summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/editors/ed/default.nix4
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.py329
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.sh331
-rw-r--r--pkgs/build-support/setup-hooks/make-wrapper.sh18
-rw-r--r--pkgs/development/compilers/go/1.16.nix1
-rw-r--r--pkgs/development/compilers/go/1.17.nix1
-rw-r--r--pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch18
-rw-r--r--pkgs/development/compilers/llvm/13/clang/default.nix5
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix3
-rw-r--r--pkgs/development/libraries/aws-checksums/default.nix4
-rw-r--r--pkgs/development/libraries/gd/default.nix12
-rw-r--r--pkgs/development/libraries/gdbm/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/2.33-master.patch.gzbin147266 -> 155232 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/lcms2/default.nix4
-rw-r--r--pkgs/development/libraries/libarchive/default.nix4
-rw-r--r--pkgs/development/libraries/libgee/default.nix4
-rw-r--r--pkgs/development/libraries/libpng/default.nix2
-rw-r--r--pkgs/development/libraries/libsigsegv/default.nix4
-rw-r--r--pkgs/development/libraries/libtiff/default.nix6
-rw-r--r--pkgs/development/libraries/libxkbcommon/default.nix4
-rw-r--r--pkgs/development/libraries/neon/default.nix4
-rw-r--r--pkgs/development/libraries/nss/default.nix4
-rw-r--r--pkgs/development/libraries/openh264/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json40
-rw-r--r--pkgs/development/libraries/wxwidgets/3.1/default.nix138
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK28.nix (renamed from pkgs/development/libraries/wxwidgets/2.8/default.nix)0
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK29.nix (renamed from pkgs/development/libraries/wxwidgets/2.9/default.nix)2
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK30.nix (renamed from pkgs/development/libraries/wxwidgets/3.0/default.nix)10
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK31.nix149
-rw-r--r--pkgs/development/libraries/wxwidgets/wxmac30.nix (renamed from pkgs/development/libraries/wxwidgets/3.0/mac.nix)0
-rw-r--r--pkgs/development/python-modules/aiosignal/default.nix5
-rw-r--r--pkgs/development/python-modules/async_generator/default.nix20
-rw-r--r--pkgs/development/python-modules/cchardet/default.nix6
-rw-r--r--pkgs/development/python-modules/django/2.nix5
-rw-r--r--pkgs/development/python-modules/django/3.nix5
-rw-r--r--pkgs/development/python-modules/eventlet/default.nix2
-rw-r--r--pkgs/development/python-modules/iniconfig/default.nix6
-rw-r--r--pkgs/development/python-modules/ipython/default.nix5
-rw-r--r--pkgs/development/python-modules/jedi/default.nix6
-rw-r--r--pkgs/development/python-modules/moto/default.nix2
-rw-r--r--pkgs/development/python-modules/pillow/default.nix4
-rw-r--r--pkgs/development/python-modules/platformdirs/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix108
-rw-r--r--pkgs/development/python-modules/pytest-aiohttp/default.nix39
-rw-r--r--pkgs/development/python-modules/pytest-asyncio/default.nix11
-rw-r--r--pkgs/development/python-modules/pytest-mock/default.nix11
-rw-r--r--pkgs/development/python-modules/pyyaml/default.nix2
-rw-r--r--pkgs/development/python-modules/regex/default.nix15
-rw-r--r--pkgs/development/python-modules/responses/default.nix6
-rw-r--r--pkgs/development/python-modules/snitun/default.nix4
-rw-r--r--pkgs/development/tools/misc/autoconf/2.13.nix2
-rw-r--r--pkgs/development/tools/misc/ctags/default.nix6
-rw-r--r--pkgs/misc/cups/default.nix4
-rw-r--r--pkgs/os-specific/linux/audit/default.nix12
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/2_03.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/common.nix3
-rw-r--r--pkgs/servers/sql/postgresql/default.nix20
-rw-r--r--pkgs/test/make-wrapper/default.nix3
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/security/gnupg/23.nix16
-rw-r--r--pkgs/top-level/all-packages.nix46
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix38
67 files changed, 814 insertions, 736 deletions
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index a6ab483a7b0..f5ed28cedf6 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (rec {
   pname = "ed";
-  version = "1.17";
+  version = "1.18";
 
   src = fetchurl {
     url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    sha256 = "0m2yrkfjjraakxr98nsiakqrn351h99n706x9asgmdi57j43kpki";
+    sha256 = "sha256-rKjvrZgAxYdySiC5eqj8R+a1pH34Fgb+q6gxsHRGK08=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 0cb09814c0f..13c5c49db48 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.4227";
+  version = "8.2.4350";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-Xj4ymkrWY5GWpQhEDYtPtaRovBa6j19dW9GWg9WSdig=";
+    sha256 = "sha256-+fCyLZi9+9r7tYoRQsVESkcoHHtM7vrVuOGdJi/9iF0=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.py b/pkgs/build-support/setup-hooks/auto-patchelf.py
new file mode 100644
index 00000000000..26fd623e3da
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -0,0 +1,329 @@
+#!/usr/bin/env python3
+
+from collections import defaultdict
+from contextlib import contextmanager
+from dataclasses import dataclass
+from elftools.common.exceptions import ELFError # type: ignore
+from elftools.elf.dynamic import DynamicSection # type: ignore
+from elftools.elf.elffile import ELFFile # type: ignore
+from elftools.elf.enums import ENUM_E_TYPE, ENUM_EI_OSABI # type: ignore
+from itertools import chain
+from pathlib import Path, PurePath
+
+from typing import Tuple, Optional, Iterator, List, DefaultDict, Set
+
+import argparse
+import os
+import pprint
+import subprocess
+import sys
+
+
+
+@contextmanager
+def open_elf(path: Path) -> Iterator[ELFFile]:
+    with path.open('rb') as stream:
+        yield ELFFile(stream)
+
+
+def is_static_executable(elf: ELFFile) -> bool:
+    # Statically linked executables have an ELF type of EXEC but no INTERP.
+    return (elf.header["e_type"] == 'ET_EXEC'
+            and not elf.get_section_by_name(".interp"))
+
+
+def is_dynamic_executable(elf: ELFFile) -> bool:
+    # We do not require an ELF type of EXEC. This also catches
+    # position-independent executables, as they typically have an INTERP
+    # section but their ELF type is DYN.
+    return bool(elf.get_section_by_name(".interp"))
+
+
+def get_dependencies(elf: ELFFile) -> List[str]:
+    dependencies = []
+    # This convoluted code is here on purpose. For some reason, using
+    # elf.get_section_by_name(".dynamic") does not always return an
+    # instance of DynamicSection, but that is required to call iter_tags
+    for section in elf.iter_sections():
+        if isinstance(section, DynamicSection):
+            for tag in section.iter_tags('DT_NEEDED'):
+                dependencies.append(tag.needed)
+            break # There is only one dynamic section
+
+    return dependencies
+
+
+def get_rpath(elf: ELFFile) -> List[str]:
+    # This convoluted code is here on purpose. For some reason, using
+    # elf.get_section_by_name(".dynamic") does not always return an
+    # instance of DynamicSection, but that is required to call iter_tags
+    for section in elf.iter_sections():
+        if isinstance(section, DynamicSection):
+            for tag in section.iter_tags('DT_RUNPATH'):
+                return tag.runpath.split(':')
+
+            for tag in section.iter_tags('DT_RPATH'):
+                return tag.rpath.split(':')
+
+            break # There is only one dynamic section
+
+    return []
+
+
+def get_arch(elf: ELFFile) -> str:
+    return elf.get_machine_arch()
+
+
+def get_osabi(elf: ELFFile) -> str:
+    return elf.header["e_ident"]["EI_OSABI"]
+
+
+def osabi_are_compatible(wanted: str, got: str) -> bool:
+    """
+    Tests whether two OS ABIs are compatible, taking into account the
+    generally accepted compatibility of SVR4 ABI with other ABIs.
+    """
+    if not wanted or not got:
+        # One of the types couldn't be detected, so as a fallback we'll
+        # assume they're compatible.
+        return True
+
+    # Generally speaking, the base ABI (0x00), which is represented by
+    # readelf(1) as "UNIX - System V", indicates broad compatibility
+    # with other ABIs.
+    #
+    # TODO: This isn't always true. For example, some OSes embed ABI
+    # compatibility into SHT_NOTE sections like .note.tag and
+    # .note.ABI-tag.  It would be prudent to add these to the detection
+    # logic to produce better ABI information.
+    if wanted == 'ELFOSABI_SYSV':
+        return True
+
+    # Similarly here, we should be able to link against a superset of
+    # features, so even if the target has another ABI, this should be
+    # fine.
+    if got == 'ELFOSABI_SYSV':
+        return True
+
+    # Otherwise, we simply return whether the ABIs are identical.
+    return wanted == got
+
+
+def glob(path: Path, pattern: str, recursive: bool) -> Iterator[Path]:
+    return path.rglob(pattern) if recursive else path.glob(pattern)
+
+
+cached_paths: Set[Path] = set()
+soname_cache: DefaultDict[Tuple[str, str], List[Tuple[Path, str]]] = defaultdict(list)
+
+
+def populate_cache(initial: List[Path], recursive: bool =False) -> None:
+    lib_dirs = list(initial)
+
+    while lib_dirs:
+        lib_dir = lib_dirs.pop(0)
+
+        if lib_dir in cached_paths:
+            continue
+
+        cached_paths.add(lib_dir)
+
+        for path in glob(lib_dir, "*.so*", recursive):
+            if not path.is_file():
+                continue
+
+            resolved = path.resolve()
+            try:
+                with open_elf(path) as elf:
+                    osabi = get_osabi(elf)
+                    arch = get_arch(elf)
+                    rpath = [Path(p) for p in get_rpath(elf)
+                                     if p and '$ORIGIN' not in p]
+                    lib_dirs += rpath
+                    soname_cache[(path.name, arch)].append((resolved.parent, osabi))
+
+            except ELFError:
+                # Not an ELF file in the right format
+                pass
+
+
+def find_dependency(soname: str, soarch: str, soabi: str) -> Optional[Path]:
+    for lib, libabi in soname_cache[(soname, soarch)]:
+        if osabi_are_compatible(soabi, libabi):
+            return lib
+    return None
+
+
+@dataclass
+class Dependency:
+    file: Path              # The file that contains the dependency
+    name: Path              # The name of the dependency
+    found: bool = False     # Whether it was found somewhere
+
+
+def auto_patchelf_file(path: Path, runtime_deps: list[Path]) -> list[Dependency]:
+    try:
+        with open_elf(path) as elf:
+
+            if is_static_executable(elf):
+                # No point patching these
+                print(f"skipping {path} because it is statically linked")
+                return []
+
+            if elf.num_segments() == 0:
+                # no segment (e.g. object file)
+                print(f"skipping {path} because it contains no segment")
+                return []
+
+            file_arch = get_arch(elf)
+            if interpreter_arch != file_arch:
+                # Our target architecture is different than this file's
+                # architecture, so skip it.
+                print(f"skipping {path} because its architecture ({file_arch})"
+                      f" differs from target ({interpreter_arch})")
+                return []
+
+            file_osabi = get_osabi(elf)
+            if not osabi_are_compatible(interpreter_osabi, file_osabi):
+                print(f"skipping {path} because its OS ABI ({file_osabi}) is"
+                      f" not compatible with target ({interpreter_osabi})")
+                return []
+
+            file_is_dynamic_executable = is_dynamic_executable(elf)
+
+            file_dependencies = map(Path, get_dependencies(elf))
+
+    except ELFError:
+        return []
+
+    rpath = []
+    if file_is_dynamic_executable:
+        print("setting interpreter of", path)
+        subprocess.run(
+                ["patchelf", "--set-interpreter", interpreter_path.as_posix(), path.as_posix()],
+                check=True)
+        rpath += runtime_deps
+
+    print("searching for dependencies of", path)
+    dependencies = []
+    # Be sure to get the output of all missing dependencies instead of
+    # failing at the first one, because it's more useful when working
+    # on a new package where you don't yet know the dependencies.
+    for dep in file_dependencies:
+        if dep.is_absolute() and dep.is_file():
+            # This is an absolute path. If it exists, just use it.
+            # Otherwise, we probably want this to produce an error when
+            # checked (because just updating the rpath won't satisfy
+            # it).
+            continue
+        elif (libc_lib / dep).is_file():
+            # This library exists in libc, and will be correctly
+            # resolved by the linker.
+            continue
+
+        if found_dependency := find_dependency(dep.name, file_arch, file_osabi):
+            rpath.append(found_dependency)
+            dependencies.append(Dependency(path, dep, True))
+            print(f"    {dep} -> found: {found_dependency}")
+        else:
+            dependencies.append(Dependency(path, dep, False))
+            print(f"    {dep} -> not found!")
+
+    # Dedup the rpath
+    rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath)))
+
+    if rpath:
+        print("setting RPATH to:", rpath_str)
+        subprocess.run(
+                ["patchelf", "--set-rpath", rpath_str, path.as_posix()],
+                check=True)
+
+    return dependencies
+
+
+def auto_patchelf(
+        paths_to_patch: List[Path],
+        lib_dirs: List[Path],
+        runtime_deps: List[Path],
+        recursive: bool =True,
+        ignore_missing: bool =False) -> None:
+
+    if not paths_to_patch:
+        sys.exit("No paths to patch, stopping.")
+
+    # Add all shared objects of the current output path to the cache,
+    # before lib_dirs, so that they are chosen first in find_dependency.
+    populate_cache(paths_to_patch, recursive)
+    populate_cache(lib_dirs)
+
+    dependencies = []
+    for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
+        if not path.is_symlink() and path.is_file():
+            dependencies += auto_patchelf_file(path, runtime_deps)
+
+    missing = [dep for dep in dependencies if not dep.found]
+
+    # Print a summary of the missing dependencies at the end
+    for dep in missing:
+        print(f"auto-patchelf could not satisfy dependency {dep.name} wanted by {dep.file}")
+
+    if missing and not ignore_missing:
+        sys.exit('auto-patchelf failed to find all the required dependencies.\n'
+                 'Add the missing dependencies to --libs or use --ignore-missing.')
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        prog="auto-patchelf",
+        description='auto-patchelf tries as hard as possible to patch the'
+                    ' provided binary files by looking for compatible'
+                    'libraries in the provided paths.')
+    parser.add_argument(
+        "--ignore-missing",
+        action="store_true",
+        help="Do not fail when some dependencies are not found.")
+    parser.add_argument(
+        "--no-recurse",
+        dest="recursive",
+        action="store_false",
+        help="Patch only the provided paths, and ignore their children")
+    parser.add_argument(
+        "--paths", nargs="*", type=Path,
+        help="Paths whose content needs to be patched.")
+    parser.add_argument(
+        "--libs", nargs="*", type=Path,
+        help="Paths where libraries are searched for.")
+    parser.add_argument(
+        "--runtime-dependencies", nargs="*", type=Path,
+        help="Paths to prepend to the runtime path of executable binaries.")
+
+    print("automatically fixing dependencies for ELF files")
+    args = parser.parse_args()
+    pprint.pprint(vars(args))
+
+    auto_patchelf(
+        args.paths,
+        args.libs,
+        args.runtime_dependencies,
+        args.recursive,
+        args.ignore_missing)
+
+
+interpreter_path: Path  = None # type: ignore
+interpreter_osabi: str  = None # type: ignore
+interpreter_arch: str   = None # type: ignore
+libc_lib: Path          = None # type: ignore
+
+if __name__ == "__main__":
+    nix_support = Path(os.environ['NIX_BINTOOLS']) / 'nix-support'
+    interpreter_path = Path((nix_support / 'dynamic-linker').read_text().strip())
+    libc_lib = Path((nix_support / 'orig-libc').read_text().strip()) / 'lib'
+
+    with open_elf(interpreter_path) as interpreter:
+        interpreter_osabi = get_osabi(interpreter)
+        interpreter_arch = get_arch(interpreter)
+
+    if interpreter_arch and interpreter_osabi and interpreter_path and libc_lib:
+        main()
+    else:
+        sys.exit("Failed to parse dynamic linker (ld) properties.")
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 4b3a1c5c390..9822674196a 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -1,289 +1,21 @@
 #!/usr/bin/env bash
 
