summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/editors/emacs/generic.nix4
-rw-r--r--pkgs/applications/graphics/fbida/default.nix4
-rw-r--r--pkgs/applications/science/math/glsurf/default.nix12
-rw-r--r--pkgs/applications/window-managers/icewm/default.nix4
-rw-r--r--pkgs/applications/window-managers/windowmaker/default.nix4
-rw-r--r--pkgs/desktops/gnustep/base/default.nix4
-rw-r--r--pkgs/desktops/gnustep/default.nix3
-rw-r--r--pkgs/desktops/plasma-5/fetch.sh2
-rw-r--r--pkgs/desktops/plasma-5/srcs.nix416
-rw-r--r--pkgs/development/compilers/gcc/10/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/8/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix3
-rw-r--r--pkgs/development/compilers/gcc/common/configure-flags.nix15
-rw-r--r--pkgs/development/compilers/llvm/7/clang/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/7/clang/unwindlib.patch227
-rw-r--r--pkgs/development/compilers/llvm/7/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/7/libc++/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/7/libc++abi/default.nix16
-rw-r--r--pkgs/development/compilers/llvm/7/libunwind/default.nix33
-rw-r--r--pkgs/development/interpreters/lua-5/default.nix28
-rw-r--r--pkgs/development/interpreters/lua-5/interpreter.nix34
-rw-r--r--pkgs/development/interpreters/lua-5/liblua.so.patch60
-rw-r--r--pkgs/development/interpreters/lua-5/lua-dso.make (renamed from pkgs/development/interpreters/lua-5/lua-5.3-dso.make)6
-rw-r--r--pkgs/development/libraries/SDL2_image/default.nix4
-rw-r--r--pkgs/development/libraries/SDL_image/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg-full/default.nix16
-rw-r--r--pkgs/development/libraries/ffmpeg/3.4.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix8
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix3
-rw-r--r--pkgs/development/libraries/giflib/libungif.nix17
-rw-r--r--pkgs/development/libraries/glib/default.nix14
-rw-r--r--pkgs/development/libraries/glibc/2.32-master.patch.gzbin58063 -> 65492 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/imlib/default.nix18
-rw-r--r--pkgs/development/libraries/json-glib/default.nix21
-rw-r--r--pkgs/development/libraries/openssl/default.nix8
-rw-r--r--pkgs/development/libraries/plasma-wayland-protocols/default.nix6
-rw-r--r--pkgs/development/libraries/protobuf/3.15.nix4
-rw-r--r--pkgs/development/libraries/pslib/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/qtModule.nix11
-rw-r--r--pkgs/development/libraries/re2/default.nix8
-rw-r--r--pkgs/development/libraries/tk/generic.nix6
-rw-r--r--pkgs/development/ocaml-modules/camlimages/4.0.nix41
-rw-r--r--pkgs/development/ocaml-modules/camlimages/4.1.2.nix37
-rw-r--r--pkgs/development/python-modules/infoqscraper/default.nix3
-rw-r--r--pkgs/development/python-modules/matplotlib/2.nix19
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix38
-rw-r--r--pkgs/development/python-modules/matplotlib/setup-darwin.cfg7
-rw-r--r--pkgs/development/python-modules/matplotlib/setup.cfg5
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix6
-rw-r--r--pkgs/development/tools/documentation/gtk-doc/default.nix7
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix17
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix10
-rw-r--r--pkgs/development/tools/parsing/re2c/default.nix40
-rw-r--r--pkgs/os-specific/bsd/netbsd/builder.sh3
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix85
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix16
-rw-r--r--pkgs/os-specific/darwin/spacebar/default.nix4
-rw-r--r--pkgs/os-specific/linux/libselinux/default.nix5
-rw-r--r--pkgs/tools/graphics/fbv/default.nix21
-rw-r--r--pkgs/tools/misc/fontforge/default.nix4
-rw-r--r--pkgs/tools/networking/curl/7.74.0-CVE-2021-22876.patch139
-rw-r--r--pkgs/tools/networking/curl/7.74.0-CVE-2021-22890.patch473
-rw-r--r--pkgs/tools/networking/curl/default.nix9
-rw-r--r--pkgs/tools/text/diffutils/default.nix5
-rw-r--r--pkgs/tools/video/swftools/default.nix26
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix10
-rw-r--r--pkgs/top-level/ocaml-packages.nix5
73 files changed, 892 insertions, 1208 deletions
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 6726790d50f..b093c7e0529 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -7,7 +7,7 @@
   , patches ? [ ]
 }:
 { stdenv, lib, fetchurl, fetchpatch, ncurses, xlibsWrapper, libXaw, libXpm
-, Xaw3d, libXcursor,  pkg-config, gettext, libXft, dbus, libpng, libjpeg, libungif
+, Xaw3d, libXcursor,  pkg-config, gettext, libXft, dbus, libpng, libjpeg, giflib
 , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
 , alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
 , jansson, harfbuzz
@@ -108,7 +108,7 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
     [ ncurses gconf libxml2 gnutls alsaLib acl gpm gettext jansson harfbuzz.dev ]
     ++ lib.optionals stdenv.isLinux [ dbus libselinux systemd ]
     ++ lib.optionals withX
-      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff libXft
+      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg giflib libtiff libXft
         gconf cairo ]
     ++ lib.optionals (withX || withNS) [ librsvg ]
     ++ lib.optionals withImageMagick [ imagemagick ]
diff --git a/pkgs/applications/graphics/fbida/default.nix b/pkgs/applications/graphics/fbida/default.nix
index 9ed6ee75159..f2d2e267595 100644
--- a/pkgs/applications/graphics/fbida/default.nix
+++ b/pkgs/applications/graphics/fbida/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libjpeg, libexif, libungif, libtiff, libpng, libwebp, libdrm
+{ lib, stdenv, fetchurl, libjpeg, libexif, giflib, libtiff, libpng, libwebp, libdrm
 , pkg-config, freetype, fontconfig, which, imagemagick, curl, sane-backends, libXpm
 , epoxy, poppler, mesa, lirc }:
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config which ];
   buildInputs = [
-    libexif libjpeg libpng libungif freetype fontconfig libtiff libwebp
+    libexif libjpeg libpng giflib freetype fontconfig libtiff libwebp
     imagemagick curl sane-backends libdrm libXpm epoxy poppler lirc
     mesa
   ];
diff --git a/pkgs/applications/science/math/glsurf/default.nix b/pkgs/applications/science/math/glsurf/default.nix
index 599d4bac8e7..208bb95f930 100644
--- a/pkgs/applications/science/math/glsurf/default.nix
+++ b/pkgs/applications/science/math/glsurf/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, ocamlPackages, libGLU, libGL, freeglut
-, libmysqlclient, mpfr, gmp, libtiff, libjpeg, libpng, giflib
+{ lib, stdenv, fetchurl, ocamlPackages, libGLU, libGL, freeglut, giflib
+, libmysqlclient, mpfr, gmp, libtiff, libjpeg, libpng
 }:
 
 stdenv.mkDerivation {
@@ -10,10 +10,10 @@ stdenv.mkDerivation {
     sha256 = "0w8xxfnw2snflz8wdr2ca9f5g91w5vbyp1hwlx1v7vg83d4bwqs7";
   };
 
-  buildInputs = [ freeglut libGLU libGL libmysqlclient mpfr gmp
-    libtiff libjpeg libpng giflib ]
+  buildInputs = [ freeglut libGLU libGL libmysqlclient mpfr giflib gmp
+    libtiff libjpeg libpng ]
   ++ (with ocamlPackages; [
-    ocaml findlib ocaml_mysql lablgl camlimages_4_0 mlgmpidl
+    ocaml findlib ocaml_mysql lablgl camlimages_4_1_2 mlgmpidl
   ]);
 
   installPhase = ''
@@ -26,6 +26,6 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://raffalli.eu/~christophe/glsurf/";
     description = "A program to draw implicit surfaces and curves";
-    license = lib.licenses.lgpl21;
+    license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index 8f1a920296a..b24aa24222b 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -30,7 +30,7 @@
 , libpthreadstubs
 , libsndfile
 , libtiff
-, libungif
+, giflib
 , libxcb
 , mkfontdir
 , pcre
@@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
     libpthreadstubs
     libsndfile
     libtiff
-    libungif
+    giflib
     libxcb
     mkfontdir
     pcre
diff --git a/pkgs/applications/window-managers/windowmaker/default.nix b/pkgs/applications/window-managers/windowmaker/default.nix
index e56ff2512c1..8c354c616fd 100644
--- a/pkgs/applications/window-managers/windowmaker/default.nix
+++ b/pkgs/applications/window-managers/windowmaker/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config
 , libX11, libXext, libXft, libXmu, libXinerama, libXrandr, libXpm
-, imagemagick, libpng, libjpeg, libexif, libtiff, libungif, libwebp }:
+, imagemagick, libpng, libjpeg, libexif, libtiff, giflib, libwebp }:
 
 stdenv.mkDerivation rec {
   pname = "windowmaker";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ libX11 libXext libXft libXmu libXinerama libXrandr libXpm
-                  imagemagick libpng libjpeg libexif libtiff libungif libwebp ];
+                  imagemagick libpng libjpeg libexif libtiff giflib libwebp ];
 
   configureFlags = [
     "--with-x"
diff --git a/pkgs/desktops/gnustep/base/default.nix b/pkgs/desktops/gnustep/base/default.nix
index 8fe232dff7b..e661dae9099 100644
--- a/pkgs/desktops/gnustep/base/default.nix
+++ b/pkgs/desktops/gnustep/base/default.nix
@@ -4,7 +4,7 @@
 , fetchurl, fetchpatch
 , gmp, gnutls
 , libffi, binutils-unwrapped
-, libjpeg, libtiff, libpng, giflib, libungif
+, libjpeg, libtiff, libpng, giflib
 , libxml2, libxslt, libiconv
 , libobjc, libgcrypt
 , icu
@@ -26,7 +26,7 @@ gsmakeDerivation {
     cups
     gmp gnutls
     libffi binutils-unwrapped
-    libjpeg libtiff libpng giflib libungif
+    libjpeg libtiff libpng giflib giflib
     libxml2 libxslt libiconv
     libobjc libgcrypt
     icu
diff --git a/pkgs/desktops/gnustep/default.nix b/pkgs/desktops/gnustep/default.nix
index abbabd4abf2..d337512dcec 100644
--- a/pkgs/desktops/gnustep/default.nix
+++ b/pkgs/desktops/gnustep/default.nix
@@ -1,6 +1,5 @@
 { newScope
 , llvmPackages
-, giflib_4_1
 }:
 
 let
@@ -16,7 +15,7 @@ let
     libobjc = callPackage ./libobjc2 {};
     make = callPackage ./make {};
     back = callPackage ./back {};
-    base = callPackage ./base { giflib = giflib_4_1; };
+    base = callPackage ./base { };
     gui = callPackage ./gui {};
     gworkspace = callPackage ./gworkspace {};
   };
diff --git a/pkgs/desktops/plasma-5/fetch.sh b/pkgs/desktops/plasma-5/fetch.sh
index 10214b3fe23..398f9a1b97d 100644
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.21.3/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.21.4/ -A '*.tar.xz' )
diff --git a/pkgs/desktops/plasma-5/srcs.nix b/pkgs/desktops/plasma-5/srcs.nix
index bf93e0564d9..8fa7ba91c6a 100644
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@@ -4,419 +4,419 @@
 
