha256-Zf0g/CMI73O9Dkn9o7aIvwZ/8wh3lCmVY8nZaPwBp68=";
     stripRoot = false;
   };
 
@@ -64,6 +65,14 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "bin" "dev" "static" ];
 
+  passthru = {
+    updateScript = gitUpdater {
+      url = "https://aomedia.googlesource.com/aom";
+      rev-prefix = "v";
+      ignoredVersions = "(alpha|beta|rc).*";
+    };
+  };
+
   meta = with lib; {
     description = "Alliance for Open Media AV1 codec library";
     longDescription = ''
diff --git a/pkgs/development/libraries/libdovi/default.nix b/pkgs/development/libraries/libdovi/default.nix
index cf1a9a561f3..c70a217f6fc 100644
--- a/pkgs/development/libraries/libdovi/default.nix
+++ b/pkgs/development/libraries/libdovi/default.nix
@@ -5,9 +5,7 @@
 , rust
 , stdenv
 }:
-let
-  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
-in
+
 rustPlatform.buildRustPackage rec {
   pname = "libdovi";
   version = "3.1.2";
@@ -28,19 +26,19 @@ rustPlatform.buildRustPackage rec {
 
   buildPhase = ''
     runHook preBuild
-    ${rust.envVars.setEnv} cargo cbuild -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cbuild -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${stdenv.hostPlatform.rust.rustcTarget}
     runHook postBuild
   '';
 
   installPhase = ''
     runHook preInstall
-    ${rust.envVars.setEnv} cargo cinstall -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cinstall -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${stdenv.hostPlatform.rust.rustcTarget}
     runHook postInstall
   '';
 
   checkPhase = ''
     runHook preCheck
-    ${rust.envVars.setEnv} cargo ctest -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo ctest -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${stdenv.hostPlatform.rust.rustcTarget}
     runHook postCheck
   '';
 
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index 0ac6e89e23e..f60a1c7cab7 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -1,8 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, rust, rustPlatform, cargo-c, python3 }:
 
-let
-  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
-in
 rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
   version = "4.2.2";
@@ -26,13 +23,13 @@ rustPlatform.buildRustPackage rec {
 
   postBuild = ''
     pushd imagequant-sys
-    ${rust.envVars.setEnv} cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${stdenv.hostPlatform.rust.rustcTarget}
     popd
   '';
 
   postInstall = ''
     pushd imagequant-sys
-    ${rust.envVars.setEnv} cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${stdenv.hostPlatform.rust.rustcTarget}
     popd
   '';
 
diff --git a/pkgs/development/libraries/libnsl/default.nix b/pkgs/development/libraries/libnsl/default.nix
index 4f9d7d09caa..59e16071ce7 100644
--- a/pkgs/development/libraries/libnsl/default.nix
+++ b/pkgs/development/libraries/libnsl/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnsl";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "thkukuk";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-f9kNzzR8baf5mLgrh+bKO/rBRZA5ZYc1tJdyLE7Bi1w=";
+    sha256 = "sha256-bCToqXVE4RZcoZ2eTNZcVHyzKlWyIpSAssQCOZcfmEA=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 8618986195e..0598fd6451e 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -1,16 +1,30 @@
-{ lib, stdenv, fetchurl
+{ lib
+, stdenv
+, fetchurl
 , enableShared ? !stdenv.hostPlatform.isStatic
+, windows
 }:
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "4.13.0";
   pname = "libpfm";
 
   src = fetchurl {
-    url = "mirror://sourceforge/perfmon2/libpfm4/${pname}-${version}.tar.gz";
+    url = "mirror://sourceforge/perfmon2/libpfm4/libpfm-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
   };
 
+  # Don't install libpfm.so on windows as it doesn't exist
+  # This target is created only if `ifeq ($(SYS),Linux)` passes
+  patches = [ ./fix-windows.patch ];
+
+  # Upstream uses "WINDOWS" instead of "Windows" which is incorrect
+  # See: https://github.com/NixOS/nixpkgs/pull/252982#discussion_r1314346216
+  postPatch = ''
+    substituteInPlace config.mk examples/Makefile \
+      --replace '($(SYS),WINDOWS)' '($(SYS),Windows)'
+  '';
+
   makeFlags = [
     "PREFIX=${placeholder "out"}"
     "LDCONFIG=true"
@@ -19,6 +33,9 @@ stdenv.mkDerivation (rec {
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n";
+
+  buildInputs = lib.optional stdenv.hostPlatform.isWindows windows.libgnurx;
 
   meta = with lib; {
     description = "Helper library to program the performance monitoring events";
@@ -29,11 +46,7 @@ stdenv.mkDerivation (rec {
       (PMU) of modern processors.
     '';
     license = licenses.gpl2;
-    maintainers = [ maintainers.pierron ];
-    platforms = platforms.linux;
+    maintainers = with maintainers; [ pierron t4ccer ];
+    platforms = platforms.linux ++ platforms.windows;
   };
-} // lib.optionalAttrs ( ! enableShared )
-{
-  CONFIG_PFMLIB_SHARED = "n";
-}
-)
+})
diff --git a/pkgs/development/libraries/libpfm/fix-windows.patch b/pkgs/development/libraries/libpfm/fix-windows.patch
new file mode 100644
index 00000000000..584b9ba6eb8
--- /dev/null
+++ b/pkgs/development/libraries/libpfm/fix-windows.patch
@@ -0,0 +1,18 @@
+diff --git a/lib/Makefile b/lib/Makefile
+index 5ca71e3..cd0717f 100644
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -428,11 +428,13 @@ install:
+ 	-mkdir -p $(DESTDIR)$(LIBDIR)
+ 	$(INSTALL) -m 644 $(ALIBPFM) $(DESTDIR)$(LIBDIR)
+ ifeq ($(CONFIG_PFMLIB_SHARED),y)
++ifeq ($(SYS),Linux)
+ 	$(INSTALL) $(SLIBPFM) $(DESTDIR)$(LIBDIR)
+ 	cd $(DESTDIR)$(LIBDIR); $(LN) $(SLIBPFM) $(VLIBPFM)
+ 	cd $(DESTDIR)$(LIBDIR); $(LN) $(SLIBPFM) libpfm.$(SOLIBEXT)
+ 	-$(LDCONFIG)
+ endif
++endif
+ 
+ tags:
+ 	$(CTAGS) -o $(TOPDIR)/tags --tag-relative=yes $(SRCS) $(INCDEP)
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index a0843d4b2ef..7ba6f1963e7 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -15,7 +15,6 @@
 , libobjc
 , rustPlatform
 , rustc
-, rust
 , cargo-auditable-cargo-wrapper
 , gi-docgen
 , python3Packages
@@ -106,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     "--enable-always-build-tests"
   ] ++ lib.optional stdenv.isDarwin "--disable-Bsymbolic"
-    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "RUST_TARGET=${rust.toRustTarget stdenv.hostPlatform}";
+    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "RUST_TARGET=${stdenv.hostPlatform.rust.rustcTarget}";
 
   doCheck = false; # all tests fail on libtool-generated rsvg-convert not being able to find coreutils
 
diff --git a/pkgs/development/libraries/liburing/default.nix b/pkgs/development/libraries/liburing/default.nix
index 5779389dda1..a42aab3d59e 100644
--- a/pkgs/development/libraries/liburing/default.nix
+++ b/pkgs/development/libraries/liburing/default.nix
@@ -1,25 +1,15 @@
-{ lib, stdenv, fetchgit, fetchpatch }:
+{ lib, stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
   pname = "liburing";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchgit {
     url    = "http://git.kernel.dk/${pname}";
     rev    = "liburing-${version}";
-    sha256 = "sha256-vbe9uh9AqXyPkzwD6zHoHH3JMeAJEl2FSGzny1T7diM=";
+    sha256 = "sha256-hPyEZ0P1rfos53OCNd2OYFiqmv6TgpWaj5/xPLccCvM=";
   };
 
