summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS14
-rw-r--r--maintainers/maintainer-list.nix20
-rw-r--r--maintainers/team-list.nix2
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md5
-rw-r--r--nixos/modules/config/stevenblack.nix2
-rw-r--r--nixos/modules/services/databases/postgresql.md119
-rw-r--r--nixos/modules/services/databases/postgresql.nix58
-rw-r--r--nixos/modules/services/development/zammad.nix4
-rw-r--r--nixos/modules/services/finance/odoo.nix2
-rw-r--r--nixos/modules/services/mail/listmonk.nix2
-rw-r--r--nixos/modules/services/mail/roundcube.nix14
-rw-r--r--nixos/modules/services/mail/sympa.nix10
-rw-r--r--nixos/modules/services/matrix/matrix-sliding-sync.nix4
-rw-r--r--nixos/modules/services/matrix/mautrix-facebook.nix4
-rw-r--r--nixos/modules/services/misc/atuin.nix4
-rw-r--r--nixos/modules/services/misc/forgejo.md79
-rw-r--r--nixos/modules/services/misc/forgejo.nix11
-rw-r--r--nixos/modules/services/misc/gitea.nix10
-rw-r--r--nixos/modules/services/misc/redmine.nix4
-rw-r--r--nixos/modules/services/misc/sourcehut/service.nix10
-rw-r--r--nixos/modules/services/monitoring/zabbix-proxy.nix4
-rw-r--r--nixos/modules/services/monitoring/zabbix-server.nix4
-rw-r--r--nixos/modules/services/security/hockeypuck.nix2
-rw-r--r--nixos/modules/services/web-apps/coder.nix10
-rw-r--r--nixos/modules/services/web-apps/gotosocial.nix4
-rw-r--r--nixos/modules/services/web-apps/invidious.nix15
-rw-r--r--nixos/modules/services/web-apps/lemmy.nix2
-rw-r--r--nixos/modules/services/web-apps/mastodon.nix6
-rw-r--r--nixos/modules/services/web-apps/mediawiki.nix4
-rw-r--r--nixos/modules/services/web-apps/miniflux.nix17
-rw-r--r--nixos/modules/services/web-apps/mobilizon.nix13
-rw-r--r--nixos/modules/services/web-apps/moodle.nix4
-rw-r--r--nixos/modules/services/web-apps/netbox.nix4
-rw-r--r--nixos/modules/services/web-apps/nextcloud.nix2
-rw-r--r--nixos/modules/services/web-apps/onlyoffice.nix2
-rw-r--r--nixos/modules/services/web-apps/outline.nix2
-rw-r--r--nixos/modules/services/web-apps/peering-manager.nix4
-rw-r--r--nixos/modules/services/web-apps/pixelfed.nix1
-rw-r--r--nixos/modules/services/web-apps/tt-rss.nix13
-rw-r--r--nixos/modules/services/web-servers/hydron.nix2
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py17
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix2
-rw-r--r--nixos/tests/dex-oidc.nix2
-rw-r--r--nixos/tests/ferretdb.nix2
-rw-r--r--nixos/tests/freshrss-pgsql.nix4
-rw-r--r--nixos/tests/grafana/basic.nix2
-rw-r--r--nixos/tests/hockeypuck.nix2
-rw-r--r--nixos/tests/home-assistant.nix12
-rw-r--r--nixos/tests/invidious.nix3
-rw-r--r--nixos/tests/paperless.nix2
-rw-r--r--nixos/tests/pgadmin4.nix8
-rw-r--r--nixos/tests/pgbouncer.nix10
-rw-r--r--nixos/tests/powerdns-admin.nix4
-rw-r--r--nixos/tests/sftpgo.nix2
-rw-r--r--nixos/tests/systemd-boot.nix16
-rw-r--r--nixos/tests/tandoor-recipes.nix23
-rw-r--r--nixos/tests/vikunja.nix2
-rw-r--r--nixos/tests/wiki-js.nix5
-rw-r--r--pkgs/applications/audio/reaper/default.nix35
-rwxr-xr-xpkgs/applications/audio/reaper/updater.sh16
-rw-r--r--pkgs/applications/editors/molsketch/default.nix2
-rw-r--r--pkgs/applications/editors/ox/default.nix2
-rw-r--r--pkgs/applications/editors/texstudio/default.nix8
-rw-r--r--pkgs/applications/graphics/gscreenshot/default.nix4
-rw-r--r--pkgs/applications/graphics/hydrus/default.nix4
-rw-r--r--pkgs/applications/misc/flavours/default.nix2
-rw-r--r--pkgs/applications/misc/kile-wl/default.nix2
-rw-r--r--pkgs/applications/misc/tiramisu/default.nix2
-rw-r--r--pkgs/applications/misc/upwork/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/vieb/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/kluctl/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/kubefirst/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/rke/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/tfautomv/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/mailspring/default.nix5
-rw-r--r--pkgs/applications/radio/uhd/default.nix6
-rw-r--r--pkgs/applications/terminal-emulators/contour/default.nix2
-rw-r--r--pkgs/applications/version-management/gitlab/default.nix4
-rw-r--r--pkgs/applications/video/bilibili/default.nix4
-rw-r--r--pkgs/applications/window-managers/lemonbar/default.nix2
-rw-r--r--pkgs/applications/window-managers/lemonbar/xft.nix2
-rw-r--r--pkgs/applications/window-managers/neocomp/default.nix2
-rw-r--r--pkgs/applications/window-managers/river/default.nix2
-rw-r--r--pkgs/applications/window-managers/sway/wrapper.nix14
-rw-r--r--pkgs/by-name/ap/apache-users/optional-args.patch24
-rw-r--r--pkgs/by-name/ap/apache-users/package.nix43
-rw-r--r--pkgs/by-name/co/cockpit/package.nix4
-rw-r--r--pkgs/by-name/cy/cyme/package.nix6
-rw-r--r--pkgs/by-name/no/nom/package.nix4
-rw-r--r--pkgs/by-name/po/polybar/package.nix2
-rw-r--r--pkgs/data/fonts/curie/default.nix2
-rw-r--r--pkgs/data/fonts/edwin/default.nix2
-rw-r--r--pkgs/data/fonts/open-fonts/default.nix2
-rw-r--r--pkgs/data/fonts/scientifica/default.nix2
-rw-r--r--pkgs/data/icons/papirus-icon-theme/default.nix2
-rw-r--r--pkgs/data/icons/phinger-cursors/default.nix2
-rw-r--r--pkgs/data/themes/onestepback/default.nix16
-rw-r--r--pkgs/data/themes/yaru/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/clang/LLVMgold-path.patch14
-rw-r--r--pkgs/development/compilers/llvm/5/clang/default.nix127
-rw-r--r--pkgs/development/compilers/llvm/5/clang/gnu-install-dirs.patch242
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/armv7l.patch23
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/codesign.patch155
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/compiler-rt-5-cstddef.patch10
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/default.nix112
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/gnu-install-dirs.patch103
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/sys-ustat.patch58
-rw-r--r--pkgs/development/compilers/llvm/5/default.nix140
-rw-r--r--pkgs/development/compilers/llvm/5/libcxx/default.nix79
-rw-r--r--pkgs/development/compilers/llvm/5/libcxx/gnu-install-dirs.patch72
-rw-r--r--pkgs/development/compilers/llvm/5/libcxxabi/default.nix70
-rw-r--r--pkgs/development/compilers/llvm/5/libcxxabi/gnu-install-dirs.patch28
-rw-r--r--pkgs/development/compilers/llvm/5/lld/default.nix46
-rw-r--r--pkgs/development/compilers/llvm/5/lld/gnu-install-dirs.patch68
-rw-r--r--pkgs/development/compilers/llvm/5/lldb/default.nix88
-rw-r--r--pkgs/development/compilers/llvm/5/lldb/gnu-install-dirs.patch76
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/default.nix283
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/fix-gcc9.patch33
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/gnu-install-dirs-polly.patch106
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/gnu-install-dirs.patch386
-rw-r--r--pkgs/development/compilers/llvm/5/openmp/default.nix37
-rw-r--r--pkgs/development/coq-modules/ITree/default.nix3
-rw-r--r--pkgs/development/coq-modules/coqprime/default.nix3
-rw-r--r--pkgs/development/coq-modules/dpdgraph/default.nix4
-rw-r--r--pkgs/development/embedded/blisp/default.nix3
-rw-r--r--pkgs/development/embedded/elf2uf2-rs/default.nix2
-rw-r--r--pkgs/development/haskell-modules/generic-builder.nix4
-rw-r--r--pkgs/development/interpreters/python/python2/mk-python-derivation.nix3
-rw-r--r--pkgs/development/interpreters/ruby/default.nix18
-rw-r--r--pkgs/development/libraries/audio/zix/default.nix7
-rw-r--r--pkgs/development/libraries/librttopo/default.nix2
-rw-r--r--pkgs/development/libraries/libspatialite/default.nix2
-rw-r--r--pkgs/development/libraries/shapelib/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/cooltt/default.nix2
-rw-r--r--pkgs/development/python-modules/acquire/default.nix4
-rw-r--r--pkgs/development/python-modules/bork/default.nix16
-rw-r--r--pkgs/development/python-modules/dasbus/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-fat/default.nix4
-rw-r--r--pkgs/development/python-modules/dissect-hypervisor/default.nix4
-rw-r--r--pkgs/development/python-modules/dissect-regf/default.nix4
-rw-r--r--pkgs/development/python-modules/dissect-sql/default.nix4
-rw-r--r--pkgs/development/python-modules/flow-record/default.nix4
-rw-r--r--pkgs/development/python-modules/glances-api/default.nix8
-rw-r--r--pkgs/development/python-modules/hledger-utils/default.nix4
-rw-r--r--pkgs/development/python-modules/iceportal/default.nix6
-rw-r--r--pkgs/development/python-modules/llm/001-disable-install-uninstall-commands.patch34
-rw-r--r--pkgs/development/python-modules/llm/default.nix107
-rw-r--r--pkgs/development/python-modules/opensensemap-api/default.nix4
-rw-r--r--pkgs/development/python-modules/owslib/default.nix6
-rw-r--r--pkgs/development/python-modules/pyproj/default.nix6
-rw-r--r--pkgs/development/python-modules/shapely/default.nix8
-rw-r--r--pkgs/development/python-modules/sqids/default.nix4
-rw-r--r--pkgs/development/python-modules/towncrier/default.nix36
-rw-r--r--pkgs/development/python-modules/trainer/default.nix12
-rw-r--r--pkgs/development/python-modules/web-cache/default.nix2
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/ats-acc/default.nix2
-rw-r--r--pkgs/development/tools/azcopy/default.nix20
-rw-r--r--pkgs/development/tools/azure-static-sites-client/versions.json48
-rw-r--r--pkgs/development/tools/bearer/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/cirrus-cli/default.nix6
-rw-r--r--pkgs/development/tools/fusee-launcher/default.nix10
-rw-r--r--pkgs/development/tools/github/bump/default.nix6
-rw-r--r--pkgs/development/tools/ko/default.nix4
-rw-r--r--pkgs/development/tools/language-servers/zls/default.nix2
-rw-r--r--pkgs/development/tools/misc/complgen/default.nix6
-rw-r--r--pkgs/development/tools/misc/cvise/default.nix13
-rw-r--r--pkgs/development/tools/misc/hydra/crypt-passphrase-argon2-fix-output-len.patch28
-rw-r--r--pkgs/development/tools/misc/hydra/unstable.nix4
-rw-r--r--pkgs/development/tools/misc/sccache/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-leptos/Cargo.lock2
-rw-r--r--pkgs/development/tools/rust/cargo-leptos/default.nix4
-rw-r--r--pkgs/development/web/bun/default.nix10
-rw-r--r--pkgs/development/web/mailcatcher/default.nix4
-rw-r--r--pkgs/games/scummvm/default.nix4
-rw-r--r--pkgs/misc/fastly/default.nix6
-rw-r--r--pkgs/misc/i3a/default.nix2
-rw-r--r--pkgs/os-specific/linux/cryptodev/default.nix2
-rw-r--r--pkgs/os-specific/linux/irqbalance/default.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8812au/default.nix2
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/default.nix2
-rw-r--r--pkgs/os-specific/linux/xf86-input-wacom/default.nix2
-rw-r--r--pkgs/servers/bloat/default.nix6
-rw-r--r--pkgs/servers/dendrite/default.nix14
-rw-r--r--pkgs/servers/http/unit/default.nix3
-rw-r--r--pkgs/servers/matrix-synapse/default.nix3
-rw-r--r--pkgs/servers/nosql/ferretdb/default.nix6
-rw-r--r--pkgs/servers/owntracks-recorder/default.nix4
-rw-r--r--pkgs/servers/snappymail/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/postgis.nix2
-rw-r--r--pkgs/servers/static-web-server/default.nix6
-rw-r--r--pkgs/shells/hilbish/default.nix2
-rw-r--r--pkgs/shells/zsh/spaceship-prompt/default.nix2
-rw-r--r--pkgs/stdenv/darwin/make-bootstrap-tools.nix22
-rw-r--r--pkgs/test/default.nix1
-rw-r--r--pkgs/tools/admin/awscli/default.nix4
-rw-r--r--pkgs/tools/admin/scalr-cli/default.nix4
-rw-r--r--pkgs/tools/audio/tts/default.nix8
-rw-r--r--pkgs/tools/bluetooth/bluetuith/default.nix6
-rw-r--r--pkgs/tools/graphics/xcolor/default.nix2
-rw-r--r--pkgs/tools/misc/bfetch/default.nix2
-rw-r--r--pkgs/tools/misc/bootspec/default.nix12
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/elfcat/default.nix2
-rw-r--r--pkgs/tools/misc/fetchutils/default.nix2
-rw-r--r--pkgs/tools/misc/sacad/default.nix2
-rw-r--r--pkgs/tools/misc/vector/Cargo.lock2
-rw-r--r--pkgs/tools/misc/vector/default.nix4
-rw-r--r--pkgs/tools/networking/crackle/default.nix2
-rw-r--r--pkgs/tools/networking/mdk4/default.nix2
-rw-r--r--pkgs/tools/networking/redfang/default.nix2
-rw-r--r--pkgs/tools/networking/stevenblack-blocklist/default.nix2
-rw-r--r--pkgs/tools/package-management/xbps/default.nix17
-rw-r--r--pkgs/tools/security/chain-bench/default.nix4
-rw-r--r--pkgs/tools/security/sequoia-sqop/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix28
-rw-r--r--pkgs/top-level/pkg-config/pkg-config-data.json5
-rw-r--r--pkgs/top-level/python-packages.nix2
-rw-r--r--pkgs/top-level/release.nix6
223 files changed, 1096 insertions, 2883 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 47069c9a794..3c300d00c6b 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -118,13 +118,13 @@
 /pkgs/development/interpreters/python/hooks                 @FRidh @jonringer
 
 # Haskell
-/doc/languages-frameworks/haskell.section.md  @cdepillabout @sternenseemann @maralorn
-/maintainers/scripts/haskell                  @cdepillabout @sternenseemann @maralorn
-/pkgs/development/compilers/ghc               @cdepillabout @sternenseemann @maralorn
-/pkgs/development/haskell-modules             @cdepillabout @sternenseemann @maralorn
-/pkgs/test/haskell                            @cdepillabout @sternenseemann @maralorn
-/pkgs/top-level/release-haskell.nix           @cdepillabout @sternenseemann @maralorn
-/pkgs/top-level/haskell-packages.nix          @cdepillabout @sternenseemann @maralorn
+/doc/languages-frameworks/haskell.section.md  @cdepillabout @sternenseemann @maralorn @ncfavier
+/maintainers/scripts/haskell                  @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/development/compilers/ghc               @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/development/haskell-modules             @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/test/haskell                            @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/release-haskell.nix           @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/haskell-packages.nix          @cdepillabout @sternenseemann @maralorn @ncfavier
 
 # Perl
 /pkgs/development/interpreters/perl @stigtsp @zakame @dasJ
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8ac9894cc22..da13f66838c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6003,13 +6003,6 @@
     githubId = 92793;
     name = "Friedrich von Never";
   };
-  fortuneteller2k = {
-    email = "lythe1107@gmail.com";
-    matrix = "@fortuneteller2k:matrix.org";
-    github = "fortuneteller2k";
-    githubId = 20619776;
-    name = "fortuneteller2k";
-  };
   fpletz = {
     email = "fpletz@fnordicwalking.de";
     github = "fpletz";
@@ -12095,6 +12088,13 @@
     github = "ribosomerocker";
     githubId = 46468162;
   };
+  moni = {
+    email = "lythe1107@gmail.com";
+    matrix = "@fortuneteller2k:matrix.org";
+    github = "moni";
+    githubId = 20619776;
+    name = "moni";
+  };
   monsieurp = {
     email = "monsieurp@gentoo.org";
     github = "monsieurp";
@@ -12758,6 +12758,12 @@
     githubId = 13920346;
     name = "Sébastien Iooss";
   };
+  netthier = {
+    email = "netthier@proton.me";
+    name = "nett_hier";
+    github = "netthier";
+    githubId = 66856670;
+  };
   networkexception = {
     name = "networkException";
     email = "nix@nwex.de";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 3ad43f2a34e..db66b8fe868 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -398,6 +398,7 @@ with lib.maintainers; {
       cdepillabout
       expipiplus1
       maralorn
+      ncfavier
       sternenseemann
     ];
     githubTeams = [
@@ -916,7 +917,6 @@ with lib.maintainers; {
 
   tts = {
     members = [
-      hexa
       mic92
     ];
     scope = "coqui-ai TTS (formerly Mozilla TTS) and leaf packages";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 5cb5fec2305..e5e4e713ae2 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -104,6 +104,8 @@
 
 - [eris-server](https://codeberg.org/eris/eris-go). [ERIS](https://eris.codeberg.page/) is an encoding for immutable storage and this server provides block exchange as well as content decoding over HTTP and through a FUSE file-system. Available as [services.eris-server](#opt-services.eris-server.enable).
 
+- [forgejo](https://forgejo.org/), a git forge. Previously deployed as a drop-in replacement package in the [gitea module](#opt-services.gitea.package). Available as [services.forgejo](#opt-services.forgejo.enable). See migration instructions in the [NixOS manual](#module-forgejo) on how to migrate your forgejo instance using [`services.gitea.package = pkgs.forgejo`](#opt-services.gitea.package) to [`services.forgejo`](#opt-services.forgejo.enable).
+
 - hardware/infiniband.nix adds infiniband subnet manager support using an [opensm](https://github.com/linux-rdma/opensm) systemd-template service, instantiated on card guids. The module also adds kernel modules and cli tooling to help administrators debug and measure performance. Available as [hardware.infiniband.enable](#opt-hardware.infiniband.enable).
 
 - [zwave-js](https://github.com/zwave-js/zwave-js-server), a small server wrapper around Z-Wave JS to access it via a WebSocket. Available as [services.zwave-js](#opt-services.zwave-js.enable).
@@ -143,6 +145,9 @@
 
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
+- `services.postgresql.ensurePermissions` has been deprecated in favor of `services.postgresql.ensureUsers.*.ensureDBOwnership` which simplifies the setup of database owned by a certain system user
+  in local database contexts (which make use of peer authentication via UNIX sockets), migration guidelines were provided in the NixOS manual, please refer to them if you are affected by a PostgreSQL 15 changing the way `GRANT ALL PRIVILEGES` is working. `services.postgresql.ensurePermissions` will be removed in 24.05. All NixOS modules were migrated using one of the strategy, e.g. `ensureDBOwnership` or `postStart`. More about this situation can be learnt in https://github.com/NixOS/nixpkgs/pull/266270.
+
 - `network-online.target` has been fixed to no longer time out for systems with `networking.useDHCP = true` and `networking.useNetworkd = true`.
   Workarounds for this can be removed.
 
diff --git a/nixos/modules/config/stevenblack.nix b/nixos/modules/config/stevenblack.nix
index 30ef7ff259f..7e623516984 100644
--- a/nixos/modules/config/stevenblack.nix
+++ b/nixos/modules/config/stevenblack.nix
@@ -30,5 +30,5 @@ in
       ++ optionals (activatedHosts == [ ]) [ "${pkgs.stevenblack-blocklist}/hosts" ];
   };
 
-  meta.maintainers = [ maintainers.fortuneteller2k maintainers.artturin ];
+  meta.maintainers = [ maintainers.moni maintainers.artturin ];
 }
diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index d65d9616e2f..e5e0b7efec2 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -39,6 +39,125 @@ By default, PostgreSQL stores its databases in {file}`/var/lib/postgresql/$psqlS
 services.postgresql.dataDir = "/data/postgresql";
 ```
 
+## Initializing {#module-services-postgres-initializing}
+
+As of NixOS 23.11,
+`services.postgresql.ensureUsers.*.ensurePermissions` has been
+deprecated, after a change to default permissions in PostgreSQL 15
+invalidated most of its previous use cases:
+
+- In psql < 15, `ALL PRIVILEGES` used to include `CREATE TABLE`, where
+  in psql >= 15 that would be a separate permission
+- psql >= 15 instead gives only the database owner create permissions
+- Even on psql < 15 (or databases migrated to >= 15), it is
+  recommended to manually assign permissions along these lines
+  - https://www.postgresql.org/docs/release/15.0/
+  - https://www.postgresql.org/docs/15/ddl-schemas.html#DDL-SCHEMAS-PRIV
+
+### Assigning ownership {#module-services-postgres-initializing-ownership}
+
+Usually, the database owner should be a database user of the same
+name. This can be done with
+`services.postgresql.ensureUsers.*.ensureDBOwnership = true;`.
+
+If the database user name equals the connecting system user name,
+postgres by default will accept a passwordless connection via unix
+domain socket. This makes it possible to run many postgres-backed
+services without creating any database secrets at all
+
+### Assigning extra permissions {#module-services-postgres-initializing-extra-permissions}
+
+For many cases, it will be enough to have the database user be the
+owner. Until `services.postgresql.ensureUsers.*.ensurePermissions` has
+been re-thought, if more users need access to the database, please use
+one of the following approaches:
+
+**WARNING:** `services.postgresql.initialScript` is not recommended
+for `ensurePermissions` replacement, as that is *only run on first
+start of PostgreSQL*.
+
+**NOTE:** all of these methods may be obsoleted, when `ensure*` is
+reworked, but it is expected that they will stay viable for running
+database migrations.
+
+**NOTE:** please make sure that any added migrations are idempotent (re-runnable).
+
+#### as superuser {#module-services-postgres-initializing-extra-permissions-superuser}
+
+**Advantage:** compatible with postgres < 15, because it's run
+as the database superuser `postgres`.
+
+##### in database `postStart` {#module-services-postgres-initializing-extra-permissions-superuser-post-start}
+
+**Disadvantage:** need to take care of ordering yourself. In this
+example, `mkAfter` ensures that permissions are assigned after any
+databases from `ensureDatabases` and `extraUser1` from `ensureUsers`
+are already created.
+
+```nix
+    systemd.services.postgresql.postStart = lib.mkAfter ''
+      $PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
+      $PSQL service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
+      # ....
+    '';
+```
+
+##### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-superuser-oneshot}
+
+```nix
+    systemd.services."migrate-service1-db1" = {
+      serviceConfig.Type = "oneshot";
+      requiredBy = "service1.service";
+      before = "service1.service";
+      after = "postgresql.service";
+      serviceConfig.User = "postgres";
+      environment.PSQL = "psql --port=${toString services.postgresql.port}";
+      path = [ postgresql ];
+      script = ''
+        $PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
+        $PSQL service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
+        # ....
+      '';
+    };
+```
+
+#### as service user {#module-services-postgres-initializing-extra-permissions-service-user}
+
+**Advantage:** re-uses systemd's dependency ordering;
+
+**Disadvantage:** relies on service user having grant permission. To be combined with `ensureDBOwnership`.
+
+##### in service `preStart` {#module-services-postgres-initializing-extra-permissions-service-user-pre-start}
+
+```nix
+    environment.PSQL = "psql --port=${toString services.postgresql.port}";
+    path = [ postgresql ];
+    systemd.services."service1".preStart = ''
+      $PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
+      $PSQL -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
+      # ....
+    '';
+```
+
+##### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-service-user-oneshot}
+
+```nix
+    systemd.services."migrate-service1-db1" = {
+      serviceConfig.Type = "oneshot";
+      requiredBy = "service1.service";
+      before = "service1.service";
+      after = "postgresql.service";
+      serviceConfig.User = "service1";
+      environment.PSQL = "psql --port=${toString services.postgresql.port}";
+      path = [ postgresql ];
+      script = ''
+        $PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
+        $PSQL -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
+        # ....
+      '';
+    };
+```
+
 ## Upgrading {#module-services-postgres-upgrading}
 
 ::: {.note}
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index af4db5c9611..a9067d5974a 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -168,7 +168,12 @@ in
             ensurePermissions = mkOption {
               type = types.attrsOf types.str;
               default = {};
+              visible = false; # This option has been deprecated.
               description = lib.mdDoc ''
+                This option is DEPRECATED and should not be used in nixpkgs anymore,
+                use `ensureDBOwnership` instead. It can also break with newer
+                versions of PostgreSQL (≥ 15).
+
                 Permissions to ensure for the user, specified as an attribute set.
                 The attribute names specify the database and tables to grant the permissions for.
                 The attribute values specify the permissions to grant. You may specify one or
@@ -187,6 +192,16 @@ in
               '';
             };
 
+            ensureDBOwnership = mkOption {
+              type = types.bool;
+              default = false;
+              description = mdDoc ''
+                Grants the user ownership to a database with the same name.
+                This database must be defined manually in
+                [](#opt-services.postgresql.ensureDatabases).
+              '';
+            };
+
             ensureClauses = mkOption {
               description = lib.mdDoc ''
                 An attrset of clauses to grant to the user. Under the hood this uses the
@@ -338,26 +353,21 @@ in
         });
         default = [];
         description = lib.mdDoc ''
-          Ensures that the specified users exist and have at least the ensured permissions.
+          Ensures that the specified users exist.
           The PostgreSQL users will be identified using peer authentication. This authenticates the Unix user with the
           same name only, and that without the need for a password.
-          This option will never delete existing users or remove permissions, especially not when the value of this
-          option is changed. This means that users created and permissions assigned once through this option or
-          otherwise have to be removed manually.
+          This option will never delete existing users or remove DB ownership of databases
+          once granted with `ensureDBOwnership = true;`. This means that this must be
+          cleaned up manually when changing after changing the config in here.
         '';
         example = literalExpression ''
           [
             {
               name = "nextcloud";
-              ensurePermissions = {
-                "DATABASE nextcloud" = "ALL PRIVILEGES";
-              };
             }
             {
               name = "superuser";
-              ensurePermissions = {
-                "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
-              };
+              ensureDBOwnership = true;
             }
           ]
         '';
@@ -445,6 +455,27 @@ in
 
   config = mkIf cfg.enable {
 
+    assertions = map ({ name, ensureDBOwnership, ... }: {
+      assertion = ensureDBOwnership -> builtins.elem name cfg.ensureDatabases;
+      message = ''
+        For each database user defined with `services.postgresql.ensureUsers` and
+        `ensureDBOwnership = true;`, a database with the same name must be defined
+        in `services.postgresql.ensureDatabases`.
+
+        Offender: ${name} has not been found among databases.
+      '';
+    }) cfg.ensureUsers;
+    # `ensurePermissions` is now deprecated, let's avoid it.
+    warnings = lib.optional (any ({ ensurePermissions, ... }: ensurePermissions != {}) cfg.ensureUsers) "
+      `services.postgresql.*.ensurePermissions` is used in your expressions,
+      this option is known to be broken with newer PostgreSQL versions,
+      consider migrating to `services.postgresql.*.ensureDBOwnership` or
+      consult the release notes or manual for more migration guidelines.
+
+      This option will be removed in NixOS 24.05 unless it sees significant
+      maintenance improvements.
+    ";
+
     services.postgresql.settings =
       {
         hba_file = "${pkgs.writeText "pg_hba.conf" cfg.authentication}";
@@ -556,12 +587,15 @@ in
             ${
               concatMapStrings
               (user:
-                let
+              let
                   userPermissions = concatStringsSep "\n"
                     (mapAttrsToList
                       (database: permission: ''$PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"' '')
                       user.ensurePermissions
                     );
+                  dbOwnershipStmt = optionalString
+                    user.ensureDBOwnership
+                    ''$PSQL -tAc 'ALTER DATABASE "${user.name}" OWNER TO "${user.name}";' '';
 
                   filteredClauses = filterAttrs (name: value: value != null) user.ensureClauses;
 
@@ -572,6 +606,8 @@ in
                   $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'
                   ${userPermissions}
                   ${userClauses}
+
+                  ${dbOwnershipStmt}
                 ''
               )
               cfg.ensureUsers
diff --git a/nixos/modules/services/development/zammad.nix b/nixos/modules/services/development/zammad.nix
index 7dd143eebf1..d24ed24ef39 100644
--- a/nixos/modules/services/development/zammad.nix
+++ b/nixos/modules/services/development/zammad.nix
@@ -204,7 +204,7 @@ in
 
     assertions = [
       {
-        assertion = cfg.database.createLocally -> cfg.database.user == "zammad";
+        assertion = cfg.database.createLocally -> cfg.database.user == "zammad" && cfg.database.name == "zammad";
         message = "services.zammad.database.user must be set to \"zammad\" if services.zammad.database.createLocally is set to true";
       }
       {
@@ -231,7 +231,7 @@ in
       ensureUsers = [
         {
           name = cfg.database.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/finance/odoo.nix b/nixos/modules/services/finance/odoo.nix
index eec7c4e30cc..b8574ed09af 100644
--- a/nixos/modules/services/finance/odoo.nix
+++ b/nixos/modules/services/finance/odoo.nix
@@ -121,7 +121,7 @@ in
       ensureDatabases = [ "odoo" ];
       ensureUsers = [{
         name = "odoo";
-        ensurePermissions = { "DATABASE odoo" = "ALL PRIVILEGES"; };
+        ensureDBOwnership = true;
       }];
     };
   });
diff --git a/nixos/modules/services/mail/listmonk.nix b/nixos/modules/services/mail/listmonk.nix
index 11b2a518622..cea1bc95608 100644
--- a/nixos/modules/services/mail/listmonk.nix
+++ b/nixos/modules/services/mail/listmonk.nix
@@ -168,7 +168,7 @@ in {
 
       ensureUsers = [{
         name = "listmonk";
-        ensurePermissions = { "DATABASE listmonk" = "ALL PRIVILEGES"; };
+        ensureDBOwnership = true;
       }];
 
       ensureDatabases = [ "listmonk" ];
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 22a4e3c451a..4e29f567ed9 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -179,14 +179,22 @@ in
       };
     };
 
+    assertions = [
+      {
+        assertion = localDB -> cfg.database.username == cfg.database.dbname;
+        message = ''
+          When setting up a DB and its owner user, the owner and the DB name must be
+          equal!
+        '';
+      }
+    ];
+
     services.postgresql = mkIf localDB {
       enable = true;
       ensureDatabases = [ cfg.database.dbname ];
       ensureUsers = [ {
         name = cfg.database.username;
-        ensurePermissions = {
-          "DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";
-        };
+        ensureDBOwnership = true;
       } ];
     };
 
diff --git a/nixos/modules/services/mail/sympa.nix b/nixos/modules/services/mail/sympa.nix
index 7a5047b2bea..04ae46f66ee 100644
--- a/nixos/modules/services/mail/sympa.nix
+++ b/nixos/modules/services/mail/sympa.nix
@@ -218,7 +218,7 @@ in
         default = null;
         example = "/run/keys/sympa-dbpassword";
         description = lib.mdDoc ''
-          A file containing the password for {option}`services.sympa.database.user`.
+          A file containing the password for {option}`services.sympa.database.name`.
         '';
       };
 
@@ -342,6 +342,7 @@ in
 
       db_type = cfg.database.type;
       db_name = cfg.database.name;
+      db_user = cfg.database.name;
     }
     // (optionalAttrs (cfg.database.host != null) {
       db_host = cfg.database.host;
@@ -355,9 +356,6 @@ in
     // (optionalAttrs (cfg.database.port != null) {
       db_port = cfg.database.port;
     })
-    // (optionalAttrs (cfg.database.user != null) {
-      db_user = cfg.database.user;
-    })
     // (optionalAttrs (cfg.mta.type == "postfix") {
       sendmail_aliases = "${dataDir}/sympa_transport";
       aliases_program  = "${pkgs.postfix}/bin/postmap";
@@ -393,7 +391,7 @@ in
     users.groups.${group} = {};
 
     assertions = [
-      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+      { assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.name == cfg.database.user;
         message = "services.sympa.database.user must be set to ${user} if services.sympa.database.createLocally is set to true";
       }
       { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
@@ -579,7 +577,7 @@ in
       ensureDatabases = [ cfg.database.name ];
       ensureUsers = [
         { name = cfg.database.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/matrix/matrix-sliding-sync.nix b/nixos/modules/services/matrix/matrix-sliding-sync.nix
index 9807cde4091..84bb38f35ae 100644
--- a/nixos/modules/services/matrix/matrix-sliding-sync.nix
+++ b/nixos/modules/services/matrix/matrix-sliding-sync.nix
@@ -74,9 +74,9 @@ in
     services.postgresql = lib.optionalAttrs cfg.createDatabase {
       enable = true;
       ensureDatabases = [ "matrix-sliding-sync" ];
-      ensureUsers = [ rec {
+      ensureUsers = [ {
         name = "matrix-sliding-sync";
-        ensurePermissions."DATABASE \"${name}\"" = "ALL PRIVILEGES";
+        ensureDBOwnership = true;
       } ];
     };
 
diff --git a/nixos/modules/services/matrix/mautrix-facebook.nix b/nixos/modules/services/matrix/mautrix-facebook.nix
index 671040500df..d7cf024bb80 100644
--- a/nixos/modules/services/matrix/mautrix-facebook.nix
+++ b/nixos/modules/services/matrix/mautrix-facebook.nix
@@ -135,9 +135,7 @@ in {
       ensureDatabases = ["mautrix-facebook"];
       ensureUsers = [{
         name = "mautrix-facebook";
-        ensurePermissions = {
-          "DATABASE \"mautrix-facebook\"" = "ALL PRIVILEGES";
-        };
+        ensureDBOwnership = true;
       }];
     };
 
diff --git a/nixos/modules/services/misc/atuin.nix b/nixos/modules/services/misc/atuin.nix
index 8d2c1b5242f..2d6ffc510ce 100644
--- a/nixos/modules/services/misc/atuin.nix
+++ b/nixos/modules/services/misc/atuin.nix
@@ -73,9 +73,7 @@ in
       enable = true;
       ensureUsers = [{
         name = "atuin";
-        ensurePermissions = {
-          "DATABASE atuin" = "ALL PRIVILEGES";
-        };
+        ensureDBOwnership = true;
       }];
       ensureDatabases = [ "atuin" ];
     };
diff --git a/nixos/modules/services/misc/forgejo.md b/nixos/modules/services/misc/forgejo.md
new file mode 100644
index 00000000000..6a340738208
--- /dev/null
+++ b/nixos/modules/services/misc/forgejo.md
@@ -0,0 +1,79 @@
+# Forgejo {#module-forgejo}
+
+Forgejo is a soft-fork of gitea, with strong community focus, as well
+as on self-hosting and federation. [Codeberg](https://codeberg.org) is
+deployed from it.
+
+See [upstream docs](https://forgejo.org/docs/latest/).
+
+The method of choice for running forgejo is using [`services.forgejo`](#opt-services.forgejo.enable).
+
+::: {.warning}
+Running forgejo using `services.gitea.package = pkgs.forgejo` is no longer
+recommended.
+If you experience issues with your instance using `services.gitea`,
+**DO NOT** report them to the `services.gitea` module maintainers.
+**DO** report them to the `services.forgejo` module maintainers instead.
+:::
+
+## Migration from Gitea {#module-forgejo-migration-gitea}
+
+::: {.note}
+Migrating is, while not strictly necessary at this point, highly recommended.
+Both modules and projects are likely to divide further with each release.
+Which might lead to an even more involved migration.
+:::
+
+### Full-Migration {#module-forgejo-migration-gitea-default}
+
+This will migrate the state directory (data), rename and chown the database and
+delete the gitea user.
+
+::: {.note}
+This will also change the git remote ssh-url user from `gitea@` to `forgejo@`,
+when using the host's openssh server (default) instead of the integrated one.
