summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/ChowKick/default.nix4
-rw-r--r--pkgs/applications/audio/audacity/default.nix4
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix4
-rw-r--r--pkgs/applications/audio/hybridreverb2/default.nix4
-rw-r--r--pkgs/applications/audio/libopenmpt/default.nix12
-rw-r--r--pkgs/applications/audio/tenacity/default.nix4
-rw-r--r--pkgs/applications/audio/zrythm/default.nix4
-rw-r--r--pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix4
-rw-r--r--pkgs/applications/editors/jucipp/default.nix4
-rw-r--r--pkgs/applications/graphics/fbida/default.nix4
-rw-r--r--pkgs/applications/graphics/megapixels/default.nix4
-rw-r--r--pkgs/applications/misc/apvlv/default.nix4
-rw-r--r--pkgs/applications/misc/audio/soxr/default.nix23
-rw-r--r--pkgs/applications/misc/hubstaff/default.nix6
-rw-r--r--pkgs/applications/misc/lutris/fhsenv.nix2
-rw-r--r--pkgs/applications/misc/mysql-workbench/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/dino/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix4
-rw-r--r--pkgs/applications/networking/remote/nice-dcv-client/default.nix4
-rw-r--r--pkgs/applications/networking/remote/remmina/default.nix4
-rw-r--r--pkgs/applications/office/libreoffice/default.nix4
-rw-r--r--pkgs/applications/science/electronics/horizon-eda/default.nix4
-rw-r--r--pkgs/applications/science/electronics/kicad/base.nix4
-rw-r--r--pkgs/applications/terminal-emulators/roxterm/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix17
-rw-r--r--pkgs/applications/video/celluloid/default.nix4
-rw-r--r--pkgs/applications/video/entangle/default.nix4
-rw-r--r--pkgs/applications/video/mkvtoolnix/default.nix5
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/default.nix2
-rw-r--r--pkgs/build-support/setup-hooks/role.bash4
-rw-r--r--pkgs/build-support/wrapper-common/utils.bash16
-rw-r--r--pkgs/data/misc/publicsuffix-list/default.nix6
-rw-r--r--pkgs/desktops/arcan/xarcan/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-control-center/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-session/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/sushi/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-session-manager/default.nix4
-rw-r--r--pkgs/desktops/plasma-5/kwin/default.nix4
-rw-r--r--pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix4
-rw-r--r--pkgs/desktops/xfce/core/libxfce4ui/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/xfwm4/default.nix4
-rw-r--r--pkgs/development/embedded/arduino/arduino-core/default.nix22
-rw-r--r--pkgs/development/interpreters/octave/default.nix5
-rw-r--r--pkgs/development/interpreters/perl/default.nix20
-rw-r--r--pkgs/development/interpreters/spidermonkey/78.nix4
-rw-r--r--pkgs/development/libraries/Xaw3d/default.nix24
-rw-r--r--pkgs/development/libraries/dbus/default.nix4
-rw-r--r--pkgs/development/libraries/dconf/default.nix4
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/default.nix19
-rw-r--r--pkgs/development/libraries/gthree/default.nix4
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix4
-rw-r--r--pkgs/development/libraries/gtk/4.x.nix4
-rw-r--r--pkgs/development/libraries/gtkmm/3.x.nix4
-rw-r--r--pkgs/development/libraries/gtkmm/4.x.nix4
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/judy/default.nix6
-rw-r--r--pkgs/development/libraries/kde-frameworks/kdeclarative.nix4
-rw-r--r--pkgs/development/libraries/libcdio/default.nix12
-rw-r--r--pkgs/development/libraries/libdeflate/default.nix14
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libepoxy/default.nix (renamed from pkgs/development/libraries/epoxy/default.nix)6
-rw-r--r--pkgs/development/libraries/libepoxy/libgl-path.patch (renamed from pkgs/development/libraries/epoxy/libgl-path.patch)0
-rw-r--r--pkgs/development/libraries/libgudev/default.nix13
-rw-r--r--pkgs/development/libraries/libnotify/default.nix14
-rw-r--r--pkgs/development/libraries/libplacebo/default.nix4
-rw-r--r--pkgs/development/libraries/libpsl/default.nix6
-rw-r--r--pkgs/development/libraries/librsvg/default.nix3
-rw-r--r--pkgs/development/libraries/libsass/default.nix2
-rw-r--r--pkgs/development/libraries/libuninameslist/default.nix4
-rw-r--r--pkgs/development/libraries/libwpe/fdo.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix3
-rw-r--r--pkgs/development/libraries/movit/default.nix4
-rw-r--r--pkgs/development/libraries/nss/default.nix4
-rw-r--r--pkgs/development/libraries/ocl-icd/default.nix5
-rw-r--r--pkgs/development/libraries/opencl-headers/default.nix4
-rw-r--r--pkgs/development/libraries/pango/default.nix20
-rw-r--r--pkgs/development/libraries/qt-5/5.12/default.nix11
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix9
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix4
-rw-r--r--pkgs/development/libraries/retro-gtk/default.nix4
-rw-r--r--pkgs/development/libraries/spice-gtk/default.nix4
-rw-r--r--pkgs/development/libraries/stfl/default.nix15
-rw-r--r--pkgs/development/libraries/t1lib/default.nix7
-rw-r--r--pkgs/development/libraries/tdb/default.nix4
-rw-r--r--pkgs/development/libraries/tecla/default.nix5
-rw-r--r--pkgs/development/libraries/telepathy/qt/default.nix22
-rw-r--r--pkgs/development/libraries/tokyo-tyrant/default.nix9
-rw-r--r--pkgs/development/libraries/tracker/default.nix12
-rw-r--r--pkgs/development/libraries/tremor/default.nix3
-rw-r--r--pkgs/development/libraries/ucl/default.nix8
-rw-r--r--pkgs/development/libraries/uid_wrapper/default.nix5
-rw-r--r--pkgs/development/libraries/virglrenderer/default.nix4
-rw-r--r--pkgs/development/libraries/wayland/default.nix1
-rw-r--r--pkgs/development/libraries/webkitgtk/default.nix4
-rw-r--r--pkgs/development/libraries/webrtc-audio-processing/default.nix5
-rw-r--r--pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix27
-rw-r--r--pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix27
-rw-r--r--pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix27
-rw-r--r--pkgs/development/ocaml-modules/bolt/default.nix13
-rw-r--r--pkgs/development/ocaml-modules/calendar/default.nix18
-rw-r--r--pkgs/development/ocaml-modules/cil/default.nix10
-rw-r--r--pkgs/development/ocaml-modules/config-file/default.nix9
-rw-r--r--pkgs/development/ocaml-modules/csv/1.5.nix10
-rw-r--r--pkgs/development/ocaml-modules/enumerate/default.nix9
-rw-r--r--pkgs/development/ocaml-modules/fieldslib/default.nix9
-rw-r--r--pkgs/development/ocaml-modules/fontconfig/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/fpath/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/inifiles/default.nix17
-rw-r--r--pkgs/development/ocaml-modules/lablgtk-extras/1.4.nix10
-rw-r--r--pkgs/development/ocaml-modules/macaque/default.nix10
-rw-r--r--pkgs/development/ocaml-modules/magick/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/ocb-stubblr/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/ocurl/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/odn/default.nix16
-rw-r--r--pkgs/development/ocaml-modules/omd/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/optcomp/default.nix12
-rw-r--r--pkgs/development/ocaml-modules/pycaml/default.nix13
-rw-r--r--pkgs/development/ocaml-modules/react/default.nix11
-rw-r--r--pkgs/development/ocaml-modules/reactivedata/default.nix10
-rw-r--r--pkgs/development/ocaml-modules/seq/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/type_conv/108.08.00.nix15
-rw-r--r--pkgs/development/ocaml-modules/type_conv/109.60.01.nix15
-rw-r--r--pkgs/development/ocaml-modules/uchar/default.nix9
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix44
-rw-r--r--pkgs/development/python-modules/async_timeout/default.nix13
-rw-r--r--pkgs/development/python-modules/dbus/default.nix4
-rw-r--r--pkgs/development/python-modules/diskcache/default.nix9
-rw-r--r--pkgs/development/python-modules/factory_boy/default.nix23
-rw-r--r--pkgs/development/python-modules/flake8-future-import/default.nix10
-rw-r--r--pkgs/development/python-modules/flake8-future-import/fix-annotations-version-10.patch (renamed from pkgs/development/python-modules/flake8-future-import/fix-annotations-version.patch)0
-rw-r--r--pkgs/development/python-modules/flake8-future-import/fix-annotations-version-11.patch13
-rw-r--r--pkgs/development/python-modules/flake8/default.nix4
-rw-r--r--pkgs/development/python-modules/hypothesis/default.nix4
-rw-r--r--pkgs/development/python-modules/oslo-concurrency/default.nix4
-rw-r--r--pkgs/development/python-modules/oslo-log/default.nix4
-rw-r--r--pkgs/development/python-modules/oslo-utils/default.nix4
-rw-r--r--pkgs/development/python-modules/pbr/default.nix4
-rw-r--r--pkgs/development/python-modules/pycairo/1.18.nix5
-rw-r--r--pkgs/development/python-modules/pycairo/default.nix5
-rw-r--r--pkgs/development/python-modules/pycodestyle/default.nix4
-rw-r--r--pkgs/development/python-modules/pyside/apiextractor.nix10
-rw-r--r--pkgs/development/python-modules/pytest-flake8/default.nix12
-rw-r--r--pkgs/development/python-modules/regex/default.nix4
-rw-r--r--pkgs/development/python-modules/responses/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/xpybutil/default.nix9
-rw-r--r--pkgs/development/python-modules/yarl/default.nix4
-rw-r--r--pkgs/development/tools/documentation/gi-docgen/default.nix4
-rw-r--r--pkgs/development/tools/iaca/2.1.nix7
-rw-r--r--pkgs/development/tools/iaca/3.0.nix7
-rw-r--r--pkgs/development/tools/kexpand/default.nix3
-rw-r--r--pkgs/development/tools/manul/default.nix3
-rw-r--r--pkgs/development/tools/misc/autoconf/2.13.nix7
-rw-r--r--pkgs/development/tools/misc/autoconf/2.64.nix7
-rw-r--r--pkgs/development/tools/misc/autoconf/2.69.nix7
-rw-r--r--pkgs/development/tools/misc/autoconf/2.71-fix-race.patch36
-rw-r--r--pkgs/development/tools/misc/autoconf/default.nix5
-rw-r--r--pkgs/development/tools/misc/autogen/default.nix36
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.11.x.nix5
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.15.x.nix5
-rw-r--r--pkgs/development/tools/misc/elfutils/default.nix5
-rw-r--r--pkgs/development/tools/misc/elfutils/musl-cdefs_h.patch15
-rw-r--r--pkgs/development/tools/misc/gperf/3.0.x.nix7
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix6
-rw-r--r--pkgs/development/tools/misc/indent/default.nix8
-rw-r--r--pkgs/development/tools/misc/itstool/default.nix6
-rw-r--r--pkgs/development/tools/misc/patchelf/0.9.nix5
-rw-r--r--pkgs/development/tools/parsing/antlr/2.7.7.nix7
-rw-r--r--pkgs/development/tools/parsing/flex/2.5.35.nix7
-rw-r--r--pkgs/development/tools/profiling/sysprof/default.nix13
-rw-r--r--pkgs/development/tools/sassc/default.nix6
-rw-r--r--pkgs/games/arx-libertatis/default.nix4
-rw-r--r--pkgs/games/gnome-hexgl/default.nix4
-rw-r--r--pkgs/games/performous/default.nix4
-rw-r--r--pkgs/misc/emulators/melonDS/default.nix4
-rw-r--r--pkgs/misc/emulators/mgba/default.nix4
-rw-r--r--pkgs/misc/emulators/nestopia/default.nix4
-rw-r--r--pkgs/misc/emulators/snes9x-gtk/default.nix4
-rw-r--r--pkgs/misc/ghostscript/default.nix43
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/default.nix4
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix102
-rw-r--r--pkgs/os-specific/linux/ell/default.nix6
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix13
-rw-r--r--pkgs/os-specific/linux/pax-utils/default.nix6
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0018-pkg-config-derive-prefix-from-prefix.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0019-core-handle-lookup-paths-being-symlinks.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0020-sd-boot-Unify-error-handling.patch401
-rw-r--r--pkgs/os-specific/linux/systemd/0021-sd-boot-Rework-console-input-handling.patch320
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix8
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix6
-rw-r--r--pkgs/servers/pulseaudio/default.nix3
-rw-r--r--pkgs/servers/samba/4.x.nix4
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix4
-rw-r--r--pkgs/servers/x11/xorg/xcb-util-xrm.nix5
-rw-r--r--pkgs/servers/x11/xorg/xwayland.nix4
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/graphics/graphviz/base.nix33
-rw-r--r--pkgs/tools/graphics/gromit-mpx/default.nix4
-rw-r--r--pkgs/tools/graphics/wdisplays/default.nix4
-rw-r--r--pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix4
-rw-r--r--pkgs/tools/misc/coreutils/coreutils-8.23-4.cygwin.patch1259
-rw-r--r--pkgs/tools/misc/coreutils/default.nix17
-rw-r--r--pkgs/tools/misc/hdf5/default.nix7
-rw-r--r--pkgs/tools/misc/hdf5/hdf5-more-determinism.patch15
-rw-r--r--pkgs/tools/misc/mandoc/default.nix2
-rw-r--r--pkgs/tools/misc/timidity/default.nix20
-rw-r--r--pkgs/tools/networking/dhcp/default.nix10
-rw-r--r--pkgs/tools/networking/openssh/common.nix55
-rw-r--r--pkgs/tools/networking/unbound/default.nix11
-rw-r--r--pkgs/tools/networking/vpnc-scripts/default.nix8
-rw-r--r--pkgs/tools/security/rhash/default.nix30
-rw-r--r--pkgs/tools/text/gawk/default.nix4
-rw-r--r--pkgs/tools/text/groff/default.nix3
-rw-r--r--pkgs/tools/text/sgml/opensp/default.nix23
-rw-r--r--pkgs/tools/typesetting/docbook2x/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix6
-rw-r--r--pkgs/top-level/perl-packages.nix6
-rw-r--r--pkgs/top-level/python-packages.nix6
-rw-r--r--pkgs/top-level/python2-packages.nix2
240 files changed, 1962 insertions, 2003 deletions
diff --git a/pkgs/applications/audio/ChowKick/default.nix b/pkgs/applications/audio/ChowKick/default.nix
index 135ed3a11a1..b3ad00bf63a 100644
--- a/pkgs/applications/audio/ChowKick/default.nix
+++ b/pkgs/applications/audio/ChowKick/default.nix
@@ -4,7 +4,7 @@
 , cmake
 , curl
 , dbus
-, epoxy
+, libepoxy
 , fetchFromGitHub
 , freeglut
 , freetype
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     brotli
     curl
     dbus
-    epoxy
+    libepoxy
     freeglut
     freetype
     gtk2-x11
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 566024881b4..0832bb1dd96 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -32,7 +32,7 @@
 , linuxHeaders
 , at-spi2-core
 , dbus
-, epoxy
+, libepoxy
 , libXdmcp
 , libXtst
 , libpthreadstubs
@@ -143,7 +143,7 @@ stdenv.mkDerivation rec {
   ] ++ optionals stdenv.isLinux [
     at-spi2-core
     dbus
-    epoxy
+    libepoxy
     libXdmcp
     libXtst
     libpthreadstubs
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index 0af7b6b1f95..ad57b6a690f 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, pkg-config, cmake
+{ stdenv, lib, fetchFromGitHub, buildPackages, pkg-config, cmake
 , alsa-lib, glib, libjack2, libsndfile, libpulseaudio
 , AudioUnit, CoreAudio, CoreMIDI, CoreServices
 }:
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
   };
 
-  nativeBuildInputs = [ pkg-config cmake ];
+  nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
 
   buildInputs = [ glib libsndfile libpulseaudio libjack2 ]
     ++ lib.optionals stdenv.isLinux [ alsa-lib ]
diff --git a/pkgs/applications/audio/hybridreverb2/default.nix b/pkgs/applications/audio/hybridreverb2/default.nix
index b83eb591d81..d281ec11c7d 100644
--- a/pkgs/applications/audio/hybridreverb2/default.nix
+++ b/pkgs/applications/audio/hybridreverb2/default.nix
@@ -13,7 +13,7 @@
 , libpthreadstubs
 , libXdmcp
 , libxkbcommon
-, epoxy
+, libepoxy
 , at-spi2-core
 , dbus
 , curl
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     libpthreadstubs
     libXdmcp
     libxkbcommon
-    epoxy
+    libepoxy
     at-spi2-core
     dbus
     curl
diff --git a/pkgs/applications/audio/libopenmpt/default.nix b/pkgs/applications/audio/libopenmpt/default.nix
index ef5c080133b..b2b5ebecd7e 100644
--- a/pkgs/applications/audio/libopenmpt/default.nix
+++ b/pkgs/applications/audio/libopenmpt/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, stdenv, fetchurl, zlib, pkg-config, mpg123, libogg, libvorbis, portaudio, libsndfile, flac
+{ config, lib, stdenv, fetchurl, fetchpatch, zlib, pkg-config, mpg123, libogg, libvorbis, portaudio, libsndfile, flac
 , usePulseAudio ? config.pulseaudio or stdenv.isLinux, libpulseaudio }:
 
 stdenv.mkDerivation rec {
@@ -12,6 +12,16 @@ stdenv.mkDerivation rec {
     sha256 = "1c54lldr2imjzhlhq5lvwhj7d5794xm97cby9pznr5wdjjay0sa4";
   };
 
+  patches = [
+    # Fix pending upstream inclusion for gcc-12 include headers:
+    #  https://github.com/OpenMPT/openmpt/pull/8
+    (fetchpatch {
+      name = "gcc-12.patch";
+      url = "https://github.com/OpenMPT/openmpt/commit/6e7a43190ef2f9ba0b3efc19b9527261b69ec8f7.patch";
+      sha256 = "081m1rf09bbrlg52aihaajmld5dcnwbp6y7zpyik92mm332r330h";
+    })
+  ];
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/audio/tenacity/default.nix b/pkgs/applications/audio/tenacity/default.nix
index 160243cdf34..fbf13c1748f 100644
--- a/pkgs/applications/audio/tenacity/default.nix
+++ b/pkgs/applications/audio/tenacity/default.nix
@@ -35,7 +35,7 @@
 , linuxHeaders
 , at-spi2-core
 , dbus
-, epoxy
+, libepoxy
 , libXdmcp
 , libXtst
 , libpthreadstubs
@@ -128,7 +128,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isLinux [
     at-spi2-core
     dbus
-    epoxy
+    libepoxy
     libXdmcp
     libXtst
     libpthreadstubs
diff --git a/pkgs/applications/audio/zrythm/default.nix b/pkgs/applications/audio/zrythm/default.nix
index ee6eef5527f..480684525b1 100644
--- a/pkgs/applications/audio/zrythm/default.nix
+++ b/pkgs/applications/audio/zrythm/default.nix
@@ -12,7 +12,7 @@
 , cmake
 , curl
 , dconf
-, epoxy
+, libepoxy
 , ffmpeg
 , fftw
 , fftwFloat
@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
     chromaprint
     curl
     dconf
-    epoxy
+    libepoxy
     ffmpeg
     fftw
     fftwFloat
diff --git a/pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix b/pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix
index f595e211dc2..ea7fc137574 100644
--- a/pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, pkg-config, linkFarm, lightdm-enso-os-greeter
-, dbus, pcre, epoxy, libXdmcp, at-spi2-core, libxklavier, libxkbcommon, libpthreadstubs
+, dbus, pcre, libepoxy, libXdmcp, at-spi2-core, libxklavier, libxkbcommon, libpthreadstubs
 , gtk3, vala, cmake, libgee, libX11, lightdm, gdk-pixbuf, clutter-gtk, wrapGAppsHook, librsvg }:
 
 stdenv.mkDerivation {
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
     dbus
     gtk3
     pcre
-    epoxy
+    libepoxy
     libgee
     libX11
     lightdm
diff --git a/pkgs/applications/editors/jucipp/default.nix b/pkgs/applications/editors/jucipp/default.nix
index 140bf04c9f3..7a57e217109 100644
--- a/pkgs/applications/editors/jucipp/default.nix
+++ b/pkgs/applications/editors/jucipp/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, dconf, gtksourceview3, at-spi2-core, gtksourceviewmm,
-  boost, epoxy, cmake, aspell, llvmPackages, libgit2, pkg-config, pcre,
+  boost, libepoxy, cmake, aspell, llvmPackages, libgit2, pkg-config, pcre,
   libXdmcp, libxkbcommon, libpthreadstubs, wrapGAppsHook, aspellDicts, gtkmm3,
   coreutils, glibc, dbus, openssl, libxml2, gnumake, ctags }:
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     gtksourceview3
     at-spi2-core
     pcre
-    epoxy
+    libepoxy
     boost
     libXdmcp
     cmake
diff --git a/pkgs/applications/graphics/fbida/default.nix b/pkgs/applications/graphics/fbida/default.nix
index 5f13136d0c8..5cd574bf9b7 100644
--- a/pkgs/applications/graphics/fbida/default.nix
+++ b/pkgs/applications/graphics/fbida/default.nix
@@ -16,7 +16,7 @@
 , curl
 , sane-backends
 , libXpm
-, epoxy
+, libepoxy
 , poppler
 , mesa
 , lirc
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     sane-backends
     libdrm
     libXpm
-    epoxy
+    libepoxy
     poppler
     lirc
     mesa
diff --git a/pkgs/applications/graphics/megapixels/default.nix b/pkgs/applications/graphics/megapixels/default.nix
index 2204ebc745e..0cdb87a2c31 100644
--- a/pkgs/applications/graphics/megapixels/default.nix
+++ b/pkgs/applications/graphics/megapixels/default.nix
@@ -6,7 +6,7 @@
 , ninja
 , pkg-config
 , wrapGAppsHook
-, epoxy
+, libepoxy
 , gtk4
 , zbar
 , tiffSupport ? true
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    epoxy
+    libepoxy
     gtk4
     zbar
   ];
diff --git a/pkgs/applications/misc/apvlv/default.nix b/pkgs/applications/misc/apvlv/default.nix
index 140d6eb7d08..d7dde2a77ff 100644
--- a/pkgs/applications/misc/apvlv/default.nix
+++ b/pkgs/applications/misc/apvlv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config, pcre, libxkbcommon, epoxy
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config, pcre, libxkbcommon, libepoxy
 , gtk3, poppler, freetype, libpthreadstubs, libXdmcp, libxshmfence, wrapGAppsHook
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    poppler pcre libxkbcommon epoxy
+    poppler pcre libxkbcommon libepoxy
     freetype gtk3
     libpthreadstubs libXdmcp libxshmfence # otherwise warnings in compilation
   ];
diff --git a/pkgs/applications/misc/audio/soxr/default.nix b/pkgs/applications/misc/audio/soxr/default.nix
index 8460b4856dc..f7c01ce4649 100644
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, cmake }:
 
 stdenv.mkDerivation rec {
-  name = "soxr-0.1.3";
+  pname = "soxr";
+  version = "0.1.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/soxr/${name}-Source.tar.xz";
+    url = "mirror://sourceforge/soxr/soxr-${version}-Source.tar.xz";
     sha256 = "12aql6svkplxq5fjycar18863hcq84c5kx8g6f4rj0lcvigw24di";
   };
 
@@ -15,18 +16,20 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ]; # headers are just two and very small
 
-  preConfigure = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}"`pwd`/build/src
-  '' else ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}"`pwd`/build/src
-  '';
+  preConfigure =
+    if stdenv.isDarwin then ''
+      export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}"`pwd`/build/src
+    '' else ''
+      export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}"`pwd`/build/src
+    '';
 
   nativeBuildInputs = [ cmake ];
 
-  meta = {
+  meta = with lib; {
     description = "An audio resampling library";
     homepage = "http://soxr.sourceforge.net";
-    license = lib.licenses.lgpl21Plus;
-    platforms = lib.platforms.unix;
+    license = licenses.lgpl21Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/hubstaff/default.nix b/pkgs/applications/misc/hubstaff/default.nix
index 797dfe504ca..ad40f6c8389 100644
--- a/pkgs/applications/misc/hubstaff/default.nix
+++ b/pkgs/applications/misc/hubstaff/default.nix
@@ -4,9 +4,9 @@
 , curl, writeShellScript, common-updater-scripts }:
 
 let
-  url = "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.6.2-328c666b/Hubstaff-1.6.2-328c666b.sh";
-  version = "1.6.2-328c666b";
-  sha256 = "0fmlblw19qk9s9xsl0dl705cnns825wrlc7navii4bvbsn6ycl5v";
+  url = "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.6.3-b75e2da6/Hubstaff-1.6.3-b75e2da6.sh";
+  version = "1.6.3-b75e2da6";
+  sha256 = "0p77182p5rqbng8j6ndijq5br9hiwcmblpw8j5nc26m5w45jfspw";
 
   rpath = lib.makeLibraryPath
     [ libX11 zlib libSM libICE libXext freetype libXrender fontconfig libXft
diff --git a/pkgs/applications/misc/lutris/fhsenv.nix b/pkgs/applications/misc/lutris/fhsenv.nix
index bd35d44b7cc..7722574720f 100644
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@@ -77,7 +77,7 @@ in buildFHSUserEnv {
     nasm sndio
 
     # Snes9x
-    epoxy minizip
+    libepoxy minizip
 
     # Vice
     bison flex
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 63dde76fabc..9ba9f360402 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -33,7 +33,7 @@
 , proj
 , cairo
 , libxkbcommon
-, epoxy
+, libepoxy
 , wrapGAppsHook
 , at-spi2-core
 , dbus
@@ -126,7 +126,7 @@ in stdenv.mkDerivation rec {
     libpthreadstubs
     libXdmcp
     libxkbcommon
-    epoxy
+    libepoxy
     at-spi2-core
     dbus
   ];
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 118e9c3ea38..7edec1f5a62 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -34,7 +34,7 @@
 , libva
 , libdrm, wayland, libxkbcommon # Ozone
 , curl
-, epoxy
+, libepoxy
 # postPatch:
 , glibc # gconv + locale
 
@@ -150,7 +150,7 @@ let
       libva
       libdrm wayland mesa.drivers libxkbcommon
       curl
-      epoxy
+      libepoxy
     ] ++ optionals gnomeSupport [ gnome2.GConf libgcrypt ]
       ++ optional gnomeKeyringSupport libgnome-keyring3
       ++ optionals cupsSupport [ libgcrypt cups ]
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index 18f73de2fd5..5e362784c81 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -5,7 +5,7 @@
 , libnotify, libsoup, libgee
 , librsvg, libsignal-protocol-c
 , libgcrypt
-, epoxy
+, libepoxy
 , at-spi2-core
 , sqlite
 , dbus
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     libgcrypt
     libsoup
     pcre
-    epoxy
+    libepoxy
     at-spi2-core
     dbus
     icu
diff --git a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
index d9f9cd91a52..cb4f3e5e5d1 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@@ -4,7 +4,7 @@
 , ffmpeg, openalSoft, minizip, libopus, alsa-lib, libpulseaudio, range-v3
 , tl-expected, hunspell, glibmm, webkitgtk
 # Transitive dependencies:
-, pcre, xorg, util-linux, libselinux, libsepol, epoxy
+, pcre, xorg, util-linux, libselinux, libsepol, libepoxy
 , at-spi2-core, libXtst, libthai, libdatrie
 }:
 
@@ -41,7 +41,7 @@ in mkDerivation rec {
     tl-expected hunspell glibmm webkitgtk
     tg_owt
     # Transitive dependencies:
-    pcre xorg.libXdmcp util-linux libselinux libsepol epoxy
+    pcre xorg.libXdmcp util-linux libselinux libsepol libepoxy
     at-spi2-core libXtst libthai libdatrie
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 0764c484ec9..1611185ca72 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -37,7 +37,7 @@
 , libXdmcp
 , libselinux
 , libsepol
-, epoxy
+, libepoxy
 , at-spi2-core
 , libXtst
 , libthai
@@ -135,7 +135,7 @@ mkDerivation rec {
     libXdmcp
     libselinux
     libsepol
-    epoxy
+    libepoxy
     at-spi2-core
     libXtst
     libthai
diff --git a/pkgs/applications/networking/remote/nice-dcv-client/default.nix b/pkgs/applications/networking/remote/nice-dcv-client/default.nix
index 3344174cb2a..82debe6f8a1 100644
--- a/pkgs/applications/networking/remote/nice-dcv-client/default.nix
+++ b/pkgs/applications/networking/remote/nice-dcv-client/default.nix
@@ -4,7 +4,7 @@
 , libX11
 , gst_all_1
 , sqlite
-, epoxy
+, libepoxy
 , pango
 , cairo
 , gdk-pixbuf
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     pcsclite
     gtk3
     cairo
-    epoxy
+    libepoxy
     pango
     gdk-pixbuf
     gst_all_1.gstreamer
diff --git a/pkgs/applications/networking/remote/remmina/default.nix b/pkgs/applications/networking/remote/remmina/default.nix
index f61a00f89ad..11fcde29b88 100644
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@@ -3,7 +3,7 @@
 , freerdp, libssh, libgcrypt, gnutls
 , pcre2, libdbusmenu-gtk3, libappindicator-gtk3
 , libvncserver, libpthreadstubs, libXdmcp, libxkbcommon
-, libsecret, libsoup, spice-protocol, spice-gtk, epoxy, at-spi2-core
+, libsecret, libsoup, spice-protocol, spice-gtk, libepoxy, at-spi2-core
 , openssl, gsettings-desktop-schemas, json-glib, libsodium, webkitgtk, harfbuzz
 # The themes here are soft dependencies; only icons are missing without them.
 , gnome
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     freerdp libssh libgcrypt gnutls
     pcre2 libdbusmenu-gtk3 libappindicator-gtk3
     libvncserver libpthreadstubs libXdmcp libxkbcommon
-    libsecret libsoup spice-protocol spice-gtk epoxy at-spi2-core
+    libsecret libsoup spice-protocol spice-gtk libepoxy at-spi2-core
     openssl gnome.adwaita-icon-theme json-glib libsodium webkitgtk
     harfbuzz
   ];
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index fb3a6c005b7..2ed4750b30d 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -12,7 +12,7 @@
 , libatomic_ops, graphite2, harfbuzz, libodfgen, libzmf
 , librevenge, libe-book, libmwaw, glm, gst_all_1
 , gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
-, gnome, glib, ncurses, epoxy, gpgme
+, gnome, glib, ncurses, libepoxy, gpgme
 , langs ? [ "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false, mkDerivation ? null, qtbase ? null, qtx11extras ? null
@@ -396,7 +396,7 @@ in (mkDrv rec {
       python3 sane-backends unzip which zip zlib
       mdds bluez5 libwps libabw libzmf
       libxshmfence libatomic_ops graphite2 harfbuzz gpgme util-linux
-      librevenge libe-book libmwaw glm ncurses epoxy
+      librevenge libe-book libmwaw glm ncurses libepoxy
       libodfgen CoinMP librdf_rasqal gnome.adwaita-icon-theme gettext
     ]
     ++ (with gst_all_1; [
diff --git a/pkgs/applications/science/electronics/horizon-eda/default.nix b/pkgs/applications/science/electronics/horizon-eda/default.nix
index eec7830b2a1..30ef1f5d109 100644
--- a/pkgs/applications/science/electronics/horizon-eda/default.nix
+++ b/pkgs/applications/science/electronics/horizon-eda/default.nix
@@ -3,7 +3,7 @@
 , coreutils
 , cppzmq
 , curl
-, epoxy
+, libepoxy
 , fetchFromGitHub
 , glm
 , gtkmm3
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     cppzmq
     curl
-    epoxy
+    libepoxy
     glm
     gtkmm3
     libgit2
diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index 0b024d5c947..61fcff77e1c 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -27,7 +27,7 @@
 , libthai
 , libdatrie
 , libxkbcommon
-, epoxy
+, libepoxy
 , dbus
 , at-spi2-core
 , libXtst
@@ -131,7 +131,7 @@ stdenv.mkDerivation rec {
     libthai
     libdatrie
     libxkbcommon
-    epoxy
+    libepoxy
     dbus.daemon
     at-spi2-core
     libXtst
diff --git a/pkgs/applications/terminal-emulators/roxterm/default.nix b/pkgs/applications/terminal-emulators/roxterm/default.nix
index 66c96ab8798..da9bfac952b 100644
--- a/pkgs/applications/terminal-emulators/roxterm/default.nix
+++ b/pkgs/applications/terminal-emulators/roxterm/default.nix
@@ -1,4 +1,4 @@
-{ at-spi2-core, cmake, dbus, dbus-glib, docbook_xsl, epoxy, fetchFromGitHub
+{ at-spi2-core, cmake, dbus, dbus-glib, docbook_xsl, libepoxy, fetchFromGitHub
 , glib, gtk3, harfbuzz, libXdmcp, libXtst, libpthreadstubs
 , libselinux, libsepol, libtasn1, libxkbcommon, libxslt, p11-kit, pcre2
 , pkg-config, lib, stdenv, util-linuxMinimal, vte, wrapGAppsHook, xmlto
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ gtk3 dbus dbus-glib vte pcre2 harfbuzz libpthreadstubs libXdmcp
       util-linuxMinimal glib docbook_xsl xmlto libselinux
-      libsepol libxkbcommon epoxy at-spi2-core libXtst libtasn1 p11-kit
+      libsepol libxkbcommon libepoxy at-spi2-core libXtst libtasn1 p11-kit
     ];
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 521e42e845f..61d5225621b 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, lib, stdenv, buildPackages
 , curl, openssl, zlib, expat, perlPackages, python3, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
-, openssh, pcre2
+, openssh, pcre2, bash
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
 , libxslt, tcl, tk, makeWrapper, libiconv
 , svnSupport, subversionClient, perlLibs, smtpPerlLibs
@@ -73,7 +73,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
     ++ lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
          docbook_xsl docbook_xml_dtd_45 libxslt ];
-  buildInputs = [curl openssl zlib expat cpio libiconv]
+  buildInputs = [ curl openssl zlib expat cpio libiconv bash ]
     ++ lib.optionals perlSupport [ perlPackages.perl ]
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
@@ -84,11 +84,12 @@ stdenv.mkDerivation {
   NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && stdenv.hostPlatform.libc == "glibc") "-lgcc_s"
               + lib.optionalString (stdenv.isFreeBSD) "-lthr";
 
-  configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+  configureFlags = [
+    "ac_cv_prog_CURL_CONFIG=${lib.getDev curl}/bin/curl-config"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "ac_cv_fread_reads_directories=yes"
     "ac_cv_snprintf_returns_bogus=no"
     "ac_cv_iconv_omits_bom=no"
-    "ac_cv_prog_CURL_CONFIG=${curl.dev}/bin/curl-config"
   ];
 
   preBuild = ''
@@ -97,8 +98,10 @@ stdenv.mkDerivation {
 
   makeFlags = [
     "prefix=\${out}"
-    "SHELL_PATH=${stdenv.shell}"
   ]
+  # Git does not allow setting a shell separately for building and run-time.
+  # Therefore lets leave it at the default /bin/sh when cross-compiling
+  ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) "SHELL_PATH=${stdenv.shell}"
   ++ (if perlSupport then ["PERL_PATH=${perlPackages.perl}/bin/perl"] else ["NO_PERL=1"])
   ++ (if pythonSupport then ["PYTHON_PATH=${python3}/bin/python"] else ["NO_PYTHON=1"])
   ++ lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
@@ -115,6 +118,10 @@ stdenv.mkDerivation {
   # See https://github.com/Homebrew/homebrew-core/commit/dfa3ccf1e7d3901e371b5140b935839ba9d8b706
   ++ lib.optional stdenv.isDarwin "TKFRAMEWORK=/nonexistent";
 
+  disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    stdenv.shellPackage
+  ];
+
 
   postBuild = ''
     make -C contrib/subtree
diff --git a/pkgs/applications/video/celluloid/default.nix b/pkgs/applications/video/celluloid/default.nix
index f6bc0561b0c..e6dcff67175 100644
--- a/pkgs/applications/video/celluloid/default.nix
+++ b/pkgs/applications/video/celluloid/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , appstream-glib
 , desktop-file-utils
-, epoxy
+, libepoxy
 , gettext
 , glib
 , gtk3
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
   buildInputs = [
-    epoxy
+    libepoxy
     glib
     gtk3
     mpv
diff --git a/pkgs/applications/video/entangle/default.nix b/pkgs/applications/video/entangle/default.nix
index 6d8905d2c00..2c756338089 100644
--- a/pkgs/applications/video/entangle/default.nix
+++ b/pkgs/applications/video/entangle/default.nix
@@ -12,7 +12,7 @@
 , at-spi2-core
 , dbus
 , elfutils
-, epoxy
+, libepoxy
 , gexiv2
 , glib
 , gobject-introspection
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     at-spi2-core
     dbus
-    epoxy
+    libepoxy
     elfutils
     gexiv2
     glib
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index 4eac16d349b..257d21ecc03 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -122,11 +122,6 @@ stdenv.mkDerivation rec {
 
   dontWrapQtApps = true;
 