 declare -a autoPatchelfLibs
-declare -Ag autoPatchelfFailedDeps
+declare -a extraAutoPatchelfLibs
 
 gatherLibraries() {
     autoPatchelfLibs+=("$1/lib")
 }
 
-# wrapper around patchelf to raise proper error messages
-# containing the tried file name and command
-runPatchelf() {
-  patchelf "$@" || (echo "Command failed: patchelf $*" && exit 1)
-}
-
 # shellcheck disable=SC2154
 # (targetOffset is referenced but not assigned.)
 addEnvHooks "$targetOffset" gatherLibraries
 
-isExecutable() {
-    # For dynamically linked ELF files it would be enough to check just for the
-    # INTERP section. However, we won't catch statically linked executables as
-    # they only have an ELF type of EXEC but no INTERP.
-    #
-    # So what we do here is just check whether *either* the ELF type is EXEC
-    # *or* there is an INTERP section. This also catches position-independent
-    # executables, as they typically have an INTERP section but their ELF type
-    # is DYN.
-    isExeResult="$(LANG=C $READELF -h -l "$1" 2> /dev/null \
-        | grep '^ *Type: *EXEC\>\|^ *INTERP\>')"
-    # not using grep -q, because it can cause Broken pipe
-    # https://unix.stackexchange.com/questions/305547/broken-pipe-when-grepping-output-but-only-with-i-flag
-    [ -n "$isExeResult" ]
-}
-
-# We cache dependencies so that we don't need to search through all of them on
-# every consecutive call to findDependency.
-declare -Ag autoPatchelfCachedDepsAssoc
-declare -ag autoPatchelfCachedDeps
-
-addToDepCache() {
-    if [[ ${autoPatchelfCachedDepsAssoc[$1]+f} ]]; then return; fi
-
-    # store deps in an assoc. array for efficient lookups
-    # otherwise findDependency would have quadratic complexity
-    autoPatchelfCachedDepsAssoc["$1"]=""
-
-    # also store deps in normal array to maintain their order
-    autoPatchelfCachedDeps+=("$1")
-}
-
-declare -gi depCacheInitialised=0
-declare -gi doneRecursiveSearch=0
-declare -g foundDependency
-
-getDepsFromElfBinary() {
-    # NOTE: This does not use runPatchelf because it may encounter non-ELF
-    # files. Caller is expected to check the return code if needed.
-    patchelf --print-needed "$1" 2> /dev/null
-}
-
-getRpathFromElfBinary() {
-    # NOTE: This does not use runPatchelf because it may encounter non-ELF
-    # files. Caller is expected to check the return code if needed.
-    local rpath
-    IFS=':' read -ra rpath < <(patchelf --print-rpath "$1" 2> /dev/null) || return $?
-
-    printf "%s\n" "${rpath[@]}"
-}
-
-populateCacheForDep() {
-    local so="$1"
-    local rpath found
-    rpath="$(getRpathFromElfBinary "$so")" || return 1
-
-    for found in $(getDepsFromElfBinary "$so"); do
-        local rpathElem
-        for rpathElem in $rpath; do
-            # Ignore empty element or $ORIGIN magic variable which should be
-            # deterministically resolved by adding this package's library
-            # files early anyway.
-            #
-            # shellcheck disable=SC2016
-            # (Expressions don't expand in single quotes, use double quotes for
-            # that.)
-            if [[ -z "$rpathElem" || "$rpathElem" == *'$ORIGIN'* ]]; then
-                continue
-            fi
-
-            local soname="${found%.so*}"
-            local foundso=
-            for foundso in "$rpathElem/$soname".so*; do
-                addToDepCache "$foundso"
-            done
-
-            # Found in this element of the rpath, no need to check others.
-            if [ -n "$foundso" ]; then
-                break
-            fi
-        done
-    done
-
-    # Not found in any rpath element.
-    return 1
-}
-
-populateCacheWithRecursiveDeps() {
-    # Dependencies may add more to the end of this array, so we use a counter
-    # with while instead of a regular for loop here.
-    local -i i=0
-    while [ $i -lt ${#autoPatchelfCachedDeps[@]} ]; do
-        populateCacheForDep "${autoPatchelfCachedDeps[$i]}"
-        i=$i+1
-    done
-}
-
-getBinArch() {
-    $OBJDUMP -f "$1" 2> /dev/null | sed -ne 's/^architecture: *\([^,]\+\).*/\1/p'
-}
-
-# Returns the specific OS ABI for an ELF file in the format produced by
-# readelf(1), like "UNIX - System V" or "UNIX - GNU".
-getBinOsabi() {
-    $READELF -h "$1" 2> /dev/null | sed -ne 's/^[ \t]*OS\/ABI:[ \t]*\(.*\)/\1/p'
-}
-
-# Tests whether two OS ABIs are compatible, taking into account the generally
-# accepted compatibility of SVR4 ABI with other ABIs.
-areBinOsabisCompatible() {
-    local wanted="$1"
-    local got="$2"
-
-    if [[ -z "$wanted" || -z "$got" ]]; then
-        # One of the types couldn't be detected, so as a fallback we'll assume
-        # they're compatible.
-        return 0
-    fi
-
-    # Generally speaking, the base ABI (0x00), which is represented by
-    # readelf(1) as "UNIX - System V", indicates broad compatibility with other
-    # ABIs.
-    #
-    # TODO: This isn't always true. For example, some OSes embed ABI
-    # compatibility into SHT_NOTE sections like .note.tag and .note.ABI-tag.
-    # It would be prudent to add these to the detection logic to produce better
-    # ABI information.
-    if [[ "$wanted" == "UNIX - System V" ]]; then
-        return 0
-    fi
-
-    # Similarly here, we should be able to link against a superset of features,
-    # so even if the target has another ABI, this should be fine.
-    if [[ "$got" == "UNIX - System V" ]]; then
-        return 0
-    fi
-
-    # Otherwise, we simply return whether the ABIs are identical.
-    if [[ "$wanted" == "$got" ]]; then
-        return 0
-    fi
-
-    return 1
-}
-
-# NOTE: If you want to use this function outside of the autoPatchelf function,
-# keep in mind that the dependency cache is only valid inside the subshell
-# spawned by the autoPatchelf function, so invoking this directly will possibly
-# rebuild the dependency cache. See the autoPatchelf function below for more
-# information.
-findDependency() {
-    local filename="$1"
-    local arch="$2"
-    local osabi="$3"
-    local lib dep
-
-    if [ $depCacheInitialised -eq 0 ]; then
-        for lib in "${autoPatchelfLibs[@]}"; do
-            for so in "$lib/"*.so*; do addToDepCache "$so"; done
-        done
-        depCacheInitialised=1
-    fi
-
-    for dep in "${autoPatchelfCachedDeps[@]}"; do
-        if [ "$filename" = "${dep##*/}" ]; then
-            if [ "$(getBinArch "$dep")" = "$arch" ] && areBinOsabisCompatible "$osabi" "$(getBinOsabi "$dep")"; then
-                foundDependency="$dep"
-                return 0
-            fi
-        fi
-    done
-
-    # Populate the dependency cache with recursive dependencies *only* if we
-    # didn't find the right dependency so far and afterwards run findDependency
-    # again, but this time with $doneRecursiveSearch set to 1 so that it won't
-    # recurse again (and thus infinitely).
-    if [ $doneRecursiveSearch -eq 0 ]; then
-        populateCacheWithRecursiveDeps
-        doneRecursiveSearch=1
-        findDependency "$filename" "$arch" || return 1
-        return 0
-    fi
-    return 1
-}
-
-autoPatchelfFile() {
-    local dep rpath="" toPatch="$1"
-
-    local interpreter
-    interpreter="$(< "$NIX_BINTOOLS/nix-support/dynamic-linker")"
-
-    local interpreterArch interpreterOsabi toPatchArch toPatchOsabi
-    interpreterArch="$(getBinArch "$interpreter")"
-    interpreterOsabi="$(getBinOsabi "$interpreter")"
-    toPatchArch="$(getBinArch "$toPatch")"
-    toPatchOsabi="$(getBinOsabi "$toPatch")"
-
-    if [ "$interpreterArch" != "$toPatchArch" ]; then
-        # Our target architecture is different than this file's architecture,
-        # so skip it.
-        echo "skipping $toPatch because its architecture ($toPatchArch) differs from target ($interpreterArch)" >&2
-        return 0
-    elif ! areBinOsabisCompatible "$interpreterOsabi" "$toPatchOsabi"; then
-        echo "skipping $toPatch because its OS ABI ($toPatchOsabi) is not compatible with target ($interpreterOsabi)" >&2
-        return 0
-    fi
-
-    if isExecutable "$toPatch"; then
-        runPatchelf --set-interpreter "$interpreter" "$toPatch"
-        # shellcheck disable=SC2154
-        # (runtimeDependencies is referenced but not assigned.)
-        if [ -n "$runtimeDependencies" ]; then
-            for dep in $runtimeDependencies; do
-                rpath="$rpath${rpath:+:}$dep/lib"
-            done
-        fi
-    fi
-
-    local libcLib
-    libcLib="$(< "$NIX_BINTOOLS/nix-support/orig-libc")/lib"
-
-    echo "searching for dependencies of $toPatch" >&2
-
-    local missing
-    missing="$(getDepsFromElfBinary "$toPatch")" || return 0
-
-    # This ensures that we get the output of all missing dependencies instead
-    # of failing at the first one, because it's more useful when working on a
-    # new package where you don't yet know its dependencies.
-
-    for dep in $missing; do
-        if [[ "$dep" == /* ]]; then
-            # This is an absolute path. If it exists, just use it. Otherwise,
-            # we probably want this to produce an error when checked (because
-            # just updating the rpath won't satisfy it).
-            if [ -f "$dep" ]; then
-                continue
-            fi
-        elif [ -f "$libcLib/$dep" ]; then
-            # This library exists in libc, and will be correctly resolved by
-            # the linker.
-            continue
-        fi
-
-        echo -n "  $dep -> " >&2
-        if findDependency "$dep" "$toPatchArch" "$toPatchOsabi"; then
-            rpath="$rpath${rpath:+:}${foundDependency%/*}"
-            echo "found: $foundDependency" >&2
-        else
-            echo "not found!" >&2
-            autoPatchelfFailedDeps["$dep"]="$toPatch"
-        fi
-    done
-
-    if [ -n "$rpath" ]; then
-        echo "setting RPATH to: $rpath" >&2
-        runPatchelf --set-rpath "$rpath" "$toPatch"
-    fi
-}
-
 # Can be used to manually add additional directories with shared object files
 # to be included for the next autoPatchelf invocation.
 addAutoPatchelfSearchPath() {
     local -a findOpts=()
 