 {
   bluedevil = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/bluedevil-5.21.3.tar.xz";
-      sha256 = "1xqm4bn97asilc4yw5rvmmhk7c7wvmbalalr6gz8gw4gv0pg67qv";
-      name = "bluedevil-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/bluedevil-5.21.4.tar.xz";
+      sha256 = "0ls6ijk10pgi75ycwcnq3z4j5hn657cnr4s7fky53qkc3y2x25g1";
+      name = "bluedevil-5.21.4.tar.xz";
     };
   };
   breeze = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-5.21.3.tar.xz";
-      sha256 = "0frm3f8q1n0pdzjk7zwmvlrl19fb9265ihnnfhak6ckaq50x72l3";
-      name = "breeze-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-5.21.4.tar.xz";
+      sha256 = "1n6hwppcbnn3hw5r3f9jssvslnming9qvs4s2czyl0kky1nv8bfm";
+      name = "breeze-5.21.4.tar.xz";
     };
   };
   breeze-grub = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-grub-5.21.3.tar.xz";
-      sha256 = "1j0pk4pv5pxwhwah1gd5znnsw3j15x2sc74pp6zinz9a1ywjklnz";
-      name = "breeze-grub-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-grub-5.21.4.tar.xz";
+      sha256 = "1jd8fy9b5cmv1da27xqbl6x3197pq6m4wwxzylxgnmciivhmnzm2";
+      name = "breeze-grub-5.21.4.tar.xz";
     };
   };
   breeze-gtk = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-gtk-5.21.3.tar.xz";
-      sha256 = "1x5by915lfhbkhgrhy3lkwg64skwdlqaxzbq92x0m9v9a9agwidc";
-      name = "breeze-gtk-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-gtk-5.21.4.tar.xz";
+      sha256 = "03aj8rxh46j663m26jsb9hrg0x5j0hvzjqwc8l1ayfcwkdgl4b4i";
+      name = "breeze-gtk-5.21.4.tar.xz";
     };
   };
   breeze-plymouth = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/breeze-plymouth-5.21.3.tar.xz";
-      sha256 = "01ida3pfj6g1igndjfjpv16199zysgxlxlnc7vsx7kr8aval8pmx";
-      name = "breeze-plymouth-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/breeze-plymouth-5.21.4.tar.xz";
+      sha256 = "0ibwl2aikh547k851pb78216v8ld5la9xg3f9945dcbf7ly88nd7";
+      name = "breeze-plymouth-5.21.4.tar.xz";
     };
   };
   discover = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/discover-5.21.3.tar.xz";
-      sha256 = "170kxhrwj4mvj5qg7cyz3sxdfyp7rr4pgsi3v7kahs19a9w3isnx";
-      name = "discover-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/discover-5.21.4.tar.xz";
+      sha256 = "1f3hvafyf2kga1ywn5aia37xxgagx6p2b43h7ap7mjkmw7ywyr30";
+      name = "discover-5.21.4.tar.xz";
     };
   };
   drkonqi = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/drkonqi-5.21.3.tar.xz";
-      sha256 = "1hq37vi0vndhy66labspm75blicx1g4q594wxfxzl076mav5jds4";
-      name = "drkonqi-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/drkonqi-5.21.4.tar.xz";
+      sha256 = "123l0hyyzskjivasp1q8w9y2f2mbjrwjap3yfi23h98zbzcblcaq";
+      name = "drkonqi-5.21.4.tar.xz";
     };
   };
   kactivitymanagerd = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kactivitymanagerd-5.21.3.tar.xz";
-      sha256 = "1x5p6rbjf9kz07r5mrkiglvbigvk5bfx8qpb8l2vagsbvlg298c3";
-      name = "kactivitymanagerd-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kactivitymanagerd-5.21.4.tar.xz";
+      sha256 = "0waawpy5pqllj8iacrxpwsnz4m1yy7z8jih63s7psgr22cbvd116";
+      name = "kactivitymanagerd-5.21.4.tar.xz";
     };
   };
   kde-cli-tools = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kde-cli-tools-5.21.3.tar.xz";
-      sha256 = "0hkmr3zxg4np1ppsgj77ijgkwgvl7d0zxwl46xjc2px877lx8bpp";
-      name = "kde-cli-tools-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kde-cli-tools-5.21.4.tar.xz";
+      sha256 = "1hvfb0qg6hxbyih665xwki8gbxjljgbw6x2blh2cikp7df66nhh1";
+      name = "kde-cli-tools-5.21.4.tar.xz";
     };
   };
   kdecoration = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kdecoration-5.21.3.tar.xz";
-      sha256 = "06a3gsf1lyjxccjzn0ad254wsf7x2bln2i6kyk5j4gwqss6lplf5";
-      name = "kdecoration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kdecoration-5.21.4.tar.xz";
+      sha256 = "003yp803gnsszlnbw1lbh043h8xlrrzg92v7vls8k5cb04ib0p8a";
+      name = "kdecoration-5.21.4.tar.xz";
     };
   };
   kde-gtk-config = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kde-gtk-config-5.21.3.tar.xz";
-      sha256 = "17fyan2jah059kj1i0sy7h901a4d2k7cc87sd84mskyys7g8vs1h";
-      name = "kde-gtk-config-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kde-gtk-config-5.21.4.tar.xz";
+      sha256 = "0g7h1l5q9hdi2iq1kh5aclxjw1ffpq1l020p37k7f251m49440y8";
+      name = "kde-gtk-config-5.21.4.tar.xz";
     };
   };
   kdeplasma-addons = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kdeplasma-addons-5.21.3.tar.xz";
-      sha256 = "1181ax96csn4170p5blvhr679d7l865nby5a66swscyl3a5ys8b1";
-      name = "kdeplasma-addons-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kdeplasma-addons-5.21.4.tar.xz";
+      sha256 = "18jny36w6zf4nfqffaqgmdgp4vcaa2civnd2lrrls8jhlz81grid";
+      name = "kdeplasma-addons-5.21.4.tar.xz";
     };
   };
   kgamma5 = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kgamma5-5.21.3.tar.xz";
-      sha256 = "0h8rwwd6lyfzmxsr5sfvllh1j8gk1pbq1w2fva8q534qrkqhqb49";
-      name = "kgamma5-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kgamma5-5.21.4.tar.xz";
+      sha256 = "1rzn3d7i2i4bba9nfydbsvjqc7wzfz9lgd7qg74k19hzmfiqfhsl";
+      name = "kgamma5-5.21.4.tar.xz";
     };
   };
   khotkeys = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/khotkeys-5.21.3.tar.xz";
-      sha256 = "1n3ahrb5mzrxap572ydal1sy5q71af97iy4i2fwbljdb6zb1l1bl";
-      name = "khotkeys-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/khotkeys-5.21.4.tar.xz";
+      sha256 = "05k6b8zilll97s14s50x27dk8p4lzmld95gzgrsv4i81jdvjgx53";
+      name = "khotkeys-5.21.4.tar.xz";
     };
   };
   kinfocenter = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kinfocenter-5.21.3.tar.xz";
-      sha256 = "1hj4mnx2mxb1ya7la05frx5c39cp3q7c5f78lnp6p8bkv3ylik72";
-      name = "kinfocenter-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kinfocenter-5.21.4.tar.xz";
+      sha256 = "150kfx4cb10zjsaqkyidh1qis5644849xfqfnd5ldwsn07nkyp1y";
+      name = "kinfocenter-5.21.4.tar.xz";
     };
   };
   kmenuedit = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kmenuedit-5.21.3.tar.xz";
-      sha256 = "0fc3sal11amaj5ydws86hdmc45zhrxkv6lc5sfy200wvff3ynjjj";
-      name = "kmenuedit-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kmenuedit-5.21.4.tar.xz";
+      sha256 = "1hmqji2ahkw3knv7pcj5m86zlmxmbsz98xv2igdx2gv6hrjbn8nh";
+      name = "kmenuedit-5.21.4.tar.xz";
     };
   };
   kscreen = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kscreen-5.21.3.tar.xz";
-      sha256 = "1f9gxdlj883ddmc1xgd1nmm8n6m5yd269kfx3m9bbp61cw4hrqlm";
-      name = "kscreen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kscreen-5.21.4.tar.xz";
+      sha256 = "1n9ymmysdfipwwi3f6ixg1kh3pkbp5wvi2y8fli0cpjdbrfj5lfr";
+      name = "kscreen-5.21.4.tar.xz";
     };
   };
   kscreenlocker = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kscreenlocker-5.21.3.tar.xz";
-      sha256 = "1hjlpwwca9nrdwgsiy5ss5ainr1fy1wfvi4g599cvijb77qc84h0";
-      name = "kscreenlocker-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kscreenlocker-5.21.4.tar.xz";
+      sha256 = "1z94p93khl2b8zz965d6wdd4vi1q60f0s2a7ca9ph06gp8d574k4";
+      name = "kscreenlocker-5.21.4.tar.xz";
     };
   };
   ksshaskpass = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/ksshaskpass-5.21.3.tar.xz";
-      sha256 = "16c2kzdmw3viphaygdff29cvi06r53ag4a6hkxw15yrscw31n3ns";
-      name = "ksshaskpass-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/ksshaskpass-5.21.4.tar.xz";
+      sha256 = "0zj4160xs940b9rin43b0a3j6czm3n04drg484y1h2mfqjflgc61";
+      name = "ksshaskpass-5.21.4.tar.xz";
     };
   };
   ksysguard = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/ksysguard-5.21.3.tar.xz";
-      sha256 = "0ys1idjqb9n67czdhlds6mhhiizxq8qq4rmds9nq8cm961g5kqsf";
-      name = "ksysguard-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/ksysguard-5.21.4.tar.xz";
+      sha256 = "10p5bb80rcawd0qdm4f17whmqrfhzhv6hd20d57f1i9m7ijq456d";
+      name = "ksysguard-5.21.4.tar.xz";
     };
   };
   kwallet-pam = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwallet-pam-5.21.3.tar.xz";
-      sha256 = "1dnni2k4ry11mfjnfc0i44zww3glhsbr70qnpkl9dsf5rj4dcwj3";
-      name = "kwallet-pam-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwallet-pam-5.21.4.tar.xz";
+      sha256 = "0s3wy9qikciblr6g98kn6s4ii5pnqwcngzng0czr3r4p90w33kkg";
+      name = "kwallet-pam-5.21.4.tar.xz";
     };
   };
   kwayland-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwayland-integration-5.21.3.tar.xz";
-      sha256 = "0kqw5dbsxmdm5fi34yq718ngkx5j23211jh4l9vl029qgbi42xhc";
-      name = "kwayland-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwayland-integration-5.21.4.tar.xz";
+      sha256 = "1r3fmmzmdyfdam4hsjvjv3wss5zvyi674xsyn6csclmq3jwfz70k";
+      name = "kwayland-integration-5.21.4.tar.xz";
     };
   };
   kwayland-server = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwayland-server-5.21.3.tar.xz";
-      sha256 = "0d3asblzz9c7cbjfdk33z26hn5n14rdrc3s9jm9awvcc1sd122a4";
-      name = "kwayland-server-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwayland-server-5.21.4.tar.xz";
+      sha256 = "1mkivw3siyxhgyhrm6fkqmp2wiswckrb433q87dh1j9gp7kg8cpz";
+      name = "kwayland-server-5.21.4.tar.xz";
     };
   };
   kwin = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwin-5.21.3.tar.xz";
-      sha256 = "0ni0ipfm0hp90sq03m1a5lm6shxb2cf9j1a4kiqpaf7n62ch8f3w";
-      name = "kwin-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwin-5.21.4.tar.xz";
+      sha256 = "0br3hxnbqm2vyxcxind01784zd88bkhpz6ira03g3gjq7hlwzjx9";
+      name = "kwin-5.21.4.tar.xz";
     };
   };
   kwrited = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/kwrited-5.21.3.tar.xz";
-      sha256 = "01nn94qmi8q38rdv694d9qs7zahsziclmkw49zy0wlffq4ivpk6x";
-      name = "kwrited-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/kwrited-5.21.4.tar.xz";
+      sha256 = "1hrsy1r7b7sgnj0l8zn1yxlrfhrrbk8rq2frbfi329fk3psca247";
+      name = "kwrited-5.21.4.tar.xz";
     };
   };
   libkscreen = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/libkscreen-5.21.3.tar.xz";
-      sha256 = "1j2d1xpn48ks0wk9vvnvj9r03bc0ggrqvblyhs30p31svfihjs3a";
-      name = "libkscreen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/libkscreen-5.21.4.tar.xz";
+      sha256 = "0b0mlc1lzfbkpzxs8rd7s7q5xmqla6p1q1jdnjxly3wj60pas2dc";
+      name = "libkscreen-5.21.4.tar.xz";
     };
   };
   libksysguard = {
-    version = "5.21.3.1";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/libksysguard-5.21.3.1.tar.xz";
-      sha256 = "0nayjihapn71wrnzfb4wv9laafysl0x6sn98sbwhclapbdvxnw73";
-      name = "libksysguard-5.21.3.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/libksysguard-5.21.4.tar.xz";
+      sha256 = "0sziqldjwcwpblkn7mn4w9xg34lv9pzdlc87andka4g1lxcln2gc";
+      name = "libksysguard-5.21.4.tar.xz";
     };
   };
   milou = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/milou-5.21.3.tar.xz";
-      sha256 = "0qbk0y783n7f7pl0akx252vyblrrgmsg5yr7ncaijq4x4l90f1yf";
-      name = "milou-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/milou-5.21.4.tar.xz";
+      sha256 = "0y6mvzc5prgg1n7z2gzv1b7ngh0fygggrhdbk5wvpy6zp8yanwka";
+      name = "milou-5.21.4.tar.xz";
     };
   };
   oxygen = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/oxygen-5.21.3.tar.xz";
-      sha256 = "16yj1qx4mbi62brkn8wkcr6sz5dkbl2pf49zc1hadnxfm9wd3z0a";
-      name = "oxygen-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/oxygen-5.21.4.tar.xz";
+      sha256 = "1d7cdpy3k7zyg3k6n6jz2473cqhbi7npgnpka4kc2lfjrkb9s0zj";
+      name = "oxygen-5.21.4.tar.xz";
     };
   };
   plasma-browser-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-browser-integration-5.21.3.tar.xz";
-      sha256 = "1hz996lv3vvp1zldzpkb9dmvnn94v69j2vq9sfs446c25ggf9d6y";
-      name = "plasma-browser-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-browser-integration-5.21.4.tar.xz";
+      sha256 = "14yna45ykfa88a17iy4c5qkd673ay818693qqn13s4zwkxriby3n";
+      name = "plasma-browser-integration-5.21.4.tar.xz";
     };
   };
   plasma-desktop = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-desktop-5.21.3.tar.xz";
-      sha256 = "0bryk523qfzb5max1h460d67ir6xbrsws9bq72bdfbv1wkv64kyy";
-      name = "plasma-desktop-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-desktop-5.21.4.tar.xz";
+      sha256 = "1drv50601030xvskkw1pa5hi5ngrx2i8lkj7m8i9pym8zy15qqy9";
+      name = "plasma-desktop-5.21.4.tar.xz";
     };
   };
   plasma-disks = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-disks-5.21.3.tar.xz";
-      sha256 = "18a7dppfhb2wpb7sfhnayq96bxjlzygdz7sppcjikxil8klhv1aq";
-      name = "plasma-disks-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-disks-5.21.4.tar.xz";
+      sha256 = "1hjihh088v1w03lpz5pcz6pycbpd8b8kh54a44pq7zkhh6l6n65g";
+      name = "plasma-disks-5.21.4.tar.xz";
     };
   };
   plasma-firewall = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-firewall-5.21.3.tar.xz";
-      sha256 = "0bzmcakzwiimc90bbpih1z5isrcfhdfwlslp4q3v3npppnivv9bw";
-      name = "plasma-firewall-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-firewall-5.21.4.tar.xz";
+      sha256 = "1in9maphksc7ajj6jhy0qxgw5f7fy4m23dpik6wvxc5r3v5b76z7";
+      name = "plasma-firewall-5.21.4.tar.xz";
     };
   };
   plasma-integration = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-integration-5.21.3.tar.xz";
-      sha256 = "09dlbfildd8wl0nbss84yibljyl6cadx95q8q4n0c5wymyc4zqy1";
-      name = "plasma-integration-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-integration-5.21.4.tar.xz";
+      sha256 = "0bj2k5c4170apy7ascfdqc052jm35pi2w5zb3m39qb5b7ylq1hhw";
+      name = "plasma-integration-5.21.4.tar.xz";
     };
   };
   plasma-nano = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-nano-5.21.3.tar.xz";
-      sha256 = "1yqn29769nnfhiyqbpv15c0zxvkfzq4yvk9x9qlchbcwjc1gr23j";
-      name = "plasma-nano-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-nano-5.21.4.tar.xz";
+      sha256 = "0v5vr5di9bk57g2xi442qj8yv9219mdpc0l0n2bsvbb8x4f0d5qk";
+      name = "plasma-nano-5.21.4.tar.xz";
     };
   };
   plasma-nm = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-nm-5.21.3.tar.xz";
-      sha256 = "0d7v757kzd0pcvlz201m0njcz9y8j0bqkwbzdz3gik9s7x6rl73p";
-      name = "plasma-nm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-nm-5.21.4.tar.xz";
+      sha256 = "1gy1drykjyipmrpqbb7yk2232g5hzy316gkmr45invgfg3fizl73";
+      name = "plasma-nm-5.21.4.tar.xz";
     };
   };
   plasma-pa = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-pa-5.21.3.tar.xz";
-      sha256 = "16z9xzn5swrzz86yd8lykjphs92ghdsahfxjv0v9nj3ca24kfibp";
-      name = "plasma-pa-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-pa-5.21.4.tar.xz";
+      sha256 = "1rcghgqvasldmpianxhn980kc3nw1knmdlmxz52kngnpnimmqmz9";
+      name = "plasma-pa-5.21.4.tar.xz";
     };
   };
   plasma-phone-components = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-phone-components-5.21.3.tar.xz";
-      sha256 = "1dhv0gdyk47dl8il6zwjdz84jmz2d4ppfyifzc2rzf0ys934scn0";
-      name = "plasma-phone-components-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-phone-components-5.21.4.tar.xz";
+      sha256 = "08dpch4c6q59c9ys4n4w1hky09886hi1wqxgwwr4lyp02g3xmwbd";
+      name = "plasma-phone-components-5.21.4.tar.xz";
     };
   };
   plasma-sdk = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-sdk-5.21.3.tar.xz";
-      sha256 = "0asbb7j5b8c4kixw1yf7mdfyd8gjrf57gdb2wfs1npasak0dw84w";
-      name = "plasma-sdk-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-sdk-5.21.4.tar.xz";
+      sha256 = "1cn0lq3d5ipmlwkjzarm7s5ipx6ybjv9cz93pnpxkfxlbi47q0s0";
+      name = "plasma-sdk-5.21.4.tar.xz";
     };
   };
   plasma-systemmonitor = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-systemmonitor-5.21.3.tar.xz";
-      sha256 = "1w1xzqmpzk016f8rkyx6cvm6lng3h177c441hird13n6v147l7ll";
-      name = "plasma-systemmonitor-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-systemmonitor-5.21.4.tar.xz";
+      sha256 = "16mrq66qripffnj4gskzb6l52hqw9siqr8cwxq618cwk5g7hg544";
+      name = "plasma-systemmonitor-5.21.4.tar.xz";
     };
   };
   plasma-tests = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-tests-5.21.3.tar.xz";
-      sha256 = "000iwijpxxicixy5zbbgfs96h988x1d4wvjw90vagjw4hj361dk8";
-      name = "plasma-tests-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-tests-5.21.4.tar.xz";
+      sha256 = "0mxl3laym3wlhqnq7pmjm1g9mm0r306dnsr3yjl5mmhdx3dwb165";
+      name = "plasma-tests-5.21.4.tar.xz";
     };
   };
   plasma-thunderbolt = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-thunderbolt-5.21.3.tar.xz";
-      sha256 = "1j0nb9p5wbgksxy19bxsz9ni9ys40r4arvs8rl8pvvv9hndqhndm";
-      name = "plasma-thunderbolt-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-thunderbolt-5.21.4.tar.xz";
+      sha256 = "10r90hjm1ykigy587kdna6cydbbh9y4h7rbifx2r5rjzkhp9mihd";
+      name = "plasma-thunderbolt-5.21.4.tar.xz";
     };
   };
   plasma-vault = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-vault-5.21.3.tar.xz";
-      sha256 = "1q59q6y8gx4qbp1a5nbsg8zmrdljacfqd3i5n214nlj6al13sg9j";
-      name = "plasma-vault-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-vault-5.21.4.tar.xz";
+      sha256 = "13d4z2g34skhw11wykhwyigdzxpa12pgq01i30km5cyp0idi6xy5";
+      name = "plasma-vault-5.21.4.tar.xz";
     };
   };
   plasma-workspace = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-workspace-5.21.3.tar.xz";
-      sha256 = "1djanxc7mslw9hnbzlngf6pflc6byjzqb14ibilg3fxsir2jwq40";
-      name = "plasma-workspace-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-workspace-5.21.4.tar.xz";
+      sha256 = "1m98ssdq4vzhlqazd87qmgryi3fhmp68y47qw95yhaxnf12ih2xs";
+      name = "plasma-workspace-5.21.4.tar.xz";
     };
   };
   plasma-workspace-wallpapers = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plasma-workspace-wallpapers-5.21.3.tar.xz";
-      sha256 = "1qjkk3qfzz1id898kmx7xx6rr6p77y0jfwkjyf26abk51bdfk9lm";
-      name = "plasma-workspace-wallpapers-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plasma-workspace-wallpapers-5.21.4.tar.xz";
+      sha256 = "1myqz90b1fcmzgq08a15mlikn83iv6hflmdw7985419w7cly81n7";
+      name = "plasma-workspace-wallpapers-5.21.4.tar.xz";
     };
   };
   plymouth-kcm = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/plymouth-kcm-5.21.3.tar.xz";
-      sha256 = "0wmpvb06z0js50c9jpv61jlxbx9sf1f5lidzs5v4xs31shxc9sbg";
-      name = "plymouth-kcm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/plymouth-kcm-5.21.4.tar.xz";
+      sha256 = "1d0na5831azka04n3j78582i3hy5ns1hpdw24y558rly16w80z60";
+      name = "plymouth-kcm-5.21.4.tar.xz";
     };
   };
   polkit-kde-agent = {
-    version = "1-5.21.3";
+    version = "1-5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/polkit-kde-agent-1-5.21.3.tar.xz";
-      sha256 = "06qpkf01665mjr49wyc3f336g6g7l93k8l35q0yyih58i3v04s0v";
-      name = "polkit-kde-agent-1-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/polkit-kde-agent-1-5.21.4.tar.xz";
+      sha256 = "0lg2ls4fb135p64y3kmkxczrqmqzlzdq4ywsrf58ayi42drghdmj";
+      name = "polkit-kde-agent-1-5.21.4.tar.xz";
     };
   };
   powerdevil = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/powerdevil-5.21.3.tar.xz";
-      sha256 = "0lk6bvc0mym3x3sd85bsvsxvm82vr40lcx355xjycxskf75c5jzz";
-      name = "powerdevil-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/powerdevil-5.21.4.tar.xz";
+      sha256 = "0i84k7dv8nvww0pfly2d7mplydjgzdkh14sd17113rlwzyfp5wf6";
+      name = "powerdevil-5.21.4.tar.xz";
     };
   };
   qqc2-breeze-style = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/qqc2-breeze-style-5.21.3.tar.xz";
-      sha256 = "1ydvirjrkjbwfc2faz74dd9zlmfz18fa3cig143gna9rfr5api54";
-      name = "qqc2-breeze-style-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/qqc2-breeze-style-5.21.4.tar.xz";
+      sha256 = "0ny9i75zm0j4m103kazs6lnny8lcmisgl6kmyvjwsnxfl0wfrdww";
+      name = "qqc2-breeze-style-5.21.4.tar.xz";
     };
   };
   sddm-kcm = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/sddm-kcm-5.21.3.tar.xz";
-      sha256 = "1flqgfpiz66s7dsw1k95zdrbj7ka09r0i2pcdygnrwlls5yvqljz";
-      name = "sddm-kcm-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/sddm-kcm-5.21.4.tar.xz";
+      sha256 = "00940pi4x7is88w6b25f5chqhi97xqvnmn92jzy629p1g8zg75ik";
+      name = "sddm-kcm-5.21.4.tar.xz";
     };
   };
   systemsettings = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/systemsettings-5.21.3.tar.xz";
-      sha256 = "08ynlg282x1klgpd43mh3ng4m579iq9hjlln96fqaw19g7x1i58x";
-      name = "systemsettings-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/systemsettings-5.21.4.tar.xz";
+      sha256 = "017d42fdb8dn1srni4lvdyvraaflybbcwkdgdl98vwyv9hw0qjq3";
+      name = "systemsettings-5.21.4.tar.xz";
     };
   };
   xdg-desktop-portal-kde = {
-    version = "5.21.3";
+    version = "5.21.4";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.3/xdg-desktop-portal-kde-5.21.3.tar.xz";
-      sha256 = "05r1kbw39jmj2gfn42052y779l0k89kxh7xynw07igr7c5mxy4ih";
-      name = "xdg-desktop-portal-kde-5.21.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.4/xdg-desktop-portal-kde-5.21.4.tar.xz";
+      sha256 = "01klvbvivw2zd478vj7bq0dn7l5mwsrqhnkj8hd5vc9xcaq6kgzg";
+      name = "xdg-desktop-portal-kde-5.21.4.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 1502b09cca6..c265fff2215 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -186,8 +186,7 @@ stdenv.mkDerivation ({
 
   dontDisableStatic = true;
 
