summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/attrsets.nix14
-rw-r--r--maintainers/scripts/nix-generate-from-cpan.nix4
-rw-r--r--nixos/modules/config/pulseaudio.nix3
-rw-r--r--nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix4
-rw-r--r--nixos/modules/programs/mininet.nix2
-rw-r--r--nixos/modules/services/audio/mopidy.nix2
-rw-r--r--nixos/modules/services/backup/borgbackup.nix2
-rw-r--r--nixos/modules/services/continuous-integration/hydra/default.nix2
-rw-r--r--nixos/modules/services/misc/etebase-server.nix2
-rw-r--r--nixos/modules/services/misc/gitlab.nix4
-rw-r--r--nixos/modules/services/networking/knot.nix2
-rw-r--r--nixos/modules/services/networking/pptpd.nix2
-rw-r--r--nixos/modules/services/networking/tinc.nix2
-rw-r--r--nixos/modules/services/networking/xl2tpd.nix2
-rw-r--r--nixos/modules/services/web-apps/mediawiki.nix2
-rw-r--r--nixos/modules/virtualisation/azure-agent.nix2
-rw-r--r--nixos/tests/hydra/common.nix2
-rw-r--r--nixos/tests/kubernetes/base.nix2
-rw-r--r--nixos/tests/pulseaudio.nix25
-rw-r--r--pkgs/applications/audio/aumix/default.nix3
-rw-r--r--pkgs/applications/audio/calf/default.nix3
-rw-r--r--pkgs/applications/audio/flac/default.nix6
-rw-r--r--pkgs/applications/audio/grandorgue/default.nix2
-rw-r--r--pkgs/applications/audio/ltc-tools/default.nix3
-rw-r--r--pkgs/applications/audio/meterbridge/default.nix3
-rw-r--r--pkgs/applications/audio/mod-arpeggiator-lv2/default.nix3
-rw-r--r--pkgs/applications/audio/opusfile/default.nix1
-rw-r--r--pkgs/applications/audio/patchage/default.nix2
-rw-r--r--pkgs/applications/audio/transcode/default.nix3
-rw-r--r--pkgs/applications/audio/xsynth-dssi/default.nix4
-rw-r--r--pkgs/applications/blockchains/zcash/default.nix2
-rw-r--r--pkgs/applications/editors/leafpad/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix3
-rw-r--r--pkgs/applications/emulators/np2kai/default.nix2
-rw-r--r--pkgs/applications/file-managers/spacefm/default.nix4
-rw-r--r--pkgs/applications/file-managers/xfe/default.nix4
-rw-r--r--pkgs/applications/graphics/gpicview/default.nix4
-rw-r--r--pkgs/applications/graphics/synfigstudio/default.nix1
-rw-r--r--pkgs/applications/graphics/xaos/default.nix3
-rw-r--r--pkgs/applications/misc/gv/default.nix2
-rw-r--r--pkgs/applications/misc/gxmessage/default.nix4
-rw-r--r--pkgs/applications/misc/pcmanx-gtk2/default.nix4
-rw-r--r--pkgs/applications/misc/udevil/default.nix3
-rw-r--r--pkgs/applications/misc/xpad/default.nix4
-rw-r--r--pkgs/applications/misc/xxkb/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix2
-rw-r--r--pkgs/applications/networking/ids/snort/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix3
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix3
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin/default.nix4
-rw-r--r--pkgs/applications/networking/sync/lsyncd/default.nix4
-rw-r--r--pkgs/applications/office/gnucash/default.nix2
-rw-r--r--pkgs/applications/office/grisbi/default.nix3
-rw-r--r--pkgs/applications/office/homebank/default.nix4
-rw-r--r--pkgs/applications/office/libreoffice/default.nix1
-rw-r--r--pkgs/applications/radio/rtl-ais/default.nix3
-rw-r--r--pkgs/applications/radio/unixcw/default.nix3
-rw-r--r--pkgs/applications/radio/xlog/default.nix3
-rwxr-xr-xpkgs/applications/science/biology/vcftools/default.nix3
-rw-r--r--pkgs/applications/science/geometry/drgeo/default.nix3
-rw-r--r--pkgs/applications/science/math/R/default.nix3
-rw-r--r--pkgs/applications/science/math/sage/sage-with-env.nix6
-rw-r--r--pkgs/applications/terminal-emulators/mrxvt/default.nix3
-rw-r--r--pkgs/applications/terminal-emulators/rxvt-unicode/default.nix3
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix6
-rw-r--r--pkgs/applications/video/byzanz/default.nix3
-rw-r--r--pkgs/applications/virtualization/xen/generic.nix4
-rw-r--r--pkgs/applications/window-managers/fbpanel/default.nix3
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh25
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix1
-rw-r--r--pkgs/build-support/rust/hooks/cargo-setup-hook.sh12
-rw-r--r--pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix6
-rw-r--r--pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix5
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix5
-rw-r--r--pkgs/build-support/trivial-builders.nix22
-rw-r--r--pkgs/data/icons/tango-icon-theme/default.nix4
-rw-r--r--pkgs/data/misc/cacert/default.nix4
-rw-r--r--pkgs/data/misc/ddccontrol-db/default.nix3
-rw-r--r--pkgs/data/misc/iana-etc/default.nix5
-rw-r--r--pkgs/data/misc/tzdata/default.nix6
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-common/default.nix2
-rw-r--r--pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix6
-rw-r--r--pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/gtkhtml/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/libgnome/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/libgnomecups/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix4
-rw-r--r--pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix3
-rw-r--r--pkgs/desktops/gnome/misc/gtkhtml/default.nix4
-rw-r--r--pkgs/desktops/lxde/core/lxmenu-data/default.nix2
-rw-r--r--pkgs/development/compilers/gerbil/gerbil-crypto.nix3
-rw-r--r--pkgs/development/compilers/gerbil/gerbil-support.nix3
-rw-r--r--pkgs/development/compilers/polyml/5.6.nix2
-rw-r--r--pkgs/development/compilers/rust/1_64.nix (renamed from pkgs/development/compilers/rust/1_63.nix)32
-rw-r--r--pkgs/development/compilers/rust/cargo.nix4
-rw-r--r--pkgs/development/compilers/rust/rustc.nix4
-rwxr-xr-xpkgs/development/embedded/blackmagic/helper.sh2
-rw-r--r--pkgs/development/interpreters/io/default.nix3
-rw-r--r--pkgs/development/interpreters/qnial/default.nix3
-rw-r--r--pkgs/development/libraries/SDL2/default.nix6
-rw-r--r--pkgs/development/libraries/SDL2/find-headers.patch26
-rw-r--r--pkgs/development/libraries/SDL2_mixer/default.nix2
-rw-r--r--pkgs/development/libraries/allegro/5.nix4
-rw-r--r--pkgs/development/libraries/apr-util/default.nix3
-rw-r--r--pkgs/development/libraries/dssi/default.nix4
-rw-r--r--pkgs/development/libraries/expat/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix9
-rw-r--r--pkgs/development/libraries/frame/default.nix3
-rw-r--r--pkgs/development/libraries/ggz_base_libs/default.nix3
-rw-r--r--pkgs/development/libraries/glew/1.10.nix6
-rw-r--r--pkgs/development/libraries/glib/default.nix2
-rw-r--r--pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch141
-rw-r--r--pkgs/development/libraries/glibc/default.nix2
-rw-r--r--pkgs/development/libraries/gnutls/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix12
-rw-r--r--pkgs/development/libraries/gstreamer/bad/fix-paths.patch48
-rw-r--r--pkgs/development/libraries/gtk-engines/default.nix4
-rw-r--r--pkgs/development/libraries/gtkspell/default.nix4
-rw-r--r--pkgs/development/libraries/kerberos/krb5.nix2
-rw-r--r--pkgs/development/libraries/libdrm/default.nix11
-rw-r--r--pkgs/development/libraries/liberfa/default.nix2
-rw-r--r--pkgs/development/libraries/libextractor/default.nix3
-rw-r--r--pkgs/development/libraries/libffi/default.nix5
-rw-r--r--pkgs/development/libraries/libffi/libffi-powerpc64.patch23
-rw-r--r--pkgs/development/libraries/libfido2/default.nix2
-rw-r--r--pkgs/development/libraries/libinklevel/default.nix2
-rw-r--r--pkgs/development/libraries/libmikmod/default.nix6
-rw-r--r--pkgs/development/libraries/libmx/default.nix3
-rw-r--r--pkgs/development/libraries/libpfm/default.nix4
-rw-r--r--pkgs/development/libraries/libpipeline/default.nix4
-rw-r--r--pkgs/development/libraries/libspectre/default.nix4
-rw-r--r--pkgs/development/libraries/libspng/default.nix2
-rw-r--r--pkgs/development/libraries/libtoxcore/new-api.nix2
-rw-r--r--pkgs/development/libraries/libwnck/2.nix4
-rw-r--r--pkgs/development/libraries/mlt/qt-5.nix3
-rw-r--r--pkgs/development/libraries/ogre/default.nix1
-rw-r--r--pkgs/development/libraries/openal-soft/default.nix8
-rw-r--r--pkgs/development/libraries/opencl-headers/default.nix4
-rw-r--r--pkgs/development/libraries/openh264/default.nix4
-rw-r--r--pkgs/development/libraries/openjpeg/default.nix68
-rw-r--r--pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch44
-rw-r--r--pkgs/development/libraries/science/math/cliquer/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix4
-rw-r--r--pkgs/development/libraries/sentry-native/default.nix4
-rw-r--r--pkgs/development/libraries/smpeg/default.nix8
-rw-r--r--pkgs/development/libraries/smpeg2/default.nix5
-rw-r--r--pkgs/development/libraries/srt/default.nix4
-rw-r--r--pkgs/development/libraries/unicap/default.nix3
-rw-r--r--pkgs/development/libraries/vapoursynth-mvtools/default.nix3
-rw-r--r--pkgs/development/libraries/volume-key/default.nix4
-rw-r--r--pkgs/development/libraries/vte/2.90.nix4
-rw-r--r--pkgs/development/libraries/xcb-util-cursor/HEAD.nix3
-rw-r--r--pkgs/development/lua-modules/overrides.nix3
-rw-r--r--pkgs/development/ocaml-modules/gsl/default.nix3
-rw-r--r--pkgs/development/perl-modules/Po4a/default.nix12
-rw-r--r--pkgs/development/python-modules/psutil/default.nix7
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix2
-rw-r--r--pkgs/development/python-modules/pyjwt/default.nix6
-rw-r--r--pkgs/development/python-modules/setuptools-rust/default.nix4
-rw-r--r--pkgs/development/ruby-modules/gem-config/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/setup-hook.sh2
-rw-r--r--pkgs/development/tools/build-managers/ninja/default.nix51
-rw-r--r--pkgs/development/tools/build-managers/ninja/setup-hook.sh50
-rw-r--r--pkgs/development/tools/mdk/default.nix4
-rw-r--r--pkgs/development/tools/memray/default.nix3
-rw-r--r--pkgs/development/tools/misc/distcc/default.nix4
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/default.nix6
-rw-r--r--pkgs/games/asc/default.nix4
-rw-r--r--pkgs/games/eduke32/default.nix2
-rw-r--r--pkgs/games/extremetuxracer/default.nix3
-rw-r--r--pkgs/games/freedink/default.nix4
-rw-r--r--pkgs/games/iortcw/sp.nix2
-rw-r--r--pkgs/games/ivan/default.nix2
-rw-r--r--pkgs/games/srb2/default.nix4
-rw-r--r--pkgs/games/srb2kart/default.nix4
-rw-r--r--pkgs/games/uhexen2/default.nix2
-rw-r--r--pkgs/games/xboard/default.nix2
-rw-r--r--pkgs/games/xonotic/default.nix8
-rw-r--r--pkgs/misc/cups/drivers/canon/default.nix4
-rw-r--r--pkgs/misc/screensavers/alock/default.nix4
-rw-r--r--pkgs/misc/stabber/default.nix3
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix6
-rw-r--r--pkgs/os-specific/darwin/libtapi/default.nix3
-rw-r--r--pkgs/os-specific/linux/ell/default.nix4
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix1
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix4
-rw-r--r--pkgs/os-specific/linux/libpsm2/default.nix3
-rw-r--r--pkgs/os-specific/linux/lightum/default.nix3
-rw-r--r--pkgs/os-specific/linux/pam_usb/default.nix2
-rw-r--r--pkgs/os-specific/linux/pmount/default.nix3
-rw-r--r--pkgs/os-specific/linux/trace-cmd/default.nix2
-rw-r--r--pkgs/os-specific/linux/xf86-video-nested/default.nix6
-rw-r--r--pkgs/servers/matrix-conduit/default.nix2
-rw-r--r--pkgs/servers/pulseaudio/default.nix18
-rw-r--r--pkgs/servers/web-apps/lemmy/ui.nix4
-rw-r--r--pkgs/servers/web-apps/sogo/default.nix4
-rw-r--r--pkgs/servers/x11/quartz-wm/default.nix2
-rw-r--r--pkgs/stdenv/darwin/default.nix5
-rw-r--r--pkgs/stdenv/generic/setup.sh6
-rw-r--r--pkgs/tools/X11/xnee/default.nix3
-rw-r--r--pkgs/tools/admin/tigervnc/default.nix2
-rw-r--r--pkgs/tools/audio/midimonster/default.nix3
-rw-r--r--pkgs/tools/audio/mpdcron/default.nix3
-rw-r--r--pkgs/tools/backup/dump/default.nix3
-rw-r--r--pkgs/tools/compression/gzip/default.nix9
-rw-r--r--pkgs/tools/compression/lz4/default.nix10
-rw-r--r--pkgs/tools/filesystems/httpfs/default.nix3
-rw-r--r--pkgs/tools/graphics/s2png/default.nix3
-rw-r--r--pkgs/tools/inputmethods/m17n-lib/default.nix18
-rw-r--r--pkgs/tools/misc/cpuminer/default.nix3
-rw-r--r--pkgs/tools/misc/expect/default.nix6
-rw-r--r--pkgs/tools/misc/expect/fix-cross-compilation.patch11
-rw-r--r--pkgs/tools/misc/notify-desktop/default.nix3
-rw-r--r--pkgs/tools/misc/popsicle/default.nix2
-rw-r--r--pkgs/tools/networking/nss-mdns/default.nix2
-rw-r--r--pkgs/tools/networking/ofono/default.nix4
-rw-r--r--pkgs/tools/networking/sipsak/default.nix2
-rw-r--r--pkgs/tools/networking/unbound/default.nix8
-rw-r--r--pkgs/tools/security/chrome-token-signing/default.nix3
-rw-r--r--pkgs/tools/security/ecryptfs/default.nix4
-rw-r--r--pkgs/tools/security/fpm2/default.nix4
-rw-r--r--pkgs/tools/security/gnupg-pkcs11-scd/default.nix3
-rw-r--r--pkgs/tools/security/metasploit/shell.nix2
-rw-r--r--pkgs/tools/security/onioncircuits/default.nix2
-rw-r--r--pkgs/tools/security/tracee/default.nix2
-rw-r--r--pkgs/tools/system/gdmap/default.nix4
-rw-r--r--pkgs/tools/typesetting/asciidoc/default.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/bin.nix17
-rw-r--r--pkgs/top-level/all-packages.nix19
-rw-r--r--pkgs/top-level/emscripten-packages.nix6
-rw-r--r--pkgs/top-level/java-packages.nix2
-rw-r--r--pkgs/top-level/perl-packages.nix12
-rw-r--r--pkgs/top-level/python-packages.nix2
-rw-r--r--pkgs/top-level/release.nix25
240 files changed, 951 insertions, 536 deletions
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 5575e957702..de88763854d 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -622,6 +622,20 @@ rec {
   dontRecurseIntoAttrs =
     attrs: attrs // { recurseForDerivations = false; };
 
+  /* `unionOfDisjoint x y` is equal to `x // y // z` where the
+     attrnames in `z` are the intersection of the attrnames in `x` and
+     `y`, and all values `assert` with an error message.  This
+      operator is commutative, unlike (//). */
+  unionOfDisjoint = x: y:
+    let
+      intersection = builtins.intersectAttrs x y;
+      collisions = lib.concatStringsSep " " (builtins.attrNames intersection);
+      mask = builtins.mapAttrs (name: value: builtins.throw
+        "unionOfDisjoint: collision on ${name}; complete list: ${collisions}")
+        intersection;
+    in
+      (x // y) // mask;
+
   /*** deprecated stuff ***/
 
   zipWithNames = zipAttrsWithNames;
diff --git a/maintainers/scripts/nix-generate-from-cpan.nix b/maintainers/scripts/nix-generate-from-cpan.nix
index fecca7f0c73..9f9833d4060 100644
--- a/maintainers/scripts/nix-generate-from-cpan.nix
+++ b/maintainers/scripts/nix-generate-from-cpan.nix
@@ -3,8 +3,10 @@
 stdenv.mkDerivation {
   name = "nix-generate-from-cpan-3";
 
+  nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = with perlPackages; [
-    makeWrapper perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
+    perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
   ];
 
   phases = [ "installPhase" ];
diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix
index 3e969991f8f..80ff6c1aabf 100644
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@@ -102,7 +102,7 @@ in {
           each user that tries to use the sound system. The server runs
           with user privileges. If true, one system-wide PulseAudio
           server is launched on boot, running as the user "pulse", and
-          only users in the "audio" group will have access to the server.
+          only users in the "pulse-access" group will have access to the server.
           Please read the PulseAudio documentation for more details.
 
           Don't enable this option unless you know what you are doing.
@@ -310,6 +310,7 @@ in {
       };
 
       users.groups.pulse.gid = gid;
+      users.groups.pulse-access = {};
 
       systemd.services.pulseaudio = {
         description = "PulseAudio System-Wide Server";
diff --git a/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix b/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
index a808429c999..8dadbd53b98 100644
--- a/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
+++ b/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
@@ -23,8 +23,10 @@ in
 runCommand "uvcdynctrl-udev-rules-${version}"
 {
   inherit dataPath;
-  buildInputs = [
+  nativeBuildInputs = [
     makeWrapper
+  ];
+  buildInputs = [
     libwebcam
   ];
   dontPatchELF = true;
diff --git a/nixos/modules/programs/mininet.nix b/nixos/modules/programs/mininet.nix
index 0b7e82cc5bd..02272729d23 100644
--- a/nixos/modules/programs/mininet.nix
+++ b/nixos/modules/programs/mininet.nix
@@ -14,7 +14,7 @@ let
   pyEnv = pkgs.python.withPackages(ps: [ ps.mininet-python ]);
 
   mnexecWrapped = pkgs.runCommand "mnexec-wrapper"
-    { buildInputs = [ pkgs.makeWrapper pkgs.pythonPackages.wrapPython ]; }
+    { nativeBuildInputs = [ pkgs.makeWrapper pkgs.pythonPackages.wrapPython ]; }
     ''
       makeWrapper ${pkgs.mininet}/bin/mnexec \
         $out/bin/mnexec \
diff --git a/nixos/modules/services/audio/mopidy.nix b/nixos/modules/services/audio/mopidy.nix
index 50ee9a82451..40e8679f53d 100644
--- a/nixos/modules/services/audio/mopidy.nix
+++ b/nixos/modules/services/audio/mopidy.nix
@@ -14,7 +14,7 @@ let
     name = "mopidy-with-extensions-${mopidy.version}";
     paths = closePropagation cfg.extensionPackages;
     pathsToLink = [ "/${mopidyPackages.python.sitePackages}" ];
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
     postBuild = ''
       makeWrapper ${mopidy}/bin/mopidy $out/bin/mopidy \
         --prefix PYTHONPATH : $out/${mopidyPackages.python.sitePackages}
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index f02e15f2b98..7b29eb41e72 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -116,7 +116,7 @@ let
       original, name, set ? {}
     }:
     pkgs.runCommand "${name}-wrapper" {
-      buildInputs = [ pkgs.makeWrapper ];
+      nativeBuildInputs = [ pkgs.makeWrapper ];
     } (with lib; ''
       makeWrapper "${original}" "$out/bin/${name}" \
         ${concatStringsSep " \\\n " (mapAttrsToList (name: value: ''--set ${name} "${value}"'') set)}
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 8b5c1228c52..71147957504 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -42,7 +42,7 @@ let
     makeWrapperArgs = concatStringsSep " " (mapAttrsToList (key: value: "--set \"${key}\" \"${value}\"") hydraEnv);
   in pkgs.buildEnv rec {
     name = "hydra-env";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     paths = [ cfg.package ];
 
     postBuild = ''
diff --git a/nixos/modules/services/misc/etebase-server.nix b/nixos/modules/services/misc/etebase-server.nix
index 76c7c6596c8..c3723d18814 100644
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@@ -162,7 +162,7 @@ in
 
     environment.systemPackages = with pkgs; [
       (runCommand "etebase-server" {
-        buildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeWrapper ];
       } ''
         makeWrapper ${pythonEnv}/bin/etebase-server \
           $out/bin/etebase-server \
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index e5de3a2b6ad..c41f2efeec4 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -190,7 +190,7 @@ let
 
   gitlab-rake = pkgs.stdenv.mkDerivation {
     name = "gitlab-rake";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     dontBuild = true;
     dontUnpack = true;
     installPhase = ''
@@ -205,7 +205,7 @@ let
 
   gitlab-rails = pkgs.stdenv.mkDerivation {
     name = "gitlab-rails";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     dontBuild = true;
     dontUnpack = true;
     installPhase = ''
diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index de238112826..ee7ea83456d 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -18,7 +18,7 @@ let
 
   knot-cli-wrappers = pkgs.stdenv.mkDerivation {
     name = "knot-cli-wrappers";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     buildCommand = ''
       mkdir -p $out/bin
       makeWrapper ${cfg.package}/bin/knotc "$out/bin/knotc" \
diff --git a/nixos/modules/services/networking/pptpd.nix b/nixos/modules/services/networking/pptpd.nix
index 2f206e813a5..703dda99803 100644
--- a/nixos/modules/services/networking/pptpd.nix
+++ b/nixos/modules/services/networking/pptpd.nix
@@ -82,7 +82,7 @@ with lib;
       ppp-pptpd-wrapped = pkgs.stdenv.mkDerivation {
         name         = "ppp-pptpd-wrapped";
         phases       = [ "installPhase" ];
-        buildInputs  = with pkgs; [ makeWrapper ];
+        nativeBuildInputs  = with pkgs; [ makeWrapper ];
         installPhase = ''
           mkdir -p $out/bin
           makeWrapper ${pkgs.ppp}/bin/pppd $out/bin/pppd \
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 1f93d82f96e..09b23a60a4a 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -410,7 +410,7 @@ in
     environment.systemPackages = let
       cli-wrappers = pkgs.stdenv.mkDerivation {
         name = "tinc-cli-wrappers";
-        buildInputs = [ pkgs.makeWrapper ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
         buildCommand = ''
           mkdir -p $out/bin
           ${concatStringsSep "\n" (mapAttrsToList (network: data:
diff --git a/nixos/modules/services/networking/xl2tpd.nix b/nixos/modules/services/networking/xl2tpd.nix
index 8f710bca322..7d259570761 100644
--- a/nixos/modules/services/networking/xl2tpd.nix
+++ b/nixos/modules/services/networking/xl2tpd.nix
@@ -84,7 +84,7 @@ with lib;
       xl2tpd-ppp-wrapped = pkgs.stdenv.mkDerivation {
         name         = "xl2tpd-ppp-wrapped";
         phases       = [ "installPhase" ];
-        buildInputs  = with pkgs; [ makeWrapper ];
+        nativeBuildInputs  = with pkgs; [ makeWrapper ];
         installPhase = ''
           mkdir -p $out/bin
 