+:::
+
+Instructions for PostgreSQL (default). Adapt accordingly for other databases:
+
+```sh
+systemctl stop gitea
+mv /var/lib/gitea /var/lib/forgejo
+runuser -u postgres -- psql -c '
+  ALTER USER gitea RENAME TO forgejo;
+  ALTER DATABASE gitea RENAME TO forgejo;
+'
+nixos-rebuild switch
+systemctl stop forgejo
+chown -R forgejo:forgejo /var/lib/forgejo
+systemctl restart forgejo
+```
+
+### Alternatively, keeping the gitea user {#module-forgejo-migration-gitea-impersonate}
+
+Alternatively, instead of renaming the database, copying the state folder and
+changing the user, the forgejo module can be set up to re-use the old storage
+locations and database, instead of having to copy or rename them.
+Make sure to disable `services.gitea`, when doing this.
+
+```nix
+services.gitea.enable = false;
+
+services.forgejo = {
+  enable = true;
+  user = "gitea";
+  group = "gitea";
+  stateDir = "/var/lib/gitea";
+  database.name = "gitea";
+  database.user = "gitea";
+};
+
+users.users,gitea = {
+  home = "/var/lib/gitea";
+  useDefaultShell = true;
+  group = "gitea";
+  isSystemUser = true;
+};
+
+users.groups.gitea = {};
+```
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 90b5f16f418..15966adfe38 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -357,6 +357,14 @@ in
         assertion = cfg.database.createDatabase -> useSqlite || cfg.database.user == cfg.user;
         message = "services.forgejo.database.user must match services.forgejo.user if the database is to be automatically provisioned";
       }
+      { assertion = cfg.database.createDatabase && usePostgresql -> cfg.database.user == cfg.database.name;
+        message = ''
+          When creating a database via NixOS, the db user and db name must be equal!
+          If you already have an existing DB+user and this assertion is new, you can safely set
+          `services.forgejo.createDatabase` to `false` because removal of `ensureUsers`
+          and `ensureDatabases` doesn't have any effect.
+        '';
+      }
     ];
 
     services.forgejo.settings = {
@@ -423,7 +431,7 @@ in
       ensureUsers = [
         {
           name = cfg.database.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
@@ -677,5 +685,6 @@ in
     };
   };
 
+  meta.doc = ./forgejo.md;
   meta.maintainers = with lib.maintainers; [ bendlas emilylange ];
 }
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 3f690f85d62..be528a29899 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -394,6 +394,14 @@ in
       { assertion = cfg.database.createDatabase -> useSqlite || cfg.database.user == cfg.user;
         message = "services.gitea.database.user must match services.gitea.user if the database is to be automatically provisioned";
       }
+      { assertion = cfg.database.createDatabase && usePostgresql -> cfg.database.user == cfg.database.name;
+        message = ''
+          When creating a database via NixOS, the db user and db name must be equal!
+          If you already have an existing DB+user and this assertion is new, you can safely set
+          `services.gitea.createDatabase` to `false` because removal of `ensureUsers`
+          and `ensureDatabases` doesn't have any effect.
+        '';
+      }
     ];
 
     services.gitea.settings = {
@@ -461,7 +469,7 @@ in
       ensureDatabases = [ cfg.database.name ];
       ensureUsers = [
         { name = cfg.database.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index a296fd3816b..20fa71507b6 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -267,7 +267,7 @@ in
       { assertion = cfg.database.passwordFile != null || cfg.database.socket != null;
         message = "one of services.redmine.database.socket or services.redmine.database.passwordFile must be set";
       }
-      { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
+      { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user && cfg.database.user == cfg.database.name;
         message = "services.redmine.database.user must be set to ${cfg.user} if services.redmine.database.createLocally is set true";
       }
       { assertion = cfg.database.createLocally -> cfg.database.socket != null;
@@ -315,7 +315,7 @@ in
       ensureDatabases = [ cfg.database.name ];
       ensureUsers = [
         { name = cfg.database.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/misc/sourcehut/service.nix b/nixos/modules/services/misc/sourcehut/service.nix
index 18c2f5effc5..f08d5eb4687 100644
--- a/nixos/modules/services/misc/sourcehut/service.nix
+++ b/nixos/modules/services/misc/sourcehut/service.nix
@@ -249,10 +249,13 @@ in
       ensureDatabases = [ srvCfg.postgresql.database ];
       ensureUsers = map (name: {
           inherit name;
-          ensurePermissions = { "DATABASE \"${srvCfg.postgresql.database}\"" = "ALL PRIVILEGES"; };
+          # We don't use it because we have a special default database name with dots.
+          # TODO(for maintainers of sourcehut): migrate away from custom preStart script.
+          ensureDBOwnership = false;
         }) [srvCfg.user];
     };
 
+
     services.sourcehut.settings = mkMerge [
       {
         "${srv}.sr.ht".origin = mkDefault "https://${srv}.${cfg.settings."sr.ht".global-domain}";
@@ -378,10 +381,11 @@ in
         extraService
       ])) extraServices)
 
-      # Work around 'pq: permission denied for schema public' with postgres v15, until a
-      # solution for `services.postgresql.ensureUsers` is found.
+      # Work around 'pq: permission denied for schema public' with postgres v15.
       # See https://github.com/NixOS/nixpkgs/issues/216989
       # Workaround taken from nixos/forgejo: https://github.com/NixOS/nixpkgs/pull/262741
+      # TODO(to maintainers of sourcehut): please migrate away from this workaround
+      # by migrating away from database name defaults with dots.
       (lib.mkIf (
           cfg.postgresql.enable
           && lib.strings.versionAtLeast config.services.postgresql.package.version "15.0"
diff --git a/nixos/modules/services/monitoring/zabbix-proxy.nix b/nixos/modules/services/monitoring/zabbix-proxy.nix
index 85da416ba6c..503e81b48a5 100644
--- a/nixos/modules/services/monitoring/zabbix-proxy.nix
+++ b/nixos/modules/services/monitoring/zabbix-proxy.nix
@@ -203,7 +203,7 @@ in
       { assertion = !config.services.zabbixServer.enable;
         message = "Please choose one of services.zabbixServer or services.zabbixProxy.";
       }
-      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+      { assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.name == cfg.database.user;
         message = "services.zabbixProxy.database.user must be set to ${user} if services.zabbixProxy.database.createLocally is set true";
       }
       { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
@@ -252,7 +252,7 @@ in
       ensureDatabases = [ cfg.database.name ];
       ensureUsers = [
         { name = cfg.database.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/monitoring/zabbix-server.nix b/nixos/modules/services/monitoring/zabbix-server.nix
index 2b50280e396..0607188d213 100644
--- a/nixos/modules/services/monitoring/zabbix-server.nix
+++ b/nixos/modules/services/monitoring/zabbix-server.nix
@@ -191,7 +191,7 @@ in
   config = mkIf cfg.enable {
 
     assertions = [
-      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+      { assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.user == cfg.database.name;
         message = "services.zabbixServer.database.user must be set to ${user} if services.zabbixServer.database.createLocally is set true";
       }
       { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
@@ -240,7 +240,7 @@ in
       ensureDatabases = [ cfg.database.name ];
       ensureUsers = [
         { name = cfg.database.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/security/hockeypuck.nix b/nixos/modules/services/security/hockeypuck.nix
index 127134bc5db..56c13d79192 100644
--- a/nixos/modules/services/security/hockeypuck.nix
+++ b/nixos/modules/services/security/hockeypuck.nix
@@ -55,7 +55,7 @@ in {
             ensureDatabases = [ "hockeypuck" ];
             ensureUsers = [{
               name = "hockeypuck";
-              ensurePermissions."DATABASE hockeypuck" = "ALL PRIVILEGES";
+              ensureDBOwnership = true;
             }];
           };
         ```
diff --git a/nixos/modules/services/web-apps/coder.nix b/nixos/modules/services/web-apps/coder.nix
index 469a29bc3aa..f65211308c4 100644
--- a/nixos/modules/services/web-apps/coder.nix
+++ b/nixos/modules/services/web-apps/coder.nix
@@ -149,8 +149,8 @@ in {
 
   config = mkIf cfg.enable {
     assertions = [
-      { assertion = cfg.database.createLocally -> cfg.database.username == name;
-        message = "services.coder.database.username must be set to ${user} if services.coder.database.createLocally is set true";
+      { assertion = cfg.database.createLocally -> cfg.database.username == name && cfg.database.database == cfg.database.username;
+        message = "services.coder.database.username must be set to ${name} if services.coder.database.createLocally is set true";
       }
     ];
 
@@ -193,10 +193,8 @@ in {
         cfg.database.database
       ];
       ensureUsers = [{
-        name = cfg.database.username;
-        ensurePermissions = {
-          "DATABASE \"${cfg.database.database}\"" = "ALL PRIVILEGES";
-        };
+        name = cfg.user;
+        ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/web-apps/gotosocial.nix b/nixos/modules/services/web-apps/gotosocial.nix
index f7ae018d5b7..9c21719a575 100644
--- a/nixos/modules/services/web-apps/gotosocial.nix
+++ b/nixos/modules/services/web-apps/gotosocial.nix
@@ -128,9 +128,7 @@ in
       ensureUsers = [
         {
           name = "gotosocial";
-          ensurePermissions = {
-            "DATABASE gotosocial" = "ALL PRIVILEGES";
-          };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 5603ef7392e..e4fbc6fd936 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -109,15 +109,17 @@ let
     # Default to using the local database if we create it
     services.invidious.database.host = lib.mkDefault null;
 
+
+    # TODO(raitobezarius to maintainers of invidious): I strongly advise to clean up the kemal specific
+    # thing for 24.05 and use `ensureDBOwnership`.
+    # See https://github.com/NixOS/nixpkgs/issues/216989
+    systemd.services.postgresql.postStart = lib.mkAfter ''
+      $PSQL -tAc 'ALTER DATABASE "${cfg.settings.db.dbname}" OWNER TO "${cfg.settings.db.user}";'
+    '';
     services.postgresql = {
       enable = true;
+      ensureUsers = lib.singleton { name = cfg.settings.db.user; ensureDBOwnership = false; };
       ensureDatabases = lib.singleton cfg.settings.db.dbname;
-      ensureUsers = lib.singleton {
-        name = cfg.settings.db.user;
-        ensurePermissions = {
-          "DATABASE ${cfg.settings.db.dbname}" = "ALL PRIVILEGES";
-        };
-      };
       # This is only needed because the unix user invidious isn't the same as
       # the database user. This tells postgres to map one to the other.
       identMap = ''
@@ -136,6 +138,7 @@ let
       documentation = [ "https://docs.invidious.io/Database-Information-and-Maintenance.md" ];
       startAt = lib.mkDefault "weekly";
       path = [ config.services.postgresql.package ];
+      after = [ "postgresql.service" ];
       script = ''
         psql ${cfg.settings.db.dbname} ${cfg.settings.db.user} -c "DELETE FROM nonces * WHERE expire < current_timestamp"
         psql ${cfg.settings.db.dbname} ${cfg.settings.db.user} -c "TRUNCATE TABLE videos"
diff --git a/nixos/modules/services/web-apps/lemmy.nix b/nixos/modules/services/web-apps/lemmy.nix
index 20d9dcb7c26..32389f7a59d 100644
--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@@ -146,7 +146,7 @@ in
         ensureDatabases = [ cfg.settings.database.database ];
         ensureUsers = [{
           name = cfg.settings.database.user;
-          ensurePermissions."DATABASE ${cfg.settings.database.database}" = "ALL PRIVILEGES";
+          ensureDBOwnership = true;
         }];
       };
 
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index d861f9e251b..8686506b1c2 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -612,7 +612,7 @@ in {
   config = lib.mkIf cfg.enable (lib.mkMerge [{
     assertions = [
       {
-        assertion = databaseActuallyCreateLocally -> (cfg.user == cfg.database.user);
+        assertion = databaseActuallyCreateLocally -> (cfg.user == cfg.database.user && cfg.database.user == cfg.database.name);
         message = ''
           For local automatic database provisioning (services.mastodon.database.createLocally == true) with peer
             authentication (services.mastodon.database.host == "/run/postgresql") to work services.mastodon.user
@@ -845,8 +845,8 @@ in {
       enable = true;
       ensureUsers = [
         {
-          name = cfg.database.user;
-          ensurePermissions."DATABASE ${cfg.database.name}" = "ALL PRIVILEGES";
+          name = cfg.database.name;
+          ensureDBOwnership = true;
         }
       ];
       ensureDatabases = [ cfg.database.name ];
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index 8b494b7c120..ce7bcd94b3f 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -454,7 +454,7 @@ in
       { assertion = cfg.database.createLocally -> (cfg.database.type == "mysql" || cfg.database.type == "postgres");
         message = "services.mediawiki.createLocally is currently only supported for database type 'mysql' and 'postgres'";
       }
-      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+      { assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.name == cfg.database.user;
         message = "services.mediawiki.database.user must be set to ${user} if services.mediawiki.database.createLocally is set true";
       }
       { assertion = cfg.database.createLocally -> cfg.database.socket != null;
@@ -486,7 +486,7 @@ in
       ensureDatabases = [ cfg.database.name ];
       ensureUsers = [{
         name = cfg.database.user;
-        ensurePermissions = { "DATABASE \"${cfg.database.name}\"" = "ALL PRIVILEGES"; };
+        ensureDBOwnership = true;
       }];
     };
 
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 3374c746ad3..5c8c93c13c4 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -6,13 +6,10 @@ let
 
   defaultAddress = "localhost:8080";
 
-  dbUser = "miniflux";
-  dbName = "miniflux";
-
   pgbin = "${config.services.postgresql.package}/bin";
   preStart = pkgs.writeScript "miniflux-pre-start" ''
     #!${pkgs.runtimeShell}
-    ${pgbin}/psql "${dbName}" -c "CREATE EXTENSION IF NOT EXISTS hstore"
+    ${pgbin}/psql "miniflux" -c "CREATE EXTENSION IF NOT EXISTS hstore"
   '';
 in
 
@@ -62,7 +59,7 @@ in
 
     services.miniflux.config =  {
       LISTEN_ADDR = mkDefault defaultAddress;
-      DATABASE_URL = "user=${dbUser} host=/run/postgresql dbname=${dbName}";
+      DATABASE_URL = "user=miniflux host=/run/postgresql dbname=miniflux";
       RUN_MIGRATIONS = "1";
       CREATE_ADMIN = "1";
     };
@@ -70,12 +67,10 @@ in
     services.postgresql = {
       enable = true;
       ensureUsers = [ {
-        name = dbUser;
-        ensurePermissions = {
-          "DATABASE ${dbName}" = "ALL PRIVILEGES";
-        };
+        name = "miniflux";
+        ensureDBOwnership = true;
       } ];
-      ensureDatabases = [ dbName ];
+      ensureDatabases = [ "miniflux" ];
     };
 
     systemd.services.miniflux-dbsetup = {
@@ -97,7 +92,7 @@ in
 
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/miniflux";
-        User = dbUser;
+        User = "miniflux";
         DynamicUser = true;
         RuntimeDirectory = "miniflux";
         RuntimeDirectoryMode = "0700";
diff --git a/nixos/modules/services/web-apps/mobilizon.nix b/nixos/modules/services/web-apps/mobilizon.nix
index 343c5cead2b..bb4319b51a2 100644
--- a/nixos/modules/services/web-apps/mobilizon.nix
+++ b/nixos/modules/services/web-apps/mobilizon.nix
@@ -347,12 +347,18 @@ in
 
       # Taken from here:
       # https://framagit.org/framasoft/mobilizon/-/blob/1.1.0/priv/templates/setup_db.eex
+      # TODO(to maintainers of mobilizon): the owner database alteration is necessary
+      # as PostgreSQL 15 changed their behaviors w.r.t. to privileges.
+      # See https://github.com/NixOS/nixpkgs/issues/216989 to get rid
+      # of that workaround.
       script =
         ''
           psql "${repoSettings.database}" -c "\
             CREATE EXTENSION IF NOT EXISTS postgis; \
             CREATE EXTENSION IF NOT EXISTS pg_trgm; \
             CREATE EXTENSION IF NOT EXISTS unaccent;"
+          psql -tAc 'ALTER DATABASE "${repoSettings.database}" OWNER TO "${dbUser}";'
+
         '';
 
       serviceConfig = {
@@ -372,9 +378,10 @@ in
       ensureUsers = [
         {
           name = dbUser;
-          ensurePermissions = {
-            "DATABASE \"${repoSettings.database}\"" = "ALL PRIVILEGES";
-          };
+          # Given that `dbUser` is potentially arbitrarily custom, we will perform
+          # manual fixups in mobilizon-postgres.
+          # TODO(to maintainers of mobilizon): Feel free to simplify your setup by using `ensureDBOwnership`.
+          ensureDBOwnership = false;
         }
       ];
       extraPlugins = with postgresql.pkgs; [ postgis ];
diff --git a/nixos/modules/services/web-apps/moodle.nix b/nixos/modules/services/web-apps/moodle.nix
index b617e9a5937..04ae6bd7f17 100644
--- a/nixos/modules/services/web-apps/moodle.nix
+++ b/nixos/modules/services/web-apps/moodle.nix
@@ -194,7 +194,7 @@ in
   config = mkIf cfg.enable {
 
     assertions = [
-      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+      { assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.user == cfg.database.name;
         message = "services.moodle.database.user must be set to ${user} if services.moodle.database.createLocally is set true";
       }
       { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
@@ -220,7 +220,7 @@ in
       ensureDatabases = [ cfg.database.name ];
       ensureUsers = [
         { name = cfg.database.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index 8ba1852848e..3b9434e3d34 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -257,9 +257,7 @@ in {
       ensureUsers = [
         {
           name = "netbox";
-          ensurePermissions = {
-            "DATABASE netbox" = "ALL PRIVILEGES";
-          };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index f9713cac47e..f1ac3770d40 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1042,7 +1042,7 @@ in {
         ensureDatabases = [ cfg.config.dbname ];
         ensureUsers = [{
           name = cfg.config.dbuser;
-          ensurePermissions = { "DATABASE ${cfg.config.dbname}" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }];
       };
 
diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index 3494f2fa21f..f958566b91f 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -198,7 +198,7 @@ in
         ensureDatabases = [ "onlyoffice" ];
         ensureUsers = [{
           name = "onlyoffice";
-          ensurePermissions = { "DATABASE \"onlyoffice\"" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }];
       };
     };
diff --git a/nixos/modules/services/web-apps/outline.nix b/nixos/modules/services/web-apps/outline.nix
index 0e3bd07c1fc..d97b45d6241 100644
--- a/nixos/modules/services/web-apps/outline.nix
+++ b/nixos/modules/services/web-apps/outline.nix
@@ -581,7 +581,7 @@ in
       enable = true;
       ensureUsers = [{
         name = "outline";
-        ensurePermissions."DATABASE outline" = "ALL PRIVILEGES";
+        ensureDBOwnership = true;
       }];
       ensureDatabases = [ "outline" ];
     };
diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix
index 7012df6dffb..d6f6077268d 100644
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -186,9 +186,7 @@ in {
       ensureUsers = [
         {
           name = "peering-manager";
-          ensurePermissions = {
-            "DATABASE \"peering-manager\"" = "ALL PRIVILEGES";
-          };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/web-apps/pixelfed.nix b/nixos/modules/services/web-apps/pixelfed.nix
index 159fb52476a..b0a25dcce9e 100644
--- a/nixos/modules/services/web-apps/pixelfed.nix
+++ b/nixos/modules/services/web-apps/pixelfed.nix
@@ -271,7 +271,6 @@ in {
         ensureDatabases = [ cfg.database.name ];
         ensureUsers = [{
           name = user;
-          ensurePermissions = { };
         }];
       };
 
diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index 7b2e3be4295..a8fb37d2c5e 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -529,6 +529,15 @@ let
         assertion = cfg.database.password != null -> cfg.database.passwordFile == null;
         message = "Cannot set both password and passwordFile";
       }
+      {
+        assertion = cfg.database.createLocally -> cfg.database.name == cfg.user && cfg.database.user == cfg.user;
+        message = ''
+          When creating a database via NixOS, the db user and db name must be equal!
+          If you already have an existing DB+user and this assertion is new, you can safely set
+          `services.tt-rss.database.createLocally` to `false` because removal of `ensureUsers`
+          and `ensureDatabases` doesn't have any effect.
+        '';
+      }
     ];
 
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
@@ -632,8 +641,8 @@ let
       enable = mkDefault true;
       ensureDatabases = [ cfg.database.name ];
       ensureUsers = [
-        { name = cfg.user;
-          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+        { name = cfg.database.user;
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/services/web-servers/hydron.nix b/nixos/modules/services/web-servers/hydron.nix
index 4434965b217..9d30fdc0caa 100644
--- a/nixos/modules/services/web-servers/hydron.nix
+++ b/nixos/modules/services/web-servers/hydron.nix
@@ -93,7 +93,7 @@ in with lib; {
       ensureDatabases = [ "hydron" ];
       ensureUsers = [
         { name = "hydron";
-          ensurePermissions = { "DATABASE hydron" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index 96b42066b22..7d06e0131d9 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -88,9 +88,20 @@ def write_loader_conf(profile: str | None, generation: int, specialisation: str
 
 
 def get_bootspec(profile: str | None, generation: int) -> BootSpec:
-    boot_json_path = os.path.realpath("%s/%s" % (system_dir(profile, generation, None), "boot.json"))
-    boot_json_f = open(boot_json_path, 'r')
-    bootspec_json = json.load(boot_json_f)
+    system_directory = system_dir(profile, generation, None)
+    boot_json_path = os.path.realpath("%s/%s" % (system_directory, "boot.json"))
+    if os.path.isfile(boot_json_path):
+        boot_json_f = open(boot_json_path, 'r')
+        bootspec_json = json.load(boot_json_f)
+    else:
+        boot_json_str = subprocess.check_output([
+        "@bootspecTools@/bin/synthesize",
+        "--version",
+        "1",
+        system_directory,
+        "/dev/stdout"],
+        universal_newlines=True)
+        bootspec_json = json.loads(boot_json_str)
     return bootspec_from_json(bootspec_json)
 
 def bootspec_from_json(bootspec_json: Dict) -> BootSpec:
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
index 1086ab80b14..9d55c21077d 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@@ -16,6 +16,8 @@ let
 
     systemd = config.systemd.package;
 
+    bootspecTools = pkgs.bootspec;
+
     nix = config.nix.package.out;
 
     timeout = optionalString (config.boot.loader.timeout != null) config.boot.loader.timeout;
diff --git a/nixos/tests/dex-oidc.nix b/nixos/tests/dex-oidc.nix
index 37275a97ef0..e54ae18ca93 100644
--- a/nixos/tests/dex-oidc.nix
+++ b/nixos/tests/dex-oidc.nix
@@ -49,7 +49,7 @@ import ./make-test-python.nix ({ lib, ... }: {
       ensureUsers = [
         {
           name = "dex";
-          ensurePermissions = { "DATABASE dex" = "ALL PRIVILEGES"; };
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/nixos/tests/ferretdb.nix b/nixos/tests/ferretdb.nix
index 9ad7397ade8..7251198af77 100644
--- a/nixos/tests/ferretdb.nix
+++ b/nixos/tests/ferretdb.nix
@@ -39,7 +39,7 @@ with import ../lib/testing-python.nix { inherit system; };
             ensureDatabases = [ "ferretdb" ];
             ensureUsers = [{
               name = "ferretdb";
-              ensurePermissions."DATABASE ferretdb" = "ALL PRIVILEGES";
+              ensureDBOwnership = true;
             }];
           };
 
diff --git a/nixos/tests/freshrss-pgsql.nix b/nixos/tests/freshrss-pgsql.nix
index 055bd51ed43..c685f4a8159 100644
--- a/nixos/tests/freshrss-pgsql.nix
+++ b/nixos/tests/freshrss-pgsql.nix
@@ -22,9 +22,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
       ensureUsers = [
         {
           name = "freshrss";
-          ensurePermissions = {
-            "DATABASE freshrss" = "ALL PRIVILEGES";
-          };
+          ensureDBOwnership = true;
         }
       ];
       initialScript = pkgs.writeText "postgresql-password" ''
diff --git a/nixos/tests/grafana/basic.nix b/nixos/tests/grafana/basic.nix
index 8bf4caad7fb..dd389bc8a3d 100644
--- a/nixos/tests/grafana/basic.nix
+++ b/nixos/tests/grafana/basic.nix
@@ -55,7 +55,7 @@ let
         ensureDatabases = [ "grafana" ];
         ensureUsers = [{
           name = "grafana";
-          ensurePermissions."DATABASE grafana" = "ALL PRIVILEGES";
+          ensureDBOwnership = true;
         }];
       };
       systemd.services.grafana.after = [ "postgresql.service" ];
diff --git a/nixos/tests/hockeypuck.nix b/nixos/tests/hockeypuck.nix
index 2b9dba8720a..675d6b226ad 100644
--- a/nixos/tests/hockeypuck.nix
+++ b/nixos/tests/hockeypuck.nix
@@ -35,7 +35,7 @@ in {
       ensureDatabases = [ "hockeypuck" ];
       ensureUsers = [{
         name = "hockeypuck";
-        ensurePermissions."DATABASE hockeypuck" = "ALL PRIVILEGES";
+        ensureDBOwnership = true;
       }];
     };
   };
diff --git a/nixos/tests/home-assistant.nix b/nixos/tests/home-assistant.nix
index e97e8a467b1..e1588088ba1 100644
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@@ -9,13 +9,11 @@ in {
   nodes.hass = { pkgs, ... }: {
     services.postgresql = {
       enable = true;
-
-      # FIXME: hack for https://github.com/NixOS/nixpkgs/issues/216989
-      # Should be replaced with ensureUsers again when a solution for that is found
-      initialScript = pkgs.writeText "hass-setup-db.sql" ''
-        CREATE ROLE hass WITH LOGIN;
-        CREATE DATABASE hass WITH OWNER hass;
-      '';
+      ensureDatabases = [ "hass" ];
+      ensureUsers = [{
+        name = "hass";
+        ensureDBOwnership = true;
+      }];
     };
 
     services.home-assistant = {
diff --git a/nixos/tests/invidious.nix b/nixos/tests/invidious.nix
index 582d1550fff..701e8e5e7a3 100644
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@@ -44,8 +44,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             enable = true;
             initialScript = pkgs.writeText "init-postgres-with-password" ''
               CREATE USER kemal WITH PASSWORD 'correct horse battery staple';
-              CREATE DATABASE invidious;
-              GRANT ALL PRIVILEGES ON DATABASE invidious TO kemal;
+              CREATE DATABASE invidious OWNER kemal;
             '';
           };
       };
diff --git a/nixos/tests/paperless.nix b/nixos/tests/paperless.nix
index 22409e89923..6a51cc522bd 100644
--- a/nixos/tests/paperless.nix
+++ b/nixos/tests/paperless.nix
@@ -17,7 +17,7 @@ import ./make-test-python.nix ({ lib, ... }: {
         ensureDatabases = [ "paperless" ];
         ensureUsers = [
           { name = config.services.paperless.user;
-            ensurePermissions = { "DATABASE \"paperless\"" = "ALL PRIVILEGES"; };
+            ensureDBOwnership = true;
           }
         ];
       };
diff --git a/nixos/tests/pgadmin4.nix b/nixos/tests/pgadmin4.nix
index cb8de87c9ee..3ee7ed19fa1 100644
--- a/nixos/tests/pgadmin4.nix
+++ b/nixos/tests/pgadmin4.nix
@@ -19,14 +19,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
       authentication = ''
         host    all             all             localhost               trust
       '';
-      ensureUsers = [
-        {
-          name = "postgres";
-          ensurePermissions = {
-            "DATABASE \"postgres\"" = "ALL PRIVILEGES";
-          };
-        }
-      ];
     };
 
     services.pgadmin = {
diff --git a/nixos/tests/pgbouncer.nix b/nixos/tests/pgbouncer.nix
index 1e72327d420..bb5afd35ee2 100644
--- a/nixos/tests/pgbouncer.nix
+++ b/nixos/tests/pgbouncer.nix
@@ -17,7 +17,8 @@ in
 
       systemd.services.postgresql = {
         postStart = ''
-            ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER ROLE testuser WITH LOGIN PASSWORD 'testpass'";
+          ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER ROLE testuser WITH LOGIN PASSWORD 'testpass'";
+          ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER DATABASE testdb OWNER TO testuser;";
         '';
       };
 
@@ -28,9 +29,6 @@ in
           ensureUsers = [
           {
             name = "testuser";
-            ensurePermissions = {
-              "DATABASE testdb" = "ALL PRIVILEGES";
-            };
           }];
           authentication = ''
             local testdb testuser scram-sha-256
@@ -40,7 +38,7 @@ in
         pgbouncer = {
           enable = true;
           listenAddress = "localhost";
-          databases = { testdb = "host=/run/postgresql/ port=5432 auth_user=testuser dbname=testdb"; };
+          databases = { test = "host=/run/postgresql/ port=5432 auth_user=testuser dbname=testdb"; };
           authType = "scram-sha-256";
           authFile = testAuthFile;
         };
@@ -55,7 +53,7 @@ in
 
     # Test if we can make a query through PgBouncer
     one.wait_until_succeeds(
-        "psql 'postgres://testuser:testpass@localhost:6432/testdb' -c 'SELECT 1;'"
+        "psql 'postgres://testuser:testpass@localhost:6432/test' -c 'SELECT 1;'"
     )
   '';
 })
diff --git a/nixos/tests/powerdns-admin.nix b/nixos/tests/powerdns-admin.nix
index d7bacb24eec..d326d74a982 100644
--- a/nixos/tests/powerdns-admin.nix
+++ b/nixos/tests/powerdns-admin.nix
@@ -87,9 +87,7 @@ let
           ensureUsers = [
             {
               name = "powerdnsadmin";
-              ensurePermissions = {
-                "DATABASE powerdnsadmin" = "ALL PRIVILEGES";
-              };
+              ensureDBOwnership = true;
             }
           ];
         };
diff --git a/nixos/tests/sftpgo.nix b/nixos/tests/sftpgo.nix
index db0098d2ac4..a5bb1981d2c 100644
--- a/nixos/tests/sftpgo.nix
+++ b/nixos/tests/sftpgo.nix
@@ -156,7 +156,7 @@ in
         ensureDatabases = [ "sftpgo" ];
         ensureUsers = [{
           name = "sftpgo";
-          ensurePermissions."DATABASE sftpgo" = "ALL PRIVILEGES";
+          ensureDBOwnership = true;
         }];
       };
 
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index 13007d0d80d..a592504addc 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -277,4 +277,20 @@ in
       machine.wait_for_unit("multi-user.target")
     '';
   };
+
+  no-bootspec = makeTest
+    {
+      name = "systemd-boot-no-bootspec";
+      meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
+
+      nodes.machine = {
+        imports = [ common ];
+        boot.bootspec.enable = false;
+      };
+
+      testScript = ''
+        machine.start()
+        machine.wait_for_unit("multi-user.target")
+      '';
+    };
 }
diff --git a/nixos/tests/tandoor-recipes.nix b/nixos/tests/tandoor-recipes.nix
index f3369da99a0..18beaac6f06 100644
--- a/nixos/tests/tandoor-recipes.nix
+++ b/nixos/tests/tandoor-recipes.nix
@@ -5,6 +5,29 @@ import ./make-test-python.nix ({ lib, ... }: {
   nodes.machine = { pkgs, ... }: {
     services.tandoor-recipes = {
       enable = true;
+      extraConfig = {
+        DB_ENGINE = "django.db.backends.postgresql";
+        POSTGRES_HOST = "/run/postgresql";
+        POSTGRES_USER = "tandoor_recipes";
+        POSTGRES_DB = "tandoor_recipes";
+      };
+    };
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "tandoor_recipes" ];
+      ensureUsers = [
+        {
+          name = "tandoor_recipes";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    systemd.services = {
+      tandoor-recipes = {
+        after = [ "postgresql.service" ];
+      };
     };
   };
 
diff --git a/nixos/tests/vikunja.nix b/nixos/tests/vikunja.nix
index 2660aa9767c..60fd5ce1385 100644
--- a/nixos/tests/vikunja.nix
+++ b/nixos/tests/vikunja.nix
@@ -33,7 +33,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
         ensureDatabases = [ "vikunja-api" ];
         ensureUsers = [
           { name = "vikunja-api";
-            ensurePermissions = { "DATABASE \"vikunja-api\"" = "ALL PRIVILEGES"; };
+            ensureDBOwnership = true;
           }
         ];
       };
diff --git a/nixos/tests/wiki-js.nix b/nixos/tests/wiki-js.nix
index fd054a9c590..8b3c51935a6 100644
--- a/nixos/tests/wiki-js.nix
+++ b/nixos/tests/wiki-js.nix
@@ -10,14 +10,15 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
       enable = true;
       settings.db.host = "/run/postgresql";
       settings.db.user = "wiki-js";
+      settings.db.db = "wiki-js";
       settings.logLevel = "debug";
     };
     services.postgresql = {
       enable = true;
-      ensureDatabases = [ "wiki" ];
+      ensureDatabases = [ "wiki-js" ];
       ensureUsers = [
         { name = "wiki-js";
-          ensurePermissions."DATABASE wiki" = "ALL PRIVILEGES";
+          ensureDBOwnership = true;
         }
       ];
     };
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index b5cf860ad9b..dcbb7586eeb 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -2,6 +2,7 @@
 , fetchurl
 , autoPatchelfHook
 , makeWrapper
+, undmg
 
 , alsa-lib
 , curl
@@ -14,14 +15,16 @@
 , xdotool
 , which
 
-, jackSupport ? true
+, jackSupport ? stdenv.isLinux
 , jackLibrary
-, pulseaudioSupport ? config.pulseaudio or true
+, pulseaudioSupport ? config.pulseaudio or stdenv.isLinux
 , libpulseaudio
 }:
 
 let
-  url_for_platform = version: arch: "https://www.reaper.fm/files/${lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_${arch}.tar.xz";
+  url_for_platform = version: arch: if stdenv.isDarwin
+    then "https://www.reaper.fm/files/${lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_universal.dmg"
+    else "https://www.reaper.fm/files/${lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_${arch}.tar.xz";
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
@@ -29,26 +32,32 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
-    hash = {
+    hash = if stdenv.isDarwin then "sha256-jaT+3cIFVfBopgeeTkpNs9rFX50unlPJogdhkI9bsWU=" else {
       x86_64-linux = "sha256-P/PnbJPr4ErDz5ho1/dLERhqkKjdetHzKpCpfVZAYb0=";
       aarch64-linux = "sha256-PdnBVlHwoEEv2SPq/p5oyiOlduCEqL35gAY+QIJU1Ys=";
     }.${stdenv.hostPlatform.system};
   };
 
   nativeBuildInputs = [
-    autoPatchelfHook
     makeWrapper
-    xdg-utils # Required for desktop integration
+  ] ++ lib.optionals stdenv.isLinux [
     which
+    autoPatchelfHook
+    xdg-utils # Required for desktop integration
+  ] ++ lib.optionals stdenv.isDarwin [
+    undmg
   ];
 
+  sourceRoot = lib.optionalString stdenv.isDarwin "Reaper.app";
+
   buildInputs = [
-    alsa-lib
     stdenv.cc.cc.lib # reaper and libSwell need libstdc++.so.6
+  ] ++ lib.optionals stdenv.isLinux [
     gtk3
+    alsa-lib
   ];
 
-  runtimeDependencies = [
+  runtimeDependencies = lib.optionals stdenv.isLinux [
     gtk3 # libSwell needs libgdk-3.so.0
   ]