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   configureFlags = import ../common/configure-flags.nix {
     inherit
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 6a2121a8298..957c85cfde5 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -196,8 +196,7 @@ stdenv.mkDerivation ({
 
   dontDisableStatic = true;
 
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   configureFlags = import ../common/configure-flags.nix {
     inherit
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 709288559d1..5d30f80edb2 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -209,8 +209,7 @@ stdenv.mkDerivation ({
 
   dontDisableStatic = true;
 
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   configureFlags = import ../common/configure-flags.nix {
     inherit
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 93c9dde61fc..0ac54e093b4 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -232,8 +232,7 @@ stdenv.mkDerivation ({
 
   dontDisableStatic = true;
 
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   configureFlags = import ../common/configure-flags.nix {
     inherit
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index d9b4c639b5a..233d022514e 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -197,8 +197,7 @@ stdenv.mkDerivation ({
 
   dontDisableStatic = true;
 
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   configureFlags = import ../common/configure-flags.nix {
     inherit
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index 6ecf462d54d..4e57e43437f 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -182,8 +182,7 @@ stdenv.mkDerivation ({
 
   dontDisableStatic = true;
 
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   configureFlags = import ../common/configure-flags.nix {
     inherit
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 7f35f5c7bb9..92810ecffaf 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -199,8 +199,7 @@ stdenv.mkDerivation ({
 
   dontDisableStatic = true;
 
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (targetPlatform != hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   configureFlags = import ../common/configure-flags.nix {
     inherit
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 7f7a40f3368..42deb970dfe 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -44,6 +44,9 @@ let
   crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
   crossDarwin = targetPlatform != hostPlatform && targetPlatform.libc == "libSystem";
 
+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+                  "${stdenv.targetPlatform.config}-";
+
   crossConfigureFlags =
     # Ensure that -print-prog-name is able to find the correct programs.
     [
@@ -112,6 +115,18 @@ let
 
     # Basic configuration
     ++ [
+      # Force target prefix. The behavior if `--target` and `--host`
+      # are specified is inconsistent: Sometimes specifying `--target`
+      # always causes a prefix to be generated, sometimes it's only
+      # added if the `--host` and `--target` differ. This means that
+      # sometimes there may be a prefix even though nixpkgs doesn't
+      # expect one and sometimes there may be none even though nixpkgs
+      # expects one (since not all information is serialized into the
+      # config attribute). The easiest way out of these problems is to
+      # always set the program prefix, so gcc will conform to our
+      # expectations.
+      "--program-prefix=${targetPrefix}"
+
       (lib.enableFeature enableLTO "lto")
       "--disable-libstdcxx-pch"
       "--without-included-gettext"
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index 4ab13441e36..a4d43d9d7f4 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -43,6 +43,9 @@ let
       ./purity.patch
       # make clang -xhip use $PATH to find executables
       ./HIP-use-PATH-7.patch
+      # Backport for the `--unwindlib=[libgcc|compiler-rt]` flag, which is
+      # needed for our bootstrapping to not interfere with C.
+      ./unwindlib.patch
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/7/clang/unwindlib.patch b/pkgs/development/compilers/llvm/7/clang/unwindlib.patch
new file mode 100644
index 00000000000..59a092d7c70
--- /dev/null
+++ b/pkgs/development/compilers/llvm/7/clang/unwindlib.patch
@@ -0,0 +1,227 @@
+commit a5cacb5ba7f1f18e7bb6f6709e42683eeb7e6470
+Author: Sterling Augustine <saugustine@google.com>
+Date:   Tue Mar 19 20:01:59 2019 +0000
+
+    Add --unwindlib=[libgcc|compiler-rt] to parallel --rtlib= [take 2]
+    
+    "clang++ hello.cc --rtlib=compiler-rt"
+    
+    now can works without specifying additional unwind or exception
+    handling libraries.
+    
+    This reworked version of the feature no longer modifies today's default
+    unwind library for compiler-rt: which is nothing. Rather, a user
+    can specify -DCLANG_DEFAULT_UNWINDLIB=libunwind when configuring
+    the compiler.
+    
+    This should address the issues from the previous version.
+    
+    Update tests for new --unwindlib semantics.
+    
+    Differential Revision: https://reviews.llvm.org/D59109
+    
+    llvm-svn: 356508
+
+diff --git clang/CMakeLists.txt clang/CMakeLists.txt
+index 52b881939499..2c3fb62f6e73 100644
+--- clang/CMakeLists.txt
++++ clang/CMakeLists.txt
+@@ -244,6 +244,24 @@ if (NOT(CLANG_DEFAULT_RTLIB STREQUAL "" OR
+     "Default runtime library to use (\"libgcc\" or \"compiler-rt\", empty for platform default)" FORCE)
+ endif()
+ 
++set(CLANG_DEFAULT_UNWINDLIB "" CACHE STRING
++  "Default unwind library to use (\"none\" \"libgcc\" or \"libunwind\", empty to match runtime library.)")
++if (CLANG_DEFAULT_UNWINDLIB STREQUAL "")
++  if (CLANG_DEFAULT_RTLIB STREQUAL "libgcc")
++    set (CLANG_DEFAULT_UNWINDLIB "libgcc" CACHE STRING "" FORCE)
++  elseif (CLANG_DEFAULT_RTLIBS STREQUAL "libunwind")
++    set (CLANG_DEFAULT_UNWINDLIB "none" CACHE STRING "" FORCE)
++  endif()
++endif()
++
++if (NOT(CLANG_DEFAULT_UNWINDLIB STREQUAL "none" OR
++        CLANG_DEFAULT_UNWINDLIB STREQUAL "libgcc" OR
++        CLANG_DEFAULT_UNWINDLIB STREQUAL "libunwind"))
++  message(WARNING "Resetting default unwindlib to use platform default")
++  set(CLANG_DEFAULT_UNWINDLIB "" CACHE STRING
++    "Default unwind library to use (\"none\" \"libgcc\" or \"libunwind\", empty for none)" FORCE)
++endif()
++
+ set(CLANG_DEFAULT_OBJCOPY "objcopy" CACHE STRING
+   "Default objcopy executable to use.")
+ 
+diff --git clang/include/clang/Basic/DiagnosticDriverKinds.td clang/include/clang/Basic/DiagnosticDriverKinds.td
+index 7f75f45c6578..7e1bb33b5cef 100644
+--- clang/include/clang/Basic/DiagnosticDriverKinds.td
++++ clang/include/clang/Basic/DiagnosticDriverKinds.td
+@@ -52,6 +52,10 @@ def err_drv_invalid_rtlib_name : Error<
+   "invalid runtime library name in argument '%0'">;
+ def err_drv_unsupported_rtlib_for_platform : Error<
+   "unsupported runtime library '%0' for platform '%1'">;
++def err_drv_invalid_unwindlib_name : Error<
++  "invalid unwind library name in argument '%0'">;
++def err_drv_incompatible_unwindlib : Error<
++  "--rtlib=libgcc requires --unwindlib=libgcc">;
+ def err_drv_invalid_stdlib_name : Error<
+   "invalid library name in argument '%0'">;
+ def err_drv_invalid_output_with_multiple_archs : Error<
+diff --git clang/include/clang/Config/config.h.cmake clang/include/clang/Config/config.h.cmake
+index 1d624450b9d9..2d4cb747e87e 100644
+--- clang/include/clang/Config/config.h.cmake
++++ clang/include/clang/Config/config.h.cmake
+@@ -23,6 +23,9 @@
+ /* Default runtime library to use. */
+ #define CLANG_DEFAULT_RTLIB "${CLANG_DEFAULT_RTLIB}"
+ 
++/* Default unwind library to use. */
++#define CLANG_DEFAULT_UNWINDLIB "${CLANG_DEFAULT_UNWINDLIB}"
++
+ /* Default objcopy to use */
+ #define CLANG_DEFAULT_OBJCOPY "${CLANG_DEFAULT_OBJCOPY}"
+ 
+diff --git clang/include/clang/Driver/Options.td clang/include/clang/Driver/Options.td
+index 601aa8744967..0e74a2d36dea 100644
+--- clang/include/clang/Driver/Options.td
++++ clang/include/clang/Driver/Options.td
+@@ -2428,6 +2428,8 @@ def std_EQ : Joined<["-", "--"], "std=">, Flags<[CC1Option]>,
+   }]>;
+ def stdlib_EQ : Joined<["-", "--"], "stdlib=">, Flags<[CC1Option]>,
+   HelpText<"C++ standard library to use">, Values<"libc++,libstdc++,platform">;
++def unwindlib_EQ : Joined<["-", "--"], "unwindlib=">, Flags<[CC1Option]>,
++  HelpText<"Unwind library to use">, Values<"libgcc,unwindlib,platform">;
+ def sub__library : JoinedOrSeparate<["-"], "sub_library">;
+ def sub__umbrella : JoinedOrSeparate<["-"], "sub_umbrella">;
+ def system_header_prefix : Joined<["--"], "system-header-prefix=">,
+diff --git clang/include/clang/Driver/ToolChain.h clang/include/clang/Driver/ToolChain.h
+index 2f9c2c190e32..d5b131bcf112 100644
+--- clang/include/clang/Driver/ToolChain.h
++++ clang/include/clang/Driver/ToolChain.h
+@@ -99,6 +99,12 @@ public:
+     RLT_Libgcc
+   };
+ 
++  enum UnwindLibType {
++    UNW_None,
++    UNW_CompilerRT,
++    UNW_Libgcc
++  };
++
+   enum RTTIMode {
+     RM_Enabled,
+     RM_Disabled,
+@@ -352,6 +358,10 @@ public:
+     return ToolChain::CST_Libstdcxx;
+   }
+ 
++  virtual UnwindLibType GetDefaultUnwindLibType() const {
++    return ToolChain::UNW_None;
++  }
++
+   virtual std::string getCompilerRTPath() const;
+ 
+   virtual std::string getCompilerRT(const llvm::opt::ArgList &Args,
+@@ -484,6 +494,10 @@ public:
+   // given compilation arguments.
+   virtual CXXStdlibType GetCXXStdlibType(const llvm::opt::ArgList &Args) const;
+ 
++  // GetUnwindLibType - Determine the unwind library type to use with the
++  // given compilation arguments.
++  virtual UnwindLibType GetUnwindLibType(const llvm::opt::ArgList &Args) const;
++
+   /// AddClangCXXStdlibIncludeArgs - Add the clang -cc1 level arguments to set
+   /// the include paths to use for the given C++ standard library type.
+   virtual void
+diff --git clang/lib/Driver/ToolChain.cpp clang/lib/Driver/ToolChain.cpp
+index cf3db34688df..d980dd5d23fb 100644
+--- clang/lib/Driver/ToolChain.cpp
++++ clang/lib/Driver/ToolChain.cpp
+@@ -665,6 +665,33 @@ ToolChain::RuntimeLibType ToolChain::GetRuntimeLibType(
+   return GetDefaultRuntimeLibType();
+ }
+ 
++ToolChain::UnwindLibType ToolChain::GetUnwindLibType(
++    const ArgList &Args) const {
++  const Arg *A = Args.getLastArg(options::OPT_unwindlib_EQ);
++  StringRef LibName = A ? A->getValue() : CLANG_DEFAULT_UNWINDLIB;
++
++  if (LibName == "none")
++    return ToolChain::UNW_None;
++  else if (LibName == "platform" || LibName == "") {
++    ToolChain::RuntimeLibType RtLibType = GetRuntimeLibType(Args);
++    if (RtLibType == ToolChain::RLT_CompilerRT)
++      return ToolChain::UNW_None;
++    else if (RtLibType == ToolChain::RLT_Libgcc)
++      return ToolChain::UNW_Libgcc;
++  } else if (LibName == "libunwind") {
++    if (GetRuntimeLibType(Args) == RLT_Libgcc)
++      getDriver().Diag(diag::err_drv_incompatible_unwindlib);
++    return ToolChain::UNW_CompilerRT;
++  } else if (LibName == "libgcc")
++    return ToolChain::UNW_Libgcc;
++
++  if (A)
++    getDriver().Diag(diag::err_drv_invalid_unwindlib_name)
++        << A->getAsString(Args);
++
++  return GetDefaultUnwindLibType();
++}
++
+ ToolChain::CXXStdlibType ToolChain::GetCXXStdlibType(const ArgList &Args) const{
+   const Arg *A = Args.getLastArg(options::OPT_stdlib_EQ);
+   StringRef LibName = A ? A->getValue() : CLANG_DEFAULT_CXX_STDLIB;
+diff --git clang/test/Driver/compiler-rt-unwind.c clang/test/Driver/compiler-rt-unwind.c
+new file mode 100644
+index 000000000000..00024dfa7ed3
+--- /dev/null
++++ clang/test/Driver/compiler-rt-unwind.c
+@@ -0,0 +1,49 @@
++// General tests that the driver handles combinations of --rtlib=XXX and
++// --unwindlib=XXX properly.
++//
++// RUN: %clang -no-canonical-prefixes %s -### -o %t.o 2>&1 \
++// RUN:     --target=x86_64-unknown-linux \
++// RUN:     --gcc-toolchain="" \
++// RUN:   | FileCheck --check-prefix=RTLIB-EMPTY %s
++// RTLIB-EMPTY: "{{.*}}lgcc"
++// RTLIB-EMPTY: "{{.*}}-lgcc_s"
++//
++// RUN: %clang -no-canonical-prefixes %s -### -o %t.o 2>&1 \
++// RUN:     --target=x86_64-unknown-linux -rtlib=libgcc \
++// RUN:     --gcc-toolchain="" \
++// RUN:   | FileCheck --check-prefix=RTLIB-GCC %s
++// RTLIB-GCC: "{{.*}}lgcc"
++// RTLIB-GCC: "{{.*}}lgcc_s"
++//
++// RUN: %clang -no-canonical-prefixes %s -### -o %t.o 2>&1 \
++// RUN:     --target=x86_64-unknown-linux -rtlib=libgcc --unwindlib=libunwind \
++// RUN:     --gcc-toolchain="" \
++// RUN:   | FileCheck --check-prefix=RTLIB-GCC-UNWINDLIB-COMPILER-RT %s
++// RTLIB-GCC-UNWINDLIB-COMPILER-RT: "{{.*}}lgcc"
++// RTLIB-GCC-UNWINDLIB-COMPILER-RT: "{{.*}}lunwind"
++//
++// RUN: %clang -no-canonical-prefixes %s -### -o %t.o 2>&1   \
++// RUN:     --target=x86_64-unknown-linux -rtlib=compiler-rt \
++// RUN:     --gcc-toolchain="" \
++// RUN:   | FileCheck --check-prefix=RTLIB-COMPILER-RT %s
++// RTLIB-COMPILER-RT: "{{.*}}libclang_rt.builtins-x86_64.a"
++//
++// RUN: %clang -no-canonical-prefixes %s -### -o %t.o 2>&1   \
++// RUN:     --target=x86_64-unknown-linux -rtlib=compiler-rt --unwindlib=libgcc \
++// RUN:     --gcc-toolchain="" \
++// RUN:   | FileCheck --check-prefix=RTLIB-COMPILER-RT-UNWINDLIB-GCC %s
++// RTLIB-COMPILER-RT-UNWINDLIB-GCC: "{{.*}}libclang_rt.builtins-x86_64.a"
++// RTLIB-COMPILER-RT-UNWINDLIB-GCC: "{{.*}}lgcc_s"
++//
++// RUN: %clang -no-canonical-prefixes %s -### -o %t.o 2>&1              \
++// RUN:     --target=x86_64-unknown-linux -rtlib=compiler-rt --unwindlib=libgcc \
++// RUN:     -static --gcc-toolchain="" \
++// RUN:   | FileCheck --check-prefix=RTLIB-COMPILER-RT-UNWINDLIB-GCC-STATIC %s
++// RTLIB-COMPILER-RT-UNWINDLIB-GCC-STATIC: "{{.*}}libclang_rt.builtins-x86_64.a"
++// RTLIB-COMPILER-RT-UNWINDLIB-GCC-STATIC: "{{.*}}lgcc_eh"
++//
++// RUN: not %clang -no-canonical-prefixes %s -o %t.o 2> %t.err              \
++// RUN:     --target=x86_64-unknown-linux -rtlib=libgcc --unwindlib=libunwind \
++// RUN:     --gcc-toolchain="" \
++// RUN: FileCheck --input-file=%t.err --check-prefix=RTLIB-GCC-UNWINDLIB-COMPILER_RT %s
++// RTLIB-GCC-UNWINDLIB-COMPILER_RT: "{{[.|\\\n]*}}--rtlib=libgcc requires --unwindlib=libgcc"
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 2170177117e..5ae5f9ecb20 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -181,6 +181,12 @@ let
         libunwind = libraries.libunwind;
       }));
 
+    libunwind = callPackage ./libunwind ({
+      inherit (buildLlvmTools) llvm;
+    } // lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+      stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
+    });
+
     openmp = callPackage ./openmp.nix {};
   });
 
diff --git a/pkgs/development/compilers/llvm/7/libc++/default.nix b/pkgs/development/compilers/llvm/7/libc++/default.nix
index fb50c4e24d7..37f90fae5e4 100644
--- a/pkgs/development/compilers/llvm/7/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/7/libc++/default.nix
@@ -37,7 +37,8 @@ stdenv.mkDerivation {
     "-DLIBCXX_LIBCPPABI_VERSION=2"
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1"
-  ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF" ;
+    ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
+    ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF" ;
 
   passthru = {
     isLLVM = true;
diff --git a/pkgs/development/compilers/llvm/7/libc++abi/default.nix b/pkgs/development/compilers/llvm/7/libc++abi/default.nix
index 84c47865141..4f29ca0d6e2 100644
--- a/pkgs/development/compilers/llvm/7/libc++abi/default.nix
+++ b/pkgs/development/compilers/llvm/7/libc++abi/default.nix
@@ -1,5 +1,6 @@
-{ lib, stdenv, cmake, fetch, libcxx, llvm, version
-, standalone ? false
+{ lib, stdenv, cmake, fetch, libcxx, libunwind, llvm, version
+, standalone ? stdenv.hostPlatform.useLLVM or false
+, withLibunwind ? !stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm
   # on musl the shared objects don't build
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
@@ -11,6 +12,13 @@ stdenv.mkDerivation {
   src = fetch "libcxxabi" "1zcqxsdjhawgz1cvpk07y3jl6fg9p3ay4nl69zsirqb2ghgyhhb2";
 
   nativeBuildInputs = [ cmake ];
+  buildInputs = lib.optional withLibunwind libunwind;
+
+  cmakeFlags = lib.optionals standalone [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+  ] ++ lib.optionals (standalone && withLibunwind) [
+    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+  ] ++ lib.optional (!enableShared) "-DLIBCXXABI_ENABLE_SHARED=OFF";
 
   postUnpack = ''
     unpackFile ${libcxx.src}
@@ -22,10 +30,6 @@ stdenv.mkDerivation {
     patch -p1 -d $(ls -d libcxx-*) -i ${../../libcxx-0001-musl-hacks.patch}
   '';
 