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index a32db718848..e332847f5a2 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -35,7 +35,7 @@ let
   };
 
   mediawikiScripts = pkgs.runCommand "mediawiki-scripts" {
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     preferLocalBuild = true;
   } ''
     mkdir -p $out/bin
diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix
index 31047c4ddc0..abe6455a1a6 100644
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@@ -17,7 +17,7 @@ let
 
     patches = [ ./azure-agent-entropy.patch ];
 
-    buildInputs = [ makeWrapper python pythonPackages.wrapPython ];
+    nativeBuildInputs = [ makeWrapper python pythonPackages.wrapPython ];
     runtimeDeps = [ findutils gnugrep gawk coreutils openssl openssh
                     nettools # for hostname
                     procps # for pidof
diff --git a/nixos/tests/hydra/common.nix b/nixos/tests/hydra/common.nix
index fdf2b2c6f6d..2bce03418e1 100644
--- a/nixos/tests/hydra/common.nix
+++ b/nixos/tests/hydra/common.nix
@@ -16,7 +16,7 @@
     createTrivialProject = pkgs.stdenv.mkDerivation {
       name = "create-trivial-project";
       dontUnpack = true;
-      buildInputs = [ pkgs.makeWrapper ];
+      nativeBuildInputs = [ pkgs.makeWrapper ];
       installPhase = "install -m755 -D ${./create-trivial-project.sh} $out/bin/create-trivial-project.sh";
       postFixup = ''
         wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob}
diff --git a/nixos/tests/kubernetes/base.nix b/nixos/tests/kubernetes/base.nix
index d4410beb937..714ac3098c0 100644
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@@ -18,7 +18,7 @@ let
         ${master.ip}  api.${domain}
         ${concatMapStringsSep "\n" (machineName: "${machines.${machineName}.ip}  ${machineName}.${domain}") (attrNames machines)}
       '';
-      wrapKubectl = with pkgs; runCommand "wrap-kubectl" { buildInputs = [ makeWrapper ]; } ''
+      wrapKubectl = with pkgs; runCommand "wrap-kubectl" { nativeBuildInputs = [ makeWrapper ]; } ''
         mkdir -p $out/bin
         makeWrapper ${pkgs.kubernetes}/bin/kubectl $out/bin/kubectl --set KUBECONFIG "/etc/kubernetes/cluster-admin.kubeconfig"
       '';
diff --git a/nixos/tests/pulseaudio.nix b/nixos/tests/pulseaudio.nix
index cfdc61bc6c2..dc8e33ccd55 100644
--- a/nixos/tests/pulseaudio.nix
+++ b/nixos/tests/pulseaudio.nix
@@ -1,10 +1,10 @@
 let
-  mkTest = { systemWide ? false }:
+  mkTest = { systemWide ? false , fullVersion ? false }:
     import ./make-test-python.nix ({ pkgs, lib, ... }:
       let
         testFile = pkgs.fetchurl {
           url =
-            "https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3";
+            "https://file-examples.com/storage/fe5947fd2362fc197a3c2df/2017/11/file_example_MP3_700KB.mp3";
           hash = "sha256-+iggJW8s0/LfA/okfXsB550/55Q0Sq3OoIzuBrzOPJQ=";
         };
 
@@ -22,7 +22,7 @@ let
           testPlay32 = { inherit (pkgs.pkgsi686Linux) sox alsa-utils; };
         };
       in {
-        name = "pulseaudio${lib.optionalString systemWide "-systemWide"}";
+        name = "pulseaudio${lib.optionalString fullVersion "Full"}${lib.optionalString systemWide "-systemWide"}";
         meta = with pkgs.lib.maintainers; {
           maintainers = [ synthetica ] ++ pkgs.pulseaudio.meta.maintainers;
         };
@@ -35,12 +35,14 @@ let
               enable = true;
               support32Bit = true;
               inherit systemWide;
+            } // lib.optionalAttrs fullVersion {
+              package = pkgs.pulseaudioFull;
             };
 
             environment.systemPackages = [ testers.testPlay pkgs.pavucontrol ]
               ++ lib.optional pkgs.stdenv.isx86_64 testers.testPlay32;
           } // lib.optionalAttrs systemWide {
-            users.users.alice.extraGroups = [ "audio" ];
+            users.users.alice.extraGroups = [ "pulse-access" ];
             systemd.services.pulseaudio.wantedBy = [ "multi-user.target" ];
           };
 
@@ -58,14 +60,21 @@ let
           ''}
           machine.screenshot("testPlay")
 
+          ${lib.optionalString (!systemWide) ''
+            machine.send_chars("pacmd info && touch /tmp/pacmd_success\n")
+            machine.wait_for_file("/tmp/pacmd_success")
+          ''}
+
           # Pavucontrol only loads when Pulseaudio is running. If it isn't, the
-          # text "Playback" (one of the tabs) will never show.
+          # text "Dummy Output" (sound device name) will never show.
           machine.send_chars("pavucontrol\n")
-          machine.wait_for_text("Playback")
+          machine.wait_for_text("Dummy Output")
           machine.screenshot("Pavucontrol")
         '';
       });
 in builtins.mapAttrs (key: val: mkTest val) {
-  user = { systemWide = false; };
-  system = { systemWide = true; };
+  user = { systemWide = false; fullVersion = false; };
+  system = { systemWide = true; fullVersion = false; };
+  userFull = { systemWide = false; fullVersion = true; };
+  systemFull = { systemWide = true; fullVersion = true; };
 }
diff --git a/pkgs/applications/audio/aumix/default.nix b/pkgs/applications/audio/aumix/default.nix
index 2603e88fcbd..e3e1ec74ffd 100644
--- a/pkgs/applications/audio/aumix/default.nix
+++ b/pkgs/applications/audio/aumix/default.nix
@@ -28,8 +28,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ gettext ncurses ]
-    ++ lib.optionals gtkGUI [ pkg-config gtk2 ];
+    ++ lib.optionals gtkGUI [ gtk2 ];
 
   meta = with lib; {
     description = "Audio mixer for X and the console";
diff --git a/pkgs/applications/audio/calf/default.nix b/pkgs/applications/audio/calf/default.nix
index bdcbf024e60..4ab651e3fb8 100644
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     cairo expat fftwSinglePrec fluidsynth glib gtk2 libjack2 ladspaH
-    libglade lv2 pkg-config
+    libglade lv2
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/flac/default.nix b/pkgs/applications/audio/flac/default.nix
index 621804840bf..c9e3b946dd1 100644
--- a/pkgs/applications/audio/flac/default.nix
+++ b/pkgs/applications/audio/flac/default.nix
@@ -2,11 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "flac";
-  version = "1.3.4";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
-    sha256 = "0dz7am8kbc97a6afml1h4yp085274prg8j7csryds8m3fmz61w4g";
+    # Official checksum is published at https://github.com/xiph/flac/releases/tag/${version}
+    sha256 = "91303c3e5dfde52c3e94e75976c0ab3ee14ced278ab8f60033a3a12db9209ae6";
   };
 
   buildInputs = [ libogg ];
@@ -20,5 +21,6 @@ stdenv.mkDerivation rec {
     description = "Library and tools for encoding and decoding the FLAC lossless audio file format";
     platforms = platforms.all;
     license = licenses.bsd3;
+    maintainers = with maintainers; [ ruuda ];
   };
 }
diff --git a/pkgs/applications/audio/grandorgue/default.nix b/pkgs/applications/audio/grandorgue/default.nix
index 30c6e57188a..954a2265312 100644
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ pkg-config fftwFloat alsa-lib zlib wavpack wxGTK31 udev ]
+  buildInputs = [ fftwFloat alsa-lib zlib wavpack wxGTK31 udev ]
     ++ lib.optional jackaudioSupport libjack2;
 
   cmakeFlags = lib.optional (!jackaudioSupport) [
diff --git a/pkgs/applications/audio/ltc-tools/default.nix b/pkgs/applications/audio/ltc-tools/default.nix
index c8c87959727..93558105074 100644
--- a/pkgs/applications/audio/ltc-tools/default.nix
+++ b/pkgs/applications/audio/ltc-tools/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vp25b970r1hv5ndzs4di63rgwnl31jfaj3jz5dka276kx34q4al";
   };
 
-  buildInputs = [ pkg-config libltc libsndfile jack2 ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libltc libsndfile jack2 ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/audio/meterbridge/default.nix b/pkgs/applications/audio/meterbridge/default.nix
index a825eaa4e38..675189f6d13 100644
--- a/pkgs/applications/audio/meterbridge/default.nix
+++ b/pkgs/applications/audio/meterbridge/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
 
   patches = [ ./buf_rect.patch ./fix_build_with_gcc-5.patch];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config SDL SDL_image libjack2
+    [ SDL SDL_image libjack2
     ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix b/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
index 3896545dc41..a628e38469f 100644
--- a/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
+++ b/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-1KiWMTVTTf1/iR4AzJ1Oe0mOrWN5edsZN0tQMidgnRA=";
   };
 
-  buildInputs = [ lv2 pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ lv2 ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/audio/opusfile/default.nix b/pkgs/applications/audio/opusfile/default.nix
index a6683904cb1..f86595361b6 100644
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl libogg ];
   propagatedBuildInputs = [ libopus ];
+  outputs = [ "out" "dev" ];
   patches = [ ./include-multistream.patch ]
     # fixes problem with openssl 1.1 dependency
     # see https://github.com/xiph/opusfile/issues/13
diff --git a/pkgs/applications/audio/patchage/default.nix b/pkgs/applications/audio/patchage/default.nix
index a8a5bed0e07..99bbdf693a9 100644
--- a/pkgs/applications/audio/patchage/default.nix
+++ b/pkgs/applications/audio/patchage/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     alsa-lib
     boost
@@ -33,7 +34,6 @@ stdenv.mkDerivation rec {
     glibmm
     gtkmm2
     libjack2
-    pkg-config
     python3
     wafHook
   ];
diff --git a/pkgs/applications/audio/transcode/default.nix b/pkgs/applications/audio/transcode/default.nix
index 112d84a08b1..da149db0753 100644
--- a/pkgs/applications/audio/transcode/default.nix
+++ b/pkgs/applications/audio/transcode/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1e4e72d8e0dd62a80b8dd90699f5ca64c9b0cb37a5c9325c184166a9654f0a92";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ flac lame zlib libjpeg libvorbis libtheora libxml2 lzo
-                  libdvdread pkg-config x264 libmpeg2 xvidcore ];
+                  libdvdread x264 libmpeg2 xvidcore ];
   configureFlags = [
     "--disable-ffmpeg" "--disable-libavcodec" "--disable-libavformat"
     "--enable-lzo" "--enable-ogg" "--enable-vorbis" "--enable-theora" "--enable-libxml2"
diff --git a/pkgs/applications/audio/xsynth-dssi/default.nix b/pkgs/applications/audio/xsynth-dssi/default.nix
index 61d49d110a9..87305027e4c 100644
--- a/pkgs/applications/audio/xsynth-dssi/default.nix
+++ b/pkgs/applications/audio/xsynth-dssi/default.nix
@@ -10,9 +10,9 @@ stdenv.mkDerivation  rec {
     sha256 = "00nwv2pqjbmxqdc6xdm0cljq6z05lv4y6bibmhz1kih9lm0lklnk";
   };
 
-  nativeBuildInputs = [ autoconf automake  ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [ alsa-lib dssi gtk2 libjack2 ladspaH
-    ladspaPlugins liblo pkg-config ];
+    ladspaPlugins liblo ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/blockchains/zcash/default.nix b/pkgs/applications/blockchains/zcash/default.nix
index 20520037a60..c4d007f2907 100644
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
   postPatch = ''
     # Have to do this here instead of in preConfigure because
     # cargoDepsCopy gets unset after postPatch.
-    configureFlagsArray+=("RUST_VENDORED_SOURCES=$NIX_BUILD_TOP/$cargoDepsCopy")
+    configureFlagsArray+=("RUST_VENDORED_SOURCES=$cargoDepsCopy")
   '';
 
   CXXFLAGS = [
diff --git a/pkgs/applications/editors/leafpad/default.nix b/pkgs/applications/editors/leafpad/default.nix
index 2f53df97d32..0376e3af6bf 100644
--- a/pkgs/applications/editors/leafpad/default.nix
+++ b/pkgs/applications/editors/leafpad/default.nix
@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0b0az2wvqgvam7w0ns1j8xp2llslm1rx6h7zcsy06a7j0yp257cm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk2 ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
index d5961f0c9eb..9eba40330b9 100644
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
@@ -45,7 +45,8 @@ let
     inherit (stdenv.hostPlatform) system;
   }).nodeDependencies.override (old: {
     inherit src version;
-    buildInputs = [pkg-config libsecret];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [libsecret];
     dontNpmInstall = true;
   }));
 
diff --git a/pkgs/applications/emulators/np2kai/default.nix b/pkgs/applications/emulators/np2kai/default.nix
index dd5e53967c0..cf55085b78a 100644
--- a/pkgs/applications/emulators/np2kai/default.nix
+++ b/pkgs/applications/emulators/np2kai/default.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation rec {
 
   configurePhase = ''
     export GIT_VERSION=${builtins.substring 0 7 src.rev}
-    buildFlags="$buildFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES -l$NIX_BUILD_CORES}"
+    buildFlags="$buildFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES"
   '' + optionalString enableX11 ''
     cd x11
     substituteInPlace Makefile.am \
diff --git a/pkgs/applications/file-managers/spacefm/default.nix b/pkgs/applications/file-managers/spacefm/default.nix
index 433109cd86a..334228f98ea 100644
--- a/pkgs/applications/file-managers/spacefm/default.nix
+++ b/pkgs/applications/file-managers/spacefm/default.nix
@@ -45,9 +45,9 @@ stdenv.mkDerivation rec {
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
   '';
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
-    gtk3 udev desktop-file-utils shared-mime-info intltool
+    gtk3 udev desktop-file-utils shared-mime-info
     wrapGAppsHook ffmpegthumbnailer jmtpfs lsof udisks2
   ] ++ (if ifuseSupport then [ ifuse ] else []);
   # Introduced because ifuse doesn't build due to CVEs in libplist
diff --git a/pkgs/applications/file-managers/xfe/default.nix b/pkgs/applications/file-managers/xfe/default.nix
index d59b936608c..c861c695598 100644
--- a/pkgs/applications/file-managers/xfe/default.nix
+++ b/pkgs/applications/file-managers/xfe/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1v1v0vcbnm30kpyd3rj8f56yh7lfnwy7nbs9785wi229b29fiqx1";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fox gettext xlibsWrapper gcc intltool file libpng ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ fox gettext xlibsWrapper gcc file libpng ];
 
   preConfigure = ''
     sed -i s,/usr/share/xfe,$out/share/xfe, src/xfedefs.h
diff --git a/pkgs/applications/graphics/gpicview/default.nix b/pkgs/applications/graphics/gpicview/default.nix
index ae1e64297bd..06c3b03ae53 100644
--- a/pkgs/applications/graphics/gpicview/default.nix
+++ b/pkgs/applications/graphics/gpicview/default.nix
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
 
-  buildInputs = [ intltool gtk2 ];
+  buildInputs = [ gtk2 ];
 
   meta = with lib; {
     description = "A simple and fast image viewer for X";
diff --git a/pkgs/applications/graphics/synfigstudio/default.nix b/pkgs/applications/graphics/synfigstudio/default.nix
index a77a0313223..c87a71fdf6c 100644
--- a/pkgs/applications/graphics/synfigstudio/default.nix
+++ b/pkgs/applications/graphics/synfigstudio/default.nix
@@ -114,7 +114,6 @@ stdenv.mkDerivation {
     gtk3
     gtkmm3
     imagemagick
-    intltool
     libjack2
     libsigcxx
     libxmlxx
diff --git a/pkgs/applications/graphics/xaos/default.nix b/pkgs/applications/graphics/xaos/default.nix
index 15c2d468fb4..2ba96fda3f0 100644
--- a/pkgs/applications/graphics/xaos/default.nix
+++ b/pkgs/applications/graphics/xaos/default.nix
@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  nativeBuildInputs = [ intltool ];
   buildInputs = [
     aalib gsl libpng libX11 xorgproto libXext
-    libXt zlib gettext intltool perl
+    libXt zlib gettext perl
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/misc/gv/default.nix b/pkgs/applications/misc/gv/default.nix
index 851f2d80c97..d5aa1ac8817 100644
--- a/pkgs/applications/misc/gv/default.nix
+++ b/pkgs/applications/misc/gv/default.nix
@@ -13,11 +13,11 @@ stdenv.mkDerivation rec {
     "--enable-SIGCHLD-fallback"
   ];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     Xaw3d
     ghostscriptX
     perl
-    pkg-config
   ] ++ lib.optionals stdenv.isDarwin [
     libiconv
   ];
diff --git a/pkgs/applications/misc/gxmessage/default.nix b/pkgs/applications/misc/gxmessage/default.nix
index f7c5714f126..fb172eb22b0 100644
--- a/pkgs/applications/misc/gxmessage/default.nix
+++ b/pkgs/applications/misc/gxmessage/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "db4e1655fc58f31e5770a17dfca4e6c89028ad8b2c8e043febc87a0beedeef05";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk3 texinfo ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk3 texinfo ];
 
   meta = {
     description = "A GTK enabled dropin replacement for xmessage";
diff --git a/pkgs/applications/misc/pcmanx-gtk2/default.nix b/pkgs/applications/misc/pcmanx-gtk2/default.nix
index dffbd2079ae..2e75791e308 100644
--- a/pkgs/applications/misc/pcmanx-gtk2/default.nix
+++ b/pkgs/applications/misc/pcmanx-gtk2/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0fbwd149wny67rfhczz4cbh713a1qnswjiz7b6c2bxfcwh51f9rc";
   };
 
-  nativeBuildInputs = [ pkg-config automake autoconf ];
-  buildInputs = [ gtk2 libXft intltool libtool ];
+  nativeBuildInputs = [ pkg-config automake autoconf intltool ];
+  buildInputs = [ gtk2 libXft libtool ];
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/applications/misc/udevil/default.nix b/pkgs/applications/misc/udevil/default.nix
index 536d800001b..9c50b189cc1 100644
--- a/pkgs/applications/misc/udevil/default.nix
+++ b/pkgs/applications/misc/udevil/default.nix
@@ -20,11 +20,10 @@ stdenv.mkDerivation rec {
     sha256 = "0nd44r8rbxifx4x4m24z5aji1c6k1fhw8cmf5s43wd5qys0bcdad";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
 
   buildInputs = [
     glib
-    intltool
     udev
   ];
 
diff --git a/pkgs/applications/misc/xpad/default.nix b/pkgs/applications/misc/xpad/default.nix
index dbb5eb42e1d..2a14cbe24fb 100644
--- a/pkgs/applications/misc/xpad/default.nix
+++ b/pkgs/applications/misc/xpad/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "1qpmlwn0bcw1q73ag0l0fdnlzmwawfvsy4g9y5b0vyrc58lcp5d3";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook intltool ];
 
-  buildInputs = [ glib intltool gtk3 gtksourceview ];
+  buildInputs = [ glib gtk3 gtksourceview ];
 
   meta = with lib; {
     description = "A sticky note application for jotting down things to remember";
diff --git a/pkgs/applications/misc/xxkb/default.nix b/pkgs/applications/misc/xxkb/default.nix
index d6514e58517..5e76e3a14d5 100644
--- a/pkgs/applications/misc/xxkb/default.nix
+++ b/pkgs/applications/misc/xxkb/default.nix
@@ -23,14 +23,14 @@ stdenv.mkDerivation rec {
     sha256 = "0hl1i38z9xnbgfjkaz04vv1n8xbgfg88g5z8fyzyb2hxv2z37anf";
   };
 
-  nativeBuildInputs = [ imake gccmakedep ];
+  nativeBuildInputs = [ imake gccmakedep pkg-config ];
 
   buildInputs = [
     libX11
     libXt
     libXext
     libXpm
-  ] ++ lib.optionals svgSupport [ librsvg glib gdk-pixbuf pkg-config ];
+  ] ++ lib.optionals svgSupport [ librsvg glib gdk-pixbuf ];
 
   outputs = [ "out" "man" ];
 
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index b22a334b64f..afee9cf4f61 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -325,7 +325,7 @@ let
 
     buildPhase = let
       buildCommand = target: ''
-        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/pkgs/applications/networking/ids/snort/default.nix b/pkgs/applications/networking/ids/snort/default.nix
index 938626806ca..46394c107de 100644
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xrc7crchflfrk4x5dq5zx22zkmgcrbkww5r1pvkc3cyyr18cc6h";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pkg-config luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
+  nativeBuildInputs = [ makeWrapper pkg-config ];
+  buildInputs = [ luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
 
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
index 52204d5c79c..aa871df5e8a 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   postInstall = "ln -s \$out/lib/pidgin \$out/share/pidgin-otr";
 
-  buildInputs = [ libotr pidgin intltool ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ libotr pidgin ];
 
   meta = with lib; {
     homepage = "https://otr.cypherpunks.ca/";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
index 9afdee8cda1..70cb3a9028d 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-CdA/aUu+CmCRbVBKpJGydicqFQa/rEsLWS3MBKlH2/M=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ glib intltool libappindicator-gtk2 libtool pidgin ];
+  nativeBuildInputs = [ autoreconfHook intltool ];
+  buildInputs = [ glib libappindicator-gtk2 libtool pidgin ];
 
   meta = with lib; {
     description = "An AppIndicator and KStatusNotifierItem Plugin for Pidgin";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
index f393a17c1bc..7c076cb3724 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g5hmy7fwgjq59j52h9yps28jsjjrfkd4r18gyx6hfd3g3kzbg1b";
   };
 
-  buildInputs = [ pidgin intltool python2 ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ pidgin python2 ];
 
   meta = with lib; {
     homepage = "https://bitbucket.org/rekkanoryo/purple-plugin-pack";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index 84f8f327cad..15e830b7687 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -16,7 +16,7 @@ let unwrapped = stdenv.mkDerivation rec {
     sha256 = "sha256-RUsbkovGvLsYM1OvMPv95VlfIkWjQjoaRubJei3yKBA=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper intltool ];
 
   NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
@@ -27,7 +27,7 @@ let unwrapped = stdenv.mkDerivation rec {
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
     libxml2 nss nspr
     libXScrnSaver python-with-dbus
-    avahi dbus dbus-glib intltool libidn
+    avahi dbus dbus-glib libidn
     libICE libXext libSM cyrus_sasl
     libgnt ncurses # optional: build finch - the console UI
   ]
diff --git a/pkgs/applications/networking/sync/lsyncd/default.nix b/pkgs/applications/networking/sync/lsyncd/default.nix
index 7690bf6ee54..3e52d664d52 100644
--- a/pkgs/applications/networking/sync/lsyncd/default.nix
+++ b/pkgs/applications/networking/sync/lsyncd/default.nix
@@ -31,10 +31,10 @@ stdenv.mkDerivation rec {
 
   dontUseCmakeBuildDir = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     rsync
-    lua pkg-config
+    lua
     asciidoc libxml2 docbook_xml_dtd_45 docbook_xsl libxslt
   ];
 