   ++ lib.optional jackSupport jackLibrary
@@ -56,7 +65,13 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  installPhase = ''
+  installPhase = if stdenv.isDarwin then ''
+    runHook preInstall
+    mkdir -p "$out/Applications/Reaper.app"
+    cp -r * "$out/Applications/Reaper.app/"
+    makeWrapper "$out/Applications/Reaper.app/Contents/MacOS/REAPER" "$out/bin/reaper"
+    runHook postInstall
+  '' else ''
     runHook preInstall
 
     HOME="$out/share" XDG_DATA_HOME="$out/share" ./install-reaper.sh \
@@ -89,7 +104,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.reaper.fm/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
     maintainers = with maintainers; [ jfrankenau ilian orivej uniquepointer viraptor ];
   };
 }
diff --git a/pkgs/applications/audio/reaper/updater.sh b/pkgs/applications/audio/reaper/updater.sh
index 750bea346bb..31832f7173c 100755
--- a/pkgs/applications/audio/reaper/updater.sh
+++ b/pkgs/applications/audio/reaper/updater.sh
@@ -5,7 +5,7 @@ set -euo pipefail
 
 reaper_ver=$(curl -Ls https://www.reaper.fm/download.php | grep -o 'Version [0-9]\.[0-9]*' | head -n1 | cut -d' ' -f2)
 
-function set_hash_for_arch() {
+function set_hash_for_linux() {
   local arch=$1
   pkg_hash=$(nix-prefetch-url https://www.reaper.fm/files/${reaper_ver%.*}.x/reaper${reaper_ver/./}_linux_$arch.tar.xz)
   pkg_hash=$(nix hash to-sri "sha256:$pkg_hash")
@@ -14,5 +14,15 @@ function set_hash_for_arch() {
   update-source-version reaper "${reaper_ver}" "$pkg_hash" --system=$arch-linux
 }
 
-set_hash_for_arch aarch64
-set_hash_for_arch x86_64
+function set_hash_for_darwin() {
+  local arch=$1
+  pkg_hash=$(nix-prefetch-url https://www.reaper.fm/files/${reaper_ver%.*}.x/reaper${reaper_ver/./}_universal.dmg)
+  pkg_hash=$(nix hash to-sri "sha256:$pkg_hash")
+  # reset the version so the second architecture update doesn't get ignored
+  update-source-version reaper 0 "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" --system=$arch-darwin
+  update-source-version reaper "${reaper_ver}" "$pkg_hash" --system=$arch-darwin
+}
+
+set_hash_for_linux aarch64
+set_hash_for_linux x86_64
+set_hash_for_darwin aarch64
diff --git a/pkgs/applications/editors/molsketch/default.nix b/pkgs/applications/editors/molsketch/default.nix
index 55db4096ce1..aa336ce45e2 100644
--- a/pkgs/applications/editors/molsketch/default.nix
+++ b/pkgs/applications/editors/molsketch/default.nix
@@ -48,6 +48,6 @@ mkDerivation rec {
     description = "2D molecule editor";
     homepage = "https://sourceforge.net/projects/molsketch/";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.fortuneteller2k ];
+    maintainers = [ maintainers.moni ];
   };
 }
diff --git a/pkgs/applications/editors/ox/default.nix b/pkgs/applications/editors/ox/default.nix
index 88229126400..2e67e83e972 100644
--- a/pkgs/applications/editors/ox/default.nix
+++ b/pkgs/applications/editors/ox/default.nix
@@ -18,6 +18,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/curlpipe/ox";
     changelog = "https://github.com/curlpipe/ox/releases/tag/${version}";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/applications/editors/texstudio/default.nix b/pkgs/applications/editors/texstudio/default.nix
index b9a386684f9..ef0f15734a2 100644
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@@ -29,6 +29,12 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    mkdir -p "$out/Applications"
+    mv "$out/bin/texstudio.app" "$out/Applications"
+    rm -d "$out/bin"
+  '';
+
   meta = with lib; {
     description = "TeX and LaTeX editor";
     longDescription=''
@@ -39,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://texstudio.org";
     changelog = "https://github.com/texstudio-org/texstudio/blob/${version}/utilities/manual/CHANGELOG.txt";
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ ajs124 cfouche ];
   };
 })
diff --git a/pkgs/applications/graphics/gscreenshot/default.nix b/pkgs/applications/graphics/gscreenshot/default.nix
index 9cc53a9c521..dc077e63e30 100644
--- a/pkgs/applications/graphics/gscreenshot/default.nix
+++ b/pkgs/applications/graphics/gscreenshot/default.nix
@@ -18,13 +18,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gscreenshot";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "thenaterhood";
     repo = "${pname}";
     rev = "v${version}";
-    sha256 = "sLJ+Fk+ePrmJeSllGd30uEQ/uFDl5CIob//1cDLKZHg=";
+    sha256 = "sha256-Ha9PTvr6XNGhe4I0ZUwrdbsNHWhz+Ubw2gp+ctLTO64=";
   };
 
   # needed for wrapGAppsHook to function
diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix
index 0f96680bb07..8bddaa96abd 100644
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "551";
+  version = "552";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-P/U44ndfucbRnwGLdSnnA0VE4K40zPz3wtNpQj8rh5Q=";
+    hash = "sha256-MaS9WxYlbQ7V/2mrETKS0UyWb5IzCrSwDcp4UlVS3zk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/flavours/default.nix b/pkgs/applications/misc/flavours/default.nix
index ed7fb787082..db625793adc 100644
--- a/pkgs/applications/misc/flavours/default.nix
+++ b/pkgs/applications/misc/flavours/default.nix
@@ -29,6 +29,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/Misterio77/flavours";
     changelog = "https://github.com/Misterio77/flavours/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ fortuneteller2k misterio77 ];
+    maintainers = with maintainers; [ moni misterio77 ];
   };
 }
diff --git a/pkgs/applications/misc/kile-wl/default.nix b/pkgs/applications/misc/kile-wl/default.nix
index 33423f474af..842499f845a 100644
--- a/pkgs/applications/misc/kile-wl/default.nix
+++ b/pkgs/applications/misc/kile-wl/default.nix
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://gitlab.com/snakedye/kile";
     license = licenses.mit;
     platforms = platforms.linux; # It's meant for river, a wayland compositor
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     mainProgram = "kile";
   };
 }
diff --git a/pkgs/applications/misc/tiramisu/default.nix b/pkgs/applications/misc/tiramisu/default.nix
index 8d1e1910cbc..3e8f101f871 100644
--- a/pkgs/applications/misc/tiramisu/default.nix
+++ b/pkgs/applications/misc/tiramisu/default.nix
@@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/Sweets/tiramisu";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ wishfort36 fortuneteller2k ];
+    maintainers = with maintainers; [ wishfort36 moni ];
   };
 }
diff --git a/pkgs/applications/misc/upwork/default.nix b/pkgs/applications/misc/upwork/default.nix
index 2c36b3411cd..e1cf49f61ae 100644
--- a/pkgs/applications/misc/upwork/default.nix
+++ b/pkgs/applications/misc/upwork/default.nix
@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation rec {
   pname = "upwork";
-  version = "5.8.0.31";
+  version = "5.8.0.33";
 
   src = requireFile {
     name = "${pname}_${version}_amd64.deb";
     url = "https://www.upwork.com/ab/downloads/os/linux/";
-    sha256 = "sha256-tQV6v0U6xxqBl7nQaBhXSrc9iv+7SPHfABTiJJQDnPI=";
+    sha256 = "sha256-MU0usTAfNNMN8OYmS6dWU6Xk2o5dg5J0V7OQiv3dLug=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/vieb/default.nix b/pkgs/applications/networking/browsers/vieb/default.nix
index 7c1beb43dca..fa5fad4934c 100644
--- a/pkgs/applications/networking/browsers/vieb/default.nix
+++ b/pkgs/applications/networking/browsers/vieb/default.nix
@@ -58,7 +58,7 @@ buildNpmPackage rec {
     homepage = "https://vieb.dev/";
     changelog = "https://github.com/Jelmerro/Vieb/releases/tag/${version}";
     description = "Vim Inspired Electron Browser";
-    maintainers = with maintainers; [ gebner fortuneteller2k tejing ];
+    maintainers = with maintainers; [ gebner tejing ];
     platforms = platforms.unix;
     license = licenses.gpl3Plus;
   };
diff --git a/pkgs/applications/networking/cluster/kluctl/default.nix b/pkgs/applications/networking/cluster/kluctl/default.nix
index 2f693934772..99e311ff3e2 100644
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@@ -33,6 +33,6 @@ buildGoModule rec {
     description = "The missing glue to put together large Kubernetes deployments";
     homepage = "https://kluctl.io/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ sikmir ];
+    maintainers = with maintainers; [ sikmir netthier ];
   };
 }
diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index 8c15855576b..ab2eb86164a 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.3.0";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-5znZMr0Dj6kpKJbypICN5+Fv/+3FgTLBok3YMrWaHdo=";
+    hash = "sha256-RqysUaHLgTNuTeLt5xsD06Qxv5qsGTPE0H7r4RqPf30=";
   };
 
-  vendorHash = "sha256-/iAGUnIMH2+IrvvXig56SpZ0eTfVwaCgGMUDp5/MtEo=";
+  vendorHash = "sha256-IH43F809dr6LGb87pqW2G9xrJLsQcHfjOm5PUj8r4Qo=";
 
   ldflags = [ "-s" "-w" "-X github.com/kubefirst/runtime/configs.K1Version=v${version}"];
 
diff --git a/pkgs/applications/networking/cluster/rke/default.nix b/pkgs/applications/networking/cluster/rke/default.nix
index 8021d55156a..f5b60daeac2 100644
--- a/pkgs/applications/networking/cluster/rke/default.nix
+++ b/pkgs/applications/networking/cluster/rke/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "rke";
-  version = "1.4.10";
+  version = "1.4.11";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-rr6CN5ik4vuLNqzNPvISfRfOjTcD48pSre2K6xr6xSk=";
+    hash = "sha256-bsvAyyf/ITIm8pxVF61idM91Ztd/2ufH2lBHR6a7lCQ=";
   };
 
   vendorHash = "sha256-3bivFrn2xDyILD1ugSr7IehhNq4vkqShFQI3sbeY0iY=";
diff --git a/pkgs/applications/networking/cluster/tfautomv/default.nix b/pkgs/applications/networking/cluster/tfautomv/default.nix
index 7409ec8ea44..358dfd0a39f 100644
--- a/pkgs/applications/networking/cluster/tfautomv/default.nix
+++ b/pkgs/applications/networking/cluster/tfautomv/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "tfautomv";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "busser";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-A1/sf+QjxQ8S2Cqmw9mD0r4aqA2Ssopeni0YNLND9L8=";
+    hash = "sha256-irB0Kfd8eqIKq0ooJRxB0X4t2/1aFCNYRwaG6lAw3ic=";
   };
 
-  vendorHash = "sha256-zAshnSqZT9lx9EWvJsMwi6rqvhUWJ/3uJnk+44TGzlU=";
+  vendorHash = "sha256-Wc5hpiHL5I01IodcHX0IzeKfthkFS7SuUxmaxOU6WkA=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index 266c843931b..5d5c8301378 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.106.0.212";
+  version = "8.108.0.205";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -68,7 +68,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "sha256-TlqhCj5nyL8SEo3M6ahPLYOTDrEjHvxtu1qFSR8LtkM=";
+        sha256 = "sha256-9V+/tTFco69NkCeswbGobr3ZxcS3q+Zd7fiei4N8uTY=";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index 4f61935faac..702e92c04c3 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mailspring";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "https://github.com/Foundry376/Mailspring/releases/download/${version}/mailspring-${version}-amd64.deb";
-    hash = "sha256-aAqkltVxIlGwRVGM+1QkrVgfnitl+D3Xb0qi0o8ow+Q=";
+    hash = "sha256-6dTAPetJgYrvIEtu+2QxcBOeYFZfN/dFhM0CZFzcC/E=";
   };
 
   nativeBuildInputs = [
@@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
     openssl
     (lib.getLib udev)
     libappindicator
+    libsecret
   ];
 
   unpackPhase = ''
diff --git a/pkgs/applications/radio/uhd/default.nix b/pkgs/applications/radio/uhd/default.nix
index bad5b2d1d98..c3f7b58fa1b 100644
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   #
   #     nix-shell maintainers/scripts/update.nix --argstr package uhd --argstr commit true
   #
-  version = "4.5.0.0";
+  version = "4.6.0.0";
 
   outputs = [ "out" "dev" ];
 
@@ -63,14 +63,14 @@ stdenv.mkDerivation (finalAttrs: {
     rev = "v${finalAttrs.version}";
     # The updateScript relies on the `src` using `hash`, and not `sha256. To
     # update the correct hash for the `src` vs the `uhdImagesSrc`
-    hash = "sha256-0EqMBaQiNr8PE542YNkPvX3o1HhnhrO0Kz1euphY6Ps=";
+    hash = "sha256-9ZGt0ZrGbprCmpAuOue6pg2gliu4MvlRFHGxyMJeKAc=";
   };
   # Firmware images are downloaded (pre-built) from the respective release on Github
   uhdImagesSrc = fetchurl {
     url = "https://github.com/EttusResearch/uhd/releases/download/v${finalAttrs.version}/uhd-images_${finalAttrs.version}.tar.xz";
     # Please don't convert this to a hash, in base64, see comment near src's
     # hash.
-    sha256 = "13cn41wv7vldk4vx7vy3jbb3wb3a5vpfg3ay893klpi6vzxc1dly";
+    sha256 = "17g503mhndaabrdl7qai3rdbafr8xx8awsyr7h2bdzwzprzmh4m3";
   };
   passthru = {
     updateScript = [
diff --git a/pkgs/applications/terminal-emulators/contour/default.nix b/pkgs/applications/terminal-emulators/contour/default.nix
index 9c44946f382..1a036106c6d 100644
--- a/pkgs/applications/terminal-emulators/contour/default.nix
+++ b/pkgs/applications/terminal-emulators/contour/default.nix
@@ -103,7 +103,7 @@ mkDerivation rec {
     homepage = "https://github.com/contour-terminal/contour";
     changelog = "https://github.com/contour-terminal/contour/raw/v${version}/Changelog.md";
     license = licenses.asl20;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index bc5d3aa8b33..c3e715ad46f 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, fetchpatch, fetchFromGitLab, bundlerEnv
-, ruby_3_0, tzdata, git, nettools, nixosTests, nodejs, openssl
+, ruby_3_2, tzdata, git, nettools, nixosTests, nodejs, openssl
 , gitlabEnterprise ? false, callPackage, yarn
 , fixup_yarn_lock, replace, file, cacert, fetchYarnDeps, makeWrapper, pkg-config
 }:
@@ -17,7 +17,7 @@ let
 
   rubyEnv = bundlerEnv rec {
     name = "gitlab-env-${version}";
-    ruby = ruby_3_0;
+    ruby = ruby_3_2;
     gemdir = ./rubyEnv;
     gemset =
       let x = import (gemdir + "/gemset.nix") src;
diff --git a/pkgs/applications/video/bilibili/default.nix b/pkgs/applications/video/bilibili/default.nix
index a4fe9570992..9a507e93ab6 100644
--- a/pkgs/applications/video/bilibili/default.nix
+++ b/pkgs/applications/video/bilibili/default.nix
@@ -7,10 +7,10 @@
 
 stdenv.mkDerivation rec {
   pname = "bilibili";
-  version = "1.12.1-2";
+  version = "1.12.3-1";
   src = fetchurl {
     url = "https://github.com/msojocs/bilibili-linux/releases/download/v${version}/io.github.msojocs.bilibili_${version}_amd64.deb";
-    hash = "sha256-vYoVHVT/Deooxq/0WVzPebR68N9KBJfgLU30lJPB89M=";
+    hash = "sha256-F2y5daIdNJZGNjOctN9iA6kHSRVSMWK8s80X+kXxzb4=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/applications/window-managers/lemonbar/default.nix b/pkgs/applications/window-managers/lemonbar/default.nix
index 8f553eb4b55..0d8436dcb3e 100644
--- a/pkgs/applications/window-managers/lemonbar/default.nix
+++ b/pkgs/applications/window-managers/lemonbar/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A lightweight xcb based bar";
     homepage = "https://github.com/LemonBoy/bar";
-    maintainers = with maintainers; [ meisternu fortuneteller2k ];
+    maintainers = with maintainers; [ meisternu moni ];
     license = licenses.mit;
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/window-managers/lemonbar/xft.nix b/pkgs/applications/window-managers/lemonbar/xft.nix
index 54e7820ec4c..8d009a3458b 100644
--- a/pkgs/applications/window-managers/lemonbar/xft.nix
+++ b/pkgs/applications/window-managers/lemonbar/xft.nix
@@ -20,6 +20,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/drscream/lemonbar-xft";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/applications/window-managers/neocomp/default.nix b/pkgs/applications/window-managers/neocomp/default.nix
index e878f4f088e..36e6322462d 100644
--- a/pkgs/applications/window-managers/neocomp/default.nix
+++ b/pkgs/applications/window-managers/neocomp/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage        = "https://github.com/DelusionalLogic/NeoComp";
     license         = licenses.gpl3Only;
-    maintainers     = with maintainers; [ twey fortuneteller2k ];
+    maintainers     = with maintainers; [ twey moni ];
     platforms       = platforms.linux;
     description     = "A fork of Compton, a compositor for X11";
     longDescription = ''
diff --git a/pkgs/applications/window-managers/river/default.nix b/pkgs/applications/window-managers/river/default.nix
index 453dcf14d82..e149bdd6521 100644
--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       adamcstephens
-      fortuneteller2k
+      moni
       rodrgz
     ];
     mainProgram = "river";
diff --git a/pkgs/applications/window-managers/sway/wrapper.nix b/pkgs/applications/window-managers/sway/wrapper.nix
index 21a7daa1fa3..7510e1e9582 100644
--- a/pkgs/applications/window-managers/sway/wrapper.nix
+++ b/pkgs/applications/window-managers/sway/wrapper.nix
@@ -17,22 +17,22 @@ with lib;
 
 let
   sway = sway-unwrapped.overrideAttrs (oa: { inherit isNixOS enableXWayland; });
-  baseWrapper = writeShellScriptBin "sway" ''
+  baseWrapper = writeShellScriptBin sway.meta.mainProgram ''
      set -o errexit
      if [ ! "$_SWAY_WRAPPER_ALREADY_EXECUTED" ]; then
-       export XDG_CURRENT_DESKTOP=sway
+       export XDG_CURRENT_DESKTOP=${sway.meta.mainProgram}
        ${extraSessionCommands}
        export _SWAY_WRAPPER_ALREADY_EXECUTED=1
      fi
      if [ "$DBUS_SESSION_BUS_ADDRESS" ]; then
        export DBUS_SESSION_BUS_ADDRESS
-       exec ${sway}/bin/sway "$@"
+       exec ${lib.getExe sway} "$@"
      else
-       exec ${lib.optionalString dbusSupport "${dbus}/bin/dbus-run-session"} ${sway}/bin/sway "$@"
+       exec ${lib.optionalString dbusSupport "${dbus}/bin/dbus-run-session"} ${lib.getExe sway} "$@"
      fi
    '';
 in symlinkJoin {
-  name = "sway-${sway.version}";
+  name = "${sway.meta.mainProgram}-${sway.version}";
 
   paths = (optional withBaseWrapper baseWrapper)
     ++ [ sway ];
@@ -49,14 +49,14 @@ in symlinkJoin {
   postBuild = ''
     ${optionalString withGtkWrapper "gappsWrapperArgsHook"}
 
-    wrapProgram $out/bin/sway \
+    wrapProgram $out/bin/${sway.meta.mainProgram} \
       ${optionalString withGtkWrapper ''"''${gappsWrapperArgs[@]}"''} \
       ${optionalString (extraOptions != []) "${concatMapStrings (x: " --add-flags " + x) extraOptions}"}
   '';
 
   passthru = {
     inherit (sway.passthru) tests;
-    providedSessions = [ "sway" ];
+    providedSessions = [ sway.meta.mainProgram ];
   };
 
   inherit (sway) meta;
diff --git a/pkgs/by-name/ap/apache-users/optional-args.patch b/pkgs/by-name/ap/apache-users/optional-args.patch
new file mode 100644
index 00000000000..7b921a21ce0
--- /dev/null
+++ b/pkgs/by-name/ap/apache-users/optional-args.patch
@@ -0,0 +1,24 @@
+--- a/apache2.1.pl
++++ b/apache2.1.pl
+@@ -63,10 +63,10 @@ getopt ("h: l: p: e: s: t:" ,\%opts);
+ use LWP;
+ 
+ 
+-if (!(exists $opts{h})||!(exists $opts{p})||!(exists $opts{l})||!(exists $opts{e})){ &usage;}
++if (!(exists $opts{h})){ &usage;}
+ 
+ sub usage{
+-print "\nUSAGE: apache.pl [-h 1.2.3.4] [-l names] [-p 80] [-s (SSL Support 1=true 0=false)] [-e 403 (http code)] [-t threads]\n\n ";
++print "\nUSAGE: apache-users -h 1.2.3.4 [-l names] [-p 80] [-s (SSL Support 1=true 0=false)] [-e 403 (http code)] [-t threads]\n\n ";
+ exit 1;	
+ };
+ 
+@@ -75,7 +75,7 @@ if (exists $opts{h}){
+ }
+ if (exists $opts{l}){ 
+     $list=$opts{l};
+-}else {$list="names";}
++}else {$list="@out@/share/apache-users/names";}
+ if (exists $opts{p}){ 
+      $port=$opts{p};
+ }else{$port=80;}
diff --git a/pkgs/by-name/ap/apache-users/package.nix b/pkgs/by-name/ap/apache-users/package.nix
new file mode 100644
index 00000000000..8780a13a3f8
--- /dev/null
+++ b/pkgs/by-name/ap/apache-users/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchurl
+, perl
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "apache-users";
+  version = "2.1";
+
+  src = fetchurl {
+    url = "https://labs.portcullis.co.uk/download/apache_users-${finalAttrs.version}.tar.gz";
+    hash = "sha256-rylW4F8Si6KKYxaxEJlVFnbLqfqS6ytMPfHpc8MgriA=";
+  };
+
+  # Allow optional arguments where defaults are provided
+  patches = [ ./optional-args.patch ];
+
+  postPatch = ''
+    substituteAllInPlace apache${finalAttrs.version}.pl
+  '';
+
+  buildInputs = [
+    (perl.withPackages (p: [ p.ParallelForkManager p.LWP ]))
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D apache${finalAttrs.version}.pl $out/bin/apache-users
+    install -Dm444 names $out/share/apache-users/names
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Username Enumeration through Apache UserDir";
+    homepage = "https://labs.portcullis.co.uk/downloads/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ emilytrau ];
+    mainProgram = "apache-users";
+  };
+})
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index 48bcff3f32a..87858931d80 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -45,13 +45,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cockpit";
-  version = "303";
+  version = "305";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     rev = "refs/tags/${version}";
-    hash = "sha256-1VPnmb4VDSwzdXtk2YZVHH4qFJSe2OPzsmzVD/NkbYg=";
+    hash = "sha256-fCVnggso/wAvci9sLRVvwEsvZ+CeEfLBDnPPcAy/wGo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/cy/cyme/package.nix b/pkgs/by-name/cy/cyme/package.nix
index 3e32c22d2e4..bcb06b8ed20 100644
--- a/pkgs/by-name/cy/cyme/package.nix
+++ b/pkgs/by-name/cy/cyme/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cyme";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "tuna-f1sh";
     repo = "cyme";
     rev = "v${version}";
-    hash = "sha256-UXh97pHJ9wa/xSslHLB7WVDwLKJYvLPgmPX8RvKrsTI=";
+    hash = "sha256-Y5TcRcbqarcKRDWCI36YhbLJFU+yrpAE3vRGArbfr0U=";
   };
 
-  cargoHash = "sha256-hSd53K50Y4K/fYGfsT2fHUaipVSpeYN6/EOFlv4ocuE=";
+  cargoHash = "sha256-ycFNNTZ7AU4WRnf1+RJB7KxQKVdJbubB28tS/GyU0bI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 258e1b44c37..fde0f3378c3 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -4,13 +4,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.0.2";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     rev = "v${version}";
-    hash = "sha256-6tk8NRuBbRMoaz3CmUUOC6thxIgjk/MWl50+YgQ6l5o=";
+    hash = "sha256-mYE8cu7qHRyG/pZSr4u6tMEF3ZM5Qz+CX+oLf/chwl4=";
   };
 
   vendorHash = "sha256-fP6yxfIQoVaBC9hYcrCyo3YP3ntEVDbDTwKMO9TdyDI=";
diff --git a/pkgs/by-name/po/polybar/package.nix b/pkgs/by-name/po/polybar/package.nix
index 67b05b8f4b6..ee649f396fa 100644
--- a/pkgs/by-name/po/polybar/package.nix
+++ b/pkgs/by-name/po/polybar/package.nix
@@ -110,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
       having a black belt in shell scripting.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ afldcr Br1ght0ne fortuneteller2k ckie ];
+    maintainers = with maintainers; [ afldcr Br1ght0ne moni ckie ];
     platforms = platforms.linux;
   };
 })
diff --git a/pkgs/data/fonts/curie/default.nix b/pkgs/data/fonts/curie/default.nix
index 4f3ab7eb013..5e8195211b0 100644
--- a/pkgs/data/fonts/curie/default.nix
+++ b/pkgs/data/fonts/curie/default.nix
@@ -25,6 +25,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/NerdyPepper/curie";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/data/fonts/edwin/default.nix b/pkgs/data/fonts/edwin/default.nix
index 41926ac1b67..2ccb44d45d2 100644
--- a/pkgs/data/fonts/edwin/default.nix
+++ b/pkgs/data/fonts/edwin/default.nix
@@ -23,6 +23,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/MuseScoreFonts/Edwin";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/data/fonts/open-fonts/default.nix b/pkgs/data/fonts/open-fonts/default.nix
index 6a628174f2e..3f768209794 100644
--- a/pkgs/data/fonts/open-fonts/default.nix
+++ b/pkgs/data/fonts/open-fonts/default.nix
@@ -23,6 +23,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/kiwi0fruit/open-fonts";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/data/fonts/scientifica/default.nix b/pkgs/data/fonts/scientifica/default.nix
index 1f946ecb17a..1b57c9f286d 100644
--- a/pkgs/data/fonts/scientifica/default.nix
+++ b/pkgs/data/fonts/scientifica/default.nix
@@ -26,6 +26,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/NerdyPepper/scientifica";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/data/icons/papirus-icon-theme/default.nix
index be53cafa434..1de1411cb75 100644
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -41,6 +41,6 @@ stdenvNoCC.mkDerivation rec {
     license = licenses.gpl3Only;
     # darwin gives hash mismatch in source, probably because of file names differing only in case
     platforms = platforms.linux;
-    maintainers = with maintainers; [ romildo fortuneteller2k ];
+    maintainers = with maintainers; [ romildo moni ];
   };
 }
diff --git a/pkgs/data/icons/phinger-cursors/default.nix b/pkgs/data/icons/phinger-cursors/default.nix
index 5afd2fe228f..82742723806 100644
--- a/pkgs/data/icons/phinger-cursors/default.nix
+++ b/pkgs/data/icons/phinger-cursors/default.nix
@@ -23,6 +23,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/phisch/phinger-cursors";
     platforms = platforms.unix;
     license = licenses.cc-by-sa-40;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/data/themes/onestepback/default.nix b/pkgs/data/themes/onestepback/default.nix
index 9547e354389..c18d55db5b4 100644
--- a/pkgs/data/themes/onestepback/default.nix
+++ b/pkgs/data/themes/onestepback/default.nix
@@ -2,20 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "onestepback";
-  version = "0.991";
+  version = "0.994";
 
   srcs = [
     (fetchurl {
       url = "http://www.vide.memoire.free.fr/perso/OneStepBack/OneStepBack-v${version}.zip";
-      sha256 = "1jfgcgzbb6ra9qs3zcp6ij0hfldzg3m0yjw6l6vf4kq1mdby1ghm";
+      hash = "sha256-kjGiGo4bF1mWJPnaPv2lf7rGG/uAntHK61mH6lcJ6e4=";
     })
     (fetchurl {
-      url = "http://www.vide.memoire.free.fr/perso/OneStepBack/OneStepBack-grey-brown-green-blue-v${version}.zip";
-      sha256 = "0i006h1asbpfdzajws0dvk9acplvcympzgxq5v3n8hmizd6yyh77";
-    })
-    (fetchurl {
-      url = "http://www.vide.memoire.free.fr/perso/OneStepBack/OneStepBack-green-brown-v${version}.zip";
-      sha256 = "16p002lak6425gcskny4hzws8x9dgsm6j3a1r08y11rsz7d2hnmy";
+      url = "http://www.vide.memoire.free.fr/perso/OneStepBack/OneStepBack-darker-v${version}.zip";
+      hash = "sha256-AuurSa45uF5GbPqaMXKblWkv3YGkYL1z0VjWrbnsB/I=";
     })
   ];
 
@@ -24,15 +20,17 @@ stdenv.mkDerivation rec {
   sourceRoot = ".";
 
   installPhase = ''
+    runHook preInstall
     mkdir -p  $out/share/themes
     cp -a OneStepBack* $out/share/themes/
     rm $out/share/themes/*/{LICENSE,README*}
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Gtk theme inspired by the NextStep look";
     homepage = "http://www.vide.memoire.free.fr/perso/OneStepBack";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = [ maintainers.romildo ];
   };
diff --git a/pkgs/data/themes/yaru/default.nix b/pkgs/data/themes/yaru/default.nix
index 93802c6b887..1490b5db79d 100644
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/ubuntu/yaru";
     license = with licenses; [ cc-by-sa-40 gpl3Plus lgpl21Only lgpl3Only ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fortuneteller2k amaxine ];
+    maintainers = with maintainers; [ moni amaxine ];
   };
 }
diff --git a/pkgs/development/compilers/llvm/5/clang/LLVMgold-path.patch b/pkgs/development/compilers/llvm/5/clang/LLVMgold-path.patch
deleted file mode 100644
index 6a09c91b513..00000000000
--- a/pkgs/development/compilers/llvm/5/clang/LLVMgold-path.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/lib/Driver/ToolChains/CommonArgs.cpp b/lib/Driver/ToolChains/CommonArgs.cpp
-index 00bd60bc24bb..17416b0bd3c0 100644
---- a/lib/Driver/ToolChains/CommonArgs.cpp
-+++ b/lib/Driver/ToolChains/CommonArgs.cpp
-@@ -376,8 +376,7 @@ void tools::AddGoldPlugin(const ToolChain &ToolChain, const ArgList &Args,
-   // as gold requires -plugin to come before any -plugin-opt that -Wl might
-   // forward.
-   CmdArgs.push_back("-plugin");
--  std::string Plugin =
--      ToolChain.getDriver().Dir + "/../lib" CLANG_LIBDIR_SUFFIX "/LLVMgold.so";
-+  std::string Plugin = "@libllvmLibdir@" "/LLVMgold.so";
-   CmdArgs.push_back(Args.MakeArgString(Plugin));
- 
-   // Try to pass driver level flags relevant to LTO code generation down to
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
deleted file mode 100644
index 70ffb3e0dd1..00000000000
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ /dev/null
@@ -1,127 +0,0 @@
-{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
-, buildLlvmTools
-, fixDarwinDylibNames
-, enableManpages ? false
-}:
-
-let
-  self = stdenv.mkDerivation ({
-    pname = "clang";
-    inherit version;
-
-    src = fetch "cfe" "0018520c4qxf5hgjdqgpz2dgl3faf4gsz87fdlb8zdmx99rfk77s";
-
-    unpackPhase = ''
-      unpackFile $src
-      mv cfe-${version}* clang
-      sourceRoot=$PWD/clang
-      unpackFile ${clang-tools-extra_src}
-      mv clang-tools-extra-* $sourceRoot/tools/extra
-    '';
-
-    nativeBuildInputs = [ cmake python3 ]
-      ++ lib.optional enableManpages python3.pkgs.sphinx
-      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-
-    buildInputs = [ libxml2 libllvm ];
-
-    cmakeFlags = [
-      "-DCMAKE_CXX_FLAGS=-std=c++11"
-      "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
-    ] ++ lib.optionals enableManpages [
-      "-DCLANG_INCLUDE_DOCS=ON"
-      "-DLLVM_ENABLE_SPHINX=ON"
-      "-DSPHINX_OUTPUT_MAN=ON"
-      "-DSPHINX_OUTPUT_HTML=OFF"
-      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
-    ];
-
-    patches = [
-      ../../common/clang/5-8-purity.patch
-      ./gnu-install-dirs.patch
-      (substituteAll {
-        src = ./LLVMgold-path.patch;
-        libllvmLibdir = "${libllvm.lib}/lib";
-      })
-    ];
-
-    postPatch = ''
-      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
-             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
-             lib/Driver/ToolChains/*.cpp
-    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
-      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
-    '';
-
-    outputs = [ "out" "lib" "dev" "python" ];
-
-    postInstall = ''
-      ln -sv $out/bin/clang $out/bin/cpp
-
-      # Move libclang to 'lib' output
-      moveToOutput "lib/libclang.*" "$lib"
-      substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
-          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang."
-
-      mkdir -p $python/bin $python/share/{clang,scan-view}
-      mv $out/bin/{git-clang-format,scan-view} $python/bin
-      if [ -e $out/bin/set-xcode-analyzer ]; then
-        mv $out/bin/set-xcode-analyzer $python/bin
-      fi
-      mv $out/share/clang/*.py $python/share/clang
-      mv $out/share/scan-view/*.py $python/share/scan-view
-      rm $out/bin/c-index-test
-      patchShebangs $python/bin
-
-      mkdir -p $dev/bin
-      cp bin/clang-tblgen $dev/bin
-    '';
-
-    passthru = {
-      inherit libllvm;
-      isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
-    };
-
-    meta = llvm_meta // {
-      homepage = "https://clang.llvm.org/";
-      description = "A C language family frontend for LLVM";
-      longDescription = ''
-        The Clang project provides a language front-end and tooling
-        infrastructure for languages in the C language family (C, C++, Objective
-        C/C++, OpenCL, CUDA, and RenderScript) for the LLVM project.
-        It aims to deliver amazingly fast compiles, extremely useful error and
-        warning messages and to provide a platform for building great source
-        level tools. The Clang Static Analyzer and clang-tidy are tools that
-        automatically find bugs in your code, and are great examples of the sort
-        of tools that can be built using the Clang frontend as a library to
-        parse C/C++ code.
-      '';
-      mainProgram = "clang";
-    };
-  } // lib.optionalAttrs enableManpages {
-    pname = "clang-manpages";
-
-    buildPhase = ''
-      make docs-clang-man
-    '';
-
-    installPhase = ''
-      mkdir -p $out/share/man/man1
-      # Manually install clang manpage
-      cp docs/man/*.1 $out/share/man/man1/
-    '';
-
-    outputs = [ "out" ];
-
-    doCheck = false;
-
-    meta = llvm_meta // {
-      description = "man page for Clang ${version}";
-    };
-  });
-in self
diff --git a/pkgs/development/compilers/llvm/5/clang/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/5/clang/gnu-install-dirs.patch
deleted file mode 100644
index 7e6903222f4..00000000000
--- a/pkgs/development/compilers/llvm/5/clang/gnu-install-dirs.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 2667b1d6892e..87c5ad58738f 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -5,6 +5,8 @@ cmake_minimum_required(VERSION 3.4.3)
- if( CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR )
-   project(Clang)
- 
-+  include(GNUInstallDirs)
-+
-   # Rely on llvm-config.
-   set(CONFIG_OUTPUT)
-   find_program(LLVM_CONFIG "llvm-config")
-@@ -344,7 +346,7 @@ include_directories(BEFORE
- 
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/clang include/clang-c
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.def"
-     PATTERN "*.h"
-@@ -353,7 +355,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-     )
- 
-   install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/include/clang
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "CMakeFiles" EXCLUDE
-     PATTERN "*.inc"
-@@ -361,7 +363,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-     )
- 
-   install(PROGRAMS utils/bash-autocomplete.sh
--    DESTINATION share/clang
-+    DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
-     )
- endif()
- 
-diff --git a/cmake/modules/AddClang.cmake b/cmake/modules/AddClang.cmake
-index e657059744a4..19da44638fe6 100644
---- a/cmake/modules/AddClang.cmake
-+++ b/cmake/modules/AddClang.cmake
-@@ -99,9 +99,9 @@ macro(add_clang_library name)
-       install(TARGETS ${name}
-         COMPONENT ${name}
-         ${export_to_clangtargets}
--        LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
--        ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
--        RUNTIME DESTINATION bin)
-+        LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
-+        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
-+        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
- 
-       if (${ARG_SHARED} AND NOT CMAKE_CONFIGURATION_TYPES)
-         add_custom_target(install-${name}
-@@ -143,7 +143,7 @@ macro(add_clang_tool name)
- 
-     install(TARGETS ${name}
-       ${export_to_clangtargets}
--      RUNTIME DESTINATION bin
-+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
-       COMPONENT ${name})
- 
-     if(NOT CMAKE_CONFIGURATION_TYPES)
-@@ -160,5 +160,5 @@ endmacro()
- macro(add_clang_symlink name dest)
-   add_llvm_tool_symlink(${name} ${dest} ALWAYS_GENERATE)
-   # Always generate install targets
--  llvm_install_symlink(${name} ${dest} ALWAYS_GENERATE)
-+  llvm_install_symlink(${name} ${dest} ${CMAKE_INSTALL_FULL_BINDIR} ALWAYS_GENERATE)
- endmacro()
-diff --git a/lib/Headers/CMakeLists.txt b/lib/Headers/CMakeLists.txt
-index a621c02644e3..e140efc9c83c 100644
---- a/lib/Headers/CMakeLists.txt
-+++ b/lib/Headers/CMakeLists.txt
-@@ -129,13 +129,13 @@ install(
-   FILES ${files} ${CMAKE_CURRENT_BINARY_DIR}/arm_neon.h
-   COMPONENT clang-headers
-   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
--  DESTINATION lib${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
-+  DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include)
- 
- install(
-   FILES ${cuda_wrapper_files}
-   COMPONENT clang-headers
-   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
--  DESTINATION lib${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include/cuda_wrappers)
-+  DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/clang/${CLANG_VERSION}/include/cuda_wrappers)
- 
- if (NOT CMAKE_CONFIGURATION_TYPES) # don't add this for IDE's.