-  cmakeFlags =
-     lib.optional standalone "-DLLVM_ENABLE_LIBCXX=ON" ++
-     lib.optional (!enableShared) "-DLIBCXXABI_ENABLE_SHARED=OFF";
-
   installPhase = if stdenv.isDarwin
     then ''
       for file in lib/*.dylib; do
diff --git a/pkgs/development/compilers/llvm/7/libunwind/default.nix b/pkgs/development/compilers/llvm/7/libunwind/default.nix
new file mode 100644
index 00000000000..8fb6e2c7b6d
--- /dev/null
+++ b/pkgs/development/compilers/llvm/7/libunwind/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, version, fetch, fetchpatch, cmake, llvm, libcxx
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation {
+  pname = "libunwind";
+  inherit version;
+
+  src = fetch "libunwind" "035dsxs10nyiqd00q07yycvmkjl01yz4jdlrjvmch8klxg4pyjhp";
+
+  patches = lib.optional (stdenv.hostPlatform.useLLVM or false) [
+    # removes use of `new` that require libc++
+    (fetchpatch {
+      url = "https://github.com/llvm-mirror/libunwind/commit/34a45c630d4c79af403661d267db42fbe7de1178.patch";
+      sha256 = "0n0pv6jvcky8pn3srhrf9x5kbnd0d2kia9xlx2g590f5q0bgwfhv";
+    })
+    # cleans up remaining libc++ dependencies (mostly header inclusions)
+    (fetchpatch {
+      url = "https://github.com/llvm-mirror/libunwind/commit/e050272d2eb57eb4e56a37b429a61df2ebb8aa3e.patch";
+      sha256 = "170mwmj0wf40iyk1kzdpaiy36rz9n8dpl881h4h7s5da0rh51xya";
+      includes = [ "src/libunwind.cpp" "src/UnwindCursor.hpp" ];
+    })
+  ];
+
+  nativeBuildInputs = [ cmake llvm ];
+
+  cmakeFlags = lib.optionals (!enableShared) [
+    "-DLIBUNWIND_ENABLE_SHARED=OFF"
+  ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+    "-DLIBUNWIND_HAS_NOSTDINCXX_FLAG=ON"
+    "-DLLVM_ENABLE_LIBCXX=ON"
+  ];
+}
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 3a52d58ffab..ae5d76aa36c 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -1,27 +1,10 @@
 # similar to interpreters/python/default.nix
 { stdenv, lib, callPackage, fetchurl, fetchpatch }:
-let
-  dsoPatch51 = fetchurl {
-    url = "https://projects.archlinux.org/svntogit/packages.git/plain/trunk/lua-arch.patch?h=packages/lua51";
-    sha256 = "11fcyb4q55p4p7kdb8yp85xlw8imy14kzamp2khvcyxss4vw8ipw";
-    name = "lua-arch.patch";
-  };
-
-  dsoPatch52 = fetchurl {
-    url = "https://projects.archlinux.org/svntogit/packages.git/plain/trunk/liblua.so.patch?h=packages/lua52";
-    sha256 = "1by1dy4ql61f5c6njq9ibf9kaqm3y633g2q8j54iyjr4cxvqwqz9";
-    name = "lua-arch.patch";
-  };
 
-in rec {
+rec {
   lua5_4 = callPackage ./interpreter.nix {
     sourceVersion = { major = "5"; minor = "4"; patch = "2"; };
     hash = "0ksj5zpj74n0jkamy3di1p6l10v4gjnd2zjnb453qc6px6bhsmqi";
-    patches = [
-      # build lua as a shared library as well, MIT-licensed from
-      # https://github.com/archlinux/svntogit-packages/tree/packages/lua/trunk
-      ./liblua.so.patch
-    ];
   };
 
   lua5_4_compat = lua5_4.override({
@@ -35,11 +18,6 @@ in rec {
     patches =
       lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ];
 
-    postConfigure = lib.optionalString (!stdenv.isDarwin) ''
-      cat ${./lua-5.3-dso.make} >> src/Makefile
-      sed -e 's/ALL_T *= */& $(LUA_SO)/' -i src/Makefile
-    '';
-
     postBuild = lib.optionalString (!stdenv.isDarwin) ''
       ( cd src; make $makeFlags "''${makeFlagsArray[@]}" liblua.so )
     '';
@@ -53,7 +31,7 @@ in rec {
   lua5_2 = callPackage ./interpreter.nix {
     sourceVersion = { major = "5"; minor = "2"; patch = "4"; };
     hash = "0jwznq0l8qg9wh5grwg07b5cy3lzngvl5m2nl1ikp6vqssmf9qmr";
-    patches = if stdenv.isDarwin then [ ./5.2.darwin.patch ] else [ dsoPatch52 ];
+    patches = lib.optional stdenv.isDarwin ./5.2.darwin.patch;
   };
 
   lua5_2_compat = lua5_2.override({
@@ -64,7 +42,7 @@ in rec {
   lua5_1 = callPackage ./interpreter.nix {
     sourceVersion = { major = "5"; minor = "1"; patch = "5"; };
     hash = "2640fc56a795f29d28ef15e13c34a47e223960b0240e8cb0a82d9b0738695333";
-    patches = (if stdenv.isDarwin then [ ./5.1.darwin.patch ] else [ dsoPatch51 ])
+    patches = (lib.optional stdenv.isDarwin ./5.1.darwin.patch)
       ++ [ ./CVE-2014-5461.patch ];
   };
 
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index 35a074add09..973e9296435 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -11,6 +11,15 @@
 let
 luaPackages = callPackage ../../lua-modules {lua=self; overrides=packageOverrides;};
 
+plat = if stdenv.isLinux then "linux"
+       else if stdenv.isDarwin then "macosx"
+       else if stdenv.hostPlatform.isMinGW then "mingw"
+       else if stdenv.isFreeBSD then "freebsd"
+       else if stdenv.isSunOS then "solaris"
+       else if stdenv.hostPlatform.isBSD then "bsd"
+       else if stdenv.hostPlatform.isUnix then "posix"
+       else "generic";
+
 self = stdenv.mkDerivation rec {
   pname = "lua";
   luaversion = with sourceVersion; "${major}.${minor}";
@@ -29,6 +38,14 @@ self = stdenv.mkDerivation rec {
 
   inherit patches;
 
+  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+    # Add a target for a shared library to the Makefile.
+    sed -e '1s/^/LUA_SO = liblua.so/' \
+        -e 's/ALL_T *= */&$(LUA_SO) /' \
+        -i src/Makefile
+    cat ${./lua-dso.make} >> src/Makefile
+  '';
+
   # see configurePhase for additional flags (with space)
   makeFlags = [
     "INSTALL_TOP=${placeholder "out"}"
@@ -36,21 +53,16 @@ self = stdenv.mkDerivation rec {
     "R=${version}"
     "LDFLAGS=-fPIC"
     "V=${luaversion}"
-  ] ++ (if stdenv.isDarwin then [
-    "PLAT=macosx"
-  ] else [
-    "PLAT=linux"
-  ]) ++ (if stdenv.buildPlatform != stdenv.hostPlatform then [
-    "CC=${stdenv.hostPlatform.config}-gcc"
-    "RANLIB=${stdenv.hostPlatform.config}-ranlib"
-  ] else [])
-  ;
+    "PLAT=${plat}"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "RANLIB=${stdenv.cc.targetPrefix}ranlib"
+  ];
 
   configurePhase = ''
     runHook preConfigure
 
-    makeFlagsArray+=(CFLAGS="-DLUA_USE_LINUX -O2 -fPIC${if compat then " -DLUA_COMPAT_ALL" else ""}" )
-    makeFlagsArray+=(${lib.optionalString stdenv.isDarwin "CC=\"$CC\""}${lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) " 'AR=${stdenv.hostPlatform.config}-ar rcu'"})
+    makeFlagsArray+=(CFLAGS='-O2 -fPIC${lib.optionalString compat " -DLUA_COMPAT_ALL"} $(SYSCFLAGS)' )
+    makeFlagsArray+=(${lib.optionalString stdenv.isDarwin "CC=\"$CC\""}${lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) " 'AR=${stdenv.cc.targetPrefix}ar rcu'"})
 
     installFlagsArray=( TO_BIN="lua luac" INSTALL_DATA='cp -d' \
       TO_LIB="${if stdenv.isDarwin then "liblua.${version}.dylib" else "liblua.a liblua.so liblua.so.${luaversion} liblua.so.${version}"}" )
diff --git a/pkgs/development/interpreters/lua-5/liblua.so.patch b/pkgs/development/interpreters/lua-5/liblua.so.patch
deleted file mode 100644
index 197832116c1..00000000000
--- a/pkgs/development/interpreters/lua-5/liblua.so.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 416f444..eeaff03 100644
---- a/Makefile
-+++ b/Makefile
-@@ -52,7 +52,7 @@ R= $V.0
- all:	$(PLAT)
- 
- $(PLATS) help test clean:
--	@cd src && $(MAKE) $@
-+	@cd src && $(MAKE) $@ V=$(V) R=$(R)
- 
- install: dummy
- 	cd src && $(MKDIR) $(INSTALL_BIN) $(INSTALL_INC) $(INSTALL_LIB) $(INSTALL_MAN) $(INSTALL_LMOD) $(INSTALL_CMOD)
-diff --git a/src/Makefile b/src/Makefile
-index 514593d..372a6dc 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -33,6 +33,7 @@ CMCFLAGS= -Os
- PLATS= guess aix bsd c89 freebsd generic linux linux-readline macosx mingw posix solaris
- 
- LUA_A=	liblua.a
-+LUA_SO= liblua.so
- CORE_O=	lapi.o lcode.o lctype.o ldebug.o ldo.o ldump.o lfunc.o lgc.o llex.o lmem.o lobject.o lopcodes.o lparser.o lstate.o lstring.o ltable.o ltm.o lundump.o lvm.o lzio.o
- LIB_O=	lauxlib.o lbaselib.o lcorolib.o ldblib.o liolib.o lmathlib.o loadlib.o loslib.o lstrlib.o ltablib.o lutf8lib.o linit.o
- BASE_O= $(CORE_O) $(LIB_O) $(MYOBJS)
-@@ -44,7 +45,7 @@ LUAC_T=	luac
- LUAC_O=	luac.o
- 
- ALL_O= $(BASE_O) $(LUA_O) $(LUAC_O)
--ALL_T= $(LUA_A) $(LUA_T) $(LUAC_T)
-+ALL_T= $(LUA_A) $(LUA_T) $(LUAC_T) $(LUA_SO)
- ALL_A= $(LUA_A)
- 
- # Targets start here.
-@@ -60,6 +61,12 @@ $(LUA_A): $(BASE_O)
- 	$(AR) $@ $(BASE_O)
- 	$(RANLIB) $@
- 
-+$(LUA_SO): $(CORE_O) $(LIB_O)
-+	$(CC) -shared -ldl -Wl,-soname,$(LUA_SO).$(V) -o $@.$(R) $? -lm $(MYLDFLAGS)
-+	ln -sf $(LUA_SO).$(R) $(LUA_SO).$(V)
-+	ln -sf $(LUA_SO).$(R) $(LUA_SO)
-+
-+
- $(LUA_T): $(LUA_O) $(LUA_A)
- 	$(CC) -o $@ $(LDFLAGS) $(LUA_O) $(LUA_A) $(LIBS)
- 
-diff --git a/src/luaconf.h b/src/luaconf.h
-index bdf927e..7e15198 100644
---- a/src/luaconf.h
-+++ b/src/luaconf.h
-@@ -227,7 +227,7 @@
- 
- #else			/* }{ */
- 
--#define LUA_ROOT	"/usr/local/"
-+#define LUA_ROOT	"/usr/"
- #define LUA_LDIR	LUA_ROOT "share/lua/" LUA_VDIR "/"
- #define LUA_CDIR	LUA_ROOT "lib/lua/" LUA_VDIR "/"
- 
diff --git a/pkgs/development/interpreters/lua-5/lua-5.3-dso.make b/pkgs/development/interpreters/lua-5/lua-dso.make
index c70dbc4f9cc..11ac71fd819 100644
--- a/pkgs/development/interpreters/lua-5/lua-5.3-dso.make
+++ b/pkgs/development/interpreters/lua-5/lua-dso.make
@@ -1,8 +1,4 @@
-
-LUA_SO=liblua.so
-
 $(LUA_SO): $(CORE_O) $(LIB_O)
-	$(CC) -shared -ldl -Wl,-soname,$(LUA_SO).$(V) -o $@.$(R) $? -lm $(MYLDFLAGS)
+	$(CC) -shared $(SYSLIBS) -Wl,-soname,$(LUA_SO).$(V) -o $@.$(R) $? $(MYLDFLAGS)
 	ln -sf $(LUA_SO).$(R) $(LUA_SO).$(V)
 	ln -sf $(LUA_SO).$(R) $(LUA_SO)
-
diff --git a/pkgs/development/libraries/SDL2_image/default.nix b/pkgs/development/libraries/SDL2_image/default.nix
index 96f85ddb0ea..a0f770178cc 100644
--- a/pkgs/development/libraries/SDL2_image/default.nix
+++ b/pkgs/development/libraries/SDL2_image/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, SDL2, libpng, libjpeg, libtiff, libungif, libwebp, libXpm, zlib, Foundation }:
+{ lib, stdenv, fetchurl, SDL2, libpng, libjpeg, libtiff, giflib, libwebp, libXpm, zlib, Foundation }:
 
 stdenv.mkDerivation rec {
   pname = "SDL2_image";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1l0864kas9cwpp2d32yxl81g98lx40dhbdp03dz7sbv84vhgdmdx";
   };
 
-  buildInputs = [ SDL2 libpng libjpeg libtiff libungif libwebp libXpm zlib ]
+  buildInputs = [ SDL2 libpng libjpeg libtiff giflib libwebp libXpm zlib ]
     ++ lib.optional stdenv.isDarwin Foundation;
 
 
diff --git a/pkgs/development/libraries/SDL_image/default.nix b/pkgs/development/libraries/SDL_image/default.nix
index 2e5841b3f48..fe97f016743 100644
--- a/pkgs/development/libraries/SDL_image/default.nix
+++ b/pkgs/development/libraries/SDL_image/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, SDL, libpng, libjpeg, libtiff, libungif, libXpm }:
+{ lib, stdenv, fetchurl, fetchpatch, SDL, libpng, libjpeg, libtiff, giflib, libXpm }:
 
 stdenv.mkDerivation rec {
   pname = "SDL_image";
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     "--disable-tif-shared"
   ] ++ lib.optional stdenv.isDarwin "--disable-sdltest";
 
-  buildInputs = [ SDL libpng libjpeg libtiff libungif libXpm ];
+  buildInputs = [ SDL libpng libjpeg libtiff giflib libXpm ];
 
   meta = with lib; {
     description = "SDL image library";
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index d861d25e67a..4cfaa9ebff2 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, ffmpeg, addOpenGLRunpath, fetchurl, fetchpatch, pkg-config, perl, texinfo, yasm
+{ lib, stdenv, ffmpeg, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
 /*
  *  Licensing options (yes some are listed twice, filters and such are not listed)
  */
@@ -126,7 +126,6 @@
 , vid-stab ? null # Video stabilization
 #, vo-aacenc ? null # AAC encoder
 , vo-amrwbenc ? null # AMR-WB encoder
-, wavpack ? null # Wavpack encoder
 , x264 ? null # H.264/AVC encoder
 , x265 ? null # H.265/HEVC encoder
 , xavs ? null # AVS encoder
@@ -244,15 +243,6 @@ stdenv.mkDerivation rec {
   pname = "ffmpeg-full";
   inherit (ffmpeg) src version;
 
