Merge commit '6e3ee8957637a60f5072e33d78e05c0f65c54366'

Conflicts:
	nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix

249 files changed, 3723 insertions, 2491 deletions

diff --git a/nixpkgs/doc/builders/special/fhs-environments.section.md b/nixpkgs/doc/builders/special/fhs-environments.section.md
index 43dc99b7c18f..cacad261e28f 100644
--- a/nixpkgs/doc/builders/special/fhs-environments.section.md
+++ b/nixpkgs/doc/builders/special/fhs-environments.section.md
@@ -45,3 +45,5 @@ One can create a simple environment using a `shell.nix` like that:
 ```
 
 Running `nix-shell` would then drop you into a shell with these libraries and binaries available. You can use this to run closed-source applications which expect FHS structure without hassles: simply change `runScript` to the application path, e.g. `./bin/start.sh` -- relative paths are supported.
+
+Additionally, the FHS builder links all relocated gsettings-schemas (the glib setup-hook moves them to `share/gsettings-schemas/${name}/glib-2.0/schemas`) to their standard FHS location. This means you don't need to wrap binaries with `wrapGAppsHook`.
diff --git a/nixpkgs/doc/using/overlays.chapter.md b/nixpkgs/doc/using/overlays.chapter.md
index df152bc14e7b..a51aa9ee8fc5 100644
--- a/nixpkgs/doc/using/overlays.chapter.md
+++ b/nixpkgs/doc/using/overlays.chapter.md
@@ -77,7 +77,7 @@ In Nixpkgs, we have multiple implementations of the BLAS/LAPACK numerical linear
 
     The Nixpkgs attribute is `openblas` for ILP64 (integer width = 64 bits) and `openblasCompat` for LP64 (integer width = 32 bits).  `openblasCompat` is the default.
 
--   [LAPACK reference](http://www.netlib.org/lapack/) (also provides BLAS)
+-   [LAPACK reference](http://www.netlib.org/lapack/) (also provides BLAS and CBLAS)
 
     The Nixpkgs attribute is `lapack-reference`.
 
@@ -117,7 +117,23 @@ $ LD_LIBRARY_PATH=$(nix-build -A mkl)/lib${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH n
 
 Intel MKL requires an `openmp` implementation when running with multiple processors. By default, `mkl` will use Intel's `iomp` implementation if no other is specified, but this is a runtime-only dependency and binary compatible with the LLVM implementation. To use that one instead, Intel recommends users set it with `LD_PRELOAD`. Note that `mkl` is only available on `x86_64-linux` and `x86_64-darwin`. Moreover, Hydra is not building and distributing pre-compiled binaries using it.
 
-For BLAS/LAPACK switching to work correctly, all packages must depend on `blas` or `lapack`. This ensures that only one BLAS/LAPACK library is used at one time. There are two versions of BLAS/LAPACK currently in the wild, `LP64` (integer size = 32 bits) and `ILP64` (integer size = 64 bits). Some software needs special flags or patches to work with `ILP64`. You can check if `ILP64` is used in Nixpkgs with `blas.isILP64` and `lapack.isILP64`. Some software does NOT work with `ILP64`, and derivations need to specify an assertion to prevent this. You can prevent `ILP64` from being used with the following:
+To override `blas` and `lapack` with its reference implementations (i.e. for development purposes), one can use the following overlay:
+
+```nix
+self: super:
+
+{
+  blas = super.blas.override {
+    blasProvider = self.lapack-reference;
+  };
+
+  lapack = super.lapack.override {
+    lapackProvider = self.lapack-reference;
+  };
+}
+```
+
+For BLAS/LAPACK switching to work correctly, all packages must depend on `blas` or `lapack`. This ensures that only one BLAS/LAPACK library is used at one time. There are two versions of BLAS/LAPACK currently in the wild, `LP64` (integer size = 32 bits) and `ILP64` (integer size = 64 bits). The attributes `blas` and `lapack` are `LP64` by default. Their `ILP64` version are provided through the attributes `blas-ilp64` and `lapack-ilp64`. Some software needs special flags or patches to work with `ILP64`. You can check if `ILP64` is used in Nixpkgs with `blas.isILP64` and `lapack.isILP64`. Some software does NOT work with `ILP64`, and derivations need to specify an assertion to prevent this. You can prevent `ILP64` from being used with the following:
 
 ```nix
 { stdenv, blas, lapack, ... }:
diff --git a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index d3a944533ab7..396de8cd77c2 100644
--- a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -406,6 +406,24 @@
       </listitem>
       <listitem>
         <para>
+          <literal>fonts.fonts</literal> no longer includes ancient
+          bitmap fonts when both
+          <literal>config.services.xserver.enable</literal> and
+          <literal>config.nixpkgs.config.allowUnfree</literal> are
+          enabled. If you still want these fonts, use:
+        </para>
+        <programlisting language="bash">
+{
+  fonts.fonts = [
+    pkgs.xorg.fontbhlucidatypewriter100dpi
+    pkgs.xorg.fontbhlucidatypewriter75dpi
+    pkgs.xorg.fontbh100dpi
+  ];
+}
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
           The DHCP server (<literal>services.dhcpd4</literal>,
           <literal>services.dhcpd6</literal>) has been hardened. The
           service is now using the systemd’s
@@ -1292,6 +1310,15 @@
       </listitem>
       <listitem>
         <para>
+          The option
+          <literal>services.xserver.videoDriver = [ &quot;nvidia&quot; ];</literal>
+          will now also install
+          <link xlink:href="https://github.com/elFarto/nvidia-vaapi-driver">nvidia
+          VA-API drivers</link> by default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The <literal>firmwareLinuxNonfree</literal> package has been
           renamed to <literal>linux-firmware</literal>.
         </para>
diff --git a/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md b/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md
index fe30cbc3cf5d..2f730de737c0 100644
--- a/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -131,6 +131,19 @@ In addition to numerous new and upgraded packages, this release has the followin
   This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
   The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.
 
+- `fonts.fonts` no longer includes ancient bitmap fonts when both `config.services.xserver.enable` and `config.nixpkgs.config.allowUnfree` are enabled.
+  If you still want these fonts, use:
+
+  ```nix
+  {
+    fonts.fonts = [
+      pkgs.xorg.fontbhlucidatypewriter100dpi
+      pkgs.xorg.fontbhlucidatypewriter75dpi
+      pkgs.xorg.fontbh100dpi
+    ];
+  }
+  ```
+
 - The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
   The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
   The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
@@ -477,6 +490,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The option `services.thelounge.plugins` has been added to allow installing plugins for The Lounge. Plugins can be found in `pkgs.theLoungePlugins.plugins` and `pkgs.theLoungePlugins.themes`.
 
+- The option `services.xserver.videoDriver = [ "nvidia" ];` will now also install [nvidia VA-API drivers](https://github.com/elFarto/nvidia-vaapi-driver) by default.
+
 - The `firmwareLinuxNonfree` package has been renamed to `linux-firmware`.
 
 - It is now possible to specify wordlists to include as handy to access environment variables using the `config.environment.wordlist` configuration options.
diff --git a/nixpkgs/nixos/modules/config/fonts/fonts.nix b/nixpkgs/nixos/modules/config/fonts/fonts.nix
index 04952898cb76..adc6654afc79 100644
--- a/nixpkgs/nixos/modules/config/fonts/fonts.nix
+++ b/nixpkgs/nixos/modules/config/fonts/fonts.nix
@@ -39,11 +39,6 @@ let
   defaultXFonts =
     [ (if hasHidpi then fontcursormisc_hidpi else pkgs.xorg.fontcursormisc)
       pkgs.xorg.fontmiscmisc
-    ] ++ optionals (config.nixpkgs.config.allowUnfree or false)
-    [ # these are unfree, and will make usage with xserver fail
-      pkgs.xorg.fontbhlucidatypewriter100dpi
-      pkgs.xorg.fontbhlucidatypewriter75dpi
-      pkgs.xorg.fontbh100dpi
     ];
 
 in
diff --git a/nixpkgs/nixos/modules/hardware/video/nvidia.nix b/nixpkgs/nixos/modules/hardware/video/nvidia.nix
index c0ba60e49a73..a81220a92a1b 100644
--- a/nixpkgs/nixos/modules/hardware/video/nvidia.nix
+++ b/nixpkgs/nixos/modules/hardware/video/nvidia.nix
@@ -285,8 +285,12 @@ in
 
     hardware.opengl.package = mkIf (!offloadCfg.enable) nvidia_x11.out;
     hardware.opengl.package32 = mkIf (!offloadCfg.enable) nvidia_x11.lib32;
-    hardware.opengl.extraPackages = optional offloadCfg.enable nvidia_x11.out;
-    hardware.opengl.extraPackages32 = optional offloadCfg.enable nvidia_x11.lib32;
+    hardware.opengl.extraPackages = [
+      pkgs.nvidia-vaapi-driver
+    ] ++ optional offloadCfg.enable nvidia_x11.out;
+    hardware.opengl.extraPackages32 = [
+      pkgs.pkgsi686Linux.nvidia-vaapi-driver
+    ] ++ optional offloadCfg.enable nvidia_x11.lib32;
 
     environment.systemPackages = [ nvidia_x11.bin ]
       ++ optionals cfg.nvidiaSettings [ nvidia_x11.settings ]
diff --git a/nixpkgs/nixos/modules/programs/environment.nix b/nixpkgs/nixos/modules/programs/environment.nix
index d552c751afd7..a448727be778 100644
--- a/nixpkgs/nixos/modules/programs/environment.nix
+++ b/nixpkgs/nixos/modules/programs/environment.nix
@@ -40,13 +40,15 @@ in
         KDEDIRS = [ "" ];
         QT_PLUGIN_PATH = [ "/lib/qt4/plugins" "/lib/kde4/plugins" ];
         QTWEBKIT_PLUGIN_PATH = [ "/lib/mozilla/plugins/" ];
-        GTK_PATH = [ "/lib/gtk-2.0" "/lib/gtk-3.0" ];
+        GTK_PATH = [ "/lib/gtk-2.0" "/lib/gtk-3.0" "/lib/gtk-4.0" ];
         XDG_CONFIG_DIRS = [ "/etc/xdg" ];
         XDG_DATA_DIRS = [ "/share" ];
         MOZ_PLUGIN_PATH = [ "/lib/mozilla/plugins" ];
         LIBEXEC_PATH = [ "/lib/libexec" ];
       };
 
+    environment.pathsToLink = [ "/lib/gtk-2.0" "/lib/gtk-3.0" "/lib/gtk-4.0" ];
+
     environment.extraInit =
       ''
          unset ASPELL_CONF
diff --git a/nixpkgs/nixos/modules/services/security/tor.nix b/nixpkgs/nixos/modules/services/security/tor.nix
index 3bf70c4aa4fc..ddd216ca7fd0 100644
--- a/nixpkgs/nixos/modules/services/security/tor.nix
+++ b/nixpkgs/nixos/modules/services/security/tor.nix
@@ -1008,7 +1008,11 @@ in
         #InaccessiblePaths = [ "-+${runDir}/root" ];
         UMask = "0066";
         BindPaths = [ stateDir ];
-        BindReadOnlyPaths = [ storeDir "/etc" ];
+        BindReadOnlyPaths = [ storeDir "/etc" ] ++
+          optionals config.services.resolved.enable [
+            "/run/systemd/resolve/stub-resolv.conf"
+            "/run/systemd/resolve/resolv.conf"
+          ];
         AmbientCapabilities   = [""] ++ lib.optional bindsPrivilegedPort "CAP_NET_BIND_SERVICE";
         CapabilityBoundingSet = [""] ++ lib.optional bindsPrivilegedPort "CAP_NET_BIND_SERVICE";
         # ProtectClock= adds DeviceAllow=char-rtc r
diff --git a/nixpkgs/nixos/tests/all-tests.nix b/nixpkgs/nixos/tests/all-tests.nix
index 001518d02cba..98ca2e081086 100644
--- a/nixpkgs/nixos/tests/all-tests.nix
+++ b/nixpkgs/nixos/tests/all-tests.nix
@@ -433,6 +433,7 @@ in
   prometheus = handleTest ./prometheus.nix {};
   prometheus-exporters = handleTest ./prometheus-exporters.nix {};
   prosody = handleTest ./xmpp/prosody.nix {};
+  prosody-mysql = handleTest ./xmpp/prosody-mysql.nix {};
   proxy = handleTest ./proxy.nix {};
   prowlarr = handleTest ./prowlarr.nix {};
   pt2-clone = handleTest ./pt2-clone.nix {};
diff --git a/nixpkgs/nixos/tests/xmpp/prosody-mysql.nix b/nixpkgs/nixos/tests/xmpp/prosody-mysql.nix
new file mode 100644
index 000000000000..40f3e308a04e
--- /dev/null
+++ b/nixpkgs/nixos/tests/xmpp/prosody-mysql.nix
@@ -0,0 +1,124 @@
+let
+  cert = pkgs: pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=example.com/CN=uploads.example.com/CN=conference.example.com' -days 36500
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
+  createUsers = pkgs: pkgs.writeScriptBin "create-prosody-users" ''
+    #!${pkgs.bash}/bin/bash
+    set -e
+
+    # Creates and set password for the 2 xmpp test users.
+    #
+    # Doing that in a bash script instead of doing that in the test
+    # script allow us to easily provision the users when running that
+    # test interactively.
+
+    prosodyctl register cthon98 example.com nothunter2
+    prosodyctl register azurediamond example.com hunter2
+  '';
+  delUsers = pkgs: pkgs.writeScriptBin "delete-prosody-users" ''
+    #!${pkgs.bash}/bin/bash
+    set -e
+
+    # Deletes the test users.
+    #
+    # Doing that in a bash script instead of doing that in the test
+    # script allow us to easily provision the users when running that
+    # test interactively.
+
+    prosodyctl deluser cthon98@example.com
+    prosodyctl deluser azurediamond@example.com
+  '';
+in import ../make-test-python.nix {
+  name = "prosody-mysql";
+  nodes = {
+    client = { nodes, pkgs, config, ... }: {
+      security.pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
+      console.keyMap = "fr-bepo";
+      networking.extraHosts = ''
+        ${nodes.server.config.networking.primaryIPAddress} example.com
+        ${nodes.server.config.networking.primaryIPAddress} conference.example.com
+        ${nodes.server.config.networking.primaryIPAddress} uploads.example.com
+      '';
+      environment.systemPackages = [
+        (pkgs.callPackage ./xmpp-sendmessage.nix { connectTo = nodes.server.config.networking.primaryIPAddress; })
+      ];
+    };
+    server = { config, pkgs, ... }: {
+      nixpkgs.overlays = [
+        (self: super: {
+          prosody = super.prosody.override {
+            withExtraLuaPackages = p: [ p.luadbi-mysql ];
+          };
+        })
+      ];
+      security.pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
+      console.keyMap = "fr-bepo";
+      networking.extraHosts = ''
+        ${config.networking.primaryIPAddress} example.com
+        ${config.networking.primaryIPAddress} conference.example.com
+        ${config.networking.primaryIPAddress} uploads.example.com
+      '';
+      networking.firewall.enable = false;
+      environment.systemPackages = [
+        (createUsers pkgs)
+        (delUsers pkgs)
+      ];
+      services.prosody = {
+        enable = true;
+        ssl.cert = "${cert pkgs}/cert.pem";
+        ssl.key = "${cert pkgs}/key.pem";
+        virtualHosts.example = {
+          domain = "example.com";
+          enabled = true;
+          ssl.cert = "${cert pkgs}/cert.pem";
+          ssl.key = "${cert pkgs}/key.pem";
+        };
+        muc = [
+          {
+            domain = "conference.example.com";
+          }
+        ];
+        uploadHttp = {
+          domain = "uploads.example.com";
+        };
+        extraConfig = ''
+          storage = "sql"
+          sql = {
+            driver = "MySQL";
+            database = "prosody";
+            host = "mysql";
+            port = 3306;
+            username = "prosody";
+            password = "password123";
+          };
+        '';
+      };
+    };
+    mysql = { config, pkgs, ... }: {
+      networking.firewall.enable = false;
+      services.mysql = {
+        enable = true;
+        initialScript = pkgs.writeText "mysql_init.sql" ''
+          CREATE DATABASE prosody;
+          CREATE USER 'prosody'@'server' IDENTIFIED BY 'password123';
+          GRANT ALL PRIVILEGES ON prosody.* TO 'prosody'@'server';
+          FLUSH PRIVILEGES;
+        '';
+        package = pkgs.mariadb;
+      };
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    # Check with mysql storage
+    mysql.wait_for_unit("mysql.service")
+    server.wait_for_unit("prosody.service")
+    server.succeed('prosodyctl status | grep "Prosody is running"')
+
+    server.succeed("create-prosody-users")
+    client.succeed("send-message")
+    server.succeed("delete-prosody-users")
+  '';
+}
diff --git a/nixpkgs/nixos/tests/xmpp/prosody.nix b/nixpkgs/nixos/tests/xmpp/prosody.nix
index c343b580879a..14eab56fb821 100644
--- a/nixpkgs/nixos/tests/xmpp/prosody.nix
+++ b/nixpkgs/nixos/tests/xmpp/prosody.nix
@@ -81,6 +81,7 @@ in import ../make-test-python.nix {
   };
 
   testScript = { nodes, ... }: ''
+    # Check with sqlite storage
     server.wait_for_unit("prosody.service")
     server.succeed('prosodyctl status | grep "Prosody is running"')
 
diff --git a/nixpkgs/pkgs/applications/audio/furnace/default.nix b/nixpkgs/pkgs/applications/audio/furnace/default.nix
new file mode 100644
index 000000000000..e7794175ac91
--- /dev/null
+++ b/nixpkgs/pkgs/applications/audio/furnace/default.nix
@@ -0,0 +1,99 @@
+{ stdenv
+, lib
+, nix-update-script
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, pkg-config
+, makeWrapper
+, fmt_8
+, libsndfile
+, SDL2
+, zlib
+, withJACK ? stdenv.hostPlatform.isUnix
+, libjack2
+, withGUI ? true
+, Cocoa
+}:
+
+stdenv.mkDerivation rec {
+  pname = "furnace";
+  version = "0.5.6";
+
+  src = fetchFromGitHub {
+    owner = "tildearrow";
+    repo = "furnace";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-BcaPQuDFkAaxFQKwoI6xdSWcyHo5VsqZcwf++JISqRs=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "0001-furnace-fix-wrong-include-path.patch";
+      url = "https://github.com/tildearrow/furnace/commit/456db22f9d9f0ed40d74fe50dde492e69e901fcc.patch";
+      sha256 = "17ikb1z9ldm7kdj00m4swsrq1qx94vlzhc6h020x3ryzwnglc8d3";
+    })
+  ];
+
+  postPatch = ''
+    # rtmidi is not used yet
+    sed -i -e '/add_subdirectory(extern\/rtmidi/d' -e '/DEPENDENCIES_LIBRARIES rtmidi/d' CMakeLists.txt
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    fmt_8
+    libsndfile
+    SDL2
+    zlib
+  ] ++ lib.optionals withJACK [
+    libjack2
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    Cocoa
+  ];
+
+  cmakeFlags = [
+    "-DBUILD_GUI=${if withGUI then "ON" else "OFF"}"
+    "-DSYSTEM_FMT=ON"
+    "-DSYSTEM_LIBSNDFILE=ON"
+    "-DSYSTEM_ZLIB=ON"
+    "-DSYSTEM_SDL2=ON"
+    "-DWITH_JACK=${if withJACK then "ON" else "OFF"}"
+    "-DWARNINGS_ARE_ERRORS=ON"
+  ];
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Normal CMake install phase on Darwin only installs the binary, the user is expected to use CPack to build a
+    # bundle. That adds alot of overhead for not much benefit (CPack is currently abit broken, and needs impure access
+    # to /usr/bin/hdiutil). So we'll manually assemble & install everything instead.
+
+    mkdir -p $out/{Applications/Furnace.app/Contents/{MacOS,Resources},share/{,doc,licenses}/furnace}
+    mv $out/{bin,Applications/Furnace.app/Contents/MacOS}/furnace
+    makeWrapper $out/{Applications/Furnace.app/Contents/MacOS,bin}/furnace
+
+    install -m644 {../res,$out/Applications/Furnace.app/Contents}/Info.plist
+    install -m644 ../res/icon.icns $out/Applications/Furnace.app/Contents/Resources/Furnace.icns
+    install -m644 {..,$out/share/licenses/furnace}/LICENSE
+    cp -r ../papers $out/share/doc/furnace/
+    cp -r ../demos $out/share/furnace/
+  '';
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
+  meta = with lib; {
+    description = "Multi-system chiptune tracker compatible with DefleMask modules";
+    homepage = "https://github.com/tildearrow/furnace";
+    license = with licenses; [ gpl2Plus ];
+    maintainers = with maintainers; [ OPNA2608 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/applications/audio/pt2-clone/default.nix b/nixpkgs/pkgs/applications/audio/pt2-clone/default.nix
index 05e6fac55f0a..57c327d429d7 100644
--- a/nixpkgs/pkgs/applications/audio/pt2-clone/default.nix
+++ b/nixpkgs/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.41";
+  version = "1.42";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "sha256-FnGtUoA6ol4lqp5HXjoJ3CHjdRs8eML0WI917ruid84=";
+    sha256 = "sha256-CwnEvQsxrYStJ4RxnE0lHt1fBHQEZrjSldnQnTOPaE0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/applications/editors/ed/default.nix b/nixpkgs/pkgs/applications/editors/ed/default.nix
index a6ab483a7b07..f5ed28cedf68 100644
--- a/nixpkgs/pkgs/applications/editors/ed/default.nix
+++ b/nixpkgs/pkgs/applications/editors/ed/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (rec {
   pname = "ed";
-  version = "1.17";
+  version = "1.18";
 
   src = fetchurl {
     url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    sha256 = "0m2yrkfjjraakxr98nsiakqrn351h99n706x9asgmdi57j43kpki";
+    sha256 = "sha256-rKjvrZgAxYdySiC5eqj8R+a1pH34Fgb+q6gxsHRGK08=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/nixpkgs/pkgs/applications/editors/vim/common.nix b/nixpkgs/pkgs/applications/editors/vim/common.nix
index 0cb09814c0f0..13c5c49db482 100644
--- a/nixpkgs/pkgs/applications/editors/vim/common.nix
+++ b/nixpkgs/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.4227";
+  version = "8.2.4350";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-Xj4ymkrWY5GWpQhEDYtPtaRovBa6j19dW9GWg9WSdig=";
+    sha256 = "sha256-+fCyLZi9+9r7tYoRQsVESkcoHHtM7vrVuOGdJi/9iF0=";
   };
 
   enableParallelBuilding = true;
diff --git a/nixpkgs/pkgs/applications/emulators/dolphin-emu/master.nix b/nixpkgs/pkgs/applications/emulators/dolphin-emu/master.nix
index 56e107300b54..be3e7f555f8f 100644
--- a/nixpkgs/pkgs/applications/emulators/dolphin-emu/master.nix
+++ b/nixpkgs/pkgs/applications/emulators/dolphin-emu/master.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dolphin-emu";
-  version = "5.0-15993";
+  version = "5.0-16101";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = "5e595616379a694789fe749e40a27ef069f0090e";
-    sha256 = "1kid8qjn8r7dxh2yc1y6yal6qkfxij0ymi3zryxsnym3rjh1jds9";
+    rev = "8ecfa537a242de74d2e372e30d9d79b14584b2fb";
+    sha256 = "3jLGVzTDzEtHWvIb9DFTbJiA9dE9Pm14vYER998Zln0=";
     fetchSubmodules = true;
   };
 
diff --git a/nixpkgs/pkgs/applications/misc/gramps/default.nix b/nixpkgs/pkgs/applications/misc/gramps/default.nix
index 531ce4237371..7365d297e3b8 100644
--- a/nixpkgs/pkgs/applications/misc/gramps/default.nix
+++ b/nixpkgs/pkgs/applications/misc/gramps/default.nix
@@ -55,6 +55,10 @@ in buildPythonApplication rec {
     runHook postInstall
   '';
 
+  # https://github.com/NixOS/nixpkgs/issues/149812
+  # https://nixos.org/manual/nixpkgs/stable/#ssec-gnome-hooks-gobject-introspection
+  strictDeps = false;
+
   meta = with lib; {
     description = "Genealogy software";
     homepage = "https://gramps-project.org";
diff --git a/nixpkgs/pkgs/applications/misc/kchmviewer/default.nix b/nixpkgs/pkgs/applications/misc/kchmviewer/default.nix
new file mode 100644
index 000000000000..4d703bff0c22
--- /dev/null
+++ b/nixpkgs/pkgs/applications/misc/kchmviewer/default.nix
@@ -0,0 +1,48 @@
+{ lib, stdenv, fetchFromGitHub, fetchpatch, qmake, wrapQtAppsHook, chmlib, libzip, qtwebengine }:
+
+stdenv.mkDerivation rec {
+  pname = "kchmviewer";
+  version = "8.0";
+
+  src = fetchFromGitHub {
+    owner = "gyunaev";
+    repo = pname;
+    rev = "RELEASE_${lib.replaceStrings [ "." ] [ "_" ] version}";
+    sha256 = "sha256-YNpiBf6AFBCRbAZRPODvqGbQQedJJJrZFQIQyzIeBlw=";
+  };
+
+  patches = [
+    # remove unused webkit
+    (fetchpatch {
+      url = "https://github.com/gyunaev/kchmviewer/commit/a4a3984465cb635822953350c571950ae726b539.patch";
+      sha256 = "sha256-nHW18a4SrTG4fETJmKS4ojHXwnX1d1uN1m4H0GIuI28=";
+    })
+    # QtWebengine fixes
+    (fetchpatch {
+      url = "https://github.com/gyunaev/kchmviewer/commit/9ac73e7ad15de08aab6b1198115be2eb44da7afe.patch";
+      sha256 = "sha256-qg2ytqA2On7jg19WZmHIOU7vLQI2hoyqItySLEA64SY=";
+    })
+    (fetchpatch {
+      url = "https://github.com/gyunaev/kchmviewer/commit/99a6d94bdfce9c4578cce82707e71863a71d1453.patch";
+      sha256 = "sha256-o8JkaMmcJObmMt+o/6ooCAPCi+yRAWDAgxV+tR5eHfY=";
+    })
+  ];
+
+  buildInputs = [ chmlib libzip qtwebengine ];
+
+  nativeBuildInputs = [ qmake wrapQtAppsHook ];
+
+  postInstall = ''
+    install -Dm755 bin/kchmviewer -t $out/bin
+    install -Dm644 packages/kchmviewer.png -t $out/share/pixmaps
+    install -Dm644 packages/kchmviewer.desktop -t $out/share/applications
+  '';
+
+  meta = with lib; {
+    description = "CHM (Winhelp) files viewer";
+    homepage = "http://www.ulduzsoft.com/linux/kchmviewer/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix b/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix
index 33e1ea185cdd..902eb19da747 100644
--- a/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -3,10 +3,10 @@
 rec {
   firefox = firefoxCommon rec {
     pname = "firefox";
-    version = "98.0";
+    version = "98.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "5b9186dd2a5dee5f2d2a2ce156fc06e2073cf71a70891a294cf3358218592f19ec3413d33b68d6f38e3cc5f940213e590a188e2b6efc39f416e90a55f89bfd9b";
+      sha512 = "1434ff775e6cdc6d9a75fa0e6d07a4680ada86ecfd7b65208c597ed765e847d900b68df355e6bea6461f6d86ee7a8b2ce3117f23826ad144bd87dfe64ee39b42";
     };
 
     meta = {
diff --git a/nixpkgs/pkgs/applications/networking/browsers/opera/default.nix b/nixpkgs/pkgs/applications/networking/browsers/opera/default.nix
index 69ee0444c3d5..bd7d42777f5d 100644
--- a/nixpkgs/pkgs/applications/networking/browsers/opera/default.nix
+++ b/nixpkgs/pkgs/applications/networking/browsers/opera/default.nix
@@ -50,11 +50,11 @@ let
 in stdenv.mkDerivation rec {
 
   pname = "opera";
-  version = "84.0.4316.21";
+  version = "84.0.4316.31";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    sha256 = "sha256-CEKUd2QlZQJbpBO1t4oKmyd+uhPiCOY+eXtSrZf75e4=";
+    sha256 = "sha256-ypSnarhtJNQn3yOtydjmf6WmHAYbOfMg3xatCxTfIMY=";
   };
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
diff --git a/nixpkgs/pkgs/applications/networking/cluster/k3s/default.nix b/nixpkgs/pkgs/applications/networking/cluster/k3s/default.nix
index 3beb8e9c23cf..fa355b65131a 100644
--- a/nixpkgs/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/nixpkgs/pkgs/applications/networking/cluster/k3s/default.nix
@@ -46,30 +46,30 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.23.3+k3s1";     # k3s git tag
-  k3sCommit = "6f4217a3405d16a1a51bbb40872d7dcb87207bb9"; # k3s git commit at the above version
-  k3sRepoSha256 = "sha256-0dRusG1vL+1KbmViIUNCZK1b+FEgV6otcVUyFonHmm4=";
-  k3sVendorSha256 = "sha256-8Yp9csyRNSYi9wo8E8mF8cu92wG1t3l18wJ8Y4L7HEA=";
+  k3sVersion = "1.23.4+k3s1";     # k3s git tag
+  k3sCommit = "43b1cb48200d8f6af85c16ed944d68fcc96b6506"; # k3s git commit at the above version
+  k3sRepoSha256 = "1sn7rd5hqfqvwj036blk0skmq6r8igbmiqk1dnpaqnkkddpzdgmc";
+  k3sVendorSha256 = "sha256-1/kQvNqFUWwch1JH+twWzBdjNYseoZyVObB1+s9WPM4=";
 
-  k3sServerVendorSha256 = "sha256-9+2k/ipAOhc8JJU+L2dwaM01Dkw+0xyrF5kt6mL19G0=";
+  k3sServerVendorSha256 = "sha256-2KIFff43jfqWdxX61aWofrjmc5mMkr5aEJRFdGpLyU8=";
 
   # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
   # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
-  traefikChartVersion = "10.9.1";
-  traefikChartSha256 = "sha256-XM1DLofU1zEEFeB5bNQ7cgv102gXsToPP7SFh87QuGQ=";
+  traefikChartVersion = "10.14.1";
+  traefikChartSha256 = "09a6cialx7nrh7nwi1gkkh8zcsasxcgb52dyx0r8bjq9ng29simj";
 
   # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
-  k3sRootVersion = "0.9.1";
-  k3sRootSha256 = "0r2cj4l50cxkrvszpzxfk36lvbjf9vcmp6d5lvxg8qsah8lki3x8";
+  k3sRootVersion = "0.11.0";
+  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
 
   # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
-  k3sCNIVersion = "0.9.1-k3s1";
-  k3sCNISha256 = "1327vmfph7b8i14q05c2xdfzk60caflg1zhycx0mrf3d59f4zsz5";
+  k3sCNIVersion = "1.0.1-k3s1";
+  k3sCNISha256 = "11ihlzzdnqf9p21y0a4ckpbxac016nm7746dcykhj26ym9zxyv92";
 
   # taken from go.mod, the 'github.com/containerd/containerd' line
   # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
   containerdVersion = "1.5.9-k3s1";
-  containerdSha256 = "sha256-7xlhBA6KuwFlw+jyThygv4Ow9F3xjjIUtS6x8YHwjic=";
+  containerdSha256 = "09wfy20z3c9fnla353pibpsb10xzl0f4xwp8qdjh3fwa1q2626gg";
 
   # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
   criCtlVersion = "1.22.0-k3s1";
diff --git a/nixpkgs/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/nixpkgs/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 4766b796a351..a1b897dce228 100644
--- a/nixpkgs/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/nixpkgs/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20220303";
+  version = "20220314";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3fT9cHosg/A/JowIARQ46OxmsQWFOBb7tIiRWVNfUo4=";
+    sha256 = "sha256-E3gH4Ym2tmH9qmbfKWybgO6qUW2rpJQyhBh6LPpfFHE=";
   };
 
   # Remove when Apple SDK is >= 10.13
diff --git a/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 265e72c3867a..c23e416d2c62 100644
--- a/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -70,7 +70,7 @@ let
 in
 env.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "3.5.2";
+  version = "3.6.0";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   # Telegram-Desktop with submodules
@@ -79,7 +79,7 @@ env.mkDerivation rec {
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "05324xvb00yz2jfigyy7izk8wnq8phm3sidw62kf7xqyh63qnrzh";
+    sha256 = "0zcjm08nfdlxrsv0fi6dqg3lk52bcvsxnsf6jm5fv6gf5v9ia3hq";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix b/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
index a3c61a6f3370..200e0e887e3e 100644
--- a/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "tg_owt";
-  version = "unstable-2022-02-09";
+  version = "unstable-2022-02-25";
 
   src = fetchFromGitHub {
     owner = "desktop-app";
     repo = "tg_owt";
-    rev = "4cba1acdd718b700bb33945c0258283689d4eac7";
-    sha256 = "0j201x9k38mvcyhf1wlyghyvdpv1l75xwgj9rl2l7r55afrpw4ca";
+    rev = "a264028ec71d9096e0aa629113c49c25db89d260";
+    sha256 = "10p3x8z3ps8s1ivi9y8px2gsg4pvsvz6g9wbgh5w8hilikxqq7r5";
     fetchSubmodules = true;
   };
 
diff --git a/nixpkgs/pkgs/applications/networking/juju/default.nix b/nixpkgs/pkgs/applications/networking/juju/default.nix
index 6810dbe679fb..0d57e252e301 100644
--- a/nixpkgs/pkgs/applications/networking/juju/default.nix
+++ b/nixpkgs/pkgs/applications/networking/juju/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "juju";
-  version = "2.9.25";
+  version = "2.9.26";
 
   src = fetchFromGitHub {
     owner = "juju";
     repo = "juju";
     rev = "juju-${version}";
-    sha256 = "sha256-h4w12dmGEviV2N0BWXQKt1eUVxdbgwRKLQghnd6bLFI=";
+    sha256 = "sha256-phzjjW9KG0Z5WAzxtYdI7i2Nw4FHVNeEJswQreHga4M=";
   };
 
-  vendorSha256 = "sha256-AATK4tDg2eW8Bt8gU88tIk6I+qp5ZeUtXzD74/59c7w=";
+  vendorSha256 = "sha256-Jzd6I3a/2Un2a3/T2vzFuHwe9Y3eGEvfpZWSwjWokM0=";
 
   # Disable tests because it attempts to use a mongodb instance
   doCheck = false;
diff --git a/nixpkgs/pkgs/applications/networking/n8n/node-packages.nix b/nixpkgs/pkgs/applications/networking/n8n/node-packages.nix
index 38a1e2ab2aad..a86ac412c148 100644
--- a/nixpkgs/pkgs/applications/networking/n8n/node-packages.nix
+++ b/nixpkgs/pkgs/applications/networking/n8n/node-packages.nix
@@ -40,13 +40,13 @@ let
         sha512 = "QmmJmexXKtPyc3/rsZR/YTLDvMatzbzAypJmLzvlfxgz/SkgnqV/D4f6F2LsK6tBj1qhyp8BoXiOebiej0zz3A==";
       };
     };
-    "@azure/core-lro-2.2.3" = {
+    "@azure/core-lro-2.2.4" = {
       name = "_at_azure_slash_core-lro";
       packageName = "@azure/core-lro";
-      version = "2.2.3";
+      version = "2.2.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.2.3.tgz";
-        sha512 = "UMdlR9NsqDCLTba3EUbRjfMF4gDmWvld196JmUjbz9WWhJ2XT00OR5MXeWiR+vmGT+ETiO4hHFCi2/eGO5YVtg==";
+        url = "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.2.4.tgz";
+        sha512 = "e1I2v2CZM0mQo8+RSix0x091Av493e4bnT22ds2fcQGslTHzM2oTbswkB65nP4iEpCxBrFxOSDPKExmTmjCVtQ==";
       };
     };
     "@azure/core-paging-1.2.1" = {
@@ -103,22 +103,22 @@ let
         sha512 = "UA/8dgLy3+ZiwJjAZHxL4MUB14fFQPkaAOZ94jsTW/Z6WmoOeny2+cLk0+dyIX/iH6qSrEWKwbStEeB970B9pA==";
       };
     };
-    "@azure/storage-blob-12.8.0" = {
+    "@azure/storage-blob-12.9.0" = {
       name = "_at_azure_slash_storage-blob";
       packageName = "@azure/storage-blob";
-      version = "12.8.0";
+      version = "12.9.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.8.0.tgz";
-        sha512 = "c8+Wz19xauW0bGkTCoqZH4dYfbtBniPiGiRQOn1ca6G5jsjr4azwaTk9gwjVY8r3vY2Taf95eivLzipfIfiS4A==";
+        url = "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.9.0.tgz";
+        sha512 = "ank38FdCLfJ+EoeMzCz3hkYJuZAd63ARvDKkxZYRDb+beBYf+/+gx8jNTqkq/hfyUl4dJQ/a7tECU0Y0F98CHg==";
       };
     };
-    "@babel/runtime-7.17.2" = {
+    "@babel/runtime-7.17.7" = {
       name = "_at_babel_slash_runtime";
       packageName = "@babel/runtime";
-      version = "7.17.2";
+      version = "7.17.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/runtime/-/runtime-7.17.2.tgz";
-        sha512 = "hzeyJyMA1YGdJTuWU0e/j4wKXrU4OMFvY2MSlaI9B7VQb0r5cxTE3EAIS2Q7Tn2RIcDkRvTA/v2JsAEhxe99uw==";
+        url = "https://registry.npmjs.org/@babel/runtime/-/runtime-7.17.7.tgz";
+        sha512 = "L6rvG9GDxaLgFjg41K+5Yv9OMrU98sWe+Ykmc6FDJW/+vYZMhdOMKkISgzptMaERHvS2Y2lw9MDRm2gHhlQQoA==";
       };
     };
     "@colors/colors-1.5.0" = {
@@ -139,13 +139,13 @@ let
         sha512 = "hrlQOIi7hAfzsMqlGSFyVucrx38O+j6wiGOf//H2ecvIEqYN4ADBSS2iLMh5UFyDunCNniUIPk/q3riFv45xRA==";
       };
     };
-    "@fontsource/open-sans-4.5.5" = {
+    "@fontsource/open-sans-4.5.6" = {
       name = "_at_fontsource_slash_open-sans";
       packageName = "@fontsource/open-sans";
-      version = "4.5.5";
+      version = "4.5.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fontsource/open-sans/-/open-sans-4.5.5.tgz";
-        sha512 = "h1oUPSQpoMnDrnzIZTVS9PPBFhWXS87v6/cd9FY2Xc+GKbOVcjPZxcvUDU1TnCie2QSoYY9aifERRV/d8JHtWQ==";
+        url = "https://registry.npmjs.org/@fontsource/open-sans/-/open-sans-4.5.6.tgz";
+        sha512 = "bQuNS0H1VL1VLC6FwmReHlpJaICVe/seODU3Q9cpTQbJ5OtRD4TwWMrAjfTxqcFNollA6O0AlE4BnRSWMQLfvw==";
       };
     };
     "@icetee/ftp-0.3.15" = {
@@ -445,13 +445,13 @@ let
         sha512 = "zm6xBQpFDIDM6o9r6HSgDeIcLy82TKWctCXEPbJJcXb5AKmi5BNNdLXneixK4lplX3PqIVcwLBCGE/kAGnlD4A==";
       };
     };
-    "@types/lodash-4.14.179" = {
+    "@types/lodash-4.14.180" = {
       name = "_at_types_slash_lodash";
       packageName = "@types/lodash";
-      version = "4.14.179";
+      version = "4.14.180";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.179.tgz";
-        sha512 = "uwc1x90yCKqGcIOAT6DwOSuxnrAbpkdPsUOZtwrXb4D/6wZs+6qG7QnIawDuZWg0sWpxl+ltIKCaLoMlna678w==";
+        url = "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.180.tgz";
+        sha512 = "XOKXa1KIxtNXgASAnwj7cnttJxS4fksBRywK/9LzRV5YxrF80BXZIGeQSuoESQ/VkUj30Ae0+YcuHc15wJCB2g==";
       };
     };
     "@types/lossless-json-1.0.1" = {
@@ -472,13 +472,13 @@ let
         sha512 = "YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==";
       };
     };
-    "@types/node-12.20.46" = {
+    "@types/node-12.20.47" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "12.20.46";
+      version = "12.20.47";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-12.20.46.tgz";
-        sha512 = "cPjLXj8d6anFPzFvOPxS3fvly3Shm5nTfl6g8X5smexixbuGUf7hfr21J5tX9JW+UPStp/5P5R8qrKL5IyVJ+A==";
+        url = "https://registry.npmjs.org/@types/node/-/node-12.20.47.tgz";
+        sha512 = "BzcaRsnFuznzOItW1WpQrDHM7plAa7GIDMZ6b5pnMbkqEtM/6WCOhvZar39oeMQP79gwvFUWjjptE7/KGcNqFg==";
       };
     };
     "@types/node-17.0.21" = {
@@ -976,13 +976,13 @@ let
         sha512 = "uUbetCWczQHbsKyX1C99XpQHBM8SWfovvaZhPIj23/1uV7SQf0WeRZbiLpw0JZm+LHTChfNgrLfDJOVoU2kU+A==";
       };
     };
-    "aws-sdk-2.1087.0" = {
+    "aws-sdk-2.1093.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.1087.0";
+      version = "2.1093.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1087.0.tgz";
-        sha512 = "m5EERT29Fwh2cv3SaSdygeAjJBXnjSaXRRERy70bf6PQ7KgmASJouBxY11g5G7LTEPK/yfB0TGshujKh3hEtPA==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1093.0.tgz";
+        sha512 = "YD6VNemoKkzDMHsUiGP/MwpM0T20ukp3KTSxPY34Xw3Ww0zP19C54CfjaXhn//R27f2c57BtVez+he2RZ5GwyQ==";
       };
     };
     "aws-sign2-0.7.0" = {
@@ -1471,6 +1471,15 @@ let
         sha512 = "jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==";
       };
     };
+    "clamp-1.0.1" = {
+      name = "clamp";
+      packageName = "clamp";
+      version = "1.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/clamp/-/clamp-1.0.1.tgz";
+        sha1 = "66a0e64011816e37196828fdc8c8c147312c8634";
+      };
+    };
     "class-validator-0.13.2" = {
       name = "class-validator";
       packageName = "class-validator";
@@ -1777,6 +1786,15 @@ let
         sha512 = "Mn4AJiYkR3TAZH1Xm/RU7gFS/0kM5TBSAQDry8y40Aez0ASY+3boUhv+3QE5XbOXiXM2JjdhkKve3IsBvWCibQ==";
       };
     };
+    "cookie-0.4.1" = {
+      name = "cookie";
+      packageName = "cookie";
+      version = "0.4.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz";
+        sha512 = "ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA==";
+      };
+    };
     "cookie-0.4.2" = {
       name = "cookie";
       packageName = "cookie";
@@ -1786,6 +1804,15 @@ let
         sha512 = "aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA==";
       };
     };
+    "cookie-parser-1.4.6" = {
+      name = "cookie-parser";
+      packageName = "cookie-parser";
+      version = "1.4.6";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.6.tgz";
+        sha512 = "z3IzaNjdwUC2olLIB5/ITd0/setiaFMLYiZJle7xg5Fe9KWAceil7xszYfHHBtDFYLSgJduS2Ty0P1uJdPDJeA==";
+      };
+    };
     "cookie-signature-1.0.6" = {
       name = "cookie-signature";
       packageName = "cookie-signature";
@@ -3604,13 +3631,13 @@ let
         sha1 = "bb935d48582cba168c06834957a54a3e07124f11";
       };
     };
-    "isbot-3.4.3" = {
+    "isbot-3.4.5" = {
       name = "isbot";
       packageName = "isbot";
-      version = "3.4.3";
+      version = "3.4.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/isbot/-/isbot-3.4.3.tgz";
-        sha512 = "5hAgiY9ysMIJcVQlGHcXptwgZr1yYbIGNBE36a3sPo7cLZ9eLTLx0qOssekFKaTHiXTwd/ZZMTuOS7w4faOmpw==";
+        url = "https://registry.npmjs.org/isbot/-/isbot-3.4.5.tgz";
+        sha512 = "+KD6q1BBtw0iK9aGBGSfxJ31/ZgizKRjhm8ebgJUBMx0aeeQuIJ1I72beCoIrltIZGrSm4vmrxRxrG5n1aUTtw==";
       };
     };
     "isexe-2.0.0" = {
@@ -4045,6 +4072,15 @@ let
         sha1 = "d8757b1da807dde24816b0d6a84bea1a76230b23";
       };
     };
+    "lodash.throttle-4.1.1" = {
+      name = "lodash.throttle";
+      packageName = "lodash.throttle";
+      version = "4.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lodash.throttle/-/lodash.throttle-4.1.1.tgz";
+        sha1 = "c23e91b710242ac70c37f1e1cda9274cc39bf2f4";
+      };
+    };
     "lodash.uniqby-4.7.0" = {
       name = "lodash.uniqby";
       packageName = "lodash.uniqby";
@@ -4135,6 +4171,15 @@ let
         sha512 = "IXAq50s4qwrOBrXJklY+KhgZF+5y98PDaNo0gi/v2KQBFLyWr+JyFvijZXkGKjQj/h9c0OwoE+JZbwUXce76hQ==";
       };
     };
+    "luxon-2.3.1" = {
+      name = "luxon";
+      packageName = "luxon";
+      version = "2.3.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/luxon/-/luxon-2.3.1.tgz";
+        sha512 = "I8vnjOmhXsMSlNMZlMkSOvgrxKJl0uOsEzdGgGNZuZPaS9KlefpE9KV95QFftlJSC+1UyCC9/I69R02cz/zcCA==";
+      };
+    };
     "mailparser-3.4.0" = {
       name = "mailparser";
       packageName = "mailparser";
@@ -4180,13 +4225,22 @@ let
         sha512 = "etgt+n4LlOkGSJbBTV9VROHA5R7ekIPS4vfh+bCAoJgRrJWdqJCBbpS3osRJ/HrT7R68MzMiY3L3sDJ/Fd8aBg==";
       };
     };
-    "mappersmith-2.37.1" = {
+    "mappersmith-2.38.0" = {
       name = "mappersmith";
       packageName = "mappersmith";
-      version = "2.37.1";
+      version = "2.38.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/mappersmith/-/mappersmith-2.37.1.tgz";
-        sha512 = "3QiXhRADHTK/it1riJMJm/sHmLlGdw3pfLgZJQu9MfT1CNeiO93keNY0BVLlRmpPBsMER/P7kj3mtcAK2V331Q==";
+        url = "https://registry.npmjs.org/mappersmith/-/mappersmith-2.38.0.tgz";
+        sha512 = "D2+ICkvNGnGCz01MADdQQilcHGffwLd1ell4b4uXS9QYvLfrX0r5nl5zb9V+2YDy3142u6VUl1b154pxJAxw3g==";
+      };
+    };
+    "material-colors-1.2.6" = {
+      name = "material-colors";
+      packageName = "material-colors";
+      version = "1.2.6";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/material-colors/-/material-colors-1.2.6.tgz";
+        sha512 = "6qE4B9deFBIa9YSpOc9O0Sgc43zTeVYbgDT5veRKSlB2+ZuHNoVVxA1L/ckMUayV9Ay9y7Z/SZCLcGteW9i7bg==";
       };
     };
     "md5-2.3.0" = {
@@ -4261,22 +4315,22 @@ let
         sha512 = "x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==";
       };
     };
-    "mime-db-1.51.0" = {
+    "mime-db-1.52.0" = {
       name = "mime-db";
       packageName = "mime-db";
-      version = "1.51.0";
+      version = "1.52.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/mime-db/-/mime-db-1.51.0.tgz";
-        sha512 = "5y8A56jg7XVQx2mbv1lu49NR4dokRnhZYTtL+KGfaa27uq4pSTXkwQkFJl4pkRMyNFz/EtYDSkiiEHx3F7UN6g==";
+        url = "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz";
+        sha512 = "sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==";
       };
     };
-    "mime-types-2.1.34" = {
+    "mime-types-2.1.35" = {
       name = "mime-types";
       packageName = "mime-types";
-      version = "2.1.34";
+      version = "2.1.35";
       src = fetchurl {
-        url = "https://registry.npmjs.org/mime-types/-/mime-types-2.1.34.tgz";
-        sha512 = "6cP692WwGIs9XXdOO4++N+7qjqv0rqxxVvJ3VHPh/Sc9mVZcQP+ZGhkKiTvWMQRr2tbHkJP/Yn7Y0npb3ZBs4A==";
+        url = "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz";
+        sha512 = "ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==";
       };
     };
     "mimic-fn-2.1.0" = {
@@ -4486,49 +4540,49 @@ let
         sha512 = "z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==";
       };
     };
-    "n8n-core-0.107.0" = {
+    "n8n-core-0.109.0" = {
       name = "n8n-core";
       packageName = "n8n-core";
-      version = "0.107.0";
+      version = "0.109.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.107.0.tgz";
-        sha512 = "jwlEv67bPCn1Npp5SkZ11MViQgN96B2bUmSdsKPIBkJGkAPdd6BAUNAhF6qlAS53KhkbSqjuZkn71sDwbHv1cg==";
+        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.109.0.tgz";
+        sha512 = "hzimsUZbWHfG9RofSX7czg0DgB7YAIcLi7JRFUVB90HVdasFf1HQFVM2AwFZC/lLVckktuadWSpq2MOKW+lE3Q==";
       };
     };
-    "n8n-design-system-0.13.0" = {
+    "n8n-design-system-0.14.0" = {
       name = "n8n-design-system";
       packageName = "n8n-design-system";
-      version = "0.13.0";
+      version = "0.14.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-design-system/-/n8n-design-system-0.13.0.tgz";
-        sha512 = "dnweYfFdU9RLdZhmllAlF35dFp0F8Cxw2YAVPMTYOJ2saTs992kvI+09k5iVHDdRxA92BKRXgRRfvY1p0goXcQ==";
+        url = "https://registry.npmjs.org/n8n-design-system/-/n8n-design-system-0.14.0.tgz";
+        sha512 = "E9Tvnjd9hktVPsqBcX579Fr4Nn/QEVAHQaYZlPGrqxXLVD76mF0WQWJpU6XTZEs/9pKfEftk/TmDihtENLVTxg==";
       };
     };
-    "n8n-editor-ui-0.133.0" = {
+    "n8n-editor-ui-0.135.0" = {
       name = "n8n-editor-ui";
       packageName = "n8n-editor-ui";
-      version = "0.133.0";
+      version = "0.135.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.133.0.tgz";
-        sha512 = "lKi2eyx5mn5vfo5sArvsnQ+1khdkX7I1Aqml5VFgzTUhHDLZB2Pvupu+czE55l9QSGs6oqaN9a9NRblWOHc0zQ==";
+        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.135.0.tgz";
+        sha512 = "oM+Pnh4ZaUnDy5lj6u71EyXUPGNlbEIn3lpi4+xyO8tYtFyaN1kifS/q/a1sYrgZlwbWaksgUvTqufZ3Te6Yqw==";
       };
     };
-    "n8n-nodes-base-0.164.0" = {
+    "n8n-nodes-base-0.166.0" = {
       name = "n8n-nodes-base";
       packageName = "n8n-nodes-base";
-      version = "0.164.0";
+      version = "0.166.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.164.0.tgz";
-        sha512 = "5GSd0f1rQZfKt9e0S1zwn5K34TSd1lYkd3MEPKDHjvksxfNOumtZpf0rwEgb/7Uf6azw7ESqk4VXwxiVQu0sgw==";
+        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.166.0.tgz";
+        sha512 = "Iet76bGJrS3rTal5KbuBsJvYzAw3o9xfcLHERpDJyXOxgvrPfZ62A7RpmLMLA3KJLfKevY+VLGLWW5odTSvtEg==";
       };
     };
-    "n8n-workflow-0.89.0" = {
+    "n8n-workflow-0.91.0" = {
       name = "n8n-workflow";
       packageName = "n8n-workflow";
-      version = "0.89.0";
+      version = "0.91.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.89.0.tgz";
-        sha512 = "hggmmjHsa3VjP5puRssH4Q8hoigqJ3W+KQeY54Qsa1rJoJEjZYy53NGOQ3QMmuPuTUvVMHe4Z/Hb6u4Bbh1wAg==";
+        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.91.0.tgz";
+        sha512 = "a4yqSvcalQs2MEDkOeadQc9cwK/3f6t+EKr/e8rEN5D9djnmuvoRJC+V9v6KPuHy66q1pv6w7fpmnrLRO+2WrA==";
       };
     };
     "named-placeholders-1.1.2" = {
@@ -5089,6 +5143,42 @@ let
         sha512 = "uWlGT3YSnK9x3BQJaOdcZwrnV6hPpd8jFH1/ucpiLRPh/2zCVJKS19E4GvYHvaCcACn3foXZ0cLB9Wrx1KGe5g==";
       };
     };
+    "passport-0.5.2" = {
+      name = "passport";
+      packageName = "passport";
+      version = "0.5.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/passport/-/passport-0.5.2.tgz";
+        sha512 = "w9n/Ot5I7orGD4y+7V3EFJCQEznE5RxHamUxcqLT2QoJY0f2JdN8GyHonYFvN0Vz+L6lUJfVhrk2aZz2LbuREw==";
+      };
+    };
+    "passport-cookie-1.0.9" = {
+      name = "passport-cookie";
+      packageName = "passport-cookie";
+      version = "1.0.9";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/passport-cookie/-/passport-cookie-1.0.9.tgz";
+        sha512 = "8a6foX2bbGoJzup0RAiNcC2tTqzYS46RQEK3Z4u8p86wesPUjgDaji3C7+5j4TGyCq4ZoOV+3YLw1Hy6cV6kyw==";
+      };
+    };
+    "passport-jwt-4.0.0" = {
+      name = "passport-jwt";
+      packageName = "passport-jwt";
+      version = "4.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/passport-jwt/-/passport-jwt-4.0.0.tgz";
+        sha512 = "BwC0n2GP/1hMVjR4QpnvqA61TxenUMlmfNjYNgK0ZAs0HK4SOQkHcSv4L328blNTLtHq7DbmvyNJiH+bn6C5Mg==";
+      };
+    };
+    "passport-strategy-1.0.0" = {
+      name = "passport-strategy";
+      packageName = "passport-strategy";
+      version = "1.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/passport-strategy/-/passport-strategy-1.0.0.tgz";
+        sha1 = "b5539aa8fc225a3d1ad179476ddf236b440f52e4";
+      };
+    };
     "path-case-3.0.4" = {
       name = "path-case";
       packageName = "path-case";
@@ -5134,6 +5224,15 @@ let
         sha512 = "gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==";
       };
     };
+    "pause-0.0.1" = {
+      name = "pause";
+      packageName = "pause";
+      version = "0.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/pause/-/pause-0.0.1.tgz";
+        sha1 = "1d408b3fdb76923b9543d96fb4c9dfd535d9cb5d";
+      };
+    };
     "pdf-parse-1.1.1" = {
       name = "pdf-parse";
       packageName = "pdf-parse";
@@ -5287,13 +5386,13 @@ let
         sha512 = "vrlOGvNVELko0+J8NpGC5lHWDGrk8LQJq9nwAMIVEVBfN1Lib3BLxAaLRGDTuUnvl45j5N9dT2H85PULz6IjjQ==";
       };
     };
-    "popsicle-redirects-1.1.0" = {
+    "popsicle-redirects-1.1.1" = {
       name = "popsicle-redirects";
       packageName = "popsicle-redirects";
-      version = "1.1.0";
+      version = "1.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/popsicle-redirects/-/popsicle-redirects-1.1.0.tgz";
-        sha512 = "XCpzVjVk7tty+IJnSdqWevmOr1n8HNDhL86v7mZ6T1JIIf2KGybxUk9mm7ZFOhWMkGB0e8XkacHip7BV8AQWQA==";
+        url = "https://registry.npmjs.org/popsicle-redirects/-/popsicle-redirects-1.1.1.tgz";
+        sha512 = "mC2HrKjdTAWDalOjGxlXw9j6Qxrz/Yd2ui6bPxpi2IQDYWpF4gUAMxbA8EpSWJhLi0PuWKDwTHHPrUPGutAoIA==";
       };
     };
     "popsicle-transport-http-1.2.1" = {
@@ -6682,6 +6781,15 @@ let
         sha512 = "a7wPxPdVlQL7lqvitHGGRsofhdwtkoSXPGATFuSOA2i1ZNQEPLrGnj68vOp2sOJTCFAQVXPeNMX/GctBaO9L2w==";
       };
     };
+    "tinycolor2-1.4.2" = {
+      name = "tinycolor2";
+      packageName = "tinycolor2";
+      version = "1.4.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/tinycolor2/-/tinycolor2-1.4.2.tgz";
+        sha512 = "vJhccZPs965sV/L2sU4oRQVAos0pQXwsvTLkWYdqJ+a8Q5kPFzJTuOFwy7UniPli44NKQGAglksjvOcpo95aZA==";
+      };
+    };
     "tlds-1.224.0" = {
       name = "tlds";
       packageName = "tlds";
@@ -7159,6 +7267,24 @@ let
         sha512 = "xwTm7NLh/uOjARRBs8/95H0e8fT3Ukw5D/JJWhxMbhKzNh1Nu981jQKvkep9iKYNxzlVrdzD0mlBGkDKZWprlw==";
       };
     };
+    "vue-2.6.14" = {
+      name = "vue";
+      packageName = "vue";
+      version = "2.6.14";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vue/-/vue-2.6.14.tgz";
+        sha512 = "x2284lgYvjOMj3Za7kqzRcUSxBboHqtgRE2zlos1qWaOye5yUmHn42LB1250NJBLRwEcdrB0JRwyPTEPhfQjiQ==";
+      };
+    };
+    "vue-color-2.8.1" = {
+      name = "vue-color";
+      packageName = "vue-color";
+      version = "2.8.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vue-color/-/vue-color-2.8.1.tgz";
+        sha512 = "BoLCEHisXi2QgwlhZBg9UepvzZZmi4176vbr+31Shen5WWZwSLVgdScEPcB+yrAtuHAz42309C0A4+WiL9lNBw==";
+      };
+    };
     "vue-fragment-1.5.2" = {
       name = "vue-fragment";
       packageName = "vue-fragment";
@@ -7177,6 +7303,15 @@ let
         sha512 = "SX35iJHL5PJ4Gfh0Mo/q0shyHiI2V6Zkh51c+k8E9O1RKv5BQyYrCxRzpvPrsIOJEnLaeiovet3dsUB0e/kDzw==";
       };
     };
+    "vue2-boring-avatars-0.3.4" = {
+      name = "vue2-boring-avatars";
+      packageName = "vue2-boring-avatars";
+      version = "0.3.4";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vue2-boring-avatars/-/vue2-boring-avatars-0.3.4.tgz";
+        sha512 = "N3FYX9Z6rZdTeP3BOBz2LMxlWo9WRmPF6SOsYzz+tEuUH0QjX8UD7c1X95J8pZ7cFvbh9QflVujYQRqRiiwoAg==";
+      };
+    };
     "webidl-conversions-3.0.1" = {
       name = "webidl-conversions";
       packageName = "webidl-conversions";
@@ -7480,10 +7615,10 @@ in
   n8n = nodeEnv.buildNodePackage {
     name = "n8n";
     packageName = "n8n";
-    version = "0.166.0";
+    version = "0.168.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/n8n/-/n8n-0.166.0.tgz";
-      sha512 = "t8tRpOyrEIxaIuLzfBajDPjAMygcCapiIqHDjU8YloJalI0MnbuoQ6DgA2RdRDZElN0yew0rQR8ZxZ2nMUk8Fg==";
+      url = "https://registry.npmjs.org/n8n/-/n8n-0.168.1.tgz";
+      sha512 = "bghyOcF+KZmRsmyC9p2ARb+RIlUBDwTKCMLd5eUFW1SKMBCWgQZwG8KCLCRApWjXjP1SYekeyDo1PSl5fa7Hxw==";
     };
     dependencies = [
       (sources."@azure/abort-controller-1.0.5" // {
@@ -7503,7 +7638,7 @@ in
           sources."tslib-2.3.1"
         ];
       })
-      (sources."@azure/core-lro-2.2.3" // {
+      (sources."@azure/core-lro-2.2.4" // {
         dependencies = [
           sources."tslib-2.3.1"
         ];
@@ -7530,12 +7665,12 @@ in
         ];
       })
       sources."@azure/ms-rest-nodeauth-3.1.1"
-      (sources."@azure/storage-blob-12.8.0" // {
+      (sources."@azure/storage-blob-12.9.0" // {
         dependencies = [
           sources."tslib-2.3.1"
         ];
       })
-      sources."@babel/runtime-7.17.2"
+      sources."@babel/runtime-7.17.7"
       sources."@colors/colors-1.5.0"
       (sources."@dabh/diagnostics-2.0.3" // {
         dependencies = [
@@ -7543,7 +7678,7 @@ in
           sources."kuler-2.0.0"
         ];
       })
-      sources."@fontsource/open-sans-4.5.5"
+      sources."@fontsource/open-sans-4.5.6"
       sources."@icetee/ftp-0.3.15"
       sources."@kafkajs/confluent-schema-registry-1.0.6"
       sources."@kwsites/file-exists-1.1.1"
@@ -7592,7 +7727,7 @@ in
       sources."@types/ftp-0.3.33"
       sources."@types/json-diff-0.5.2"
       sources."@types/jsonwebtoken-8.5.8"
-      sources."@types/lodash-4.14.179"
+      sources."@types/lodash-4.14.180"
       sources."@types/lossless-json-1.0.1"
       sources."@types/mime-1.3.2"
       sources."@types/node-17.0.21"
@@ -7664,7 +7799,7 @@ in
         ];
       })
       sources."avsc-5.7.3"
-      (sources."aws-sdk-2.1087.0" // {
+      (sources."aws-sdk-2.1093.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."events-1.1.1"
@@ -7774,6 +7909,7 @@ in
       sources."cheerio-select-1.5.0"
       sources."chokidar-3.5.2"
       sources."chownr-1.1.4"
+      sources."clamp-1.0.1"
       sources."class-validator-0.13.2"
       sources."clean-stack-3.0.1"
       sources."cli-color-0.1.7"
@@ -7835,7 +7971,8 @@ in
       sources."content-disposition-0.5.4"
       sources."content-type-1.0.4"
       sources."convict-6.2.1"
-      sources."cookie-0.4.2"
+      sources."cookie-0.4.1"
+      sources."cookie-parser-1.4.6"
       sources."cookie-signature-1.0.6"
       sources."core-js-3.21.1"
       sources."core-util-is-1.0.2"
@@ -7923,6 +8060,7 @@ in
       sources."expand-tilde-2.0.2"
       (sources."express-4.17.3" // {
         dependencies = [
+          sources."cookie-0.4.2"
           sources."debug-2.6.9"
           sources."ms-2.0.0"
         ];
@@ -8078,7 +8216,7 @@ in
       sources."is-windows-1.0.2"
       sources."is-wsl-2.2.0"
       sources."isarray-0.0.1"
-      sources."isbot-3.4.3"
+      sources."isbot-3.4.5"
       sources."isexe-2.0.0"
       sources."iso-639-1-2.1.13"
       sources."isstream-0.1.2"
@@ -8137,6 +8275,7 @@ in
       sources."lodash.merge-4.6.2"
       sources."lodash.once-4.1.1"
       sources."lodash.set-4.3.2"
+      sources."lodash.throttle-4.1.1"
       sources."lodash.uniqby-4.7.0"
       sources."lodash.unset-4.5.2"
       sources."logform-2.4.0"
@@ -8154,6 +8293,7 @@ in
           sources."yallist-2.1.2"
         ];
       })
+      sources."luxon-2.3.1"
       (sources."mailparser-3.4.0" // {
         dependencies = [
           sources."iconv-lite-0.6.3"
@@ -8168,7 +8308,8 @@ in
       })
       sources."make-error-1.3.6"
       sources."make-error-cause-2.3.0"
-      sources."mappersmith-2.37.1"
+      sources."mappersmith-2.38.0"
+      sources."material-colors-1.2.6"
       sources."md5-2.3.0"
       sources."media-typer-0.3.0"
       sources."merge-descriptors-1.0.1"
@@ -8177,8 +8318,8 @@ in
       sources."micromatch-4.0.4"
       sources."millisecond-0.1.2"
       sources."mime-1.6.0"
-      sources."mime-db-1.51.0"
-      sources."mime-types-2.1.34"
+      sources."mime-db-1.52.0"
+      sources."mime-types-2.1.35"
       sources."mimic-fn-2.1.0"
       sources."minimalistic-assert-1.0.1"
       sources."minimatch-3.1.2"
@@ -8224,19 +8365,19 @@ in
         ];
       })
       sources."mz-2.7.0"
-      (sources."n8n-core-0.107.0" // {
+      (sources."n8n-core-0.109.0" // {
         dependencies = [
           sources."qs-6.10.3"
         ];
       })
-      sources."n8n-design-system-0.13.0"
-      sources."n8n-editor-ui-0.133.0"
-      (sources."n8n-nodes-base-0.164.0" // {
+      sources."n8n-design-system-0.14.0"
+      sources."n8n-editor-ui-0.135.0"
+      (sources."n8n-nodes-base-0.166.0" // {
         dependencies = [
           sources."iconv-lite-0.6.3"
         ];
       })
-      sources."n8n-workflow-0.89.0"
+      sources."n8n-workflow-0.91.0"
       (sources."named-placeholders-1.1.2" // {
         dependencies = [
           sources."lru-cache-4.1.5"
@@ -8341,6 +8482,10 @@ in
           sources."tslib-2.3.1"
         ];
       })
+      sources."passport-0.5.2"
+      sources."passport-cookie-1.0.9"
+      sources."passport-jwt-4.0.0"
+      sources."passport-strategy-1.0.0"
       (sources."path-case-3.0.4" // {
         dependencies = [
           sources."tslib-2.3.1"
@@ -8350,6 +8495,7 @@ in
       sources."path-is-absolute-1.0.1"
       sources."path-to-regexp-0.1.7"
       sources."path-type-4.0.0"
+      sources."pause-0.0.1"
       (sources."pdf-parse-1.1.1" // {
         dependencies = [
           sources."debug-3.2.7"
@@ -8378,7 +8524,7 @@ in
       sources."popsicle-12.1.0"
       sources."popsicle-content-encoding-1.0.0"
       sources."popsicle-cookie-jar-1.0.0"
-      sources."popsicle-redirects-1.1.0"
+      sources."popsicle-redirects-1.1.1"
       sources."popsicle-transport-http-1.2.1"
       sources."popsicle-transport-xhr-2.0.0"
       sources."popsicle-user-agent-1.0.0"
@@ -8564,7 +8710,7 @@ in
       sources."tdigest-0.1.1"
       (sources."tedious-6.7.1" // {
         dependencies = [
-          sources."@types/node-12.20.46"
+          sources."@types/node-12.20.47"
           sources."bl-3.0.1"
           sources."depd-2.0.0"
           sources."iconv-lite-0.5.2"
@@ -8588,6 +8734,7 @@ in
       sources."through2-filter-3.0.0"
       sources."throwback-4.1.0"
       sources."timeago.js-4.0.2"
+      sources."tinycolor2-1.4.2"
       sources."tlds-1.224.0"
       sources."tmp-0.0.33"
       (sources."tmp-promise-3.0.3" // {
@@ -8663,8 +8810,11 @@ in
       sources."vary-1.1.2"
       sources."verror-1.10.0"
       sources."vm2-3.9.9"
+      sources."vue-2.6.14"
+      sources."vue-color-2.8.1"
       sources."vue-fragment-1.5.2"
       sources."vue-i18n-8.27.0"
+      sources."vue2-boring-avatars-0.3.4"
       sources."webidl-conversions-3.0.1"
       sources."whatwg-url-5.0.0"
       sources."which-1.3.1"
diff --git a/nixpkgs/pkgs/applications/office/paperless-ng/default.nix b/nixpkgs/pkgs/applications/office/paperless-ng/default.nix
index e3ca9af422c2..ab140f90ceda 100644
--- a/nixpkgs/pkgs/applications/office/paperless-ng/default.nix
+++ b/nixpkgs/pkgs/applications/office/paperless-ng/default.nix
@@ -18,10 +18,6 @@ let
   py = python3.override {
     packageOverrides = self: super: {
       django = super.django_3;
-      django-picklefield = super.django-picklefield.overrideAttrs (oldAttrs: {
-        # Checks do not pass with django 3
-        doInstallCheck = false;
-      });
       # Avoid warning in django-q versions > 1.3.4
       # https://github.com/jonaswinkler/paperless-ng/issues/857
       # https://github.com/Koed00/django-q/issues/526
diff --git a/nixpkgs/pkgs/applications/science/logic/nuXmv/default.nix b/nixpkgs/pkgs/applications/science/logic/nuXmv/default.nix
new file mode 100644
index 000000000000..021c612d1069
--- /dev/null
+++ b/nixpkgs/pkgs/applications/science/logic/nuXmv/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "nuXmv";
+  version = "2.0.0";
+
+  src = fetchurl {
+    url = "https://es-static.fbk.eu/tools/nuxmv/downloads/nuXmv-${version}-linux64.tar.gz";
+    sha256 = "0nndrw994clf8lnlcfzdf1mf00vif3fvd4xsiwcjpbyk12091zqr";
+  };
+
+  installPhase= ''
+    runHook preInstall
+    install -Dm755 -t $out/bin ./bin/nuXmv
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Symbolic model checker for analysis of finite and infinite state systems";
+    homepage = "https://nuxmv.fbk.eu/pmwiki.php";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ siraben ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/nixpkgs/pkgs/applications/science/math/sage/patches/no-cython-sources-in-tracebacks-on-ipython8.patch b/nixpkgs/pkgs/applications/science/math/sage/patches/no-cython-sources-in-tracebacks-on-ipython8.patch
deleted file mode 100644
index 871e494c3625..000000000000
--- a/nixpkgs/pkgs/applications/science/math/sage/patches/no-cython-sources-in-tracebacks-on-ipython8.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-diff --git a/src/sage/repl/interface_magic.py b/src/sage/repl/interface_magic.py
-index 8a455b69b0..a93e1c9e04 100644
---- a/src/sage/repl/interface_magic.py
-+++ b/src/sage/repl/interface_magic.py
-@@ -260,7 +260,7 @@ class InterfaceMagic(object):
-             2
-             120
-             sage: shell.run_cell('%%gap foo\n1+1;\n')
--            ...File "<string>", line unknown
-+            ...File...<string>...
-             SyntaxError: Interface magics have no options, got "foo"
-             <BLANKLINE>
-             sage: shell.run_cell('%%gap?')
-diff --git a/src/sage/repl/interpreter.py b/src/sage/repl/interpreter.py
-index 71dbe429fd..36b1d986d6 100644
---- a/src/sage/repl/interpreter.py
-+++ b/src/sage/repl/interpreter.py
-@@ -70,25 +70,6 @@ that shell.  The bulk of this functionality is provided through
- 
- TESTS:
- 
--Check that Cython source code appears in tracebacks::
--
--    sage: from sage.repl.interpreter import get_test_shell
--    sage: shell = get_test_shell()
--    sage: print("dummy line"); shell.run_cell('1/0') # see #25320 for the reason of the `...` and the dummy line in this test
--    dummy line
--    ...
--    ZeroDivisionError...Traceback (most recent call last)
--    <ipython-input-...> in <module>...
--    ----> 1 Integer(1)/Integer(0)
--    .../sage/rings/integer.pyx in sage.rings.integer.Integer...div...
--    ...
--    -> ...                  raise ZeroDivisionError("rational division by zero")
--       ....:            x = <Rational> Rational.__new__(Rational)
--       ....:            mpq_div_zz(x.value, ....value, (<Integer>right).value)
--    <BLANKLINE>
--    ZeroDivisionError: rational division by zero
--    sage: shell.quit()
--
- Test prompt transformer::
- 
-     sage: from sage.repl.interpreter import SagePromptTransformer
-@@ -423,7 +404,7 @@ def SagePreparseTransformer(lines):
-         sage: from sage.repl.interpreter import get_test_shell
-         sage: shell = get_test_shell()
-         sage: shell.run_cell(bad_syntax)
--          File "<string>", line unknown
-+          File...<string>...
-         SyntaxError: Mismatched ']'
-         <BLANKLINE>
-         sage: shell.quit()
diff --git a/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix b/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix
index bae33802d301..22e3a288b7d7 100644
--- a/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix
+++ b/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix
@@ -119,15 +119,13 @@ stdenv.mkDerivation rec {
     # https://trac.sagemath.org/ticket/32959
     ./patches/linbox-1.7-upgrade.patch
 