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 251c7795132..9e5294c4b00 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
     gettext
     makeWrapper
     wrapGAppsHook
+    pkg-config
   ];
 
   buildInputs = [
@@ -55,7 +56,6 @@ stdenv.mkDerivation rec {
     libofx
     libxml2
     libxslt
-    pkg-config
     swig
     webkitgtk
   ]
diff --git a/pkgs/applications/office/grisbi/default.nix b/pkgs/applications/office/grisbi/default.nix
index ff0d75711cf..81f97b116b0 100644
--- a/pkgs/applications/office/grisbi/default.nix
+++ b/pkgs/applications/office/grisbi/default.nix
@@ -19,12 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vTrbq/xLTfwF7/YtKzZFiiSw8A0HzzWin2ry8gPHej8=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
   buildInputs = [
     gtk
     libgsf
     libofx
-    intltool
     libsoup
     gnome.adwaita-icon-theme
   ];
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index 2a00811a449..17a9cbb5924 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Rg6OjHLkwVIDnXqzqPXA8DxqSdrh2T6V/gLBND8vx9o=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
-  buildInputs = [ gtk libofx intltool libsoup gnome.adwaita-icon-theme ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
+  buildInputs = [ gtk libofx libsoup gnome.adwaita-icon-theme ];
 
   meta = with lib; {
     description = "Free, easy, personal accounting for everyone";
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index c4435ca6269..43a1571b46e 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -555,7 +555,6 @@ in
     openssl
     pam
     perl
-    pkg-config
     poppler
     python3
     sane-backends
diff --git a/pkgs/applications/radio/rtl-ais/default.nix b/pkgs/applications/radio/rtl-ais/default.nix
index c244868f65d..407c18c1a0a 100644
--- a/pkgs/applications/radio/rtl-ais/default.nix
+++ b/pkgs/applications/radio/rtl-ais/default.nix
@@ -3,7 +3,8 @@
 stdenv.mkDerivation {
   pname = "rtl-ais";
   version = "0.8.1";
-  buildInputs = [ pkg-config rtl-sdr libusb1 ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ rtl-sdr libusb1 ];
 
   src = fetchFromGitHub {
     owner = "dgiardini";
diff --git a/pkgs/applications/radio/unixcw/default.nix b/pkgs/applications/radio/unixcw/default.nix
index 0d352609cf0..3fd066ec7b7 100644
--- a/pkgs/applications/radio/unixcw/default.nix
+++ b/pkgs/applications/radio/unixcw/default.nix
@@ -10,7 +10,8 @@ mkDerivation rec {
   patches = [
     ./remove-use-of-dlopen.patch
   ];
-  buildInputs = [ libpulseaudio alsa-lib pkg-config qtbase ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libpulseaudio alsa-lib qtbase ];
   CFLAGS   ="-lasound -lpulse-simple";
 
   meta = with lib; {
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index 59af9a94d96..d47bd418f51 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
   # glib-2.62 deprecations
   NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
-  buildInputs = [ glib pkg-config gtk2 hamlib ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ glib gtk2 hamlib ];
 
   meta = with lib; {
     description = "An amateur radio logging program";
diff --git a/pkgs/applications/science/biology/vcftools/default.nix b/pkgs/applications/science/biology/vcftools/default.nix
index 9f88079627e..a4ec84d4d50 100755
--- a/pkgs/applications/science/biology/vcftools/default.nix
+++ b/pkgs/applications/science/biology/vcftools/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0msb09d2cnm8rlpg8bsc1lhjddvp3kf3i9dsj1qs4qgsdlzhxkyx";
   };
 
-  buildInputs = [ autoreconfHook pkg-config zlib perl ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  buildInputs = [ zlib perl ];
 
   meta = with lib; {
     description = "A set of tools written in Perl and C++ for working with VCF files, such as those generated by the 1000 Genomes Project";
diff --git a/pkgs/applications/science/geometry/drgeo/default.nix b/pkgs/applications/science/geometry/drgeo/default.nix
index 59d7315ef41..0cc8bcb0fb3 100644
--- a/pkgs/applications/science/geometry/drgeo/default.nix
+++ b/pkgs/applications/science/geometry/drgeo/default.nix
@@ -13,8 +13,9 @@ stdenv.mkDerivation rec {
   };
   patches = [ ./struct.patch ];
 
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [libglade gtk2 guile libxml2
-    perl intltool libtool pkg-config];
+    perl libtool ];
 
   prebuild = ''
     cp drgeo.desktop.in drgeo.desktop
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 74f27fa534e..1c8c565528e 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -23,10 +23,11 @@ stdenv.mkDerivation rec {
 
   dontUseImakeConfigure = true;
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     bzip2 gfortran libX11 libXmu libXt libXt libjpeg libpng libtiff ncurses
     pango pcre2 perl readline texLive xz zlib less texinfo graphviz icu
-    pkg-config bison imake which blas lapack curl tcl tk jdk
+    bison imake which blas lapack curl tcl tk jdk
   ] ++ lib.optionals stdenv.isDarwin [ Cocoa Foundation libobjc libcxx ];
 
   patches = [
diff --git a/pkgs/applications/science/math/sage/sage-with-env.nix b/pkgs/applications/science/math/sage/sage-with-env.nix
index 23069f335b8..7632b851773 100644
--- a/pkgs/applications/science/math/sage/sage-with-env.nix
+++ b/pkgs/applications/science/math/sage/sage-with-env.nix
@@ -28,9 +28,9 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 # executable sage. No tests are run yet and no documentation is built.
 
 let
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     pythonEnv # for patchShebangs
-    pkg-config
     blas lapack
     singular
     three
@@ -72,7 +72,7 @@ let
       []
     );
 
-  allInputs = lib.remove null (buildInputs ++ pythonEnv.extraLibs ++ [ makeWrapper ]);
+  allInputs = lib.remove null (nativeBuildInputs ++ buildInputs ++ pythonEnv.extraLibs ++ [ makeWrapper ]);
   transitiveDeps = lib.unique (builtins.concatLists (map transitiveClosure allInputs ));
   # fix differences between spkg and sage names
   # (could patch sage instead, but this is more lightweight and also works for packages depending on sage)
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
   pname = "sage-with-env";
   src = sage-env.lib.src;
 
-  inherit buildInputs;
+  inherit nativeBuildInputs buildInputs;
 
   configurePhase = "#do nothing";
 
diff --git a/pkgs/applications/terminal-emulators/mrxvt/default.nix b/pkgs/applications/terminal-emulators/mrxvt/default.nix
index 006616bd944..b05872b11e4 100644
--- a/pkgs/applications/terminal-emulators/mrxvt/default.nix
+++ b/pkgs/applications/terminal-emulators/mrxvt/default.nix
@@ -22,7 +22,8 @@ stdenv.mkDerivation rec {
     sha256 = "1mqhmnlz32lvld9rc6c1hyz7gjw4anwf39yhbsjkikcgj1das0zl";
   };
 
-  buildInputs = [ libX11 libXft libXi xorgproto libSM libICE freetype pkg-config which ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libX11 libXft libXi xorgproto libSM libICE freetype which ];
 
   configureFlags = [
     "--with-x"
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
index 0eccceb5a4f..ede0638e7a0 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@@ -44,9 +44,10 @@ stdenv.mkDerivation {
     sha256 = "0badnkjsn3zps24r5iggj8k5v4f00npc77wqg92pcn1q5z8r677y";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
     [ libX11 libXt libXft ncurses  # required to build the terminfo file
-      fontconfig freetype pkg-config libXrender
+      fontconfig freetype libXrender
       libptytty
     ] ++ optional perlSupport perl
       ++ optional gdkPixbufSupport gdk-pixbuf;
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 95327f31ddc..9b2c755b109 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '';
 
-  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
+  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper pkg-config ]
     ++ lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
          docbook_xsl docbook_xml_dtd_45 libxslt ];
   buildInputs = [ curl openssl zlib expat cpio libiconv bash ]
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
     ++ lib.optionals stdenv.isDarwin [ Security CoreServices ]
-    ++ lib.optionals withLibsecret [ pkg-config glib libsecret ];
+    ++ lib.optionals withLibsecret [ glib libsecret ];
 
   # required to support pthread_cancel()
   NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && stdenv.hostPlatform.libc == "glibc") "-lgcc_s"
@@ -252,7 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
       '')
 
    + lib.optionalString withManual ''# Install man pages
-       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
+       make -j $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
          -C Documentation ''
 
    + (if guiSupport then ''
diff --git a/pkgs/applications/video/byzanz/default.nix b/pkgs/applications/video/byzanz/default.nix
index 5e60bb7fd90..d7ad9846306 100644
--- a/pkgs/applications/video/byzanz/default.nix
+++ b/pkgs/applications/video/byzanz/default.nix
@@ -34,12 +34,11 @@ stdenv.mkDerivation {
     "-Wno-error=incompatible-pointer-types"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
     which
     gnome.gnome-common
     glib
-    intltool
     libtool
     cairo
     gtk3
diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix
index cde71d2b87f..234d72e4682 100644
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@@ -66,9 +66,9 @@ stdenv.mkDerivation (rec {
 
   hardeningDisable = [ "stackprotector" "fortify" "pic" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [
-    cmake which
+    which
 
     # Xen
     bison bzip2 checkpolicy dev86 figlet flex gettext glib acpica-tools libaio
diff --git a/pkgs/applications/window-managers/fbpanel/default.nix b/pkgs/applications/window-managers/fbpanel/default.nix
index 33a313eb8ee..6dc22a664d3 100644
--- a/pkgs/applications/window-managers/fbpanel/default.nix
+++ b/pkgs/applications/window-managers/fbpanel/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/fbpanel/${pname}-${version}.tbz2";
     sha256 = "e14542cc81ea06e64dd4708546f5fd3f5e01884c3e4617885c7ef22af8cf3965";
   };
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config libX11 libXmu libXpm gtk2 libpng libjpeg libtiff librsvg gdk-pixbuf gdk-pixbuf-xlib.dev ];
+    [ libX11 libXmu libXpm gtk2 libpng libjpeg libtiff librsvg gdk-pixbuf gdk-pixbuf-xlib.dev ];
 
   preConfigure = "patchShebangs .";
 
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 83b6817798f..78759f2cfbb 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -122,6 +122,31 @@ fi
 
 if [[ "$isCxx" = 1 ]]; then
     if [[ "$cxxInclude" = 1 ]]; then
+        #
+        # The motivation for this comment is to explain the reason for appending
+        # the C++ stdlib to NIX_CFLAGS_COMPILE, which I initially thought should
+        # change and later realized it shouldn't in:
+        #
+        #   https://github.com/NixOS/nixpkgs/pull/185569#issuecomment-1234959249
+        #
+        # NIX_CFLAGS_COMPILE contains dependencies added using "-isystem", and
+        # NIX_CXXSTDLIB_COMPILE adds the C++ stdlib using "-isystem". Appending
+        # NIX_CXXSTDLIB_COMPILE to NIX_CLAGS_COMPILE emulates this part of the
+        # include lookup order from GCC/Clang:
+        #
+        # > 4. Directories specified with -isystem options are scanned in
+        # >    left-to-right order.
+        # > 5. Standard system directories are scanned.
+        # > 6. Directories specified with -idirafter options are scanned
+        # >    in left-to-right order.
+        #
+        # NIX_CXX_STDLIB_COMPILE acts as the "standard system directories" that
+        # are otherwise missing from CC in nixpkgs, so should be added last.
+        #
+        # This means that the C standard library should never be present inside
+        # NIX_CFLAGS_COMPILE, because it MUST come after the C++ stdlib. It is
+        # added automatically by cc-wrapper later using "-idirafter".
+        #
         NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
     fi
     if [[ "$cxxLibrary" = 1 ]]; then
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index db0d2c53bb1..40ae5ece112 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -128,7 +128,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
   ];
 
   buildInputs = buildInputs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ]
     ++ lib.optionals stdenv.hostPlatform.isMinGW [ windows.pthreads ];
 
   patches = cargoPatches ++ patches;
diff --git a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
index 842e66b5170..b85796e2a41 100644
--- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@@ -7,23 +7,23 @@ cargoSetupPostUnpackHook() {
     # this for us automatically.
     if [ -z $cargoVendorDir ]; then
         unpackFile "$cargoDeps"
-        export cargoDepsCopy=$(stripHash $cargoDeps)
+        export cargoDepsCopy="$(realpath "$(stripHash $cargoDeps)")"
     else
-      cargoDepsCopy="$sourceRoot/${cargoRoot:+$cargoRoot/}${cargoVendorDir}"
+        cargoDepsCopy="$(realpath "$(pwd)/$sourceRoot/${cargoRoot:+$cargoRoot/}${cargoVendorDir}")"
     fi
 
     if [ ! -d .cargo ]; then
         mkdir .cargo
     fi
 
-    config="$(pwd)/$cargoDepsCopy/.cargo/config";
+    config="$cargoDepsCopy/.cargo/config";
     if [[ ! -e $config ]]; then
       config=@defaultConfig@
     fi;
 
     tmp_config=$(mktemp)
     substitute $config $tmp_config \
-      --subst-var-by vendor "$(pwd)/$cargoDepsCopy"
+      --subst-var-by vendor "$cargoDepsCopy"
     cat ${tmp_config} >> .cargo/config
 
     cat >> .cargo/config <<'EOF'
@@ -39,8 +39,8 @@ EOF
 cargoSetupPostPatchHook() {
     echo "Executing cargoSetupPostPatchHook"
 
-    cargoDepsLockfile="$NIX_BUILD_TOP/$cargoDepsCopy/Cargo.lock"
-    srcLockfile="$NIX_BUILD_TOP/$sourceRoot/${cargoRoot:+$cargoRoot/}/Cargo.lock"
+    cargoDepsLockfile="$cargoDepsCopy/Cargo.lock"
+    srcLockfile="$(pwd)/${cargoRoot:+$cargoRoot/}Cargo.lock"
 
     echo "Validating consistency between $srcLockfile and $cargoDepsLockfile"
     if ! @diff@ $srcLockfile $cargoDepsLockfile; then
diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index 9f52a05f61c..c9b03b75cd0 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -16,12 +16,14 @@ makeSetupHook {
 
   substitutions = {
     cc = "${cc}/bin/${cc.targetPrefix}cc ${lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)}";
+  };
 
+  passthru = {
     # Extract the function call used to create a binary wrapper from its embedded docstring
-    passthru.extractCmd = writeShellScript "extract-binary-wrapper-cmd" ''
+    extractCmd = writeShellScript "extract-binary-wrapper-cmd" ''
       strings -dw "$1" | sed -n '/^makeCWrapper/,/^$/ p'
     '';
 
-    passthru.tests = tests.makeBinaryWrapper;
+    tests = tests.makeBinaryWrapper;
   };
 } ./make-binary-wrapper.sh
diff --git a/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix b/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
index d0031c93c10..e9e77b0bbe6 100644
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
@@ -1,9 +1,8 @@
 { callPackage, makeSetupHook }:
 
-(makeSetupHook {
+makeSetupHook {
   name = "postgresql-test-hook";
-} ./postgresql-test-hook.sh).overrideAttrs (o: {
   passthru.tests = {
     simple = callPackage ./test.nix { };
   };
-})
+} ./postgresql-test-hook.sh
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
index d7699b2557f..5ef61383885 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@@ -13,6 +13,7 @@
 }:
 
 makeSetupHook {
+  name = "wrap-gapps-hook";
   deps = lib.optionals (!stdenv.isDarwin) [
     # It is highly probable that a program will use GSettings,
     # at minimum through GTK file chooser dialogue.
@@ -36,8 +37,8 @@ makeSetupHook {
     # We use the wrapProgram function.
     makeWrapper
   ];
-  substitutions = {
-    passthru.tests = let
+  passthru = {
+    tests = let
       sample-project = ./tests/sample-project;
 
       testLib = callPackage ./tests/lib.nix { };
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index e73cb9c5dec..a8c291b8232 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -1,5 +1,12 @@
 { lib, stdenv, stdenvNoCC, lndir, runtimeShell, shellcheck }:
 
+let
+  inherit (lib)
+    optionalAttrs
+    warn
+    ;
+in
+
 rec {
 
   /* Run the shell command `buildCommand' to produce a store path named
@@ -525,12 +532,25 @@ rec {
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
    *                 meta.platforms = lib.platforms.linux;
    *               } ./myscript.sh;
+   *
+   * # setup hook with a package test
+   * myhellohookTested = makeSetupHook {
+   *                 deps = [ hello ];
+   *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
+   *                 meta.platforms = lib.platforms.linux;
+   *                 passthru.tests.greeting = callPackage ./test { };
+   *               } ./myscript.sh;
    */
-  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {} }: script:
+  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {}, passthru ? {} }: script:
     runCommand name
       (substitutions // {
         inherit meta;
         strictDeps = true;
+        # TODO 2023-01, no backport: simplify to inherit passthru;
+        passthru = passthru
+          // optionalAttrs (substitutions?passthru)
+            (warn "makeSetupHook (name = ${lib.strings.escapeNixString name}): `substitutions.passthru` is deprecated. Please set `passthru` directly."
+              substitutions.passthru);
       })
       (''
         mkdir -p $out/nix-support
diff --git a/pkgs/data/icons/tango-icon-theme/default.nix b/pkgs/data/icons/tango-icon-theme/default.nix
index 9e6b0666a11..18676018eff 100644
--- a/pkgs/data/icons/tango-icon-theme/default.nix
+++ b/pkgs/data/icons/tango-icon-theme/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./rsvg-convert.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool iconnamingutils imagemagick librsvg ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ iconnamingutils imagemagick librsvg ];
   propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
   # still missing parent icon themes: cristalsvg
 
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 0ed4f95f8cf..a4739edea12 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.80";
+  srcVersion = "3.83";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -35,7 +35,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "sha256-wL8f0sfimmsCswliK6r8RD7skMiTS7FV2ku5iYh4S2o=";
+      sha256 = "sha256-qyPqZ/lkCQuLc8gKZ0CCVxw25fTrqSBXrGSMnB3vASg=";
     };
 
     dontBuild = true;
diff --git a/pkgs/data/misc/ddccontrol-db/default.nix b/pkgs/data/misc/ddccontrol-db/default.nix
index efec5c73ba2..3d91a4e7e72 100644
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@@ -21,11 +21,10 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake intltool ];
   buildInputs =
     [
       libtool
-      intltool
     ];
 
   meta = with lib; {
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index 6f90669b819..19331f458de 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,10 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20220520";
+  version = "20220915";
+
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-LSrfNb4fUJEGSPJ+StlAbTE9LbOPDrRJLKTDSkuyoZQ=";
+    sha256 = "sha256-gBaM5YEK2XA42S7ELwjQChie/wYgo6n8dt2WEg3Pdns=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 1a6cba44ef8..41004243a55 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2022c";
+  version = "2022d";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-aXT040i/IyMnS1bf+edQAkfjFZ6qS0hd+gzWbnXBS/4=";
+      hash = "sha256-bs2+4n+kPc+knz1P2Lsd/vVMkNoavNgsmrzy3E8yHeA=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-Pnzh82IMwEgZB8fgdNaZEHkyhb/+DKMx7xptGuPqkMw=";
+      hash = "sha256-1kS6D5OImTdOqMtVTjX7SvoPe9e3FsYXd80AUAuHWeA=";
     })
   ];
 
diff --git a/pkgs/desktops/cinnamon/cinnamon-common/default.nix b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
index d477b012261..69c687912e0 100644
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -102,7 +102,6 @@ stdenv.mkDerivation rec {
     libXdamage
     muffin
     networkmanager
-    pkg-config
     polkit
     libxml2
     libgnomekbd
@@ -134,6 +133,7 @@ stdenv.mkDerivation rec {
     gtk-doc
     perl
     python3.pkgs.wrapPython
+    pkg-config
   ];
 
   # use locales from cinnamon-translations (not using --localedir because datadir is used)
diff --git a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
index 34dfaa85b2f..df63449c2f6 100644
--- a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
@@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ] ++ lib.optionals stdenv.isDarwin [ autoreconfHook ];
   buildInputs = [
     atk cairo glib gtk2
-    pango libxml2Python perl intltool
+    pango libxml2Python perl
     gettext
   ] ++ optionals stdenv.isDarwin [
-    autoreconfHook gnome-common gtk-mac-integration-gtk2
+    gnome-common gtk-mac-integration-gtk2
   ];
 
   preConfigure = optionalString stdenv.isDarwin ''
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
index 580d0a8cc82..72422cf41c3 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
@@ -25,6 +25,6 @@ stdenv.mkDerivation rec {
   ];
 
   propagatedBuildInputs = [ gsettings-desktop-schemas gtk3 gnome-icon-theme GConf ];
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool enchant isocodes autoreconfHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook intltool ];
+  buildInputs = [ enchant isocodes ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
index 4f4e0503f81..206494e7022 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
   #http://www.mail-archive.com/debian-bugs-rc@lists.debian.org/msg250091.html
   patches = [ ./01_remove-disable-deprecated.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 intltool GConf enchant isocodes gnome-icon-theme ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 GConf enchant isocodes gnome-icon-theme ];
 
   NIX_LDFLAGS = "-lgthread-2.0";
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnome/default.nix b/pkgs/desktops/gnome-2/platform/libgnome/default.nix
index 2c70338a900..56145980a5d 100644
--- a/pkgs/desktops/gnome-2/platform/libgnome/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnome/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ popt zlib intltool GConf gnome_vfs libcanberra-gtk2 libtool ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ popt zlib GConf gnome_vfs libcanberra-gtk2 libtool ];
   propagatedBuildInputs = [ glib libbonobo libogg ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix b/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
index 42de8c2471a..8d6bcce6020 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./glib.patch ./cups_1.6.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libart_lgpl ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libart_lgpl ];
 
   propagatedBuildInputs = [ libxml2 ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix b/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
index bb2e435f422..5f7a254c8fb 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libart_lgpl libgnomecups bison flex ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libart_lgpl libgnomecups bison flex ];
 
   propagatedBuildInputs = [ libxml2 ];
 
diff --git a/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix b/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
index a95ee70bca1..f8a647a5b5a 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
@@ -9,6 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "0spl8vinb5n6n1krnfnr61dwaxidg67h8j94z9p59k2xdsvfashm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libgnomecanvas libgnomeprint gnome-icon-theme];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libgnomecanvas libgnomeprint gnome-icon-theme];
 }
diff --git a/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix b/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
index ca9b8f7fb81..e2f556c4869 100644
--- a/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
+++ b/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript { packageName = "gnome-devel-docs"; attrPath = "gnome.gnome-devel-docs"; };
   };
 
-  buildInputs = [ intltool itstool libxml2 ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ itstool libxml2 ];
 
   meta = with lib; {
     homepage = "https://github.com/GNOME/gnome-devel-docs";
diff --git a/pkgs/desktops/gnome/misc/gtkhtml/default.nix b/pkgs/desktops/gnome/misc/gtkhtml/default.nix
index 88fb31c4333..f4454e15bb9 100644
--- a/pkgs/desktops/gnome/misc/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome/misc/gtkhtml/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript { packageName = "gtkhtml"; attrPath = "gnome.gtkhtml"; };
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk3 intltool gnome.adwaita-icon-theme
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk3 gnome.adwaita-icon-theme
                   gsettings-desktop-schemas ];
 
   propagatedBuildInputs = [ enchant isocodes ];
diff --git a/pkgs/desktops/lxde/core/lxmenu-data/default.nix b/pkgs/desktops/lxde/core/lxmenu-data/default.nix
index e52445aa0b0..fc00c4cdad1 100644
--- a/pkgs/desktops/lxde/core/lxmenu-data/default.nix
+++ b/pkgs/desktops/lxde/core/lxmenu-data/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "9fe3218d2ef50b91190162f4f923d6524c364849f87bcda8b4ed8eb59b80bab8";
   };
 