-  patches = [
-    # Pull upstream fix for parallel build failures:
-    #   https://github.com/axboe/liburing/pull/891
-    (fetchpatch {
-      name = "parallel.patch";
-      url = "https://github.com/axboe/liburing/commit/c34dca74854cb6e7f2b09affa2a4ab0145e62371.patch";
-      hash = "sha256-RZSgHdQy5d7mXtMvkMyr+/kMhp1w+S5v9cqk5NSii5o=";
-    })
-  ];
-
   separateDebugInfo = true;
   enableParallelBuilding = true;
   # Upstream's configure script is not autoconf generated, but a hand written one.
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 3f5b4c779a9..173cc2016e5 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch
+{ stdenv, lib, fetchurl, fetchpatch, buildPackages
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
@@ -66,7 +66,6 @@
 , enablePatentEncumberedCodecs ? true
 , jdupes
 , rustc
-, rust-bindgen
 , spirv-llvm-translator
 , zstd
 , directx-headers
@@ -98,9 +97,9 @@ let
   # Align all the Mesa versions used. Required to prevent explosions when
   # two different LLVMs are loaded in the same process.
   # FIXME: these should really go into some sort of versioned LLVM package set
-  rust-bindgen' = rust-bindgen.override {
-    rust-bindgen-unwrapped = rust-bindgen.unwrapped.override {
-      clang = llvmPackages.clang;
+  rust-bindgen' = buildPackages.rust-bindgen.override {
+    rust-bindgen-unwrapped = buildPackages.rust-bindgen.unwrapped.override {
+      clang = buildPackages.llvmPackages_15.clang;
     };
   };
   spirv-llvm-translator' = spirv-llvm-translator.override {
@@ -201,7 +200,8 @@ self = stdenv.mkDerivation {
     "-Dglvnd=true"
 
     # Enable RT for Intel hardware
-    "-Dintel-clc=enabled"
+    # https://gitlab.freedesktop.org/mesa/mesa/-/issues/9080
+    (lib.mesonEnable "intel-clc" (stdenv.buildPlatform == stdenv.hostPlatform))
   ] ++ lib.optionals enableOpenCL [
     # Clover, old OpenCL frontend
     "-Dgallium-opencl=icd"
@@ -217,7 +217,7 @@ self = stdenv.mkDerivation {
   ++ lib.optional (vulkanLayers != []) "-D vulkan-layers=${builtins.concatStringsSep "," vulkanLayers}";
 
   buildInputs = with xorg; [
-    expat llvmPackages.libllvm libglvnd xorgproto
+    expat glslang llvmPackages.libllvm libglvnd xorgproto
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
     libffi libvdpau libelf libXvMC
     libpthreadstubs openssl /*or another sha1 provider*/
@@ -225,19 +225,21 @@ self = stdenv.mkDerivation {
     python3Packages.python # for shebang
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
-    ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator' ]
+    ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator' ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader
     ++ lib.optional haveDozen directx-headers;
 
-  depsBuildBuild = [ pkg-config ];
+  depsBuildBuild = [ pkg-config ]
+    ++ lib.optional enableOpenCL buildPackages.stdenv.cc;
 
   nativeBuildInputs = [
     meson pkg-config ninja
     intltool bison flex file
     python3Packages.python python3Packages.mako python3Packages.ply
     jdupes glslang
-  ] ++ lib.optional haveWayland wayland-scanner;
+  ] ++ lib.optionals enableOpenCL [ rust-bindgen' rustc ]
+    ++ lib.optional haveWayland wayland-scanner;
 
   propagatedBuildInputs = with xorg; [
     libXdamage libXxf86vm
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index cb8333704ff..9c1c8b422a9 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , buildPackages
+, ncurses
 , pkg-config
 , abiVersion ? "6"
 , enableStatic ? stdenv.hostPlatform.isStatic
@@ -48,20 +49,20 @@ stdenv.mkDerivation (finalAttrs: {
         "/usr/share/terminfo" # upstream default, probably all FHS-based distros
         "/run/current-system/sw/share/terminfo" # NixOS
       ]}"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "--with-build-cc=${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc"
   ];
 
   # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
   CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
 
   strictDeps = true;
-  depsBuildBuild = [
-    buildPackages.stdenv.cc
-  ];
 
   nativeBuildInputs = [
     pkg-config
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    buildPackages.ncurses
+   # for `tic`, build already depends on for build `cc` so it's weird the build doesn't just build `tic`.
+    ncurses
   ];
 
   buildInputs = lib.optional (mouseSupport && stdenv.isLinux) gpm;
diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index 3062c3cb4e1..a1a9dc87573 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "oniguruma";
-  version = "6.9.8";
+  version = "6.9.9";
 
   # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
   src = fetchurl {
     url = "https://github.com/kkos/oniguruma/releases/download/v${version}/onig-${version}.tar.gz";
-    sha256 = "sha256-KM1iwUZGI8eRBWX7HMqqAQSy/osSvNZG6B9ztHU1IT4=";
+    sha256 = "sha256-YBYr07n8b0iG1MegeSX/03QWdzL1Xc6MSRv9nNgYps8=";
   };
 
   outputs = [ "dev" "lib" "out" ];
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 05741652f46..3876a5c892a 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -81,7 +81,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.83";
+    version = "0.3.84";
 
     outputs = [
       "out"
@@ -97,7 +97,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-12g8/zLTCQkBtgwE6zt3yEDwcHCr2LQXJCjB1nqbmB0=";
+      sha256 = "sha256-9W9y+wtS/CYUaPRrCRmRDeyvuS1XllMBNQLy6GAMqBM=";
     };
 
     patches = [
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index c5f74854f77..a1a22fb38e4 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re2";
-  version = "2023-09-01";
+  version = "2023-11-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = version;
-    hash = "sha256-dCEkwjIs8ITVUZ4N0+qeGoShGNqKkdvJ88teyGKN6pg=";
+    hash = "sha256-cKXe8r5MUag/z+seem4Zg/gmqIQjaCY7DBxiKlrnXPs=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/relibc/default.nix b/pkgs/development/libraries/relibc/default.nix
index 28ed971a25e..3bc476ccc0f 100644
--- a/pkgs/development/libraries/relibc/default.nix
+++ b/pkgs/development/libraries/relibc/default.nix
@@ -64,7 +64,7 @@ redoxRustPlatform.buildRustPackage rec {
   '';
 
   # TODO: should be hostPlatform
-  TARGET = buildPackages.rust.toRustTargetSpec stdenvNoCC.targetPlatform;
+  TARGET = stdenvNoCC.targetPlatform.rust.rustcTargetSpec;
 
   cargoLock = {
     lockFile = ./Cargo.lock;
diff --git a/pkgs/development/libraries/rustc-demangle/default.nix b/pkgs/development/libraries/rustc-demangle/default.nix
index 6dd6d46e30b..4e142c58452 100644
--- a/pkgs/development/libraries/rustc-demangle/default.nix
+++ b/pkgs/development/libraries/rustc-demangle/default.nix
@@ -1,4 +1,4 @@
-{ rustPlatform, fetchFromGitHub, rust, lib, stdenv }:
+{ rustPlatform, fetchFromGitHub, lib, stdenv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rustc-demangle";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     mkdir -p $out/lib
-    cp target/${rust.toRustTargetSpec stdenv.hostPlatform}/release/librustc_demangle.so $out/lib
+    cp target/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc_demangle.so $out/lib
     cp -R crates/capi/include $out
   '';
 
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index 9c826aa4dde..73092a803d6 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.55";
+  version = "1.3.56";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-d/h6vBqef4pE/6cb1bQboIXAAMRxdAALKHUVW07jOlE=";
+    hash = "sha256-VS/85qu0Dc3HSeD0DYm2f4ur+ZRPhb1Srf7BeK7Pdfk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/deal/default.nix b/pkgs/development/python-modules/deal/default.nix
index 0333bb37ce3..13704b20939 100644
--- a/pkgs/development/python-modules/deal/default.nix
+++ b/pkgs/development/python-modules/deal/default.nix
@@ -77,13 +77,17 @@ buildPythonPackage rec {
     "test_scheme_contract_is_satisfied_when_setting_arg"
     "test_scheme_contract_is_satisfied_within_chain"
     "test_scheme_errors_rewrite_message"
-    # broken since pytest > 7.1.3
-    "test_exception_hook"
+    # assert errors
+    "test_doctest"
+    "test_no_violations"
   ];
 
   disabledTestPaths = [
     # needs internet access
     "tests/test_runtime/test_offline.py"
+    # depends on typeguard <4.0.0 for tests, but >=4.0.0 seems fine for runtime
+    # https://github.com/life4/deal/blob/9be70fa1c5a0635880619b2cea83a9f6631eb236/pyproject.toml#L40
+    "tests/test_testing.py"
   ];
 