-    # XXX: Somewhat similar to the one in the autoPatchelf function, maybe make
-    #      it DRY someday...
     while [ $# -gt 0 ]; do
         case "$1" in
             --) shift; break;;
@@ -296,15 +28,19 @@ addAutoPatchelfSearchPath() {
         esac
     done
 
-    while IFS= read -r -d '' file; do
-        addToDepCache "$file"
+    local dir=
+    while IFS= read -r -d '' dir; do
+        extraAutoPatchelfLibs+=("$dir")
     done <  <(find "$@" "${findOpts[@]}" \! -type d \
-            \( -name '*.so' -o -name '*.so.*' \) -print0)
+            \( -name '*.so' -o -name '*.so.*' \) -print0 \
+            | sed -z 's#/[^/]*$##' \
+            | uniq -z
+        )
 }
 
+
 autoPatchelf() {
     local norecurse=
-
     while [ $# -gt 0 ]; do
         case "$1" in
             --) shift; break;;
@@ -317,47 +53,14 @@ autoPatchelf() {
         esac
     done
 
-    if [ $# -eq 0 ]; then
-        echo "autoPatchelf: No paths to patch specified." >&2
-        return 1
-    fi
-
-    echo "automatically fixing dependencies for ELF files" >&2
-
-    # Add all shared objects of the current output path to the start of
-    # autoPatchelfCachedDeps so that it's chosen first in findDependency.
-    addAutoPatchelfSearchPath ${norecurse:+--no-recurse} -- "$@"
-
-    while IFS= read -r -d $'\0' file; do
-      isELF "$file" || continue
-      segmentHeaders="$(LANG=C $READELF -l "$file")"
-      # Skip if the ELF file doesn't have segment headers (eg. object files).
-      # not using grep -q, because it can cause Broken pipe
-      grep -q '^Program Headers:' <<<"$segmentHeaders" || continue
-      if isExecutable "$file"; then
-          # Skip if the executable is statically linked.
-          grep -q "^ *INTERP\\>" <<<"$segmentHeaders" || continue
-      fi
-      # Jump file if patchelf is unable to parse it
-      # Some programs contain binary blobs for testing,
-      # which are identified as ELF but fail to be parsed by patchelf
-      patchelf "$file" || continue
-      autoPatchelfFile "$file"
-    done < <(find "$@" ${norecurse:+-maxdepth 1} -type f -print0)
-
-    # fail if any dependencies were not found and
-    # autoPatchelfIgnoreMissingDeps is not set
-    local depsMissing=0
-    for failedDep in "${!autoPatchelfFailedDeps[@]}"; do
-      echo "autoPatchelfHook could not satisfy dependency $failedDep wanted by ${autoPatchelfFailedDeps[$failedDep]}"
-      depsMissing=1
-    done
-    # shellcheck disable=SC2154
-    # (autoPatchelfIgnoreMissingDeps is referenced but not assigned.)
-    if [[ $depsMissing == 1 && -z "$autoPatchelfIgnoreMissingDeps" ]]; then
-      echo "Add the missing dependencies to the build inputs or set autoPatchelfIgnoreMissingDeps=true"
-      exit 1
-    fi
+    local runtimeDependenciesArray=($runtimeDependencies)
+    @pythonInterpreter@ @autoPatchelfScript@                            \
+        ${norecurse:+--no-recurse}                                      \
+        ${autoPatchelfIgnoreMissingDeps:+--ignore-missing}              \
+        --paths "$@"                                                    \
+        --libs "${autoPatchelfLibs[@]}"                                 \
+               "${extraAutoPatchelfLibs[@]}"                            \
+        --runtime-dependencies "${runtimeDependenciesArray[@]/%//lib}"
 }
 
 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index 604096135c2..fa606583289 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -51,7 +51,19 @@ makeWrapper() {
         local varName="$2"    # name of list variable to add to
         local separator="$3"  # character used to separate elements of list
         local value="$4"      # one value, or multiple values separated by `separator`, to add to list
-        if test -n "$value"; then
+
+        # Disable file globbing, since bash will otherwise try to find
+        # filenames matching the the value to be prefixed/suffixed if
+        # it contains characters considered wildcards, such as `?` and
+        # `*`. We want the value as is, except we also want to split
+        # it on on the separator; hence we can't quote it.
+        local reenableGlob=0
+        if [[ ! -o noglob ]]; then
+            reenableGlob=1
+        fi
+        set -o noglob
+
+        if [[ -n "$value" ]]; then
             local old_ifs=$IFS
             IFS=$separator
 
@@ -86,6 +98,10 @@ makeWrapper() {
             done
             IFS=$old_ifs
         fi
+
+        if (( reenableGlob )); then
+            set +o noglob
+        fi
     }
 
     mkdir -p "$(dirname "$wrapper")"
diff --git a/pkgs/development/compilers/go/1.16.nix b/pkgs/development/compilers/go/1.16.nix
index 46591d2369d..d503cf50ae9 100644
--- a/pkgs/development/compilers/go/1.16.nix
+++ b/pkgs/development/compilers/go/1.16.nix
@@ -168,6 +168,7 @@ stdenv.mkDerivation rec {
     ./creds-test.patch
     ./go-1.9-skip-flaky-19608.patch
     ./go-1.9-skip-flaky-20072.patch
+    ./skip-chown-tests-1.16.patch
     ./skip-external-network-tests-1.16.patch
     ./skip-nohup-tests.patch
     ./skip-cgo-tests-1.15.patch
diff --git a/pkgs/development/compilers/go/1.17.nix b/pkgs/development/compilers/go/1.17.nix
index 4b2a3d39a98..a7259358749 100644
--- a/pkgs/development/compilers/go/1.17.nix
+++ b/pkgs/development/compilers/go/1.17.nix
@@ -168,6 +168,7 @@ stdenv.mkDerivation rec {
     ./creds-test.patch
     ./go-1.9-skip-flaky-19608.patch
     ./go-1.9-skip-flaky-20072.patch
+    ./skip-chown-tests-1.16.patch
     ./skip-external-network-tests-1.16.patch
     ./skip-nohup-tests.patch
     ./skip-cgo-tests-1.15.patch
diff --git a/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch b/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch
new file mode 100644
index 00000000000..8007ba05f6e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch
@@ -0,0 +1,18 @@
+diff --git a/lib/Driver/Driver.cpp b/lib/Driver/Driver.cpp
+index 94a7553e273b..8a1d455950b2 100644
+--- a/lib/Driver/Driver.cpp
++++ b/lib/Driver/Driver.cpp
+@@ -412,6 +412,13 @@ DerivedArgList *Driver::TranslateInputArgs(const InputArgList &Args) const {
+   }
+ #endif
+ 
++  {
++    Arg *A = DAL->MakeFlagArg(/*BaseArg=*/nullptr,
++                              Opts.getOption(options::OPT_nostdlibinc));
++    A->claim();
++    DAL->append(A);
++  }
++
+   return DAL;
+ }
+ 
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index 6c227f1ae72..62b9e0470a6 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -42,6 +42,7 @@ let
       # mis-compilation in firefox.
       # See: https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
       ./revert-malloc-alignment-assumption.patch
+      ./add-nostdlibinc-flag.patch
       (substituteAll {
         src = ../../clang-11-12-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
@@ -51,10 +52,6 @@ let
     postPatch = ''
       (cd tools && ln -s ../../clang-tools-extra extra)
 