-    # To emit better tracebacks, IPython 8 parses Python files using the ast
-    # module (via the stack_data package). Since Cython is a superset of Python,
-    # this results in no Cython code being printed in tracebacks. Fixing this
-    # properly is tracked in https://github.com/alexmojaki/stack_data/issues/21,
-    # but for now we just disable the corresponding test. An alternative would
-    # be to revert IPython's IPython/core/ultratb.py, but this would need to be
-    # Sage-specific (since it would worsen tracebacks for pure Python code).
-    # Sage tracks this at https://trac.sagemath.org/ticket/33170
-    ./patches/no-cython-sources-in-tracebacks-on-ipython8.patch
+    # https://trac.sagemath.org/ticket/33170
+    (fetchSageDiff {
+      base = "9.5.rc1";
+      name = "ipython-8-update.patch";
+      rev = "a90a314616d86d6be9c0d5233f0d36c4bfe06231";
+      sha256 = "sha256-pXdtokTo84xNCnV+HyAKEzG562z8FjzJ7hczOja0dRw=";
+    })
 
     # https://trac.sagemath.org/ticket/32968
     (fetchSageDiff {
diff --git a/nixpkgs/pkgs/applications/science/misc/bada-bib/default.nix b/nixpkgs/pkgs/applications/science/misc/bada-bib/default.nix
index bd2f94ac4a74..3ca998643ac2 100644
--- a/nixpkgs/pkgs/applications/science/misc/bada-bib/default.nix
+++ b/nixpkgs/pkgs/applications/science/misc/bada-bib/default.nix
@@ -17,7 +17,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bada-bib";
-  version = "0.5.1";
+  version = "0.6.0";
   format = "other";
   strictDeps = false; # https://github.com/NixOS/nixpkgs/issues/56943
 
@@ -25,7 +25,7 @@ python3Packages.buildPythonApplication rec {
     owner = "RogerCrocker";
     repo = "BadaBib";
     rev = "v${version}";
-    sha256 = "sha256-tb/720WPqcO4w1EMmidjtEidsjZ0dEhe+/vnJPM6kxo=";
+    sha256 = "sha256-gfZc3R8hrYy4Nco+XwG29lzZd537ByEgd3RL8h7f6DQ=";
   };
 
   nativeBuildInputs = [
@@ -52,7 +52,6 @@ python3Packages.buildPythonApplication rec {
   pythonPath = with python3Packages; [
     bibtexparser
     pygobject3
-    watchgod
   ];
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix b/nixpkgs/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
index b93491e267c3..c9bf60a1eb93 100644
--- a/nixpkgs/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
+++ b/nixpkgs/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-cliff";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "git-cliff";
     rev = "v${version}";
-    sha256 = "sha256-cctgZz65BliOePal4zrPpTbxMkz4GJj6gIh2YzEg+Do=";
+    sha256 = "sha256-CJ/2Cv/XoLq9U7u5mexH8iCCHbGtV6xohP3FapqO3+g=";
   };
 
-  cargoSha256 = "sha256-M/BNqLZnLthaBONwn5XMmulmqyZTWv5LQFvxASDrBCI=";
+  cargoSha256 = "sha256-pYStKDgvvV/Z96TAonpDW7DIs1YSO6gAoiUCieVa9QY=";
 
   # attempts to run the program on .git in src which is not deterministic
   doCheck = false;
diff --git a/nixpkgs/pkgs/applications/video/f1viewer/default.nix b/nixpkgs/pkgs/applications/video/f1viewer/default.nix
index 33e1863428ef..7c091b425af6 100644
--- a/nixpkgs/pkgs/applications/video/f1viewer/default.nix
+++ b/nixpkgs/pkgs/applications/video/f1viewer/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "f1viewer";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "SoMuchForSubtlety";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cTXueIOD+OXx4WikhdNv3v/F2/f5aDicyPP7FgTU6AM=";
+    sha256 = "sha256-MY8xqpAzK1c4XL7w/LR83DyHFCI5X7wldosDDo7pXNI=";
   };
 
-  vendorSha256 = "sha256-47uLx4t0N1T3zqZ9o/su/onJEUdGXpq+iVSUaRnwW3I=";
+  vendorSha256 = "sha256-8c1+t6Lo11Q2kEDy9IWLw9bsZYtJFksE7Om3ysx7fc4=";
 
   meta = with lib; {
     description =
diff --git a/nixpkgs/pkgs/applications/window-managers/i3/status-rust.nix b/nixpkgs/pkgs/applications/window-managers/i3/status-rust.nix
index cdcfcca15eae..89da6b6b11e8 100644
--- a/nixpkgs/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/nixpkgs/pkgs/applications/window-managers/i3/status-rust.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3status-rust";
-  version = "0.21.6";
+  version = "0.21.7";
 
   src = fetchFromGitHub {
     owner = "greshake";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2PBGw5LHIOOPXBZ+12wL2ZGH+gfbkXNIItpE6SLT8so=";
+    sha256 = "sha256-2fh1/7/or++AzvkJfwXD07UiyX8U8CIEe+qXc5S82mM=";
   };
 
-  cargoSha256 = "sha256-wtxfdQw5zKCxYu7N2BpcLVTlitQmwY7s8oO4dpK8MjE=";
+  cargoSha256 = "sha256-ERBxY0PBQOvAVeWCRcB7rApTLjtHxa0KMV4qGlU/j/Q=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
diff --git a/nixpkgs/pkgs/build-support/alternatives/blas/default.nix b/nixpkgs/pkgs/build-support/alternatives/blas/default.nix
index 8917784bc6c3..7186675a5c62 100644
--- a/nixpkgs/pkgs/build-support/alternatives/blas/default.nix
+++ b/nixpkgs/pkgs/build-support/alternatives/blas/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
-, lapack-reference, openblasCompat, openblas
+, lapack-reference, openblas
 , isILP64 ? false
-, blasProvider ? if isILP64 then openblas else openblasCompat }:
+, blasProvider ? openblas }:
 
 let
   blasFortranSymbols = [
@@ -32,10 +32,13 @@ let
 
 
   blasImplementation = lib.getName blasProvider;
+  blasProvider' = if blasImplementation == "mkl"
+                  then blasProvider
+                  else blasProvider.override { blas64 = isILP64; };
 
 in
 
-assert isILP64 -> (blasImplementation == "openblas" && blasProvider.blas64) || blasImplementation == "mkl";
+assert isILP64 -> blasImplementation == "mkl" || blasProvider'.blas64;
 
 stdenv.mkDerivation {
   pname = "blas";
@@ -43,13 +46,13 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  meta = (blasProvider.meta or {}) // {
+  meta = (blasProvider'.meta or {}) // {
     description = "${lib.getName blasProvider} with just the BLAS C and FORTRAN ABI";
   };
 
   passthru = {
     inherit isILP64;
-    provider = blasProvider;
+    provider = blasProvider';
     implementation = blasImplementation;
   };
 
@@ -62,10 +65,10 @@ stdenv.mkDerivation {
   installPhase = (''
   mkdir -p $out/lib $dev/include $dev/lib/pkgconfig
 
-  libblas="${lib.getLib blasProvider}/lib/libblas${canonicalExtension}"
+  libblas="${lib.getLib blasProvider'}/lib/libblas${canonicalExtension}"
 
   if ! [ -e "$libblas" ]; then
-    echo "$libblas does not exist, ${blasProvider.name} does not provide libblas."
+    echo "$libblas does not exist, ${blasProvider'.name} does not provide libblas."
     exit 1
   fi
 
@@ -79,11 +82,11 @@ stdenv.mkDerivation {
 
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname libblas${canonicalExtension} $out/lib/libblas${canonicalExtension}
-  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libblas${canonicalExtension}):${lib.getLib blasProvider}/lib" $out/lib/libblas${canonicalExtension}
+  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libblas${canonicalExtension}):${lib.getLib blasProvider'}/lib" $out/lib/libblas${canonicalExtension}
 '' else if stdenv.hostPlatform.isDarwin then ''
   install_name_tool \
     -id $out/lib/libblas${canonicalExtension} \
-    -add_rpath ${lib.getLib blasProvider}/lib \
+    -add_rpath ${lib.getLib blasProvider'}/lib \
     $out/lib/libblas${canonicalExtension}
 '' else "") + ''
 
@@ -99,10 +102,10 @@ Libs: -L$out/lib -lblas
 Cflags: -I$dev/include
 EOF
 
-  libcblas="${lib.getLib blasProvider}/lib/libcblas${canonicalExtension}"
+  libcblas="${lib.getLib blasProvider'}/lib/libcblas${canonicalExtension}"
 
   if ! [ -e "$libcblas" ]; then
-    echo "$libcblas does not exist, ${blasProvider.name} does not provide libcblas."
+    echo "$libcblas does not exist, ${blasProvider'.name} does not provide libcblas."
     exit 1
   fi
 
@@ -111,11 +114,11 @@ EOF
 
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname libcblas${canonicalExtension} $out/lib/libcblas${canonicalExtension}
-  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libcblas${canonicalExtension}):${lib.getLib blasProvider}/lib" $out/lib/libcblas${canonicalExtension}
+  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libcblas${canonicalExtension}):${lib.getLib blasProvider'}/lib" $out/lib/libcblas${canonicalExtension}
 '' else if stdenv.hostPlatform.isDarwin then ''
   install_name_tool \
     -id $out/lib/libcblas${canonicalExtension} \
-    -add_rpath ${lib.getLib blasProvider}/lib \
+    -add_rpath ${lib.getLib blasProvider'}/lib \
     $out/lib/libcblas${canonicalExtension}
 '' else "") + ''
   if [ "$out/lib/libcblas${canonicalExtension}" != "$out/lib/libcblas${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
@@ -135,6 +138,6 @@ EOF
   mkdir -p $out/nix-support
   echo 'export MKL_INTERFACE_LAYER=${lib.optionalString isILP64 "I"}LP64,GNU' > $out/nix-support/setup-hook
   ln -s $out/lib/libblas${canonicalExtension} $out/lib/libmkl_rt${stdenv.hostPlatform.extensions.sharedLibrary}
-  ln -sf ${blasProvider}/include/* $dev/include
+  ln -sf ${blasProvider'}/include/* $dev/include
 '');
 }
diff --git a/nixpkgs/pkgs/build-support/alternatives/lapack/default.nix b/nixpkgs/pkgs/build-support/alternatives/lapack/default.nix
index 61da183c835d..80fb7be8c1e1 100644
--- a/nixpkgs/pkgs/build-support/alternatives/lapack/default.nix
+++ b/nixpkgs/pkgs/build-support/alternatives/lapack/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
-, lapack-reference, openblasCompat, openblas
+, lapack-reference, openblas
 , isILP64 ? false
-, lapackProvider ? if isILP64 then openblas else openblasCompat }:
+, lapackProvider ? openblas }:
 
 let
 
@@ -11,10 +11,13 @@ let
                        else stdenv.hostPlatform.extensions.sharedLibrary;
 
   lapackImplementation = lib.getName lapackProvider;
+  lapackProvider' = if lapackImplementation == "mkl"
+                  then lapackProvider
+                  else lapackProvider.override { blas64 = isILP64; };
 
 in
 
-assert isILP64 -> (lapackImplementation == "openblas" && lapackProvider.blas64) || lapackImplementation == "mkl";
+assert isILP64 -> lapackImplementation == "mkl" || lapackProvider'.blas64;
 
 stdenv.mkDerivation {
   pname = "lapack";
@@ -22,13 +25,13 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  meta = (lapackProvider.meta or {}) // {
-    description = "${lib.getName lapackProvider} with just the LAPACK C and FORTRAN ABI";
+  meta = (lapackProvider'.meta or {}) // {
+    description = "${lib.getName lapackProvider'} with just the LAPACK C and FORTRAN ABI";
   };
 
   passthru = {
     inherit isILP64;
-    provider = lapackProvider;
+    provider = lapackProvider';
     implementation = lapackImplementation;
   };
 
@@ -41,10 +44,10 @@ stdenv.mkDerivation {
   installPhase = (''
   mkdir -p $out/lib $dev/include $dev/lib/pkgconfig
 
-  liblapack="${lib.getLib lapackProvider}/lib/liblapack${canonicalExtension}"
+  liblapack="${lib.getLib lapackProvider'}/lib/liblapack${canonicalExtension}"
 
   if ! [ -e "$liblapack" ]; then
-    echo "$liblapack does not exist, ${lapackProvider.name} does not provide liblapack."
+    echo "$liblapack does not exist, ${lapackProvider'.name} does not provide liblapack."
     exit 1
   fi
 
@@ -53,7 +56,7 @@ stdenv.mkDerivation {
 
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname liblapack${canonicalExtension} $out/lib/liblapack${canonicalExtension}
-  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapack${canonicalExtension}):${lapackProvider}/lib" $out/lib/liblapack${canonicalExtension}
+  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapack${canonicalExtension}):${lapackProvider'}/lib" $out/lib/liblapack${canonicalExtension}
 '' else "") + ''
 
   if [ "$out/lib/liblapack${canonicalExtension}" != "$out/lib/liblapack${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
@@ -70,10 +73,10 @@ Cflags: -I$dev/include
 Libs: -L$out/lib -llapack
 EOF
 
-  liblapacke="${lib.getLib lapackProvider}/lib/liblapacke${canonicalExtension}"
+  liblapacke="${lib.getLib lapackProvider'}/lib/liblapacke${canonicalExtension}"
 
   if ! [ -e "$liblapacke" ]; then
-    echo "$liblapacke does not exist, ${lapackProvider.name} does not provide liblapacke."
+    echo "$liblapacke does not exist, ${lapackProvider'.name} does not provide liblapacke."
     exit 1
   fi
 
@@ -82,7 +85,7 @@ EOF
 
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname liblapacke${canonicalExtension} $out/lib/liblapacke${canonicalExtension}
-  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapacke${canonicalExtension}):${lib.getLib lapackProvider}/lib" $out/lib/liblapacke${canonicalExtension}
+  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapacke${canonicalExtension}):${lib.getLib lapackProvider'}/lib" $out/lib/liblapacke${canonicalExtension}
 '' else "") + ''
 
   if [ -f "$out/lib/liblapacke.so.3" ]; then
@@ -102,6 +105,6 @@ EOF
   mkdir -p $out/nix-support
   echo 'export MKL_INTERFACE_LAYER=${lib.optionalString isILP64 "I"}LP64,GNU' > $out/nix-support/setup-hook
   ln -s $out/lib/liblapack${canonicalExtension} $out/lib/libmkl_rt${stdenv.hostPlatform.extensions.sharedLibrary}
-  ln -sf ${lapackProvider}/include/* $dev/include
+  ln -sf ${lapackProvider'}/include/* $dev/include
 '');
 }
diff --git a/nixpkgs/pkgs/build-support/appimage/default.nix b/nixpkgs/pkgs/build-support/appimage/default.nix
index 4d302156f707..0bee6ce065ad 100644
--- a/nixpkgs/pkgs/build-support/appimage/default.nix
+++ b/nixpkgs/pkgs/build-support/appimage/default.nix
@@ -68,6 +68,8 @@ rec {
       xdg-utils
       iana-etc
       krb5
+      gsettings-desktop-schemas
+      hicolor-icon-theme # dont show a gtk warning about hicolor not being installed
     ];
 
     # list of libraries expected in an appimage environment:
diff --git a/nixpkgs/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix b/nixpkgs/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
index 1c4e2b607696..d0f88df44537 100644
--- a/nixpkgs/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
+++ b/nixpkgs/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
@@ -93,6 +93,32 @@ let
     paths = [ etcPkg ldconfig ] ++ basePkgs ++ targetPaths;
     extraOutputsToInstall = [ "out" "lib" "bin" ] ++ extraOutputsToInstall;
     ignoreCollisions = true;
+    postBuild = ''
+      if [[ -d  $out/share/gsettings-schemas/ ]]; then
+          # Recreate the standard schemas directory if its a symlink to make it writable
+          if [[ -L $out/share/glib-2.0 ]]; then
+              ln -s $(readlink $out/share/glib-2.0) $out/share/glib-2.0.old
+              rm -rf $out/share/glib-2.0
+          fi
+
+          mkdir -p $out/share/glib-2.0/schemas
+
+          # symlink any schema files or overrides to the standard schema directory
+          if [[ -e $out/share/glib-2.0.old/schemas ]]; then
+              ln -fs $out/share/glib-2.0.old/schemas/*.xml $out/share/glib-2.0/schemas
+              ln -fs $out/share/glib-2.0.old/schemas/*.gsettings-schemas.override $out/share/glib-2.0/schemas
+          fi
+
+          for d in $out/share/gsettings-schemas/*; do
+              # Force symlink, in case there are duplicates
+              ln -fs $d/glib-2.0/schemas/*.xml $out/share/glib-2.0/schemas
+              ln -fs $d/glib-2.0/schemas/*.gschema.override $out/share/glib-2.0/schemas
+          done
+
+          # and compile them
+          ${pkgs.glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+      fi
+    '';
   };
 
   staticUsrProfileMulti = buildEnv {
diff --git a/nixpkgs/pkgs/build-support/build-fhs-userenv/env.nix b/nixpkgs/pkgs/build-support/build-fhs-userenv/env.nix
index abf577baa2d1..7251500f76c5 100644
--- a/nixpkgs/pkgs/build-support/build-fhs-userenv/env.nix
+++ b/nixpkgs/pkgs/build-support/build-fhs-userenv/env.nix
@@ -134,6 +134,32 @@ let
     paths = [ etcPkg ] ++ basePkgs ++ targetPaths;
     extraOutputsToInstall = [ "out" "lib" "bin" ] ++ extraOutputsToInstall;
     ignoreCollisions = true;
+    postBuild = ''
+      if [[ -d  $out/share/gsettings-schemas/ ]]; then
+          # Recreate the standard schemas directory if its a symlink to make it writable
+          if [[ -L $out/share/glib-2.0 ]]; then
+              ln -s $(readlink $out/share/glib-2.0) $out/share/glib-2.0.old
+              rm -rf $out/share/glib-2.0
+          fi
+
+          mkdir -p $out/share/glib-2.0/schemas
+
+          # symlink any schema files or overrides to the standard schema directory
+          if [[ -e $out/share/glib-2.0.old/schemas ]]; then
+              ln -fs $out/share/glib-2.0.old/schemas/*.xml $out/share/glib-2.0/schemas
+              ln -fs $out/share/glib-2.0.old/schemas/*.gsettings-schemas.override $out/share/glib-2.0/schemas
+          fi
+
+          for d in $out/share/gsettings-schemas/*; do
+              # Force symlink, in case there are duplicates
+              ln -fs $d/glib-2.0/schemas/*.xml $out/share/glib-2.0/schemas
+              ln -fs $d/glib-2.0/schemas/*.gschema.override $out/share/glib-2.0/schemas
+          done
+
+          # and compile them
+          ${pkgs.glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+      fi
+    '';
   };
 
   staticUsrProfileMulti = buildEnv {
diff --git a/nixpkgs/pkgs/build-support/cc-wrapper/add-flags.sh b/nixpkgs/pkgs/build-support/cc-wrapper/add-flags.sh
index a6e991914e6b..c59118d6c09e 100644
--- a/nixpkgs/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/nixpkgs/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -33,6 +33,20 @@ NIX_CFLAGS_COMPILE_@suffixSalt@="-B@out@/bin/ $NIX_CFLAGS_COMPILE_@suffixSalt@"
 # Export and assign separately in order that a failing $(..) will fail
 # the script.
 
+# Currently bootstrap-tools does not split glibc, and gcc files into
+# separate directories. As a workaround we want resulting cflags to be
+# ordered as: crt1-cflags libc-cflags cc-cflags. Otherwise we mix crt/libc.so
+# from different libc as seen in
+#   https://github.com/NixOS/nixpkgs/issues/158042
+#
+# Note that below has reverse ordering as we prepend flags one-by-one.
+# Once bootstrap-tools is split into different directories we can stop
+# relying on flag ordering below.
+
+if [ -e @out@/nix-support/cc-cflags ]; then
+    NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/cc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
+fi
+
 if [[ "$cInclude" = 1 ]] && [ -e @out@/nix-support/libc-cflags ]; then
     NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
 fi
@@ -49,10 +63,6 @@ if [ -e @out@/nix-support/libcxx-ldflags ]; then
     NIX_CXXSTDLIB_LINK_@suffixSalt@+=" $(< @out@/nix-support/libcxx-ldflags)"
 fi
 
-if [ -e @out@/nix-support/cc-cflags ]; then
-    NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/cc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
-fi
-
 if [ -e @out@/nix-support/gnat-cflags ]; then
     NIX_GNATFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/gnat-cflags) $NIX_GNATFLAGS_COMPILE_@suffixSalt@"
 fi
diff --git a/nixpkgs/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh b/nixpkgs/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
index 2d02767814e0..d2e7882caf6d 100755
--- a/nixpkgs/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
+++ b/nixpkgs/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
@@ -9,7 +9,7 @@ fi
 
 pkgs=$1
 tmpfile=$(mktemp /tmp/nuget-to-nix.XXXXXX)
-trap 'rm -f "$tmpfile" EXIT
+trap "rm -f ${tmpfile}" EXIT
 
 echo "{ fetchNuGet }: ["
 
diff --git a/nixpkgs/pkgs/build-support/fetchpatch/default.nix b/nixpkgs/pkgs/build-support/fetchpatch/default.nix
index 740baa8cff5f..6e25b2d6ecc5 100644
--- a/nixpkgs/pkgs/build-support/fetchpatch/default.nix
+++ b/nixpkgs/pkgs/build-support/fetchpatch/default.nix
@@ -54,9 +54,9 @@ fetchurl ({
       "$tmpfile" > "$out"
 
     if [ ! -s "$out" ]; then
-      echo "error: Filtered patch '$out$' is empty (while the original patch file was not)!" 1>&2
+      echo "error: Filtered patch '$out' is empty (while the original patch file was not)!" 1>&2
       echo "Check your includes and excludes." 1>&2
-      echo "Normalizd patch file was:" 1>&2
+      echo "Normalized patch file was:" 1>&2
       cat "$tmpfile" 1>&2
       exit 1
     fi
diff --git a/nixpkgs/pkgs/build-support/setup-hooks/auto-patchelf.py b/nixpkgs/pkgs/build-support/setup-hooks/auto-patchelf.py
new file mode 100644
index 000000000000..26fd623e3da0
--- /dev/null
+++ b/nixpkgs/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -0,0 +1,329 @@
+#!/usr/bin/env python3
+
+from collections import defaultdict
+from contextlib import contextmanager
+from dataclasses import dataclass
+from elftools.common.exceptions import ELFError # type: ignore
+from elftools.elf.dynamic import DynamicSection # type: ignore
+from elftools.elf.elffile import ELFFile # type: ignore
+from elftools.elf.enums import ENUM_E_TYPE, ENUM_EI_OSABI # type: ignore
+from itertools import chain
+from pathlib import Path, PurePath
+
+from typing import Tuple, Optional, Iterator, List, DefaultDict, Set
+
+import argparse
+import os
+import pprint
+import subprocess
+import sys
+
+
+
+@contextmanager
+def open_elf(path: Path) -> Iterator[ELFFile]:
+    with path.open('rb') as stream:
+        yield ELFFile(stream)
+
+
+def is_static_executable(elf: ELFFile) -> bool:
+    # Statically linked executables have an ELF type of EXEC but no INTERP.
+    return (elf.header["e_type"] == 'ET_EXEC'
+            and not elf.get_section_by_name(".interp"))
+
+
+def is_dynamic_executable(elf: ELFFile) -> bool:
+    # We do not require an ELF type of EXEC. This also catches
+    # position-independent executables, as they typically have an INTERP
+    # section but their ELF type is DYN.
+    return bool(elf.get_section_by_name(".interp"))
+
+
+def get_dependencies(elf: ELFFile) -> List[str]:
+    dependencies = []
+    # This convoluted code is here on purpose. For some reason, using
+    # elf.get_section_by_name(".dynamic") does not always return an
+    # instance of DynamicSection, but that is required to call iter_tags
+    for section in elf.iter_sections():
+        if isinstance(section, DynamicSection):
+            for tag in section.iter_tags('DT_NEEDED'):
+                dependencies.append(tag.needed)
+            break # There is only one dynamic section
+
+    return dependencies
+
+
+def get_rpath(elf: ELFFile) -> List[str]:
+    # This convoluted code is here on purpose. For some reason, using
+    # elf.get_section_by_name(".dynamic") does not always return an
+    # instance of DynamicSection, but that is required to call iter_tags
+    for section in elf.iter_sections():
+        if isinstance(section, DynamicSection):
+            for tag in section.iter_tags('DT_RUNPATH'):
+                return tag.runpath.split(':')
+
+            for tag in section.iter_tags('DT_RPATH'):
+                return tag.rpath.split(':')
+
+            break # There is only one dynamic section
+
+    return []
+
+
+def get_arch(elf: ELFFile) -> str:
+    return elf.get_machine_arch()
+
+
+def get_osabi(elf: ELFFile) -> str:
+    return elf.header["e_ident"]["EI_OSABI"]
+
+
+def osabi_are_compatible(wanted: str, got: str) -> bool:
+    """
+    Tests whether two OS ABIs are compatible, taking into account the
+    generally accepted compatibility of SVR4 ABI with other ABIs.
+    """
+    if not wanted or not got:
+        # One of the types couldn't be detected, so as a fallback we'll
+        # assume they're compatible.
+        return True
+
+    # Generally speaking, the base ABI (0x00), which is represented by
+    # readelf(1) as "UNIX - System V", indicates broad compatibility
+    # with other ABIs.
+    #
+    # TODO: This isn't always true. For example, some OSes embed ABI
+    # compatibility into SHT_NOTE sections like .note.tag and
+    # .note.ABI-tag.  It would be prudent to add these to the detection
+    # logic to produce better ABI information.
+    if wanted == 'ELFOSABI_SYSV':
+        return True
+
+    # Similarly here, we should be able to link against a superset of
+    # features, so even if the target has another ABI, this should be
+    # fine.
+    if got == 'ELFOSABI_SYSV':
+        return True
+
+    # Otherwise, we simply return whether the ABIs are identical.
+    return wanted == got
+
+
+def glob(path: Path, pattern: str, recursive: bool) -> Iterator[Path]:
+    return path.rglob(pattern) if recursive else path.glob(pattern)
+
+
+cached_paths: Set[Path] = set()
+soname_cache: DefaultDict[Tuple[str, str], List[Tuple[Path, str]]] = defaultdict(list)
+
+
+def populate_cache(initial: List[Path], recursive: bool =False) -> None:
+    lib_dirs = list(initial)
+
+    while lib_dirs:
+        lib_dir = lib_dirs.pop(0)
+
+        if lib_dir in cached_paths:
+            continue
+
+        cached_paths.add(lib_dir)
+
+        for path in glob(lib_dir, "*.so*", recursive):
+            if not path.is_file():
+                continue
+
+            resolved = path.resolve()
+            try:
+                with open_elf(path) as elf:
+                    osabi = get_osabi(elf)
+                    arch = get_arch(elf)
+                    rpath = [Path(p) for p in get_rpath(elf)
+                                     if p and '$ORIGIN' not in p]
+                    lib_dirs += rpath
+                    soname_cache[(path.name, arch)].append((resolved.parent, osabi))
+
+            except ELFError:
+                # Not an ELF file in the right format
+                pass
+
+
+def find_dependency(soname: str, soarch: str, soabi: str) -> Optional[Path]:
+    for lib, libabi in soname_cache[(soname, soarch)]:
+        if osabi_are_compatible(soabi, libabi):
+            return lib
+    return None
+
+
+@dataclass
+class Dependency:
+    file: Path              # The file that contains the dependency
+    name: Path              # The name of the dependency
+    found: bool = False     # Whether it was found somewhere
+
+
+def auto_patchelf_file(path: Path, runtime_deps: list[Path]) -> list[Dependency]:
+    try:
+        with open_elf(path) as elf:
+
+            if is_static_executable(elf):
+                # No point patching these
+                print(f"skipping {path} because it is statically linked")
+                return []
+
+            if elf.num_segments() == 0:
+                # no segment (e.g. object file)
+                print(f"skipping {path} because it contains no segment")
+                return []
+
+            file_arch = get_arch(elf)
+            if interpreter_arch != file_arch:
+                # Our target architecture is different than this file's
+                # architecture, so skip it.
+                print(f"skipping {path} because its architecture ({file_arch})"
+                      f" differs from target ({interpreter_arch})")
+                return []
+
+            file_osabi = get_osabi(elf)
+            if not osabi_are_compatible(interpreter_osabi, file_osabi):
+                print(f"skipping {path} because its OS ABI ({file_osabi}) is"
+                      f" not compatible with target ({interpreter_osabi})")
+                return []
+
+            file_is_dynamic_executable = is_dynamic_executable(elf)
+
+            file_dependencies = map(Path, get_dependencies(elf))
+
+    except ELFError:
+        return []
+
+    rpath = []
+    if file_is_dynamic_executable:
+        print("setting interpreter of", path)
+        subprocess.run(
+                ["patchelf", "--set-interpreter", interpreter_path.as_posix(), path.as_posix()],
+                check=True)
+        rpath += runtime_deps
+
+    print("searching for dependencies of", path)
+    dependencies = []
+    # Be sure to get the output of all missing dependencies instead of
+    # failing at the first one, because it's more useful when working
+    # on a new package where you don't yet know the dependencies.
+    for dep in file_dependencies:
+        if dep.is_absolute() and dep.is_file():
+            # This is an absolute path. If it exists, just use it.
+            # Otherwise, we probably want this to produce an error when
+            # checked (because just updating the rpath won't satisfy
+            # it).
+            continue
+        elif (libc_lib / dep).is_file():
+            # This library exists in libc, and will be correctly
+            # resolved by the linker.
+            continue
+
+        if found_dependency := find_dependency(dep.name, file_arch, file_osabi):
+            rpath.append(found_dependency)
+            dependencies.append(Dependency(path, dep, True))
+            print(f"    {dep} -> found: {found_dependency}")
+        else:
+            dependencies.append(Dependency(path, dep, False))
+            print(f"    {dep} -> not found!")
+
+    # Dedup the rpath
+    rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath)))
+
+    if rpath:
+        print("setting RPATH to:", rpath_str)
+        subprocess.run(
+                ["patchelf", "--set-rpath", rpath_str, path.as_posix()],
+                check=True)
+
+    return dependencies
+
+
+def auto_patchelf(
+        paths_to_patch: List[Path],
+        lib_dirs: List[Path],
+        runtime_deps: List[Path],
+        recursive: bool =True,
+        ignore_missing: bool =False) -> None:
+
+    if not paths_to_patch:
+        sys.exit("No paths to patch, stopping.")
+
+    # Add all shared objects of the current output path to the cache,
+    # before lib_dirs, so that they are chosen first in find_dependency.
+    populate_cache(paths_to_patch, recursive)
+    populate_cache(lib_dirs)
+
+    dependencies = []
+    for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
+        if not path.is_symlink() and path.is_file():
+            dependencies += auto_patchelf_file(path, runtime_deps)
+
+    missing = [dep for dep in dependencies if not dep.found]
+
+    # Print a summary of the missing dependencies at the end
+    for dep in missing:
+        print(f"auto-patchelf could not satisfy dependency {dep.name} wanted by {dep.file}")
+
+    if missing and not ignore_missing:
+        sys.exit('auto-patchelf failed to find all the required dependencies.\n'
+                 'Add the missing dependencies to --libs or use --ignore-missing.')
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        prog="auto-patchelf",
+        description='auto-patchelf tries as hard as possible to patch the'
+                    ' provided binary files by looking for compatible'
+                    'libraries in the provided paths.')
+    parser.add_argument(
+        "--ignore-missing",
+        action="store_true",
+        help="Do not fail when some dependencies are not found.")
+    parser.add_argument(
+        "--no-recurse",
+        dest="recursive",
+        action="store_false",
+        help="Patch only the provided paths, and ignore their children")
+    parser.add_argument(
+        "--paths", nargs="*", type=Path,
+        help="Paths whose content needs to be patched.")
+    parser.add_argument(
+        "--libs", nargs="*", type=Path,
+        help="Paths where libraries are searched for.")
+    parser.add_argument(
+        "--runtime-dependencies", nargs="*", type=Path,
+        help="Paths to prepend to the runtime path of executable binaries.")
+
+    print("automatically fixing dependencies for ELF files")
+    args = parser.parse_args()
+    pprint.pprint(vars(args))
+
+    auto_patchelf(
+        args.paths,
+        args.libs,
+        args.runtime_dependencies,
+        args.recursive,
+        args.ignore_missing)
+
+
+interpreter_path: Path  = None # type: ignore
+interpreter_osabi: str  = None # type: ignore
+interpreter_arch: str   = None # type: ignore
+libc_lib: Path          = None # type: ignore
+
+if __name__ == "__main__":
+    nix_support = Path(os.environ['NIX_BINTOOLS']) / 'nix-support'
+    interpreter_path = Path((nix_support / 'dynamic-linker').read_text().strip())
+    libc_lib = Path((nix_support / 'orig-libc').read_text().strip()) / 'lib'
+
+    with open_elf(interpreter_path) as interpreter:
+        interpreter_osabi = get_osabi(interpreter)
+        interpreter_arch = get_arch(interpreter)
+
+    if interpreter_arch and interpreter_osabi and interpreter_path and libc_lib:
+        main()
+    else:
+        sys.exit("Failed to parse dynamic linker (ld) properties.")
diff --git a/nixpkgs/pkgs/build-support/setup-hooks/auto-patchelf.sh b/nixpkgs/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 4b3a1c5c3909..9822674196ae 100644
--- a/nixpkgs/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/nixpkgs/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -1,289 +1,21 @@
 #!/usr/bin/env bash
 
 declare -a autoPatchelfLibs
-declare -Ag autoPatchelfFailedDeps
+declare -a extraAutoPatchelfLibs
 
 gatherLibraries() {
     autoPatchelfLibs+=("$1/lib")
 }
 
-# wrapper around patchelf to raise proper error messages
-# containing the tried file name and command
-runPatchelf() {
-  patchelf "$@" || (echo "Command failed: patchelf $*" && exit 1)
-}
-
 # shellcheck disable=SC2154
 # (targetOffset is referenced but not assigned.)
 addEnvHooks "$targetOffset" gatherLibraries
 