   pythonImportsCheck = [ "deal" ];
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index ce1a78f02cf..4c028e4ec71 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.58.0";
+  version = "1.59.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B9WGI/J77PGGyGLLrn39elS9Y/SzdZTHfIuPyTPxHC8=";
+    hash = "sha256-4CIcpupsITlhQXmAi4+LMjA30LG977D8TN2agUmZVx4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index c03c1faa9d4..e7d6fd55095 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.58.0";
+  version = "1.59.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-C0LnDAQFpmqC2emGf6JV/lnmGJZKYJmyBWjDHdkJl2Y=";
+    hash = "sha256-+TucM+CiYWLvhDG/z/zD4fshfM2Ne1swYbbp+BPmmLU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 904c0b24a0a..bb3024d4407 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.58.0";
+  version = "1.59.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ABZMp+VTsyf2HE50cnHf9wdCOeGlAqpbuMWlbsWE/qY=";
+    hash = "sha256-YiqbhlOsyoAT/uYNPbLQK5c2T8cYGEDXVkAPIzCaOQ4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 285f3477dea..cd0b0abcb12 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.58.0";
+  version = "1.59.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b02AzrWR4xyk3O7HR9vlYTLhOSoKm7HI/gAdG1ysiYo=";
+    hash = "sha256-qkAY8thmKsTZgwRF09JToRs+CW6K/iCGVUcTeqEWDpM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/icontract/default.nix b/pkgs/development/python-modules/icontract/default.nix
index 77565311efb..76e1814dddd 100644
--- a/pkgs/development/python-modules/icontract/default.nix
+++ b/pkgs/development/python-modules/icontract/default.nix
@@ -50,6 +50,13 @@ buildPythonPackage rec {
     # mypy decorator checks don't pass. For some reason mypy
     # doesn't check the python file provided in the test.
     "tests/test_mypy_decorators.py"
+    # those tests seems to simply re-run some typeguard tests
+    "tests/test_typeguard.py"
+  ];
+
+  pytestFlagsArray = [
+    # RuntimeWarning: coroutine '*' was never awaited
+    "-W" "ignore::RuntimeWarning"
   ];
 
   pythonImportsCheck = [ "icontract" ];
diff --git a/pkgs/development/python-modules/mocket/default.nix b/pkgs/development/python-modules/mocket/default.nix
index 49125a286e9..41789a796dd 100644
--- a/pkgs/development/python-modules/mocket/default.nix
+++ b/pkgs/development/python-modules/mocket/default.nix
@@ -1,37 +1,51 @@
 { lib
-, aiohttp
-, asgiref
 , buildPythonPackage
+, fetchPypi
+, pythonOlder
+, stdenv
+
+# build-system
+, hatchling
+
+# dependencies
 , decorator
+, httptools
+, python-magic
+, urllib3
+
+# optional-dependencies
+, xxhash
+, pook
+
+# tests
+, aiohttp
+, asgiref
 , fastapi
-, fetchPypi
 , gevent
-, httptools
 , httpx
-, isPy3k
-, pook
-, pytest-mock
+, pytest-asyncio
 , pytestCheckHook
-, python-magic
-, pythonOlder
 , redis
+, redis-server
 , requests
 , sure
-, urllib3
+
 }:
 
 buildPythonPackage rec {
   pname = "mocket";
-  version = "3.11.1";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  version = "3.12.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sEPLUN9nod4AKYcoCNQZ4FBblUCLCPV1dFOrNC6xDWo=";
+    hash = "sha256-brvBWwTWT2F/usVBRr7wz9L0kct4X1Fddl4mu5LUENA=";
   };
 
+  nativeBuildInputs = [
+    hatchling
+  ];
+
   propagatedBuildInputs = [
     decorator
     httptools
@@ -43,52 +57,58 @@ buildPythonPackage rec {
     pook = [
       pook
     ];
+    speedups = [
+      xxhash
+    ];
   };
 
   nativeCheckInputs = [
-    aiohttp
     asgiref
     fastapi
     gevent
     httpx
-    pytest-mock
+    pytest-asyncio
     pytestCheckHook
     redis
     requests
     sure
-  ] ++ passthru.optional-dependencies.pook;
+  ] ++ lib.optionals (pythonOlder "3.12") [
+    aiohttp
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  # Skip http tests
-  SKIP_TRUE_HTTP = true;
+  preCheck = lib.optionalString stdenv.isLinux ''
+    ${redis-server}/bin/redis-server &
+    REDIS_PID=$!
+  '';
 
-  disabledTestPaths = [
-    # Requires a live Redis instance
-    "tests/main/test_redis.py"
-  ];
+  postCheck = lib.optionalString stdenv.isLinux ''
+    kill $REDIS_PID
+  '';
+
+  # Skip http tests, they require network access
+  env.SKIP_TRUE_HTTP = true;
+
+  _darwinAllowLocalNetworking = true;
 
   disabledTests = [
     # tests that require network access (like DNS lookups)
-    "test_truesendall"
-    "test_truesendall_with_chunk_recording"
-    "test_truesendall_with_gzip_recording"
-    "test_truesendall_with_recording"
-    "test_wrongpath_truesendall"
     "test_truesendall_with_dump_from_recording"
-    "test_truesendall_with_recording_https"
-    "test_truesendall_after_mocket_session"
-    "test_real_request_session"
     "test_asyncio_record_replay"
     "test_gethostbyname"
   ];
 
+  disabledTestPaths = lib.optionals stdenv.isDarwin [
+    "tests/main/test_redis.py"
+  ];
+
   pythonImportsCheck = [
     "mocket"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/mindflayer/python-mocket/releases/tag/${version}";
     description = "A socket mock framework for all kinds of sockets including web-clients";
     homepage = "https://github.com/mindflayer/python-mocket";
-    changelog = "https://github.com/mindflayer/python-mocket/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ hexa ];
   };
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 5297cb920d3..fb81938bc09 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.9.7";
+  version = "3.9.10";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,13 +25,13 @@ buildPythonPackage rec {
     owner = "ijl";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-VkCwvksUtgvFLSMy2fHLxrpZjcWYhincSM4fX/Gwl0I=";
+    hash = "sha256-MkcuayNDt7/GcswXoFTvzuaZzhQEQV+V7OfKqgJwVIQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-IwWbd7LE/t1UEo/bdC0bXl2K8hYyvDPbyHLBIurfb/8=";
+    hash = "sha256-2eRV+oZQvsWWJ4AUTeuE0CHtTHC6jNZiX/y5uXuwvns=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-datadir/default.nix b/pkgs/development/python-modules/pytest-datadir/default.nix
index bca05a0010a..90b7e6f55e2 100644
--- a/pkgs/development/python-modules/pytest-datadir/default.nix
+++ b/pkgs/development/python-modules/pytest-datadir/default.nix
@@ -1,30 +1,41 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , fetchFromGitHub
+, setuptools
 , setuptools-scm
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pytest-datadir";
-  version = "1.4.1";
+  version = "1.5.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "gabrielcnr";
     repo = "pytest-datadir";
-    rev = "refs/tags/${version}";
-    hash = "sha256-HyJ0rU1nHqRv8SHFS8m3GZ5409+JZIkoDgIVjy4ol54=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-sRLqL+8Jf5Kz+qscuG3hClUuPA+33PQa+ob1ht/7CJE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
-  nativeBuildInputs = [ setuptools-scm ];
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "pytest_datadir" ];
 
   meta = with lib; {
     description = "Pytest plugin for manipulating test data directories and files";
     homepage = "https://github.com/gabrielcnr/pytest-datadir";
+    changelog = "https://github.com/gabrielcnr/pytest-datadir/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ kira-bruneau ];
   };
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index d557bcf15e9..a00b59c425b 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -3,10 +3,10 @@
 , callPackage
 , pythonOlder
 , fetchPypi
-, isPyPy
 , writeText
 