-      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
-             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
-             lib/Driver/ToolChains/*.cpp
-
       # Patch for standalone doc building
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '' + lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 1bcbd2bb4b5..02ecf8d25b1 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -191,7 +191,6 @@ in with passthru; stdenv.mkDerivation {
 
   prePatch = optionalString stdenv.isDarwin ''
     substituteInPlace configure --replace '`/usr/bin/arch`' '"i386"'
-    substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '' + optionalString (pythonOlder "3.9" && stdenv.isDarwin && x11Support) ''
     # Broken on >= 3.9; replaced with ./3.9/darwin-tcl-tk.patch
     substituteInPlace setup.py --replace /Library/Frameworks /no-such-path
@@ -342,8 +341,6 @@ in with passthru; stdenv.mkDerivation {
       substituteInPlace ./setup.py --replace $i /no-such-path
     done
   '' + optionalString stdenv.isDarwin ''
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -msse2"
-    export MACOSX_DEPLOYMENT_TARGET=10.6
     # Override the auto-detection in setup.py, which assumes a universal build
     export PYTHON_DECIMAL_WITH_MACHINE=${if stdenv.isAarch64 then "uint128" else "x64"}
   '' + optionalString (isPy3k && pythonOlder "3.7") ''
diff --git a/pkgs/development/libraries/aws-checksums/default.nix b/pkgs/development/libraries/aws-checksums/default.nix
index 9042dc56154..058e4ea6a5f 100644
--- a/pkgs/development/libraries/aws-checksums/default.nix
+++ b/pkgs/development/libraries/aws-checksums/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-checksums";
-  version = "0.1.11";
+  version = "0.1.12";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fXu7GI2UR9QiBGP2n2pEFRjz9ZwA+BAK9zxhNnoYWt4=";
+    sha256 = "sha256-k3hIGk92HncRAktpuvNcZnaBZiLj63/wQBz2WScUjhQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index cd971b291b9..7ea8ce6d29b 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -5,10 +5,11 @@
 , pkg-config
 , zlib
 , libpng
-, libjpeg ? null
-, libwebp ? null
-, libtiff ? null
-, libXpm ? null
+, libjpeg
+, libwebp
+, libtiff
+, libXpm
+, libavif
 , fontconfig
 , freetype
 }:
@@ -41,8 +42,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake pkg-config ];
 
-  buildInputs = [ zlib fontconfig freetype ];
-  propagatedBuildInputs = [ libpng libjpeg libwebp libtiff libXpm ];
+  buildInputs = [ zlib fontconfig freetype libpng libjpeg libwebp libtiff libXpm libavif ];
 
   outputs = [ "bin" "dev" "out" ];
 
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 83df37f236b..e1a3def0ba4 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gdbm";
-  version = "1.20";
+  version = "1.23";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${pname}-${version}.tar.gz";
-    sha256 = "sha256-OurAVkizSCoQotqYa586OAoprWUL6AuYF6Q1+4EUopI=";
+    sha256 = "sha256-dLEIHSH/8TrkvXwW5dblBKTCb3zeHcoNljpIQXS7ys0=";
   };
 
   doCheck = true; # not cross;
diff --git a/pkgs/development/libraries/glibc/2.33-master.patch.gz b/pkgs/development/libraries/glibc/2.33-master.patch.gz
index 49ffd4a7441..777e94e2b2e 100644
--- a/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.33-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 9a84a5f8167..ffec9972d28 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -44,7 +44,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-108";
+  patchSuffix = "-117";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-108-g3e2a15c666
+          glibc-2.33-117-g55446dd8a2
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 1e36f1e7f0f..e47b18252e9 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -24,7 +24,7 @@
 }:
 
 let
-  version = "3.2.0";
+  version = "3.3.2";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     owner = "harfbuzz";
     repo = "harfbuzz";
     rev = version;
-    sha256 = "sha256-iNYp/hyJTaaF6e09YpUL7ktBhq2wRN9zKiEH59WLbYU=";
+    sha256 = "sha256-UbYqV7Ch9ugTIwSsCpjnS8H7tcv4P3OVpFDFDZtQCk0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index b600a2ca4c3..14579bc5915 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.12";
+  version = "2.13.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    sha256 = "sha256-GGY5hehkEARVrD5QdiXEOMNxA1TYXly7fNQEPhH+EPU=";
+    sha256 = "sha256-1HPnlueyfFrwG9bRVS1CtFtDRX5xgs6ZA/OLt0ggO4g=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 2a1d53e6ee0..1cc6fe6f521 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -12,13 +12,13 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   pname = "libarchive";
-  version = "3.5.2";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${version}";
-    sha256 = "sha256-H00UJ+ON1kBc19BgWBBKmO8f23oAg2mk7o9hhDhn50Q=";
+    sha256 = "sha256-u6Zeu9yTjhx5U7KZVUkuuUsQPjWN71mE5egG4T+FGfY=";
   };
 
   outputs = [ "out" "lib" "dev" ];
diff --git a/pkgs/development/libraries/libgee/default.nix b/pkgs/development/libraries/libgee/default.nix
index 1a40d1f17b4..b34790d59c7 100644
--- a/pkgs/development/libraries/libgee/default.nix
+++ b/pkgs/development/libraries/libgee/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgee";
-  version = "0.20.4";
+  version = "0.20.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "03nyf8n7i7f67fsh220g52slmihdk1lv4iwspm7xmkgrj3rink2j";
+    sha256 = "MYY6iVfVpyf5BnSVyr8KCIn6XT1EYm5UCUMxGI1cFRg=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index aeb3fcba06f..2293dfc00a0 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -11,7 +11,7 @@ let
   whenPatched = lib.optionalString apngSupport;
 
 in stdenv.mkDerivation rec {
-  name = "libpng" + whenPatched "-apng" + "-${version}";
+  pname = "libpng" + whenPatched "-apng";
   version = "1.6.37";
 
   src = fetchurl {
diff --git a/pkgs/development/libraries/libsigsegv/default.nix b/pkgs/development/libraries/libsigsegv/default.nix
index bc36a12eea8..84c2f19e5e2 100644
--- a/pkgs/development/libraries/libsigsegv/default.nix
+++ b/pkgs/development/libraries/libsigsegv/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsigsegv";
-  version = "2.13";
+  version = "2.14";
 
   src = fetchurl {
     url = "mirror://gnu/libsigsegv/libsigsegv-${version}.tar.gz";
-    sha256 = "sha256-vnjuQXawX3x1/wMpjYSHTbkPS2ydVQPw2hIms6PEgRk=";
+    sha256 = "sha256-zaw5QYAzZM+BqQhJm+t5wgDq1gtrW0DK0ST9HgbKopU=";
   };
 
   patches = if enableSigbusFix then [ ./sigbus_fix.patch ] else null;
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 5f34a80d253..a724d5f7fec 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 
 , autoreconfHook
 , pkg-config
@@ -27,6 +28,11 @@ stdenv.mkDerivation rec {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2022-22844.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64.patch";
+      sha256 = "0cfih55f5qpc84mvlwsffik80bgz6drkflkhrdyqq8m84jw3mbwb";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libxkbcommon/default.nix b/pkgs/development/libraries/libxkbcommon/default.nix
index 25d2d89add0..7bcc62af6ec 100644
--- a/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/pkgs/development/libraries/libxkbcommon/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libxkbcommon";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "https://xkbcommon.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0d4jzq0zv1xmng0z0q5lb4rz03ikgxdwi68k3r70ac16gb911ixk";
+    sha256 = "0ca00awfzvxiznvd4mgwgxyqxiwvi07j5xxmg5z0l47rcd9fqv0h";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/neon/default.nix b/pkgs/development/libraries/neon/default.nix
index a39ece28aae..1521c1a6389 100644
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@@ -14,12 +14,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "0.31.2";
+  version = "0.32.2";
   pname = "neon";
 
   src = fetchurl {
     url = "https://notroj.github.io/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0y46dbhiblcvg8k41bdydr3fivghwk73z040ki5825d24ynf67ng";
+    sha256 = "sha256-mGVmRoxilfxdD7FBpZgeMcn4LuOOk4N0q+2Ece8vsoY=";
   };
 
   patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index e92b3dec07b..d17f4c4a783 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -27,7 +27,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.74";
+  version = "3.75";
 