-isExecutable() {
-    # For dynamically linked ELF files it would be enough to check just for the
-    # INTERP section. However, we won't catch statically linked executables as
-    # they only have an ELF type of EXEC but no INTERP.
-    #
-    # So what we do here is just check whether *either* the ELF type is EXEC
-    # *or* there is an INTERP section. This also catches position-independent
-    # executables, as they typically have an INTERP section but their ELF type
-    # is DYN.
-    isExeResult="$(LANG=C $READELF -h -l "$1" 2> /dev/null \
-        | grep '^ *Type: *EXEC\>\|^ *INTERP\>')"
-    # not using grep -q, because it can cause Broken pipe
-    # https://unix.stackexchange.com/questions/305547/broken-pipe-when-grepping-output-but-only-with-i-flag
-    [ -n "$isExeResult" ]
-}
-
-# We cache dependencies so that we don't need to search through all of them on
-# every consecutive call to findDependency.
-declare -Ag autoPatchelfCachedDepsAssoc
-declare -ag autoPatchelfCachedDeps
-
-addToDepCache() {
-    if [[ ${autoPatchelfCachedDepsAssoc[$1]+f} ]]; then return; fi
-
-    # store deps in an assoc. array for efficient lookups
-    # otherwise findDependency would have quadratic complexity
-    autoPatchelfCachedDepsAssoc["$1"]=""
-
-    # also store deps in normal array to maintain their order
-    autoPatchelfCachedDeps+=("$1")
-}
-
-declare -gi depCacheInitialised=0
-declare -gi doneRecursiveSearch=0
-declare -g foundDependency
-
-getDepsFromElfBinary() {
-    # NOTE: This does not use runPatchelf because it may encounter non-ELF
-    # files. Caller is expected to check the return code if needed.
-    patchelf --print-needed "$1" 2> /dev/null
-}
-
-getRpathFromElfBinary() {
-    # NOTE: This does not use runPatchelf because it may encounter non-ELF
-    # files. Caller is expected to check the return code if needed.
-    local rpath
-    IFS=':' read -ra rpath < <(patchelf --print-rpath "$1" 2> /dev/null) || return $?
-
-    printf "%s\n" "${rpath[@]}"
-}
-
-populateCacheForDep() {
-    local so="$1"
-    local rpath found
-    rpath="$(getRpathFromElfBinary "$so")" || return 1
-
-    for found in $(getDepsFromElfBinary "$so"); do
-        local rpathElem
-        for rpathElem in $rpath; do
-            # Ignore empty element or $ORIGIN magic variable which should be
-            # deterministically resolved by adding this package's library
-            # files early anyway.
-            #
-            # shellcheck disable=SC2016
-            # (Expressions don't expand in single quotes, use double quotes for
-            # that.)
-            if [[ -z "$rpathElem" || "$rpathElem" == *'$ORIGIN'* ]]; then
-                continue
-            fi
-
-            local soname="${found%.so*}"
-            local foundso=
-            for foundso in "$rpathElem/$soname".so*; do
-                addToDepCache "$foundso"
-            done
-
-            # Found in this element of the rpath, no need to check others.
-            if [ -n "$foundso" ]; then
-                break
-            fi
-        done
-    done
-
-    # Not found in any rpath element.
-    return 1
-}
-
-populateCacheWithRecursiveDeps() {
-    # Dependencies may add more to the end of this array, so we use a counter
-    # with while instead of a regular for loop here.
-    local -i i=0
-    while [ $i -lt ${#autoPatchelfCachedDeps[@]} ]; do
-        populateCacheForDep "${autoPatchelfCachedDeps[$i]}"
-        i=$i+1
-    done
-}
-
-getBinArch() {
-    $OBJDUMP -f "$1" 2> /dev/null | sed -ne 's/^architecture: *\([^,]\+\).*/\1/p'
-}
-
-# Returns the specific OS ABI for an ELF file in the format produced by
-# readelf(1), like "UNIX - System V" or "UNIX - GNU".
-getBinOsabi() {
-    $READELF -h "$1" 2> /dev/null | sed -ne 's/^[ \t]*OS\/ABI:[ \t]*\(.*\)/\1/p'
-}
-
-# Tests whether two OS ABIs are compatible, taking into account the generally
-# accepted compatibility of SVR4 ABI with other ABIs.
-areBinOsabisCompatible() {
-    local wanted="$1"
-    local got="$2"
-
-    if [[ -z "$wanted" || -z "$got" ]]; then
-        # One of the types couldn't be detected, so as a fallback we'll assume
-        # they're compatible.
-        return 0
-    fi
-
-    # Generally speaking, the base ABI (0x00), which is represented by
-    # readelf(1) as "UNIX - System V", indicates broad compatibility with other
-    # ABIs.
-    #
-    # TODO: This isn't always true. For example, some OSes embed ABI
-    # compatibility into SHT_NOTE sections like .note.tag and .note.ABI-tag.
-    # It would be prudent to add these to the detection logic to produce better
-    # ABI information.
-    if [[ "$wanted" == "UNIX - System V" ]]; then
-        return 0
-    fi
-
-    # Similarly here, we should be able to link against a superset of features,
-    # so even if the target has another ABI, this should be fine.
-    if [[ "$got" == "UNIX - System V" ]]; then
-        return 0
-    fi
-
-    # Otherwise, we simply return whether the ABIs are identical.
-    if [[ "$wanted" == "$got" ]]; then
-        return 0
-    fi
-
-    return 1
-}
-
-# NOTE: If you want to use this function outside of the autoPatchelf function,
-# keep in mind that the dependency cache is only valid inside the subshell
-# spawned by the autoPatchelf function, so invoking this directly will possibly
-# rebuild the dependency cache. See the autoPatchelf function below for more
-# information.
-findDependency() {
-    local filename="$1"
-    local arch="$2"
-    local osabi="$3"
-    local lib dep
-
-    if [ $depCacheInitialised -eq 0 ]; then
-        for lib in "${autoPatchelfLibs[@]}"; do
-            for so in "$lib/"*.so*; do addToDepCache "$so"; done
-        done
-        depCacheInitialised=1
-    fi
-
-    for dep in "${autoPatchelfCachedDeps[@]}"; do
-        if [ "$filename" = "${dep##*/}" ]; then
-            if [ "$(getBinArch "$dep")" = "$arch" ] && areBinOsabisCompatible "$osabi" "$(getBinOsabi "$dep")"; then
-                foundDependency="$dep"
-                return 0
-            fi
-        fi
-    done
-
-    # Populate the dependency cache with recursive dependencies *only* if we
-    # didn't find the right dependency so far and afterwards run findDependency
-    # again, but this time with $doneRecursiveSearch set to 1 so that it won't
-    # recurse again (and thus infinitely).
-    if [ $doneRecursiveSearch -eq 0 ]; then
-        populateCacheWithRecursiveDeps
-        doneRecursiveSearch=1
-        findDependency "$filename" "$arch" || return 1
-        return 0
-    fi
-    return 1
-}
-
-autoPatchelfFile() {
-    local dep rpath="" toPatch="$1"
-
-    local interpreter
-    interpreter="$(< "$NIX_BINTOOLS/nix-support/dynamic-linker")"
-
-    local interpreterArch interpreterOsabi toPatchArch toPatchOsabi
-    interpreterArch="$(getBinArch "$interpreter")"
-    interpreterOsabi="$(getBinOsabi "$interpreter")"
-    toPatchArch="$(getBinArch "$toPatch")"
-    toPatchOsabi="$(getBinOsabi "$toPatch")"
-
-    if [ "$interpreterArch" != "$toPatchArch" ]; then
-        # Our target architecture is different than this file's architecture,
-        # so skip it.
-        echo "skipping $toPatch because its architecture ($toPatchArch) differs from target ($interpreterArch)" >&2
-        return 0
-    elif ! areBinOsabisCompatible "$interpreterOsabi" "$toPatchOsabi"; then
-        echo "skipping $toPatch because its OS ABI ($toPatchOsabi) is not compatible with target ($interpreterOsabi)" >&2
-        return 0
-    fi
-
-    if isExecutable "$toPatch"; then
-        runPatchelf --set-interpreter "$interpreter" "$toPatch"
-        # shellcheck disable=SC2154
-        # (runtimeDependencies is referenced but not assigned.)
-        if [ -n "$runtimeDependencies" ]; then
-            for dep in $runtimeDependencies; do
-                rpath="$rpath${rpath:+:}$dep/lib"
-            done
-        fi
-    fi
-
-    local libcLib
-    libcLib="$(< "$NIX_BINTOOLS/nix-support/orig-libc")/lib"
-
-    echo "searching for dependencies of $toPatch" >&2
-
-    local missing
-    missing="$(getDepsFromElfBinary "$toPatch")" || return 0
-
-    # This ensures that we get the output of all missing dependencies instead
-    # of failing at the first one, because it's more useful when working on a
-    # new package where you don't yet know its dependencies.
-
-    for dep in $missing; do
-        if [[ "$dep" == /* ]]; then
-            # This is an absolute path. If it exists, just use it. Otherwise,
-            # we probably want this to produce an error when checked (because
-            # just updating the rpath won't satisfy it).
-            if [ -f "$dep" ]; then
-                continue
-            fi
-        elif [ -f "$libcLib/$dep" ]; then
-            # This library exists in libc, and will be correctly resolved by
-            # the linker.
-            continue
-        fi
-
-        echo -n "  $dep -> " >&2
-        if findDependency "$dep" "$toPatchArch" "$toPatchOsabi"; then
-            rpath="$rpath${rpath:+:}${foundDependency%/*}"
-            echo "found: $foundDependency" >&2
-        else
-            echo "not found!" >&2
-            autoPatchelfFailedDeps["$dep"]="$toPatch"
-        fi
-    done
-
-    if [ -n "$rpath" ]; then
-        echo "setting RPATH to: $rpath" >&2
-        runPatchelf --set-rpath "$rpath" "$toPatch"
-    fi
-}
-
 # Can be used to manually add additional directories with shared object files
 # to be included for the next autoPatchelf invocation.
 addAutoPatchelfSearchPath() {
     local -a findOpts=()
 
-    # XXX: Somewhat similar to the one in the autoPatchelf function, maybe make
-    #      it DRY someday...
     while [ $# -gt 0 ]; do
         case "$1" in
             --) shift; break;;
@@ -296,15 +28,19 @@ addAutoPatchelfSearchPath() {
         esac
     done
 
-    while IFS= read -r -d '' file; do
-        addToDepCache "$file"
+    local dir=
+    while IFS= read -r -d '' dir; do
+        extraAutoPatchelfLibs+=("$dir")
     done <  <(find "$@" "${findOpts[@]}" \! -type d \
-            \( -name '*.so' -o -name '*.so.*' \) -print0)
+            \( -name '*.so' -o -name '*.so.*' \) -print0 \
+            | sed -z 's#/[^/]*$##' \
+            | uniq -z
+        )
 }
 
+
 autoPatchelf() {
     local norecurse=
-
     while [ $# -gt 0 ]; do
         case "$1" in
             --) shift; break;;
@@ -317,47 +53,14 @@ autoPatchelf() {
         esac
     done
 
-    if [ $# -eq 0 ]; then
-        echo "autoPatchelf: No paths to patch specified." >&2
-        return 1
-    fi
-
-    echo "automatically fixing dependencies for ELF files" >&2
-
-    # Add all shared objects of the current output path to the start of
-    # autoPatchelfCachedDeps so that it's chosen first in findDependency.
-    addAutoPatchelfSearchPath ${norecurse:+--no-recurse} -- "$@"
-
-    while IFS= read -r -d $'\0' file; do
-      isELF "$file" || continue
-      segmentHeaders="$(LANG=C $READELF -l "$file")"
-      # Skip if the ELF file doesn't have segment headers (eg. object files).
-      # not using grep -q, because it can cause Broken pipe
-      grep -q '^Program Headers:' <<<"$segmentHeaders" || continue
-      if isExecutable "$file"; then
-          # Skip if the executable is statically linked.
-          grep -q "^ *INTERP\\>" <<<"$segmentHeaders" || continue
-      fi
-      # Jump file if patchelf is unable to parse it
-      # Some programs contain binary blobs for testing,
-      # which are identified as ELF but fail to be parsed by patchelf
-      patchelf "$file" || continue
-      autoPatchelfFile "$file"
-    done < <(find "$@" ${norecurse:+-maxdepth 1} -type f -print0)
-
-    # fail if any dependencies were not found and
-    # autoPatchelfIgnoreMissingDeps is not set
-    local depsMissing=0
-    for failedDep in "${!autoPatchelfFailedDeps[@]}"; do
-      echo "autoPatchelfHook could not satisfy dependency $failedDep wanted by ${autoPatchelfFailedDeps[$failedDep]}"
-      depsMissing=1
-    done
-    # shellcheck disable=SC2154
-    # (autoPatchelfIgnoreMissingDeps is referenced but not assigned.)
-    if [[ $depsMissing == 1 && -z "$autoPatchelfIgnoreMissingDeps" ]]; then
-      echo "Add the missing dependencies to the build inputs or set autoPatchelfIgnoreMissingDeps=true"
-      exit 1
-    fi
+    local runtimeDependenciesArray=($runtimeDependencies)
+    @pythonInterpreter@ @autoPatchelfScript@                            \
+        ${norecurse:+--no-recurse}                                      \
+        ${autoPatchelfIgnoreMissingDeps:+--ignore-missing}              \
+        --paths "$@"                                                    \
+        --libs "${autoPatchelfLibs[@]}"                                 \
+               "${extraAutoPatchelfLibs[@]}"                            \
+        --runtime-dependencies "${runtimeDependenciesArray[@]/%//lib}"
 }
 
 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
diff --git a/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh b/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh
index 604096135c20..fa6065832894 100644
--- a/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -51,7 +51,19 @@ makeWrapper() {
         local varName="$2"    # name of list variable to add to
         local separator="$3"  # character used to separate elements of list
         local value="$4"      # one value, or multiple values separated by `separator`, to add to list
-        if test -n "$value"; then
+
+        # Disable file globbing, since bash will otherwise try to find
+        # filenames matching the the value to be prefixed/suffixed if
+        # it contains characters considered wildcards, such as `?` and
+        # `*`. We want the value as is, except we also want to split
+        # it on on the separator; hence we can't quote it.
+        local reenableGlob=0
+        if [[ ! -o noglob ]]; then
+            reenableGlob=1
+        fi
+        set -o noglob
+
+        if [[ -n "$value" ]]; then
             local old_ifs=$IFS
             IFS=$separator
 
@@ -86,6 +98,10 @@ makeWrapper() {
             done
             IFS=$old_ifs
         fi
+
+        if (( reenableGlob )); then
+            set +o noglob
+        fi
     }
 
     mkdir -p "$(dirname "$wrapper")"
diff --git a/nixpkgs/pkgs/data/misc/tzdata/default.nix b/nixpkgs/pkgs/data/misc/tzdata/default.nix
index 52662b190a74..78c93b05033e 100644
--- a/nixpkgs/pkgs/data/misc/tzdata/default.nix
+++ b/nixpkgs/pkgs/data/misc/tzdata/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "BINDIR=$(bin)/bin"
     "ZICDIR=$(bin)/bin"
     "ETCDIR=$(TMPDIR)/etc"
-    "TZDEFAULT=$(TMPDIR)/etc"
+    "TZDEFAULT=tzdefault-to-remove"
     "LIBDIR=$(dev)/lib"
     "MANDIR=$(man)/share/man"
     "AWK=awk"
@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
   postInstall =
     ''
       rm $out/share/zoneinfo-posix
+      rm $out/share/zoneinfo/tzdefault-to-remove
       mkdir $out/share/zoneinfo/posix
       ( cd $out/share/zoneinfo/posix; ln -s ../* .; rm posix )
       mv $out/share/zoneinfo-leaps $out/share/zoneinfo/right
diff --git a/nixpkgs/pkgs/desktops/plasma-5/fetch.sh b/nixpkgs/pkgs/desktops/plasma-5/fetch.sh
index b0e706602b69..44b96e8beb9d 100644
--- a/nixpkgs/pkgs/desktops/plasma-5/fetch.sh
+++ b/nixpkgs/pkgs/desktops/plasma-5/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.23.5/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.24.0/ -A '*.tar.xz' )
diff --git a/nixpkgs/pkgs/desktops/plasma-5/kdecoration.nix b/nixpkgs/pkgs/desktops/plasma-5/kdecoration.nix
index 1427997ee847..86d146c8b41a 100644
--- a/nixpkgs/pkgs/desktops/plasma-5/kdecoration.nix
+++ b/nixpkgs/pkgs/desktops/plasma-5/kdecoration.nix
@@ -1,8 +1,8 @@
-{ mkDerivation, lib, extra-cmake-modules, qtbase, ki18n }:
+{ mkDerivation, lib, extra-cmake-modules, qtbase, ki18n, kcoreaddons }:
 
 mkDerivation {
   pname = "kdecoration";
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ qtbase ki18n ];
+  buildInputs = [ qtbase ki18n kcoreaddons ];
   outputs = [ "out" "dev" ];
 }
diff --git a/nixpkgs/pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch b/nixpkgs/pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
index e6ab62caf714..9bade4eab6a9 100644
--- a/nixpkgs/pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
+++ b/nixpkgs/pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
@@ -63,11 +63,11 @@ index 0000000..726065d
 +
 +}// namespace
 +
-+#endif // SERVICE_UTILS_H
-diff --git a/src/service_utils.h b/src/service_utils.h
++#endif // NIXOS_UTILS_H
+diff --git a/src/utils/serviceutils.h b/src/utils/serviceutils.h
 index 8a70c1f..475b15d 100644
---- a/src/service_utils.h
-+++ b/src/service_utils.h
+--- a/src/utils/serviceutils.h
++++ b/src/utils/serviceutils.h
 @@ -19,6 +19,7 @@
  #include <QLoggingCategory>
  //KF
diff --git a/nixpkgs/pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch b/nixpkgs/pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch
index cda82e08442e..ec4a34037dcb 100644
--- a/nixpkgs/pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch
+++ b/nixpkgs/pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch
@@ -11,11 +11,10 @@ diff --git a/processui/scripting.cpp b/processui/scripting.cpp
 index efed8ff..841761a 100644
 --- a/processui/scripting.cpp
 +++ b/processui/scripting.cpp
-@@ -167,7 +167,7 @@ void Scripting::loadContextMenu() {
-     QStringList scripts;
+@@ -293,7 +293,7 @@ void Scripting::loadContextMenu()
      const QStringList dirs =
          QStandardPaths::locateAll(QStandardPaths::GenericDataLocation, QStringLiteral("ksysguard/scripts/"), QStandardPaths::LocateDirectory);
-     Q_FOREACH (const QString &dir, dirs) {
+     for (const QString &dir : dirs) {
 -        QDirIterator it(dir, QStringList() << QStringLiteral("*.desktop"), QDir::NoFilter, QDirIterator::Subdirectories);
 +        QDirIterator it(dir, QStringList() << QStringLiteral("*.desktop"), QDir::NoFilter, QDirIterator::Subdirectories | QDirIterator::FollowSymlinks);
          while (it.hasNext()) {
diff --git a/nixpkgs/pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch b/nixpkgs/pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch
index 508d39498840..e00d8b4a5c9d 100644
--- a/nixpkgs/pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch
+++ b/nixpkgs/pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch
@@ -14,33 +14,33 @@ diff --git a/startkde/plasma-session/startup.cpp b/startkde/plasma-session/start
 index 270744053..356160e96 100644
 --- a/startkde/plasma-session/startup.cpp
 +++ b/startkde/plasma-session/startup.cpp
-@@ -143,7 +143,7 @@ Startup::Startup(QObject *parent)
-     const AutoStart autostart;
+@@ -179,7 +179,7 @@ Startup::Startup(QObject *parent)
+     }
  
      // Keep for KF5; remove in KF6 (KInit will be gone then)
 -    QProcess::execute(QStringLiteral(CMAKE_INSTALL_FULL_LIBEXECDIR_KF5 "/start_kdeinit_wrapper"), QStringList());
 +    QProcess::execute(QStringLiteral(NIXPKGS_START_KDEINIT_WRAPPER), QStringList());
  
-     KJob *windowManagerJob = nullptr;
-     if (qEnvironmentVariable("XDG_SESSION_TYPE") != QLatin1String("wayland")) {
-diff --git a/startkde/startplasma-waylandsession.cpp b/startkde/startplasma-waylandsession.cpp
+     KJob *phase1 = nullptr;
+     m_lock.reset(new QEventLoopLocker);
+diff --git a/startkde/startplasma-wayland.cpp b/startkde/startplasma-wayland.cpp
 index 3a054a04f..b2e7ab3fb 100644
---- a/startkde/startplasma-waylandsession.cpp
-+++ b/startkde/startplasma-waylandsession.cpp
-@@ -33,7 +33,7 @@ int main(int argc, char **argv)
-     out << "startplasma-waylandsession: Shutting down...\n";
+--- a/startkde/startplasma-wayland.cpp
++++ b/startkde/startplasma-wayland.cpp
+@@ -91,7 +91,7 @@ int main(int argc, char **argv)
+     out << "startplasma-wayland: Shutting down...\n";
  
      // Keep for KF5; remove in KF6 (KInit will be gone then)
 -    runSync(QStringLiteral("kdeinit5_shutdown"), {});
 +    runSync(QStringLiteral(NIXPKGS_KDEINIT5_SHUTDOWN), {});
  
-     out << "startplasma-waylandsession: Done.\n";
- 
+     out << "startplasmacompositor: Shutting down...\n";
+     cleanupPlasmaEnvironment(oldSystemdEnvironment);
 diff --git a/startkde/startplasma-x11.cpp b/startkde/startplasma-x11.cpp
 index d6b2c5439..534eeb0e5 100644
 --- a/startkde/startplasma-x11.cpp
 +++ b/startkde/startplasma-x11.cpp
-@@ -90,7 +90,7 @@ int main(int argc, char **argv)
+@@ -89,7 +89,7 @@ int main(int argc, char **argv)
      out << "startkde: Shutting down...\n";
  
      // Keep for KF5; remove in KF6 (KInit will be gone then)
@@ -53,7 +53,7 @@ diff --git a/startkde/startplasma.cpp b/startkde/startplasma.cpp
 index 008fdfcaf..72468f21c 100644
 --- a/startkde/startplasma.cpp
 +++ b/startkde/startplasma.cpp
-@@ -39,7 +39,7 @@ QTextStream out(stderr);
+@@ -50,7 +50,7 @@ QTextStream out(stderr);
  void messageBox(const QString &text)
  {
      out << text;
@@ -62,7 +62,7 @@ index 008fdfcaf..72468f21c 100644
  }
  
  QStringList allServices(const QLatin1String &prefix)
-@@ -340,7 +340,7 @@ void setupX11()
+@@ -412,7 +412,7 @@ void setupX11()
      //     If the user has overwritten fonts, the cursor font may be different now
      //     so don't move this up.
  
@@ -70,17 +70,8 @@ index 008fdfcaf..72468f21c 100644
 +    runSync(QStringLiteral(NIXPKGS_XSETROOT), {QStringLiteral("-cursor_name"), QStringLiteral("left_ptr")});
  }
  
- void cleanupPlasmaEnvironment(const std::optional<QStringList> &oldSystemdEnvironment)
-@@ -403,7 +403,7 @@ void setupFontDpi()
-     // TODO port to c++?
-     const QByteArray input = "Xft.dpi: " + QByteArray::number(fontsCfg.readEntry("forceFontDPI", 0));
-     QProcess p;
--    p.start(QStringLiteral("xrdb"), {QStringLiteral("-quiet"), QStringLiteral("-merge"), QStringLiteral("-nocpp")});
-+    p.start(QStringLiteral(NIXPKGS_XRDB), {QStringLiteral("-quiet"), QStringLiteral("-merge"), QStringLiteral("-nocpp")});
-     p.setProcessChannelMode(QProcess::ForwardedChannels);
-     p.write(input);
-     p.closeWriteChannel();
-@@ -425,7 +425,7 @@ QProcess *setupKSplash()
+ void cleanupPlasmaEnvironment(const std::optional<QProcessEnvironment> &oldSystemdEnvironment)
+@@ -500,7 +500,7 @@ QProcess *setupKSplash()
          KConfigGroup ksplashCfg = cfg.group("KSplash");
          if (ksplashCfg.readEntry("Engine", QStringLiteral("KSplashQML")) == QLatin1String("KSplashQML")) {
              p = new QProcess;
diff --git a/nixpkgs/pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch b/nixpkgs/pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch
index 633551f6e3c2..211316e24736 100644
--- a/nixpkgs/pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch
+++ b/nixpkgs/pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch
@@ -15,8 +15,8 @@ index a560da3..f723c1e 100644
  type=image
  color=#1d99f3
  fontSize=10
--background=${KDE_INSTALL_FULL_WALLPAPERDIR}/Next/contents/images/5120x2880.png
-+background=${NIXPKGS_BREEZE_WALLPAPERS}/Next/contents/images/5120x2880.png
+-background=${KDE_INSTALL_FULL_WALLPAPERDIR}/Next/contents/images/5120x2880.jpg
++background=${NIXPKGS_BREEZE_WALLPAPERS}/Next/contents/images/5120x2880.jpg
  needsFullUserModel=false
 -- 
 2.30.0
diff --git a/nixpkgs/pkgs/desktops/plasma-5/srcs.nix b/nixpkgs/pkgs/desktops/plasma-5/srcs.nix
index 9de087f10e8c..c5da337d10d6 100644
--- a/nixpkgs/pkgs/desktops/plasma-5/srcs.nix
+++ b/nixpkgs/pkgs/desktops/plasma-5/srcs.nix
@@ -4,427 +4,435 @@
 
 {
   bluedevil = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/bluedevil-5.23.5.tar.xz";
-      sha256 = "1nbnmfdaisqngygyz1478fswsm1xp28v9l78xlw70yvvyjk2kc6v";
-      name = "bluedevil-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/bluedevil-5.24.0.tar.xz";
+      sha256 = "128br83hkxxrb6wca3d1racygdnfgk3r5md1gcjvgwb0gpy6bnzp";
+      name = "bluedevil-5.24.0.tar.xz";
     };
   };
   breeze = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/breeze-5.23.5.tar.xz";
-      sha256 = "1pyw7rhzkbd9kwsm8l7iz867jhwlbmkarc5iihg0bkbcg1ds18ic";
-      name = "breeze-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/breeze-5.24.0.tar.xz";
+      sha256 = "08b3hihz98z7kdybb0y1b74q1dn511ga81qqqxzlfirgpp8c9f9q";
+      name = "breeze-5.24.0.tar.xz";
     };
   };
   breeze-grub = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/breeze-grub-5.23.5.tar.xz";
-      sha256 = "12rm9a3vrmb3sm04l2c4vcj8psfyjxplp9wgh87q3k1rcyqz7fqk";
-      name = "breeze-grub-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/breeze-grub-5.24.0.tar.xz";
+      sha256 = "0p0pzmsd6scssyxcm9n58mp7fc9vz1lg4n7c1ch4bqragih1gnlr";
+      name = "breeze-grub-5.24.0.tar.xz";
     };
   };
   breeze-gtk = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/breeze-gtk-5.23.5.tar.xz";
-      sha256 = "1ynbvfgy2nlxg5svjqazj70m7py58ixxa7xyj13dcj6i2ikbcjld";
-      name = "breeze-gtk-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/breeze-gtk-5.24.0.tar.xz";
+      sha256 = "090cczxc1ciic6wghz3p21gpfdwnc8pjcvq6wn7bfkp1i3r5mihp";
+      name = "breeze-gtk-5.24.0.tar.xz";
     };
   };
   breeze-plymouth = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/breeze-plymouth-5.23.5.tar.xz";
-      sha256 = "1sllcrhz8hniqkgybk5bbb36fzjcdp5drjbf7v7jn4ih4wvybwmk";
-      name = "breeze-plymouth-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/breeze-plymouth-5.24.0.tar.xz";
+      sha256 = "1qqpwgp1yy3p1s0z21xwds6wx4z8daibkgk1bynj73cx7a2wch9g";
+      name = "breeze-plymouth-5.24.0.tar.xz";
     };
   };
   discover = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/discover-5.23.5.tar.xz";
-      sha256 = "1kzp7jpw2kgml2yc3cx9n5syln3kyd9fxa5klh3sa1xn6bz9f8zr";
-      name = "discover-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/discover-5.24.0.tar.xz";
+      sha256 = "0dbfvqana31wqharsbyb8rcrw1w6l9x1g6p02aqwiph0inkrz20q";
+      name = "discover-5.24.0.tar.xz";
     };
   };
   drkonqi = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/drkonqi-5.23.5.tar.xz";
-      sha256 = "08jjh52r6dmgp7dyxjxvavb4cxhmvzirwdn7hnmfhdbwkm09fqm5";
-      name = "drkonqi-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/drkonqi-5.24.0.tar.xz";
+      sha256 = "1ismgg7rcxijkprn4sci15wn4w2gmdn0fdbgvzxdcrqaf4g6qc3s";
+      name = "drkonqi-5.24.0.tar.xz";
     };
   };
   kactivitymanagerd = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kactivitymanagerd-5.23.5.tar.xz";
-      sha256 = "09v6pia34a694g0amj0miqi0j42yqvhfcv6yr9zfix4gf1qcdidn";
-      name = "kactivitymanagerd-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kactivitymanagerd-5.24.0.tar.xz";
+      sha256 = "12dvgm3ilyqlxzm8209b7g42nfk0ahfzizs3pbmi18zapjszcsps";
+      name = "kactivitymanagerd-5.24.0.tar.xz";
     };
   };
   kde-cli-tools = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kde-cli-tools-5.23.5.tar.xz";
-      sha256 = "1203z87i4dmhq1vlrfj4kiw157i5zkccd2bwc7p7qwhgbddaw5jd";
-      name = "kde-cli-tools-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kde-cli-tools-5.24.0.tar.xz";
+      sha256 = "0l8a4ysz1cqwdh3c20q51qamwh58vvs8yzb5jdvbp8bahsyyc4mr";
+      name = "kde-cli-tools-5.24.0.tar.xz";
     };
   };
   kde-gtk-config = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kde-gtk-config-5.23.5.tar.xz";
-      sha256 = "14qqxy2vz9004kfam9biv6q0601sn9yhrkx0i8y0958a58s5z3hp";
-      name = "kde-gtk-config-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kde-gtk-config-5.24.0.tar.xz";
+      sha256 = "024pglycz2kbp9npnvbx5qpkz9381wyyp6xkalqynzr9gy58syrx";
+      name = "kde-gtk-config-5.24.0.tar.xz";
     };
   };
   kdecoration = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kdecoration-5.23.5.tar.xz";
-      sha256 = "1kqj8l95wy46kfsw3f1crxwba9zwdlbgi7345mamhyks74wj1628";
-      name = "kdecoration-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kdecoration-5.24.0.tar.xz";
+      sha256 = "0xl8892w49z11k9mxgh7lp8a4l1x8wldmaij82kd1vnh9sxvb3f3";
+      name = "kdecoration-5.24.0.tar.xz";
     };
   };
   kdeplasma-addons = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kdeplasma-addons-5.23.5.tar.xz";
-      sha256 = "0cq0g8nqrkwv12010rsrmzqvxsa5arjpa87gvws8pah3v9k1xnkq";
-      name = "kdeplasma-addons-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kdeplasma-addons-5.24.0.tar.xz";
+      sha256 = "0q8yf0gz4gjn1kyf545i8fpsn2dpy48qhjpm8ssp3ywv6s2abjxn";
+      name = "kdeplasma-addons-5.24.0.tar.xz";
     };
   };
   kgamma5 = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kgamma5-5.23.5.tar.xz";
-      sha256 = "17j0kv00ibs2g9jxfvflk965221iznm0ydgj3i05i6j2bd8301zn";
-      name = "kgamma5-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kgamma5-5.24.0.tar.xz";
+      sha256 = "07w7l25snpi98j5bxg3zri5lsymabnli6h9d5w0qx0c19wzjwayl";
+      name = "kgamma5-5.24.0.tar.xz";
     };
   };
   khotkeys = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/khotkeys-5.23.5.tar.xz";
-      sha256 = "13562p0bv0jkamx9q07wi5vs78bdrhd0h3qg5rxajc5s36gyh63a";
-      name = "khotkeys-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/khotkeys-5.24.0.tar.xz";
+      sha256 = "0gjdwdzg5vybalima8jnwrprqj0rnxmzds0x8w707nb9ypz4k7k6";
+      name = "khotkeys-5.24.0.tar.xz";
     };
   };
   kinfocenter = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kinfocenter-5.23.5.tar.xz";
-      sha256 = "0f7ik3gg1pimjlc94dp6psk0sha8k7pinx50nvmgsglap4k1xbk7";
-      name = "kinfocenter-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kinfocenter-5.24.0.tar.xz";
+      sha256 = "09fq69q4300ppi1y9pp8s4h1bbai1p5qsz384bb445pjvwsyn6nf";
+      name = "kinfocenter-5.24.0.tar.xz";
     };
   };
   kmenuedit = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kmenuedit-5.23.5.tar.xz";
-      sha256 = "0k3dbip98zwia6m8nlgiw4mz09pkw7bik4cn3j73v2x3n7y3c542";
-      name = "kmenuedit-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kmenuedit-5.24.0.tar.xz";
+      sha256 = "0bjiqdw4wqi5vpkn98wjjz23x6k47lvxac8nyxs8ddd9i8mlklij";
+      name = "kmenuedit-5.24.0.tar.xz";
     };
   };
   kscreen = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kscreen-5.23.5.tar.xz";
-      sha256 = "0j5rgzj132j7qy1pgi12mhihf1a89a3xh8j5f7dp5s1f8kyjq0yi";
-      name = "kscreen-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kscreen-5.24.0.tar.xz";
+      sha256 = "19kqvvgj209ri035ldzn1k5l36l54rvagsnfzhw61v8rd9r6r02x";
+      name = "kscreen-5.24.0.tar.xz";
     };
   };
   kscreenlocker = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kscreenlocker-5.23.5.tar.xz";
-      sha256 = "07vhwvcyz9ynjzh44zny1f6di2knzy3fkiji3bhrki8p3zc9vjpm";
-      name = "kscreenlocker-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kscreenlocker-5.24.0.tar.xz";
+      sha256 = "0d827h5br27sdd925brljb1mwnkzj739g5q0k8xkw9f9q9bxk8l8";
+      name = "kscreenlocker-5.24.0.tar.xz";
     };
   };
   ksshaskpass = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/ksshaskpass-5.23.5.tar.xz";
-      sha256 = "0p8aka60mc8p96v3bx954jy99n9lf0a4b09sig307clwinfr23if";
-      name = "ksshaskpass-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/ksshaskpass-5.24.0.tar.xz";
+      sha256 = "1xiw25imhmkcikp746q9s393djmkdpkh9jb7h1diwwhambnimy6d";
+      name = "ksshaskpass-5.24.0.tar.xz";
     };
   };
   ksystemstats = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/ksystemstats-5.23.5.tar.xz";
-      sha256 = "1xmr0yk5xynja6z7xc6l1zd529q5si5qs71f72dba2zna22hb7hb";
-      name = "ksystemstats-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/ksystemstats-5.24.0.tar.xz";
+      sha256 = "1182dfcg1av9329g9p9ll64yiwyxm46kczakxb3vj4d2ajaclzm1";
+      name = "ksystemstats-5.24.0.tar.xz";
     };
   };
   kwallet-pam = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwallet-pam-5.23.5.tar.xz";
-      sha256 = "1cha41wiqsfgyrqb8di5qnnz0mnvmchprxay48czrn3r5mz49pw9";
-      name = "kwallet-pam-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwallet-pam-5.24.0.tar.xz";
+      sha256 = "0jzi2rcwxxjp3lg8cywp96ysnwm51a0m9pdwk8z7n3v1ncr2p38q";
+      name = "kwallet-pam-5.24.0.tar.xz";
     };
   };
   kwayland-integration = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwayland-integration-5.23.5.tar.xz";
-      sha256 = "0gs68v4rriknn59fv0yjcgrmcryv7wxgskswdgi1xx18v0rlc4ag";
-      name = "kwayland-integration-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwayland-integration-5.24.0.tar.xz";
+      sha256 = "1yq9cjb8xcvqr747p5hm8xxg4rn6mahchd5c2camv3qrjbqm8ll6";
+      name = "kwayland-integration-5.24.0.tar.xz";
     };
   };
   kwayland-server = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwayland-server-5.23.5.tar.xz";
-      sha256 = "0b8c1mkh36cgxhx18v9j23n9gnvzy22x50gpiw3dbkjzsmr1n7by";
-      name = "kwayland-server-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwayland-server-5.24.0.tar.xz";
+      sha256 = "1zbi4c14zvjwkxxqlg80mv749ybnkmcdvn72irmrzbbf4g1z7k32";
+      name = "kwayland-server-5.24.0.tar.xz";
     };
   };
   kwin = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwin-5.23.5.tar.xz";
-      sha256 = "00azqmdgkh72bg4d8868cin984vxxk6s6pk5x4dfvlaknzlyfjgp";
-      name = "kwin-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwin-5.24.0.tar.xz";
+      sha256 = "19q5pphqnr1xc1c4z0sd3yr60jsiq190llwllfmlj4acjlbcbbn6";
+      name = "kwin-5.24.0.tar.xz";
     };
   };
   kwrited = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwrited-5.23.5.tar.xz";
-      sha256 = "0aj911kfzd100jq1k1sg7i1nhiixnl7qiphc2bczn47f1jj64iqv";
-      name = "kwrited-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwrited-5.24.0.tar.xz";
+      sha256 = "018wvkkqzg4qyjd0w1h2d3ms72ghlq8mg79rrsj518l7hhlv6rsg";
+      name = "kwrited-5.24.0.tar.xz";
     };
   };
   layer-shell-qt = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/layer-shell-qt-5.23.5.tar.xz";
-      sha256 = "1ah66z9hiricw6h3j7x2k7d49y7g4l2s9w2658wjrava2qng9bsr";
-      name = "layer-shell-qt-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/layer-shell-qt-5.24.0.tar.xz";
+      sha256 = "0y3z2xr9vpxnm84gs1zpa1apma341wza7pjcpwibaqd6aiz9vpqv";
+      name = "layer-shell-qt-5.24.0.tar.xz";
     };
   };
   libkscreen = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/libkscreen-5.23.5.tar.xz";
-      sha256 = "08wgg96clp685fl5lflrfd4kmf5c2p5ms7n1q2izvg0n6qr37m1i";
-      name = "libkscreen-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/libkscreen-5.24.0.tar.xz";
+      sha256 = "0h6sycib940gbw2rf6ax3v7mg77pzga36xzwzbyz9h49fba3dpjk";
+      name = "libkscreen-5.24.0.tar.xz";
     };
   };
   libksysguard = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/libksysguard-5.23.5.tar.xz";
-      sha256 = "1gy1grkkz7vwglby52vv4gr8zbzsv8rbvwbp6rqvvhmqg7ascc1h";
-      name = "libksysguard-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/libksysguard-5.24.0.tar.xz";
+      sha256 = "1f0hwk2kzmgpjxmsjfd4g25sr91qyazp4hysyfjdhrrs2ajdkm0b";
+      name = "libksysguard-5.24.0.tar.xz";
     };
   };
   milou = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/milou-5.23.5.tar.xz";
-      sha256 = "05bc6hc5pn5rz4zp6b2akjdbssv7xppvzsw3pidkqb8pincl01gh";
-      name = "milou-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/milou-5.24.0.tar.xz";
+      sha256 = "0sxsisrzfancxwk8lsxhj2b85sgjdb9gzy4l0nax4fp942ygiirs";
+      name = "milou-5.24.0.tar.xz";
     };
   };
   oxygen = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/oxygen-5.23.5.tar.xz";
-      sha256 = "1vvy9yqllqq9dx2riwv4bmxfq13wph5wagy84f1hhl7zxnbcyv0c";
-      name = "oxygen-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/oxygen-5.24.0.tar.xz";
+      sha256 = "0ym74q29c2f32l1xm3kd0s2p7zzbg6a96g7d39fkp5paxicx5fb7";
+      name = "oxygen-5.24.0.tar.xz";
     };
   };
   plasma-browser-integration = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-browser-integration-5.23.5.tar.xz";
-      sha256 = "0jw9jircgbilig4pryyjxhby8qc7nag9a1s5nk1zdsnlaqr08jyp";
-      name = "plasma-browser-integration-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-browser-integration-5.24.0.tar.xz";
+      sha256 = "1gp9m7drwxflb0ms0vbvk7qydm1bghhzalc00lpcjh4nrf0bgh33";
+      name = "plasma-browser-integration-5.24.0.tar.xz";
     };
   };
   plasma-desktop = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-desktop-5.23.5.tar.xz";
-      sha256 = "0ym8cssw351ygw2vy27cyxql05y0gaflnqnq4fwkdgidldvmi45k";
-      name = "plasma-desktop-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-desktop-5.24.0.tar.xz";
+      sha256 = "1brnm6yivjy2piy88ncmclv4g2rxkaiyi923c557dmiipah2bx7z";
+      name = "plasma-desktop-5.24.0.tar.xz";
     };
   };
   plasma-disks = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-disks-5.23.5.tar.xz";
-      sha256 = "0197zyj5p7j8y80g0vvf5d9bq86qxkhwpa9dzb5l3is50y8lkj6p";
-      name = "plasma-disks-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-disks-5.24.0.tar.xz";
+      sha256 = "1c3pwnyhdmj7grk3gjh4kw5437m5cxhp70qsbhnfsaacps3mdv5d";
+      name = "plasma-disks-5.24.0.tar.xz";
     };
   };
   plasma-firewall = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-firewall-5.23.5.tar.xz";
-      sha256 = "0fhycjrb89blh6wf24rvq7bafqqrxj37ir0daj5jlph9f1w4laq0";
-      name = "plasma-firewall-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-firewall-5.24.0.tar.xz";
+      sha256 = "1jjw414547qksjxg2x5n666iq6qildbn9k9c8hqipmwnlkprpbb1";
+      name = "plasma-firewall-5.24.0.tar.xz";
     };
   };
   plasma-integration = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-integration-5.23.5.tar.xz";
-      sha256 = "03c0cqvr5cdpvxgm145sqpbbr8wv0qv4pqjl69v3bs010pd755lg";
-      name = "plasma-integration-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-integration-5.24.0.tar.xz";
+      sha256 = "17dqf6j1za3q8hzk7jfc5wc7s4kr28slrkq5iqvzqgyqjqy3z7rv";
+      name = "plasma-integration-5.24.0.tar.xz";
+    };
+  };
+  plasma-mobile = {
+    version = "5.24.0";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma/5.24.0/plasma-mobile-5.24.0.tar.xz";
+      sha256 = "0g9mbb8dzqcngc1sq43knwyc3kr81w3vl359wyrgvnr8r1qikv2z";
+      name = "plasma-mobile-5.24.0.tar.xz";
     };
   };
   plasma-nano = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-nano-5.23.5.tar.xz";
-      sha256 = "1yh67bh1smk7zx35hd72pafjbjdv7wwwhm76ga5sj251m61ncxim";
-      name = "plasma-nano-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-nano-5.24.0.tar.xz";
+      sha256 = "0i8lsp83g2i3c88djkmxawwbwa6lr0w89lzxj73fr6az6vdcrypj";
+      name = "plasma-nano-5.24.0.tar.xz";
     };
   };
   plasma-nm = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-nm-5.23.5.tar.xz";
-      sha256 = "14sknzy4v4xx1ihjn1s6x0lv5difnp4gi24zsdqvnkxkmxzhcij3";
-      name = "plasma-nm-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-nm-5.24.0.tar.xz";
+      sha256 = "17pmyklmr46qg21w4ql9q5nhfdjw1xmmv1qz7lyhlww7qa6mz1ny";
+      name = "plasma-nm-5.24.0.tar.xz";
     };
   };
   plasma-pa = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-pa-5.23.5.tar.xz";
-      sha256 = "1pcnf59qj7rgmcbc5xhad5zl487r48i2kyp6nc3yrlgj1xcfpfxg";
-      name = "plasma-pa-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-pa-5.24.0.tar.xz";
+      sha256 = "19n2plbk455qwgq0lcpb7rj2ck78ck64fpvlldmh53j9vxyzcasl";
+      name = "plasma-pa-5.24.0.tar.xz";
     };
   };
   plasma-phone-components = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-phone-components-5.23.5.tar.xz";
-      sha256 = "08c03pycvv7ald21d8ckxpv6d25qlxs28gjm99hdn6x8m74j7frn";
-      name = "plasma-phone-components-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-phone-components-5.24.0.tar.xz";
+      sha256 = "0g9mbb8dzqcngc1sq43knwyc3kr81w3vl359wyrgvnr8r1qikv2z";
+      name = "plasma-phone-components-5.24.0.tar.xz";
     };
   };
   plasma-sdk = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-sdk-5.23.5.tar.xz";
-      sha256 = "1s0l09lgqipks0w0jplaaipcs4a1ny4iclkz9hkfx4xjgcvk5m2j";
-      name = "plasma-sdk-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-sdk-5.24.0.tar.xz";
+      sha256 = "16fn98rv4qaci3b5whzjs6csbbxyrnmnr9gngn5dirdpla8cffld";
+      name = "plasma-sdk-5.24.0.tar.xz";
     };
   };
   plasma-systemmonitor = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-systemmonitor-5.23.5.tar.xz";
-      sha256 = "1snzabxgja9rsk000h97qjadb9fs8zdbqpr4zqa9sk0jjgm011lf";
-      name = "plasma-systemmonitor-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-systemmonitor-5.24.0.tar.xz";
+      sha256 = "0zkvbgwm2rpyisbx72a75ywy45d2primjjpnmw76x6924j8sp7pd";
+      name = "plasma-systemmonitor-5.24.0.tar.xz";
     };
   };
   plasma-tests = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-tests-5.23.5.tar.xz";
-      sha256 = "125b0sf7h0ibjl7msw1sc3cccms8nrrkx6cgwd46a9xi5svrsfg2";
-      name = "plasma-tests-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-tests-5.24.0.tar.xz";
+      sha256 = "1q95mrrb0p9ah4dg3bhkc9yh2ydasdmyd87jclraybcsfl6fi9kf";
+      name = "plasma-tests-5.24.0.tar.xz";
     };
   };
   plasma-thunderbolt = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-thunderbolt-5.23.5.tar.xz";
-      sha256 = "1ich92w479llvq1vjlfyvxh3dvqc4pgycfi97hz4sfhn7dnaw3vr";
-      name = "plasma-thunderbolt-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-thunderbolt-5.24.0.tar.xz";
+      sha256 = "1vsb3wf2sgbfbm2wk8kj18qhv4z9l4yzxaf8g30zpz4d1sva7jdc";
+      name = "plasma-thunderbolt-5.24.0.tar.xz";
     };
   };
   plasma-vault = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-vault-5.23.5.tar.xz";
-      sha256 = "1gf531q29qnvvsdxqgb1zyxwh5ck25kb0h1kk0d95pjkkylgyv0d";
-      name = "plasma-vault-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-vault-5.24.0.tar.xz";
+      sha256 = "1vk38iarhsr6rdrmhbcyjziw3dn8yjmgyn4dy2xdr0l4yqpq7qzz";
+      name = "plasma-vault-5.24.0.tar.xz";
     };
   };
   plasma-workspace = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-workspace-5.23.5.tar.xz";
-      sha256 = "0x950nb56xmmdf7hfpbrd9hvgq1a8vca0x8g1qsvrjhh5ymydgif";
-      name = "plasma-workspace-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-workspace-5.24.0.tar.xz";
+      sha256 = "0jnksl2i2viw5aaqv38b371z4lxrxah6p1bjp40a1zfa68vr8dz3";
+      name = "plasma-workspace-5.24.0.tar.xz";
     };
   };
   plasma-workspace-wallpapers = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-workspace-wallpapers-5.23.5.tar.xz";
-      sha256 = "0nr631yz8v671a87vh9f2a5kfjhn4f9147b339p09fwgfpx06vfx";
-      name = "plasma-workspace-wallpapers-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-workspace-wallpapers-5.24.0.tar.xz";
+      sha256 = "0329ks3q32nb9k3dxddlmxccjilgyxx5jplwbpln5b0p4plkn77k";
+      name = "plasma-workspace-wallpapers-5.24.0.tar.xz";
     };
   };
   plymouth-kcm = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plymouth-kcm-5.23.5.tar.xz";
-      sha256 = "0ynyqfm6az8yj3d30yxza5mjcsgfw6mmdkcgr3v95r6db112hqbx";
-      name = "plymouth-kcm-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plymouth-kcm-5.24.0.tar.xz";
+      sha256 = "1pcvfrv8vmk43s14209iv8gngi3al9g4za74yz2l79nxscyppzh5";
+      name = "plymouth-kcm-5.24.0.tar.xz";
     };
   };
   polkit-kde-agent = {
-    version = "1-5.23.5";
+    version = "1-5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/polkit-kde-agent-1-5.23.5.tar.xz";
-      sha256 = "1wgpgbq987qa6fdayw4155fwym6rcn2z7w66s8faqv94x78njzln";
-      name = "polkit-kde-agent-1-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/polkit-kde-agent-1-5.24.0.tar.xz";
+      sha256 = "1qayxff5hl8qr9p5bsfrq0cz3x1jlwc8f0nx66rkbngphdm7085n";
+      name = "polkit-kde-agent-1-5.24.0.tar.xz";
     };
   };
   powerdevil = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/powerdevil-5.23.5.tar.xz";
-      sha256 = "1lxjqd4w3jvnffcn9751j9k1fzsyasd1z8b1gm2iaf38iys21116";
-      name = "powerdevil-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/powerdevil-5.24.0.tar.xz";
+      sha256 = "06mrahlrqibvgfhcxywh72h6jblqq6sjsxqjzbq7zbq61vgc3jg3";
+      name = "powerdevil-5.24.0.tar.xz";
     };
   };
   qqc2-breeze-style = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/qqc2-breeze-style-5.23.5.tar.xz";
-      sha256 = "15i9h2md54a1h7isvma4x9pni3iy0bk84z8ibn3a36ydimyq5hra";
-      name = "qqc2-breeze-style-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/qqc2-breeze-style-5.24.0.tar.xz";
+      sha256 = "11kwrqsq5i1y1kvhg75hvax7bz122cjdsvb66f6hvni09yfcgyci";
+      name = "qqc2-breeze-style-5.24.0.tar.xz";
     };
   };
   sddm-kcm = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/sddm-kcm-5.23.5.tar.xz";
-      sha256 = "0csj1gml8w29dzv62zpbia9g10qz5k1nzv1yywsvay1q8rbqccxv";
-      name = "sddm-kcm-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/sddm-kcm-5.24.0.tar.xz";
+      sha256 = "011b68vca8nnmj9rxlyl5gl3xrrbysmcrx8szyfhha0wl9rgy2hx";
+      name = "sddm-kcm-5.24.0.tar.xz";
     };
   };
   systemsettings = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/systemsettings-5.23.5.tar.xz";
-      sha256 = "0shsqancxbxy6f4fd9m2a30x7gnjmd6gb8kq4nhlj6rramcwn3jh";
-      name = "systemsettings-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/systemsettings-5.24.0.tar.xz";
+      sha256 = "1jx1kllfd5561fq11d90r7m68736rsdlyzb109yq8awdwrl1vkp3";
+      name = "systemsettings-5.24.0.tar.xz";
     };
   };
   xdg-desktop-portal-kde = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/xdg-desktop-portal-kde-5.23.5.tar.xz";
-      sha256 = "09s3fpjdrnxqvnyxmxva0rx612d6pxv28qqvm00hzrb23nxz6qgb";
-      name = "xdg-desktop-portal-kde-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/xdg-desktop-portal-kde-5.24.0.tar.xz";
+      sha256 = "0f5wv4557avzcn7gf2hjqpn2p9r0d16k1iqcijzcfdmnvh2cp69d";
+      name = "xdg-desktop-portal-kde-5.24.0.tar.xz";
     };
   };
 }
diff --git a/nixpkgs/pkgs/development/compilers/cudatoolkit/common.nix b/nixpkgs/pkgs/development/compilers/cudatoolkit/common.nix
index f408d7b33121..46832e1cc2de 100644
--- a/nixpkgs/pkgs/development/compilers/cudatoolkit/common.nix
+++ b/nixpkgs/pkgs/development/compilers/cudatoolkit/common.nix
@@ -61,8 +61,6 @@ stdenv.mkDerivation rec {
     gtk2 glib fontconfig freetype unixODBC alsa-lib
   ];
 
-  rpath = "${lib.makeLibraryPath runtimeDependencies}:${stdenv.cc.cc.lib}/lib64";
-
   unpackPhase = ''
     sh $src --keep --noexec
 
@@ -119,6 +117,12 @@ stdenv.mkDerivation rec {
         fi
       done
       mv pkg/builds/cuda_nvcc/nvvm $out/nvvm
+
+      mv pkg/builds/cuda_sanitizer_api $out/cuda_sanitizer_api
+      ln -s $out/cuda_sanitizer_api/compute-sanitizer/compute-sanitizer $out/bin/compute-sanitizer
+
+      mv pkg/builds/nsight_systems/target-linux-x64 $out/target-linux-x64
+      mv pkg/builds/nsight_systems/host-linux-x64 $out/host-linux-x64
     ''}
 
     rm -f $out/tools/CUDA_Occupancy_Calculator.xls # FIXME: why?
@@ -184,22 +188,35 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  preFixup = ''
-    while IFS= read -r -d ''$'\0' i; do
-      if ! isELF "$i"; then continue; fi
-      echo "patching $i..."
-      if [[ ! $i =~ \.so ]]; then
-        patchelf \
-          --set-interpreter "''$(cat $NIX_CC/nix-support/dynamic-linker)" $i
-      fi
-      if [[ $i =~ libcudart ]]; then
-        patchelf --remove-rpath $i
-      else
-        rpath2=$rpath:$lib/lib:$out/jre/lib/amd64/jli:$out/lib:$out/lib64:$out/nvvm/lib:$out/nvvm/lib64
-        patchelf --set-rpath "$rpath2" --force-rpath $i
-      fi
-    done < <(find $out $lib $doc -type f -print0)
-  '';
+  preFixup =
+    let rpath = lib.concatStringsSep ":" [
+      (lib.makeLibraryPath (runtimeDependencies ++ [ "$lib" "$out" "$out/nvvm" ]))
+      "${stdenv.cc.cc.lib}/lib64"
+      "$out/jre/lib/amd64/jli"
+      "$out/lib64"
+      "$out/nvvm/lib64"
+    ];
+    in
+    ''
+      while IFS= read -r -d $'\0' i; do
+        if ! isELF "$i"; then continue; fi
+        echo "patching $i..."
+        if [[ ! $i =~ \.so ]]; then
+          patchelf \
+            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $i
+        fi
+        if [[ $i =~ libcudart ]]; then
+          patchelf --remove-rpath $i
+        else
+          patchelf --set-rpath "${rpath}" --force-rpath $i
+        fi
+      done < <(find $out $lib $doc -type f -print0)
+    '' + lib.optionalString (lib.versionAtLeast version "11") ''
+      for file in $out/target-linux-x64/*.so; do
+        echo "patching $file..."
+        patchelf --set-rpath "${rpath}:\$ORIGIN" $file
+      done
+    '';
 