-  buildInputs = [ intltool ];
+  nativeBuildInputs = [ intltool ];
 
   meta = {
     homepage = "https://lxde.org/";
diff --git a/pkgs/development/compilers/gerbil/gerbil-crypto.nix b/pkgs/development/compilers/gerbil/gerbil-crypto.nix
index 12f4726f1c6..38943471a37 100644
--- a/pkgs/development/compilers/gerbil/gerbil-crypto.nix
+++ b/pkgs/development/compilers/gerbil/gerbil-crypto.nix
@@ -7,7 +7,8 @@ gerbil-support.gerbilPackage {
   gerbil-package = "clan/crypto";
   gerbil = gerbil-unstable;
   gerbilInputs = [gerbil-support.gerbilPackages-unstable.gerbil-utils];
-  buildInputs = [pkgs.secp256k1 pkgs.pkg-config];
+  nativeBuildInputs = [ pkgs.pkg-config ];
+  buildInputs = [pkgs.secp256k1 ];
   gambit-params = gambit-support.unstable-params;
   version-path = "version";
   softwareName = "Gerbil-crypto";
diff --git a/pkgs/development/compilers/gerbil/gerbil-support.nix b/pkgs/development/compilers/gerbil/gerbil-support.nix
index 9cb9954544c..f51076fd5d4 100644
--- a/pkgs/development/compilers/gerbil/gerbil-support.nix
+++ b/pkgs/development/compilers/gerbil/gerbil-support.nix
@@ -24,12 +24,13 @@ rec {
     gerbil ? pkgs.gerbil-unstable,
     gambit-params ? pkgs.gambit-support.stable-params,
     gerbilInputs ? [],
+    nativeBuildInputs ? [],
     buildInputs ? [],
     buildScript ? "./build.ss",
     softwareName ? ""} :
     let buildInputs_ = buildInputs; in
     gccStdenv.mkDerivation rec {
-      inherit src meta pname version;
+      inherit src meta pname version nativeBuildInputs;
       passthru = { inherit gerbil-package version-path ;};
       buildInputs = [ gerbil ] ++ gerbilInputs ++ buildInputs_;
       postPatch = ''
diff --git a/pkgs/development/compilers/polyml/5.6.nix b/pkgs/development/compilers/polyml/5.6.nix
index 4354ce7e2d6..bcd52380701 100644
--- a/pkgs/development/compilers/polyml/5.6.nix
+++ b/pkgs/development/compilers/polyml/5.6.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  buildInputs = lib.optional stdenv.isDarwin autoreconfHook;
+  nativeBuildInputs = lib.optional stdenv.isDarwin autoreconfHook;
 
   src = fetchurl {
     url = "mirror://sourceforge/polyml/polyml.${version}.tar.gz";
diff --git a/pkgs/development/compilers/rust/1_63.nix b/pkgs/development/compilers/rust/1_64.nix
index a33576f9426..f93123fcd70 100644
--- a/pkgs/development/compilers/rust/1_63.nix
+++ b/pkgs/development/compilers/rust/1_64.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.63.0";
-  rustcSha256 = "1l4rrbzhxv88pnfq94nbyb9m6lfnjwixma3mwjkmvvs2aqlq158z";
+  rustcVersion = "1.64.0";
+  rustcSha256 = "sha256-s82fSB4aKQG/bzgI0wxpzE6oDZPEzE4u1SJYsYA4EgU=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
@@ -37,25 +37,25 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.62.1";
+  bootstrapVersion = "1.63.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "1669163ffe01e252ffb62da7d84949378fc274931a65ac827d54059a5ffc542c";
-    x86_64-unknown-linux-gnu = "dd7d82b8fa8eae59729e1c31fe59a9de6ee61d08ab40ce016185653beebe04d2";
-    x86_64-unknown-linux-musl = "32bee487074b105e2582cddce35934a6019eec74bae3f9300fdc3edfcf5b66d4";
-    arm-unknown-linux-gnueabihf = "5c735e8174d394936d7b499c2d147ddadf3c4d77e652d1e0b0a72d9d09f81ea4";
-    armv7-unknown-linux-gnueabihf = "26fa731385f1a71211ba8e3c94f3bb3b1a82bde89f8d4dcf75b4b463b57b0f88";
-    aarch64-unknown-linux-gnu = "1311fa8204f895d054c23a3481de3b158a5cd3b3a6338761fee9cdf4dbf075a5";
-    aarch64-unknown-linux-musl = "73bbab4d8a9e3c416035d40406e656ab37e785df35fa069a33af52e931a24b12";
-    x86_64-apple-darwin = "0a04dcf2b521239826f3eaa66d77169d91e68087ccc3107b54e8aba7c02c9adf";
-    aarch64-apple-darwin = "6d1671ea31b05cab5e2587cc2b295b3e7232b0135f0977355618e2a01933ff0a";
-    powerpc64le-unknown-linux-gnu = "1d3248e1a673cda87cf443cd4334ff5fb53e6f87c72d3587b07e5c0cb507f3ae";
-    riscv64gc-unknown-linux-gnu = "fd378d0bf866689e8111aba0e2b020da87f32f70fb11d98a575d42dc05978c2a";
-    mips64el-unknown-linux-gnuabi64 = "b7c47dd94728161aa96762fb7bc51b6ab0feba7c5215d06eaea5b78649815a96";
+    i686-unknown-linux-gnu = "6ac6ca18f119e099749d67c6dc25ce3f70542b43cc05062d5138fc1052e44c54";
+    x86_64-unknown-linux-gnu = "536bcf16807a4ff49b7b29af6e573a2f1821055bfad72c275c60e56edc693984";
+    x86_64-unknown-linux-musl = "4516f1fa2a0d9ec9176cc734e5faaa0a3d439bd49f75553a484b6c3c6d7905ab";
+    arm-unknown-linux-gnueabihf = "8847d8482e1d5ec962e092a63c95618dc7e17a079a9bf58bec1da39cac0ba4ce";
+    armv7-unknown-linux-gnueabihf = "d9227bf6d93f49889c698d35adc7ab3e042988740b9d9d9c81fb54fc0f854474";
+    aarch64-unknown-linux-gnu = "26745b57500da293a8147122a5998926301350a610c164f053107cbe026d3a51";
+    aarch64-unknown-linux-musl = "8fee65f2bd7e010259763939cbef8ed0794773ec8959c5ef90273cf39dcba180";
+    x86_64-apple-darwin = "37f76a45b8616e764c2663850758ce822c730e96af60168a46b818f528c1467d";
+    aarch64-apple-darwin = "25c3f43459da9b8683292999c3522d88980b0ca3244fe830f5a87a8092aac5a6";
+    powerpc64le-unknown-linux-gnu = "781662048caa48b78540c2fb22f0aa7c06d6d8e81aede0f6ef900c11428056cf";
+    riscv64gc-unknown-linux-gnu = "a7f398b45229c5cca833f75421c32897174e365fbbdf78e19b87612736c918aa";
+    mips64el-unknown-linux-gnuabi64 = "19f04c576c9d6b171acba65cfe44edcbcf6134a75a853d2f1538fdb2128ec654";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_63;
+  selectRustPackage = pkgs: pkgs.rust_1_64;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 01b21971438..6a4d01de5ef 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, cacert, rustPlatform, rustc
-, CoreFoundation, Security
+, libiconv, CoreFoundation, Security
 }:
 
 rustPlatform.buildRustPackage {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage {
     (lib.getDev pkgsHostHost.curl)
   ];
   buildInputs = [ cacert file curl python3 openssl zlib ]
-    ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
+    ++ lib.optionals stdenv.isDarwin [ libiconv CoreFoundation Security ];
 
   # cargo uses git-rs which is made for a version of libgit2 from recent master that
   # is not compatible with the current version in nixpkgs.
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index bb5bc1bb1d7..60ee42d4649 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -145,9 +145,11 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openssl ]
-    ++ optionals stdenv.isDarwin [ libiconv Security ]
+    ++ optionals stdenv.isDarwin [ Security ]
     ++ optional (!withBundledLLVM) llvmShared;
 
+  depsTargetTargetPropagated = optionals stdenv.isDarwin [ libiconv ];
+
   outputs = [ "out" "man" "doc" ];
   setOutputFlags = false;
 
diff --git a/pkgs/development/embedded/blackmagic/helper.sh b/pkgs/development/embedded/blackmagic/helper.sh
index bae57f633cf..9185253b39d 100755
--- a/pkgs/development/embedded/blackmagic/helper.sh
+++ b/pkgs/development/embedded/blackmagic/helper.sh
@@ -11,7 +11,7 @@ out=${out:-/tmp}
 ################################################################################
 export CFLAGS=$NIX_CFLAGS_COMPILE
 export MAKEFLAGS="\
-  ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}"
+  ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}"
 
 ################################################################################
 PRODUCTS="blackmagic.bin blackmagic.hex blackmagic_dfu.bin blackmagic_dfu.hex"
diff --git a/pkgs/development/interpreters/io/default.nix b/pkgs/development/interpreters/io/default.nix
index 9f6ecb2516e..0777fb8d48b 100644
--- a/pkgs/development/interpreters/io/default.nix
+++ b/pkgs/development/interpreters/io/default.nix
@@ -24,13 +24,14 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
+    pkg-config
   ];
 
   buildInputs = [
     zlib sqlite gmp libffi cairo ncurses freetype
     libGLU libGL libpng libtiff libjpeg readline libsndfile libxml2
     freeglut libsamplerate pcre libevent libedit yajl
-    pkg-config glfw openssl libpthreadstubs libXdmcp
+    glfw openssl libpthreadstubs libXdmcp
     libmemcached python3
   ];
 
diff --git a/pkgs/development/interpreters/qnial/default.nix b/pkgs/development/interpreters/qnial/default.nix
index 1173315192e..74360daa876 100644
--- a/pkgs/development/interpreters/qnial/default.nix
+++ b/pkgs/development/interpreters/qnial/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     owner = "vrthra";
   };
 
-  nativeBuildInputs = [ makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper unzip pkg-config ];
 
   preConfigure = ''
     cd build;
@@ -25,7 +25,6 @@ stdenv.mkDerivation {
   '';
 
   buildInputs = [
-     pkg-config
      ncurses
   ];
 
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index f73c5746cb7..9900d8874b2 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -59,13 +59,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.0.22";
+  version = "2.24.0";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-/ny/MSeILj/HJZp1oMtYViAnLFF0XThSq53YeWBpfy4=";
+    sha256 = "sha256-keTDSxdo+S05mweOFxRIxq8Yyv2nQ5h+0gZKKJVNbZc=";
   };
-  dontDisableStatic = withStatic;
+  dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
   outputBin = "dev"; # sdl-config
 
diff --git a/pkgs/development/libraries/SDL2/find-headers.patch b/pkgs/development/libraries/SDL2/find-headers.patch
index 4792679deb1..8739da91eac 100644
--- a/pkgs/development/libraries/SDL2/find-headers.patch
+++ b/pkgs/development/libraries/SDL2/find-headers.patch
@@ -1,22 +1,23 @@
 diff --git a/sdl2-config.cmake.in b/sdl2-config.cmake.in
-index c570511fa..ca694f595 100644
+index db864aab9..b94e16043 100644
 --- a/sdl2-config.cmake.in
 +++ b/sdl2-config.cmake.in
-@@ -7,7 +7,8 @@ set(includedir "@includedir@")
- set(SDL2_PREFIX "${prefix}")
- set(SDL2_EXEC_PREFIX "${exec_prefix}")
- set(SDL2_LIBDIR "${libdir}")
--set(SDL2_INCLUDE_DIRS "${includedir}/SDL2")
-+set(SDL2_INCLUDE_DIRS "${includedir}/SDL2" $ENV{SDL2_PATH})
+@@ -26,7 +26,9 @@ set_and_check(SDL2_EXEC_PREFIX    "${exec_prefix}")
+ set_and_check(SDL2_BINDIR         "${bindir}")
+ set_and_check(SDL2_INCLUDE_DIR    "${includedir}/SDL2")
+ set_and_check(SDL2_LIBDIR         "${libdir}")
+-set(SDL2_INCLUDE_DIRS             "${includedir};${SDL2_INCLUDE_DIR}")
++
++set(SDL2_INCLUDE_DIRS "${includedir};${SDL2_INCLUDE_DIR}" $ENV{SDL2_PATH})
 +separate_arguments(SDL2_INCLUDE_DIRS)
- set(SDL2_LIBRARIES "-L${SDL2_LIBDIR} @SDL_RLD_FLAGS@ @SDL_LIBS@")
- string(STRIP "${SDL2_LIBRARIES}" SDL2_LIBRARIES)
  
+ set(SDL2_LIBRARIES SDL2::SDL2)
+ set(SDL2_STATIC_LIBRARIES SDL2::SDL2-static)
 diff --git a/sdl2-config.in b/sdl2-config.in
-index 5a2aed292..7c55f0a28 100644
+index f6eca7668..c0cd94590 100644
 --- a/sdl2-config.in
 +++ b/sdl2-config.in
-@@ -42,7 +42,11 @@ while test $# -gt 0; do
+@@ -46,7 +46,11 @@ while test $# -gt 0; do
        echo @SDL_VERSION@
        ;;
      --cflags)
@@ -29,6 +30,3 @@ index 5a2aed292..7c55f0a28 100644
        ;;
  @ENABLE_SHARED_TRUE@    --libs)
  @ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@
--- 
-2.33.1
-
diff --git a/pkgs/development/libraries/SDL2_mixer/default.nix b/pkgs/development/libraries/SDL2_mixer/default.nix
index 2d1ef985381..7e562dddf0f 100644
--- a/pkgs/development/libraries/SDL2_mixer/default.nix
+++ b/pkgs/development/libraries/SDL2_mixer/default.nix
@@ -47,6 +47,8 @@ stdenv.mkDerivation rec {
     timidity
   ];
 
+  outputs = [ "out" "dev" ];
+
   # fix default path to timidity.cfg so MIDI files could be played
   postPatch = ''
     substituteInPlace timidity/options.h \
diff --git a/pkgs/development/libraries/allegro/5.nix b/pkgs/development/libraries/allegro/5.nix
index 6bb1a70b865..0ff8f0ea7fc 100644
--- a/pkgs/development/libraries/allegro/5.nix
+++ b/pkgs/development/libraries/allegro/5.nix
@@ -18,14 +18,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-uNcaeTelFNfg+YjPYc7nK4TrFDxJsEuPhsF8x1cvIYQ=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     texinfo libXext xorgproto libX11 libXpm libXt libXcursor
     alsa-lib zlib libpng libvorbis libXxf86dga libXxf86misc
     libXxf86vm openal libGLU libGL
     libjpeg flac
     libXi libXfixes
-    enet libtheora freetype physfs libopus pkg-config gtk3 pcre libXdmcp
+    enet libtheora freetype physfs libopus gtk3 pcre libXdmcp
     libpulseaudio libpthreadstubs
   ];
 
diff --git a/pkgs/development/libraries/apr-util/default.nix b/pkgs/development/libraries/apr-util/default.nix
index b9756e0e1a1..6f38bfa0d07 100644
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@@ -26,8 +26,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = optional stdenv.isFreeBSD autoreconfHook;
+  nativeBuildInputs = [ makeWrapper ] ++ optional stdenv.isFreeBSD autoreconfHook;
 
   configureFlags = [ "--with-apr=${apr.dev}" "--with-expat=${expat.dev}" ]
     ++ optional (!stdenv.isCygwin) "--with-crypto"
diff --git a/pkgs/development/libraries/dssi/default.nix b/pkgs/development/libraries/dssi/default.nix
index 4f7891910a7..697ff1a857b 100644
--- a/pkgs/development/libraries/dssi/default.nix
+++ b/pkgs/development/libraries/dssi/default.nix
@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "0kl1hzhb7cykzkrqcqgq1dk4xcgrcxv0jja251aq4z4l783jpj7j";
   };
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs =
     [ ladspaH libjack2 liblo alsa-lib qt4 libX11 libsndfile libSM
-      libsamplerate libtool xorgproto libICE pkg-config
+      libsamplerate libtool xorgproto libICE
     ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index f20abe0bfc3..71841e0cfbc 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "expat";
-  version = "2.4.8";
+  version = "2.4.9";
 
   src = fetchurl {
     url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-95uPkEt0nj4NIK/q3s+CScVbLjLU67CJrjeN9HncryU=";
+    sha256 = "sha256-bowHKP5cfNP5OmrM5DBGxeRzbHtLaOAy6TUNqg78A1Q=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 9e7dcfd751c..b518b7527ac 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,4 +1,4 @@
-{ callPackage
+{ callPackage, fetchpatch
 # Darwin frameworks
 , Cocoa, CoreMedia, VideoToolbox
 , stdenv, lib
@@ -10,4 +10,11 @@ callPackage ./generic.nix (rec {
   branch = version;
   sha256 = "sha256-+YpIJSDEdQdSGpB5FNqp77wThOBZG1r8PaGKqJfeKUg=";
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
+  patches = [
+    #  sdl2 recently changed their versioning
+    (fetchpatch {
+      url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
+      hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
+    })
+  ];
 } // args)
diff --git a/pkgs/development/libraries/frame/default.nix b/pkgs/development/libraries/frame/default.nix
index e96aa9394da..f0b37b7e633 100644
--- a/pkgs/development/libraries/frame/default.nix
+++ b/pkgs/development/libraries/frame/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "bc2a20cd3ac1e61fe0461bd3ee8cb250dbcc1fa511fad0686d267744e9c78f3a";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    stdenv pkg-config
+    stdenv
   ] ++ lib.optionals enableX11 [xorg.xorgserver xorg.libX11 xorg.libXext xorg.libXi];
 
   configureFlags = lib.optional enableX11 "--with-x11";
diff --git a/pkgs/development/libraries/ggz_base_libs/default.nix b/pkgs/development/libraries/ggz_base_libs/default.nix
index 687b74fdb3a..162a64eeb5d 100644
--- a/pkgs/development/libraries/ggz_base_libs/default.nix
+++ b/pkgs/development/libraries/ggz_base_libs/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1cw1vg0fbj36zyggnzidx9cbjwfc1yr4zqmsipxnvns7xa2awbdk";
   };
 
-  buildInputs = [ intltool openssl expat libgcrypt ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ openssl expat libgcrypt ];
 
   patchPhase = ''
     substituteInPlace configure \
diff --git a/pkgs/development/libraries/glew/1.10.nix b/pkgs/development/libraries/glew/1.10.nix
index ab2e740cd86..dadab6e610f 100644
--- a/pkgs/development/libraries/glew/1.10.nix
+++ b/pkgs/development/libraries/glew/1.10.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
   buildInputs = if stdenv.isDarwin then [ AGL ] else [ xlibsWrapper libXmu libXi ];
   propagatedBuildInputs = if stdenv.isDarwin then [ OpenGL ] else [ libGLU ]; # GL/glew.h includes GL/glu.h
 
+  outputs = [ "out" "dev" ];
+
   patchPhase = ''
     sed -i 's|lib64|lib|' config/Makefile.linux
     ${optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@@ -32,8 +34,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     mkdir -pv $out/share/doc/glew
-    mkdir -p $out/lib/pkgconfig
-    cp glew*.pc $out/lib/pkgconfig
+    mkdir -p $dev/lib/pkgconfig
+    cp glew*.pc $dev/lib/pkgconfig
     cp -r README.txt LICENSE.txt doc $out/share/doc/glew
   '';
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 942231ebb3e..c6da42738c6 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -96,6 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://gitlab.gnome.org/qyliss/glib/-/commit/339a06d66685107280ca6bdca5da5d96b8222fb5.patch";
       sha256 = "sha256-/NdFkuiJvyass3jTDEJPeciA2Lwe53IUd3kAnKAvTaw=";
     })
+    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
+    ./tests-skip-shared-libs-if-default_library-static.patch
 
     ./skip-timer-test.patch
   ];
diff --git a/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch b/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
new file mode 100644
index 00000000000..681e361896e
--- /dev/null
+++ b/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
@@ -0,0 +1,141 @@
+From b804e4b82cd8e85631112d935543c62ef56783e5 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Tue, 23 Aug 2022 13:13:44 +0000
+Subject: [PATCH] tests: skip shared libs if default_library=static
+
+Otherwise, the build will fail when the toolchain is static-only, even
+with -Ddefault_library=static.  I talked to a Meson developer in their
+IRC channel, who told me that the correct fix was to ensure that
+shared_library is only used if default_library != static.
+
+Part-of: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
+[Backported to 2.72.3]
+---
+ gio/tests/meson.build  | 43 +++++++++++++++++++++++-------------------
+ glib/tests/meson.build |  2 +-
+ tests/meson.build      | 30 +++++++++++++++--------------
+ 3 files changed, 41 insertions(+), 34 deletions(-)
+
+diff --git a/gio/tests/meson.build b/gio/tests/meson.build
+index 3ed23a5f2..7b1aba80d 100644
+--- a/gio/tests/meson.build
++++ b/gio/tests/meson.build
+@@ -203,7 +203,7 @@ if host_machine.system() != 'windows'
+   }
+ 
+   # LD_PRELOAD modules don't work so well with AddressSanitizer
+-  if have_rtld_next and get_option('b_sanitize') == 'none'
++  if have_rtld_next and get_option('default_library') != 'static' and get_option('b_sanitize') == 'none'
+     gio_tests += {
+       'gsocketclient-slow' : {
+         'depends' : [
+@@ -607,24 +607,26 @@ if not meson.is_cross_build() or meson.has_exe_wrapper()
+ 
+   compiler_type = '--compiler=@0@'.format(cc.get_id())
+ 
+-  plugin_resources_c = custom_target('plugin-resources.c',
+-    input : 'test4.gresource.xml',
+-    output : 'plugin-resources.c',
+-    command : [glib_compile_resources,
+-               compiler_type,
+-               '--target=@OUTPUT@',
+-               '--sourcedir=' + meson.current_source_dir(),
+-               '--internal',
+-               '--generate-source',
+-               '--c-name', '_g_plugin',
+-               '@INPUT@'])
++  if get_option('default_library') != 'static'
++    plugin_resources_c = custom_target('plugin-resources.c',
++      input : 'test4.gresource.xml',
++      output : 'plugin-resources.c',
++      command : [glib_compile_resources,
++                 compiler_type,
++                 '--target=@OUTPUT@',
++                 '--sourcedir=' + meson.current_source_dir(),
++                 '--internal',
++                 '--generate-source',
++                 '--c-name', '_g_plugin',
++                 '@INPUT@'])
+ 
+-  shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
+-    link_args : export_dynamic_ldflags,
+-    dependencies : common_gio_tests_deps,
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled
+-  )
++    shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
++      link_args : export_dynamic_ldflags,
++      dependencies : common_gio_tests_deps,
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled
++    )
++  endif
+ 
+   # referenced by test2.gresource.xml
+   big_test_resource = custom_target(
+@@ -917,4 +919,7 @@ if installed_tests_enabled
+ endif
+ 
+ subdir('services')
+-subdir('modules')
++
++if get_option('default_library') != 'static'
++  subdir('modules')
++endif
+diff --git a/glib/tests/meson.build b/glib/tests/meson.build
+index 301158e0f..6203ff45e 100644
+--- a/glib/tests/meson.build
++++ b/glib/tests/meson.build
+@@ -172,7 +172,7 @@ else
+     'include' : {},
+     'unix' : {},
+   }
+-  if have_rtld_next
++  if have_rtld_next and get_option('default_library') != 'static'
+     glib_tests += {
+       'gutils-user-database' : {
+         'depends' : [
+diff --git a/tests/meson.build b/tests/meson.build
+index c95fa1d00..25144c941 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -72,20 +72,22 @@ if ['darwin', 'ios'].contains(host_machine.system())
+   module_suffix = 'so'
+ endif
+ 
+-foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
+-  shared_module(module + '_plugin', 'lib@0@.c'.format(module),
+-    dependencies : [libglib_dep, libgmodule_dep],
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled,
+-    name_suffix : module_suffix
+-  )
+-  shared_library(module + '_library', 'lib@0@.c'.format(module),
+-    dependencies : [libglib_dep, libgmodule_dep],
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled,
+-    name_suffix : module_suffix
+-  )
+-endforeach
++if get_option('default_library') != 'static'
++  foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
++    shared_module(module + '_plugin', 'lib@0@.c'.format(module),
++      dependencies : [libglib_dep, libgmodule_dep],
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled,
++      name_suffix : module_suffix
++    )
++    shared_library(module + '_library', 'lib@0@.c'.format(module),
++      dependencies : [libglib_dep, libgmodule_dep],
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled,
++      name_suffix : module_suffix
++    )
++  endforeach
++endif
+ 
+ common_c_args = test_cargs + ['-DGLIB_DISABLE_DEPRECATION_WARNINGS']
+ common_deps = [libm, thread_dep, libglib_dep]
+-- 
+2.37.1
+
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index ec57ef27e94..728b97d2f5f 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -81,7 +81,7 @@ callPackage ./common.nix { inherit stdenv; } {
 
     postInstall = (if stdenv.hostPlatform == stdenv.buildPlatform then ''
       echo SUPPORTED-LOCALES=C.UTF-8/UTF-8 > ../glibc-2*/localedata/SUPPORTED
-      make -j''${NIX_BUILD_CORES:-1} -l''${NIX_BUILD_CORES:-1} localedata/install-locales
+      make -j''${NIX_BUILD_CORES:-1} localedata/install-locales
     '' else lib.optionalString stdenv.buildPlatform.isLinux ''
       # This is based on http://www.linuxfromscratch.org/lfs/view/development/chapter06/glibc.html
       # Instead of using their patch to build a build-native localedef,
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 226b91b0ce5..d04fda98c7f 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -22,11 +22,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.7.7";
+  version = "3.7.8";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "sha256-vpFD0NWOq2TbqbdxFKqvrFKbbA1+gd5r3xybWQJ9IQY=";
+    sha256 = "sha256-xYrTmvBnDv5qiu5eOosjMaEgBBi2S3xRl3+zltRhcRQ=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index b378c81c89f..e9f324b2453 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, substituteAll
 , meson
 , ninja
 , gettext
@@ -19,6 +20,7 @@
 , libkate
 , lrdf
 , ladspaH
+, lcms2
 , libnice
 , webrtc-audio-processing
 , webrtc-audio-processing_1
@@ -77,6 +79,7 @@
 , mjpegtools
 , libGLU
 , libGL
+, addOpenGLRunpath
 , libintl
 , game-music-emu
 , openssl
@@ -108,6 +111,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ehHBO1XdHSOG3ZAiGeQcv83ajh4Ko+c4GGyVB0s12k8=";
   };
 