-  # Avoid Qt 5.12 problem on Big Sur: https://bugreports.qt.io/browse/QTBUG-87014
-  qtWrapperArgs = lib.optionals stdenv.isDarwin [
-    "--set QT_MAC_WANTS_LAYER 1"
-  ];
-
   postFixup = optionalString withGUI ''
     wrapQtApp $out/bin/mkvtoolnix-gui
   '';
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 7442f883b5f..a8a18692b9e 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -18,7 +18,7 @@
 , xenSupport ? false, xen
 , cephSupport ? false, ceph
 , glusterfsSupport ? false, glusterfs, libuuid
-, openGLSupport ? sdlSupport, mesa, epoxy, libdrm
+, openGLSupport ? sdlSupport, mesa, libepoxy, libdrm
 , virglSupport ? openGLSupport, virglrenderer
 , libiscsiSupport ? true, libiscsi
 , smbdSupport ? false, samba
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals xenSupport [ xen ]
     ++ lib.optionals cephSupport [ ceph ]
     ++ lib.optionals glusterfsSupport [ glusterfs libuuid ]
-    ++ lib.optionals openGLSupport [ mesa epoxy libdrm ]
+    ++ lib.optionals openGLSupport [ mesa libepoxy libdrm ]
     ++ lib.optionals virglSupport [ virglrenderer ]
     ++ lib.optionals libiscsiSupport [ libiscsi ]
     ++ lib.optionals smbdSupport [ samba ]
diff --git a/pkgs/applications/window-managers/i3/default.nix b/pkgs/applications/window-managers/i3/default.nix
index 0d07ce4e8d1..0617e857239 100644
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    pkg-config makeWrapper meson ninja installShellFiles
+    pkg-config makeWrapper meson ninja installShellFiles perl
     asciidoc xmlto docbook_xml_dtd_45 docbook_xsl findXMLCatalogs
   ];
 
diff --git a/pkgs/build-support/setup-hooks/role.bash b/pkgs/build-support/setup-hooks/role.bash
index cf69e732e7c..b2d34a1f860 100644
--- a/pkgs/build-support/setup-hooks/role.bash
+++ b/pkgs/build-support/setup-hooks/role.bash
@@ -17,7 +17,7 @@ function getRole() {
             role_post='_FOR_TARGET'
             ;;
         *)
-            echo "@name@: used as improper sort of dependency" >2
+            echo "@name@: used as improper sort of dependency" >&2
             return 1
             ;;
     esac
@@ -64,7 +64,7 @@ function getTargetRoleWrapper() {
             export NIX_@wrapperName@_TARGET_TARGET_@suffixSalt@=1
             ;;
         *)
-            echo "@name@: used as improper sort of dependency" >2
+            echo "@name@: used as improper sort of dependency" >&2
             return 1
             ;;
     esac
diff --git a/pkgs/build-support/wrapper-common/utils.bash b/pkgs/build-support/wrapper-common/utils.bash
index cb3552ebc54..0afccadf338 100644
--- a/pkgs/build-support/wrapper-common/utils.bash
+++ b/pkgs/build-support/wrapper-common/utils.bash
@@ -21,13 +21,13 @@ mangleVarListGeneric() {
     local -a role_suffixes=("$@")
 
     local outputVar="${var}_@suffixSalt@"
-    declare -gx ${outputVar}+=''
+    declare -gx "$outputVar"+=''
     # For each role we serve, we accumulate the input parameters into our own
     # cc-wrapper-derivation-specific environment variables.
     for suffix in "${role_suffixes[@]}"; do
         local inputVar="${var}${suffix}"
         if [ -v "$inputVar" ]; then
-            export ${outputVar}+="${!outputVar:+$sep}${!inputVar}"
+            export "${outputVar}+=${!outputVar:+$sep}${!inputVar}"
         fi
     done
 }
@@ -42,7 +42,7 @@ mangleVarBool() {
     local -a role_suffixes=("$@")
 
     local outputVar="${var}_@suffixSalt@"
-    declare -gxi ${outputVar}+=0
+    declare -gxi "${outputVar}+=0"
     for suffix in "${role_suffixes[@]}"; do
         local inputVar="${var}${suffix}"
         if [ -v "$inputVar" ]; then
@@ -131,7 +131,7 @@ expandResponseParams() {
 }
 
 checkLinkType() {
-    local arg mode
+    local arg
     type="dynamic"
     for arg in "$@"; do
         if [[ "$arg" = -static ]]; then
@@ -146,7 +146,7 @@ checkLinkType() {
 # When building static-pie executables we cannot have rpath
 # set. At least glibc requires rpath to be empty
 filterRpathFlags() {
-    local linkType=$1 ret="" i
+    local linkType=$1 ret i
     shift
 
     if [[ "$linkType" == "static-pie" ]]; then
@@ -156,11 +156,11 @@ filterRpathFlags() {
                 # also skip its argument
                 shift
             else
-                ret+="$i "
+                ret+=("$i")
             fi
         done
     else
-        ret=$@
+        ret=("$@")
     fi
-    echo $ret
+    echo "${ret[@]}"
 }
diff --git a/pkgs/data/misc/publicsuffix-list/default.nix b/pkgs/data/misc/publicsuffix-list/default.nix
index ca79e251f28..db74b74f22d 100644
--- a/pkgs/data/misc/publicsuffix-list/default.nix
+++ b/pkgs/data/misc/publicsuffix-list/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "publicsuffix-list";
-  version = "2019-05-24";
+  version = "2021-09-03";
 in fetchFromGitHub {
   name = "${pname}-${version}";
   owner = "publicsuffix";
   repo = "list";
-  rev = "a1db0e898956e126de65be1a5e977fbbbbeebe33";
-  sha256 = "092153w2jr7nx28p9wc9k6b5azi9c39ghnqfnfiwfzv1j8jm3znq";
+  rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
+  sha256 = "sha256-Q8uIXM1CMu8dlWcVoL17M1XRGu3kG7Y7jpx0oHQh+2I=";
 
   postFetch = ''
     tar xf $downloadedFile --strip=1
diff --git a/pkgs/desktops/arcan/xarcan/default.nix b/pkgs/desktops/arcan/xarcan/default.nix
index 9bfd7e29073..6245471a7ef 100644
--- a/pkgs/desktops/arcan/xarcan/default.nix
+++ b/pkgs/desktops/arcan/xarcan/default.nix
@@ -4,7 +4,7 @@
 , arcan
 , audit
 , dbus
-, epoxy
+, libepoxy
 , fontutil
 , libGL
 , libX11
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     arcan
     audit
     dbus
-    epoxy
+    libepoxy
     fontutil
     libGL
     libX11
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/default.nix b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
index d60b64b78aa..9ea727969b3 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@@ -60,7 +60,7 @@
 , tzdata
 , udisks2
 , upower
-, epoxy
+, libepoxy
 , gnome-user-share
 , gnome-remote-desktop
 , wrapGAppsHook
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
     clutter-gtk
     colord
     colord-gtk
-    epoxy
+    libepoxy
     fontconfig
     gdk-pixbuf
     glib
diff --git a/pkgs/desktops/gnome/core/gnome-session/default.nix b/pkgs/desktops/gnome/core/gnome-session/default.nix
index c1ebc436207..3ba6958fad0 100644
--- a/pkgs/desktops/gnome/core/gnome-session/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-session/default.nix
@@ -1,6 +1,6 @@
 { fetchurl, lib, stdenv, substituteAll, meson, ninja, pkg-config, gnome, glib, gtk3, gsettings-desktop-schemas
 , gnome-desktop, dbus, json-glib, libICE, xmlto, docbook_xsl, docbook_xml_dtd_412, python3
-, libxslt, gettext, makeWrapper, systemd, xorg, epoxy, gnugrep, bash, gnome-session-ctl }:
+, libxslt, gettext, makeWrapper, systemd, xorg, libepoxy, gnugrep, bash, gnome-session-ctl }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-session";
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib gtk3 libICE gnome-desktop json-glib xorg.xtrans gnome.adwaita-icon-theme
-    gnome.gnome-settings-daemon gsettings-desktop-schemas systemd epoxy
+    gnome.gnome-settings-daemon gsettings-desktop-schemas systemd libepoxy
   ];
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome/core/sushi/default.nix b/pkgs/desktops/gnome/core/sushi/default.nix
index f08f51512c4..49aa1a021cf 100644
--- a/pkgs/desktops/gnome/core/sushi/default.nix
+++ b/pkgs/desktops/gnome/core/sushi/default.nix
@@ -17,7 +17,7 @@
 , gtk3
 , harfbuzz
 , ninja
-, epoxy
+, libepoxy
 }:
 
 stdenv.mkDerivation rec {
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     gdk-pixbuf
     librsvg
     webkitgtk_4_1
-    epoxy
+    libepoxy
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
diff --git a/pkgs/desktops/mate/mate-session-manager/default.nix b/pkgs/desktops/mate/mate-session-manager/default.nix
index 1c51e2f6ae8..dba5c374f94 100644
--- a/pkgs/desktops/mate/mate-session-manager/default.nix
+++ b/pkgs/desktops/mate/mate-session-manager/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, gettext, xtrans, dbus-glib, systemd,
-  libSM, libXtst, gtk3, epoxy, polkit, hicolor-icon-theme, mate,
+  libSM, libXtst, gtk3, libepoxy, polkit, hicolor-icon-theme, mate,
   wrapGAppsHook, fetchpatch, mateUpdateScript
 }:
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     gtk3
     mate.mate-desktop
     hicolor-icon-theme
-    epoxy
+    libepoxy
     polkit
   ];
 
diff --git a/pkgs/desktops/plasma-5/kwin/default.nix b/pkgs/desktops/plasma-5/kwin/default.nix
index 4e5ba348cd8..36f0da9e961 100644
--- a/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/pkgs/desktops/plasma-5/kwin/default.nix
@@ -2,7 +2,7 @@
   mkDerivation, lib,
   extra-cmake-modules, kdoctools, fetchpatch,
 
-  epoxy, lcms2, libICE, libSM, libcap, libdrm, libinput, libxkbcommon, mesa,
+  libepoxy, lcms2, libICE, libSM, libcap, libdrm, libinput, libxkbcommon, mesa,
   pipewire, udev, wayland, xcb-util-cursor, xwayland,
 
   qtdeclarative, qtmultimedia, qtquickcontrols2, qtscript, qtsensors,
@@ -21,7 +21,7 @@ mkDerivation {
   name = "kwin";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    epoxy lcms2 libICE libSM libcap libdrm libinput libxkbcommon mesa pipewire
+    libepoxy lcms2 libICE libSM libcap libdrm libinput libxkbcommon mesa pipewire
     udev wayland xcb-util-cursor xwayland
 
     qtdeclarative qtmultimedia qtquickcontrols2 qtscript qtsensors
diff --git a/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix b/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
index f754bc5a46d..60d4867cb47 100644
--- a/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
+++ b/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, gettext, kdoctools,
-  cups, epoxy, mesa, pcre, pipewire, wayland, wayland-protocols,
+  cups, libepoxy, mesa, pcre, pipewire, wayland, wayland-protocols,
   kcoreaddons, knotifications, kwayland, kwidgetsaddons, kwindowsystem,
   kirigami2, kdeclarative, plasma-framework, plasma-wayland-protocols, kio,
   qtbase
@@ -11,7 +11,7 @@ mkDerivation {
   name = "xdg-desktop-portal-kde";
   nativeBuildInputs = [ extra-cmake-modules gettext kdoctools ];
   buildInputs = [
-    cups epoxy mesa pcre pipewire wayland wayland-protocols
+    cups libepoxy mesa pcre pipewire wayland wayland-protocols
 
     kio kcoreaddons knotifications kwayland kwidgetsaddons kwindowsystem
     kirigami2 kdeclarative plasma-framework plasma-wayland-protocols
diff --git a/pkgs/desktops/xfce/core/libxfce4ui/default.nix b/pkgs/desktops/xfce/core/libxfce4ui/default.nix
index 0a937f68fd0..b70ef2788ac 100644
--- a/pkgs/desktops/xfce/core/libxfce4ui/default.nix
+++ b/pkgs/desktops/xfce/core/libxfce4ui/default.nix
@@ -1,5 +1,5 @@
 { lib, mkXfceDerivation, gobject-introspection, vala, gtk3, libICE, libSM
-, libstartup_notification, libgtop, epoxy, libxfce4util, xfconf }:
+, libstartup_notification, libgtop, libepoxy, libxfce4util, xfconf }:
 
 mkXfceDerivation {
   category = "xfce";
@@ -9,7 +9,7 @@ mkXfceDerivation {
   sha256 = "sha256-5mwyC3YA1LvdVSvaHN7CXDJh+IXjmdHGLKzhpjtUZkw=";
 
   nativeBuildInputs = [ gobject-introspection vala ];
-  buildInputs =  [ gtk3 libstartup_notification libgtop epoxy xfconf ];
+  buildInputs =  [ gtk3 libstartup_notification libgtop libepoxy xfconf ];
   propagatedBuildInputs = [ libxfce4util libICE libSM ];
 
   configureFlags = [
diff --git a/pkgs/desktops/xfce/core/xfwm4/default.nix b/pkgs/desktops/xfce/core/xfwm4/default.nix
index cc998487f16..61e46d3047d 100644
--- a/pkgs/desktops/xfce/core/xfwm4/default.nix
+++ b/pkgs/desktops/xfce/core/xfwm4/default.nix
@@ -1,4 +1,4 @@
-{ mkXfceDerivation, exo, librsvg, dbus-glib, epoxy, gtk3, libXdamage
+{ mkXfceDerivation, exo, librsvg, dbus-glib, libepoxy, gtk3, libXdamage
 , libstartup_notification, libxfce4ui, libxfce4util, libwnck
 , libXpresent, xfconf }:
 
@@ -13,7 +13,7 @@ mkXfceDerivation {
 
   buildInputs = [
     dbus-glib
-    epoxy
+    libepoxy
     gtk3
     libXdamage
     libstartup_notification
diff --git a/pkgs/development/embedded/arduino/arduino-core/default.nix b/pkgs/development/embedded/arduino/arduino-core/default.nix
index a0184eb94e5..25d0301d032 100644
--- a/pkgs/development/embedded/arduino/arduino-core/default.nix
+++ b/pkgs/development/embedded/arduino/arduino-core/default.nix
@@ -11,7 +11,7 @@
 , ncurses
 , readline
 , withGui ? false
-, gtk3 ? null
+, gtk3
 , wrapGAppsHook
 , withTeensyduino ? false
   /* Packages needed for Teensyduino */
@@ -31,7 +31,6 @@
 , udev
 }:
 
-assert withGui -> gtk3 != null && wrapGAppsHook != null;
 assert withTeensyduino -> withGui;
 let
   externalDownloads = import ./downloads.nix {
@@ -76,12 +75,12 @@ let
                         else if stdenv.hostPlatform.isAarch32 then "linuxarm"
                         else throw "${stdenv.hostPlatform.system} is not supported in teensy";
 
-  flavor = (if withTeensyduino then "teensyduino" else "arduino")
+  pname = (if withTeensyduino then "teensyduino" else "arduino")
              + lib.optionalString (!withGui) "-core";
 in
 stdenv.mkDerivation rec {
+  inherit pname;
   version = "1.8.16";
-  name = "${flavor}-${version}";
 
   src = fetchFromGitHub {
     owner = "arduino";
@@ -103,13 +102,12 @@ stdenv.mkDerivation rec {
   # Used because teensyduino requires jars be a specific size
   arduino_dist_src = fetchurl {
     url = "https://downloads.arduino.cc/arduino-${version}-${teensy_architecture}.tar.xz";
-    sha256 =
-      {
-        linux64 = "sha256-VK+Skl2xjqPWYEEKt1CCLwBZRxoyRfYQ3/60Byen9po=";
-        linux32 = "sha256-fjqV4avddmWAdFqMuUNUcDguxv3SI45m5QHFiWP8EKE=";
-        linuxarm = "sha256-Br8vUN7njI7VCH+ZvUh44l8LcgW+61+Q0x2AiXxIhTM=";
-        linuxaarch64 = "sha256-bOizBUUuyINg0/EqEatBq9lECT97JXxKbesCGyCA3YQ=";
-      }.${teensy_architecture} or (throw "No arduino binaries for ${teensy_architecture}");
+    sha256 = {
+      linux64 = "sha256-VK+Skl2xjqPWYEEKt1CCLwBZRxoyRfYQ3/60Byen9po=";
+      linux32 = "sha256-fjqV4avddmWAdFqMuUNUcDguxv3SI45m5QHFiWP8EKE=";
+      linuxarm = "sha256-Br8vUN7njI7VCH+ZvUh44l8LcgW+61+Q0x2AiXxIhTM=";
+      linuxaarch64 = "sha256-bOizBUUuyINg0/EqEatBq9lECT97JXxKbesCGyCA3YQ=";
+    }.${teensy_architecture} or (throw "No arduino binaries for ${teensy_architecture}");
   };
 
   # the glib setup hook will populate GSETTINGS_SCHEMAS_PATH,
@@ -157,7 +155,7 @@ stdenv.mkDerivation rec {
   javaPath = lib.makeBinPath [ jdk ];
 
   # Everything else will be patched into rpath
-  rpath = (lib.makeLibraryPath [ zlib libusb-compat-0_1 libusb1 readline ncurses5 stdenv.cc.cc ]);
+  rpath = lib.makeLibraryPath [ zlib libusb-compat-0_1 libusb1 readline ncurses5 stdenv.cc.cc ];
 
   installPhase = ''
     mkdir -p $out/share/arduino
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index 033cc2f872a..30fd21f2f83 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -187,11 +187,6 @@ let
     # Fix linker error on Darwin (see https://trac.macports.org/ticket/61865)
     NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lobjc";
 
-    # Avoid Qt 5.12 problem on Big Sur: https://bugreports.qt.io/browse/QTBUG-87014
-    qtWrapperArgs = lib.optionals stdenv.isDarwin [
-      "--set QT_MAC_WANTS_LAYER 1"
-    ];
-
     # See https://savannah.gnu.org/bugs/?50339
     F77_INTEGER_8_FLAG = if use64BitIdx then "-fdefault-integer-8" else "";
 
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 45c12b9720c..54769a03b7b 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -100,9 +100,22 @@ let
 
     enableParallelBuilding = !crossCompiling;
 
+    # perl includes the build date, the uname of the build system and the
+    # username of the build user in some files.
+    # We override these to make it build deterministically.
+    # other distro solutions
+    # https://github.com/bmwiedemann/openSUSE/blob/master/packages/p/perl/perl-reproducible.patch
+    # https://github.com/archlinux/svntogit-packages/blob/packages/perl/trunk/config.over
+    # https://salsa.debian.org/perl-team/interpreter/perl/blob/debian-5.26/debian/config.over
+    # A ticket has been opened upstream to possibly clean some of this up: https://rt.perl.org/Public/Bug/Display.html?id=133452
     preConfigure = ''
-        substituteInPlace ./Configure --replace '`LC_ALL=C; LANGUAGE=C; export LC_ALL; export LANGUAGE; $date 2>&1`' 'Thu Jan  1 00:00:01 UTC 1970'
-        substituteInPlace ./Configure --replace '$uname -a' '$uname --kernel-name --machine --operating-system'
+        cat > config.over <<EOF
+        ${lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) ''osvers="gnulinux"''}
+        myuname="nixpkgs"
+        myhostname="nixpkgs"
+        cf_by="nixpkgs"
+        cf_time="$(date -d "@$SOURCE_DATE_EPOCH")"
+        EOF
       '' + optionalString stdenv.isDarwin ''
         substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
       '' + optionalString (!enableThreading) ''
@@ -110,6 +123,9 @@ let
         sed -i 's,\(libswanted.*\)pthread,\1,g' Configure
       '';
 
+    # Default perl does not support --host= & co.
+    configurePlatforms = [];
+
     setupHook = ./setup-hook.sh;
 
     passthru = rec {
diff --git a/pkgs/development/interpreters/spidermonkey/78.nix b/pkgs/development/interpreters/spidermonkey/78.nix
index 5a63be5b838..cd745c5ba9e 100644
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "spidermonkey";
-  version = "78.11.0";
+  version = "78.15.0";
 
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha256 = "0zjpzkxx3wc2840d7q4b9lnkj1kwk1qps29s9c83jf5y6xclnf9q";
+    sha256 = "0l91cxdc5v9fps79ckb1kid4gw6v5qng1jd9zvaacwaiv628shx4";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/Xaw3d/default.nix b/pkgs/development/libraries/Xaw3d/default.nix
index 88501ca1ee6..3ec220ca80d 100644
--- a/pkgs/development/libraries/Xaw3d/default.nix
+++ b/pkgs/development/libraries/Xaw3d/default.nix
@@ -1,11 +1,23 @@
-{ lib, stdenv, fetchurl
-, imake, gccmakedep, bison, flex, pkg-config
-, xlibsWrapper, libXmu, libXpm, libXp }:
+{ lib
+, stdenv
+, fetchurl
+, imake
+, gccmakedep
+, bison
+, flex
+, pkg-config
+, xlibsWrapper
+, libXmu
+, libXpm
+, libXp
+}:
+
+stdenv.mkDerivation rec {
+  pname = "Xaw3d";
+  version = "1.6.3";
 
-stdenv.mkDerivation {
-  name = "Xaw3d-1.6.3";
   src = fetchurl {
-    url = "https://www.x.org/releases/individual/lib/libXaw3d-1.6.3.tar.bz2";
+    url = "https://www.x.org/releases/individual/lib/libXaw3d-${version}.tar.bz2";
     sha256 = "0i653s8g25cc0mimkwid9366bqkbyhdyjhckx7bw77j20hzrkfid";
   };
   dontUseImakeConfigure = true;
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a1e42a435ab..22798fb1d84 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -86,10 +86,6 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (!x11Support) "--without-x"
   ++ lib.optionals stdenv.isLinux [ "--enable-apparmor" "--enable-libaudit" ];
 
-  # Enable X11 autolaunch support in libdbus. This doesn't actually depend on X11
-  # (it just execs dbus-launch in dbus.tools), contrary to what the configure script demands.
-  # problems building without x11Support so disabled in that case for now
-  NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-DDBUS_ENABLE_X11_AUTOLAUNCH=1";
   NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-Wl,--as-needed";
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/dconf/default.nix b/pkgs/development/libraries/dconf/default.nix
index 550940f5a1e..a5879011697 100644
--- a/pkgs/development/libraries/dconf/default.nix
+++ b/pkgs/development/libraries/dconf/default.nix
@@ -52,6 +52,10 @@ stdenv.mkDerivation rec {
     "-Dgtk_doc=${lib.boolToString (!isCross)}" # gtk-doc does do some gobject introspection, which doesn't yet cross-compile.
   ] ++ lib.optional isCross "-Dvapi=false";
 
+  checkInputs = [
+    dbus # for dbus-daemon
+  ];
+
   doCheck = !stdenv.isAarch32 && !stdenv.isAarch64 && !stdenv.isDarwin;
 
   postPatch = ''
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 7f63d5f67e7..3182a4b3998 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -16,10 +16,11 @@
 , libjpeg
 , libpng
 , gnome
-, gobject-introspection
 , doCheck ? false
 , makeWrapper
 , lib
+, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, gobject-introspection
 }:
 
 let
@@ -43,13 +44,19 @@ stdenv.mkDerivation rec {
     ./installed-tests-path.patch
   ];
 
+  # gdk-pixbuf-thumbnailer is not wrapped therefore strictDeps will work
+  strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     gettext
     python3
-    gobject-introspection
     makeWrapper
     glib
     gi-docgen
@@ -58,7 +65,11 @@ stdenv.mkDerivation rec {
     libxslt
     docbook-xsl-nons
     docbook_xml_dtd_43
-  ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  ] ++ lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ];
 
   propagatedBuildInputs = [
     glib
@@ -69,7 +80,7 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dgtk_doc=${lib.boolToString withGtkDoc}"
-    "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
     "-Dgio_sniffing=false"
   ];
 
diff --git a/pkgs/development/libraries/gthree/default.nix b/pkgs/development/libraries/gthree/default.nix
index 990e151efe4..a59541edb25 100644
--- a/pkgs/development/libraries/gthree/default.nix
+++ b/pkgs/development/libraries/gthree/default.nix
@@ -11,7 +11,7 @@
 , glib
 , gtk3
 , graphene
-, epoxy
+, libepoxy
 , json-glib
 }:
 
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    epoxy
+    libepoxy
     json-glib
   ];
 
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 6fce8ca78e8..82bcad0b985 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -24,7 +24,7 @@
 , gobject-introspection
 , fribidi
 , xorg
-, epoxy
+, libepoxy
 , libxkbcommon
 , libxml2
 , gmp
@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libxkbcommon
-    epoxy
+    libepoxy
     isocodes
   ] ++ lib.optionals stdenv.isDarwin [
     AppKit
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 38df17765c8..5a61b78d85a 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -21,7 +21,7 @@
 , fribidi
 , harfbuzz
 , xorg
-, epoxy
+, libepoxy
 , libxkbcommon
 , libxml2
 , gnome
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libxkbcommon
-    epoxy
+    libepoxy
     isocodes
   ] ++ lib.optionals vulkanSupport [
     vulkan-headers
diff --git a/pkgs/development/libraries/gtkmm/3.x.nix b/pkgs/development/libraries/gtkmm/3.x.nix
index 734cf833fd8..2d0921cf097 100644
--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, meson, ninja, python3, gtk3, glibmm, cairomm, pangomm, atkmm, epoxy, gnome }:
+{ lib, stdenv, fetchurl, pkg-config, meson, ninja, python3, gtk3, glibmm, cairomm, pangomm, atkmm, libepoxy, gnome }:
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ pkg-config meson ninja python3 ];
-  buildInputs = [ epoxy ];
+  buildInputs = [ libepoxy ];
 
   propagatedBuildInputs = [ glibmm gtk3 atkmm cairomm pangomm ];
 
diff --git a/pkgs/development/libraries/gtkmm/4.x.nix b/pkgs/development/libraries/gtkmm/4.x.nix
index 67afc4026d1..c1bac87a6c0 100644
--- a/pkgs/development/libraries/gtkmm/4.x.nix
+++ b/pkgs/development/libraries/gtkmm/4.x.nix
@@ -9,7 +9,7 @@
 , glibmm_2_68
 , cairomm_1_16
 , pangomm_2_48
-, epoxy
+, libepoxy
 , gnome
 , makeFontsConf
 , xvfb-run
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    epoxy
+    libepoxy
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index e94fcc5ece9..06cc41c6b58 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -24,7 +24,7 @@
 }:
 
 let
-  version = "2.8.2";
+  version = "3.0.0";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     owner = "harfbuzz";
     repo = "harfbuzz";
     rev = version;
-    sha256 = "sha256-uqcwfe5Oa3S0tyZDzqhIQfRFEv/HaiVWzVvwjqpLo5g=";
+    sha256 = "sha256-yRRr4RcnbwoZ1Hn3+zbbocKFyBSLYx/exaAHNGsPINA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/judy/default.nix b/pkgs/development/libraries/judy/default.nix
index 077c4fe90fd..bec72ac8020 100644
--- a/pkgs/development/libraries/judy/default.nix
+++ b/pkgs/development/libraries/judy/default.nix
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
     configureFlagsArray+=("CFLAGS=-fno-strict-aliasing -fno-aggressive-loop-optimizations")
   '';
 
+  # Disable parallel builds as manpages lack some dependencies:
+  #    ../tool/jhton ext/JudyHS_funcs_3.htm | grep -v '^[   ]*$' | sed -e 's/\.C//' > man/man3/JudyHS_funcs
+  #    make[2]: *** No rule to make target 'man/man3/JSLD', needed by 'all-am'.  Stop.
+  # Let's wait for the upstream fix similar to https://sourceforge.net/p/judy/patches/4/
+  enableParallelBuilding = false;
+
   meta = {
     homepage = "http://judy.sourceforge.net/";
     license = lib.licenses.lgpl21Plus;
diff --git a/pkgs/development/libraries/kde-frameworks/kdeclarative.nix b/pkgs/development/libraries/kde-frameworks/kdeclarative.nix
index cc4e2699821..1389df5eb15 100644
--- a/pkgs/development/libraries/kde-frameworks/kdeclarative.nix
+++ b/pkgs/development/libraries/kde-frameworks/kdeclarative.nix
@@ -1,6 +1,6 @@
 {
   mkDerivation, extra-cmake-modules,
-  epoxy, kconfig, kglobalaccel, kguiaddons, ki18n, kiconthemes, kio, kpackage,
+  libepoxy, kconfig, kglobalaccel, kguiaddons, ki18n, kiconthemes, kio, kpackage,
   kwidgetsaddons, kwindowsystem, qtdeclarative
 }:
 
@@ -8,7 +8,7 @@ mkDerivation {
   name = "kdeclarative";
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
-    epoxy kglobalaccel kguiaddons ki18n kiconthemes kio kwidgetsaddons
+    libepoxy kglobalaccel kguiaddons ki18n kiconthemes kio kwidgetsaddons
     kwindowsystem
   ];
   propagatedBuildInputs = [ kconfig kpackage qtdeclarative ];
diff --git a/pkgs/development/libraries/libcdio/default.nix b/pkgs/development/libraries/libcdio/default.nix
index cfe796b14d0..71a953b8390 100644
--- a/pkgs/development/libraries/libcdio/default.nix
+++ b/pkgs/development/libraries/libcdio/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libcddb, pkg-config, ncurses, help2man, libiconv, Carbon, IOKit }:
+{ lib, stdenv, fetchurl, fetchpatch, libcddb, pkg-config, ncurses, help2man, libiconv, Carbon, IOKit }:
 
 stdenv.mkDerivation rec {
   name = "libcdio-2.1.0";
@@ -8,6 +8,16 @@ stdenv.mkDerivation rec {
     sha256 = "0avi6apv5ydjy6b9c3z9a46rvp5i57qyr09vr7x4nndxkmcfjl45";
   };
 
+  patches = [
+    # pull pending upstream patch to fix build on ncurses-6.3:
+    #  https://savannah.gnu.org/patch/index.php?10130
+    (fetchpatch {
+      name = "ncurses-6.3.patch";
+      url = "https://savannah.gnu.org/patch/download.php?file_id=52179";
+      sha256 = "1v15gxhpi4bgcr12pb3d9c3hiwj0drvc832vic7sham34lhjmcbb";
+    })
+  ];
+
   postPatch = ''
     patchShebangs .
   '';
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index 3fb89091aa0..449a3d309cd 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fixDarwinDylibNames }:
+{ stdenv, lib, fetchpatch, fetchFromGitHub, fixDarwinDylibNames, pkgsStatic }:
 
 stdenv.mkDerivation rec {
   pname = "libdeflate";
@@ -11,10 +11,19 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-P7YbuhP2/zJCpE9dxZev1yy5oda8WKAHY84ZLTL8gVs=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ebiggers/libdeflate/commit/ee4d18872bfe09a32cfd031c716b9069a04a50a0.diff";
+      sha256 = "0d2lllg60zbbbch0w0qrcqijrgski8xlsy5llg3i684d66ci538a";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace Makefile --replace /usr/local $out
   '';
 
+  makeFlags = lib.optional stdenv.hostPlatform.isStatic [ "DISABLE_SHARED=1"];
+
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   configurePhase = ''
@@ -23,11 +32,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests.static = pkgsStatic.libdeflate;
   meta = with lib; {
     description = "Fast DEFLATE/zlib/gzip compressor and decompressor";
     license = licenses.mit;
     homepage = "https://github.com/ebiggers/libdeflate";
     platforms = platforms.unix;
-    maintainers = with maintainers; [ orivej ];
+    maintainers = with maintainers; [ orivej kaction ];
   };
 }
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index c5bf352ff57..ae442e69836 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.107";
+  version = "2.4.108";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "127qf1rzhaf13vdd75a58v5q34617hvangjlfnlkcdh37gqcwm65";
+    sha256 = "186nwf7qnzh805iz8k3djq3pd1m79mgfnjsbw7yn6rskpj699mx1";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/epoxy/default.nix b/pkgs/development/libraries/libepoxy/default.nix
index 7ae0e73953f..83b8ba8960d 100644
--- a/pkgs/development/libraries/epoxy/default.nix
+++ b/pkgs/development/libraries/libepoxy/default.nix
@@ -5,12 +5,12 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  pname = "epoxy";
+  pname = "libepoxy";
   version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "anholt";
-    repo = "libepoxy";
+    repo = pname;
     rev = version;
     sha256 = "0rmg0qlswn250h0arx434jh3hwzsr95lawanpmh1czsfvrcx59l6";
   };
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     description = "A library for handling OpenGL function pointer management";
     homepage = "https://github.com/anholt/libepoxy";
     license = licenses.mit;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = with maintainers; [ goibhniu erictapen ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/epoxy/libgl-path.patch b/pkgs/development/libraries/libepoxy/libgl-path.patch
index 8f38ee27174..8f38ee27174 100644
--- a/pkgs/development/libraries/epoxy/libgl-path.patch
+++ b/pkgs/development/libraries/libepoxy/libgl-path.patch
diff --git a/pkgs/development/libraries/libgudev/default.nix b/pkgs/development/libraries/libgudev/default.nix
index 87061ae6559..6a63947c8a5 100644
--- a/pkgs/development/libraries/libgudev/default.nix
+++ b/pkgs/development/libraries/libgudev/default.nix
@@ -5,9 +5,10 @@
 , ninja
 , udev
 , glib
-, gobject-introspection
 , gnome
 , vala
+, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
@@ -21,12 +22,18 @@ stdenv.mkDerivation rec {
     sha256 = "1al6nr492nzbm8ql02xhzwci2kwb1advnkaky3j9636jf08v41hd";
   };
 
+  strictDeps = true;
+
+  depsBuildBuild = [ pkg-config ];
+
   nativeBuildInputs = [
     pkg-config
-    gobject-introspection
     meson
     ninja
     vala
+    glib # for glib-mkenums needed during the build
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -37,8 +44,8 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     # There's a dependency cycle with umockdev and the tests fail to LD_PRELOAD anyway
     "-Dtests=disabled"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dintrospection=disabled"
     "-Dvapi=disabled"
   ];
 
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index b108a5c5eea..40089e3d7e9 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -7,8 +7,9 @@
 , docbook-xsl-ns
 , glib
 , gdk-pixbuf
-, gobject-introspection
 , gnome
+, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
@@ -27,15 +28,24 @@ stdenv.mkDerivation rec {
     "-Dtests=false"
     "-Ddocbook_docs=disabled"
     "-Dgtk_doc=false"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
-    gobject-introspection
     meson
     ninja
     pkg-config
     libxslt
     docbook-xsl-ns
+    glib # for glib-mkenums needed during the build
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ];
+
+  buildInputs = lib.optionals withIntrospection [
+    gobject-introspection
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/libplacebo/default.nix b/pkgs/development/libraries/libplacebo/default.nix
index 099bac9274b..5ce953be070 100644
--- a/pkgs/development/libraries/libplacebo/default.nix
+++ b/pkgs/development/libraries/libplacebo/default.nix
@@ -9,7 +9,7 @@
 , shaderc
 , glslang
 , lcms2
-, epoxy
+, libepoxy
 , libGL
 , xorg
 }:
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     shaderc
     glslang
     lcms2
-    epoxy
+    libepoxy
     libGL
     xorg.libX11
   ];
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index 562820bed6a..0a710d648fb 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -21,11 +21,11 @@ let
     && !stdenv.isAarch64;
 in stdenv.mkDerivation rec {
   pname = "libpsl";
-  version = "0.21.0";
+  version = "0.21.1";
 
   src = fetchurl {
-    url = "https://github.com/rockdaboot/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.lz";
-    sha256 = "183hadbira0d2zvv8272lspy31dgm9x26z35c61s5axcd5wd9g9i";
+    url = "https://github.com/rockdaboot/libpsl/releases/download/${version}/libpsl-${version}.tar.lz";
+    sha256 = "1a9kp2rj71jb9q030lmp3zhy33rqxscawbfzhp288fxvazapahv4";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index c59a80c0e0f..25f8209dd3d 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -105,6 +105,9 @@ stdenv.mkDerivation rec {
     # Fix thumbnailer path
     sed -e "s#@bindir@\(/gdk-pixbuf-thumbnailer\)#${gdk-pixbuf}/bin\1#g" \
         -i gdk-pixbuf-loader/librsvg.thumbnailer.in
+
+    # 'error: linker `cc` not found' when cross-compiling
+    export RUSTFLAGS="-Clinker=$CC"
   '';
 
   # Not generated when cross compiling.
diff --git a/pkgs/development/libraries/libsass/default.nix b/pkgs/development/libraries/libsass/default.nix
index 9b61ce65d45..83df5161a8e 100644
--- a/pkgs/development/libraries/libsass/default.nix
+++ b/pkgs/development/libraries/libsass/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libsass";
-  version = "3.6.5";
+  version = "3.6.5"; # also check sassc for updates
 
   src = fetchFromGitHub {
     owner = "sass";
diff --git a/pkgs/development/libraries/libuninameslist/default.nix b/pkgs/development/libraries/libuninameslist/default.nix
index 2e75c783681..90ea1947cb5 100644
--- a/pkgs/development/libraries/libuninameslist/default.nix
+++ b/pkgs/development/libraries/libuninameslist/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libuninameslist";
-  version = "20200413";
+  version = "20210917";
 
   src = fetchFromGitHub {
     owner = "fontforge";
     repo = pname;
     rev = version;
-    sha256 = "0jbg94z00f5vwqyjfrbill6cjvzp1zrki6m3d235jjxyw0hm3wr5";
+    sha256 = "sha256-bwMgNK3DhhWjijush27265Q1UoZOw7T17fKsaR6IV14=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libwpe/fdo.nix b/pkgs/development/libraries/libwpe/fdo.nix
index e9c0e3c7f44..e68c60ebbdb 100644
--- a/pkgs/development/libraries/libwpe/fdo.nix
+++ b/pkgs/development/libraries/libwpe/fdo.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , ninja
 , wayland
-, epoxy
+, libepoxy
 , glib
 , libwpe
 , libxkbcommon
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     wayland
-    epoxy
+    libepoxy
     glib
     libwpe
     libxkbcommon
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 31f0a0e750d..05935e65ea0 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -129,6 +129,9 @@ self = stdenv.mkDerivation {
     "-Dgallium-nine=${boolToString enableGalliumNine}" # Direct3D in Wine
     "-Dosmesa=${boolToString enableOSMesa}" # used by wine
     "-Dmicrosoft-clc=disabled" # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
+
+    # To enable non-mesa gbm backends to be found (e.g. Nvidia)
+    "-Dgbm-backends-path=${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm"
   ] ++ optionals stdenv.isLinux [
     "-Dglvnd=true"
   ] ++ optionals enableOpenCL [
diff --git a/pkgs/development/libraries/movit/default.nix b/pkgs/development/libraries/movit/default.nix
index 9c03a9f6c49..de69bd730d2 100644
--- a/pkgs/development/libraries/movit/default.nix
+++ b/pkgs/development/libraries/movit/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, SDL2, eigen, epoxy, fftw, gtest, pkg-config }:
+{ lib, stdenv, fetchurl, SDL2, eigen, libepoxy, fftw, gtest, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "movit";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   GTEST_DIR = "${gtest.src}/googletest";
 
-  propagatedBuildInputs = [ eigen epoxy ];
+  propagatedBuildInputs = [ eigen libepoxy ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ SDL2 fftw gtest ];
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 9d85515e2fa..ad212e1b1d7 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -27,7 +27,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.71";
+  version = "3.72";
 
 in
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
+    sha256 = "bqYKn/ET5JPqKrJfQep1qfvRCveQPyb3A9rIaAcy0C4=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/ocl-icd/default.nix b/pkgs/development/libraries/ocl-icd/default.nix
index 7dbcecab0c8..ea8e1841b0c 100644
--- a/pkgs/development/libraries/ocl-icd/default.nix
+++ b/pkgs/development/libraries/ocl-icd/default.nix
@@ -25,10 +25,15 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ opencl-headers ];
 
+  configureFlags = [
+    "--enable-custom-vendordir=/run/opengl-driver/etc/OpenCL/vendors"
+  ];
+
   meta = with lib; {
     description = "OpenCL ICD Loader for ${opencl-headers.name}";
     homepage    = "https://github.com/OCL-dev/ocl-icd";
     license     = licenses.bsd2;
     platforms = platforms.unix;
+    maintainers = with maintainers; [ r-burns ];
   };
 }
diff --git a/pkgs/development/libraries/opencl-headers/default.nix b/pkgs/development/libraries/opencl-headers/default.nix
index d7a8b4497f7..661fd734d88 100644
--- a/pkgs/development/libraries/opencl-headers/default.nix
+++ b/pkgs/development/libraries/opencl-headers/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "opencl-headers-${version}";
-  version = "2020.06.16";
+  version = "2021.06.30";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-Headers";
     rev = "v${version}";
-    sha256 = "0viiwhfqccw90r3mr45ab3wyhabpdrihplj5842brn5ny0ayh73z";
+    sha256 = "sha256-MdKC48f1zhVAcHrqzrgT9iaYrHXurV8vDt+GnDroO9s=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 513bfe2d17e..c298ca8c17d 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -6,7 +6,6 @@
 , harfbuzz
 , libintl
 , libthai
-, gobject-introspection
 , darwin
 , fribidi
 , gnome
@@ -16,12 +15,13 @@
 , meson
 , ninja
 , glib
+, python3
 , x11Support? !stdenv.isDarwin, libXft
+, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, gobject-introspection
+, withDocs ? (stdenv.buildPlatform == stdenv.hostPlatform)
 }:
 
-let
-  withDocs = stdenv.buildPlatform == stdenv.hostPlatform;
-in
 stdenv.mkDerivation rec {
   pname = "pango";
   version = "1.48.10";
@@ -34,12 +34,21 @@ stdenv.mkDerivation rec {
     sha256 = "IeH1eYvN/adeq8QoBRSwiWq1b2VtTn5mAwuaJTXs3Jg=";
   };
 
+  strictDeps = !withIntrospection;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson ninja
     glib # for glib-mkenum
     pkg-config
+  ] ++ lib.optionals withIntrospection [
     gobject-introspection
+  ] ++ lib.optionals withDocs [
     gi-docgen
+    python3
   ];
 
   buildInputs = [
@@ -63,10 +72,9 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dgtk_doc=${lib.boolToString withDocs}"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
   ] ++ lib.optionals (!x11Support) [
     "-Dxft=disabled" # only works with x11
-  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dintrospection=disabled"
   ];
 