   # Set RPATH so that libcuda and other libraries in
   # /run/opengl-driver(-32)/lib can be found. See the explanation in
@@ -208,6 +225,10 @@ stdenv.mkDerivation rec {
   # --force-rpath prevents changing RPATH (set above) to RUNPATH.
   postFixup = ''
     addOpenGLRunpath --force-rpath {$out,$lib}/lib/lib*.so
+  '' + lib.optionalString (lib.versionAtLeast version "11") ''
+    addOpenGLRunpath $out/cuda_sanitizer_api/compute-sanitizer/*
+    addOpenGLRunpath $out/cuda_sanitizer_api/compute-sanitizer/x86/*
+    addOpenGLRunpath $out/target-linux-x64/*
   '';
 
   # cuda-gdb doesn't run correctly when not using sandboxing, so
diff --git a/nixpkgs/pkgs/development/compilers/go/1.16.nix b/nixpkgs/pkgs/development/compilers/go/1.16.nix
index c30abc44fe20..872ade45946d 100644
--- a/nixpkgs/pkgs/development/compilers/go/1.16.nix
+++ b/nixpkgs/pkgs/development/compilers/go/1.16.nix
@@ -168,6 +168,7 @@ stdenv.mkDerivation rec {
     ./creds-test.patch
     ./go-1.9-skip-flaky-19608.patch
     ./go-1.9-skip-flaky-20072.patch
+    ./skip-chown-tests-1.16.patch
     ./skip-external-network-tests-1.16.patch
     ./skip-nohup-tests.patch
     ./skip-cgo-tests-1.15.patch
diff --git a/nixpkgs/pkgs/development/compilers/go/1.17.nix b/nixpkgs/pkgs/development/compilers/go/1.17.nix
index 4b2a3d39a982..a72593587490 100644
--- a/nixpkgs/pkgs/development/compilers/go/1.17.nix
+++ b/nixpkgs/pkgs/development/compilers/go/1.17.nix
@@ -168,6 +168,7 @@ stdenv.mkDerivation rec {
     ./creds-test.patch
     ./go-1.9-skip-flaky-19608.patch
     ./go-1.9-skip-flaky-20072.patch
+    ./skip-chown-tests-1.16.patch
     ./skip-external-network-tests-1.16.patch
     ./skip-nohup-tests.patch
     ./skip-cgo-tests-1.15.patch
diff --git a/nixpkgs/pkgs/development/compilers/go/1.18.nix b/nixpkgs/pkgs/development/compilers/go/1.18.nix
index 17c310519995..23e9f70d4da2 100644
--- a/nixpkgs/pkgs/development/compilers/go/1.18.nix
+++ b/nixpkgs/pkgs/development/compilers/go/1.18.nix
@@ -54,11 +54,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18rc1";
+  version = "1.18";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-XOx6ZlMAj6hfiCGzNmXeN74om3oC8X829wWojEOYC7g=";
+    sha256 = "sha256-OPQj20zINIg/K1I0QoL6ejn7uTZQ3GKhH98L5kCb2tY=";
   };
 
   # perl is used for testing go vet
diff --git a/nixpkgs/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch b/nixpkgs/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch
new file mode 100644
index 000000000000..8007ba05f6e1
--- /dev/null
+++ b/nixpkgs/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch
@@ -0,0 +1,18 @@
+diff --git a/lib/Driver/Driver.cpp b/lib/Driver/Driver.cpp
+index 94a7553e273b..8a1d455950b2 100644
+--- a/lib/Driver/Driver.cpp
++++ b/lib/Driver/Driver.cpp
+@@ -412,6 +412,13 @@ DerivedArgList *Driver::TranslateInputArgs(const InputArgList &Args) const {
+   }
+ #endif
+ 
++  {
++    Arg *A = DAL->MakeFlagArg(/*BaseArg=*/nullptr,
++                              Opts.getOption(options::OPT_nostdlibinc));
++    A->claim();
++    DAL->append(A);
++  }
++
+   return DAL;
+ }
+ 
diff --git a/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix b/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix
index 6c227f1ae72b..62b9e0470a61 100644
--- a/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -42,6 +42,7 @@ let
       # mis-compilation in firefox.
       # See: https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
       ./revert-malloc-alignment-assumption.patch
+      ./add-nostdlibinc-flag.patch
       (substituteAll {
         src = ../../clang-11-12-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
@@ -51,10 +52,6 @@ let
     postPatch = ''
       (cd tools && ln -s ../../clang-tools-extra extra)
 
-      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
-             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
-             lib/Driver/ToolChains/*.cpp
-
       # Patch for standalone doc building
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '' + lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/nixpkgs/pkgs/development/compilers/llvm/13/default.nix b/nixpkgs/pkgs/development/compilers/llvm/13/default.nix
index be5e9404cdd4..874be111ade0 100644
--- a/nixpkgs/pkgs/development/compilers/llvm/13/default.nix
+++ b/nixpkgs/pkgs/development/compilers/llvm/13/default.nix
@@ -18,7 +18,7 @@
 }:
 
 let
-  release_version = "13.0.0";
+  release_version = "13.0.1";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   rev = ""; # When using a Git commit
@@ -30,7 +30,7 @@ let
     owner = "llvm";
     repo = "llvm-project";
     rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "0cjl0vssi4y2g4nfr710fb6cdhxmn5r0vis15sf088zsc5zydfhw";
+    sha256 = "06dv6h5dmvzdxbif2s8njki6h32796v368dyb5945x8gjj72xh7k";
   };
 
   llvm_meta = {
diff --git a/nixpkgs/pkgs/development/compilers/sdcc/default.nix b/nixpkgs/pkgs/development/compilers/sdcc/default.nix
index 28a461b09883..8f6bc5e6dac0 100644
--- a/nixpkgs/pkgs/development/compilers/sdcc/default.nix
+++ b/nixpkgs/pkgs/development/compilers/sdcc/default.nix
@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sdcc";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/sdcc/sdcc-src-${version}.tar.bz2";
-    sha256 = "0gskzli17ghnn5qllvn4d56qf9bvvclqjh63nnj63p52smvggvc1";
+    sha256 = "sha256-tJuuHSO81gV6gsT/5WE/nNDLz9HpQOnYTEv+nfCowFM=";
   };
 
   buildInputs = [ boost gputils texinfo zlib ];
diff --git a/nixpkgs/pkgs/development/compilers/vala/default.nix b/nixpkgs/pkgs/development/compilers/vala/default.nix
index 1dc910c62227..72512a1202f2 100644
--- a/nixpkgs/pkgs/development/compilers/vala/default.nix
+++ b/nixpkgs/pkgs/development/compilers/vala/default.nix
@@ -90,8 +90,8 @@ in rec {
   };
 
   vala_0_54 = generic {
-    version = "0.54.6";
-    sha256 = "SdYNlqP99sQoc5dEK8bW2Vv0CqffZ47kkSjEsRum5Gk=";
+    version = "0.54.7";
+    sha256 = "Ygecof8C5dF65yqppa3GGuav3P67DZ8GBjo2776soMc=";
   };
 
   vala = vala_0_54;
diff --git a/nixpkgs/pkgs/development/embedded/stm32/stm32cubemx/default.nix b/nixpkgs/pkgs/development/embedded/stm32/stm32cubemx/default.nix
index 7c0b1802bacd..e6ead8dd3723 100644
--- a/nixpkgs/pkgs/development/embedded/stm32/stm32cubemx/default.nix
+++ b/nixpkgs/pkgs/development/embedded/stm32/stm32cubemx/default.nix
@@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "stm32cubemx";
-  version = "6.4.0";
+  version = "6.5.0";
 
   src = fetchzip {
     url = "https://sw-center.st.com/packs/resource/library/stm32cube_mx_v${builtins.replaceStrings ["."] [""] version}-lin.zip";
-    sha256 = "sha256-5qotjAyaNFtYUjHlNKwywmBJGAzS/IM9bF+dmONE4bk=";
+    sha256 = "sha256-19RG+bJCmkaytMtDpDLbDvfKo27Z+Mo/sOrs8lOVV44=";
     stripRoot = false;
   };
 
diff --git a/nixpkgs/pkgs/development/interpreters/python/cpython/default.nix b/nixpkgs/pkgs/development/interpreters/python/cpython/default.nix
index 1bcbd2bb4b5e..02ecf8d25b1e 100644
--- a/nixpkgs/pkgs/development/interpreters/python/cpython/default.nix
+++ b/nixpkgs/pkgs/development/interpreters/python/cpython/default.nix
@@ -191,7 +191,6 @@ in with passthru; stdenv.mkDerivation {
 
   prePatch = optionalString stdenv.isDarwin ''
     substituteInPlace configure --replace '`/usr/bin/arch`' '"i386"'
-    substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '' + optionalString (pythonOlder "3.9" && stdenv.isDarwin && x11Support) ''
     # Broken on >= 3.9; replaced with ./3.9/darwin-tcl-tk.patch
     substituteInPlace setup.py --replace /Library/Frameworks /no-such-path
@@ -342,8 +341,6 @@ in with passthru; stdenv.mkDerivation {
       substituteInPlace ./setup.py --replace $i /no-such-path
     done
   '' + optionalString stdenv.isDarwin ''
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -msse2"
-    export MACOSX_DEPLOYMENT_TARGET=10.6
     # Override the auto-detection in setup.py, which assumes a universal build
     export PYTHON_DECIMAL_WITH_MACHINE=${if stdenv.isAarch64 then "uint128" else "x64"}
   '' + optionalString (isPy3k && pythonOlder "3.7") ''
diff --git a/nixpkgs/pkgs/development/interpreters/python/default.nix b/nixpkgs/pkgs/development/interpreters/python/default.nix
index 33eb8489299b..f2e59cd27816 100644
--- a/nixpkgs/pkgs/development/interpreters/python/default.nix
+++ b/nixpkgs/pkgs/development/interpreters/python/default.nix
@@ -282,9 +282,9 @@ in {
     sourceVersion = {
       major = "7";
       minor = "3";
-      patch = "6";
+      patch = "8";
     };
-    sha256 = "sha256-ghJ/Q/rmznXUfWxFOfjB6jcunC2/pA+ui1g1HVInk6Q="; # linux64
+    sha256 = "0h493q0lhpz035afi4g09f4mz5a72vqx4sa7qcry5z4zagxq8bhz"; # linux64
     pythonVersion = "2.7";
     inherit passthruFun;
   };
diff --git a/nixpkgs/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix b/nixpkgs/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
index 460af1cc67b4..877a00efa483 100644
--- a/nixpkgs/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
+++ b/nixpkgs/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
@@ -7,7 +7,6 @@
 # Dependencies
 , bzip2
 , zlib
-, openssl_1_0_2
 , expat
 , ncurses6
 , tcl-8_5
@@ -50,7 +49,6 @@ let
   deps = [
     bzip2
     zlib
-    openssl_1_0_2
     expat
     ncurses6
     tcl-8_5
diff --git a/nixpkgs/pkgs/development/libraries/SDL2/Fix-build-against-wayland-1.20.patch b/nixpkgs/pkgs/development/libraries/SDL2/Fix-build-against-wayland-1.20.patch
deleted file mode 100644
index 1be600bedb35..000000000000
--- a/nixpkgs/pkgs/development/libraries/SDL2/Fix-build-against-wayland-1.20.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From a31d1f1683ef2e9c063c3fa1db79d111cca99414 Mon Sep 17 00:00:00 2001
-From: David Redondo <kde@david-redondo.de>
-Date: Fri, 10 Dec 2021 16:22:34 +0100
-Subject: [PATCH] Fix build against wayland 1.20
-
-Fixes #5088
-
-(cherry picked from commit e2ade2bfc46d915cd306c63c830b81d800b2575f)
----
- src/video/wayland/SDL_waylanddyn.h | 2 ++
- src/video/wayland/SDL_waylandsym.h | 4 ++++
- 2 files changed, 6 insertions(+)
-
-diff --git a/src/video/wayland/SDL_waylanddyn.h b/src/video/wayland/SDL_waylanddyn.h
-index 485a9c19f..37070e946 100644
---- a/src/video/wayland/SDL_waylanddyn.h
-+++ b/src/video/wayland/SDL_waylanddyn.h
-@@ -81,6 +81,8 @@ void SDL_WAYLAND_UnloadSymbols(void);
- #define wl_proxy_add_listener (*WAYLAND_wl_proxy_add_listener)
- #define wl_proxy_marshal_constructor (*WAYLAND_wl_proxy_marshal_constructor)
- #define wl_proxy_marshal_constructor_versioned (*WAYLAND_wl_proxy_marshal_constructor_versioned)
-+#define wl_proxy_marshal_flags (*WAYLAND_wl_proxy_marshal_flags)
-+#define wl_proxy_marshal_array_flags (*WAYLAND_wl_proxy_marshal_array_flags)
-
- #define wl_seat_interface (*WAYLAND_wl_seat_interface)
- #define wl_surface_interface (*WAYLAND_wl_surface_interface)
-diff --git a/src/video/wayland/SDL_waylandsym.h b/src/video/wayland/SDL_waylandsym.h
-index c4c189d3c..789f49e27 100644
---- a/src/video/wayland/SDL_waylandsym.h
-+++ b/src/video/wayland/SDL_waylandsym.h
-@@ -71,6 +71,10 @@ SDL_WAYLAND_SYM(struct wl_proxy *, wl_proxy_marshal_constructor, (struct wl_prox
- SDL_WAYLAND_MODULE(WAYLAND_CLIENT_1_10)
- SDL_WAYLAND_SYM(struct wl_proxy *, wl_proxy_marshal_constructor_versioned, (struct wl_proxy *proxy, uint32_t opcode, const struct wl_interface *interface, uint32_t version, ...))
-
-+SDL_WAYLAND_MODULE(WAYLAND_CLIENT_1_20)
-+SDL_WAYLAND_SYM(struct wl_proxy*, wl_proxy_marshal_flags, (struct wl_proxy *proxy, uint32_t opcode, const struct wl_interface *interfac, uint32_t version, uint32_t flags, ...))
-+SDL_WAYLAND_SYM(struct wl_proxy*, wl_proxy_marshal_array_flags, (struct wl_proxy *proxy, uint32_t opcode, const struct wl_interface *interface, uint32_t version,  uint32_t flags, union wl_argument *args))
-+
- SDL_WAYLAND_INTERFACE(wl_seat_interface)
- SDL_WAYLAND_INTERFACE(wl_surface_interface)
- SDL_WAYLAND_INTERFACE(wl_shm_pool_interface)
---
-2.33.1
diff --git a/nixpkgs/pkgs/development/libraries/SDL2/default.nix b/nixpkgs/pkgs/development/libraries/SDL2/default.nix
index 95022211d2f7..d1086de3718d 100644
--- a/nixpkgs/pkgs/development/libraries/SDL2/default.nix
+++ b/nixpkgs/pkgs/development/libraries/SDL2/default.nix
@@ -1,20 +1,50 @@
-{ lib, stdenv, config, fetchurl, pkg-config
+{ lib
+, stdenv
+, config
+, fetchurl
+, pkg-config
 , libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, openglSupport ? libGLSupported, libGL
-, alsaSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid, alsa-lib
+, openglSupport ? libGLSupported
+, libGL
+, alsaSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, alsa-lib
 , x11Support ? !stdenv.targetPlatform.isWindows && !stdenv.hostPlatform.isAndroid
-, libX11, xorgproto, libICE, libXi, libXScrnSaver, libXcursor
-, libXinerama, libXext, libXxf86vm, libXrandr
+, libX11
+, xorgproto
+, libICE
+, libXi
+, libXScrnSaver
+, libXcursor
+, libXinerama
+, libXext
+, libXxf86vm
+, libXrandr
 , waylandSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, wayland, wayland-protocols, libxkbcommon
-, dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid, dbus
-, udevSupport ? false, udev
-, ibusSupport ? false, ibus
-, fcitxSupport ? false, fcitx
+, wayland
+, wayland-protocols
+, libxkbcommon
+, dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, dbus
+, udevSupport ? false
+, udev
+, ibusSupport ? false
+, ibus
+, fcitxSupport ? false
+, fcitx
+, libdecorSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, libdecor
+, pipewireSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, pipewire # NOTE: must be built with SDL2 without pipewire support
 , pulseaudioSupport ? config.pulseaudio or stdenv.isLinux && !stdenv.hostPlatform.isAndroid
 , libpulseaudio
-, AudioUnit, Cocoa, CoreAudio, CoreServices, ForceFeedback, OpenGL
-, audiofile, libiconv
+, AudioUnit
+, Cocoa
+, CoreAudio
+, CoreServices
+, ForceFeedback
+, OpenGL
+, audiofile
+, libiconv
 , withStatic ? false
 }:
 
@@ -25,32 +55,16 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.0.14";
+  version = "2.0.20";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "1g1jahknv5r4yhh1xq5sf0md20ybdw1zh1i15lry26sq39bmn8fq";
+    sha256 = "sha256-xWq6HXtbDn6Znkp2mMcLY6M5T/lwS19uHFfgwW8E3QY=";
   };
   dontDisableStatic = withStatic;
   outputs = [ "out" "dev" ];
   outputBin = "dev"; # sdl-config
 
-  patches = [
-    ./find-headers.patch
-    # To fix the build with wayland 1.20.0:
-    ./Fix-build-against-wayland-1.20.patch
-  ];
-
-  # Fix with mesa 19.2: https://bugzilla.libsdl.org/show_bug.cgi?id=4797
-  postPatch = ''
-    substituteInPlace include/SDL_opengl_glext.h \
-      --replace "typedef ptrdiff_t GLsizeiptr;" "typedef signed long int khronos_ssize_t; typedef khronos_ssize_t GLsizeiptr;" \
-      --replace "typedef ptrdiff_t GLintptr;" "typedef signed long int khronos_intptr_t; typedef khronos_intptr_t GLintptr;"
-
-    substituteInPlace configure \
-      --replace 'WAYLAND_SCANNER=`$PKG_CONFIG --variable=wayland_scanner wayland-scanner`' 'WAYLAND_SCANNER=`pkg-config --variable=wayland_scanner wayland-scanner`'
-  '';
-
   depsBuildBuild = [ pkg-config ];
 
   nativeBuildInputs = [ pkg-config ] ++ optionals waylandSupport [ wayland ];
@@ -63,18 +77,19 @@ stdenv.mkDerivation rec {
     # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
     ++ optionals x11Support [ libX11 xorgproto ];
 
-  dlopenBuildInputs = [ ]
-    ++ optionals  alsaSupport [ alsa-lib audiofile ]
-    ++ optional  dbusSupport dbus
-    ++ optional  pulseaudioSupport libpulseaudio
-    ++ optional  udevSupport udev
+  dlopenBuildInputs = optionals alsaSupport [ alsa-lib audiofile ]
+    ++ optional dbusSupport dbus
+    ++ optional libdecorSupport libdecor
+    ++ optional pipewireSupport pipewire
+    ++ optional pulseaudioSupport libpulseaudio
+    ++ optional udevSupport udev
     ++ optionals waylandSupport [ wayland wayland-protocols libxkbcommon ]
     ++ optionals x11Support [ libICE libXi libXScrnSaver libXcursor libXinerama libXext libXrandr libXxf86vm ];
 
   buildInputs = [ libiconv ]
     ++ dlopenBuildInputs
-    ++ optional  ibusSupport ibus
-    ++ optional  fcitxSupport fcitx
+    ++ optional ibusSupport ibus
+    ++ optional fcitxSupport fcitx
     ++ optionals stdenv.isDarwin [ AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL ];
 
   enableParallelBuilding = true;
@@ -82,9 +97,9 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--disable-oss"
   ] ++ optional (!x11Support) "--without-x"
-    ++ optional alsaSupport "--with-alsa-prefix=${alsa-lib.out}/lib"
-    ++ optional stdenv.targetPlatform.isWindows "--disable-video-opengles"
-    ++ optional stdenv.isDarwin "--disable-sdltest";
+  ++ optional alsaSupport "--with-alsa-prefix=${alsa-lib.out}/lib"
+  ++ optional stdenv.targetPlatform.isWindows "--disable-video-opengles"
+  ++ optional stdenv.isDarwin "--disable-sdltest";
 
   # We remove libtool .la files when static libs are requested,
   # because they make the builds of downstream libs like `SDL_tff`
@@ -117,15 +132,17 @@ stdenv.mkDerivation rec {
   #
   # You can grep SDL sources with `grep -rE 'SDL_(NAME|.*_SYM)'` to
   # list the symbols used in this way.
-  postFixup = let
-    rpath = makeLibraryPath (dlopenPropagatedBuildInputs ++ dlopenBuildInputs);
-  in optionalString (stdenv.hostPlatform.extensions.sharedLibrary == ".so") ''
-    for lib in $out/lib/*.so* ; do
-      if ! [[ -L "$lib" ]]; then
-        patchelf --set-rpath "$(patchelf --print-rpath $lib):${rpath}" "$lib"
-      fi
-    done
-  '';
+  postFixup =
+    let
+      rpath = makeLibraryPath (dlopenPropagatedBuildInputs ++ dlopenBuildInputs);
+    in
+    optionalString (stdenv.hostPlatform.extensions.sharedLibrary == ".so") ''
+      for lib in $out/lib/*.so* ; do
+        if ! [[ -L "$lib" ]]; then
+          patchelf --set-rpath "$(patchelf --print-rpath $lib):${rpath}" "$lib"
+        fi
+      done
+    '';
 
   setupHook = ./setup-hook.sh;
 
diff --git a/nixpkgs/pkgs/development/libraries/SDL2/find-headers.patch b/nixpkgs/pkgs/development/libraries/SDL2/find-headers.patch
deleted file mode 100644
index a2e0c4837031..000000000000
--- a/nixpkgs/pkgs/development/libraries/SDL2/find-headers.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff -ru3 SDL2-2.0.14/sdl2-config.cmake.in SDL2-2.0.14-new/sdl2-config.cmake.in
---- SDL2-2.0.14/sdl2-config.cmake.in	2020-12-21 18:44:36.000000000 +0100
-+++ SDL2-2.0.14-new/sdl2-config.cmake.in	2021-01-16 23:53:40.721121792 +0100
-@@ -6,7 +6,8 @@
- set(SDL2_PREFIX "@prefix@")
- set(SDL2_EXEC_PREFIX "@prefix@")
- set(SDL2_LIBDIR "@libdir@")
--set(SDL2_INCLUDE_DIRS "@includedir@/SDL2")
-+set(SDL2_INCLUDE_DIRS "@includedir@/SDL2" $ENV{SDL2_PATH})
-+separate_arguments(SDL2_INCLUDE_DIRS)
- set(SDL2_LIBRARIES "-L${SDL2_LIBDIR} @SDL_RLD_FLAGS@ @SDL_LIBS@")
- string(STRIP "${SDL2_LIBRARIES}" SDL2_LIBRARIES)
- 
-@@ -20,14 +21,14 @@
- 
-   add_library(SDL2::SDL2 SHARED IMPORTED)
-   set_target_properties(SDL2::SDL2 PROPERTIES
--    INTERFACE_INCLUDE_DIRECTORIES "@includedir@/SDL2"
-+    INTERFACE_INCLUDE_DIRECTORIES "${SDL2_INCLUDE_DIRS}"
-     IMPORTED_LINK_INTERFACE_LANGUAGES "C"
-     IMPORTED_LOCATION "@libdir@/${CMAKE_SHARED_LIBRARY_PREFIX}SDL2${CMAKE_SHARED_LIBRARY_SUFFIX}"
-     INTERFACE_LINK_LIBRARIES "${SDL2_EXTRA_LINK_FLAGS}")
- 
-   add_library(SDL2::SDL2-static STATIC IMPORTED)
-   set_target_properties(SDL2::SDL2-static PROPERTIES
--    INTERFACE_INCLUDE_DIRECTORIES "@includedir@/SDL2"
-+    INTERFACE_INCLUDE_DIRECTORIES "${SDL2_INCLUDE_DIRS}"
-     IMPORTED_LINK_INTERFACE_LANGUAGES "C"
-     IMPORTED_LOCATION "@libdir@/${CMAKE_STATIC_LIBRARY_PREFIX}SDL2${CMAKE_STATIC_LIBRARY_SUFFIX}"
-     INTERFACE_LINK_LIBRARIES "${SDL2_EXTRA_LINK_FLAGS_STATIC}")
-diff -ru3 SDL2-2.0.14/sdl2-config.in SDL2-2.0.14-new/sdl2-config.in
---- SDL2-2.0.14/sdl2-config.in	2020-12-21 18:44:36.000000000 +0100
-+++ SDL2-2.0.14-new/sdl2-config.in	2021-01-16 23:57:11.940353171 +0100
-@@ -42,7 +42,11 @@
-       echo @SDL_VERSION@
-       ;;
-     --cflags)
--      echo -I@includedir@/SDL2 @SDL_CFLAGS@
-+      SDL_CFLAGS=""
-+      for i in @includedir@/SDL2 $SDL2_PATH; do
-+        SDL_CFLAGS="$SDL_CFLAGS -I$i"
-+      done
-+      echo $SDL_CFLAGS @SDL_CFLAGS@
-       ;;
- @ENABLE_SHARED_TRUE@    --libs)
- @ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@
diff --git a/nixpkgs/pkgs/development/libraries/aws-checksums/default.nix b/nixpkgs/pkgs/development/libraries/aws-checksums/default.nix
index 9042dc561544..058e4ea6a5f7 100644
--- a/nixpkgs/pkgs/development/libraries/aws-checksums/default.nix
+++ b/nixpkgs/pkgs/development/libraries/aws-checksums/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-checksums";
-  version = "0.1.11";
+  version = "0.1.12";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fXu7GI2UR9QiBGP2n2pEFRjz9ZwA+BAK9zxhNnoYWt4=";
+    sha256 = "sha256-k3hIGk92HncRAktpuvNcZnaBZiLj63/wQBz2WScUjhQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/development/libraries/boost/generic.nix b/nixpkgs/pkgs/development/libraries/boost/generic.nix
index 490693035707..bad87fba8c64 100644
--- a/nixpkgs/pkgs/development/libraries/boost/generic.nix
+++ b/nixpkgs/pkgs/development/libraries/boost/generic.nix
@@ -127,7 +127,14 @@ stdenv.mkDerivation {
     extraPrefix = "libs/context/";
   })
   ++ optional (and (versionAtLeast version "1.70") (!versionAtLeast version "1.73")) ./cmake-paths.patch
-  ++ optional (versionAtLeast version "1.73") ./cmake-paths-173.patch;
+  ++ optional (versionAtLeast version "1.73") ./cmake-paths-173.patch
+  ++ optional (version == "1.77.0") (fetchpatch {
+    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
+    sha256 = "sha256-KlmIbixcds6GyKYt1fx5BxDIrU7msrgDdYo9Va/KJR4=";
+    stripLen = 2;
+    extraPrefix = "";
+    includes = [ "boost/math/special_functions/detail/bernoulli_details.hpp" ];
+  });
 
   meta = {
     homepage = "http://boost.org/";
diff --git a/nixpkgs/pkgs/development/libraries/civetweb/0001-allow-setting-paths-in-makefile.patch b/nixpkgs/pkgs/development/libraries/civetweb/0001-allow-setting-paths-in-makefile.patch
deleted file mode 100644
index 8a14fb3a5fab..000000000000
--- a/nixpkgs/pkgs/development/libraries/civetweb/0001-allow-setting-paths-in-makefile.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-diff -u a/Makefile b/Makefile
---- a/Makefile	2020-12-27 18:48:53.934098765 +0100
-+++ b/Makefile	2020-12-27 18:50:44.022674117 +0100
-@@ -19,13 +19,13 @@
- # http://www.gnu.org/prep/standards/html_node/Directory-Variables.html
- PREFIX ?= /usr/local
- EXEC_PREFIX = $(PREFIX)
--BINDIR = $(EXEC_PREFIX)/bin
-+BINDIR ?= $(EXEC_PREFIX)/bin
- DATAROOTDIR = $(PREFIX)/share
- DOCDIR = $(DATAROOTDIR)/doc/$(CPROG)
- SYSCONFDIR ?= $(PREFIX)/etc
- HTMLDIR = $(DOCDIR)
--INCLUDEDIR = $(DESTDIR)$(PREFIX)/include
--LIBDIR = $(DESTDIR)$(EXEC_PREFIX)/lib
-+INCLUDEDIR ?= $(DESTDIR)$(PREFIX)/include
-+LIBDIR ?= $(DESTDIR)$(EXEC_PREFIX)/lib
- PID_FILE ?= /var/run/$(CPROG).pid
- 
- # build tools
-@@ -337,10 +337,10 @@
- 	install -m 755 $(CPROG) "$(BINDIR)/"
- 
- install-headers:
--	install -m 644 $(HEADERS) "$(INCLUDEDIR)"
-+	install -m 644 $(HEADERS) "$(INCLUDEDIR)/"
- 
- install-lib: lib$(CPROG).a
--	install -m 644 $< "$(LIBDIR)"
-+	install -m 644 $< "$(LIBDIR)/"
- 
- install-slib: lib$(CPROG).so
- 	$(eval version=$(shell grep -w "define CIVETWEB_VERSION" include/civetweb.h | sed 's|.*VERSION "\(.*\)"|\1|g'))
diff --git a/nixpkgs/pkgs/development/libraries/civetweb/default.nix b/nixpkgs/pkgs/development/libraries/civetweb/default.nix
index 93ac618bcacf..bf737972612b 100644
--- a/nixpkgs/pkgs/development/libraries/civetweb/default.nix
+++ b/nixpkgs/pkgs/development/libraries/civetweb/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
+, cmake
 }:
 
 stdenv.mkDerivation rec {
@@ -13,33 +15,28 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Qh6BGPk7a01YzCeX42+Og9M+fjXRs7kzNUCyT4mYab4=";
   };
 
-  makeFlags = [
-    "WITH_CPP=1"
-    "PREFIX=${placeholder "out"}"
-    "LIBDIR=${placeholder "out"}/lib"
-    "INCLUDEDIR=${placeholder "dev"}/include"
-  ];
-
-  patches = [
-    ./0001-allow-setting-paths-in-makefile.patch
-  ];
+  outputs = [ "out" "dev" ];
 
   strictDeps = true;
 
-  outputs = [ "out" "dev" ];
-
-  installTargets = [
-    "install-headers"
-    "install-lib"
-    "install-slib"
-    "install"
+  nativeBuildInputs = [
+    cmake
   ];
 
-  preInstall = ''
-    mkdir -p $dev/include
-    mkdir -p $out/lib
+  # The existence of the "build" script causes `mkdir -p build` to fail:
+  #   mkdir: cannot create directory 'build': File exists
+  preConfigure = ''
+    rm build
   '';
 
+  cmakeFlags = [
+    "-DCIVETWEB_ENABLE_CXX=ON"
+    "-DBUILD_SHARED_LIBS=ON"
+
+    # The civetweb unit tests rely on downloading their fork of libcheck.
+    "-DCIVETWEB_BUILD_TESTING=OFF"
+  ];
+
   meta = {
     description = "Embedded C/C++ web server";
     homepage = "https://github.com/civetweb/civetweb";
diff --git a/nixpkgs/pkgs/development/libraries/expat/default.nix b/nixpkgs/pkgs/development/libraries/expat/default.nix
index 9e913fdf52b4..ac54ced75b1b 100644
--- a/nixpkgs/pkgs/development/libraries/expat/default.nix
+++ b/nixpkgs/pkgs/development/libraries/expat/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "expat";
-  version = "2.4.4";
+  version = "2.4.6";
 
   src = fetchurl {
     url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-tdJdbjczUcLtGbVitHMtAdJYmsjI6eeWLY3xIHzDEbg=";
+    sha256 = "sha256-3lV5S3qbwhSFL9wHW+quzYVO/hNhWX5iaO6HlGlRKJs=";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
diff --git a/nixpkgs/pkgs/development/libraries/gd/default.nix b/nixpkgs/pkgs/development/libraries/gd/default.nix
index cd971b291b98..7ea8ce6d29b4 100644
--- a/nixpkgs/pkgs/development/libraries/gd/default.nix
+++ b/nixpkgs/pkgs/development/libraries/gd/default.nix
@@ -5,10 +5,11 @@
 , pkg-config
 , zlib
 , libpng
-, libjpeg ? null
-, libwebp ? null
-, libtiff ? null
-, libXpm ? null
+, libjpeg
+, libwebp
+, libtiff
+, libXpm
+, libavif
 , fontconfig
 , freetype
 }:
@@ -41,8 +42,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake pkg-config ];
 
-  buildInputs = [ zlib fontconfig freetype ];
-  propagatedBuildInputs = [ libpng libjpeg libwebp libtiff libXpm ];
+  buildInputs = [ zlib fontconfig freetype libpng libjpeg libwebp libtiff libXpm libavif ];
 
   outputs = [ "bin" "dev" "out" ];
 
diff --git a/nixpkgs/pkgs/development/libraries/gdbm/default.nix b/nixpkgs/pkgs/development/libraries/gdbm/default.nix
index 83df37f236be..e1a3def0ba42 100644
--- a/nixpkgs/pkgs/development/libraries/gdbm/default.nix
+++ b/nixpkgs/pkgs/development/libraries/gdbm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gdbm";
-  version = "1.20";
+  version = "1.23";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${pname}-${version}.tar.gz";
-    sha256 = "sha256-OurAVkizSCoQotqYa586OAoprWUL6AuYF6Q1+4EUopI=";
+    sha256 = "sha256-dLEIHSH/8TrkvXwW5dblBKTCb3zeHcoNljpIQXS7ys0=";
   };
 
   doCheck = true; # not cross;
diff --git a/nixpkgs/pkgs/development/libraries/glib/default.nix b/nixpkgs/pkgs/development/libraries/glib/default.nix
index 30f43c00a05d..c98058768b2e 100644
--- a/nixpkgs/pkgs/development/libraries/glib/default.nix
+++ b/nixpkgs/pkgs/development/libraries/glib/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.70.2";
+  version = "2.70.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "BVFFnIXNPaPVjdyQFv0ovlr1A/XhYVpxultRKslFgG8=";
+    sha256 = "Iz+khBweGeOW23YH1Y9rdbozE8UL8Pzgey41MtXrfUY=";
   };
 
   patches = optionals stdenv.isDarwin [
diff --git a/nixpkgs/pkgs/development/libraries/glibc/2.33-master.patch.gz b/nixpkgs/pkgs/development/libraries/glibc/2.33-master.patch.gz
index 49ffd4a7441c..777e94e2b2ea 100644
--- a/nixpkgs/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/nixpkgs/pkgs/development/libraries/glibc/2.33-master.patch.gz
Binary files differdiff --git a/nixpkgs/pkgs/development/libraries/glibc/common.nix b/nixpkgs/pkgs/development/libraries/glibc/common.nix
index 9a84a5f8167a..ffec9972d287 100644
--- a/nixpkgs/pkgs/development/libraries/glibc/common.nix
+++ b/nixpkgs/pkgs/development/libraries/glibc/common.nix
@@ -44,7 +44,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-108";
+  patchSuffix = "-117";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-108-g3e2a15c666
+          glibc-2.33-117-g55446dd8a2
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/nixpkgs/pkgs/development/libraries/gnu-config/default.nix b/nixpkgs/pkgs/development/libraries/gnu-config/default.nix
index a08997ea2cdb..0b7650199923 100644
--- a/nixpkgs/pkgs/development/libraries/gnu-config/default.nix
+++ b/nixpkgs/pkgs/development/libraries/gnu-config/default.nix
@@ -20,6 +20,8 @@ in stdenv.mkDerivation {
     mkdir -p $out
     cp ${configGuess} $out/config.guess
     cp ${configSub} $out/config.sub
+
+    chmod +x $out/config.*
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/development/libraries/gpgme/default.nix b/nixpkgs/pkgs/development/libraries/gpgme/default.nix
index 263807c2fc1d..75b13b6b7ef1 100644
--- a/nixpkgs/pkgs/development/libraries/gpgme/default.nix
+++ b/nixpkgs/pkgs/development/libraries/gpgme/default.nix
@@ -1,28 +1,37 @@
-{ lib, stdenv, fetchurl, fetchpatch
-, autoreconfHook, libgpg-error, gnupg, pkg-config, glib, pth, libassuan
-, file, which, ncurses
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, autoreconfHook
+, libgpg-error
+, gnupg
+, pkg-config
+, glib
+, pth
+, libassuan
+, file
+, which
+, ncurses
 , texinfo
 , buildPackages
 , qtbase ? null
-, pythonSupport ? false, swig2 ? null, python ? null
+, pythonSupport ? false
+, swig2 ? null
+, python ? null
 }:
-
 let
   inherit (stdenv.hostPlatform) system;
 in
-
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    sha256 = "1l4yw9fqc1blvx1sq1jnfvp1jijla3ca2jw90p4x9m8hvfpc933c";
+    sha256 = "1xb9k88rrafdi0n95nzx0d6bz7hcn9b44hciqbigrqkvxc6gblsf";
   };
 
   patches = [
-    # probably included in > 1.16.0
-    ./test_t-edit-sign.diff
     # https://dev.gnupg.org/rMc4cf527ea227edb468a84bf9b8ce996807bd6992
     ./fix_gpg_list_keys.diff
     # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
@@ -31,22 +40,48 @@ stdenv.mkDerivation rec {
       url = "https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20200415/f7be62d1/attachment.obj";
       sha256 = "00d4sxq63601lzdp2ha1i8fvybh7dzih4531jh8bx07fab3sw65g";
     })
+    # Support Python 3.10 version detection without distutils, https://dev.gnupg.org/D545
+    ./python-310-detection-without-distutils.patch
+    # Find correct version string for Python >= 3.10, https://dev.gnupg.org/D546
+    ./python-find-version-string-above-310.patch
     # Disable python tests on Darwin as they use gpg (see configureFlags below)
   ] ++ lib.optional stdenv.isDarwin ./disable-python-tests.patch
-  # Fix _AC_UNDECLARED_WARNING for autoconf≥2.70. See https://lists.gnupg.org/pipermail/gnupg-devel/2020-November/034643.html
+  # Fix _AC_UNDECLARED_WARNING for autoconf>=2.70
+  # See https://lists.gnupg.org/pipermail/gnupg-devel/2020-November/034643.html
   ++ lib.optional stdenv.cc.isClang ./fix-clang-autoconf-undeclared-warning.patch;
 
   outputs = [ "out" "dev" "info" ];
+
   outputBin = "dev"; # gpgme-config; not so sure about gpgme-tool
 
-  propagatedBuildInputs =
-    [ libgpg-error glib libassuan pth ]
-    ++ lib.optional (qtbase != null) qtbase;
+  nativeBuildInputs = [
+    autoreconfHook
+    gnupg
+    pkg-config
+    texinfo
+  ] ++ lib.optionals pythonSupport [
+    ncurses
+    python
+    swig2
+    which
+  ];
 
-  nativeBuildInputs = [ pkg-config gnupg texinfo autoreconfHook ]
-  ++ lib.optionals pythonSupport [ python swig2 which ncurses ];
+  propagatedBuildInputs = [
+    glib
+    libassuan
+    libgpg-error
+    pth
+  ] ++ lib.optionals (qtbase != null) [
+    qtbase
+  ];
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  checkInputs = [
+    which
+  ];
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
 
   dontWrapQtApps = true;
 
@@ -59,16 +94,15 @@ stdenv.mkDerivation rec {
   # which has a path length limit. Nix on darwin is using a build directory
   # that already has quite a long path and the resulting socket path doesn't
   # fit in the limit. https://github.com/NixOS/nix/pull/1085
-    ++ lib.optionals stdenv.isDarwin [ "--disable-gpg-test" ];
+  ++ lib.optionals stdenv.isDarwin [ "--disable-gpg-test" ];
 
   NIX_CFLAGS_COMPILE = toString (
     # qgpgme uses Q_ASSERT which retains build inputs at runtime unless
     # debugging is disabled
     lib.optional (qtbase != null) "-DQT_NO_DEBUG"
     # https://www.gnupg.org/documentation/manuals/gpgme/Largefile-Support-_0028LFS_0029.html
-    ++ lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64");
-
-  checkInputs = [ which ];
+    ++ lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64"
+  );
 
   doCheck = true;
 