 in
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
+    sha256 = "10l5qn68gly2l4ifv0v6by1qc8nsmhra08nm9m7n913jh83iamzx";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index 93fc495d385..42ae370cd90 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ffav46pz3sbj92nipd62z03fibyqgclfq9w8lgr80s6za6zdk5s";
+    sha256 = "sha256-l64xP39Uaislqh4D7oSxJiQGhXkklol4LgS9BVPbaGk=";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 76c4237dcaf..8bf6386c4c6 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,8 +1,8 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "7edec6e014de27b9dd03f63875c471aac606a918",
-    "sha256": "0qv4vhciigqd8bnqzrs7y71ls7jx1p9cal2rh78m42qgskk1ci59"
+    "rev": "dba14d48611b9e9d59576172658779ab4a39b416",
+    "sha256": "1w2m1rm6mhj9qbanak36rqvc30x495zvj7mh2syy1yd29by0g5i8"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "c9fde86b0a2440133bc08f4811b6ca793be47f0a",
-    "sha256": "1fqhdkv3sp3nbzqi2a5wvxn5d4v0xcrq2bl609bdyj4nx367a8wp"
+    "rev": "d16bf02a11953dcac01dca73e6f3778f293adefe",
+    "sha256": "0rpyd5r60707lzfmfi3y501c7is1gzhh30bframsy8bwglck2hjj"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -26,8 +26,8 @@
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "69a87a9b831e36a578594a0a13130c384ad03121",
-    "sha256": "0ph07rdf9qfxnw3z2nqbmh6na65z0p2snmlzdw80amd7s0g255kw"
+    "rev": "5e9ca5d36d65dadb98ef90013a1dcf15fbd7ae26",
+    "sha256": "1lpiq3svlnj8f8apd12if11sng7k0l8y6vhr317srzz4dd77cfry"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "55324650f9e759a43dce927f823c9858574106c3",
-    "sha256": "0cxz4pqvb8l0wqpc4hr0xmc72csqf7dpbbzdqgil9nyyg21ihkz0"
+    "rev": "1d49a5b678957adde7e2db23a485a3f48157bc8f",
+    "sha256": "1wdpgh23mdn0nny9c837iyg9kszc3m4cdmaanf8glymkzn0rkd8w"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -101,8 +101,8 @@
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "be66bf9a5618c745d2a6ee2262967af6307b3b07",
-    "sha256": "11h3f3rb2kqgsw7njzhjwazw1k03v12i83irjndylafiaqw6c6ks"
+    "rev": "d8d6b14b9907adbc6ce307d52be34aaa761a58fa",
+    "sha256": "15c7nrvvn7qc3l7kdbl5wdpazqwv8zvg1aij2jvcrhbymn0zl3mc"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@@ -146,8 +146,8 @@
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "24128cdf8bef53eddf31a5709bbbc46293006b1c",
-    "sha256": "0vinjcbq4saxhlmvb5i93bzgg30qc3j8r2qfwrzaxc4vmfhfgi56"
+    "rev": "728012f7762ecd5762d493f8796907c6456f31e7",
+    "sha256": "1ldizgybl4fp95xlzf103hqmsqdmr3jbx048jyxcb5gjd3pbwh7p"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
@@ -161,18 +161,18 @@
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "353b75b2e34bdae901625bbddf5c5e3f3e6c0de5",
-    "sha256": "12nv773zc05yrbai1z6i481yinih0kxcjzgm9pa0580qz69gd9a5"
+    "rev": "98d1fd864cbb6c7c012c4139118808af110fb8f0",
+    "sha256": "07xjmhca7z5bva03zk73d948qz0a3wnn4kvyy6j4cnp3w5giz5kc"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "992833ca741efe8f533c61abfaf129a1d8bfcfee",
-    "sha256": "1w8mq38k6s0fncqv113bw1pc7g10ysfmsbyg23hxh9fr5q4ia4q7"
+    "rev": "214f7ab9d3384a4123f14d9f6cd0205cf0aaa794",
+    "sha256": "1qd64w5c16gmpgi936dfjc0pn1a1rbs752k8lfqv2xwysx7qkqwi"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "47be9a51b01d9fd9e7f6dca81e98d4eedcec6d38",
-    "sha256": "167rp43c86xr4grzxs4bl46y6sf1q9xa0641mgp4r94g2ipxyc1d"
+    "rev": "fa8b07105b5e274daaa8adcc129fa4aa0447f9f7",
+    "sha256": "0mggqa8kixknbm1p5i5lkrmkj1na3b2xflj011dkjbj8wb78i42n"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
@@ -181,8 +181,8 @@
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "e7883bc64440b1ff4666272ac6eb710ee4bc221b",
-    "sha256": "1rj99y1f0wn6g1m2k53xkni5v79zgq25yv8b9wx2bz0n2r9iasca"
+    "rev": "b13b56904b76e96ea52d0efe56395acc94b17d96",
+    "sha256": "047asrq7c44v7cn2d7c5zba47qzpsb6nidba77i2xn7gqlfv6z3b"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
diff --git a/pkgs/development/libraries/wxwidgets/3.1/default.nix b/pkgs/development/libraries/wxwidgets/3.1/default.nix
deleted file mode 100644
index cab0197c939..00000000000
--- a/pkgs/development/libraries/wxwidgets/3.1/default.nix
+++ /dev/null
@@ -1,138 +0,0 @@
-{ lib, stdenv
-, fetchFromGitHub
-, fetchurl
-, pkg-config
-, libXinerama
-, libSM
-, libXxf86vm
-, libXtst
-, gtk2
-, GConf ? null
-, gtk3
-, xorgproto
-, gst_all_1
-, setfile
-, libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, withMesa ? libGLSupported
-, libGLU ? null
-, libGL ? null
-, compat28 ? false
-, compat30 ? true
-, unicode ? true
-, withGtk2 ? true
-, withWebKit ? false
-, webkitgtk ? null
-, AGL ? null
-, Carbon ? null
-, Cocoa ? null
-, Kernel ? null
-, QTKit ? null
-}:
-
-with lib;
-
-assert withMesa -> libGLU != null && libGL != null;
-assert withWebKit -> webkitgtk != null;
-
-assert assertMsg (withGtk2 -> withWebKit == false) "wxGTK31: You cannot enable withWebKit when using withGtk2.";
-
-stdenv.mkDerivation rec {
-  version = "3.1.4";
-  pname = "wxwidgets";
-
-  src = fetchFromGitHub {
-    owner = "wxWidgets";
-    repo = "wxWidgets";
-    rev = "v${version}";
-    sha256 = "1fwzrk6w5k0vs8kqdq5lpzdbp5c09hx740wg6mi6vgmc1r67dv67";
-    fetchSubmodules = true;
-  };
-
-  buildInputs = [
-    libXinerama
-    libSM
-    libXxf86vm
-    libXtst
-    xorgproto
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-  ] ++ optionals withGtk2 [ gtk2 GConf ]
-  ++ optional (!withGtk2) gtk3
-  ++ optional withMesa libGLU
-  ++ optional withWebKit webkitgtk
-  ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  propagatedBuildInputs = optional stdenv.isDarwin AGL;
-
-  patches = [
-    (fetchurl {
-      # https://trac.wxwidgets.org/ticket/17942
-      url = "https://trac.wxwidgets.org/raw-attachment/ticket/17942/"
-        + "fix_assertion_using_hide_in_destroy.diff";
-      sha256 = "009y3dav79wiig789vkkc07g1qdqprg1544lih79199kb1h64lvy";
-    })
-  ];
-
-  configureFlags =
-    [
-      "--disable-precomp-headers"
-      "--enable-mediactrl"
-      (if compat28 then "--enable-compat28" else "--disable-compat28")
-      (if compat30 then "--enable-compat30" else "--disable-compat30")
-    ]
-    ++ optional unicode "--enable-unicode"
-    ++ optional withMesa "--with-opengl"
-    ++ optionals stdenv.isDarwin
-      # allow building on 64-bit
-      [ "--with-cocoa" "--enable-universal-binaries" "--with-macosx-version-min=10.7" ]
-    ++ optionals withWebKit
-      [ "--enable-webview" "--enable-webviewwebkit" ];
-
-  SEARCH_LIB = "${libGLU.out}/lib ${libGL.out}/lib ";
-
-  preConfigure = "
-    substituteInPlace configure --replace 'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
-    substituteInPlace configure --replace 'SEARCH_LIB=' 'DUMMY_SEARCH_LIB='
-    substituteInPlace configure --replace /usr /no-such-path
-  " + optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace \
-      'ac_cv_prog_SETFILE="/Developer/Tools/SetFile"' \
-      'ac_cv_prog_SETFILE="${setfile}/bin/SetFile"'
-    substituteInPlace configure --replace \
-      "-framework System" \
-      -lSystem
-  '';
-
-  postInstall = "
-    (cd $out/include && ln -s wx-*/* .)
-  ";
-
-  passthru = {
-    inherit compat28 compat30 unicode;
-    gtk = if withGtk2 then gtk2 else gtk3;
-  };
-
-  enableParallelBuilding = true;
-
-  meta = {
-    platforms = with platforms; darwin ++ linux;
-    license = licenses.wxWindows;
-    homepage = "https://www.wxwidgets.org/";
-    description = "A C++ library that lets developers create applications for Windows, macOS, Linux and other platforms with a single code base";
-    longDescription = ''
-      WxWidgets gives you a single, easy-to-use API for
-      writing GUI applications on multiple platforms that still utilize the
-      native platform's controls and utilities. Link with the appropriate library
-      for your platform and compiler, and your application will adopt the look
-      and feel appropriate to that platform. On top of great GUI functionality,
-      wxWidgets gives you: online help, network programming, streams, clipboard
-      and drag and drop, multithreading, image loading and saving in a variety of
-      popular formats, database support, HTML viewing and printing, and much
-      more.
-    '';
-    badPlatforms = [ "x86_64-darwin" ];
-    maintainers = with maintainers; [ tfmoraes ];
-  };
-}
diff --git a/pkgs/development/libraries/wxwidgets/2.8/default.nix b/pkgs/development/libraries/wxwidgets/wxGTK28.nix
index bc8fc6f5b04..bc8fc6f5b04 100644
--- a/pkgs/development/libraries/wxwidgets/2.8/default.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK28.nix
diff --git a/pkgs/development/libraries/wxwidgets/2.9/default.nix b/pkgs/development/libraries/wxwidgets/wxGTK29.nix
index 46ef04dcb7a..4a33d9263ed 100644
--- a/pkgs/development/libraries/wxwidgets/2.9/default.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK29.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # https://github.com/wxWidgets/wxWidgets/issues/17942
-    ../0001-fix-assertion-using-hide-in-destroy.patch
+    ./0001-fix-assertion-using-hide-in-destroy.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/wxwidgets/3.0/default.nix b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
index 0469ccbd0df..5b15d189a13 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/default.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
@@ -12,8 +12,8 @@
 , pkg-config
 , xorgproto
 , withMesa ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, compat24 ? false
-, compat26 ? true
+, compat26 ? false
+, compat28 ? true
 , unicode ? true
 , withGtk2 ? true
 , withWebKit ? false, webkitgtk
@@ -66,14 +66,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     # https://github.com/wxWidgets/wxWidgets/issues/17942
-    ../0001-fix-assertion-using-hide-in-destroy.patch
+    ./0001-fix-assertion-using-hide-in-destroy.patch
   ];
 
   configureFlags = [
     "--disable-precomp-headers"
     "--enable-mediactrl"
-    (if compat24 then "--enable-compat24" else "--disable-compat24")
     (if compat26 then "--enable-compat26" else "--disable-compat26")
+    (if compat28 then "--enable-compat28" else "--disable-compat28")
   ]
   ++ lib.optional unicode "--enable-unicode"
   ++ lib.optional withMesa "--with-opengl"
@@ -133,6 +133,6 @@ stdenv.mkDerivation rec {
 
   passthru = {
     inherit gtk;
-    inherit compat24 compat26 unicode;
+    inherit compat26 compat28 unicode;
   };
 }
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK31.nix b/pkgs/development/libraries/wxwidgets/wxGTK31.nix
new file mode 100644
index 00000000000..ae6f3e6a0c9
--- /dev/null
+++ b/pkgs/development/libraries/wxwidgets/wxGTK31.nix
@@ -0,0 +1,149 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchurl
+, gnome2
+, gst_all_1
+, gtk2
+, gtk3
+, libGL
+, libGLU
+, libSM
+, libXinerama
+, libXtst
+, libXxf86vm
+, pkg-config
+, xorgproto
+, compat28 ? false
+, compat30 ? true
+, unicode ? true
+, withGtk2 ? true
+, withMesa ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
+, withWebKit ? false, webkitgtk
+, darwin
+}:
+
+assert withMesa -> libGLU != null && libGL != null;
+assert withWebKit -> webkitgtk != null;
+
+assert withGtk2 -> (!withWebKit);
+
+let
+  inherit (darwin.stubs) setfile;
+  inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  inherit (gnome2) GConf;
+  inherit (gst_all_1) gst-plugins-base gstreamer;
+  gtk = if withGtk2 then gtk2 else gtk3;
+in
+stdenv.mkDerivation rec {
+  pname = "wxwidgets";
+  version = "3.1.5";
+
+  src = fetchFromGitHub {
+    owner = "wxWidgets";
+    repo = "wxWidgets";
+    rev = "v${version}";
+    hash = "sha256-2zMvcva0GUDmSYK0Wk3/2Y6R3F7MgdqGBrOhmWgVA6g=";
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    # https://github.com/wxWidgets/wxWidgets/issues/17942
+    ./0001-fix-assertion-using-hide-in-destroy.patch
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    gst-plugins-base
+    gstreamer
+    gtk
+    libSM
+    libXinerama
+    libXtst
+    libXxf86vm
+    xorgproto
+  ]
+  ++ lib.optionals withGtk2 [
+    GConf
+  ]
+  ++ lib.optional withMesa libGLU
+  ++ lib.optional withWebKit webkitgtk
+  ++ lib.optionals stdenv.isDarwin [
+    Carbon
+    Cocoa
+    Kernel
+    QTKit
+    setfile
+  ];
+
+  propagatedBuildInputs = lib.optional stdenv.isDarwin AGL;
+
+  configureFlags = [
+    "--disable-precomp-headers"
+    "--enable-mediactrl"
+    (if compat28 then "--enable-compat28" else "--disable-compat28")
+    (if compat30 then "--enable-compat30" else "--disable-compat30")
+  ]
+  ++ lib.optional unicode "--enable-unicode"
+  ++ lib.optional withMesa "--with-opengl"
+  ++ lib.optionals stdenv.isDarwin [
+    # allow building on 64-bit
+    "--enable-universal-binaries"
+    "--with-cocoa"
+    "--with-macosx-version-min=10.7"
+  ]
+  ++ lib.optionals withWebKit [
+    "--enable-webview"
+    "--enable-webviewwebkit"
+  ];
+
+  SEARCH_LIB = "${libGLU.out}/lib ${libGL.out}/lib ";
+
+  preConfigure = ''
+    substituteInPlace configure --replace \
+      'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
+    substituteInPlace configure --replace \
+      'SEARCH_LIB=' 'DUMMY_SEARCH_LIB='
+    substituteInPlace configure --replace \
+      /usr /no-such-path
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure --replace \
+      'ac_cv_prog_SETFILE="/Developer/Tools/SetFile"' \
+      'ac_cv_prog_SETFILE="${setfile}/bin/SetFile"'
+    substituteInPlace configure --replace \
+      "-framework System" "-lSystem"
+  '';
+
+  postInstall = "
+    pushd $out/include
+    ln -s wx-*/* .
+    popd
+  ";
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://www.wxwidgets.org/";
+    description = "A Cross-Platform C++ GUI Library";
+    longDescription = ''
+      wxWidgets gives you a single, easy-to-use API for writing GUI applications
+      on multiple platforms that still utilize the native platform's controls
+      and utilities. Link with the appropriate library for your platform and
+      compiler, and your application will adopt the look and feel appropriate to
+      that platform. On top of great GUI functionality, wxWidgets gives you:
+      online help, network programming, streams, clipboard and drag and drop,
+      multithreading, image loading and saving in a variety of popular formats,
+      database support, HTML viewing and printing, and much more.
+    '';
+    license = licenses.wxWindows;
+    maintainers = with maintainers; [ AndersonTorres tfmoraes ];
+    platforms = platforms.unix;
+    badPlatforms = platforms.darwin; # ofBorg is failing, don't know if internal
+  };
+
+  passthru = {
+    inherit gtk;
+    inherit compat28 compat30 unicode;
+  };
+}
diff --git a/pkgs/development/libraries/wxwidgets/3.0/mac.nix b/pkgs/development/libraries/wxwidgets/wxmac30.nix
index e1f732929ce..e1f732929ce 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/mac.nix
+++ b/pkgs/development/libraries/wxwidgets/wxmac30.nix
diff --git a/pkgs/development/python-modules/aiosignal/default.nix b/pkgs/development/python-modules/aiosignal/default.nix
index 1fd619a846a..9d815dfac05 100644
--- a/pkgs/development/python-modules/aiosignal/default.nix
+++ b/pkgs/development/python-modules/aiosignal/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aiosignal";
-  version = "1.2.0"; # re-enable tests after 1.2.0
+  version = "1.2.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     frozenlist
   ];
 