   # Fontconfig error: Cannot load default config file
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index 0f5eb19474e..a047b5b7108 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -70,6 +70,17 @@ let
       # Ensure -I${includedir} is added to Cflags in pkg-config files.
       # See https://github.com/NixOS/nixpkgs/issues/52457
       ./qtbase.patch.d/0014-qtbase-pkg-config.patch
+
+      # Make Qt applications work on macOS Big Sur even if they're
+      # built with an older version of the macOS SDK (<10.14). This
+      # issue is fixed in 5.12.11, but it requires macOS SDK 10.13 to
+      # build. See https://bugreports.qt.io/browse/QTBUG-87014 for
+      # more info.
+      (fetchpatch {
+        name = "big_sur_layer_backed_views.patch";
+        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=c5d904639dbd690a36306e2b455610029704d821";
+        sha256 = "0crkw3j1iwdc1pbf5dhar0b4q3h5gs2q1sika8m12y02yk3ns697";
+      })
     ];
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtlocation = [ ./qtlocation-gcc-9.patch ];
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 183311c5f18..0b4fc4f1c5e 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -58,14 +58,7 @@ let
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
-    qtwebengine = [
-      # Fix invisible fonts with glibc 2.33: https://github.com/NixOS/nixpkgs/issues/131074
-      (fetchpatch {
-        url = "https://src.fedoraproject.org/rpms/qt5-qtwebengine/raw/d122c011631137b79455850c363676c655cf9e09/f/qtwebengine-everywhere-src-5.15.5-%231904652.patch";
-        name = "qtwebengine-everywhere-src-5.15.5-_1904652.patch";
-        sha256 = "01q7hagq0ysii1jnrh5adm97vdm9cis592xr6im7accyw6hgcn7b";
-      })
-    ] ++ lib.optionals stdenv.isDarwin [
+    qtwebengine = lib.optionals stdenv.isDarwin [
       ./qtwebengine-darwin-no-platform-check.patch
       ./qtwebengine-mac-dont-set-dsymutil-path.patch
     ];
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index e254912b600..1fe00d7e539 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -38,7 +38,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
   qtwebengine =
     let
-      branchName = "5.15.6";
+      branchName = "5.15.7";
       rev = "v${branchName}-lts";
     in
     {
@@ -46,7 +46,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
       src = fetchgit {
         url = "https://github.com/qt/qtwebengine.git";
-        sha256 = "17bw9yf04zmr9ck5jkrd435c8b03zpf937vn2nwgsr8p78wkg3kr";
+        sha256 = "fssBN/CDgXAuiNj14MPeIDI15ZDRBGuF7wxSXns9exU=";
         inherit rev branchName;
         fetchSubmodules = true;
         leaveDotGit = true;
diff --git a/pkgs/development/libraries/retro-gtk/default.nix b/pkgs/development/libraries/retro-gtk/default.nix
index 3ab3ffcda0d..e1385f7a3ef 100644
--- a/pkgs/development/libraries/retro-gtk/default.nix
+++ b/pkgs/development/libraries/retro-gtk/default.nix
@@ -5,7 +5,7 @@
 , meson
 , ninja
 , pkg-config
-, epoxy
+, libepoxy
 , glib
 , gtk3
 , libpulseaudio
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    epoxy
+    libepoxy
     glib
     gtk3
     libpulseaudio
diff --git a/pkgs/development/libraries/spice-gtk/default.nix b/pkgs/development/libraries/spice-gtk/default.nix
index 3d76e67f67a..13bfae944e0 100644
--- a/pkgs/development/libraries/spice-gtk/default.nix
+++ b/pkgs/development/libraries/spice-gtk/default.nix
@@ -3,7 +3,7 @@
 , acl
 , cyrus_sasl
 , docbook_xsl
-, epoxy
+, libepoxy
 , gettext
 , gobject-introspection
 , gst_all_1
@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     cyrus_sasl
-    epoxy
+    libepoxy
     gtk3
     json-glib
     libcacard
diff --git a/pkgs/development/libraries/stfl/default.nix b/pkgs/development/libraries/stfl/default.nix
index 20676c16b9c..48c5edd13bf 100644
--- a/pkgs/development/libraries/stfl/default.nix
+++ b/pkgs/development/libraries/stfl/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, ncurses, libiconv }:
 
 stdenv.mkDerivation rec {
-  name = "stfl-0.24";
+  pname = "stfl";
+  version = "0.24";
 
   src = fetchurl {
-    url = "http://www.clifford.at/stfl/${name}.tar.gz";
+    url = "http://www.clifford.at/stfl/stfl-${version}.tar.gz";
     sha256 = "1460d5lc780p3q38l3wc9jfr2a7zlyrcra0li65aynj738cam9yl";
   };
 
@@ -13,9 +14,9 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     sed -i s/gcc/cc/g Makefile
     sed -i s%ncursesw/ncurses.h%ncurses.h% stfl_internals.h
-  '' + ( lib.optionalString stdenv.isDarwin ''
+  '' + (lib.optionalString stdenv.isDarwin ''
     sed -i s/-soname/-install_name/ Makefile
-  '' ) + ''
+  '') + ''
     make
   '';
 
@@ -27,10 +28,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage    = "http://www.clifford.at/stfl/";
+    homepage = "http://www.clifford.at/stfl/";
     description = "A library which implements a curses-based widget set for text terminals";
     maintainers = with lib.maintainers; [ lovek323 ];
-    license     = lib.licenses.lgpl3;
-    platforms   = lib.platforms.unix;
+    license = lib.licenses.lgpl3;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/t1lib/default.nix b/pkgs/development/libraries/t1lib/default.nix
index 5bd4b02b61d..69940c18aaf 100644
--- a/pkgs/development/libraries/t1lib/default.nix
+++ b/pkgs/development/libraries/t1lib/default.nix
@@ -16,11 +16,12 @@ let
       # this ^ also fixes CVE-2011-5244
   ];
 in
-stdenv.mkDerivation {
-  name = "t1lib-5.1.2";
+stdenv.mkDerivation rec {
+  pname = "t1lib";
+  version = "5.1.2";
 
   src = fetchurl {
-    url = "mirror://metalab/libs/graphics/t1lib-5.1.2.tar.gz";
+    url = "mirror://metalab/libs/graphics/t1lib-${version}.tar.gz";
     sha256 = "0nbvjpnmcznib1nlgg8xckrmsw3haa154byds2h90y2g0nsjh4w2";
   };
   inherit patches;
diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index 2e2e09be108..febf1b97eb6 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tdb";
-  version = "1.4.3";
+  version = "1.4.5";
 
   src = fetchurl {
     url = "mirror://samba/tdb/${pname}-${version}.tar.gz";
-    sha256 = "06waz0k50c7v3chd08mzp2rv7w4k4q9isbxx3vhlfpx1vy9q61f8";
+    sha256 = "sha256-vPztiE9wMQgJmLXEscXc5XVnBV95QX+G26QNzemaDkE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/tecla/default.nix b/pkgs/development/libraries/tecla/default.nix
index 9682ac1637a..11918d76da6 100644
--- a/pkgs/development/libraries/tecla/default.nix
+++ b/pkgs/development/libraries/tecla/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "tecla-1.6.3";
+  pname = "tecla";
+  version = "1.6.3";
 
   src = fetchurl {
-    url = "https://www.astro.caltech.edu/~mcs/tecla/lib${name}.tar.gz";
+    url = "https://www.astro.caltech.edu/~mcs/tecla/libtecla-${version}.tar.gz";
     sha256 = "06pfq5wa8d25i9bdjkp4xhms5101dsrbg82riz7rz1a0a32pqxgj";
   };
 
diff --git a/pkgs/development/libraries/telepathy/qt/default.nix b/pkgs/development/libraries/telepathy/qt/default.nix
index dbbaca7e11a..37a71fb2536 100644
--- a/pkgs/development/libraries/telepathy/qt/default.nix
+++ b/pkgs/development/libraries/telepathy/qt/default.nix
@@ -1,13 +1,25 @@
-{ lib, stdenv, fetchurl, cmake, qtbase, pkg-config, python3Packages, dbus-glib, dbus
-, telepathy-farstream, telepathy-glib }:
+{ lib
+, stdenv
+, fetchurl
+, cmake
+, qtbase
+, pkg-config
+, python3Packages
+, dbus-glib
+, dbus
+, telepathy-farstream
+, telepathy-glib
+}:
 
 let
   inherit (python3Packages) python dbus-python;
-in stdenv.mkDerivation rec {
-  name = "telepathy-qt-0.9.8";
+in
+stdenv.mkDerivation rec {
+  pname = "telepathy-qt";
+  version = "0.9.8";
 
   src = fetchurl {
-    url = "https://telepathy.freedesktop.org/releases/telepathy-qt/${name}.tar.gz";
+    url = "https://telepathy.freedesktop.org/releases/telepathy-qt/telepathy-qt-${version}.tar.gz";
     sha256 = "bf8e2a09060addb80475a4938105b9b41d9e6837999b7a00e5351783857e18ad";
   };
 
diff --git a/pkgs/development/libraries/tokyo-tyrant/default.nix b/pkgs/development/libraries/tokyo-tyrant/default.nix
index 6431e6a1a7a..6407840c443 100644
--- a/pkgs/development/libraries/tokyo-tyrant/default.nix
+++ b/pkgs/development/libraries/tokyo-tyrant/default.nix
@@ -1,17 +1,18 @@
 { fetchurl, lib, stdenv, tokyocabinet, pkg-config }:
 
 stdenv.mkDerivation rec {
-  name = "tokyotyrant-1.1.41";
+  pname = "tokyotyrant";
+  version = "1.1.41";
 
   src = fetchurl {
-    url = "https://fallabs.com/tokyotyrant/${name}.tar.gz";
+    url = "https://fallabs.com/tokyotyrant/tokyotyrant-${version}.tar.gz";
     sha256 = "13xqcinhydqmh7231qlir6pymacjwcf98drybkhd9597kzxp1bs2";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ tokyocabinet ];
 
-  doCheck = false;                                # FIXME
+  doCheck = false; # FIXME
 
   meta = {
     description = "Network interface of the Tokyo Cabinet DBM";
@@ -35,7 +36,7 @@ stdenv.mkDerivation rec {
 
     license = lib.licenses.lgpl21Plus;
 
-    platforms = lib.platforms.gnu ++ lib.platforms.linux;         # arbitrary choice
+    platforms = lib.platforms.gnu ++ lib.platforms.linux; # arbitrary choice
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index fc0ba54cbe7..7dbe0d410f7 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , gettext
 , meson
 , ninja
@@ -31,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker";
-  version = "3.2.0";
+  version = "3.2.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8RelKHXUpNCceqmT+Mio0GRo1dz7FT642qUesThEUTo=";
+    sha256 = "GEfgiznm5h2EhzWqH5f32WwDggFlP6DXy56Bs365wDo=";
   };
 
   patches = [
@@ -45,13 +44,6 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit asciidoc;
     })
-  ] ++ lib.optionals (stdenv.hostPlatform.isi686) [
-    # Upstream: https://gitlab.gnome.org/GNOME/tracker/-/issues/332
-    (fetchpatch {
-      name = "i686-test.patch";
-      url = "https://gitlab.gnome.org/GNOME/tracker/-/commit/af707181a2c492a794daec7ce3f3062d67ffd9dc.patch";
-      sha256 = "sha256-KOdkTy79w3oiQILrPG00UVrv+VBjAk4Y868I8jtifqk=";
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/tremor/default.nix b/pkgs/development/libraries/tremor/default.nix
index 16e1a78d396..d17ef6c8fd7 100644
--- a/pkgs/development/libraries/tremor/default.nix
+++ b/pkgs/development/libraries/tremor/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchFromGitLab, autoreconfHook, pkg-config, libogg }:
 
 stdenv.mkDerivation {
-  name = "tremor-unstable-2018-03-16";
+  pname = "tremor";
+  version = "unstable-2018-03-16";
 
   src = fetchFromGitLab {
     owner = "xiph";
diff --git a/pkgs/development/libraries/ucl/default.nix b/pkgs/development/libraries/ucl/default.nix
index 43f7ddf63af..5aef7e9d8f4 100644
--- a/pkgs/development/libraries/ucl/default.nix
+++ b/pkgs/development/libraries/ucl/default.nix
@@ -1,9 +1,11 @@
 { lib, stdenv, fetchurl }:
 
-stdenv.mkDerivation {
-  name = "ucl-1.03";
+stdenv.mkDerivation rec {
+  pname = "ucl";
+  version = "1.03";
+
   src = fetchurl {
-    url = "https://www.oberhumer.com/opensource/ucl/download/ucl-1.03.tar.gz";
+    url = "https://www.oberhumer.com/opensource/ucl/download/ucl-${version}.tar.gz";
     sha256 = "b865299ffd45d73412293369c9754b07637680e5c826915f097577cd27350348";
   };
 
diff --git a/pkgs/development/libraries/uid_wrapper/default.nix b/pkgs/development/libraries/uid_wrapper/default.nix
index ec7626a7e8b..c4ec9c84f40 100644
--- a/pkgs/development/libraries/uid_wrapper/default.nix
+++ b/pkgs/development/libraries/uid_wrapper/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, cmake, pkg-config }:
 
 stdenv.mkDerivation rec {
-  name = "uid_wrapper-1.2.8";
+  pname = "uid_wrapper";
+  version = "1.2.8";
 
   src = fetchurl {
-    url = "mirror://samba/cwrap/${name}.tar.gz";
+    url = "mirror://samba/cwrap/uid_wrapper-${version}.tar.gz";
     sha256 = "0swm9d8l69dw7nbrw6xh7rdy7cfrqflw3hxshicsrhd9v03iwvqf";
   };
 
diff --git a/pkgs/development/libraries/virglrenderer/default.nix b/pkgs/development/libraries/virglrenderer/default.nix
index 4c4af6b2c1f..1fbf94452f7 100644
--- a/pkgs/development/libraries/virglrenderer/default.nix
+++ b/pkgs/development/libraries/virglrenderer/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, cmake, meson, ninja, pkg-config, python3
-, libGLU, epoxy, libX11, libdrm, mesa
+, libGLU, libepoxy, libX11, libdrm, mesa
 }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1h76a1ylhh4niq33sa5knx033sr4k2816vibh4m58j54y7qc6346";
   };
 
-  buildInputs = [ libGLU epoxy libX11 libdrm mesa ];
+  buildInputs = [ libGLU libepoxy libX11 libdrm mesa ];
 
   nativeBuildInputs = [ cmake meson ninja pkg-config python3 ];
 
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 08741c29dd6..1d6bf0f7aa4 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -78,6 +78,7 @@ stdenv.mkDerivation rec {
     xmlto
     python3
     docbook_xml_dtd_45
+    docbook_xsl
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 304dfbc2e78..d3b0ef67d86 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -21,7 +21,7 @@
 , enchant2
 , xorg
 , libxkbcommon
-, epoxy
+, libepoxy
 , at-spi2-core
 , libxml2
 , libsoup
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     at-spi2-core
     enchant2
-    epoxy
+    libepoxy
     gnutls
     gst-plugins-bad
     gst-plugins-base
diff --git a/pkgs/development/libraries/webrtc-audio-processing/default.nix b/pkgs/development/libraries/webrtc-audio-processing/default.nix
index d757789fc26..1ce3c2d9fa8 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/default.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, darwin }:
 
 stdenv.mkDerivation rec {
-  name = "webrtc-audio-processing-0.3.1";
+  pname = "webrtc-audio-processing";
+  version = "0.3.1";
 
   src = fetchurl {
-    url = "https://freedesktop.org/software/pulseaudio/webrtc-audio-processing/${name}.tar.xz";
+    url = "https://freedesktop.org/software/pulseaudio/webrtc-audio-processing/webrtc-audio-processing-${version}.tar.xz";
     sha256 = "1gsx7k77blfy171b6g3m0k0s0072v6jcawhmx1kjs9w5zlwdkzd0";
   };
 
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
index ea6ead43f0c..4c8a63a0a52 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, unzip, makeWrapper}:
+{ stdenv, fetchurl, unzip, makeWrapper }:
 
 let
   # Gradle is a build system that bootstraps itself. This is what it actually
@@ -53,16 +53,21 @@ let
   };
 in
 stdenv.mkDerivation {
-  name = "mobilesdk-7.5.1.GA";
-  src = if (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") then fetchurl {
-    url = "https://builds.appcelerator.com/mobile/7_5_X/mobilesdk-7.5.1.v20190124152315-linux.zip";
-    sha256 = "1ihyh6szl9a2gbdgv13msd3g7i3xi9ifmgsh6v562hqlfi4lixng";
-  }
-  else if stdenv.system == "x86_64-darwin" then fetchurl {
-    url = "https://builds.appcelerator.com/mobile/7_5_X/mobilesdk-7.5.1.v20190124152315-osx.zip";
-    sha256 = "1whs1j7fkk2hxr4nxq50d7ic5wj83b1i1jl0p722sqbvkmgxssa2";
-  }
-  else throw "Platform: ${stdenv.system} not supported!";
+  pname = "mobilesdk";
+  version = "7.5.1.GA";
+
+  src =
+    if (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") then
+      fetchurl {
+        url = "https://builds.appcelerator.com/mobile/7_5_X/mobilesdk-7.5.1.v20190124152315-linux.zip";
+        sha256 = "1ihyh6szl9a2gbdgv13msd3g7i3xi9ifmgsh6v562hqlfi4lixng";
+      }
+    else if stdenv.system == "x86_64-darwin" then
+      fetchurl {
+        url = "https://builds.appcelerator.com/mobile/7_5_X/mobilesdk-7.5.1.v20190124152315-osx.zip";
+        sha256 = "1whs1j7fkk2hxr4nxq50d7ic5wj83b1i1jl0p722sqbvkmgxssa2";
+      }
+    else throw "Platform: ${stdenv.system} not supported!";
 
   nativeBuildInputs = [ makeWrapper unzip ];
 
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
index 7cb0390417f..e51775b8c6d 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
@@ -1,4 +1,4 @@
-{stdenv, lib, fetchurl, unzip, makeWrapper}:
+{ stdenv, lib, fetchurl, unzip, makeWrapper }:
 
 let
   # Gradle is a build system that bootstraps itself. This is what it actually
@@ -53,16 +53,21 @@ let
   };
 in
 stdenv.mkDerivation {
-  name = "mobilesdk-8.2.1.GA";
-  src = if (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") then fetchurl {
-    url = "https://builds.appcelerator.com/mobile/8_2_X/mobilesdk-8.2.1.v20191025070136-linux.zip";
-    sha256 = "1nvcmm6cby6bmwdiacq46n5y4zjpz9qlipakvglw27j3p4rbmkwl";
-  }
-  else if stdenv.system == "x86_64-darwin" then fetchurl {
-    url = "https://builds.appcelerator.com/mobile/8_2_X/mobilesdk-8.2.1.v20191025070136-osx.zip";
-    sha256 = "1nxwmyw3vqc5wghj38kpksisy0i808x0x3pa8w3p290w709g311l";
-  }
-  else throw "Platform: ${stdenv.system} not supported!";
+  pname = "mobilesdk";
+  version = "8.2.1.GA";
+
+  src =
+    if (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") then
+      fetchurl {
+        url = "https://builds.appcelerator.com/mobile/8_2_X/mobilesdk-8.2.1.v20191025070136-linux.zip";
+        sha256 = "1nvcmm6cby6bmwdiacq46n5y4zjpz9qlipakvglw27j3p4rbmkwl";
+      }
+    else if stdenv.system == "x86_64-darwin" then
+      fetchurl {
+        url = "https://builds.appcelerator.com/mobile/8_2_X/mobilesdk-8.2.1.v20191025070136-osx.zip";
+        sha256 = "1nxwmyw3vqc5wghj38kpksisy0i808x0x3pa8w3p290w709g311l";
+      }
+    else throw "Platform: ${stdenv.system} not supported!";
 
   nativeBuildInputs = [ makeWrapper unzip ];
 
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
index aef3e0c56e4..eadbad7e0f5 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
@@ -1,4 +1,4 @@
-{stdenv, lib, fetchurl, unzip, makeWrapper}:
+{ stdenv, lib, fetchurl, unzip, makeWrapper }:
 
 let
   # Gradle is a build system that bootstraps itself. This is what it actually
@@ -53,16 +53,21 @@ let
   };
 in
 stdenv.mkDerivation {
-  name = "mobilesdk-8.3.2.GA";
-  src = if (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") then fetchurl {
-    url = "https://builds.appcelerator.com/mobile/8_3_X/mobilesdk-8.3.2.v20200117111803-linux.zip";
-    sha256 = "04pfw21jrx9w259lphynwykqjk4c9hm0zix4d40s7mf8mmh3xdx9";
-  }
-  else if stdenv.system == "x86_64-darwin" then fetchurl {
-    url = "https://builds.appcelerator.com/mobile/8_3_X/mobilesdk-8.3.2.v20200117111803-osx.zip";
-    sha256 = "1zflq5hc96lrriw71ya623kkskkisi9yayg8qs03zimi0gksizxw";
-  }
-  else throw "Platform: ${stdenv.system} not supported!";
+  pname = "mobilesdk";
+  version = "8.3.2.GA";
+
+  src =
+    if (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") then
+      fetchurl {
+        url = "https://builds.appcelerator.com/mobile/8_3_X/mobilesdk-8.3.2.v20200117111803-linux.zip";
+        sha256 = "04pfw21jrx9w259lphynwykqjk4c9hm0zix4d40s7mf8mmh3xdx9";
+      }
+    else if stdenv.system == "x86_64-darwin" then
+      fetchurl {
+        url = "https://builds.appcelerator.com/mobile/8_3_X/mobilesdk-8.3.2.v20200117111803-osx.zip";
+        sha256 = "1zflq5hc96lrriw71ya623kkskkisi9yayg8qs03zimi0gksizxw";
+      }
+    else throw "Platform: ${stdenv.system} not supported!";
 
   nativeBuildInputs = [ makeWrapper unzip ];
 
diff --git a/pkgs/development/ocaml-modules/bolt/default.nix b/pkgs/development/ocaml-modules/bolt/default.nix
index ea32d659f64..a6b63676e77 100644
--- a/pkgs/development/ocaml-modules/bolt/default.nix
+++ b/pkgs/development/ocaml-modules/bolt/default.nix
@@ -10,17 +10,18 @@ then throw "bolt is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {
-
-  name = "bolt-1.4";
+  pname = "bolt";
+  version = "1.4";
 
   src = fetchurl {
-    url = "https://forge.ocamlcore.org/frs/download.php/1043/${name}.tar.gz";
+    url = "https://forge.ocamlcore.org/frs/download.php/1043/bolt-${version}.tar.gz";
     sha256 = "1c807wrpxra9sbb34lajhimwra28ldxv04m570567lh2b04n38zy";
   };
 
   buildInputs = [ ocaml findlib ocamlbuild which camlp4 ];
 
-  patches = [ (fetchpatch {
+  patches = [
+    (fetchpatch {
       url = "https://raw.githubusercontent.com/ocaml/opam-repository/master/packages/bolt/bolt.1.4/files/opam.patch";
       sha256 = "08cl39r98w312sw23cskd5wian6zg20isn9ki41hnbcgkazhi7pb";
     })
@@ -43,7 +44,7 @@ EOF
   # option. Installation is handled by ocamlfind.
   dontAddPrefix = true;
   dontAddStaticConfigureFlags = true;
-  configurePlatforms = [];
+  configurePlatforms = [ ];
 
   createFindlibDestdir = true;
 
@@ -60,7 +61,7 @@ EOF
       modeled after the famous log4j logging framework for Java.
     '';
     license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = [ maintainers.jirkamarsik ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/calendar/default.nix b/pkgs/development/ocaml-modules/calendar/default.nix
index 1210ed41dc2..29927aae04a 100644
--- a/pkgs/development/ocaml-modules/calendar/default.nix
+++ b/pkgs/development/ocaml-modules/calendar/default.nix
@@ -1,21 +1,23 @@
-{stdenv, lib, fetchurl, ocaml, findlib}:
+{ stdenv, lib, fetchurl, ocaml, findlib }:
+
+stdenv.mkDerivation rec {
+  pname = "ocaml-calendar";
+  version = "2.5";
 
-stdenv.mkDerivation {
-  name = "ocaml-calendar-2.5";
   src = fetchurl {
-    url = "https://forge.ocamlcore.org/frs/download.php/915/calendar-2.5.tar.bz2";
+    url = "https://forge.ocamlcore.org/frs/download.php/915/calendar-${version}.tar.bz2";
     sha256 = "04pvhwb664g3s644c7v7419a3kvf5s3pynkhmk5j59dvlfm1yf0f";
-    };
+  };
 
-  buildInputs = [ocaml findlib];
+  buildInputs = [ ocaml findlib ];
 
   createFindlibDestdir = true;
 
-  meta =  {
+  meta = {
     homepage = "https://forge.ocamlcore.org/projects/calendar/";
     description = "An Objective Caml library managing dates and times";
     license = "LGPL";
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = [
       lib.maintainers.gal_bolle
     ];
diff --git a/pkgs/development/ocaml-modules/cil/default.nix b/pkgs/development/ocaml-modules/cil/default.nix
index 3aefe2eb874..c5a3dcde226 100644
--- a/pkgs/development/ocaml-modules/cil/default.nix
+++ b/pkgs/development/ocaml-modules/cil/default.nix
@@ -4,10 +4,12 @@ if lib.versionAtLeast ocaml.version "4.06"
 then throw "cil is not available for OCaml ${ocaml.version}"
 else
 
-stdenv.mkDerivation {
-  name = "ocaml-cil-1.7.3";
+stdenv.mkDerivation rec {
+  pname = "ocaml-cil";
+  version = "1.7.3";
+
   src = fetchurl {
-    url = "mirror://sourceforge/cil/cil-1.7.3.tar.gz";
+    url = "mirror://sourceforge/cil/cil-${version}.tar.gz";
     sha256 = "05739da0b0msx6kmdavr3y2bwi92jbh3szc35d7d8pdisa8g5dv9";
   };
 
@@ -26,6 +28,6 @@ stdenv.mkDerivation {
     description = "A front-end for the C programming language that facilitates program analysis and transformation";
     license = licenses.bsd3;
     maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/config-file/default.nix b/pkgs/development/ocaml-modules/config-file/default.nix
index 29c7cd61c3f..c408d1a392f 100644
--- a/pkgs/development/ocaml-modules/config-file/default.nix
+++ b/pkgs/development/ocaml-modules/config-file/default.nix
@@ -1,10 +1,11 @@
 { stdenv, lib, fetchurl, ocaml, findlib, camlp4 }:
 
-stdenv.mkDerivation {
-  name = "ocaml-config-file-1.2";
+stdenv.mkDerivation rec {
+  pname = "ocaml-config-file";
+  version = "1.2";
 
   src = fetchurl {
-    url = "https://forge.ocamlcore.org/frs/download.php/1387/config-file-1.2.tar.gz";
+    url = "https://forge.ocamlcore.org/frs/download.php/1387/config-file-${version}.tar.gz";
     sha256 = "1b02yxcnsjhr05ssh2br2ka4hxsjpdw34ldl3nk33wfnkwk7g67q";
   };
 
@@ -14,7 +15,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "http://config-file.forge.ocamlcore.org/";
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     description = "An OCaml library used to manage the configuration file(s) of an application";
     license = lib.licenses.lgpl2Plus;
     maintainers = with lib.maintainers; [ vbgl ];
diff --git a/pkgs/development/ocaml-modules/csv/1.5.nix b/pkgs/development/ocaml-modules/csv/1.5.nix
index 6fdf2030861..ee68782313c 100644
--- a/pkgs/development/ocaml-modules/csv/1.5.nix
+++ b/pkgs/development/ocaml-modules/csv/1.5.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchzip, ocaml, findlib, ocamlbuild }:
 
-stdenv.mkDerivation {
-
-  name = "ocaml${ocaml.version}-csv-1.5";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-csv";
+  version = "1.5";
 
   src = fetchzip {
-    url = "https://github.com/Chris00/ocaml-csv/releases/download/1.5/csv-1.5.tar.gz";
+    url = "https://github.com/Chris00/ocaml-csv/releases/download/${version}/csv-${version}.tar.gz";
     sha256 = "1ca7jgg58j24pccs5fshis726s06fdcjshnwza5kwxpjgdbvc63g";
   };
 
@@ -27,6 +27,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/Chris00/ocaml-csv";
     license = licenses.lgpl21;
     maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/enumerate/default.nix b/pkgs/development/ocaml-modules/enumerate/default.nix
index eb0495be797..d7f467e8eb9 100644
--- a/pkgs/development/ocaml-modules/enumerate/default.nix
+++ b/pkgs/development/ocaml-modules/enumerate/default.nix
@@ -6,11 +6,12 @@ if lib.versionAtLeast ocaml.version "4.06"
 then throw "enumerate-111.08.00 is not available for OCaml ${ocaml.version}"
 else
 
-stdenv.mkDerivation {
-  name = "ocaml-enumerate-111.08.00";
+stdenv.mkDerivation rec {
+  pname = "ocaml-enumerate";
+  version = "111.08.00";
 
   src = fetchurl {
-    url = "https://ocaml.janestreet.com/ocaml-core/111.08.00/individual/enumerate-111.08.00.tar.gz";
+    url = "https://ocaml.janestreet.com/ocaml-core/${lib.versions.majorMinor version}.00/individual/enumerate-${version}.tar.gz";
     sha256 = "0b6mx5p01lcpimvak4wx6aj2119707wsfzd83rwgb91bhpgzh156";
   };
 
@@ -23,6 +24,6 @@ stdenv.mkDerivation {
     homepage = "https://ocaml.janestreet.com/";
     description = "Quotation expanders for enumerating finite types";
     license = lib.licenses.asl20;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/fieldslib/default.nix b/pkgs/development/ocaml-modules/fieldslib/default.nix
index 4adddbfe54d..4d3c369d432 100644
--- a/pkgs/development/ocaml-modules/fieldslib/default.nix
+++ b/pkgs/development/ocaml-modules/fieldslib/default.nix
@@ -6,11 +6,12 @@ if lib.versionAtLeast ocaml.version "4.06"
 then throw "fieldslib-109.20.03 is not available for OCaml ${ocaml.version}"
 else
 
-stdenv.mkDerivation {
-  name = "ocaml-fieldslib-109.20.03";
+stdenv.mkDerivation rec {
+  pname = "ocaml-fieldslib";
+  version = "109.20.03";
 
   src = fetchurl {
-    url = "https://ocaml.janestreet.com/ocaml-core/109.20.00/individual/fieldslib-109.20.03.tar.gz";
+    url = "https://ocaml.janestreet.com/ocaml-core/${lib.versions.majorMinor version}.00/individual/fieldslib-${version}.tar.gz";
     sha256 = "1dkzk0wf26rhvji80dz1r56dp6x9zqrnp87wldd4pj56jli94vir";
   };
 
@@ -24,6 +25,6 @@ stdenv.mkDerivation {
     description = "OCaml syntax extension to define first class values representing record fields, to get and set record fields, iterate and fold over all fields of a record and create new record values";
     license = licenses.asl20;
     maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/fontconfig/default.nix b/pkgs/development/ocaml-modules/fontconfig/default.nix
index 55e8e941895..f4afe80d532 100644
--- a/pkgs/development/ocaml-modules/fontconfig/default.nix
+++ b/pkgs/development/ocaml-modules/fontconfig/default.nix
@@ -1,7 +1,9 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, fontconfig, ocaml }:
 
 stdenv.mkDerivation {
-  name = "ocaml-fontconfig-20131103";
+  pname = "ocaml-fontconfig";
+  version = "unstable-2013-11-03";
+
   src = fetchFromGitHub {
     owner = "flh";
     repo = "ocaml-fontconfig";
@@ -19,7 +21,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Fontconfig bindings for OCaml";
     license = lib.licenses.gpl2Plus;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = with lib.maintainers; [ vbgl ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/fpath/default.nix b/pkgs/development/ocaml-modules/fpath/default.nix
index 785a71e13a7..532210888bf 100644
--- a/pkgs/development/ocaml-modules/fpath/default.nix
+++ b/pkgs/development/ocaml-modules/fpath/default.nix
@@ -4,10 +4,12 @@ if !lib.versionAtLeast ocaml.version "4.03"
 then throw "fpath is not available for OCaml ${ocaml.version}"
 else
 
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-fpath-0.7.3";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-fpath";
+  version = "0.7.3";
+
   src = fetchurl {
-    url = "https://erratique.ch/software/fpath/releases/fpath-0.7.3.tbz";
+    url = "https://erratique.ch/software/fpath/releases/fpath-${version}.tbz";
     sha256 = "03z7mj0sqdz465rc4drj1gr88l9q3nfs374yssvdjdyhjbqqzc0j";
   };
 
diff --git a/pkgs/development/ocaml-modules/inifiles/default.nix b/pkgs/development/ocaml-modules/inifiles/default.nix
index 7e265938114..90308ee7d6d 100644
--- a/pkgs/development/ocaml-modules/inifiles/default.nix
+++ b/pkgs/development/ocaml-modules/inifiles/default.nix
@@ -1,17 +1,20 @@
 { stdenv, lib, fetchurl, fetchpatch, ocaml, findlib, ocaml_pcre }:
 
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-inifiles-1.2";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-inifiles";
+  version = "1.2";
 
   src = fetchurl {
-    url = "mirror://ubuntu/pool/universe/o/ocaml-inifiles/ocaml-inifiles_1.2.orig.tar.gz";
+    url = "mirror://ubuntu/pool/universe/o/ocaml-inifiles/ocaml-inifiles_${version}.orig.tar.gz";
     sha256 = "0jhzgiypmh6hwsv1zpiq77fi0cvcmwbiy5x0yg7mz6p3dh1dmkns";
   };
 
-  patches = [ (fetchpatch {
-    url = "https://raw.githubusercontent.com/ocaml/opam-repository/master/packages/ocaml-inifiles/ocaml-inifiles.1.2/files/ocaml-inifiles.diff";
-    sha256 = "037kk3172s187w8vwsykdxlpklxzc7m7np57sapk499d8adzdgwn";
-  })];
+  patches = [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/ocaml/opam-repository/master/packages/ocaml-inifiles/ocaml-inifiles.1.2/files/ocaml-inifiles.diff";
+      sha256 = "037kk3172s187w8vwsykdxlpklxzc7m7np57sapk499d8adzdgwn";
+    })
+  ];
 
   buildInputs = [ ocaml findlib ];
   propagatedBuildInputs = [ ocaml_pcre ];
diff --git a/pkgs/development/ocaml-modules/lablgtk-extras/1.4.nix b/pkgs/development/ocaml-modules/lablgtk-extras/1.4.nix
index 70cc88d2116..f2fbc71b5a9 100644
--- a/pkgs/development/ocaml-modules/lablgtk-extras/1.4.nix
+++ b/pkgs/development/ocaml-modules/lablgtk-extras/1.4.nix
@@ -1,9 +1,11 @@
 { stdenv, lib, fetchurl, ocaml, findlib, camlp4, config-file, lablgtk, xmlm }:
 
-stdenv.mkDerivation {
-  name = "ocaml-lablgtk-extras-1.4";
+stdenv.mkDerivation rec {
+  pname = "ocaml-lablgtk-extras";
+  version = "1.4";
+
   src = fetchurl {
-    url = "http://forge.ocamlcore.org/frs/download.php/1282/lablgtkextras-1.4.tar.gz";
+    url = "http://forge.ocamlcore.org/frs/download.php/1282/lablgtkextras-${version}.tar.gz";
     sha256 = "09fqxwdib7r9yxynknc9gv3jw2hnhj5cak7q5jngk6m8rzvmhfcc";
   };
 
@@ -13,7 +15,7 @@ stdenv.mkDerivation {
   createFindlibDestdir = true;
 
   meta = {
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = with lib.maintainers; [ vbgl ];
     homepage = "http://gtk-extras.forge.ocamlcore.org/";
     description = "A collection of libraries and modules useful when developing OCaml/LablGtk2 applications";
diff --git a/pkgs/development/ocaml-modules/macaque/default.nix b/pkgs/development/ocaml-modules/macaque/default.nix
index 61ee7ebfe9c..7caf99f4b39 100644
--- a/pkgs/development/ocaml-modules/macaque/default.nix
+++ b/pkgs/development/ocaml-modules/macaque/default.nix
@@ -1,9 +1,11 @@
 { lib, stdenv, fetchzip, ocaml, findlib, ocamlbuild, pgocaml, camlp4 }:
 
-stdenv.mkDerivation {
-  name = "ocaml-macaque-0.7.2";
+stdenv.mkDerivation rec {
+  pname = "ocaml-macaque";
+  version = "0.7.2";
+
   src = fetchzip {
-    url = "https://github.com/ocsigen/macaque/archive/0.7.2.tar.gz";
+    url = "https://github.com/ocsigen/macaque/archive/${version}.tar.gz";
     sha256 = "14i0a8cndzndjmlkyhf31r451q99cnkndgxcj0id4qjqhdl4bmjv";
   };
 
@@ -16,7 +18,7 @@ stdenv.mkDerivation {
     description = "Macros for Caml Queries";
     homepage = "https://github.com/ocsigen/macaque";
     license = licenses.lgpl2;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = with maintainers; [ vbgl ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/magick/default.nix b/pkgs/development/ocaml-modules/magick/default.nix
index 016c059573b..f9fec120a62 100644
--- a/pkgs/development/ocaml-modules/magick/default.nix
+++ b/pkgs/development/ocaml-modules/magick/default.nix
@@ -4,10 +4,12 @@ if lib.versionAtLeast ocaml.version "4.06"
 then throw "magick is not available for OCaml ${ocaml.version}"
 else
 
-stdenv.mkDerivation {
-  name = "ocaml-magick-0.34";
+stdenv.mkDerivation rec {
+  pname = "ocaml-magick";
+  version = "0.34";
+
   src = fetchurl {
-    url = "http://www.linux-nantes.org/~fmonnier/OCaml/ImageMagick/ImageMagick/OCaml-ImageMagick-0.34.tgz";
+    url = "http://www.linux-nantes.org/~fmonnier/OCaml/ImageMagick/ImageMagick/OCaml-ImageMagick-${version}.tgz";
     sha256 = "0gn9l2qdr8gby2x8c2mb59x1kipb2plr45rbq6ymcxyi0wmzfh3q";
   };
 
diff --git a/pkgs/development/ocaml-modules/ocb-stubblr/default.nix b/pkgs/development/ocaml-modules/ocb-stubblr/default.nix
index d8d19f5e365..2f26eb32ffb 100644
--- a/pkgs/development/ocaml-modules/ocb-stubblr/default.nix
+++ b/pkgs/development/ocaml-modules/ocb-stubblr/default.nix
@@ -1,9 +1,11 @@
 { stdenv, lib, fetchzip, ocaml, findlib, ocamlbuild, topkg, astring }:
 
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-ocb-stubblr-0.1.0";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-ocb-stubblr";
+  version = "0.1.0";
+
   src = fetchzip {
-    url = "https://github.com/pqwy/ocb-stubblr/releases/download/v0.1.0/ocb-stubblr-0.1.0.tbz";
+    url = "https://github.com/pqwy/ocb-stubblr/releases/download/v${version}/ocb-stubblr-${version}.tbz";
     name = "src.tar.bz";
     sha256 = "0hpds1lkq4j8wgslv7hnirgfrjmqi36h5rarpw9mwf24gfp5ays2";
   };
diff --git a/pkgs/development/ocaml-modules/ocurl/default.nix b/pkgs/development/ocaml-modules/ocurl/default.nix
index 83668b30cec..ea2af8dd4c8 100644
--- a/pkgs/development/ocaml-modules/ocurl/default.nix
+++ b/pkgs/development/ocaml-modules/ocurl/default.nix
@@ -5,9 +5,11 @@ then throw "ocurl is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {
-  name = "ocurl-0.9.1";
+  pname = "ocurl";
+  version = "0.9.1";
+
   src = fetchurl {
-    url = "http://ygrek.org.ua/p/release/ocurl/${name}.tar.gz";
+    url = "http://ygrek.org.ua/p/release/ocurl/ocurl-${version}.tar.gz";
     sha256 = "0n621cxb9012pj280c7821qqsdhypj8qy9qgrah79dkh6a8h2py6";
   };
 
@@ -19,6 +21,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.mit;
     homepage = "http://ygrek.org.ua/p/ocurl/";
     maintainers = with lib.maintainers; [ bennofs ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/odn/default.nix b/pkgs/development/ocaml-modules/odn/default.nix
index edf7d864955..9179ce3f1d1 100644
--- a/pkgs/development/ocaml-modules/odn/default.nix
+++ b/pkgs/development/ocaml-modules/odn/default.nix
@@ -4,11 +4,12 @@ if lib.versionAtLeast ocaml.version "4.06"
 then throw "ocaml-data-notation is not available for OCaml ${ocaml.version}"
 else
 
-stdenv.mkDerivation {
-  name = "ocaml-data-notation-0.0.11";
+stdenv.mkDerivation rec {
+  pname = "ocaml-data-notation";
+  version = "0.0.11";
 
   src = fetchurl {
-    url = "https://forge.ocamlcore.org/frs/download.php/1310/ocaml-data-notation-0.0.11.tar.gz";
+    url = "https://forge.ocamlcore.org/frs/download.php/1310/ocaml-data-notation-${version}.tar.gz";
     sha256 = "09a8zdyifpc2nl4hdvg9206142y31cq95ajgij011s1qcg3z93lj";
   };
 