diff --git a/nixpkgs/pkgs/development/libraries/gpgme/python-310-detection-without-distutils.patch b/nixpkgs/pkgs/development/libraries/gpgme/python-310-detection-without-distutils.patch
new file mode 100644
index 000000000000..e0eea9ff0429
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/gpgme/python-310-detection-without-distutils.patch
@@ -0,0 +1,273 @@
+diff --git a/m4/ax_python_devel.m4 b/m4/ax_python_devel.m4
+--- a/m4/ax_python_devel.m4
++++ b/m4/ax_python_devel.m4
+@@ -1,5 +1,5 @@
+ # ===========================================================================
+-#      https://www.gnu.org/software/autoconf-archive/ax_python_devel.html
++#     https://www.gnu.org/software/autoconf-archive/ax_python_devel.html
+ # ===========================================================================
+ #
+ # SYNOPSIS
+@@ -12,8 +12,8 @@
+ #   in your configure.ac.
+ #
+ #   This macro checks for Python and tries to get the include path to
+-#   'Python.h'. It provides the $(PYTHON_CPPFLAGS) and $(PYTHON_LDFLAGS)
+-#   output variables. It also exports $(PYTHON_EXTRA_LIBS) and
++#   'Python.h'. It provides the $(PYTHON_CPPFLAGS) and $(PYTHON_LIBS) output
++#   variables. It also exports $(PYTHON_EXTRA_LIBS) and
+ #   $(PYTHON_EXTRA_LDFLAGS) for embedding Python in your code.
+ #
+ #   You can search for some particular version of Python by passing a
+@@ -67,7 +67,7 @@
+ #   modified version of the Autoconf Macro, you may extend this special
+ #   exception to the GPL to apply to your modified version as well.
+ 
+-#serial 17
++#serial 23
+ 
+ AU_ALIAS([AC_PYTHON_DEVEL], [AX_PYTHON_DEVEL])
+ AC_DEFUN([AX_PYTHON_DEVEL],[
+@@ -99,7 +99,7 @@
+ This version of the AC@&t@_PYTHON_DEVEL macro
+ doesn't work properly with versions of Python before
+ 2.1.0. You may need to re-run configure, setting the
+-variables PYTHON_CPPFLAGS, PYTHON_LDFLAGS, PYTHON_SITE_PKG,
++variables PYTHON_CPPFLAGS, PYTHON_LIBS, PYTHON_SITE_PKG,
+ PYTHON_EXTRA_LIBS and PYTHON_EXTRA_LDFLAGS by hand.
+ Moreover, to disable this check, set PYTHON_NOVERSIONCHECK
+ to something else than an empty string.
+@@ -135,16 +135,25 @@
+ 	#
+ 	# Check if you have distutils, else fail
+ 	#
+-	AC_MSG_CHECKING([for the distutils Python package])
+-	ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`
+-	if test -z "$ac_distutils_result"; then
++	AC_MSG_CHECKING([for the sysconfig Python package])
++	ac_sysconfig_result=`$PYTHON -c "import sysconfig" 2>&1`
++	if test $? -eq 0; then
+ 		AC_MSG_RESULT([yes])
++		IMPORT_SYSCONFIG="import sysconfig"
+ 	else
+ 		AC_MSG_RESULT([no])
+-		AC_MSG_ERROR([cannot import Python module "distutils".
++
++		AC_MSG_CHECKING([for the distutils Python package])
++		ac_sysconfig_result=`$PYTHON -c "from distutils import sysconfig" 2>&1`
++		if test $? -eq 0; then
++			AC_MSG_RESULT([yes])
++			IMPORT_SYSCONFIG="from distutils import sysconfig"
++		else
++			AC_MSG_ERROR([cannot import Python module "distutils".
+ Please check your Python installation. The error was:
+-$ac_distutils_result])
+-		PYTHON_VERSION=""
++$ac_sysconfig_result])
++			PYTHON_VERSION=""
++		fi
+ 	fi
+ 
+ 	#
+@@ -152,10 +161,19 @@
+ 	#
+ 	AC_MSG_CHECKING([for Python include path])
+ 	if test -z "$PYTHON_CPPFLAGS"; then
+-		python_path=`$PYTHON -c "import distutils.sysconfig; \
+-			print (distutils.sysconfig.get_python_inc ());"`
+-		plat_python_path=`$PYTHON -c "import distutils.sysconfig; \
+-			print (distutils.sysconfig.get_python_inc (plat_specific=1));"`
++		if test "$IMPORT_SYSCONFIG" = "import sysconfig"; then
++			# sysconfig module has different functions
++			python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_path ('include'));"`
++			plat_python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_path ('platinclude'));"`
++		else
++			# old distutils way
++			python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_python_inc ());"`
++			plat_python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_python_inc (plat_specific=1));"`
++		fi
+ 		if test -n "${python_path}"; then
+ 			if test "${plat_python_path}" != "${python_path}"; then
+ 				python_path="-I$python_path -I$plat_python_path"
+@@ -172,14 +190,14 @@
+ 	# Check for Python library path
+ 	#
+ 	AC_MSG_CHECKING([for Python library path])
+-	if test -z "$PYTHON_LDFLAGS"; then
++	if test -z "$PYTHON_LIBS"; then
+ 		# (makes two attempts to ensure we've got a version number
+ 		# from the interpreter)
+ 		ac_python_version=`cat<<EOD | $PYTHON -
+ 
+ # join all versioning strings, on some systems
+ # major/minor numbers could be in different list elements
+-from distutils.sysconfig import *
++from sysconfig import *
+ e = get_config_var('VERSION')
+ if e is not None:
+ 	print(e)
+@@ -197,7 +215,7 @@
+ 		# Make the versioning information available to the compiler
+ 
+ 		# JW: We don't need it and it interferes with the hack
+-		# to detect multiple Pyhton versions
++		# to detect multiple Python versions
+ 		#AC_DEFINE_UNQUOTED([HAVE_PYTHON], ["$ac_python_version"],
+                 #                  [If available, contains the Python version number currently in use.])
+ 
+@@ -205,8 +223,8 @@
+ 		ac_python_libdir=`cat<<EOD | $PYTHON -
+ 
+ # There should be only one
+-import distutils.sysconfig
+-e = distutils.sysconfig.get_config_var('LIBDIR')
++$IMPORT_SYSCONFIG
++e = sysconfig.get_config_var('LIBDIR')
+ if e is not None:
+ 	print (e)
+ EOD`
+@@ -214,8 +232,8 @@
+ 		# Now, for the library:
+ 		ac_python_library=`cat<<EOD | $PYTHON -
+ 
+-import distutils.sysconfig
+-c = distutils.sysconfig.get_config_vars()
++$IMPORT_SYSCONFIG
++c = sysconfig.get_config_vars()
+ if 'LDVERSION' in c:
+ 	print ('python'+c[['LDVERSION']])
+ else:
+@@ -230,44 +248,67 @@
+ 		then
+ 			# use the official shared library
+ 			ac_python_library=`echo "$ac_python_library" | sed "s/^lib//"`
+-			PYTHON_LDFLAGS="-L$ac_python_libdir -l$ac_python_library"
++			PYTHON_LIBS="-L$ac_python_libdir -l$ac_python_library"
+ 		else
+ 			# old way: use libpython from python_configdir
+ 			ac_python_libdir=`$PYTHON -c \
+-			  "from distutils.sysconfig import get_python_lib as f; \
++			  "from sysconfig import get_python_lib as f; \
+ 			  import os; \
+ 			  print (os.path.join(f(plat_specific=1, standard_lib=1), 'config'));"`
+-			PYTHON_LDFLAGS="-L$ac_python_libdir -lpython$ac_python_version"
++			PYTHON_LIBS="-L$ac_python_libdir -lpython$ac_python_version"
+ 		fi
+ 
+-		if test -z "PYTHON_LDFLAGS"; then
++		if test -z "PYTHON_LIBS"; then
+ 			AC_MSG_ERROR([
+   Cannot determine location of your Python DSO. Please check it was installed with
+-  dynamic libraries enabled, or try setting PYTHON_LDFLAGS by hand.
++  dynamic libraries enabled, or try setting PYTHON_LIBS by hand.
+ 			])
+ 		fi
+ 	fi
+-	AC_MSG_RESULT([$PYTHON_LDFLAGS])
+-	AC_SUBST([PYTHON_LDFLAGS])
++	AC_MSG_RESULT([$PYTHON_LIBS])
++	AC_SUBST([PYTHON_LIBS])
+ 
+ 	#
+ 	# Check for site packages
+ 	#
+ 	AC_MSG_CHECKING([for Python site-packages path])
+ 	if test -z "$PYTHON_SITE_PKG"; then
+-		PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
+-			print (distutils.sysconfig.get_python_lib(0,0));"`
++		if test "$IMPORT_SYSCONFIG" = "import sysconfig"; then
++			PYTHON_SITE_PKG=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_path('purelib'));"`
++		else
++			# distutils.sysconfig way
++			PYTHON_SITE_PKG=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_python_lib(0,0));"`
++		fi
+ 	fi
+ 	AC_MSG_RESULT([$PYTHON_SITE_PKG])
+ 	AC_SUBST([PYTHON_SITE_PKG])
+ 
++	#
++	# Check for platform-specific site packages
++	#
++	AC_MSG_CHECKING([for Python platform specific site-packages path])
++	if test -z "$PYTHON_SITE_PKG"; then
++		if test "$IMPORT_SYSCONFIG" = "import sysconfig"; then
++			PYTHON_PLATFORM_SITE_PKG=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_path('platlib'));"`
++		else
++			# distutils.sysconfig way
++			PYTHON_PLATFORM_SITE_PKG=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_python_lib(1,0));"`
++		fi
++	fi
++	AC_MSG_RESULT([$PYTHON_PLATFORM_SITE_PKG])
++	AC_SUBST([PYTHON_PLATFORM_SITE_PKG])
++
+ 	#
+ 	# libraries which must be linked in when embedding
+ 	#
+ 	AC_MSG_CHECKING(python extra libraries)
+ 	if test -z "$PYTHON_EXTRA_LIBS"; then
+-	   PYTHON_EXTRA_LIBS=`$PYTHON -c "import distutils.sysconfig; \
+-                conf = distutils.sysconfig.get_config_var; \
++	   PYTHON_EXTRA_LIBS=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++                conf = sysconfig.get_config_var; \
+                 print (conf('LIBS') + ' ' + conf('SYSLIBS'))"`
+ 	fi
+ 	AC_MSG_RESULT([$PYTHON_EXTRA_LIBS])
+@@ -278,8 +319,8 @@
+ 	#
+ 	AC_MSG_CHECKING(python extra linking flags)
+ 	if test -z "$PYTHON_EXTRA_LDFLAGS"; then
+-		PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import distutils.sysconfig; \
+-			conf = distutils.sysconfig.get_config_var; \
++		PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++			conf = sysconfig.get_config_var; \
+ 			print (conf('LINKFORSHARED'))"`
+ 	fi
+ 	AC_MSG_RESULT([$PYTHON_EXTRA_LDFLAGS])
+@@ -291,8 +332,10 @@
+ 	AC_MSG_CHECKING([consistency of all components of python development environment])
+ 	# save current global flags
+ 	ac_save_LIBS="$LIBS"
++	ac_save_LDFLAGS="$LDFLAGS"
+ 	ac_save_CPPFLAGS="$CPPFLAGS"
+-	LIBS="$ac_save_LIBS $PYTHON_LDFLAGS $PYTHON_EXTRA_LDFLAGS $PYTHON_EXTRA_LIBS"
++	LIBS="$ac_save_LIBS $PYTHON_LIBS $PYTHON_EXTRA_LIBS $PYTHON_EXTRA_LIBS"
++	LDFLAGS="$ac_save_LDFLAGS $PYTHON_EXTRA_LDFLAGS"
+ 	CPPFLAGS="$ac_save_CPPFLAGS $PYTHON_CPPFLAGS"
+ 	AC_LANG_PUSH([C])
+ 	AC_LINK_IFELSE([
+@@ -303,15 +346,17 @@
+ 	# turn back to default flags
+ 	CPPFLAGS="$ac_save_CPPFLAGS"
+ 	LIBS="$ac_save_LIBS"
++	LDFLAGS="$ac_save_LDFLAGS"
+ 
+ 	AC_MSG_RESULT([$pythonexists])
+ 
+         if test ! "x$pythonexists" = "xyes"; then
++        # gpgme: only warn here, no error, as we are looking for multiple versions
+ 	   AC_MSG_WARN([
+   Could not link test program to Python. Maybe the main Python library has been
+   installed in some non-standard library path. If so, pass it to configure,
+-  via the LDFLAGS environment variable.
+-  Example: ./configure LDFLAGS="-L/usr/non-standard-path/python/lib"
++  via the LIBS environment variable.
++  Example: ./configure LIBS="-L/usr/non-standard-path/python/lib"
+   ============================================================================
+    You probably have to install the development version of the Python package
+    for your distribution.  The exact name of this package varies among them.
+@@ -323,4 +368,4 @@
+ 	#
+ 	# all done!
+ 	#
+-])
++])
+\ No newline at end of file
+
diff --git a/nixpkgs/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch b/nixpkgs/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch
new file mode 100644
index 000000000000..3d8191c99295
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch
@@ -0,0 +1,373 @@
+diff --git a/configure.ac b/configure.ac
+--- a/configure.ac
++++ b/configure.ac
+@@ -425,11 +425,12 @@
+ 	if test "$found_py" = "1" -o "$found_py3" = "1"; then
+ 	  # Reset everything, so that we can look for another Python.
+           m4_foreach([mym4pythonver],
+-                     [[2.7],[3.4],[3.5],[3.6],[3.7],[3.8],[3.9],[all]],
++                     [[2.7],[3.4],[3.5],[3.6],[3.7],[3.8],[3.9],[3.10],[all]],
+            [unset PYTHON
+ 	    unset PYTHON_VERSION
+ 	    unset PYTHON_CPPFLAGS
+ 	    unset PYTHON_LDFLAGS
++	    unset PYTHON_LIBS
+ 	    unset PYTHON_SITE_PKG
+ 	    unset PYTHON_EXTRA_LIBS
+ 	    unset PYTHON_EXTRA_LDFLAGS
+diff --git a/m4/python.m4 b/m4/python.m4
+--- a/m4/python.m4
++++ b/m4/python.m4
+@@ -1,10 +1,10 @@
+ ## ------------------------                                 -*- Autoconf -*-
+ ## Python file handling
+ ## From Andrew Dalke
+-## Updated by James Henstridge
++## Updated by James Henstridge and other contributors.
+ ## Updated by Werner Koch 2018-10-17
+-## ---------------------------------
+-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
++## ------------------------
++# Copyright (C) 1999-2021 Free Software Foundation, Inc.
+ #
+ # This file is free software; the Free Software Foundation
+ # gives unlimited permission to copy and/or distribute it,
+@@ -36,13 +36,12 @@
+ # numbers and dots only.
+ AC_DEFUN([AM_PATH_PYTHON],
+  [
+-  dnl Find a Python interpreter.  Python versions prior to 2.0 are not
+-  dnl supported. (2.0 was released on October 16, 2000).  Python 3.0
+-  dnl through to Python 3.9 are also not supported.
++  dnl Find a Python interpreter.  Python versions prior to 2.7 are not
++  dnl supported. Python 3.0 through to Python 3.3 are also not supported.
+   m4_define_default([_AM_PYTHON_INTERPRETER_LIST],
+ [python2 python2.7 dnl
+  python dnl
+- python3 python3.9 python3.8 python3.7 python3.6 python3.5 python3.4
++ python3 python3.10 python3.9 python3.8 python3.7 python3.6 python3.5 python3.4
+  ])
+ 
+   AC_ARG_VAR([PYTHON], [the Python interpreter])
+@@ -85,34 +84,141 @@
+   ])
+ 
+   if test "$PYTHON" = :; then
+-  dnl Run any user-specified action, or abort.
++    dnl Run any user-specified action, or abort.
+     m4_default([$3], [AC_MSG_ERROR([no suitable Python interpreter found])])
+   else
+ 
+-  dnl Query Python for its version number.  Getting [:3] seems to be
+-  dnl the best way to do this; it's what "site.py" does in the standard
+-  dnl library.
+-
++  dnl Query Python for its version number.  Although site.py simply uses
++  dnl sys.version[:3], printing that failed with Python 3.10, since the
++  dnl trailing zero was eliminated. So now we output just the major
++  dnl and minor version numbers, as numbers. Apparently the tertiary
++  dnl version is not of interest.
++  dnl
+   AC_CACHE_CHECK([for $am_display_PYTHON version], [am_cv_python_version],
+-    [am_cv_python_version=`$PYTHON -c "import sys; sys.stdout.write(sys.version[[:3]])"`])
++    [am_cv_python_version=`$PYTHON -c "import sys; print ('%u.%u' % sys.version_info[[:2]])"`])
+   AC_SUBST([PYTHON_VERSION], [$am_cv_python_version])
+ 
+-  dnl Use the values of $prefix and $exec_prefix for the corresponding
+-  dnl values of PYTHON_PREFIX and PYTHON_EXEC_PREFIX.  These are made
+-  dnl distinct variables so they can be overridden if need be.  However,
+-  dnl general consensus is that you shouldn't need this ability.
+-
+-  AC_SUBST([PYTHON_PREFIX], ['${prefix}'])
+-  AC_SUBST([PYTHON_EXEC_PREFIX], ['${exec_prefix}'])
+-
+-  dnl At times (like when building shared libraries) you may want
++  dnl At times, e.g., when building shared libraries, you may want
+   dnl to know which OS platform Python thinks this is.
+-
++  dnl
+   AC_CACHE_CHECK([for $am_display_PYTHON platform], [am_cv_python_platform],
+     [am_cv_python_platform=`$PYTHON -c "import sys; sys.stdout.write(sys.platform)"`])
+   AC_SUBST([PYTHON_PLATFORM], [$am_cv_python_platform])
+ 
+-  # Just factor out some code duplication.
++  dnl emacs-page
++  dnl If --with-python-sys-prefix is given, use the values of sys.prefix
++  dnl and sys.exec_prefix for the corresponding values of PYTHON_PREFIX
++  dnl and PYTHON_EXEC_PREFIX. Otherwise, use the GNU ${prefix} and
++  dnl ${exec_prefix} variables.
++  dnl
++  dnl The two are made distinct variables so they can be overridden if
++  dnl need be, although general consensus is that you shouldn't need
++  dnl this separation.
++  dnl
++  dnl Also allow directly setting the prefixes via configure options,
++  dnl overriding any default.
++  dnl
++  if test "x$prefix" = xNONE; then
++    am__usable_prefix=$ac_default_prefix
++  else
++    am__usable_prefix=$prefix
++  fi
++
++  # Allow user to request using sys.* values from Python,
++  # instead of the GNU $prefix values.
++  AC_ARG_WITH([python-sys-prefix],
++  [AS_HELP_STRING([--with-python-sys-prefix],
++                  [use Python's sys.prefix and sys.exec_prefix values])],
++  [am_use_python_sys=:],
++  [am_use_python_sys=false])
++
++  # Allow user to override whatever the default Python prefix is.
++  AC_ARG_WITH([python_prefix],
++  [AS_HELP_STRING([--with-python_prefix],
++                  [override the default PYTHON_PREFIX])],
++  [am_python_prefix_subst=$withval
++   am_cv_python_prefix=$withval
++   AC_MSG_CHECKING([for explicit $am_display_PYTHON prefix])
++   AC_MSG_RESULT([$am_cv_python_prefix])],
++  [
++   if $am_use_python_sys; then
++     # using python sys.prefix value, not GNU
++     AC_CACHE_CHECK([for python default $am_display_PYTHON prefix],
++     [am_cv_python_prefix],
++     [am_cv_python_prefix=`$PYTHON -c "import sys; sys.stdout.write(sys.prefix)"`])
++
++     dnl If sys.prefix is a subdir of $prefix, replace the literal value of
++     dnl $prefix with a variable reference so it can be overridden.
++     case $am_cv_python_prefix in
++     $am__usable_prefix*)
++       am__strip_prefix=`echo "$am__usable_prefix" | sed 's|.|.|g'`
++       am_python_prefix_subst=`echo "$am_cv_python_prefix" | sed "s,^$am__strip_prefix,\\${prefix},"`
++       ;;
++     *)
++       am_python_prefix_subst=$am_cv_python_prefix
++       ;;
++     esac
++   else # using GNU prefix value, not python sys.prefix
++     am_python_prefix_subst='${prefix}'
++     am_python_prefix=$am_python_prefix_subst
++     AC_MSG_CHECKING([for GNU default $am_display_PYTHON prefix])
++     AC_MSG_RESULT([$am_python_prefix])
++   fi])
++  # Substituting python_prefix_subst value.
++  AC_SUBST([PYTHON_PREFIX], [$am_python_prefix_subst])
++
++  # emacs-page Now do it all over again for Python exec_prefix, but with yet
++  # another conditional: fall back to regular prefix if that was specified.
++  AC_ARG_WITH([python_exec_prefix],
++  [AS_HELP_STRING([--with-python_exec_prefix],
++                  [override the default PYTHON_EXEC_PREFIX])],
++  [am_python_exec_prefix_subst=$withval
++   am_cv_python_exec_prefix=$withval
++   AC_MSG_CHECKING([for explicit $am_display_PYTHON exec_prefix])
++   AC_MSG_RESULT([$am_cv_python_exec_prefix])],
++  [
++   # no explicit --with-python_exec_prefix, but if
++   # --with-python_prefix was given, use its value for python_exec_prefix too.
++   AS_IF([test -n "$with_python_prefix"],
++   [am_python_exec_prefix_subst=$with_python_prefix
++    am_cv_python_exec_prefix=$with_python_prefix
++    AC_MSG_CHECKING([for python_prefix-given $am_display_PYTHON exec_prefix])
++    AC_MSG_RESULT([$am_cv_python_exec_prefix])],
++   [
++    # Set am__usable_exec_prefix whether using GNU or Python values,
++    # since we use that variable for pyexecdir.
++    if test "x$exec_prefix" = xNONE; then
++      am__usable_exec_prefix=$am__usable_prefix
++    else
++      am__usable_exec_prefix=$exec_prefix
++    fi
++    #
++    if $am_use_python_sys; then # using python sys.exec_prefix, not GNU
++      AC_CACHE_CHECK([for python default $am_display_PYTHON exec_prefix],
++      [am_cv_python_exec_prefix],
++      [am_cv_python_exec_prefix=`$PYTHON -c "import sys; sys.stdout.write(sys.exec_prefix)"`])
++      dnl If sys.exec_prefix is a subdir of $exec_prefix, replace the
++      dnl literal value of $exec_prefix with a variable reference so it can
++      dnl be overridden.
++      case $am_cv_python_exec_prefix in
++      $am__usable_exec_prefix*)
++        am__strip_prefix=`echo "$am__usable_exec_prefix" | sed 's|.|.|g'`
++        am_python_exec_prefix_subst=`echo "$am_cv_python_exec_prefix" | sed "s,^$am__strip_prefix,\\${exec_prefix},"`
++        ;;
++      *)
++        am_python_exec_prefix_subst=$am_cv_python_exec_prefix
++        ;;
++     esac
++   else # using GNU $exec_prefix, not python sys.exec_prefix
++     am_python_exec_prefix_subst='${exec_prefix}'
++     am_python_exec_prefix=$am_python_exec_prefix_subst
++     AC_MSG_CHECKING([for GNU default $am_display_PYTHON exec_prefix])
++     AC_MSG_RESULT([$am_python_exec_prefix])
++   fi])])
++  # Substituting python_exec_prefix_subst.
++  AC_SUBST([PYTHON_EXEC_PREFIX], [$am_python_exec_prefix_subst])
++
++  # Factor out some code duplication into this shell variable.
+   am_python_setup_sysconfig="\
+ import sys
+ # Prefer sysconfig over distutils.sysconfig, for better compatibility
+@@ -132,96 +238,95 @@
+ except ImportError:
+     pass"
+ 
+-  dnl Set up 4 directories:
++  dnl emacs-page Set up 4 directories:
+ 
+-  dnl pythondir -- where to install python scripts.  This is the
+-  dnl   site-packages directory, not the python standard library
+-  dnl   directory like in previous automake betas.  This behavior
+-  dnl   is more consistent with lispdir.m4 for example.
++  dnl 1. pythondir: where to install python scripts.  This is the
++  dnl    site-packages directory, not the python standard library
++  dnl    directory like in previous automake betas.  This behavior
++  dnl    is more consistent with lispdir.m4 for example.
+   dnl Query distutils for this directory.
+-  AC_CACHE_CHECK([for $am_display_PYTHON script directory],
+-    [am_cv_python_pythondir],
+-    [if test "x$prefix" = xNONE
+-     then
+-       am_py_prefix=$ac_default_prefix
+-     else
+-       am_py_prefix=$prefix
+-     fi
+-     am_cv_python_pythondir=`$PYTHON -c "
++  dnl
++  AC_CACHE_CHECK([for $am_display_PYTHON script directory (pythondir)],
++  [am_cv_python_pythondir],
++  [if test "x$am_cv_python_prefix" = x; then
++     am_py_prefix=$am__usable_prefix
++   else
++     am_py_prefix=$am_cv_python_prefix
++   fi
++   am_cv_python_pythondir=`$PYTHON -c "
+ $am_python_setup_sysconfig
+ if can_use_sysconfig:
+-    sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'})
++  sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'})
+ else:
+-    from distutils import sysconfig
+-    sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix')
++  from distutils import sysconfig
++  sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix')
+ sys.stdout.write(sitedir)"`
+-     case $am_cv_python_pythondir in
+-     $am_py_prefix*)
+-       am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'`
+-       am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,$PYTHON_PREFIX,"`
+-       ;;
+-     *)
+-       case $am_py_prefix in
+-         /usr|/System*) ;;
+-         *)
+-	  am_cv_python_pythondir=$PYTHON_PREFIX/lib/python$PYTHON_VERSION/site-packages
+-	  ;;
+-       esac
+-       ;;
++   #
++   case $am_cv_python_pythondir in
++   $am_py_prefix*)
++     am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'`
++     am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,\\${PYTHON_PREFIX},"`
++     ;;
++   *)
++     case $am_py_prefix in
++       /usr|/System*) ;;
++       *) am_cv_python_pythondir="\${PYTHON_PREFIX}/lib/python$PYTHON_VERSION/site-packages"
++          ;;
+      esac
+-    ])
++     ;;
++   esac
++  ])
+   AC_SUBST([pythondir], [$am_cv_python_pythondir])
+ 
+-  dnl pkgpythondir -- $PACKAGE directory under pythondir.  Was
+-  dnl   PYTHON_SITE_PACKAGE in previous betas, but this naming is
+-  dnl   more consistent with the rest of automake.
+-
++  dnl 2. pkgpythondir: $PACKAGE directory under pythondir.  Was
++  dnl    PYTHON_SITE_PACKAGE in previous betas, but this naming is
++  dnl    more consistent with the rest of automake.
++  dnl
+   AC_SUBST([pkgpythondir], [\${pythondir}/$PACKAGE])
+ 
+-  dnl pyexecdir -- directory for installing python extension modules
+-  dnl   (shared libraries)
++  dnl 3. pyexecdir: directory for installing python extension modules
++  dnl    (shared libraries).
+   dnl Query distutils for this directory.
+-  AC_CACHE_CHECK([for $am_display_PYTHON extension module directory],
+-    [am_cv_python_pyexecdir],
+-    [if test "x$exec_prefix" = xNONE
+-     then
+-       am_py_exec_prefix=$am_py_prefix
+-     else
+-       am_py_exec_prefix=$exec_prefix
+-     fi
+-     am_cv_python_pyexecdir=`$PYTHON -c "
++  dnl
++  AC_CACHE_CHECK([for $am_display_PYTHON extension module directory (pyexecdir)],
++  [am_cv_python_pyexecdir],
++  [if test "x$am_cv_python_exec_prefix" = x; then
++     am_py_exec_prefix=$am__usable_exec_prefix
++   else
++     am_py_exec_prefix=$am_cv_python_exec_prefix
++   fi
++   am_cv_python_pyexecdir=`$PYTHON -c "
+ $am_python_setup_sysconfig
+ if can_use_sysconfig:
+-    sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_prefix'})
++  sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_exec_prefix'})
+ else:
+-    from distutils import sysconfig
+-    sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_prefix')
++  from distutils import sysconfig
++  sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_exec_prefix')
+ sys.stdout.write(sitedir)"`
+-     case $am_cv_python_pyexecdir in
+-     $am_py_exec_prefix*)
+-       am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'`
+-       am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,$PYTHON_EXEC_PREFIX,"`
+-       ;;
+-     *)
+-       case $am_py_exec_prefix in
+-         /usr|/System*) ;;
+-         *)
+-	   am_cv_python_pyexecdir=$PYTHON_EXEC_PREFIX/lib/python$PYTHON_VERSION/site-packages
+-	   ;;
+-       esac
+-       ;;
++   #
++   case $am_cv_python_pyexecdir in
++   $am_py_exec_prefix*)
++     am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'`
++     am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,\\${PYTHON_EXEC_PREFIX},"`
++     ;;
++   *)
++     case $am_py_exec_prefix in
++       /usr|/System*) ;;
++       *) am_cv_python_pyexecdir="\${PYTHON_EXEC_PREFIX}/lib/python$PYTHON_VERSION/site-packages"
++          ;;
+      esac
+-    ])
++     ;;
++   esac
++  ])
+   AC_SUBST([pyexecdir], [$am_cv_python_pyexecdir])
+ 
+-  dnl pkgpyexecdir -- $(pyexecdir)/$(PACKAGE)
+-
++  dnl 4. pkgpyexecdir: $(pyexecdir)/$(PACKAGE)
++  dnl
+   AC_SUBST([pkgpyexecdir], [\${pyexecdir}/$PACKAGE])
+ 
+   dnl Run any user-specified action.
+   $2
+   fi
+-
+ ])
+ 
+ 
+
diff --git a/nixpkgs/pkgs/development/libraries/gpgme/test_t-edit-sign.diff b/nixpkgs/pkgs/development/libraries/gpgme/test_t-edit-sign.diff
deleted file mode 100644
index 55075b9eb126..000000000000
--- a/nixpkgs/pkgs/development/libraries/gpgme/test_t-edit-sign.diff
+++ /dev/null
@@ -1,125 +0,0 @@
-From 81a33ea5e1b86d586b956e893a5b25c4cd41c969 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
-Date: Sat, 26 Jun 2021 18:02:47 +0200
-Subject: [PATCH] core: Fix use-after-free issue in test
-
-* tests/gpg/t-edit-sign.c (sign_key, verify_key_signature): New.
-(main): Factored out signing and verifying the result.
---
-
-Factoring the two steps of the test into different functions fixes the
-use-after-free issue that was caused by accidentaly using a variable
-of the first step in the second step.
-
-GnuPG-bug-id: 5509
----
- tests/gpg/t-edit-sign.c | 54 ++++++++++++++++++++++++++++-------------
- 1 file changed, 37 insertions(+), 17 deletions(-)
-
-diff --git a/tests/gpg/t-edit-sign.c b/tests/gpg/t-edit-sign.c
-index 2f983622..e0494c54 100644
---- a/tests/gpg/t-edit-sign.c
-+++ b/tests/gpg/t-edit-sign.c
-@@ -107,31 +107,19 @@ interact_fnc (void *opaque, const char *status, const char *args, int fd)
- }
- 
- 
--int
--main (int argc, char **argv)
-+void
-+sign_key (const char *key_fpr, const char *signer_fpr)
- {
-   gpgme_ctx_t ctx;
-   gpgme_error_t err;
-   gpgme_data_t out = NULL;
--  const char *signer_fpr = "A0FF4590BB6122EDEF6E3C542D727CC768697734"; /* Alpha Test */
-   gpgme_key_t signing_key = NULL;
--  const char *key_fpr = "D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2"; /* Bravo Test */
-   gpgme_key_t key = NULL;
--  gpgme_key_t signed_key = NULL;
--  gpgme_user_id_t signed_uid = NULL;
--  gpgme_key_sig_t key_sig = NULL;
-   char *agent_info;
--  int mode;
--
--  (void)argc;
--  (void)argv;
--
--  init_gpgme (GPGME_PROTOCOL_OpenPGP);
- 
-   err = gpgme_new (&ctx);
-   fail_if_err (err);
- 
--  /* Sign the key */
-   agent_info = getenv("GPG_AGENT_INFO");
-   if (!(agent_info && strchr (agent_info, ':')))
-     gpgme_set_passphrase_cb (ctx, passphrase_cb, 0);
-@@ -159,8 +147,23 @@ main (int argc, char **argv)
-   gpgme_data_release (out);
-   gpgme_key_unref (key);
-   gpgme_key_unref (signing_key);
-+  gpgme_release (ctx);
-+}
-+
-+
-+void
-+verify_key_signature (const char *key_fpr, const char *signer_keyid)
-+{
-+  gpgme_ctx_t ctx;
-+  gpgme_error_t err;
-+  gpgme_key_t signed_key = NULL;
-+  gpgme_user_id_t signed_uid = NULL;
-+  gpgme_key_sig_t key_sig = NULL;
-+  int mode;
-+
-+  err = gpgme_new (&ctx);
-+  fail_if_err (err);
- 
--  /* Verify the key signature */
-   mode  = gpgme_get_keylist_mode (ctx);
-   mode |= GPGME_KEYLIST_MODE_SIGS;
-   err = gpgme_set_keylist_mode (ctx, mode);
-@@ -168,7 +171,7 @@ main (int argc, char **argv)
-   err = gpgme_get_key (ctx, key_fpr, &signed_key, 0);
-   fail_if_err (err);
- 
--  signed_uid = key->uids;
-+  signed_uid = signed_key->uids;
-   if (!signed_uid)
-     {
-       fprintf (stderr, "Signed key has no user IDs\n");
-@@ -180,7 +183,7 @@ main (int argc, char **argv)
-       exit (1);
-     }
-   key_sig = signed_uid->signatures->next;
--  if (strcmp ("2D727CC768697734", key_sig->keyid))
-+  if (strcmp (signer_keyid, key_sig->keyid))
-     {
-       fprintf (stderr, "Unexpected key ID in second user ID sig: %s\n",
-                 key_sig->keyid);
-@@ -196,6 +199,23 @@ main (int argc, char **argv)
- 
-   gpgme_key_unref (signed_key);
-   gpgme_release (ctx);
-+}
-+
-+
-+int
-+main (int argc, char **argv)
-+{
-+  const char *signer_fpr = "A0FF4590BB6122EDEF6E3C542D727CC768697734"; /* Alpha Test */
-+  const char *signer_keyid = signer_fpr + strlen(signer_fpr) - 16;
-+  const char *key_fpr = "D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2"; /* Bravo Test */
-+
-+  (void)argc;
-+  (void)argv;
-+
-+  init_gpgme (GPGME_PROTOCOL_OpenPGP);
-+
-+  sign_key (key_fpr, signer_fpr);
-+  verify_key_signature (key_fpr, signer_keyid);
- 
-   return 0;
- }
--- 
-2.32.0
diff --git a/nixpkgs/pkgs/development/libraries/harfbuzz/default.nix b/nixpkgs/pkgs/development/libraries/harfbuzz/default.nix
index 1e36f1e7f0f7..e47b18252e9e 100644
--- a/nixpkgs/pkgs/development/libraries/harfbuzz/default.nix
+++ b/nixpkgs/pkgs/development/libraries/harfbuzz/default.nix
@@ -24,7 +24,7 @@
 }:
 
 let
-  version = "3.2.0";
+  version = "3.3.2";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     owner = "harfbuzz";
     repo = "harfbuzz";
     rev = version;
-    sha256 = "sha256-iNYp/hyJTaaF6e09YpUL7ktBhq2wRN9zKiEH59WLbYU=";
+    sha256 = "sha256-UbYqV7Ch9ugTIwSsCpjnS8H7tcv4P3OVpFDFDZtQCk0=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/development/libraries/kde-frameworks/fetch.sh b/nixpkgs/pkgs/development/libraries/kde-frameworks/fetch.sh
index 50204bc0ec0e..cb4e4cc26298 100644
--- a/nixpkgs/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/nixpkgs/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.90/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.91/ -A '*.tar.xz' )
diff --git a/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch b/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch
index 07da70092dc6..1379707f02fe 100644
--- a/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch
+++ b/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch
@@ -13,18 +13,18 @@ diff --git a/src/client.cpp b/src/client.cpp
 index 44fbacd..6b5abf5 100644
 --- a/src/client.cpp
 +++ b/src/client.cpp
-@@ -378,11 +378,14 @@ int KDEsuClient::stopServer()
+@@ -384,11 +384,14 @@ int KDEsuClient::stopServer()
  
  static QString findDaemon()
  {
--    QString daemon = QFile::decodeName(KDE_INSTALL_FULL_LIBEXECDIR_KF5 "/kdesud");
+-    QString daemon = QFile::decodeName(KDE_INSTALL_FULL_LIBEXECDIR_KF "/kdesud");
 -    if (!QFile::exists(daemon)) { // if not in libexec, find it in PATH
 -        daemon = QStandardPaths::findExecutable(QStringLiteral("kdesud"));
 -        if (daemon.isEmpty()) {
 -            qCWarning(KSU_LOG) << "kdesud daemon not found.";
 +    QString daemon = QFile::decodeName("/run/wrappers/bin/kdesud");
 +    if (!QFile::exists(daemon)) { // if not in wrappers
-+        daemon = QFile::decodeName(KDE_INSTALL_FULL_LIBEXECDIR_KF5 "/kdesud");
++        daemon = QFile::decodeName(KDE_INSTALL_FULL_LIBEXECDIR_KF "/kdesud");
 +        if (!QFile::exists(daemon)) { // if not in libexec, find it in PATH
 +            daemon = QStandardPaths::findExecutable(QStringLiteral("kdesud"));
 +            if (daemon.isEmpty()) {
diff --git a/nixpkgs/pkgs/development/libraries/kde-frameworks/srcs.nix b/nixpkgs/pkgs/development/libraries/kde-frameworks/srcs.nix
index 1ffc5df68c36..2b3983a892c8 100644
--- a/nixpkgs/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/nixpkgs/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/attica-5.90.0.tar.xz";
-      sha256 = "0zs37qyh9biafk76ps2xfc41hbd1n4dq42qqqcvbqcrwfgqz2wlk";
-      name = "attica-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/attica-5.91.0.tar.xz";
+      sha256 = "0svvy7qflidwxns12y2lra54gg6lhglcddzmrw7ccvbdyqcy2pn0";
+      name = "attica-5.91.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/baloo-5.90.0.tar.xz";
-      sha256 = "1nnfys8dyiivd2if81qrgrmpprfni77an9l3wff0l5k85ac86i56";
-      name = "baloo-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/baloo-5.91.0.tar.xz";
+      sha256 = "1cqjbaiwqba707xaz9zsrdz9cms2mdrhv6jpwsq8q7f4g4rxcx3m";
+      name = "baloo-5.91.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/bluez-qt-5.90.0.tar.xz";
-      sha256 = "056i5ndrg5fqm1bx49a0plfhlladphha128wi766zdhcm6np11z3";
-      name = "bluez-qt-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/bluez-qt-5.91.0.tar.xz";
+      sha256 = "0p37jrmppwahh4vaq3wkw6xn0ms8dxcxpfd4glzjlnw426zrwnjr";
+      name = "bluez-qt-5.91.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/breeze-icons-5.90.0.tar.xz";
-      sha256 = "06dfh571rf8gp4gnnqn13xqgc1bpc4ycn6bmxf38x53fxxfl3fnn";
-      name = "breeze-icons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/breeze-icons-5.91.0.tar.xz";
+      sha256 = "0aj24gn48c17n9jzrj0az04ph4hpx7zf2rj4vgwl19iip69vfzf1";
+      name = "breeze-icons-5.91.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/extra-cmake-modules-5.90.0.tar.xz";
-      sha256 = "1c5wza7srib3mdkf29ygmyj5b6jq322s6h7k5hlljqm5xhy7q07k";
-      name = "extra-cmake-modules-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/extra-cmake-modules-5.91.0.tar.xz";
+      sha256 = "0k65rvxh926ya6qahzk2ns7g1fya1429648mlx7iipxa61g8h5wp";
+      name = "extra-cmake-modules-5.91.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/frameworkintegration-5.90.0.tar.xz";
-      sha256 = "1v7vlq2gk7j5b6gzbawgnpii7csh2zclp5v24qhx4qrmpfssylan";
-      name = "frameworkintegration-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/frameworkintegration-5.91.0.tar.xz";
+      sha256 = "1176ql8f96ap4gzjaj8vm4cr6f2rsx9z93gpc4hx4jcqjhxqrg3z";
+      name = "frameworkintegration-5.91.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kactivities-5.90.0.tar.xz";
-      sha256 = "0wf7nnf3bjz2iq2wqxnyay1100ks0zscsh7sa8xfcijrl7pp305w";
-      name = "kactivities-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kactivities-5.91.0.tar.xz";
+      sha256 = "03y4hx7jgrhac12ys8pm22h0f49kms8b71gck4xv577p3ywi3j60";
+      name = "kactivities-5.91.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kactivities-stats-5.90.0.tar.xz";
-      sha256 = "0qamy8xggjlnm8pkv6vxbaagcp1hg9vgi2ws2yb9xpqk8mdlfbvp";
-      name = "kactivities-stats-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kactivities-stats-5.91.0.tar.xz";
+      sha256 = "0864qfljh20723djfzdv8h6nipw01825lhiknyqz17aj2x2ymzcq";
+      name = "kactivities-stats-5.91.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kapidox-5.90.0.tar.xz";
-      sha256 = "16jl519sx7pirjp5x57x5gbgv477457063rrbwpvyf2ldb6lc29p";
-      name = "kapidox-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kapidox-5.91.0.tar.xz";
+      sha256 = "1xxpl8rn49d2cr7ld94j3wsg21019l2kq14p5bvilisnj3salka3";
+      name = "kapidox-5.91.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/karchive-5.90.0.tar.xz";
-      sha256 = "0411rpgr9dy0zf9mmhj7n7ax0afrn7zvkpzpnjvpvvqsrfkz7qm6";
-      name = "karchive-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/karchive-5.91.0.tar.xz";
+      sha256 = "1kjc47zzdd9jhcmynq6zw6y6zaj2c1i8pxvszx3d9x5asaz2qq53";
+      name = "karchive-5.91.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kauth-5.90.0.tar.xz";
-      sha256 = "1g4i1prspcczpx25wvd8lgdk8c3my7kp3wv489gvcci40rl5z913";
-      name = "kauth-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kauth-5.91.0.tar.xz";
+      sha256 = "001svdyvs8qc6h8zkb9x072npkz6xabz6j0djjb380gl9h9wnrgq";
+      name = "kauth-5.91.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kbookmarks-5.90.0.tar.xz";
-      sha256 = "1svc1i9zxbxf65crfhnv6sz5gknb7x87lzjd8cn11y5lwnsw36kx";
-      name = "kbookmarks-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kbookmarks-5.91.0.tar.xz";
+      sha256 = "0iqfngsvpbgxk6h8l68idcp97df28sa2zwj707zs0mf2bl9k68m4";
+      name = "kbookmarks-5.91.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcalendarcore-5.90.0.tar.xz";
-      sha256 = "0qbds2ysjv9rqwpvrhisvdd6wyhq5qwhbw5xcbj7ndxwpf8lpa8w";
-      name = "kcalendarcore-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcalendarcore-5.91.0.tar.xz";
+      sha256 = "0gkn0mzk3za86pjrpi8gd9d71bfv0ihzkgn8yy1ik3dw1rf9gxip";
+      name = "kcalendarcore-5.91.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcmutils-5.90.0.tar.xz";
-      sha256 = "04crq3j48xwlvp047p3waqrv1gg5sv1950jh02w85q00yjjh0qxk";
-      name = "kcmutils-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcmutils-5.91.0.tar.xz";
+      sha256 = "009r9r7fz1588g2cnqw585d2fz170x8j8bip1zqr7i4jl21ms68s";
+      name = "kcmutils-5.91.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcodecs-5.90.0.tar.xz";
-      sha256 = "0kwqyhjs63pqslqcmv3sngyqvl6ah8iaa6nn045sb8a58xb09inh";
-      name = "kcodecs-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcodecs-5.91.0.tar.xz";
+      sha256 = "0qkwvbp4vp3w57f3fyjknxd66qac77hl77mf042c7jxjl5vq7h1y";
+      name = "kcodecs-5.91.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcompletion-5.90.0.tar.xz";
-      sha256 = "0hd3nsixibw5z846mpib2lap3ar65rqvasifdnlmqsrvxfmw0ggk";
-      name = "kcompletion-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcompletion-5.91.0.tar.xz";
+      sha256 = "1l6z85a4rh3vrf4x5g3pqvp0q36gwmw0fbp9ny1iaqyy21dlh8i4";
+      name = "kcompletion-5.91.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kconfig-5.90.0.tar.xz";
-      sha256 = "0yqs3ydxzhhb7rrl01swjc9xw8j1bs3n204bf9slb2bs7lfz56rn";
-      name = "kconfig-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kconfig-5.91.0.tar.xz";
+      sha256 = "0axdnqipa8xgx864zylxllnzchlp50q59bbfw3c98svvvkm3yg56";
+      name = "kconfig-5.91.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kconfigwidgets-5.90.0.tar.xz";
-      sha256 = "1sm1x64x2v3xfcz9ia6qk8d8y1q02fggrc2q0yy5ag5xh1yr9zwq";
-      name = "kconfigwidgets-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kconfigwidgets-5.91.0.tar.xz";
+      sha256 = "01mvv01hv64wadjh8xk3hhp1vbs04cvbrjpfl1g9cv2sa6hr7102";
+      name = "kconfigwidgets-5.91.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcontacts-5.90.0.tar.xz";
-      sha256 = "0vv2136da5a6lwdj2x38jx2qwrk96hgn8iwaad4yynvc2csx6dim";
-      name = "kcontacts-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcontacts-5.91.0.tar.xz";
+      sha256 = "1c839c9rvys3jwmi3fzw06r1nhgvrb4z8sdh8gda0w03vqh7h1hv";
+      name = "kcontacts-5.91.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcoreaddons-5.90.0.tar.xz";
-      sha256 = "02m4h4r0kdy94zq8c6d2fhnd8qwrp4a0v5i4wf6khk4yf4fqy5kf";
-      name = "kcoreaddons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcoreaddons-5.91.0.tar.xz";
+      sha256 = "16vimllvcs6rnb1ccbv9zg8hxbzacisgrlffyvwm608f4q1xmqyz";
+      name = "kcoreaddons-5.91.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcrash-5.90.0.tar.xz";
-      sha256 = "0634jqzbvr8xkv53n2q3fcqlkcmq843w7g455v3swnlaqi92l04f";
-      name = "kcrash-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcrash-5.91.0.tar.xz";
+      sha256 = "0gdknmp5a36ipvzms4jhxywyxpjh0vy26861c54jfsk13yircjal";
+      name = "kcrash-5.91.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdav-5.90.0.tar.xz";
-      sha256 = "0181ray8vigmwlamx4j5dinw10al0g4l965kyx4wjq9k59nxxgbi";
-      name = "kdav-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdav-5.91.0.tar.xz";
+      sha256 = "026w3bk2lmc7lqzra8w9jq8i2l1hvqsxz36r1jzj9p01skhdm32v";
+      name = "kdav-5.91.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdbusaddons-5.90.0.tar.xz";
-      sha256 = "0g609bymfixwaic30y7i0q96anf7pi3galipmjbbfg85ghj9rsa4";
-      name = "kdbusaddons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdbusaddons-5.91.0.tar.xz";
+      sha256 = "18qhpj0s4abypkb8ix2d84wv1kqv6qxyblninn2f9hjkl2dnlwis";
+      name = "kdbusaddons-5.91.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdeclarative-5.90.0.tar.xz";
-      sha256 = "1z7zyj6pw2ym3izi19kpgy12mqpar6mbdbsn6jpxy36l6m3jld1y";
-      name = "kdeclarative-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdeclarative-5.91.0.tar.xz";
+      sha256 = "183df5c0xyjqsip0izqvvk4wy2bjb973900s1wqsldhhvc7gpf7z";
+      name = "kdeclarative-5.91.0.tar.xz";
     };
   };
   kded = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kded-5.90.0.tar.xz";
-      sha256 = "094g6p87nd5cxcars71315w6zrxjgiw2080p6cf6g72ww54k7sps";
-      name = "kded-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kded-5.91.0.tar.xz";
+      sha256 = "1zi0sixlzaxvw4lfil2r36i3xrav3vfwxp2r1lp4n65dpl7nv7p5";
+      name = "kded-5.91.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kdelibs4support-5.90.0.tar.xz";
-      sha256 = "0zxc11jbg06qz79ljrd6wl36jp73hafcmbk29d0hcvxnkscg3k29";
-      name = "kdelibs4support-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kdelibs4support-5.91.0.tar.xz";
+      sha256 = "1373fi9vi7ki8frr0lsw6yp335i95v8yq2j41s7ip003dpy4hr2g";
+      name = "kdelibs4support-5.91.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kdesignerplugin-5.90.0.tar.xz";
-      sha256 = "18gsy8f32hjadzjnavi3dsknc6hflcnfpr0107lwfc735fd2x2iq";
-      name = "kdesignerplugin-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kdesignerplugin-5.91.0.tar.xz";
+      sha256 = "07lvvryc3k418hd0j7ddlqhid26c51isa8mvk7g6gd0v2x3gp76q";
+      name = "kdesignerplugin-5.91.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdesu-5.90.0.tar.xz";
-      sha256 = "1q8k2q7c41fzw9gwx9nq4zjpjdwvh29zyh3zd0w3r2kxf6vhf1wp";
-      name = "kdesu-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdesu-5.91.0.tar.xz";
+      sha256 = "1wj099w810dabqn43pqis4sism3zwq3d1qa9mvcdyjafqbl7xnjm";
+      name = "kdesu-5.91.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kdewebkit-5.90.0.tar.xz";
-      sha256 = "19dqlxy2sl822aldqy1jj7fvxabmg97a0av7d5ayzhnbhhy5izx1";
-      name = "kdewebkit-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kdewebkit-5.91.0.tar.xz";
+      sha256 = "1mln0w1dzrbpm373vfpcyss4xxnrfgwh9nhzr8wmzs8965bn3wqq";
+      name = "kdewebkit-5.91.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdnssd-5.90.0.tar.xz";
-      sha256 = "17szlqsafz6p4h7s9wascaggn5909c1ig452wy6y4z4402s2lsrr";
-      name = "kdnssd-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdnssd-5.91.0.tar.xz";
+      sha256 = "1smzwh7lvz8g7vydxnd2kkh0ymg7yp6akc7k2vg8q65pa6pxqn3g";
+      name = "kdnssd-5.91.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdoctools-5.90.0.tar.xz";
-      sha256 = "1l2a9mlcm8np3s8myq0hj08l82284r90yhx3z2gn7h68b8fzyx0s";
-      name = "kdoctools-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdoctools-5.91.0.tar.xz";
+      sha256 = "02lr4l4n5gnv7ffzml8lbrdwgfpq6m7ayhz3bdqqijdfvw6h283n";
+      name = "kdoctools-5.91.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kemoticons-5.90.0.tar.xz";
-      sha256 = "08mgk56dafj3q9gs69qcx17qfc45s8ifkjrpzg44p8zs0q51q6cb";
-      name = "kemoticons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kemoticons-5.91.0.tar.xz";
+      sha256 = "1jznkiq87rkndv10xs6974b5k0v82ly32agy5acxc2xy9wq7la0h";
+      name = "kemoticons-5.91.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kfilemetadata-5.90.0.tar.xz";
-      sha256 = "18y4bn6hz8xa68m0nxv88a1f3xkkks7c7pbiqb1vkrp9bbh52yax";
-      name = "kfilemetadata-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kfilemetadata-5.91.0.tar.xz";
+      sha256 = "1z030irzcvmjq329nwfk3h8cd51dwy9mppnwbgcd0lw6y3bka0rq";
+      name = "kfilemetadata-5.91.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kglobalaccel-5.90.0.tar.xz";
-      sha256 = "04qd1fcc22x70jacqzrv44q1jg5ldzynlfpw5cg2679409r0wnxw";
-      name = "kglobalaccel-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kglobalaccel-5.91.0.tar.xz";
+      sha256 = "09wscg6f19sh314ywpxp47pdr1xf1wzpjchg9rcjg207zrfhqqf0";
+      name = "kglobalaccel-5.91.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kguiaddons-5.90.0.tar.xz";
-      sha256 = "0m9l8xyc7xyj29fzxwp8ahr2l1rzs5rw1c26x446kb7smxvy8awx";
-      name = "kguiaddons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kguiaddons-5.91.0.tar.xz";
+      sha256 = "0gn8lvpm4i11s5vavlpm162bizjkmh5cb4dhj3p34dlp4vcc4mky";
+      name = "kguiaddons-5.91.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kholidays-5.90.0.tar.xz";
-      sha256 = "1p1kgy110ijk5a3ix4g9y1i7w0gsnzf82jdkwbdza95vibm82iz8";
-      name = "kholidays-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kholidays-5.91.0.tar.xz";
+      sha256 = "165vfmi5y8l00ng494469w5s1gjnf9zkggqrzmq65dfkdis3amdm";
+      name = "kholidays-5.91.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/khtml-5.90.0.tar.xz";
-      sha256 = "1bi839x4dhlkqxmv98pq01725b8i8szdxf9b1hf1jv37fk468mja";
-      name = "khtml-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/khtml-5.91.0.tar.xz";
+      sha256 = "1ldkk1f954mmgz30vqa895z1nw2jaknnb53lsd5vqxzxi3cmc054";
+      name = "khtml-5.91.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/ki18n-5.90.0.tar.xz";
-      sha256 = "13k8kbkmgdywclcdbfj5ri3gmdblv8yzalmvqd0hn7sym6pkdqfw";
-      name = "ki18n-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/ki18n-5.91.0.tar.xz";
+      sha256 = "11gdd2gvzsz3r8zvqbxxwbpwjvjwnzzhzyrd4spbpdy0w7j8n6ly";
+      name = "ki18n-5.91.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kiconthemes-5.90.0.tar.xz";
-      sha256 = "0w3wi4xy1yy2s1a927cj4my63q0fqhw06ghy9zjw830m31xwpx1k";
-      name = "kiconthemes-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kiconthemes-5.91.0.tar.xz";
+      sha256 = "1khh4ngivwdj9rxxcpx08ka8anskc9i1z9n2zijp4m5ix8mmj3c2";
+      name = "kiconthemes-5.91.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kidletime-5.90.0.tar.xz";
-      sha256 = "1xzwmk0aqv1lcdi51nl1k0lyiinnqxwla6w0xxmsh6193qa3fpvq";
-      name = "kidletime-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kidletime-5.91.0.tar.xz";
+      sha256 = "12qmiwc8p3izj1y5h0rndj2s496ckm1p85dv4g51zbpg7m8a48qv";
+      name = "kidletime-5.91.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kimageformats-5.90.0.tar.xz";
-      sha256 = "0r3ihkly0hf20aqbn7b9171mzqjna078rksdp96z6f7f1qy99v1v";
-      name = "kimageformats-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kimageformats-5.91.0.tar.xz";
+      sha256 = "0df8in33xwajqay487w0hjfsplz8y51w9sjb75na7yqsn75p38xb";
+      name = "kimageformats-5.91.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kinit-5.90.0.tar.xz";
-      sha256 = "0z65hfhj68ahjm558p2pj7dlrczcww8f2xyw9f44w10bp3p5hf1a";
-      name = "kinit-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kinit-5.91.0.tar.xz";
+      sha256 = "1y62k24mwzbg4gchvjb8wn6ygq57wc72clb3jgyipw034czdihvi";
+      name = "kinit-5.91.0.tar.xz";
     };
   };
   kio = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kio-5.90.0.tar.xz";
-      sha256 = "0ds6465fyzjj2azwdghrkxr9wvih0m96lv4kp6syqwii8nv2w7rs";
-      name = "kio-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kio-5.91.0.tar.xz";
+      sha256 = "14v28qilb5ayv9shw86hb88k60nr4bbd2pa4vwsqij9xkwlympgj";
+      name = "kio-5.91.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kirigami2-5.90.0.tar.xz";
-      sha256 = "0r48n11pv3yqsf11phl19cs52ph5ldabrfmq3xmsvxsknm6c4f9b";
-      name = "kirigami2-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kirigami2-5.91.0.tar.xz";
+      sha256 = "0ifljwa6hli2rndfadpzs30dpwc99nnvcm3yi9j5dim2bdf6glwc";
+      name = "kirigami2-5.91.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kitemmodels-5.90.0.tar.xz";
-      sha256 = "0f7zlif7kskbwpw8yrzlfyl954b623icdd9qn0algjcc2i9gqbzi";
-      name = "kitemmodels-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kitemmodels-5.91.0.tar.xz";
+      sha256 = "189kgrw2vjr9067mqr4f2sv06xmnjaapry0bf8s41v6r9v7py708";
+      name = "kitemmodels-5.91.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kitemviews-5.90.0.tar.xz";
-      sha256 = "10s285vxaaxjcy3am4bvch5wd7wv64wwcjvj7lqk2866aql9hmzp";
-      name = "kitemviews-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kitemviews-5.91.0.tar.xz";
+      sha256 = "16cm4zmv1ngrsmy6k0ybv5wxd0g8cc8zwq6ab7jvs7a04sykv238";
+      name = "kitemviews-5.91.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kjobwidgets-5.90.0.tar.xz";
-      sha256 = "1jv3c68mlsxhnd6jgqw5d4qqd66jf8bh6zbcs6bq0bad52ad2r8d";
-      name = "kjobwidgets-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kjobwidgets-5.91.0.tar.xz";
+      sha256 = "14pkyd6j78kignr62xfkvpyi2fwvzcvcsdnn23h8jxkhwm2ri42v";
+      name = "kjobwidgets-5.91.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kjs-5.90.0.tar.xz";
-      sha256 = "1z5d1ixzvaq6x9x0jhmh5bdrdqpsl1x7mh3s8wnycfxwmln6bawv";
-      name = "kjs-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kjs-5.91.0.tar.xz";
+      sha256 = "0jbwlnmf8whzgjkrbnsvdsnn3kv0h44ghf63m2qcgg2l9wb0j8rj";
+      name = "kjs-5.91.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kjsembed-5.90.0.tar.xz";
-      sha256 = "0ydrsg7z1b5hkskjvkb0b9lhx60aqcby2alhfbmkac197sf2frn4";
-      name = "kjsembed-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kjsembed-5.91.0.tar.xz";
+      sha256 = "124y7518jhjg3y2x7bcyl6b3c0bfxfbgd2sz6dwk45y4byx7rl60";
+      name = "kjsembed-5.91.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kmediaplayer-5.90.0.tar.xz";
-      sha256 = "010m5qrn41hcxsmxsq72m83qxikfvn3mgibkgy4bn2x8kxibzmlq";
-      name = "kmediaplayer-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kmediaplayer-5.91.0.tar.xz";
+      sha256 = "0rn9azrj8k1m67y9ni0f3nwl9ldf1ksiqv6dgnzrx6xh0rxfm2h1";
+      name = "kmediaplayer-5.91.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/knewstuff-5.90.0.tar.xz";
-      sha256 = "0q30p7z5zg3p24gp8q83i7my5bg4yfcdwsblmhl230kih8aap2cg";
-      name = "knewstuff-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/knewstuff-5.91.0.tar.xz";
+      sha256 = "0akaxi9klmpwn4pyr6ys5sxcapdspldq1f64im7vd6byzqrgpnax";
+      name = "knewstuff-5.91.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/knotifications-5.90.0.tar.xz";
-      sha256 = "15qb3jh5y1z84dp6wddwid4bk3ks05knkxlwv79hb9cdj8m4m7gi";
-      name = "knotifications-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/knotifications-5.91.0.tar.xz";
+      sha256 = "1207rimq8si1zxnn827631a1hskrd3m3ilgaj3wj859qrbkqmxzm";
+      name = "knotifications-5.91.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/knotifyconfig-5.90.0.tar.xz";
-      sha256 = "1qss40sr7az9x4yvl59mblzzgjm3hd8nvxgqmqlylargvggw496c";
-      name = "knotifyconfig-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/knotifyconfig-5.91.0.tar.xz";
+      sha256 = "07m5mphd8mrak5sdqlldbcd51946v49xpcwi9fhn7w0kx29hknyf";
+      name = "knotifyconfig-5.91.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kpackage-5.90.0.tar.xz";
-      sha256 = "1rig9aws8530sav0pmginqmdcrnz10qjbxfc5lw6mmb3sfig53z0";
-      name = "kpackage-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kpackage-5.91.0.tar.xz";
+      sha256 = "12w8lfwifa107wlrld3zz774hczn9mkib6wqxw24yxxmzfw9lc2i";
+      name = "kpackage-5.91.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kparts-5.90.0.tar.xz";
-      sha256 = "1x8kxd8kgzabd9dyqx2yx1qrrzl1mms4hm3lyg3f1nxki7xl6ra2";
-      name = "kparts-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kparts-5.91.0.tar.xz";
+      sha256 = "10ni6b114acjnmrahvvqw75iqkc10ii97y3z7lirj2727a3qmzzj";
+      name = "kparts-5.91.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kpeople-5.90.0.tar.xz";
-      sha256 = "1632k365bn9n3n8babq620v0px2hmapk8fprx28xpfp27zakhfgw";
-      name = "kpeople-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kpeople-5.91.0.tar.xz";
+      sha256 = "09l2q8cg9p8g7zkd1mjx6x08bqkr4ykxjibskc184asff7v47gvp";
+      name = "kpeople-5.91.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kplotting-5.90.0.tar.xz";
-      sha256 = "0i5ganvpzkpkd2p1avw0fpbp3mgbbifg8mmpvdf28ayh75dvrh9y";
-      name = "kplotting-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kplotting-5.91.0.tar.xz";
+      sha256 = "0rgmmliw9cfi0j2miszqz2kphqm04r5nfs8dqq6pnvclk1k9kss6";
+      name = "kplotting-5.91.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kpty-5.90.0.tar.xz";
-      sha256 = "1p5ny9ry0wwwprhpj9s9xg96h9476rldly7mawvfp5q3ihys8c4a";
-      name = "kpty-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kpty-5.91.0.tar.xz";
+      sha256 = "1yy1k96kikvvnlyd00krc08ifiqbrz0x5vwv3pgdbpnwgl8p580d";
+      name = "kpty-5.91.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kquickcharts-5.90.0.tar.xz";
-      sha256 = "1vf9vwrb03z6f19xyc1dc50s3kz21s4mkrv85mmyia0by4qvq5fi";
-      name = "kquickcharts-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kquickcharts-5.91.0.tar.xz";
+      sha256 = "1ghiymm257b8xgmkibb7s7bwb28x3zhnrgrrsya47q5njb87h0ck";
+      name = "kquickcharts-5.91.0.tar.xz";
     };
   };
   kross = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kross-5.90.0.tar.xz";
-      sha256 = "1gs7h03j753pq78q0fmajgd5pw8j3mc105rsph1c22l23vccya3z";
-      name = "kross-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kross-5.91.0.tar.xz";
+      sha256 = "06f8220jmvjsfbzjkr2ybwicwjffbi3yw9sr3bcyrilchrrpgqal";
+      name = "kross-5.91.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/krunner-5.90.0.tar.xz";
-      sha256 = "1q3hsml5274v8dy8rnqpnwxliad2q7a8mbs8k6kpqzih9z94crgi";
-      name = "krunner-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/krunner-5.91.0.tar.xz";
+      sha256 = "17iaw55rkzyfpgkbw2an6pa4wid79b0dnb3310vfaq0xkm0gjxq6";
+      name = "krunner-5.91.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kservice-5.90.0.tar.xz";
-      sha256 = "121y8bbq3m4pv5m9pj753v2nk914216a86ksmdqbgffw217qckdd";
-      name = "kservice-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kservice-5.91.0.tar.xz";
+      sha256 = "0m4j7djiyapi1hm23lz9nd238rrlldxlggzkqq056z486v2137bp";
+      name = "kservice-5.91.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/ktexteditor-5.90.0.tar.xz";
-      sha256 = "1g1dky9bgr2zjr0rw9c730shz588ykyw7qw3sgf0dr3sh8aq222n";
-      name = "ktexteditor-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/ktexteditor-5.91.0.tar.xz";
+      sha256 = "1bkz6v1y5vyxav398a6224ldqa9pqhbad3vmhxrjb2hxcbha2cpm";
+      name = "ktexteditor-5.91.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/ktextwidgets-5.90.0.tar.xz";
-      sha256 = "02g85zahh6hfsw3fcac7hp8kv4d1ha2asmmhnknqd054yl0adxjg";
-      name = "ktextwidgets-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/ktextwidgets-5.91.0.tar.xz";
+      sha256 = "0xmzrak5mwg1l4v38g14i7j1yr3j6sj13q2iqa433hs5agl6l6n4";
+      name = "ktextwidgets-5.91.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kunitconversion-5.90.0.tar.xz";
-      sha256 = "1vrvbsd8limfsmgjcv5kvzyf7g62rv1a0rvbdyq15z23zf4rsmf3";
-      name = "kunitconversion-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kunitconversion-5.91.0.tar.xz";
+      sha256 = "0n2v0f08s71z2imhn41jkm2knjvk7bkwmcz70gs8h97ykrj6niap";
+      name = "kunitconversion-5.91.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kwallet-5.90.0.tar.xz";
-      sha256 = "06ffg84jvrc8xhymg1g5j311vq3ajfqg3arx2cxa98aqld213akl";
-      name = "kwallet-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kwallet-5.91.0.tar.xz";
+      sha256 = "1z1qb6a2b5rqj7js88ms8n67fbs885pw6djbf1l86na2zhf0adip";
+      name = "kwallet-5.91.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kwayland-5.90.0.tar.xz";
-      sha256 = "0n7f4rx695q889j8g4sdpdi3jhk29z8zc4wrk5srs2diqi4y0qqi";
-      name = "kwayland-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kwayland-5.91.0.tar.xz";
+      sha256 = "1a03ckacp39lpsqyykkm6lxajxm71s6ifpzgj8q0a37v75jzmz9y";
+      name = "kwayland-5.91.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kwidgetsaddons-5.90.0.tar.xz";
-      sha256 = "1c17iq0q2w80p7v7k32db0pc5sbzqhvh0w5d145a1nkgr3nbnk6a";
-      name = "kwidgetsaddons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kwidgetsaddons-5.91.0.tar.xz";
+      sha256 = "03pj98sgybkcz487vr774x05w46imnipq2794nkv426nnhyxrd73";
+      name = "kwidgetsaddons-5.91.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kwindowsystem-5.90.0.tar.xz";
-      sha256 = "0fj7a86dk833ld76c3b1s4ri47bhpvjsi6ryfgdv5q7h2fwh6ia5";
-      name = "kwindowsystem-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kwindowsystem-5.91.0.tar.xz";
+      sha256 = "1yy02fvfabrsvdpmrkdnjdsdd3d2crxavsl47si6ry8fdxb90y95";
+      name = "kwindowsystem-5.91.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kxmlgui-5.90.0.tar.xz";
-      sha256 = "1q8v1wrx67c37jnd874ilkk8kfk3zvf3f86qg51k16ml0nrwjysg";
-      name = "kxmlgui-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kxmlgui-5.91.0.tar.xz";
+      sha256 = "1qww2isx99lx0mn1dv0vzrvmr2xdp8zgikyvgw1wf8hfay3v2s1g";
+      name = "kxmlgui-5.91.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kxmlrpcclient-5.90.0.tar.xz";
-      sha256 = "0mq2wgi4qnvscjdkis7jhs004k3s1b3wg0vijjai7xzy772kvclc";
-      name = "kxmlrpcclient-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kxmlrpcclient-5.91.0.tar.xz";
+      sha256 = "1bnymf5wq4apjsgshvbhcggdw7jc0yxv4jag3k19ff9820lskhph";
+      name = "kxmlrpcclient-5.91.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/modemmanager-qt-5.90.0.tar.xz";
-      sha256 = "08nlvg5lwvl3rspi848gp2b2b5pki6sy8c3ww9nn4afy4lk7p609";
-      name = "modemmanager-qt-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/modemmanager-qt-5.91.0.tar.xz";
+      sha256 = "15l46lkh8nkal1nai494dabaysy581jzi8nwrv4kjvc6qwc3yrx2";
+      name = "modemmanager-qt-5.91.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/networkmanager-qt-5.90.0.tar.xz";
-      sha256 = "0i9wvrxbkbil21zndiq4cmnldbqsrdp9gnhmp2ns78xdih8wysa7";
-      name = "networkmanager-qt-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/networkmanager-qt-5.91.0.tar.xz";
+      sha256 = "0f27qin2ks3q7rin53sk9vjjnadjnax99d9k245sjr6fjpczy81f";
+      name = "networkmanager-qt-5.91.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/oxygen-icons5-5.90.0.tar.xz";
-      sha256 = "1izfh6cxivmwiymy7lwbmf9j1hxy2skv6z1lbjr0c4snmx6pqx1g";
-      name = "oxygen-icons5-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/oxygen-icons5-5.91.0.tar.xz";
+      sha256 = "0j3j2lyxr2iz68vasvpjqkix4bnnj6wc4sr97i6x6z06zq0kawai";
+      name = "oxygen-icons5-5.91.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/plasma-framework-5.90.0.tar.xz";
-      sha256 = "1msqjnwvb815kii0rjhn1lvsnvq5wr8iprdjzsviw67va6gaz4p1";
-      name = "plasma-framework-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/plasma-framework-5.91.0.tar.xz";
+      sha256 = "0ydhhpnwf7lfl3kdjsw92mgsza5gy292f7v6kyby4ygjnir1hizl";
+      name = "plasma-framework-5.91.0.tar.xz";
     };
   };
   prison = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/prison-5.90.0.tar.xz";
-      sha256 = "0z2k2hyjj86va5rqgd8qrvhflfppcl2d3f9smxb5w9pp19ashvyk";
-      name = "prison-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/prison-5.91.0.tar.xz";
+      sha256 = "0k1zp3jzh8gjsji6wh5g8k41zdl8s1vd58ipm0lxy670a71wcqcg";
+      name = "prison-5.91.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/purpose-5.90.0.tar.xz";
-      sha256 = "182196hj3mdy1k7wfgadfxy7m1kbqzk6kksn7yd681h2gpky82l1";
-      name = "purpose-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/purpose-5.91.0.tar.xz";
+      sha256 = "1z6wpz7d9byx4n5zx6chmyy9k1jkmghdgahsvkqsc33z6hnh2b4m";
+      name = "purpose-5.91.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/qqc2-desktop-style-5.90.0.tar.xz";
-      sha256 = "05g1rydx0innmiz28mslix4bjsrhsnci227gadngzijncp2v288r";
-      name = "qqc2-desktop-style-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/qqc2-desktop-style-5.91.0.tar.xz";
+      sha256 = "0rd9rvffhif8yckwr7axjcv5iqn5b0jdviij7f9y8vjpkzyjvm8i";
+      name = "qqc2-desktop-style-5.91.0.tar.xz";
     };
   };
   solid = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/solid-5.90.0.tar.xz";
-      sha256 = "10hk4mh426dhi7is5hxa1varn15ijzra5a420zk297pzkphvx0ip";
-      name = "solid-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/solid-5.91.0.tar.xz";
+      sha256 = "1a4k0amyg8mvfr2ld7v8zyphhxv33yybh55vqcshwv4a0jm1wmjg";
+      name = "solid-5.91.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/sonnet-5.90.0.tar.xz";
-      sha256 = "0d4xxm9vw1rc2mypv4z0yihcn679sab0afxr2kbzq01wr6p759y7";
-      name = "sonnet-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/sonnet-5.91.0.tar.xz";
+      sha256 = "067xj5mllpzl0gnxxljhfi9y4xdgrpqbckm7pykczzqrklrrx8dx";
+      name = "sonnet-5.91.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/syndication-5.90.0.tar.xz";
-      sha256 = "0a9j443w42jwvlzjh5mfxn25kwjrz1ya6sgy0c4y3n5xbg031zmx";
-      name = "syndication-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/syndication-5.91.0.tar.xz";
+      sha256 = "1f2kb6mh1xc1k1bn536lq9gq0j2lb65qw4vpp4ixynlfij4zq1gy";
+      name = "syndication-5.91.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/syntax-highlighting-5.90.0.tar.xz";
-      sha256 = "19mckdfdxb5i26y75cgmda91s864jbh1wmf98bv8xa1iqxwkwj5z";
-      name = "syntax-highlighting-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/syntax-highlighting-5.91.0.tar.xz";
+      sha256 = "0fprqi2z8issh3jkql6labszkwd3cpvd6qadsg9fi46vfjr4a2ip";
+      name = "syntax-highlighting-5.91.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/threadweaver-5.90.0.tar.xz";
-      sha256 = "1frhzlzmnrp5y3lrl0ahzxh8syj4vlkjvaypsmbm2bkkn4akizg3";
-      name = "threadweaver-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/threadweaver-5.91.0.tar.xz";
+      sha256 = "1900kqglkwzkjc24mvl0j7jf7xcx6cr6b1g78s5b5m18rw050j12";
+      name = "threadweaver-5.91.0.tar.xz";
     };
   };
 }
diff --git a/nixpkgs/pkgs/development/libraries/lcms2/default.nix b/nixpkgs/pkgs/development/libraries/lcms2/default.nix
index b600a2ca4c3d..14579bc59156 100644
--- a/nixpkgs/pkgs/development/libraries/lcms2/default.nix
+++ b/nixpkgs/pkgs/development/libraries/lcms2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.12";
+  version = "2.13.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    sha256 = "sha256-GGY5hehkEARVrD5QdiXEOMNxA1TYXly7fNQEPhH+EPU=";
+    sha256 = "sha256-1HPnlueyfFrwG9bRVS1CtFtDRX5xgs6ZA/OLt0ggO4g=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/nixpkgs/pkgs/development/libraries/libaom/default.nix b/nixpkgs/pkgs/development/libraries/libaom/default.nix
index 82e440333136..3a3866911b8d 100644
--- a/nixpkgs/pkgs/development/libraries/libaom/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libaom/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "0fmnbzpl481i7kchx4hbvb507r5pfgyrzfrlrs7jk3bicycm75qv";
+    sha256 = "sha256-g6QkKLrk+SH1s5fRmseAQMmM6y4QwmKmVDPxdbqGmwg=";
     stripRoot = false;
   };
 