-   add_custom_target(install-clang-headers
-diff --git a/tools/c-index-test/CMakeLists.txt b/tools/c-index-test/CMakeLists.txt
-index ad990e010eef..92e52d05afb9 100644
---- a/tools/c-index-test/CMakeLists.txt
-+++ b/tools/c-index-test/CMakeLists.txt
-@@ -48,7 +48,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-     set_property(TARGET c-index-test APPEND PROPERTY INSTALL_RPATH
-        "@executable_path/../../lib")
-   else()
--    set(INSTALL_DESTINATION bin)
-+    set(INSTALL_DESTINATION ${CMAKE_INSTALL_BINDIR})
-   endif()
- 
-   install(TARGETS c-index-test
-diff --git a/tools/clang-check/CMakeLists.txt b/tools/clang-check/CMakeLists.txt
-index 04151a8e0331..13918d91c4ba 100644
---- a/tools/clang-check/CMakeLists.txt
-+++ b/tools/clang-check/CMakeLists.txt
-@@ -19,4 +19,4 @@ target_link_libraries(clang-check
-   )
- 
- install(TARGETS clang-check
--  RUNTIME DESTINATION bin)
-+  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
-diff --git a/tools/clang-format/CMakeLists.txt b/tools/clang-format/CMakeLists.txt
-index a13633eaefc4..9b0094783690 100644
---- a/tools/clang-format/CMakeLists.txt
-+++ b/tools/clang-format/CMakeLists.txt
-@@ -20,20 +20,20 @@ if( LLVM_USE_SANITIZE_COVERAGE )
- endif()
- 
- install(PROGRAMS clang-format-bbedit.applescript
--  DESTINATION share/clang
-+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
-   COMPONENT clang-format)
- install(PROGRAMS clang-format-diff.py
--  DESTINATION share/clang
-+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
-   COMPONENT clang-format)
- install(PROGRAMS clang-format-sublime.py
--  DESTINATION share/clang
-+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
-   COMPONENT clang-format)
- install(PROGRAMS clang-format.el
--  DESTINATION share/clang
-+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
-   COMPONENT clang-format)
- install(PROGRAMS clang-format.py
--  DESTINATION share/clang
-+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
-   COMPONENT clang-format)
- install(PROGRAMS git-clang-format
--  DESTINATION bin
-+  DESTINATION ${CMAKE_INSTALL_BINDIR}
-   COMPONENT clang-format)
-diff --git a/tools/clang-offload-bundler/CMakeLists.txt b/tools/clang-offload-bundler/CMakeLists.txt
-index 6161d08ae587..a003292d1676 100644
---- a/tools/clang-offload-bundler/CMakeLists.txt
-+++ b/tools/clang-offload-bundler/CMakeLists.txt
-@@ -21,4 +21,4 @@ target_link_libraries(clang-offload-bundler
-   ${CLANG_OFFLOAD_BUNDLER_LIB_DEPS}
-   )
- 
--install(TARGETS clang-offload-bundler RUNTIME DESTINATION bin)
-+install(TARGETS clang-offload-bundler RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
-diff --git a/tools/clang-rename/CMakeLists.txt b/tools/clang-rename/CMakeLists.txt
-index 771e3bdea6f0..d1396e62b28f 100644
---- a/tools/clang-rename/CMakeLists.txt
-+++ b/tools/clang-rename/CMakeLists.txt
-@@ -14,11 +14,11 @@ target_link_libraries(clang-rename
-   clangToolingRefactor
-   )
- 
--install(TARGETS clang-rename RUNTIME DESTINATION bin)
-+install(TARGETS clang-rename RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
- 
- install(PROGRAMS clang-rename.py
--  DESTINATION share/clang
-+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
-   COMPONENT clang-rename)
- install(PROGRAMS clang-rename.el
--  DESTINATION share/clang
-+  DESTINATION ${CMAKE_INSTALL_DATADIR}/clang
-   COMPONENT clang-rename)
-diff --git a/tools/libclang/CMakeLists.txt b/tools/libclang/CMakeLists.txt
-index 2dd670307636..1fe576f77ddb 100644
---- a/tools/libclang/CMakeLists.txt
-+++ b/tools/libclang/CMakeLists.txt
-@@ -121,7 +121,7 @@ endif()
- if(INTERNAL_INSTALL_PREFIX)
-   set(LIBCLANG_HEADERS_INSTALL_DESTINATION "${INTERNAL_INSTALL_PREFIX}/include")
- else()
--  set(LIBCLANG_HEADERS_INSTALL_DESTINATION include)
-+  set(LIBCLANG_HEADERS_INSTALL_DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
- endif()
- 
- install(DIRECTORY ../../include/clang-c
-diff --git a/tools/scan-build/CMakeLists.txt b/tools/scan-build/CMakeLists.txt
-index 380379300b09..adfd58ed5f7d 100644
---- a/tools/scan-build/CMakeLists.txt
-+++ b/tools/scan-build/CMakeLists.txt
-@@ -41,7 +41,7 @@ if(CLANG_INSTALL_SCANBUILD)
-                          ${CMAKE_BINARY_DIR}/bin/
-                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/bin/${BinFile})
-     list(APPEND Depends ${CMAKE_BINARY_DIR}/bin/${BinFile})
--    install(PROGRAMS bin/${BinFile} DESTINATION bin)
-+    install(PROGRAMS bin/${BinFile} DESTINATION ${CMAKE_INSTALL_BINDIR})
-   endforeach()
- 
-   foreach(LibexecFile ${LibexecFiles})
-@@ -53,7 +53,7 @@ if(CLANG_INSTALL_SCANBUILD)
-                          ${CMAKE_BINARY_DIR}/libexec/
-                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/libexec/${LibexecFile})
-     list(APPEND Depends ${CMAKE_BINARY_DIR}/libexec/${LibexecFile})
--    install(PROGRAMS libexec/${LibexecFile} DESTINATION libexec)
-+    install(PROGRAMS libexec/${LibexecFile} DESTINATION ${CMAKE_INSTALL_LIBEXECDIR})
-   endforeach()
- 
-   foreach(ManPage ${ManPages})
-@@ -77,7 +77,7 @@ if(CLANG_INSTALL_SCANBUILD)
-                          ${CMAKE_BINARY_DIR}/share/scan-build/
-                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/share/scan-build/${ShareFile})
-     list(APPEND Depends ${CMAKE_BINARY_DIR}/share/scan-build/${ShareFile})
--    install(FILES share/scan-build/${ShareFile} DESTINATION share/scan-build)
-+    install(FILES share/scan-build/${ShareFile} DESTINATION ${CMAKE_INSTALL_DATADIR}/scan-build)
-   endforeach()
- 
-   add_custom_target(scan-build ALL DEPENDS ${Depends})
-diff --git a/tools/scan-view/CMakeLists.txt b/tools/scan-view/CMakeLists.txt
-index b305ca562a72..554bcb379061 100644
---- a/tools/scan-view/CMakeLists.txt
-+++ b/tools/scan-view/CMakeLists.txt
-@@ -21,7 +21,7 @@ if(CLANG_INSTALL_SCANVIEW)
-                          ${CMAKE_BINARY_DIR}/bin/
-                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/bin/${BinFile})
-     list(APPEND Depends ${CMAKE_BINARY_DIR}/bin/${BinFile})
--    install(PROGRAMS bin/${BinFile} DESTINATION bin)
-+    install(PROGRAMS bin/${BinFile} DESTINATION ${CMAKE_INSTALL_BINDIR})
-   endforeach()
- 
-   foreach(ShareFile ${ShareFiles})
-@@ -33,7 +33,7 @@ if(CLANG_INSTALL_SCANVIEW)
-                          ${CMAKE_BINARY_DIR}/share/scan-view/
-                        DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/share/${ShareFile})
-     list(APPEND Depends ${CMAKE_BINARY_DIR}/share/scan-view/${ShareFile})
--    install(FILES share/${ShareFile} DESTINATION share/scan-view)
-+    install(FILES share/${ShareFile} DESTINATION ${CMAKE_INSTALL_DATADIR}/scan-view)
-   endforeach()
- 
-   add_custom_target(scan-view ALL DEPENDS ${Depends})
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/armv7l.patch b/pkgs/development/compilers/llvm/5/compiler-rt/armv7l.patch
deleted file mode 100644
index 77bf2640c47..00000000000
--- a/pkgs/development/compilers/llvm/5/compiler-rt/armv7l.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-diff -ur compiler-rt-5.0.2.src/cmake/builtin-config-ix.cmake compiler-rt-5.0.2.src-patched/cmake/builtin-config-ix.cmake
---- compiler-rt-5.0.2.src/cmake/builtin-config-ix.cmake	2017-05-25 00:53:24.000000000 +0900
-+++ compiler-rt-5.0.2.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:24:24.937433155 +0900
-@@ -24,7 +24,7 @@
- 
- 
- set(ARM64 aarch64)
--set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
-+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
- set(X86 i386 i686)
- set(X86_64 x86_64)
- set(MIPS32 mips mipsel)
-diff -ur compiler-rt-5.0.2.src/lib/builtins/CMakeLists.txt compiler-rt-5.0.2.src-patched/lib/builtins/CMakeLists.txt
---- compiler-rt-5.0.2.src/lib/builtins/CMakeLists.txt	2017-07-13 04:33:30.000000000 +0900
-+++ compiler-rt-5.0.2.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:24:45.945075423 +0900
-@@ -444,6 +444,7 @@
- set(armv7_SOURCES ${arm_SOURCES})
- set(armv7s_SOURCES ${arm_SOURCES})
- set(armv7k_SOURCES ${arm_SOURCES})
-+set(armv7l_SOURCES ${arm_SOURCES})
- set(arm64_SOURCES ${aarch64_SOURCES})
- 
- # macho_embedded archs
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/codesign.patch b/pkgs/development/compilers/llvm/5/compiler-rt/codesign.patch
deleted file mode 100644
index 8f4c76bca1e..00000000000
--- a/pkgs/development/compilers/llvm/5/compiler-rt/codesign.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 19 Sep 2017 13:13:06 -0500
-Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
- needs it
-
----
- cmake/Modules/AddCompilerRT.cmake |  8 ------
- test/asan/CMakeLists.txt          | 52 ---------------------------------------
- test/tsan/CMakeLists.txt          | 47 -----------------------------------
- 3 files changed, 107 deletions(-)
-
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff7..b64eb4246 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
-         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
-         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
-       endif()
--      if(APPLE)
--        # Ad-hoc sign the dylibs
--        add_custom_command(TARGET ${libname}
--          POST_BUILD  
--          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
--          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
--        )
--      endif()
-     endif()
-     install(TARGETS ${libname}
-       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
-diff --git a/test/asan/CMakeLists.txt b/test/asan/CMakeLists.txt
-index 8bfc15b5c..f23d0f71a 100644
---- a/test/asan/CMakeLists.txt
-+++ b/test/asan/CMakeLists.txt
-@@ -83,58 +83,6 @@ foreach(arch ${ASAN_TEST_ARCH})
-   endif()
- endforeach()
- 
--# iOS and iOS simulator test suites
--# These are not added into "check-all", in order to run these tests, use
--# "check-asan-iossim-x86_64" and similar. They also require that an extra env
--# variable to select which iOS device or simulator to use, e.g.:
--# SANITIZER_IOSSIM_TEST_DEVICE_IDENTIFIER="iPhone 6"
--if(APPLE)
--  set(EXCLUDE_FROM_ALL ON)
--
--  set(ASAN_TEST_TARGET_CC ${COMPILER_RT_TEST_COMPILER})
--  set(ASAN_TEST_IOS "1")
--  pythonize_bool(ASAN_TEST_IOS)
--  set(ASAN_TEST_DYNAMIC True)
--
--  foreach(arch ${DARWIN_iossim_ARCHS})
--    set(ASAN_TEST_IOSSIM "1")
--    pythonize_bool(ASAN_TEST_IOSSIM)
--    set(ASAN_TEST_TARGET_ARCH ${arch})
--    set(ASAN_TEST_TARGET_CFLAGS "-arch ${arch} -isysroot ${DARWIN_iossim_SYSROOT} ${COMPILER_RT_TEST_COMPILER_CFLAGS}")
--    set(ASAN_TEST_CONFIG_SUFFIX "-${arch}-iossim")
--    get_bits_for_arch(${arch} ASAN_TEST_BITS)
--    string(TOUPPER ${arch} ARCH_UPPER_CASE)
--    set(CONFIG_NAME "IOSSim${ARCH_UPPER_CASE}Config")
--    configure_lit_site_cfg(
--      ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in
--      ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/lit.site.cfg
--      )
--    add_lit_testsuite(check-asan-iossim-${arch} "AddressSanitizer iOS Simulator ${arch} tests"
--      ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/
--      DEPENDS ${ASAN_TEST_DEPS})
--  endforeach()
--
--  foreach (arch ${DARWIN_ios_ARCHS})
--    set(ASAN_TEST_IOSSIM "0")
--    pythonize_bool(ASAN_TEST_IOSSIM)
--    set(ASAN_TEST_TARGET_ARCH ${arch})
--    set(ASAN_TEST_TARGET_CFLAGS "-arch ${arch} -isysroot ${DARWIN_ios_SYSROOT} ${COMPILER_RT_TEST_COMPILER_CFLAGS}")
--    set(ASAN_TEST_CONFIG_SUFFIX "-${arch}-ios")
--    get_bits_for_arch(${arch} ASAN_TEST_BITS)
--    string(TOUPPER ${arch} ARCH_UPPER_CASE)
--    set(CONFIG_NAME "IOS${ARCH_UPPER_CASE}Config")
--    configure_lit_site_cfg(
--      ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in
--      ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/lit.site.cfg
--      )
--    add_lit_testsuite(check-asan-ios-${arch} "AddressSanitizer iOS ${arch} tests"
--      ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/
--      DEPENDS ${ASAN_TEST_DEPS})
--  endforeach()
--
--  set(EXCLUDE_FROM_ALL OFF)
--endif()
--
- # Add unit tests.
- if(COMPILER_RT_INCLUDE_TESTS)
-   set(ASAN_TEST_DYNAMIC False)
-diff --git a/test/tsan/CMakeLists.txt b/test/tsan/CMakeLists.txt
-index a68908612..cde0accb5 100644
---- a/test/tsan/CMakeLists.txt
-+++ b/test/tsan/CMakeLists.txt
-@@ -42,53 +42,6 @@ foreach(arch ${TSAN_TEST_ARCH})
-   list(APPEND TSAN_TESTSUITES ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME})
- endforeach()
- 
--# iOS and iOS simulator test suites
--# These are not added into "check-all", in order to run these tests, use
--# "check-tsan-iossim-x86_64" and similar. They also require an extra environment
--# variable to select which iOS device or simulator to use, e.g.:
--# SANITIZER_IOSSIM_TEST_DEVICE_IDENTIFIER="iPhone 6"
--if(APPLE)
--  set(EXCLUDE_FROM_ALL ON)
--
--  set(TSAN_TEST_TARGET_CC ${COMPILER_RT_TEST_COMPILER})
--  set(TSAN_TEST_IOS "1")
--  pythonize_bool(TSAN_TEST_IOS)
--
--  set(arch "x86_64")
--  set(TSAN_TEST_IOSSIM "1")
--  pythonize_bool(TSAN_TEST_IOSSIM)
--  set(TSAN_TEST_TARGET_ARCH ${arch})
--  set(TSAN_TEST_TARGET_CFLAGS "-arch ${arch} -isysroot ${DARWIN_iossim_SYSROOT} ${COMPILER_RT_TEST_COMPILER_CFLAGS}")
--  set(TSAN_TEST_CONFIG_SUFFIX "-${arch}-iossim")
--  string(TOUPPER ${arch} ARCH_UPPER_CASE)
--  set(CONFIG_NAME "IOSSim${ARCH_UPPER_CASE}Config")
--  configure_lit_site_cfg(
--    ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in
--    ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/lit.site.cfg
--    )
--  add_lit_testsuite(check-tsan-iossim-${arch} "ThreadSanitizer iOS Simulator ${arch} tests"
--    ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/
--    DEPENDS ${TSAN_TEST_DEPS})
--
--  set(arch "arm64")
--  set(TSAN_TEST_IOSSIM "0")
--  pythonize_bool(TSAN_TEST_IOSSIM)
--  set(TSAN_TEST_TARGET_ARCH ${arch})
--  set(TSAN_TEST_TARGET_CFLAGS "-arch ${arch} -isysroot ${DARWIN_ios_SYSROOT} ${COMPILER_RT_TEST_COMPILER_CFLAGS}")
--  set(TSAN_TEST_CONFIG_SUFFIX "-${arch}-ios")
--  string(TOUPPER ${arch} ARCH_UPPER_CASE)
--  set(CONFIG_NAME "IOS${ARCH_UPPER_CASE}Config")
--  configure_lit_site_cfg(
--    ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in
--    ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/lit.site.cfg
--    )
--  add_lit_testsuite(check-tsan-ios-${arch} "ThreadSanitizer iOS Simulator ${arch} tests"
--    ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/
--    DEPENDS ${TSAN_TEST_DEPS})
--
--  set(EXCLUDE_FROM_ALL OFF)
--endif()
--
- if(COMPILER_RT_INCLUDE_TESTS)
-   configure_lit_site_cfg(
-     ${CMAKE_CURRENT_SOURCE_DIR}/Unit/lit.site.cfg.in
--- 
-2.14.1
-
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/compiler-rt-5-cstddef.patch b/pkgs/development/compilers/llvm/5/compiler-rt/compiler-rt-5-cstddef.patch
deleted file mode 100644
index e7abf9735b9..00000000000
--- a/pkgs/development/compilers/llvm/5/compiler-rt/compiler-rt-5-cstddef.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/lib/xray/xray_buffer_queue.h
-+++ b/lib/xray/xray_buffer_queue.h
-@@ -17,6 +17,7 @@
- 
- #include "sanitizer_common/sanitizer_atomic.h"
- #include "sanitizer_common/sanitizer_mutex.h"
-+#include <cstddef>
- #include <deque>
- #include <unordered_set>
- #include <utility>
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/default.nix b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
deleted file mode 100644
index fede3347e42..00000000000
--- a/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
+++ /dev/null
@@ -1,112 +0,0 @@
-{ lib, stdenv, llvm_meta, version, fetch, cmake, python3, libllvm, libcxxabi
-, doFakeLibgcc ? stdenv.hostPlatform.isFreeBSD
-}:
-
-let
-
-  useLLVM = stdenv.hostPlatform.useLLVM or false;
-  bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
-  inherit (stdenv.hostPlatform) isMusl;
-
-in
-
-stdenv.mkDerivation {
-  pname = "compiler-rt";
-  inherit version;
-  src = fetch "compiler-rt" "0ipd4jdxpczgr2w6lzrabymz6dhzj69ywmyybjjc1q397zgrvziy";
-
-  nativeBuildInputs = [ cmake python3 libllvm.dev ];
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-  ];
-
-  cmakeFlags = [
-    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
-    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
-    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
-    "-DCOMPILER_RT_BUILD_XRAY=OFF"
-    "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
-  ] ++ lib.optionals (useLLVM || bareMetal) [
-    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
-  ] ++ lib.optionals (useLLVM || bareMetal) [
-    "-DCMAKE_C_COMPILER_WORKS=ON"
-    "-DCMAKE_CXX_COMPILER_WORKS=ON"
-    "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
-    "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM) [
-    "-DCOMPILER_RT_BUILD_BUILTINS=ON"
-    "-DCMAKE_C_FLAGS=-nodefaultlibs"
-    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
-    "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
-  ] ++ lib.optionals (bareMetal) [
-    "-DCOMPILER_RT_OS_DIR=baremetal"
-  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-    # The compiler-rt build infrastructure sniffs supported platforms on Darwin
-    # and finds i386;x86_64;x86_64h. We only build for x86_64, so linking fails
-    # when it tries to use libc++ and libc++api for i386.
-    "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
-  ];
-
-  outputs = [ "out" "dev" ];
-
-  patches = [
-    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-    # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
-    ../../common/compiler-rt/glibc.patch
-    ./gnu-install-dirs.patch
-
-    ./sys-ustat.patch
-    ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
-    ./compiler-rt-5-cstddef.patch
-  ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
-
-  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
-  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
-  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
-  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
-  # a flag and turn the flag off during the stdenv build.
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/config-ix.cmake \
-      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
-  '' + lib.optionalString (useLLVM) ''
-    substituteInPlace lib/builtins/int_util.c \
-      --replace "#include <stdlib.h>" ""
-    substituteInPlace lib/builtins/clear_cache.c \
-      --replace "#include <assert.h>" ""
-    substituteInPlace lib/builtins/cpu_model.c \
-      --replace "#include <assert.h>" ""
-  '';
-
-  # Hack around weird upsream RPATH bug
-  postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
-    ln -s "$out/lib"/*/* "$out/lib"
-  '' + lib.optionalString (useLLVM) ''
-    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/linux/crtbegin.o
-    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/linux/crtend.o
-    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/linux/crtbeginS.o
-    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/linux/crtendS.o
-  '' + lib.optionalString doFakeLibgcc ''
-    ln -s $out/lib/freebsd/libclang_rt.builtins-*.a $out/lib/freebsd/libgcc.a
-  '';
-
-  meta = llvm_meta // {
-    homepage = "https://compiler-rt.llvm.org/";
-    description = "Compiler runtime libraries";
-    longDescription = ''
-      The compiler-rt project provides highly tuned implementations of the
-      low-level code generator support routines like "__fixunsdfdi" and other
-      calls generated when a target doesn't have a short sequence of native
-      instructions to implement a core IR operation. It also provides
-      implementations of run-time libraries for dynamic testing tools such as
-      AddressSanitizer, ThreadSanitizer, MemorySanitizer, and DataFlowSanitizer.
-    '';
-    # "All of the code in the compiler-rt project is dual licensed under the MIT
-    # license and the UIUC License (a BSD-like license)":
-    license = with lib.licenses; [ mit ncsa ];
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
-  };
-}
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/5/compiler-rt/gnu-install-dirs.patch
deleted file mode 100644
index 618e597e96d..00000000000
--- a/pkgs/development/compilers/llvm/5/compiler-rt/gnu-install-dirs.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index f997c53410c1..ac079d89b57b 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -12,6 +12,7 @@ cmake_minimum_required(VERSION 3.4.3)
- # Check if compiler-rt is built as a standalone project.
- if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR COMPILER_RT_STANDALONE_BUILD)
-   project(CompilerRT C CXX ASM)
-+  include(GNUInstallDirs)
-   set(COMPILER_RT_STANDALONE_BUILD TRUE)
- endif()
- 
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
-index bc5fb9ff722b..91fb79d1980c 100644
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -344,7 +344,7 @@ macro(add_compiler_rt_resource_file target_name file_name component)
-   add_custom_target(${target_name} DEPENDS ${dst_file})
-   # Install in Clang resource directory.
-   install(FILES ${file_name}
--    DESTINATION ${COMPILER_RT_INSTALL_PATH}
-+    DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_PREFIX}
-     COMPONENT ${component})
-   add_dependencies(${component} ${target_name})
- 
-@@ -361,7 +361,7 @@ macro(add_compiler_rt_script name)
-   add_custom_target(${name} DEPENDS ${dst})
-   install(FILES ${dst}
-     PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
--    DESTINATION ${COMPILER_RT_INSTALL_PATH}/bin)
-+    DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_BINDIR})
- endmacro(add_compiler_rt_script src name)
- 
- # Builds custom version of libc++ and installs it in <prefix>.
-diff --git a/cmake/Modules/CompilerRTDarwinUtils.cmake b/cmake/Modules/CompilerRTDarwinUtils.cmake
-index f646975475bb..75885bf305b8 100644
---- a/cmake/Modules/CompilerRTDarwinUtils.cmake
-+++ b/cmake/Modules/CompilerRTDarwinUtils.cmake
-@@ -391,7 +391,7 @@ macro(darwin_add_embedded_builtin_libraries)
-     set(DARWIN_macho_embedded_LIBRARY_OUTPUT_DIR
-       ${COMPILER_RT_OUTPUT_DIR}/lib/macho_embedded)
-     set(DARWIN_macho_embedded_LIBRARY_INSTALL_DIR
--      ${COMPILER_RT_INSTALL_PATH}/lib/macho_embedded)
-+      ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_LIBDIR}/macho_embedded)
-       
-     set(CFLAGS_armv7 "-target thumbv7-apple-darwin-eabi")
-     set(CFLAGS_i386 "-march=pentium")
-diff --git a/cmake/base-config-ix.cmake b/cmake/base-config-ix.cmake
-index b38c6ca96fac..a4580414cbc8 100644
---- a/cmake/base-config-ix.cmake
-+++ b/cmake/base-config-ix.cmake
-@@ -43,11 +43,11 @@ if (LLVM_TREE_AVAILABLE)
- else()
-     # Take output dir and install path from the user.
-   set(COMPILER_RT_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR} CACHE PATH
--    "Path where built compiler-rt libraries should be stored.")
-+    "Path where built compiler-rt build artifacts should be stored.")
-   set(COMPILER_RT_EXEC_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR}/bin CACHE PATH
-     "Path where built compiler-rt executables should be stored.")
--  set(COMPILER_RT_INSTALL_PATH ${CMAKE_INSTALL_PREFIX} CACHE PATH
--    "Path where built compiler-rt libraries should be installed.")
-+  set(COMPILER_RT_INSTALL_PATH "" CACHE PATH
-+    "Prefix where built compiler-rt artifacts should be installed, comes before CMAKE_INSTALL_PREFIX.")
-   option(COMPILER_RT_INCLUDE_TESTS "Generate and build compiler-rt unit tests." OFF)
-   option(COMPILER_RT_ENABLE_WERROR "Fail and stop if warning is triggered" OFF)
-   # Use a host compiler to compile/link tests.
-@@ -67,9 +67,9 @@ if(NOT DEFINED COMPILER_RT_OS_DIR)
-   string(TOLOWER ${CMAKE_SYSTEM_NAME} COMPILER_RT_OS_DIR)
- endif()
- set(COMPILER_RT_LIBRARY_OUTPUT_DIR
--  ${COMPILER_RT_OUTPUT_DIR}/lib/${COMPILER_RT_OS_DIR})
-+  ${COMPILER_RT_OUTPUT_DIR}/${CMAKE_INSTALL_FULL_LIBDIR}/${COMPILER_RT_OS_DIR})
- set(COMPILER_RT_LIBRARY_INSTALL_DIR
--  ${COMPILER_RT_INSTALL_PATH}/lib/${COMPILER_RT_OS_DIR})
-+  ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_LIBDIR}/${COMPILER_RT_OS_DIR})
- 
- if(APPLE)
-   # On Darwin if /usr/include doesn't exist, the user probably has Xcode but not
-diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
-index ec3bf40b95e6..af119f10ee2b 100644
---- a/include/CMakeLists.txt
-+++ b/include/CMakeLists.txt
-@@ -44,8 +44,8 @@ set_target_properties(compiler-rt-headers PROPERTIES FOLDER "Compiler-RT Misc")
- # Install sanitizer headers.
- install(FILES ${SANITIZER_HEADERS}
-   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
--  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/sanitizer)
-+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/sanitizer)
- # Install xray headers.
- install(FILES ${XRAY_HEADERS}
-   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
--  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/xray)
-+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/xray)
-diff --git a/lib/dfsan/CMakeLists.txt b/lib/dfsan/CMakeLists.txt
-index 2c486bff821b..0ee715da95f8 100644
---- a/lib/dfsan/CMakeLists.txt
-+++ b/lib/dfsan/CMakeLists.txt
-@@ -44,4 +44,4 @@ add_custom_command(OUTPUT ${dfsan_abilist_filename}
-                    DEPENDS done_abilist.txt libc_ubuntu1404_abilist.txt)
- add_dependencies(dfsan dfsan_abilist)
- install(FILES ${dfsan_abilist_filename}
--        DESTINATION ${COMPILER_RT_INSTALL_PATH})
-+        DESTINATION ${COMPILER_RT_INSTALL_PATH}/${CMAKE_INSTALL_PREFIX})
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/sys-ustat.patch b/pkgs/development/compilers/llvm/5/compiler-rt/sys-ustat.patch
deleted file mode 100644
index d9e9a10d860..00000000000
--- a/pkgs/development/compilers/llvm/5/compiler-rt/sys-ustat.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 521935db9de17ad08748fd050137ac83b7734835 Mon Sep 17 00:00:00 2001
-From: Craig Topper <craig.topper@intel.com>
-Date: Thu, 24 May 2018 17:59:47 +0000
-Subject: [PATCH] sanitizer: Use pre-computed size of struct ustat for Linux
-
-<sys/ustat.h> has been removed from glibc 2.28 by:
-
-commit cf2478d53ad7071e84c724a986b56fe17f4f4ca7
-Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-Date: Sun Mar 18 11:28:59 2018 +0800
-
-Deprecate ustat syscall interface
-This patch uses pre-computed size of struct ustat for Linux to fix
-
-https://bugs.llvm.org/show_bug.cgi?id=37418
-
-Patch by H.J. Lu.
-
-Differential Revision: https://reviews.llvm.org/D47281
-
-git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@333213 91177308-0d34-0410-b5e6-96231b3b80d8
----
- .../sanitizer_platform_limits_posix.cc            | 15 +++++++++++++--
- 1 file changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
-index 94b8f3f627..936d818673 100644
---- a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
-+++ b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
-@@ -159,7 +159,6 @@ typedef struct user_fpregs elf_fpregset_t;
- # include <sys/procfs.h>
- #endif
- #include <sys/user.h>
--#include <sys/ustat.h>
- #include <linux/cyclades.h>
- #include <linux/if_eql.h>
- #include <linux/if_plip.h>
-@@ -253,7 +252,19 @@ namespace __sanitizer {
- #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
- 
- #if SANITIZER_LINUX && !SANITIZER_ANDROID
--  unsigned struct_ustat_sz = sizeof(struct ustat);
-+  // Use pre-computed size of struct ustat to avoid <sys/ustat.h> which
-+  // has been removed from glibc 2.28.
-+#if defined(__aarch64__) || defined(__s390x__) || defined (__mips64) \
-+  || defined(__powerpc64__) || defined(__arch64__) || defined(__sparcv9) \
-+  || defined(__x86_64__)
-+#define SIZEOF_STRUCT_USTAT 32
-+#elif defined(__arm__) || defined(__i386__) || defined(__mips__) \
-+  || defined(__powerpc__) || defined(__s390__)
-+#define SIZEOF_STRUCT_USTAT 20
-+#else
-+#error Unknown size of struct ustat
-+#endif
-+  unsigned struct_ustat_sz = SIZEOF_STRUCT_USTAT;
-   unsigned struct_rlimit64_sz = sizeof(struct rlimit64);
-   unsigned struct_statvfs64_sz = sizeof(struct statvfs64);
- #endif // SANITIZER_LINUX && !SANITIZER_ANDROID
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
deleted file mode 100644
index 70f0d2e11bb..00000000000
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ /dev/null
@@ -1,140 +0,0 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake, gccForLibs
-, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith
-, buildLlvmTools # tools, but from the previous stage, for cross
-, targetLlvmLibraries # libraries, but from the next stage, for cross
-, targetLlvm
-}:
-
-let
-  release_version = "5.0.2";
-  version = release_version; # differentiating these is important for rc's
-  targetConfig = stdenv.targetPlatform.config;
-
-  fetch = name: sha256: fetchurl {
-    url = "https://releases.llvm.org/${release_version}/${name}-${version}.src.tar.xz";
-    inherit sha256;
-  };
-
-  clang-tools-extra_src = fetch "clang-tools-extra" "018b3fiwah8f8br5i26qmzh6sjvzchpn358sn8v079m49f2jldm3";
-
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
-
-  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
-    mkExtraBuildCommands = cc: ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-    '';
-
-  in {
-
-    libllvm = callPackage ./llvm {
-      inherit llvm_meta;
-    };
-
-    # `llvm` historically had the binaries.  When choosing an output explicitly,
-    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
-    llvm = tools.libllvm;
-
-    libllvm-polly = callPackage ./llvm {
-      inherit llvm_meta;
-      enablePolly = true;
-    };
-
-    llvm-polly = tools.libllvm-polly.lib // { outputSpecified = false; };
-
-    libclang = callPackage ./clang {
-      inherit clang-tools-extra_src llvm_meta;
-    };
-
-    clang-unwrapped = tools.libclang;
-
-    llvm-manpages = lowPrio (tools.libllvm.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    clang-manpages = lowPrio (tools.libclang.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    # pick clang appropriate for package set we are targeting
-    clang =
-      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
-      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
-      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
-      else tools.libcxxClang;
-
-    libstdcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
-      libcxx = null;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    libcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      extraPackages = [
-        libcxx.cxxabi
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    lld = callPackage ./lld {
-      inherit llvm_meta;
-    };
-
-    lldb = callPackage ./lldb {
-      inherit llvm_meta;
-    };
-  });
-
-  libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
-  in {
-
-    compiler-rt = callPackage ./compiler-rt {
-      inherit llvm_meta;
-    };
-
-    stdenv = overrideCC stdenv buildLlvmTools.clang;
-
-    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
-
-    libcxx = callPackage ./libcxx {
-      inherit llvm_meta;
-    };
-
-    libcxxabi = callPackage ./libcxxabi {
-      inherit llvm_meta;
-    };
-
-    openmp = callPackage ./openmp {
-      inherit llvm_meta targetLlvm;
-    };
-  });
-  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
-
-in { inherit tools libraries release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/5/libcxx/default.nix b/pkgs/development/compilers/llvm/5/libcxx/default.nix
deleted file mode 100644
index 073787e92db..00000000000
--- a/pkgs/development/compilers/llvm/5/libcxx/default.nix
+++ /dev/null
@@ -1,79 +0,0 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, python3, fixDarwinDylibNames, version
-, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
-, libcxxabi, libcxxrt
-}:
-
-assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
-
-stdenv.mkDerivation {
-  pname = "libcxx";
-  inherit version;
-
-  src = fetch "libcxx" "1672aaf95fgy4xsfra8pw24f6r93zwzpan1033hkcm8p2glqipvf";
-
-  postUnpack = ''
-    unpackFile ${libcxxabi.src}
-    export LIBCXXABI_INCLUDE_DIR="$PWD/$(ls -d libcxxabi-${version}*)/include"
-  '';
-
-  outputs = [ "out" "dev" ];
-
-  patches = [
-    ./gnu-install-dirs.patch
-  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-    ../../libcxx-0001-musl-hacks.patch
-  ];
-
-  prePatch = ''
-    substituteInPlace lib/CMakeLists.txt --replace "/usr/lib/libc++" "\''${LIBCXX_LIBCXXABI_LIB_PATH}/libc++"
-  '';
-
-  preConfigure = ''
-    # Get headers from the cxxabi source so we can see private headers not installed by the cxxabi package
-    cmakeFlagsArray=($cmakeFlagsArray -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$LIBCXXABI_INCLUDE_DIR")
-  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
-    patchShebangs utils/cat_files.py
-  '';
-  nativeBuildInputs = [ cmake ]
-    ++ lib.optional stdenv.hostPlatform.isMusl python3
-    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-
-  buildInputs = [ cxxabi ];
-
-  cmakeFlags = [
-    "-DLIBCXX_LIBCPPABI_VERSION=2"
-    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
-  ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1"
-    ++ lib.optional (cxxabi.pname == "libcxxabi") "-DLIBCXX_LIBCXXABI_LIB_PATH=${cxxabi}/lib";
-
-  preInstall = lib.optionalString (stdenv.isDarwin) ''
-    for file in lib/*.dylib; do
-      if [ -L "$file" ]; then continue; fi
-
-      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
-      installName="$out/lib/$baseName"
-      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
-
-      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
-      done
-    done
-  '';
-
-  passthru = {
-    isLLVM = true;
-    inherit cxxabi;
-  };
-
-  meta = llvm_meta // {
-    homepage = "https://libcxx.llvm.org/";
-    description = "C++ standard library";
-    longDescription = ''
-      libc++ is an implementation of the C++ standard library, targeting C++11,
-      C++14 and above.