+  patches = [
+    # Add fallback paths for nvidia userspace libraries
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit (addOpenGLRunpath) driverLink;
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -126,6 +137,7 @@ stdenv.mkDerivation rec {
     gst-plugins-base
     orc
     json-glib
+    lcms2
     ldacbt
     libass
     libkate
diff --git a/pkgs/development/libraries/gstreamer/bad/fix-paths.patch b/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
new file mode 100644
index 00000000000..dfb8f5462c4
--- /dev/null
+++ b/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
@@ -0,0 +1,48 @@
+diff --git a/sys/nvcodec/gstcudaloader.c b/sys/nvcodec/gstcudaloader.c
+index 4223ba1fbd..ca8bb5ceb1 100644
+--- a/sys/nvcodec/gstcudaloader.c
++++ b/sys/nvcodec/gstcudaloader.c
+@@ -135,6 +135,11 @@ gst_cuda_load_library (void)
+     return TRUE;
+ 
+   module = g_module_open (filename, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open("@driverLink@/lib/" CUDA_LIBNAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s", filename, g_module_error ());
+     return FALSE;
+diff --git a/sys/nvcodec/gstcuvidloader.c b/sys/nvcodec/gstcuvidloader.c
+index 3c7505ca36..eeb376fa80 100644
+--- a/sys/nvcodec/gstcuvidloader.c
++++ b/sys/nvcodec/gstcuvidloader.c
+@@ -85,6 +85,11 @@ gst_cuvid_load_library (guint api_major_ver, guint api_minor_ver)
+     return TRUE;
+ 
+   module = g_module_open (filename, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open ("@driverLink@/lib/" NVCUVID_LIBNAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s", filename, g_module_error ());
+     return FALSE;
+diff --git a/sys/nvcodec/gstnvenc.c b/sys/nvcodec/gstnvenc.c
+index 19637671ad..39858ccdee 100644
+--- a/sys/nvcodec/gstnvenc.c
++++ b/sys/nvcodec/gstnvenc.c
+@@ -874,6 +874,11 @@ gst_nvenc_load_library (guint * api_major_ver, guint * api_minor_ver)
+   };
+ 
+   module = g_module_open (NVENC_LIBRARY_NAME, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open ("@driverLink@/lib/" NVENC_LIBRARY_NAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s",
+         NVENC_LIBRARY_NAME, g_module_error ());
diff --git a/pkgs/development/libraries/gtk-engines/default.nix b/pkgs/development/libraries/gtk-engines/default.nix
index e553efa5f25..d722143b210 100644
--- a/pkgs/development/libraries/gtk-engines/default.nix
+++ b/pkgs/development/libraries/gtk-engines/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1db65pb0j0mijmswrvpgkdabilqd23x22d95hp5kwxvcramq1dhm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk2 ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 ];
 
   meta = {
     description = "Theme engines for GTK 2";
diff --git a/pkgs/development/libraries/gtkspell/default.nix b/pkgs/development/libraries/gtkspell/default.nix
index aca6ccdcccb..6f48ba4e266 100644
--- a/pkgs/development/libraries/gtkspell/default.nix
+++ b/pkgs/development/libraries/gtkspell/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "00hdv28bp72kg1mq2jdz1sdw2b8mb9iclsp7jdqwpck705bdriwg";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [aspell gtk2 enchant intltool];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [aspell gtk2 enchant];
 
   meta = with lib; {
     description = "Word-processor-style highlighting and replacement of misspelled words";
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 7397824f9a7..a7197f9ff98 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   buildPhase = lib.optionalString libOnly ''
     runHook preBuild
 
-    MAKE="make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES"
+    MAKE="make -j $NIX_BUILD_CORES"
     for folder in $libFolders; do
       $MAKE -C $folder
     done
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index e49a903730b..72ecdc51ab1 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.112";
+  version = "2.4.113";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1zr0hi7k5s7my4q9hyj6ryzg89zyjx24zbqfv3c5rcq9pl87gc00";
+    sha256 = "sha256-f9frKWf2O+tGBvItUOJ32ZNIDQXvdd2Iqb2OZ3Mj5eE=";
   };
 
   outputs = [ "out" "dev" "bin" ];
@@ -20,10 +20,11 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dinstall-test-programs=true"
-    "-Domap=true"
+    "-Domap=enabled"
+    "-Dcairo-tests=disabled"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch [
-    "-Dtegra=true"
-    "-Detnaviv=true"
+    "-Dtegra=enabled"
+    "-Detnaviv=enabled"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/liberfa/default.nix b/pkgs/development/libraries/liberfa/default.nix
index 8edc3d7b5a5..b59d3aab4a3 100644
--- a/pkgs/development/libraries/liberfa/default.nix
+++ b/pkgs/development/libraries/liberfa/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "erfa";
   version = "2.0.0";
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
 
   src = fetchFromGitHub {
     owner = "liberfa";
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix
index 7251e5b645b..29762e231f2 100644
--- a/pkgs/development/libraries/libextractor/default.nix
+++ b/pkgs/development/libraries/libextractor/default.nix
@@ -45,10 +45,11 @@ stdenv.mkDerivation rec {
            -e "s|pexe[[:blank:]]*=.*$|pexe = strdup(\"$out/lib/\");|g"
     '';
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs =
    [ libtool gettext zlib bzip2 flac libvorbis exiv2
      libgsf rpm
-     pkg-config
    ] ++ lib.optionals gstreamerSupport
           ([ gst_all_1.gstreamer ] ++ gstPlugins gst_all_1)
      ++ lib.optionals gtkSupport [ glib gtk3 ]
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 4c3e00150ab..2904e6e4567 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libffi";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchurl {
     url = "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "081nx7wpzds168jbr59m34n6s3lyiq6r8zggvqxvlslsc4hvf3sl";
+    sha256 = "sha256-RBbdkrauj8tbEEIecRxNPLMSA9d1Iad9hdAQIxHmw7g=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
   # cgit) that are needed here should be included directly in Nixpkgs as
   # files.
   patches = [
-    ./libffi-powerpc64.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libffi/libffi-powerpc64.patch b/pkgs/development/libraries/libffi/libffi-powerpc64.patch
deleted file mode 100644
index 5748ac08498..00000000000
--- a/pkgs/development/libraries/libffi/libffi-powerpc64.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-https://github.com/libffi/libffi/issues/668
---- a/src/powerpc/linux64.S
-+++ b/src/powerpc/linux64.S
-@@ -29,6 +29,8 @@
- #include <fficonfig.h>
- #include <ffi.h>
- 
-+	.machine altivec
-+
- #ifdef POWERPC64
- 	.hidden	ffi_call_LINUX64
- 	.globl	ffi_call_LINUX64
---- a/src/powerpc/linux64_closure.S
-+++ b/src/powerpc/linux64_closure.S
-@@ -30,6 +30,8 @@
- 
- 	.file	"linux64_closure.S"
- 
-+	.machine altivec
-+
- #ifdef POWERPC64
- 	FFI_HIDDEN (ffi_closure_LINUX64)
- 	.globl  ffi_closure_LINUX64
diff --git a/pkgs/development/libraries/libfido2/default.nix b/pkgs/development/libraries/libfido2/default.nix
index d7c034b9e98..bd4d21fe1b9 100644
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ openssl ];
 
+  outputs = [ "out" "dev" "man" ];
+
   cmakeFlags = [
     "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
     "-DCMAKE_INSTALL_LIBDIR=lib"
diff --git a/pkgs/development/libraries/libinklevel/default.nix b/pkgs/development/libraries/libinklevel/default.nix
index dffbcdd69d1..f9c711df704 100644
--- a/pkgs/development/libraries/libinklevel/default.nix
+++ b/pkgs/development/libraries/libinklevel/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-J0cEaC5v4naO4GGUzdfV55kB7KzA+q+v64i5y5Xbp9Q=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    pkg-config
     libusb1
   ];
 
diff --git a/pkgs/development/libraries/libmikmod/default.nix b/pkgs/development/libraries/libmikmod/default.nix
index c7a00e7372d..29f64116b7a 100644
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -18,8 +18,14 @@ in stdenv.mkDerivation rec {
   propagatedBuildInputs =
     optional stdenv.isLinux libpulseaudio;
 
+  outputs = [ "out" "dev" "man" ];
+
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lasound";
 
+  postInstall = ''
+    moveToOutput bin/libmikmod-config "$dev"
+  '';
+
   meta = with lib; {
     description = "A library for playing tracker music module files";
     homepage    = "https://mikmod.shlomifish.org/";
diff --git a/pkgs/development/libraries/libmx/default.nix b/pkgs/development/libraries/libmx/default.nix
index be4cdd62f6e..6cff9e3f03a 100644
--- a/pkgs/development/libraries/libmx/default.nix
+++ b/pkgs/development/libraries/libmx/default.nix
@@ -33,10 +33,9 @@ stdenv.mkDerivation rec {
 
   configureScript = "sh autogen.sh";
 
-  nativeBuildInputs = [ pkg-config automake autoconf ];
+  nativeBuildInputs = [ pkg-config automake autoconf intltool ];
   buildInputs = [
     libtool
-    intltool
     gobject-introspection glib
     gtk2 gtk-doc clutter clutter-gtk
   ];
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 20c4c0a1c6e..3006efe9b29 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation (rec {
-  version = "4.11.0";
+  version = "4.12.0";
   pname = "libpfm";
 
   src = fetchurl {
     url = "mirror://sourceforge/perfmon2/libpfm4/${pname}-${version}.tar.gz";
-    sha256 = "1k7yp6xfsglp2b6271r622sjinlbys0dk24n9iiv656y5f3zi9ax";
+    sha256 = "sha256-SwwfU/OaYVJbab6/UyxoBAwbmE11RKiuCESxPNkeHuQ=";
   };
 
   makeFlags = [
diff --git a/pkgs/development/libraries/libpipeline/default.nix b/pkgs/development/libraries/libpipeline/default.nix
index 9e2c8342776..f682d394c15 100644
--- a/pkgs/development/libraries/libpipeline/default.nix
+++ b/pkgs/development/libraries/libpipeline/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libpipeline";
-  version = "1.5.4";
+  version = "1.5.6";
 
   src = fetchurl {
     url = "mirror://savannah/libpipeline/libpipeline-${version}.tar.gz";
-    sha256 = "sha256-23hb3boKN+8UtO+Cri0YuIJOaYPfuZEDGTheKN8/Gpw=";
+    sha256 = "sha256-YPu559w5hSjl86d2r1e7KMo/5dnwzYqWGsbOv+bpt5c=";
   };
 
   patches = lib.optionals stdenv.isDarwin [ ./fix-on-osx.patch ];
diff --git a/pkgs/development/libraries/libspectre/default.nix b/pkgs/development/libraries/libspectre/default.nix
index 81e661a9421..2d916fa9a93 100644
--- a/pkgs/development/libraries/libspectre/default.nix
+++ b/pkgs/development/libraries/libspectre/default.nix
@@ -11,9 +11,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./libspectre-0.2.7-gs918.patch ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     # Need `libgs.so'.
-    pkg-config ghostscript cairo /*for tests*/
+    ghostscript cairo /*for tests*/
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libspng/default.nix b/pkgs/development/libraries/libspng/default.nix
index dba098b4468..077b414a665 100644
--- a/pkgs/development/libraries/libspng/default.nix
+++ b/pkgs/development/libraries/libspng/default.nix
@@ -38,13 +38,13 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    pkg-config
     zlib
   ];
 
   nativeBuildInputs = [
     ninja
     meson
+    pkg-config
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libtoxcore/new-api.nix b/pkgs/development/libraries/libtoxcore/new-api.nix
index 831ff2447a2..e726f07a7d8 100644
--- a/pkgs/development/libraries/libtoxcore/new-api.nix
+++ b/pkgs/development/libraries/libtoxcore/new-api.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [
-    autoreconfHook libsodium ncurses check libconfig
+    libsodium ncurses check libconfig
   ] ++ lib.optionals (!stdenv.isAarch32) [
     libopus
   ];
diff --git a/pkgs/development/libraries/libwnck/2.nix b/pkgs/development/libraries/libwnck/2.nix
index fd7d80574a7..a1f54006beb 100644
--- a/pkgs/development/libraries/libwnck/2.nix
+++ b/pkgs/development/libraries/libwnck/2.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 intltool xorg.libX11 xorg.libXres ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 xorg.libX11 xorg.libXres ];
   # ?another optional: startup-notification
 
   configureFlags = [ "--disable-introspection" ]; # not needed anywhere AFAIK
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index b050c8d0caf..b809b180a9c 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -45,7 +45,6 @@ mkDerivation rec {
     libvorbis
     libxml2
     movit
-    pkg-config
     qtbase
     qtsvg
     sox
@@ -56,7 +55,7 @@ mkDerivation rec {
     ladspaPlugins
   ];
 
-  nativeBuildInputs = [ cmake which ];
+  nativeBuildInputs = [ cmake which pkg-config ];
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index e93dfdfb144..2017d5435ea 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -57,7 +57,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake unzip pkg-config ];
   buildInputs =
     [
-      cmake
       libGLU
       libGL
       freetype
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index b9471d68193..8164a4264e6 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, removeReferencesTo
 , alsaSupport ? !stdenv.isDarwin, alsa-lib
 , dbusSupport ? !stdenv.isDarwin, dbus
 , pipewireSupport ? !stdenv.isDarwin, pipewire
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config removeReferencesTo ];
 
   buildInputs = lib.optional alsaSupport alsa-lib
     ++ lib.optional dbusSupport dbus
@@ -46,6 +46,10 @@ stdenv.mkDerivation rec {
     "-DOSS_INCLUDE_DIR=${stdenv.cc.libc}/include"
   ];
 
+  postInstall = lib.optional pipewireSupport ''
+    remove-references-to -t ${pipewire.dev} $(readlink -f $out/lib/*.so)
+  '';
+
   meta = with lib; {
     description = "OpenAL alternative";
     homepage = "https://openal-soft.org/";
diff --git a/pkgs/development/libraries/opencl-headers/default.nix b/pkgs/development/libraries/opencl-headers/default.nix
index 879a916d3ea..273cdea6f8c 100644
--- a/pkgs/development/libraries/opencl-headers/default.nix
+++ b/pkgs/development/libraries/opencl-headers/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opencl-headers";
-  version = "2021.06.30";
+  version = "2022.09.23";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-Headers";
     rev = "v${version}";
-    sha256 = "sha256-MdKC48f1zhVAcHrqzrgT9iaYrHXurV8vDt+GnDroO9s=";
+    sha256 = "sha256-kBXkevcapVfpFmI5C77DwULrC8zjcoto+veb49Ksixk=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index e85589af0c1..479ffbc78ee 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OSTsU2E4UWiwBqq3NqD0lj8uqVXeyd3MJ/gre6W2Jvs=";
+    sha256 = "sha256-L5u0xkoza3G1ZHdtJH7ayVOgcVbPWYp7MC3lJd7LsSY=";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/openjpeg/default.nix b/pkgs/development/libraries/openjpeg/default.nix
index b26738c9ea1..8dd2415433a 100644
--- a/pkgs/development/libraries/openjpeg/default.nix
+++ b/pkgs/development/libraries/openjpeg/default.nix
@@ -1,75 +1,64 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config
-, libpng, libtiff, lcms2, jpylyzer
-, mj2Support ? true # MJ2 executables
-, jpwlLibSupport ? true # JPWL library & executables
+, libdeflate, libpng, libtiff, zlib, lcms2, jpylyzer
 , jpipLibSupport ? false # JPIP library & executables
-, jpipServerSupport ? false, curl ? null, fcgi ? null # JPIP Server
-#, opjViewerSupport ? false, wxGTK ? null # OPJViewer executable
+, jpipServerSupport ? false, curl, fcgi # JPIP Server
+, opjViewerSupport ? false, wxGTK # OPJViewer executable
 , openjpegJarSupport ? false # Openjpeg jar (Java)
-, jp3dSupport ? true # # JP3D comp
-, thirdPartySupport ? false # Third party libraries - OFF: only build when found, ON: always build
-, testsSupport ? true
-, jdk ? null
+, jdk
+, poppler
 }:
 
-assert jpipServerSupport -> jpipLibSupport && curl != null && fcgi != null;
-#assert opjViewerSupport -> (wxGTK != null);
-assert (openjpegJarSupport || jpipLibSupport) -> jdk != null;
-
 let
-  inherit (lib) optional optionals;
   mkFlag = optSet: flag: "-D${flag}=${if optSet then "ON" else "OFF"}";
 in
 
 stdenv.mkDerivation rec {
   pname = "openjpeg";
-  version = "2.4.0"; # don't forget to change passthru.incDir
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "uclouvain";
     repo = "openjpeg";
     rev = "v${version}";
-    sha256 = "143dvy5g6v6129lzvl0r8mrgva2fppkn0zl099qmi9yi9l9h7yyf";
+    sha256 = "sha256-/0o3Fl6/jx5zu854TCqMyOz/8mnEyEC9lpZ6ij/tbHc=";
   };
 
+  outputs = [ "out" "dev" ];
+
   patches = [
-    ./fix-cmake-config-includedir.patch
+    # modernise cmake files, also fixes them for multiple outputs
     (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/uclouvain/openjpeg/pull/1321.patch";
-      sha256 = "1cjpr76nf9g65nqkfnxnjzi3bv7ifbxpc74kxxibh58pzjlp6al8";
+      url = "https://github.com/uclouvain/openjpeg/pull/1424.patch";
+      sha256 = "sha256-CxVRt1u4HVOMUjWiZ2plmZC29t/zshCpSY+N4Wlrlvg=";
+    })
+    # fix cmake files cross compilation
+    (fetchpatch {
+      url = "https://github.com/uclouvain/openjpeg/commit/c6ceb84c221b5094f1e8a4c0c247dee3fb5074e8.patch";
+      sha256 = "sha256-gBUtmO/7RwSWEl7rc8HGr8gNtvNFdhjEwm0Dd51p5O8=";
     })
   ];
 
-  outputs = [ "out" "dev" ];
-
   cmakeFlags = [
     "-DCMAKE_INSTALL_NAME_DIR=\${CMAKE_INSTALL_PREFIX}/lib"
     "-DBUILD_SHARED_LIBS=ON"
     "-DBUILD_CODEC=ON"
-    (mkFlag mj2Support "BUILD_MJ2")
-    (mkFlag jpwlLibSupport "BUILD_JPWL")
+    "-DBUILD_THIRDPARTY=OFF"
     (mkFlag jpipLibSupport "BUILD_JPIP")
     (mkFlag jpipServerSupport "BUILD_JPIP_SERVER")
-    #(mkFlag opjViewerSupport "BUILD_VIEWER")
-    "-DBUILD_VIEWER=OFF"
+    (mkFlag opjViewerSupport "BUILD_VIEWER")
     (mkFlag openjpegJarSupport "BUILD_JAVA")
-    (mkFlag jp3dSupport "BUILD_JP3D")
-    (mkFlag thirdPartySupport "BUILD_THIRDPARTY")
-    (mkFlag testsSupport "BUILD_TESTING")
-    "-DOPENJPEG_INSTALL_INCLUDE_DIR=${placeholder "dev"}/include/${passthru.incDir}"
-    "-DOPENJPEG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/${passthru.incDir}"
+    (mkFlag doCheck "BUILD_TESTING")
   ];
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ ]
-    ++ optionals jpipServerSupport [ curl fcgi ]
-    #++ optional opjViewerSupport wxGTK
-    ++ optional (openjpegJarSupport || jpipLibSupport) jdk;
+  buildInputs = [ libdeflate libpng libtiff zlib lcms2 ]
+    ++ lib.optionals jpipServerSupport [ curl fcgi ]
+    ++ lib.optional opjViewerSupport wxGTK
+    ++ lib.optional (openjpegJarSupport || jpipLibSupport) jdk;
 
-  propagatedBuildInputs = [ libpng libtiff lcms2 ];
+  doCheck = (!stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
 
-  doCheck = (testsSupport && !stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
   checkPhase = ''
     substituteInPlace ../tools/ctest_scripts/travis-ci.cmake \
       --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"${jpylyzer}/bin/jpylyzer\" # "
@@ -77,7 +66,10 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    incDir = "openjpeg-2.4";
+    incDir = "openjpeg-${lib.versions.majorMinor version}";
+    tests = {
+      inherit poppler;
+    };
   };
 
   meta = with lib; {
@@ -86,5 +78,7 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ codyopel ];
     platforms = platforms.all;
+    # opj viewer fails to compile with lots of errors, jar requires openjpeg library already compiled and installed
+    broken = (opjViewerSupport || openjpegJarSupport);
   };
 }
diff --git a/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch b/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
deleted file mode 100644
index 21306400dd4..00000000000
--- a/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
+++ /dev/null
@@ -1,44 +0,0 @@
---- a/src/lib/openjp2/libopenjp2.pc.cmake.in
-+++ b/src/lib/openjp2/libopenjp2.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjp2
- Description: JPEG2000 library (Part 1 and 2)
---- a/src/lib/openjp3d/libopenjp3d.pc.cmake.in
-+++ b/src/lib/openjp3d/libopenjp3d.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjp3d
- Description: JPEG2000 Extensions for three-dimensional data (Part 10)
---- a/src/lib/openjpip/libopenjpip.pc.cmake.in
-+++ b/src/lib/openjpip/libopenjpip.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjpip
- Description: JPEG2000 Interactivity tools, APIs and protocols (Part 9)
---- a/src/lib/openjpwl/libopenjpwl.pc.cmake.in
-+++ b/src/lib/openjpwl/libopenjpwl.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjpwl
- Description: JPEG2000 Wireless library (Part 11)
diff --git a/pkgs/development/libraries/science/math/cliquer/default.nix b/pkgs/development/libraries/science/math/cliquer/default.nix
index fd89ede1efb..55a1b9dcb4c 100644
--- a/pkgs/development/libraries/science/math/cliquer/default.nix
+++ b/pkgs/development/libraries/science/math/cliquer/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs = [
+  nativeBuildInputs = [
     autoreconfHook
   ];
 