-  # this should go away in the next release
-  patches = [
-    # Patch ffmpeg for svt-av1 until version 4.4
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/AOMediaCodec/SVT-AV1/v0.8.4/ffmpeg_plugin/0001-Add-ability-for-ffmpeg-to-run-svt-av1.patch";
-      sha256 = "1p4g8skr5gjw5h1648j7qrks81zx49lrnx9g0p81qgnrvxc2wwx0";
-    })
-  ];
-
   prePatch = ''
     patchShebangs .
   '' + lib.optionalString stdenv.isDarwin ''
@@ -405,7 +395,6 @@ stdenv.mkDerivation rec {
     (enableFeature (vid-stab != null && gplLicensing) "libvidstab") # Actual min. version 2.0
     #(enableFeature (vo-aacenc != null && version3Licensing) "libvo-aacenc")
     (enableFeature (vo-amrwbenc != null && version3Licensing) "libvo-amrwbenc")
-    (enableFeature (wavpack != null) "libwavpack")
     (enableFeature (x264 != null && gplLicensing) "libx264")
     (enableFeature (x265 != null && gplLicensing) "libx265")
     (enableFeature (xavs != null && gplLicensing) "libxavs")
@@ -432,7 +421,7 @@ stdenv.mkDerivation rec {
     libjack2 ladspaH lame libaom libass libbluray libbs2b libcaca libdc1394 libmodplug libmysofa
     libogg libopus librsvg libssh libtheora libvdpau libvorbis libvpx libwebp libX11
     libxcb libXv libXext xz openal openjpeg libpulseaudio rav1e svt-av1 rtmpdump opencore-amr
-    samba SDL2 soxr speex srt vid-stab vo-amrwbenc wavpack x264 x265 xavs xvidcore
+    samba SDL2 soxr speex srt vid-stab vo-amrwbenc x264 x265 xavs xvidcore
     zeromq4 zlib
   ] ++ optionals openglExtlib [ libGL libGLU ]
     ++ optionals nonfreeLicensing [ fdk_aac openssl ]
@@ -465,6 +454,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A complete, cross-platform solution to record, convert and stream audio and video";
     homepage = "https://www.ffmpeg.org/";
+    changelog = "https://github.com/FFmpeg/FFmpeg/blob/n${version}/Changelog";
     longDescription = ''
       FFmpeg is the leading multimedia framework, able to decode, encode, transcode,
       mux, demux, stream, filter and play pretty much anything that humans and machines
diff --git a/pkgs/development/libraries/ffmpeg/3.4.nix b/pkgs/development/libraries/ffmpeg/3.4.nix
index be341d588c1..a5140fa01ca 100644
--- a/pkgs/development/libraries/ffmpeg/3.4.nix
+++ b/pkgs/development/libraries/ffmpeg/3.4.nix
@@ -1,4 +1,4 @@
-{ callPackage, fetchpatch
+{ callPackage
 # Darwin frameworks
 , Cocoa, CoreMedia
 , ...
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 95207b5386f..c765cdf73c5 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,12 +1,12 @@
-{ callPackage, fetchpatch
+{ callPackage
 # Darwin frameworks
 , Cocoa, CoreMedia, VideoToolbox
 , ...
 }@args:
 
 callPackage ./generic.nix (rec {
-  version = "4.3.2";
-  branch = "4.3";
-  sha256 = "0flik4y7c5kchj65p3p908mk1dsncqgzjdvzysjs12rmf1m6sfmb";
+  version = "4.4";
+  branch = "4.4";
+  sha256 = "03kxc29y8190k4y8s8qdpsghlbpmchv1m8iqygq2qn0vfm4ka2a2";
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 } // args)
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 82f1a8bf564..befdb910210 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -213,7 +213,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A complete, cross-platform solution to record, convert and stream audio and video";
-    homepage = "http://www.ffmpeg.org/";
+    homepage = "https://www.ffmpeg.org/";
+    changelog = "https://github.com/FFmpeg/FFmpeg/blob/n${version}/Changelog";
     longDescription = ''
       FFmpeg is the leading multimedia framework, able to decode, encode, transcode,
       mux, demux, stream, filter and play pretty much anything that humans and machines
diff --git a/pkgs/development/libraries/giflib/libungif.nix b/pkgs/development/libraries/giflib/libungif.nix
deleted file mode 100644
index d8c32d14fca..00000000000
--- a/pkgs/development/libraries/giflib/libungif.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{lib, stdenv, fetchurl}:
-
-stdenv.mkDerivation {
-  name = "libungif-4.1.4";
-  src = fetchurl {
-    url = "mirror://sourceforge/giflib/libungif-4.1.4.tar.gz";
-    sha256 = "5e65e1e5deacd0cde489900dbf54c6c2ee2ebc818199e720dbad685d87abda3d";
-  };
-
-  hardeningDisable = [ "format" ];
-
-  meta = with lib; {
-    description = "Library and utilities for processing GIFs";
-    platforms = platforms.unix;
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index ce64bef95ad..fccd6ddb041 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -92,13 +92,23 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libelf setupHook pcre
     bash gnum4 # install glib-gettextize and m4 macros for other apps to use
-    gtk-doc
   ] ++ optionals stdenv.isLinux [
     libselinux
     util-linuxMinimal # for libmount
   ] ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     AppKit Carbon Cocoa CoreFoundation CoreServices Foundation
-  ]);
+  ]) ++ optionals (stdenv.hostPlatform == stdenv.buildPlatform) [
+    # Note: this needs to be both in buildInputs and nativeBuildInputs. The
+    # Meson gtkdoc module uses find_program to look it up (-> build dep), but
+    # glib's own Meson configuration uses the host pkg-config to find its
+    # version (-> host dep). We could technically go and fix this in glib, add
+    # pkg-config to depsBuildBuild, but this would be a futile exercise since
+    # Meson's gtkdoc integration does not support cross compilation[1] anyway
+    # and this derivation disables the docs build when cross compiling.
+    #
+    # [1] https://github.com/mesonbuild/meson/issues/2003
+    gtk-doc
+  ];
 
   strictDeps = true;
 
diff --git a/pkgs/development/libraries/glibc/2.32-master.patch.gz b/pkgs/development/libraries/glibc/2.32-master.patch.gz
index bcf4d13443c..2fda4294130 100644
--- a/pkgs/development/libraries/glibc/2.32-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.32-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 7a83ffd36d7..0108214a56e 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -42,7 +42,7 @@
 
 let
   version = "2.32";
-  patchSuffix = "-40";
+  patchSuffix = "-46";
   sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in
 
@@ -61,7 +61,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.32/master && git describe
-          glibc-2.32-40-g778b8d3786
+          glibc-2.32-46-g1799ac8eab
           $ git show --minimal --reverse glibc-2.32.. | gzip -9n --rsyncable - > 2.32-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/imlib/default.nix b/pkgs/development/libraries/imlib/default.nix
index 53612f8205f..1d6fed2281e 100644
--- a/pkgs/development/libraries/imlib/default.nix
+++ b/pkgs/development/libraries/imlib/default.nix
@@ -1,4 +1,6 @@
-{lib, stdenv, fetchurl, fetchpatch, libX11, libXext, xorgproto, libjpeg, libungif, libtiff, libpng}:
+{ lib, stdenv, fetchurl, fetchpatch
+, libX11, libXext, xorgproto, libjpeg, giflib, libtiff, libpng
+}:
 
 stdenv.mkDerivation {
   name = "imlib-1.9.15";
@@ -13,6 +15,16 @@ stdenv.mkDerivation {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/imlib/files/imlib-1.9.15-bpp16-CVE-2007-3568.patch";
       sha256 = "0lxfibi094gki39sq1w4p0hcx25xlk0875agbhjkjngzx862wvbg";
     })
+
+    # The following two patches fix the build with recent giflib.
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/imlib/files/imlib-1.9.15-giflib51-1.patch?id=c6d0ed89ad5653421f21cbf3b3d40fd9a1361828";
+      sha256 = "0jynlhxcyjiwnz1m8j48xwz4z5csgyg03jfjc8xgpvvcyid4m65l";
+    })
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/imlib/files/imlib-1.9.15-giflib51-2.patch?id=c6d0ed89ad5653421f21cbf3b3d40fd9a1361828";
+      sha256 = "164x7rd992930rqllmr89p5ahfmbz37ipi8x0igd8gkvc8a4fd5x";
+    })
   ];
 
   configureFlags = [
@@ -21,11 +33,11 @@ stdenv.mkDerivation {
     "--x-libraries=${libX11.out}/lib"
   ];
 
-  buildInputs = [libjpeg libXext libX11 xorgproto libtiff libungif libpng];
+  buildInputs = [ libjpeg libXext libX11 xorgproto libtiff giflib libpng ];
 
   meta = with lib; {
     description = "An image loading and rendering library for X11";
     platforms = platforms.unix;
-    license = with licenses; [ gpl2 lgpl2 ];
+    license = with licenses; [ gpl2Only lgpl2Only ];
   };
 }
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index ed086dac90f..b879af32bd0 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -6,6 +6,7 @@
 , ninja
 , pkg-config
 , gettext
+, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 , gobject-introspection
 , fixDarwinDylibNames
 , gtk-doc
@@ -18,31 +19,45 @@ stdenv.mkDerivation rec {
   pname = "json-glib";
   version = "1.6.2";
 
-  outputs = [ "out" "dev" "devdoc" ];
+  outputs = [ "out" "dev" ]
+    ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "092g2dyy1hhl0ix9kp33wcab0pg1qicnsv0cj5ms9g9qs336cgd3";
   };
 
+  strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     gettext
-    gobject-introspection
     glib
-    gtk-doc
     docbook-xsl-nons
     docbook_xml_dtd_43
   ] ++ lib.optional stdenv.hostPlatform.isDarwin [
     fixDarwinDylibNames
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+    gtk-doc
   ];
 
   propagatedBuildInputs = [
     glib
   ];
 
+  mesonFlags = lib.optionals (!withIntrospection) [
+    "-Dintrospection=disabled"
+    # doc gen uses introspection, doesn't work properly
+    "-Dgtk_doc=disabled"
+  ];
+
   doCheck = true;
 
   passthru = {
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index f6d45f66b1a..1c53a32a49e 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -123,8 +123,6 @@ let
       if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
           rm "$out/lib/"*.a
       fi
-
-      mkdir -p $bin
     '' + lib.optionalString (!stdenv.hostPlatform.isWindows)
       # Fix bin/c_rehash's perl interpreter line
       #
@@ -138,9 +136,9 @@ let
       # "#!/usr/bin/env perl"
     ''
       substituteInPlace $out/bin/c_rehash --replace ${buildPackages.perl}/bin/perl "/usr/bin/env perl"
-    '' +
-    ''
-      mv $out/bin $bin/
+    '' + ''
+      mkdir -p $bin
+      mv $out/bin $bin/bin
 
       mkdir $dev
       mv $out/include $dev/
diff --git a/pkgs/development/libraries/plasma-wayland-protocols/default.nix b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
index 2d3a5239d7b..ea02eb428db 100644
--- a/pkgs/development/libraries/plasma-wayland-protocols/default.nix
+++ b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
@@ -5,11 +5,11 @@
 
 mkDerivation rec {
   pname = "plasma-wayland-protocols";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-xUkzg9EVFxw0NeqaIbOWaGBjKoRFRP+sj1SJBDalHTg=";
+    url = "mirror://kde/stable/${pname}/${pname}-v${version}.tar.xz";
+    sha256 = "sha256-KHuQkD+afzlMdedcsYdCaGLq9kqS8b5+LvaOmf2Muqo=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
diff --git a/pkgs/development/libraries/protobuf/3.15.nix b/pkgs/development/libraries/protobuf/3.15.nix
index 661a552882e..e4783be6a35 100644
--- a/pkgs/development/libraries/protobuf/3.15.nix
+++ b/pkgs/development/libraries/protobuf/3.15.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.15.7";
-  sha256 = "03fx96rwxfbmr47f1nrflvaq5kk5p3a9wms4688nbnmymyghyml0";
+  version = "3.15.8";
+  sha256 = "1q3k8axhq6g8fqczmd6kbgzpdplrrgygppym4x1l99lzhplx9rqv";
 }
diff --git a/pkgs/development/libraries/pslib/default.nix b/pkgs/development/libraries/pslib/default.nix
index ec2362009ff..b3439b7ee96 100644
--- a/pkgs/development/libraries/pslib/default.nix
+++ b/pkgs/development/libraries/pslib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, pkg-config, zlib, libpng, libjpeg, libungif, libtiff
+{ lib, stdenv, fetchurl, cmake, pkg-config, zlib, libpng, libjpeg, giflib, libtiff
 }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ zlib libpng libjpeg libungif libtiff ];
+  buildInputs = [ zlib libpng libjpeg giflib libtiff ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/qt-5/qtModule.nix b/pkgs/development/libraries/qt-5/qtModule.nix
index 930ed9d67ba..ebd6e887ec9 100644
--- a/pkgs/development/libraries/qt-5/qtModule.nix
+++ b/pkgs/development/libraries/qt-5/qtModule.nix
@@ -7,15 +7,14 @@ let inherit (lib) licenses maintainers platforms; in
 args:
 
 let
-  inherit (args) name;
-  version = args.version or srcs.${name}.version;
-  src = args.src or srcs.${name}.src;
+  pname = args.name;
+  version = args.version or srcs.${pname}.version;
+  src = args.src or srcs.${pname}.src;
 in
 
 mkDerivation (args // {
-  name = "${name}-${version}";
-  inherit src;
-  patches = args.patches or patches.${name} or [];
+  inherit pname version src;
+  patches = args.patches or patches.${pname} or [];
 
   nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ perl self.qmake ];
   propagatedBuildInputs = args.qtInputs ++ (args.propagatedBuildInputs or []);
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index 2d8d0059764..9b7a2e91011 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "re2";
-  version = "20201001";
+  version = "2021-04-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
-    rev = "2020-10-01";
-    sha256 = "0a5f7av1pk6p3jxc2w6prl00lyrplap97m68hnhw7jllnwljk0bx";
+    rev = version;
+    sha256 = "1iia0883lssj7ckbsr0n7yb3gdw24c8wnl2q5hhzlml23h4ipbh3";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index 57dc3dac2d0..ecb3840b2de 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation {
     cd unix
   '';
 
+  postPatch = ''
+    for file in $(find library/demos/. -type f ! -name "*.*"); do
+      substituteInPlace $file --replace "exec wish" "exec $out/bin/wish"
+    done
+  '';
+
   postInstall = ''
     ln -s $out/bin/wish* $out/bin/wish
     cp ../{unix,generic}/*.h $out/include
diff --git a/pkgs/development/ocaml-modules/camlimages/4.0.nix b/pkgs/development/ocaml-modules/camlimages/4.0.nix
deleted file mode 100644
index 26735b1c5d7..00000000000
--- a/pkgs/development/ocaml-modules/camlimages/4.0.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ lib, stdenv, fetchurl, omake, ocaml, libtiff, libjpeg, libpng, giflib, findlib, libXpm, freetype, graphicsmagick, ghostscript }:
-
-let
-  pname = "camlimages";
-  version = "4.0.1";
-in
-
-stdenv.mkDerivation {
-  name = "${pname}-${version}";
-
-  src = fetchurl {
-    url = "https://bitbucket.org/camlspotter/camlimages/get/v4.0.1.tar.gz";
-    sha256 = "b40237c1505487049799a7af296eb3996b3fa08eab94415546f46d61355747c4";
-  };
-
-  buildInputs = [ ocaml omake findlib graphicsmagick ghostscript ];
-
-  propagatedBuildInputs = [libtiff libjpeg libpng giflib freetype libXpm ];
-
-  createFindlibDestdir = true;
-
-  preConfigure = ''
-    rm ./configure
-  '';
-
-  buildPhase = ''
-    omake
-  '';
-
-  installPhase = ''
-    omake install
-  '';
-
-  meta = with lib; {
-    branch = "4.0";
-    homepage = "https://bitbucket.org/camlspotter/camlimages";
-    description = "OCaml image processing library";
-    license = licenses.lgpl2;
-    maintainers = [ maintainers.vbgl ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/camlimages/4.1.2.nix b/pkgs/development/ocaml-modules/camlimages/4.1.2.nix
new file mode 100644
index 00000000000..437cb84d15d
--- /dev/null
+++ b/pkgs/development/ocaml-modules/camlimages/4.1.2.nix
@@ -0,0 +1,37 @@
+{ lib, stdenv, fetchFromGitLab, fetchpatch, omake, ocaml, findlib
+, graphicsmagick, ghostscript
+, freetype, giflib, libjpeg, libpng, libtiff, libXpm
+}:
+
+stdenv.mkDerivation rec {
+  pname = "camlimages";
+  version = "4.1.2";
+
+  src = fetchFromGitLab {
+    owner = "camlspotter";
+    repo = "camlimages";
+    rev = "98661d507e12ce91a51295a50f244cb8265b4439"; # no tag
+    sha256 = "0kpxj8wm2m17wjq217jzjpfgv1d7sp4w1yd1gi8ipn5rj4sid2j8";
+  };
+
+  buildInputs = [ ocaml omake findlib graphicsmagick ghostscript ];
+  propagatedBuildInputs = [ libtiff libjpeg libpng giflib freetype libXpm ];
+
+  createFindlibDestdir = true;
+
+  buildPhase = ''
+    omake
+  '';
+
+  installPhase = ''
+    omake install
+  '';
+
+  meta = with lib; {
+    branch = "4.0";
+    homepage = "https://bitbucket.org/camlspotter/camlimages";
+    description = "OCaml image processing library";
+    license = licenses.lgpl2;
+    maintainers = [ maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/python-modules/infoqscraper/default.nix b/pkgs/development/python-modules/infoqscraper/default.nix
index b250dfc6c7f..629f343a7cb 100644
--- a/pkgs/development/python-modules/infoqscraper/default.nix
+++ b/pkgs/development/python-modules/infoqscraper/default.nix
@@ -28,6 +28,9 @@ buildPythonPackage rec {
     homepage = "https://github.com/cykl/infoqscraper/wiki";
     license = licenses.mit;
     maintainers = with maintainers; [ edwtjo ];
+    # infoq HTML has changed:
+    # https://github.com/cykl/infoqscraper/issues/29
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/matplotlib/2.nix b/pkgs/development/python-modules/matplotlib/2.nix
index 2c929d9a694..a6ee1a3bade 100644
--- a/pkgs/development/python-modules/matplotlib/2.nix
+++ b/pkgs/development/python-modules/matplotlib/2.nix
@@ -1,24 +1,16 @@
-{ lib, stdenv, fetchPypi, python, buildPythonPackage, pycairo, backports_functools_lru_cache
+{ lib, stdenv, fetchPypi, writeText, python, buildPythonPackage, pycairo, backports_functools_lru_cache
 , which, cycler, dateutil, nose, numpy, pyparsing, sphinx, tornado, kiwisolver
 , freetype, libpng, pkg-config, mock, pytz, pygobject3, gobject-introspection, functools32, subprocess32
 , fetchpatch
-, enableGhostscript ? false, ghostscript ? null, gtk3
+, enableGhostscript ? false, ghostscript, gtk3
 , enableGtk3 ? false, cairo
 # darwin has its own "MacOSX" backend
-, enableTk ? !stdenv.isDarwin, tcl ? null, tk ? null, tkinter ? null, libX11 ? null
+, enableTk ? !stdenv.isDarwin, tcl, tk, tkinter, libX11
 , enableQt ? false, pyqt4
 , Cocoa
 , pythonOlder
 }:
 
-assert enableGhostscript -> ghostscript != null;
-assert enableTk -> (tcl != null)
-                && (tk != null)
-                && (tkinter != null)
-                && (libX11 != null)
-                ;
-assert enableQt -> pyqt4 != null;
-
 buildPythonPackage rec {
   version = "2.2.3";
   pname = "matplotlib";
@@ -54,7 +46,10 @@ buildPythonPackage rec {
     ++ lib.optionals enableQt [ pyqt4 ]
     ++ lib.optionals python.isPy2 [ functools32 subprocess32 ];
 