-  # not compatible w ith latest asyncio
-  doCheck = false;
   checkInputs = [
     pytest-asyncio
     pytestCheckHook
@@ -32,6 +30,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pytest.ini \
+      --replace "filterwarnings = error" "" \
       --replace "--cov=aiosignal" ""
   '';
 
diff --git a/pkgs/development/python-modules/async_generator/default.nix b/pkgs/development/python-modules/async_generator/default.nix
index fb7dec6d6ed..6f6da10a87f 100644
--- a/pkgs/development/python-modules/async_generator/default.nix
+++ b/pkgs/development/python-modules/async_generator/default.nix
@@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy35, pytest, pytest-asyncio }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pytest-asyncio
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "async-generator";
@@ -12,17 +18,17 @@ buildPythonPackage rec {
     sha256 = "6ebb3d106c12920aaae42ccb6f787ef5eefdcdd166ea3d628fa8476abe712144";
   };
 
-  # no longer compatible with pytest-asyncio
-  doCheck = false;
-  checkInputs = [ pytest pytest-asyncio ];
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
-  checkPhase = ''
-    pytest -W error -ra -v --pyargs async_generator
-  '';
+  pythonImportsCheck = [ "async_generator" ];
 
   meta = with lib; {
     description = "Async generators and context managers for Python 3.5+";
     homepage = "https://github.com/python-trio/async_generator";
     license = with licenses; [ mit asl20 ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/cchardet/default.nix b/pkgs/development/python-modules/cchardet/default.nix
index e1c27d9e4fb..587d0d1f6c1 100644
--- a/pkgs/development/python-modules/cchardet/default.nix
+++ b/pkgs/development/python-modules/cchardet/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , python
@@ -20,9 +21,14 @@ buildPythonPackage rec {
 
   checkInputs = [ nose ];
 
+  # on non x86-64 some charsets are identified as their superset, so we skip these tests (last checked with version 2.1.7)
   preCheck = ''
     cp -R src/tests $TMPDIR
     pushd $TMPDIR
+  '' + lib.optionalString (stdenv.hostPlatform.system != "x86_64-linux") ''
+    rm $TMPDIR/tests/testdata/th/tis-620.txt  # identified as iso-8859-11, which is fine for all practical purposes
+    rm $TMPDIR/tests/testdata/ga/iso-8859-1.txt  # identified as windows-1252, which is fine for all practical purposes
+    rm $TMPDIR/tests/testdata/fi/iso-8859-1.txt  # identified as windows-1252, which is fine for all practical purposes
   '';
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/django/2.nix b/pkgs/development/python-modules/django/2.nix
index c4df27beaaa..727bf304fdb 100644
--- a/pkgs/development/python-modules/django/2.nix
+++ b/pkgs/development/python-modules/django/2.nix
@@ -5,13 +5,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Django";
+  pname = "django";
   version = "2.2.27";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Django";
+    inherit version;
     sha256 = "sha256-HuNwRrC/K2HoOzoB0GcyNRbsO28rF81JsTJt1LqdyRM=";
   };
 
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index 3ed7024c349..1538b8a82b4 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -12,13 +12,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Django";
+  pname = "django";
   version = "3.2.12";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Django";
+    inherit version;
     sha256 = "sha256-l3Lmk1cD5Z6ZOWCDLWamFM8CM6HFEjvGIk7MataeQeI=";
   };
 
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index 7c8f520647e..096279b3453 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -57,6 +57,8 @@ buildPythonPackage rec {
     "test_hosts_no_network"
     "test_leakage_from_tracebacks"
     "test_patcher_existing_locks_locked"
+    # broken with pyopenssl 22.0.0
+    "test_sendall_timeout"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/iniconfig/default.nix b/pkgs/development/python-modules/iniconfig/default.nix
index 90761f76f9d..a8a4a611fee 100644
--- a/pkgs/development/python-modules/iniconfig/default.nix
+++ b/pkgs/development/python-modules/iniconfig/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, setuptools-scm }:
 
 buildPythonPackage rec {
   pname = "iniconfig";
@@ -9,12 +9,14 @@ buildPythonPackage rec {
     sha256 = "bc3af051d7d14b2ee5ef9969666def0cd1a000e121eaea580d4a313df4b37f32";
   };
 
+  nativeBuildInputs = [ setuptools-scm ];
+
   doCheck = false; # avoid circular import with pytest
   pythonImportsCheck = [ "iniconfig" ];
 
   meta = with lib; {
     description = "brain-dead simple parsing of ini files";
-    homepage = "https://github.com/RonnyPfannschmidt/iniconfig";
+    homepage = "https://github.com/pytest-dev/iniconfig";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
   };
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index cee9868cfac..c1c0b049dc8 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -76,6 +76,11 @@ buildPythonPackage rec {
     testpath
   ];
 
+  disabledTests = lib.optionals (stdenv.isDarwin) [
+    # FileNotFoundError: [Errno 2] No such file or directory: 'pbpaste'
+    "test_clipboard_get"
+  ];
+
   meta = with lib; {
     description = "IPython: Productive Interactive Computing";
     homepage = "http://ipython.org/";
diff --git a/pkgs/development/python-modules/jedi/default.nix b/pkgs/development/python-modules/jedi/default.nix
index d9884ab3d9f..f271920706f 100644
--- a/pkgs/development/python-modules/jedi/default.nix
+++ b/pkgs/development/python-modules/jedi/default.nix
@@ -3,9 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, colorama
 , django
-, docopt
 , pytestCheckHook
 , parso
 }:
@@ -26,9 +24,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ parso ];
 
   checkInputs = [
-    colorama
     django
-    docopt
     pytestCheckHook
   ];
 
@@ -50,7 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/davidhalter/jedi";
     description = "An autocompletion tool for Python that can be used for text editors";
-    license = licenses.lgpl3Plus;
+    license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index a998e7b74b4..1d9d0774379 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -264,6 +264,8 @@ buildPythonPackage rec {
     "test_state_machine_creation_fails_with_invalid_names"
     # needs graphql
     "test_get_schema_creation_status"
+    # only appears in aarch64 currently, but best to be safe
+    "test_state_machine_list_executions_with_filter"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 57b085a5405..4ecb138615c 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -5,13 +5,13 @@
 
 import ./generic.nix (rec {
   pname = "Pillow";
-  version = "9.0.0";
+  version = "9.0.1";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0gjry0yqryd2678sm47jhdnbghzxn5wk8pgyaqwr4qi7x5ijjvpf";
+    sha256 = "bIvII4p9/a96dfXsWmY/QXP4w2flo5+H5yBJXh7tdfo=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index f2e86599148..2be8928f630 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.4.1";
+  version = "2.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ce1dwE2g/7o91NPkmlM0uv0eMB7WzFCExV/8ZCAn22Y=";
+    sha256 = "sha256-fppwtY8VX8IQ96H930xItO7mS8LlxxHgBcKlwIL5P2E=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 16bfddc8340..e4655082af9 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -6,17 +6,50 @@
 , cryptography
 , pyasn1
 , idna
-, pytest
+, pytestCheckHook
 , pretend
 , flaky
 , glibcLocales
 , six
 }:
 
-let
-  # https://github.com/pyca/pyopenssl/issues/791
-  # These tests, we disable in the case that libressl is passed in as openssl.
-  failingLibresslTests = [
+buildPythonPackage rec {
+  pname = "pyopenssl";
+  version = "22.0.0";
+
+  src = fetchPypi {
+    pname = "pyOpenSSL";
+    inherit version;
+    sha256 = "sha256-ZgsbFCWqxKG+odlBaKhdmfCzFEyGndQ5DSdinQCH8b8=";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
+  # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
+  doCheck = !stdenv.isDarwin;
+
+  nativeBuildInputs = [ openssl ];
+  propagatedBuildInputs = [ cryptography pyasn1 idna six ];
+
+  checkInputs = [ pytestCheckHook pretend flaky glibcLocales ];
+
+  preCheck = ''
+    export LANG="en_US.UTF-8"
+  '';
+
+  disabledTests = [
+    # https://github.com/pyca/pyopenssl/issues/692
+    # These tests, we disable always.
+    "test_set_default_verify_paths"
+    "test_fallback_default_verify_paths"
+    # https://github.com/pyca/pyopenssl/issues/768
+    "test_wantWriteError"
+    # https://github.com/pyca/pyopenssl/issues/1043
+    "test_alpn_call_failure"
+  ] ++ lib.optionals (lib.hasPrefix "libressl" openssl.meta.name) [
+    # https://github.com/pyca/pyopenssl/issues/791
+    # These tests, we disable in the case that libressl is passed in as openssl.
     "test_op_no_compression"
     "test_npn_advertise_error"
     "test_npn_select_error"
@@ -29,66 +62,21 @@ let
     "test_verify_with_revoked"
     "test_set_notAfter"
     "test_set_notBefore"
-  ];
-
-  # these tests are extremely tightly wed to the exact output of the openssl cli tool,
-  # including exact punctuation.
-  failingOpenSSL_1_1Tests = [
+  ] ++ lib.optionals (lib.versionAtLeast (lib.getVersion openssl.name) "1.1") [
+    # these tests are extremely tightly wed to the exact output of the openssl cli tool, including exact punctuation.
     "test_dump_certificate"
     "test_dump_privatekey_text"
     "test_dump_certificate_request"
     "test_export_text"
-  ];
-
-  disabledTests = [
-    # https://github.com/pyca/pyopenssl/issues/692
-    # These tests, we disable always.
-    "test_set_default_verify_paths"
-    "test_fallback_default_verify_paths"
-    # https://github.com/pyca/pyopenssl/issues/768
-    "test_wantWriteError"
-    # https://github.com/pyca/pyopenssl/issues/1043
-    "test_alpn_call_failure"
-  ] ++ (
-    lib.optionals (lib.hasPrefix "libressl" openssl.meta.name) failingLibresslTests
-  ) ++ (
-    lib.optionals (lib.versionAtLeast (lib.getVersion openssl.name) "1.1") failingOpenSSL_1_1Tests
-  ) ++ (
+  ] ++ lib.optionals stdenv.is32bit [
     # https://github.com/pyca/pyopenssl/issues/974
-    lib.optionals stdenv.is32bit [ "test_verify_with_time" ]
-  );
-
-  # Compose the final string expression, including the "-k" and the single quotes.
-  testExpression = lib.optionalString (disabledTests != [])
-    "-k 'not ${lib.concatStringsSep " and not " disabledTests}'";
-
-in
-
-buildPythonPackage rec {
-  pname = "pyopenssl";
-  version = "21.0.0";
+    "test_verify_with_time"
+  ];
 