 # build
+, setuptools
 , setuptools-scm
 
 # propagates
@@ -21,12 +21,12 @@
 
 buildPythonPackage rec {
   pname = "pytest";
-  version = "7.4.2";
-  format = "pyproject";
+  version = "7.4.3";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-p2YlnPq1ZKKtUssarhuIGnXD6340yjd5aXwj7UfEcGk=";
+    hash = "sha256-2YnRNpgt5OOynavMg4rVgcZOjtUsEfvobd69naCBjNU=";
   };
 
   outputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index 7fd258e9123..23e3bdc5b54 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -54,8 +54,12 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # not compatible with python3.10
-    "test_typed_dict"
+    # AssertionError: 'type of argument "x" must be ' != 'None'
+    "TestPrecondition::test_precondition_ok_and_typeguard_fails"
+    # AttributeError: 'C' object has no attribute 'x'
+    "TestInvariant::test_invariant_ok_and_typeguard_fails"
+    # AttributeError: 'D' object has no attribute 'x'
+    "TestInheritance::test_invariant_ok_and_typeguard_fails"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 632aa101b31..c4c3cd8b8d2 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.21";
-  source.sha256 = "sha256-AXrnGnsKMCTGFONEzQzFahbLNK/FOtoYmfs3nSZiTJE=";
+  version = "2.4.22";
+  source.sha256 = "sha256-dHulCw5n3yXL07SPlYMad6TVOlgdVfBjly/LFG0ULF8=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index a43520ecb4b..c8046b68cd9 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.21.0";
+  version = "3.22.0";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-EM4WGLs+M/rRbreVUrCj4SEXYkSKDX/OEcimJDuayXE=";
+    hash = "sha256-yBHbWt0sX3KZRMr0fE56Zdyqu5Rh5HK1eHZd179tLUw=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
deleted file mode 100644
index dc7780b2fd3..00000000000
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ /dev/null
@@ -1,71 +0,0 @@
-mesonConfigurePhase() {
-    runHook preConfigure
-
-    if [ -z "${dontAddPrefix-}" ]; then
-        mesonFlags="--prefix=$prefix $mesonFlags"
-    fi
-
-    # See multiple-outputs.sh and meson’s coredata.py
-    mesonFlags="\
-        --libdir=${!outputLib}/lib --libexecdir=${!outputLib}/libexec \
-        --bindir=${!outputBin}/bin --sbindir=${!outputBin}/sbin \
-        --includedir=${!outputInclude}/include \
-        --mandir=${!outputMan}/share/man --infodir=${!outputInfo}/share/info \
-        --localedir=${!outputLib}/share/locale \
-        -Dauto_features=${mesonAutoFeatures:-enabled} \
-        -Dwrap_mode=${mesonWrapMode:-nodownload} \
-        $mesonFlags"
-
-    mesonFlags="${crossMesonFlags+$crossMesonFlags }--buildtype=${mesonBuildType:-plain} $mesonFlags"
-
-    echo "meson flags: $mesonFlags ${mesonFlagsArray[@]}"
-
-    meson setup build $mesonFlags "${mesonFlagsArray[@]}"
-    cd build
-
-    if ! [[ -v enableParallelBuilding ]]; then
-        enableParallelBuilding=1
-        echo "meson: enabled parallel building"
-    fi
-
-    if [[ ${checkPhase-ninjaCheckPhase} = ninjaCheckPhase && -z $dontUseMesonCheck ]]; then
-        checkPhase=mesonCheckPhase
-    fi
-    if [[ ${installPhase-ninjaInstallPhase} = ninjaInstallPhase && -z $dontUseMesonInstall ]]; then
-        installPhase=mesonInstallPhase
-    fi
-
-    runHook postConfigure
-}
-
-mesonCheckPhase() {
-    runHook preCheck
-
-    local flagsArray=($mesonCheckFlags "${mesonCheckFlagsArray[@]}")
-
-    echoCmd 'check flags' "${flagsArray[@]}"
-    meson test --no-rebuild "${flagsArray[@]}"
-
-    runHook postCheck
-}
-
-mesonInstallPhase() {
-    runHook preInstall
-
-    # shellcheck disable=SC2086
-    local flagsArray=($mesonInstallFlags "${mesonInstallFlagsArray[@]}")
-
-    if [[ -n "$mesonInstallTags" ]]; then
-        flagsArray+=("--tags" "${mesonInstallTags// /,}")
-    fi
-
-    echoCmd 'install flags' "${flagsArray[@]}"
-    meson install --no-rebuild "${flagsArray[@]}"
-
-    runHook postInstall
-}
-
-if [ -z "${dontUseMesonConfigure-}" -a -z "${configurePhase-}" ]; then
-    setOutputFlags=
-    configurePhase=mesonConfigurePhase
-fi
diff --git a/pkgs/development/tools/build-managers/scons/3.1.2.nix b/pkgs/development/tools/build-managers/scons/3.1.2.nix
new file mode 100644
index 00000000000..097a8ffd519
--- /dev/null
+++ b/pkgs/development/tools/build-managers/scons/3.1.2.nix
@@ -0,0 +1,38 @@
+{ lib, fetchurl, python3 }:
+
+let
+  pname = "scons";
+  version = "3.1.2";
+  src = fetchurl {
+    url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
+    hash = "sha256-eAHz9i9lRSjict94C+EMDpM36JdlC2Ldzunzn94T+Ps=";
+  };
+in
+python3.pkgs.buildPythonApplication {
+  inherit pname version src;
+
+  setupHook = ./setup-hook.sh;
+
+  doCheck = true;
+
+  passthru = {
+    # expose the used python version so tools using this (and extensing scos
+    # with other python modules) can use the exact same python version.
+    inherit python3;
+    python = python3;
+  };
+
+  meta = {
+    description = "An improved, cross-platform substitute for Make";
+    longDescription = ''
+      SCons is an Open Source software construction tool. Think of SCons as an
+      improved, cross-platform substitute for the classic Make utility with
+      integrated functionality similar to autoconf/automake and compiler caches
+      such as ccache. In short, SCons is an easier, more reliable and faster way
+      to build software.
+    '';
+    homepage = "https://scons.org/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/scons/4.1.0.nix b/pkgs/development/tools/build-managers/scons/4.1.0.nix
new file mode 100644
index 00000000000..65499280c2c
--- /dev/null
+++ b/pkgs/development/tools/build-managers/scons/4.1.0.nix
@@ -0,0 +1,50 @@
+{ lib, fetchurl, python3 }:
+
+let
+  pname = "scons";
+  version = "4.1.0";
+  src = fetchurl {
+    url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
+    hash = "sha256-ctKNdi4hJnh/Fz49WeCJI5+LL06e8xFNV/ELEgaYXYU=";
+  };
+in
+python3.pkgs.buildPythonApplication {
+  inherit pname version src;
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "build/dist" "dist" \
+      --replace "build/doc/man/" ""
+  '';
+
+  postInstall = ''
+    mkdir -p "$out/share/man/man1"
+    mv "$out/"*.1 "$out/share/man/man1/"
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  # The release tarballs don't contain any tests (runtest.py and test/*):
+  doCheck = false;
+
+  passthru = {
+    # expose the used python version so tools using this (and extensing scos
+    # with other python modules) can use the exact same python version.
+    inherit python3;
+    python = python3;
+  };
+
+  meta = {
+    description = "An improved, cross-platform substitute for Make";
+    longDescription = ''
+      SCons is an Open Source software construction tool. Think of SCons as an
+      improved, cross-platform substitute for the classic Make utility with
+      integrated functionality similar to autoconf/automake and compiler caches
+      such as ccache. In short, SCons is an easier, more reliable and faster way
+      to build software.
+    '';
+    homepage = "https://scons.org/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/scons/4.5.2.nix b/pkgs/development/tools/build-managers/scons/4.5.2.nix
new file mode 100644
index 00000000000..61d1719642e
--- /dev/null
+++ b/pkgs/development/tools/build-managers/scons/4.5.2.nix
@@ -0,0 +1,54 @@
+{ lib, fetchurl, python3 }:
+
+let
+  pname = "scons";
+  version = "4.5.2";
+  src = fetchurl {
+    url = "mirror://sourceforge/project/scons/scons/${version}/SCons-${version}.tar.gz";
+    hash = "sha256-ziaqyV01CnmkGSGWsL6sPLJPTMq84BI+so0zcPV28HI=";
+  };
+in
+python3.pkgs.buildPythonApplication {
+  inherit pname version src;
+
+  patches = [
+    ./env.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "build/dist" "dist" \
+      --replace "build/doc/man/" ""
+  '';
+
+  postInstall = ''
+    mkdir -p "$out/share/man/man1"
+    mv "$out/"*.1 "$out/share/man/man1/"
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  # The release tarballs don't contain any tests (runtest.py and test/*):
+  doCheck = false;
+
+  passthru = {
+    # expose the used python version so tools using this (and extensing scos
+    # with other python modules) can use the exact same python version.
+    inherit python3;
+    python = python3;
+  };
+
+  meta = {
+    description = "An improved, cross-platform substitute for Make";
+    longDescription = ''
+      SCons is an Open Source software construction tool. Think of SCons as an
+      improved, cross-platform substitute for the classic Make utility with
+      integrated functionality similar to autoconf/automake and compiler caches
+      such as ccache. In short, SCons is an easier, more reliable and faster way
+      to build software.
+    '';
+    homepage = "https://scons.org/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/scons/common.nix b/pkgs/development/tools/build-managers/scons/common.nix
deleted file mode 100644
index 64890d12cea..00000000000
--- a/pkgs/development/tools/build-managers/scons/common.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ version, sha256 }:
-
-{ fetchurl, python, lib }:
-
-python.pkgs.buildPythonApplication rec {
-  pname = "scons";
-  inherit version;
-
-  src = fetchurl {
-    url =
-      if lib.versionAtLeast version "4.3.0" then
-        "mirror://sourceforge/project/scons/scons/${version}/SCons-${version}.tar.gz"
-      else
-        "mirror://sourceforge/scons/scons-${version}.tar.gz";
-    inherit sha256;
-  };
-
-  setupHook = ./setup-hook.sh;
-
-  patches = lib.optionals (lib.versionAtLeast version "4.3.0") [
-    ./env.patch
-  ];
-
-  postPatch = lib.optionalString (lib.versionAtLeast version "4.0.0") ''
-    substituteInPlace setup.cfg \
-      --replace "build/dist" "dist"
-  '' + lib.optionalString (lib.versionAtLeast version "4.1.0") ''
-    substituteInPlace setup.cfg \
-      --replace "build/doc/man/" ""
-  '';
-
-  # The release tarballs don't contain any tests (runtest.py and test/*):
-  doCheck = lib.versionOlder version "4.0.0";
-
-  postInstall = lib.optionalString (lib.versionAtLeast version "4.1.0") ''
-    mkdir -p "$out/share/man/man1"
-    mv "$out/"*.1 "$out/share/man/man1/"
-  '';
-
-  passthru = {
-    # expose the used python version so tools using this (and extensing scos with other python modules)
-    # can use the exact same python version.
-    inherit python;
-  };
-
-  meta = with lib; {
-    description = "An improved, cross-platform substitute for Make";
-    longDescription = ''
-      SCons is an Open Source software construction tool. Think of
-      SCons as an improved, cross-platform substitute for the classic
-      Make utility with integrated functionality similar to
-      autoconf/automake and compiler caches such as ccache. In short,
-      SCons is an easier, more reliable and faster way to build
-      software.
-    '';
-    homepage = "https://scons.org/";
-    changelog = "https://raw.githubusercontent.com/SConsProject/scons/rel_${version}/src/CHANGES.txt";
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with lib.maintainers; [ AndersonTorres ];
-  };
-}
diff --git a/pkgs/development/tools/build-managers/scons/default.nix b/pkgs/development/tools/build-managers/scons/default.nix
deleted file mode 100644
index f338d346a70..00000000000
--- a/pkgs/development/tools/build-managers/scons/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ callPackage, python2, python3 }:
-
-let
-  mkScons = args: callPackage (import ./common.nix args) {
-    python = python3;
-  };
-in {
-  scons_3_1_2 = (mkScons {
-    version = "3.1.2";
-    sha256 = "1yzq2gg9zwz9rvfn42v5jzl3g4qf1khhny6zfbi2hib55zvg60bq";
-  });
-  scons_4_1_0 = mkScons {
-    version = "4.1.0";
-    sha256 = "11axk03142ziax6i3wwy9qpqp7r3i7h5jg9y2xzph9i15rv8vlkj";
-  };
-  scons_latest = mkScons {
-    version = "4.5.2";
-    sha256 = "sha256-ziaqyV01CnmkGSGWsL6sPLJPTMq84BI+so0zcPV28HI=";
-  };
-}
diff --git a/pkgs/development/tools/lalrpop/default.nix b/pkgs/development/tools/lalrpop/default.nix
index 0bc8bddefbd..32e6ec7a35b 100644
--- a/pkgs/development/tools/lalrpop/default.nix
+++ b/pkgs/development/tools/lalrpop/default.nix
@@ -1,6 +1,5 @@
 { lib
 , rustPlatform
-, rust
 , fetchFromGitHub
 , substituteAll
 , stdenv
@@ -24,7 +23,7 @@ rustPlatform.buildRustPackage rec {
   patches = [
     (substituteAll {
       src = ./use-correct-binary-path-in-tests.patch;
-      target_triple = rust.toRustTarget stdenv.hostPlatform;
+      target_triple = stdenv.hostPlatform.rust.rustcTarget;
     })
   ];
 