-  setup_cfg = ./setup.cfg;
+  passthru.config = {
+    directories = { basedirlist = "."; };
+  };
+  setup_cfg = writeText "setup.cfg" (lib.generators.toINI {} passthru.config);
   preBuild = ''
     cp "$setup_cfg" ./setup.cfg
   '';
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 4be4189f8c7..7364920cba2 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -1,33 +1,25 @@
-{ lib, stdenv, fetchPypi, python, buildPythonPackage, isPy3k, pycairo, backports_functools_lru_cache
+{ lib, stdenv, fetchPypi, writeText, python, buildPythonPackage, isPy3k, pycairo, backports_functools_lru_cache
 , which, cycler, dateutil, nose, numpy, pyparsing, sphinx, tornado, kiwisolver
-, freetype, libpng, pkg-config, mock, pytz, pygobject3, gobject-introspection
+, freetype, qhull, libpng, pkg-config, mock, pytz, pygobject3, gobject-introspection
 , certifi, pillow
-, enableGhostscript ? true, ghostscript ? null, gtk3
+, enableGhostscript ? true, ghostscript, gtk3
 , enableGtk3 ? false, cairo
 # darwin has its own "MacOSX" backend
-, enableTk ? !stdenv.isDarwin, tcl ? null, tk ? null, tkinter ? null, libX11 ? null
-, enableQt ? false, pyqt5 ? null
+, enableTk ? !stdenv.isDarwin, tcl, tk, tkinter, libX11
+, enableQt ? false, pyqt5
 , Cocoa
 , pythonOlder
 }:
 
-assert enableGhostscript -> ghostscript != null;
-assert enableTk -> (tcl != null)
-                && (tk != null)
-                && (tkinter != null)
-                && (libX11 != null)
-                ;
-assert enableQt -> pyqt5 != null;
-
 buildPythonPackage rec {
-  version = "3.3.4";
+  version = "3.4.1";
   pname = "matplotlib";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3e477db76c22929e4c6876c44f88d790aacdf3c3f8f3a90cb1975c0bf37825b0";
+    sha256 = "84d4c4f650f356678a5d658a43ca21a41fca13f9b8b00169c0b76e6a6a948908";
   };
 
   XDG_RUNTIME_DIR = "/tmp";
@@ -39,13 +31,23 @@ buildPythonPackage rec {
     ++ lib.optional stdenv.isDarwin [ Cocoa ];
 
   propagatedBuildInputs =
-    [ cycler dateutil numpy pyparsing tornado freetype kiwisolver
-      certifi libpng mock pytz pillow ]
+    [ cycler dateutil numpy pyparsing tornado freetype qhull
+      kiwisolver certifi libpng mock pytz pillow ]
     ++ lib.optionals enableGtk3 [ cairo pycairo gtk3 gobject-introspection pygobject3 ]
     ++ lib.optionals enableTk [ tcl tk tkinter libX11 ]
     ++ lib.optionals enableQt [ pyqt5 ];
 
-  setup_cfg = if stdenv.isDarwin then ./setup-darwin.cfg else ./setup.cfg;
+  passthru.config = {
+    directories = { basedirlist = "."; };
+    libs = {
+      system_freetype = true;
+      system_qhull = true;
+    } // lib.optionalAttrs stdenv.isDarwin {
+      # LTO not working in darwin stdenv, see #19312
+      enable_lto = false;
+    };
+  };
+  setup_cfg = writeText "setup.cfg" (lib.generators.toINI {} passthru.config);
   preBuild = ''
     cp "$setup_cfg" ./setup.cfg
   '';
diff --git a/pkgs/development/python-modules/matplotlib/setup-darwin.cfg b/pkgs/development/python-modules/matplotlib/setup-darwin.cfg
deleted file mode 100644
index f6463d9c574..00000000000
--- a/pkgs/development/python-modules/matplotlib/setup-darwin.cfg
+++ /dev/null
@@ -1,7 +0,0 @@
-[directories]
-basedirlist = .
-
-[libs]
-system_freetype = true
-# LTO not working in darwin stdenv, see #19312
-enable_lto = false
diff --git a/pkgs/development/python-modules/matplotlib/setup.cfg b/pkgs/development/python-modules/matplotlib/setup.cfg
deleted file mode 100644
index 6a773862765..00000000000
--- a/pkgs/development/python-modules/matplotlib/setup.cfg
+++ /dev/null
@@ -1,5 +0,0 @@
-[directories]
-basedirlist = .
-
-[libs]
-system_freetype = true
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 1c5cc29f414..8168e4e0375 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -33,11 +33,11 @@
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "3.3.1";
+  version = "3.5.4";
   src = fetchPypi {
     pname = "Sphinx";
     inherit version;
-    sha256 = "1e8d592225447104d1172be415bc2972bd1357e3e12fdc76edf2261105db4300";
+    sha256 = "19010b7b9fa0dc7756a6e105b2aacd3a80f798af3c25c273be64d7beeb482cb1";
   };
   LC_ALL = "en_US.UTF-8";
 
@@ -74,7 +74,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "A tool that makes it easy to create intelligent and beautiful documentation for Python projects";
-    homepage = "http://sphinx.pocoo.org/";
+    homepage = "https://www.sphinx-doc.org";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ nand0p ];
   };
diff --git a/pkgs/development/tools/documentation/gtk-doc/default.nix b/pkgs/development/tools/documentation/gtk-doc/default.nix
index e74a6b9c3c6..55fd0feff10 100644
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@@ -32,6 +32,13 @@ python3.pkgs.buildPythonApplication rec {
     passthru.respect_xml_catalog_files_var_patch
   ];
 
+  strictDeps = true;
+
+  depsBuildBuild = [
+    python3
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     pkg-config
     gettext
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 995f3f7430c..8042655a859 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -107,8 +107,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" "pie" ];
 
-  # TODO(@Ericson2314): Always pass "--target" and always targetPrefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   configureFlags =
     (if enableShared then [ "--enable-shared" "--disable-static" ]
@@ -126,7 +125,19 @@ stdenv.mkDerivation {
     # RUNPATH instead of RPATH on binaries.  This is important because
     # RUNPATH can be overriden using LD_LIBRARY_PATH at runtime.
     "--enable-new-dtags"
-  ] ++ lib.optionals gold [ "--enable-gold" "--enable-plugins" ];
+
+    # force target prefix. Some versions of binutils will make it empty
+    # if `--host` and `--target` are too close, even if Nixpkgs thinks
+    # the platforms are different (e.g. because not all the info makes
+    # the `config`). Other versions of binutils will always prefix if
+    # `--target` is passed, even if `--host` and `--target` are the same.
+    # The easiest thing for us to do is not leave it to chance, and force
+    # the program prefix to be what we want it to be.
+    "--program-prefix=${targetPrefix}"
+  ] ++ lib.optionals gold [
+    "--enable-gold"
+    "--enable-plugins"
+  ];
 
   doCheck = false; # fails
 
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 6f923778975..66d4e8bc057 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -61,8 +61,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
 
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
+  configurePlatforms = [ "build" "host" "target" ];
 
   # GDB have to be built out of tree.
   preConfigure = ''
@@ -72,6 +71,13 @@ stdenv.mkDerivation rec {
   configureScript = "../configure";
 
   configureFlags = with lib; [
+    # Set the program prefix to the current targetPrefix.
+    # This ensures that the prefix always conforms to
+    # nixpkgs' expectations instead of relying on the build
+    # system which only receives `config` which is merely a
+    # subset of the platform description.
+    "--program-prefix=${targetPrefix}"
+
     "--enable-targets=all" "--enable-64-bit-bfd"
     "--disable-install-libbfd"
     "--disable-shared" "--enable-static"
diff --git a/pkgs/development/tools/parsing/re2c/default.nix b/pkgs/development/tools/parsing/re2c/default.nix
index ebba9903a47..a945f3bdde0 100644
--- a/pkgs/development/tools/parsing/re2c/default.nix
+++ b/pkgs/development/tools/parsing/re2c/default.nix
@@ -1,48 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "re2c";
-  version = "1.3";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner  = "skvadrik";
     repo   = "re2c";
     rev    = version;
-    sha256 = "0aqlf2h6i2m3dq11dkq89p4w4c9kp4x66s5rhp84gmpz5xqv1x5h";
+    sha256 = "06nvk5sf4vrc2bvpj4vi2xwy3ggv548sn530drz5fi67nhzgga26";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2018-21232-part1.patch";
-      url = "https://github.com/skvadrik/re2c/commit/fd634998f813340768c333cdad638498602856e5.patch";
-      sha256 = "1blyg5lyhqd4ymisih65xl0g36ig71ijia4skkkd59rdvj78aiw6";
-    })
-
-    (fetchpatch {
-      name = "CVE-2018-21232-part2.patch";
-      url = "https://github.com/skvadrik/re2c/commit/7b5643476bd99c994c4f51b8143f942982d85521.patch";
-      sha256 = "0rhmgqrinpk49r9x75ygrs14lz72aw5ad5kr6qp9bdyl8gs082qp";
-    })
-
-    (fetchpatch {
-      name = "CVE-2018-21232-part3.patch";
-      url = "https://github.com/skvadrik/re2c/commit/4d9c809355b574f2a58eac119f5e076c48e4d1e2.patch";
-      sha256 = "0k86wg9icw1gkqpf7rq2w6xsq4caxw3rc0zfxf39liwa35027rai";
-    })
-
-    (fetchpatch {
-      name = "CVE-2018-21232-part4.patch";
-      url = "https://github.com/skvadrik/re2c/commit/89be91f3df00657261870adbc590209fdb2bc405.patch";
-      sha256 = "1aygy9va7jwby93chlskwg7z90fn07x5hym0gziwlkx8k900p3a3";
-    })
-
-    (fetchpatch {
-      name = "CVE-2020-11958.patch";
-      url = "https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a.patch";
-      sha256 = "1d95ahxk92g7k87sda9gxgmr3blyfzwd2y7h9jxj8zkd74knd9zh";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook ];
 
   doCheck = true;
@@ -54,7 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Tool for writing very fast and very flexible scanners";
-    homepage    = "http://re2c.org";
+    homepage    = "https://re2c.org";
     license     = licenses.publicDomain;
     platforms   = platforms.all;
     maintainers = with maintainers; [ thoughtpolice ];
diff --git a/pkgs/os-specific/bsd/netbsd/builder.sh b/pkgs/os-specific/bsd/netbsd/builder.sh
index 925001567f7..332e5c2098f 100644
--- a/pkgs/os-specific/bsd/netbsd/builder.sh
+++ b/pkgs/os-specific/bsd/netbsd/builder.sh
@@ -105,9 +105,10 @@ moveUsrDir() {
   if [ -d $prefix ]; then
     # Remove lingering /usr references
     if [ -d $prefix/usr ]; then
-      cd $prefix/usr
+      pushd $prefix/usr
       find . -type d -exec mkdir -p $out/\{} \;
       find . \( -type f -o -type l \) -exec mv \{} $out/\{} \;
+      popd
     fi
 
     find $prefix -type d -empty -delete
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index d7ee2182109..d461a3e62f3 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, stdenvNoCC, fetchcvs, lib, groff, mandoc, zlib, bison, flex
-, writeText, buildPackages, splicePackages, symlinkJoin }:
+{ stdenv, stdenvNoCC, fetchcvs, lib, groff, mandoc, zlib, byacc, flex
+, makeSetupHook, writeText, buildPackages, splicePackages, symlinkJoin }:
 
 let
   fetchNetBSD = path: version: sha256: fetchcvs {
@@ -26,11 +26,11 @@ let
     stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
   in stdenv'.mkDerivation ({
     name = "${attrs.pname or (baseNameOf attrs.path)}-netbsd-${attrs.version}";
-    src = attrs.src or fetchNetBSD attrs.path attrs.version attrs.sha256;
+    src = fetchNetBSD attrs.path attrs.version attrs.sha256;
 
     extraPaths = [ ];
 
-    nativeBuildInputs = [ makeMinimal install tsort lorder mandoc groff stat ];
+    nativeBuildInputs = [ makeMinimal install tsort lorder mandoc groff statHook ];
     buildInputs = [ compat ];
     # depsBuildBuild = [ buildPackages.stdenv.cc ];
 
@@ -243,6 +243,7 @@ let
     ];
   };
 
+  # Don't add this to nativeBuildInputs directly.  Use statHook instead.
   stat = mkDerivation {
     path = "usr.bin/stat";
     version = "8.0";
@@ -250,6 +251,17 @@ let
     nativeBuildInputs = [ makeMinimal install mandoc groff ];
   };
 
+  # stat isn't in POSIX, and NetBSD stat supports a completely
+  # different range of flags than GNU stat, so including it in PATH
+  # breaks stdenv.  Work around that with a hook that will point
+  # NetBSD's build system and NetBSD stat without including it in
+  # PATH.
+  statHook = makeSetupHook {
+    name = "netbsd-stat-hook";
+  } (writeText "netbsd-stat-hook-impl" ''
+    makeFlagsArray+=(TOOL_STAT=${netbsd.stat}/bin/stat)
+  '');
+
   tsort = mkDerivation {
     path = "usr.bin/tsort";
     version = "8.0";
@@ -367,6 +379,30 @@ let
       (fetchNetBSD "tools/Makefile.host" "8.0" "1p23dsc4qrv93vc6gzid9w2479jwswry9qfn88505s0pdd7h6nvp")
     ];
   };
+
+  uudecode = mkDerivation {
+    path = "usr.bin/uudecode";
+    version = "8.0";
+    sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
+    NIX_CFLAGS_COMPILE = lib.optional stdenv.isLinux "-DNO_BASE64";
+  };
+
+  cksum = mkDerivation {
+    path = "usr.bin/cksum";
+    version = "8.0";
+    sha256 = "0327820171djn9dzb2q1arypxw2zsxiixnd1ahy34dagd9cwcphj";
+    meta.platforms = lib.platforms.netbsd;
+  };
+
+  config = mkDerivation {
+    path = "usr.bin/config";
+    version = "8.0";
+    sha256 = "0piyn8lgdqxwz9wkgc2plzp2xpj93fs4xncri8l0jfas9rv5j2m5";
+    NIX_CFLAGS_COMPILE = [ "-DMAKE_BOOTSTRAP" ];
+    buildInputs = [ compat ];
+    nativeBuildInputs = [ makeMinimal install mandoc byacc flex ];
+    extraPaths = [ cksum.src ];
+  };
   ##
   ## END COMMAND LINE TOOLS
   ##
@@ -397,10 +433,35 @@ let
     path = "sys";
     version = "8.0";
     sha256 = "123ilg8fqmp69bw6bs6nh98fpi1v2n9lamrzar61p27ji6sj7g0w";
+
+    CONFIG = "GENERIC";
+
     propagatedBuildInputs = [ include ];
-    #meta.platforms = lib.platforms.netbsd;
-    extraPaths = [ common.src ];
+    nativeBuildInputs = [
+      makeMinimal install tsort lorder statHook uudecode config genassym
+    ];
+
+    postConfigure = ''
+      pushd arch/$MACHINE/conf
+      config $CONFIG
+      popd
+    '';
+
+    makeFlags = [ "FIRMWAREDIR=$(out)/libdata/firmware" ];
+    hardeningDisable = [ "pic" ];
     MKKMOD = "no";
+    NIX_CFLAGS_COMPILE = [ "-Wa,--no-warn" ];
+
+    postBuild = ''
+      make -C arch/$MACHINE/compile/$CONFIG $makeFlags
+    '';
+
+    postInstall = ''
+      cp arch/$MACHINE/compile/$CONFIG/netbsd $out
+    '';
+
+    meta.platforms = lib.platforms.netbsd;
+    extraPaths = [ common.src ];
   };
 
   headers = symlinkJoin {
@@ -563,7 +624,7 @@ let
     sha256 = "0630lbvz6v4ic13bfg8ccwfhqkgcv76bfdw9f36rfsnwfgpxqsmq";
     meta.platforms = lib.platforms.netbsd;
     nativeBuildInputs = [ makeMinimal install mandoc groff flex
-                          bison genassym gencat lorder tsort stat ];
+                          byacc genassym gencat lorder tsort statHook ];
     extraPaths = [ sys.src ld_elf_so.src ];
   };
 
@@ -587,7 +648,7 @@ let
                    librpcsvc.src libutil.src librt.src libcrypt.src ];
     buildInputs = [ buildPackages.netbsd.headers csu ];
     nativeBuildInputs = [ makeMinimal install mandoc groff flex
-                          bison genassym gencat lorder tsort stat ];
+                          byacc genassym gencat lorder tsort statHook rpcgen ];
     NIX_CFLAGS_COMPILE = "-B${csu}/lib";
     meta.platforms = lib.platforms.netbsd;
     SHLIBINSTALLDIR = "$(out)/lib";
@@ -617,8 +678,8 @@ let
       make -C $NETBSDSRCDIR/lib/libresolv $makeFlags
       make -C $NETBSDSRCDIR/lib/libresolv $makeFlags install
 
-      make -C $NETBSDSRCDIR/lib/librpcsv $makeFlags
-      make -C $NETBSDSRCDIR/lib/librpcsv $makeFlags install
+      make -C $NETBSDSRCDIR/lib/librpcsvc $makeFlags
+      make -C $NETBSDSRCDIR/lib/librpcsvc $makeFlags install
 
       make -C $NETBSDSRCDIR/lib/i18n_module $makeFlags
       make -C $NETBSDSRCDIR/lib/i18n_module $makeFlags install
@@ -633,8 +694,8 @@ let
       make -C $NETBSDSRCDIR/lib/libcrypt $makeFlags install
     '';
     postPatch = ''
-      substituteInPlace sys/Makefile.inc \
-        --replace /usr/include/sys/syscall.h ${buildPackages.netbsd.headers}/include/sys/syscall.h
+      sed -i 's,/usr\(/include/sys/syscall.h\),${buildPackages.netbsd.headers}\1,g' \
+        sys/Makefile.inc ../librt/sys/Makefile.inc
     '';
   };
   #
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index b88107f992c..1b60abf562b 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -192,6 +192,20 @@ let
       mkdir -p $out/Library/Frameworks/
       cp -r ${darwin-stubs}/System/Library/${lib.optionalString private "Private"}Frameworks/${name}.framework \
         $out/Library/Frameworks
+
+      cd $out/Library/Frameworks/${name}.framework
+
+      versions=(./Versions/*)
+      if [ "''${#versions[@]}" != 1 ]; then
+        echo "Unable to determine current version of framework ${name}"
+        exit 1
+      fi
+      current=$(basename ''${versions[0]})
+
+      chmod u+w -R .
+      ln -s "$current" Versions/Current
+      ln -s Versions/Current/* .
+
       # NOTE there's no re-export checking here, this is probably wrong
     '';
   };
@@ -312,7 +326,7 @@ in rec {
         "Versions/A/Frameworks/WebKitLegacy.framework/Versions/A/WebKitLegacy.tbd"
       ];
     });
-  } // lib.genAttrs [ "ContactsPersistence" "UIFoundation" "GameCenter" ] (x: tbdOnlyFramework x {});
+  } // lib.genAttrs [ "ContactsPersistence" "GameCenter" "SkyLight" "UIFoundation" ] (x: tbdOnlyFramework x {});
 
   bareFrameworks = lib.mapAttrs framework (import ./frameworks.nix {
     inherit frameworks libs;
diff --git a/pkgs/os-specific/darwin/spacebar/default.nix b/pkgs/os-specific/darwin/spacebar/default.nix
index 780347c60c5..8cfbaa3f9a3 100644
--- a/pkgs/os-specific/darwin/spacebar/default.nix
+++ b/pkgs/os-specific/darwin/spacebar/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, Carbon, Cocoa, ScriptingBridge }:
+{ lib, stdenv, fetchFromGitHub, Carbon, Cocoa, ScriptingBridge, SkyLight }:
 
 stdenv.mkDerivation rec {
   pname = "spacebar";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0f5ddn3sx13rwwh0nfl784160s8ml3m5593d5fz2b1996aznzrsx";
   };
 