-    '';
-    # "All of the code in libc++ is dual licensed under the MIT license and the
-    # UIUC License (a BSD-like license)":
-    license = with lib.licenses; [ mit ncsa ];
-  };
-}
diff --git a/pkgs/development/compilers/llvm/5/libcxx/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/5/libcxx/gnu-install-dirs.patch
deleted file mode 100644
index d9ea0dc7dfd..00000000000
--- a/pkgs/development/compilers/llvm/5/libcxx/gnu-install-dirs.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index ca5afba86d19..ed69e4043c3d 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -22,6 +22,8 @@ set(CMAKE_MODULE_PATH
- if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
-   project(libcxx CXX C)
- 
-+  include(GNUInstallDirs)
-+
-   set(PACKAGE_NAME libcxx)
-   set(PACKAGE_VERSION 5.0.0)
-   set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}")
-diff --git a/cmake/Modules/HandleLibCXXABI.cmake b/cmake/Modules/HandleLibCXXABI.cmake
-index b1f6bee8f945..1b455fceed7f 100644
---- a/cmake/Modules/HandleLibCXXABI.cmake
-+++ b/cmake/Modules/HandleLibCXXABI.cmake
-@@ -55,7 +55,7 @@ macro(setup_abi_lib abidefines abilib abifiles abidirs)
-           )
-         if (LIBCXX_INSTALL_HEADERS)
-           install(FILES "${LIBCXX_BINARY_INCLUDE_DIR}/${fpath}"
--            DESTINATION ${LIBCXX_INSTALL_PREFIX}include/c++/v1/${dstdir}
-+            DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1/${dstdir}
-             COMPONENT libcxx
-             PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
-             )
-diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
-index 5a1b2ccdc426..106d3d6c1d3c 100644
---- a/include/CMakeLists.txt
-+++ b/include/CMakeLists.txt
-@@ -20,7 +20,7 @@ endif()
- 
- if (LIBCXX_INSTALL_HEADERS)
-   install(DIRECTORY .
--    DESTINATION ${LIBCXX_INSTALL_PREFIX}include/c++/v1
-+    DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1
-     COMPONENT cxx-headers
-     FILES_MATCHING
-     ${LIBCXX_HEADER_PATTERN}
-@@ -44,7 +44,7 @@ if (LIBCXX_INSTALL_HEADERS)
-     set(generated_config_deps generate_config_header)
-     # Install the generated header as __config.
-     install(FILES ${LIBCXX_BINARY_DIR}/__generated_config
--      DESTINATION ${LIBCXX_INSTALL_PREFIX}include/c++/v1
-+      DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_INCLUDEDIR}/c++/v1
-       PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
-       RENAME __config
-       COMPONENT cxx-headers)
-diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
-index 578651423f3b..277befd631ac 100644
---- a/lib/CMakeLists.txt
-+++ b/lib/CMakeLists.txt
-@@ -355,8 +355,8 @@ if (LIBCXX_INSTALL_LIBRARY)
-     set(experimental_lib cxx_experimental)
-   endif()
-   install(TARGETS ${LIBCXX_TARGETS} ${experimental_lib}
--    LIBRARY DESTINATION ${LIBCXX_INSTALL_PREFIX}lib${LIBCXX_LIBDIR_SUFFIX} COMPONENT cxx
--    ARCHIVE DESTINATION ${LIBCXX_INSTALL_PREFIX}lib${LIBCXX_LIBDIR_SUFFIX} COMPONENT cxx
-+    LIBRARY DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX} COMPONENT cxx
-+    ARCHIVE DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX} COMPONENT cxx
-     )
-   # NOTE: This install command must go after the cxx install command otherwise
-   # it will not be executed after the library symlinks are installed.
-@@ -364,7 +364,7 @@ if (LIBCXX_INSTALL_LIBRARY)
-     # Replace the libc++ filename with $<TARGET_LINKER_FILE:cxx>
-     # after we required CMake 3.0.
-     install(FILES "${LIBCXX_LIBRARY_DIR}/libc++${CMAKE_SHARED_LIBRARY_SUFFIX}"
--      DESTINATION ${LIBCXX_INSTALL_PREFIX}lib${LIBCXX_LIBDIR_SUFFIX}
-+      DESTINATION ${LIBCXX_INSTALL_PREFIX}${CMAKE_INSTALL_LIBDIR}${LIBCXX_LIBDIR_SUFFIX}
-       COMPONENT libcxx)
-   endif()
- endif()
diff --git a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
deleted file mode 100644
index cc2ac1beaf0..00000000000
--- a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ lib, stdenv, llvm_meta, cmake, fetch, libcxx, libunwind, llvm, version }:
-
-stdenv.mkDerivation {
-  pname = "libcxxabi";
-  inherit version;
-
-  src = fetch "libcxxabi" "12lp799rskr4fc2xr64qn4jfkjnfd8b1aymvsxyn4k9ar7r9pgqv";
-
-  outputs = [ "out" "dev" ];
-
-  postUnpack = ''
-    unpackFile ${libcxx.src}
-    unpackFile ${llvm.src}
-    export cmakeFlags="-DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
-  '' + lib.optionalString stdenv.isDarwin ''
-    export TRIPLE=x86_64-apple-darwin
-  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -d $(ls -d libcxx-*) -i ${../../libcxx-0001-musl-hacks.patch}
-  '';
-
-  patches = [
-    ./gnu-install-dirs.patch
-  ];
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optional (!stdenv.isDarwin) libunwind;
-
-  preInstall = lib.optionalString stdenv.isDarwin ''
-    for file in lib/*.dylib; do
-      if [ -L "$file" ]; then continue; fi
-
-      # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
-
-      # this should be done in CMake, but having trouble figuring out
-      # the magic combination of necessary CMake variables
-      # if you fancy a try, take a look at
-      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
-
-      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
-      # libcxxabi to sometimes link against a different version of itself.
-      # Here we simply make that second reference point to ourselves.
-      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
-      done
-    done
-  '';
-
-  postInstall = ''
-    mkdir -p "$dev/include"
-    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
-  '';
-
-  passthru = {
-    libName = "c++abi";
-  };
-
-  meta = llvm_meta // {
-    homepage = "https://libcxxabi.llvm.org/";
-    description = "Provides C++ standard library support";
-    longDescription = ''
-      libc++abi is a new implementation of low level support for a standard C++ library.
-    '';
-    # "All of the code in libc++abi is dual licensed under the MIT license and
-    # the UIUC License (a BSD-like license)":
-    license = with lib.licenses; [ mit ncsa ];
-    maintainers = llvm_meta.maintainers ++ [ lib.maintainers.vlstill ];
-  };
-}
diff --git a/pkgs/development/compilers/llvm/5/libcxxabi/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/5/libcxxabi/gnu-install-dirs.patch
deleted file mode 100644
index 760d7194f7b..00000000000
--- a/pkgs/development/compilers/llvm/5/libcxxabi/gnu-install-dirs.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4db3328deb9c..74b39acfe588 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -20,6 +20,8 @@ set(CMAKE_MODULE_PATH
- if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
-   project(libcxxabi CXX C)
- 
-+  include(GNUInstallDirs)
-+
-   set(PACKAGE_NAME libcxxabi)
-   set(PACKAGE_VERSION 5.0.0)
-   set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}")
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index adcc412880c9..71758665af05 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -174,8 +174,8 @@ endif()
- add_custom_target(cxxabi DEPENDS ${LIBCXXABI_TARGETS})
- 
- install(TARGETS ${LIBCXXABI_TARGETS}
--  LIBRARY DESTINATION ${LIBCXXABI_INSTALL_PREFIX}lib${LIBCXXABI_LIBDIR_SUFFIX} COMPONENT cxxabi
--  ARCHIVE DESTINATION ${LIBCXXABI_INSTALL_PREFIX}lib${LIBCXXABI_LIBDIR_SUFFIX} COMPONENT cxxabi
-+  LIBRARY DESTINATION ${LIBCXXABI_INSTALL_PREFIX}${CMAKE_INSTALL_LIBDIR}${LIBCXXABI_LIBDIR_SUFFIX} COMPONENT cxxabi
-+  ARCHIVE DESTINATION ${LIBCXXABI_INSTALL_PREFIX}${CMAKE_INSTALL_LIBDIR}${LIBCXXABI_LIBDIR_SUFFIX} COMPONENT cxxabi
-   )
- 
- if (NOT CMAKE_CONFIGURATION_TYPES)
diff --git a/pkgs/development/compilers/llvm/5/lld/default.nix b/pkgs/development/compilers/llvm/5/lld/default.nix
deleted file mode 100644
index d3cbede8433..00000000000
--- a/pkgs/development/compilers/llvm/5/lld/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ lib, stdenv, llvm_meta
-, buildLlvmTools
-, fetch
-, cmake
-, libllvm
-, version
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lld";
-  inherit version;
-
-  src = fetch "lld" "1ah75rjly6747jk1zbwca3z0svr9b09ylgxd4x9ns721xir6sia6";
-
-  patches = [
-    ./gnu-install-dirs.patch
-  ];
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ libllvm ];
-
-  cmakeFlags = [
-    "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-  ];
-
-  # Musl's default stack size is too small for lld to be able to link Firefox.
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-Wl,-z,stack-size=2097152";
-
-  outputs = [ "out" "lib" "dev" ];
-
-  meta = llvm_meta // {
-    broken = stdenv.isDarwin;
-    homepage = "https://lld.llvm.org/";
-    description = "The LLVM linker (unwrapped)";
-    longDescription = ''
-      LLD is a linker from the LLVM project that is a drop-in replacement for
-      system linkers and runs much faster than them. It also provides features
-      that are useful for toolchain developers.
-      The linker supports ELF (Unix), PE/COFF (Windows), and Mach-O (macOS)
-      in descending order of completeness. Internally, LLD consists
-      of several different linkers.
-    '';
-  };
-}
diff --git a/pkgs/development/compilers/llvm/5/lld/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/5/lld/gnu-install-dirs.patch
deleted file mode 100644
index ed673870dec..00000000000
--- a/pkgs/development/compilers/llvm/5/lld/gnu-install-dirs.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index e2ab0e35f1ab..f68e23d2a70d 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -6,6 +6,8 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
-   set(CMAKE_INCLUDE_CURRENT_DIR ON)
-   set(LLD_BUILT_STANDALONE TRUE)
- 
-+  include(GNUInstallDirs)
-+
-   find_program(LLVM_CONFIG_PATH "llvm-config" DOC "Path to llvm-config binary")
-   if(NOT LLVM_CONFIG_PATH)
-     message(FATAL_ERROR "llvm-config not found: specify LLVM_CONFIG_PATH")
-@@ -203,7 +205,7 @@ include_directories(BEFORE
- 
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN ".svn" EXCLUDE
-diff --git a/cmake/modules/AddLLD.cmake b/cmake/modules/AddLLD.cmake
-index fd1d44199ca6..2ec1831ed8f6 100644
---- a/cmake/modules/AddLLD.cmake
-+++ b/cmake/modules/AddLLD.cmake
-@@ -20,9 +20,9 @@ macro(add_lld_library name)
-     install(TARGETS ${name}
-       COMPONENT ${name}
-       ${export_to_lldtargets}
--      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
--      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX}
--      RUNTIME DESTINATION bin)
-+      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
-+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
-+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
- 
-     if (${ARG_SHARED} AND NOT CMAKE_CONFIGURATION_TYPES)
-       add_custom_target(install-${name}
-@@ -56,7 +56,7 @@ macro(add_lld_tool name)
- 
-     install(TARGETS ${name}
-       ${export_to_lldtargets}
--      RUNTIME DESTINATION bin
-+      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
-       COMPONENT ${name})
- 
-     if(NOT CMAKE_CONFIGURATION_TYPES)
-@@ -73,5 +73,5 @@ endmacro()
- macro(add_lld_symlink name dest)
-   add_llvm_tool_symlink(${name} ${dest} ALWAYS_GENERATE)
-   # Always generate install targets
--  llvm_install_symlink(${name} ${dest} ALWAYS_GENERATE)
-+  llvm_install_symlink(${name} ${dest} ${CMAKE_INSTALL_FULL_BINDIR} ALWAYS_GENERATE)
- endmacro()
-diff --git a/tools/lld/CMakeLists.txt b/tools/lld/CMakeLists.txt
-index 2df10697ff66..94aa8d092220 100644
---- a/tools/lld/CMakeLists.txt
-+++ b/tools/lld/CMakeLists.txt
-@@ -13,7 +13,7 @@ target_link_libraries(lld
-   )
- 
- install(TARGETS lld
--  RUNTIME DESTINATION bin)
-+  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
- 
- if(NOT LLD_SYMLINKS_TO_CREATE)
-   set(LLD_SYMLINKS_TO_CREATE lld-link ld.lld)
diff --git a/pkgs/development/compilers/llvm/5/lldb/default.nix b/pkgs/development/compilers/llvm/5/lldb/default.nix
deleted file mode 100644
index 6c60a44b3d6..00000000000
--- a/pkgs/development/compilers/llvm/5/lldb/default.nix
+++ /dev/null
@@ -1,88 +0,0 @@
-{ lib, stdenv, llvm_meta
-, fetch
-, fetchpatch
-, cmake
-, zlib
-, ncurses
-, swig
-, which
-, libedit
-, libxml2
-, libllvm
-, libclang
-, python3
-, version
-, darwin
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lldb";
-  inherit version;
-
-  src = fetch "lldb" "05j2a63yzln43852nng8a7y47spzlyr1cvdmgmbxgd29c8r0bfkq";
-
-  patches = [
-    # Fix PythonString::GetString for >=python-3.7
-    (fetchpatch {
-      url = "https://github.com/llvm/llvm-project/commit/5457b426f5e15a29c0acc8af1a476132f8be2a36.patch";
-      sha256 = "1zbx4m0m8kbg0wq6740jcw151vb2pb1p25p401wiq8diqqagkjps";
-      stripLen = 1;
-    })
-    ./gnu-install-dirs.patch
-  ];
-
-  postPatch = ''
-    # Fix up various paths that assume llvm and clang are installed in the same place
-    sed -i 's,".*ClangConfig.cmake","${libclang.dev}/lib/cmake/clang/ClangConfig.cmake",' \
-      cmake/modules/LLDBStandalone.cmake
-    sed -i 's,".*tools/clang/include","${libclang.dev}/include",' \
-      cmake/modules/LLDBStandalone.cmake
-    sed -i 's,"$.LLVM_LIBRARY_DIR.",${libllvm.lib}/lib ${libclang.lib}/lib,' \
-      cmake/modules/LLDBStandalone.cmake
-  '';
-
-  outputs = [ "out" "lib" "dev" ];
-
-  nativeBuildInputs = [
-    cmake python3 which swig
-  ];
-
-  buildInputs = [
-    ncurses zlib libedit libxml2 libllvm
-  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.libobjc
-    darwin.apple_sdk.libs.xpc
-    darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa
-  ];
-
-  CXXFLAGS = "-fno-rtti";
-  hardeningDisable = [ "format" ];
-
-  cmakeFlags = [
-    "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
-    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
-  ] ++ lib.optionals doCheck [
-    "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
-    "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
-  ];
-
-  doCheck = false;
-
-  postInstall = ''
-    mkdir -p $out/share/man/man1
-    cp ../docs/lldb.1 $out/share/man/man1/
-  '';
-
-  meta = llvm_meta // {
-    homepage = "https://lldb.llvm.org/";
-    description = "A next-generation high-performance debugger";
-    longDescription = ''
-      LLDB is a next generation, high-performance debugger. It is built as a set
-      of reusable components which highly leverage existing libraries in the
-      larger LLVM Project, such as the Clang expression parser and LLVM
-      disassembler.
-    '';
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
-  };
-}
diff --git a/pkgs/development/compilers/llvm/5/lldb/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/5/lldb/gnu-install-dirs.patch
deleted file mode 100644
index 5c6193b028f..00000000000
--- a/pkgs/development/compilers/llvm/5/lldb/gnu-install-dirs.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index ada293811b3e..6c2149309f65 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -7,6 +7,8 @@ set(CMAKE_MODULE_PATH
-   "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules"
-   )
- 
-+include(GNUInstallDirs)
-+
- include(LLDBStandalone)
- include(LLDBConfig)
- include(AddLLDB)
-diff --git a/cmake/modules/AddLLDB.cmake b/cmake/modules/AddLLDB.cmake
-index 4c6f1efd673d..179a12b49cce 100644
---- a/cmake/modules/AddLLDB.cmake
-+++ b/cmake/modules/AddLLDB.cmake
-@@ -54,14 +54,14 @@ function(add_lldb_library name)
-         endif()
-         install(TARGETS ${name}
-           COMPONENT ${name}
--          RUNTIME DESTINATION bin
-+          RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
-           LIBRARY DESTINATION ${out_dir}
-           ARCHIVE DESTINATION ${out_dir})
-       else()
-         install(TARGETS ${name}
-           COMPONENT ${name}
--          LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
--          ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
-+          LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
-+          ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
-       endif()
-       if (NOT CMAKE_CONFIGURATION_TYPES)
-         add_custom_target(install-${name}
-@@ -126,7 +126,7 @@ function(add_lldb_executable name)
-   if(ARG_GENERATE_INSTALL AND NOT (ARG_INCLUDE_IN_FRAMEWORK AND LLDB_BUILD_FRAMEWORK ))
-     install(TARGETS ${name}
-           COMPONENT ${name}
--          RUNTIME DESTINATION bin)
-+          RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
-     if (NOT CMAKE_CONFIGURATION_TYPES)
-       add_custom_target(install-${name}
-                         DEPENDS ${name}
-diff --git a/cmake/modules/LLDBConfig.cmake b/cmake/modules/LLDBConfig.cmake
-index 726552675f47..f1f769f34446 100644
---- a/cmake/modules/LLDBConfig.cmake
-+++ b/cmake/modules/LLDBConfig.cmake
-@@ -276,7 +276,7 @@ include_directories(BEFORE
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/
-     COMPONENT lldb_headers
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN ".svn" EXCLUDE
-@@ -286,7 +286,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
- 
-   install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/include/
-     COMPONENT lldb_headers
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN ".svn" EXCLUDE
-diff --git a/tools/intel-mpx/CMakeLists.txt b/tools/intel-mpx/CMakeLists.txt
-index 29ba9a1cacec..30e2f9334b95 100644
---- a/tools/intel-mpx/CMakeLists.txt
-+++ b/tools/intel-mpx/CMakeLists.txt
-@@ -12,4 +12,4 @@ target_link_libraries(lldb-intel-mpxtable
-                       PUBLIC liblldb LLVMSupport)
- 
- install(TARGETS lldb-intel-mpxtable
--  LIBRARY DESTINATION bin)
-+  LIBRARY DESTINATION ${CMAKE_INSTALL_BINDIR})
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
deleted file mode 100644
index 74523490244..00000000000
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ /dev/null
@@ -1,283 +0,0 @@
-{ lib, stdenv, llvm_meta
-, pkgsBuildBuild
-, fetch
-, fetchpatch
-, cmake
-, python3
-, libffi
-, enableGoldPlugin ? libbfd.hasPluginAPI
-, libbfd
-, libxml2
-, ncurses
-, version
-, release_version
-, zlib
-, buildLlvmTools
-, debugVersion ? false
-, enableManpages ? false
-, enableSharedLibraries ? !enableManpages
-, enablePolly ? false
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-
-  # Used when creating a versioned symlinks of libLLVM.dylib
-  versionSuffixes = with lib;
-    let parts = splitVersion release_version; in
-    imap (i: _: concatStringsSep "." (take i parts)) parts;
-in
-
-stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  src = fetch "llvm" "0g1bbj2n6xv4p1n6hh17vj3vpvg56wacipc81dgwga9mg2lys8nm";
-  polly_src = fetch "polly" "1f4i1qsw7ywx25v262p8syz339zcbvfkx295xz26hmqrn944xa6x";
-
-  unpackPhase = ''
-    unpackFile $src
-    mv llvm-${version}* llvm
-    sourceRoot=$PWD/llvm
-  '' + optionalString enablePolly ''
-    unpackFile $polly_src
-    mv polly-* $sourceRoot/tools/polly
-  '';
-
-  outputs = [ "out" "lib" "dev" "python" ];
-
-  nativeBuildInputs = [ cmake python3 ]
-    ++ optional enableManpages python3.pkgs.sphinx;
-
-  buildInputs = [ libxml2 libffi ];
-
-  propagatedBuildInputs = [ ncurses zlib ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://bugzilla.redhat.com/attachment.cgi?id=1389687";
-      name = "llvm-gcc8-type-mismatch.patch";
-      sha256 = "0ga2123aclq3x9w72d0rm0az12m8c1i4r1106vh701hf4cghgbch";
-    })
-    ./fix-gcc9.patch
-    #(fetchpatch {
-    #  name = "llvm-fix-gcc9.patch";
-    #  url = "https://reviews.llvm.org/file/data/zs3ck5ryvc5n672fd2kw/PHID-FILE-byoqefzwmkd7qnlip4v2/file";
-    #  sha256 = "0injj1hqgrbcbihhwp2nbal88jfykad30r54f2cdcx7gws2fcy8i";
-    #  stripLen = 1;
-    #})
-
-    # When cross-compiling we configure llvm-config-native with an approximation
-    # of the flags used for the normal LLVM build. To avoid the need for building
-    # a native libLLVM.so (which would fail) we force llvm-config to be linked
-    # statically against the necessary LLVM components always.
-    ../../llvm-config-link-static.patch
-
-    ./gnu-install-dirs.patch
-
-    # Fix invalid std::string(nullptr) for GCC 12
-    (fetchpatch {
-      name = "nvptx-gcc-12.patch";
-      url = "https://github.com/llvm/llvm-project/commit/99e64623ec9b31def9375753491cc6093c831809.patch";
-      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
-      stripLen = 1;
-    })
-
-    ../../llvm-7-musl.patch
-  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
-
-  postPatch = optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  '' + ''
-    # FileSystem permissions tests fail with various special bits
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "Path.cpp" ""
-    rm unittests/Support/Path.cpp
-
-    # llvm-5 does not support dwarf-5 style info, fails on gcc-11.
-    rm test/tools/llvm-symbolizer/print_context.c
-  '' + optionalString stdenv.isAarch64 ''
-    patch -p0 < ${../../aarch64.patch}
-  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../TLI-musl.patch}
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "add_subdirectory(DynamicLibrary)" ""
-    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-  '' + ''
-    # Tweak tests to ignore namespace part of type to support
-    # gcc-12: https://gcc.gnu.org/PR103598.
-    # The change below mangles strings like:
-    #    CHECK-NEXT: Starting llvm::Function pass manager run.
-    # to:
-    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
-    for f in \
-      test/Other/new-pass-manager.ll \
-      test/Other/new-pm-defaults.ll \
-      test/Other/new-pm-lto-defaults.ll \
-      test/Other/new-pm-thinlto-defaults.ll \
-      test/Other/pass-pipeline-parsing.ll \
-      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
-      test/Transforms/Inline/clear-analyses.ll \
-      ; do
-      echo "PATCH: $f"
-      substituteInPlace $f \
-        --replace 'Starting llvm::' 'Starting {{.*}}' \
-        --replace 'Finished llvm::' 'Finished {{.*}}'
-    done
-  '';
-
-  preConfigure = ''
-    # Workaround for configure flags that need to have spaces
-    cmakeFlagsArray+=(
-      -DLLVM_LIT_ARGS='-svj''${NIX_BUILD_CORES} --no-progress-bar'
-    )
-  '';
-
-  # hacky fix: created binaries need to be run before installation
-  preBuild = ''
-    mkdir -p $out/
-    ln -sv $PWD/lib $out
-  '';
-
-  cmakeBuildType = if debugVersion then "Debug" else "Release";
-
-  cmakeFlags = with stdenv; let
-    # These flags influence llvm-config's BuildVariables.inc in addition to the
-    # general build. We need to make sure these are also passed via
-    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
-    # will return different results from the cross llvm-config.
-    #
-    # Some flags don't need to be repassed because LLVM already does so (like
-    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
-      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
-      "-DLLVM_ENABLE_RTTI=ON"
-    ] ++ optionals enableSharedLibraries [
-      "-DLLVM_LINK_LLVM_DYLIB=ON"
-    ];
-  in flagsForLlvmConfig ++ [
-    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
-    "-DLLVM_ENABLE_FFI=ON"
-
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
-  ]
-  ++ lib.optionals enableManpages [
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ lib.optionals (enableGoldPlugin) [
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ] ++ lib.optionals (isDarwin) [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    (
-      let
-        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
-        nativeBintools = nativeCC.bintools.bintools;
-        nativeToolchainFlags = [
-          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
-          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
-          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
-          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
-          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-        ];
-        # We need to repass the custom GNUInstallDirs values, otherwise CMake
-        # will choose them for us, leading to wrong results in llvm-config-native
-        nativeInstallFlags = [
-          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
-          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
-          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
-        ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
-      + lib.concatStringsSep ";" (lib.concatLists [
-        flagsForLlvmConfig
-        nativeToolchainFlags
-        nativeInstallFlags
-      ])
-    )
-  ];
-
-  postBuild = ''
-    rm -fR $out
-  '';
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
-  '';
-
-  postInstall = ''
-    mkdir -p $python/share
-    mv $out/share/opt-viewer $python/share/opt-viewer
-    moveToOutput "bin/llvm-config*" "$dev"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
-      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
-      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}'"$lib"'")'
-  ''
-  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    ${lib.concatMapStringsSep "\n" (v: ''
-      ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${v}.dylib
-    '') versionSuffixes}
-  ''
-  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
-  '';
-
-  doCheck = stdenv.isLinux && (!stdenv.isi686)
-    && (stdenv.hostPlatform == stdenv.buildPlatform);
-
-  checkTarget = "check-all";
-
-  requiredSystemFeatures = [ "big-parallel" ];
-  meta = llvm_meta // {
-    homepage = "https://llvm.org/";
-    description = "A collection of modular and reusable compiler and toolchain technologies";
-    longDescription = ''
-      The LLVM Project is a collection of modular and reusable compiler and
-      toolchain technologies. Despite its name, LLVM has little to do with
-      traditional virtual machines. The name "LLVM" itself is not an acronym; it
-      is the full name of the project.
-      LLVM began as a research project at the University of Illinois, with the
-      goal of providing a modern, SSA-based compilation strategy capable of
-      supporting both static and dynamic compilation of arbitrary programming
-      languages. Since then, LLVM has grown to be an umbrella project consisting
-      of a number of subprojects, many of which are being used in production by
-      a wide variety of commercial and open source projects as well as being
-      widely used in academic research. Code in the LLVM project is licensed
-      under the "Apache 2.0 License with LLVM exceptions".
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "llvm-manpages";
-
-  buildPhase = ''
-    make docs-llvm-man
-  '';
-
-  propagatedBuildInputs = [];
-
-  installPhase = ''
-    make -C docs install
-  '';
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLVM ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/llvm/5/llvm/fix-gcc9.patch b/pkgs/development/compilers/llvm/5/llvm/fix-gcc9.patch
deleted file mode 100644
index eaf71f1468d..00000000000
--- a/pkgs/development/compilers/llvm/5/llvm/fix-gcc9.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-diff --git a/lib/Target/Mips/MipsFastISel.cpp b/lib/Target/Mips/MipsFastISel.cpp
-index f79cb0e6..c6279046 100644
---- a/lib/Target/Mips/MipsFastISel.cpp
-+++ b/lib/Target/Mips/MipsFastISel.cpp
-@@ -70,6 +70,7 @@
- #include <cassert>
- #include <cstdint>
- #include <new>
-+#include <array>
- 
- #define DEBUG_TYPE "mips-fastisel"
- 
-@@ -1309,13 +1310,13 @@ bool MipsFastISel::fastLowerArguments() {
-     return false;
-   }
- 
--  const ArrayRef<MCPhysReg> GPR32ArgRegs = {Mips::A0, Mips::A1, Mips::A2,
--                                            Mips::A3};
--  const ArrayRef<MCPhysReg> FGR32ArgRegs = {Mips::F12, Mips::F14};
--  const ArrayRef<MCPhysReg> AFGR64ArgRegs = {Mips::D6, Mips::D7};
--  ArrayRef<MCPhysReg>::iterator NextGPR32 = GPR32ArgRegs.begin();
--  ArrayRef<MCPhysReg>::iterator NextFGR32 = FGR32ArgRegs.begin();
--  ArrayRef<MCPhysReg>::iterator NextAFGR64 = AFGR64ArgRegs.begin();
-+   std::array<MCPhysReg, 4> GPR32ArgRegs = {{Mips::A0, Mips::A1, Mips::A2,
-+                                            Mips::A3}};
-+   std::array<MCPhysReg, 2> FGR32ArgRegs = {{Mips::F12, Mips::F14}};
-+   std::array<MCPhysReg, 2> AFGR64ArgRegs = {{Mips::D6, Mips::D7}};
-+   auto NextGPR32 = GPR32ArgRegs.begin();
-+   auto NextFGR32 = FGR32ArgRegs.begin();
-+   auto NextAFGR64 = AFGR64ArgRegs.begin();
- 
-   struct AllocatedReg {
-     const TargetRegisterClass *RC;
diff --git a/pkgs/development/compilers/llvm/5/llvm/gnu-install-dirs-polly.patch b/pkgs/development/compilers/llvm/5/llvm/gnu-install-dirs-polly.patch
deleted file mode 100644
index 40f6fa06036..00000000000
--- a/pkgs/development/compilers/llvm/5/llvm/gnu-install-dirs-polly.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-diff --git a/tools/polly/CMakeLists.txt b/tools/polly/CMakeLists.txt
-index 9ddc0f7ff81d..7ca45f286d47 100644
---- a/tools/polly/CMakeLists.txt
-+++ b/tools/polly/CMakeLists.txt
-@@ -2,7 +2,11 @@
- if (NOT DEFINED LLVM_MAIN_SRC_DIR)
-   project(Polly)
-   cmake_minimum_required(VERSION 3.4.3)
-+endif()
-+
-+include(GNUInstallDirs)
- 
-+if (NOT DEFINED LLVM_MAIN_SRC_DIR)
-   # Where is LLVM installed?
-   find_package(LLVM CONFIG REQUIRED)
-   set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${LLVM_CMAKE_DIR})
-@@ -157,14 +161,14 @@ include_directories(
- 
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN ".svn" EXCLUDE
-     )
- 
-   install(DIRECTORY ${POLLY_BINARY_DIR}/include/
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     FILES_MATCHING
-     PATTERN "*.h"
-     PATTERN "CMakeFiles" EXCLUDE
-diff --git a/tools/polly/cmake/CMakeLists.txt b/tools/polly/cmake/CMakeLists.txt
-index 969292cd6b00..d7aea77bdd20 100644
---- a/tools/polly/cmake/CMakeLists.txt
-+++ b/tools/polly/cmake/CMakeLists.txt
-@@ -79,18 +79,18 @@ file(GENERATE
- 
- # Generate PollyConfig.cmake for the install tree.
- unset(POLLY_EXPORTS)
--set(POLLY_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}")
-+set(POLLY_INSTALL_PREFIX "")
- set(POLLY_CONFIG_LLVM_CMAKE_DIR "${LLVM_BINARY_DIR}/${LLVM_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
--set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}")
-+set(POLLY_CONFIG_CMAKE_DIR "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_PREFIX}/${POLLY_INSTALL_PACKAGE_DIR}")
-+set(POLLY_CONFIG_LIBRARY_DIRS "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
- if (POLLY_BUNDLED_ISL)
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
--    "${POLLY_INSTALL_PREFIX}/include/polly"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_LIBDIR}/polly"
-     )
- else()
-   set(POLLY_CONFIG_INCLUDE_DIRS
--    "${POLLY_INSTALL_PREFIX}/include"
-+    "${POLLY_INSTALL_PREFIX}${CMAKE_INSTALL_FULL_INCLUDEDIR}"
-     ${ISL_INCLUDE_DIRS}
-     )
- endif()
-@@ -100,12 +100,12 @@ endif()
- foreach(tgt IN LISTS POLLY_CONFIG_EXPORTED_TARGETS)
-   get_target_property(tgt_type ${tgt} TYPE)
-   if (tgt_type STREQUAL "EXECUTABLE")
--    set(tgt_prefix "bin/")
-+    set(tgt_prefix "${CMAKE_INSTALL_BINDIR}/")
-   else()
--    set(tgt_prefix "lib/")
-+    set(tgt_prefix "${CMAKE_INSTALL_LIBDIR}/")
-   endif()
- 
--  set(tgt_path "${CMAKE_INSTALL_PREFIX}/${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-+  set(tgt_path "${tgt_prefix}$<TARGET_FILE_NAME:${tgt}>")
-   file(RELATIVE_PATH tgt_path ${POLLY_CONFIG_CMAKE_DIR} ${tgt_path})
- 
-   if (NOT tgt_type STREQUAL "INTERFACE_LIBRARY")
-diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macros.cmake
-index 32bed50bb060..cca5bfff4970 100644
---- a/tools/polly/cmake/polly_macros.cmake
-+++ b/tools/polly/cmake/polly_macros.cmake
-@@ -44,8 +44,8 @@ macro(add_polly_library name)
-   if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY OR ${name} STREQUAL "LLVMPolly")
-     install(TARGETS ${name}
-       EXPORT LLVMExports
--      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
--      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
-+	  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
-+      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
-   endif()
-   set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
- endmacro(add_polly_library)
-diff --git a/tools/polly/lib/External/CMakeLists.txt b/tools/polly/lib/External/CMakeLists.txt
-index 286c04fba287..07905e68f595 100644
---- a/tools/polly/lib/External/CMakeLists.txt
-+++ b/tools/polly/lib/External/CMakeLists.txt
-@@ -268,7 +268,7 @@ if (POLLY_BUNDLED_ISL)
-     install(DIRECTORY
-       ${ISL_SOURCE_DIR}/include/
-       ${ISL_BINARY_DIR}/include/
--      DESTINATION include/polly
-+      DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/polly
-       FILES_MATCHING
-       PATTERN "*.h"
-       PATTERN "CMakeFiles" EXCLUDE
diff --git a/pkgs/development/compilers/llvm/5/llvm/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/5/llvm/gnu-install-dirs.patch
deleted file mode 100644
index 3f6d6acb83f..00000000000
--- a/pkgs/development/compilers/llvm/5/llvm/gnu-install-dirs.patch
+++ /dev/null
@@ -1,386 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index c1e03aed4809..8b8bbb8c403e 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -279,15 +279,21 @@ if (CMAKE_BUILD_TYPE AND
-   message(FATAL_ERROR "Invalid value for CMAKE_BUILD_TYPE: ${CMAKE_BUILD_TYPE}")
- endif()
- 
-+include(GNUInstallDirs)
-+
- set(LLVM_LIBDIR_SUFFIX "" CACHE STRING "Define suffix of library directory name (32/64)" )
- 
--set(LLVM_TOOLS_INSTALL_DIR "bin" CACHE STRING "Path for binary subdirectory (defaults to 'bin')")
-+set(LLVM_TOOLS_INSTALL_DIR "${CMAKE_INSTALL_BINDIR}" CACHE STRING
-+    "Path for binary subdirectory (defaults to 'bin')")
- mark_as_advanced(LLVM_TOOLS_INSTALL_DIR)
- 
- set(LLVM_UTILS_INSTALL_DIR "bin" CACHE STRING
-     "Path to install LLVM utilities (enabled by LLVM_INSTALL_UTILS=ON) (defaults to LLVM_TOOLS_INSTALL_DIR)")
- mark_as_advanced(LLVM_TOOLS_INSTALL_DIR)
- 
-+set(LLVM_INSTALL_CMAKE_DIR "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}/cmake/llvm" CACHE STRING
-+	"Path for CMake subdirectory (defaults to lib/cmake/llvm)" )
-+
- # They are used as destination of target generators.