@@ -17,16 +18,17 @@ stdenv.mkDerivation {
   createFindlibDestdir = true;
 
   configurePhase = "ocaml setup.ml -configure";
-  buildPhase     = "ocaml setup.ml -build";
-  installPhase   = "ocaml setup.ml -install";
+  buildPhase = "ocaml setup.ml -build";
+  installPhase = "ocaml setup.ml -install";
 
   meta = with lib; {
     description = "Store data using OCaml notation";
     homepage = "https://forge.ocamlcore.org/projects/odn/";
     license = licenses.lgpl21;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = with maintainers; [
-      vbgl maggesi
+      vbgl
+      maggesi
     ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/omd/default.nix b/pkgs/development/ocaml-modules/omd/default.nix
index fee2f300eac..d6cea183d85 100644
--- a/pkgs/development/ocaml-modules/omd/default.nix
+++ b/pkgs/development/ocaml-modules/omd/default.nix
@@ -1,9 +1,11 @@
 { stdenv, lib, fetchurl, ocaml, findlib, ocamlbuild }:
 
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-omd-1.3.1";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-omd";
+  version = "1.3.1";
+
   src = fetchurl {
-    url = "https://github.com/Chris00/omd/releases/download/1.3.1/omd-1.3.1.tar.gz";
+    url = "https://github.com/Chris00/omd/releases/download/${version}/omd-${version}.tar.gz";
     sha256 = "1sgdgzpx96br7npj8mh91cli5mqmzsjpngwm7x4212n3k1d0ivwa";
   };
 
diff --git a/pkgs/development/ocaml-modules/optcomp/default.nix b/pkgs/development/ocaml-modules/optcomp/default.nix
index b78d070962e..55ee0b419c7 100644
--- a/pkgs/development/ocaml-modules/optcomp/default.nix
+++ b/pkgs/development/ocaml-modules/optcomp/default.nix
@@ -1,9 +1,11 @@
 { stdenv, lib, fetchurl, fetchpatch, ocaml, findlib, ocamlbuild, camlp4 }:
 
-stdenv.mkDerivation {
-  name = "ocaml-optcomp-1.6";
+stdenv.mkDerivation rec {
+  pname = "ocaml-optcomp";
+  version = "1.6";
+
   src = fetchurl {
-    url = "https://github.com/diml/optcomp/archive/1.6.tar.gz";
+    url = "https://github.com/diml/optcomp/archive/${version}.tar.gz";
     sha256 = "0hhhb2gisah1h22zlg5iszbgqxdd7x85cwd57bd4mfkx9l7dh8jh";
   };
 
@@ -34,11 +36,11 @@ stdenv.mkDerivation {
     ocamlfind install optcomp META _build/src/optcomp.{a,cma,cmxa,cmxs} _build/src/pa_optcomp.{cmi,cmx,mli}
   '';
 
-  meta =  {
+  meta = {
     homepage = "https://github.com/diml/optcomp";
     description = "Optional compilation for OCaml with cpp-like directives";
     license = lib.licenses.bsd3;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = [
       lib.maintainers.gal_bolle
     ];
diff --git a/pkgs/development/ocaml-modules/pycaml/default.nix b/pkgs/development/ocaml-modules/pycaml/default.nix
index 1aa2590f2ae..bee8a6106ea 100644
--- a/pkgs/development/ocaml-modules/pycaml/default.nix
+++ b/pkgs/development/ocaml-modules/pycaml/default.nix
@@ -1,18 +1,19 @@
-{stdenv, fetchurl, ocaml, findlib, ncurses, python, ocaml_make}:
+{ lib, stdenv, fetchurl, ocaml, findlib, ncurses, python, ocaml_make }:
 
 # This is the original pycaml version with patches from debian.
 
-stdenv.mkDerivation {
-  name = "pycaml-0.82-14";
+stdenv.mkDerivation rec {
+  pname = "pycaml";
+  version = "0.82-14";
 
   srcs = [
     (fetchurl {
-      url = "mirror://debian/pool/main/p/pycaml/pycaml_0.82.orig.tar.gz";
+      url = "mirror://debian/pool/main/p/pycaml/pycaml_${lib.versions.majorMinor version}.orig.tar.gz";
       sha256 = "d57be559c8d586c575717d47817986bbdbcebe2ffd16ad6b291525c62868babe";
     })
 
     (fetchurl {
-      url = "mirror://debian/pool/main/p/pycaml/pycaml_0.82-14.debian.tar.gz";
+      url = "mirror://debian/pool/main/p/pycaml/pycaml_${version}.debian.tar.gz";
       sha256 = "a763088ec1fa76c769bf586ed6692e7ac035b0a2bfd48a90a8e7a9539ec0c2f1";
     })
   ];
@@ -41,6 +42,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/chemoelectric/pycaml";
     description = "Bindings for python and ocaml";
     license = "LGPL";
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/react/default.nix b/pkgs/development/ocaml-modules/react/default.nix
index 7ae3e8e66f3..0edae983069 100644
--- a/pkgs/development/ocaml-modules/react/default.nix
+++ b/pkgs/development/ocaml-modules/react/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, ocaml, findlib, topkg, ocamlbuild }:
 
-stdenv.mkDerivation {
-  name = "ocaml-react-1.2.1";
+stdenv.mkDerivation rec {
+  pname = "ocaml-react";
+  version = "1.2.1";
 
   src = fetchurl {
-    url = "https://erratique.ch/software/react/releases/react-1.2.1.tbz";
+    url = "https://erratique.ch/software/react/releases/react-${version}.tbz";
     sha256 = "1aj8w79gdd9xnrbz7s5p8glcb4pmimi8jp9f439dqnf6ih3mqb3v";
   };
 
@@ -16,7 +17,7 @@ stdenv.mkDerivation {
     homepage = "https://erratique.ch/software/react";
     description = "Applicative events and signals for OCaml";
     license = licenses.bsd3;
-    platforms = ocaml.meta.platforms or [];
-    maintainers = with maintainers; [ maggesi vbmithr gal_bolle];
+    platforms = ocaml.meta.platforms or [ ];
+    maintainers = with maintainers; [ maggesi vbmithr gal_bolle ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/reactivedata/default.nix b/pkgs/development/ocaml-modules/reactivedata/default.nix
index 899547a937b..b2bbd13fc90 100644
--- a/pkgs/development/ocaml-modules/reactivedata/default.nix
+++ b/pkgs/development/ocaml-modules/reactivedata/default.nix
@@ -4,10 +4,12 @@ if !lib.versionAtLeast ocaml.version "4.04"
 then throw "reactiveData is not available for OCaml ${ocaml.version}"
 else
 
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-reactiveData-0.2.2";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-reactiveData";
+  version = "0.2.2";
+
   src = fetchurl {
-    url = "https://github.com/ocsigen/reactiveData/archive/0.2.2.tar.gz";
+    url = "https://github.com/ocsigen/reactiveData/archive/${version}.tar.gz";
     sha256 = "0jzagyp4zla28wykvcgqwd8df71ir0vb4s8akp02cfacd5v86sng";
   };
 
@@ -22,7 +24,7 @@ stdenv.mkDerivation {
     description = "An OCaml module for functional reactive programming (FRP) based on React";
     homepage = "https://github.com/ocsigen/reactiveData";
     license = licenses.lgpl21;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = with maintainers; [ vbgl ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/seq/default.nix b/pkgs/development/ocaml-modules/seq/default.nix
index 44503668ff0..6131585e34b 100644
--- a/pkgs/development/ocaml-modules/seq/default.nix
+++ b/pkgs/development/ocaml-modules/seq/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation ({
   version = "0.1";
-  name = "ocaml${ocaml.version}-seq-0.1";
+  pname = "ocaml${ocaml.version}-seq";
 
   meta = {
     license = lib.licenses.lgpl21;
diff --git a/pkgs/development/ocaml-modules/type_conv/108.08.00.nix b/pkgs/development/ocaml-modules/type_conv/108.08.00.nix
index 72e4fcbb35f..337874e11a9 100644
--- a/pkgs/development/ocaml-modules/type_conv/108.08.00.nix
+++ b/pkgs/development/ocaml-modules/type_conv/108.08.00.nix
@@ -1,18 +1,19 @@
-{lib, stdenv, fetchurl, ocaml, findlib, camlp4}:
+{ lib, stdenv, fetchurl, ocaml, findlib, camlp4 }:
 
 if !lib.versionAtLeast ocaml.version "3.12"
-|| lib.versionAtLeast ocaml.version "4.03"
+  || lib.versionAtLeast ocaml.version "4.03"
 then throw "type_conv-108.08.00 is not available for OCaml ${ocaml.version}" else
 
-stdenv.mkDerivation {
-  name = "ocaml-type_conv-108.08.00";
+stdenv.mkDerivation rec {
+  pname = "ocaml-type_conv";
+  version = "108.08.00";
 
   src = fetchurl {
-    url = "https://ocaml.janestreet.com/ocaml-core/108.08.00/individual/type_conv-108.08.00.tar.gz";
+    url = "https://ocaml.janestreet.com/ocaml-core/${version}/individual/type_conv-${version}.tar.gz";
     sha256 = "08ysikwwp69zvc147lzzg79nwlrzrk738rj0ggcfadi8h5il42sl";
   };
 
-  buildInputs = [ocaml findlib camlp4];
+  buildInputs = [ ocaml findlib camlp4 ];
 
   createFindlibDestdir = true;
 
@@ -21,7 +22,7 @@ stdenv.mkDerivation {
     description = "Support library for OCaml preprocessor type conversions";
     license = licenses.asl20;
     branch = "108";
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = with maintainers; [ maggesi ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/type_conv/109.60.01.nix b/pkgs/development/ocaml-modules/type_conv/109.60.01.nix
index e41e9b188fc..cc77a731f02 100644
--- a/pkgs/development/ocaml-modules/type_conv/109.60.01.nix
+++ b/pkgs/development/ocaml-modules/type_conv/109.60.01.nix
@@ -1,18 +1,19 @@
-{stdenv, lib, fetchurl, ocaml, findlib, camlp4}:
+{ stdenv, lib, fetchurl, ocaml, findlib, camlp4 }:
 
 if !lib.versionAtLeast ocaml.version "4.00"
-|| lib.versionAtLeast ocaml.version "4.03"
+  || lib.versionAtLeast ocaml.version "4.03"
 then throw "type_conv-109.60.01 is not available for OCaml ${ocaml.version}" else
 
-stdenv.mkDerivation {
-  name = "ocaml-type_conv-109.60.01";
+stdenv.mkDerivation rec {
+  pname = "ocaml-type_conv";
+  version = "109.60.01";
 
   src = fetchurl {
-    url = "https://github.com/janestreet/type_conv/archive/109.60.01.tar.gz";
+    url = "https://github.com/janestreet/type_conv/archive/${version}.tar.gz";
     sha256 = "0lpxri68glgq1z2pp02rp45cb909xywbff8d4idljrf6fzzil2zx";
   };
 
-  buildInputs = [ocaml findlib camlp4];
+  buildInputs = [ ocaml findlib camlp4 ];
 
   createFindlibDestdir = true;
 
@@ -20,7 +21,7 @@ stdenv.mkDerivation {
     homepage = "http://forge.ocamlcore.org/projects/type-conv/";
     description = "Support library for OCaml preprocessor type conversions";
     license = lib.licenses.lgpl21;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
     maintainers = with lib.maintainers; [ maggesi ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/uchar/default.nix b/pkgs/development/ocaml-modules/uchar/default.nix
index 7eec0154715..7d7d87af853 100644
--- a/pkgs/development/ocaml-modules/uchar/default.nix
+++ b/pkgs/development/ocaml-modules/uchar/default.nix
@@ -1,10 +1,11 @@
 { stdenv, fetchurl, ocaml, findlib, ocamlbuild, opaline, withShared ? true, lib }:
 
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-uchar-0.0.2";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-uchar";
+  version = "0.0.2";
 
   src = fetchurl {
-    url = "https://github.com/ocaml/uchar/releases/download/v0.0.2/uchar-0.0.2.tbz";
+    url = "https://github.com/ocaml/uchar/releases/download/v${version}/uchar-${version}.tbz";
     sha256 = "1w2saw7zanf9m9ffvz2lvcxvlm118pws2x1wym526xmydhqpyfa7";
   };
 
@@ -12,7 +13,7 @@ stdenv.mkDerivation {
   buildInputs = [ findlib ocaml ocamlbuild ];
   buildPhase = "ocaml pkg/build.ml native=true native-dynlink=${lib.boolToString withShared}";
   installPhase = "${opaline}/bin/opaline -libdir $OCAMLFIND_DESTDIR";
-  configurePlatforms = [];
+  configurePlatforms = [ ];
 
   meta = {
     description = "Compatibility library for OCaml’s Uchar module";
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index d6203c1ebeb..db1f810cbc8 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -3,15 +3,22 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, async-timeout
+# install_requires
 , attrs
-, chardet
-, idna-ssl
+, charset-normalizer
 , multidict
-, typing-extensions
+, async-timeout
 , yarl
+, frozenlist
+, aiosignal
+, aiodns
+, brotli
+, cchardet
+, asynctest
+, typing-extensions
+, idna-ssl
+# tests_require
 , async_generator
-, brotlipy
 , freezegun
 , gunicorn
 , pytest-mock
@@ -22,32 +29,39 @@
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.7.4.post0";
+  version = "3.8.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "493d3299ebe5f5a7c66b9819eacdcfbbaaf1a8e84911ddffcdc48888497afecf";
+    sha256 = "sha256-07GdjRg7z9aLJb7rq43DMIKC/iyj1uo8tM0QGzwnn40=";
   };
 
   postPatch = ''
-    substituteInPlace setup.cfg --replace " --cov=aiohttp" ""
+    sed -i '/--cov/d' setup.cfg
   '';
 
   propagatedBuildInputs = [
-    async-timeout
     attrs
-    chardet
+    charset-normalizer
     multidict
-    typing-extensions
+    async-timeout
     yarl
+    typing-extensions
+    frozenlist
+    aiosignal
+    aiodns
+    brotli
+    cchardet
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    asynctest
+    typing-extensions
   ] ++ lib.optionals (pythonOlder "3.7") [
     idna-ssl
   ];
 
   checkInputs = [
     async_generator
-    brotlipy
     freezegun
     gunicorn
     pytest-mock
@@ -58,7 +72,9 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Disable tests that require network access
+    "test_client_session_timeout_zero"
     "test_mark_formdata_as_processed"
+    "test_requote_redirect_url_default"
   ] ++ lib.optionals stdenv.is32bit [
     "test_cookiejar"
   ] ++ lib.optionals stdenv.isDarwin [
@@ -66,6 +82,10 @@ buildPythonPackage rec {
     "test_close"
   ];
 
+  disabledTestPaths = [
+    "test_proxy_functional.py" # FIXME package proxy.py
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   # aiohttp in current folder shadows installed version
diff --git a/pkgs/development/python-modules/async_timeout/default.nix b/pkgs/development/python-modules/async_timeout/default.nix
index a1dbb521ce3..ae8bacc9441 100644
--- a/pkgs/development/python-modules/async_timeout/default.nix
+++ b/pkgs/development/python-modules/async_timeout/default.nix
@@ -2,22 +2,27 @@
 , fetchPypi
 , buildPythonPackage
 , pythonOlder
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "async-timeout";
-  version = "3.0.1";
+  version = "4.0.1";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0c3c816a028d47f659d6ff5c745cb2acf1f966da1fe5c19c77a70282b25f4c5f";
+    sha256 = "sha256-uTDLFho5BC+SIvbvtzATmch+6rOUcn7FQ3kko21u71E=";
   };
 
+  propagatedBuildInputs = [
+    typing-extensions
+  ];
+
   # Circular dependency on aiohttp
   doCheck = false;
 
-  disabled = pythonOlder "3.4";
-
   meta = {
     description = "Timeout context manager for asyncio programs";
     homepage = "https://github.com/aio-libs/async_timeout/";
diff --git a/pkgs/development/python-modules/dbus/default.nix b/pkgs/development/python-modules/dbus/default.nix
index 8c9eb476fe0..23fcf511187 100644
--- a/pkgs/development/python-modules/dbus/default.nix
+++ b/pkgs/development/python-modules/dbus/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "dbus-python";
-  version = "1.2.16";
+  version = "1.2.18";
   format = "other";
 
   outputs = [ "out" "dev" ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "196m5rk3qzw5nkmgzjl7wmq0v7vpwfhh8bz2sapdi5f9hqfqy8qi";
+    sha256 = "0q3jrw515z98mqdk9x822nd95rky455zz9876f1nqna5igkd3gcj";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/diskcache/default.nix b/pkgs/development/python-modules/diskcache/default.nix
index 0264c0ff10c..457ab077a0c 100644
--- a/pkgs/development/python-modules/diskcache/default.nix
+++ b/pkgs/development/python-modules/diskcache/default.nix
@@ -32,6 +32,15 @@ buildPythonPackage rec {
   doCheck = !stdenv.isDarwin;
   pythonImportsCheck = [ "diskcache" ];
 
+  disabledTests = [
+    # very time sensitive, can fail on over subscribed machines
+    "test_incr_update_keyerror"
+  ];
+
+  pytestFlagsArray = [
+    "-n $NIX_BUILD_CORES"
+  ];
+
   meta = with lib; {
     description = "Disk and file backed persistent cache";
     homepage = "http://www.grantjenks.com/docs/diskcache/";
diff --git a/pkgs/development/python-modules/factory_boy/default.nix b/pkgs/development/python-modules/factory_boy/default.nix
index 845e27dcc44..1c612e2b57e 100644
--- a/pkgs/development/python-modules/factory_boy/default.nix
+++ b/pkgs/development/python-modules/factory_boy/default.nix
@@ -11,15 +11,19 @@
 }:
 
 buildPythonPackage rec {
-  pname = "factory_boy";
-  version = "3.2.0";
+  pname = "factory-boy";
+  version = "3.2.1";
+  format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "0nsw2mdjk8sqds3qsix4cf19ws6i0fak79349pw2581ryc7w0720";
+    pname = "factory_boy";
+    inherit version;
+    sha256 = "sha256-qY0newwEfHXrbkq4UIp/gfsD0sshmG9ieRNUbveipV4=";
   };
 
-  propagatedBuildInputs = [ faker ];
+  propagatedBuildInputs = [
+    faker
+  ];
 
   checkInputs = [
     django
@@ -31,8 +35,13 @@ buildPythonPackage rec {
   ];
 
   # Checks for MongoDB requires an a running DB
-  disabledTests = [ "MongoEngineTestCase" ];
-  pythonImportsCheck = [ "factory" ];
+  disabledTests = [
+    "MongoEngineTestCase"
+  ];
+
+  pythonImportsCheck = [
+    "factory"
+  ];
 
   meta = with lib; {
     description = "Python package to create factories for complex objects";
diff --git a/pkgs/development/python-modules/flake8-future-import/default.nix b/pkgs/development/python-modules/flake8-future-import/default.nix
index 41e9680937d..699d37770a3 100644
--- a/pkgs/development/python-modules/flake8-future-import/default.nix
+++ b/pkgs/development/python-modules/flake8-future-import/default.nix
@@ -1,8 +1,10 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonAtLeast
 , isPy27
+, isPy38
+, isPy39
+, pythonAtLeast
 , flake8
 , six
 , python
@@ -20,8 +22,10 @@ buildPythonPackage rec {
     sha256 = "00q8n15xdnvqj454arn7xxksyrzh0dw996kjyy7g9rdk0rf8x82z";
   };
 
-  patches = lib.optionals (pythonAtLeast "3.8") [
-    ./fix-annotations-version.patch
+  patches = lib.optionals (pythonAtLeast "3.10") [
+    ./fix-annotations-version-11.patch
+  ] ++ lib.optionals (isPy38 || isPy39) [
+    ./fix-annotations-version-10.patch
   ] ++ lib.optionals isPy27 [
     # Upstream disables this test case naturally on python 3, but it also fails
     # inside NixPkgs for python 2. Since it's going to be deleted, we just skip it
diff --git a/pkgs/development/python-modules/flake8-future-import/fix-annotations-version.patch b/pkgs/development/python-modules/flake8-future-import/fix-annotations-version-10.patch
index 2e3062c8ac4..2e3062c8ac4 100644
--- a/pkgs/development/python-modules/flake8-future-import/fix-annotations-version.patch
+++ b/pkgs/development/python-modules/flake8-future-import/fix-annotations-version-10.patch
diff --git a/pkgs/development/python-modules/flake8-future-import/fix-annotations-version-11.patch b/pkgs/development/python-modules/flake8-future-import/fix-annotations-version-11.patch
new file mode 100644
index 00000000000..7cbb5e562c3
--- /dev/null
+++ b/pkgs/development/python-modules/flake8-future-import/fix-annotations-version-11.patch
@@ -0,0 +1,13 @@
+diff --git a/flake8_future_import.py b/flake8_future_import.py
+index 92c3fda..27a1a66 100755
+--- a/flake8_future_import.py
++++ b/flake8_future_import.py
+@@ -76,7 +76,7 @@ UNICODE_LITERALS = Feature(4, 'unicode_literals', (2, 6, 0), (3, 0, 0))
+ GENERATOR_STOP = Feature(5, 'generator_stop', (3, 5, 0), (3, 7, 0))
+ NESTED_SCOPES = Feature(6, 'nested_scopes', (2, 1, 0), (2, 2, 0))
+ GENERATORS = Feature(7, 'generators', (2, 2, 0), (2, 3, 0))
+-ANNOTATIONS = Feature(8, 'annotations', (3, 7, 0), (4, 0, 0))
++ANNOTATIONS = Feature(8, 'annotations', (3, 7, 0), (3, 11, 0))
+ 
+ 
+ # Order important as it defines the error code
diff --git a/pkgs/development/python-modules/flake8/default.nix b/pkgs/development/python-modules/flake8/default.nix
index e27be602d7a..7f51cd2703c 100644
--- a/pkgs/development/python-modules/flake8/default.nix
+++ b/pkgs/development/python-modules/flake8/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "flake8";
-  version = "3.9.2";
+  version = "4.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "07528381786f2a6237b061f6e96610a4167b226cb926e2aa2b6b1d78057c576b";
+    sha256 = "03c7mnk34wfz7a0m5zq0273y94awz69fy5iww8alh4a4v96h6vl0";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index ee377868590..799d7e0702f 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -18,14 +18,14 @@ buildPythonPackage rec {
   # If you need these, you can just add them to your environment.
 
   pname = "hypothesis";
-  version = "6.23.2";
+  version = "6.24.5";
 
   # Use github tarballs that includes tests
   src = fetchFromGitHub {
     owner = "HypothesisWorks";
     repo = "hypothesis-python";
     rev = "hypothesis-python-${version}";
-    sha256 = "1mdygyq6ra4kysi0y2g3a4bgpqrcb8ci2061117zyms419qwwh4l";
+    sha256 = "+pPnMgbLdYbh0xqPewNOJRaL7VtxeN73wbHHuK0fNYo=";
   };
 
   postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
diff --git a/pkgs/development/python-modules/oslo-concurrency/default.nix b/pkgs/development/python-modules/oslo-concurrency/default.nix
index d3d90bfb223..71c9bf4260d 100644
--- a/pkgs/development/python-modules/oslo-concurrency/default.nix
+++ b/pkgs/development/python-modules/oslo-concurrency/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "oslo-concurrency";
-  version = "4.4.1";
+  version = "4.5.0";
 
   src = fetchPypi {
     pname = "oslo.concurrency";
     inherit version;
-    sha256 = "6449cfbd15dbab20cf9907bbb2f057e0e5267f97161223d2b516cc8226b17ec3";
+    sha256 = "1h76pq9p1bpwcs6jl9m2w4280wcp2w3is88qlaqknqkd3pdaixwr";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/oslo-log/default.nix b/pkgs/development/python-modules/oslo-log/default.nix
index 1e4598ead65..dd2d69a0c23 100644
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "oslo-log";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchPypi {
     pname = "oslo.log";
     inherit version;
-    sha256 = "dad5d7ff1290f01132b356d36a1bb79f98a3929d5005cce73e849ed31b385ba7";
+    sha256 = "0dlnxjci9mpwhgfv19fy1z7xrdp8m95skrj5dr60all3pr7n22f6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/oslo-utils/default.nix b/pkgs/development/python-modules/oslo-utils/default.nix
index 3707a196d03..4f1a4d9df2d 100644
--- a/pkgs/development/python-modules/oslo-utils/default.nix
+++ b/pkgs/development/python-modules/oslo-utils/default.nix
@@ -23,12 +23,12 @@
 
 buildPythonPackage rec {
   pname = "oslo-utils";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchPypi {
     pname = "oslo.utils";
     inherit version;
-    sha256 = "9646e6570ed08a79f21b03acfb60d32a3ac453d76304f8759b1211a59ce372cb";
+    sha256 = "1wl3r4jayzjgzf36iwn05xcjfh227s97qymjxji9hz4ibhy3v83f";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index 77e8d5c210a..d9887b626af 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "42df03e7797b796625b1029c0400279c7c34fd7df24a7d7818a1abb5b38710dd";
+    sha256 = "1dvkqixz227bhhk7c9r2bwcm7kmkfqyxw1bkha0jf3z88laclla6";
   };
 
   propagatedBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycairo/1.18.nix b/pkgs/development/python-modules/pycairo/1.18.nix
index 0a51c78c584..9da4da1479c 100644
--- a/pkgs/development/python-modules/pycairo/1.18.nix
+++ b/pkgs/development/python-modules/pycairo/1.18.nix
@@ -37,7 +37,10 @@ buildPythonPackage rec {
   ];
 
   mesonFlags = [
-    "-Dpython=${python.interpreter}"
+    # This is only used for figuring out what version of Python is in
+    # use, and related stuff like figuring out what the install prefix
+    # should be, but it does need to be able to execute Python code.
+    "-Dpython=${python.pythonForBuild.interpreter}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pycairo/default.nix b/pkgs/development/python-modules/pycairo/default.nix
index 587013e30f8..85edbdb29b4 100644
--- a/pkgs/development/python-modules/pycairo/default.nix
+++ b/pkgs/development/python-modules/pycairo/default.nix
@@ -40,7 +40,10 @@ buildPythonPackage rec {
   ];
 
   mesonFlags = [
-    "-Dpython=${python.interpreter}"
+    # This is only used for figuring out what version of Python is in
+    # use, and related stuff like figuring out what the install prefix
+    # should be, but it does need to be able to execute Python code.
+    "-Dpython=${python.pythonForBuild.interpreter}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pycodestyle/default.nix b/pkgs/development/python-modules/pycodestyle/default.nix
index 0e92196f745..865c1febddc 100644
--- a/pkgs/development/python-modules/pycodestyle/default.nix
+++ b/pkgs/development/python-modules/pycodestyle/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pycodestyle";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c389c1d06bf7904078ca03399a4816f974a1d590090fecea0c63ec26ebaf1cef";
+    sha256 = "0zxyrg8029lzjhima6l5nk6y0z6lm5wfp9qchz3s33j3xx3mipgd";
   };
 
   dontUseSetuptoolsCheck = true;
diff --git a/pkgs/development/python-modules/pyside/apiextractor.nix b/pkgs/development/python-modules/pyside/apiextractor.nix
index 9398a62997b..ab8c6eb7840 100644
--- a/pkgs/development/python-modules/pyside/apiextractor.nix
+++ b/pkgs/development/python-modules/pyside/apiextractor.nix
@@ -2,12 +2,14 @@
 
 # This derivation does not provide any Python module and should therefore be called via `all-packages.nix`.
 let
-  pythonEnv = python3.withPackages(ps: with ps; [  sphinx ]);
-in stdenv.mkDerivation {
-  name = "pyside-apiextractor-0.10.10";
+  pythonEnv = python3.withPackages (ps: with ps; [ sphinx ]);
+in
+stdenv.mkDerivation rec {
+  pname = "pyside-apiextractor";
+  version = "0.10.10";
 
   src = fetchurl {
-    url = "https://github.com/PySide/Apiextractor/archive/0.10.10.tar.gz";
+    url = "https://github.com/PySide/Apiextractor/archive/${version}.tar.gz";
     sha256 = "1zj8yrxy08iv1pk38djxw3faimm226w6wmi0gm32w4yczblylwz3";
   };
 
diff --git a/pkgs/development/python-modules/pytest-flake8/default.nix b/pkgs/development/python-modules/pytest-flake8/default.nix
index 9486875ff34..231ddf97c94 100644
--- a/pkgs/development/python-modules/pytest-flake8/default.nix
+++ b/pkgs/development/python-modules/pytest-flake8/default.nix
@@ -1,9 +1,11 @@
-{lib, buildPythonPackage, fetchPypi, pytest, flake8}:
+{lib, buildPythonPackage, fetchPypi, pythonOlder, fetchpatch, pytest, flake8}:
 
 buildPythonPackage rec {
   pname = "pytest-flake8";
   version = "1.0.7";
 
+  disabled = pythonOlder "3.5";
+
   # although pytest is a runtime dependency, do not add it as
   # propagatedBuildInputs in order to allow packages depend on another version
   # of pytest more easily
@@ -15,6 +17,14 @@ buildPythonPackage rec {
     sha256 = "f0259761a903563f33d6f099914afef339c085085e643bee8343eb323b32dd6b";
   };
 
+  # see https://github.com/tholo/pytest-flake8/pull/82/commits
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/tholo/pytest-flake8/commit/eda4ef74c0f25b856fe282742ea206b21e94c24c.patch";
+      sha256 = "0kq0wshds00rk6wvkn6ccjrjyqxg7m9l7dlyaqw974asizw6byci";
+    })
+  ];
+
   checkPhase = ''
     pytest .
   '';
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index b62355bb2c1..b96c7ca8995 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2021.10.8";
+  version = "2021.11.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "26895d7c9bbda5c52b3635ce5991caa90fbb1ddfac9c9ff1c7ce505e2282fb2a";
+    sha256 = "sha256-80HuLfCZm/33qV5EgHXv/g2yEqWTh94acGkOSssD1MY=";
   };
 
   # Sources for different Python releases are located in same folder
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index e052a51d859..98a04c2ac58 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-k/d0p2LuDifA2dfgYieu2p/59faTkvcrtsa3P4djVj4=";
+    sha256 = "sha256-hmdXmH0ZYqqQjZyLMYVzn679cqNZ6VRZ3gwuTlNpybI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 54f21c49f77..a8c85fdffd6 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.4.25";
+  version = "1.4.27";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Gt89JeLjOvvNSM+tgHb5N4eTvkPn/sPkM0MGysa+wTg=";
+    sha256 = "sha256-12g1na6zqGZE84VMZlnkSWo+a7orRlHsyHznrUFbMgw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/xpybutil/default.nix b/pkgs/development/python-modules/xpybutil/default.nix
index af8fda8a7d2..cc574c58241 100644
--- a/pkgs/development/python-modules/xpybutil/default.nix
+++ b/pkgs/development/python-modules/xpybutil/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, xcffib, pillow, nose }:
+{ lib, buildPythonPackage, fetchFromGitHub, xcffib, pillow }:
 
 buildPythonPackage rec {
   pname = "xpybutil";
@@ -17,7 +17,12 @@ buildPythonPackage rec {
 
   propagatedNativeBuildInputs = [ xcffib ];
 
-  checkInputs = [ nose ];
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "xpybutil"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/BurntSushi/xpybutil";
diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index 0e15f138daa..08866ac3907 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.7.0";
+  version = "1.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8e7ebaf62e19c2feb097ffb7c94deb0f0c9fab52590784c8cd679d30ab009162";
+    sha256 = "sha256-RTmbRtYMJTMnpGDpmFZ1IAn87l9dPICy98DK4cONVt0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index ac715147dc3..05b7aac82c1 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -29,6 +29,10 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
+  depsBuildBuild = [
+    python3
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/tools/iaca/2.1.nix b/pkgs/development/tools/iaca/2.1.nix
index 6170cbb4318..a1b9729ccb4 100644
--- a/pkgs/development/tools/iaca/2.1.nix
+++ b/pkgs/development/tools/iaca/2.1.nix
@@ -2,10 +2,11 @@
 with lib;
 
 # v2.1: last version with NHM/WSM arch support
-stdenv.mkDerivation {
-  name = "iaca-2.1";
+stdenv.mkDerivation rec {
+  pname = "iaca";
+  version = "2.1";
   src = requireFile {
-    name = "iaca-version-2.1-lin64.zip";
+    name = "iaca-version-${version}-lin64.zip";
     sha256 = "11s1134ijf66wrc77ksky9mnb0lq6ml6fzmr86a6p6r5xclzay2m";
     url = "https://software.intel.com/en-us/articles/intel-architecture-code-analyzer-download";
   };
diff --git a/pkgs/development/tools/iaca/3.0.nix b/pkgs/development/tools/iaca/3.0.nix
index 731b6431717..4da6851af5a 100644
--- a/pkgs/development/tools/iaca/3.0.nix
+++ b/pkgs/development/tools/iaca/3.0.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, requireFile, unzip }:
 with lib;
 
-stdenv.mkDerivation {
-  name = "iaca-3.0";
+stdenv.mkDerivation rec {
+  pname = "iaca";
+  version = "3.0";
   src = requireFile {
-    name = "iaca-version-v3.0-lin64.zip";
+    name = "iaca-version-v${version}-lin64.zip";
     sha256 = "0qd81bxg269cwwvfmdp266kvhcl3sdvhrkfqdrbmanawk0w7lvp1";
     url = "https://software.intel.com/en-us/articles/intel-architecture-code-analyzer-download";
   };
diff --git a/pkgs/development/tools/kexpand/default.nix b/pkgs/development/tools/kexpand/default.nix
index 8e45eb2654b..35d0a5c2da0 100644
--- a/pkgs/development/tools/kexpand/default.nix
+++ b/pkgs/development/tools/kexpand/default.nix
@@ -1,7 +1,8 @@
 { buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage {
-  name = "kexpand-unstable-2017-05-12";
+  pname = "kexpand";
+  version = "unstable-2017-05-12";
 
   goPackagePath = "github.com/kopeio/kexpand";
 
diff --git a/pkgs/development/tools/manul/default.nix b/pkgs/development/tools/manul/default.nix
index 306c9143c5c..377cd2856df 100644
--- a/pkgs/development/tools/manul/default.nix
+++ b/pkgs/development/tools/manul/default.nix
@@ -1,7 +1,8 @@
 { lib, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage {
-  name = "manul-unstable-2016-09-30";
+  pname = "manul";
+  version = "unstable-2016-09-30";
 
   goPackagePath = "github.com/kovetskiy/manul";
   excludedPackages = "tests";
diff --git a/pkgs/development/tools/misc/autoconf/2.13.nix b/pkgs/development/tools/misc/autoconf/2.13.nix
index 26d6d9178ed..dc36028332f 100644
--- a/pkgs/development/tools/misc/autoconf/2.13.nix
+++ b/pkgs/development/tools/misc/autoconf/2.13.nix
@@ -1,10 +1,11 @@
-{lib, stdenv, fetchurl, m4, perl, xz}:
+{ lib, stdenv, fetchurl, m4, perl, xz }:
 
 stdenv.mkDerivation rec {
-  name = "autoconf-2.13";
+  pname = "autoconf";
+  version = "2.13";
 
   src = fetchurl {
-    url = "mirror://gnu/autoconf/${name}.tar.gz";
+    url = "mirror://gnu/autoconf/autoconf-${version}.tar.gz";
     sha256 = "07krzl4czczdsgzrrw9fiqx35xcf32naf751khg821g5pqv12qgh";
   };
 
diff --git a/pkgs/development/tools/misc/autoconf/2.64.nix b/pkgs/development/tools/misc/autoconf/2.64.nix
index 6976a291ae7..8c6e104e11b 100644
--- a/pkgs/development/tools/misc/autoconf/2.64.nix
+++ b/pkgs/development/tools/misc/autoconf/2.64.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, m4, perl }:
 
 stdenv.mkDerivation rec {
-  name = "autoconf-2.64";
+  pname = "autoconf";
+  version = "2.64";
 
   src = fetchurl {
-    url = "mirror://gnu/autoconf/${name}.tar.xz";
+    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
     sha256 = "0j3jdjpf5ly39dlp0bg70h72nzqr059k0x8iqxvaxf106chpgn9j";
   };
 
@@ -24,7 +25,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Make the Autotest test suite run in parallel.
-  preCheck =''
+  preCheck = ''
     export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
   '';
 
diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix
index f2f8ca0a858..870b0ae1d34 100644
--- a/pkgs/development/tools/misc/autoconf/2.69.nix
+++ b/pkgs/development/tools/misc/autoconf/2.69.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, m4, perl }:
 
 stdenv.mkDerivation rec {
-  name = "autoconf-2.69";
+  pname = "autoconf";
+  version = "2.69";
 
   src = fetchurl {
-    url = "mirror://gnu/autoconf/${name}.tar.xz";
+    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
     sha256 = "113nlmidxy9kjr45kg9x3ngar4951mvag1js2a3j8nxcz34wxsv4";
   };
 
@@ -25,7 +26,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Make the Autotest test suite run in parallel.
-  preCheck =''
+  preCheck = ''
     export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
   '';
 
diff --git a/pkgs/development/tools/misc/autoconf/2.71-fix-race.patch b/pkgs/development/tools/misc/autoconf/2.71-fix-race.patch
new file mode 100644
index 00000000000..e3b28554352
--- /dev/null
+++ b/pkgs/development/tools/misc/autoconf/2.71-fix-race.patch
@@ -0,0 +1,36 @@
+https://savannah.gnu.org/support/index.php?110521
+https://git.savannah.gnu.org/cgit/autoconf.git/patch/?id=3a9802d60156809c139e9b4620bf04917e143ee2
+--- a/lib/Autom4te/FileUtils.pm
++++ b/lib/Autom4te/FileUtils.pm
+@@ -34,12 +34,12 @@ This perl module provides various general purpose file handling functions.
+ 
+ =cut
+ 
+-use 5.006;
++use 5.008;
+ use strict;
+ use warnings FATAL => 'all';
+ 
+ use Exporter;
+-use File::stat;
++use Time::HiRes qw(stat);
+ use IO::File;
+ 
+ use Autom4te::Channels;
+@@ -115,10 +115,11 @@ sub mtime ($)
+   return 0
+     if $file eq '-' || ! -f $file;
+ 
+-  my $stat = stat ($file)
++  my ($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,
++    $atime,$mtime,$ctime,$blksize,$blocks) = stat ($file)
+     or fatal "cannot stat $file: $!";
+ 
+-  return $stat->mtime;
++  return $mtime;
+ }
+ 
+ 
+-- 
+cgit v1.2.1
+
diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix
index a2c160f5662..ac342086f6c 100644
--- a/pkgs/development/tools/misc/autoconf/default.nix
+++ b/pkgs/development/tools/misc/autoconf/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
     url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
     sha256 = "197sl23irn6s9pd54rxj5vcp5y8dv65jb9yfqgr2g56cxg7q6k7i";
   };
+  patches = [
+    # fix stale autom4te cache race condition:
+    #  https://savannah.gnu.org/support/index.php?110521
+    ./2.71-fix-race.patch
+  ];
 
   nativeBuildInputs = [ m4 perl ];
   buildInputs = [ m4 ];
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 8f2121c2599..61df38f68ce 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -53,25 +53,23 @@ stdenv.mkDerivation rec {
     export MAN_PAGE_DATE=$(date '+%Y-%m-%d' -d "@$SOURCE_DATE_EPOCH")
   '';
 
-  configureFlags =
-    [
-      # Make sure to use a static value for the timeout. If we do not set a value
-      # here autogen will select one based on the execution time of the configure
-      # phase which is not really reproducible.
-      #
-      # If you are curious about the number 78, it has been cargo-culted from
-      # Debian: https://salsa.debian.org/debian/autogen/-/blob/master/debian/rules#L21
-      "--enable-timeout=78"
-    ]
-    ++ (lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "--with-libxml2=${libxml2.dev}"
-      "--with-libxml2-cflags=-I${libxml2.dev}/include/libxml2"
-      # the configure check for regcomp wants to run a host program
-      "libopts_cv_with_libregex=yes"
-      #"MAKEINFO=${buildPackages.texinfo}/bin/makeinfo"
-    ])
-    # See: https://sourceforge.net/p/autogen/bugs/187/
-    ++ lib.optionals stdenv.isDarwin [ "ac_cv_func_utimensat=no" ];
+  configureFlags = [
+    "--with-libxml2=${libxml2.dev}"
+    "--with-libxml2-cflags=-I${libxml2.dev}/include/libxml2"
+    # Make sure to use a static value for the timeout. If we do not set a value
+    # here autogen will select one based on the execution time of the configure
+    # phase which is not really reproducible.
+    #
+    # If you are curious about the number 78, it has been cargo-culted from
+    # Debian: https://salsa.debian.org/debian/autogen/-/blob/master/debian/rules#L21
+    "--enable-timeout=78"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # the configure check for regcomp wants to run a host program
+    "libopts_cv_with_libregex=yes"
+    #"MAKEINFO=${buildPackages.texinfo}/bin/makeinfo"
+  ]
+  # See: https://sourceforge.net/p/autogen/bugs/187/
+  ++ lib.optionals stdenv.isDarwin [ "ac_cv_func_utimensat=no" ];
 