diff --git a/nixpkgs/pkgs/development/libraries/libarchive/default.nix b/nixpkgs/pkgs/development/libraries/libarchive/default.nix
index 2a1d53e6ee01..1cc6fe6f521e 100644
--- a/nixpkgs/pkgs/development/libraries/libarchive/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libarchive/default.nix
@@ -12,13 +12,13 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   pname = "libarchive";
-  version = "3.5.2";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${version}";
-    sha256 = "sha256-H00UJ+ON1kBc19BgWBBKmO8f23oAg2mk7o9hhDhn50Q=";
+    sha256 = "sha256-u6Zeu9yTjhx5U7KZVUkuuUsQPjWN71mE5egG4T+FGfY=";
   };
 
   outputs = [ "out" "lib" "dev" ];
diff --git a/nixpkgs/pkgs/development/libraries/libbsd/default.nix b/nixpkgs/pkgs/development/libraries/libbsd/default.nix
index 745b34226e2d..8c8e47b98a4d 100644
--- a/nixpkgs/pkgs/development/libraries/libbsd/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libbsd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libbsd";
-  version = "0.11.3";
+  version = "0.11.5";
 
   src = fetchurl {
     url = "https://libbsd.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "18a2bcl9z0zyxhrm1lfv4yhhz0589s6jz0s78apaq78mhj0wz5gz";
+    sha256 = "sha256-GpyVJSVjXBu2dwyyLpabk42Oap15EjYrmO6DcFmbDv0=";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Common functions found on BSD systems";
     homepage = "https://libbsd.freedesktop.org/";
-    license = licenses.bsd3;
+    license = with licenses; [ beerware bsd2 bsd3 bsdOriginal isc mit ];
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ matthewbauer ];
   };
diff --git a/nixpkgs/pkgs/development/libraries/libclc/default.nix b/nixpkgs/pkgs/development/libraries/libclc/default.nix
index fdcc2ae0081b..c634892944ca 100644
--- a/nixpkgs/pkgs/development/libraries/libclc/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libclc/default.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ninja python3 ];
   buildInputs = [ llvm clang-unwrapped ];
   strictDeps = true;
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ];
 
   meta = with lib; {
     homepage = "http://libclc.llvm.org/";
diff --git a/nixpkgs/pkgs/development/libraries/libdrm/default.nix b/nixpkgs/pkgs/development/libraries/libdrm/default.nix
index 731039e26a08..e08a46732480 100644
--- a/nixpkgs/pkgs/development/libraries/libdrm/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.109";
+  version = "2.4.110";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "09kzrdsd14zr0i3izvi5mck4vqccl3c9hr84r9i4is0zikh554v2";
+    sha256 = "0dwpry9m5l27dlhq48j4bsiqwm0247cxdqwv3b7ddmkynk2f9kpf";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/nixpkgs/pkgs/development/libraries/libgee/default.nix b/nixpkgs/pkgs/development/libraries/libgee/default.nix
index 1a40d1f17b41..b34790d59c73 100644
--- a/nixpkgs/pkgs/development/libraries/libgee/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libgee/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgee";
-  version = "0.20.4";
+  version = "0.20.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "03nyf8n7i7f67fsh220g52slmihdk1lv4iwspm7xmkgrj3rink2j";
+    sha256 = "MYY6iVfVpyf5BnSVyr8KCIn6XT1EYm5UCUMxGI1cFRg=";
   };
 
   doCheck = true;
diff --git a/nixpkgs/pkgs/development/libraries/libnfs/default.nix b/nixpkgs/pkgs/development/libraries/libnfs/default.nix
index 4e12553b00ba..dd442b2cd4bd 100644
--- a/nixpkgs/pkgs/development/libraries/libnfs/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libnfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnfs";
-  version = "4.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "sahlberg";
     repo = "libnfs";
     rev = "libnfs-${version}";
-    sha256 = "0i27wd4zvhjz7620q043p4d4mkx8zv2yz9adm1byin47dynahyda";
+    sha256 = "sha256-5jyY7hqEhBPiQ8pNd+mRTEc4brht4ID7PoV7O2RFNQA=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/nixpkgs/pkgs/development/libraries/libpng/default.nix b/nixpkgs/pkgs/development/libraries/libpng/default.nix
index aeb3fcba06fa..2293dfc00a0c 100644
--- a/nixpkgs/pkgs/development/libraries/libpng/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libpng/default.nix
@@ -11,7 +11,7 @@ let
   whenPatched = lib.optionalString apngSupport;
 
 in stdenv.mkDerivation rec {
-  name = "libpng" + whenPatched "-apng" + "-${version}";
+  pname = "libpng" + whenPatched "-apng";
   version = "1.6.37";
 
   src = fetchurl {
diff --git a/nixpkgs/pkgs/development/libraries/libqmi/default.nix b/nixpkgs/pkgs/development/libraries/libqmi/default.nix
index c3c9bf6947eb..0906d7b967c9 100644
--- a/nixpkgs/pkgs/development/libraries/libqmi/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libqmi/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.30.2";
+  version = "1.30.4";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-vgHs4OosIZTL6ldEv1qvBsBLpft+x4h6ExFsdtEU/t0=";
+    sha256 = "sha256-ANfaMKT40RhfN8uiic+vHfzQSljy921qz99bhTEtbtY=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/libraries/librsvg/default.nix b/nixpkgs/pkgs/development/libraries/librsvg/default.nix
index 1de6090b146c..81cad37351a5 100644
--- a/nixpkgs/pkgs/development/libraries/librsvg/default.nix
+++ b/nixpkgs/pkgs/development/libraries/librsvg/default.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librsvg";
-  version = "2.52.5";
+  version = "2.52.6";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "QHy7q1GBN+oYo/MiC+oYD77nXz5b1roQp6hiwab3TYI=";
+    sha256 = "o/k5oeajpgQIJEYy0DI/jDsg60t7AAU24uW9k7jv+q0=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/nixpkgs/pkgs/development/libraries/libsigsegv/default.nix b/nixpkgs/pkgs/development/libraries/libsigsegv/default.nix
index bc36a12eea82..84c2f19e5e29 100644
--- a/nixpkgs/pkgs/development/libraries/libsigsegv/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libsigsegv/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsigsegv";
-  version = "2.13";
+  version = "2.14";
 
   src = fetchurl {
     url = "mirror://gnu/libsigsegv/libsigsegv-${version}.tar.gz";
-    sha256 = "sha256-vnjuQXawX3x1/wMpjYSHTbkPS2ydVQPw2hIms6PEgRk=";
+    sha256 = "sha256-zaw5QYAzZM+BqQhJm+t5wgDq1gtrW0DK0ST9HgbKopU=";
   };
 
   patches = if enableSigbusFix then [ ./sigbus_fix.patch ] else null;
diff --git a/nixpkgs/pkgs/development/libraries/libtiff/default.nix b/nixpkgs/pkgs/development/libraries/libtiff/default.nix
index 5f34a80d253a..1371345ddd7c 100644
--- a/nixpkgs/pkgs/development/libraries/libtiff/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libtiff/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 
 , autoreconfHook
 , pkg-config
@@ -27,6 +28,21 @@ stdenv.mkDerivation rec {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2022-22844.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64.patch";
+      sha256 = "0cfih55f5qpc84mvlwsffik80bgz6drkflkhrdyqq8m84jw3mbwb";
+    })
+    (fetchpatch {
+      name = "CVE-2022-0561.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef.patch";
+      sha256 = "0m57fdxyvhhr9cc260lvkkn2g4zr4n4v9nricc6lf9h6diagd7mk";
+    })
+    (fetchpatch {
+      name = "CVE-2022-0562.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b.patch";
+      sha256 = "0ycirjjc1vigj03kwjb92n6jszsl9p17ccw5hry7lli9gxyyr0an";
+    })
   ];
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/development/libraries/libwacom/default.nix b/nixpkgs/pkgs/development/libraries/libwacom/default.nix
index 2f9afff56d87..1517cf970782 100644
--- a/nixpkgs/pkgs/development/libraries/libwacom/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libwacom/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "1.99.1";
+  version = "2.0.0";
 
   outputs = [ "out" "dev" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "sha256-WGW/4m+BTe6dEigUcuUIZjoTeamInW6zrtrlaqKM6Js=";
+    sha256 = "sha256-k8pEgEu+oWNa0rI47osVPKaZGxgwX/ENaz9jPrQXy0E=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/libraries/libxkbcommon/default.nix b/nixpkgs/pkgs/development/libraries/libxkbcommon/default.nix
index 25d2d89add01..7bcc62af6ec8 100644
--- a/nixpkgs/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libxkbcommon/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libxkbcommon";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "https://xkbcommon.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0d4jzq0zv1xmng0z0q5lb4rz03ikgxdwi68k3r70ac16gb911ixk";
+    sha256 = "0ca00awfzvxiznvd4mgwgxyqxiwvi07j5xxmg5z0l47rcd9fqv0h";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/nixpkgs/pkgs/development/libraries/libxml2/default.nix b/nixpkgs/pkgs/development/libraries/libxml2/default.nix
index bc11c9cfea1f..3b7cae36a0ee 100644
--- a/nixpkgs/pkgs/development/libraries/libxml2/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libxml2/default.nix
@@ -1,20 +1,37 @@
-{ stdenv, lib, fetchurl, fetchpatch
-, zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
+{ stdenv
+, lib
+, fetchurl
+, zlib
+, pkg-config
+, autoreconfHook
+, xz
+, libintl
+, python
+, gettext
+, ncurses
+, findXMLCatalogs
 , libiconv
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
-, icuSupport ? false, icu ? null
+, icuSupport ? false
+, icu
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
 , enableStatic ? !enableShared
+, gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.9.12";
+  version = "2.9.13";
+
+  outputs = [ "bin" "dev" "out" "man" "doc" ]
+    ++ lib.optional pythonSupport "py"
+    ++ lib.optional (enableStatic && enableShared) "static";
 
   src = fetchurl {
-    url = "http://xmlsoft.org/sources/${pname}-${version}.tar.gz";
-    sha256 = "14hxwzmf5xqppx77z7i0ni9lpzg1a84dqpf8j8l1fvy570g6imn8";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "J2EwYC0S/khOzANEfuXnWdBGVVj7yda9FE43RTBuvw4=";
   };
+
   patches = [
     # Upstream bugs:
     #   https://bugzilla.gnome.org/show_bug.cgi?id=789714
@@ -28,62 +45,65 @@ stdenv.mkDerivation rec {
     #   https://github.com/NixOS/nixpkgs/pull/63174
     #   https://github.com/NixOS/nixpkgs/pull/72342
     ./utf8-xmlErrorFuncHandler.patch
-
-    # Work around lxml API misuse.
-    # https://gitlab.gnome.org/GNOME/libxml2/issues/255
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libxml2/commit/85b1792e37b131e7a51af98a37f92472e8de5f3f.patch";
-      sha256 = "epqlNs2S0Zczox3KyCB6R2aJKh87lXydlZ0x6tLHweE=";
-    })
   ];
 
-  outputs = [ "bin" "dev" "out" "man" "doc" ]
-    ++ lib.optional pythonSupport "py"
-    ++ lib.optional (enableStatic && enableShared) "static";
-
   strictDeps = true;
 
-  buildInputs = lib.optional pythonSupport python
-    ++ lib.optional (pythonSupport && python?isPy2 && python.isPy2) gettext
-    ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses
-    ++ lib.optional (stdenv.isDarwin &&
-                     pythonSupport && python?isPy2 && python.isPy2) libintl
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
+
+  buildInputs = lib.optionals pythonSupport [
+    python
+  ] ++ lib.optionals (pythonSupport && python?isPy2 && python.isPy2) [
+    gettext
+  ] ++ lib.optionals (pythonSupport && python?isPy3 && python.isPy3) [
+    ncurses
+  ] ++ lib.optionals (stdenv.isDarwin && pythonSupport && python?isPy2 && python.isPy2) [
+    libintl
+  ] ++ lib.optionals stdenv.isFreeBSD [
     # Libxml2 has an optional dependency on liblzma.  However, on impure
     # platforms, it may end up using that from /usr/lib, and thus lack a
     # RUNPATH for that, leading to undefined references for its users.
-    ++ lib.optional stdenv.isFreeBSD xz;
+    xz
+  ];
 
-  propagatedBuildInputs = [ zlib findXMLCatalogs ]
-    ++ lib.optional stdenv.isDarwin libiconv
-    ++ lib.optional icuSupport icu;
+  propagatedBuildInputs = [
+    zlib
+    findXMLCatalogs
+  ] ++ lib.optionals stdenv.isDarwin [
+    libiconv
+  ] ++ lib.optionals icuSupport [
+    icu
+  ];
 
   configureFlags = [
-    "--exec_prefix=$dev"
+    "--exec-prefix=${placeholder "dev"}"
     (lib.enableFeature enableStatic "static")
     (lib.enableFeature enableShared "shared")
     (lib.withFeature icuSupport "icu")
     (lib.withFeatureAs pythonSupport "python" python)
   ];
 
-  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
-    MACOSX_DEPLOYMENT_TARGET=10.16
-  '';
+  installFlags = lib.optionals pythonSupport [
+    "pythondir=\"${placeholder "py"}/${python.sitePackages}\""
+  ];
 
   enableParallelBuilding = true;
 
-  # disable test that's problematic with newer pythons: see
-  # https://mail.gnome.org/archives/xml/2017-August/msg00014.html
-  preCheck = lib.optionalString (pythonSupport && !(python?pythonOlder && python.pythonOlder "3.5")) ''
-    echo "" > python/tests/tstLastError.py
-  '';
-
-  doCheck = (stdenv.hostPlatform == stdenv.buildPlatform) && !stdenv.isDarwin &&
+  doCheck =
+    (stdenv.hostPlatform == stdenv.buildPlatform) &&
+    !stdenv.isDarwin &&
     stdenv.hostPlatform.libc != "musl";
 
-  preInstall = lib.optionalString pythonSupport
-    ''substituteInPlace python/libxml2mod.la --replace "${python}" "$py"'';
-  installFlags = lib.optional pythonSupport
-    "pythondir=\"${placeholder "py"}/lib/${python.libPrefix}/site-packages\"";
+  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
+    MACOSX_DEPLOYMENT_TARGET=10.16
+  '';
+
+  preInstall = lib.optionalString pythonSupport ''
+    substituteInPlace python/libxml2mod.la --replace "$dev/${python.sitePackages}" "$py/${python.sitePackages}"
+  '';
 
   postFixup = ''
     moveToOutput bin/xml2-config "$dev"
@@ -93,13 +113,21 @@ stdenv.mkDerivation rec {
     moveToOutput lib/libxml2.a "$static"
   '';
 
-  passthru = { inherit version; pythonSupport = pythonSupport; };
+  passthru = {
+    inherit version;
+    pythonSupport = pythonSupport;
+
+    updateScript = gnome.updateScript {
+      packageName = pname;
+      versionPolicy = "none";
+    };
+  };
 
-  meta = {
+  meta = with lib; {
     homepage = "http://xmlsoft.org/";
-    description = "An XML parsing library for C";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    maintainers = [ lib.maintainers.eelco ];
+    description = "XML parsing library for C";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ eelco jtojnar ];
   };
 }
diff --git a/nixpkgs/pkgs/development/libraries/libxslt/default.nix b/nixpkgs/pkgs/development/libraries/libxslt/default.nix
index 3993b3f73e1f..ac4dd7492337 100644
--- a/nixpkgs/pkgs/development/libraries/libxslt/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libxslt/default.nix
@@ -1,38 +1,60 @@
-{ lib, stdenv, fetchurl
+{ lib
+, stdenv
+, fetchurl
 , pkg-config
-, libxml2, findXMLCatalogs, gettext, python, libgcrypt
+, autoreconfHook
+, libxml2
+, findXMLCatalogs
+, gettext
+, python
+, ncurses
+, libgcrypt
 , cryptoSupport ? false
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
+, gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "libxslt";
-  version = "1.1.34";
+  version = "1.1.35";
+
+  outputs = [ "bin" "dev" "out" "man" "doc" ] ++ lib.optional pythonSupport "py";
 
   src = fetchurl {
-    url = "http://xmlsoft.org/sources/${pname}-${version}.tar.gz";
-    sha256 = "0zrzz6kjdyavspzik6fbkpvfpbd25r2qg6py5nnjaabrsr3bvccq";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "gkfzPpqHLGrIWapFAYvExNALl+L+rJ7rwQyTzh803Xk=";
   };
 
-  outputs = [ "bin" "dev" "out" "man" "doc" ] ++ lib.optional pythonSupport "py";
-
   nativeBuildInputs = [
     pkg-config
+    autoreconfHook
   ];
 
-  buildInputs = [ libxml2.dev ]
-    ++ lib.optional stdenv.isDarwin gettext
-    ++ lib.optionals pythonSupport [ libxml2.py python ]
-    ++ lib.optionals cryptoSupport [ libgcrypt ];
+  buildInputs = [
+    libxml2.dev
+  ] ++ lib.optional stdenv.isDarwin [
+    gettext
+  ] ++ lib.optionals pythonSupport [
+    libxml2.py
+    python
+    ncurses
+  ] ++ lib.optionals cryptoSupport [
+    libgcrypt
+  ];
 
-  propagatedBuildInputs = [ findXMLCatalogs ];
+  propagatedBuildInputs = [
+    findXMLCatalogs
+  ];
 
   configureFlags = [
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ lib.optional pythonSupport "--with-python=${python}"
-    ++ lib.optional (!cryptoSupport) "--without-crypto";
+  ] ++ lib.optionals pythonSupport [
+    "--with-python=${python}"
+  ] ++ lib.optionals (!cryptoSupport) [
+    "--without-crypto"
+  ];
 
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
@@ -46,6 +68,11 @@ stdenv.mkDerivation rec {
 
   passthru = {
     inherit pythonSupport;
+
+    updateScript = gnome.updateScript {
+      packageName = pname;
+      versionPolicy = "none";
+    };
   };
 
   meta = with lib; {
@@ -53,7 +80,7 @@ stdenv.mkDerivation rec {
     description = "A C library and tools to do XSL transformations";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = [ maintainers.eelco ];
-    broken = !(pythonSupport -> libxml2.pythonSupport); # see #73102 for why this is not an assert
+    maintainers = with maintainers; [ eelco jtojnar ];
+    broken = pythonSupport && !libxml2.pythonSupport; # see #73102 for why this is not an assert
   };
 }
diff --git a/nixpkgs/pkgs/development/libraries/mesa/default.nix b/nixpkgs/pkgs/development/libraries/mesa/default.nix
index 1fb573931b6d..23163763ed9b 100644
--- a/nixpkgs/pkgs/development/libraries/mesa/default.nix
+++ b/nixpkgs/pkgs/development/libraries/mesa/default.nix
@@ -33,7 +33,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.3.5";
+  version = "21.3.7";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -47,18 +47,13 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0k2ary16ixsrp65m2n5djpr51nbwdgzpv81pfrnqbvk44jfjlfyr";
+    sha256 = "0ggw3s514z6szasbiy4dv5mdi689121yy2xly2g21gv1mavrvyml";
   };
 
   # TODO:
   #  revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved
   #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
   patches = [
-    # To fix flickering on Intel GPUs (iris), see https://github.com/NixOS/nixpkgs/issues/153377:
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/07dc3d4238e57901ccf98e0b506d9aad2c86b9d9.diff";
-      sha256 = "sha256-3fa1qHJes3x1/iXsxfjgy9HnEGlOyFtJatSkU1a3XDI=";
-    })
     # fixes pkgsMusl.mesa build
     ./musl.patch
     (fetchpatch {
diff --git a/nixpkgs/pkgs/development/libraries/ncurses/default.nix b/nixpkgs/pkgs/development/libraries/ncurses/default.nix
index efab246bb1f0..2740b95986c9 100644
--- a/nixpkgs/pkgs/development/libraries/ncurses/default.nix
+++ b/nixpkgs/pkgs/development/libraries/ncurses/default.nix
@@ -13,7 +13,7 @@
 stdenv.mkDerivation rec {
   # Note the revision needs to be adjusted.
   version = "6.3";
-  name = "ncurses-${version}" + lib.optionalString (abiVersion == "5") "-abi5-compat";
+  pname = "ncurses" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   # We cannot use fetchFromGitHub (which calls fetchzip)
   # because we need to be able to use fetchurlBoot.
diff --git a/nixpkgs/pkgs/development/libraries/neon/default.nix b/nixpkgs/pkgs/development/libraries/neon/default.nix
index a39ece28aae9..1521c1a63895 100644
--- a/nixpkgs/pkgs/development/libraries/neon/default.nix
+++ b/nixpkgs/pkgs/development/libraries/neon/default.nix
@@ -14,12 +14,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "0.31.2";
+  version = "0.32.2";
   pname = "neon";
 
   src = fetchurl {
     url = "https://notroj.github.io/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0y46dbhiblcvg8k41bdydr3fivghwk73z040ki5825d24ynf67ng";
+    sha256 = "sha256-mGVmRoxilfxdD7FBpZgeMcn4LuOOk4N0q+2Ece8vsoY=";
   };
 
   patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];
diff --git a/nixpkgs/pkgs/development/libraries/nettle/generic.nix b/nixpkgs/pkgs/development/libraries/nettle/generic.nix
index 348faf56b56a..44afdf45513f 100644
--- a/nixpkgs/pkgs/development/libraries/nettle/generic.nix
+++ b/nixpkgs/pkgs/development/libraries/nettle/generic.nix
@@ -5,9 +5,9 @@
 }:
 
 stdenv.mkDerivation {
-  name = "nettle-${version}";
+  pname = "nettle";
 
-  inherit src;
+  inherit version src;
 
   outputs = [ "out" "dev" ];
   outputBin = "dev";
diff --git a/nixpkgs/pkgs/development/libraries/openh264/default.nix b/nixpkgs/pkgs/development/libraries/openh264/default.nix
index 93fc495d3854..42ae370cd901 100644
--- a/nixpkgs/pkgs/development/libraries/openh264/default.nix
+++ b/nixpkgs/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ffav46pz3sbj92nipd62z03fibyqgclfq9w8lgr80s6za6zdk5s";
+    sha256 = "sha256-l64xP39Uaislqh4D7oSxJiQGhXkklol4LgS9BVPbaGk=";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/nixpkgs/pkgs/development/libraries/openssl/default.nix b/nixpkgs/pkgs/development/libraries/openssl/default.nix
index 390227cfe95c..33ddbf7018c5 100644
--- a/nixpkgs/pkgs/development/libraries/openssl/default.nix
+++ b/nixpkgs/pkgs/development/libraries/openssl/default.nix
@@ -186,8 +186,8 @@ in {
   };
 
   openssl_1_1 = common rec {
-    version = "1.1.1m";
-    sha256 = "sha256-+JGZvosjykX8fLnx2NPuZzEjGChq0DD1MWrKZGLbbJY=";
+    version = "1.1.1n";
+    sha256 = "sha256-QNzrUaT2pSdb3g5r8g70uRv8Mu1XwFUuLo4VRjNysXo=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -201,8 +201,8 @@ in {
   };
 
   openssl_3_0 = common {
-    version = "3.0.1";
-    sha256 = "sha256-wxGthTNTvOeW7a0BqGLFCopYf2Ln4hAO9GWrU+ybBtE=";
+    version = "3.0.2";
+    sha256 = "sha256-mOkczq1NR1auPJzeXgkZGo5YbZ9NUIOOfsCdZBHf22M=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
diff --git a/nixpkgs/pkgs/development/libraries/orcania/default.nix b/nixpkgs/pkgs/development/libraries/orcania/default.nix
index 1058eaa1f631..2c43cfb4cc90 100644
--- a/nixpkgs/pkgs/development/libraries/orcania/default.nix
+++ b/nixpkgs/pkgs/development/libraries/orcania/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake, check, subunit }:
 stdenv.mkDerivation rec {
   pname = "orcania";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "babelouest";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6Libn+S5c7sCmKGq8KojiUhI18zO37rgiiVwQxP3p4o=";
+    sha256 = "sha256-lrc4VEqmCp/P/h0+5/ix6tx4pjfkLy9BLBZtKYLlyGI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/development/libraries/pango/default.nix b/nixpkgs/pkgs/development/libraries/pango/default.nix
index 964a3640871f..3033b7df4e3d 100644
--- a/nixpkgs/pkgs/development/libraries/pango/default.nix
+++ b/nixpkgs/pkgs/development/libraries/pango/default.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pango";
-  version = "1.50.3";
+  version = "1.50.4";
 
   outputs = [ "bin" "out" "dev" ]
     ++ lib.optionals withDocs [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "St0F7fUcH7N1oczedJiRQSDiPLKA3XOVsa60QfGDikw=";
+    sha256 = "9K1j6H3CsUUwBUKk+wBNB6n5GzQVL64N2+UOzdhRwWI=";
   };
 
   strictDeps = !withIntrospection;
diff --git a/nixpkgs/pkgs/development/libraries/pipewire/default.nix b/nixpkgs/pkgs/development/libraries/pipewire/default.nix
index d4dc43021396..d37e0a050866 100644
--- a/nixpkgs/pkgs/development/libraries/pipewire/default.nix
+++ b/nixpkgs/pkgs/development/libraries/pipewire/default.nix
@@ -20,7 +20,6 @@
 , udev
 , libva
 , libsndfile
-, SDL2
 , vulkan-headers
 , vulkan-loader
 , webrtc-audio-processing
@@ -129,7 +128,6 @@ let
       vulkan-headers
       vulkan-loader
       webrtc-audio-processing
-      SDL2
       systemd
     ] ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
     ++ lib.optionals libcameraSupport [ libcamera libdrm ]
@@ -169,6 +167,7 @@ let
       "-Dsession-managers="
       "-Dvulkan=enabled"
       "-Dx11=${mesonEnableFeature x11Support}"
+      "-Dsdl2=disabled" # required only to build examples, causes dependency loop
     ];
 
     # Fontconfig error: Cannot load default config file
diff --git a/nixpkgs/pkgs/development/libraries/plasma-wayland-protocols/default.nix b/nixpkgs/pkgs/development/libraries/plasma-wayland-protocols/default.nix
index fe148368b499..082702ec46f7 100644
--- a/nixpkgs/pkgs/development/libraries/plasma-wayland-protocols/default.nix
+++ b/nixpkgs/pkgs/development/libraries/plasma-wayland-protocols/default.nix
@@ -7,11 +7,11 @@
 
 mkDerivation rec {
   pname = "plasma-wayland-protocols";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-zMn8INehMO2/sjPDOxMldArAGyZAqjelxUTtv7oYqDM=";
+    sha256 = "sha256-t0/6yWnvBn5HGA50imejoYFrcVf/TqYg7UQy9Ztw8B8=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
diff --git a/nixpkgs/pkgs/development/libraries/polkit/default.nix b/nixpkgs/pkgs/development/libraries/polkit/default.nix
index 3a3199cbd7a9..72907f7aedc8 100644
--- a/nixpkgs/pkgs/development/libraries/polkit/default.nix
+++ b/nixpkgs/pkgs/development/libraries/polkit/default.nix
@@ -65,6 +65,12 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683.patch";
       sha256 = "162jkpg2myq0rb0s5k3nfr4pqwv9im13jf6vzj8p5l39nazg5i4s";
     })
+    # File descriptor leak allows an unprivileged user to cause a crash (CVE-2021-4115)
+    (fetchpatch {
+      name = "CVE-2021-4115.patch";
+      url = "https://src.fedoraproject.org/rpms/polkit/raw/0a203bd46a1e2ec8cc4b3626840e2ea9d0d13a9a/f/CVE-2021-4115.patch";
+      sha256 = "sha256-BivHVVpYB4Ies1YbBDyKwUmNlqq2D1MpMipH9/dZM54=";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     # Make netgroup support optional (musl does not have it)
     # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10
diff --git a/nixpkgs/pkgs/development/libraries/prometheus-cpp/default.nix b/nixpkgs/pkgs/development/libraries/prometheus-cpp/default.nix
index 173ee6d2e09d..a046f255a6a3 100644
--- a/nixpkgs/pkgs/development/libraries/prometheus-cpp/default.nix
+++ b/nixpkgs/pkgs/development/libraries/prometheus-cpp/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , cmake
 , gbenchmark
@@ -10,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "prometheus-cpp";
-  version = "0.9.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "jupp0r";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pjz29ywzfg3blhg2v8fn7gjvq46k3bqn7y0xvmn468ixxhv21fi";
+    sha256 = "L6CXRup3kU1lY5UnwPbaOwEtCeAySNmFCPmHwsk6cRE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/nixpkgs/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 76c4237dcaf7..8bf6386c4c60 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/nixpkgs/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,8 +1,8 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "7edec6e014de27b9dd03f63875c471aac606a918",
-    "sha256": "0qv4vhciigqd8bnqzrs7y71ls7jx1p9cal2rh78m42qgskk1ci59"
+    "rev": "dba14d48611b9e9d59576172658779ab4a39b416",
+    "sha256": "1w2m1rm6mhj9qbanak36rqvc30x495zvj7mh2syy1yd29by0g5i8"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "c9fde86b0a2440133bc08f4811b6ca793be47f0a",
-    "sha256": "1fqhdkv3sp3nbzqi2a5wvxn5d4v0xcrq2bl609bdyj4nx367a8wp"
+    "rev": "d16bf02a11953dcac01dca73e6f3778f293adefe",
+    "sha256": "0rpyd5r60707lzfmfi3y501c7is1gzhh30bframsy8bwglck2hjj"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -26,8 +26,8 @@
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "69a87a9b831e36a578594a0a13130c384ad03121",
-    "sha256": "0ph07rdf9qfxnw3z2nqbmh6na65z0p2snmlzdw80amd7s0g255kw"
+    "rev": "5e9ca5d36d65dadb98ef90013a1dcf15fbd7ae26",
+    "sha256": "1lpiq3svlnj8f8apd12if11sng7k0l8y6vhr317srzz4dd77cfry"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "55324650f9e759a43dce927f823c9858574106c3",
-    "sha256": "0cxz4pqvb8l0wqpc4hr0xmc72csqf7dpbbzdqgil9nyyg21ihkz0"
+    "rev": "1d49a5b678957adde7e2db23a485a3f48157bc8f",
+    "sha256": "1wdpgh23mdn0nny9c837iyg9kszc3m4cdmaanf8glymkzn0rkd8w"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -101,8 +101,8 @@
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "be66bf9a5618c745d2a6ee2262967af6307b3b07",
-    "sha256": "11h3f3rb2kqgsw7njzhjwazw1k03v12i83irjndylafiaqw6c6ks"
+    "rev": "d8d6b14b9907adbc6ce307d52be34aaa761a58fa",
+    "sha256": "15c7nrvvn7qc3l7kdbl5wdpazqwv8zvg1aij2jvcrhbymn0zl3mc"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@@ -146,8 +146,8 @@
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "24128cdf8bef53eddf31a5709bbbc46293006b1c",
-    "sha256": "0vinjcbq4saxhlmvb5i93bzgg30qc3j8r2qfwrzaxc4vmfhfgi56"
+    "rev": "728012f7762ecd5762d493f8796907c6456f31e7",
+    "sha256": "1ldizgybl4fp95xlzf103hqmsqdmr3jbx048jyxcb5gjd3pbwh7p"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
@@ -161,18 +161,18 @@
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "353b75b2e34bdae901625bbddf5c5e3f3e6c0de5",
-    "sha256": "12nv773zc05yrbai1z6i481yinih0kxcjzgm9pa0580qz69gd9a5"
+    "rev": "98d1fd864cbb6c7c012c4139118808af110fb8f0",
+    "sha256": "07xjmhca7z5bva03zk73d948qz0a3wnn4kvyy6j4cnp3w5giz5kc"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "992833ca741efe8f533c61abfaf129a1d8bfcfee",
-    "sha256": "1w8mq38k6s0fncqv113bw1pc7g10ysfmsbyg23hxh9fr5q4ia4q7"
+    "rev": "214f7ab9d3384a4123f14d9f6cd0205cf0aaa794",
+    "sha256": "1qd64w5c16gmpgi936dfjc0pn1a1rbs752k8lfqv2xwysx7qkqwi"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "47be9a51b01d9fd9e7f6dca81e98d4eedcec6d38",
-    "sha256": "167rp43c86xr4grzxs4bl46y6sf1q9xa0641mgp4r94g2ipxyc1d"
+    "rev": "fa8b07105b5e274daaa8adcc129fa4aa0447f9f7",
+    "sha256": "0mggqa8kixknbm1p5i5lkrmkj1na3b2xflj011dkjbj8wb78i42n"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
@@ -181,8 +181,8 @@
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "e7883bc64440b1ff4666272ac6eb710ee4bc221b",
-    "sha256": "1rj99y1f0wn6g1m2k53xkni5v79zgq25yv8b9wx2bz0n2r9iasca"
+    "rev": "b13b56904b76e96ea52d0efe56395acc94b17d96",
+    "sha256": "047asrq7c44v7cn2d7c5zba47qzpsb6nidba77i2xn7gqlfv6z3b"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
diff --git a/nixpkgs/pkgs/development/libraries/readline/readline-8.1-patches.nix b/nixpkgs/pkgs/development/libraries/readline/readline-8.1-patches.nix
index b8019fb33502..b2aaadf0e9b5 100644
--- a/nixpkgs/pkgs/development/libraries/readline/readline-8.1-patches.nix
+++ b/nixpkgs/pkgs/development/libraries/readline/readline-8.1-patches.nix
@@ -1,4 +1,6 @@
 # Automatically generated by `update-patch-set.sh'; do not edit.
 
 patch: [
+(patch "001" "0i4ikdqgcjnb40y2ss3lm09rq56zih5rzma3bib50dk3d1d4cak8")
+(patch "002" "1p15sfx5xg5k4lam12lyd0givk7dfjddqpnb1jdp3c4clray0nz5")
 ]
diff --git a/nixpkgs/pkgs/development/libraries/readline/update-patch-set.sh b/nixpkgs/pkgs/development/libraries/readline/update-patch-set.sh
new file mode 120000
index 000000000000..d4f5cd2f3126
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/readline/update-patch-set.sh
@@ -0,0 +1 @@
+../../../shells/bash/update-patch-set.sh
\ No newline at end of file
diff --git a/nixpkgs/pkgs/development/libraries/science/astronomy/stellarsolver/default.nix b/nixpkgs/pkgs/development/libraries/science/astronomy/stellarsolver/default.nix
index a214d28347de..933b972a4e79 100644
--- a/nixpkgs/pkgs/development/libraries/science/astronomy/stellarsolver/default.nix
+++ b/nixpkgs/pkgs/development/libraries/science/astronomy/stellarsolver/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "stellarsolver";
-  version = "1.9";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "rlancaste";
     repo = pname;
     rev = version;
-    sha256 = "sha256-PiRXNiemJ+UjVhmd2KPcTKJoDW9K9QBf62nkP1LlOfw=";
+    sha256 = "sha256-pqTSsey1CgOHiEm/C+7sTl9uGe3RVpL7Rdm04KgY+Z8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/development/libraries/science/math/amd-blis/default.nix b/nixpkgs/pkgs/development/libraries/science/math/amd-blis/default.nix
index cba9c28164a3..f04087302825 100644
--- a/nixpkgs/pkgs/development/libraries/science/math/amd-blis/default.nix
+++ b/nixpkgs/pkgs/development/libraries/science/math/amd-blis/default.nix
@@ -64,7 +64,7 @@ in stdenv.mkDerivation rec {
     description = "BLAS-compatible library optimized for AMD CPUs";
     homepage = "https://developer.amd.com/amd-aocl/blas-library/";
     license = licenses.bsd3;
-    maintainers = [ ];
+    maintainers = [ maintainers.markuskowa ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/nixpkgs/pkgs/development/libraries/science/math/amd-libflame/default.nix b/nixpkgs/pkgs/development/libraries/science/math/amd-libflame/default.nix
index b28fa43a2269..a5b657379411 100644
--- a/nixpkgs/pkgs/development/libraries/science/math/amd-libflame/default.nix
+++ b/nixpkgs/pkgs/development/libraries/science/math/amd-libflame/default.nix
@@ -6,8 +6,12 @@
 , amd-blis
 
 , withOpenMP ? true
+, blas64 ? false
 }:
 
+# right now only LP64 is supported
+assert !blas64;
+
 stdenv.mkDerivation rec {
   pname = "amd-libflame";
   version = "3.0";
@@ -26,6 +30,8 @@ stdenv.mkDerivation rec {
     ./add-lapacke.diff
   ];
 
+  passthru = { inherit blas64; };
+
   nativeBuildInputs = [ gfortran python3 ];
 
   buildInputs = [ amd-blis ];
diff --git a/nixpkgs/pkgs/development/libraries/science/math/blas/default.nix b/nixpkgs/pkgs/development/libraries/science/math/blas/default.nix
index cfdc102e0447..acb737836c0d 100644
--- a/nixpkgs/pkgs/development/libraries/science/math/blas/default.nix
+++ b/nixpkgs/pkgs/development/libraries/science/math/blas/default.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, gfortran }:
+{ lib, stdenv, fetchurl, cmake, gfortran
+# Wether to build with ILP64 interface
+, blas64 ? false
+}:
 
 stdenv.mkDerivation rec {
   pname = "blas";
@@ -9,50 +12,19 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-LjYNmcm9yEB6YYiMQKqFP7QhlCDruCZNtIbLiGBGirM=";
   };
 
-  nativeBuildInputs = [ gfortran ];
+  passthru = { inherit blas64; };
 
-  configurePhase = ''
-    echo >make.inc  "SHELL = ${stdenv.shell}"
-    echo >>make.inc "PLAT = _LINUX"
-    echo >>make.inc "FORTRAN = gfortran"
-    echo >>make.inc "OPTS = -O2 -fPIC"
-    echo >>make.inc "DRVOPTS = $$(OPTS)"
-    echo >>make.inc "NOOPT = -O0 -fPIC"
-    echo >>make.inc "LOADER = gfortran"
-    echo >>make.inc "LOADOPTS ="
-    echo >>make.inc "AR = gfortran"
-    echo >>make.inc "ARFLAGS = -shared -o"
-    echo >>make.inc "RANLIB = echo"
-    echo >>make.inc "BLASLIB = libblas.so.${version}"
-  '';
+  nativeBuildInputs = [ cmake gfortran ];
 
-  buildPhase = ''
-    make
-    echo >>make.inc "ARFLAGS = "
-    echo >>make.inc "BLASLIB = libblas.a"
-    echo >>make.inc "AR = ar rcs"
-    echo >>make.inc "RANLIB = ranlib"
-    make
-  '';
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ]
+    ++ lib.optional blas64 "-DBUILD_INDEX64=ON";
 
-  installPhase =
-    # FreeBSD's stdenv doesn't use Coreutils.
-    let dashD = if stdenv.isFreeBSD then "" else "-D"; in
-    (lib.optionalString stdenv.isFreeBSD "mkdir -p $out/lib ;")
-    + ''
-    install ${dashD} -m755 libblas.a "$out/lib/libblas.a"
-    install ${dashD} -m755 libblas.so.${version} "$out/lib/libblas.so.${version}"
-    ln -s libblas.so.${version} "$out/lib/libblas.so.3"
-    ln -s libblas.so.${version} "$out/lib/libblas.so"
-    # Write pkg-config alias.
-    # See also openblas/default.nix
-    mkdir $out/lib/pkgconfig
-    cat <<EOF > $out/lib/pkgconfig/blas.pc
-Name: blas
-Version: ${version}
-Description: blas provided by the BLAS package.
-Libs: -L$out/lib -lblas
-EOF
+  postInstall = let
+    canonicalExtension = if stdenv.hostPlatform.isLinux
+                       then "${stdenv.hostPlatform.extensions.sharedLibrary}.${lib.versions.major version}"
+                       else stdenv.hostPlatform.extensions.sharedLibrary;
+  in lib.optionalString blas64 ''
+    ln -s $out/lib/libblas64${canonicalExtension} $out/lib/libblas${canonicalExtension}
   '';
 
   preFixup = lib.optionalString stdenv.isDarwin ''
@@ -62,10 +34,11 @@ EOF
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Basic Linear Algebra Subprograms";
-    license = lib.licenses.publicDomain;
+    license = licenses.publicDomain;
+    maintainers = [ maintainers.markuskowa ];
     homepage = "http://www.netlib.org/blas/";
-    platforms = lib.platforms.unix;
+    platforms = platforms.unix;
   };
 }
diff --git a/nixpkgs/pkgs/development/libraries/science/math/liblapack/default.nix b/nixpkgs/pkgs/development/libraries/science/math/liblapack/default.nix
index f2a50cb2d3d4..9f481961e5bf 100644
--- a/nixpkgs/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/nixpkgs/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -5,6 +5,8 @@
 , gfortran
 , cmake
 , shared ? true
+# Compile with ILP64 interface
+, blas64 ? false
 }:
 
 stdenv.mkDerivation rec {
@@ -36,7 +38,19 @@ stdenv.mkDerivation rec {
     "-DLAPACKE=ON"
     "-DCBLAS=ON"
     "-DBUILD_TESTING=ON"
-  ] ++ lib.optional shared "-DBUILD_SHARED_LIBS=ON";
+  ] ++ lib.optional shared "-DBUILD_SHARED_LIBS=ON"
+    ++ lib.optional blas64 "-DBUILD_INDEX64=ON";
+
+  passthru = { inherit blas64; };
+
+  postInstall =  let
+    canonicalExtension = if stdenv.hostPlatform.isLinux
+                       then "${stdenv.hostPlatform.extensions.sharedLibrary}.${lib.versions.major version}"
+                       else stdenv.hostPlatform.extensions.sharedLibrary;
+  in lib.optionalString blas64 ''
+    ln -s $out/lib/liblapack64${canonicalExtension} $out/lib/liblapack${canonicalExtension}
+    ln -s $out/lib/liblapacke64${canonicalExtension} $out/lib/liblapacke${canonicalExtension}
+  '';
 
   doCheck = true;
 
@@ -63,7 +77,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linear Algebra PACKage";
     homepage = "http://www.netlib.org/lapack/";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ markuskowa ];
     license = licenses.bsd3;
     platforms = platforms.all;
   };
diff --git a/nixpkgs/pkgs/development/libraries/science/math/openblas/default.nix b/nixpkgs/pkgs/development/libraries/science/math/openblas/default.nix
index d61b6ee3acb0..8e5d71801158 100644
--- a/nixpkgs/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/nixpkgs/pkgs/development/libraries/science/math/openblas/default.nix
@@ -129,7 +129,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.19";
+  version = "0.3.20";
 
   outputs = [ "out" "dev" ];
 