- set(LLVM_RUNTIME_OUTPUT_INTDIR ${CMAKE_CURRENT_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin)
- set(LLVM_LIBRARY_OUTPUT_INTDIR ${CMAKE_CURRENT_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX})
-@@ -512,9 +518,9 @@ option (LLVM_ENABLE_DOXYGEN "Use doxygen to generate llvm API documentation." OF
- option (LLVM_ENABLE_SPHINX "Use Sphinx to generate llvm documentation." OFF)
- option (LLVM_ENABLE_OCAMLDOC "Build OCaml bindings documentation." ON)
- 
--set(LLVM_INSTALL_DOXYGEN_HTML_DIR "share/doc/llvm/doxygen-html"
-+set(LLVM_INSTALL_DOXYGEN_HTML_DIR "${CMAKE_INSTALL_DOCDIR}/${project}/doxygen-html"
-     CACHE STRING "Doxygen-generated HTML documentation install directory")
--set(LLVM_INSTALL_OCAMLDOC_HTML_DIR "share/doc/llvm/ocaml-html"
-+set(LLVM_INSTALL_OCAMLDOC_HTML_DIR "${CMAKE_INSTALL_DOCDIR}/${project}/ocaml-html"
-     CACHE STRING "OCamldoc-generated HTML documentation install directory")
- 
- option (LLVM_BUILD_EXTERNAL_COMPILER_RT
-@@ -945,7 +951,7 @@ add_subdirectory(cmake/modules)
- 
- if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-   install(DIRECTORY include/llvm include/llvm-c
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     COMPONENT llvm-headers
-     FILES_MATCHING
-     PATTERN "*.def"
-@@ -957,7 +963,7 @@ if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-     )
- 
-   install(DIRECTORY ${LLVM_INCLUDE_DIR}/llvm
--    DESTINATION include
-+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
-     COMPONENT llvm-headers
-     FILES_MATCHING
-     PATTERN "*.def"
-diff --git a/cmake/modules/AddLLVM.cmake b/cmake/modules/AddLLVM.cmake
-index 1c922651b133..d555fd627a4f 100644
---- a/cmake/modules/AddLLVM.cmake
-+++ b/cmake/modules/AddLLVM.cmake
-@@ -589,11 +589,11 @@ macro(add_llvm_library name)
-   else()
-     if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY OR ${name} STREQUAL "LTO" OR
-         (LLVM_LINK_LLVM_DYLIB AND ${name} STREQUAL "LLVM"))
--      set(install_dir lib${LLVM_LIBDIR_SUFFIX})
-+      set(install_dir ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
-       if(ARG_SHARED OR BUILD_SHARED_LIBS)
-         if(WIN32 OR CYGWIN OR MINGW)
-           set(install_type RUNTIME)
--          set(install_dir bin)
-+          set(install_dir ${CMAKE_INSTALL_BINDIR})
-         else()
-           set(install_type LIBRARY)
-         endif()
-@@ -637,9 +637,9 @@ macro(add_llvm_loadable_module name)
-       if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY)
-         if(WIN32 OR CYGWIN)
-           # DLL platform
--          set(dlldir "bin")
-+          set(dlldir "${CMAKE_INSTALL_BINDIR}")
-         else()
--          set(dlldir "lib${LLVM_LIBDIR_SUFFIX}")
-+          set(dlldir "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
-         endif()
- 
-         if(${name} IN_LIST LLVM_DISTRIBUTION_COMPONENTS OR
-@@ -651,7 +651,7 @@ macro(add_llvm_loadable_module name)
-         install(TARGETS ${name}
-                 ${export_to_llvmexports}
-                 LIBRARY DESTINATION ${dlldir}
--                ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
-+                ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
-       endif()
-       set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
-     endif()
-@@ -864,7 +864,7 @@ macro(add_llvm_example name)
-   endif()
-   add_llvm_executable(${name} ${ARGN})
-   if( LLVM_BUILD_EXAMPLES )
--    install(TARGETS ${name} RUNTIME DESTINATION examples)
-+    install(TARGETS ${name} RUNTIME DESTINATION ${CMAKE_INSTALL_DOCDIR}/examples)
-   endif()
-   set_target_properties(${name} PROPERTIES FOLDER "Examples")
- endmacro(add_llvm_example name)
-@@ -1275,7 +1275,7 @@ function(llvm_install_library_symlink name dest type)
-   set(full_name ${CMAKE_${type}_LIBRARY_PREFIX}${name}${CMAKE_${type}_LIBRARY_SUFFIX})
-   set(full_dest ${CMAKE_${type}_LIBRARY_PREFIX}${dest}${CMAKE_${type}_LIBRARY_SUFFIX})
- 
--  set(output_dir lib${LLVM_LIBDIR_SUFFIX})
-+  set(output_dir ${CMAKE_INSTALL_FULL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
-   if(WIN32 AND "${type}" STREQUAL "SHARED")
-     set(output_dir bin)
-   endif()
-@@ -1293,7 +1293,7 @@ function(llvm_install_library_symlink name dest type)
-   endif()
- endfunction()
- 
--function(llvm_install_symlink name dest)
-+function(llvm_install_symlink name dest output_dir)
-   cmake_parse_arguments(ARG "ALWAYS_GENERATE" "COMPONENT" "" ${ARGN})
-   foreach(path ${CMAKE_MODULE_PATH})
-     if(EXISTS ${path}/LLVMInstallSymlink.cmake)
-@@ -1316,7 +1316,7 @@ function(llvm_install_symlink name dest)
-   set(full_dest ${dest}${CMAKE_EXECUTABLE_SUFFIX})
- 
-   install(SCRIPT ${INSTALL_SYMLINK}
--          CODE "install_symlink(${full_name} ${full_dest} ${LLVM_TOOLS_INSTALL_DIR})"
-+          CODE "install_symlink(${full_name} ${full_dest} ${output_dir})"
-           COMPONENT ${component})
- 
-   if (NOT CMAKE_CONFIGURATION_TYPES AND NOT ARG_ALWAYS_GENERATE)
-@@ -1400,7 +1400,8 @@ function(add_llvm_tool_symlink link_name target)
-     endif()
- 
-     if ((TOOL_IS_TOOLCHAIN OR NOT LLVM_INSTALL_TOOLCHAIN_ONLY) AND LLVM_BUILD_TOOLS)
--      llvm_install_symlink(${link_name} ${target})
-+      GNUInstallDirs_get_absolute_install_dir(output_dir LLVM_TOOLS_INSTALL_DIR)
-+      llvm_install_symlink(${link_name} ${target} ${output_dir})
-     endif()
-   endif()
- endfunction()
-@@ -1452,9 +1453,9 @@ function(llvm_setup_rpath name)
- 
-   if (APPLE)
-     set(_install_name_dir INSTALL_NAME_DIR "@rpath")
--    set(_install_rpath "@loader_path/../lib" ${extra_libdir})
-+    set(_install_rpath "@loader_path/../${CMAKE_INSTALL_LIBDIR}" ${extra_libdir})
-   elseif(UNIX)
--    set(_install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
-+    set(_install_rpath "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
-     if(${CMAKE_SYSTEM_NAME} MATCHES "(FreeBSD|DragonFly)")
-       set_property(TARGET ${name} APPEND_STRING PROPERTY
-                    LINK_FLAGS " -Wl,-z,origin ")
-diff --git a/cmake/modules/AddOCaml.cmake b/cmake/modules/AddOCaml.cmake
-index 1d8094cc505f..afdbe6e6d19c 100644
---- a/cmake/modules/AddOCaml.cmake
-+++ b/cmake/modules/AddOCaml.cmake
-@@ -140,9 +140,9 @@ function(add_ocaml_library name)
-   endforeach()
- 
-   if( APPLE )
--    set(ocaml_rpath "@executable_path/../../../lib${LLVM_LIBDIR_SUFFIX}")
-+    set(ocaml_rpath "@executable_path/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
-   elseif( UNIX )
--    set(ocaml_rpath "\\$ORIGIN/../../../lib${LLVM_LIBDIR_SUFFIX}")
-+    set(ocaml_rpath "\\$ORIGIN/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
-   endif()
-   list(APPEND ocaml_flags "-ldopt" "-Wl,-rpath,${ocaml_rpath}")
- 
-diff --git a/cmake/modules/AddSphinxTarget.cmake b/cmake/modules/AddSphinxTarget.cmake
-index 4540c5c36c8e..4cefb17fbd55 100644
---- a/cmake/modules/AddSphinxTarget.cmake
-+++ b/cmake/modules/AddSphinxTarget.cmake
-@@ -73,7 +73,7 @@ function (add_sphinx_target builder project)
- 
-       elseif (builder STREQUAL html)
-         string(TOUPPER "${project}" project_upper)
--        set(${project_upper}_INSTALL_SPHINX_HTML_DIR "share/doc/${project}/html"
-+        set(${project_upper}_INSTALL_SPHINX_HTML_DIR "${CMAKE_INSTALL_DOCDIR}/${project}/html"
-             CACHE STRING "HTML documentation install directory for ${project}")
- 
-         # '/.' indicates: copy the contents of the directory directly into
-diff --git a/cmake/modules/CMakeLists.txt b/cmake/modules/CMakeLists.txt
-index ac4b0b7c0304..21a6a3da8667 100644
---- a/cmake/modules/CMakeLists.txt
-+++ b/cmake/modules/CMakeLists.txt
-@@ -1,4 +1,4 @@
--set(LLVM_INSTALL_PACKAGE_DIR lib${LLVM_LIBDIR_SUFFIX}/cmake/llvm)
-+set(LLVM_INSTALL_PACKAGE_DIR ${LLVM_INSTALL_CMAKE_DIR} CACHE STRING "Path for CMake subdirectory (defaults to 'cmake/llvm')")
- set(llvm_cmake_builddir "${LLVM_BINARY_DIR}/${LLVM_INSTALL_PACKAGE_DIR}")
- 
- # First for users who use an installed LLVM, create the LLVMExports.cmake file.
-@@ -84,11 +84,11 @@ foreach(p ${_count})
-   set(LLVM_CONFIG_CODE "${LLVM_CONFIG_CODE}
- get_filename_component(LLVM_INSTALL_PREFIX \"\${LLVM_INSTALL_PREFIX}\" PATH)")
- endforeach(p)
--set(LLVM_CONFIG_INCLUDE_DIRS "\${LLVM_INSTALL_PREFIX}/include")
--set(LLVM_CONFIG_LIBRARY_DIRS "\${LLVM_INSTALL_PREFIX}/lib\${LLVM_LIBDIR_SUFFIX}")
-+set(LLVM_CONFIG_INCLUDE_DIRS "\${LLVM_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}")
-+set(LLVM_CONFIG_LIBRARY_DIRS "\${LLVM_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}\${LLVM_LIBDIR_SUFFIX}")
- set(LLVM_CONFIG_CMAKE_DIR "\${LLVM_INSTALL_PREFIX}/${LLVM_INSTALL_PACKAGE_DIR}")
- set(LLVM_CONFIG_BINARY_DIR "\${LLVM_INSTALL_PREFIX}")
--set(LLVM_CONFIG_TOOLS_BINARY_DIR "\${LLVM_INSTALL_PREFIX}/bin")
-+set(LLVM_CONFIG_TOOLS_BINARY_DIR "\${LLVM_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}")
- set(LLVM_CONFIG_EXPORTS_FILE "\${LLVM_CMAKE_DIR}/LLVMExports.cmake")
- set(LLVM_CONFIG_EXPORTS "${LLVM_EXPORTS}")
- configure_file(
-diff --git a/cmake/modules/LLVMInstallSymlink.cmake b/cmake/modules/LLVMInstallSymlink.cmake
-index 482697b06baf..af2ac1e6c979 100644
---- a/cmake/modules/LLVMInstallSymlink.cmake
-+++ b/cmake/modules/LLVMInstallSymlink.cmake
-@@ -10,7 +10,7 @@ function(install_symlink name target outdir)
-     set(LINK_OR_COPY copy)
-   endif()
- 
--  set(bindir "${DESTDIR}${CMAKE_INSTALL_PREFIX}/${outdir}/")
-+  set(bindir "${DESTDIR}${outdir}/")
- 
-   message("Creating ${name}")
- 
-diff --git a/docs/CMake.rst b/docs/CMake.rst
-index b6ebf37adc92..34c73d2869e0 100644
---- a/docs/CMake.rst
-+++ b/docs/CMake.rst
-@@ -196,7 +196,7 @@ CMake manual, or execute ``cmake --help-variable VARIABLE_NAME``.
- **LLVM_LIBDIR_SUFFIX**:STRING
-   Extra suffix to append to the directory where libraries are to be
-   installed. On a 64-bit architecture, one could use ``-DLLVM_LIBDIR_SUFFIX=64``
--  to install libraries to ``/usr/lib64``.
-+  to install libraries to ``/usr/lib64``. See also ``CMAKE_INSTALL_LIBDIR``.
- 
- **CMAKE_C_FLAGS**:STRING
-   Extra flags to use when compiling C source files.
-@@ -461,8 +461,8 @@ LLVM-specific variables
- 
- **LLVM_INSTALL_DOXYGEN_HTML_DIR**:STRING
-   The path to install Doxygen-generated HTML documentation to. This path can
--  either be absolute or relative to the CMAKE_INSTALL_PREFIX. Defaults to
--  `share/doc/llvm/doxygen-html`.
-+  either be absolute or relative to the ``CMAKE_INSTALL_PREFIX``. Defaults to
-+  `${CMAKE_INSTALL_DOCDIR}/${project}/doxygen-html`.
- 
- **LLVM_ENABLE_SPHINX**:BOOL
-   If specified, CMake will search for the ``sphinx-build`` executable and will make
-@@ -493,13 +493,33 @@ LLVM-specific variables
- 
- **LLVM_INSTALL_SPHINX_HTML_DIR**:STRING
-   The path to install Sphinx-generated HTML documentation to. This path can
--  either be absolute or relative to the CMAKE_INSTALL_PREFIX. Defaults to
--  `share/doc/llvm/html`.
-+  either be absolute or relative to the ``CMAKE_INSTALL_PREFIX``. Defaults to
-+  `${CMAKE_INSTALL_DOCDIR}/${project}/html`.
- 
- **LLVM_INSTALL_OCAMLDOC_HTML_DIR**:STRING
-   The path to install OCamldoc-generated HTML documentation to. This path can
--  either be absolute or relative to the CMAKE_INSTALL_PREFIX. Defaults to
--  `share/doc/llvm/ocaml-html`.
-+  either be absolute or relative to the ``CMAKE_INSTALL_PREFIX``. Defaults to
-+  `${CMAKE_INSTALL_DOCDIR}/${project}/ocaml-html`.
-+
-+**CMAKE_INSTALL_BINDIR**:STRING
-+  The path to install binary tools, relative to the ``CMAKE_INSTALL_PREFIX``.
-+  Defaults to `bin`.
-+
-+**CMAKE_INSTALL_LIBDIR**:STRING
-+  The path to install libraries, relative to the ``CMAKE_INSTALL_PREFIX``.
-+  Defaults to `lib`.
-+
-+**CMAKE_INSTALL_INCLUDEDIR**:STRING
-+  The path to install header files, relative to the ``CMAKE_INSTALL_PREFIX``.
-+  Defaults to `include`.
-+
-+**CMAKE_INSTALL_DOCDIR**:STRING
-+  The path to install documentation, relative to the ``CMAKE_INSTALL_PREFIX``.
-+  Defaults to `share/doc`.
-+
-+**CMAKE_INSTALL_MANDIR**:STRING
-+  The path to install manpage files, relative to the ``CMAKE_INSTALL_PREFIX``.
-+  Defaults to `share/man`.
- 
- **LLVM_CREATE_XCODE_TOOLCHAIN**:BOOL
-   OS X Only: If enabled CMake will generate a target named
-@@ -651,9 +671,11 @@ the ``cmake`` command or by setting it directly in ``ccmake`` or ``cmake-gui``).
- 
- This file is available in two different locations.
- 
--* ``<INSTALL_PREFIX>/lib/cmake/llvm/LLVMConfig.cmake`` where
--  ``<INSTALL_PREFIX>`` is the install prefix of an installed version of LLVM.
--  On Linux typically this is ``/usr/lib/cmake/llvm/LLVMConfig.cmake``.
-+* ``<LLVM_INSTALL_PACKAGE_DIR>LLVMConfig.cmake`` where
-+  ``<LLVM_INSTALL_PACKAGE_DIR>`` is the location where LLVM CMake modules are
-+  installed as part of an installed version of LLVM. This is typically
-+  ``cmake/llvm/`` within the lib directory. On Linux, this is typically
-+  ``/usr/lib/cmake/llvm/LLVMConfig.cmake``.
- 
- * ``<LLVM_BUILD_ROOT>/lib/cmake/llvm/LLVMConfig.cmake`` where
-   ``<LLVM_BUILD_ROOT>`` is the root of the LLVM build tree. **Note: this is only
-diff --git a/include/llvm/CMakeLists.txt b/include/llvm/CMakeLists.txt
-index 1d5ca3ba92b0..026f5453c1da 100644
---- a/include/llvm/CMakeLists.txt
-+++ b/include/llvm/CMakeLists.txt
-@@ -4,5 +4,5 @@ add_subdirectory(Support)
- # If we're doing an out-of-tree build, copy a module map for generated
- # header files into the build area.
- if (NOT "${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
--  configure_file(module.modulemap.build module.modulemap COPYONLY)
-+  configure_file(module.modulemap.build ${LLVM_INCLUDE_DIR}/module.modulemap COPYONLY)
- endif (NOT "${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
-diff --git a/tools/llvm-config/BuildVariables.inc.in b/tools/llvm-config/BuildVariables.inc.in
-index f201e1f7bff0..4582ed556a02 100644
---- a/tools/llvm-config/BuildVariables.inc.in
-+++ b/tools/llvm-config/BuildVariables.inc.in
-@@ -24,6 +24,10 @@
- #define LLVM_CXXFLAGS "@LLVM_CXXFLAGS@"
- #define LLVM_BUILDMODE "@LLVM_BUILDMODE@"
- #define LLVM_LIBDIR_SUFFIX "@LLVM_LIBDIR_SUFFIX@"
-+#define LLVM_INSTALL_BINDIR "@CMAKE_INSTALL_BINDIR@"
-+#define LLVM_INSTALL_LIBDIR "@CMAKE_INSTALL_LIBDIR@"
-+#define LLVM_INSTALL_INCLUDEDIR "@CMAKE_INSTALL_INCLUDEDIR@"
-+#define LLVM_INSTALL_CMAKEDIR "@LLVM_INSTALL_CMAKE_DIR@"
- #define LLVM_TARGETS_BUILT "@LLVM_TARGETS_BUILT@"
- #define LLVM_SYSTEM_LIBS "@LLVM_SYSTEM_LIBS@"
- #define LLVM_BUILD_SYSTEM "@LLVM_BUILD_SYSTEM@"
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 08b096afb052..2deae0dcfacc 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -332,12 +332,26 @@ int main(int argc, char **argv) {
-         ("-I" + ActiveIncludeDir + " " + "-I" + ActiveObjRoot + "/include");
-   } else {
-     ActivePrefix = CurrentExecPrefix;
--    ActiveIncludeDir = ActivePrefix + "/include";
--    SmallString<256> path(StringRef(LLVM_TOOLS_INSTALL_DIR));
--    sys::fs::make_absolute(ActivePrefix, path);
--    ActiveBinDir = path.str();
--    ActiveLibDir = ActivePrefix + "/lib" + LLVM_LIBDIR_SUFFIX;
--    ActiveCMakeDir = ActiveLibDir + "/cmake/llvm";
-+    {
-+      SmallString<256> path(StringRef(LLVM_INSTALL_INCLUDEDIR));
-+      sys::fs::make_absolute(ActivePrefix, path);
-+      ActiveIncludeDir = std::string(path.str());
-+    }
-+    {
-+      SmallString<256> path(StringRef(LLVM_INSTALL_BINDIR));
-+      sys::fs::make_absolute(ActivePrefix, path);
-+      ActiveBinDir = std::string(path.str());
-+    }
-+    {
-+      SmallString<256> path(StringRef(LLVM_INSTALL_LIBDIR LLVM_LIBDIR_SUFFIX));
-+      sys::fs::make_absolute(ActivePrefix, path);
-+      ActiveLibDir = std::string(path.str());
-+    }
-+    {
-+      SmallString<256> path(StringRef(LLVM_INSTALL_CMAKEDIR));
-+      sys::fs::make_absolute(ActivePrefix, path);
-+      ActiveCMakeDir = std::string(path.str());
-+    }
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-diff --git a/tools/lto/CMakeLists.txt b/tools/lto/CMakeLists.txt
-index 6e913519a809..85641eef721f 100644
---- a/tools/lto/CMakeLists.txt
-+++ b/tools/lto/CMakeLists.txt
-@@ -19,7 +19,7 @@ set(LLVM_EXPORTED_SYMBOL_FILE ${CMAKE_CURRENT_SOURCE_DIR}/lto.exports)
- add_llvm_library(LTO SHARED ${SOURCES} DEPENDS intrinsics_gen)
- 
- install(FILES ${LLVM_MAIN_INCLUDE_DIR}/llvm-c/lto.h
--  DESTINATION include/llvm-c
-+  DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/llvm-c
-   COMPONENT LTO)
- 
- if (APPLE)
-diff --git a/tools/opt-viewer/CMakeLists.txt b/tools/opt-viewer/CMakeLists.txt
-index 19b606933082..27b9f71b3d79 100644
---- a/tools/opt-viewer/CMakeLists.txt
-+++ b/tools/opt-viewer/CMakeLists.txt
-@@ -8,6 +8,6 @@ set (files
- 
- foreach (file ${files})
-   install(PROGRAMS ${file}
--    DESTINATION share/opt-viewer
-+    DESTINATION ${CMAKE_INSTALL_DATADIR}/opt-viewer
-     COMPONENT opt-viewer)
- endforeach (file)
diff --git a/pkgs/development/compilers/llvm/5/openmp/default.nix b/pkgs/development/compilers/llvm/5/openmp/default.nix
deleted file mode 100644
index 900e920173f..00000000000
--- a/pkgs/development/compilers/llvm/5/openmp/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib
-, stdenv
-, llvm_meta
-, fetch
-, cmake
-, llvm
-, targetLlvm
-, perl
-, version
-}:
-
-stdenv.mkDerivation {
-  pname = "openmp";
-  inherit version;
-
-  src = fetch "openmp" "0p2n52676wlq6y9q99n5pivq6pvvda1p994r69fxj206ahn59jir";
-
-  nativeBuildInputs = [ cmake perl ];
-  buildInputs = [
-    (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
-  ];
-
-  meta = llvm_meta // {
-    homepage = "https://openmp.llvm.org/";
-    description = "Support for the OpenMP language";
-    longDescription = ''
-      The OpenMP subproject of LLVM contains the components required to build an
-      executable OpenMP program that are outside the compiler itself.
-      Contains the code for the runtime library against which code compiled by
-      "clang -fopenmp" must be linked before it can run and the library that
-      supports offload to target devices.
-    '';
-    # "All of the code is dual licensed under the MIT license and the UIUC
-    # License (a BSD-like license)":
-    license = with lib.licenses; [ mit ncsa ];
-  };
-}
diff --git a/pkgs/development/coq-modules/ITree/default.nix b/pkgs/development/coq-modules/ITree/default.nix
index df41ab6e161..aee24225021 100644
--- a/pkgs/development/coq-modules/ITree/default.nix
+++ b/pkgs/development/coq-modules/ITree/default.nix
@@ -5,9 +5,10 @@ mkCoqDerivation rec {
   owner = "DeepSpec";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.version [
-    { case = range "8.13" "8.17";  out = "5.1.1"; }
+    { case = range "8.13" "8.18";  out = "5.1.2"; }
     { case = range "8.10" "8.16";  out = "4.0.0"; }
   ] null;
+  release."5.1.2".sha256 = "sha256-uKJIjNXGWl0YS0WH52Rnr9Jz98Eo2k0X0qWB9hUYJMk=";
   release."5.1.1".sha256 = "sha256-VlmPNwaGkdWrH7Z6DGXRosGtjuuQ+FBiGcadN2Hg5pY=";
   release."5.1.0".sha256 = "sha256-ny7Mi1KgWADiFznkNJiRgD7Djc5SUclNgKOmWRxK+eo=";
   release."4.0.0".sha256 = "0h5rhndl8syc24hxq1gch86kj7mpmgr89bxp2hmf28fd7028ijsm";
diff --git a/pkgs/development/coq-modules/coqprime/default.nix b/pkgs/development/coq-modules/coqprime/default.nix
index af2f56475fd..9420d69cb4b 100644
--- a/pkgs/development/coq-modules/coqprime/default.nix
+++ b/pkgs/development/coq-modules/coqprime/default.nix
@@ -6,13 +6,14 @@ mkCoqDerivation {
   owner = "thery";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.14" "8.18"; out = "8.17"; }
+    { case = range "8.14" "8.18"; out = "8.18"; }
     { case = range "8.12" "8.16"; out = "8.15"; }
     { case = range "8.10" "8.11"; out = "8.10"; }
     { case = range "8.8"  "8.9";  out = "8.8"; }
     { case = "8.7";               out = "8.7.2"; }
   ] null;
 
+  release."8.18".sha256  = "sha256-KObBEYerWhIStmq90G3vs9K5LUEOfB2SPxirwLiWQ6E=";
   release."8.17".sha256  = "sha256-D878t/PijVCopRKHYqfwdNvt3arGlI8yxbK/vI6qZUY=";
   release."8.15".sha256  = "sha256:1zr2q52r08na8265019pj9spcz982ivixk6cnzk6l1srn2g328gv";
   release."8.14.1".sha256= "sha256:0dqf87xkzcpg7gglbxjyx68ad84w1w73icxgy3s7d3w563glc2p7";
diff --git a/pkgs/development/coq-modules/dpdgraph/default.nix b/pkgs/development/coq-modules/dpdgraph/default.nix
index 49333b41697..dac3fb2b74d 100644
--- a/pkgs/development/coq-modules/dpdgraph/default.nix
+++ b/pkgs/development/coq-modules/dpdgraph/default.nix
@@ -8,6 +8,7 @@ mkCoqDerivation {
   repo = "coq-dpdgraph";
   inherit version;
   defaultVersion = lib.switch coq.coq-version [
+    { case = "8.18"; out = "1.0+8.18"; }
     { case = "8.17"; out = "1.0+8.17"; }
     { case = "8.16"; out = "1.0+8.16"; }
     { case = "8.15"; out = "1.0+8.15"; }
@@ -19,10 +20,9 @@ mkCoqDerivation {
     { case = "8.9";  out = "0.6.5"; }
     { case = "8.8";  out = "0.6.3"; }
     { case = "8.7";  out = "0.6.2"; }
-    { case = "8.6";  out = "0.6.1"; }
-    { case = "8.5";  out = "0.6"; }
   ] null;
 
+  release."1.0+8.18".sha256 = "sha256-z14MI1VSYzPqmF1PqDXzymXWRMYoTlQAfR/P3Pdf7fI=";
   release."1.0+8.17".sha256 = "sha256-gcvL3vseLKEF9xinT0579jXBBaA5E3rJ5KaU8RfKtm4=";
   release."1.0+8.16".sha256 = "sha256-xy4xcVHaD1OHBdGUzUy3SeZnHtOf1+UIh6YjUYFINm0=";
   release."1.0+8.15".sha256 = "sha256:1pxr0gakcz297y8hhrnssv5j07ccd58pv7rh7qv5g7855pfqrkg7";
diff --git a/pkgs/development/embedded/blisp/default.nix b/pkgs/development/embedded/blisp/default.nix
index 093e0ef195c..027ca82324f 100644
--- a/pkgs/development/embedded/blisp/default.nix
+++ b/pkgs/development/embedded/blisp/default.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-DBLISP_USE_SYSTEM_LIBRARIES=ON"
   ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-error=implicit-function-declaration";
+
   passthru.tests.version = testers.testVersion {
     package = finalAttrs.finalPackage;
     version = "v${finalAttrs.version}";
@@ -42,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.mit;
     mainProgram = "blisp";
     homepage = "https://github.com/pine64/blisp";
+    platforms = platforms.unix;
     maintainers = [ maintainers.bdd ];
   };
 })
diff --git a/pkgs/development/embedded/elf2uf2-rs/default.nix b/pkgs/development/embedded/elf2uf2-rs/default.nix
index d26c0072265..49338184210 100644
--- a/pkgs/development/embedded/elf2uf2-rs/default.nix
+++ b/pkgs/development/embedded/elf2uf2-rs/default.nix
@@ -27,6 +27,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/JoNil/elf2uf2-rs";
     license = with licenses; [ bsd0 ];
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ polygon fortuneteller2k ];
+    maintainers = with maintainers; [ polygon moni ];
   };
 }
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index 0b8af6ba6de..1819b29da46 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -814,14 +814,14 @@ stdenv.mkDerivation ({
 
 # Implicit pointer to integer conversions are errors by default since clang 15.
 # Works around https://gitlab.haskell.org/ghc/ghc/-/issues/23456.
-// lib.optionalAttrs stdenv.cc.isClang {
+// lib.optionalAttrs (stdenv.hasCC && stdenv.cc.isClang) {
   NIX_CFLAGS_COMPILE = "-Wno-error=int-conversion";
 }
 
 # Ensure libc++abi is linked even when clang is invoked as just `clang` or `cc`.
 # Works around https://github.com/NixOS/nixpkgs/issues/166205.
 # This can be dropped once a fix has been committed to cc-wrapper.
-// lib.optionalAttrs (stdenv.cc.isClang && stdenv.cc.libcxx != null) {
+// lib.optionalAttrs (stdenv.hasCC && stdenv.cc.isClang && stdenv.cc.libcxx != null) {
   NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
 }
 )
diff --git a/pkgs/development/interpreters/python/python2/mk-python-derivation.nix b/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
index 1a6f9c784cf..6d51b51b215 100644
--- a/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
@@ -57,7 +57,8 @@
 # Raise an error if two packages are installed with the same name
 # TODO: For cross we probably need a different PYTHONPATH, or not
 # add the runtime deps until after buildPhase.
-, catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform)
+# FIXME: disabled for Python 2 because broken
+, catchConflicts ? false
 
 # Additional arguments to pass to the makeWrapper function, which wraps
 # generated binaries.
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 903a101aa49..3ccbe1e855a 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -15,13 +15,6 @@ let
   config = import ./config.nix { inherit fetchFromSavannah; };
   rubygems = import ./rubygems { inherit stdenv lib fetchurl; };
 
-  openssl3Gem = fetchFromGitHub {
-    owner = "ruby";
-    repo = "openssl";
-    rev = "v3.0.2";
-    hash = "sha256-KhuKRP1JkMJv7CagGRQ0KKGOd5Oh0FP0fbj0VZ4utGo=";
-  };
-
   # Contains the ruby version heuristics
   rubyVersion = import ./ruby-version.nix { inherit lib; };
 
@@ -156,12 +149,6 @@ let
           rm -rf $sourceRoot/{lib,test}/rubygems*
           cp -r ${rubygems}/lib/rubygems* $sourceRoot/lib
           cp -r ${rubygems}/test/rubygems $sourceRoot/test
-        '' + opString (ver.majMin == "3.0" && opensslSupport) ''
-          # Replace the Gem by a OpenSSL3-compatible one.
-          echo "Hotpatching the OpenSSL gem with a 3.x series for OpenSSL 3 support..."
-          cp -vr ${openssl3Gem}/ext/openssl $sourceRoot/ext/
-          cp -vr ${openssl3Gem}/lib/ $sourceRoot/ext/openssl/
-          cp -vr ${openssl3Gem}/{History.md,openssl.gemspec} $sourceRoot/ext/openssl/
         '';
 
         postPatch = ''
@@ -334,11 +321,6 @@ in {
     sha256 = "sha256-wtq2PLyPKgVSYQitQZ76Y6Z+1AdNu8+fwrHKZky0W6A=";
   };
 
-  ruby_3_0 = generic {
-    version = rubyVersion "3" "0" "6" "";
-    sha256 = "sha256-bmy9SQAw15EMD/IO3vq0KU380QRvD49H94tZeYesaD4=";
-  };
-
   ruby_3_1 = generic {
     version = rubyVersion "3" "1" "4" "";
     sha256 = "sha256-o9VYeaDfqx1xQf3xDSKgfb+OXNxEFdob3gYSfVzDx7Y=";
diff --git a/pkgs/development/libraries/audio/zix/default.nix b/pkgs/development/libraries/audio/zix/default.nix
index 7d1bac57472..9f5d8867a15 100644
--- a/pkgs/development/libraries/audio/zix/default.nix
+++ b/pkgs/development/libraries/audio/zix/default.nix
@@ -28,6 +28,13 @@ stdenv.mkDerivation rec {
     "-Ddocs=disabled"
   ];
 
+  env = lib.optionalAttrs stdenv.isDarwin {
+    # Do not fail the build on clang-16/darwin.