   #doCheck = true; # not reliable
 
diff --git a/pkgs/development/tools/misc/automake/automake-1.11.x.nix b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
index 5e3167d182d..02d9f4c4872 100644
--- a/pkgs/development/tools/misc/automake/automake-1.11.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchurl, perl, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "automake-1.11.6";
+  pname = "automake";
+  version = "1.11.6";
 
   # TODO: Remove the `aclocal' wrapper when $ACLOCAL_PATH support is
   # available upstream; see
@@ -11,7 +12,7 @@ stdenv.mkDerivation rec {
   setupHook = ./setup-hook.sh;
 
   src = fetchurl {
-    url = "mirror://gnu/automake/${name}.tar.xz";
+    url = "mirror://gnu/automake/automake-${version}.tar.xz";
     sha256 = "1ffbc6cc41f0ea6c864fbe9485b981679dc5e350f6c4bc6c3512f5a4226936b5";
   };
 
diff --git a/pkgs/development/tools/misc/automake/automake-1.15.x.nix b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
index 0088eb74cc4..470827c2b45 100644
--- a/pkgs/development/tools/misc/automake/automake-1.15.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, perl, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "automake-1.15.1";
+  pname = "automake";
+  version = "1.15.1";
 
   src = fetchurl {
-    url = "mirror://gnu/automake/${name}.tar.xz";
+    url = "mirror://gnu/automake/automake-${version}.tar.xz";
     sha256 = "1bzd9g32dfm4rsbw93ld9x7b5nc1y6i4m6zp032qf1i28a8s6sxg";
   };
 
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index c89dd583299..adee94dafa9 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -7,16 +7,15 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
   pname = "elfutils";
-  version = "0.185";
+  version = "0.186";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-3I0+dKsglGXn9Wjhs7uaWhQvhlbitX0QBJpz2irmtaY=";
+    sha256 = "sha256-f2+5FJsWc9ONkXig0+D7ih7E9TqfTC/4lGlgmHlkEXc=";
   };
 
   patches = [
     ./debug-info-from-env.patch
-    ./musl-cdefs_h.patch
     (fetchpatch {
       name = "fix-aarch64_fregs.patch";
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/fix-aarch64_fregs.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
diff --git a/pkgs/development/tools/misc/elfutils/musl-cdefs_h.patch b/pkgs/development/tools/misc/elfutils/musl-cdefs_h.patch
deleted file mode 100644
index 1b5bf466217..00000000000
--- a/pkgs/development/tools/misc/elfutils/musl-cdefs_h.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-# avoids a warning about including an internal header when
-# compiling with musl-libc
-diff -crb --new-file a/lib/fixedsizehash.h b/lib/fixedsizehash.h
-*** a/lib/fixedsizehash.h	2020-06-11 11:37:46.000000000 -0400
---- b/lib/fixedsizehash.h	2021-01-21 05:52:59.000000000 -0500
-***************
-*** 30,36 ****
-  #include <errno.h>
-  #include <stdlib.h>
-  #include <string.h>
-- #include <sys/cdefs.h>
-  
-  #include <system.h>
-  
---- 30,35 ----
diff --git a/pkgs/development/tools/misc/gperf/3.0.x.nix b/pkgs/development/tools/misc/gperf/3.0.x.nix
index 339511f2cc0..f83b245417e 100644
--- a/pkgs/development/tools/misc/gperf/3.0.x.nix
+++ b/pkgs/development/tools/misc/gperf/3.0.x.nix
@@ -1,10 +1,11 @@
-{lib, stdenv, fetchurl, autoreconfHook }:
+{ lib, stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "gperf-3.0.4";
+  pname = "gperf";
+  version = "3.0.4";
 
   src = fetchurl {
-    url = "mirror://gnu/gperf/${name}.tar.gz";
+    url = "mirror://gnu/gperf/gperf-${version}.tar.gz";
     sha256 = "0gnnm8iqcl52m8iha3sxrzrl9mcyhg7lfrhhqgdn4zj00ji14wbn";
   };
 
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 24edb2c5955..4521eee95a2 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -14,8 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ZznkyqQuau0zmb5Dh8p5OZZAlnM06RcohjuOqpIlgr4=";
   };
 
-  nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
-  buildInputs = [ perlPackages.perl perlPackages.LocaleGettext ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ gettext perlPackages.perl perlPackages.LocaleGettext ];
+  buildInputs = [ perlPackages.LocaleGettext ];
 
   doCheck = false;                                # target `check' is missing
 
diff --git a/pkgs/development/tools/misc/indent/default.nix b/pkgs/development/tools/misc/indent/default.nix
index 1f5236456db..ce8ce9d8a48 100644
--- a/pkgs/development/tools/misc/indent/default.nix
+++ b/pkgs/development/tools/misc/indent/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, texinfo }:
+{ lib, stdenv, fetchurl, texinfo, buildPackages, pkgsStatic }:
 
 stdenv.mkDerivation rec {
   pname = "indent";
@@ -10,14 +10,18 @@ stdenv.mkDerivation rec {
   };
 
   patches = [ ./darwin.patch ];
+  makeFlags = [ "AR=${stdenv.cc.targetPrefix}ar" ];
 
-  buildInputs = [ texinfo ];
+  strictDeps = true;
+  nativeBuildInputs = [ texinfo ];
+  pkgsBuildBuild = [ buildPackages.stdenv.cc ]; # needed when cross-compiling
 
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
     "-Wno-implicit-function-declaration";
 
   hardeningDisable = [ "format" ];
 
+  passthru.tests.static = pkgsStatic.indent;
   meta = {
     homepage = "https://www.gnu.org/software/indent/";
     description = "A source code reformatter";
diff --git a/pkgs/development/tools/misc/itstool/default.nix b/pkgs/development/tools/misc/itstool/default.nix
index 01a0fab369e..2c189cbf5a6 100644
--- a/pkgs/development/tools/misc/itstool/default.nix
+++ b/pkgs/development/tools/misc/itstool/default.nix
@@ -9,9 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "1acjgf8zlyk7qckdk19iqaca4jcmywd7vxjbcs1mm6kaf8icqcv2";
   };
 
-  pythonPath = [ python3.pkgs.libxml2 ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ python3 python3.pkgs.wrapPython ];
   buildInputs = [ python3 python3.pkgs.libxml2 ];
-  nativeBuildInputs = [ python3.pkgs.wrapPython ];
+  pythonPath = [ python3.pkgs.libxml2 ];
 
   postFixup = ''
     wrapPythonPrograms
diff --git a/pkgs/development/tools/misc/patchelf/0.9.nix b/pkgs/development/tools/misc/patchelf/0.9.nix
index c64d722ca71..142e6b0d760 100644
--- a/pkgs/development/tools/misc/patchelf/0.9.nix
+++ b/pkgs/development/tools/misc/patchelf/0.9.nix
@@ -1,10 +1,11 @@
 { stdenv, fetchurl, patchelf }:
 
 stdenv.mkDerivation rec {
-  name = "patchelf-0.9";
+  pname = "patchelf";
+  version = "0.9";
 
   src = fetchurl {
-    url = "https://nixos.org/releases/patchelf/${name}/${name}.tar.bz2";
+    url = "https://nixos.org/releases/patchelf/patchelf-${version}/patchelf-${version}.tar.bz2";
     sha256 = "a0f65c1ba148890e9f2f7823f4bedf7ecad5417772f64f994004f59a39014f83";
   };
 
diff --git a/pkgs/development/tools/parsing/antlr/2.7.7.nix b/pkgs/development/tools/parsing/antlr/2.7.7.nix
index fed96e95475..3fc1b2cd866 100644
--- a/pkgs/development/tools/parsing/antlr/2.7.7.nix
+++ b/pkgs/development/tools/parsing/antlr/2.7.7.nix
@@ -1,9 +1,10 @@
 { lib, stdenv, fetchurl, jdk, python2 }:
 
-stdenv.mkDerivation {
-  name = "antlr-2.7.7";
+stdenv.mkDerivation rec {
+  pname = "antlr";
+  version = "2.7.7";
   src = fetchurl {
-    url = "https://www.antlr2.org/download/antlr-2.7.7.tar.gz";
+    url = "https://www.antlr2.org/download/antlr-${version}.tar.gz";
     sha256 = "1ffvcwdw73id0dk6pj2mlxjvbg0662qacx4ylayqcxgg381fnfl5";
   };
   patches = [ ./2.7.7-fixes.patch ];
diff --git a/pkgs/development/tools/parsing/flex/2.5.35.nix b/pkgs/development/tools/parsing/flex/2.5.35.nix
index ec2c9eeb2d1..a80e75559df 100644
--- a/pkgs/development/tools/parsing/flex/2.5.35.nix
+++ b/pkgs/development/tools/parsing/flex/2.5.35.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, autoreconfHook, flex, bison, texinfo, help2man, m4 }:
 
-stdenv.mkDerivation {
-  name = "flex-2.5.35";
+stdenv.mkDerivation rec {
+  pname = "flex";
+  version = "2.5.35";
 
   src = fetchurl {
-    url = "https://github.com/westes/flex/archive/flex-2-5-35.tar.gz";
+    url = "https://github.com/westes/flex/archive/flex-${lib.replaceStrings ["."] ["-"] version}.tar.gz";
     sha256 = "0wh06nix8bd4w1aq4k2fbbkdq5i30a9lxz3xczf3ff28yy0kfwzm";
   };
 
diff --git a/pkgs/development/tools/profiling/sysprof/default.nix b/pkgs/development/tools/profiling/sysprof/default.nix
index 7bcf387202e..319212da770 100644
--- a/pkgs/development/tools/profiling/sysprof/default.nix
+++ b/pkgs/development/tools/profiling/sysprof/default.nix
@@ -2,7 +2,6 @@
 , lib
 , desktop-file-utils
 , fetchurl
-, fetchpatch
 , gettext
 , glib
 , gtk3
@@ -22,23 +21,15 @@
 
 stdenv.mkDerivation rec {
   pname = "sysprof";
-  version = "3.42.0";
+  version = "3.42.1";
 
   outputs = [ "out" "lib" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "PBbgPv3+XT5xxNI5xndBrTf3LOiXHi9/rxaNvV6T6IY=";
+    sha256 = "F5a4FATudf0eus9URkrXr/6/YvKFHu9STZ+OrAxKIAE=";
   };
 
-  patches = [
-    # Fix missing unistd.h include.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/sysprof/commit/b113c89af1de2f87589175795a197f6384852a78.patch";
-      sha256 = "3Q8d6IZYNJl/vbyzRgoRR2sdl4aRkbcKPeVjSSqxb98=";
-    })
-  ];
-
   nativeBuildInputs = [
     desktop-file-utils
     gettext
diff --git a/pkgs/development/tools/sassc/default.nix b/pkgs/development/tools/sassc/default.nix
index d9662cd7ddb..16bc97a48ee 100644
--- a/pkgs/development/tools/sassc/default.nix
+++ b/pkgs/development/tools/sassc/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "sassc";
-  version = "3.6.1";
+  version = "3.6.2"; # also check libsass for updates
 
   src = fetchFromGitHub {
     owner = "sass";
     repo = pname;
     rev = version;
-    sha256 = "1sxm54mkhs9m4vnl7vn11y17mhzamc403hv3966j1c7p2rbzg5pv";
+    sha256 = "sha256-jcs3+orRqKt9C3c2FTdeaj4H2rBP74lW3HF8CHSm7lQ=";
   };
 
-  patchPhase = ''
+  preConfigure = ''
     export SASSC_VERSION=${version}
   '';
 
diff --git a/pkgs/games/arx-libertatis/default.nix b/pkgs/games/arx-libertatis/default.nix
index 945ebf7b785..edeacdec2a1 100644
--- a/pkgs/games/arx-libertatis/default.nix
+++ b/pkgs/games/arx-libertatis/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, zlib, boost
-, openal, glm, freetype, libGLU, SDL2, epoxy
+, openal, glm, freetype, libGLU, SDL2, libepoxy
 , dejavu_fonts, inkscape, optipng, imagemagick
 , withCrashReporter ? !stdenv.isDarwin
 ,   qtbase ? null
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     zlib boost openal glm
-    freetype libGLU SDL2 epoxy
+    freetype libGLU SDL2 libepoxy
   ] ++ optionals withCrashReporter [ qtbase curl ]
     ++ optionals stdenv.isLinux    [ gdb ];
 
diff --git a/pkgs/games/gnome-hexgl/default.nix b/pkgs/games/gnome-hexgl/default.nix
index 8e2fa41f420..c78bc69c26f 100644
--- a/pkgs/games/gnome-hexgl/default.nix
+++ b/pkgs/games/gnome-hexgl/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , gthree
 , gsound
-, epoxy
+, libepoxy
 , gtk3
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gthree
     gsound
-    epoxy
+    libepoxy
     gtk3
   ];
 
diff --git a/pkgs/games/performous/default.nix b/pkgs/games/performous/default.nix
index dce771faec1..c4af373cdcd 100644
--- a/pkgs/games/performous/default.nix
+++ b/pkgs/games/performous/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, gettext
 , glibmm, libxmlxx, pango, librsvg
-, SDL2, glew, boost, ffmpeg, portaudio, epoxy
+, SDL2, glew, boost, ffmpeg, portaudio, libepoxy
 }:
 
 stdenv.mkDerivation rec {
@@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glibmm libxmlxx pango librsvg
-    SDL2 glew boost ffmpeg portaudio epoxy
+    SDL2 glew boost ffmpeg portaudio libepoxy
   ];
 }
diff --git a/pkgs/misc/emulators/melonDS/default.nix b/pkgs/misc/emulators/melonDS/default.nix
index 7123f496fad..3e30be8c2a3 100644
--- a/pkgs/misc/emulators/melonDS/default.nix
+++ b/pkgs/misc/emulators/melonDS/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , mkDerivation
 , cmake
-, epoxy
+, libepoxy
 , libarchive
 , libpcap
 , libslirp
@@ -24,7 +24,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
-    epoxy
+    libepoxy
     libarchive
     libslirp
     qtbase
diff --git a/pkgs/misc/emulators/mgba/default.nix b/pkgs/misc/emulators/mgba/default.nix
index be0911aaab1..a01e8a4a4da 100644
--- a/pkgs/misc/emulators/mgba/default.nix
+++ b/pkgs/misc/emulators/mgba/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , SDL2
 , cmake
-, epoxy
+, libepoxy
 , ffmpeg
 , imagemagick
 , libedit
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     SDL2
-    epoxy
+    libepoxy
     ffmpeg
     imagemagick
     libedit
diff --git a/pkgs/misc/emulators/nestopia/default.nix b/pkgs/misc/emulators/nestopia/default.nix
index e19b97a477e..fa55c2e9635 100644
--- a/pkgs/misc/emulators/nestopia/default.nix
+++ b/pkgs/misc/emulators/nestopia/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, SDL2, alsa-lib, gtk3
 , makeWrapper, libGLU, libGL, libarchive, libao, unzip, xdg-utils
-, epoxy, gdk-pixbuf, gnome, wrapGAppsHook
+, libepoxy, gdk-pixbuf, gnome, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     SDL2
     alsa-lib
-    epoxy
+    libepoxy
     gtk3
     gdk-pixbuf
     libGLU libGL
diff --git a/pkgs/misc/emulators/snes9x-gtk/default.nix b/pkgs/misc/emulators/snes9x-gtk/default.nix
index 8cebc664bca..27f3400cc0b 100644
--- a/pkgs/misc/emulators/snes9x-gtk/default.nix
+++ b/pkgs/misc/emulators/snes9x-gtk/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, wrapGAppsHook
-, SDL2, zlib, gtk3, libxml2, libXv, epoxy, minizip, pulseaudio, portaudio }:
+, SDL2, zlib, gtk3, libxml2, libXv, libepoxy, minizip, pulseaudio, portaudio }:
 
 stdenv.mkDerivation rec {
   pname = "snes9x-gtk";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ meson ninja pkg-config wrapGAppsHook ];
-  buildInputs = [ SDL2 zlib gtk3 libxml2 libXv epoxy minizip pulseaudio portaudio ];
+  buildInputs = [ SDL2 zlib gtk3 libxml2 libXv libepoxy minizip pulseaudio portaudio ];
 
   preConfigure = "cd gtk";
 
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 676c24b3f7d..5e27e5573c5 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -1,13 +1,10 @@
 { config, stdenv, lib, fetchurl, pkg-config, zlib, expat, openssl, autoconf
 , libjpeg, libpng, libtiff, freetype, fontconfig, libpaper, jbig2dec
-, libiconv, ijs, lcms2, fetchpatch, callPackage
-, cupsSupport ? config.ghostscript.cups or (!stdenv.isDarwin), cups ? null
-, x11Support ? cupsSupport, xlibsWrapper ? null # with CUPS, X11 only adds very little
+, libiconv, ijs, lcms2, fetchpatch, callPackage, bash, buildPackages
+, cupsSupport ? config.ghostscript.cups or (!stdenv.isDarwin), cups
+, x11Support ? cupsSupport, xlibsWrapper # with CUPS, X11 only adds very little
 }:
 
-assert x11Support -> xlibsWrapper != null;
-assert cupsSupport -> cups != null;
-
 let
   fonts = stdenv.mkDerivation {
     name = "ghostscript-fonts";
@@ -58,17 +55,27 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ pkg-config autoconf ];
-  buildInputs =
-    [ zlib expat openssl
-      libjpeg libpng libtiff freetype fontconfig libpaper jbig2dec
-      libiconv ijs lcms2
-    ]
-    ++ lib.optional x11Support xlibsWrapper
-    ++ lib.optional cupsSupport cups
-    ;
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
+  nativeBuildInputs = [ pkg-config autoconf zlib ]
+    ++ lib.optional cupsSupport cups;
+
+  buildInputs = [
+    zlib expat openssl
+    libjpeg libpng libtiff freetype fontconfig libpaper jbig2dec
+    libiconv ijs lcms2 bash
+  ]
+  ++ lib.optional x11Support xlibsWrapper
+  ++ lib.optional cupsSupport cups
+  ;
 
   preConfigure = ''
+    # https://ghostscript.com/doc/current/Make.htm
+    export CCAUX=$CC_FOR_BUILD
+    ${lib.optionalString cupsSupport ''export CUPSCONFIG="${cups.dev}/bin/cups-config"''}
+
     # requires in-tree (heavily patched) openjpeg
     rm -rf jpeg libpng zlib jasper expat tiff lcms2mt jbig2dec freetype cups/libs ijs
 
@@ -85,9 +92,6 @@ stdenv.mkDerivation rec {
   ++ lib.optional x11Support "--with-x"
   ++ lib.optionals cupsSupport [
     "--enable-cups"
-    "--with-cups-serverbin=$(out)/lib/cups"
-    "--with-cups-serverroot=$(out)/etc/cups"
-    "--with-cups-datadir=$(out)/share/cups"
   ];
 
   # make check does nothing useful
@@ -143,7 +147,6 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://www.ghostscript.com/";
     description = "PostScript interpreter (mainline version)";
-
     longDescription = ''
       Ghostscript is the name of a set of tools that provides (i) an
       interpreter for the PostScript language and the PDF file format,
@@ -152,9 +155,7 @@ stdenv.mkDerivation rec {
       operations in the PostScript language, and (iii) a wide variety
       of output drivers for various file formats and printers.
     '';
-
     license = lib.licenses.agpl3;
-
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.viric ];
     mainProgram = "gs";
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index 13dd8302b18..736f5ca6bc9 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, elfutils
 , xorg, patchelf, openssl, libdrm, udev
-, libxcb, libxshmfence, epoxy, perl, zlib
+, libxcb, libxshmfence, libepoxy, perl, zlib
 , ncurses
 , libsOnly ? false, kernel ? null
 }:
@@ -101,7 +101,7 @@ in stdenv.mkDerivation rec {
 
   depLibPath = makeLibraryPath [
     stdenv.cc.cc.lib xorg.libXext xorg.libX11 xorg.libXdamage xorg.libXfixes zlib
-    xorg.libXxf86vm libxcb libxshmfence epoxy openssl libdrm elfutils udev ncurses5
+    xorg.libXxf86vm libxcb libxshmfence libepoxy openssl libdrm elfutils udev ncurses5
   ];
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 344913888d5..38b08eb7709 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -4,13 +4,14 @@
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
 , gawk
 , withPerl ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl, perl
-, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python, python
+, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python3, python3
 , swig
 , ncurses
 , pam
 , libnotify
 , buildPackages
 , coreutils
+, bash
 , gnugrep
 , gnused
 , kmod
@@ -44,10 +45,11 @@ let
   prePatchCommon = ''
     chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh
     patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh
-    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man"
-    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html"
-    substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-    substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"
+    substituteInPlace ./common/Make.rules \
+      --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man" \
+      --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html" \
+      --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" \
+      --replace "/usr/share/man" "share/man"
   '';
 
   patches = lib.optionals stdenv.hostPlatform.isMusl [
@@ -65,9 +67,16 @@ let
   # FIXME: convert these to a single multiple-outputs package?
 
   libapparmor = stdenv.mkDerivation {
-    name = "libapparmor-${apparmor-version}";
+    pname = "libapparmor";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
+   # checking whether python bindings are enabled... yes
+   # checking for python3... no
+   # configure: error: python is required when enabling python bindings
+    strictDeps = false;
+
     nativeBuildInputs = [
       autoreconfHook
       bison
@@ -77,11 +86,10 @@ let
       ncurses
       which
       perl
-    ];
+    ] ++ lib.optional withPython python3;
 
-    buildInputs = []
-      ++ lib.optional withPerl perl
-      ++ lib.optional withPython python;
+    buildInputs = lib.optional withPerl perl
+      ++ lib.optional withPython python3;
 
     # required to build apparmor-parser
     dontDisableStatic = true;
@@ -94,7 +102,10 @@ let
     '';
     inherit patches;
 
-    postPatch = "cd ./libraries/libapparmor";
+    postPatch = ''
+      cd ./libraries/libapparmor
+    '';
+
     # https://gitlab.com/apparmor/apparmor/issues/1
     configureFlags = [
       (lib.withFeature withPerl "perl")
@@ -114,14 +125,19 @@ let
   };
 
   apparmor-utils = stdenv.mkDerivation {
-    name = "apparmor-utils-${apparmor-version}";
+    pname = "apparmor-utils";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
-    nativeBuildInputs = [ makeWrapper which ];
+    strictDeps = true;
+
+    nativeBuildInputs = [ makeWrapper which python3 ];
 
     buildInputs = [
+      bash
       perl
-      python
+      python3
       libapparmor
       libapparmor.python
     ];
@@ -131,9 +147,9 @@ let
       lib.optionalString stdenv.hostPlatform.isMusl ''
         sed -i ./utils/Makefile -e "/\<vim\>/d"
       '' + ''
-      substituteInPlace ./utils/apparmor/easyprof.py --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
-      substituteInPlace ./utils/apparmor/aa.py --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
-      substituteInPlace ./utils/logprof.conf --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
+      for file in utils/apparmor/easyprof.py utils/apparmor/aa.py utils/logprof.conf; do
+        substituteInPlace $file --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
+      done
     '';
     inherit patches;
     postPatch = "cd ./utils";
@@ -143,7 +159,7 @@ let
     postInstall = ''
       sed -i $out/bin/aa-unconfined -e "/my_env\['PATH'\]/d"
       for prog in aa-audit aa-autodep aa-cleanprof aa-complain aa-disable aa-enforce aa-genprof aa-logprof aa-mergeprof aa-unconfined ; do
-        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python3.libPrefix}/site-packages:$PYTHONPATH"
       done
 
       substituteInPlace $out/bin/aa-notify \
@@ -153,7 +169,7 @@ let
       substituteInPlace $out/bin/aa-remove-unknown \
        --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
       wrapProgram $out/bin/aa-remove-unknown \
-       --prefix PATH : ${lib.makeBinPath [gawk]}
+       --prefix PATH : ${lib.makeBinPath [ gawk ]}
 
       ln -s ${aa-teardown} $out/bin/aa-teardown
     '';
@@ -166,7 +182,9 @@ let
   };
 
   apparmor-bin-utils = stdenv.mkDerivation {
-    name = "apparmor-bin-utils-${apparmor-version}";
+    pname = "apparmor-bin-utils";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     nativeBuildInputs = [
@@ -181,7 +199,9 @@ let
     ];
 
     prePatch = prePatchCommon;
-    postPatch = "cd ./binutils";
+    postPatch = ''
+      cd ./binutils
+    '';
     makeFlags = [ "LANGS=" "USE_SYSTEM=1" ];
     installFlags = [ "DESTDIR=$(out)" "BINDIR=$(out)/bin" "SBINDIR=$(out)/bin" ];
 
@@ -191,7 +211,9 @@ let
   };
 
   apparmor-parser = stdenv.mkDerivation {
-    name = "apparmor-parser-${apparmor-version}";
+    name = "apparmor-parser";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     nativeBuildInputs = [ bison flex which ];
@@ -199,17 +221,20 @@ let
     buildInputs = [ libapparmor ];
 
     prePatch = prePatchCommon + ''
-      substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison"
-      substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex"
-      substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
       ## techdoc.pdf still doesn't build ...
-      substituteInPlace ./parser/Makefile --replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
+      substituteInPlace ./parser/Makefile \
+        --replace "/usr/bin/bison" "${bison}/bin/bison" \
+        --replace "/usr/bin/flex" "${flex}/bin/flex" \
+        --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" \
+        --replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
       substituteInPlace parser/rc.apparmor.functions \
        --replace "/sbin/apparmor_parser" "$out/bin/apparmor_parser"
       sed -i parser/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
     '';
     inherit patches;
-    postPatch = "cd ./parser";
+    postPatch = ''
+      cd ./parser
+    '';
     makeFlags = [
       "LANGS=" "USE_SYSTEM=1" "INCLUDEDIR=${libapparmor}/include"
       "AR=${stdenv.cc.bintools.targetPrefix}ar"
@@ -222,14 +247,18 @@ let
   };
 
   apparmor-pam = stdenv.mkDerivation {
-    name = "apparmor-pam-${apparmor-version}";
+    pname = "apparmor-pam";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     nativeBuildInputs = [ pkg-config which ];
 
     buildInputs = [ libapparmor pam ];
 
-    postPatch = "cd ./changehat/pam_apparmor";
+    postPatch = ''
+      cd ./changehat/pam_apparmor
+    '';
     makeFlags = [ "USE_SYSTEM=1" ];
     installFlags = [ "DESTDIR=$(out)" ];
 
@@ -239,12 +268,17 @@ let
   };
 
   apparmor-profiles = stdenv.mkDerivation {
-    name = "apparmor-profiles-${apparmor-version}";
+    pname = "apparmor-profiles";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     nativeBuildInputs = [ which ];
 
-    postPatch = "cd ./profiles";
+    postPatch = ''
+      cd ./profiles
+    '';
+
     installFlags = [ "DESTDIR=$(out)" "EXTRAS_DEST=$(out)/share/apparmor/extra-profiles" ];
 
     inherit doCheck;
@@ -253,7 +287,9 @@ let
   };
 
   apparmor-kernel-patches = stdenv.mkDerivation {
-    name = "apparmor-kernel-patches-${apparmor-version}";
+    pname = "apparmor-kernel-patches";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     dontBuild = true;
@@ -294,7 +330,7 @@ let
     touch $out
     while read -r path
     do printf >>$out "%s,\n" ${lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules)}
-    done <${closureInfo {inherit rootPaths;}}/store-paths
+    done <${closureInfo { inherit rootPaths; }}/store-paths
   '';
 in
 {
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 308997501ff..be46f00a2cf 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.44";
+  version = "0.45";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/libs/${pname}/${pname}.git";
+    url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-8korsEvlQOtfyuGkzFun1Xbuc4uhI2I0YpACUfxlpIM=";
+    sha256 = "sha256-W+IXubPuA/BQzD/LknCeJQgTXUH6I/rUrKBMeEzcBlw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index 33e1f1783ab..a7bc2ab7f61 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -8,17 +8,16 @@
 , readline
 , openssl
 , python3Packages
-, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.17";
+  version = "1.19";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-uWWdKjxctz8fdiIkSiuOYNcZPhxEWDXaA8QPLnd/I9c=";
+    sha256 = "sha256-sMET4ouZ33SZRnkqJBadVvIDYMCOi7pib6d1zt1EJ8k=";
   };
 
   outputs = [ "out" "man" ]
@@ -57,14 +56,6 @@ stdenv.mkDerivation rec {
     "--with-systemd-networkdir=${placeholder "out"}/lib/systemd/network/"
   ];
 
-  patches = [
-    # Fix failure in test-eapol. Remove when bumping to 1.18
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git/patch/?id=ed10b00afa3f4c087b46d7ba0b60a47bd05d8b39";
-      sha256 = "0n8ixrbfh428ajncakcb9kd2n4fw82kw9sfskn1d9ny0lrg39nvg";
-    })
-  ];
-
   postUnpack = ''
     mkdir -p iwd/ell
     ln -s ${ell.src}/ell/useful.h iwd/ell/useful.h
diff --git a/pkgs/os-specific/linux/pax-utils/default.nix b/pkgs/os-specific/linux/pax-utils/default.nix
index 4bc5266cadc..b22af8d7083 100644
--- a/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/pkgs/os-specific/linux/pax-utils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchurl, bash }:
 
 stdenv.mkDerivation rec {
   pname = "pax-utils";
@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-7sp/vZi8Zr6tSncADCAl2fF+qCAbhCRYgkBs4AubaxQ=";
   };
 
+  strictDeps = true;
+
+  buildInputs = [ bash ];
+
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index dc7f2a2868e..ac95dc745fe 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -1,7 +1,7 @@
-From 06a8dbb65584b6f705fee8a486f32dab12f72082 Mon Sep 17 00:00:00 2001
+From d4ea219a35a09fe02bc9e47e8530644cb4fc4146 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Tue, 8 Jan 2013 15:46:30 +0100
-Subject: [PATCH 01/19] Start device units for uninitialised encrypted devices
+Subject: [PATCH 01/21] Start device units for uninitialised encrypted devices
 
 This is necessary because the NixOS service that initialises the
 filesystem depends on the appearance of the device unit.  Also, this
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 51e934ef983..dd351c00100 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -1,7 +1,7 @@
-From 2c98ff115f7027bebde14cf3e74f2c51b343874c Mon Sep 17 00:00:00 2001
+From 67abd8f22f70d9348bc9d8e0e93dde4d325627ba Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 12 Apr 2013 13:16:57 +0200
-Subject: [PATCH 02/19] Don't try to unmount /nix or /nix/store
+Subject: [PATCH 02/21] Don't try to unmount /nix or /nix/store
 
 They'll still be remounted read-only.
 
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 194b3f5418a..2dd3d87f6ed 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -1,7 +1,7 @@
-From 16f441b6495ff4c4d1d0b71a7f1650505147173d Mon Sep 17 00:00:00 2001
+From 37c9471f59bd57223014a4a645b5f96a71d78787 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Wed, 16 Apr 2014 10:59:28 +0200
-Subject: [PATCH 03/19] Fix NixOS containers
+Subject: [PATCH 03/21] Fix NixOS containers
 
 In NixOS containers, the init script is bind-mounted into the
 container, so checking early whether it exists will fail.
diff --git a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
index 210382d9259..54d9ff93b43 100644
--- a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
@@ -1,7 +1,7 @@
-From 261423bc039378115ad9223c2b6ede9c395847b2 Mon Sep 17 00:00:00 2001
+From 987d6f94dac8e1a75615fd9ddcfb0eb1c2c4c349 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Thu, 1 May 2014 14:10:10 +0200
-Subject: [PATCH 04/19] Look for fsck in the right place
+Subject: [PATCH 04/21] Look for fsck in the right place
 
 ---
  src/fsck/fsck.c | 2 +-
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index ba105424f6c..ee878b410f0 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -1,7 +1,7 @@
-From 18b45c20499747bcc66714ee87edf34d4f6e3dca Mon Sep 17 00:00:00 2001
+From da4f855044b2babe052ce303cca1de736cf952cd Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 19 Dec 2014 14:46:17 +0100
-Subject: [PATCH 05/19] Add some NixOS-specific unit directories
+Subject: [PATCH 05/21] Add some NixOS-specific unit directories
 
 Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for
 units provided by packages installed into the default profile via
diff --git a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
index c136bd8f4c8..482eeacb021 100644
--- a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -1,7 +1,7 @@
-From 8b8f4168828a12cac17c3e8803cacebf31608c68 Mon Sep 17 00:00:00 2001
+From c06abdb631527f56a626b739340d1b275349612c Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Mon, 11 May 2015 15:39:38 +0200
-Subject: [PATCH 06/19] Get rid of a useless message in user sessions
+Subject: [PATCH 06/21] Get rid of a useless message in user sessions
 
 Namely lots of variants of
 
diff --git a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 4f9f98ec8b3..22e4c74d08d 100644
--- a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -1,7 +1,7 @@
-From e147e9defaf2bb5e8040566537661d90b4008daf Mon Sep 17 00:00:00 2001
+From 207c69466cdd164c42ed1901deb06f57b12f4363 Mon Sep 17 00:00:00 2001
 From: Gabriel Ebner <gebner@gebner.org>
 Date: Sun, 6 Dec 2015 14:26:36 +0100
-Subject: [PATCH 07/19] hostnamed, localed, timedated: disable methods that
+Subject: [PATCH 07/21] hostnamed, localed, timedated: disable methods that
  change system settings.
 
 ---
diff --git a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
index 4ef72f0dccf..e5a0bf7d97f 100644
--- a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
@@ -1,7 +1,7 @@
-From 992d0e6abb09aacceee2f8646c4bcdacf7277dc7 Mon Sep 17 00:00:00 2001
+From 3ca3855259c3015615983587063fa159cfa7e93c Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 7 Jul 2016 02:47:13 +0300
-Subject: [PATCH 08/19] Fix hwdb paths
+Subject: [PATCH 08/21] Fix hwdb paths
 
 Patch by vcunat.
 ---
diff --git a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 78ebcb50fcc..9e22ea719e3 100644
--- a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -1,7 +1,7 @@
-From 462bc01b3a38468fd617066a3d7f27b1acca9e0a Mon Sep 17 00:00:00 2001
+From 717226ad0dc37ceb6c667c1f56396848978b6e83 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Tue, 11 Oct 2016 13:12:08 +0300
-Subject: [PATCH 09/19] Change /usr/share/zoneinfo to /etc/zoneinfo
+Subject: [PATCH 09/21] Change /usr/share/zoneinfo to /etc/zoneinfo
 
 NixOS uses this path.
 ---
diff --git a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
index a956cceff55..ce0ad7e4ddc 100644
--- a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -1,7 +1,7 @@
-From fbb302d00c63dc17a210f83648f24a1da983b2c0 Mon Sep 17 00:00:00 2001
+From 75d12cf65073458f091899d673c613dfc43f60c0 Mon Sep 17 00:00:00 2001
 From: Imuli <i@imu.li>
 Date: Wed, 19 Oct 2016 08:46:47 -0400
-Subject: [PATCH 10/19] localectl: use /etc/X11/xkb for list-x11-*
+Subject: [PATCH 10/21] localectl: use /etc/X11/xkb for list-x11-*
 
 NixOS has an option to link the xkb data files to /etc/X11, but not to
 /usr/share/X11.
diff --git a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index 6b482eb8c9d..a03c5a14ad8 100644
--- a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -1,7 +1,7 @@
-From b850dae349de8ac6906d4f920a21ef275cecb2de Mon Sep 17 00:00:00 2001
+From bce75eb4cdeb0b86df6b0a577e886c49a88303f6 Mon Sep 17 00:00:00 2001
 From: Franz Pletz <fpletz@fnordicwalking.de>
 Date: Sun, 11 Feb 2018 04:37:44 +0100
-Subject: [PATCH 11/19] build: don't create statedir and don't touch prefixdir
+Subject: [PATCH 11/21] build: don't create statedir and don't touch prefixdir
 
 ---
  meson.build | 3 ---
diff --git a/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
index ffe7b7467f5..0576f7a62f2 100644
--- a/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
@@ -1,7 +1,7 @@
-From beefb6d381286769cc47c71c82b831a37a405d90 Mon Sep 17 00:00:00 2001
+From ecdf0c5d9f88f526521f093cc9ee85f43efab4b7 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Fri, 2 Nov 2018 21:15:42 +0100
-Subject: [PATCH 12/19] inherit systemd environment when calling generators.
+Subject: [PATCH 12/21] inherit systemd environment when calling generators.
 