diff --git a/pkgs/development/tools/rust/cargo-benchcmp/default.nix b/pkgs/development/tools/rust/cargo-benchcmp/default.nix
index 4aa3c411f12..d46a57355d7 100644
--- a/pkgs/development/tools/rust/cargo-benchcmp/default.nix
+++ b/pkgs/development/tools/rust/cargo-benchcmp/default.nix
@@ -2,7 +2,6 @@
 , rustPlatform
 , fetchFromGitHub
 , substituteAll
-, rust
 , stdenv
 }:
 
@@ -23,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     # patch the binary path so tests can find the binary when `--target` is present
     (substituteAll {
       src = ./fix-test-binary-path.patch;
-      shortTarget = rust.toRustTarget stdenv.hostPlatform;
+      shortTarget = stdenv.hostPlatform.rust.rustcTarget;
     })
   ];
 
diff --git a/pkgs/development/tools/rust/cargo-watch/default.nix b/pkgs/development/tools/rust/cargo-watch/default.nix
index fda47b5070a..63217b655ac 100644
--- a/pkgs/development/tools/rust/cargo-watch/default.nix
+++ b/pkgs/development/tools/rust/cargo-watch/default.nix
@@ -5,7 +5,6 @@
 , Cocoa
 , CoreServices
 , Foundation
-, rust
 , libiconv
 }:
 
@@ -27,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   # `test with_cargo` tries to call cargo-watch as a cargo subcommand
   # (calling cargo-watch with command `cargo watch`)
   preCheck = ''
-    export PATH="$(pwd)/target/${rust.toRustTarget stdenv.hostPlatform}/release:$PATH"
+    export PATH="$(pwd)/target/${stdenv.hostPlatform.rust.rustcTarget}/release:$PATH"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/web/deno/librusty_v8.nix b/pkgs/development/web/deno/librusty_v8.nix
index 20fd20a5b98..e4d2a2fec70 100644
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@@ -1,11 +1,10 @@
 # auto-generated file -- DO NOT EDIT!
-{ rust, stdenv, fetchurl }:
+{ stdenv, fetchurl }:
 
 let
-  arch = rust.toRustTarget stdenv.hostPlatform;
   fetch_librusty_v8 = args: fetchurl {
     name = "librusty_v8-${args.version}";
-    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${arch}.a";
+    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";
     sha256 = args.shas.${stdenv.hostPlatform.system};
     meta = { inherit (args) version; };
   };
diff --git a/pkgs/development/web/deno/update/librusty_v8.ts b/pkgs/development/web/deno/update/librusty_v8.ts
index b38e0a28f1a..39831f6ea27 100644
--- a/pkgs/development/web/deno/update/librusty_v8.ts
+++ b/pkgs/development/web/deno/update/librusty_v8.ts
@@ -40,13 +40,12 @@ fetchurl {
 
 const templateDeps = (version: string, deps: PrefetchResult[]) =>
   `# auto-generated file -- DO NOT EDIT!
-{ rust, stdenv, fetchurl }:
+{ stdenv, fetchurl }:
 