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 6718262c2a3..73a72337432 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -136,7 +136,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.20";
+  version = "0.3.21";
 
   outputs = [ "out" "dev" ];
 
@@ -144,7 +144,7 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-FLPVcepf7tv/es+4kur9Op7o3iVAAayuYN4hY/P4mmQ=";
+    sha256 = "sha256-F6cXPqQai4kA5zrsa8E0Q7dD9zZHlwZ+B16EOGNXoXs=";
   };
 
   inherit blas64;
diff --git a/pkgs/development/libraries/sentry-native/default.nix b/pkgs/development/libraries/sentry-native/default.nix
index eafc773ef20..83f84d4d4fd 100644
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-whbzoKIYLwj4yoFaT3frghJd/WzfpolSAuZzQRtnP5E=";
   };
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ curl breakpad pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ curl breakpad ];
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
     "-DSENTRY_BREAKPAD_SYSTEM=On"
diff --git a/pkgs/development/libraries/smpeg/default.nix b/pkgs/development/libraries/smpeg/default.nix
index 8b54cb37a32..5c72d653278 100644
--- a/pkgs/development/libraries/smpeg/default.nix
+++ b/pkgs/development/libraries/smpeg/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL gtk2 libGLU libGL ];
 
+  outputs = [ "out" "dev" ];
+
   preConfigure = ''
     touch NEWS AUTHORS ChangeLog
     sh autogen.sh
@@ -35,9 +37,11 @@ stdenv.mkDerivation rec {
     -e 's,"SDL_audio.h",<SDL/SDL_audio.h>,' \
     -e 's,"SDL_thread.h",<SDL/SDL_thread.h>,' \
     -e 's,"SDL_types.h",<SDL/SDL_types.h>,' \
-      $out/include/smpeg/*.h
+      $dev/include/smpeg/*.h
+
+    moveToOutput bin/smpeg-config "$dev"
 
-    wrapProgram $out/bin/smpeg-config \
+    wrapProgram $dev/bin/smpeg-config \
       --prefix PATH ":" "${pkg-config}/bin" \
       --prefix PKG_CONFIG_PATH ":" "${lib.getDev SDL}/lib/pkgconfig"
   '';
diff --git a/pkgs/development/libraries/smpeg2/default.nix b/pkgs/development/libraries/smpeg2/default.nix
index 48281ba04ec..24dd9c9dc40 100644
--- a/pkgs/development/libraries/smpeg2/default.nix
+++ b/pkgs/development/libraries/smpeg2/default.nix
@@ -24,12 +24,15 @@ stdenv.mkDerivation rec {
   buildInputs = [ SDL2 ]
     ++ lib.optional stdenv.isDarwin darwin.libobjc;
 
+  outputs = [ "out" "dev" "man" ];
+
   preConfigure = ''
     sh autogen.sh
   '';
 
   postInstall = ''
-    wrapProgram $out/bin/smpeg2-config \
+    moveToOutput bin/smpeg2-config "$dev"
+    wrapProgram $dev/bin/smpeg2-config \
       --prefix PATH ":" "${pkg-config}/bin" \
       --prefix PKG_CONFIG_PATH ":" "${SDL2.dev}/lib/pkgconfig"
   '';
diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index c74780148a1..2e1a96eebbd 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -4,13 +4,13 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = "srt";
-  version = "1.4.4";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${version}";
-    sha256 = "sha256-OfcMHH+MSOGY9pxpXt19EIGdP4FJFssSv/lENX+iIf8=";
+    sha256 = "sha256-qVvoHtROtJjrUd+YpjN/0I6KmiH7c24+pQ4xYTUGPXk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/unicap/default.nix b/pkgs/development/libraries/unicap/default.nix
index 17e91f7e236..f26365fa8e6 100644
--- a/pkgs/development/libraries/unicap/default.nix
+++ b/pkgs/development/libraries/unicap/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05zcnnm4dfc6idihfi0fq5xka6x86zi89wip2ca19yz768sd33s9";
   };
 
-  buildInputs = [ libusb-compat-0_1 libraw1394 dcraw intltool perl v4l-utils ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ libusb-compat-0_1 libraw1394 dcraw perl v4l-utils ];
 
   patches = [
     # Debian has a patch that fixes the build.
diff --git a/pkgs/development/libraries/vapoursynth-mvtools/default.nix b/pkgs/development/libraries/vapoursynth-mvtools/default.nix
index 76ce9a36c71..54d9bad1644 100644
--- a/pkgs/development/libraries/vapoursynth-mvtools/default.nix
+++ b/pkgs/development/libraries/vapoursynth-mvtools/default.nix
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0lngkvxnzn82rz558nvl96rvclrck07ja1pny7wcfixp9b68ppkn";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
-    autoreconfHook
     nasm vapoursynth fftwFloat
   ];
 
diff --git a/pkgs/development/libraries/volume-key/default.nix b/pkgs/development/libraries/volume-key/default.nix
index ce2f7c20d3c..cc0049ef756 100644
--- a/pkgs/development/libraries/volume-key/default.nix
+++ b/pkgs/development/libraries/volume-key/default.nix
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "dev" "py" ];
 
-  nativeBuildInputs = [ autoconf automake libtool pkg-config gettext swig ];
+  nativeBuildInputs = [ autoconf automake libtool pkg-config gettext swig autoreconfHook ];
 
-  buildInputs = [ autoreconfHook glib cryptsetup nss util-linux gpgme ncurses ];
+  buildInputs = [ glib cryptsetup nss util-linux gpgme ncurses ];
 
   configureFlags = [
     "--with-gpgme-prefix=${gpgme.dev}"
diff --git a/pkgs/development/libraries/vte/2.90.nix b/pkgs/development/libraries/vte/2.90.nix
index dfb76069c3b..59f1a2cd673 100644
--- a/pkgs/development/libraries/vte/2.90.nix
+++ b/pkgs/development/libraries/vte/2.90.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "54e5b07be3c0f7b158302f54ee79d4de1cb002f4259b6642b79b1e0e314a959c";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gobject-introspection intltool glib gtk3 ncurses ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gobject-introspection glib gtk3 ncurses ];
 
   configureFlags = [ "--enable-introspection" ];
 
diff --git a/pkgs/development/libraries/xcb-util-cursor/HEAD.nix b/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
index 92796b4116c..4ac58c3f3d0 100644
--- a/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
+++ b/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
@@ -21,13 +21,12 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [
     gnum4
     gperf
     libtool
     libxcb
-    pkg-config
     xorg.utilmacros
     xorg.xcbutilimage
     xorg.xcbutilrenderutil
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index e5d5e111855..1ff2101b146 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -427,7 +427,8 @@ with prev;
 
   luv = prev.luaLib.overrideLuarocks prev.luv (drv: {
 
-    buildInputs = [ pkg-config libuv ];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libuv ];
 
     # Use system libuv instead of building local and statically linking
     extraVariables = {
diff --git a/pkgs/development/ocaml-modules/gsl/default.nix b/pkgs/development/ocaml-modules/gsl/default.nix
index eacdda27f43..4588d0c04b0 100644
--- a/pkgs/development/ocaml-modules/gsl/default.nix
+++ b/pkgs/development/ocaml-modules/gsl/default.nix
@@ -13,7 +13,8 @@ buildDunePackage rec {
     sha256 = "1mpzcgbrha2l8iikqbmn32668v2mnnsykxg5n5jgs0qnskn2nvrn";
   };
 
-  buildInputs = [ dune-configurator gsl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dune-configurator gsl ];
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Accelerate ];
 
   meta = with lib; {
diff --git a/pkgs/development/perl-modules/Po4a/default.nix b/pkgs/development/perl-modules/Po4a/default.nix
index 11941490785..3689122805e 100644
--- a/pkgs/development/perl-modules/Po4a/default.nix
+++ b/pkgs/development/perl-modules/Po4a/default.nix
@@ -1,5 +1,7 @@
 { stdenv, lib, fetchurl, docbook_xsl, docbook_xsl_ns, gettext, libxslt, glibcLocales, docbook_xml_dtd_412, docbook_sgml_dtd_41, texlive, opensp
-, perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny }:
+, perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny
+, fetchpatch
+}:
 
 buildPerlPackage rec {
   pname = "po4a";
@@ -8,6 +10,14 @@ buildPerlPackage rec {
     url = "https://github.com/mquinson/po4a/releases/download/v${version}/po4a-${version}.tar.gz";
     sha256 = "0eb510a66f59de68cf7a205342036cc9fc08b39334b91f1456421a5f3359e68b";
   };
+  patches = [
+    (fetchpatch {
+      # make devdoc output reproducible
+      # https://github.com/mquinson/po4a/pull/387
+      url = "https://github.com/mquinson/po4a/commit/df7433b58f6570558d44b6aac885c2a8f7862e51.patch";
+      sha256 = "9MVkYiItR2P3PBCUc4OhEOUHQuLqTWUYtYlZ3L8miC8=";
+    })
+  ];
   nativeBuildInputs = [ docbook_xsl docbook_xsl_ns ModuleBuild ];
   propagatedBuildInputs = lib.optional (!stdenv.hostPlatform.isMusl) TextWrapI18N ++ [ LocaleGettext SGMLSpm UnicodeLineBreak PodParser YAMLTiny ];
   # TODO: TermReadKey was temporarily removed from propagatedBuildInputs to unfreeze the build
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 3815a64eec6..088541552ec 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPythonPackage, fetchPypi, isPy27, python
-, IOKit
+, CoreFoundation, IOKit
 , pytestCheckHook
 , mock
 , unittest2
@@ -41,7 +41,10 @@ buildPythonPackage rec {
     "cpu_freq"
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ IOKit ];
+  buildInputs =
+    # workaround for https://github.com/NixOS/nixpkgs/issues/146760
+    lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ CoreFoundation ] ++
+    lib.optionals stdenv.isDarwin [ IOKit ];
 
   pythonImportsCheck = [ "psutil" ];
 
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 327a44690da..241953cda3e 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage rec {
 
   postBuild = ''
     # build tests
-    make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES
+    make -j $NIX_BUILD_CORES
   '';
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 500f46b0240..68659555ff1 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.4.0";
-  disabled = pythonOlder "3.6";
+  version = "2.5.0";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "PyJWT";
     inherit version;
-    sha256 = "sha256-1CkIIIxpmzuXPL6wGpabpqlsgh7vscW/5MOQwB1nq7o=";
+    sha256 = "sha256-53q4lICQXYaZhEKsV4jzUzP6hfZQR6U0rcOO3zyI/Ds=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index 0afa482960c..1ad0095e009 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.5.1";
+  version = "1.5.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-DgXkVmRdWUKcsQITcK7ec8B2DpNgu/2q77W87VMOudc=";
+    sha256 = "sha256-2NrMsU3A6uG2tus+zveWdb03tAZTafecNTk91cVWUsc=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 2ed9d860f8b..a8e8fee5ba7 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -572,7 +572,8 @@ in
   };
 
   ruby-libvirt = attrs: {
-    buildInputs = [ libvirt pkg-config ];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libvirt ];
     buildFlags = [
       "--with-libvirt-include=${libvirt}/include"
       "--with-libvirt-lib=${libvirt}/lib"
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 722c8b63034..d64b3bbe1a8 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.24.1";
+  version = "3.24.2";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-STHid6TbGoBfE7qnATp3V6DL/lt5MogpJccGHZ0fqCs=";
+    sha256 = "sha256-DZAg8G893xf7U33CKOGlbJJ+5Qa0hvVf4twZ9pvwyNs=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 3d946fcffd5..ded9c3c63b8 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -20,7 +20,7 @@ mesonConfigurePhase() {
 
     echo "meson flags: $mesonFlags ${mesonFlagsArray[@]}"
 
-    meson build $mesonFlags "${mesonFlagsArray[@]}"
+    meson setup build $mesonFlags "${mesonFlagsArray[@]}"
     cd build
 
     if ! [[ -v enableParallelBuilding ]]; then
diff --git a/pkgs/development/tools/build-managers/ninja/default.nix b/pkgs/development/tools/build-managers/ninja/default.nix
index ffa582b5618..f80f0289dbe 100644
--- a/pkgs/development/tools/build-managers/ninja/default.nix
+++ b/pkgs/development/tools/build-managers/ninja/default.nix
@@ -1,6 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python3, buildDocs ? true, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, re2c }:
-
-with lib;
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, asciidoc
+, docbook_xml_dtd_45
+, docbook_xsl
+, installShellFiles
+, libxslt
+, python3
+, re2c
+, buildDocs ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "ninja";
@@ -10,30 +20,51 @@ stdenv.mkDerivation rec {
     owner = "ninja-build";
     repo = "ninja";
     rev = "v${version}";
-    sha256 = "sha256-LvV/Fi2ARXBkfyA1paCRmLUwCh/rTyz+tGMg2/qEepI=";
+    hash = "sha256-LvV/Fi2ARXBkfyA1paCRmLUwCh/rTyz+tGMg2/qEepI=";
   };
 
-  nativeBuildInputs = [ python3 re2c ] ++ optionals buildDocs [ asciidoc docbook_xml_dtd_45 docbook_xsl libxslt.bin ];
+  nativeBuildInputs = [
+    python3
+    re2c
+    installShellFiles
+  ]
+  ++ lib.optionals buildDocs [
+    asciidoc
+    docbook_xml_dtd_45
+    docbook_xsl
+    libxslt.bin
+  ];
 
   buildPhase = ''
+    runHook preBuild
+
     python configure.py --bootstrap
-  '' + optionalString buildDocs ''
+  '' + lib.optionalString buildDocs ''
     # "./ninja -vn manual" output copied here to support cross compilation.
     asciidoc -b docbook -d book -o build/manual.xml doc/manual.asciidoc
     xsltproc --nonet doc/docbook.xsl build/manual.xml > doc/manual.html
+  '' + ''
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm555 -t $out/bin ninja
-    install -Dm444 misc/bash-completion $out/share/bash-completion/completions/ninja
-    install -Dm444 misc/zsh-completion $out/share/zsh/site-functions/_ninja
-  '' + optionalString buildDocs ''
+    installShellCompletion --name ninja \
+      --bash misc/bash-completion \
+      --zsh misc/zsh-completion
+  '' + lib.optionalString buildDocs ''
     install -Dm444 -t $out/share/doc/ninja doc/manual.asciidoc doc/manual.html
+  '' + ''
+
+    runHook postInstall
   '';
 
   setupHook = ./setup-hook.sh;
 
-  meta = {
+  meta = with lib; {
     description = "Small build system with a focus on speed";
     longDescription = ''
       Ninja is a small build system with a focus on speed. It differs from
diff --git a/pkgs/development/tools/build-managers/ninja/setup-hook.sh b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
index 63fa7d8f16f..ecaa8b88c1a 100644
--- a/pkgs/development/tools/build-managers/ninja/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
@@ -9,7 +9,7 @@ ninjaBuildPhase() {
     fi
 
     local flagsArray=(
-        -j$buildCores -l$NIX_BUILD_CORES
+        -j$buildCores
         $ninjaFlags "${ninjaFlagsArray[@]}"
     )
 
@@ -19,29 +19,6 @@ ninjaBuildPhase() {
     runHook postBuild
 }
 
-if [ -z "${dontUseNinjaBuild-}" -a -z "${buildPhase-}" ]; then
-    buildPhase=ninjaBuildPhase
-fi
-
-ninjaInstallPhase() {
-    runHook preInstall
-
-    # shellcheck disable=SC2086
-    local flagsArray=(
-        $ninjaFlags "${ninjaFlagsArray[@]}"
-        ${installTargets:-install}
-    )
-
-    echoCmd 'install flags' "${flagsArray[@]}"
-    TERM=dumb ninja "${flagsArray[@]}"
-
-    runHook postInstall
-}
-
-if [ -z "${dontUseNinjaInstall-}" -a -z "${installPhase-}" ]; then
-    installPhase=ninjaInstallPhase
-fi
-
 ninjaCheckPhase() {
     runHook preCheck
 
@@ -61,7 +38,7 @@ ninjaCheckPhase() {
         fi
 
         local flagsArray=(
-            -j$buildCores -l$NIX_BUILD_CORES
+            -j$buildCores
             $ninjaFlags "${ninjaFlagsArray[@]}"
             $checkTarget
         )
@@ -73,6 +50,29 @@ ninjaCheckPhase() {
     runHook postCheck
 }
 
+ninjaInstallPhase() {
+    runHook preInstall
+
+    # shellcheck disable=SC2086
+    local flagsArray=(
+        $ninjaFlags "${ninjaFlagsArray[@]}"
+        ${installTargets:-install}
+    )
+
+    echoCmd 'install flags' "${flagsArray[@]}"
+    TERM=dumb ninja "${flagsArray[@]}"
+
+    runHook postInstall
+}
+
+if [ -z "${dontUseNinjaBuild-}" -a -z "${buildPhase-}" ]; then
+    buildPhase=ninjaBuildPhase
+fi
+
 if [ -z "${dontUseNinjaCheck-}" -a -z "${checkPhase-}" ]; then
     checkPhase=ninjaCheckPhase
 fi
+
+if [ -z "${dontUseNinjaInstall-}" -a -z "${installPhase-}" ]; then
+    installPhase=ninjaInstallPhase
+fi
diff --git a/pkgs/development/tools/mdk/default.nix b/pkgs/development/tools/mdk/default.nix
index 9c92764fdaf..30ae23e85a8 100644
--- a/pkgs/development/tools/mdk/default.nix
+++ b/pkgs/development/tools/mdk/default.nix
@@ -7,8 +7,8 @@ stdenv.mkDerivation rec {
     url = "mirror://gnu/gnu/mdk/v${version}/mdk-${version}.tar.gz";
     sha256 = "0bhk3c82kyp8167h71vdpbcr852h5blpnwggcswqqwvvykbms7lb";
   };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool glib ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ glib ];
   postInstall = ''
     mkdir -p $out/share/emacs/site-lisp/
     cp -v ./misc/*.el $out/share/emacs/site-lisp
diff --git a/pkgs/development/tools/memray/default.nix b/pkgs/development/tools/memray/default.nix
index 405e7e7b9b0..4dc94dcf5d5 100644
--- a/pkgs/development/tools/memray/default.nix
+++ b/pkgs/development/tools/memray/default.nix
@@ -18,10 +18,11 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-zHdgVpe92OiwLC4jHVtT3oC+WnB30e5U3ZOHnmuo+Ao=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     libunwind
     lz4
-    pkg-config
   ] ++ (with python3.pkgs; [
     cython
   ]);
diff --git a/pkgs/development/tools/misc/distcc/default.nix b/pkgs/development/tools/misc/distcc/default.nix
index b20d172a403..27ff1b5e69d 100644
--- a/pkgs/development/tools/misc/distcc/default.nix
+++ b/pkgs/development/tools/misc/distcc/default.nix
@@ -17,8 +17,8 @@ let
       sha256 = "0zjba1090awxkmgifr9jnjkxf41zhzc4f6mrnbayn3v6s77ca9x4";
     };
 
-  nativeBuildInputs = [ pkg-config autoconf automake ];
-    buildInputs = [popt avahi pkg-config python3 gtk3 which procps libiberty_static];
+    nativeBuildInputs = [ pkg-config autoconf automake ];
+    buildInputs = [popt avahi python3 gtk3 which procps libiberty_static];
     preConfigure =
     ''
       export CPATH=$(ls -d ${gcc.cc}/lib/gcc/*/${gcc.cc.version}/plugin/include)
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 0db37008ae7..11af21a6e48 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -30,9 +30,9 @@ let
   # 2) nix-build -A tree-sitter.updater.update-all-grammars
   # 3) OPTIONAL: Set GITHUB_TOKEN env variable to avoid api rate limit
   # 4) run the ./result script that is output by that (it updates ./grammars)
-  version = "0.20.6";
-  sha256 = "sha256-zaxy8VCfJKK8NtfuFFojmmP5a19FP1zO/eB5q1EoQPw=";
-  cargoSha256 = "sha256-sOOhzm2nz+HC6dvT+8hj/wh19o+OB2zQ6Uz+H89txSA=";
+  version = "0.20.7";
+  sha256 = "sha256-5ILiN5EfJ7WpeYBiXynfcLucdp8zmxVOj4gLkaFQYts=";
+  cargoSha256 = "sha256-V4frCaU5QzTx3ujdaplw7vNkosbzyXHQvE+T7ntVOtU=";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
diff --git a/pkgs/games/asc/default.nix b/pkgs/games/asc/default.nix
index a6a1129acad..46f8231680b 100644
--- a/pkgs/games/asc/default.nix
+++ b/pkgs/games/asc/default.nix
@@ -16,9 +16,11 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = "-fpermissive -Wno-error=narrowing -std=c++11"; # I'm too lazy to catch all gcc47-related problems
   hardeningDisable = [ "format" ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     SDL SDL_image SDL_mixer SDL_sound libsigcxx physfs boost expat
-    freetype libjpeg wxGTK lua perl pkg-config zlib zip bzip2 libpng
+    freetype libjpeg wxGTK lua perl zlib zip bzip2 libpng
     libtiff fluidsynth libmikmod flac libvorbis libogg
   ];
 
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index 4eb46e0ac15..ec65db97ce4 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -58,7 +58,7 @@ in stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
+  NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2}/include/SDL2 -I${lib.getDev SDL2_mixer}/include/SDL2";
 
   makeFlags = [
     "SDLCONFIG=${SDL2}/bin/sdl2-config"
diff --git a/pkgs/games/extremetuxracer/default.nix b/pkgs/games/extremetuxracer/default.nix
index 416a3ac913e..71887c8b47d 100644
--- a/pkgs/games/extremetuxracer/default.nix
+++ b/pkgs/games/extremetuxracer/default.nix
@@ -13,11 +13,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-HIdJZeniSVM78VwI2rxh5gwFuz/VeJF4gBF/+KkQzU4=";
   };
 
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
     libGLU libGL libX11 xorgproto tcl freeglut freetype
     sfml libXi
     libXmu libXext libXt libSM libICE
-    libpng pkg-config gettext intltool
+    libpng gettext
   ];
 
   configureFlags = [ "--with-tcl=${tcl}/lib" ];
diff --git a/pkgs/games/freedink/default.nix b/pkgs/games/freedink/default.nix
index b48d7e52cf3..ecdcbb7dce6 100644
--- a/pkgs/games/freedink/default.nix
+++ b/pkgs/games/freedink/default.nix
@@ -25,9 +25,11 @@ in stdenv.mkDerivation rec {
     sha256 = "19xximbcm6506kvpf3s0q96697kmzca3yrjdr6dgphklp33zqsqr";
   };
 
+  nativeBuildInputs = [ pkg-config intltool ];
+
   buildInputs = [
     SDL SDL_mixer SDL_image SDL_ttf SDL_gfx
-    pkg-config intltool fontconfig libzip zip zlib
+    fontconfig libzip zip zlib
   ];
 
   preConfigure = ''
diff --git a/pkgs/games/iortcw/sp.nix b/pkgs/games/iortcw/sp.nix
index d9faa177c17..ba8a4dd10bd 100644
--- a/pkgs/games/iortcw/sp.nix
+++ b/pkgs/games/iortcw/sp.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = [
     "-I${SDL2.dev}/include/SDL2"
-    "-I${opusfile}/include/opus"
+    "-I${opusfile.dev}/include/opus"
   ];
   NIX_CFLAGS_LINK = [ "-lSDL2" ];
 
diff --git a/pkgs/games/ivan/default.nix b/pkgs/games/ivan/default.nix
index 53e1b3cf00e..80dc182127d 100644
--- a/pkgs/games/ivan/default.nix
+++ b/pkgs/games/ivan/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = ["-DCMAKE_CXX_FLAGS=-DWIZARD"];
 
   # Help CMake find SDL_mixer.h
-  NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";
+  NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2_mixer}/include/SDL2";
 