-  buildInputs = [ Carbon Cocoa ScriptingBridge ];
+  buildInputs = [ Carbon Cocoa ScriptingBridge SkyLight ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 2c9239b2e7d..fbf7e4bd995 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -44,6 +44,11 @@ stdenv.mkDerivation rec {
     "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
   ];
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
+    substituteInPlace src/procattr.c \
+      --replace "#include <unistd.h>" ""
+  '';
+
   preInstall = optionalString enablePython ''
     mkdir -p $py/${python3.sitePackages}/selinux
   '';
diff --git a/pkgs/tools/graphics/fbv/default.nix b/pkgs/tools/graphics/fbv/default.nix
index 6f6e0aeca2c..5b46d5d2268 100644
--- a/pkgs/tools/graphics/fbv/default.nix
+++ b/pkgs/tools/graphics/fbv/default.nix
@@ -1,14 +1,25 @@
-{ lib, stdenv, fetchurl, getopt, libjpeg, libpng12, libungif }:
+{ lib, stdenv, fetchurl, fetchpatch, getopt, libjpeg, libpng12, giflib }:
 
 stdenv.mkDerivation rec {
-  name = "fbv-1.0b";
+  pname = "fbv";
+  version = "1.0b";
 
   src = fetchurl {
-    url = "http://s-tech.elsat.net.pl/fbv/${name}.tar.gz";
+    url = "http://s-tech.elsat.net.pl/fbv/fbv-${version}.tar.gz";
     sha256 = "0g5b550vk11l639y8p5sx1v1i6ihgqk0x1hd0ri1bc2yzpdbjmcv";
   };
 
-  buildInputs = [ getopt libjpeg libpng12 libungif ];
+  patches = [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/4a5bfe522ea5afd8203e804dc6a642d0871cd6dd/srcpkgs/fbv/patches/giflib-5.1.patch";
+      sha256 = "00q1zcn92yvvyij68bnq0m1sr3a411w914f4nyp6mpz0j5xc6dc7";
+    })
+  ];
+
+  patchFlags = [ "-p0" ];
+
+  buildInputs = [ getopt libjpeg libpng12 giflib ];
+  makeFlags = [ "LDFLAGS=-lgif" ];
 
   enableParallelBuilding = true;
 
@@ -19,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "View pictures on a linux framebuffer device";
     homepage = "http://s-tech.elsat.net.pl/fbv/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ peterhoeg ];
   };
 }
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 89bd0f0491e..5f64057c46c 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchpatch, fetchFromGitHub, lib
 , cmake, perl, uthash, pkg-config, gettext
-, python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, cairo, pango
+, python, freetype, zlib, glib, giflib, libpng, libjpeg, libtiff, libxml2, cairo, pango
 , readline, woff2, zeromq, libuninameslist
 , withSpiro ? false, libspiro
 , withGTK ? false, gtk3
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [
     readline uthash woff2 zeromq libuninameslist
-    python freetype zlib glib libungif libpng libjpeg libtiff libxml2
+    python freetype zlib glib giflib libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
     ++ lib.optionals withGUI [ gtk3 cairo pango ]
diff --git a/pkgs/tools/networking/curl/7.74.0-CVE-2021-22876.patch b/pkgs/tools/networking/curl/7.74.0-CVE-2021-22876.patch
deleted file mode 100644
index f915f298a49..00000000000
--- a/pkgs/tools/networking/curl/7.74.0-CVE-2021-22876.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-Based on upstream 7214288898f5625a6cc196e22a74232eada7861c, adapted by ris to

-compensate for lack of 95cbcec8f986492766c4be3922af1e7644e1e7c5

-

----

- lib/transfer.c          | 25 ++++++++++++++--

- tests/data/Makefile.inc |  2 +-

- tests/data/test2081     | 66 +++++++++++++++++++++++++++++++++++++++++

- 3 files changed, 90 insertions(+), 3 deletions(-)

- create mode 100644 tests/data/test2081

-

-diff --git a/lib/transfer.c b/lib/transfer.c

-index 1976bc0338bc..a68c021c84d6 100644

---- a/lib/transfer.c

-+++ b/lib/transfer.c

-@@ -1581,6 +1581,9 @@ CURLcode Curl_follow(struct Curl_easy *data,

-       data->set.followlocation++; /* count location-followers */

- 

-       if(data->set.http_auto_referer) {

-+        CURLU *u;

-+        char *referer;

-+

-         /* We are asked to automatically set the previous URL as the referer

-            when we get the next URL. We pick the ->url field, which may or may

-            not be 100% correct */

-@@ -1590,9 +1593,27 @@ CURLcode Curl_follow(struct Curl_easy *data,

-           data->change.referer_alloc = FALSE;

-         }

- 

--        data->change.referer = strdup(data->change.url);

--        if(!data->change.referer)

-+        /* Make a copy of the URL without crenditals and fragment */

-+        u = curl_url();

-+        if(!u)

-+          return CURLE_OUT_OF_MEMORY;

-+

-+        uc = curl_url_set(u, CURLUPART_URL, data->change.url, 0);

-+        if(!uc)

-+          uc = curl_url_set(u, CURLUPART_FRAGMENT, NULL, 0);

-+        if(!uc)

-+          uc = curl_url_set(u, CURLUPART_USER, NULL, 0);

-+        if(!uc)

-+          uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0);

-+        if(!uc)

-+          uc = curl_url_get(u, CURLUPART_URL, &referer, 0);

-+

-+        curl_url_cleanup(u);

-+

-+        if(uc || referer == NULL)

-           return CURLE_OUT_OF_MEMORY;

-+

-+        data->change.referer = referer;

-         data->change.referer_alloc = TRUE; /* yes, free this later */

-       }

-     }

-diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc

-index 2c7a0ca89fd8..ea52683d2254 100644

---- a/tests/data/Makefile.inc

-+++ b/tests/data/Makefile.inc

-@@ -225,7 +225,7 @@ test2064 test2065 test2066 test2067 test2068 test2069 \

- test2064 test2065 test2066 test2067 test2068 test2069 test2070 \

-          test2071 test2072 test2073 test2074 test2075 test2076 test2077 \

- test2078 \

--test2080 \

-+test2080 test2081 \

- test2100 \

- \

- test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \

-diff --git a/tests/data/test2081 b/tests/data/test2081

-new file mode 100644

-index 000000000000..a6733e737beb

---- /dev/null

-+++ b/tests/data/test2081

-@@ -0,0 +1,66 @@

-+<testcase>

-+<info>

-+<keywords>

-+HTTP

-+HTTP GET

-+referer

-+followlocation

-+--write-out

-+</keywords>

-+</info>

-+

-+# Server-side

-+<reply>

-+<data nocheck="yes">

-+HTTP/1.1 301 This is a weirdo text message swsclose

-+Location: data/%TESTNUMBER0002.txt?coolsite=yes

-+Content-Length: 62

-+Connection: close

-+

-+This server reply is for testing a simple Location: following

-+</data>

-+</reply>

-+

-+# Client-side

-+<client>

-+<server>

-+http

-+</server>

-+ <name>

-+Automatic referrer credential and anchor stripping check

-+ </name>

-+ <command>

-+http://user:pass@%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER#anchor --location --referer ';auto' --write-out '%{referer}\n'

-+</command>

-+</client>

-+

-+# Verify data after the test has been "shot"