-  src = fetchPypi {
-    pname = "pyOpenSSL";
-    inherit version;
-    sha256 = "5e2d8c5e46d0d865ae933bef5230090bdaf5506281e9eec60fa250ee80600cb3";
+  meta = with lib; {
+    description = "Python wrapper around the OpenSSL library";
+    homepage = "https://github.com/pyca/pyopenssl";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
-  outputs = [ "out" "dev" ];
-
-  checkPhase = ''
-    runHook preCheck
-    export LANG="en_US.UTF-8"
-    py.test tests ${testExpression}
-    runHook postCheck
-  '';
-
-  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
-  # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
-  doCheck = !stdenv.isDarwin;
-
-  nativeBuildInputs = [ openssl ];
-  propagatedBuildInputs = [ cryptography pyasn1 idna six ];
-
-  checkInputs = [ pytest pretend flaky glibcLocales ];
 }
diff --git a/pkgs/development/python-modules/pytest-aiohttp/default.nix b/pkgs/development/python-modules/pytest-aiohttp/default.nix
index 4e45477c8ca..794bbce74e0 100644
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -1,20 +1,45 @@
-{ lib, buildPythonPackage, fetchPypi, pytest, aiohttp }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, setuptools-scm
+, aiohttp
+, pytest
+, pytest-asyncio
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pytest-aiohttp";
-  version = "0.3.0";
+  version = "1.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0kx4mbs9bflycd8x9af0idcjhdgnzri3nw1qb0vpfyb3751qaaf9";
+    hash = "sha256-DI/rSNyOuAhw4rFTrK9iu7zCB5d+vLdDZf/P4WrcnxU=";
   };
 
-  buildInputs = [ pytest ];
+  patches = [
+    # https://github.com/aio-libs/pytest-aiohttp/pull/26
+    (fetchpatch {
+      name = "fix-tests-with-pytest-asyncio-0.18.0.patch";
+      url = "https://github.com/aio-libs/pytest-aiohttp/commit/97152c2dfdd368f799ec6bcb5fc315736a726f53.patch";
+      hash = "sha256-g7MTyCKUHnufOfrbhVV58WtfbGt1uXx8F7U9U+EaXfg=";
+    })
+  ];
 
-  propagatedBuildInputs = [ aiohttp ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
-  # There are no tests
-  doCheck = false;
+  propagatedBuildInputs = [
+    aiohttp
+    pytest
+    pytest-asyncio
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/aio-libs/pytest-aiohttp/";
diff --git a/pkgs/development/python-modules/pytest-asyncio/default.nix b/pkgs/development/python-modules/pytest-asyncio/default.nix
index 6401e1ce2c9..b8d3dffa3b0 100644
--- a/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -11,16 +11,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "0.17.2";
+  version = "0.18.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4wDXvO6pDK0dQLnyfJTTa+GXf9Qtsi6ywYDUIdhkgGo=";
+    hash = "sha256-PE66ogjfzj6cW3+UD5nZHSt6zg7b+j6Q4ACznE4j0j8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -36,6 +36,7 @@ buildPythonPackage rec {
   checkInputs = [
     flaky
     hypothesis
+    flaky
     pytestCheckHook
   ];
 
@@ -44,9 +45,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "library for testing asyncio code with pytest";
+    description = "Library for testing asyncio code with pytest";
     homepage = "https://github.com/pytest-dev/pytest-asyncio";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/pytest-mock/default.nix b/pkgs/development/python-modules/pytest-mock/default.nix
index 7f07ed2b6dd..94db409be91 100644
--- a/pkgs/development/python-modules/pytest-mock/default.nix
+++ b/pkgs/development/python-modules/pytest-mock/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pytest
 , pytest-asyncio
 , pytestCheckHook
 , setuptools-scm
@@ -8,15 +9,19 @@
 
 buildPythonPackage rec {
   pname = "pytest-mock";
-  version = "3.6.1";
+  version = "3.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "40217a058c52a63f1042f0784f62009e976ba824c418cced42e88d5f40ab0e62";
+    hash = "sha256-URK9ksyfGG7pbhqS78hJaepJSTnDrq05xQ9CHEzGlTQ=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
 
+  propagatedBuildInputs = [
+    pytest
+  ];
+
   checkInputs = [
     pytest-asyncio
     pytestCheckHook
@@ -34,6 +39,6 @@ buildPythonPackage rec {
     description = "Thin-wrapper around the mock package for easier use with pytest";
     homepage = "https://github.com/pytest-dev/pytest-mock";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index 2c0e893b9c5..10f78ab5e14 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -8,7 +8,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyYAML";
+  pname = "pyyaml";
   version = "6.0";
 
   disabled = pythonOlder "3.6";
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index b96c7ca8995..86e591eaf14 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -2,25 +2,28 @@
 , buildPythonPackage
 , fetchPypi
 , python
-, isPy27
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2021.11.10";
+  version = "2022.1.18";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-80HuLfCZm/33qV5EgHXv/g2yEqWTh94acGkOSssD1MY=";
+    hash = "sha256-l/MtwDqAVKTEpatddh7Uhh6CiywgD+vU5GhXBppIORY=";
   };
 
-  # Sources for different Python releases are located in same folder
   checkPhase = ''
-    rm -r ${if !isPy27 then "regex_2" else "regex_3"}
     ${python.interpreter} -m unittest
   '';
 
-  pythonImportsCheck = [ "regex" ];
+  pythonImportsCheck = [
+    "regex"
+  ];
 
   meta = with lib; {
     description = "Alternative regular expression module, to replace re";
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index 86e37419c72..95861bda181 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -5,25 +5,23 @@
 , pytestCheckHook
 , pythonOlder
 , requests
-, six
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.17.0";
+  version = "0.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7GdeCA0Gv40fteWmih5c0N9GsJx4IwMV9lCvXkA2vsc=";
+    hash = "sha256-OAytTBwdyULl6KjqrgtNTt9wj08BDbi3vPr60fzSVP8=";
   };
 
   propagatedBuildInputs = [
     requests
-    six
     urllib3
   ];
 
diff --git a/pkgs/development/python-modules/snitun/default.nix b/pkgs/development/python-modules/snitun/default.nix
index 293b8069b58..1b7bd7341eb 100644
--- a/pkgs/development/python-modules/snitun/default.nix
+++ b/pkgs/development/python-modules/snitun/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "snitun";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "NabuCasa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-IjdgxX6ed9IWMFaMXIXQWZWoODrZBzXtMAcMOIhPFVQ=";
+    hash = "sha256-Ehafb35H462Ffn6omGh/MDJKQX5qJJZeiIBO3n0IGlA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/misc/autoconf/2.13.nix b/pkgs/development/tools/misc/autoconf/2.13.nix
index dc36028332f..078b882e00e 100644
--- a/pkgs/development/tools/misc/autoconf/2.13.nix
+++ b/pkgs/development/tools/misc/autoconf/2.13.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "07krzl4czczdsgzrrw9fiqx35xcf32naf751khg821g5pqv12qgh";
   };
 
-  nativebuildInputs = [ xz ];
+  nativeBuildInputs = [ xz ];
   buildInputs = [ m4 perl ];
 
   doCheck = true;
diff --git a/pkgs/development/tools/misc/ctags/default.nix b/pkgs/development/tools/misc/ctags/default.nix
index fde7307b27d..dc6ee481523 100644
--- a/pkgs/development/tools/misc/ctags/default.nix
+++ b/pkgs/development/tools/misc/ctags/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchsvn, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "ctags-${revision}";
-  revision = "816";
+  pname = "ctags";
+  version = "816";
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/ctags/code/trunk";
-    rev = revision;
+    rev = version;
     sha256 = "0jmbkrmscbl64j71qffcc39x005jrmphx8kirs1g2ws44wil39hf";
   };
 
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 2d0129e21c5..af43c55072c 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -26,14 +26,14 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.4.0";
+  version = if stdenv.isDarwin then "2.2.6" else "2.4.1";
 
   src = fetchurl (if stdenv.isDarwin then {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
   } else {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "1pm6lf08z8vgs62g5b5rjw32qy3vr0q3sgidpg2lfs6a530wxgls";
+    sha256 = "sha256-xzOfdfjU8t7FDGczQaRfwGtohbttQ2bWv1mk5sEK4Xg=";
   });
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 9fd24eea6d9..de71b7d8c3e 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -3,11 +3,10 @@
   runCommand,
   autoreconfHook,
   autoconf, automake, libtool,
-  enablePython ? false, python ? null,
+  enablePython ? true, python3, swig,
+  linuxHeaders ? stdenv.cc.libc.linuxHeaders
 }:
 
-assert enablePython -> python != null;
-
 stdenv.mkDerivation rec {
   pname = "audit";
   version = "2.8.5"; # at the next release, remove the patches below!
@@ -21,7 +20,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = lib.optional enablePython python;
+  buildInputs = lib.optionals enablePython [ python3 swig ];
 
   configureFlags = [
     # z/OS plugin is not useful on Linux,
@@ -69,8 +68,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  prePatch = ''
+  postPatch = ''
     sed -i 's,#include <sys/poll.h>,#include <poll.h>\n#include <limits.h>,' audisp/audispd.c
+    substituteInPlace bindings/swig/src/auditswig.i \
+      --replace "/usr/include/linux/audit.h" \
+                "${linuxHeaders}/include/linux/audit.h"
   ''
   # According to https://stackoverflow.com/questions/13089166
   # --whole-archive linker flag is required to be sure that linker
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 5e81cf6b2c1..fb75b99f03d 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -22,11 +22,11 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.62";
+  version = "5.63";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-OAkKW3UOF/wI0+UheO2NMlTF9L0sSIMNXBlVuI47wMI=";
+    sha256 = "sha256-k0nhHoFguz1yCDXScSUNinQk02kPUonm22/gfMZsbXY=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 555ff6b0dc1..73f1e9fbdee 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.14";
-  sha256 = "0p5077h3z7mrr0b49ikmhlhrs4v4qb530raypk3y72ja125bqqsa";
+  version = "2.03.15";
+  sha256 = "17n9xl01by7dcbjwjnr6b4rrkp2frz8hwnjl59svsyp13sjq6llk";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 0749292531b..0f2e6efe3a2 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     sed -i /DEFAULT_SYS_DIR/d Makefile.in
     sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
+  '' + lib.optionalString (lib.versionOlder version "2.03.15") ''
     substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
       --replace /usr/bin/udevadm /run/current-system/systemd/bin/udevadm
     # https://github.com/lvmteam/lvm2/issues/36
@@ -82,7 +83,7 @@ stdenv.mkDerivation rec {
     sed -i 's|^#define LVM_CONFIGURE_LINE.*$|#define LVM_CONFIGURE_LINE "<removed>"|g' ./include/configure.h
   '';
 