 Systemd generators need access to the environment configured in
 stage-2-init.sh since it schedules fsck and mkfs executions based on
diff --git a/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
index 086a20cabce..a424cf1061c 100644
--- a/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
@@ -1,7 +1,7 @@
-From 146b79d55cc4fdfdb5fd4978e68b21f5c1df1679 Mon Sep 17 00:00:00 2001
+From 39969a1b01d6c223a21c770093209b7f4047aaa4 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Thu, 9 May 2019 11:15:22 +0200
-Subject: [PATCH 13/19] add rootprefix to lookup dir paths
+Subject: [PATCH 13/21] add rootprefix to lookup dir paths
 
 systemd does not longer use the UDEVLIBEXEC directory as root for
 discovery default udev rules. By adding `$out/lib` to the lookup paths
diff --git a/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index b3fafabb515..5610d4d3ecc 100644
--- a/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -1,7 +1,7 @@
-From 8edd810e74e2308f34eba6e8072e559e69307830 Mon Sep 17 00:00:00 2001
+From e7c960789b0ca97b24a66e9eeaa56ea645d9c66b Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:45:55 +0300
-Subject: [PATCH 14/19] systemd-shutdown: execute scripts in
+Subject: [PATCH 14/21] systemd-shutdown: execute scripts in
  /etc/systemd/system-shutdown
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
diff --git a/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index ac40b8c1e25..11848a623a3 100644
--- a/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -1,7 +1,7 @@
-From 9ed24199dd3ce91d3f7fbfbdf823312c124aba56 Mon Sep 17 00:00:00 2001
+From 6124720aa2b9dbc07f2fb898f0db150a44a86041 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:46:58 +0300
-Subject: [PATCH 15/19] systemd-sleep: execute scripts in
+Subject: [PATCH 15/21] systemd-sleep: execute scripts in
  /etc/systemd/system-sleep
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
diff --git a/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch b/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
index 26e586c00af..156195d9a90 100644
--- a/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
+++ b/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
@@ -1,7 +1,7 @@
-From 6db7ad4d5526a82e4ed9b135daf1054a8b71e1c7 Mon Sep 17 00:00:00 2001
+From bee1d855d4fb7f2d6f6b9beb1dfd14b1dea31887 Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sat, 7 Mar 2020 22:40:27 +0100
-Subject: [PATCH 16/19] kmod-static-nodes.service: Update ConditionFileNotEmpty
+Subject: [PATCH 16/21] kmod-static-nodes.service: Update ConditionFileNotEmpty
 
 On NixOS, kernel modules of the currently booted systems are located at
 /run/booted-system/kernel-modules/lib/modules/%v/, not /lib/modules/%v/.
diff --git a/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index a47c6f51836..1f21b628e92 100644
--- a/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -1,7 +1,7 @@
-From 160d32c336c96744bbfb618eae4c12cb90138644 Mon Sep 17 00:00:00 2001
+From 62198599bbc559eeb8e2a3caebce7b9135085270 Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sun, 8 Mar 2020 01:05:54 +0100
-Subject: [PATCH 17/19] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
+Subject: [PATCH 17/21] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
 
 This will be the $PATH used to lookup ExecStart= etc. options, which
 systemd itself uses extensively.
diff --git a/pkgs/os-specific/linux/systemd/0018-pkg-config-derive-prefix-from-prefix.patch b/pkgs/os-specific/linux/systemd/0018-pkg-config-derive-prefix-from-prefix.patch
index 3939a2ba15e..344b8b3952f 100644
--- a/pkgs/os-specific/linux/systemd/0018-pkg-config-derive-prefix-from-prefix.patch
+++ b/pkgs/os-specific/linux/systemd/0018-pkg-config-derive-prefix-from-prefix.patch
@@ -1,7 +1,7 @@
-From 777d61550f95b1dcf253e1d2132f9db7010a18f3 Mon Sep 17 00:00:00 2001
+From 7654964344ba083529cb232ab229db7c0888f782 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
 Date: Sun, 6 Dec 2020 08:34:19 +0100
-Subject: [PATCH 18/19] pkg-config: derive prefix from --prefix
+Subject: [PATCH 18/21] pkg-config: derive prefix from --prefix
 
 Point prefix to the one configured, instead of `/usr` `systemd` has limited
 support for making the pkgconfig prefix overridable, and interpolates those
diff --git a/pkgs/os-specific/linux/systemd/0019-core-handle-lookup-paths-being-symlinks.patch b/pkgs/os-specific/linux/systemd/0019-core-handle-lookup-paths-being-symlinks.patch
index 5820e7605c4..4f950650d32 100644
--- a/pkgs/os-specific/linux/systemd/0019-core-handle-lookup-paths-being-symlinks.patch
+++ b/pkgs/os-specific/linux/systemd/0019-core-handle-lookup-paths-being-symlinks.patch
@@ -1,7 +1,7 @@
-From 273e706ff561f2164b84c714148346ac92dd8846 Mon Sep 17 00:00:00 2001
+From 4e9b4aa87d299be08cffc77a86d6f473a7a4109a Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Wed, 18 Aug 2021 19:10:08 +0200
-Subject: [PATCH 19/19] core: handle lookup paths being symlinks
+Subject: [PATCH 19/21] core: handle lookup paths being symlinks
 
 With a recent change paths leaving the statically known lookup paths
 would be treated differently then those that remained within those. That
diff --git a/pkgs/os-specific/linux/systemd/0020-sd-boot-Unify-error-handling.patch b/pkgs/os-specific/linux/systemd/0020-sd-boot-Unify-error-handling.patch
new file mode 100644
index 00000000000..5c82cdbd6fa
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0020-sd-boot-Unify-error-handling.patch
@@ -0,0 +1,401 @@
+From 3cf1b5fb6d1dc342e836cf0990df3170d2e9db49 Mon Sep 17 00:00:00 2001
+From: Jan Janssen <medhefgo@web.de>
+Date: Wed, 11 Aug 2021 14:59:46 +0200
+Subject: [PATCH 20/21] sd-boot: Unify error handling
+
+log_error_stall() and log_error_status_stall() will ensure the user has
+a chance to catch an error message by stalling and also forcing a
+lightred/black color on it. Also, convert several Print() calls to it
+since they are actually error messages.
+
+(cherry picked from commit 8aba0eec499b762657f528988c2f093ac490620d)
+---
+ src/boot/efi/boot.c        | 62 ++++++++++----------------------
+ src/boot/efi/random-seed.c | 73 +++++++++++++-------------------------
+ src/boot/efi/stub.c        | 24 ++++---------
+ src/boot/efi/util.c        | 17 +++++++--
+ src/boot/efi/util.h        |  9 +++++
+ 5 files changed, 75 insertions(+), 110 deletions(-)
+
+diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
+index 13940a6df7..54d704f0d1 100644
+--- a/src/boot/efi/boot.c
++++ b/src/boot/efi/boot.c
+@@ -527,7 +527,7 @@ static BOOLEAN menu_run(
+                 err = console_set_mode(&config->console_mode, config->console_mode_change);
+                 if (EFI_ERROR(err)) {
+                         uefi_call_wrapper(ST->ConOut->ClearScreen, 1, ST->ConOut);
+-                        Print(L"Error switching console mode to %ld: %r.\r", (UINT64)config->console_mode, err);
++                        log_error_stall(L"Error switching console mode to %lu: %r", (UINT64)config->console_mode, err);
+                 }
+         } else
+                 uefi_call_wrapper(ST->ConOut->ClearScreen, 1, ST->ConOut);
+@@ -1221,8 +1221,7 @@ static VOID config_entry_bump_counters(
+                         break;
+ 
+                 if (r != EFI_BUFFER_TOO_SMALL || file_info_size * 2 < file_info_size) {
+-                        Print(L"\nFailed to get file info for '%s': %r\n", old_path, r);
+-                        uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
++                        log_error_stall(L"Failed to get file info for '%s': %r", old_path, r);
+                         return;
+                 }
+ 
+@@ -1234,8 +1233,7 @@ static VOID config_entry_bump_counters(
+         StrCpy(file_info->FileName, entry->next_name);
+         r = uefi_call_wrapper(handle->SetInfo, 4, handle, &EfiFileInfoGuid, file_info_size, file_info);
+         if (EFI_ERROR(r)) {
+-                Print(L"\nFailed to rename '%s' to '%s', ignoring: %r\n", old_path, entry->next_name, r);
+-                uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
++                log_error_stall(L"Failed to rename '%s' to '%s', ignoring: %r", old_path, entry->next_name, r);
+                 return;
+         }
+ 
+@@ -2165,18 +2163,12 @@ static EFI_STATUS image_start(
+         EFI_STATUS err;
+ 
+         path = FileDevicePath(entry->device, entry->loader);
+-        if (!path) {
+-                Print(L"Error getting device path.");
+-                uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-                return EFI_INVALID_PARAMETER;
+-        }
++        if (!path)
++                return log_error_status_stall(EFI_INVALID_PARAMETER, L"Error getting device path.");
+ 
+         err = uefi_call_wrapper(BS->LoadImage, 6, FALSE, parent_image, path, NULL, 0, &image);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Error loading %s: %r", entry->loader, err);
+-                uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-                return err;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Error loading %s: %r", entry->loader, err);
+ 
+         if (config->options_edit)
+                 options = config->options_edit;
+@@ -2190,8 +2182,7 @@ static EFI_STATUS image_start(
+                 err = uefi_call_wrapper(BS->OpenProtocol, 6, image, &LoadedImageProtocol, (VOID **)&loaded_image,
+                                         parent_image, NULL, EFI_OPEN_PROTOCOL_GET_PROTOCOL);
+                 if (EFI_ERROR(err)) {
+-                        Print(L"Error getting LoadedImageProtocol handle: %r", err);
+-                        uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
++                        log_error_stall(L"Error getting LoadedImageProtocol handle: %r", err);
+                         goto out_unload;
+                 }
+                 loaded_image->LoadOptions = options;
+@@ -2202,10 +2193,8 @@ static EFI_STATUS image_start(
+                 err = tpm_log_event(SD_TPM_PCR,
+                                     (EFI_PHYSICAL_ADDRESS) (UINTN) loaded_image->LoadOptions,
+                                     loaded_image->LoadOptionsSize, loaded_image->LoadOptions);
+-                if (EFI_ERROR(err)) {
+-                        Print(L"Unable to add image options measurement: %r", err);
+-                        uefi_call_wrapper(BS->Stall, 1, 200 * 1000);
+-                }
++                if (EFI_ERROR(err))
++                        log_error_stall(L"Unable to add image options measurement: %r", err);
+ #endif
+         }
+ 
+@@ -2231,9 +2220,7 @@ static EFI_STATUS reboot_into_firmware(VOID) {
+                 return err;
+ 
+         err = uefi_call_wrapper(RT->ResetSystem, 4, EfiResetCold, EFI_SUCCESS, 0, NULL);
+-        Print(L"Error calling ResetSystem: %r", err);
+-        uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-        return err;
++        return log_error_status_stall(err, L"Error calling ResetSystem: %r", err);
+ }
+ 
+ static VOID config_free(Config *config) {
+@@ -2305,30 +2292,21 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
+ 
+         err = uefi_call_wrapper(BS->OpenProtocol, 6, image, &LoadedImageProtocol, (VOID **)&loaded_image,
+                                 image, NULL, EFI_OPEN_PROTOCOL_GET_PROTOCOL);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Error getting a LoadedImageProtocol handle: %r", err);
+-                uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-                return err;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Error getting a LoadedImageProtocol handle: %r", err);
+ 
+         /* export the device path this image is started from */
+         if (disk_get_part_uuid(loaded_image->DeviceHandle, uuid) == EFI_SUCCESS)
+                 efivar_set(LOADER_GUID, L"LoaderDevicePartUUID", uuid, 0);
+ 
+         root_dir = LibOpenRoot(loaded_image->DeviceHandle);
+-        if (!root_dir) {
+-                Print(L"Unable to open root directory.");
+-                uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-                return EFI_LOAD_ERROR;
+-        }
++        if (!root_dir)
++                return log_error_status_stall(EFI_LOAD_ERROR, L"Unable to open root directory.", EFI_LOAD_ERROR);
+ 
+         if (secure_boot_enabled() && shim_loaded()) {
+                 err = security_policy_install();
+-                if (EFI_ERROR(err)) {
+-                        Print(L"Error installing security policy: %r ", err);
+-                        uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-                        return err;
+-                }
++                if (EFI_ERROR(err))
++                        return log_error_status_stall(err, L"Error installing security policy: %r", err);
+         }
+ 
+         /* the filesystem path to this image, to prevent adding ourselves to the menu */
+@@ -2367,8 +2345,7 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
+         }
+ 
+         if (config.entry_count == 0) {
+-                Print(L"No loader found. Configuration files in \\loader\\entries\\*.conf are needed.");
+-                uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
++                log_error_stall(L"No loader found. Configuration files in \\loader\\entries\\*.conf are needed.");
+                 goto out;
+         }
+ 
+@@ -2440,8 +2417,7 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
+                 err = image_start(image, &config, entry);
+                 if (EFI_ERROR(err)) {
+                         graphics_mode(FALSE);
+-                        Print(L"\nFailed to execute %s (%s): %r\n", entry->title, entry->loader, err);
+-                        uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
++                        log_error_stall(L"Failed to execute %s (%s): %r", entry->title, entry->loader, err);
+                         goto out;
+                 }
+ 
+diff --git a/src/boot/efi/random-seed.c b/src/boot/efi/random-seed.c
+index 3e179851b0..939daf3e41 100644
+--- a/src/boot/efi/random-seed.c
++++ b/src/boot/efi/random-seed.c
+@@ -35,10 +35,8 @@ static EFI_STATUS acquire_rng(UINTN size, VOID **ret) {
+                 return log_oom();
+ 
+         err = uefi_call_wrapper(rng->GetRNG, 3, rng, NULL, size, data);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Failed to acquire RNG data: %r\n", err);
+-                return err;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Failed to acquire RNG data: %r", err);
+ 
+         *ret = TAKE_PTR(data);
+         return EFI_SUCCESS;
+@@ -149,14 +147,12 @@ static EFI_STATUS acquire_system_token(VOID **ret, UINTN *ret_size) {
+         err = efivar_get_raw(LOADER_GUID, L"LoaderSystemToken", &data, &size);
+         if (EFI_ERROR(err)) {
+                 if (err != EFI_NOT_FOUND)
+-                        Print(L"Failed to read LoaderSystemToken EFI variable: %r", err);
++                        log_error_stall(L"Failed to read LoaderSystemToken EFI variable: %r", err);
+                 return err;
+         }
+ 
+-        if (size <= 0) {
+-                Print(L"System token too short, ignoring.");
+-                return EFI_NOT_FOUND;
+-        }
++        if (size <= 0)
++                return log_error_status_stall(EFI_NOT_FOUND, L"System token too short, ignoring.");
+ 
+         *ret = TAKE_PTR(data);
+         *ret_size = size;
+@@ -209,8 +205,7 @@ static VOID validate_sha256(void) {
+                 sha256_finish_ctx(&hash, result);
+ 
+                 if (CompareMem(result, array[i].hash, HASH_VALUE_SIZE) != 0) {
+-                        Print(L"SHA256 failed validation.\n");
+-                        uefi_call_wrapper(BS->Stall, 1, 120 * 1000 * 1000);
++                        log_error_stall(L"SHA256 failed validation.");
+                         return;
+                 }
+         }
+@@ -246,7 +241,7 @@ EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode) {
+         err = uefi_call_wrapper(root_dir->Open, 5, root_dir, &handle, (CHAR16*) L"\\loader\\random-seed", EFI_FILE_MODE_READ|EFI_FILE_MODE_WRITE, 0ULL);
+         if (EFI_ERROR(err)) {
+                 if (err != EFI_NOT_FOUND && err != EFI_WRITE_PROTECTED)
+-                        Print(L"Failed to open random seed file: %r\n", err);
++                        log_error_stall(L"Failed to open random seed file: %r", err);
+                 return err;
+         }
+ 
+@@ -255,15 +250,11 @@ EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode) {
+                 return log_oom();
+ 
+         size = info->FileSize;
+-        if (size < RANDOM_MAX_SIZE_MIN) {
+-                Print(L"Random seed file is too short?\n");
+-                return EFI_INVALID_PARAMETER;
+-        }
++        if (size < RANDOM_MAX_SIZE_MIN)
++                return log_error_status_stall(EFI_INVALID_PARAMETER, L"Random seed file is too short.");
+ 
+-        if (size > RANDOM_MAX_SIZE_MAX) {
+-                Print(L"Random seed file is too large?\n");
+-                return EFI_INVALID_PARAMETER;
+-        }
++        if (size > RANDOM_MAX_SIZE_MAX)
++                return log_error_status_stall(EFI_INVALID_PARAMETER, L"Random seed file is too large.");
+ 
+         seed = AllocatePool(size);
+         if (!seed)
+@@ -271,20 +262,14 @@ EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode) {
+ 
+         rsize = size;
+         err = uefi_call_wrapper(handle->Read, 3, handle, &rsize, seed);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Failed to read random seed file: %r\n", err);
+-                return err;
+-        }
+-        if (rsize != size) {
+-                Print(L"Short read on random seed file\n");
+-                return EFI_PROTOCOL_ERROR;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Failed to read random seed file: %r", err);
++        if (rsize != size)
++                return log_error_status_stall(EFI_PROTOCOL_ERROR, L"Short read on random seed file.");
+ 
+         err = uefi_call_wrapper(handle->SetPosition, 2, handle, 0);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Failed to seek to beginning of random seed file: %r\n", err);
+-                return err;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Failed to seek to beginning of random seed file: %r", err);
+ 
+         /* Request some random data from the UEFI RNG. We don't need this to work safely, but it's a good
+          * idea to use it because it helps us for cases where users mistakenly include a random seed in
+@@ -299,27 +284,19 @@ EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode) {
+         /* Update the random seed on disk before we use it */
+         wsize = size;
+         err = uefi_call_wrapper(handle->Write, 3, handle, &wsize, new_seed);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Failed to write random seed file: %r\n", err);
+-                return err;
+-        }
+-        if (wsize != size) {
+-                Print(L"Short write on random seed file\n");
+-                return EFI_PROTOCOL_ERROR;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Failed to write random seed file: %r", err);
++        if (wsize != size)
++                return log_error_status_stall(EFI_PROTOCOL_ERROR, L"Short write on random seed file.");
+ 
+         err = uefi_call_wrapper(handle->Flush, 1, handle);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Failed to flush random seed file: %r\n");
+-                return err;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Failed to flush random seed file: %r", err);
+ 
+         /* We are good to go */
+         err = efivar_set_raw(LOADER_GUID, L"LoaderRandomSeed", for_kernel, size, 0);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Failed to write random seed to EFI variable: %r\n", err);
+-                return err;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Failed to write random seed to EFI variable: %r", err);
+ 
+         return EFI_SUCCESS;
+ }
+diff --git a/src/boot/efi/stub.c b/src/boot/efi/stub.c
+index 082fe91c9e..82da1d3ec4 100644
+--- a/src/boot/efi/stub.c
++++ b/src/boot/efi/stub.c
+@@ -36,18 +36,12 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
+ 
+         err = uefi_call_wrapper(BS->OpenProtocol, 6, image, &LoadedImageProtocol, (VOID **)&loaded_image,
+                                 image, NULL, EFI_OPEN_PROTOCOL_GET_PROTOCOL);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Error getting a LoadedImageProtocol handle: %r ", err);
+-                uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-                return err;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Error getting a LoadedImageProtocol handle: %r", err);
+ 
+         err = pe_memory_locate_sections(loaded_image->ImageBase, sections, addrs, offs, szs);
+-        if (EFI_ERROR(err)) {
+-                Print(L"Unable to locate embedded .linux section: %r ", err);
+-                uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-                return err;
+-        }
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Unable to locate embedded .linux section: %r", err);
+ 
+         if (szs[0] > 0)
+                 cmdline = (CHAR8 *)(loaded_image->ImageBase) + addrs[0];
+@@ -72,10 +66,8 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
+                 err = tpm_log_event(SD_TPM_PCR,
+                                     (EFI_PHYSICAL_ADDRESS) (UINTN) loaded_image->LoadOptions,
+                                     loaded_image->LoadOptionsSize, loaded_image->LoadOptions);
+-                if (EFI_ERROR(err)) {
+-                        Print(L"Unable to add image options measurement: %r", err);
+-                        uefi_call_wrapper(BS->Stall, 1, 200 * 1000);
+-                }
++                if (EFI_ERROR(err))
++                        log_error_stall(L"Unable to add image options measurement: %r", err);
+ #endif
+         }
+ 
+@@ -126,7 +118,5 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
+                          (UINTN)loaded_image->ImageBase + addrs[2], szs[2]);
+ 
+         graphics_mode(FALSE);
+-        Print(L"Execution of embedded linux image failed: %r\n", err);
+-        uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
+-        return err;
++        return log_error_status_stall(err, L"Execution of embedded linux image failed: %r", err);
+ }
+diff --git a/src/boot/efi/util.c b/src/boot/efi/util.c
+index 6f4e5933d3..aee076060b 100644
+--- a/src/boot/efi/util.c
++++ b/src/boot/efi/util.c
+@@ -411,8 +411,21 @@ EFI_STATUS file_read(EFI_FILE_HANDLE dir, const CHAR16 *name, UINTN off, UINTN s
+         return err;
+ }
+ 
++VOID log_error_stall(const CHAR16 *fmt, ...) {
++        va_list args;
++
++        uefi_call_wrapper(ST->ConOut->SetAttribute, 2, ST->ConOut, EFI_LIGHTRED|EFI_BACKGROUND_BLACK);
++
++        Print(L"\n");
++        va_start(args, fmt);
++        VPrint(fmt, args);
++        va_end(args);
++        Print(L"\n");
++
++        uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
++}
++
+ EFI_STATUS log_oom(void) {
+-        Print(L"Out of memory.");
+-        (void) uefi_call_wrapper(BS->Stall, 1, 3 * 1000 * 1000);
++        log_error_stall(L"Out of memory.");
+         return EFI_OUT_OF_RESOURCES;
+ }
+diff --git a/src/boot/efi/util.h b/src/boot/efi/util.h
+index 1a42b01033..d3bf848a95 100644
+--- a/src/boot/efi/util.h
++++ b/src/boot/efi/util.h
+@@ -74,4 +74,13 @@ static inline void FileHandleClosep(EFI_FILE_HANDLE *handle) {
+ #define UINT64_MAX ((UINT64) -1)
+ #endif
+ 
++VOID log_error_stall(const CHAR16 *fmt, ...);
+ EFI_STATUS log_oom(void);
++
++/* This works just like log_error_errno() from userspace, but requires you
++ * to provide err a second time if you want to use %r in the message! */
++#define log_error_status_stall(err, fmt, ...) \
++        ({ \
++                log_error_stall(fmt, ##__VA_ARGS__); \
++                err; \
++        })
+-- 
+2.33.0
+
diff --git a/pkgs/os-specific/linux/systemd/0021-sd-boot-Rework-console-input-handling.patch b/pkgs/os-specific/linux/systemd/0021-sd-boot-Rework-console-input-handling.patch
new file mode 100644
index 00000000000..7cdc2491fa3
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0021-sd-boot-Rework-console-input-handling.patch
@@ -0,0 +1,320 @@
+From 2d9fcfcfa38667ada306e095599944f941576e53 Mon Sep 17 00:00:00 2001
+From: Jan Janssen <medhefgo@web.de>
+Date: Wed, 11 Aug 2021 14:59:46 +0200
+Subject: [PATCH 21/21] sd-boot: Rework console input handling
+
+Fixes: #15847
+Probably fixes: #19191
+
+(cherry picked from commit e98d271e57f3d0356e444b6ea2d48836ee2769b0)
+---
+ src/boot/efi/boot.c    |  55 +++++++---------------
+ src/boot/efi/console.c | 102 +++++++++++++++++++++++++++++------------
+ src/boot/efi/console.h |   2 +-
+ 3 files changed, 91 insertions(+), 68 deletions(-)
+
+diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
+index 54d704f0d1..b4f3b9605a 100644
+--- a/src/boot/efi/boot.c
++++ b/src/boot/efi/boot.c
+@@ -134,7 +134,7 @@ static BOOLEAN line_edit(
+                 uefi_call_wrapper(ST->ConOut->OutputString, 2, ST->ConOut, print);
+                 uefi_call_wrapper(ST->ConOut->SetCursorPosition, 3, ST->ConOut, cursor, y_pos);
+ 
+-                err = console_key_read(&key, TRUE);
++                err = console_key_read(&key, 0);
+                 if (EFI_ERROR(err))
+                         continue;
+ 
+@@ -387,7 +387,7 @@ static VOID print_status(Config *config, CHAR16 *loaded_image_path) {
+                 Print(L"OsIndicationsSupported: %d\n", indvar);
+ 
+         Print(L"\n--- press key ---\n\n");
+-        console_key_read(&key, TRUE);
++        console_key_read(&key, 0);
+ 
+         Print(L"timeout:                %u\n", config->timeout_sec);
+         if (config->timeout_sec_efivar >= 0)
+@@ -432,7 +432,7 @@ static VOID print_status(Config *config, CHAR16 *loaded_image_path) {
+                 Print(L"LoaderEntryDefault:     %s\n", defaultstr);
+ 
+         Print(L"\n--- press key ---\n\n");
+-        console_key_read(&key, TRUE);
++        console_key_read(&key, 0);
+ 
+         for (UINTN i = 0; i < config->entry_count; i++) {
+                 ConfigEntry *entry;
+@@ -482,7 +482,7 @@ static VOID print_status(Config *config, CHAR16 *loaded_image_path) {
+                               entry->path, entry->next_name);
+ 
+                 Print(L"\n--- press key ---\n\n");
+-                console_key_read(&key, TRUE);
++                console_key_read(&key, 0);
+         }
+ 
+         uefi_call_wrapper(ST->ConOut->ClearScreen, 1, ST->ConOut);
+@@ -509,11 +509,10 @@ static BOOLEAN menu_run(
+         UINTN y_max;
+         CHAR16 *status;
+         CHAR16 *clearline;
+-        INTN timeout_remain;
++        UINTN timeout_remain = config->timeout_sec;
+         INT16 idx;
+         BOOLEAN exit = FALSE;
+         BOOLEAN run = TRUE;
+-        BOOLEAN wait = FALSE;
+ 
+         graphics_mode(FALSE);
+         uefi_call_wrapper(ST->ConIn->Reset, 2, ST->ConIn, FALSE);
+@@ -538,12 +537,6 @@ static BOOLEAN menu_run(
+                 y_max = 25;
+         }
+ 
+-        /* we check 10 times per second for a keystroke */
+-        if (config->timeout_sec > 0)
+-                timeout_remain = config->timeout_sec * 10;
+-        else
+-                timeout_remain = -1;
+-
+         idx_highlight = config->idx_default;
+         idx_highlight_prev = 0;
+ 
+@@ -643,7 +636,7 @@ static BOOLEAN menu_run(
+ 
+                 if (timeout_remain > 0) {
+                         FreePool(status);
+-                        status = PoolPrint(L"Boot in %d sec.", (timeout_remain + 5) / 10);
++                        status = PoolPrint(L"Boot in %d s.", timeout_remain);
+                 }
+ 
+                 /* print status at last line of screen */
+@@ -664,27 +657,18 @@ static BOOLEAN menu_run(
+                         uefi_call_wrapper(ST->ConOut->OutputString, 2, ST->ConOut, clearline+1 + x + len);
+                 }
+ 
+-                err = console_key_read(&key, wait);
+-                if (EFI_ERROR(err)) {
+-                        /* timeout reached */
++                err = console_key_read(&key, timeout_remain > 0 ? 1000 * 1000 : 0);
++                if (err == EFI_TIMEOUT) {
++                        timeout_remain--;
+                         if (timeout_remain == 0) {
+                                 exit = TRUE;
+                                 break;
+                         }
+ 
+-                        /* sleep and update status */
+-                        if (timeout_remain > 0) {
+-                                uefi_call_wrapper(BS->Stall, 1, 100 * 1000);
+-                                timeout_remain--;
+-                                continue;
+-                        }
+-
+-                        /* timeout disabled, wait for next key */
+-                        wait = TRUE;
++                        /* update status */
+                         continue;
+-                }
+-
+-                timeout_remain = -1;
++                } else
++                        timeout_remain = 0;
+ 
+                 /* clear status after keystroke */
+                 if (status) {
+@@ -787,7 +771,7 @@ static BOOLEAN menu_run(
+                                         config->timeout_sec_efivar,
+                                         EFI_VARIABLE_NON_VOLATILE);
+                                 if (config->timeout_sec_efivar > 0)
+-                                        status = PoolPrint(L"Menu timeout set to %d sec.", config->timeout_sec_efivar);
++                                        status = PoolPrint(L"Menu timeout set to %d s.", config->timeout_sec_efivar);
+                                 else
+                                         status = StrDuplicate(L"Menu disabled. Hold down key at bootup to show menu.");
+                         } else if (config->timeout_sec_efivar <= 0){
+@@ -795,7 +779,7 @@ static BOOLEAN menu_run(
+                                 efivar_set(
+                                         LOADER_GUID, L"LoaderConfigTimeout", NULL, EFI_VARIABLE_NON_VOLATILE);
+                                 if (config->timeout_sec_config > 0)
+-                                        status = PoolPrint(L"Menu timeout of %d sec is defined by configuration file.",
++                                        status = PoolPrint(L"Menu timeout of %d s is defined by configuration file.",
+                                                            config->timeout_sec_config);
+                                 else
+                                         status = StrDuplicate(L"Menu disabled. Hold down key at bootup to show menu.");
+@@ -813,7 +797,7 @@ static BOOLEAN menu_run(
+                                 config->timeout_sec_efivar,
+                                 EFI_VARIABLE_NON_VOLATILE);
+                         if (config->timeout_sec_efivar > 0)
+-                                status = PoolPrint(L"Menu timeout set to %d sec.",
++                                status = PoolPrint(L"Menu timeout set to %d s.",
+                                                    config->timeout_sec_efivar);
+                         else
+                                 status = StrDuplicate(L"Menu disabled. Hold down key at bootup to show menu.");
+@@ -2369,13 +2353,8 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
+         else {
+                 UINT64 key;
+ 
+-                err = console_key_read(&key, FALSE);
+-
+-                if (err == EFI_NOT_READY) {
+-                        uefi_call_wrapper(BS->Stall, 1, 100 * 1000);
+-                        err = console_key_read(&key, FALSE);
+-                }
+-
++                /* Block up to 100ms to give firmware time to get input working. */
++                err = console_key_read(&key, 100 * 1000);
+                 if (!EFI_ERROR(err)) {
+                         INT16 idx;
+ 
+diff --git a/src/boot/efi/console.c b/src/boot/efi/console.c
+index 83619d2147..369c549daf 100644
+--- a/src/boot/efi/console.c
++++ b/src/boot/efi/console.c
+@@ -11,61 +11,105 @@
+ 
+ #define EFI_SIMPLE_TEXT_INPUT_EX_GUID &(EFI_GUID) EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL_GUID
+ 
+-EFI_STATUS console_key_read(UINT64 *key, BOOLEAN wait) {
++static inline void EventClosep(EFI_EVENT *event) {
++        if (!*event)
++                return;
++
++        uefi_call_wrapper(BS->CloseEvent, 1, *event);
++}
++
++/*
++ * Reading input from the console sounds like an easy task to do, but thanks to broken
++ * firmware it is actually a nightmare.
++ *
++ * There is a ConIn and TextInputEx API for this. Ideally we want to use TextInputEx,
++ * because that gives us Ctrl/Alt/Shift key state information. Unfortunately, it is not
++ * always available and sometimes just non-functional.
++ *
++ * On the other hand we have ConIn, where some firmware likes to just freeze on us
++ * if we call ReadKeyStroke on it.
++ *
++ * Therefore, we use WaitForEvent on both ConIn and TextInputEx (if available) along
++ * with a timer event. The timer ensures there is no need to call into functions
++ * that might freeze on us, while still allowing us to show a timeout counter.
++ */
++EFI_STATUS console_key_read(UINT64 *key, UINT64 timeout_usec) {
+         static EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *TextInputEx;
+         static BOOLEAN checked;
+         UINTN index;
+         EFI_INPUT_KEY k;
+         EFI_STATUS err;
++        _cleanup_(EventClosep) EFI_EVENT timer = NULL;
++        EFI_EVENT events[3] = { ST->ConIn->WaitForKey };
++        UINTN n_events = 1;
+ 
+         if (!checked) {
+                 err = LibLocateProtocol(EFI_SIMPLE_TEXT_INPUT_EX_GUID, (VOID **)&TextInputEx);
+-                if (EFI_ERROR(err))
++                if (EFI_ERROR(err) ||
++                    uefi_call_wrapper(BS->CheckEvent, 1, TextInputEx->WaitForKeyEx) == EFI_INVALID_PARAMETER)
++                        /* If WaitForKeyEx fails here, the firmware pretends it talks this
++                         * protocol, but it really doesn't. */
+                         TextInputEx = NULL;
++                else
++                        events[n_events++] = TextInputEx->WaitForKeyEx;
+ 
+                 checked = TRUE;
+         }
+ 
+-        /* wait until key is pressed */
+-        if (wait)
+-                uefi_call_wrapper(BS->WaitForEvent, 3, 1, &ST->ConIn->WaitForKey, &index);
++        if (timeout_usec > 0) {
++                err = uefi_call_wrapper(BS->CreateEvent, 5, EVT_TIMER, 0, NULL, NULL, &timer);
++                if (EFI_ERROR(err))
++                        return log_error_status_stall(err, L"Error creating timer event: %r", err);
++
++                /* SetTimer expects 100ns units for some reason. */
++                err = uefi_call_wrapper(BS->SetTimer, 3, timer, TimerRelative, timeout_usec * 10);
++                if (EFI_ERROR(err))
++                        return log_error_status_stall(err, L"Error arming timer event: %r", err);
+ 
+-        if (TextInputEx) {
++                events[n_events++] = timer;
++        }
++
++        err = uefi_call_wrapper(BS->WaitForEvent, 3, n_events, events, &index);
++        if (EFI_ERROR(err))
++                return log_error_status_stall(err, L"Error waiting for events: %r", err);
++
++        if (timeout_usec > 0 && timer == events[index])
++                return EFI_TIMEOUT;
++
++        /* TextInputEx might be ready too even if ConIn got to signal first. */
++        if (TextInputEx && !EFI_ERROR(uefi_call_wrapper(BS->CheckEvent, 1, TextInputEx->WaitForKeyEx))) {
+                 EFI_KEY_DATA keydata;
+                 UINT64 keypress;
++                UINT32 shift = 0;
+ 
+                 err = uefi_call_wrapper(TextInputEx->ReadKeyStrokeEx, 2, TextInputEx, &keydata);
+-                if (!EFI_ERROR(err)) {
+-                        UINT32 shift = 0;
+-
+-                        /* do not distinguish between left and right keys */
+-                        if (keydata.KeyState.KeyShiftState & EFI_SHIFT_STATE_VALID) {
+-                                if (keydata.KeyState.KeyShiftState & (EFI_RIGHT_CONTROL_PRESSED|EFI_LEFT_CONTROL_PRESSED))
+-                                        shift |= EFI_CONTROL_PRESSED;
+-                                if (keydata.KeyState.KeyShiftState & (EFI_RIGHT_ALT_PRESSED|EFI_LEFT_ALT_PRESSED))
+-                                        shift |= EFI_ALT_PRESSED;
+-                        };
+-
+-                        /* 32 bit modifier keys + 16 bit scan code + 16 bit unicode */
+-                        keypress = KEYPRESS(shift, keydata.Key.ScanCode, keydata.Key.UnicodeChar);
+-                        if (keypress > 0) {
+-                                *key = keypress;
+-                                return 0;
+-                        }
++                if (EFI_ERROR(err))
++                        return err;
++
++                /* do not distinguish between left and right keys */
++                if (keydata.KeyState.KeyShiftState & EFI_SHIFT_STATE_VALID) {
++                        if (keydata.KeyState.KeyShiftState & (EFI_RIGHT_CONTROL_PRESSED|EFI_LEFT_CONTROL_PRESSED))
++                                shift |= EFI_CONTROL_PRESSED;
++                        if (keydata.KeyState.KeyShiftState & (EFI_RIGHT_ALT_PRESSED|EFI_LEFT_ALT_PRESSED))
++                                shift |= EFI_ALT_PRESSED;
++                };
++
++                /* 32 bit modifier keys + 16 bit scan code + 16 bit unicode */
++                keypress = KEYPRESS(shift, keydata.Key.ScanCode, keydata.Key.UnicodeChar);
++                if (keypress > 0) {
++                        *key = keypress;
++                        return EFI_SUCCESS;
+                 }
++
++                return EFI_NOT_READY;
+         }
+ 
+-        /* fallback for firmware which does not support SimpleTextInputExProtocol
+-         *
+-         * This is also called in case ReadKeyStrokeEx did not return a key, because
+-         * some broken firmwares offer SimpleTextInputExProtocol, but never actually
+-         * handle any key. */
+         err  = uefi_call_wrapper(ST->ConIn->ReadKeyStroke, 2, ST->ConIn, &k);
+         if (EFI_ERROR(err))
+                 return err;
+ 
+         *key = KEYPRESS(0, k.ScanCode, k.UnicodeChar);
+-        return 0;
++        return EFI_SUCCESS;
+ }
+ 
+ static EFI_STATUS change_mode(UINTN mode) {
+diff --git a/src/boot/efi/console.h b/src/boot/efi/console.h
+index 2c69af552a..23848a9c58 100644
+--- a/src/boot/efi/console.h
++++ b/src/boot/efi/console.h
+@@ -16,5 +16,5 @@ enum console_mode_change_type {
+         CONSOLE_MODE_MAX,
+ };
+ 
+-EFI_STATUS console_key_read(UINT64 *key, BOOLEAN wait);
++EFI_STATUS console_key_read(UINT64 *key, UINT64 timeout_usec);
+ EFI_STATUS console_set_mode(UINTN *mode, enum console_mode_change_type how);
+-- 
+2.33.0
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 036ea991ef6..aa106ca1aba 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -164,6 +164,14 @@ stdenv.mkDerivation {
     # all our root unit dirs if they are symlinks. This does exactly what we
     # need (AFAICT).
     ./0019-core-handle-lookup-paths-being-symlinks.patch
+
+    # In v248 compiler weirdness and refactoring lead to the bootloader
+    # erroring out handling keyboard input on some systems. See
+    # https://github.com/systemd/systemd/issues/19191
+    # This should be redundant in v249.6 when it offically gets tagged in
+    # systemd-stable
+    ./0020-sd-boot-Unify-error-handling.patch
+    ./0021-sd-boot-Rework-console-input-handling.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (let
     oe-core = fetchzip {
       url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-14c6e5a4b72d0e4665279158a0740dd1dc21f72f.tar.bz2";
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 7ab2489f5e8..0818d7bde79 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux";
-  version = "2.36.2";
+  version = "2.37.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0psc0asjp1rmfx1j7468zfnk9nphlphybw2n8dcl74v8v2lnnlgp";
+    sha256 = "sha256-agdkwarn+2B++KbdLA9sR9Xl/SeqCIIKuq2ewU4o6dk=";
   };
 
   patches = [
@@ -34,8 +34,6 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--localstatedir=/var"
     "--enable-write"
-    "--enable-last"
-    "--enable-mesg"
     "--disable-use-tty-group"
     "--enable-fs-paths-default=/run/wrappers/bin:/run/current-system/sw/bin:/sbin"
     "--disable-makeinstall-setuid" "--disable-makeinstall-chown"
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 232b228394b..a2836be7ef8 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -40,7 +40,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook makeWrapper perlPackages.perl perlPackages.XMLParser ];
+  nativeBuildInputs = [ pkg-config autoreconfHook makeWrapper perlPackages.perl perlPackages.XMLParser ]
+    ++ lib.optionals stdenv.isLinux [ glib ];
 
   propagatedBuildInputs =
     lib.optionals stdenv.isLinux [ libcap ];
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 88defab9302..47d2c4b4d40 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -45,11 +45,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.15.0";
+  version = "4.15.1";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    sha256 = "0h26s9lfdl8mccs9rfv1gr5f8snd95gjkrik6wl5ccb27044gwxi";
+    sha256 = "sha256-oYEfu0EQ1klp9sEI+NFh4sPiDd9HVSmj0yvZS7dFnwA=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 3a6ec31ad75..87a42c4b852 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -4,7 +4,7 @@
   freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
   libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
-  mcpp, epoxy, openssl, pkg-config, llvm, libxslt,
+  mcpp, libepoxy, openssl, pkg-config, llvm, libxslt,
   ApplicationServices, Carbon, Cocoa, Xplugin
 }:
 
@@ -650,7 +650,7 @@ self: super:
           ./dont-create-logdir-during-build.patch
         ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
-        propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess epoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
+        propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
           udev
         ];
         prePatch = lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/servers/x11/xorg/xcb-util-xrm.nix b/pkgs/servers/x11/xorg/xcb-util-xrm.nix
index ee870f07125..0235ad29cc6 100644
--- a/pkgs/servers/x11/xorg/xcb-util-xrm.nix
+++ b/pkgs/servers/x11/xorg/xcb-util-xrm.nix
@@ -9,10 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "118cj1ybw86pgw0l5whn9vbg5n5b0ijcpx295mwahzi004vz671h";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [ pkg-config m4 ];
   doCheck = true;
-  buildInputs = [ libxcb xcbutil ];
-  checkInputs = [ libX11 ];
+  buildInputs = [ libxcb xcbutil libX11 ];
 
   meta = with lib; {
     description = "XCB utility functions for the X resource manager";
diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index 7db47f4bf76..98f2f3c9730 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -1,5 +1,5 @@
 { egl-wayland
-, epoxy
+, libepoxy
 , fetchurl
 , fontutil
 , lib
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     egl-wayland
-    epoxy
+    libepoxy
     fontutil
     libGL
     libGLU
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 80e091845ce..c7b459cb2b6 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.70.0";
+  version = "0.71.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wBDG6um7HCFAEyiubnkCxg91sQ6HX0CTpYItwVkMx28=";
+    sha256 = "sha256-tXsMBry7KtzIhKFOjx30YhyXo2T+oA2RiKf1Yr2uWOI=";
   };
 
-  vendorSha256 = "sha256-cUo+tcHhnbJbn3HS/I8lnkvfv+6+htIs1dMtKuEArQg=";
+  vendorSha256 = "sha256-6egcoQEUe9OU5k0m8GVMU3EMStA9ICE7GiBSOj0olmY=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix
index f225f2196cc..53c231aa49b 100644
--- a/pkgs/tools/graphics/graphviz/base.nix
+++ b/pkgs/tools/graphics/graphviz/base.nix
@@ -1,8 +1,9 @@
 { rev, sha256, version }:
 
 { lib, stdenv, fetchFromGitLab, autoreconfHook, pkg-config, cairo, expat, flex
-, fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango
-, bison, fetchpatch, xorg, ApplicationServices, python3 }:
+, fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango, bash
+, bison, fetchpatch, xorg, ApplicationServices, python3, withXorg ? true
+}:
 
 let
   inherit (lib) optional optionals optionalString;
@@ -12,7 +13,7 @@ let
       name = "CVE-2018-10196.patch";
       url = "https://gitlab.com/graphviz/graphviz/uploads/30f8f0b00e357c112ac35fb20241604a/p.diff";
       sha256 = "074qx6ch9blrnlilmz7p96fkiz2va84x2fbqdza5k4808rngirc7";
-      excludes = ["tests/*"]; # we don't run them and they don't apply
+      excludes = [ "tests/*" ]; # we don't run them and they don't apply
     };
   # the patch needs a small adaption for older versions
   patchToUse = if lib.versionAtLeast version "2.37" then raw_patch else
@@ -28,6 +29,13 @@ let
       url = "https://gitlab.com/graphviz/graphviz/-/commit/784411ca3655c80da0f6025ab20634b2a6ff696b.patch";
       sha256 = "1nkw9ism8lkfvxsp5fh95i2l5s5cbjsidbb3g1kjfv10rxkyb41m";
     })
+  ] ++ [
+    # Fix cross.
+    # https://gitlab.com/graphviz/graphviz/-/merge_requests/2281
+    (fetchpatch {
+      url = "https://gitlab.com/graphviz/graphviz/-/commit/0cdb89acbb0caf5baf3d04a8821c9d0dfe065ea8.patch";
+      sha256 = "130mqlxzhzaz3vp4ccaq7z7fd9q6vjxmimz70g8y818igsbb13rf";
+    })
   ];
 in
 