 let
-  arch = rust.toRustTarget stdenv.hostPlatform;
   fetch_librusty_v8 = args: fetchurl {
     name = "librusty_v8-\${args.version}";
-    url = "https://github.com/denoland/rusty_v8/releases/download/v\${args.version}/librusty_v8_release_\${arch}.a";
+    url = "https://github.com/denoland/rusty_v8/releases/download/v\${args.version}/librusty_v8_release_\${stdenv.hostPlatform.rust.rustcTarget}.a";
     sha256 = args.shas.\${stdenv.hostPlatform.system};
     meta = { inherit (args) version; };
   };
diff --git a/pkgs/development/web/edge-runtime/librusty_v8.nix b/pkgs/development/web/edge-runtime/librusty_v8.nix
index 6e9fc0a669f..1e0a306c13b 100644
--- a/pkgs/development/web/edge-runtime/librusty_v8.nix
+++ b/pkgs/development/web/edge-runtime/librusty_v8.nix
@@ -1,11 +1,10 @@
 # auto-generated file -- DO NOT EDIT!
-{ rust, stdenv, fetchurl }:
+{ stdenv, fetchurl }:
 
 let
-  arch = rust.toRustTarget stdenv.hostPlatform;
   fetch_librusty_v8 = args: fetchurl {
     name = "librusty_v8-${args.version}";
-    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${arch}.a";
+    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";
     sha256 = args.shas.${stdenv.hostPlatform.system};
     meta = { inherit (args) version; };
   };
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 67b839a1bd3..56a92ffa44e 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -27,7 +27,9 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-RRiz56r9NOwH0AY9JQ/UdJmbILIAIYw65W9dIRPxQbQ=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isMusl [
+  patches = [
+    ./v3-CVE-2023-4016.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     # NOTE: Starting from 4.x we will not need a patch anymore, but need to add
     # "--disable-w" to configureFlags instead to prevent the utmp errors
     (fetchpatch {
diff --git a/pkgs/os-specific/linux/procps-ng/v3-CVE-2023-4016.patch b/pkgs/os-specific/linux/procps-ng/v3-CVE-2023-4016.patch
new file mode 100644
index 00000000000..2e260eaf738
--- /dev/null
+++ b/pkgs/os-specific/linux/procps-ng/v3-CVE-2023-4016.patch
@@ -0,0 +1,63 @@
+This is https://gitlab.com/procps-ng/procps/-/commit/2c933ecba3bb1d3041a5a7a53a7b4078a6003413.diff
+back-ported to procps 3.3.17.  That commit changes xmalloc to xcalloc.  This patch differs in two ways:
+
+* We modify it to change malloc (no x-) to xcalloc instead
+* We pull in procps-4's definition of xcalloc
+
+Alternative considered: Also pull in commits that changed malloc to xmalloc and defined xcalloc.
+This alternative is rejected because those commits contain many other unrelated changes.
+
+diff --git a/ps/parser.c b/ps/parser.c
+index 4263a1fb..ee9a57d9 100644
+--- a/ps/parser.c
++++ b/ps/parser.c
+@@ -36,6 +36,14 @@
+ #include "common.h"
+ #include "c.h"
+ 
++static void *xxcalloc(const size_t nelems, const size_t size)
++{
++  void *ret = calloc(nelems, size);
++  if (!ret && size && nelems)
++    xerrx(EXIT_FAILURE, "cannot allocate %zu bytes", nelems*size);
++  return ret;
++}
++
+ #define ARG_GNU  0
+ #define ARG_END  1
+ #define ARG_PGRP 2
+@@ -184,7 +192,6 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s
+   const char *err;       /* error code that could or did happen */
+   /*** prepare to operate ***/
+   node = malloc(sizeof(selection_node));
+-  node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */
+   node->n = 0;
+   buf = strdup(arg);
+   /*** sanity check and count items ***/
+@@ -205,6 +212,7 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s
+   } while (*++walk);
+   if(need_item) goto parse_error;
+   node->n = items;
++  node->u = xxcalloc(items, sizeof(sel_union));
+   /*** actually parse the list ***/
+   walk = buf;
+   while(items--){
+@@ -1031,15 +1039,15 @@ static const char *parse_trailing_pids(void){
+   thisarg = ps_argc - 1;   /* we must be at the end now */
+ 
+   pidnode = malloc(sizeof(selection_node));
+-  pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
++  pidnode->u = xxcalloc(i, sizeof(sel_union)); /* waste is insignificant */
+   pidnode->n = 0;
+ 
+   grpnode = malloc(sizeof(selection_node));
+-  grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
++  grpnode->u = xxcalloc(i, sizeof(sel_union)); /* waste is insignificant */
+   grpnode->n = 0;
+ 
+   sidnode = malloc(sizeof(selection_node));
+-  sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
++  sidnode->u = xxcalloc(i, sizeof(sel_union)); /* waste is insignificant */
+   sidnode->n = 0;
+ 
+   while(i--){
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 44c595de0e4..0311d46d1fc 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -124,7 +124,7 @@
 , withRemote ? !stdenv.hostPlatform.isMusl
 , withResolved ? true
 , withShellCompletions ? true
-, withSysusers ? false # conflicts with the NixOS user management
+, withSysusers ? true
 , withSysupdate ? true
 , withTimedated ? true
 , withTimesyncd ? true
@@ -729,6 +729,8 @@ stdenv.mkDerivation (finalAttrs: {
     rm -rf $out/share/doc
   '' + lib.optionalString (withKmod && !buildLibsOnly) ''
     mv $out/lib/modules-load.d $out/example
+  '' + lib.optionalString withSysusers ''
+    mv $out/lib/sysusers.d $out/example
   '';
 
   # Avoid *.EFI binary stripping. At least on aarch64-linux strip
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index 20936fa7d49..cfd94bf33c4 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "usbutils";
-  version = "015";
+  version = "017";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/usb/usbutils/usbutils-${version}.tar.xz";
-    sha256 = "sha256-w7RRux9P+fY1bKxaaVaprI6F2BZRr1ainmiflPpv2m4=";
+    hash = "sha256-pqJf/c+RA+ONekRzKsoXBz9OYCuS5K5VYlIxqCcC4Fs=";
   };
 
   patches = [
diff --git a/pkgs/servers/http/router/librusty_v8.nix b/pkgs/servers/http/router/librusty_v8.nix
index 60c6b4caef8..3e3bf55c757 100644
--- a/pkgs/servers/http/router/librusty_v8.nix
+++ b/pkgs/servers/http/router/librusty_v8.nix
@@ -1,10 +1,9 @@
-{ rust, stdenv, fetchurl }:
+{ stdenv, fetchurl }:
 
 let
-  arch = rust.toRustTarget stdenv.hostPlatform;
   fetch_librusty_v8 = args: fetchurl {
     name = "librusty_v8-${args.version}";
-    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${arch}.a";
+    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";
     sha256 = args.shas.${stdenv.hostPlatform.system};
     meta = { inherit (args) version; };
   };
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/default.nix b/pkgs/servers/matrix-synapse/matrix-hookshot/default.nix
index 99b28a4defa..6113bd6ff41 100644
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/default.nix
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/default.nix
@@ -5,7 +5,6 @@
 , makeWrapper
 , matrix-sdk-crypto-nodejs
 , mkYarnPackage
-, rust
 , cargo
 , rustPlatform
 , rustc
@@ -60,7 +59,7 @@ mkYarnPackage rec {
   buildPhase = ''
     runHook preBuild
     cd deps/${pname}
-    napi build --target ${rust.toRustTargetSpec stdenv.targetPlatform} --dts ../src/libRs.d.ts --release ./lib
+    napi build --target ${stdenv.targetPlatform.rust.rustcTargetSpec} --dts ../src/libRs.d.ts --release ./lib
     yarn run build:app:fix-defs
     yarn run build:app
     yarn run build:web
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 5be49f18891..df7efb33b68 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, sconsPackages
+, scons_3_1_2
 , boost
 , gperftools
 , pcre-cpp
@@ -31,7 +31,8 @@ with lib;
 
 let
   variants =
-    if versionAtLeast version "6.0" then rec {
+    if versionAtLeast version "6.0"
+    then rec {
       python = scons.python.withPackages (ps: with ps; [
         pyyaml
         cheetah3
@@ -41,12 +42,13 @@ let
         pymongo
       ]);
 
-      scons = sconsPackages.scons_3_1_2;
+      scons = scons_3_1_2;
 
       mozjsVersion = "60";
       mozjsReplace = "defined(HAVE___SINCOS)";
 
-    } else rec {
+    }
+    else rec {
       python = scons.python.withPackages (ps: with ps; [
         pyyaml
         cheetah3
@@ -54,7 +56,7 @@ let
         setuptools
       ]);
 