@@ -137,7 +137,7 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-EqA6oFM2theuvvuDOWeOx0Bv6AEFffmpWHJBzp23br0=";
+    sha256 = "sha256-FLPVcepf7tv/es+4kur9Op7o3iVAAayuYN4hY/P4mmQ=";
   };
 
   inherit blas64;
diff --git a/nixpkgs/pkgs/development/libraries/speex/default.nix b/nixpkgs/pkgs/development/libraries/speex/default.nix
index a7d4aa970742..5509be7822d7 100644
--- a/nixpkgs/pkgs/development/libraries/speex/default.nix
+++ b/nixpkgs/pkgs/development/libraries/speex/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fftw, speexdsp }:
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, pkg-config, fftw, speexdsp }:
 
 stdenv.mkDerivation rec {
   pname = "speex";
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sed -i '/AC_CONFIG_MACRO_DIR/i PKG_PROG_PKG_CONFIG' configure.ac
   '';
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-23903.patch";
+      url = "https://github.com/xiph/speex/commit/870ff845b32f314aec0036641ffe18aba4916887.patch";
+      sha256 = "sha256-uEMDhDTw/LIWNPPCXW6kF+udBmNO88G/jJTojAA9fs8=";
+    })
+  ];
+
   outputs = [ "out" "dev" "doc" ];
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/nixpkgs/pkgs/development/libraries/tk/generic.nix b/nixpkgs/pkgs/development/libraries/tk/generic.nix
index 6aa67bf274de..fd4f3dea3750 100644
--- a/nixpkgs/pkgs/development/libraries/tk/generic.nix
+++ b/nixpkgs/pkgs/development/libraries/tk/generic.nix
@@ -3,7 +3,8 @@
 , ... }:
 
 tcl.mkTclDerivation {
-  name = "tk-${tcl.version}";
+  pname = "tk";
+  version = tcl.version;
 
   inherit src patches;
 
diff --git a/nixpkgs/pkgs/development/libraries/wxwidgets/3.1/default.nix b/nixpkgs/pkgs/development/libraries/wxwidgets/3.1/default.nix
deleted file mode 100644
index cab0197c9390..000000000000
--- a/nixpkgs/pkgs/development/libraries/wxwidgets/3.1/default.nix
+++ /dev/null
@@ -1,138 +0,0 @@
-{ lib, stdenv
-, fetchFromGitHub
-, fetchurl
-, pkg-config
-, libXinerama
-, libSM
-, libXxf86vm
-, libXtst
-, gtk2
-, GConf ? null
-, gtk3
-, xorgproto
-, gst_all_1
-, setfile
-, libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, withMesa ? libGLSupported
-, libGLU ? null
-, libGL ? null
-, compat28 ? false
-, compat30 ? true
-, unicode ? true
-, withGtk2 ? true
-, withWebKit ? false
-, webkitgtk ? null
-, AGL ? null
-, Carbon ? null
-, Cocoa ? null
-, Kernel ? null
-, QTKit ? null
-}:
-
-with lib;
-
-assert withMesa -> libGLU != null && libGL != null;
-assert withWebKit -> webkitgtk != null;
-
-assert assertMsg (withGtk2 -> withWebKit == false) "wxGTK31: You cannot enable withWebKit when using withGtk2.";
-
-stdenv.mkDerivation rec {
-  version = "3.1.4";
-  pname = "wxwidgets";
-
-  src = fetchFromGitHub {
-    owner = "wxWidgets";
-    repo = "wxWidgets";
-    rev = "v${version}";
-    sha256 = "1fwzrk6w5k0vs8kqdq5lpzdbp5c09hx740wg6mi6vgmc1r67dv67";
-    fetchSubmodules = true;
-  };
-
-  buildInputs = [
-    libXinerama
-    libSM
-    libXxf86vm
-    libXtst
-    xorgproto
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-  ] ++ optionals withGtk2 [ gtk2 GConf ]
-  ++ optional (!withGtk2) gtk3
-  ++ optional withMesa libGLU
-  ++ optional withWebKit webkitgtk
-  ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  propagatedBuildInputs = optional stdenv.isDarwin AGL;
-
-  patches = [
-    (fetchurl {
-      # https://trac.wxwidgets.org/ticket/17942
-      url = "https://trac.wxwidgets.org/raw-attachment/ticket/17942/"
-        + "fix_assertion_using_hide_in_destroy.diff";
-      sha256 = "009y3dav79wiig789vkkc07g1qdqprg1544lih79199kb1h64lvy";
-    })
-  ];
-
-  configureFlags =
-    [
-      "--disable-precomp-headers"
-      "--enable-mediactrl"
-      (if compat28 then "--enable-compat28" else "--disable-compat28")
-      (if compat30 then "--enable-compat30" else "--disable-compat30")
-    ]
-    ++ optional unicode "--enable-unicode"
-    ++ optional withMesa "--with-opengl"
-    ++ optionals stdenv.isDarwin
-      # allow building on 64-bit
-      [ "--with-cocoa" "--enable-universal-binaries" "--with-macosx-version-min=10.7" ]
-    ++ optionals withWebKit
-      [ "--enable-webview" "--enable-webviewwebkit" ];
-
-  SEARCH_LIB = "${libGLU.out}/lib ${libGL.out}/lib ";
-
-  preConfigure = "
-    substituteInPlace configure --replace 'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
-    substituteInPlace configure --replace 'SEARCH_LIB=' 'DUMMY_SEARCH_LIB='
-    substituteInPlace configure --replace /usr /no-such-path
-  " + optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace \
-      'ac_cv_prog_SETFILE="/Developer/Tools/SetFile"' \
-      'ac_cv_prog_SETFILE="${setfile}/bin/SetFile"'
-    substituteInPlace configure --replace \
-      "-framework System" \
-      -lSystem
-  '';
-
-  postInstall = "
-    (cd $out/include && ln -s wx-*/* .)
-  ";
-
-  passthru = {
-    inherit compat28 compat30 unicode;
-    gtk = if withGtk2 then gtk2 else gtk3;
-  };
-
-  enableParallelBuilding = true;
-
-  meta = {
-    platforms = with platforms; darwin ++ linux;
-    license = licenses.wxWindows;
-    homepage = "https://www.wxwidgets.org/";
-    description = "A C++ library that lets developers create applications for Windows, macOS, Linux and other platforms with a single code base";
-    longDescription = ''
-      WxWidgets gives you a single, easy-to-use API for
-      writing GUI applications on multiple platforms that still utilize the
-      native platform's controls and utilities. Link with the appropriate library
-      for your platform and compiler, and your application will adopt the look
-      and feel appropriate to that platform. On top of great GUI functionality,
-      wxWidgets gives you: online help, network programming, streams, clipboard
-      and drag and drop, multithreading, image loading and saving in a variety of
-      popular formats, database support, HTML viewing and printing, and much
-      more.
-    '';
-    badPlatforms = [ "x86_64-darwin" ];
-    maintainers = with maintainers; [ tfmoraes ];
-  };
-}
diff --git a/nixpkgs/pkgs/development/libraries/wxwidgets/2.8/default.nix b/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK28.nix
index 19a57d68e15b..19a57d68e15b 100644
--- a/nixpkgs/pkgs/development/libraries/wxwidgets/2.8/default.nix
+++ b/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK28.nix
diff --git a/nixpkgs/pkgs/development/libraries/wxwidgets/2.9/default.nix b/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK29.nix
index 34d76e53ff67..d5bef77202f1 100644
--- a/nixpkgs/pkgs/development/libraries/wxwidgets/2.9/default.nix
+++ b/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK29.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # https://github.com/wxWidgets/wxWidgets/issues/17942
-    ../patches/0001-fix-assertion-using-hide-in-destroy.patch
+    ./patches/0001-fix-assertion-using-hide-in-destroy.patch
   ];
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/libraries/wxwidgets/3.0/default.nix b/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK30.nix
index 628d8bd02377..115453303870 100644
--- a/nixpkgs/pkgs/development/libraries/wxwidgets/3.0/default.nix
+++ b/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK30.nix
@@ -12,8 +12,8 @@
 , pkg-config
 , xorgproto
 , withMesa ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, compat24 ? false
-, compat26 ? true
+, compat26 ? false
+, compat28 ? true
 , unicode ? true
 , withGtk2 ? true
 , withWebKit ? false, webkitgtk
@@ -69,14 +69,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     # https://github.com/wxWidgets/wxWidgets/issues/17942
-    ../patches/0001-fix-assertion-using-hide-in-destroy.patch
+    ./patches/0001-fix-assertion-using-hide-in-destroy.patch
   ];
 
   configureFlags = [
     "--disable-precomp-headers"
     "--enable-mediactrl"
-    (if compat24 then "--enable-compat24" else "--disable-compat24")
     (if compat26 then "--enable-compat26" else "--disable-compat26")
+    (if compat28 then "--enable-compat28" else "--disable-compat28")
   ]
   ++ lib.optional unicode "--enable-unicode"
   ++ lib.optional withMesa "--with-opengl"
@@ -136,6 +136,6 @@ stdenv.mkDerivation rec {
 
   passthru = {
     inherit gtk;
-    inherit compat24 compat26 unicode;
+    inherit compat26 compat28 unicode;
   };
 }
diff --git a/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK31.nix b/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK31.nix
new file mode 100644
index 000000000000..c262232f30d0
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/wxwidgets/wxGTK31.nix
@@ -0,0 +1,149 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchurl
+, gnome2
+, gst_all_1
+, gtk2
+, gtk3
+, libGL
+, libGLU
+, libSM
+, libXinerama
+, libXtst
+, libXxf86vm
+, pkg-config
+, xorgproto
+, compat28 ? false
+, compat30 ? true
+, unicode ? true
+, withGtk2 ? true
+, withMesa ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
+, withWebKit ? false, webkitgtk
+, darwin
+}:
+
+assert withMesa -> libGLU != null && libGL != null;
+assert withWebKit -> webkitgtk != null;
+
+assert withGtk2 -> (!withWebKit);
+
+let
+  inherit (darwin.stubs) setfile;
+  inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  inherit (gnome2) GConf;
+  inherit (gst_all_1) gst-plugins-base gstreamer;
+  gtk = if withGtk2 then gtk2 else gtk3;
+in
+stdenv.mkDerivation rec {
+  pname = "wxwidgets";
+  version = "3.1.5";
+
+  src = fetchFromGitHub {
+    owner = "wxWidgets";
+    repo = "wxWidgets";
+    rev = "v${version}";
+    hash = "sha256-2zMvcva0GUDmSYK0Wk3/2Y6R3F7MgdqGBrOhmWgVA6g=";
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    # https://github.com/wxWidgets/wxWidgets/issues/17942
+    ./patches/0001-fix-assertion-using-hide-in-destroy.patch
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    gst-plugins-base
+    gstreamer
+    gtk
+    libSM
+    libXinerama
+    libXtst
+    libXxf86vm
+    xorgproto
+  ]
+  ++ lib.optionals withGtk2 [
+    GConf
+  ]
+  ++ lib.optional withMesa libGLU
+  ++ lib.optional withWebKit webkitgtk
+  ++ lib.optionals stdenv.isDarwin [
+    Carbon
+    Cocoa
+    Kernel
+    QTKit
+    setfile
+  ];
+
+  propagatedBuildInputs = lib.optional stdenv.isDarwin AGL;
+
+  configureFlags = [
+    "--disable-precomp-headers"
+    "--enable-mediactrl"
+    (if compat28 then "--enable-compat28" else "--disable-compat28")
+    (if compat30 then "--enable-compat30" else "--disable-compat30")
+  ]
+  ++ lib.optional unicode "--enable-unicode"
+  ++ lib.optional withMesa "--with-opengl"
+  ++ lib.optionals stdenv.isDarwin [
+    # allow building on 64-bit
+    "--enable-universal-binaries"
+    "--with-cocoa"
+    "--with-macosx-version-min=10.7"
+  ]
+  ++ lib.optionals withWebKit [
+    "--enable-webview"
+    "--enable-webviewwebkit"
+  ];
+
+  SEARCH_LIB = "${libGLU.out}/lib ${libGL.out}/lib ";
+
+  preConfigure = ''
+    substituteInPlace configure --replace \
+      'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
+    substituteInPlace configure --replace \
+      'SEARCH_LIB=' 'DUMMY_SEARCH_LIB='
+    substituteInPlace configure --replace \
+      /usr /no-such-path
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure --replace \
+      'ac_cv_prog_SETFILE="/Developer/Tools/SetFile"' \
+      'ac_cv_prog_SETFILE="${setfile}/bin/SetFile"'
+    substituteInPlace configure --replace \
+      "-framework System" "-lSystem"
+  '';
+
+  postInstall = "
+    pushd $out/include
+    ln -s wx-*/* .
+    popd
+  ";
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://www.wxwidgets.org/";
+    description = "A Cross-Platform C++ GUI Library";
+    longDescription = ''
+      wxWidgets gives you a single, easy-to-use API for writing GUI applications
+      on multiple platforms that still utilize the native platform's controls
+      and utilities. Link with the appropriate library for your platform and
+      compiler, and your application will adopt the look and feel appropriate to
+      that platform. On top of great GUI functionality, wxWidgets gives you:
+      online help, network programming, streams, clipboard and drag and drop,
+      multithreading, image loading and saving in a variety of popular formats,
+      database support, HTML viewing and printing, and much more.
+    '';
+    license = licenses.wxWindows;
+    maintainers = with maintainers; [ AndersonTorres tfmoraes ];
+    platforms = platforms.unix;
+    badPlatforms = platforms.darwin; # ofBorg is failing, don't know if internal
+  };
+
+  passthru = {
+    inherit gtk;
+    inherit compat28 compat30 unicode;
+  };
+}
diff --git a/nixpkgs/pkgs/development/libraries/wxwidgets/3.0/mac.nix b/nixpkgs/pkgs/development/libraries/wxwidgets/wxmac30.nix
index e1f732929cec..e1f732929cec 100644
--- a/nixpkgs/pkgs/development/libraries/wxwidgets/3.0/mac.nix
+++ b/nixpkgs/pkgs/development/libraries/wxwidgets/wxmac30.nix
diff --git a/nixpkgs/pkgs/development/libraries/xdg-dbus-proxy/default.nix b/nixpkgs/pkgs/development/libraries/xdg-dbus-proxy/default.nix
index 21d6b6fa73e8..95373934a47a 100644
--- a/nixpkgs/pkgs/development/libraries/xdg-dbus-proxy/default.nix
+++ b/nixpkgs/pkgs/development/libraries/xdg-dbus-proxy/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-dbus-proxy";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchurl {
     url = "https://github.com/flatpak/xdg-dbus-proxy/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "03sj1h0c2l08xa8phw013fnxr4fgav7l2mkjhzf9xk3dykwxcj8p";
+    sha256 = "sha256-A7XSjKh5JT3bvOMQmJCb7MoUleqBGmN3pJLijxbAm5s=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/ocaml-modules/ppx_tools/default.nix b/nixpkgs/pkgs/development/ocaml-modules/ppx_tools/default.nix
index 59b7c29730aa..9ec1c24dbe3e 100644
--- a/nixpkgs/pkgs/development/ocaml-modules/ppx_tools/default.nix
+++ b/nixpkgs/pkgs/development/ocaml-modules/ppx_tools/default.nix
@@ -1,9 +1,9 @@
 { lib, stdenv, fetchFromGitHub, buildDunePackage, ocaml, findlib, cppo }:
 
 let param =
-  let v6_4 = {
-    version = "6.4";
-    sha256 = "15v7yfv6gyp8lzlgwi9garz10wpg34dk4072jdv19n6v20zfg7n1";
+  let v6_5 = {
+    version = "6.5";
+    sha256 = "sha256:0fwibah2hgllrnbdrmfqil5gr5raf6pb5h2zx6zs1h3d4ykvy8k8";
     useDune2 = true;
     nativeBuildInputs = [cppo];
     buildInputs = [cppo];
@@ -28,12 +28,13 @@ let param =
   "4.07" = {
     version = "5.1+4.06.0";
     sha256 = "1ww4cspdpgjjsgiv71s0im5yjkr3544x96wsq1vpdacq7dr7zwiw"; };
-  "4.08" = v6_4;
-  "4.09" = v6_4;
-  "4.10" = v6_4;
-  "4.11" = v6_4;
-  "4.12" = v6_4;
-  "4.13" = v6_4;
+  "4.08" = v6_5;
+  "4.09" = v6_5;
+  "4.10" = v6_5;
+  "4.11" = v6_5;
+  "4.12" = v6_5;
+  "4.13" = v6_5;
+  "4.14" = v6_5;
 }.${ocaml.meta.branch};
 in
 
diff --git a/nixpkgs/pkgs/development/python-modules/aiohttp/default.nix b/nixpkgs/pkgs/development/python-modules/aiohttp/default.nix
index f96fa8820384..f6d9b5d97ec7 100644
--- a/nixpkgs/pkgs/development/python-modules/aiohttp/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/aiohttp/default.nix
@@ -92,7 +92,10 @@ buildPythonPackage rec {
   # Probably because we run `python -m pytest` instead of `pytest` in the hook.
   preCheck = ''
     cd tests
-  '';
+  '' + lib.optionalString stdenv.isDarwin ''
+    # Work around "OSError: AF_UNIX path too long"
+    export TMPDIR="/tmp"
+   '';
 
   meta = with lib; {
     description = "Asynchronous HTTP Client/Server for Python and asyncio";
diff --git a/nixpkgs/pkgs/development/python-modules/aiosignal/default.nix b/nixpkgs/pkgs/development/python-modules/aiosignal/default.nix
index 1fd619a846aa..9d815dfac059 100644
--- a/nixpkgs/pkgs/development/python-modules/aiosignal/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/aiosignal/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aiosignal";
-  version = "1.2.0"; # re-enable tests after 1.2.0
+  version = "1.2.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     frozenlist
   ];
 
-  # not compatible w ith latest asyncio
-  doCheck = false;
   checkInputs = [
     pytest-asyncio
     pytestCheckHook
@@ -32,6 +30,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pytest.ini \
+      --replace "filterwarnings = error" "" \
       --replace "--cov=aiosignal" ""
   '';
 
diff --git a/nixpkgs/pkgs/development/python-modules/apycula/default.nix b/nixpkgs/pkgs/development/python-modules/apycula/default.nix
index d8a369d6da04..e84e3eb301b5 100644
--- a/nixpkgs/pkgs/development/python-modules/apycula/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/apycula/default.nix
@@ -12,17 +12,20 @@
 
 buildPythonPackage rec {
   pname = "apycula";
-  version = "0.2a2";
+  version = "0.2";
+  format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit version;
     pname = "Apycula";
-    hash = "sha256-pcVoYGBhp9jyuWBJ/Rpi8cjwDgPjhJ1PrPblj5DQTpk=";
+    hash = "sha256-xvr/NDAjCjhpImzNlCOcI4x5dIAefJ1TnUgoBhgdhPA=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     numpy
@@ -35,7 +38,9 @@ buildPythonPackage rec {
   # tests require a physical FPGA
   doCheck = false;
 
-  pythonImportsCheck = [ "apycula" ];
+  pythonImportsCheck = [
+    "apycula"
+  ];
 
   meta = with lib; {
     description = "Open Source tools for Gowin FPGAs";
diff --git a/nixpkgs/pkgs/development/python-modules/async_generator/default.nix b/nixpkgs/pkgs/development/python-modules/async_generator/default.nix
index fb7dec6d6ed4..6f6da10a87f9 100644
--- a/nixpkgs/pkgs/development/python-modules/async_generator/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/async_generator/default.nix
@@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy35, pytest, pytest-asyncio }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pytest-asyncio
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "async-generator";
@@ -12,17 +18,17 @@ buildPythonPackage rec {
     sha256 = "6ebb3d106c12920aaae42ccb6f787ef5eefdcdd166ea3d628fa8476abe712144";
   };
 
-  # no longer compatible with pytest-asyncio
-  doCheck = false;
-  checkInputs = [ pytest pytest-asyncio ];
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
-  checkPhase = ''
-    pytest -W error -ra -v --pyargs async_generator
-  '';
+  pythonImportsCheck = [ "async_generator" ];
 
   meta = with lib; {
     description = "Async generators and context managers for Python 3.5+";
     homepage = "https://github.com/python-trio/async_generator";
     license = with licenses; [ mit asl20 ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/azure-mgmt-netapp/default.nix b/nixpkgs/pkgs/development/python-modules/azure-mgmt-netapp/default.nix
index edf8057e503c..8c2ec661f8c1 100644
--- a/nixpkgs/pkgs/development/python-modules/azure-mgmt-netapp/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/azure-mgmt-netapp/default.nix
@@ -1,4 +1,7 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
 , azure-common
 , azure-mgmt-core
 , msrest
@@ -6,13 +9,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "6.0.1";
   pname = "azure-mgmt-netapp";
-  disabled = isPy27;
+  version = "7.0.0";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6ce683587be1638d8d77620b7af118060b8b7dfc4fd23d46a623a66edcb388e1";
+    hash = "sha256-ziaddG+6MoPG18OYZyQ9HRx8nfGsz2UbWPC1pWacKto=";
     extension = "zip";
   };
 
@@ -26,7 +30,10 @@ buildPythonPackage rec {
   # no tests included
   doCheck = false;
 
-  pythonImportsCheck = [ "azure.common" "azure.mgmt.netapp" ];
+  pythonImportsCheck = [
+    "azure.common"
+    "azure.mgmt.netapp"
+  ];
 
   meta = with lib; {
     description = "Microsoft Azure NetApp Files Management Client Library for Python";
diff --git a/nixpkgs/pkgs/development/python-modules/black/default.nix b/nixpkgs/pkgs/development/python-modules/black/default.nix
index 13f05fa61365..064fe8187edc 100644
--- a/nixpkgs/pkgs/development/python-modules/black/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/black/default.nix
@@ -1,8 +1,12 @@
-{ stdenv, lib
-, buildPythonPackage, fetchPypi, pythonOlder, setuptools-scm, pytestCheckHook
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools-scm
+, pytestCheckHook
 , aiohttp
 , aiohttp-cors
-, attrs
 , click
 , colorama
 , dataclasses
@@ -19,13 +23,13 @@
 
 buildPythonPackage rec {
   pname = "black";
-  version = "21.12b0";
+  version = "22.1.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d7gPaTpWni5SeVhFljTxjfmwuiYluk4MLV2lvkLm8rM=";
+    hash = "sha256-p8AZLTVjX2/BF0vldct5FekuXdYp7nn9rw3PpBqAr7U=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
@@ -61,17 +65,15 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     aiohttp
     aiohttp-cors
-    attrs
     click
     colorama
     mypy-extensions
     pathspec
     platformdirs
     tomli
-    typed-ast # required for tests and python2 extra
     uvloop
-  ] ++ lib.optional (pythonOlder "3.7") dataclasses
-    ++ lib.optional (pythonOlder "3.8") typing-extensions;
+  ] ++ lib.optional (pythonOlder "3.8") typed-ast
+  ++ lib.optional (pythonOlder "3.10") typing-extensions;
 
   meta = with lib; {
     description = "The uncompromising Python code formatter";
diff --git a/nixpkgs/pkgs/development/python-modules/cchardet/default.nix b/nixpkgs/pkgs/development/python-modules/cchardet/default.nix
index e1c27d9e4fb1..587d0d1f6c12 100644
--- a/nixpkgs/pkgs/development/python-modules/cchardet/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/cchardet/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , python
@@ -20,9 +21,14 @@ buildPythonPackage rec {
 
   checkInputs = [ nose ];
 
+  # on non x86-64 some charsets are identified as their superset, so we skip these tests (last checked with version 2.1.7)
   preCheck = ''
     cp -R src/tests $TMPDIR
     pushd $TMPDIR
+  '' + lib.optionalString (stdenv.hostPlatform.system != "x86_64-linux") ''
+    rm $TMPDIR/tests/testdata/th/tis-620.txt  # identified as iso-8859-11, which is fine for all practical purposes
+    rm $TMPDIR/tests/testdata/ga/iso-8859-1.txt  # identified as windows-1252, which is fine for all practical purposes
+    rm $TMPDIR/tests/testdata/fi/iso-8859-1.txt  # identified as windows-1252, which is fine for all practical purposes
   '';
 
   checkPhase = ''
diff --git a/nixpkgs/pkgs/development/python-modules/charset-normalizer/default.nix b/nixpkgs/pkgs/development/python-modules/charset-normalizer/default.nix
index ba7dd1db3b9a..d406ea15fbd3 100644
--- a/nixpkgs/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "charset-normalizer";
-  version = "2.0.10";
+  version = "2.0.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "Ousret";
     repo = "charset_normalizer";
     rev = version;
-    hash = "sha256-QsUqrC2oycvyCbOzGmHahgNi40YZ0sujb3Cj8EnsGS8=";
+    hash = "sha256-d5vWnZtFR669l1Meg4ZSsYIyBlJZya7SpXJMx2AP8NU=";
   };
 
   checkInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/check-manifest/default.nix b/nixpkgs/pkgs/development/python-modules/check-manifest/default.nix
index 608f3a0cac68..d55f5155b451 100644
--- a/nixpkgs/pkgs/development/python-modules/check-manifest/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/check-manifest/default.nix
@@ -8,22 +8,21 @@
 , pep517
 , pytestCheckHook
 , toml
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "check-manifest";
   version = "0.47";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "56dadd260a9c7d550b159796d2894b6d0bcc176a94cbc426d9bb93e5e48d12ce";
+    hash = "sha256-VtrdJgqcfVULFZeW0olLbQvMF2qUy8Qm2buT5eSNEs4=";
   };
 
-  # Test requires filesystem access
-  postPatch = ''
-    substituteInPlace tests.py --replace "test_build_sdist" "no_test_build_sdist"
-  '';
-
   propagatedBuildInputs = [
     build
     pep517
@@ -37,11 +36,18 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "check_manifest" ];
+  disabledTests = [
+    # Test wants to setup a venv
+    "test_build_sdist_pep517_isolated"
+  ];
+
+  pythonImportsCheck = [
+    "check_manifest"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/mgedmin/check-manifest";
     description = "Check MANIFEST.in in a Python source package for completeness";
+    homepage = "https://github.com/mgedmin/check-manifest";
     license = licenses.mit;
     maintainers = with maintainers; [ lewo ];
   };
diff --git a/nixpkgs/pkgs/development/python-modules/deep-translator/default.nix b/nixpkgs/pkgs/development/python-modules/deep-translator/default.nix
index fd6d4d478f46..a4f71774c4db 100644
--- a/nixpkgs/pkgs/development/python-modules/deep-translator/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/deep-translator/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "deep-translator";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2u4ZmLUEOwbN2sbPgLu9R1VdNevXBP4lBFuGw2aiRMg=";
+    sha256 = "sha256-Oi5dzrC19PnlExCOgu+bT5n3/XwgJkDirzl8ra8w7Nw=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/django-picklefield/default.nix b/nixpkgs/pkgs/development/python-modules/django-picklefield/default.nix
index 4710de2c7ecb..b1dab2e73c91 100644
--- a/nixpkgs/pkgs/development/python-modules/django-picklefield/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/django-picklefield/default.nix
@@ -1,8 +1,9 @@
-{ lib, buildPythonPackage, fetchFromGitHub, django, pytest, pytest-django }:
+{ lib, buildPythonPackage, fetchFromGitHub, django, pytest, pytest-django, python }:
 
 buildPythonPackage rec {
   pname = "django-picklefield";
   version = "3.0.1";
+  format = "setuptools";
 
   # The PyPi source doesn't contain tests
   src = fetchFromGitHub {
@@ -14,17 +15,20 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ django ];
 
-  checkInputs = [ pytest pytest-django ];
+  # Tests are failing with Django 3.2
+  # https://github.com/gintas/django-picklefield/issues/58
+  doCheck = false;
 
   checkPhase = ''
-    PYTHONPATH="$(pwd):$PYTHONPATH" \
-    DJANGO_SETTINGS_MODULE=tests.settings \
-      pytest tests/tests.py
+    runHook preCheck
+    ${python.interpreter} -m django test --settings=tests.settings
+    runHook postCheck
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A pickled object field for Django";
     homepage = "https://github.com/gintas/django-picklefield";
-    license = lib.licenses.mit;
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/django/2.nix b/nixpkgs/pkgs/development/python-modules/django/2.nix
index c4df27beaaa2..727bf304fdb2 100644
--- a/nixpkgs/pkgs/development/python-modules/django/2.nix
+++ b/nixpkgs/pkgs/development/python-modules/django/2.nix
@@ -5,13 +5,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Django";
+  pname = "django";
   version = "2.2.27";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Django";
+    inherit version;
     sha256 = "sha256-HuNwRrC/K2HoOzoB0GcyNRbsO28rF81JsTJt1LqdyRM=";
   };
 
diff --git a/nixpkgs/pkgs/development/python-modules/django/3.nix b/nixpkgs/pkgs/development/python-modules/django/3.nix
index 3ed7024c3499..1538b8a82b47 100644
--- a/nixpkgs/pkgs/development/python-modules/django/3.nix
+++ b/nixpkgs/pkgs/development/python-modules/django/3.nix
@@ -12,13 +12,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Django";
+  pname = "django";
   version = "3.2.12";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Django";
+    inherit version;
     sha256 = "sha256-l3Lmk1cD5Z6ZOWCDLWamFM8CM6HFEjvGIk7MataeQeI=";
   };
 
diff --git a/nixpkgs/pkgs/development/python-modules/eventlet/default.nix b/nixpkgs/pkgs/development/python-modules/eventlet/default.nix
index 7c8f520647ee..096279b3453a 100644
--- a/nixpkgs/pkgs/development/python-modules/eventlet/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/eventlet/default.nix
@@ -57,6 +57,8 @@ buildPythonPackage rec {
     "test_hosts_no_network"
     "test_leakage_from_tracebacks"
     "test_patcher_existing_locks_locked"
+    # broken with pyopenssl 22.0.0
+    "test_sendall_timeout"
   ];
 
   disabledTestPaths = [
diff --git a/nixpkgs/pkgs/development/python-modules/frozenlist/default.nix b/nixpkgs/pkgs/development/python-modules/frozenlist/default.nix
index 34660645b596..1bc295fbe332 100644
--- a/nixpkgs/pkgs/development/python-modules/frozenlist/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/frozenlist/default.nix
@@ -8,14 +8,16 @@
 
 buildPythonPackage rec {
   pname = "frozenlist";
-  version = "1.2.0";
-  disabled = pythonOlder "3.6";
+  version = "1.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rTbekdceC5QK0aiySi/4QUwaEoDfTlLrx2t6Kb9bH7U=";
+    hash = "sha256-cHKqkvsBUN7If+8swbd6aafFrSgnop3YlweBLPOHzyU=";
   };
 
   nativeBuildInputs = [
@@ -35,7 +37,9 @@ buildPythonPackage rec {
     cython frozenlist/_frozenlist.pyx
   '';
 
-  pythonImportsCheck = [ "frozenlist" ];
+  pythonImportsCheck = [
+    "frozenlist"
+  ];
 
   meta = with lib; {
     description = "Python module for list-like structure";
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index e3c3e05ac183..f7c79521b632 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-apn1ex/2VX18GHgN5+JYurzTKMqzPTNqTNOAI+DEBLw=";
+    sha256 = "sha256-W93SDJR8bUPQX9KzoZ6YvV9kU+Twd9huH09Smap481g=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-storage/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-storage/default.nix
index f77c718ed8b9..bce214102094 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0a5e7ab1a38d2c24be8e566e50b8b0daa8af8fd49d4ab312b1fda5c147429893";
+    sha256 = "sha256-01mWgBE11R20m7j3p+Kc7cwlqotDXu0MTA7y+e5W0dk=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix b/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
index 13b26e337ac2..3917742a55a9 100644
--- a/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -10,15 +10,15 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "4.10.1";
-  format = "setuptools";
+  version = "4.11.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    hash = "sha256-lR8NiltyYOnbXkHUKShbX0UekoR58Z2AgYh4Un026V4=";
+    hash = "sha256-nl5VO7uhhDy0oAgjAUuQdha+Ru5QPSuboAHSFKjaIY8=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/iniconfig/default.nix b/nixpkgs/pkgs/development/python-modules/iniconfig/default.nix
index 90761f76f9d5..a8a4a611fee6 100644
--- a/nixpkgs/pkgs/development/python-modules/iniconfig/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/iniconfig/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, setuptools-scm }:
 
 buildPythonPackage rec {
   pname = "iniconfig";
@@ -9,12 +9,14 @@ buildPythonPackage rec {
     sha256 = "bc3af051d7d14b2ee5ef9969666def0cd1a000e121eaea580d4a313df4b37f32";
   };
 
+  nativeBuildInputs = [ setuptools-scm ];
+
   doCheck = false; # avoid circular import with pytest
   pythonImportsCheck = [ "iniconfig" ];
 
   meta = with lib; {
     description = "brain-dead simple parsing of ini files";
-    homepage = "https://github.com/RonnyPfannschmidt/iniconfig";
+    homepage = "https://github.com/pytest-dev/iniconfig";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
   };
diff --git a/nixpkgs/pkgs/development/python-modules/ipython/default.nix b/nixpkgs/pkgs/development/python-modules/ipython/default.nix
index 432f83e75cc5..c1c0b049dc8c 100644
--- a/nixpkgs/pkgs/development/python-modules/ipython/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/ipython/default.nix
@@ -26,7 +26,7 @@
 , testpath
 }:
 
-buildPythonPackage (rec {
+buildPythonPackage rec {
   pname = "ipython";
   version = "8.0.1";
   format = "pyproject";
@@ -76,14 +76,15 @@ buildPythonPackage (rec {
     testpath
   ];
 
+  disabledTests = lib.optionals (stdenv.isDarwin) [
+    # FileNotFoundError: [Errno 2] No such file or directory: 'pbpaste'
+    "test_clipboard_get"
+  ];
+
   meta = with lib; {
     description = "IPython: Productive Interactive Computing";
     homepage = "http://ipython.org/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ bjornfor fridh ];
   };
-} // lib.optionalAttrs stdenv.isDarwin {
-  disabledTests = [
-    "test_clipboard_get" # uses pbpaste
-  ];
-})
+}
diff --git a/nixpkgs/pkgs/development/python-modules/jedi/default.nix b/nixpkgs/pkgs/development/python-modules/jedi/default.nix
index d9884ab3d9f5..f271920706fa 100644
--- a/nixpkgs/pkgs/development/python-modules/jedi/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/jedi/default.nix
@@ -3,9 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, colorama
 , django
-, docopt
 , pytestCheckHook
 , parso
 }:
@@ -26,9 +24,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ parso ];
 
   checkInputs = [
-    colorama
     django
-    docopt
     pytestCheckHook
   ];
 
@@ -50,7 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/davidhalter/jedi";
     description = "An autocompletion tool for Python that can be used for text editors";
-    license = licenses.lgpl3Plus;
+    license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/jupyterlab/default.nix b/nixpkgs/pkgs/development/python-modules/jupyterlab/default.nix
index c000bb050d89..fbea0935ff30 100644
--- a/nixpkgs/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/jupyterlab/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "3.3.1";
+  version = "3.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zkgnmTeccKqH5jtZ4sU3l3nOGGWLkkYM0gu0QVSGWXM=";
+    sha256 = "sha256-PHFr9VkssoxcVcYVxuW9PvxxiY9pV9E3GbVkeLu7WHo=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/moto/default.nix b/nixpkgs/pkgs/development/python-modules/moto/default.nix
index a998e7b74b41..1d9d07743798 100644
--- a/nixpkgs/pkgs/development/python-modules/moto/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/moto/default.nix
@@ -264,6 +264,8 @@ buildPythonPackage rec {
     "test_state_machine_creation_fails_with_invalid_names"
     # needs graphql
     "test_get_schema_creation_status"
+    # only appears in aarch64 currently, but best to be safe
+    "test_state_machine_list_executions_with_filter"
   ];
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/development/python-modules/pbr/default.nix b/nixpkgs/pkgs/development/python-modules/pbr/default.nix
index 8775faa53c24..7a03226b4dde 100644
--- a/nixpkgs/pkgs/development/python-modules/pbr/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pbr/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "5.8.0";
+  version = "5.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "672d8ebee84921862110f23fcec2acea191ef58543d34dfe9ef3d9f13c31cddf";
+    sha256 = "sha256-ZrxaNJEvQIuzklvyEjHLb1kgYme39j81A++GXBopLiU=";
   };
 
   propagatedBuildInputs = [ setuptools ];
diff --git a/nixpkgs/pkgs/development/python-modules/pbr/tests.nix b/nixpkgs/pkgs/development/python-modules/pbr/tests.nix
index b31334589f5d..aacb726d6a1d 100644
--- a/nixpkgs/pkgs/development/python-modules/pbr/tests.nix
+++ b/nixpkgs/pkgs/development/python-modules/pbr/tests.nix
@@ -1,8 +1,8 @@
 { buildPythonPackage
+, build
 , git
 , gnupg
 , pbr
-, mock
 , sphinx
 , stestr
 , testresources
@@ -27,9 +27,9 @@ buildPythonPackage rec {
 
   checkInputs = [
     pbr
+    build
     git
     gnupg
-    mock
     sphinx
     stestr
     testresources
diff --git a/nixpkgs/pkgs/development/python-modules/pillow/default.nix b/nixpkgs/pkgs/development/python-modules/pillow/default.nix
index c1df3ce27513..8aa1ad1f4c4d 100644
--- a/nixpkgs/pkgs/development/python-modules/pillow/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pillow/default.nix
@@ -7,13 +7,13 @@
 
 import ./generic.nix (rec {
   pname = "Pillow";
-  version = "9.0.0";
+  version = "9.0.1";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0gjry0yqryd2678sm47jhdnbghzxn5wk8pgyaqwr4qi7x5ijjvpf";
+    sha256 = "bIvII4p9/a96dfXsWmY/QXP4w2flo5+H5yBJXh7tdfo=";
   };
 
   passthru.tests = {
diff --git a/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix b/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
index 83c697aa7c86..d36ba25ba474 100644
--- a/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "plaid-python";
-  version = "9.1.0";
+  version = "9.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jvg/2dL+W4N7rbbBcIUZUrSt0BCV15k4QgYST2lEA5U=";
+    hash = "sha256-vHJ35MvMw3G1k/A2gifaE97GayoVEOQ9lR6yG6ZkzS4=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/platformdirs/default.nix b/nixpkgs/pkgs/development/python-modules/platformdirs/default.nix
index f2e865991487..2be8928f630f 100644
--- a/nixpkgs/pkgs/development/python-modules/platformdirs/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.4.1";
+  version = "2.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ce1dwE2g/7o91NPkmlM0uv0eMB7WzFCExV/8ZCAn22Y=";
+    sha256 = "sha256-fppwtY8VX8IQ96H930xItO7mS8LlxxHgBcKlwIL5P2E=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/nixpkgs/pkgs/development/python-modules/py3status/default.nix b/nixpkgs/pkgs/development/python-modules/py3status/default.nix
index a5de75f70f88..c56fc990f2c5 100644
--- a/nixpkgs/pkgs/development/python-modules/py3status/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/py3status/default.nix
@@ -24,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "py3status";
-  version = "3.41";
+  version = "3.42";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2G+5lKkLtgZ/2ghU0xVTDqIXbTNykYIKRiwZiagusoc=";
+    sha256 = "sha256-2/YT36X4UvmmhiaxyJBtCKA3QuibYtReTS6MQ3YGV+c=";
   };
 
   doCheck = false;
diff --git a/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix b/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
index 44e7ed0ad4aa..e3e4e6c3a03a 100644
--- a/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
@@ -6,13 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.12.0";
+  version = "3.14.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Esc0OuxaOz31xHJlKBsSthHybsk2e2EpGZ1n2lS3aME=";
-    extension = "zip";
+    hash = "sha256-4E5Ap/jBZpGVU2o3l53YfaLDLb3HPW/jXwB3sMF8gDs=";
   };
 
   pythonImportsCheck = [
diff --git a/nixpkgs/pkgs/development/python-modules/pycryptodomex/default.nix b/nixpkgs/pkgs/development/python-modules/pycryptodomex/default.nix
index c9f622d6c699..934c021ed909 100644
--- a/nixpkgs/pkgs/development/python-modules/pycryptodomex/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pycryptodomex/default.nix
@@ -6,13 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pycryptodomex";
-  version = "3.12.0";
+  version = "3.14.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ki6drAFm5GF+XHmA0s/2kSputctcE+fs4iJDhlC9f2Y=";
-    extension = "zip";
+    hash = "sha256-LOdu0Agf1qyMdO3HW50U7KIGQXOveYQ8JPpiVzJjwfI=";
   };
 
   pythonImportsCheck = [
diff --git a/nixpkgs/pkgs/development/python-modules/pyopenssl/default.nix b/nixpkgs/pkgs/development/python-modules/pyopenssl/default.nix
index 16bfddc8340a..e4655082af92 100644
--- a/nixpkgs/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pyopenssl/default.nix
@@ -6,17 +6,50 @@
 , cryptography
 , pyasn1
 , idna
-, pytest
+, pytestCheckHook
 , pretend
 , flaky
 , glibcLocales
 , six
 }:
 
-let
-  # https://github.com/pyca/pyopenssl/issues/791
-  # These tests, we disable in the case that libressl is passed in as openssl.
-  failingLibresslTests = [
+buildPythonPackage rec {
+  pname = "pyopenssl";
+  version = "22.0.0";
+
+  src = fetchPypi {
+    pname = "pyOpenSSL";
+    inherit version;
+    sha256 = "sha256-ZgsbFCWqxKG+odlBaKhdmfCzFEyGndQ5DSdinQCH8b8=";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
+  # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
+  doCheck = !stdenv.isDarwin;
+
+  nativeBuildInputs = [ openssl ];
+  propagatedBuildInputs = [ cryptography pyasn1 idna six ];
+
+  checkInputs = [ pytestCheckHook pretend flaky glibcLocales ];
+
+  preCheck = ''
+    export LANG="en_US.UTF-8"
+  '';
+
+  disabledTests = [
+    # https://github.com/pyca/pyopenssl/issues/692
+    # These tests, we disable always.
+    "test_set_default_verify_paths"
+    "test_fallback_default_verify_paths"
+    # https://github.com/pyca/pyopenssl/issues/768
+    "test_wantWriteError"
+    # https://github.com/pyca/pyopenssl/issues/1043
+    "test_alpn_call_failure"
+  ] ++ lib.optionals (lib.hasPrefix "libressl" openssl.meta.name) [
+    # https://github.com/pyca/pyopenssl/issues/791
+    # These tests, we disable in the case that libressl is passed in as openssl.
     "test_op_no_compression"
     "test_npn_advertise_error"
     "test_npn_select_error"
@@ -29,66 +62,21 @@ let
     "test_verify_with_revoked"
     "test_set_notAfter"
     "test_set_notBefore"
-  ];
-
-  # these tests are extremely tightly wed to the exact output of the openssl cli tool,
-  # including exact punctuation.
-  failingOpenSSL_1_1Tests = [
+  ] ++ lib.optionals (lib.versionAtLeast (lib.getVersion openssl.name) "1.1") [
+    # these tests are extremely tightly wed to the exact output of the openssl cli tool, including exact punctuation.
     "test_dump_certificate"
     "test_dump_privatekey_text"
     "test_dump_certificate_request"
     "test_export_text"
-  ];
-
-  disabledTests = [
-    # https://github.com/pyca/pyopenssl/issues/692
-    # These tests, we disable always.
-    "test_set_default_verify_paths"
-    "test_fallback_default_verify_paths"
-    # https://github.com/pyca/pyopenssl/issues/768
-    "test_wantWriteError"
-    # https://github.com/pyca/pyopenssl/issues/1043
-    "test_alpn_call_failure"
-  ] ++ (
-    lib.optionals (lib.hasPrefix "libressl" openssl.meta.name) failingLibresslTests
-  ) ++ (
-    lib.optionals (lib.versionAtLeast (lib.getVersion openssl.name) "1.1") failingOpenSSL_1_1Tests
-  ) ++ (
+  ] ++ lib.optionals stdenv.is32bit [
     # https://github.com/pyca/pyopenssl/issues/974
-    lib.optionals stdenv.is32bit [ "test_verify_with_time" ]
-  );
-
-  # Compose the final string expression, including the "-k" and the single quotes.
-  testExpression = lib.optionalString (disabledTests != [])
-    "-k 'not ${lib.concatStringsSep " and not " disabledTests}'";
-
-in
-
-buildPythonPackage rec {
-  pname = "pyopenssl";
-  version = "21.0.0";
+    "test_verify_with_time"
+  ];
 
-  src = fetchPypi {
-    pname = "pyOpenSSL";
-    inherit version;
-    sha256 = "5e2d8c5e46d0d865ae933bef5230090bdaf5506281e9eec60fa250ee80600cb3";
+  meta = with lib; {
+    description = "Python wrapper around the OpenSSL library";
+    homepage = "https://github.com/pyca/pyopenssl";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
-  outputs = [ "out" "dev" ];
-
-  checkPhase = ''
-    runHook preCheck
-    export LANG="en_US.UTF-8"
-    py.test tests ${testExpression}
-    runHook postCheck
-  '';
-
-  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
-  # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
-  doCheck = !stdenv.isDarwin;
-
-  nativeBuildInputs = [ openssl ];
-  propagatedBuildInputs = [ cryptography pyasn1 idna six ];
-
-  checkInputs = [ pytest pretend flaky glibcLocales ];
 }
diff --git a/nixpkgs/pkgs/development/python-modules/pyramid_exclog/default.nix b/nixpkgs/pkgs/development/python-modules/pyramid_exclog/default.nix
index 96570fce884f..2d23256ff844 100644
--- a/nixpkgs/pkgs/development/python-modules/pyramid_exclog/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pyramid_exclog/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyramid_exclog";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d05ced5c12407507154de6750036bc83861b85c11be70b3ec3098c929652c14b";
+    sha256 = "sha256-Tl2rYH/GifNfB9w4nG9UIqAQz0O6kujCED/4iZnPKDw=";
   };
 
   propagatedBuildInputs = [ pyramid ];
diff --git a/nixpkgs/pkgs/development/python-modules/pytest-aiohttp/default.nix b/nixpkgs/pkgs/development/python-modules/pytest-aiohttp/default.nix
index 4e45477c8caa..794bbce74e0c 100644
--- a/nixpkgs/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -1,20 +1,45 @@
-{ lib, buildPythonPackage, fetchPypi, pytest, aiohttp }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, setuptools-scm
+, aiohttp
+, pytest
+, pytest-asyncio
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pytest-aiohttp";
-  version = "0.3.0";
+  version = "1.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0kx4mbs9bflycd8x9af0idcjhdgnzri3nw1qb0vpfyb3751qaaf9";
+    hash = "sha256-DI/rSNyOuAhw4rFTrK9iu7zCB5d+vLdDZf/P4WrcnxU=";
   };
 
-  buildInputs = [ pytest ];
+  patches = [
+    # https://github.com/aio-libs/pytest-aiohttp/pull/26
+    (fetchpatch {
+      name = "fix-tests-with-pytest-asyncio-0.18.0.patch";
+      url = "https://github.com/aio-libs/pytest-aiohttp/commit/97152c2dfdd368f799ec6bcb5fc315736a726f53.patch";
+      hash = "sha256-g7MTyCKUHnufOfrbhVV58WtfbGt1uXx8F7U9U+EaXfg=";
+    })
+  ];
 
-  propagatedBuildInputs = [ aiohttp ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
-  # There are no tests
-  doCheck = false;
+  propagatedBuildInputs = [
+    aiohttp
+    pytest
+    pytest-asyncio
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/aio-libs/pytest-aiohttp/";
diff --git a/nixpkgs/pkgs/development/python-modules/pytest-asyncio/default.nix b/nixpkgs/pkgs/development/python-modules/pytest-asyncio/default.nix
index 6401e1ce2c9b..b8d3dffa3b0b 100644
--- a/nixpkgs/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -11,16 +11,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "0.17.2";
+  version = "0.18.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4wDXvO6pDK0dQLnyfJTTa+GXf9Qtsi6ywYDUIdhkgGo=";
+    hash = "sha256-PE66ogjfzj6cW3+UD5nZHSt6zg7b+j6Q4ACznE4j0j8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -36,6 +36,7 @@ buildPythonPackage rec {
   checkInputs = [
     flaky
     hypothesis
+    flaky
     pytestCheckHook
   ];
 
@@ -44,9 +45,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "library for testing asyncio code with pytest";
+    description = "Library for testing asyncio code with pytest";
     homepage = "https://github.com/pytest-dev/pytest-asyncio";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/pytest-cases/default.nix b/nixpkgs/pkgs/development/python-modules/pytest-cases/default.nix
index 766e07543879..5d4d8d1798fc 100644
--- a/nixpkgs/pkgs/development/python-modules/pytest-cases/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pytest-cases/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-cases";
-  version = "3.6.9";
+  version = "3.6.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Bf9favhlHcGj8nf1JxTkMjpo8hMyfBHgMCilOcIL2Sk=";
+    sha256 = "sha256-W8Syxgl/lPqDX2zdzvpk3Q/0aNBWM8JeUOXGDBYyamM=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/pytest-mock/default.nix b/nixpkgs/pkgs/development/python-modules/pytest-mock/default.nix
index 7f07ed2b6dd1..94db409be918 100644
--- a/nixpkgs/pkgs/development/python-modules/pytest-mock/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pytest-mock/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pytest
 , pytest-asyncio
 , pytestCheckHook
 , setuptools-scm
@@ -8,15 +9,19 @@
 
 buildPythonPackage rec {
   pname = "pytest-mock";
-  version = "3.6.1";
+  version = "3.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "40217a058c52a63f1042f0784f62009e976ba824c418cced42e88d5f40ab0e62";
+    hash = "sha256-URK9ksyfGG7pbhqS78hJaepJSTnDrq05xQ9CHEzGlTQ=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
 
+  propagatedBuildInputs = [
+    pytest
+  ];
+
   checkInputs = [
     pytest-asyncio
     pytestCheckHook
@@ -34,6 +39,6 @@ buildPythonPackage rec {
     description = "Thin-wrapper around the mock package for easier use with pytest";
     homepage = "https://github.com/pytest-dev/pytest-mock";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/pyyaml/default.nix b/nixpkgs/pkgs/development/python-modules/pyyaml/default.nix
index 2c0e893b9c50..10f78ab5e14b 100644
--- a/nixpkgs/pkgs/development/python-modules/pyyaml/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/pyyaml/default.nix
@@ -8,7 +8,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyYAML";
+  pname = "pyyaml";
   version = "6.0";
 
   disabled = pythonOlder "3.6";
diff --git a/nixpkgs/pkgs/development/python-modules/regex/default.nix b/nixpkgs/pkgs/development/python-modules/regex/default.nix
index b96c7ca89956..86e591eaf14f 100644
--- a/nixpkgs/pkgs/development/python-modules/regex/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/regex/default.nix
@@ -2,25 +2,28 @@
 , buildPythonPackage
 , fetchPypi
 , python
-, isPy27
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2021.11.10";
+  version = "2022.1.18";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-80HuLfCZm/33qV5EgHXv/g2yEqWTh94acGkOSssD1MY=";
+    hash = "sha256-l/MtwDqAVKTEpatddh7Uhh6CiywgD+vU5GhXBppIORY=";
   };
 
-  # Sources for different Python releases are located in same folder
   checkPhase = ''
-    rm -r ${if !isPy27 then "regex_2" else "regex_3"}
     ${python.interpreter} -m unittest
   '';
 
-  pythonImportsCheck = [ "regex" ];
+  pythonImportsCheck = [
+    "regex"
+  ];
 
   meta = with lib; {
     description = "Alternative regular expression module, to replace re";
diff --git a/nixpkgs/pkgs/development/python-modules/responses/default.nix b/nixpkgs/pkgs/development/python-modules/responses/default.nix
index 86e37419c72d..95861bda181c 100644
--- a/nixpkgs/pkgs/development/python-modules/responses/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/responses/default.nix
@@ -5,25 +5,23 @@
 , pytestCheckHook
 , pythonOlder
 , requests
-, six
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.17.0";
+  version = "0.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7GdeCA0Gv40fteWmih5c0N9GsJx4IwMV9lCvXkA2vsc=";
+    hash = "sha256-OAytTBwdyULl6KjqrgtNTt9wj08BDbi3vPr60fzSVP8=";
   };
 
   propagatedBuildInputs = [
     requests
-    six
     urllib3
   ];
 
diff --git a/nixpkgs/pkgs/development/python-modules/ruamel-yaml/default.nix b/nixpkgs/pkgs/development/python-modules/ruamel-yaml/default.nix
index 79f21ba6aabd..31d76d78ac7e 100644
--- a/nixpkgs/pkgs/development/python-modules/ruamel-yaml/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/ruamel-yaml/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "ruamel-yaml";
-  version = "0.17.20";
+  version = "0.17.21";
 
   src = fetchPypi {
     pname = "ruamel.yaml";
     inherit version;
-    sha256 = "sha256-S4ozwe+ytEOpP8qvz6TS5EX46MKcUo2fXNr7fMnkAEw=";
+    sha256 = "sha256-i3zml6LyEnUqNcGsQURx3BbEJMlXO+SSa1b/P10jt68=";
   };
 
   # Tests use relative paths
diff --git a/nixpkgs/pkgs/development/python-modules/sabyenc3/default.nix b/nixpkgs/pkgs/development/python-modules/sabyenc3/default.nix
index 2e44326acc40..d2dbb2e40581 100644
--- a/nixpkgs/pkgs/development/python-modules/sabyenc3/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/sabyenc3/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "sabyenc3";
-  version = "5.1.0";
+  version = "5.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-y2I/kSyPIPSz7PrwW/AbP4BsEXHWQgXRb1VT0nTHQcE=";
+    hash = "sha256-muqJCn5FcSp5KNZqfW433NCOxfj1DvFvlZPClmNkPR0=";
   };
 
   # Tests are not included in pypi distribution
diff --git a/nixpkgs/pkgs/development/python-modules/semantic-version/default.nix b/nixpkgs/pkgs/development/python-modules/semantic-version/default.nix
index e939142fd82f..d3ca44596193 100644
--- a/nixpkgs/pkgs/development/python-modules/semantic-version/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/semantic-version/default.nix
@@ -1,20 +1,35 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pythonOlder
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
-  pname = "semantic_version";
-  version = "2.8.5";
+  pname = "semantic-version";
+  version = "2.9.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "d2cb2de0558762934679b9a104e82eca7af448c9f4974d1f3eeccff651df8a54";
+    pname = "semantic_version";
+    inherit version;
+    sha256 = "sha256-q/VIc1U+Xgem/U1fZTt4H1rkEpekk2ZrWdzyFABqErI=";
   };
 
-  # ModuleNotFoundError: No module named 'tests'
-  doCheck = false;
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "semantic_version"
+  ];
 
   meta = with lib; {
     description = "A library implementing the 'SemVer' scheme";
-    license = licenses.bsdOriginal;
+    homepage = "https://github.com/rbarrois/python-semanticversion/";
+    license = licenses.bsd2;
     maintainers = with maintainers; [ layus makefu ];
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/snitun/default.nix b/nixpkgs/pkgs/development/python-modules/snitun/default.nix
index d1645e1fbe74..1b7bd7341ebf 100644
--- a/nixpkgs/pkgs/development/python-modules/snitun/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/snitun/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "NabuCasa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ehafb35H462Ffn6omGh/MDJKQX5qJJZeiIBO3n0IGlA=";
+    hash = "sha256-Ehafb35H462Ffn6omGh/MDJKQX5qJJZeiIBO3n0IGlA=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/stack-data/default.nix b/nixpkgs/pkgs/development/python-modules/stack-data/default.nix
index cbbd3a878d7e..eb9879a4bf02 100644
--- a/nixpkgs/pkgs/development/python-modules/stack-data/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/stack-data/default.nix
@@ -1,5 +1,6 @@
 { asttokens
 , buildPythonPackage
+, cython
 , executing
 , fetchFromGitHub
 , git
@@ -15,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "stack-data";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "alexmojaki";
     repo = "stack_data";
     rev = "v${version}";
-    sha256 = "sha256-dRIRDMq0tc1QuBHvppPwJA5PVGHyVRhoBlX5BsdDzec=";
+    sha256 = "sha256-brXFrk1UU5hxCVeRvGK7wzRA0Hoj9fgqoxTIwInPrEc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -39,6 +40,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    cython
     littleutils
     pygments
     pytestCheckHook
diff --git a/nixpkgs/pkgs/development/python-modules/thinc/default.nix b/nixpkgs/pkgs/development/python-modules/thinc/default.nix
index 55bf72aec769..417cd8e056c9 100644
--- a/nixpkgs/pkgs/development/python-modules/thinc/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/thinc/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "thinc";
-  version = "8.0.13";
+  version = "8.0.14";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-R2YqOuM9RFp3tup7dyREgFx7uomR8SLjUNr3Le3IFxo=";
+    sha256 = "sha256-3MC8ao6BTiDyaCXj/X+DNCTpMYcTWVJFSl0X+sCc5J0=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/development/python-modules/traitsui/default.nix b/nixpkgs/pkgs/development/python-modules/traitsui/default.nix
index d09a855bd32a..dc42ba0972fc 100644
--- a/nixpkgs/pkgs/development/python-modules/traitsui/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/traitsui/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "traitsui";
-  version = "7.3.0";
+  version = "7.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZkSz+PYColdgcC3IchuneM51lFBAk68UpIadI56GdPQ=";
+    hash = "sha256-lHStZ/NF2Wsya0AemgFAXICCyS+kO/R8CwOYGOWHrGk=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/typed-ast/default.nix b/nixpkgs/pkgs/development/python-modules/typed-ast/default.nix
index c4977ab08292..87116017063d 100644
--- a/nixpkgs/pkgs/development/python-modules/typed-ast/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/typed-ast/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.5.1";
+  version = "1.5.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "python";
     repo = "typed_ast";
     rev = version;
-    hash = "sha256-qfXMT+rSf/WcWHpkg4VZXZMYj/5IKQWAKRsxQ0TRzPU=";
+    hash = "sha256-Ul1FIS1a1f8l3tX+m8Bj/LsLQW1sXJv6XzEZ9zh8rfI=";
   };
 
   checkInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/xmltodict/default.nix b/nixpkgs/pkgs/development/python-modules/xmltodict/default.nix
index 790aaec3ce3d..13cc5b89c2a2 100644
--- a/nixpkgs/pkgs/development/python-modules/xmltodict/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/xmltodict/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , coverage
-, nose
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -14,11 +14,13 @@ buildPythonPackage rec {
     sha256 = "50d8c638ed7ecb88d90561beedbf720c9b4e851a9fa6c47ebd64e99d166d8a21";
   };
 