@@ -41,17 +49,22 @@ stdenv.mkDerivation {
     inherit sha256 rev;
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config python3 ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    python3
+    bison
+    flex
+  ];
 
   buildInputs = [
-    libpng libjpeg expat bison libtool fontconfig gd gts libdevil flex pango
-    gettext
-  ] ++ optionals (xorg != null) (with xorg; [ libXrender libXaw libXpm ])
-    ++ optionals (stdenv.isDarwin) [ ApplicationServices ];
+    libpng libjpeg expat fontconfig gd gts libdevil pango bash
+  ] ++ optionals withXorg (with xorg; [ libXrender libXaw libXpm ])
+    ++ optionals stdenv.isDarwin [ ApplicationServices ];
 
   hardeningDisable = [ "fortify" ];
 
-  CPPFLAGS = lib.optionalString (xorg != null && stdenv.isDarwin)
+  CPPFLAGS = lib.optionalString (withXorg && stdenv.isDarwin)
     "-I${cairo.dev}/include/cairo";
 
   configureFlags = [
@@ -76,7 +89,7 @@ stdenv.mkDerivation {
 
   preAutoreconf = "./autogen.sh";
 
-  postFixup = optionalString (xorg != null) ''
+  postFixup = optionalString withXorg ''
     substituteInPlace $out/bin/dotty --replace '`which lefty`' $out/bin/lefty
     substituteInPlace $out/bin/vimdot \
       --replace /usr/bin/vi '$(command -v vi)' \
diff --git a/pkgs/tools/graphics/gromit-mpx/default.nix b/pkgs/tools/graphics/gromit-mpx/default.nix
index 710ed04006c..9af99a58098 100644
--- a/pkgs/tools/graphics/gromit-mpx/default.nix
+++ b/pkgs/tools/graphics/gromit-mpx/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config
 , gtk, glib, pcre, libappindicator, libpthreadstubs, libXdmcp
-, libxkbcommon, epoxy, at-spi2-core, dbus, libdbusmenu
+, libxkbcommon, libepoxy, at-spi2-core, dbus, libdbusmenu
 , wrapGAppsHook
 }:
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
   buildInputs = [
     gtk glib pcre libappindicator libpthreadstubs
-    libXdmcp libxkbcommon epoxy at-spi2-core
+    libXdmcp libxkbcommon libepoxy at-spi2-core
     dbus libdbusmenu
   ];
 
diff --git a/pkgs/tools/graphics/wdisplays/default.nix b/pkgs/tools/graphics/wdisplays/default.nix
index 073a3b1b6d4..49832c5d6d8 100644
--- a/pkgs/tools/graphics/wdisplays/default.nix
+++ b/pkgs/tools/graphics/wdisplays/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, gtk3, epoxy, wayland, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, gtk3, libepoxy, wayland, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "wdisplays";
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja pkg-config wrapGAppsHook ];
 
-  buildInputs = [ gtk3 epoxy wayland ];
+  buildInputs = [ gtk3 libepoxy wayland ];
 
   src = fetchFromGitHub {
     owner = "luispabon";
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
index 7b27184cde3..723624e96ab 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
@@ -17,7 +17,7 @@
 , libdatrie
 , libXdmcp
 , libxkbcommon
-, epoxy
+, libepoxy
 , dbus
 , at-spi2-core
 , libXtst
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     libdatrie
     libXdmcp
     libxkbcommon
-    epoxy
+    libepoxy
     dbus
     at-spi2-core
     libXtst
diff --git a/pkgs/tools/misc/coreutils/coreutils-8.23-4.cygwin.patch b/pkgs/tools/misc/coreutils/coreutils-8.23-4.cygwin.patch
deleted file mode 100644
index 2f69347ffab..00000000000
--- a/pkgs/tools/misc/coreutils/coreutils-8.23-4.cygwin.patch
+++ /dev/null
@@ -1,1259 +0,0 @@
---- coreutils-8.23/ChangeLog	2014-07-18 15:22:24.000000000 -0700
-+++ coreutils-8.23/ChangeLog	2014-10-13 08:56:50.775188900 -0700
-@@ -1,3 +1,220 @@
-+2014-10-13  U-WIN-RSJ0SJPBR3E\Administrator  <Administrator@WIN-KQ1OCEBI2E8>
-+
-+	Cygwin release 8.23-4
-+	* copy.c (copy_internal): Fix typo that broke recursive copy
-+	when dealing with directories.
-+
-+2014-09-24  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.23-3
-+	* lib/cygwin.c (cygwin_spelling): Skip .exe magic if .exe is
-+	already present.  Also honor .exe magic on symlinks.
-+	* lib/same.c (same_name): Treat files as same if only difference
-+	is .exe magic.
-+	* copy.c (copy): Move symlink special casing here.
-+	* install.c (strip): Update caller.
-+	* ls.c (gobble_file): Likewise.
-+	* stat.c (do_statfs, do_stat): Likewise.
-+
-+2014-08-12  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.23-2.
-+	Drop hostname.
-+
-+2014-08-01  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.23-1.
-+	* configure.ac: Disable stdbuf.
-+	* lib/local.mk: Upstream switched to flat make, impacting how
-+	we build local cygwin.c code.
-+	* lib/canonicalize.c: Accepted upstream.
-+	* lib/file-has-acl.c: Likewise.
-+	* realpath.c: Likewise.
-+	* su.c: Upstream dropped su.
-+	* Makefile.am: Drop su changes.
-+	* chroot.c: Adapt to new upstream code.
-+
-+2012-02-04  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.15-1.
-+	* lib/fts.c: Early gnulib fix is now upstream.
-+	* lib/canonicalize.c: Backport gnulib fix for /// -> /.
-+	* realpath.c: Backport gnulib fix for --relative-to.
-+
-+2011-10-27  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.14-1.
-+	* lib/ftc.c: Backport gnulib fix to make rm close before rmdir.
-+	* lib/cygwin.c (cygwin_spelling): Fix logic when 'f' and 'f.exe'
-+	exist but are different files.
-+	* stat.c: Fix --append-exe.
-+
-+2011-02-04  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.10-1.
-+
-+2010-12-24  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.8-1.
-+	* lib/mountlist.c (ME_REMOTE): Restore previous cygwin hack to
-+	determine remote drives, lost since 6.11-1.
-+
-+2010-04-29  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.5-1.
-+
-+2010-03-11  Eric Blake  <eblake@redhat.com>
-+
-+	Cygwin release 8.4-1.
-+	* lib/xfreopen.c (xfreopen): Consolidate workaround for broken
-+	freopen usage into one place.
-+	* copy.c (copy): Reinstate .exe magic handling when copying
-+	files with implicit .exe.
-+
-+2008-12-13  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 7.0-1.
-+
-+2008-06-02  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 6.12-1.
-+
-+2008-05-12  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 6.11-1, requires cygwin 1.7.0.
-+	* lib/cygwin.h (CYGWIN_APPEND_EXE): Accomodate new PATH_MAX.
-+	* lib/cygwin.c (cygwin_spelling): Accomodate new trailing
-+	`.' semantics.
-+	* lib/same.c (same_name): Accomodate new PATH_MAX.
-+
-+2008-01-24  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 6.10-1.
-+	* lib/hash-triple.c (triple_hash): Hash case-insensitively.
-+	* lib/hash-pjw.h (hash_pjw_case): New interface.
-+	* lib/hash-pjw.c (hash_pjw_case): New function.
-+	* chcon.c (main): Support my root_dev_ino tweaks.
-+
-+2007-08-21  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 6.9-5.
-+	* same.c (same_name): Detect same file differing only by case.
-+	* copy.c (same_file_ok): Add parameter to detect when case
-+	change is being attempted.
-+	(triple_hash): Hash names case-insensitively.
-+	(copy_internal): Accommodate case-change attempts.
-+	* mv.c (do_move): Allow 'mv foo/ Foo/' as shorthand for
-+	'mv -T foo/ Foo/'.
-+
-+2007-07-23  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 6.9-4.
-+	* dd.c (main): Fix typo in earlier cygwin patch.
-+
-+2007-05-29  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 6.9-3.
-+	* cksum.c (main): Don't lose append mode.
-+	* md5sum.c (main): Likewise.
-+	* cat.c (main): Likewise.
-+	* head.c (main): Likewise.
-+	* tac.c (main): Likewise.
-+	* tail.c (main): Likewise.
-+	* tee.c (main): Likewise.
-+	* tr.c (main): Likewise.
-+
-+2006-11-24  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 6.6-2.
-+	* lib/cygwin.c (cygwin_spelling): Work even with old-style
-+	symlinks, which lacked .lnk suffix.
-+
-+2006-04-14  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 5.94-5. Experimental only, depends on cygwin
-+	snapshot 20060329 or later.
-+	* dd.c (main): Default to binary mode.
-+	* system.h (rpl_freopen): Remove this hack, now that cygwin
-+	freopen(NULL) works.
-+	* lib/quotearg.c (quote_eight_bit): New variable, so I can...
-+	(quotearg_buffer_restyled): treat 8-bit	characters as printable
-+	when outputting to a terminal.
-+	* lib/quote.c (quote_n): Use it.
-+
-+2006-02-28  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 5.94-4. Experimental only, depends on cygwin
-+	snapshot 20060227 or later.
-+	* lib/root-dev-ino.h (struct root_dev_ino): New struct.
-+	(ROOT_DEV_INO_CHECK, ROOT_DEV_INO_WARN): Also track //.
-+	* lib/root-dev-ino.c (get_root_dev_ino): Also track //.
-+	* chmod.c (root_dev_ino): Use new type.
-+	(main): Ditto.
-+	* chown-core.h (struct Chown_option): Ditto.
-+	* chown.c (main): Ditto.
-+	* remove.h (struct rm_options): Ditto.
-+	* rm.c (main): Ditto.
-+	* pwd.c (robust_getcwd): Ditto.  Also fix bug when in / or //.
-+
-+2006-01-24  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 5.93-3, depends on cygwin-1.5.19-1 or later.
-+	* cksum.c (main): Always output binary files.
-+	* md5sum.c (main): Likewise.
-+	* su.c (correct_password): On NT machines, attempt
-+	passwordless login first, and give better error message if
-+	password check fails.  I still don't know how to distinguish
-+	between insufficient privileges vs. incorrect password.
-+	* dircolors.c (main): Silence warning from tcsh 6.14.00.
-+
-+2005-10-15  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 5.90-3, depends on snapshot 20051003 or later (will
-+	become cygwin 1.5.19).
-+	* doc/coreutils.texi (ls invocation, stat invocation): Document
-+	--append-exe.
-+	* ls.c (usage): Ditto.
-+	(gobble_file): Append .exe as needed when requested.
-+	* stat.c (usage): Document --append-exe.
-+	(do_stat, do_statfs): Append .exe as needed when requested.
-+
-+2005-10-08  Eric Blake  <ebb9@byu.net>
-+
-+	Cygwin release 5.90-2, depends on snapshot 20051003 or later (will
-+	become cygwin 1.5.19).
-+	* lib/mkdir-p.c (make_dir_parents): Fix bug in last patch.
-+	* lib/cygwin.h (CYGWIN_APPEND_EXE): Factor into common macro.
-+	* copy.c (copy): Use new macro.
-+	* install.c (strip): Ditto.
-+	* ln.c (do_link): Ditto.
-+
-+2005-07-13  Eric Blake  <ebb9@byu.net>
-+
-+	* doc/coreutils.texi (ln invocation): Document --disable-exe-magic.
-+	* ln.c (usage): Likewise.
-+	(do_link): Skip .exe magic when requested.
-+
-+2005-07-12  Eric Blake  <ebb9@byu.net>
-+
-+	* lib/cygwin.c (cygwin_spelling): Don't append .exe to directories.
-+	Make sure .exe exists before returning 1, because otherwise
-+	virtual directories such as /cygdrive have problems.
-+
-+2005-07-07  Eric Blake  <ebb9@byu.net>
-+
-+	* lib/cygwin.h: New file, defining cygwin_spelling.
-+	* lib/cygwin.c: New file.
-+	* lib/Makefile.am: Compile it.
-+	* copy.c (copy_internal, copy): Use new cygwin_spelling() to
-+	undo .exe magic.
-+	* link.c (do_link): Likewise.
-+	* install.c (strip): Likewise.
-+
-+2005-01-03  Corinna Vinschen  <corinna@vinschen.de>
-+
-+	* install.c (strip): Check for .exe here since strip doesn't.
-+
-+
- 2014-07-18  Pádraig Brady  <P@draigBrady.com>
- 
- 	version 8.23
---- coreutils-8.23/configure.ac	2014-07-17 18:40:57.000000000 -0700
-+++ coreutils-8.23/configure.ac	2014-10-13 08:30:37.165262300 -0700
-@@ -473,7 +473,7 @@ AC_COMPILE_IFELSE(
-   [stdbuf_supported=yes],
-   [stdbuf_supported=no])
- AC_MSG_RESULT([$stdbuf_supported])
--if test "$stdbuf_supported" = "yes"; then
-+if test "$stdbuf_supported" = "yes" && test -z "$EXEEXT"; then
-   gl_ADD_PROG([optional_bin_progs], [stdbuf])
- fi
- 
---- coreutils-8.23/doc/coreutils.texi	2014-07-13 15:09:52.000000000 -0700
-+++ coreutils-8.23/doc/coreutils.texi	2014-10-13 08:30:37.180881200 -0700
-@@ -7838,6 +7838,14 @@ These options change how file names them
- 
- @table @samp
- 
-+@item --append-exe
-+@opindex --append-exe
-+@cindex appending exe on cygwin
-+Cygwin only: Cygwin normally performs @samp{.exe} magic, where a
-+command line argument typed without an .exe extension transparently
-+refers to the existing file with an extension.  Specifying this option
-+will make the .exe show if cygwin magic was involved.
-+
- @item -b
- @itemx --escape
- @itemx --quoting-style=escape
-@@ -11799,6 +11807,14 @@ With this option, @command{stat} acts on
- by each symbolic link argument.
- Without it, @command{stat} acts on any symbolic link argument directly.
- 
-+@item --append-exe
-+@opindex --append-exe
-+@cindex appending exe on cygwin
-+Cygwin only: Cygwin normally performs .exe magic, where a command line
-+argument typed without an .exe extension transparently refers to the
-+existing file with an extension.  Specifying this option will make
-+the .exe show if cygwin magic was involved.
-+
- @item -f
- @itemx --file-system
- @opindex -f
---- coreutils-8.23/lib/cygwin.c	1969-12-31 16:00:00.000000000 -0800
-+++ coreutils-8.23/lib/cygwin.c	2014-10-13 08:30:37.180881200 -0700
-@@ -0,0 +1,67 @@
-+/* cygwin.c - helper functions unique to Cygwin
-+
-+   Copyright (C) 2005, 2006, 2008, 2011 Free Software Foundation, Inc.
-+
-+   This program is free software; you can redistribute it and/or modify
-+   it under the terms of the GNU General Public License as published by
-+   the Free Software Foundation; either version 3, or (at your option)
-+   any later version.
-+
-+   This program is distributed in the hope that it will be useful,
-+   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+   GNU General Public License for more details.
-+
-+   You should have received a copy of the GNU General Public License
-+   along with this program; if not, write to the Free Software Foundation,
-+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-+
-+   Written by Eric Blake.  */
-+
-+#include <config.h>
-+
-+#include "cygwin.h"
-+
-+#include <errno.h>
-+#include <limits.h>
-+#include <string.h>
-+#include <unistd.h>
-+
-+/* Return -1 if PATH is not found, 0 if PATH will not have .exe
-+   appended (it is possible that a PATH that does not exist still
-+   returns 0 instead of -1, or fails for a PATH that exists but cannot
-+   be stat'ed), and positive if PATH has ".exe" automatically appended
-+   by cygwin (1 if PATH is a symlink, 2 otherwise).  Won't change errno.  */
-+
-+int
-+cygwin_spelling (char const *path)
-+{
-+  int saved_errno = errno;
-+  int result = 0; /* Start with assumption that PATH is okay.  */
-+  int len;
-+  struct stat st1;
-+  struct stat st2;
-+  char *path_exe;
-+
-+  if (! path || ! *path || len > PATH_MAX)
-+    /* PATH will cause EINVAL or ENAMETOOLONG, treat it as non-existing.  */
-+    return -1;
-+  len = strlen (path);
-+  if (path[len - 1] == '/'
-+      || (len > 4 && !strcasecmp (&path[len - 4], ".exe")))
-+    /* Don't change spelling if there is a trailing `/' or '.exe'.  */
-+    return 0;
-+  if (lstat (path, &st1) < 0 || S_ISDIR(st1.st_mode))
-+    {
-+      errno = saved_errno;
-+      return -1;
-+    }
-+  path_exe = malloca (len + 5); /* adding ".exe" and NUL.  */
-+  strcat (stpcpy (path_exe, path), ".exe");
-+  if (lstat (path_exe, &st2) == 0 && st1.st_ino == st2.st_ino)
-+    result = 1 + !S_ISLNK(st1.st_mode);
-+  freea (path_exe);
-+
-+  errno = saved_errno;
-+  return result;
-+}
---- coreutils-8.23/lib/cygwin.h	1969-12-31 16:00:00.000000000 -0800
-+++ coreutils-8.23/lib/cygwin.h	2014-10-13 08:30:37.180881200 -0700
-@@ -0,0 +1,38 @@
-+/* cygwin.h - helper functions unique to Cygwin
-+
-+   Copyright (C) 2005, 2006, 2008, 2010, 2011 Free Software Foundation, Inc.
-+
-+   This program is free software; you can redistribute it and/or modify
-+   it under the terms of the GNU General Public License as published by
-+   the Free Software Foundation; either version 3, or (at your option)
-+   any later version.
-+
-+   This program is distributed in the hope that it will be useful,
-+   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+   GNU General Public License for more details.
-+
-+   You should have received a copy of the GNU General Public License
-+   along with this program; if not, write to the Free Software Foundation,
-+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-+
-+   Written by Eric Blake.  */
-+
-+#ifndef CYGWIN_H
-+# define CYGWIN_H 1
-+
-+#include "malloca.h"
-+
-+int cygwin_spelling (char const *);
-+
-+/* Append ".exe" to char *__NAME_ORIG, where __NAME is either NULL or
-+   between __NAME_ORIG and the nul terminator.  Both params will be
-+   evaluated more than once and assigned the new value.  The user must
-+   later call freea(__NAME).  */
-+#define CYGWIN_APPEND_EXE(__name, __name_orig)                          \
-+  __name_orig = __name =                                                \
-+    strcat (strcpy (malloca (strchr (__name ? __name : __name_orig, '\0') \
-+                             - (__name_orig) + 5),                      \
-+                    __name_orig), ".exe")
-+
-+#endif /* CYGWIN_H */
---- coreutils-8.23/lib/hash-pjw.c	2014-05-29 05:05:50.000000000 -0700
-+++ coreutils-8.23/lib/hash-pjw.c	2014-10-13 08:30:37.180881200 -0700
-@@ -19,6 +19,7 @@
- 
- #include "hash-pjw.h"
- 
-+#include <ctype.h>
- #include <limits.h>
- 
- #define SIZE_BITS (sizeof (size_t) * CHAR_BIT)
-@@ -38,3 +39,16 @@ hash_pjw (const void *x, size_t tablesiz
- 
-   return h % tablesize;
- }
-+
-+/* Likewise, but case-insensitive.  */
-+size_t
-+hash_pjw_case (const void *x, size_t tablesize)
-+{
-+  const unsigned char *s;
-+  size_t h = 0;
-+
-+  for (s = x; *s; s++)
-+    h = tolower (*s) + ((h << 9) | (h >> (SIZE_BITS - 9)));
-+
-+  return h % tablesize;
-+}
---- coreutils-8.23/lib/hash-pjw.h	2014-05-29 05:05:50.000000000 -0700
-+++ coreutils-8.23/lib/hash-pjw.h	2014-10-13 08:30:37.180881200 -0700
-@@ -21,3 +21,4 @@
-    The result is platform dependent: it depends on the size of the 'size_t'
-    type and on the signedness of the 'char' type.  */
- extern size_t hash_pjw (void const *x, size_t tablesize) _GL_ATTRIBUTE_PURE;
-+extern size_t hash_pjw_case (void const *x, size_t tablesize) _GL_ATTRIBUTE_PURE;
---- coreutils-8.23/lib/hash-triple.c	2014-05-29 05:05:50.000000000 -0700
-+++ coreutils-8.23/lib/hash-triple.c	2014-10-13 08:30:37.180881200 -0700
-@@ -34,7 +34,13 @@ size_t
- triple_hash (void const *x, size_t table_size)
- {
-   struct F_triple const *p = x;
-+#if !__CYGWIN__
-   size_t tmp = hash_pjw (p->name, table_size);
-+#else // cygwin
-+  /* Hash case-insensitively, to force collisions on names that differ by
-+     case; copy.c can then account for case-insensitive renames. */
-+  size_t tmp = hash_pjw_case (p->name, table_size);
-+#endif
- 
-   /* Ignoring the device number here should be fine.  */
-   return (tmp ^ p->st_ino) % table_size;
---- coreutils-8.23/lib/local.mk	2013-12-04 06:48:30.000000000 -0800
-+++ coreutils-8.23/lib/local.mk	2014-10-13 08:30:37.180881200 -0700
-@@ -3,3 +3,6 @@ include lib/gnulib.mk
- # Allow "make distdir" to succeed before "make all" has run.
- dist-hook: $(noinst_LIBRARIES)
- .PHONY: dist-hook
-+
-+# Hook in cygwin helper
-+lib_libcoreutils_a_SOURCES += lib/cygwin.c lib/cygwin.h
---- coreutils-8.23/lib/root-dev-ino.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/lib/root-dev-ino.c	2014-10-13 08:30:37.180881200 -0700
-@@ -25,13 +25,17 @@
- /* Call lstat to get the device and inode numbers for '/'.
-    Upon failure, return NULL.  Otherwise, set the members of
-    *ROOT_D_I accordingly and return ROOT_D_I.  */
--struct dev_ino *
--get_root_dev_ino (struct dev_ino *root_d_i)
-+struct root_dev_ino *
-+get_root_dev_ino (struct root_dev_ino *root_d_i)
- {
-   struct stat statbuf;
-   if (lstat ("/", &statbuf))
-     return NULL;
--  root_d_i->st_ino = statbuf.st_ino;
--  root_d_i->st_dev = statbuf.st_dev;
-+  root_d_i->single_slash.st_ino = statbuf.st_ino;
-+  root_d_i->single_slash.st_dev = statbuf.st_dev;
-+  if (lstat ("//", &statbuf))
-+    return NULL;
-+  root_d_i->double_slash.st_ino = statbuf.st_ino;
-+  root_d_i->double_slash.st_dev = statbuf.st_dev;
-   return root_d_i;
- }
---- coreutils-8.23/lib/root-dev-ino.h	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/lib/root-dev-ino.h	2014-10-13 08:30:37.180881200 -0700
-@@ -21,19 +21,26 @@
- # include "dev-ino.h"
- # include "same-inode.h"
- 
--struct dev_ino *
--get_root_dev_ino (struct dev_ino *root_d_i);
-+struct root_dev_ino
-+{
-+  struct dev_ino single_slash;
-+  struct dev_ino double_slash;
-+};
-+
-+struct root_dev_ino *
-+get_root_dev_ino (struct root_dev_ino *root_d_i);
- 
- /* These macros are common to the programs that support the
-    --preserve-root and --no-preserve-root options.  */
- 
- # define ROOT_DEV_INO_CHECK(Root_dev_ino, Dir_statbuf) \
--    (Root_dev_ino && SAME_INODE (*Dir_statbuf, *Root_dev_ino))
-+  (Root_dev_ino && (SAME_INODE (*Dir_statbuf, (Root_dev_ino)->single_slash) \
-+                    || SAME_INODE (*Dir_statbuf, (Root_dev_ino)->double_slash)))
- 
- # define ROOT_DEV_INO_WARN(Dirname)					\
-   do									\
-     {									\
--      if (STREQ (Dirname, "/"))						\
-+      if (STREQ (Dirname, "/") || STREQ (Dirname, "//"))                \
-         error (0, 0, _("it is dangerous to operate recursively on %s"),	\
-                quote (Dirname));					\
-       else								\
---- coreutils-8.23/lib/same.c	2014-05-29 05:05:50.000000000 -0700
-+++ coreutils-8.23/lib/same.c	2014-10-13 08:30:37.180881200 -0700
-@@ -40,6 +40,13 @@
- #include "error.h"
- #include "same-inode.h"
- 
-+#if __CYGWIN__
-+# include <sys/cygwin.h>
-+# include "cygwin.h"
-+# include "malloca.h"
-+# include "memcasecmp.h"
-+#endif
-+
- #ifndef MIN
- # define MIN(a, b) ((a) < (b) ? (a) : (b))
- #endif
-@@ -59,6 +66,45 @@ same_name (const char *source, const cha
-     (source_baselen == dest_baselen
-      && memcmp (source_basename, dest_basename, dest_baselen) == 0);
-   bool compare_dirs = identical_basenames;
-+#if __CYGWIN__
-+  /* If two names differ case-insensitively by only an '.exe' suffix,
-+     do some sleuthing to see if .exe magic matters on the shorter
-+     name.  Swapping the longer name to dest avoids duplication.  */
-+  if (source_baselen == dest_baselen + 4)
-+    {
-+      char const *tmp_basename = source_basename;
-+      size_t tmp_baselen = source_baselen;
-+      source_basename = dest_basename;
-+      source_baselen = dest_baselen;
-+      dest_basename = tmp_basename;
-+      dest_baselen = tmp_baselen;
-+    }
-+  if (source_baselen + 4 == dest_baselen
-+      && !memcasecmp (dest_basename - 4, ".exe", 4)
-+      && !memcasecmp (source_basename, dest_basename, source_baselen)
-+      && 0 < cygwin_spelling(source))
-+    dest_baselen -= 4;
-+  /* Some, but not all, files are case-insensitive (depending on mount
-+     options, CYGWIN=case settings, and virtual file systems).  Do
-+     some sleuthing to decide whether case-insensitivity matters.  */
-+  if (! compare_dirs && source_baselen == dest_baselen)
-+    {
-+      ssize_t wsrclen = cygwin_conv_path (CCP_POSIX_TO_WIN_W,
-+                                          source, NULL, 0);
-+      ssize_t wdstlen = cygwin_conv_path (CCP_POSIX_TO_WIN_W,
-+                                          dest, NULL, 0);
-+      char *wsrc = malloca (wsrclen);
-+      char *wdst = malloca (wdstlen);
-+      if (cygwin_conv_path (CCP_POSIX_TO_WIN_W, source, wsrc, wsrclen))
-+        error (EXIT_FAILURE, errno, "unable to convert path name %s", source);
-+      if (cygwin_conv_path (CCP_POSIX_TO_WIN_W, dest, wdst, wdstlen))
-+        error (EXIT_FAILURE, errno, "unable to convert path name %s", dest);
-+      if (wsrclen == wdstlen && memcasecmp (wsrc, wdst, wsrclen) == 0)
-+        compare_dirs = true;
-+      freea (wsrc);
-+      freea (wdst);
-+    }
-+#endif /* __CYGWIN__ */
-   bool same = false;
- 
- #if ! _POSIX_NO_TRUNC && HAVE_PATHCONF && defined _PC_NAME_MAX
---- coreutils-8.23/lib/xfreopen.c	2014-05-29 05:05:50.000000000 -0700
-+++ coreutils-8.23/lib/xfreopen.c	2014-10-13 08:30:37.180881200 -0700
-@@ -18,6 +18,7 @@
- #include "xfreopen.h"
- 
- #include <errno.h>
-+#include <fcntl.h>
- #include "error.h"
- #include "exitfail.h"
- #include "quote.h"
-@@ -26,9 +27,17 @@
- #include "gettext.h"
- #define _(msgid) gettext (msgid)
- 
-+#define STREQ(s1, s2) (strcmp (s1, s2) == 0)
-+
- void
- xfreopen (char const *filename, char const *mode, FILE *fp)
- {
-+  if (!filename && STREQ (mode, "wb"))
-+    {
-+      int flag = fcntl (fileno (fp), F_GETFL);
-+      if (0 <= flag && (flag & O_APPEND))
-+        mode = "ab";
-+    }
-   if (!freopen (filename, mode, fp))
-     {
-       char const *f = (filename ? filename
---- coreutils-8.23/chcon.c	2014-07-13 15:09:52.000000000 -0700
-+++ coreutils-8.23/src/chcon.c	2014-10-13 08:30:37.180881200 -0700
-@@ -48,7 +48,7 @@ static bool verbose;
- 
- /* Pointer to the device and inode numbers of '/', when --recursive.
-    Otherwise NULL.  */
--static struct dev_ino *root_dev_ino;
-+static struct root_dev_ino *root_dev_ino;
- 
- /* The name of the context file is being given. */
- static char const *specified_context;
-@@ -569,7 +569,7 @@ main (int argc, char **argv)
- 
-   if (recurse && preserve_root)
-     {
--      static struct dev_ino dev_ino_buf;
-+      static struct root_dev_ino dev_ino_buf;
-       root_dev_ino = get_root_dev_ino (&dev_ino_buf);
-       if (root_dev_ino == NULL)
-         error (EXIT_FAILURE, errno, _("failed to get attributes of %s"),
---- coreutils-8.23/chgrp.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/chgrp.c	2014-10-13 08:30:37.180881200 -0700
-@@ -299,7 +299,7 @@ main (int argc, char **argv)
- 
-   if (chopt.recurse && preserve_root)
-     {
--      static struct dev_ino dev_ino_buf;
-+      static struct root_dev_ino dev_ino_buf;
-       chopt.root_dev_ino = get_root_dev_ino (&dev_ino_buf);
-       if (chopt.root_dev_ino == NULL)
-         error (EXIT_FAILURE, errno, _("failed to get attributes of %s"),
---- coreutils-8.23/chmod.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/chmod.c	2014-10-13 08:30:37.180881200 -0700
-@@ -81,7 +81,7 @@ static enum Verbosity verbosity = V_off;
- 
- /* Pointer to the device and inode numbers of '/', when --recursive.
-    Otherwise NULL.  */
--static struct dev_ino *root_dev_ino;
-+static struct root_dev_ino *root_dev_ino;
- 
- /* For long options that have no equivalent short option, use a
-    non-character as a pseudo short option, starting with CHAR_MAX + 1.  */
-@@ -552,7 +552,7 @@ main (int argc, char **argv)
- 
-   if (recurse && preserve_root)
-     {
--      static struct dev_ino dev_ino_buf;
-+      static struct root_dev_ino dev_ino_buf;
-       root_dev_ino = get_root_dev_ino (&dev_ino_buf);
-       if (root_dev_ino == NULL)
-         error (EXIT_FAILURE, errno, _("failed to get attributes of %s"),
---- coreutils-8.23/chown-core.h	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/chown-core.h	2014-10-13 08:30:37.196451900 -0700
-@@ -50,7 +50,7 @@ struct Chown_option
- 
-   /* Pointer to the device and inode numbers of '/', when --recursive.
-      Need not be freed.  Otherwise NULL.  */
--  struct dev_ino *root_dev_ino;
-+  struct root_dev_ino *root_dev_ino;
- 
-   /* This corresponds to the --dereference (opposite of -h) option.  */
-   bool affect_symlink_referent;
---- coreutils-8.23/chown.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/chown.c	2014-10-13 08:30:37.196451900 -0700
-@@ -312,7 +312,7 @@ main (int argc, char **argv)
- 
-   if (chopt.recurse && preserve_root)
-     {
--      static struct dev_ino dev_ino_buf;
-+      static struct root_dev_ino dev_ino_buf;
-       chopt.root_dev_ino = get_root_dev_ino (&dev_ino_buf);
-       if (chopt.root_dev_ino == NULL)
-         error (EXIT_FAILURE, errno, _("failed to get attributes of %s"),
---- coreutils-8.23/chroot.c	2014-07-13 16:59:20.000000000 -0700
-+++ coreutils-8.23/src/chroot.c	2014-10-13 08:30:37.196451900 -0700
-@@ -163,7 +163,7 @@ parse_additional_groups (char const *gro
- static bool
- is_root (const char* dir)
- {
--  struct dev_ino root_ino;
-+  struct root_dev_ino root_ino;
-   if (! get_root_dev_ino (&root_ino))
-     error (EXIT_CANCELED, errno, _("failed to get attributes of %s"),
-            quote ("/"));
-@@ -173,7 +173,7 @@ is_root (const char* dir)
-     error (EXIT_CANCELED, errno, _("failed to get attributes of %s"),
-            quote (dir));
- 
--  return SAME_INODE (root_ino, arg_st);
-+  return ROOT_DEV_INO_CHECK (&root_ino, &arg_st);
- }
- 
- void
---- coreutils-8.23/cksum.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/cksum.c	2014-10-13 08:30:37.196451900 -0700
-@@ -301,6 +301,9 @@ main (int argc, char **argv)
- 
-   have_read_stdin = false;
- 
-+  if (O_BINARY)
-+    xfreopen (NULL, "wb", stdout);
-+
-   if (optind == argc)
-     ok = cksum ("-", false);
-   else
---- coreutils-8.23/copy.c	2014-07-13 15:09:52.000000000 -0700
-+++ coreutils-8.23/src/copy.c	2014-10-13 08:49:30.450181800 -0700
-@@ -70,6 +70,10 @@
- # include "verror.h"
- #endif
- 
-+#if __CYGWIN__
-+# include "cygwin.h"
-+#endif
-+
- #ifndef HAVE_FCHOWN
- # define HAVE_FCHOWN false
- # define fchown(fd, uid, gid) (-1)
-@@ -1313,7 +1317,11 @@ close_src_desc:
- static bool
- same_file_ok (char const *src_name, struct stat const *src_sb,
-               char const *dst_name, struct stat const *dst_sb,
--              const struct cp_options *x, bool *return_now, bool *unlink_src)
-+              const struct cp_options *x, bool *return_now, bool *unlink_src
-+#if __CYGWIN__
-+	      , bool *case_change
-+#endif
-+	      )
- {
-   const struct stat *src_sb_link;
-   const struct stat *dst_sb_link;
-@@ -1461,6 +1469,18 @@ same_file_ok (char const *src_name, stru
-       if (S_ISLNK (dst_sb_link->st_mode))
-         return true;
- 
-+#if __CYGWIN__
-+      /* If the files have the same name, but differ in case, then let
-+        rename() change the case.  */
-+      if (same_link && x->move_mode && same_name (src_name, dst_name)
-+         && memcmp (last_component (src_name), last_component (dst_name),
-+                    base_len (src_name)) != 0)
-+       {
-+         *case_change = true;
-+         return true;
-+       }
-+#endif /* __CYGWIN__ */
-+
-       if (same_link
-           && 1 < dst_sb_link->st_nlink
-           && ! same_name (src_name, dst_name))
-@@ -1813,10 +1833,20 @@ copy_internal (char const *src_name, cha
-          && ! (x->move_mode || x->symbolic_link || x->hard_link
-                || x->backup_type != no_backups
-                || x->unlink_dest_before_opening));
--      if ((use_stat
--           ? stat (dst_name, &dst_sb)
--           : lstat (dst_name, &dst_sb))
--          != 0)
-+      int res = (use_stat
-+                 ? stat (dst_name, &dst_sb)
-+                 : lstat (dst_name, &dst_sb));
-+#if __CYGWIN__
-+      /* stat("a") succeeds even if it was really "a.exe".  */
-+      if (! res && 0 < cygwin_spelling (dst_name))
-+        {
-+          /* Only DST_NAME.exe exists, but we want the non-existant
-+             DST_NAME.  */
-+          res = -1;
-+          errno = ENOENT;
-+        }
-+#endif /* __CYGWIN__ */
-+      if (res != 0)
-         {
-           if (errno != ENOENT)
-             {
-@@ -1833,10 +1863,17 @@ copy_internal (char const *src_name, cha
-              that it is stat'able or lstat'able.  */
-           bool return_now;
-           bool unlink_src;
-+#if __CYGWIN__
-+          bool case_change = false;
-+#endif /* __CYGWIN__ */
- 
-           have_dst_lstat = !use_stat;
-           if (! same_file_ok (src_name, &src_sb, dst_name, &dst_sb,
--                              x, &return_now, &unlink_src))
-+                              x, &return_now, &unlink_src
-+#if __CYGWIN__
-+                              , &case_change
-+#endif
-+))
-             {
-               error (0, 0, _("%s and %s are the same file"),
-                      quote_n (0, src_name), quote_n (1, dst_name));
-@@ -1895,6 +1932,9 @@ copy_internal (char const *src_name, cha
-              cp and mv treat -i and -f differently.  */
-           if (x->move_mode)
-             {
-+#if __CYGWIN__
-+              if (!case_change)
-+#endif /* __CYGWIN__ */
-               if (abandon_move (x, dst_name, &dst_sb)
-                   || (unlink_src && unlink (src_name) == 0))
-                 {
-@@ -2058,7 +2098,11 @@ copy_internal (char const *src_name, cha
-                    /* Never unlink dst_name when in move mode.  */
-                    && ! x->move_mode
-                    && (x->unlink_dest_before_opening
--                       || (x->preserve_links && 1 < dst_sb.st_nlink)
-+                       || (x->preserve_links && 1 < dst_sb.st_nlink
-+#if __CYGWIN__
-+                           && !case_change
-+#endif /* __CYGWIN__ */
-+			   )
-                        || (x->dereference == DEREF_NEVER
-                            && ! S_ISREG (src_sb.st_mode))
-                        ))
-@@ -2816,6 +2860,21 @@ copy (char const *src_name, char const *
- {
-   assert (valid_options (options));
- 
-+#if __CYGWIN__
-+  /* .exe magic - if src exists with an implicit .exe suffix and is
-+     not a symlink, but dst does not exist and was also specified
-+     without a suffix, then append .exe to dst.  */
-+  int cygwin = cygwin_spelling (src_name);
-+  char *p;
-+  if (cygwin == 2
-+      && ((p = strchr (dst_name, '\0') - 4) <= dst_name
-+          || strcasecmp (p, ".exe") != 0))
-+    {
-+      cygwin = 3;
-+      CYGWIN_APPEND_EXE (p, dst_name);
-+    }
-+#endif /* __CYGWIN__ */
-+
-   /* Record the file names: they're used in case of error, when copying
-      a directory into itself.  I don't like to make these tools do *any*
-      extra work in the common case when that work is solely to handle
-@@ -2827,10 +2886,15 @@ copy (char const *src_name, char const *
-   top_level_dst_name = dst_name;
- 
-   bool first_dir_created_per_command_line_arg = false;
--  return copy_internal (src_name, dst_name, nonexistent_dst, NULL, NULL,
-+  bool result = copy_internal (src_name, dst_name, nonexistent_dst, NULL, NULL,
-                         options, true,
-                         &first_dir_created_per_command_line_arg,
-                         copy_into_self, rename_succeeded);
-+#if __CYGWIN__
-+  if (cygwin == 3)
-+    freea ((char *) dst_name);
-+#endif /* __CYGWIN__ */
-+  return result;
- }
- 
- /* Set *X to the default options for a value of type struct cp_options.  */
---- coreutils-8.23/dd.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/dd.c	2014-10-13 08:30:37.196451900 -0700
-@@ -37,6 +37,10 @@
- #include "xstrtol.h"
- #include "xtime.h"
- 
-+#if __CYGWIN__
-+# include <io.h>
-+#endif
-+
- /* The official name of this program (e.g., no 'g' prefix).  */
- #define PROGRAM_NAME "dd"
- 
-@@ -1862,6 +1866,13 @@ copy_with_unblock (char const *buf, size
- static void
- set_fd_flags (int fd, int add_flags, char const *name)
- {
-+#if __CYGWIN__
-+  /* Cygwin does not allow fcntl to set the mode.  */
-+  int mode_flags = add_flags & (O_BINARY | O_TEXT);
-+  add_flags &= ~(O_BINARY | O_TEXT);
-+  if (mode_flags && setmode (fd, mode_flags) == -1)
-+    error (EXIT_FAILURE, errno, _("setting flags for %s"), quote (name));
-+#endif /* __CYGWIN__ */
-   /* Ignore file creation flags that are no-ops on file descriptors.  */
-   add_flags &= ~ (O_NOCTTY | O_NOFOLLOW);
- 
-@@ -2242,6 +2253,8 @@ main (int argc, char **argv)
-     }
-   else
-     {
-+      if ((input_flags & (O_BINARY | O_TEXT)) == 0)
-+	input_flags |= O_BINARY;
-       if (fd_reopen (STDIN_FILENO, input_file, O_RDONLY | input_flags, 0) < 0)
-         error (EXIT_FAILURE, errno, _("failed to open %s"), quote (input_file));
-     }
-@@ -2264,6 +2277,8 @@ main (int argc, char **argv)
-            | (conversions_mask & C_NOCREAT ? 0 : O_CREAT)
-            | (conversions_mask & C_EXCL ? O_EXCL : 0)
-            | (seek_records || (conversions_mask & C_NOTRUNC) ? 0 : O_TRUNC));
-+      if ((opts & (O_BINARY | O_TEXT)) == 0)
-+        opts |= O_BINARY;
- 
-       /* Open the output file with *read* access only if we might
-          need to read to satisfy a 'seek=' request.  If we can't read
---- coreutils-8.23/dircolors.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/dircolors.c	2014-10-13 08:30:37.196451900 -0700
-@@ -494,8 +494,12 @@ main (int argc, char **argv)
-             }
-           else
-             {
-+              /* tcsh treats LS_COLORS as a magic shell variable for its
-+                 builtin ls-F, but does not recognize all the categories
-+                 that coreutils ls does.  Therefore, silence stderr to
-+                 avoid messages like "Unknown colorls variable `su'.".  */
-               prefix = "setenv LS_COLORS '";
--              suffix = "'\n";
-+              suffix = "' >&/dev/null\n";
-             }
-           fputs (prefix, stdout);
-           fwrite (s, 1, len, stdout);
---- coreutils-8.23/install.c	2014-07-13 15:09:52.000000000 -0700
-+++ coreutils-8.23/src/install.c	2014-10-13 08:30:37.196451900 -0700
-@@ -44,6 +44,10 @@
- #include "utimens.h"
- #include "xstrtol.h"
- 
-+#if __CYGWIN__
-+# include "cygwin.h"
-+#endif
-+
- /* The official name of this program (e.g., no 'g' prefix).  */
- #define PROGRAM_NAME "install"
- 
-@@ -531,6 +535,16 @@ strip (char const *name)
-       error (0, errno, _("fork system call failed"));
-       break;
-     case 0:			/* Child. */
-+#if __CYGWIN__
-+      {
-+	/* Check for .exe here, since strip doesn't.  */
-+	char *p;
-+	if (((p = strchr (name, '\0') - 4) <= name
-+	     || strcasecmp (p, ".exe") != 0)
-+	    && 0 < cygwin_spelling (name))
-+          CYGWIN_APPEND_EXE (p, name);
-+      }
-+#endif /* __CYGWIN__ */
-       execlp (strip_program, strip_program, name, NULL);
-       error (EXIT_FAILURE, errno, _("cannot run %s"), strip_program);
-       break;
---- coreutils-8.23/ls.c	2014-07-13 15:09:52.000000000 -0700
-+++ coreutils-8.23/src/ls.c	2014-10-13 08:30:37.196451900 -0700
-@@ -117,6 +117,10 @@
- # include <sys/capability.h>
- #endif
- 
-+#if __CYGWIN__
-+# include "cygwin.h"
-+#endif
-+
- #define PROGRAM_NAME (ls_mode == LS_LS ? "ls" \
-                       : (ls_mode == LS_MULTI_COL \
-                          ? "dir" : "vdir"))
-@@ -747,6 +751,11 @@ static char const *long_time_format[2] =
-     N_("%b %e %H:%M")
-   };
- 
-+#if __CYGWIN__
-+/* Whether .exe should be appended to command-line args as needed.  */
-+static bool append_exe;
-+#endif /* __CYGWIN__ */
-+
- /* The set of signals that are caught.  */
- 
- static sigset_t caught_signals;
-@@ -782,6 +791,9 @@ enum
- enum
- {
-   AUTHOR_OPTION = CHAR_MAX + 1,
-+#if __CYGWIN__
-+  APPEND_EXE_OPTION,
-+#endif /* __CYGWIN__ */
-   BLOCK_SIZE_OPTION,
-   COLOR_OPTION,
-   DEREFERENCE_COMMAND_LINE_SYMLINK_TO_DIR_OPTION,
-@@ -843,6 +855,9 @@ static struct option const long_options[
-   {"block-size", required_argument, NULL, BLOCK_SIZE_OPTION},
-   {"context", no_argument, 0, 'Z'},
-   {"author", no_argument, NULL, AUTHOR_OPTION},
-+#if __CYGWIN__
-+  {"append-exe", no_argument, NULL, APPEND_EXE_OPTION},
-+#endif /* __CYGWIN__ */
-   {GETOPT_HELP_OPTION_DECL},
-   {GETOPT_VERSION_OPTION_DECL},
-   {NULL, 0, NULL, 0}
-@@ -1954,6 +1969,12 @@ decode_switches (int argc, char **argv)
-           print_scontext = true;
-           break;
- 
-+#if __CYGWIN__
-+        case APPEND_EXE_OPTION:
-+          append_exe = true;
-+          break;
-+#endif /* __CYGWIN__ */
-+
-         case_GETOPT_HELP_CHAR;
- 
-         case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
-@@ -2924,6 +2945,12 @@ gobble_file (char const *name, enum file
-   uintmax_t blocks = 0;
-   struct fileinfo *f;
- 
-+#if __CYGWIN__
-+  char *name_alt = NULL;
-+  if (command_line_arg && append_exe && 0 < cygwin_spelling (name))
-+    CYGWIN_APPEND_EXE (name_alt, name);
-+#endif /* __CYGWIN__ */
-+
-   /* An inode value prior to gobble_file necessarily came from readdir,
-      which is not used for command line arguments.  */
-   assert (! command_line_arg || inode == NOT_AN_INODE_NUMBER);
-@@ -3035,11 +3062,19 @@ gobble_file (char const *name, enum file
-           file_failure (command_line_arg,
-                         _("cannot access %s"), absolute_name);
-           if (command_line_arg)
--            return 0;
-+            {
-+#if __CYGWIN__
-+              freea (name_alt);
-+#endif /* __CYGWIN__ */
-+              return 0;
-+            }
- 
-           f->name = xstrdup (name);
-           cwd_n_used++;
- 
-+#if __CYGWIN__
-+          freea (name_alt);
-+#endif /* __CYGWIN__ */
-           return 0;
-         }
- 
-@@ -3223,6 +3258,9 @@ gobble_file (char const *name, enum file
-   f->name = xstrdup (name);
-   cwd_n_used++;
- 
-+#if __CYGWIN__
-+  freea (name_alt);
-+#endif /* __CYGWIN__ */
-   return blocks;
- }
- 
-@@ -4923,6 +4961,11 @@ Sort entries alphabetically if none of -
-   -Z, --context              print any security context of each file\n\
-   -1                         list one file per line\n\
- "), stdout);
-+#if __CYGWIN__
-+      fputs (_("\
-+      --append-exe           append .exe if cygwin magic was needed\n\
-+"), stdout);
-+#endif /* __CYGWIN__ */
-       fputs (HELP_OPTION_DESCRIPTION, stdout);
-       fputs (VERSION_OPTION_DESCRIPTION, stdout);
-       emit_size_note ();
---- coreutils-8.23/md5sum.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/md5sum.c	2014-10-13 08:30:37.212072800 -0700
-@@ -813,6 +813,9 @@ main (int argc, char **argv)
-   if (optind == argc)
-     argv[argc++] = bad_cast ("-");
- 
-+  if (O_BINARY)
-+    xfreopen (NULL, "wb", stdout);
-+
-   for (; optind < argc; ++optind)
-     {
-       char *file = argv[optind];
---- coreutils-8.23/mv.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/mv.c	2014-10-13 08:30:37.212072800 -0700
-@@ -92,7 +92,7 @@ rm_option_init (struct rm_options *x)
-   x->require_restore_cwd = true;
- 
-   {
--    static struct dev_ino dev_ino_buf;
-+    static struct root_dev_ino dev_ino_buf;
-     x->root_dev_ino = get_root_dev_ino (&dev_ino_buf);
-     if (x->root_dev_ino == NULL)
-       error (EXIT_FAILURE, errno, _("failed to get attributes of %s"),
-@@ -467,6 +467,16 @@ main (int argc, char **argv)
-   else if (!target_directory)
-     {
-       assert (2 <= n_files);
-+#if __CYGWIN__
-+      struct stat s1, s2;
-+      if (2 == n_files
-+	  && lstat (file[0], &s1) == 0 && lstat (file[1], &s2) == 0
-+	  && s1.st_ino == s2.st_ino)
-+	{
-+	  /* Allow 'mv foo Foo' to change case of the directory foo.  */
-+	}
-+      else
-+#endif /* __CYGWIN__ */
-       if (target_directory_operand (file[n_files - 1]))
-         target_directory = file[--n_files];
-       else if (2 < n_files)
---- coreutils-8.23/pwd.c	2014-07-13 15:09:52.000000000 -0700
-+++ coreutils-8.23/src/pwd.c	2014-10-13 08:30:37.212072800 -0700
-@@ -268,8 +268,8 @@ static void
- robust_getcwd (struct file_name *file_name)
- {
-   size_t height = 1;
--  struct dev_ino dev_ino_buf;
--  struct dev_ino *root_dev_ino = get_root_dev_ino (&dev_ino_buf);
-+  struct root_dev_ino dev_ino_buf;
-+  struct root_dev_ino *root_dev_ino = get_root_dev_ino (&dev_ino_buf);
-   struct stat dot_sb;
- 
-   if (root_dev_ino == NULL)
-@@ -282,7 +282,7 @@ robust_getcwd (struct file_name *file_na
-   while (1)
-     {
-       /* If we've reached the root, we're done.  */
--      if (SAME_INODE (dot_sb, *root_dev_ino))
-+      if (ROOT_DEV_INO_CHECK (root_dev_ino, &dot_sb))
-         break;
- 
-       find_dir_entry (&dot_sb, file_name, height++);
-@@ -291,6 +291,9 @@ robust_getcwd (struct file_name *file_na
-   /* See if a leading slash is needed; file_name_prepend adds one.  */
-   if (file_name->start[0] == '\0')
-     file_name_prepend (file_name, "", 0);
-+  /* If we aren't in `/', we must be in `//'.  */
-+  if (! SAME_INODE (root_dev_ino->single_slash, dot_sb))
-+    file_name_prepend (file_name, "", 0);
- }
- 
- 
---- coreutils-8.23/remove.h	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/remove.h	2014-10-13 08:30:37.212072800 -0700
-@@ -54,7 +54,7 @@ struct rm_options
- 
-   /* Pointer to the device and inode numbers of '/', when --recursive
-      and preserving '/'.  Otherwise NULL.  */
--  struct dev_ino *root_dev_ino;
-+  struct root_dev_ino *root_dev_ino;
- 
-   /* If nonzero, stdin is a tty.  */
-   bool stdin_tty;
---- coreutils-8.23/rm.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/rm.c	2014-10-13 08:30:37.212072800 -0700
-@@ -325,7 +325,7 @@ main (int argc, char **argv)
- 
-   if (x.recursive && preserve_root)
-     {
--      static struct dev_ino dev_ino_buf;
-+      static struct root_dev_ino dev_ino_buf;
-       x.root_dev_ino = get_root_dev_ino (&dev_ino_buf);
-       if (x.root_dev_ino == NULL)
-         error (EXIT_FAILURE, errno, _("failed to get attributes of %s"),
---- coreutils-8.23/stat.c	2014-07-11 04:00:07.000000000 -0700
-+++ coreutils-8.23/src/stat.c	2014-10-13 08:30:37.212072800 -0700
-@@ -73,6 +73,13 @@
- #include "find-mount-point.h"
- #include "xvasprintf.h"
- 
-+#if __CYGWIN__
-+# include "cygwin.h"
-+/* Whether .exe should be appended to command-line args as needed.  */
-+static bool append_exe;
-+# define APPEND_EXE_OPTION 10000
-+#endif
-+
- #if USE_STATVFS
- # define STRUCT_STATVFS struct statvfs
- # define STRUCT_STATXFS_F_FSID_IS_INTEGER STRUCT_STATVFS_F_FSID_IS_INTEGER
-@@ -189,6 +196,9 @@ static struct option const long_options[
-   {"format", required_argument, NULL, 'c'},
-   {"printf", required_argument, NULL, PRINTF_OPTION},
-   {"terse", no_argument, NULL, 't'},
-+#if __CYGWIN__
-+  {"append-exe", no_argument, NULL, APPEND_EXE_OPTION},
-+#endif /* __CYGWIN__ */
-   {GETOPT_HELP_OPTION_DECL},
-   {GETOPT_VERSION_OPTION_DECL},
-   {NULL, 0, NULL, 0}
-@@ -1264,14 +1274,26 @@ do_statfs (char const *filename, char co
-       return false;
-     }
- 
-+#if __CYGWIN__
-+  char *name_alt = NULL;
-+  if (append_exe && 0 < cygwin_spelling (filename))
-+    CYGWIN_APPEND_EXE (name_alt, filename);
-+#endif /* __CYGWIN__ */
-+
-   if (STATFS (filename, &statfsbuf) != 0)
-     {
-       error (0, errno, _("cannot read file system information for %s"),
-              quote (filename));
-+#if __CYGWIN__
-+      freea (name_alt);
-+#endif /* __CYGWIN__ */
-       return false;
-     }
- 
-   bool fail = print_it (format, -1, filename, print_statfs, &statfsbuf);
-+#if __CYGWIN__
-+  freea (name_alt);
-+#endif /* __CYGWIN__ */
-   return ! fail;
- }
- 
-@@ -1282,6 +1304,7 @@ do_stat (char const *filename, char cons
- {
-   int fd = STREQ (filename, "-") ? 0 : -1;
-   struct stat statbuf;
-+  char *name_alt = NULL;
- 
-   if (0 <= fd)
-     {
-@@ -1294,18 +1317,29 @@ do_stat (char const *filename, char cons
-   /* We can't use the shorter
-      (follow_links?stat:lstat) (filename, &statbug)
-      since stat might be a function-like macro.  */
--  else if ((follow_links
--            ? stat (filename, &statbuf)
--            : lstat (filename, &statbuf)) != 0)
-+  else
-     {
--      error (0, errno, _("cannot stat %s"), quote (filename));
--      return false;
-+      if ((follow_links
-+	   ? stat (filename, &statbuf)
-+	   : lstat (filename, &statbuf)) != 0)
-+	{
-+	  error (0, errno, _("cannot stat %s"), quote (filename));
-+	  return false;
-+	}
-+
-+#if __CYGWIN__
-+      if (append_exe && 0 < cygwin_spelling (filename))
-+        CYGWIN_APPEND_EXE (name_alt, filename);
-+#endif /* __CYGWIN__ */
-     }
- 
-   if (S_ISBLK (statbuf.st_mode) || S_ISCHR (statbuf.st_mode))
-     format = format2;
- 
-   bool fail = print_it (format, fd, filename, print_stat, &statbuf);
-+#if __CYGWIN__
-+  freea (name_alt);
-+#endif /* __CYGWIN__ */
-   return ! fail;
- }
- 
-@@ -1427,6 +1461,11 @@ Display file or file system status.\n\
-                           if you want a newline, include \\n in FORMAT\n\
-   -t, --terse           print the information in terse form\n\
- "), stdout);
-+#if __CYGWIN__
-+      fputs (_("\
-+      --append-exe      append .exe if cygwin magic was needed\n\
-+"), stdout);
-+#endif /* __CYGWIN__ */
-       fputs (HELP_OPTION_DESCRIPTION, stdout);
-       fputs (VERSION_OPTION_DESCRIPTION, stdout);
- 
-@@ -1547,6 +1586,12 @@ main (int argc, char *argv[])
-           terse = true;
-           break;
- 
-+#if __CYGWIN__
-+        case APPEND_EXE_OPTION:
-+          append_exe = true;
-+          break;
-+#endif /* __CYGWIN__ */
-+
-         case_GETOPT_HELP_CHAR;
- 
-         case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 75798edf70e..c4280fbd122 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (rec {
     ./fix-chmod-exit-code.patch
     # Workaround for https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51433
     ./disable-seek-hole.patch
-  ] ++ optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
+  ];
 