+    # TODO: drop the workaround when upstream fixes it in:
+    #   https://gitlab.com/drobilla/zix/-/issues/3
+    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  };
+
   meta = with lib; {
     description = "A lightweight C99 portability and data structure library";
     homepage = "https://gitlab.com/drobilla/zix";
diff --git a/pkgs/development/libraries/librttopo/default.nix b/pkgs/development/libraries/librttopo/default.nix
index 690417c3e73..5d768db366d 100644
--- a/pkgs/development/libraries/librttopo/default.nix
+++ b/pkgs/development/libraries/librttopo/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     description = "RT Topology Library";
     homepage = "https://git.osgeo.org/gitea/rttopo/librttopo";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ dotlambda ];
+    maintainers = with maintainers; teams.geospatial.members ++ [ dotlambda ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libspatialite/default.nix b/pkgs/development/libraries/libspatialite/default.nix
index 372f0c479c8..b8d1fe45e44 100644
--- a/pkgs/development/libraries/libspatialite/default.nix
+++ b/pkgs/development/libraries/libspatialite/default.nix
@@ -64,6 +64,6 @@ stdenv.mkDerivation rec {
     # They allow any of these
     license = with licenses; [ gpl2Plus lgpl21Plus mpl11 ];
     platforms = platforms.unix;
-    maintainers = with maintainers; [ dotlambda ];
+    maintainers = with maintainers; teams.geospatial.members ++ [ dotlambda ];
   };
 }
diff --git a/pkgs/development/libraries/shapelib/default.nix b/pkgs/development/libraries/shapelib/default.nix
index f0afda7a900..fe17da91e58 100644
--- a/pkgs/development/libraries/shapelib/default.nix
+++ b/pkgs/development/libraries/shapelib/default.nix
@@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
     description = "C Library for reading, writing and updating ESRI Shapefiles";
     homepage = "http://shapelib.maptools.org/";
     license = licenses.gpl2;
-    maintainers = [ maintainers.ehmry ];
+    maintainers = with maintainers; teams.geospatial.members ++ [ ehmry ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/cooltt/default.nix b/pkgs/development/ocaml-modules/cooltt/default.nix
index c9e25045426..7cf63e5c0b1 100644
--- a/pkgs/development/ocaml-modules/cooltt/default.nix
+++ b/pkgs/development/ocaml-modules/cooltt/default.nix
@@ -106,6 +106,6 @@ buildDunePackage {
     homepage = "https://github.com/RedPRL/cooltt";
     description = "A cool implementation of normalization by evaluation (nbe) & elaboration for Cartesian cubical type theory";
     license = licenses.asl20;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/development/python-modules/acquire/default.nix b/pkgs/development/python-modules/acquire/default.nix
index 4426f930b0d..87e1ef29307 100644
--- a/pkgs/development/python-modules/acquire/default.nix
+++ b/pkgs/development/python-modules/acquire/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "acquire";
-  version = "3.9";
+  version = "3.10";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "acquire";
     rev = "refs/tags/${version}";
-    hash = "sha256-ppkfnPJEvCImTA0+NjYD8r6SHcx9eBN9GBvo0IZYcjY=";
+    hash = "sha256-8fvVK/mH+pgPaaxNKvKOw1qU0ElWAmNVP6YAqvBTwio=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/bork/default.nix b/pkgs/development/python-modules/bork/default.nix
index 5cd247cf287..2b3b27108d1 100644
--- a/pkgs/development/python-modules/bork/default.nix
+++ b/pkgs/development/python-modules/bork/default.nix
@@ -1,11 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pytestCheckHook
 , pythonOlder
 
 , build
 , coloredlogs
 , packaging
+, pip
 , toml
 , twine
 , wheel
@@ -13,21 +15,22 @@
 
 buildPythonPackage rec {
   pname = "bork";
-  version = "7.0.0";
+  version = "7.0.1";
   pyproject = true;
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "duckinator";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-frwkU2YesYK0RJNz9yqiXj1XeTZ8jg5oClri4hEYokg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-y/p2uuU+QKgJSdJmMt3oebm/zcuatYWTW8Jl79YxA3g=";
   };
 
   propagatedBuildInputs = [
     build
     coloredlogs
     packaging
+    pip
     toml
     twine
     wheel
@@ -39,6 +42,13 @@ buildPythonPackage rec {
     "bork.cli"
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+  pytestFlagsArray = [
+    "-m 'not network'"
+  ];
+
   meta = with lib; {
     description = "Python build and release management tool";
     homepage = "https://github.com/duckinator/bork";
diff --git a/pkgs/development/python-modules/dasbus/default.nix b/pkgs/development/python-modules/dasbus/default.nix
index a7e0b754273..dceb2e74ca8 100644
--- a/pkgs/development/python-modules/dasbus/default.nix
+++ b/pkgs/development/python-modules/dasbus/default.nix
@@ -20,6 +20,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/rhinstaller/dasbus";
     description = "DBus library in Python3";
     license = licenses.lgpl21Only;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/development/python-modules/dissect-fat/default.nix b/pkgs/development/python-modules/dissect-fat/default.nix
index 9fa9457b284..0a22c7b8b7b 100644
--- a/pkgs/development/python-modules/dissect-fat/default.nix
+++ b/pkgs/development/python-modules/dissect-fat/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-fat";
-  version = "3.6";
+  version = "3.7";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.fat";
     rev = "refs/tags/${version}";
-    hash = "sha256-3Zyjo7yoSLtAnC5lOLzjWsqMRoJxsrw2LKjQ2Qy38sg=";
+    hash = "sha256-YfWshytfj4p2MqLpzE3b1/RtrL1/+Xd/5+RNbrH/Jfc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/dissect-hypervisor/default.nix b/pkgs/development/python-modules/dissect-hypervisor/default.nix
index 55ce876fe21..e7f17cb0286 100644
--- a/pkgs/development/python-modules/dissect-hypervisor/default.nix
+++ b/pkgs/development/python-modules/dissect-hypervisor/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-hypervisor";
-  version = "3.9";
+  version = "3.10";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.hypervisor";
     rev = "refs/tags/${version}";
-    hash = "sha256-AcDlyLKrRyt1mhh7nb9Oln/cjVKw8s1g78J8sgE2p2g=";
+    hash = "sha256-Ml5U7yc4iqqilL6Y9qF3VU+pa0AXnYVQjVas90TpG30=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/dissect-regf/default.nix b/pkgs/development/python-modules/dissect-regf/default.nix
index 9671bb33c8a..94881ca3ca4 100644
--- a/pkgs/development/python-modules/dissect-regf/default.nix
+++ b/pkgs/development/python-modules/dissect-regf/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-regf";
-  version = "3.7";
+  version = "3.8";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.regf";
     rev = "refs/tags/${version}";
-    hash = "sha256-WUrND1RnXTeN3WosR+m+yVJLe/imBTx7nmUZrSIc1E0=";
+    hash = "sha256-4tKu7oPkpNcWr2XJvZg94yZZcbTeeXBphPCLoZYzg6U=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/dissect-sql/default.nix b/pkgs/development/python-modules/dissect-sql/default.nix
index c7192854fcf..173170396f7 100644
--- a/pkgs/development/python-modules/dissect-sql/default.nix
+++ b/pkgs/development/python-modules/dissect-sql/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-sql";
-  version = "3.6";
+  version = "3.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.sql";
     rev = "refs/tags/${version}";
-    hash = "sha256-CMUXMSkrutziAIYjUFbLEpsYpCZUiPmV16puXneGeHE=";
+    hash = "sha256-BHwm88IPtfg/bi5veFGnciQeH4s0asVnxiMVsIi8vV8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/flow-record/default.nix b/pkgs/development/python-modules/flow-record/default.nix
index 1562600a231..2c8de577dc2 100644
--- a/pkgs/development/python-modules/flow-record/default.nix
+++ b/pkgs/development/python-modules/flow-record/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "flow-record";
-  version = "3.12";
+  version = "3.13";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "flow.record";
     rev = "refs/tags/${version}";
-    hash = "sha256-b9MCgs3Imo0DHtPyvQuRgYvsLWe8N2Y9TIWdU1E04L8=";
+    hash = "sha256-Yg42nA0dRjHormpmpbOuZYuvBpNz9XEpf84XI2iJpYY=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/glances-api/default.nix b/pkgs/development/python-modules/glances-api/default.nix
index b0f54b53dc6..fc8d2edac2b 100644
--- a/pkgs/development/python-modules/glances-api/default.nix
+++ b/pkgs/development/python-modules/glances-api/default.nix
@@ -11,16 +11,16 @@
 
 buildPythonPackage rec {
   pname = "glances-api";
-  version = "0.4.3";
-  format = "pyproject";
+  version = "0.5.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "python-glances-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-VfiAJuSmzFVgDTThtsTy7/caRmJKZuD5YwHjMspeB0A=";
+    hash = "sha256-DUTZLLWO4xUeUlxHGGVr/MD5uKqRxUf+p0crYsELgzw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hledger-utils/default.nix b/pkgs/development/python-modules/hledger-utils/default.nix
index 92966821d4b..cea6592b42b 100644
--- a/pkgs/development/python-modules/hledger-utils/default.nix
+++ b/pkgs/development/python-modules/hledger-utils/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "hledger-utils";
-  version = "1.13.2";
+  version = "1.14.0";
 
   format = "pyproject";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "nobodyinperson";
     repo = "hledger-utils";
     rev = "refs/tags/v${version}";
-    hash = "sha256-E++gHvXspPodLW2hEESKjg+R5aV39UJpDP8JYQX9iBw=";
+    hash = "sha256-Qu4nUcAGTACmLhwc7fkLxITOyFnUHv85qMhtViFumVs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/iceportal/default.nix b/pkgs/development/python-modules/iceportal/default.nix
index 251f1372789..ffc0335761b 100644
--- a/pkgs/development/python-modules/iceportal/default.nix
+++ b/pkgs/development/python-modules/iceportal/default.nix
@@ -11,8 +11,8 @@
 
 buildPythonPackage rec {
   pname = "iceportal";
-  version = "1.1.1";
-  format = "pyproject";
+  version = "1.1.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "home-assistant-ecosystem";
     repo = "python-iceportal";
     rev = "refs/tags/${version}";
-    hash = "sha256-edG4tF5nYaEOCcbunetYNL9moi9vA75IOkorDuLEx1c=";
+    hash = "sha256-s+jEpxKsa3eIV4a/Ltso51jqZC4jzsvPLTjDFMV9FIA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/llm/001-disable-install-uninstall-commands.patch b/pkgs/development/python-modules/llm/001-disable-install-uninstall-commands.patch
new file mode 100644
index 00000000000..cef7fba1334
--- /dev/null
+++ b/pkgs/development/python-modules/llm/001-disable-install-uninstall-commands.patch
@@ -0,0 +1,34 @@
+diff --git a/llm/cli.py b/llm/cli.py
+index af37feb..18b078a 100644
+--- a/llm/cli.py
++++ b/llm/cli.py
+@@ -1014,18 +1014,7 @@ def templates_path():
+ )
+ def install(packages, upgrade, editable, force_reinstall, no_cache_dir):
+     """Install packages from PyPI into the same environment as LLM"""
+-    args = ["pip", "install"]
+-    if upgrade:
+-        args += ["--upgrade"]
+-    if editable:
+-        args += ["--editable", editable]
+-    if force_reinstall:
+-        args += ["--force-reinstall"]
+-    if no_cache_dir:
+-        args += ["--no-cache-dir"]
+-    args += list(packages)
+-    sys.argv = args
+-    run_module("pip", run_name="__main__")
++    click.echo("Install command has been disabled for Nix. If you want to install extra llm plugins, use llm.withPlugins([]) expression.")
+ 
+ 
+ @cli.command()
+@@ -1033,8 +1022,7 @@ def install(packages, upgrade, editable, force_reinstall, no_cache_dir):
+ @click.option("-y", "--yes", is_flag=True, help="Don't ask for confirmation")
+ def uninstall(packages, yes):
+     """Uninstall Python packages from the LLM environment"""
+-    sys.argv = ["pip", "uninstall"] + list(packages) + (["-y"] if yes else [])
+-    run_module("pip", run_name="__main__")
++    click.echo("Uninstall command has been disabled for Nix. If you want to uninstall extra llm plugins, just remove them from llm.withPlugins([]) list expression.")
+ 
+ 
+ @cli.command()
diff --git a/pkgs/development/python-modules/llm/default.nix b/pkgs/development/python-modules/llm/default.nix
new file mode 100644
index 00000000000..318f6735330
--- /dev/null
+++ b/pkgs/development/python-modules/llm/default.nix
@@ -0,0 +1,107 @@
+{
+  buildPythonApplication,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  makeWrapper,
+  pytestCheckHook,
+  python3,
+  pythonOlder,
+  ruff,
+  setuptools,
+}: let
+  llm = buildPythonPackage rec {
+    pname = "llm";
+    version = "0.12";
+    pyproject = true;
+
+    disabled = pythonOlder "3.8";
+
+    src = fetchFromGitHub {
+      owner = "simonw";
+      repo = pname;
+      rev = "refs/tags/${version}";
+      hash = "sha256-aCqdw2co/cXrBwVY/k/aSLl3C22nlH5LvU2yir1/NnQ=";
+    };
+
+    patches = [
+      ./001-disable-install-uninstall-commands.patch
+    ];
+
+    nativeBuildInputs = [
+      setuptools
+    ];
+
+    propagatedBuildInputs = with python3.pkgs; [
+      click-default-group
+      numpy
+      openai
+      pluggy
+      pydantic
+      python-ulid
+      pyyaml
+      setuptools # for pkg_resources
+      sqlite-migrate
+      sqlite-utils
+    ];
+
+    nativeCheckInputs = with python3.pkgs; [
+      cogapp
+      numpy
+      pytestCheckHook
+      requests-mock
+    ];
+
+    doCheck = true;
+
+    pytestFlagsArray = [
+      "-svv"
+      "tests/"
+    ];
+
+    pythonImportsCheck = [
+      "llm"
+    ];
+
+    passthru = {inherit withPlugins;};
+
+    meta = with lib; {
+      homepage = "https://github.com/simonw/llm";
+      description = "Access large language models from the command-line";
+      changelog = "https://github.com/simonw/llm/releases/tag/${version}";
+      license = licenses.asl20;
+      mainProgram = "llm";
+      maintainers = with maintainers; [aldoborrero];
+    };
+  };
+
+  withPlugins = plugins: buildPythonApplication {
+    inherit (llm) pname version;
+    format = "other";
+
+    disabled = pythonOlder "3.8";
+
+    dontUnpack = true;
+    dontBuild = true;
+    doCheck = false;
+
+    nativeBuildInputs = [
+      makeWrapper
+    ];
+
+    installPhase = ''
+      makeWrapper ${llm}/bin/llm $out/bin/llm \
+        --prefix PYTHONPATH : "${llm}/${python3.sitePackages}:$PYTHONPATH"
+      ln -sfv ${llm}/lib $out/lib
+    '';
+
+    propagatedBuildInputs = llm.propagatedBuildInputs ++ plugins;
+
+    passthru = llm.passthru // {
+      withPlugins = morePlugins: withPlugins (morePlugins ++ plugins);
+    };
+
+    inherit (llm) meta;
+  };
+in
+  llm
diff --git a/pkgs/development/python-modules/opensensemap-api/default.nix b/pkgs/development/python-modules/opensensemap-api/default.nix
index 4cce64c4300..326f7d2aced 100644
--- a/pkgs/development/python-modules/opensensemap-api/default.nix
+++ b/pkgs/development/python-modules/opensensemap-api/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "opensensemap-api";
-  version = "0.3.0";
+  version = "0.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lz2G7vXUadhTFgfHpIq9kHfojf+iytjitFZZ7rgqeO8=";
+    hash = "sha256-UrgQjZYw7TlFvhnaI7wFUpuUYeVKO5hsnx8h1OKfV8w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/owslib/default.nix b/pkgs/development/python-modules/owslib/default.nix
index 26c62b70c0a..5e5e5a07b9c 100644
--- a/pkgs/development/python-modules/owslib/default.nix
+++ b/pkgs/development/python-modules/owslib/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "owslib";
-  version = "0.29.2";
+  version = "0.29.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "geopython";
     repo = "OWSLib";
     rev = "refs/tags/${version}";
-    hash = "sha256-dbL4VdnPszwiDO+UjluuyqeBRMKojTnZPEFKEYiIWS0=";
+    hash = "sha256-yAJXknSsGXcerzaOVSrFO4j5E6B/4/0JfoSxZ+Szmws=";
   };
 
   postPatch = ''
@@ -72,7 +72,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Client for Open Geospatial Consortium web service interface standards";
     homepage = "https://www.osgeo.org/projects/owslib/";
-    changelog = "https://github.com/geopython/OWSLib/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/geopython/OWSLib/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = teams.geospatial.members;
   };
diff --git a/pkgs/development/python-modules/pyproj/default.nix b/pkgs/development/python-modules/pyproj/default.nix
index 0d77ed937cf..576688accc0 100644
--- a/pkgs/development/python-modules/pyproj/default.nix
+++ b/pkgs/development/python-modules/pyproj/default.nix
@@ -100,11 +100,11 @@ buildPythonPackage rec {
     "pyproj.exceptions"
   ];
 
-  meta = {
+  meta = with lib; {
     description = "Python interface to PROJ library";
     homepage = "https://github.com/pyproj4/pyproj";
     changelog = "https://github.com/pyproj4/pyproj/blob/${src.rev}/docs/history.rst";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ lsix dotlambda ];
+    license = licenses.mit;
+    maintainers = with maintainers; teams.geospatial.members ++ [ lsix dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/shapely/default.nix b/pkgs/development/python-modules/shapely/default.nix
index 488e936abb8..7f87ddf6bef 100644
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "shapely";
-  version = "2.0.1";
+  version = "2.0.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Zqaxo+cuzpf8hVNqKBR2+bd5TeLmRsqKRRfi48FEaJM=";
+    hash = "sha256-FxPMBMFxuv/Fslm6hTHFiswqMBcHt/Ah2IoV7QkGSec=";
   };
 
   nativeBuildInputs = [
@@ -44,8 +44,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  # Fix a ModuleNotFoundError. Investigated at:
+  # https://github.com/NixOS/nixpkgs/issues/255262
   preCheck = ''
-    rm -r shapely # prevent import of local shapely
+    cd $out
   '';
 
   disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
diff --git a/pkgs/development/python-modules/sqids/default.nix b/pkgs/development/python-modules/sqids/default.nix
index dc6befc1799..a9d5fe37295 100644
--- a/pkgs/development/python-modules/sqids/default.nix
+++ b/pkgs/development/python-modules/sqids/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "sqids";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-U9nVpRc9PIM1ZO+bcL3RGIfAdlUMf+uFw/SpPTAjdnA=";
+    hash = "sha256-/8P7/vY0kb7ouUCpgGU4g0Xb77BtSeQVt6nkdcogD50=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/towncrier/default.nix b/pkgs/development/python-modules/towncrier/default.nix
index 03b91688343..e90648ec081 100644
--- a/pkgs/development/python-modules/towncrier/default.nix
+++ b/pkgs/development/python-modules/towncrier/default.nix
@@ -1,38 +1,48 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, pythonOlder
 , click
-, click-default-group
+, fetchPypi
+, git # shells out to git
+, hatchling
+, importlib-resources
 , incremental
 , jinja2
 , mock
 , pytestCheckHook
-, toml
+, pythonOlder
+, tomli
 , twisted
-, setuptools
-, git # shells out to git
 }:
 
 buildPythonPackage rec {
   pname = "towncrier";
-  version = "23.6.0";
-  format = "setuptools";
+  version = "23.11.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/Cm9WrRyfI2s++Y29/tdxTuZgFti2hyWshSDYVn/cME=";
+    hash = "sha256-E5N8JH4/iuIKxE2JXPX5amCtRs/cwWcXWVMNeDfZ7l0=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "hatchling ~= 1.17.1" "hatchling"
+  '';
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
   propagatedBuildInputs = [
     click
-    click-default-group
     incremental
     jinja2
-    toml
-    setuptools
+  ] ++ lib.optionals (pythonOlder "3.10") [
+    importlib-resources
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    tomli
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/trainer/default.nix b/pkgs/development/python-modules/trainer/default.nix
index 466d6db8da5..734bc324e26 100644
--- a/pkgs/development/python-modules/trainer/default.nix
+++ b/pkgs/development/python-modules/trainer/default.nix
@@ -4,19 +4,19 @@
 
 , coqpit
 , fsspec
-, torch-bin
+, torch
 , tensorboard
 , protobuf
 , psutil
 
 , pytestCheckHook
 , soundfile
-, torchvision-bin
+, torchvision
 }:
 
 let
   pname = "trainer";
-  version = "0.0.31";
+  version = "0.0.32";
 in
 buildPythonPackage {
   inherit pname version;
@@ -26,7 +26,7 @@ buildPythonPackage {
     owner = "coqui-ai";
     repo = "Trainer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-avZuujeWG/UGkj7fcGB99Fw7KYktJPIDf8oB4wjoiD4=";
+    hash = "sha256-lSfkokPFB09KZBHe/Qkon2gUsA82AK52WNK1bJfzCNc=";
   };
 
   postPatch = ''
@@ -40,7 +40,7 @@ buildPythonPackage {
     psutil
     soundfile
     tensorboard
-    torch-bin
+    torch
   ];
 
   # only one test and that requires training data from the internet
@@ -48,7 +48,7 @@ buildPythonPackage {
 
   nativeCheckInputs = [
     pytestCheckHook
-    torchvision-bin
+    torchvision
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/web-cache/default.nix b/pkgs/development/python-modules/web-cache/default.nix
index 9246b2b571e..dba9d91875c 100644
--- a/pkgs/development/python-modules/web-cache/default.nix
+++ b/pkgs/development/python-modules/web-cache/default.nix
@@ -20,6 +20,6 @@ buildPythonPackage rec {
     description = "Simple Python key-value storage backed up by sqlite3 database";
     homepage = "https://github.com/desbma/web_cache";
     license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index cf7eb3fd612..25e04817643 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.0.37";
+  version = "3.0.38";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-cRc5mBMTh5HCqq5hKfvJmYROs74ZiWjX17cgQv7ub+I=";
+    hash = "sha256-2ObPi+wrxvoVWjASmp0KSPMLFuIGdWNWK4jRrZC9ODE=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/ats-acc/default.nix b/pkgs/development/tools/ats-acc/default.nix
index 5a3cd9c6401..b8eef344f20 100644
--- a/pkgs/development/tools/ats-acc/default.nix
+++ b/pkgs/development/tools/ats-acc/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Pretty-print error messages of the ATS Compiler";
     homepage = "https://github.com/sparverius/ats-acc";
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     license = licenses.unfree; # Upstream has no license
   };
 }
diff --git a/pkgs/development/tools/azcopy/default.nix b/pkgs/development/tools/azcopy/default.nix
index c39dca4e28d..3c60d0e25e2 100644
--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@@ -1,19 +1,23 @@
-{ stdenv, lib, fetchFromGitHub, buildGoModule }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, buildGoModule
+}:
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.20.1";
+  version = "10.21.1";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
-    rev = "v${version}";
-    sha256 = "sha256-pfbSNFKZubgebx90zL5sVva36wXS+0NQvvMxPI8kV3Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-FdiDxWmCRkSOa+6A9XgKeyFGk/ba+BgFm3/ChERkYvk=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-byFroeXRMepN9RYak2++tT9IE8ZbT+0qJAyipHkE5WE=";
+  vendorHash = "sha256-F5YMPwdS2A5FAwuG1gfiAqBKapZ24VIGzJXnwojoDk0=";
 
   doCheck = false;
 
@@ -22,8 +26,10 @@ buildGoModule rec {
   '';
 
   meta = with lib; {
-    maintainers = with maintainers; [ colemickens kashw2 ];
-    license = licenses.mit;
     description = "The new Azure Storage data transfer utility - AzCopy v10";
+    homepage = "https://github.com/Azure/azure-storage-azcopy";
+    changelog = "https://github.com/Azure/azure-storage-azcopy/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ colemickens kashw2 ];
   };
 }
diff --git a/pkgs/development/tools/azure-static-sites-client/versions.json b/pkgs/development/tools/azure-static-sites-client/versions.json
index 88d31f718ef..55c30a12add 100644
--- a/pkgs/development/tools/azure-static-sites-client/versions.json
+++ b/pkgs/development/tools/azure-static-sites-client/versions.json
@@ -1,58 +1,58 @@
 [
   {
     "version": "latest",
-    "buildId": "1.0.024871",
-    "publishDate": "2023-10-24T04:09:23.7109231Z",
+    "buildId": "1.0.024941",
+    "publishDate": "2023-10-31T04:54:50.5527205Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/linux/StaticSitesClient",
-        "sha": "13d1c02e43dec373be04152f7f8e71974f080440cb9480c3ccb4f83c8c6f036a"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/linux/StaticSitesClient",
+        "sha": "bea23499732d615698baf4c9dcafe717fdd4ba8344f2d96740233b0380df79b6"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/windows/StaticSitesClient.exe",
-        "sha": "868f221ea77b13cea8c6c41edbecea53bf5171d42dc9376f34615e544a3874f0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/windows/StaticSitesClient.exe",
+        "sha": "a93aa5ec2a17280f3c9c8252948f8c68050c8852770322758ffa3187b6bce1dd"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/macOS/StaticSitesClient",
-        "sha": "63c9027a7b5e597ae9e0ad8311b31a587bd977ed758555784d08cc3ff35e80a4"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/macOS/StaticSitesClient",
+        "sha": "57ea66c930aafbf4dea82216e51128b3315ec2db3ab385d41e8d912a3adab2c0"
       }
     }
   },
   {
     "version": "stable",
-    "buildId": "1.0.024741",
-    "publishDate": "2023-10-10T20:13:22.904778Z",
+    "buildId": "1.0.024941",
+    "publishDate": "2023-10-31T04:54:50.5527205Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024741/linux/StaticSitesClient",
-        "sha": "0e174b1551a495dbb751240201b8d264f86264c704d66678c189fe4d94f53502"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/linux/StaticSitesClient",
+        "sha": "bea23499732d615698baf4c9dcafe717fdd4ba8344f2d96740233b0380df79b6"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024741/windows/StaticSitesClient.exe",
-        "sha": "cb8d6e7cf83ab7ee394627b088f42de6e63fa77ed5c56eb79a088a1de02163ff"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/windows/StaticSitesClient.exe",
+        "sha": "a93aa5ec2a17280f3c9c8252948f8c68050c8852770322758ffa3187b6bce1dd"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024741/macOS/StaticSitesClient",
-        "sha": "1ef4292cad223972ed820921d29f6b844e18edd732c99c183269e86b150a8224"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024941/macOS/StaticSitesClient",
+        "sha": "57ea66c930aafbf4dea82216e51128b3315ec2db3ab385d41e8d912a3adab2c0"
       }
     }
   },
   {
     "version": "backup",
-    "buildId": "1.0.024671",
-    "publishDate": "2023-10-04T00:20:16.1747762Z",
+    "buildId": "1.0.024871",
+    "publishDate": "2023-10-24T04:09:23.7109231Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024671/linux/StaticSitesClient",
-        "sha": "82b8181bb5ea47e1d449c1c56e622bd350513dd97f27ac4abd25bd139fde92e2"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/linux/StaticSitesClient",
+        "sha": "13d1c02e43dec373be04152f7f8e71974f080440cb9480c3ccb4f83c8c6f036a"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024671/windows/StaticSitesClient.exe",
-        "sha": "a7660746d9dbed8814259547da7f96122d01ae90de6f8aa5ccf7b07b58f59f19"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/windows/StaticSitesClient.exe",
+        "sha": "868f221ea77b13cea8c6c41edbecea53bf5171d42dc9376f34615e544a3874f0"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024671/macOS/StaticSitesClient",
-        "sha": "7584bea04c7d9e685216d4248063226d5a230cc955e560885a48737d1abd385e"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024871/macOS/StaticSitesClient",
+        "sha": "63c9027a7b5e597ae9e0ad8311b31a587bd977ed758555784d08cc3ff35e80a4"
       }
     }
   }
diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index 05b7d61f858..3aa78a18ecd 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.27.1";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3kJPBvw12iyAu9WVIZgyUrsW6XQ0AqpDmDl1E72vyuE=";
+    hash = "sha256-18kXDdkwT0bINpwQ5sG+ic0ZFJS/vBMidzo67/C/fbM=";
   };
 
-  vendorHash = "sha256-ikrpFnn+CTuhttd3gVyoKU3RIBRR/zL8YjvE0tjIH6I=";
+  vendorHash = "sha256-UbXKMeia6j5xARzO8GjRiDn6GGYz7gjEIdP8ylvJGT4=";
 
   subPackages = [
     "cmd/bearer"
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index 62856ffd389..5dfec9c11a8 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.106.1";
+  version = "0.107.1";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-W+3sqWPYpMkbmA8dGEodZy+pZGRBLJdthicBFdkn6oU=";
+    sha256 = "sha256-PaIjeqL32CADE+m6kq7VIDXMBvEEMVW8eSlXiIwNEJ4=";
   };
 
-  vendorHash = "sha256-+cxh3/TQqm6n7hUYhW2B3pdfdtzRuepZmLNSGVPA3H0=";
+  vendorHash = "sha256-OHeoa3SXmDiUROxFiprlq/gfnqMjha6PQ8tlkr7Pd00=";
 
   ldflags = [
     "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${version}"
diff --git a/pkgs/development/tools/fusee-launcher/default.nix b/pkgs/development/tools/fusee-launcher/default.nix
index 08cf6caae3e..117bd0c9450 100644
--- a/pkgs/development/tools/fusee-launcher/default.nix
+++ b/pkgs/development/tools/fusee-launcher/default.nix
@@ -6,6 +6,10 @@
 , makeWrapper
 } :
 
+let
+  arm-embedded-cc = pkgsCross.arm-embedded.buildPackages.gcc;
+in
+
 stdenv.mkDerivation {
   pname = "fusee-launcher";
   version = "unstable-2018-07-14";
@@ -17,6 +21,10 @@ stdenv.mkDerivation {
     sha256 = "1pqkgw5bk0xcz9x7pc1f0r0b9nsc8jnnvcs1315d8ml8mx23fshm";
   };
 
+  makeFlags = [
+    "CROSS_COMPILE=${arm-embedded-cc.targetPrefix}"
+  ];
+
   installPhase = ''
     mkdir -p $out/bin $out/share
     cp fusee-launcher.py $out/bin/fusee-launcher
@@ -28,7 +36,7 @@ stdenv.mkDerivation {
       --prefix PYTHONPATH : "$PYTHONPATH:$(toPythonPath $out)"
   '';
 
-  nativeBuildInputs = [ pkgsCross.arm-embedded.buildPackages.gcc makeWrapper python3Packages.wrapPython ];
+  nativeBuildInputs = [ arm-embedded-cc makeWrapper python3Packages.wrapPython ];
   buildInputs = [ python3 python3Packages.pyusb ];
   pythonPath = with python3Packages; [ pyusb ];
 
diff --git a/pkgs/development/tools/github/bump/default.nix b/pkgs/development/tools/github/bump/default.nix
index 163b4e95496..2ba546699f1 100644
--- a/pkgs/development/tools/github/bump/default.nix
+++ b/pkgs/development/tools/github/bump/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bump";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "mroth";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tgTG/QlDxX1Ns0WpcNjwr/tvsdtgap7RcxX/JuYcxw8=";
+    sha256 = "sha256-DFgNx0H9/hZ+wUdPkEybRCIjnLsmuoYWruYgbDuFRhU=";
   };
 
-  vendorHash = "sha256-ZeKokW6jMiKrXLfnxwEBF+wLuFQufnPUnA/EnuhvrwI=";
+  vendorHash = "sha256-AiXbCS3RXd6KZwIo7qzz3yM28cJloLRR+gdWqEpyims=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ko/default.nix b/pkgs/development/tools/ko/default.nix
index 66a196ab02d..3f9bc4c0b3f 100644
--- a/pkgs/development/tools/ko/default.nix
+++ b/pkgs/development/tools/ko/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "ko";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "ko-build";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-z0VemNdN35p5fA+cenXil7Vonl+ryu1ruKxzWFwMPfI=";
+    hash = "sha256-BEKsa5mzJplcyR65/4T0MizrYxEk8/ON8SDFt8ZxqMU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/language-servers/zls/default.nix b/pkgs/development/tools/language-servers/zls/default.nix
index 9fda43915ca..2188af2a116 100644
--- a/pkgs/development/tools/language-servers/zls/default.nix
+++ b/pkgs/development/tools/language-servers/zls/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/zigtools/zls/releases/tag/${finalAttrs.version}";
     homepage = "https://github.com/zigtools/zls";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ figsoda fortuneteller2k ];
+    maintainers = with lib.maintainers; [ figsoda moni ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/development/tools/misc/complgen/default.nix b/pkgs/development/tools/misc/complgen/default.nix
index 81cf9c120ed..6c0cdb3c5bb 100644
--- a/pkgs/development/tools/misc/complgen/default.nix
+++ b/pkgs/development/tools/misc/complgen/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "complgen";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     rev = "v${version}";
-    hash = "sha256-FetiopX4k58JQP67zTh0ssy1HFJHmi0Op9h9vjH1pLE=";
+    hash = "sha256-B7ydYz9nui3B/IC3obVTiJZvzTD/lCQyf+tREwFJERg=";
   };
 
-  cargoHash = "sha256-2EJuxoed+6LGpxxqkdFxbntilA2SihQScliUFYgjYmU=";
+  cargoHash = "sha256-CXvaGrE4sQlc7K6FVQqGU8EKPfHr8EIV5YFq+VMoBWg=";
 
   meta = with lib; {
     description = "Generate {bash,fish,zsh} completions from a single EBNF-like grammar";
diff --git a/pkgs/development/tools/misc/cvise/default.nix b/pkgs/development/tools/misc/cvise/default.nix
index 56bd85b7721..f65b0386cfd 100644
--- a/pkgs/development/tools/misc/cvise/default.nix
+++ b/pkgs/development/tools/misc/cvise/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonApplication
 , fetchFromGitHub
+, fetchpatch
 , bash
 , cmake
 , colordiff
@@ -29,6 +30,14 @@ buildPythonApplication rec {
   patches = [
     # Refer to unifdef by absolute path.
     ./unifdef.patch
+
+    # Refer to shell via /usr/bin/env:
+    #   https://github.com/marxin/cvise/pull/121
+    (fetchpatch {
+      name = "env-shell.patch";
+      url = "https://github.com/marxin/cvise/commit/6a416eb590be978a2ad25c610974fdde84e88651.patch";
+      hash = "sha256-Kn6+TXP+wJpMs6jrgsa9OwjXf6vmIgGzny8jg3dfKWA=";
+    })
   ];
 
   postPatch = ''
@@ -37,10 +46,6 @@ buildPythonApplication rec {
     substituteInPlace CMakeLists.txt \
       --replace " -Werror " " "
 
-    # 'cvise --command=...' generates a script with hardcoded shebang.
-    substituteInPlace cvise.py \
-      --replace "#!/bin/bash" "#!${bash}/bin/bash"
-
     substituteInPlace cvise/utils/testing.py \
       --replace "'colordiff --version'" "'${colordiff}/bin/colordiff --version'" \
       --replace "'colordiff'" "'${colordiff}/bin/colordiff'"
diff --git a/pkgs/development/tools/misc/hydra/crypt-passphrase-argon2-fix-output-len.patch b/pkgs/development/tools/misc/hydra/crypt-passphrase-argon2-fix-output-len.patch
deleted file mode 100644
index 0c8e6ae434d..00000000000
--- a/pkgs/development/tools/misc/hydra/crypt-passphrase-argon2-fix-output-len.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 6a5fb9efaea35ca29836371307f5083576f421ab Mon Sep 17 00:00:00 2001
-From: Stig Palmquist <git@stig.io>
-Date: Fri, 20 Oct 2023 00:09:28 +0200
-Subject: [PATCH] Set output length of C::P::Argon2 hashes to 16
-
-Since the default lengths in Crypt::Passphrase::Argon2 changed from 16
-to 32 in in 0.009, some tests that expected the passphrase to be
-unchanged started failing.