-      scons = sconsPackages.scons_3_1_2;
+      scons = scons_3_1_2;
 
       mozjsVersion = "60";
       mozjsReplace = "defined(HAVE___SINCOS)";
@@ -84,7 +86,7 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ variants.scons ]
-    ++ lib.optionals (versionAtLeast version "4.4") [ xz ];
+                      ++ lib.optionals (versionAtLeast version "4.4") [ xz ];
 
   buildInputs = [
     boost
@@ -147,7 +149,7 @@ in stdenv.mkDerivation rec {
     "--disable-warnings-as-errors"
     "VARIANT_DIR=nixos" # Needed so we don't produce argument lists that are too long for gcc / ld
   ] ++ lib.optionals (versionAtLeast version "4.4") [ "--link-model=static" ]
-    ++ map (lib: "--use-system-${lib}") system-libraries;
+  ++ map (lib: "--use-system-${lib}") system-libraries;
 
   # This seems to fix mongodb not able to find OpenSSL's crypto.h during build
   hardeningDisable = [ "fortify3" ];
diff --git a/pkgs/servers/windmill/default.nix b/pkgs/servers/windmill/default.nix
index 6b822ade08b..a10610ea195 100644
--- a/pkgs/servers/windmill/default.nix
+++ b/pkgs/servers/windmill/default.nix
@@ -16,7 +16,6 @@
 , pixman
 , pkg-config
 , python3
-, rust
 , rustfmt
 , stdenv
 , swagger-cli
@@ -70,11 +69,10 @@ rustPlatform.buildRustPackage {
     SQLX_OFFLINE = "true";
     RUSTY_V8_ARCHIVE =
       let
-        arch = rust.toRustTarget stdenv.hostPlatform;
         fetch_librusty_v8 = args:
           fetchurl {
             name = "librusty_v8-${args.version}";
-            url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${arch}.a";
+            url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";
             sha256 = args.shas.${stdenv.hostPlatform.system} or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
             meta = { inherit (args) version; };
           };
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index 448d6ecd9f1..deda9b052e5 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -28,7 +28,7 @@ in rec {
   cctools_ = darwin.cctools;
 
   # Avoid debugging larger changes for now.
-  bzip2_ = bzip2.override (args: { linkStatic = true; });
+  bzip2_ = bzip2.override (args: { enableStatic = true; enableShared = false; });
 
   # Avoid messing with libkrb5 and libnghttp2.
   curl_ = curlMinimal.override (args: { gssSupport = false; http2Support = false; });
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index d235ffefaab..bd0d85fc676 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -402,6 +402,7 @@ else let
 
           crossFile = builtins.toFile "cross-file.conf" ''
             [properties]
+            bindgen_clang_arguments = ['-target', '${stdenv.targetPlatform.config}']
             needs_exe_wrapper = ${lib.boolToString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform)}
 
             [host_machine]
@@ -412,6 +413,7 @@ else let
 
             [binaries]
             llvm-config = 'llvm-config-native'
+            rust = ['rustc', '--target', '${stdenv.targetPlatform.rust.rustcTargetSpec}']
           '';
           crossFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
         in crossFlags ++ mesonFlags;
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 419a66261e6..37c10fb2957 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1526,6 +1526,44 @@ showPhaseFooter() {
 }
 
 
+runPhase() {
+    local curPhase="$*"
+    if [[ "$curPhase" = unpackPhase && -n "${dontUnpack:-}" ]]; then return; fi
+    if [[ "$curPhase" = patchPhase && -n "${dontPatch:-}" ]]; then return; fi
+    if [[ "$curPhase" = configurePhase && -n "${dontConfigure:-}" ]]; then return; fi
+    if [[ "$curPhase" = buildPhase && -n "${dontBuild:-}" ]]; then return; fi
+    if [[ "$curPhase" = checkPhase && -z "${doCheck:-}" ]]; then return; fi
+    if [[ "$curPhase" = installPhase && -n "${dontInstall:-}" ]]; then return; fi
+    if [[ "$curPhase" = fixupPhase && -n "${dontFixup:-}" ]]; then return; fi
+    if [[ "$curPhase" = installCheckPhase && -z "${doInstallCheck:-}" ]]; then return; fi
+    if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then return; fi
+
+    if [[ -n $NIX_LOG_FD ]]; then
+        echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&"$NIX_LOG_FD"
+    fi
+
+    showPhaseHeader "$curPhase"
+    dumpVars
+
+    local startTime=$(date +"%s")
+
+    # Evaluate the variable named $curPhase if it exists, otherwise the
+    # function named $curPhase.
+    eval "${!curPhase:-$curPhase}"
+
+    local endTime=$(date +"%s")
+
+    showPhaseFooter "$curPhase" "$startTime" "$endTime"
+
+    if [ "$curPhase" = unpackPhase ]; then
+        # make sure we can cd into the directory
+        [ -n "${sourceRoot:-}" ] && chmod +x "${sourceRoot}"
+
+        cd "${sourceRoot:-.}"
+    fi
+}
+
+
 genericBuild() {
     # variable used by our gzip wrapper to add -n.
     # gzip is in common-path.nix and is added to nix-shell but we only want to change its behaviour in nix builds. do not move to a setupHook in gzip.
@@ -1552,39 +1590,7 @@ genericBuild() {
     # phase name is space-free, which it must be because it's the name
     # of either a shell variable or a shell function.
     for curPhase in ${phases[*]}; do
-        if [[ "$curPhase" = unpackPhase && -n "${dontUnpack:-}" ]]; then continue; fi
-        if [[ "$curPhase" = patchPhase && -n "${dontPatch:-}" ]]; then continue; fi
-        if [[ "$curPhase" = configurePhase && -n "${dontConfigure:-}" ]]; then continue; fi
-        if [[ "$curPhase" = buildPhase && -n "${dontBuild:-}" ]]; then continue; fi
-        if [[ "$curPhase" = checkPhase && -z "${doCheck:-}" ]]; then continue; fi
-        if [[ "$curPhase" = installPhase && -n "${dontInstall:-}" ]]; then continue; fi
-        if [[ "$curPhase" = fixupPhase && -n "${dontFixup:-}" ]]; then continue; fi
-        if [[ "$curPhase" = installCheckPhase && -z "${doInstallCheck:-}" ]]; then continue; fi
-        if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then continue; fi
-
-        if [[ -n $NIX_LOG_FD ]]; then
-            echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&"$NIX_LOG_FD"
-        fi
-
-        showPhaseHeader "$curPhase"
-        dumpVars
-
-        local startTime=$(date +"%s")
-
-        # Evaluate the variable named $curPhase if it exists, otherwise the
-        # function named $curPhase.
-        eval "${!curPhase:-$curPhase}"
-
-        local endTime=$(date +"%s")
-
-        showPhaseFooter "$curPhase" "$startTime" "$endTime"
-
-        if [ "$curPhase" = unpackPhase ]; then
-            # make sure we can cd into the directory
-            [ -n "${sourceRoot:-}" ] && chmod +x "${sourceRoot}"
-
-            cd "${sourceRoot:-.}"
-        fi
+        runPhase "$curPhase"
     done
 }
 
diff --git a/pkgs/tools/compression/bzip2/default.nix b/pkgs/tools/compression/bzip2/default.nix
index be456cf5944..bfab2dbb946 100644
--- a/pkgs/tools/compression/bzip2/default.nix
+++ b/pkgs/tools/compression/bzip2/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl
-, linkStatic ? with stdenv.hostPlatform; isStatic || isCygwin
+, enableStatic ? with stdenv.hostPlatform; isStatic || isCygwin
+, enableShared ? true
 , autoreconfHook
 , testers
 }:
@@ -47,8 +48,12 @@ in {
 
   outputs = [ "bin" "dev" "out" "man" ];
 