   postPatch = ''
     # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
@@ -43,9 +43,6 @@ stdenv.mkDerivation (rec {
     sed '2i echo Skipping rm deep-2 test && exit 77' -i ./tests/rm/deep-2.sh
     sed '2i echo Skipping du long-from-unreadable test && exit 77' -i ./tests/du/long-from-unreadable.sh
 
-    # Depends on the mountpoints
-    sed '2i echo Skipping df df-symlink test && exit 77' -i ./tests/df/df-symlink.sh
-
     # Some target platforms, especially when building inside a container have
     # issues with the inotify test.
     sed '2i echo Skipping tail inotify dir recreate test && exit 77' -i ./tests/tail-2/inotify-dir-recreate.sh
@@ -55,8 +52,6 @@ stdenv.mkDerivation (rec {
     substituteInPlace ./tests/install/install-C.sh \
       --replace 'mode3=2755' 'mode3=1755'
 
-    sed '2i print "Skipping env -S test";  exit 77;' -i ./tests/misc/env-S.pl
-
     # Fails on systems with a rootfs. Looks like a bug in the test, see
     # https://lists.gnu.org/archive/html/bug-coreutils/2019-12/msg00000.html
     sed '2i print "Skipping df skip-rootfs test"; exit 77' -i ./tests/df/skip-rootfs.sh
@@ -69,11 +64,8 @@ stdenv.mkDerivation (rec {
       echo "int main() { return 77; }" > "$f"
     done
 
-    # tests try to access user 1000 which is forbidden in sandbox
-    sed '2i print "Skipping id uid test"; exit 77' -i ./tests/id/uid.sh
-    sed '2i print "Skipping id zero test"; exit 77' -i ./tests/id/zero.sh
-    sed '2i print "Skipping misc help-versiob test"; exit 77' -i ./tests/misc/help-version.sh
-    sed '2i print "Skipping chown separator test"; exit 77' -i ./tests/chown/separator.sh
+    # intermittent failures on builders, unknown reason
+    sed '2i echo Skipping du basic test && exit 77' -i ./tests/du/basic.sh
   '' + (optionalString (stdenv.hostPlatform.libc == "musl") (lib.concatStringsSep "\n" [
     ''
       echo "int main() { return 77; }" > gnulib-tests/test-parse-datetime.c
@@ -81,6 +73,9 @@ stdenv.mkDerivation (rec {
     ''
   ])) + (optionalString stdenv.isAarch64 ''
     sed '2i print "Skipping tail assert test"; exit 77' -i ./tests/tail-2/assert.sh
+
+    # Sometimes fails: https://github.com/NixOS/nixpkgs/pull/143097#issuecomment-954462584
+    sed '2i echo Skipping cut huge range test && exit 77' -i ./tests/misc/cut-huge-range.sh
   '');
 
   outputs = [ "out" "info" ];
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index 43c156de419..5671e73c85f 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -67,6 +67,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./bin-mv.patch
+
+    # Avoid non-determinism in autoconf build system:
+    # - build time
+    # - build user
+    # - uname -a (kernel version)
+    # Can be dropped once/if we switch to cmake.
+    ./hdf5-more-determinism.patch
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/misc/hdf5/hdf5-more-determinism.patch b/pkgs/tools/misc/hdf5/hdf5-more-determinism.patch
new file mode 100644
index 00000000000..9a9bfe24af7
--- /dev/null
+++ b/pkgs/tools/misc/hdf5/hdf5-more-determinism.patch
@@ -0,0 +1,15 @@
+diff --git a/src/libhdf5.settings.in b/src/libhdf5.settings.in
+index a4d4af6..70f1909 100644
+--- a/src/libhdf5.settings.in
++++ b/src/libhdf5.settings.in
+@@ -4,10 +4,7 @@
+ General Information:
+ -------------------
+                    HDF5 Version: @H5_VERSION@
+-                  Configured on: @CONFIG_DATE@
+-                  Configured by: @CONFIG_USER@
+                     Host system: @host_cpu@-@host_vendor@-@host_os@
+-              Uname information: @UNAME_INFO@
+                        Byte sex: @BYTESEX@
+              Installation point: @prefix@
+ 
diff --git a/pkgs/tools/misc/mandoc/default.nix b/pkgs/tools/misc/mandoc/default.nix
index db0789c1126..1771f6515bc 100644
--- a/pkgs/tools/misc/mandoc/default.nix
+++ b/pkgs/tools/misc/mandoc/default.nix
@@ -42,6 +42,8 @@ stdenv.mkDerivation rec {
     SBINDIR="$PREFIX/bin"
     CC=${stdenv.cc.targetPrefix}cc
     AR=${stdenv.cc.bintools.targetPrefix}ar
+    # Allow makewhatis(8) to follow symlinks from a manpath to the nix store
+    READ_ALLOWED_PATH=${builtins.storeDir}
     # Bypass the locale(1)-based check for UTF-8 support since it causes trouble:
     # * We only have meaningful locale(1) implementations for glibc and macOS
     # * NetBSD's locale(1) (used for macOS) depends on mandoc
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index 42d6d5da4e0..1f0e68bb9c0 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, alsa-lib, libjack2, CoreAudio, ncurses, pkg-config }:
+{ lib, stdenv, fetchurl
+, pkg-config, buildPackages
+, CoreAudio, alsa-lib, libjack2, ncurses
+}:
 
 stdenv.mkDerivation rec {
   pname = "timidity";
@@ -23,12 +26,20 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-ncurses"
+    "lib_cv_va_copy=yes"
+    "lib_cv___va_copy=yes"
   ] ++ lib.optionals stdenv.isLinux [
     "--enable-audio=oss,alsa,jack"
     "--enable-alsaseq"
     "--with-default-output=alsa"
+    "lib_cv_va_val_copy=yes"
   ] ++ lib.optionals stdenv.isDarwin [
     "--enable-audio=darwin,jack"
+    "lib_cv_va_val_copy=no"
+  ];
+
+  makeFlags = [
+    "AR=${stdenv.cc.targetPrefix}ar"
   ];
 
   NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
@@ -38,6 +49,13 @@ stdenv.mkDerivation rec {
     sha256 = "0lsh9l8l5h46z0y8ybsjd4pf6c22n33jsjvapfv3rjlfnasnqw67";
   };
 
+  preBuild = ''
+    # calcnewt has to be built with the host compiler.
+    ${buildPackages.stdenv.cc}/bin/cc -o timidity/calcnewt -lm timidity/calcnewt.c
+    # Remove dependencies of calcnewt so it doesn't try to remake it.
+    sed -i 's/^\(calcnewt\$(EXEEXT):\).*/\1/g' timidity/Makefile
+  '';
+
   # the instruments could be compressed (?)
   postInstall = ''
     mkdir -p $out/share/timidity/;
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index 7df04ac0c89..5a531bddcaf 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -24,6 +24,14 @@ stdenv.mkDerivation rec {
         url = "https://gitlab.isc.org/isc-projects/dhcp/-/commit/6c7e61578b1b449272dbb40dd8b98d03dad8a57a.patch";
         sha256 = "1g37ix0yf9zza8ri8bg438ygcjviniblfyb20y4gzc8lysy28m8b";
       })
+
+      # Fix parallel build failure, the patch is pending upstream inclusion:
+      #  https://gitlab.isc.org/isc-projects/dhcp/-/merge_requests/76
+      (fetchpatch {
+        name = "parallel-make.patch";
+        url = "https://gitlab.isc.org/isc-projects/dhcp/-/commit/46d101b97c5a3b19a3f63f7b60e5f88994a64e22.patch";
+        sha256 = "1y3nsmqjzcg4bhp1xmqp47v7rkl3bpcildkx6mlrg255yvxapmdp";
+      })
     ];
 
   nativeBuildInputs = [ perl makeWrapper ];
@@ -79,6 +87,8 @@ stdenv.mkDerivation rec {
       export AR='${stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar'
     '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Dynamic Host Configuration Protocol (DHCP) tools";
 
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index fefa80b9c4f..9d5e89980fe 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -18,10 +18,12 @@
 , libedit
 , pkg-config
 , pam
+, libredirect
 , etcDir ? null
 , withKerberos ? !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)
 , libkrb5
 , libfido2
+, hostname
 , nixosTests
 , withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl
 , linkOpenssl ? true
@@ -100,6 +102,59 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
+  doCheck = true;
+  enableParallelChecking = false;
+  checkInputs = optional (!stdenv.isDarwin) hostname;
+  preCheck = ''
+    # construct a dummy HOME
+    export HOME=$(realpath ../dummy-home)
+    mkdir -p ~/.ssh
+
+    # construct a dummy /etc/passwd file for the sshd under test
+    # to use to look up the connecting user
+    DUMMY_PASSWD=$(realpath ../dummy-passwd)
+    cat > $DUMMY_PASSWD <<EOF
+    $(whoami)::$(id -u):$(id -g)::$HOME:$SHELL
+    EOF
+
+    # we need to NIX_REDIRECTS /etc/passwd both for processes
+    # invoked directly and those invoked by the "remote" session
+    cat > ~/.ssh/environment.base <<EOF
+    NIX_REDIRECTS=/etc/passwd=$DUMMY_PASSWD
+    LD_PRELOAD=${libredirect}/lib/libredirect.so
+    EOF
+
+    # use an ssh environment file to ensure environment is set
+    # up appropriately for build environment even when no shell
+    # is invoked by the ssh session. otherwise the PATH will
+    # only contain default unix paths like /bin which we don't
+    # have in our build environment
+    cat - regress/test-exec.sh > regress/test-exec.sh.new <<EOF
+    cp $HOME/.ssh/environment.base $HOME/.ssh/environment
+    echo "PATH=\$PATH" >> $HOME/.ssh/environment
+    EOF
+    mv regress/test-exec.sh.new regress/test-exec.sh
+
+    # explicitly enable the PermitUserEnvironment feature
+    substituteInPlace regress/test-exec.sh \
+      --replace \
+        'cat << EOF > $OBJ/sshd_config' \
+        $'cat << EOF > $OBJ/sshd_config\n\tPermitUserEnvironment yes'
+
+    # some tests want to use files under /bin as example files
+    for f in regress/sftp-cmds.sh regress/forwarding.sh; do
+      substituteInPlace $f --replace '/bin' "$(dirname $(type -p ls))"
+    done
+
+    # set up NIX_REDIRECTS for direct invocations
+    set -a; source ~/.ssh/environment.base; set +a
+  '';
+  # integration tests hard to get working on darwin with its shaky
+  # sandbox
+  checkTarget = optional (!stdenv.isDarwin) "t-exec"
+    # other tests are less demanding of the environment
+    ++ [ "unit" "file-tests" "interop-tests" ];
+
   postInstall = ''
     # Install ssh-copy-id, it's very useful.
     cp contrib/ssh-copy-id $out/bin/
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index bd994c2640f..98b7b2547d6 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -12,6 +12,8 @@
 , pkg-config
 , makeWrapper
 , symlinkJoin
+, bison
+, nixosTests
   #
   # By default unbound will not be built with systemd support. Unbound is a very
   # commmon dependency. The transitive dependency closure of systemd also
@@ -91,6 +93,10 @@ stdenv.mkDerivation rec {
     sed -E '/CONFCMDLINE/ s;${storeDir}/[a-z0-9]{32}-;${storeDir}/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-;g' -i config.h
   '';
 
+  checkInputs = [ bison ];
+
+  doCheck = true;
+
   installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ];
 
   postInstall = ''
@@ -107,6 +113,9 @@ stdenv.mkDerivation rec {
       configureFlags="$configureFlags --with-nettle=${nettle.dev} --with-libunbound-only"
       configurePhase
       buildPhase
+      if [ -n "$doCheck" ]; then
+          checkPhase
+      fi
       installPhase
     ''
   # get rid of runtime dependencies on $dev outputs
@@ -115,6 +124,8 @@ stdenv.mkDerivation rec {
     (pkg: lib.optionalString (pkg ? dev) " --replace '-L${pkg.dev}/lib' '-L${pkg.out}/lib' --replace '-R${pkg.dev}/lib' '-R${pkg.out}/lib'")
     (builtins.filter (p: p != null) buildInputs);
 
+  passthru.tests = nixosTests.unbound;
+
   meta = with lib; {
     description = "Validating, recursive, and caching DNS resolver";
     license = licenses.bsd3;
diff --git a/pkgs/tools/networking/vpnc-scripts/default.nix b/pkgs/tools/networking/vpnc-scripts/default.nix
index 776e8450d13..f0d5991d34b 100644
--- a/pkgs/tools/networking/vpnc-scripts/default.nix
+++ b/pkgs/tools/networking/vpnc-scripts/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation {
   pname = "vpnc-scripts";
-  version = "unstable-2021-03-21";
+  version = "unstable-2021-09-24";
   src = fetchgit {
-    url = "git://git.infradead.org/users/dwmw2/vpnc-scripts.git";
-    rev = "8fff06090ed193c4a7285e9a10b42e6679e8ecf3";
-    sha256 = "14bzzpwz7kdmlbx825h6s4jjdml9q6ziyrq8311lp8caql68qdq1";
+    url = "https://gitlab.com/openconnect/vpnc-scripts.git";
+    rev = "b749c2cadc2f32e2efffa69302861f9a7d4a4e5f";
+    sha256 = "sha256:19aj6mfkclbkx6ycyd4xm7id1bq78ismw0y6z23f6s016k3sjc8c";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index 68bf35a751e..7177b1891f2 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,23 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, which
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, which
 , enableStatic ? stdenv.hostPlatform.isStatic
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.1";
+  version = "1.4.2";
   pname = "rhash";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "sha256-kmi1FtJYPBUdMfJlzEsQkTwcYB99isP3yzH1EYlk54g=";
+    sha256 = "sha256-HkDgWwHoRWCNtWyfP4sj3veEd+KT5J7yL4J4Z/hJcrE=";
   };
 
+  patches = lib.optionals stdenv.cc.isClang [
+    # Fix clang configuration; remove with next release
+    (fetchpatch {
+      url = "https://github.com/rhash/RHash/commit/4dc506066cf1727b021e6352535a8bb315c3f8dc.patch";
+      sha256 = "0i5jz2s37h278c8d36pzphhp8rjy660zmhpg2cqlp960f6ny8wwj";
+    })
+  ];
+
   nativeBuildInputs = [ which ];
 
   # configure script is not autotools-based, doesn't support these options
   dontAddStaticConfigureFlags = true;
+
   configurePlatforms = [ ];
+
   configureFlags = [
     "--ar=${stdenv.cc.targetPrefix}ar"
     (lib.enableFeature enableStatic "static")
@@ -28,14 +42,18 @@ stdenv.mkDerivation rec {
 
   checkTarget = "test-full";
 
-  installTargets = [ "install" "install-lib-headers" ]
-    ++ lib.optional (!enableStatic) "install-lib-so-link";
+  installTargets = [
+    "install"
+    "install-lib-headers"
+  ] ++ lib.optional (!enableStatic) [
+    "install-lib-so-link"
+  ];
 
   meta = with lib; {
     homepage = "http://rhash.sourceforge.net/";
     description = "Console utility and library for computing and verifying hash sums of files";
     license = licenses.bsd0;
     platforms = platforms.all;
-    maintainers = [ maintainers.andrewrk ];
+    maintainers = with maintainers; [ andrewrk ];
   };
 }
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 3eb9ed3000c..d66d3763c03 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -17,11 +17,11 @@ assert (doCheck && stdenv.isLinux) -> glibcLocales != null;
 
 stdenv.mkDerivation rec {
   pname = "gawk";
-  version = "5.1.0";
+  version = "5.1.1";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.xz";
-    sha256 = "1gc2cccqy1x1bf6rhwlmd8q7dz7gnam6nwgl38bxapv6qm5flpyg";
+    sha256 = "18kybw47fb1sdagav7aj95r9pp09r5gm202y3ahvwjw9dqw2jxnq";
   };
 
   # When we do build separate interactive version, it makes sense to always include man.
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index 5b158f2cbb0..cb57fb2bb07 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -55,10 +55,10 @@ stdenv.mkDerivation rec {
   # have to pass "--with-appresdir", too.
   configureFlags = [
     "--without-x"
+    "ac_cv_path_PERL=${buildPackages.perl}/bin/perl"
   ] ++ lib.optionals (ghostscript != null) [
     "--with-gs=${ghostscript}/bin/gs"
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "ac_cv_path_PERL=${buildPackages.perl}/bin/perl"
     "gl_cv_func_signbit=yes"
   ];
 
@@ -106,7 +106,6 @@ stdenv.mkDerivation rec {
     substituteInPlace $perl/bin/grog \
       --replace $out/lib/groff/grog $perl/lib/groff/grog
 
-  '' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     find $perl/ -type f -print0 | xargs --null sed -i 's|${buildPackages.perl}|${perl}|'
   '';
 
diff --git a/pkgs/tools/text/sgml/opensp/default.nix b/pkgs/tools/text/sgml/opensp/default.nix
index 6924c8953ee..d55afbc5dd9 100644
--- a/pkgs/tools/text/sgml/opensp/default.nix
+++ b/pkgs/tools/text/sgml/opensp/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, xmlto, docbook_xml_dtd_412
-, libxslt, docbook_xsl, autoconf, automake, gettext, libiconv, libtool}:
+, libxslt, docbook_xsl, autoconf, automake, gettext, libiconv, libtool
+}:
 
 stdenv.mkDerivation rec {
   pname = "opensp";
@@ -30,19 +31,25 @@ stdenv.mkDerivation rec {
     sed -i -e 's/name="idm.*"//g' $out/share/doc/OpenSP/releasenotes.html
     '';
 
-  preConfigure = if stdenv.isCygwin then "autoreconf -fi" else null;
+  preConfigure = lib.optionalString stdenv.isCygwin ''
+    autoreconf -fi
+  '';
 
-  # need autoconf, automake, gettext, and libtool for reconfigure
-  nativeBuildInputs = lib.optionals stdenv.isCygwin [ autoconf automake libtool ];
+  strictDeps = true;
 
-  buildInputs = [ xmlto docbook_xml_dtd_412 libxslt docbook_xsl gettext libiconv ];
+  nativeBuildInputs = [
+    xmlto
+    docbook_xml_dtd_412
+    docbook_xsl
+  ] ++ lib.optionals stdenv.isCygwin [ autoconf automake libtool ];
 
   doCheck = false; # fails
 
-  meta = {
+  meta = with lib; {
     description = "A suite of SGML/XML processing tools";
-    license = lib.licenses.mit;
+    license = licenses.mit;
     homepage = "http://openjade.sourceforge.net/";
-    platforms = lib.platforms.unix;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/typesetting/docbook2x/default.nix b/pkgs/tools/typesetting/docbook2x/default.nix
index aac992552d3..42ac92698b0 100644
--- a/pkgs/tools/typesetting/docbook2x/default.nix
+++ b/pkgs/tools/typesetting/docbook2x/default.nix
@@ -1,6 +1,6 @@
 { fetchurl, lib, stdenv, texinfo, perlPackages
 , groff, libxml2, libxslt, gnused, libiconv, opensp
-, docbook_xml_dtd_43
+, docbook_xml_dtd_43, bash
 , makeWrapper }:
 
 stdenv.mkDerivation rec {
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
   # writes its output to stdout instead of creating a file.
   patches = [ ./db2x_texixml-to-stdout.patch ];
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ texinfo groff libxml2 libxslt opensp libiconv ]
+  nativeBuildInputs = [ makeWrapper perlPackages.perl texinfo libxslt ];
+  buildInputs = [ groff libxml2 opensp libiconv bash ]
     ++ (with perlPackages; [ perl XMLSAX XMLParser XMLNamespaceSupport ]);
 
   postConfigure = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 99e365540a5..e0939aafba8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -227,6 +227,7 @@ mapAliases ({
   emacsPackages = emacs.pkgs; # added 2020-12-18
   enblendenfuse = enblend-enfuse; # 2015-09-30
   envelope = throw "envelope has been removed from nixpkgs, as it was unmaintained."; # added 2021-08-05
+  epoxy = libepoxy; # 2021-11-11
   esniper = throw "esniper has been removed because upstream no longer maintains it (and it no longer works)"; # added 2021-04-12
   evolution_data_server = evolution-data-server; # added 2018-02-25
   etcdctl = etcd; # added 2018-04-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index eaf92ebfeff..658913a445d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5946,7 +5946,7 @@ with pkgs;
   };
 
   graphviz-nox = graphviz.override {
-    xorg = null;
+    withXorg = false;
     libdevil = libdevil-nox;
   };
 
@@ -16102,7 +16102,7 @@ with pkgs;
 
   entt = callPackage ../development/libraries/entt { };
 
-  epoxy = callPackage ../development/libraries/epoxy {};
+  libepoxy = callPackage ../development/libraries/libepoxy {};
 
   libesmtp = callPackage ../development/libraries/libesmtp { };
 
@@ -21752,7 +21752,7 @@ with pkgs;
 
   iucode-tool = callPackage ../os-specific/linux/microcode/iucode-tool.nix { };
 
-  inherit (callPackages ../os-specific/linux/apparmor { python = python3; })
+  inherit (callPackages ../os-specific/linux/apparmor { })
     libapparmor apparmor-utils apparmor-bin-utils apparmor-parser apparmor-pam
     apparmor-profiles apparmor-kernel-patches apparmorRulesFromClosure;
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3b427030756..70b7926d30e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8046,6 +8046,11 @@ let
     };
     nativeBuildInputs = [ buildPackages.pkg-config ];
     propagatedBuildInputs = [ pkgs.pkg-config ];
+    postPatch = ''
+      # no pkg-config binary when cross-compiling so the check fails
+      substituteInPlace Makefile.PL \
+        --replace "pkg-config" "$PKG_CONFIG"
+    '';
     doCheck = false; # expects test_glib-2.0.pc in PKG_CONFIG_PATH
     meta = {
       homepage = "http://gtk2-perl.sourceforge.net";
@@ -24561,6 +24566,7 @@ let
       })
     ];
     AUTOMATED_TESTING = false;
+    nativeBuildInputs = [ pkgs.pkg-config ];
     buildInputs = [ pkgs.xorg.libxcb pkgs.xorg.xcbproto pkgs.xorg.xcbutil pkgs.xorg.xcbutilwm ExtUtilsDepends ExtUtilsPkgConfig TestDeep TestException XSObjectMagic ];
     propagatedBuildInputs = [ DataDump MouseXNativeTraits XMLDescent XMLSimple ];
     NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index eb9e8bf2ec5..575524df518 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -295,9 +295,7 @@ in {
 
   aiohomekit = callPackage ../development/python-modules/aiohomekit { };
 
-  aiohttp = callPackage ../development/python-modules/aiohttp {
-    pytestCheckHook = self.pytestCheckHook_6_1;
-  };
+  aiohttp = callPackage ../development/python-modules/aiohttp { };
 
   aiohttp-cors = callPackage ../development/python-modules/aiohttp-cors { };
 
@@ -6232,7 +6230,7 @@ in {
   pybullet = callPackage ../development/python-modules/pybullet { };
 
   pycairo = callPackage ../development/python-modules/pycairo {
-    inherit (pkgs) meson;
+    inherit (pkgs.buildPackages) meson;
   };
 
   pycallgraph = callPackage ../development/python-modules/pycallgraph { };
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 56b39b5087a..f9f9dc3bdb6 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -425,7 +425,7 @@ with self; with super; {
   pyblosxom = callPackage ../development/python-modules/pyblosxom { };
 
   pycairo = callPackage ../development/python-modules/pycairo/1.18.nix {
-    inherit (pkgs) meson;
+    inherit (pkgs.buildPackages) meson;
   };
 
   pycangjie = disabled pycangjie;