----
- src/lib/Hydra/Schema/Result/Users.pm | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/lib/Hydra/Schema/Result/Users.pm b/src/lib/Hydra/Schema/Result/Users.pm
-index b3de6543..c28ae931 100644
---- a/src/lib/Hydra/Schema/Result/Users.pm
-+++ b/src/lib/Hydra/Schema/Result/Users.pm
-@@ -216,7 +216,7 @@ sub json_hint {
- 
- sub _authenticator() {
-     my $authenticator = Crypt::Passphrase->new(
--        encoder    => 'Argon2',
-+        encoder    => { module => 'Argon2', output_size => 16 },
-         validators => [
-             (sub {
-                 my ($password, $hash) = @_;
--- 
-2.42.0
-
diff --git a/pkgs/development/tools/misc/hydra/unstable.nix b/pkgs/development/tools/misc/hydra/unstable.nix
index 26102f36daf..02774ac4105 100644
--- a/pkgs/development/tools/misc/hydra/unstable.nix
+++ b/pkgs/development/tools/misc/hydra/unstable.nix
@@ -205,10 +205,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  patches = [
-    ./crypt-passphrase-argon2-fix-output-len.patch
-  ];
-
   postPatch = ''
     # Change 5s timeout for init to 30s
     substituteInPlace t/lib/HydraTestContext.pm \
diff --git a/pkgs/development/tools/misc/sccache/default.nix b/pkgs/development/tools/misc/sccache/default.nix
index 138765bb228..47ae36c77ea 100644
--- a/pkgs/development/tools/misc/sccache/default.nix
+++ b/pkgs/development/tools/misc/sccache/default.nix
@@ -1,17 +1,17 @@
 { lib, fetchFromGitHub, rustPlatform, pkg-config, openssl, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.6.0";
+  version = "0.7.2";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${version}";
-    sha256 = "sha256-/H4QhkWsvq6UvrxuNhRPwlUi/spSYB78h8yUvdCJ2Ws=";
+    sha256 = "sha256-hup9FM2KEBXRx6NleDGR01C0whJgR1KYyIrcIv2UE80=";
   };
 
-  cargoSha256 = "sha256-wFkVGKa00WQjk59KSBdOJ9Zfj8MwzC4XOhT9p4yvJM0=";
+  cargoSha256 = "sha256-Od1uaKZVAZaIDrsNheR1kYIjnmpnThlU7k3EIKdOjzM=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
diff --git a/pkgs/development/tools/rust/cargo-leptos/Cargo.lock b/pkgs/development/tools/rust/cargo-leptos/Cargo.lock
index 1849049179b..7e0abac242a 100644
--- a/pkgs/development/tools/rust/cargo-leptos/Cargo.lock
+++ b/pkgs/development/tools/rust/cargo-leptos/Cargo.lock
@@ -389,7 +389,7 @@ dependencies = [
 
 [[package]]
 name = "cargo-leptos"
-version = "0.2.1"
+version = "0.2.2"
 dependencies = [
  "ansi_term",
  "anyhow",
diff --git a/pkgs/development/tools/rust/cargo-leptos/default.nix b/pkgs/development/tools/rust/cargo-leptos/default.nix
index ed40ca12569..a1e1ca03071 100644
--- a/pkgs/development/tools/rust/cargo-leptos/default.nix
+++ b/pkgs/development/tools/rust/cargo-leptos/default.nix
@@ -20,8 +20,8 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "leptos-rs";
     repo = pname;
-    rev = "${version}";
-    hash = "sha256-i2nKtQC63BbZsrYvg+HkdqQfK59f0LzZ9dfmFBaqn14=";
+    rev = "e98b478b0c82af1469151eff30f4246b9af4a539";
+    hash = "sha256-7o/yQanBBSA+MmMiGCYSjar4hZ8TRZoPiUniF5ELzXU=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index f0f8a345455..01496458182 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.11";
+  version = "1.0.12";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-yZp/AFlOVRtZ60865utrtVv0zlerwFMhpqBh26WnfL8=";
+        hash = "sha256-tGQQEEPBrMx3AuIsJbN0i/xoa7HSf4rNrE6km3NWjHQ=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-/9MKD2iRogrOIiKlCCPUX5KoDD0rM7K8+jVLx9xxs5s=";
+        hash = "sha256-xMmNBK0t+e/BLXnE3wOxbANXlwpQ/rczTK/7E80T6cw=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-9wE3GL+EGvPHtVgfMx09Jn+WU/VoUf5x/QrrdlhePa8=";
+        hash = "sha256-/3qLt3duJt0x0aI7xwWIEt8kAzLqSAlwC3C539vZ/aI=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-pT9+GchNC3vmeFgTF0GzzyLzWBrCQcR/DFRVK2CnHCw=";
+        hash = "sha256-+EWt1/YtGzJm/lRBPrf1RM5xdMVFMWurRNBQACALcSA=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/development/web/mailcatcher/default.nix b/pkgs/development/web/mailcatcher/default.nix
index df6ed0a5233..17d25378d8c 100644
--- a/pkgs/development/web/mailcatcher/default.nix
+++ b/pkgs/development/web/mailcatcher/default.nix
@@ -1,10 +1,10 @@
-{ pkgs, lib, bundlerApp, bundlerUpdateScript }:
+{ ruby_3_2, lib, bundlerApp, bundlerUpdateScript }:
 
 bundlerApp {
   pname = "mailcatcher";
   gemdir = ./.;
   exes = [ "mailcatcher" "catchmail" ];
-  ruby = pkgs.ruby_3_0;
+  ruby = ruby_3_2;
 
   passthru.updateScript = bundlerUpdateScript "mailcatcher";
 
diff --git a/pkgs/games/scummvm/default.nix b/pkgs/games/scummvm/default.nix
index 85ef0766b8e..923b69d31cf 100644
--- a/pkgs/games/scummvm/default.nix
+++ b/pkgs/games/scummvm/default.nix
@@ -17,11 +17,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ nasm ];
 
   buildInputs = lib.optionals stdenv.isLinux [
-    alsa-lib
+    alsa-lib libGLU libGL
   ] ++ lib.optionals stdenv.isDarwin [
     Cocoa AudioToolbox Carbon CoreMIDI AudioUnit
   ] ++ [
-    curl freetype flac fluidsynth libjpeg libmad libmpeg2 libogg libtheora libvorbis libGLU libGL SDL2 zlib
+    curl freetype flac fluidsynth libjpeg libmad libmpeg2 libogg libtheora libvorbis SDL2 zlib
   ];
 
   dontDisableStatic = true;
diff --git a/pkgs/misc/fastly/default.nix b/pkgs/misc/fastly/default.nix
index fe6c5a21ceb..ca191319243 100644
--- a/pkgs/misc/fastly/default.nix
+++ b/pkgs/misc/fastly/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "fastly";
-  version = "10.6.2";
+  version = "10.6.4";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-j4dqLV1Q17RQczkTqGTh8S8Y6ELqXjWuJRr+xB/x2yE=";
+    hash = "sha256-+qBeE7t+d1Es63hUBO9Bcqyc0vtatcJGoYw2GE0JPxQ=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
@@ -33,7 +33,7 @@ buildGoModule rec {
     "cmd/fastly"
   ];
 
-  vendorHash = "sha256-aCekNpf6C5fGIEk0pLkz4hJ6mQfBIzeCsIL6Fxf2QGk=";
+  vendorHash = "sha256-Mh737emdQkIoNOAkaTafCoMQnLqXIGMKX6X5ClsmMzc=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/misc/i3a/default.nix b/pkgs/misc/i3a/default.nix
index 5bfc2c5c4a3..42d8c11915c 100644
--- a/pkgs/misc/i3a/default.nix
+++ b/pkgs/misc/i3a/default.nix
@@ -24,6 +24,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://git.goral.net.pl/mgoral/i3a";
     description = "A set of scripts used for automation of i3 and sway window manager layouts";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/os-specific/linux/cryptodev/default.nix b/pkgs/os-specific/linux/cryptodev/default.nix
index 296e4b79b3e..cacef99afd7 100644
--- a/pkgs/os-specific/linux/cryptodev/default.nix
+++ b/pkgs/os-specific/linux/cryptodev/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Device that allows access to Linux kernel cryptographic drivers";
     homepage = "http://cryptodev-linux.org/";
-    maintainers = with lib.maintainers; [ fortuneteller2k ];
+    maintainers = with lib.maintainers; [ moni ];
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix
index 585c1661b8a..df197715013 100644
--- a/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/pkgs/os-specific/linux/irqbalance/default.nix
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     description = "A daemon to help balance the cpu load generated by interrupts across all of a systems cpus";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 691b4899f2d..4f967734d5e 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -44,7 +44,7 @@ let
 
     extraMeta = {
       branch = lib.versions.majorMinor version;
-      maintainers = with lib.maintainers; [ fortuneteller2k lovesegfault atemu shawn8901 zzzsy ];
+      maintainers = with lib.maintainers; [ moni lovesegfault atemu shawn8901 zzzsy ];
       description = "Built with custom settings and new features built to provide a stable, responsive and smooth desktop experience";
       broken = stdenv.isAarch64;
     };
diff --git a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
index a4fc11c8647..50793167a34 100644
--- a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
     description = "RealTek RTL8188eus WiFi driver with monitor mode & frame injection support";
     homepage = "https://github.com/aircrack-ng/rtl8188eus";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     broken = (lib.versionAtLeast kernel.version "6.6") || ((lib.versions.majorMinor kernel.version) == "5.4" && kernel.isHardened);
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index 9646886a6de..adc197a1166 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -44,6 +44,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/morrownr/8812au-20210629";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 2c1b4fbb4f4..e17fda67218 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     description = "A kernel module to create V4L2 loopback devices";
     homepage = "https://github.com/umlaeute/v4l2loopback";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     platforms = platforms.linux;
     outputsToInstall = [ "out" ];
   };
diff --git a/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index 7b7687bc306..614831c057d 100644
--- a/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    maintainers = with maintainers; [ goibhniu fortuneteller2k ];
+    maintainers = with maintainers; [ goibhniu moni ];
     description = "Wacom digitizer driver for X11";
     homepage = "https://linuxwacom.sourceforge.net";
     license = licenses.gpl2Only;
diff --git a/pkgs/servers/bloat/default.nix b/pkgs/servers/bloat/default.nix
index 4a28c4377ff..bd4ae38efaa 100644
--- a/pkgs/servers/bloat/default.nix
+++ b/pkgs/servers/bloat/default.nix
@@ -6,12 +6,12 @@
 
 buildGoModule {
   pname = "bloat";
-  version = "unstable-2023-10-15";
+  version = "unstable-2023-10-25";
 
   src = fetchgit {
     url = "git://git.freesoftwareextremist.com/bloat";
-    rev = "67b13c71baea56eeb15532ca1b1377f6da8d18ac";
-    hash = "sha256-h885uAuVjpVsp5cAAX9pIxfydcBiajBX3ZSmQUr3/4Q=";
+    rev = "f4881e72675e87a9eae716436c3ac18a788d596d";
+    hash = "sha256-i6HjhGPPXKtQ7hVPECk9gZglFmjb/Fo9pFIq5ikw4Y8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/servers/dendrite/default.nix b/pkgs/servers/dendrite/default.nix
index d722f6beb0a..4dfe4b33318 100644
--- a/pkgs/servers/dendrite/default.nix
+++ b/pkgs/servers/dendrite/default.nix
@@ -1,5 +1,12 @@
-{ lib, buildGoModule, fetchFromGitHub, nix-update-script
-, nixosTests, postgresql, postgresqlTestHook }:
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+, nix-update-script
+, nixosTests
+, postgresql
+, postgresqlTestHook
+}:
 
 buildGoModule rec {
   pname = "matrix-dendrite";
@@ -44,6 +51,9 @@ buildGoModule rec {
     rm roomserver/internal/input/input_test.go
   '';
 
+  # PostgreSQL's request for a shared memory segment exceeded your kernel's SHMALL parameter
+  doCheck = !(stdenv.isDarwin && stdenv.isx86_64);
+
   passthru.tests = {
     inherit (nixosTests) dendrite;
   };
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index 5d1da4c4706..6f75352796c 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -5,7 +5,6 @@
 , withPHP82 ? false, php82
 , withPerl536 ? false, perl536
 , withPerl538 ? true, perl538
-, withRuby_3_0 ? false, ruby_3_0
 , withRuby_3_1 ? true, ruby_3_1
 , withRuby_3_2 ? false, ruby_3_2
 , withSSL ? true, openssl ? null
@@ -47,7 +46,6 @@ in stdenv.mkDerivation rec {
     ++ optional withPHP82 php82-unit
     ++ optional withPerl536 perl536
     ++ optional withPerl538 perl538
-    ++ optional withRuby_3_0 ruby_3_0
     ++ optional withRuby_3_1 ruby_3_1
     ++ optional withRuby_3_2 ruby_3_2
     ++ optional withSSL openssl;
@@ -70,7 +68,6 @@ in stdenv.mkDerivation rec {
     ${optionalString withPHP82      "./configure php    --module=php81    --config=${php82-unit.unwrapped.dev}/bin/php-config --lib-path=${php82-unit}/lib"}
     ${optionalString withPerl536    "./configure perl   --module=perl536  --perl=${perl536}/bin/perl"}
     ${optionalString withPerl538    "./configure perl   --module=perl538  --perl=${perl538}/bin/perl"}
-    ${optionalString withRuby_3_0   "./configure ruby   --module=ruby30   --ruby=${ruby_3_0}/bin/ruby"}
     ${optionalString withRuby_3_1   "./configure ruby   --module=ruby31   --ruby=${ruby_3_1}/bin/ruby"}
     ${optionalString withRuby_3_2   "./configure ruby   --module=ruby32   --ruby=${ruby_3_2}/bin/ruby"}
   '';
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 4b7c6d21f30..ef8ff520c07 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , python3
 , openssl
+, libiconv
 , cargo
 , rustPlatform
 , rustc
@@ -57,6 +58,8 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [
     openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    libiconv
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index 4f683b83a57..ba46d7f0128 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -6,13 +6,13 @@
 
 buildGo121Module rec {
   pname = "ferretdb";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    hash = "sha256-D1iMYh76a9H38tiZWByuJZrABWfjQFCkyxtbtLM/DMw=";
+    hash = "sha256-x5In8cBRki3rHaAB+iSglL19UCD8DtITr5gjb8KKuAw=";
   };
 
   postPatch = ''
@@ -20,7 +20,7 @@ buildGo121Module rec {
     echo nixpkgs     > build/version/package.txt
   '';
 
-  vendorHash = "sha256-WrnACseWo+bLn0IJhGY/DFsrMFAyy7J02cjO4FvE2xA=";
+  vendorHash = "sha256-0DFNDfJmBFpgzarg9FaGb8GV11LhA1N8oq0kSXIWxi8=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/servers/owntracks-recorder/default.nix b/pkgs/servers/owntracks-recorder/default.nix
index 85985584c82..83ebe99c112 100644
--- a/pkgs/servers/owntracks-recorder/default.nix
+++ b/pkgs/servers/owntracks-recorder/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "owntracks-recorder";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchFromGitHub {
     owner = "owntracks";
     repo = "recorder";
     rev = finalAttrs.version;
-    hash = "sha256-N9qMMAIgmBUEscydJKBQneLcX8odOEXY+560lJJz52g=";
+    hash = "sha256-QpPZDh++WHIvIgml32UWtAe3tzh2x7lFUu2xdioNGW4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index 197e9b48d18..312629fc3b6 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.29.1";
+  version = "2.29.2";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-ZE17VCrpHlZ4GMc7+DaUyuehKtYWMr7NJFV1hGQ+UsA=";
+    sha256 = "sha256-f7xjjYy7uPSgssEftXPrfEcNrU6OFlXgwoTTWXgHfUU=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index 5745630964e..583bde82f48 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     homepage = "https://postgis.net/";
     changelog = "https://git.osgeo.org/gitea/postgis/postgis/raw/tag/${version}/NEWS";
     license = licenses.gpl2;
-    maintainers = [ maintainers.marcweber ];
+    maintainers = with maintainers; teams.geospatial.members ++ [ marcweber ];
     inherit (postgresql.meta) platforms;
     broken = versionOlder postgresql.version "12";
   };
diff --git a/pkgs/servers/static-web-server/default.nix b/pkgs/servers/static-web-server/default.nix
index a14313cdaf6..a8057cac7e7 100644
--- a/pkgs/servers/static-web-server/default.nix
+++ b/pkgs/servers/static-web-server/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "static-web-server";
-  version = "2.24.0";
+  version = "2.24.1";
 
   src = fetchFromGitHub {
     owner = "static-web-server";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NJjzfl44qRPph3M6u1jYELSvMzsPww8aD8DDNXSQjOo=";
+    hash = "sha256-U+B/k/stwjJw+mxUCb4A3yUtc/+Tg0PsWhVnovLLX4A=";
   };
 
-  cargoHash = "sha256-gHs8aFZozWgF4uE2mp/qRb9J3hRAohRwu15Q5/FLtTs=";
+  cargoHash = "sha256-ZDrRjIM8187nr72MlzFr0NAqH2f8qkF1sGAT9+NvfhA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/shells/hilbish/default.nix b/pkgs/shells/hilbish/default.nix
index e558402543b..f5450e1da5c 100644
--- a/pkgs/shells/hilbish/default.nix
+++ b/pkgs/shells/hilbish/default.nix
@@ -35,7 +35,7 @@ buildGoModule rec {
     description = "An interactive Unix-like shell written in Go";
     changelog = "https://github.com/Rosettea/Hilbish/releases/tag/v${version}";
     homepage = "https://github.com/Rosettea/Hilbish";
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/shells/zsh/spaceship-prompt/default.nix b/pkgs/shells/zsh/spaceship-prompt/default.nix
index b7c7284e9f4..5dc50c558ac 100644
--- a/pkgs/shells/zsh/spaceship-prompt/default.nix
+++ b/pkgs/shells/zsh/spaceship-prompt/default.nix
@@ -35,6 +35,6 @@ stdenvNoCC.mkDerivation rec {
     changelog = "https://github.com/spaceship-prompt/spaceship-prompt/releases/tag/v${version}";
     license = licenses.mit;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ nyanloutre fortuneteller2k kyleondy ];
+    maintainers = with maintainers; [ nyanloutre moni kyleondy ];
   };
 }
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index deda9b052e5..1324c78c5fd 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -1,5 +1,21 @@
 { pkgspath ? ../../.., test-pkgspath ? pkgspath
 , localSystem ? { system = builtins.currentSystem; }
+# Specify the desired LLVM version in an overlay to avoid the use of
+# mismatching versions.
+#
+# The llvmPackages that we take things (clang, libc++ and such) from
+# is specified explicitly to be llvmPackages_11 to keep the
+# bootstrap-tools stable.  However, tools like otool,
+# install_name_tool and strip are taken straight from stdenv.cc,
+# which, after the bump, is a different LLVM version altogether.
+#
+# The original intent was that bootstrap-tools specified LLVM 11
+# exhaustively but it didn't. That should be rectified with this
+# PR. As to why stick with 11? That's just to keep the
+# bootstrap-tools unchanged.
+#
+# https://github.com/NixOS/nixpkgs/pull/267058/files#r1390889848
+, overlays ? [(self: super: { llvmPackages = super.llvmPackages_11; })]
 , crossSystem ? null
 , bootstrapFiles ? null
 }:
@@ -13,11 +29,9 @@ let cross = if crossSystem != null
               in (import "${pkgspath}/pkgs/stdenv/darwin" args');
            }
       else {};
-in with import pkgspath ({ inherit localSystem; } // cross // custom-bootstrap);
+in with import pkgspath ({ inherit localSystem overlays; } // cross // custom-bootstrap);
 
-let
-  llvmPackages = llvmPackages_11;
-in rec {
+rec {
   coreutils_ = coreutils.override (args: {
     # We want coreutils without ACL support.
     aclSupport = false;
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index d8c5f3208bc..9543e165a80 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -67,7 +67,6 @@ with pkgs;
             # libcxx does not build for some reason on aarch64-linux
             (filterAttrs (n: _: n != "llvmPackages_7"))
           ] ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
-            (filterAttrs (n: _: n != "llvmPackages_5"))
             (filterAttrs (n: _: n != "llvmPackages_6"))
             (filterAttrs (n: _: n != "llvmPackages_7"))
             (filterAttrs (n: _: n != "llvmPackages_8"))
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 16acc62416a..7bbc1e14efb 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -10,11 +10,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "awscli";
-  version = "1.29.57"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.30.2"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+xME5GiDitxn61yrIkiEByx/xeMeXMrVS2rifIX6Ci8=";
+    hash = "sha256-XbYsPbYUIJPCS+nhcE3A5K7yxHcGUkulT5vHPT5T9kM=";
   };
 
 
diff --git a/pkgs/tools/admin/scalr-cli/default.nix b/pkgs/tools/admin/scalr-cli/default.nix
index 3450019afa2..7adbaf7f668 100644
--- a/pkgs/tools/admin/scalr-cli/default.nix
+++ b/pkgs/tools/admin/scalr-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "scalr-cli";
-  version = "0.15.2";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "Scalr";
     repo = "scalr-cli";
     rev = "v${version}";
-    hash = "sha256-vuYkUFh9C+D6Sbu/vbEFV57FDVQVSCkvOxdLeDVbe18=";
+    hash = "sha256-ciretC6z2NcLffSkK78DFIUqbRHgVTA7OEyNk6qdAgI=";
   };
 
   vendorHash = "sha256-zyshSluHq5f+DQV4K7qxHNsZ4nKzL8J5A25rdg9fHeM=";
diff --git a/pkgs/tools/audio/tts/default.nix b/pkgs/tools/audio/tts/default.nix
index f6b1f6d9f66..48c936ca632 100644
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@@ -16,14 +16,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "tts";
-  version = "0.19.1";
-  format = "pyproject";
+  version = "0.20.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = "TTS";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GYVr/Wam1IGCSR2vHMAu5Fg/jRB333L6iNjltnRKh4E=";
+    hash = "sha256-1nlSf15IEX1qKfDtR6+jQqskjxIuzaIWatkj9Z1fh8Y=";
   };
 
   postPatch = let
@@ -57,7 +57,9 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     cython
+    numpy
     packaging
+    setuptools
   ];
 
   propagatedBuildInputs = with python.pkgs; [
diff --git a/pkgs/tools/bluetooth/bluetuith/default.nix b/pkgs/tools/bluetooth/bluetuith/default.nix
index 6b126055318..d6fad23c163 100644
--- a/pkgs/tools/bluetooth/bluetuith/default.nix
+++ b/pkgs/tools/bluetooth/bluetuith/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bluetuith";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "darkhz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b+J+8nxFZYJlAKOStpH7ItPqMw7inM5pss17kyX1brg=";
+    sha256 = "sha256-vdHnG0uQdy5PboIovtxl5i9xwFpjYLCZf2IGeiMcWe8=";
   };
 
-  vendorHash = "sha256-d0O54KNGLXU8FGr1eSEp30JMWNVo91Le2MI8UnAfTuU=";
+  vendorHash = "sha256-pYVEFKLPfstWWO6ypgv7ntAaE1Wmq2XKuZC2ccMa8Vc=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/tools/graphics/xcolor/default.nix b/pkgs/tools/graphics/xcolor/default.nix
index 1ef2c807bde..dabe14d895f 100644
--- a/pkgs/tools/graphics/xcolor/default.nix
+++ b/pkgs/tools/graphics/xcolor/default.nix
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Lightweight color picker for X11";
     homepage = "https://github.com/Soft/xcolor";
-    maintainers = with lib.maintainers; [ fortuneteller2k ];
+    maintainers = with lib.maintainers; [ moni ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/tools/misc/bfetch/default.nix b/pkgs/tools/misc/bfetch/default.nix
index 107f2cd9452..675a8cb11f3 100644
--- a/pkgs/tools/misc/bfetch/default.nix
+++ b/pkgs/tools/misc/bfetch/default.nix
@@ -24,6 +24,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/NNBnh/bfetch";
     license = licenses.gpl3Only;
     platforms = platforms.all;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/tools/misc/bootspec/default.nix b/pkgs/tools/misc/bootspec/default.nix
index 7bf6bc478d7..2ffa6c47ab0 100644
--- a/pkgs/tools/misc/bootspec/default.nix
+++ b/pkgs/tools/misc/bootspec/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, fetchpatch
 }:
 rustPlatform.buildRustPackage rec {
   pname = "bootspec";
@@ -13,6 +14,17 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-5IGSMHeL0eKfl7teDejAckYQjc8aeLwfwIQSzQ8YaAg=";
   };
 
+  patches = [
+    # https://github.com/DeterminateSystems/bootspec/pull/127
+    # Fixes the synthesize tool for aarch64-linux
+    (fetchpatch {
+      name = "aarch64-support.patch";
+      url = "https://github.com/DeterminateSystems/bootspec/commit/1d0e925f360f0199f13422fb7541225fd162fd4f.patch";
+      sha256 = "sha256-wU/jWnOqVBrU2swANdXbQfzRpNd/JIS4cxSyCvixZM0=";
+    })
+
+  ];
+
   cargoHash = "sha256-eGSKVHjPnHK7WyGkO5LIjocNGHawahYQR3H5Lgk1C9s=";
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 8926b971429..09a4ef57c69 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -78,11 +78,11 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "251";
+  version = "252";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-7oAFxzLLEds9SI14F88QRhirb/3pjXhmGaW0SWUgpv4=";
+    hash = "sha256-NmYv5htZT2v04vVksIWGuaPI1rXfNmrVSmErT/faBbQ=";
   };
 
   outputs = [
diff --git a/pkgs/tools/misc/elfcat/default.nix b/pkgs/tools/misc/elfcat/default.nix
index 359bd6d3ab9..22247029973 100644
--- a/pkgs/tools/misc/elfcat/default.nix
+++ b/pkgs/tools/misc/elfcat/default.nix
@@ -17,6 +17,6 @@ rustPlatform.buildRustPackage rec {
     description = "ELF visualizer, generates HTML files from ELF binaries.";
     homepage = "https://github.com/ruslashev/elfcat";
     license = licenses.zlib;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/tools/misc/fetchutils/default.nix b/pkgs/tools/misc/fetchutils/default.nix
index e9ee3fba516..d1c830f877d 100644
--- a/pkgs/tools/misc/fetchutils/default.nix
+++ b/pkgs/tools/misc/fetchutils/default.nix
@@ -24,6 +24,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/lptstr/fetchutils";
     license = licenses.mit;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/tools/misc/sacad/default.nix b/pkgs/tools/misc/sacad/default.nix
index aca6e18e372..5aa6adf768a 100644
--- a/pkgs/tools/misc/sacad/default.nix
+++ b/pkgs/tools/misc/sacad/default.nix
@@ -34,6 +34,6 @@ python3Packages.buildPythonApplication rec {
     description = "Smart Automatic Cover Art Downloader";
     homepage = "https://github.com/desbma/sacad";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/tools/misc/vector/Cargo.lock b/pkgs/tools/misc/vector/Cargo.lock
index c3cb420f5fe..d5b347bb415 100644
--- a/pkgs/tools/misc/vector/Cargo.lock
+++ b/pkgs/tools/misc/vector/Cargo.lock
@@ -9864,7 +9864,7 @@ checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
 
 [[package]]
 name = "vector"
-version = "0.34.0"
+version = "0.34.1"
 dependencies = [
  "apache-avro",
  "approx",
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index f0c48dd9796..fe58e934f55 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -34,7 +34,7 @@
 
 let
   pname = "vector";
-  version = "0.34.0";
+  version = "0.34.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage {
     owner = "vectordotdev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-E9sbpVFDVKJKYqSiqXeC9AItset/bXvVA9mURazTn/I=";
+    hash = "sha256-vK+k+VbUVgJ8idlvuod5ExAkkeTYDk/135dyLRct0zs=";
   };
 
   cargoLock = {
diff --git a/pkgs/tools/networking/crackle/default.nix b/pkgs/tools/networking/crackle/default.nix
index 00d0acd2aa9..ea42e7a0b32 100644
--- a/pkgs/tools/networking/crackle/default.nix
+++ b/pkgs/tools/networking/crackle/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Crack and decrypt BLE encryption";
     homepage = "https://github.com/mikeryan/crackle";
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     license = licenses.bsd2;
   };
 }
diff --git a/pkgs/tools/networking/mdk4/default.nix b/pkgs/tools/networking/mdk4/default.nix
index 903504633ac..979584db432 100644
--- a/pkgs/tools/networking/mdk4/default.nix
+++ b/pkgs/tools/networking/mdk4/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "A tool that injects data into wireless networks";
     homepage = "https://github.com/aircrack-ng/mdk4";
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/tools/networking/redfang/default.nix b/pkgs/tools/networking/redfang/default.nix
index 8e799b7d41f..a4ba12b2948 100644
--- a/pkgs/tools/networking/redfang/default.nix
+++ b/pkgs/tools/networking/redfang/default.nix
@@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
     description = "A small proof-of-concept application to find non discoverable bluetooth devices";
     homepage = "https://gitlab.com/kalilinux/packages/redfang";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/tools/networking/stevenblack-blocklist/default.nix b/pkgs/tools/networking/stevenblack-blocklist/default.nix
index 8a71f6d99fd..6c690fe4064 100644
--- a/pkgs/tools/networking/stevenblack-blocklist/default.nix
+++ b/pkgs/tools/networking/stevenblack-blocklist/default.nix
@@ -15,6 +15,6 @@ fetchFromGitHub {
     description = "Unified hosts file with base extensions";
     homepage = "https://github.com/StevenBlack/hosts";
     license = licenses.mit;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
index c948c66b47f..07aa1a7accc 100644
--- a/pkgs/tools/package-management/xbps/default.nix
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, which, zlib, openssl, libarchive }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, which, zlib, openssl, libarchive }:
 
 stdenv.mkDerivation rec {
   pname = "xbps";
-  version = "0.59.1";
+  version = "0.59.2";
 
   src = fetchFromGitHub {
     owner = "void-linux";
     repo = "xbps";
     rev = version;
-    sha256 = "0pab3xf97y4wqlyrb92zxd3cfsrbnlx6pssbw4brgwcxccw9jrhy";
+    hash = "sha256-3+LzFLDZ1zfRPBETMlpEn66zsfHRHQLlgeZPdMtmA14=";
   };
 
   nativeBuildInputs = [ pkg-config which ];
@@ -17,16 +17,17 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./cert-paths.patch
-    # fix openssl 3
-    (fetchpatch {
-      url = "https://github.com/void-linux/xbps/commit/db1766986c4389eb7e17c0e0076971b711617ef9.patch";
-      hash = "sha256-CmyZdsHStPsELdEgeJBWIbXIuVeBhv7VYb2uGYxzUWQ=";
-    })
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=deprecated-declarations";
 
   postPatch = ''
+    # _BSD_SOURCE causes cpp warning
+    # https://github.com/void-linux/xbps/issues/576
+    substituteInPlace bin/xbps-fbulk/main.c lib/util.c lib/external/dewey.c lib/external/fexec.c \
+      --replace 'define _BSD_SOURCE' 'define _DEFAULT_SOURCE' \
+      --replace '# define _BSD_SOURCE' '#define _DEFAULT_SOURCE'
+
     # fix unprefixed ranlib (needed on cross)
     substituteInPlace lib/Makefile \
       --replace 'SILENT}ranlib ' 'SILENT}$(RANLIB) '
diff --git a/pkgs/tools/security/chain-bench/default.nix b/pkgs/tools/security/chain-bench/default.nix
index fef69399cc1..e123cf30b43 100644
--- a/pkgs/tools/security/chain-bench/default.nix
+++ b/pkgs/tools/security/chain-bench/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "chain-bench";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vQzxTOShxQGitZRCuR8izSxCkZdPWm2ohoXBOvAkwfw=";
+    sha256 = "sha256-eNCQbmqTnCBBwrppFL2yvmiwgj439sosYVkk2ryMa0I=";
   };
   vendorHash = "sha256-sAZIMJRx/E+l12Zyp/vKfuiaCMeaonRbEcsRIRXbXm8=";
 
diff --git a/pkgs/tools/security/sequoia-sqop/default.nix b/pkgs/tools/security/sequoia-sqop/default.nix
index fdefbdea9e5..19dd99b871b 100644
--- a/pkgs/tools/security/sequoia-sqop/default.nix
+++ b/pkgs/tools/security/sequoia-sqop/default.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia-sqop";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage rec {
     # generated etc
     repo = "sequoia-sop";
     rev = "v${version}";
-    hash = "sha256-2fRlHkT2jhUp1dIqKe8r7ktSbgudCmzuiiyF0WcbYIE=";
+    hash = "sha256-qGSVmjLdx84YphAXt1MRF1cIfk7xLOvtUj+3e7vO+jA=";
   };
 
-  cargoHash = "sha256-/LLW0AHCgqi2pAOkhZXNGlmNF/+u0TmSstd/B6mDr6M=";
+  cargoHash = "sha256-y4n6UPAYwI9P+jw59TOf98xSdNvzEgJp5n/GtiixsIU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1363383109d..5b096430c1e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -161,7 +161,6 @@ mapAliases ({
   cvs_fast_export = cvs-fast-export; # Added 2021-06-10
 
   # these are for convenience, not for backward compat and shouldn't expire
-  clang5Stdenv = lowPrio llvmPackages_5.stdenv;
   clang6Stdenv = lowPrio llvmPackages_6.stdenv;
   clang7Stdenv = lowPrio llvmPackages_7.stdenv;
   clang8Stdenv = lowPrio llvmPackages_8.stdenv;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bca8878d743..7fb9cdafdd7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9990,6 +9990,8 @@ with pkgs;
 
   lldpd = callPackage ../tools/networking/lldpd { };
 
+  llm = with python3Packages; toPythonApplication llm;
+
   lnav = callPackage ../tools/misc/lnav { };
 
   lnch = callPackage ../tools/misc/lnch { };
@@ -15036,9 +15038,7 @@ with pkgs;
 
   clipnotify = callPackage ../tools/misc/clipnotify { };
 
-  clipboard-jh = callPackage ../tools/misc/clipboard-jh {
-    stdenv = if stdenv.isDarwin then llvmPackages_16.stdenv else stdenv;
-  };
+  clipboard-jh = callPackage ../tools/misc/clipboard-jh { };
 
   clipbuzz = callPackage ../tools/misc/clipbuzz { };
 
@@ -15646,7 +15646,6 @@ with pkgs;
   };
 
   clang = llvmPackages.clang;
-  clang_5  = llvmPackages_5.clang;
   clang_6  = llvmPackages_6.clang;
   clang_7  = llvmPackages_7.clang;
   clang_8  = llvmPackages_8.clang;
@@ -15663,10 +15662,6 @@ with pkgs;
     llvmPackages = llvmPackages_14;
   };
 
-  clang-tools_5 = callPackage ../development/tools/clang-tools {
-    llvmPackages = llvmPackages_5;
-  };
-
   clang-tools_6 = callPackage ../development/tools/clang-tools {
     llvmPackages = llvmPackages_6;
   };
@@ -16599,7 +16594,6 @@ with pkgs;
   };
 
   lld = llvmPackages.lld;
-  lld_5 = llvmPackages_5.lld;
   lld_6 = llvmPackages_6.lld;
   lld_7 = llvmPackages_7.lld;
   lld_8 = llvmPackages_8.lld;
@@ -16613,7 +16607,6 @@ with pkgs;
   lld_16 = llvmPackages_16.lld;
 
   lldb = lldb_14;
-  lldb_5 = llvmPackages_5.lldb;
   lldb_6 = llvmPackages_6.lldb;
   lldb_7 = llvmPackages_7.lldb;
   lldb_8 = llvmPackages_8.lldb;
@@ -16627,7 +16620,6 @@ with pkgs;
   lldb_16 = llvmPackages_16.lldb;
 
   llvm = llvmPackages.llvm;
-  llvm_5  = llvmPackages_5.llvm;
   llvm_6  = llvmPackages_6.llvm;
   llvm_7  = llvmPackages_7.llvm;
   llvm_8  = llvmPackages_8.llvm;
@@ -16660,13 +16652,6 @@ with pkgs;
       stdenv.targetPlatform));
   in pkgs.${"llvmPackages_${minSupported}"};
 
-  llvmPackages_5 = recurseIntoAttrs (callPackage ../development/compilers/llvm/5 {
-    inherit (stdenvAdapters) overrideCC;
-    buildLlvmTools = buildPackages.llvmPackages_5.tools;
-    targetLlvm = targetPackages.llvmPackages_5.llvm or llvmPackages_5.llvm;
-    targetLlvmLibraries = targetPackages.llvmPackages_5.libraries or llvmPackages_5.libraries;
-  });
-
   llvmPackages_6 = recurseIntoAttrs (callPackage ../development/compilers/llvm/6 {
     inherit (stdenvAdapters) overrideCC;
     buildLlvmTools = buildPackages.llvmPackages_6.tools;
@@ -17760,7 +17745,7 @@ with pkgs;
   ### End of CuboCore
 
   maude = callPackage ../development/interpreters/maude {
-    stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
+    stdenv = if stdenv.cc.isClang then llvmPackages_7.stdenv else stdenv;
   };
 
   me_cleaner = callPackage ../tools/misc/me_cleaner { };
@@ -18044,7 +18029,6 @@ with pkgs;
     mkRubyVersion
     mkRuby
     ruby_2_7
-    ruby_3_0
     ruby_3_1
     ruby_3_2
     ruby_3_3;
@@ -18053,7 +18037,6 @@ with pkgs;
   rubyPackages = rubyPackages_3_1;
 
   rubyPackages_2_7 = recurseIntoAttrs ruby_2_7.gems;
-  rubyPackages_3_0 = recurseIntoAttrs ruby_3_0.gems;
   rubyPackages_3_1 = recurseIntoAttrs ruby_3_1.gems;
   rubyPackages_3_2 = recurseIntoAttrs ruby_3_2.gems;
   rubyPackages_3_3 = recurseIntoAttrs ruby_3_3.gems;
@@ -38345,7 +38328,6 @@ with pkgs;
   scid-vs-pc = callPackage ../games/scid-vs-pc { };
 
   scummvm = callPackage ../games/scummvm {
-    stdenv = if (stdenv.isDarwin && stdenv.isAarch64) then llvmPackages_14.stdenv else stdenv;
     inherit (darwin) cctools;
     inherit (darwin.apple_sdk.frameworks) Cocoa AudioToolbox Carbon CoreMIDI AudioUnit;
   };
@@ -40031,7 +40013,7 @@ with pkgs;
 
   root5 = lowPrio (callPackage ../applications/science/misc/root/5.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
-    stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
+    stdenv = if stdenv.cc.isClang then llvmPackages_7.stdenv else stdenv;
   });
 
   rinetd = callPackage ../servers/rinetd { };
diff --git a/pkgs/top-level/pkg-config/pkg-config-data.json b/pkgs/top-level/pkg-config/pkg-config-data.json
index 4578b0f92b2..50eae9ac572 100644
--- a/pkgs/top-level/pkg-config/pkg-config-data.json
+++ b/pkgs/top-level/pkg-config/pkg-config-data.json
@@ -773,11 +773,6 @@
         "ruby_2_7"
       ]
     },
-    "ruby-3.0": {
-      "attrPath": [
-        "ruby_3_0"
-      ]
-    },
     "ruby-3.1": {
       "attrPath": [
         "ruby_3_1"
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f21dc11dd49..0a2f0fea462 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6390,6 +6390,8 @@ self: super: with self; {
     inherit (pkgs) fuse;
   };
 
+  llm = callPackage ../development/python-modules/llm { };
+
   llvmlite = callPackage ../development/python-modules/llvmlite {
     # llvmlite always requires a specific version of llvm.
     llvm = pkgs.llvm_14;
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 63679dd28f0..a8e9f397c0b 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -143,10 +143,12 @@ let
 
               jobs.tests.cc-wrapper.llvmPackages.clang.x86_64-linux
               jobs.tests.cc-wrapper.llvmPackages.libcxx.x86_64-linux
-              jobs.tests.cc-wrapper.llvmPackages_5.clang.x86_64-linux
-              jobs.tests.cc-wrapper.llvmPackages_5.libcxx.x86_64-linux
               jobs.tests.cc-wrapper.llvmPackages_6.clang.x86_64-linux
               jobs.tests.cc-wrapper.llvmPackages_6.libcxx.x86_64-linux
+              jobs.tests.cc-wrapper.llvmPackages_7.clang.x86_64-linux
+              jobs.tests.cc-wrapper.llvmPackages_7.libcxx.x86_64-linux
+              jobs.tests.cc-wrapper.llvmPackages_7.clang.x86_64-linux
+              jobs.tests.cc-wrapper.llvmPackages_7.libcxx.x86_64-linux
               jobs.tests.cc-multilib-gcc.x86_64-linux
               jobs.tests.cc-multilib-clang.x86_64-linux
               jobs.tests.stdenv-inputs.x86_64-linux