-  patches = [
+  patches = lib.optionals (lib.versionOlder version "2.03.15") [
     # Musl fixes from Alpine.
     ./fix-stdio-usage.patch
     (fetchpatch {
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 0af47ccca83..0998ddb573d 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -202,9 +202,9 @@ let
 in self: {
 
   postgresql_10 = self.callPackage generic {
-    version = "10.19";
+    version = "10.20";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "sha256-brgwtCi2DoSuh+IENrzmecTZ0CAr567A5BsMZ9kTQjk=";
+    sha256 = "sha256-h94W1ZvP5C+mBcMSxZvl4pToo+astlXdetR8u5MKZZ8=";
     this = self.postgresql_10;
     thisAttr = "postgresql_10";
     inherit self;
@@ -212,36 +212,36 @@ in self: {
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.14";
+    version = "11.15";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "sha256-llx/S+lvtk+VgYUsWMTwXDgS1K2CPA8+K9/nd8Fi+Zk=";
+    sha256 = "sha256-yPWOjr1PRWf0+boQMus+meAlHYfL4+VktIVZDjeoeeM=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.9";
+    version = "12.10";
     psqlSchema = "12";
-    sha256 = "sha256-if2i3jPtBKmFSOQ/PuXxW4gr4XUF1jH+DdGlQKK1bc4=";
+    sha256 = "sha256-g90ZLmA0lRGSuahtwZzzcXqLghIOLxGgo2cjyCDSslc=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.5";
+    version = "13.6";
     psqlSchema = "13";
-    sha256 = "sha256-m4EGelXtuqvEGKrO9FfdhHdkKCdJlWCwBhWm6mwT9rM=";
+    sha256 = "sha256-uvx/o9nU2o/nG4TGO6i9/oCSk1wwwKqFwkssCFCPZ/w=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.1";
+    version = "14.2";
     psqlSchema = "14";
-    sha256 = "sha256-TTwQHqeuOJgvBr3HN1i1Nyf7ZALs2TggBvpezHwspB8=";
+    sha256 = "sha256-LPeLLkaJEvgQHWldtTQM8xPC6faKYS+3FCdSToyal3o=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
diff --git a/pkgs/test/make-wrapper/default.nix b/pkgs/test/make-wrapper/default.nix
index 6e70945ee19..62ccd272adf 100644
--- a/pkgs/test/make-wrapper/default.nix
+++ b/pkgs/test/make-wrapper/default.nix
@@ -64,6 +64,7 @@ runCommand "make-wrapper-test"
     (mkWrapperBinary { name = "test-run-and-set"; args = [ "--run" "export VAR=foo" "--set" "VAR" "bar" ]; })
     (mkWrapperBinary { name = "test-args"; args = [ "--add-flags" "abc" ]; wrapped = wrappedBinaryArgs; })
     (mkWrapperBinary { name = "test-prefix"; args = [ "--prefix" "VAR" ":" "abc" ]; })
+    (mkWrapperBinary { name = "test-prefix-noglob"; args = [ "--prefix" "VAR" ":" "./*" ]; })
     (mkWrapperBinary { name = "test-suffix"; args = [ "--suffix" "VAR" ":" "abc" ]; })
     (mkWrapperBinary { name = "test-prefix-and-suffix"; args = [ "--prefix" "VAR" ":" "foo" "--suffix" "VAR" ":" "bar" ]; })
     (mkWrapperBinary { name = "test-prefix-multi"; args = [ "--prefix" "VAR" ":" "abc:foo:foo" ]; })
@@ -112,6 +113,8 @@ runCommand "make-wrapper-test"
     # Only append the value once when given multiple times in a parameter
     # to makeWrapper
     + mkTest "test-prefix" "VAR=abc"
+    # --prefix doesn't expand globs
+    + mkTest "VAR=f?oo test-prefix-noglob" "VAR=./*:f?oo"
 
 
     # --suffix works
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 936555f93a4..72a869b08e6 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.16";
+  version = "5.16.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0cqqlcq9bywfi3cpg5ivxiv7p9v6z1r6k4nnmin24mj1kp8krarq";
+    sha256 = "sha256-PaTaU2HPhr3dqA7bTE8w6gdstOvsKZBPoIr8kw754ag=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/23.nix
index ef7a5cf85e7..e80804cd002 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null && enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "0dz9x0r5021bhk1kjh29m1q13xbslwb8yn9qzcp7b9m1lrnvi2ap";
+    sha256 = "sha256-80aOyvsdf5rXtR/R23rr8XzridLvqKBc8vObTUBUAq4=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -34,19 +34,9 @@ stdenv.mkDerivation rec {
     ./tests-add-test-cases-for-import-without-uid.patch
     ./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
-  ] ++ lib.optional stdenv.isDarwin [
-    # Remove an innocent warning printed on systems without procfs
-    # https://dev.gnupg.org/T5656
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/890be5f6af88e7913d177af87a50129049e681bb/gnupg/2.3.3-proc-error.patch";
-      sha256 = "sha256-oiTa7Nf+AEmhZ683CJEaCb559PXJ6RpSSgRLpxz4CKU=";
-    })
   ];
   postPatch = ''
-    sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' configure doc/dirmngr.texi doc/gnupg.info-1
-    # Fix broken SOURCE_DATE_EPOCH usage - remove on the next upstream update
-    sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.am
-    sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.in
+    sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
   '' + lib.optionalString (stdenv.isLinux && pcsclite != null) ''
     sed -i 's,"libpcsclite\.so[^"]*","${lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   '';
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d37a6e8efb0..21bc6bd94ad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -143,9 +143,14 @@ with pkgs;
 
   autorestic = callPackage ../tools/backup/autorestic { };
 
-  autoPatchelfHook = makeSetupHook
-    { name = "auto-patchelf-hook"; deps = [ bintools ]; }
-    ../build-support/setup-hooks/auto-patchelf.sh;
+  autoPatchelfHook = makeSetupHook {
+    name = "auto-patchelf-hook";
+    deps = [ bintools ];
+    substitutions = {
+      pythonInterpreter = "${python3.withPackages (ps: [ ps.pyelftools ])}/bin/python";
+      autoPatchelfScript = ../build-support/setup-hooks/auto-patchelf.py;
+    };
+  } ../build-support/setup-hooks/auto-patchelf.sh;
 
   appflowy = callPackage ../applications/office/appflowy { };
 
@@ -20457,34 +20462,17 @@ with pkgs;
 
   wxGTK = wxGTK28;
 
-  wxGTK30 = wxGTK30-gtk2;
-  wxGTK31 = wxGTK31-gtk2;
-
-  wxGTK28 = callPackage ../development/libraries/wxwidgets/2.8 { };
-
-  wxGTK29 = callPackage ../development/libraries/wxwidgets/2.9 { };
-
-  wxGTK30-gtk2 = callPackage ../development/libraries/wxwidgets/3.0 {
-    withGtk2 = true;
-  };
-
-  wxGTK30-gtk3 = callPackage ../development/libraries/wxwidgets/3.0 {
-    withGtk2 = false;
-  };
-
-  wxGTK31-gtk2 = callPackage ../development/libraries/wxwidgets/3.1 {
-    withGtk2 = true;
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
-  };
+  wxGTK28 = callPackage ../development/libraries/wxwidgets/wxGTK28.nix { };
+  wxGTK29 = callPackage ../development/libraries/wxwidgets/wxGTK29.nix { };
+  wxGTK30 = callPackage ../development/libraries/wxwidgets/wxGTK30.nix { };
+  wxGTK31 = callPackage ../development/libraries/wxwidgets/wxGTK31.nix { };
+  wxmac = callPackage ../development/libraries/wxwidgets/wxmac30.nix { };
 
-  wxGTK31-gtk3 = callPackage ../development/libraries/wxwidgets/3.1 {
-    withGtk2 = false;
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
-  };
+  wxGTK30-gtk2 = wxGTK30.override { withGtk2 = true; };
+  wxGTK30-gtk3 = wxGTK30.override { withGtk2 = false; };
 
-  wxmac = callPackage ../development/libraries/wxwidgets/3.0/mac.nix { };
+  wxGTK31-gtk2 = wxGTK30.override { withGtk2 = true; };
+  wxGTK31-gtk3 = wxGTK30.override { withGtk2 = false; };
 
   wxSVG = callPackage ../development/libraries/wxSVG {
     wxGTK = wxGTK30-gtk3;
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index b9b3b88f272..d40ab46a35b 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -84,6 +84,7 @@ mapAliases ({
   pylibgen = throw "pylibgen is unmaintained upstreamed, and removed from nixpkgs"; # added 2020-06-20
   pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04
   pysmart-smartx = pysmart; # added 2021-10-22
+  pytest_6 = pytest; # added 2022-02-10
   pytestcov = pytest-cov; # added 2021-01-04
   pytest-pep8 = pytestpep8; # added 2021-01-04
   pytestpep8 = throw "pytestpep8 was removed because it is abandoned and no longer compatible with pytest v6.0"; # added 2020-12-10
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8e090dc984a..4f2183bd0b9 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -135,16 +135,6 @@ in {
     venvShellHook
     wheelUnpackHook;
 
-  # Not all packages are compatible with the latest pytest yet.
-  # We need to override the hook to select an older pytest, however,
-  # it should not override the version of pytest that is used for say
-  # Python 2. This is an ugly hack that is needed now because the hook
-  # propagates the package.
-  pytestCheckHook_6_1 = if isPy3k then
-    self.pytestCheckHook.override { pytest = self.pytest_6_1; }
-  else
-    self.pytestCheckHook;
-
   # helpers
 
   # We use build packages because we are making a setup hook to be used as a
@@ -2190,7 +2180,7 @@ in {
 
   distutils_extra = callPackage ../development/python-modules/distutils_extra { };
 
-  django = self.django_2;
+  django = self.django_3;
 
   # Current LTS
   django_2 = callPackage ../development/python-modules/django/2.nix { };
@@ -7673,28 +7663,12 @@ in {
 
   pytesseract = callPackage ../development/python-modules/pytesseract { };
 
-  pytest = self.pytest_6;
-
-  pytest_6 =
-    callPackage ../development/python-modules/pytest {
-      # hypothesis tests require pytest that causes dependency cycle
-      hypothesis = self.hypothesis.override {
-        doCheck = false;
-      };
+  pytest = callPackage ../development/python-modules/pytest {
+    # hypothesis tests require pytest that causes dependency cycle
+    hypothesis = self.hypothesis.override {
+      doCheck = false;
     };
-
-  pytest_6_1 = self.pytest_6.overridePythonAttrs (oldAttrs: rec {
-    version = "6.1.2";
-    src = oldAttrs.src.override {
-      inherit version;
-      sha256 = "c0a7e94a8cdbc5422a51ccdad8e6f1024795939cc89159a0ae7f0b316ad3823e";
-    };
-
-    postPatch = ''
-      substituteInPlace setup.cfg \
-        --replace "pluggy>=0.12,<1.0" "pluggy>=0.12,<2.0"
-    '';
-  });
+  };
 
   pytest-aio = callPackage ../development/python-modules/pytest-aio { };