   # Create "ivan.desktop" file
   ivanDesktop = makeDesktopItem {
diff --git a/pkgs/games/srb2/default.nix b/pkgs/games/srb2/default.nix
index 57488bdb8b1..26bc4eae96c 100644
--- a/pkgs/games/srb2/default.nix
+++ b/pkgs/games/srb2/default.nix
@@ -60,8 +60,8 @@ in stdenv.mkDerivation rec {
     "-DSRB2_ASSET_DIRECTORY=/build/source/assets"
     "-DGME_INCLUDE_DIR=${game-music-emu}/include"
     "-DOPENMPT_INCLUDE_DIR=${libopenmpt.dev}/include"
-    "-DSDL2_MIXER_INCLUDE_DIR=${SDL2_mixer}/include/SDL2"
-    "-DSDL2_INCLUDE_DIR=${SDL2.dev}/include/SDL2"
+    "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
+    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2}/include/SDL2"
   ];
 
   patches = [
diff --git a/pkgs/games/srb2kart/default.nix b/pkgs/games/srb2kart/default.nix
index e5a29aa5654..cb68125adda 100644
--- a/pkgs/games/srb2kart/default.nix
+++ b/pkgs/games/srb2kart/default.nix
@@ -52,8 +52,8 @@ in stdenv.mkDerivation rec {
   cmakeFlags = [
     #"-DSRB2_ASSET_DIRECTORY=/build/source/assets"
     "-DGME_INCLUDE_DIR=${game-music-emu}/include"
-    "-DSDL2_MIXER_INCLUDE_DIR=${SDL2_mixer}/include/SDL2"
-    "-DSDL2_INCLUDE_DIR=${SDL2.dev}/include/SDL2"
+    "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
+    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2}/include/SDL2"
   ];
 
   patches = [
diff --git a/pkgs/games/uhexen2/default.nix b/pkgs/games/uhexen2/default.nix
index c76dd9ec252..b9bde8d3e43 100644
--- a/pkgs/games/uhexen2/default.nix
+++ b/pkgs/games/uhexen2/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     runHook preBuild
     for makefile in "''${makeFiles[@]}"; do
           local flagsArray=(
-            -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+            -j$NIX_BUILD_CORES
             SHELL=$SHELL
             $makeFlags "''${makeFlagsArray[@]}"
             $buildFlags "''${buildFlagsArray[@]}"
diff --git a/pkgs/games/xboard/default.nix b/pkgs/games/xboard/default.nix
index eefbb90114f..af75ec79e73 100644
--- a/pkgs/games/xboard/default.nix
+++ b/pkgs/games/xboard/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libX11
     xorgproto
@@ -51,7 +52,6 @@ stdenv.mkDerivation rec {
     gnuchess
     texinfo
     libXpm
-    pkg-config
     librsvg
     cairo
     pango
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index 8865e8f992d..d29e43850fb 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -83,14 +83,14 @@ let
     '';
 
     buildPhase = (lib.optionalString withDedicated ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES sv-${target}
+      make -j $NIX_BUILD_CORES sv-${target}
     '' + lib.optionalString withGLX ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES cl-${target}
+      make -j $NIX_BUILD_CORES cl-${target}
     '' + lib.optionalString withSDL ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES sdl-${target}
+      make -j $NIX_BUILD_CORES sdl-${target}
     '') + ''
       pushd ../d0_blind_id
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES
+      make -j $NIX_BUILD_CORES
       popd
     '';
 
diff --git a/pkgs/misc/cups/drivers/canon/default.nix b/pkgs/misc/cups/drivers/canon/default.nix
index 07b81ce9bc2..12e4f5cac96 100644
--- a/pkgs/misc/cups/drivers/canon/default.nix
+++ b/pkgs/misc/cups/drivers/canon/default.nix
@@ -44,7 +44,7 @@ let
     sha256 = "sha256:069z6ijmql62mcdyxnzc9mf0dxa6z1107cd0ab4i1adk8kr3d75k";
   };
 
-  buildInputs = [ cups zlib jbigkit glib gtk3 pkg-config gnome2.libglade libxml2 gdk-pixbuf pango cairo atk ];
+  buildInputs = [ cups zlib jbigkit glib gtk3 gnome2.libglade libxml2 gdk-pixbuf pango cairo atk ];
 in
 stdenv.mkDerivation rec {
   pname = "canon-cups-ufr2";
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  nativeBuildInputs = [ makeWrapper unzip autoconf automake libtool_1_5 ];
+  nativeBuildInputs = [ makeWrapper unzip autoconf automake libtool_1_5 pkg-config ];
 
   inherit buildInputs;
 
diff --git a/pkgs/misc/screensavers/alock/default.nix b/pkgs/misc/screensavers/alock/default.nix
index 87c81531122..74155f43c2b 100644
--- a/pkgs/misc/screensavers/alock/default.nix
+++ b/pkgs/misc/screensavers/alock/default.nix
@@ -21,9 +21,9 @@ stdenv.mkDerivation rec {
     "--enable-imlib2"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
-    autoreconfHook libX11
+    libX11
     pam libgcrypt libXrender imlib2
   ];
 
diff --git a/pkgs/misc/stabber/default.nix b/pkgs/misc/stabber/default.nix
index eb0d6a4109d..478cbda3dc0 100644
--- a/pkgs/misc/stabber/default.nix
+++ b/pkgs/misc/stabber/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation {
     mkdir m4
   '';
 
-  buildInputs = [ autoreconfHook pkg-config glib expat libmicrohttpd ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  buildInputs = [ glib expat libmicrohttpd ];
 
   meta = {
     description = "Stubbed XMPP Server";
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index 05340642f8d..b7666fe31cd 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -168,7 +168,7 @@ in rec {
   bareFrameworks = (
     lib.mapAttrs framework (import ./frameworks.nix {
       inherit frameworks libs;
-      inherit (pkgs.darwin.apple_sdk_11_0) libnetwork Libsystem;
+      inherit (pkgs.darwin.apple_sdk_11_0) libnetwork;
       libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
     })
   ) // (
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index b29a36177a8..4565f698d26 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -50,7 +50,9 @@ let
     libcharset = callPackage ./libcharset.nix {};
     libunwind = callPackage ./libunwind.nix {};
     libnetwork = callPackage ./libnetwork.nix {};
-    objc4 = callPackage ./libobjc.nix {};
+    # Avoid introducing a new objc4 if stdenv already has one, to prevent
+    # conflicting LLVM modules.
+    objc4 = if stdenv ? objc4 then stdenv.objc4 else callPackage ./libobjc.nix {};
 
     # questionable aliases
     configd = pkgs.darwin.apple_sdk.frameworks.SystemConfiguration;
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
index e9121b02116..dc4ab1955b5 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -1,4 +1,4 @@
-{ frameworks, libs, libobjc, Libsystem, libnetwork }: with frameworks; with libs;
+{ frameworks, libs, libobjc, libnetwork }: with frameworks; with libs;
 {
   AGL                              = { inherit Carbon OpenGL; };
   AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics simd UniformTypeIdentifiers; };
@@ -89,9 +89,7 @@
   IOBluetooth                      = { inherit CoreBluetooth IOKit; };
   IOBluetoothUI                    = { inherit IOBluetooth; };
   IOKit                            = {};
-  # `IOSurface` should depend on `Libsystem` (in place of `xpc`) but this currently causes build
-  # issues due to incompatibility issues between `Libsystem` and `libcxx`.
-  IOSurface                        = { inherit IOKit xpc; };
+  IOSurface                        = { inherit IOKit; };
   IOUSBHost                        = {};
   IdentityLookup                   = {};
   ImageCaptureCore                 = {};
diff --git a/pkgs/os-specific/darwin/libtapi/default.nix b/pkgs/os-specific/darwin/libtapi/default.nix
index da071074097..eba61a15ccb 100644
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@@ -40,12 +40,15 @@ stdenv.mkDerivation {
         let
           nativeCC = pkgsBuildBuild.stdenv.cc;
           nativeBintools = nativeCC.bintools.bintools;
+          nativeLibcxxabi = lib.getLib pkgsBuildBuild.libcxxabi;
           nativeToolchainFlags = [
             "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
             "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
             "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
             "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
             "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+            "-DCMAKE_EXE_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
+            "-DCMAKE_SHARED_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
           ];
         in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
       )
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 67d8f107ce3..2fce9d6f0d7 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.52";
+  version = "0.53";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-JnkNWWdr0CSlwME619BBWkvelFZoZpzmAR53nm2bSqM=";
+    sha256 = "sha256-txtXPWmLfZLBsK3s94W5LyA81mTHStpP3nkq6KW33Mk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index dfd5f5724ef..b62b6946e42 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.29";
+  version = "1.30";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-W2MOK6aIa1whkj13OeuibNjL/2LWt7TO8h4JeoUrZnQ=";
+    sha256 = "sha256-9uyYXxnxRqWvzrw3QXCOT/ZubQ8/nrB+b60jKn1hAJk=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 97bf388d46a..3a71563593e 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -481,6 +481,7 @@ let
       DEBUG_LIST                       = yes;
       # Detect writes to read-only module pages
       DEBUG_SET_MODULE_RONX            = whenOlder "4.11" (option yes);
+      HARDENED_USERCOPY                = yes;
       RANDOMIZE_BASE                   = option yes;
       STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
       IO_STRICT_DEVMEM                 = mkDefault yes;
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 0577107fd02..75ba8710449 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -7,11 +7,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.65";
+  version = "2.66";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-c+NQAgzDH+FTYIedGThP+jOVqCXwZfz2vaOlzfllvr0=";
+    sha256 = "sha256-FcQO3tswA9cKKD/lh6NrfRnIs7VU4z+GEpwFmku0ZrI=";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/libpsm2/default.nix b/pkgs/os-specific/linux/libpsm2/default.nix
index ebfe492f736..43c9bf74e3f 100644
--- a/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/pkgs/os-specific/linux/libpsm2/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ numactl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ numactl ];
 
   makeFlags = [
     # Disable blanket -Werror to avoid build failures
diff --git a/pkgs/os-specific/linux/lightum/default.nix b/pkgs/os-specific/linux/lightum/default.nix
index 95b766aec05..e9925b95bcd 100644
--- a/pkgs/os-specific/linux/lightum/default.nix
+++ b/pkgs/os-specific/linux/lightum/default.nix
@@ -11,13 +11,14 @@ stdenv.mkDerivation {
     sha256 = "sha256-dzWUVY2srgk6BM6jZ7FF+snxnPopz3fx9nq+mVkmogc=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     dbus
     glib
     libX11
     libXScrnSaver
     libXext
-    pkg-config
     systemd
   ];
 
diff --git a/pkgs/os-specific/linux/pam_usb/default.nix b/pkgs/os-specific/linux/pam_usb/default.nix
index ebd45246ae8..1264894ad0c 100644
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     # pam_usb dependencies
-    dbus libxml2 pam pmount pkg-config
+    dbus libxml2 pam pmount
     # pam_usb's tools dependencies
     python
     # cElementTree is included with python 2.5 and later.
diff --git a/pkgs/os-specific/linux/pmount/default.nix b/pkgs/os-specific/linux/pmount/default.nix
index 0f65e0278ca..8267a2d4a7f 100644
--- a/pkgs/os-specific/linux/pmount/default.nix
+++ b/pkgs/os-specific/linux/pmount/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "db38fc290b710e8e9e9d442da2fb627d41e13b3ee80326c15cc2595ba00ea036";
   };
 
-  buildInputs = [ intltool util-linux ];
+  nativeBuildInputs = [ intltool util-linux ];
+  buildInputs = [ util-linux ];
 
   configureFlags = [
     "--with-media-dir=${mediaDir}"
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index d27aaa1f137..0aff1bdd789 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   # because the Makefile would not print warnings about too old
   # libraries (see "warning:" in the Makefile)
   postBuild = ''
-    make libs doc -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+    make libs doc -j$NIX_BUILD_CORES
   '';
 
   installTargets = [
diff --git a/pkgs/os-specific/linux/xf86-video-nested/default.nix b/pkgs/os-specific/linux/xf86-video-nested/default.nix
index bba646e583b..4092e3797c2 100644
--- a/pkgs/os-specific/linux/xf86-video-nested/default.nix
+++ b/pkgs/os-specific/linux/xf86-video-nested/default.nix
@@ -12,9 +12,11 @@ stdenv.mkDerivation {
     sha256 = "133rd2kvr2q2wmwpx82bb93qbi8wm8qp1vlmbhgc7aslz0j4cqqv";
   };
 
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+
   buildInputs =
-    [ autoreconfHook xorgproto libX11 libXext pixman
-      pkg-config utilmacros xorgserver
+    [ xorgproto libX11 libXext pixman
+      utilmacros xorgserver
     ];
 
   hardeningDisable = [ "fortify" ];
diff --git a/pkgs/servers/matrix-conduit/default.nix b/pkgs/servers/matrix-conduit/default.nix
index 4eced54bc72..d328a8d5c23 100644
--- a/pkgs/servers/matrix-conduit/default.nix
+++ b/pkgs/servers/matrix-conduit/default.nix
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = with pkgs; [
     rustPlatform.bindgenHook
+    pkg-config
   ];
 
   buildInputs = with pkgs; [
-    pkg-config
     rocksdb
   ];
 
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 5084bd72051..2639ad8b80e 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -116,6 +116,11 @@ stdenv.mkDerivation rec {
     "-Dsysconfdir=/etc"
     "-Dsysconfdir_install=${placeholder "out"}/etc"
     "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
+
+    # pulseaudio complains if its binary is moved after installation;
+    # this is needed so that wrapGApp can operate *without*
+    # renaming the unwrapped binaries (see below)
+    "--bindir=${placeholder "out"}/.bin-unwrapped"
   ]
   ++ lib.optional (stdenv.isLinux && useSystemd) "-Dsystemduserunitdir=${placeholder "out"}/lib/systemd/user"
   ++ lib.optionals stdenv.isDarwin [
@@ -133,11 +138,11 @@ stdenv.mkDerivation rec {
   postInstall = lib.optionalString libOnly ''
     find $out/share -maxdepth 1 -mindepth 1 ! -name "vala" -prune -exec rm -r {} \;
     find $out/share/vala -maxdepth 1 -mindepth 1 ! -name "vapi" -prune -exec rm -r {} \;
-    rm -r $out/{bin,etc,lib/pulse-*}
+    rm -r $out/{.bin-unwrapped,etc,lib/pulse-*}
   ''
     + ''
     moveToOutput lib/cmake "$dev"
-    rm -f $out/bin/qpaeq # this is packaged by the "qpaeq" package now, because of missing deps
+    rm -f $out/.bin-unwrapped/qpaeq # this is packaged by the "qpaeq" package now, because of missing deps
   '';
 
   preFixup = lib.optionalString (stdenv.isLinux  && (stdenv.hostPlatform == stdenv.buildPlatform)) ''
@@ -151,6 +156,15 @@ stdenv.mkDerivation rec {
       ln -s "''$file" "''${file%.dylib}.so"
       ln -s "''$file" "$out/lib/pulseaudio/''$(basename ''$file .dylib).so"
     done
+  ''
+  # put symlinks to binaries in `$prefix/bin`;
+  # then wrapGApp will *rename these symlinks* instead of
+  # the original binaries in `$prefix/.bin-unwrapped` (see above);
+  # when pulseaudio is looking for its own binary (it does!),
+  # it will be happy to find it in its original installation location
+  + lib.optionalString (!libOnly) ''
+    mkdir -p $out/bin
+    ln -st $out/bin $out/.bin-unwrapped/*
   '';
 
   meta = {
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index 82aa67a45d4..24e7b87f5c7 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -14,8 +14,8 @@ let
 
   pkgConfig = {
     node-sass = {
-      nativeBuildInputs = [ ];
-      buildInputs = [ libsass pkg-config python3 ];
+      nativeBuildInputs = [ pkg-config ];
+      buildInputs = [ libsass python3 ];
       postInstall = ''
         LIBSASS_EXT=auto yarn --offline run build
         rm build/config.gypi
diff --git a/pkgs/servers/web-apps/sogo/default.nix b/pkgs/servers/web-apps/sogo/default.nix
index 94672ffe6f1..286883722f6 100644
--- a/pkgs/servers/web-apps/sogo/default.nix
+++ b/pkgs/servers/web-apps/sogo/default.nix
@@ -14,8 +14,8 @@ gnustep.stdenv.mkDerivation rec {
     hash = "sha256-3Xy0y1sdixy4gXhzhP9mfWeaDmOVJty+X95xCyxayPE=";
   };
 
-  nativeBuildInputs = [ gnustep.make makeWrapper python3 ];
-  buildInputs = [ gnustep.base sope openssl libmemcached curl libsodium libytnef libzip pkg-config openldap oath-toolkit ]
+  nativeBuildInputs = [ gnustep.make makeWrapper python3 pkg-config ];
+  buildInputs = [ gnustep.base sope openssl libmemcached curl libsodium libytnef libzip openldap oath-toolkit ]
     ++ lib.optional enableActiveSync libwbxml;
 
   patches = lib.optional enableActiveSync ./enable-activesync.patch;
diff --git a/pkgs/servers/x11/quartz-wm/default.nix b/pkgs/servers/x11/quartz-wm/default.nix
index 9beb0553395..2d132b389be 100644
--- a/pkgs/servers/x11/quartz-wm/default.nix
+++ b/pkgs/servers/x11/quartz-wm/default.nix
@@ -12,6 +12,7 @@ in stdenv.mkDerivation {
     ./no_title_crash.patch
     ./extern-patch.patch
   ];
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     xorg.libXinerama
     xorg.libAppleWM
@@ -19,7 +20,6 @@ in stdenv.mkDerivation {
     xorg.libXrandr
     xorg.libXext
     pixman
-    pkg-config
     AppKit Xplugin Foundation
   ];
   meta = with lib; {
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index ff56f1de022..9a7cd9aa9de 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -698,6 +698,11 @@ rec {
         libc = pkgs.darwin.Libsystem;
         shellPackage = pkgs.bash;
         inherit bootstrapTools;
+      } // lib.optionalAttrs useAppleSDKLibs {
+        # This objc4 will be propagated to all builds using the final stdenv,
+        # and we shouldn't mix different builds, because they would be
+        # conflicting LLVM modules. Export it here so we can grab it later.
+        inherit (pkgs.darwin) objc4;
       };
 
       allowedRequisites = (with pkgs; [
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index f0fcb30451d..62f9121d73d 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1100,7 +1100,7 @@ buildPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             $buildFlags "${buildFlagsArray[@]}"
@@ -1139,7 +1139,7 @@ checkPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelChecking:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             ${checkFlags:-VERBOSE=y} "${checkFlagsArray[@]}"
@@ -1273,7 +1273,7 @@ installCheckPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelChecking:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             $installCheckFlags "${installCheckFlagsArray[@]}"
diff --git a/pkgs/tools/X11/xnee/default.nix b/pkgs/tools/X11/xnee/default.nix
index d2236dfe354..c16da204f2f 100644
--- a/pkgs/tools/X11/xnee/default.nix
+++ b/pkgs/tools/X11/xnee/default.nix
@@ -33,9 +33,10 @@ stdenv.mkDerivation rec {
         --replace 'LIBSEMA="CCC"' 'LIBSEMA=""'
     '';
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
     [ libX11 xorgproto libXext libXtst gtk2
-      libXi pkg-config
+      libXi
       texinfo
     ];
 
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 549096ec0e4..724301854b4 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
         --with-xkb-path=${xkeyboard_config}/share/X11/xkb \
         --with-xkb-bin-directory=${xorg.xkbcomp}/bin \
         --with-xkb-output=$out/share/X11/xkb/compiled
-    make TIGERVNC_SRC=$src TIGERVNC_BUILDDIR=`pwd`/../.. -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+    make TIGERVNC_SRC=$src TIGERVNC_BUILDDIR=`pwd`/../.. -j$NIX_BUILD_CORES
     popd
   '' + lib.optionalString stdenv.isDarwin ''
     make dmg
diff --git a/pkgs/tools/audio/midimonster/default.nix b/pkgs/tools/audio/midimonster/default.nix
index 3792d997aa0..841704427c2 100644
--- a/pkgs/tools/audio/midimonster/default.nix
+++ b/pkgs/tools/audio/midimonster/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
   pname = "midimonster";
   version = "0.6.0";
 
-  buildInputs = [pkg-config gnumake gcc lua5_4 openssl jack1 python3 alsa-lib ncurses libevdev];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [gnumake gcc lua5_4 openssl jack1 python3 alsa-lib ncurses libevdev];
 
   src = fetchFromGitHub {
     repo = "midimonster";
diff --git a/pkgs/tools/audio/mpdcron/default.nix b/pkgs/tools/audio/mpdcron/default.nix
index 94ba5a56d03..924181608af 100644
--- a/pkgs/tools/audio/mpdcron/default.nix
+++ b/pkgs/tools/audio/mpdcron/default.nix
@@ -31,10 +31,9 @@ in stdenv.mkDerivation {
     sha256 = "0vdksf6lcgmizqr5mqp0bbci259k0dj7gpmhx32md41jlmw5skaw";
   };
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [
     libtool
-    pkg-config
     glib
     libdaemon
     pandoc
diff --git a/pkgs/tools/backup/dump/default.nix b/pkgs/tools/backup/dump/default.nix
index 75a449a1276..f9e1b68ac39 100644
--- a/pkgs/tools/backup/dump/default.nix
+++ b/pkgs/tools/backup/dump/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0CGs3k+77T2T662YFCL2cfSNZrKeyI196DZC7Pv/T9A=";
   };
 
-  buildInputs = [ e2fsprogs pkg-config ncurses readline ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ e2fsprogs ncurses readline ];
 
   meta = with lib; {
     homepage = "https://dump.sourceforge.io/";
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index bd28ca63e80..771188a98cd 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -24,7 +24,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ xz.bin ];
 
-  makeFlags = [ "SHELL=/bin/sh" "GREP=grep" ];
+  makeFlags = [
+    "SHELL=/bin/sh"
+    "GREP=grep"
+    # gzip 1.12 doesn't build `zless` unless it can find `less`, but we
+    # can avoid having `less` as a build input if we just override these.
+    "ZLESS_MAN=zless.1"
+    "ZLESS_PROG=zless"
+  ];
 
   # Many gzip executables are shell scripts that depend upon other gzip
   # executables being in $PATH.  Rather than try to re-write all the
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index bf048eeb87d..af5342877c6 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, valgrind
+{ lib, stdenv, fetchFromGitHub, valgrind, fetchpatch
 , enableStatic ? stdenv.hostPlatform.isStatic
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
     owner = pname;
   };
 
+  patches = [
+    (fetchpatch { # https://github.com/lz4/lz4/pull/1162
+      name = "build-shared-no.patch";
+      url = "https://github.com/lz4/lz4/commit/851ef4b23c7cbf4ceb2ba1099666a8b5ec4fa195.patch";
+      sha256 = "sha256-P+/uz3m7EAmHgXF/1Vncc0uKKxNVq6HNIsElx0rGxpw=";
+    })
+  ];
+
   # TODO(@Ericson2314): Separate binaries and libraries
   outputs = [ "bin" "out" "dev" ];
 
diff --git a/pkgs/tools/filesystems/httpfs/default.nix b/pkgs/tools/filesystems/httpfs/default.nix
index 61843e4c65b..24233a8441d 100644
--- a/pkgs/tools/filesystems/httpfs/default.nix
+++ b/pkgs/tools/filesystems/httpfs/default.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "1h8ggvhw30n2r6w11n1s458ypggdqx6ldwd61ma4yd7binrlpjq1";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config fuse openssl
+    [ fuse openssl
       asciidoc docbook_xml_dtd_45 docbook_xsl libxml2 libxslt
     ];
 
diff --git a/pkgs/tools/graphics/s2png/default.nix b/pkgs/tools/graphics/s2png/default.nix
index c1124880944..d3f8b74512a 100644
--- a/pkgs/tools/graphics/s2png/default.nix
+++ b/pkgs/tools/graphics/s2png/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y3crfm0jqprgxamlly713cka2x1bp6z63p1lw9wh4wc37kpira6";
   };
 