-+<verify>

-+<errorcode>

-+52

-+</errorcode>

-+<protocol>

-+GET /we/want/our/%TESTNUMBER HTTP/1.1

-+Host: %HOSTIP:%HTTPPORT

-+Authorization: Basic dXNlcjpwYXNz

-+User-Agent: curl/%VERSION

-+Accept: */*

-+

-+GET /we/want/our/data/%TESTNUMBER0002.txt?coolsite=yes HTTP/1.1

-+Host: %HOSTIP:%HTTPPORT

-+Authorization: Basic dXNlcjpwYXNz

-+User-Agent: curl/%VERSION

-+Accept: */*

-+Referer: http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER

-+

-+</protocol>

-+<stdout>

-+HTTP/1.1 301 This is a weirdo text message swsclose

-+Location: data/%TESTNUMBER0002.txt?coolsite=yes

-+Content-Length: 62

-+Connection: close

-+

-+http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER

-+</stdout>

-+</verify>

-+</testcase>

diff --git a/pkgs/tools/networking/curl/7.74.0-CVE-2021-22890.patch b/pkgs/tools/networking/curl/7.74.0-CVE-2021-22890.patch
deleted file mode 100644
index 06cc3842e32..00000000000
--- a/pkgs/tools/networking/curl/7.74.0-CVE-2021-22890.patch
+++ /dev/null
@@ -1,473 +0,0 @@
-Based on upstream b09c8ee15771c614c4bf3ddac893cdb12187c844, adapted by ris mostly to
-compensate for lack of bbe3aa9f881fa27fe828e3c9a36d6831f254a3ee
-
-diff --git a/lib/vtls/bearssl.c b/lib/vtls/bearssl.c
-index 36c32d8d55be..39fc1a29209c 100644
---- a/lib/vtls/bearssl.c
-+++ b/lib/vtls/bearssl.c
-@@ -375,7 +375,8 @@ static CURLcode bearssl_connect_step1(struct Curl_easy *data,
-     void *session;
- 
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, &session, NULL, sockindex)) {
-+    if(!Curl_ssl_getsessionid(conn, SSL_IS_PROXY() ? TRUE : FALSE,
-+                              &session, NULL, sockindex)) {
-       br_ssl_engine_set_session_parameters(&backend->ctx.eng, session);
-       infof(data, "BearSSL: re-using session ID\n");
-     }
-@@ -571,9 +572,13 @@ static CURLcode bearssl_connect_step3(struct Curl_easy *data,
-     br_ssl_engine_get_session_parameters(&backend->ctx.eng, session);
-     Curl_ssl_sessionid_lock(conn);
--    incache = !(Curl_ssl_getsessionid(conn, &oldsession, NULL, sockindex));
-+    incache = !(Curl_ssl_getsessionid(conn,
-+                                      SSL_IS_PROXY() ? TRUE : FALSE,
-+                                      &oldsession, NULL, sockindex));
-     if(incache)
-       Curl_ssl_delsessionid(conn, oldsession);
--    ret = Curl_ssl_addsessionid(conn, session, 0, sockindex);
-+    ret = Curl_ssl_addsessionid(conn,
-+                                SSL_IS_PROXY() ? TRUE : FALSE,
-+                                session, 0, sockindex);
-     Curl_ssl_sessionid_unlock(conn);
-     if(ret) {
-       free(session);
-diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
-index a75937b4646c..3b0d940a60e1 100644
---- a/lib/vtls/gtls.c
-+++ b/lib/vtls/gtls.c
-@@ -727,5 +727,7 @@ gtls_connect_step1(struct Curl_easy *data,
- 
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, &ssl_idsize, sockindex)) {
-+    if(!Curl_ssl_getsessionid(conn,
-+                              SSL_IS_PROXY() ? TRUE : FALSE,
-+                              &ssl_sessionid, &ssl_idsize, sockindex)) {
-       /* we got a session id, use it! */
-       gnutls_session_set_data(session, ssl_sessionid, ssl_idsize);
-@@ -1286,8 +1287,9 @@ gtls_connect_step3(struct Curl_easy *data,
-       gnutls_session_get_data(session, connect_sessionid, &connect_idsize);
- 
-       Curl_ssl_sessionid_lock(conn);
--      incache = !(Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL,
--                                        sockindex));
-+      incache = !(Curl_ssl_getsessionid(conn,
-+                                        SSL_IS_PROXY() ? TRUE : FALSE,
-+                                        &ssl_sessionid, NULL, sockindex));
-       if(incache) {
-         /* there was one before in the cache, so instead of risking that the
-            previous one was rejected, we just kill that and store the new */
-@@ -1295,8 +1297,10 @@ gtls_connect_step3(struct Curl_easy *data,
-       }
- 
-       /* store this session id */
--      result = Curl_ssl_addsessionid(conn, connect_sessionid, connect_idsize,
--                                     sockindex);
-+      result = Curl_ssl_addsessionid(conn,
-+                                     SSL_IS_PROXY() ? TRUE : FALSE,
-+                                     connect_sessionid, connect_idsize,
-+                                     sockindex);
-       Curl_ssl_sessionid_unlock(conn);
-       if(result) {
-         free(connect_sessionid);
-diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
-index 95cd4d99b665..93a7ac1fd87d 100644
---- a/lib/vtls/mbedtls.c
-+++ b/lib/vtls/mbedtls.c
-@@ -463,7 +463,9 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn,
-     void *old_session = NULL;
- 
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, &old_session, NULL, sockindex)) {
-+    if(!Curl_ssl_getsessionid(conn,
-+                              SSL_IS_PROXY() ? TRUE : FALSE,
-+                              &old_session, NULL, sockindex)) {
-       ret = mbedtls_ssl_set_session(&backend->ssl, old_session);
-       if(ret) {
-         Curl_ssl_sessionid_unlock(conn);
-@@ -724,6 +726,7 @@ mbed_connect_step3(struct Curl_easy *data, struct connectdata *conn,
-     int ret;
-     mbedtls_ssl_session *our_ssl_sessionid;
-     void *old_ssl_sessionid = NULL;
-+    bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
- 
-     our_ssl_sessionid = malloc(sizeof(mbedtls_ssl_session));
-     if(!our_ssl_sessionid)
-@@ -742,10 +745,12 @@ mbed_connect_step3(struct Curl_easy *data, struct connectdata *conn,
- 
-     /* If there's already a matching session in the cache, delete it */
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL, sockindex))
-+    if(!Curl_ssl_getsessionid(conn, isproxy, &old_ssl_sessionid, NULL,
-+                              sockindex))
-       Curl_ssl_delsessionid(conn, old_ssl_sessionid);
- 
--    retcode = Curl_ssl_addsessionid(conn, our_ssl_sessionid, 0, sockindex);
-+    retcode = Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid,
-+                                    0, sockindex);
-     Curl_ssl_sessionid_unlock(conn);
-     if(retcode) {
-       mbedtls_ssl_session_free(our_ssl_sessionid);
-diff --git a/lib/vtls/mesalink.c b/lib/vtls/mesalink.c
-index 4f1ab8627f49..5d6a1495d790 100644
---- a/lib/vtls/mesalink.c
-+++ b/lib/vtls/mesalink.c
-@@ -261,7 +261,9 @@ mesalink_connect_step1(struct Curl_easy *data,
-     void *ssl_sessionid = NULL;
- 
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
-+    if(!Curl_ssl_getsessionid(conn,
-+                              SSL_IS_PROXY() ? TRUE : FALSE,
-+                              &ssl_sessionid, NULL, sockindex)) {
-       /* we got a session id, use it! */
-       if(!SSL_set_session(BACKEND->handle, ssl_sessionid)) {
-         Curl_ssl_sessionid_unlock(conn);
-@@ -345,12 +347,14 @@ mesalink_connect_step3(struct connectdata *conn, int sockindex)
-     bool incache;
-     SSL_SESSION *our_ssl_sessionid;
-     void *old_ssl_sessionid = NULL;
-+    bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
- 
-     our_ssl_sessionid = SSL_get_session(BACKEND->handle);
- 
-     Curl_ssl_sessionid_lock(conn);
-     incache =
--      !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL, sockindex));
-+      !(Curl_ssl_getsessionid(conn, isproxy, &old_ssl_sessionid, NULL,
-+                              sockindex));
-     if(incache) {
-       if(old_ssl_sessionid != our_ssl_sessionid) {
-         infof(data, "old SSL session ID is stale, removing\n");
-@@ -361,8 +364,9 @@ mesalink_connect_step3(struct connectdata *conn, int sockindex)
-     }
- 
-     if(!incache) {
--      result = Curl_ssl_addsessionid(
--        conn, our_ssl_sessionid, 0 /* unknown size */, sockindex);
-+      result =
-+        Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid, 0,
-+                              sockindex);
-       if(result) {
-         Curl_ssl_sessionid_unlock(conn);
-         failf(data, "failed to store ssl session");
-diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
-index 498f8b9d1d08..68b98984b460 100644
---- a/lib/vtls/openssl.c
-+++ b/lib/vtls/openssl.c
-@@ -393,12 +393,23 @@ static int ossl_get_ssl_conn_index(void)
-  */
- static int ossl_get_ssl_sockindex_index(void)
- {
--  static int ssl_ex_data_sockindex_index = -1;
--  if(ssl_ex_data_sockindex_index < 0) {
--    ssl_ex_data_sockindex_index = SSL_get_ex_new_index(0, NULL, NULL, NULL,
--        NULL);
-+  static int sockindex_index = -1;
-+  if(sockindex_index < 0) {
-+    sockindex_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
-   }
--  return ssl_ex_data_sockindex_index;
-+  return sockindex_index;
-+}
-+
-+/* Return an extra data index for proxy boolean.
-+ * This index can be used with SSL_get_ex_data() and SSL_set_ex_data().
-+ */
-+static int ossl_get_proxy_index(void)
-+{
-+  static int proxy_index = -1;
-+  if(proxy_index < 0) {
-+    proxy_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
-+  }
-+  return proxy_index;
- }
- 
- static int passwd_callback(char *buf, int num, int encrypting,
-@@ -1174,6 +1185,7 @@ static int ossl_init(void)
- 
-   /* Initialize the extra data indexes */
--  if(ossl_get_ssl_conn_index() < 0 || ossl_get_ssl_sockindex_index() < 0)
-+  if(ossl_get_ssl_conn_index() < 0 ||
-+     ossl_get_ssl_sockindex_index() < 0 || ossl_get_proxy_index() < 0)
-     return 0;
- 
-   return 1;
-@@ -2432,8 +2443,10 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
-   curl_socket_t *sockindex_ptr;
-   int connectdata_idx = ossl_get_ssl_conn_index();
-   int sockindex_idx = ossl_get_ssl_sockindex_index();
-+  int proxy_idx = ossl_get_proxy_index();
-+  bool isproxy;
- 
--  if(connectdata_idx < 0 || sockindex_idx < 0)
-+  if(connectdata_idx < 0 || sockindex_idx < 0 || proxy_idx < 0)
-     return 0;
- 
-   conn = (struct connectdata*) SSL_get_ex_data(ssl, connectdata_idx);
-@@ -2446,13 +2459,18 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
-   sockindex_ptr = (curl_socket_t*) SSL_get_ex_data(ssl, sockindex_idx);
-   sockindex = (int)(sockindex_ptr - conn->sock);
- 
-+  isproxy = SSL_get_ex_data(ssl, proxy_idx) ? TRUE : FALSE;
-+
-   if(SSL_SET_OPTION(primary.sessionid)) {
-     bool incache;
-     void *old_ssl_sessionid = NULL;
- 
-     Curl_ssl_sessionid_lock(conn);
--    incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL,
--                                      sockindex));
-+    if(isproxy)
-+      incache = FALSE;
-+    else
-+      incache = !(Curl_ssl_getsessionid(conn, isproxy,
-+                                        &old_ssl_sessionid, NULL, sockindex));
-     if(incache) {
-       if(old_ssl_sessionid != ssl_sessionid) {
-         infof(data, "old SSL session ID is stale, removing\n");
-@@ -2462,8 +2480,8 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
-     }
- 
-     if(!incache) {
--      if(!Curl_ssl_addsessionid(conn, ssl_sessionid,
--                                      0 /* unknown size */, sockindex)) {
-+      if(!Curl_ssl_addsessionid(conn, isproxy, ssl_sessionid,
-+                                0 /* unknown size */, sockindex)) {
-         /* the session has been put into the session cache */
-         res = 1;
-       }
-@@ -3193,16 +3211,26 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
-     void *ssl_sessionid = NULL;
-     int connectdata_idx = ossl_get_ssl_conn_index();
-     int sockindex_idx = ossl_get_ssl_sockindex_index();
-+    int proxy_idx = ossl_get_proxy_index();
- 
--    if(connectdata_idx >= 0 && sockindex_idx >= 0) {
-+    if(connectdata_idx >= 0 && sockindex_idx >= 0 &&
-+       proxy_idx >= 0) {
-       /* Store the data needed for the "new session" callback.
-        * The sockindex is stored as a pointer to an array element. */
-       SSL_set_ex_data(backend->handle, connectdata_idx, conn);
-       SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
-+#ifndef CURL_DISABLE_PROXY
-+      SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
-+                      NULL);
-+#else
-+      SSL_set_ex_data(backend->handle, proxy_idx, NULL);
-+#endif
-+
-     }
- 
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
-+    if(!Curl_ssl_getsessionid(conn, SSL_IS_PROXY() ? TRUE : FALSE,
-+                              &ssl_sessionid, NULL, sockindex)) {
-       /* we got a session id, use it! */
-       if(!SSL_set_session(backend->handle, ssl_sessionid)) {
-         Curl_ssl_sessionid_unlock(conn);
-diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
-index d7b89d43f892..931bd853eb8e 100644
---- a/lib/vtls/schannel.c
-+++ b/lib/vtls/schannel.c
-@@ -496,5 +496,7 @@ schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn,
-   if(SSL_SET_OPTION(primary.sessionid)) {
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL, sockindex)) {
-+    if(!Curl_ssl_getsessionid(conn,
-+                              SSL_IS_PROXY() ? TRUE : FALSE,
-+                              (void **)&old_cred, NULL, sockindex)) {
-       BACKEND->cred = old_cred;
-       DEBUGF(infof(data, "schannel: re-using existing credential handle\n"));
-@@ -1337,8 +1338,9 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
-   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-   SECURITY_STATUS sspi_status = SEC_E_OK;
-   CERT_CONTEXT *ccert_context = NULL;
-+  bool isproxy = SSL_IS_PROXY();
- #ifdef DEBUGBUILD
--  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
-+  const char * const hostname = isproxy ? conn->http_proxy.host.name :
-     conn->host.name;
- #endif
- #ifdef HAS_ALPN
-@@ -1414,8 +1416,8 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
-     struct Curl_schannel_cred *old_cred = NULL;
- 
-     Curl_ssl_sessionid_lock(conn);
--    incache = !(Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL,
--                                      sockindex));
-+    incache = !(Curl_ssl_getsessionid(conn, isproxy, (void **)&old_cred,
-+                                      NULL, sockindex));
-     if(incache) {
-       if(old_cred != BACKEND->cred) {
-         DEBUGF(infof(data,
-@@ -1426,7 +1428,7 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
-       }
-     }
-     if(!incache) {
--      result = Curl_ssl_addsessionid(conn, (void *)BACKEND->cred,
-+      result = Curl_ssl_addsessionid(conn, isproxy, BACKEND->cred,
-                                      sizeof(struct Curl_schannel_cred),
-                                      sockindex);
-       if(result) {
-diff --git a/lib/vtls/sectransp.c b/lib/vtls/sectransp.c
-index 05b57dfaad91..e69b99b72cd6 100644
---- a/lib/vtls/sectransp.c
-+++ b/lib/vtls/sectransp.c
-@@ -1400,10 +1400,12 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
-   char * const ssl_cert = SSL_SET_OPTION(primary.clientcert);
-   const struct curl_blob *ssl_cert_blob = SSL_SET_OPTION(primary.cert_blob);
- #ifndef CURL_DISABLE_PROXY
--  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
-+  bool isproxy = SSL_IS_PROXY();
-+  const char * const hostname = isproxy ? conn->http_proxy.host.name :
-     conn->host.name;
-   const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
- #else
-+  const isproxy = FALSE;
-   const char * const hostname = conn->host.name;
-   const long int port = conn->remote_port;
- #endif
-@@ -1613,7 +1615,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
- #ifdef USE_NGHTTP2
-       if(data->state.httpversion >= CURL_HTTP_VERSION_2
- #ifndef CURL_DISABLE_PROXY
--         && (!SSL_IS_PROXY() || !conn->bits.tunnel_proxy)
-+         && (!isproxy || !conn->bits.tunnel_proxy)
- #endif
-         ) {
-         CFArrayAppendValue(alpnArr, CFSTR(NGHTTP2_PROTO_VERSION_ID));
-@@ -1953,7 +1955,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
-     size_t ssl_sessionid_len;
- 
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, (void **)&ssl_sessionid,
-+    if(!Curl_ssl_getsessionid(conn, isproxy, (void **)&ssl_sessionid,
-                               &ssl_sessionid_len, sockindex)) {
-       /* we got a session id, use it! */
-       err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
-@@ -1981,7 +1983,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
-         return CURLE_SSL_CONNECT_ERROR;
-       }
- 
--      result = Curl_ssl_addsessionid(conn, ssl_sessionid, ssl_sessionid_len,
-+      result = Curl_ssl_addsessionid(conn, isproxy, ssl_sessionid, ssl_sessionid_len,
-                                      sockindex);
-       Curl_ssl_sessionid_unlock(conn);
-       if(result) {
-diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index 6a0069237fdb..95fd6356285f 100644
---- a/lib/vtls/vtls.c
-+++ b/lib/vtls/vtls.c
-@@ -367,5 +367,6 @@ void Curl_ssl_sessionid_unlock(struct Curl_easy *data)
-  */
- bool Curl_ssl_getsessionid(struct connectdata *conn,
-+                           const bool isProxy,
-                            void **ssl_sessionid,
-                            size_t *idsize, /* set 0 if unknown */
-                            int sockindex)
-@@ -377,7 +378,6 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
-   bool no_match = TRUE;
- 
- #ifndef CURL_DISABLE_PROXY
--  const bool isProxy = CONNECT_PROXY_SSL();
-   struct ssl_primary_config * const ssl_config = isProxy ?
-     &conn->proxy_ssl_config :
-     &conn->ssl_config;
-@@ -389,10 +389,15 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
-   struct ssl_primary_config * const ssl_config = &conn->ssl_config;
-   const char * const name = conn->host.name;
-   int port = conn->remote_port;
--  (void)sockindex;
- #endif
-+  (void)sockindex;
-   *ssl_sessionid = NULL;
- 
-+#ifdef CURL_DISABLE_PROXY
-+  if(isProxy)
-+    return TRUE;
-+#endif
-+
-   DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
- 
-   if(!SSL_SET_OPTION(primary.sessionid))
-@@ -480,5 +485,6 @@ void Curl_ssl_delsessionid(struct Curl_easy *data, void *ssl_sessionid)
-  */
- CURLcode Curl_ssl_addsessionid(struct connectdata *conn,
-+                               bool isProxy,
-                                void *ssl_sessionid,
-                                size_t idsize,
-                                int sockindex)
-@@ -492,7 +498,6 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
-   int conn_to_port;
-   long *general_age;
- #ifndef CURL_DISABLE_PROXY
--  const bool isProxy = CONNECT_PROXY_SSL();
-   struct ssl_primary_config * const ssl_config = isProxy ?
-     &conn->proxy_ssl_config :
-     &conn->ssl_config;
-@@ -505,6 +510,7 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
-   const char *hostname = conn->host.name;
-   (void)sockindex;
- #endif
-+  (void)sockindex;
-   DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
- 
-   clone_host = strdup(hostname);
-diff --git a/lib/vtls/vtls.h b/lib/vtls/vtls.h
-index 273184f1894a..2b43e7744b19 100644
---- a/lib/vtls/vtls.h
-+++ b/lib/vtls/vtls.h
-@@ -235,5 +235,6 @@ void Curl_ssl_sessionid_unlock(struct Curl_easy *data);
-  */
- bool Curl_ssl_getsessionid(struct connectdata *conn,
-+                           const bool isproxy,
-                            void **ssl_sessionid,
-                            size_t *idsize, /* set 0 if unknown */
-                            int sockindex);
-@@ -245,5 +246,6 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
-  */
- CURLcode Curl_ssl_addsessionid(struct connectdata *conn,
-+                               const bool isProxy,
-                                void *ssl_sessionid,
-                                size_t idsize,
-                                int sockindex);
-diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
-index 7159ac9d5e64..8fb2ea7acf31 100644
---- a/lib/vtls/wolfssl.c
-+++ b/lib/vtls/wolfssl.c
-@@ -516,7 +516,9 @@ wolfssl_connect_step1(struct Curl_easy *data, struct connectdata *conn,
-     void *ssl_sessionid = NULL;
- 
-     Curl_ssl_sessionid_lock(conn);
--    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
-+    if(!Curl_ssl_getsessionid(conn,
-+                              SSL_IS_PROXY() ? TRUE : FALSE,
-+                              &ssl_sessionid, NULL, sockindex)) {
-       /* we got a session id, use it! */
-       if(!SSL_set_session(backend->handle, ssl_sessionid)) {
-         char error_buffer[WOLFSSL_MAX_ERROR_SZ];
-@@ -772,10 +774,11 @@ wolfssl_connect_step3(struct Curl_easy *data, struct connectdata *conn,
-     void *old_ssl_sessionid = NULL;
- 
-     our_ssl_sessionid = SSL_get_session(backend->handle);
-+    bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
- 
-     Curl_ssl_sessionid_lock(conn);
--    incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL,
--                                      sockindex));
-+    incache = !(Curl_ssl_getsessionid(conn, isproxy,
-+                                      &old_ssl_sessionid, NULL, sockindex));
-     if(incache) {
-       if(old_ssl_sessionid != our_ssl_sessionid) {
-         infof(data, "old SSL session ID is stale, removing\n");
-@@ -786,8 +789,8 @@ wolfssl_connect_step3(struct Curl_easy *data, struct connectdata *conn,
-     }
- 
-     if(!incache) {
--      result = Curl_ssl_addsessionid(conn, our_ssl_sessionid,
--                                     0 /* unknown size */, sockindex);
-+      result = Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid,
-+                                     0, sockindex);
-       if(result) {
-         Curl_ssl_sessionid_unlock(conn);
-         failf(data, "failed to store ssl session");
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 7c24be7aea7..f73ab773876 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -35,21 +35,16 @@ assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
   pname = "curl";
-  version = "7.74.0";
+  version = "7.76.1";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
     ];
-    sha256 = "19bp3d91xq9vqwlbzq261j23mk9lz4lyka4gr2fm6dhnd3k66k8g";
+    sha256 = "1scmfrp0c27pkd7yva9k50miprjpsyfbb33apx72qc9igm6ii3ks";
   };
 
-  patches = [
-    ./7.74.0-CVE-2021-22876.patch
-    ./7.74.0-CVE-2021-22890.patch
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/tools/text/diffutils/default.nix
index bcb7fad58da..d95e7ae399d 100644
--- a/pkgs/tools/text/diffutils/default.nix
+++ b/pkgs/tools/text/diffutils/default.nix
@@ -6,10 +6,11 @@
 # files.
 
 stdenv.mkDerivation rec {
-  name = "diffutils-3.7";
+  pname = "diffutils";
+  version = "3.7";
 
   src = fetchurl {
-    url = "mirror://gnu/diffutils/${name}.tar.xz";
+    url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
     sha256 = "09isrg0isjinv8c535nxsi1s86wfdfzml80dbw41dj9x3hiad9xk";
   };
 
diff --git a/pkgs/tools/video/swftools/default.nix b/pkgs/tools/video/swftools/default.nix
index cd3af661840..6867869a0a9 100644
--- a/pkgs/tools/video/swftools/default.nix
+++ b/pkgs/tools/video/swftools/default.nix
@@ -1,6 +1,5 @@
-{ lib, stdenv, fetchurl, freetype, libjpeg, libungif, zlib }:
+{ lib, stdenv, fetchurl, freetype, libjpeg, zlib }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "swftools";
   version = "0.9.2";
@@ -12,13 +11,30 @@ stdenv.mkDerivation rec {
 
   patches = [ ./swftools.patch ];
 
-  buildInputs = [ freetype libjpeg libungif zlib ];
+  buildInputs = [ freetype libjpeg zlib ];
 
-  meta = {
+  meta = with lib; {
     description = "Collection of SWF manipulation and creation utilities";
     homepage = "http://www.swftools.org/about.html";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = [ maintainers.koral ];
     platforms = lib.platforms.unix;
+    broken = true;
+    knownVulnerabilities = [
+      "CVE-2017-10976"
+      "CVE-2017-11096"
+      "CVE-2017-11097"
+      "CVE-2017-11098"
+      "CVE-2017-11099"
+      "CVE-2017-11100"
+      "CVE-2017-11101"
+      "CVE-2017-16711"
+      "CVE-2017-16793"
+      "CVE-2017-16794"
+      "CVE-2017-16796"
+      "CVE-2017-16797"
+      "CVE-2017-16868"
+      "CVE-2017-16890"
+    ];
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index a4e0597310a..b52ce922e78 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -239,6 +239,7 @@ mapAliases ({
   gdb-multitarget = gdb; # added 2017-11-13
   gdk_pixbuf = gdk-pixbuf; # added 2019-05-22
   gettextWithExpat = gettext; # 2016-02-19
+  giflib_4_1 = throw "giflib_4_1 has been removed; use giflib instead"; # 2020-02-12
   gitAndTools = self // { # added 2021-01-14
     darcsToGit = darcs-to-git;
     gitAnnex = git-annex;
@@ -388,6 +389,7 @@ mapAliases ({
   libtxc_dxtn = throw "libtxc_dxtn was removed 2020-03-16, now integrated in Mesa";
   libtxc_dxtn_s2tc = throw "libtxc_dxtn_s2tc was removed 2020-03-16, now integrated in Mesa";
   libudev = udev; # added 2018-04-25
+  libungif = giflib; # added 2020-02-12
   libusb = libusb1; # added 2020-04-28
   libsexy = throw "libsexy has been removed from nixpkgs, as it's abandoned and no package needed it."; # 2019-12-10
   libstdcxxHook = throw "libstdcxx hook has been removed because cc-wrapper is now directly aware of the c++ standard library intended to be used."; # 2020-06-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c3915304ebf..1dd33edbd94 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8473,7 +8473,7 @@ in
 
   spacebar = callPackage ../os-specific/darwin/spacebar {
     inherit (darwin.apple_sdk.frameworks)
-      Carbon Cocoa ScriptingBridge;
+      Carbon Cocoa ScriptingBridge SkyLight;
   };
 
   spaceFM = callPackage ../applications/misc/spacefm { };
@@ -14593,7 +14593,6 @@ in
 
   glsurf = callPackage ../applications/science/math/glsurf {
     libpng = libpng12;
-    giflib = giflib_4_1;
     ocamlPackages = ocaml-ng.ocamlPackages_4_01_0;
   };
 
@@ -16239,13 +16238,10 @@ in
 
   libwhereami = callPackage ../development/libraries/libwhereami { };
 
-  giflib_4_1 = callPackage ../development/libraries/giflib/4.1.nix { };
   giflib     = callPackage ../development/libraries/giflib { };
 
   libunarr = callPackage ../development/libraries/libunarr { };
 
-  libungif = callPackage ../development/libraries/giflib/libungif.nix { };
-
   libunibreak = callPackage ../development/libraries/libunibreak { };
 
   libuninameslist = callPackage ../development/libraries/libuninameslist { };
@@ -30563,9 +30559,7 @@ in
 
   vbam = callPackage ../misc/emulators/vbam { };
 
-  vice = callPackage ../misc/emulators/vice {
-    giflib = giflib_4_1;
-  };
+  vice = callPackage ../misc/emulators/vice { };
 
   ViennaRNA = callPackage ../applications/science/molecular-dynamics/viennarna { };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index d8c1f2d3e40..a2718e6d8df 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -114,12 +114,11 @@ let
       then callPackage ../development/ocaml-modules/camomile { }
       else callPackage ../development/ocaml-modules/camomile/0.8.5.nix { };
 
-    camlimages_4_0 =
+    camlimages_4_1_2 =
       if lib.versionOlder "4.02" ocaml.version
       then null
-      else callPackage ../development/ocaml-modules/camlimages/4.0.nix {
+      else callPackage ../development/ocaml-modules/camlimages/4.1.2.nix {
       libpng = pkgs.libpng12;
-      giflib = pkgs.giflib_4_1;
     };
     camlimages = callPackage ../development/ocaml-modules/camlimages { };