-  configureFlags =
-    lib.optionals linkStatic [ "--enable-static" "--disable-shared" ];
+  configureFlags = lib.concatLists [
+    (lib.optional enableStatic "--enable-static")
+    (lib.optional (!enableShared) "--disable-shared")
+  ];
+
+  dontDisableStatic = enableStatic;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 791dda4f11e..75b306b368a 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -2,7 +2,8 @@
 , fixDarwinDylibNames
 , file
 , legacySupport ? false
-, static ? stdenv.hostPlatform.isStatic
+, static ? stdenv.hostPlatform.isStatic # generates static libraries *only*
+, enableStatic ? static
 # these need to be ran on the host, thus disable when cross-compiling
 , buildContrib ? stdenv.hostPlatform == stdenv.buildPlatform
 , doCheck ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -54,7 +55,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = lib.attrsets.mapAttrsToList
     (name: value: "-DZSTD_${name}:BOOL=${if value then "ON" else "OFF"}") {
       BUILD_SHARED = !static;
-      BUILD_STATIC = static;
+      BUILD_STATIC = enableStatic;
       BUILD_CONTRIB = buildContrib;
       PROGRAMS_LINK_SHARED = !static;
       LEGACY_SUPPORT = legacySupport;
diff --git a/pkgs/tools/misc/halp/default.nix b/pkgs/tools/misc/halp/default.nix
index d9028a8392a..89867fe7a94 100644
--- a/pkgs/tools/misc/halp/default.nix
+++ b/pkgs/tools/misc/halp/default.nix
@@ -5,7 +5,6 @@
 , stdenv
 , darwin
 , unixtools
-, rust
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -48,7 +47,7 @@ rustPlatform.buildRustPackage rec {
 
   postPatch = ''
     substituteInPlace src/helper/args/mod.rs \
-      --subst-var-by releaseDir target/${rust.toRustTargetSpec stdenv.hostPlatform}/$cargoCheckType
+      --subst-var-by releaseDir target/${stdenv.hostPlatform.rust.rustcTargetSpec}/$cargoCheckType
   '';
 
   preCheck = ''
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index 39c0b680b00..89702cfd1a7 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -27,7 +27,7 @@ assert !cppSupport || !mpiSupport;
 let inherit (lib) optional optionals; in
 
 stdenv.mkDerivation rec {
-  version = "1.14.2";
+  version = "1.14.3";
   pname = "hdf5"
     + lib.optionalString cppSupport "-cpp"
     + lib.optionalString fortranSupport "-fortran"
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
         majorMinorPatch = with lib.versions; "${major version}.${minor version}.${patch version}";
       in
       "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-${majorMinor}/hdf5-${majorMinorPatch}/src/hdf5-${version}.tar.bz2";
-    sha256 = "sha256-6jxeJX7zIq9ed/weUurTrWvzu0rAZIDdF+45ANeiTPs=";
+    sha256 = "sha256-lCXyJO110SgLtG1vJpI92Tj5BA5+rr9X5m7HNXwI+Rc=";
   };
 
   passthru = {
diff --git a/pkgs/tools/system/zram-generator/default.nix b/pkgs/tools/system/zram-generator/default.nix
index 81bf4082d5c..3d55d7c1961 100644
--- a/pkgs/tools/system/zram-generator/default.nix
+++ b/pkgs/tools/system/zram-generator/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, rust
 , rustPlatform
 , pkg-config
 , ronn
@@ -28,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   postPatch = ''
     cp ${./Cargo.lock} Cargo.lock
     substituteInPlace Makefile \
-      --replace 'target/$(BUILDTYPE)' 'target/${rust.toRustTargetSpec stdenv.hostPlatform}/$(BUILDTYPE)'
+      --replace 'target/$(BUILDTYPE)' 'target/${stdenv.hostPlatform.rust.rustcTargetSpec}/$(BUILDTYPE)'
     substituteInPlace src/generator.rs \
       --replace 'Command::new("systemd-detect-virt")' 'Command::new("${systemd}/bin/systemd-detect-virt")' \
       --replace 'Command::new("modprobe")' 'Command::new("${kmod}/bin/modprobe")'
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 70e95cb4f01..146ff607254 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -13,10 +13,7 @@
 , buildPackages
 }:
 
-let
-  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
-
-in rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "rav1e";
   version = "0.6.6";
 
@@ -47,11 +44,11 @@ in rustPlatform.buildRustPackage rec {
   checkType = "debug";
 
   postBuild =  ''
-    ${rust.envVars.setEnv} cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${stdenv.hostPlatform.rust.rustcTarget}
   '';
 
   postInstall = ''
-    ${rust.envVars.setEnv} cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${stdenv.hostPlatform.rust.rustcTarget}
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 13d13e65502..344267e5bb2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5983,10 +5983,6 @@ with pkgs;
 
   merriweather-sans = callPackage ../data/fonts/merriweather-sans { };
 
-  meson = callPackage ../development/tools/build-managers/meson {
-    inherit (darwin.apple_sdk.frameworks) Foundation OpenGL AppKit Cocoa;
-  };
-
   # while building documentation meson may want to run binaries for host
   # which needs an emulator
   # example of an error which this fixes
@@ -6006,7 +6002,7 @@ with pkgs;
       # outer level, but not its outPath can still be evaluated if the condition
       # doesn't hold. This ensures that splicing still can work correctly.
       (if (!stdenv.hostPlatform.canExecute stdenv.targetPlatform) then
-        ../development/tools/build-managers/meson/emulator-hook.sh
+        ../by-name/me/meson/emulator-hook.sh
        else
          throw "mesonEmulatorHook may only be added to nativeBuildInputs when the target binaries can't be executed; however you are attempting to use it in a situation where ${stdenv.hostPlatform.config} can execute ${stdenv.targetPlatform.config}. Consider only adding mesonEmulatorHook according to a conditional based canExecute in your package expression.");
 
@@ -18915,11 +18911,9 @@ with pkgs;
 
   ctmg = callPackage ../tools/security/ctmg { };
 
-  cmake = callPackage ../development/tools/build-managers/cmake { };
-
   # can't use override - it triggers infinite recursion
-  cmakeMinimal = callPackage ../development/tools/build-managers/cmake {
-    isBootstrap = true;
+  cmakeMinimal = callPackage ../by-name/cm/cmake/package.nix {
+    isMinimalBuild = true;
   };
 
   cmakeCurses = cmake.override {
@@ -20033,8 +20027,10 @@ with pkgs;
 
   sca2d = callPackage ../development/tools/sca2d {  };
 
-  sconsPackages = dontRecurseIntoAttrs (callPackage ../development/tools/build-managers/scons { });
-  scons = sconsPackages.scons_latest;
+  scons = scons_4_5_2;
+  scons_3_1_2 = callPackage ../development/tools/build-managers/scons/3.1.2.nix { };
+  scons_4_1_0 = callPackage ../development/tools/build-managers/scons/4.1.0.nix { };
+  scons_4_5_2 = callPackage ../development/tools/build-managers/scons/4.5.2.nix { };
 
   mill = callPackage ../development/tools/build-managers/mill { };
 
@@ -21797,10 +21793,9 @@ with pkgs;
 
   grilo-plugins = callPackage ../development/libraries/grilo-plugins { };
 
-  grpc = callPackage ../development/libraries/grpc {
-    # Work around Clang check for 10.13 when using aligned allocations with C++17.
+  grpc = darwin.apple_sdk_11_0.callPackage ../development/libraries/grpc {
     stdenv = if stdenv.isDarwin && stdenv.isx86_64
-      then overrideSDK stdenv { darwinMinVersion = "10.13"; }
+      then overrideSDK darwin.apple_sdk_11_0.stdenv { darwinMinVersion = "10.13"; }
       else stdenv;
   };
 
@@ -28800,6 +28795,7 @@ with pkgs;
     withResolved = false;
     withShellCompletions = false;
     withSysupdate = false;
+    withSysusers = false;
     withTimedated = false;
     withTimesyncd = false;
     withTpm2Tss = false;
diff --git a/pkgs/top-level/packages-config.nix b/pkgs/top-level/packages-config.nix
index 79be645162e..b1c436d1ccf 100644
--- a/pkgs/top-level/packages-config.nix
+++ b/pkgs/top-level/packages-config.nix
@@ -20,7 +20,6 @@
       quicklispPackagesSBCL
       rPackages
       roundcubePlugins
-      sconsPackages
       sourceHanPackages
       steamPackages
       ut2004Packages
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4dcd18d9c85..f6888cc01d8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6947,7 +6947,9 @@ self: super: with self; {
 
   mobly = callPackage ../development/python-modules/mobly { };
 
-  mocket = callPackage ../development/python-modules/mocket { };
+  mocket = callPackage ../development/python-modules/mocket {
+    redis-server = pkgs.redis;
+  };
 
   mock = callPackage ../development/python-modules/mock { };