-  buildInputs = [ diffutils gd pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ diffutils gd ];
   installFlags = [ "prefix=" "DESTDIR=$(out)" ];
 
   meta = {
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index cc290ab0eca..ff3b0afad25 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m17n_db, autoreconfHook, pkg-config }:
+{ lib, stdenv, fetchurl, fetchpatch, m17n_db, autoreconfHook, pkg-config }:
 stdenv.mkDerivation rec {
   pname = "m17n-lib";
   version = "1.8.0";
@@ -8,6 +8,17 @@ stdenv.mkDerivation rec {
     sha256 = "0jp61y09xqj10mclpip48qlfhniw8gwy8b28cbzxy8hq8pkwmfkq";
   };
 
+  patches = [
+    (fetchpatch {
+      # Patch pending upstream inclusion:
+      #   https://savannah.nongnu.org/bugs/index.php?61377
+      name = "parallel-build.patch";
+      url = "https://savannah.nongnu.org/bugs/download.php?file_id=53704";
+      hash = "sha256-1smKSIFVRJZSwCv0NiUsnndxKcPnJ/wqzH8+ka6nfNM=";
+      excludes = [ "src/ChangeLog" ];
+    })
+  ];
+
   strictDeps = true;
 
   # reconf needed to sucesfully cross-compile
@@ -17,10 +28,7 @@ stdenv.mkDerivation rec {
     m17n_db
   ];
 
-  # Fails parallel build due to missing intra-package depends:
-  #   https://savannah.nongnu.org/bugs/index.php?61377
-  #     make[2]: *** No rule to make target '../src/libm17n-core.la', needed by 'libm17n.la'.  Stop.
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;
 
   meta = {
     homepage = "https://www.nongnu.org/m17n/";
diff --git a/pkgs/tools/misc/cpuminer/default.nix b/pkgs/tools/misc/cpuminer/default.nix
index 27bf0ec5374..eb7a73e469c 100644
--- a/pkgs/tools/misc/cpuminer/default.nix
+++ b/pkgs/tools/misc/cpuminer/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
 
   patchPhase = if stdenv.cc.isClang then "${perl}/bin/perl ./nomacro.pl" else null;
 
-  buildInputs = [ curl jansson autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ curl jansson ];
 
   configureFlags = [ "CFLAGS=-O3" ];
 
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 5a792c040b3..45f45e89e82 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, tcl, makeWrapper, autoreconfHook, fetchpatch }:
+{ lib, stdenv, buildPackages, fetchurl, tcl, makeWrapper, autoreconfHook, fetchpatch, substituteAll }:
 
 tcl.mkTclDerivation rec {
   pname = "expect";
@@ -14,6 +14,10 @@ tcl.mkTclDerivation rec {
       url = "https://raw.githubusercontent.com/buildroot/buildroot/c05e6aa361a4049eabd8b21eb64a34899ef83fc7/package/expect/0001-enable-cross-compilation.patch";
       sha256 = "1jwx2l1slidvcpahxbyqs942l81jd62rzbxliyd9lwysk38c8b6b";
     })
+    (substituteAll {
+      src = ./fix-cross-compilation.patch;
+      tcl = "${buildPackages.tcl}/bin/tclsh";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/expect/fix-cross-compilation.patch b/pkgs/tools/misc/expect/fix-cross-compilation.patch
new file mode 100644
index 00000000000..8edc4bea39d
--- /dev/null
+++ b/pkgs/tools/misc/expect/fix-cross-compilation.patch
@@ -0,0 +1,11 @@
+--- a/Makefile.in	2022-09-07 21:46:37.090519258 +0200
++++ b/Makefile.in	2022-09-07 21:46:21.462592279 +0200
+@@ -380,7 +380,7 @@
+ 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
+ 
+ $(SCRIPTS):
+-	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
++	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
+ 
+ ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
+ ## expansion references the contents of LIBS, which contains linker
diff --git a/pkgs/tools/misc/notify-desktop/default.nix b/pkgs/tools/misc/notify-desktop/default.nix
index c906443b07c..22b5035da51 100644
--- a/pkgs/tools/misc/notify-desktop/default.nix
+++ b/pkgs/tools/misc/notify-desktop/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1brcvl2fx0yzxj9mc8hzfl32zdka1f1bxpzsclcsjplyakyinr1a";
   };
 
-  buildInputs = [ dbus pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dbus ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/popsicle/default.nix b/pkgs/tools/misc/popsicle/default.nix
index e9369270fcd..bae9465c7cb 100644
--- a/pkgs/tools/misc/popsicle/default.nix
+++ b/pkgs/tools/misc/popsicle/default.nix
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
   postPatch = ''
     # Have to do this here instead of in preConfigure because
     # cargoDepsCopy gets unset after postPatch.
-    configureFlagsArray+=("RUST_VENDORED_SOURCES=$NIX_BUILD_TOP/$cargoDepsCopy")
+    configureFlagsArray+=("RUST_VENDORED_SOURCES=$cargoDepsCopy")
   '';
 
   makeFlags = [
diff --git a/pkgs/tools/networking/nss-mdns/default.nix b/pkgs/tools/networking/nss-mdns/default.nix
index 238c0c364f9..f2af99a922f 100644
--- a/pkgs/tools/networking/nss-mdns/default.nix
+++ b/pkgs/tools/networking/nss-mdns/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-iRaf9/gu9VkGi1VbGpxvC5q+0M8ivezCz/oAKEg5V1M=";
   };
 
-  buildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   # Note: Although `nss-mdns' works by talking to `avahi-daemon', it
   # doesn't depend on the Avahi libraries.  Instead, it contains
   # hand-written D-Bus code to talk to the Avahi daemon.
diff --git a/pkgs/tools/networking/ofono/default.nix b/pkgs/tools/networking/ofono/default.nix
index 80e37782154..3733998c10b 100644
--- a/pkgs/tools/networking/ofono/default.nix
+++ b/pkgs/tools/networking/ofono/default.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ofono";
-  version = "1.34";
+  version = "2.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/network/ofono/ofono.git";
     rev = version;
-    sha256 = "sha256-mqltc+/RmQO8awP+J7p9fCVhNsEYA3SgxeV5Gkr1srg=";
+    sha256 = "sha256-T8rfReruvHGQCN9IDGIrFCoNjFKKMnUGPKzxo2HTZFQ=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/sipsak/default.nix b/pkgs/tools/networking/sipsak/default.nix
index 668dc18f8ac..89a7d706ccd 100644
--- a/pkgs/tools/networking/sipsak/default.nix
+++ b/pkgs/tools/networking/sipsak/default.nix
@@ -4,8 +4,8 @@ stdenv.mkDerivation rec {
   pname = "sipsak";
   version = "4.1.2.1";
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [
-    autoreconfHook
     openssl
     c-ares
   ];
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 189cc14ff1b..25fcc1bcc39 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,20 +48,20 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.16.2";
+  version = "1.16.3";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-LjLyg4IMJMUcod2K/s/bdHxzhaE3q+hlyZ20sldANYE=";
+    hash = "sha256-6gxmZeLDMlt2nqwd/M1g/hgo1fz2YmUAOezLP2ftso4=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
 
-  nativeBuildInputs = [ makeWrapper ]
+  nativeBuildInputs = [ makeWrapper pkg-config ]
     ++ lib.optionals withPythonModule [ swig ];
 
   buildInputs = [ openssl nettle expat libevent ]
-    ++ lib.optionals withSystemd [ pkg-config systemd ]
+    ++ lib.optionals withSystemd [ systemd ]
     ++ lib.optionals withDoH [ libnghttp2 ]
     ++ lib.optionals withPythonModule [ python ];
 
diff --git a/pkgs/tools/security/chrome-token-signing/default.nix b/pkgs/tools/security/chrome-token-signing/default.nix
index 18104aa7710..8081c7ef6eb 100644
--- a/pkgs/tools/security/chrome-token-signing/default.nix
+++ b/pkgs/tools/security/chrome-token-signing/default.nix
@@ -11,7 +11,8 @@ mkDerivation rec {
     sha256 = "sha256-wKy/RVR7jx5AkMJgHXsuV+jlzyfH5nDRggcIUgh2ML4=";
   };
 
-  buildInputs = [ qmake pcsclite pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ qmake pcsclite ];
   dontUseQmakeConfigure = true;
 
   patchPhase = ''
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index cd90342738e..777aaea41ec 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -35,11 +35,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optionals (!enablePython) [ "--disable-pywrap" ];
 
-  nativeBuildInputs = [ pkg-config makeWrapper ]
+  nativeBuildInputs = [ pkg-config makeWrapper intltool ]
   # if python2 support is requested, it is needed at builtime as well as runtime.
   ++ lib.optionals (enablePython) [ python2 ]
   ;
-  buildInputs = [ perl nss nspr pam intltool ]
+  buildInputs = [ perl nss nspr pam ]
   ++ lib.optionals (enablePython) [ python2 ]
   ;
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
diff --git a/pkgs/tools/security/fpm2/default.nix b/pkgs/tools/security/fpm2/default.nix
index 15d5a5adcff..69e6c7f0281 100644
--- a/pkgs/tools/security/fpm2/default.nix
+++ b/pkgs/tools/security/fpm2/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lfzja3vzd6l6hfvw8gvg4qkl5iy6gra5pa8gjlps9l63k2bjfhz";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gnupg gtk3 libxml2 intltool nettle ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gnupg gtk3 libxml2 nettle ];
 
   meta = with lib; {
     description = "GTK2 port from Figaro's Password Manager originally developed by John Conneely, with some new enhancements";
diff --git a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
index 1e46df40f85..22c11b3f2b1 100644
--- a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
+++ b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Kb8p53gPkhxtOhH2COKwSDwbtRDFr6hHMJAkndV8Ukk=";
   };
 
-  buildInputs = [ pkcs11helper pkg-config openssl ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pkcs11helper openssl ];
 
   configureFlags = [
     "--with-libgpg-error-prefix=${libgpg-error.dev}"
diff --git a/pkgs/tools/security/metasploit/shell.nix b/pkgs/tools/security/metasploit/shell.nix
index e4bae57b686..ccd510f63af 100644
--- a/pkgs/tools/security/metasploit/shell.nix
+++ b/pkgs/tools/security/metasploit/shell.nix
@@ -2,6 +2,7 @@
 with import <nixpkgs> {};
 stdenv.mkDerivation {
   name = "env";
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     bundix
     git
@@ -9,7 +10,6 @@ stdenv.mkDerivation {
     libpcap
     libxml2
     libxslt
-    pkg-config
     postgresql
     ruby.devEnv
     sqlite
diff --git a/pkgs/tools/security/onioncircuits/default.nix b/pkgs/tools/security/onioncircuits/default.nix
index 329de10ff6b..249762781e7 100644
--- a/pkgs/tools/security/onioncircuits/default.nix
+++ b/pkgs/tools/security/onioncircuits/default.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [ intltool ];
-  buildInputs = [ intltool gtk3 gobject-introspection ];
+  buildInputs = [ gtk3 gobject-introspection ];
   propagatedBuildInputs =  with python3.pkgs; [ stem distutils_extra pygobject3 ];
 
   postFixup = ''
diff --git a/pkgs/tools/security/tracee/default.nix b/pkgs/tools/security/tracee/default.nix
index 48d102e619d..7d93e6d76f7 100644
--- a/pkgs/tools/security/tracee/default.nix
+++ b/pkgs/tools/security/tracee/default.nix
@@ -63,7 +63,7 @@ buildGoModule rec {
 
   buildPhase = ''
     runHook preBuild
-    make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES -l$NIX_BUILD_CORES}
+    make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES
     runHook postBuild
   '';
 
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index 5fc242d533b..eedb0f07d13 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nr8l88cg19zj585hczj8v73yh21k7j13xivhlzl8jdk0j0cj052";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 libxml2 intltool gettext ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 libxml2 gettext ];
 
   patches = [ ./get_sensitive.patch ./set_flags.patch ];
 
diff --git a/pkgs/tools/typesetting/asciidoc/default.nix b/pkgs/tools/typesetting/asciidoc/default.nix
index cf6e0bdb3d4..4cfecfccdbc 100644
--- a/pkgs/tools/typesetting/asciidoc/default.nix
+++ b/pkgs/tools/typesetting/asciidoc/default.nix
@@ -218,7 +218,7 @@ in python3.pkgs.buildPythonApplication rec {
     # cannot find their neighbours (e.g. pdflatex doesn't find mktextfm).
     # We can remove PATH= when those impurities are fixed.
     # TODO: Is this still necessary when using texlive?
-    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', PATH='${lib.makeBinPath [ texlive coreutils gnused ]}')|" \
+    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', PATH='${lib.makeBinPath [ texlive coreutils gnused ]}', **(dict(filter(lambda v: v[0] == 'SOURCE_DATE_EPOCH', os.environ.items()))))|" \
         -e "s|^ASCIIDOC =.*|ASCIIDOC = '$out/bin/asciidoc'|" \
         -e "s|^XSLTPROC =.*|XSLTPROC = '${libxslt.bin}/bin/xsltproc'|" \
         -e "s|^DBLATEX =.*|DBLATEX = '${dblatexFull}/bin/dblatex'|" \
@@ -229,7 +229,7 @@ in python3.pkgs.buildPythonApplication rec {
         -e "s|^EPUBCHECK =.*|EPUBCHECK = '${epubcheck}/bin/epubcheck'|" \
         -i asciidoc/a2x.py
   '' else ''
-    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml')|" \
+    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', **(dict(filter(lambda v: v[0] == 'SOURCE_DATE_EPOCH', os.environ.items()))))|" \
         -e "s|^XSLTPROC =.*|XSLTPROC = '${libxslt.bin}/bin/xsltproc'|" \
         -e "s|^XMLLINT =.*|XMLLINT = '${libxml2.bin}/bin/xmllint'|" \
         -i asciidoc/a2x.py
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 8da3df2773f..94ed0b87362 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch
+{ lib, stdenv, fetchurl, fetchpatch, buildPackages
 , texlive
 , zlib, libiconv, libpng, libX11
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
@@ -77,7 +77,13 @@ core = stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # configure: error: tangle was not found but is required when cross-compiling.
+    texlive.bin.core
+  ];
+
   buildInputs = [
     /*teckit*/ zziplib mpfr gmp
     pixman gd freetype libpng libpaper zlib
@@ -94,7 +100,10 @@ core = stdenv.mkDerivation rec {
   '';
   configureScript = "../configure";
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   configureFlags = common.configureFlags
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "BUILDCC=${buildPackages.stdenv.cc.targetPrefix}cc" ]
     ++ [ "--without-x" ] # disable xdvik and xpdfopen
     ++ map (what: "--disable-${what}") [
       "chktex"
@@ -113,7 +122,7 @@ core = stdenv.mkDerivation rec {
 
   # TODO: perhaps improve texmf.cnf search locations
   postInstall = /* links format -> engine will be regenerated in texlive.combine */ ''
-    PATH="$out/bin:$PATH" ${texlinks}/bin/texlinks --cnffile "$out/share/texmf-dist/web2c/fmtutil.cnf" --unlink "$out/bin"
+    PATH="$out/bin:$PATH" ${buildPackages.texlive.bin.texlinks}/bin/texlinks --cnffile "$out/share/texmf-dist/web2c/fmtutil.cnf" --unlink "$out/bin"
   '' + /* a few texmf-dist files are useful; take the rest from pkgs */ ''
     mv "$out/share/texmf-dist/web2c/texmf.cnf" .
     rm -r "$out/share/texmf-dist"
@@ -202,7 +211,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
         if [[ "$path" =~ "libs/pplib" ]]; then
           # TODO: revert for texlive 2022
           # ../../../texk/web2c/luatexdir/luamd5/md5lib.c:197:10: fatal error: 'utilsha.h' file not found
-          make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES} -l''${NIX_BUILD_CORES}}
+          make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}}
         fi
       )
     done
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ac4ea888a94..88757c2aa13 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -922,7 +922,9 @@ with pkgs;
     { deps = [ dieHook ];
       substitutions = {
         shell = targetPackages.runtimeShell;
-        passthru.tests = tests.makeWrapper;
+      };
+      passthru = {
+        tests = tests.makeWrapper;
       };
     }
     ../build-support/setup-hooks/make-wrapper.sh;
@@ -2201,7 +2203,10 @@ with pkgs;
 
   brewtarget = libsForQt514.callPackage ../applications/misc/brewtarget { } ;
 
-  stdenvBootstrapTools = if stdenv.hostPlatform.isDarwin then
+  # Derivation's result is not used by nixpkgs. Useful for validation for
+  # regressions of bootstrapTools on hydra and on ofborg. Example:
+  #     pkgsCross.aarch64-multiplatform.freshBootstrapTools.build
+  freshBootstrapTools = if stdenv.hostPlatform.isDarwin then
     callPackage ../stdenv/darwin/make-bootstrap-tools.nix {
       localSystem = stdenv.buildPlatform;
       crossSystem =
@@ -2209,7 +2214,7 @@ with pkgs;
     }
   else if stdenv.hostPlatform.isLinux then
     callPackage ../stdenv/linux/make-bootstrap-tools.nix {}
-  else throw "stdenvBootstrapTools: unknown hostPlatform ${stdenv.hostPlatform.config}";
+  else throw "freshBootstrapTools: unknown hostPlatform ${stdenv.hostPlatform.config}";
 
   boxes = callPackage ../tools/text/boxes { };
 
@@ -14571,11 +14576,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_63 = callPackage ../development/compilers/rust/1_63.nix {
+  rust_1_64 = callPackage ../development/compilers/rust/1_64.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_14 = llvmPackages_14.libllvm;
   };
-  rust = rust_1_63;
+  rust = rust_1_64;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -14584,8 +14589,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_63 = rust_1_63.packages.stable;
-  rustPackages = rustPackages_1_63;
+  rustPackages_1_64 = rust_1_64.packages.stable;
+  rustPackages = rustPackages_1_64;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index 9a6b1880950..d5f820d0d60 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -50,7 +50,7 @@ rec {
   }).overrideDerivation
     (old: {
       propagatedBuildInputs = [ zlib ];
-      buildInputs = old.buildInputs ++ [ pkg-config ];
+      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pkg-config ];
 
       # just override it with nothing so it does not fail
       autoreconfPhase = "echo autoreconfPhase not used...";
@@ -87,7 +87,7 @@ rec {
     pname = "xmlmirror";
     version = "unstable-2016-06-05";
 
-    buildInputs = [ pkg-config libtool gnumake libxml2 nodejs openjdk json_c ];
+    buildInputs = [ libtool gnumake libxml2 nodejs openjdk json_c ];
     nativeBuildInputs = [ pkg-config zlib autoconf automake ];
 
     src = pkgs.fetchgit {
@@ -140,7 +140,7 @@ rec {
     stdenv = pkgs.emscriptenStdenv;
   }).overrideDerivation
     (old: {
-      buildInputs = old.buildInputs ++ [ pkg-config ];
+      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pkg-config ];
       # we need to reset this setting!
       NIX_CFLAGS_COMPILE="";
       dontStrip = true;
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index 302b301b115..e8ce756fe99 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -45,7 +45,7 @@ in {
     mkBootstrap = adoptopenjdk: path: args:
       /* adoptopenjdk not available for i686, so fall back to our old builds for bootstrapping */
       if   adoptopenjdk.jdk-hotspot.meta.available
-      then adoptopenjdk.jdk-hotspot
+      then adoptopenjdk.jdk-hotspot.override { gtkSupport = false; }
       else callPackage path args;
 
     mkOpenjdk = path-linux: path-darwin: args:
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6a5806736e9..564f9d5ecc5 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13873,7 +13873,8 @@ let
       url = "mirror://cpan/authors/id/L/LK/LKUNDRAK/Log-Journald-0.30.tar.gz";
       hash = "sha256-VZks+aHh+4M/QoMAUlv6fPftRrg+xBT4KgkXibN9CKM=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.systemd ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.systemd ];
     postPatch = ''
       substituteInPlace Build.PL \
         --replace "libsystemd-journal" "libsystemd"
@@ -20935,7 +20936,8 @@ let
       url = "mirror://cpan/authors/id/L/LK/LKUNDRAK/RPM2-1.4.tar.gz";
       hash = "sha256-XstCqmkyTm9AiKv64HMTkG5aq/L0bxIE8/HeWRVbtjY=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.rpm ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.rpm ];
     doCheck = false; # Tries to open /var/lib/rpm
     meta = {
       description = "Perl bindings for the RPM Package Manager API";
@@ -27230,7 +27232,8 @@ let
       url = "mirror://cpan/authors/id/S/SH/SHLOMIF/XML-LibXSLT-1.99.tar.gz";
       hash = "sha256-En4XqHf7YeR7nouHv42q0xM5pioAEh+XUdUitDiw9/A=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.zlib pkgs.libxml2 pkgs.libxslt ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.zlib pkgs.libxml2 pkgs.libxslt ];
     propagatedBuildInputs = [ XMLLibXML ];
     meta = {
       description = "Interface to the GNOME libxslt library";
@@ -27806,7 +27809,8 @@ let
 
     makeMakerFlags = "--prefix-openssl=${pkgs.openssl_1_1.dev}";
 
-    buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl_1_1 pkgs.pkg-config ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl_1_1 ];
     meta = {
       description = "Perl wrapper for the ldns DNS library";
       license = with lib.licenses; [ bsd3 ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 381acbf4aa7..b8cb72ad369 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7322,7 +7322,7 @@ in {
   psd-tools = callPackage ../development/python-modules/psd-tools { };
 
   psutil = callPackage ../development/python-modules/psutil {
-    inherit (pkgs.darwin.apple_sdk.frameworks) IOKit;
+    inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation IOKit;
   };
 
   psutil-home-assistant = callPackage ../development/python-modules/psutil-home-assistant { };
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index bac3d1b1171..61116328b29 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -30,7 +30,7 @@ let
     "aarch64"
   ] (arch: builtins.elem "${arch}-darwin" systemsWithAnySupport);
 
-  jobs =
+  nonPackageJobs =
     { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease supportedSystems; };
 
       metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
@@ -167,7 +167,9 @@ let
           (system: {
             inherit
               (import ../stdenv/linux/make-bootstrap-tools.nix {
-                localSystem = { inherit system; };
+                pkgs = import ../.. {
+                  localSystem = { inherit system; };
+                };
               })
               dist test;
           })
@@ -175,7 +177,9 @@ let
         // optionalAttrs supportDarwin.x86_64 {
           x86_64-darwin =
             let
-              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix { system = "x86_64-darwin"; };
+              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix {
+                localSystem = { system = "x86_64-darwin"; };
+              };
             in {
               # Lightweight distribution and test
               inherit (bootstrap) dist test;
@@ -186,14 +190,25 @@ let
           # Cross compiled bootstrap tools
           aarch64-darwin =
             let
-              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix { system = "x86_64-darwin"; crossSystem = "aarch64-darwin"; };
+              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix {
+                localSystem = { system = "x86_64-darwin"; };
+                crossSystem = { system = "aarch64-darwin"; };
+              };
             in {
               # Distribution only for now
               inherit (bootstrap) dist;
             };
           };
 
-    } // (mapTestOn ((packagePlatforms pkgs) // {
+       };
+
+  # Do not allow attribute collision between jobs inserted in
+  # 'nonPackageAttrs' and jobs pulled in from 'pkgs'.
+  # Conflicts usually cause silent job drops like in
+  #   https://github.com/NixOS/nixpkgs/pull/182058
+  jobs = lib.attrsets.unionOfDisjoint
+    nonPackageJobs
+    (mapTestOn ((packagePlatforms pkgs) // {
       haskell.compiler = packagePlatforms pkgs.haskell.compiler;
       haskellPackages = packagePlatforms pkgs.haskellPackages;
       idrisPackages = packagePlatforms pkgs.idrisPackages;