-  checkInputs = [ coverage nose ];
+  checkInputs = [ coverage pytestCheckHook ];
 
-  checkPhase = ''
-    nosetests
-  '';
+  disabledTests = [
+    # incompatibilities with security fixes: https://github.com/martinblech/xmltodict/issues/289
+    "test_namespace_collapse"
+    "test_namespace_support"
+  ];
 
   meta = {
     description = "Makes working with XML feel like you are working with JSON";
diff --git a/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix b/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix
index 8862464156f1..58fed0070d08 100644
--- a/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.941";
+  version = "2.0.954";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-hNmIJmxzKEaKQzqLl9LSqtMj1dTpFDeztUo2ESCHIw0=";
+    hash = "sha256-gCUciYTEL+4Pt9vAGbun0WFQWneOhDDXh7Dn9+sZbWw=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/nixpkgs/pkgs/development/tools/database/litestream/default.nix b/nixpkgs/pkgs/development/tools/database/litestream/default.nix
index 6a7e53e6cf20..00e541efc0d4 100644
--- a/nixpkgs/pkgs/development/tools/database/litestream/default.nix
+++ b/nixpkgs/pkgs/development/tools/database/litestream/default.nix
@@ -4,13 +4,13 @@
 }:
 buildGoModule rec {
   pname = "litestream";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "benbjohnson";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IEdTLf+fEp19FhwL3IaGT9HGKQoa6HwFox2gf0lvFu4=";
+    sha256 = "sha256-0Yyx8kbpu3T868hI9tJkBIjplAoQDA4XzhraHhOp61Q=";
   };
 
   ldflags = [
@@ -19,7 +19,7 @@ buildGoModule rec {
     "-X main.Version=${version}"
   ];
 
-  vendorSha256 = "sha256-ScG8cukUuChOvN9r0HvVJsYnu1X9DSO7aD32iu55jIM=";
+  vendorSha256 = "sha256-zCz9dki87dpZCo+/KuFzwtv/0TlBcvQDTxTuLN2FiHY=";
 
   meta = with lib; {
     description = "Streaming replication for SQLite";
diff --git a/nixpkgs/pkgs/development/tools/esbuild/default.nix b/nixpkgs/pkgs/development/tools/esbuild/default.nix
index f7335a8ef8da..3d136a62f522 100644
--- a/nixpkgs/pkgs/development/tools/esbuild/default.nix
+++ b/nixpkgs/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.14.25";
+  version = "0.14.27";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-95xVQU1AWIDvMlWJpB54RxGoOtZtaUlyfmfdcKERe6Y=";
+    sha256 = "sha256-h5PodIFzqD0hJb89eGxMJN6uvrF2exOHJYk+Wmwvso8=";
   };
 
   vendorSha256 = "sha256-QPkBR+FscUc3jOvH7olcGUhM6OW4vxawmNJuRQxPuGs=";
diff --git a/nixpkgs/pkgs/development/tools/kustomize/kustomize-sops.nix b/nixpkgs/pkgs/development/tools/kustomize/kustomize-sops.nix
index 04024dc3acfb..4b5e6d8bb388 100644
--- a/nixpkgs/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/nixpkgs/pkgs/development/tools/kustomize/kustomize-sops.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kustomize-sops";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "viaduct-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZCEgv+2WC1XLDFdRtigkiWu81zLMHvmB8vvIBWN2UYY=";
+    sha256 = "sha256-6mLfMbYbdsjWHpfUHP3Q5nsqdMXo/82+A9PV8xWZBM0=";
   };
 
-  vendorSha256 = "sha256-LFa0s2FBkw97P0CV+9JBmUAjaKVO+RzCX+iWGPUD9iA=";
+  vendorSha256 = "sha256-aRS+MwME72qIMyhnnIRqmrx5hcQ1V0pLIBJqSoR+Fkk=";
 
   installPhase = ''
     mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
diff --git a/nixpkgs/pkgs/development/tools/misc/autoconf/2.13.nix b/nixpkgs/pkgs/development/tools/misc/autoconf/2.13.nix
index dc36028332ff..4ff990ca0ed2 100644
--- a/nixpkgs/pkgs/development/tools/misc/autoconf/2.13.nix
+++ b/nixpkgs/pkgs/development/tools/misc/autoconf/2.13.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m4, perl, xz }:
+{ lib, stdenv, fetchurl, m4, perl }:
 
 stdenv.mkDerivation rec {
   pname = "autoconf";
@@ -9,7 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "07krzl4czczdsgzrrw9fiqx35xcf32naf751khg821g5pqv12qgh";
   };
 
-  nativebuildInputs = [ xz ];
   buildInputs = [ m4 perl ];
 
   doCheck = true;
diff --git a/nixpkgs/pkgs/development/tools/misc/ctags/default.nix b/nixpkgs/pkgs/development/tools/misc/ctags/default.nix
index fde7307b27dc..dc6ee4815238 100644
--- a/nixpkgs/pkgs/development/tools/misc/ctags/default.nix
+++ b/nixpkgs/pkgs/development/tools/misc/ctags/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchsvn, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "ctags-${revision}";
-  revision = "816";
+  pname = "ctags";
+  version = "816";
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/ctags/code/trunk";
-    rev = revision;
+    rev = version;
     sha256 = "0jmbkrmscbl64j71qffcc39x005jrmphx8kirs1g2ws44wil39hf";
   };
 
diff --git a/nixpkgs/pkgs/development/tools/misc/gdb/default.nix b/nixpkgs/pkgs/development/tools/misc/gdb/default.nix
index c173b96f6eb0..5bb5bc0652fe 100644
--- a/nixpkgs/pkgs/development/tools/misc/gdb/default.nix
+++ b/nixpkgs/pkgs/development/tools/misc/gdb/default.nix
@@ -27,11 +27,11 @@ assert pythonSupport -> python3 != null;
 
 stdenv.mkDerivation rec {
   pname = targetPrefix + basename;
-  version = "11.1";
+  version = "11.2";
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}-${version}.tar.xz";
-    sha256 = "151z6d0265hv9cgx9zqqa4bd6vbp20hrljhd6bxl7lr0gd0crkyc";
+    hash = "sha256-FJfDanGIG4ZxqahKDuQPqreIyjDXuhnYRjw8x4cVLjI=";
   };
 
   postPatch = if stdenv.isDarwin then ''
diff --git a/nixpkgs/pkgs/development/tools/misc/help2man/default.nix b/nixpkgs/pkgs/development/tools/misc/help2man/default.nix
index 4521eee95a21..f7d1667dfa24 100644
--- a/nixpkgs/pkgs/development/tools/misc/help2man/default.nix
+++ b/nixpkgs/pkgs/development/tools/misc/help2man/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "help2man";
-  version = "1.48.5";
+  version = "1.49.1";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ZznkyqQuau0zmb5Dh8p5OZZAlnM06RcohjuOqpIlgr4=";
+    sha256 = "sha256-/ZmmZOxL6ahqDdiXGZifFPNnqcB5110OHXHhinu1GwM=";
   };
 
   strictDeps = true;
diff --git a/nixpkgs/pkgs/development/tools/parsing/flex/default.nix b/nixpkgs/pkgs/development/tools/parsing/flex/default.nix
index 58f0bb54fb1a..8991c1419f2a 100644
--- a/nixpkgs/pkgs/development/tools/parsing/flex/default.nix
+++ b/nixpkgs/pkgs/development/tools/parsing/flex/default.nix
@@ -47,6 +47,10 @@ stdenv.mkDerivation rec {
 
   dontDisableStatic = stdenv.buildPlatform != stdenv.hostPlatform;
 
+  postInstall = ''
+    ln -s $out/bin/flex $out/bin/lex
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/westes/flex";
     description = "A fast lexical analyser generator";
diff --git a/nixpkgs/pkgs/development/tools/rust/cargo-insta/default.nix b/nixpkgs/pkgs/development/tools/rust/cargo-insta/default.nix
index 93593a01f5ee..727e9b38c053 100644
--- a/nixpkgs/pkgs/development/tools/rust/cargo-insta/default.nix
+++ b/nixpkgs/pkgs/development/tools/rust/cargo-insta/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-insta";
-  version = "1.11.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
     rev = version;
-    sha256 = "sha256-Vi3FwetCpL8qMniaXypw1EYVHh6lfZu6GjDXPDKda5c=";
+    sha256 = "sha256-cSQEwsUqn+Q0ZWndBVatHL0btO7xLOJWO+MMjtSL0Zo=";
   };
 
   sourceRoot = "source/cargo-insta";
-  cargoSha256 = "sha256-Bjh9we0OD8kqMJtovO1yw9Yta5u93dlYMRsxPdErkaY=";
+  cargoSha256 = "sha256-rn4ln/MeaDAQmWpxeTn3mGH4sEvO4876o1VPYiz/CR8=";
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/development/tools/rust/cargo-nextest/default.nix b/nixpkgs/pkgs/development/tools/rust/cargo-nextest/default.nix
new file mode 100644
index 000000000000..54d568726ddc
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/rust/cargo-nextest/default.nix
@@ -0,0 +1,29 @@
+{ lib, fetchFromGitHub, rustPlatform, stdenv, libiconv }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-nextest";
+  version = "0.9.10";
+
+  src = fetchFromGitHub {
+    owner = "nextest-rs";
+    repo = "nextest";
+    rev = "cargo-nextest-${version}";
+    sha256 = "0gbh990dd4514bfqh4x2nymh5w608ljp3s7akq100m4v723b6339";
+  };
+
+  cargoSha256 = "0c0i274dkz3jx9dzcxl9hyf3imiga8vb6m6jc5z1f1wdq3vknh9r";
+
+  cargoTestFlags = [ # TODO: investigate some more why these tests fail in nix
+    "--"
+    "--skip=tests_integration::test_relocated_run"
+    "--skip=tests_integration::test_run"
+    "--skip=tests_integration::test_run_after_build"
+  ];
+
+  meta = with lib; {
+    description = "Next-generation test runner for Rust projects";
+    homepage = "https://github.com/nextest-rs/nextest";
+    license = with licenses; [ mit asl20 ];
+    maintainers = [ maintainers.ekleog ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/shellharden/default.nix b/nixpkgs/pkgs/development/tools/shellharden/default.nix
index d444a3685c5c..ee56e58f6ca9 100644
--- a/nixpkgs/pkgs/development/tools/shellharden/default.nix
+++ b/nixpkgs/pkgs/development/tools/shellharden/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shellharden";
-  version = "4.1.3";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "anordal";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04pgmkaqjb1lmlwjjipcrqh9qcyjjkr39vi3h5fl9sr71c8g7dnd";
+    sha256 = "081b51h88hhyzn9vb9pcszz1wfdj73xwsyfn2ygz708kabzqpvdl";
   };
 
-  cargoSha256 = "0bjqgw49msl288yfa7bl31bfa9kdy4zh1q3j0lyw4vvkv2r14pf5";
+  cargoSha256 = "1gwlmds417szwvywvm19wv60a83inp52sf46sd05x5vahb8gv8hg";
 
   postPatch = "patchShebangs moduletests/run";
 
diff --git a/nixpkgs/pkgs/development/tools/tokio-console/default.nix b/nixpkgs/pkgs/development/tools/tokio-console/default.nix
index f04de27f1c24..6ff132e8146a 100644
--- a/nixpkgs/pkgs/development/tools/tokio-console/default.nix
+++ b/nixpkgs/pkgs/development/tools/tokio-console/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tokio-console";
-  version = "0.1.0";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "tokio-rs";
     repo = "console";
     rev = "tokio-console-v${version}";
-    sha256 = "sha256-1wxRTdDmgTlGJ3W1txDA/3Rnccs3KBw55vprrGaVnkg=";
+    sha256 = "sha256-v9BxfBLRJug/1AgvDV7P5AOXwZfCu1mNgJjhbipoZNg=";
   };
 
-  cargoSha256 = "sha256-RScu5V55OowwWHi3MLjW8DPlTMA/IEBYFt4VUDUHPKo=";
+  cargoSha256 = "sha256-584EC9x7tJE3pHqgQVh6LWKuCgLXuBBEnaPvo1A8RIs=";
 
   nativeBuildInputs = [ protobuf ];
 
diff --git a/nixpkgs/pkgs/development/tools/typos/default.nix b/nixpkgs/pkgs/development/tools/typos/default.nix
index 9ce8a9494dd3..23b6f535fc36 100644
--- a/nixpkgs/pkgs/development/tools/typos/default.nix
+++ b/nixpkgs/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dQ+FLKf+zNrUabrXWvdYqpNXzS+j92zQcaZXPTxxB/E=";
+    sha256 = "sha256-It112+60ze+5rvq3TYlIU+X4lJ4pgdCO7Gb1ADArDvY=";
   };
 
-  cargoSha256 = "sha256-ud2Hb8EoOiPyzp7qPUeQi8FZ49RXbrDsk8ZEBI6lPtk=";
+  cargoSha256 = "sha256-yiy1xLxCdjIzqXUlkxWoOZ7cPZzJgDuTUvNHpnnTnwE=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/nixpkgs/pkgs/development/tools/vendir/default.nix b/nixpkgs/pkgs/development/tools/vendir/default.nix
index e80bb0f14cdf..d6ff0825737a 100644
--- a/nixpkgs/pkgs/development/tools/vendir/default.nix
+++ b/nixpkgs/pkgs/development/tools/vendir/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "vendir";
-  version = "0.24.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-vendir";
     rev = "v${version}";
-    sha256 = "sha256-3l0ezObZK/QEmpBlqSm3R3e4pFM7KUnsxDrzvEYExnk=";
+    sha256 = "sha256-a/fftMJuN6YnjPP0Gk6bMckoCouwgtxhf23OuyLR5Tk=";
   };
 
   vendorSha256 = null;
diff --git a/nixpkgs/pkgs/games/terraria-server/default.nix b/nixpkgs/pkgs/games/terraria-server/default.nix
index 0100418326dc..cd4895fc0643 100644
--- a/nixpkgs/pkgs/games/terraria-server/default.nix
+++ b/nixpkgs/pkgs/games/terraria-server/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "terraria-server";
-  version = "1.4.3.5";
+  version = "1.4.3.6";
   urlVersion = lib.replaceChars [ "." ] [ "" ] version;
 
   src = fetchurl {
     url = "https://terraria.org/api/download/pc-dedicated-server/terraria-server-${urlVersion}.zip";
-    sha256 = "sha256-N1GnxEe0A6Wuzy08lL3CFPWjQJECGGf504FE+lnhDcw=";
+    sha256 = "sha256-OFI7U6Mqu09pIbgJQs0O+GS8jf1uVuhAVEJhYNYXrBE=";
   };
 
   buildInputs = [ file ];
diff --git a/nixpkgs/pkgs/misc/cups/default.nix b/nixpkgs/pkgs/misc/cups/default.nix
index 2d0129e21c5c..af43c55072c3 100644
--- a/nixpkgs/pkgs/misc/cups/default.nix
+++ b/nixpkgs/pkgs/misc/cups/default.nix
@@ -26,14 +26,14 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.4.0";
+  version = if stdenv.isDarwin then "2.2.6" else "2.4.1";
 
   src = fetchurl (if stdenv.isDarwin then {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
   } else {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "1pm6lf08z8vgs62g5b5rjw32qy3vr0q3sgidpg2lfs6a530wxgls";
+    sha256 = "sha256-xzOfdfjU8t7FDGczQaRfwGtohbttQ2bWv1mk5sEK4Xg=";
   });
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/nixpkgs/pkgs/misc/openrussian-cli/default.nix b/nixpkgs/pkgs/misc/openrussian-cli/default.nix
index 24c0b6bece78..4f30fd918963 100644
--- a/nixpkgs/pkgs/misc/openrussian-cli/default.nix
+++ b/nixpkgs/pkgs/misc/openrussian-cli/default.nix
@@ -1,6 +1,9 @@
 { stdenv, lib, fetchFromGitHub, gnumake, pkg-config, wget, unzip, gawk
-, sqlite, which, luaPackages, installShellFiles, makeWrapper
+, sqlite, which, lua, installShellFiles, makeWrapper
 }:
+let
+  luaEnv = lua.withPackages(p: with p; [ luasql-sqlite3 luautf8 ]);
+in
 stdenv.mkDerivation rec {
   pname   = "openrussian-cli";
   version = "1.0.0";
@@ -16,11 +19,11 @@ stdenv.mkDerivation rec {
     gnumake pkg-config wget unzip gawk sqlite which installShellFiles makeWrapper
   ];
 
-  buildInputs = with luaPackages; [ lua luasql-sqlite3 luautf8 ];
+  buildInputs = [ luaEnv ];
 
   makeFlags = [
-    "LUA=${luaPackages.lua}/bin/lua"
-    "LUAC=${luaPackages.lua}/bin/luac"
+    "LUA=${luaEnv}/bin/lua"
+    "LUAC=${luaEnv}/bin/luac"
   ];
 
   dontConfigure = true;
@@ -34,8 +37,8 @@ stdenv.mkDerivation rec {
     cp openrussian $out/bin
 
     wrapProgram $out/bin/openrussian \
-      --prefix LUA_PATH ';' "$LUA_PATH" \
-      --prefix LUA_CPATH ';' "$LUA_CPATH"
+      --prefix LUA_PATH ';' '${lua.pkgs.lib.genLuaPathAbsStr luaEnv}' \
+      --prefix LUA_CPATH ';' '${lua.pkgs.lib.genLuaCPathAbsStr luaEnv}'
 
     runHook postInstall
   '';
diff --git a/nixpkgs/pkgs/misc/screensavers/xlockmore/default.nix b/nixpkgs/pkgs/misc/screensavers/xlockmore/default.nix
index 8d6b5eba5bf6..ac739d6a0db4 100644
--- a/nixpkgs/pkgs/misc/screensavers/xlockmore/default.nix
+++ b/nixpkgs/pkgs/misc/screensavers/xlockmore/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xlockmore";
-  version = "5.68";
+  version = "5.69";
 
   src = fetchurl {
     url = "http://sillycycle.com/xlock/xlockmore-${version}.tar.xz";
-    sha256 = "sha256-MHMf3LID8W61wcQ8BdQuRSrQ60VVyXxVVmpuyxh3zW4=";
+    sha256 = "sha256-6pJlTAASJoSHZaJRpzvLxHPM7xe3IcwY1TYfWdvW07k=";
     curlOpts = "--user-agent 'Mozilla/5.0'";
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/audit/default.nix b/nixpkgs/pkgs/os-specific/linux/audit/default.nix
index 9fd24eea6d9b..de71b7d8c3e0 100644
--- a/nixpkgs/pkgs/os-specific/linux/audit/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/audit/default.nix
@@ -3,11 +3,10 @@
   runCommand,
   autoreconfHook,
   autoconf, automake, libtool,
-  enablePython ? false, python ? null,
+  enablePython ? true, python3, swig,
+  linuxHeaders ? stdenv.cc.libc.linuxHeaders
 }:
 
-assert enablePython -> python != null;
-
 stdenv.mkDerivation rec {
   pname = "audit";
   version = "2.8.5"; # at the next release, remove the patches below!
@@ -21,7 +20,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = lib.optional enablePython python;
+  buildInputs = lib.optionals enablePython [ python3 swig ];
 
   configureFlags = [
     # z/OS plugin is not useful on Linux,
@@ -69,8 +68,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  prePatch = ''
+  postPatch = ''
     sed -i 's,#include <sys/poll.h>,#include <poll.h>\n#include <limits.h>,' audisp/audispd.c
+    substituteInPlace bindings/swig/src/auditswig.i \
+      --replace "/usr/include/linux/audit.h" \
+                "${linuxHeaders}/include/linux/audit.h"
   ''
   # According to https://stackoverflow.com/questions/13089166
   # --whole-archive linker flag is required to be sure that linker
diff --git a/nixpkgs/pkgs/os-specific/linux/bluez/default.nix b/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
index 5e81cf6b2c1d..fb75b99f03d9 100644
--- a/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
@@ -22,11 +22,11 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.62";
+  version = "5.63";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-OAkKW3UOF/wI0+UheO2NMlTF9L0sSIMNXBlVuI47wMI=";
+    sha256 = "sha256-k0nhHoFguz1yCDXScSUNinQk02kPUonm22/gfMZsbXY=";
   };
 
   buildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
index 671fdef2f5d1..068aedf31213 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
@@ -218,6 +218,11 @@ let
       # Kernel TLS
       TLS         = whenAtLeast "4.13" module;
       TLS_DEVICE  = whenAtLeast "4.18" yes;
+
+      # infiniband
+      INFINIBAND = module;
+      INFINIBAND_IPOIB = module;
+      INFINIBAND_IPOIB_CM = yes;
     };
 
     wireless = {
@@ -719,7 +724,12 @@ let
 
       HID_ACRUX_FF       = yes;
       DRAGONRISE_FF      = yes;
+      GREENASIA_FF       = yes;
       HOLTEK_FF          = yes;
+      JOYSTICK_PSXPAD_SPI_FF = whenAtLeast "4.14" yes;
+      LOGIG940_FF        = yes;
+      NINTENDO_FF        = whenAtLeast "5.16" yes;
+      PLAYSTATION_FF     = whenAtLeast "5.12" yes;
       SONY_FF            = yes;
       SMARTJOYPLUS_FF    = yes;
       THRUSTMASTER_FF    = yes;
diff --git a/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix b/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
index aeb261aaaca5..070a18f6984a 100644
--- a/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libpsm2";
-  version = "11.2.203";
+  version = "11.2.206";
 
   preConfigure= ''
     export UDEVDIR=$out/etc/udev
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "opa-psm2";
     rev = "PSM2_${version}";
-    sha256 = "sha256-W5Mg5ATUARMFAy1VVpMKPar0VpbKfrkxa6bDhqVYpoc=";
+    sha256 = "sha256-HsM2OaoX+SdbIednX1MWw1M4kkkPwUs5Dm32q2H7Mg4=";
   };
 
   postInstall = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix b/nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix
index 555ff6b0dc14..73f1e9fbdeec 100644
--- a/nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.14";
-  sha256 = "0p5077h3z7mrr0b49ikmhlhrs4v4qb530raypk3y72ja125bqqsa";
+  version = "2.03.15";
+  sha256 = "17n9xl01by7dcbjwjnr6b4rrkp2frz8hwnjl59svsyp13sjq6llk";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix b/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
index 0749292531bb..0f2e6efe3a26 100644
--- a/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     sed -i /DEFAULT_SYS_DIR/d Makefile.in
     sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
+  '' + lib.optionalString (lib.versionOlder version "2.03.15") ''
     substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
       --replace /usr/bin/udevadm /run/current-system/systemd/bin/udevadm
     # https://github.com/lvmteam/lvm2/issues/36
@@ -82,7 +83,7 @@ stdenv.mkDerivation rec {
     sed -i 's|^#define LVM_CONFIGURE_LINE.*$|#define LVM_CONFIGURE_LINE "<removed>"|g' ./include/configure.h
   '';
 
-  patches = [
+  patches = lib.optionals (lib.versionOlder version "2.03.15") [
     # Musl fixes from Alpine.
     ./fix-stdio-usage.patch
     (fetchpatch {
diff --git a/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix b/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
index 8485565e0a88..bedd2417e7ea 100644
--- a/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux";
-  version = "2.37.3";
+  version = "2.37.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-WQxZLljNa/OFGctGevBc5qGrGAQOPjQY8kvPsvVfl3Y=";
+    sha256 = "sha256-Y05pFq2RM2bDU2tkaOeER2lUm5mnsr+AMU3nirVlW4M=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix
index 90a052fdef9d..3fdd9e791bd5 100644
--- a/nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -12,11 +12,11 @@ let
 # we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
 in stdenv.mkDerivation rec {
   pname = "v4l-utils";
-  version = "1.20.0";
+  version = "1.22.1";
 
   src = fetchurl {
     url = "https://linuxtv.org/downloads/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1xr66y6w422hil6s7n8d61a2vhwh4im8l267amf41jvw7xqihqcm";
+    hash = "sha256-Zcb76DCkTKEFxEOwJxgsGyyQU6kdHnKthJ36s4i5TjE=";
   };
 
   outputs = [ "out" ] ++ lib.optional withUtils "lib" ++ [ "dev" ];
@@ -40,14 +40,16 @@ in stdenv.mkDerivation rec {
   propagatedBuildInputs = [ libjpeg ];
 
   postPatch = ''
-    patchShebangs utils/cec-ctl/msg2ctl.pl
-    patchShebangs utils/libcecutil/cec-gen.pl
+    patchShebangs utils/
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "V4L utils and libv4l, provide common image formats regardless of the v4l device";
     homepage = "https://linuxtv.org/projects.php";
-    license = licenses.lgpl21Plus;
+    changelog = "https://git.linuxtv.org/v4l-utils.git/plain/ChangeLog?h=v4l-utils-${version}";
+    license = with licenses; [ lgpl21Plus gpl2Plus ];
     maintainers = with maintainers; [ codyopel ];
     platforms = platforms.linux;
   };
diff --git a/nixpkgs/pkgs/servers/fingerd/bsd-fingerd/default.nix b/nixpkgs/pkgs/servers/fingerd/bsd-fingerd/default.nix
deleted file mode 100644
index b907c67ccb73..000000000000
--- a/nixpkgs/pkgs/servers/fingerd/bsd-fingerd/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-# !!! Duplication: this package is almost exactly the same as `bsd-fingerd'.
-
-stdenv.mkDerivation rec {
-  pname = "bsd-fingerd";
-  version = "0.17";
-
-  src = fetchurl {
-    url = "mirror://ibiblioPubLinux/system/network/finger/bsd-finger-${version}.tar.gz";
-    sha256 = "1yhkiv0in588il7f84k2xiy78g9lv12ll0y7047gazhiimk5v244";
-  };
-
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
-
-  patches = [ ./ubuntu-0.17-9.patch ];
-
-  preBuild = "cd fingerd";
-
-  preInstall = "mkdir -p $out/man/man8 $out/sbin ";
-
-  meta = with lib; {
-    platforms = platforms.linux;
-    license = licenses.bsdOriginal;
-  };
-}
diff --git a/nixpkgs/pkgs/servers/fingerd/bsd-fingerd/ubuntu-0.17-9.patch b/nixpkgs/pkgs/servers/fingerd/bsd-fingerd/ubuntu-0.17-9.patch
deleted file mode 100644
index 80968d587ba9..000000000000
--- a/nixpkgs/pkgs/servers/fingerd/bsd-fingerd/ubuntu-0.17-9.patch
+++ /dev/null
@@ -1,67 +0,0 @@
---- bsd-finger-0.17.orig/fingerd/fingerd.8
-+++ bsd-finger-0.17/fingerd/fingerd.8
-@@ -36,10 +36,10 @@
- .Dt FINGERD 8
- .Os "Linux NetKit (0.17)"
- .Sh NAME
--.Nm fingerd
-+.Nm in.fingerd
- .Nd remote user information server
- .Sh SYNOPSIS
--.Nm fingerd
-+.Nm in.fingerd
- .Op Fl wulf
- .Op Fl pL Ar path
- .Op Fl t Ar timeout
-@@ -61,7 +61,7 @@
- banner
- which also shows some informations (e.g. uptime, operating system name and
- release) about the system the
--.Nm fingerd
-+.Nm in.fingerd
- is running on. Some sites may consider this a security risk as it
- gives out information that may be useful to crackers. 
- .Pp
-@@ -85,7 +85,7 @@
- .Pp
- The 
- .Fl p
--option allows specification of an alternate location for fingerd to find
-+option allows specification of an alternate location for in.fingerd to find
- the 
- .Dq finger
- program. The
-@@ -97,7 +97,7 @@
- option specifies the time to wait for a request before closing the
- connection.  A value of 0 waits forever.  The default is 60 seconds.
- .Pp
--Options to fingerd should be specified in 
-+Options to in.fingerd should be specified in 
- .Pa /etc/inetd.conf .
- .Pp
- The finger protocol consists mostly of specifying command arguments.
-@@ -105,12 +105,12 @@
- .Xr inetd 8
- .Dq super-server
- runs
--.Nm fingerd
-+.Nm in.fingerd
- for 
- .Tn TCP
- requests received on port 79.
- Once connected 
--.Nm fingerd
-+.Nm in.fingerd
- reads a single command line
- terminated by a
- .Aq Tn CRLF
---- bsd-finger-0.17.orig/fingerd/fingerd.c
-+++ bsd-finger-0.17/fingerd/fingerd.c
-@@ -55,6 +55,7 @@
- #include <netinet/in.h>
- #include <sys/utsname.h>
- #include <sys/wait.h>
-+#include <sys/socket.h>
- 
- #include "pathnames.h"
- #include "../version.h"
diff --git a/nixpkgs/pkgs/servers/freeradius/default.nix b/nixpkgs/pkgs/servers/freeradius/default.nix
index a3cdec3fec8a..3999d422d21d 100644
--- a/nixpkgs/pkgs/servers/freeradius/default.nix
+++ b/nixpkgs/pkgs/servers/freeradius/default.nix
@@ -1,28 +1,23 @@
-{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, talloc, finger_bsd, perl
-, openssl
-, linkOpenssl? true
-, openldap
-, withLdap ? true
-, sqlite
-, withSqlite ? true
-, libpcap
-, withPcap ? true
-, libcap
-, withCap ? true
-, libmemcached
-, withMemcached ? false
-, hiredis
-, withRedis ? false
-, libmysqlclient
-, withMysql ? false
-, json_c
-, withJson ? false
-, libyubikey
-, withYubikey ? false
-, collectd
-, withCollectd ? false
-, curl
-, withRest ? false
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, autoreconfHook
+, bsd-finger
+, perl
+, talloc
+, linkOpenssl? true, openssl
+, withCap ? true, libcap
+, withCollectd ? false, collectd
+, withJson ? false, json_c
+, withLdap ? true, openldap
+, withMemcached ? false, libmemcached
+, withMysql ? false, libmysqlclient
+, withPcap ? true, libpcap
+, withRedis ? false, hiredis
+, withRest ? false, curl
+, withSqlite ? true, sqlite
+, withYubikey ? false, libyubikey
 }:
 
 assert withSqlite -> sqlite != null;
@@ -36,43 +31,38 @@ assert withYubikey -> libyubikey != null;
 assert withCollectd -> collectd != null;
 assert withRest -> curl != null && withJson;
 
-## TODO: include windbind optionally (via samba?)
-## TODO: include oracle optionally
-## TODO: include ykclient optionally
-
-with lib;
 stdenv.mkDerivation rec {
   pname = "freeradius";
   version = "3.0.25";
 
   src = fetchurl {
     url = "ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-${version}.tar.gz";
-    sha256 = "SIOmi7PO5GAlNZqXwWkc5lXour/W3DwCHQDhCaL/TBA=";
+    hash = "sha256-SIOmi7PO5GAlNZqXwWkc5lXour/W3DwCHQDhCaL/TBA=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  buildInputs = [ openssl talloc finger_bsd perl ]
-    ++ optional withLdap openldap
-    ++ optional withSqlite sqlite
-    ++ optional withPcap libpcap
-    ++ optional withCap libcap
-    ++ optional withMemcached libmemcached
-    ++ optional withRedis hiredis
-    ++ optional withMysql libmysqlclient
-    ++ optional withJson json_c
-    ++ optional withYubikey libyubikey
-    ++ optional withCollectd collectd
-    ++ optional withRest curl;
-
+  buildInputs = [ openssl talloc bsd-finger perl ]
+    ++ lib.optional withCap libcap
+    ++ lib.optional withCollectd collectd
+    ++ lib.optional withJson json_c
+    ++ lib.optional withLdap openldap
+    ++ lib.optional withMemcached libmemcached
+    ++ lib.optional withMysql libmysqlclient
+    ++ lib.optional withPcap libpcap
+    ++ lib.optional withRedis hiredis
+    ++ lib.optional withRest curl
+    ++ lib.optional withSqlite sqlite
+    ++ lib.optional withYubikey libyubikey;
 
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-  ] ++ optional (!linkOpenssl) "--with-openssl=no";
+  ] ++ lib.optional (!linkOpenssl) "--with-openssl=no";
 
   postPatch = ''
-    substituteInPlace src/main/checkrad.in --replace "/usr/bin/finger" "${finger_bsd}/bin/finger"
+    substituteInPlace src/main/checkrad.in \
+      --replace "/usr/bin/finger" "${bsd-finger}/bin/finger"
   '';
 
   # By default, freeradius will generate Diffie-Hellman parameters and
@@ -99,6 +89,7 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ sheenobu willibutz fpletz lheckemann elseym ];
     platforms = with platforms; linux;
   };
-
 }
-
+## TODO: include windbind optionally (via samba?)
+## TODO: include oracle optionally
+## TODO: include ykclient optionally
diff --git a/nixpkgs/pkgs/servers/home-assistant/component-packages.nix b/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
index bb750635d5d9..7f765eb9fd8d 100644
--- a/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
+++ b/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2022.3.4";
+  version = "2022.3.5";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
diff --git a/nixpkgs/pkgs/servers/home-assistant/default.nix b/nixpkgs/pkgs/servers/home-assistant/default.nix
index b6ceb02270ae..9e7fc76e4e3f 100644
--- a/nixpkgs/pkgs/servers/home-assistant/default.nix
+++ b/nixpkgs/pkgs/servers/home-assistant/default.nix
@@ -37,8 +37,11 @@ let
         version = "0.3.0";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "0kx4mbs9bflycd8x9af0idcjhdgnzri3nw1qb0vpfyb3751qaaf9";
+          hash = "sha256-ySmFQzljeXc3WDhwO2L+9jUoWYvAqdRRY566lfSqpE8=";
         };
+        propagatedBuildInputs = with python3.pkgs; [ aiohttp pytest ];
+        doCheck = false;
+        patches = [];
       });
       aiohomekit = super.aiohomekit.overridePythonAttrs (oldAttrs: {
         doCheck = false; # requires aiohttp>=1.0.0
@@ -46,6 +49,9 @@ let
       hass-nabucasa = super.hass-nabucasa.overridePythonAttrs (oldAttrs: {
         doCheck = false; # requires aiohttp>=1.0.0
       });
+      snitun = super.snitun.overridePythonAttrs (oldAttrs: {
+        doCheck = false; # requires aiohttp>=1.0.0
+      });
       zwave-js-server-python = super.zwave-js-server-python.overridePythonAttrs (oldAttrs: {
         doCheck = false; # requires aiohttp>=1.0.0
       });
@@ -158,7 +164,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.3.4";
+  hassVersion = "2022.3.5";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -176,7 +182,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256-7de1m7pvPkgCcZN/Slhy26Y1j2NtkebkGanSTl9jN1M=";
+    hash = "sha256-VXE2zQH/HHhogo5qjneC0zlo9892wgGN1qd3ZFKfyqw=";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/nixpkgs/pkgs/servers/home-assistant/frontend.nix b/nixpkgs/pkgs/servers/home-assistant/frontend.nix
index 9bfa5cf2f37a..9f13a6652d7d 100644
--- a/nixpkgs/pkgs/servers/home-assistant/frontend.nix
+++ b/nixpkgs/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20220301.1";
+  version = "20220301.2";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    sha256 = "sha256-+S888lUHbWqEJQm5HvZqimTfqoDEHYRVAoGQ5UvU4u4=";
+    sha256 = "sha256-iIywlG9ATLV/+bHtOQFx4mRwToelpPdE3DOKSp4yxN0=";
   };
 
   # there is nothing to strip in this package
diff --git a/nixpkgs/pkgs/servers/imgproxy/default.nix b/nixpkgs/pkgs/servers/imgproxy/default.nix
index 29b33cd66104..2b7ed9e1c9cc 100644
--- a/nixpkgs/pkgs/servers/imgproxy/default.nix
+++ b/nixpkgs/pkgs/servers/imgproxy/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "imgproxy";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    sha256 = "sha256-8oUPqtoxdJ768CmDNBicBGCyejt2v9GIahVRL6pYDJ4=";
+    sha256 = "sha256-GZYaFK6g26gbVa3sHwTZ4fNGMFWBWevqcfJc/3SC890=";
     rev = "v${version}";
   };
 
-  vendorSha256 = "sha256-Dr5qCLVsv22BcISo2OyB+VEDncPwpcp323w9IfDTQv0=";
+  vendorSha256 = "sha256-uV5pnnvVYviw2LnceQUiTJXva3WI51pgW6IeZzVhULc=";
 
   doCheck = false;
 
diff --git a/nixpkgs/pkgs/servers/janus-gateway/default.nix b/nixpkgs/pkgs/servers/janus-gateway/default.nix
index e9138c2eeddb..3400b5c50541 100644
--- a/nixpkgs/pkgs/servers/janus-gateway/default.nix
+++ b/nixpkgs/pkgs/servers/janus-gateway/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "janus-gateway";
-  version = "0.11.8";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "meetecho";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-otTIDwcbF8Rcas048Vkn30v39GYIYbAIY72ipJhIwC4=";
+    sha256 = "sha256-BREPSDmGR85kDx1PWLdwpbwImAFuctLLx3AcHqAcURk=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config gengetopt ];
diff --git a/nixpkgs/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/nixpkgs/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index 32c26a395e73..4b60c5a28d0e 100644
--- a/nixpkgs/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/nixpkgs/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.35.1";
+  version = "1.36.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-S89Okd57QyMHb/QYUQbib2HLdH9qo0duNxcdaP8wKUg=";
+    sha256 = "sha256-n+LvWl0KMAay90GQg42ODcvxX9QbvQ1Ixo4PfJYEAWA=";
   };
 
   vendorSha256 = "sha256-u9FfKOD6kiCFTjwQ7LHE9WC4j2vPm0ZCluL8pC4aQIc=";
diff --git a/nixpkgs/pkgs/servers/sql/postgresql/default.nix b/nixpkgs/pkgs/servers/sql/postgresql/default.nix
index 0af47ccca83a..0998ddb573da 100644
--- a/nixpkgs/pkgs/servers/sql/postgresql/default.nix
+++ b/nixpkgs/pkgs/servers/sql/postgresql/default.nix
@@ -202,9 +202,9 @@ let
 in self: {
 
   postgresql_10 = self.callPackage generic {
-    version = "10.19";
+    version = "10.20";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "sha256-brgwtCi2DoSuh+IENrzmecTZ0CAr567A5BsMZ9kTQjk=";
+    sha256 = "sha256-h94W1ZvP5C+mBcMSxZvl4pToo+astlXdetR8u5MKZZ8=";
     this = self.postgresql_10;
     thisAttr = "postgresql_10";
     inherit self;
@@ -212,36 +212,36 @@ in self: {
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.14";
+    version = "11.15";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "sha256-llx/S+lvtk+VgYUsWMTwXDgS1K2CPA8+K9/nd8Fi+Zk=";
+    sha256 = "sha256-yPWOjr1PRWf0+boQMus+meAlHYfL4+VktIVZDjeoeeM=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.9";
+    version = "12.10";
     psqlSchema = "12";
-    sha256 = "sha256-if2i3jPtBKmFSOQ/PuXxW4gr4XUF1jH+DdGlQKK1bc4=";
+    sha256 = "sha256-g90ZLmA0lRGSuahtwZzzcXqLghIOLxGgo2cjyCDSslc=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.5";
+    version = "13.6";
     psqlSchema = "13";
-    sha256 = "sha256-m4EGelXtuqvEGKrO9FfdhHdkKCdJlWCwBhWm6mwT9rM=";
+    sha256 = "sha256-uvx/o9nU2o/nG4TGO6i9/oCSk1wwwKqFwkssCFCPZ/w=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.1";
+    version = "14.2";
     psqlSchema = "14";
-    sha256 = "sha256-TTwQHqeuOJgvBr3HN1i1Nyf7ZALs2TggBvpezHwspB8=";
+    sha256 = "sha256-LPeLLkaJEvgQHWldtTQM8xPC6faKYS+3FCdSToyal3o=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
diff --git a/nixpkgs/pkgs/servers/sql/proxysql/default.nix b/nixpkgs/pkgs/servers/sql/proxysql/default.nix
index ab8f7f9a6993..be1739f2b8af 100644
--- a/nixpkgs/pkgs/servers/sql/proxysql/default.nix
+++ b/nixpkgs/pkgs/servers/sql/proxysql/default.nix
@@ -24,7 +24,6 @@
 , openssl
 , pcre
 , perl
-, prometheus-cpp
 , python2
 , re2
 , zlib
@@ -109,7 +108,6 @@ stdenv.mkDerivation rec {
         { f = "libssl"; p = openssl; }
         { f = "lz4"; p = lz4; }
         { f = "pcre"; p = pcre; }
-        { f = "prometheus-cpp"; p = prometheus-cpp; }
         { f = "re2"; p = re2; }
     ]}
 
@@ -123,8 +121,9 @@ stdenv.mkDerivation rec {
     ln -s ${nlohmann_json.src}/single_include/nlohmann/json.hpp .
     popd
 
-    pushd prometheus-cpp/prometheus-cpp/3rdparty
-    replace_dep . "${civetweb.src}" civetweb
+    pushd prometheus-cpp
+    tar xf v0.9.0.tar.gz
+    replace_dep prometheus-cpp/3rdparty "${civetweb.src}" civetweb
     popd
 
     sed -i s_/usr/bin/env_${coreutils}/bin/env_g libssl/openssl/config
diff --git a/nixpkgs/pkgs/servers/web-apps/wiki-js/default.nix b/nixpkgs/pkgs/servers/web-apps/wiki-js/default.nix
index 8eb1a9e7a87f..f4e7775c400f 100644
--- a/nixpkgs/pkgs/servers/web-apps/wiki-js/default.nix
+++ b/nixpkgs/pkgs/servers/web-apps/wiki-js/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wiki-js";
-  version = "2.5.274";
+  version = "2.5.276";
 
   src = fetchurl {
-    url = "https://github.com/Requarks/wiki/releases/download/${version}/${pname}.tar.gz";
-    sha256 = "sha256-l3mvlC/DIJ2W3xLdwSV2gCRDdNGcg6OUW4e1IOihlyQ=";
+    url = "https://github.com/Requarks/wiki/releases/download/v${version}/${pname}.tar.gz";
+    sha256 = "sha256-ulx3/yj5wxmHsep0+93xpy6VeQJkMXRjGd/xx2F1zII=";
   };
 
   sourceRoot = ".";
diff --git a/nixpkgs/pkgs/servers/xmpp/prosody/default.nix b/nixpkgs/pkgs/servers/xmpp/prosody/default.nix
index 5d0ed06b5ae0..1556250447a9 100644
--- a/nixpkgs/pkgs/servers/xmpp/prosody/default.nix
+++ b/nixpkgs/pkgs/servers/xmpp/prosody/default.nix
@@ -11,7 +11,6 @@
 
 with lib;
 
-
 let
   luaEnv = lua.withPackages(p: with p; [
       luasocket luasec luaexpat luafilesystem luabitop luadbi-sqlite3
@@ -22,7 +21,7 @@ let
   );
 in
 stdenv.mkDerivation rec {
-  version = "0.11.12"; # also update communityModules
+  version = "0.11.13"; # also update communityModules
   pname = "prosody";
   # The following community modules are necessary for the nixos module
   # prosody module to comply with XEP-0423 and provide a working
@@ -36,7 +35,7 @@ stdenv.mkDerivation rec {
   ];
   src = fetchurl {
     url = "https://prosody.im/downloads/source/${pname}-${version}.tar.gz";
-    sha256 = "03an206bl3h2lqcgv1wfvc2bqjq6m9vjb2idw0vyvczm43c55kan";
+    sha256 = "sha256-OcYbNGoJtRJbYEy5aeFCBsu8uGyBFW/8a6LWJSfPBDI=";
   };
 
   # A note to all those merging automated updates: Please also update this
@@ -44,8 +43,8 @@ stdenv.mkDerivation rec {
   # version.
   communityModules = fetchhg {
     url = "https://hg.prosody.im/prosody-modules";
-    rev = "bd0a1f917d98";
-    sha256 = "0figx0b0y5zfk5anf16h20y4crjmpb6bkg30vl7p0m594qnyqjcx";
+    rev = "54fa2116bbf3";
+    sha256 = "sha256-OKZ7tD75q8/GMXruUQ+r9l0BxzdbPHNf41fZ3fHVQVw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
   ]
   ++ withExtraLibs;
 
-
   configureFlags = [
     "--ostype=linux"
     "--with-lua-include=${luaEnv}/include"
@@ -89,9 +87,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     communityModules = withCommunityModules;
-    tests = {
-      main = nixosTests.prosody;
-    };
+    tests = { inherit (nixosTests) prosody prosody-mysql; };
   };
 
   meta = {
diff --git a/nixpkgs/pkgs/shells/bash/bash-5.1-patches.nix b/nixpkgs/pkgs/shells/bash/bash-5.1-patches.nix
index e6e9461bcbef..41eb92710588 100644
--- a/nixpkgs/pkgs/shells/bash/bash-5.1-patches.nix
+++ b/nixpkgs/pkgs/shells/bash/bash-5.1-patches.nix
@@ -13,4 +13,8 @@ patch: [
 (patch "010" "0amfmvbzsand7bdypylkjdpcp88fa3cplfshn7vyzv2ff2rdgj52")
 (patch "011" "0yq24abb4fzfxqnwl20b330sxl9lr9ds0nc4yi30f81l94b1y6aq")
 (patch "012" "165bff97ffih49vfs4mkr5w3z5gn1w6zfyrf773iajkw6v48kw8h")
+(patch "013" "1bfmgv3lagbk3aq9a831d29xv7jz4sjq7jhn9hq89limyinvdb67")
+(patch "014" "1l43dw4kpddn7l41i8wmj406z9abxky1wb3rk8krcys33g4f0kka")
+(patch "015" "1w40vzadzx019v0zhs4q6yqycrk04x1k8xs6qb73vk7ny4p6jdqv")
+(patch "016" "0krqqljz4bkp9wrdnwfx51bxkb8rkwf8ivc93as1znx5fr7i96c8")
 ]
diff --git a/nixpkgs/pkgs/test/make-wrapper/default.nix b/nixpkgs/pkgs/test/make-wrapper/default.nix
index 6e70945ee194..62ccd272adf4 100644
--- a/nixpkgs/pkgs/test/make-wrapper/default.nix
+++ b/nixpkgs/pkgs/test/make-wrapper/default.nix
@@ -64,6 +64,7 @@ runCommand "make-wrapper-test"
     (mkWrapperBinary { name = "test-run-and-set"; args = [ "--run" "export VAR=foo" "--set" "VAR" "bar" ]; })
     (mkWrapperBinary { name = "test-args"; args = [ "--add-flags" "abc" ]; wrapped = wrappedBinaryArgs; })
     (mkWrapperBinary { name = "test-prefix"; args = [ "--prefix" "VAR" ":" "abc" ]; })
+    (mkWrapperBinary { name = "test-prefix-noglob"; args = [ "--prefix" "VAR" ":" "./*" ]; })
     (mkWrapperBinary { name = "test-suffix"; args = [ "--suffix" "VAR" ":" "abc" ]; })
     (mkWrapperBinary { name = "test-prefix-and-suffix"; args = [ "--prefix" "VAR" ":" "foo" "--suffix" "VAR" ":" "bar" ]; })
     (mkWrapperBinary { name = "test-prefix-multi"; args = [ "--prefix" "VAR" ":" "abc:foo:foo" ]; })
@@ -112,6 +113,8 @@ runCommand "make-wrapper-test"
     # Only append the value once when given multiple times in a parameter
     # to makeWrapper
     + mkTest "test-prefix" "VAR=abc"
+    # --prefix doesn't expand globs
+    + mkTest "VAR=f?oo test-prefix-noglob" "VAR=./*:f?oo"
 
 
     # --suffix works
diff --git a/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix b/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
index 28733f8ed77e..c51cc12da36b 100644
--- a/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.16";
+  version = "5.16.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0cqqlcq9bywfi3cpg5ivxiv7p9v6z1r6k4nnmin24mj1kp8krarq";
+    sha256 = "sha256-PaTaU2HPhr3dqA7bTE8w6gdstOvsKZBPoIr8kw754ag=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/tools/graphics/agi/default.nix b/nixpkgs/pkgs/tools/graphics/agi/default.nix
index 1dc47e4287a2..4a0ef0e9a73a 100644
--- a/nixpkgs/pkgs/tools/graphics/agi/default.nix
+++ b/nixpkgs/pkgs/tools/graphics/agi/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "agi";
-  version = "2.2.0-dev-20220120";
+  version = "3.1.0-dev-20220314";
 
   src = fetchzip {
     url = "https://github.com/google/agi-dev-releases/releases/download/v${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-0f17CAANxomtx1fvhj+mI6k4IqwIimmcTSTXZGbbWDY=";
+    sha256 = "sha256-j/ozkIoRM+G7fi0qBG8UGKPtrn6DR6KNK0Hc53dxsMw=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/tools/inputmethods/ibus/default.nix b/nixpkgs/pkgs/tools/inputmethods/ibus/default.nix
index 50b9dba51d35..0f4dde0a4169 100644
--- a/nixpkgs/pkgs/tools/inputmethods/ibus/default.nix
+++ b/nixpkgs/pkgs/tools/inputmethods/ibus/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv
 , substituteAll
 , fetchurl
+, fetchpatch
 , fetchFromGitHub
 , autoreconfHook
 , gettext
@@ -9,12 +10,14 @@
 , vala
 , wrapGAppsHook
 , dbus
+, systemd
 , dconf ? null
 , glib
 , gdk-pixbuf
 , gobject-introspection
 , gtk2
 , gtk3
+, gtk4
 , gtk-doc
 , runCommand
 , isocodes
@@ -60,16 +63,22 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus";
-  version = "1.5.24";
+  version = "1.5.26";
 
   src = fetchFromGitHub {
     owner = "ibus";
     repo = "ibus";
     rev = version;
-    sha256 = "sha256-1qx06MlEUjSS067FdQG1Bdi4ZAh3hPcNjUX5PIiC3Sk=";
+    sha256 = "7Vuj4Gyd+dLUoCkR4SPkfGPwVQPRo2pHk0pRAsmtjxc=";
   };
 
   patches = [
+    # Fixes systemd unit installation path https://github.com/ibus/ibus/pull/2388
+    (fetchpatch {
+      url = "https://github.com/ibus/ibus/commit/33b4b3932bfea476a841f8df99e20049b83f4b0e.patch";
+      sha256 = "kh8SBR+cqsov/B0A2YXLJVq1F171qoSRUKbBPHjPRHI=";
+    })
+
     (substituteAll {
       src = ./fix-paths.patch;
       pythonInterpreter = python3Runtime.interpreter;
@@ -94,6 +103,7 @@ stdenv.mkDerivation rec {
     (enableFeature enablePython2Library "python-library")
     (enableFeature enablePython2Library "python2") # XXX: python2 library does not work anyway
     (enableFeature enableUI "ui")
+    "--enable-gtk4"
     "--enable-install-tests"
     "--with-unicode-emoji-dir=${unicode-emoji}/share/unicode/emoji"
     "--with-emoji-annotation-dir=${cldr-emoji-annotation}/share/unicode/cldr/common/annotations"
@@ -123,12 +133,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dbus
+    systemd
     dconf
     gdk-pixbuf
     gobject-introspection
     python3.pkgs.pygobject3 # for pygobject overrides
     gtk2
     gtk3
+    gtk4
     isocodes
     json-glib
     libnotify
diff --git a/nixpkgs/pkgs/tools/inputmethods/ibus/fix-paths.patch b/nixpkgs/pkgs/tools/inputmethods/ibus/fix-paths.patch
index 60269c6c2418..340ec22130f0 100644
--- a/nixpkgs/pkgs/tools/inputmethods/ibus/fix-paths.patch
+++ b/nixpkgs/pkgs/tools/inputmethods/ibus/fix-paths.patch
@@ -1,6 +1,8 @@
+diff --git a/configure.ac b/configure.ac
+index a3cdb2da..cade9466 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -429,11 +429,11 @@
+@@ -469,11 +469,11 @@ PKG_CHECK_EXISTS([pygobject-3.0 >= $PYGOBJECT_REQUIRED],
  if test "x$enable_pygobject" = "xyes"; then
      PKG_CHECK_MODULES(PYTHON, [pygobject-3.0 >= $PYGOBJECT_REQUIRED])
  
@@ -14,7 +16,7 @@
          AC_SUBST(py2overridesdir)
      fi
  fi
-@@ -462,7 +462,7 @@
+@@ -502,7 +502,7 @@ if test x"$enable_python_library" = x"yes"; then
      PYTHON2_VERSION=`$PYTHON2 -c "import sys; sys.stdout.write(sys.version[[:3]])"`
      PYTHON2_LIBDIR="$PYTHON2_PREFIX/lib/python$PYTHON2_VERSION"
      python2dir="$PYTHON2_LIBDIR/site-packages"
@@ -23,9 +25,11 @@
      AC_SUBST(pkgpython2dir)
  else
      enable_python_library="no (disabled, use --enable-python-library to enable)"
+diff --git a/data/dconf/Makefile.am b/data/dconf/Makefile.am
+index 5360f033..6d5e726f 100644
 --- a/data/dconf/Makefile.am
 +++ b/data/dconf/Makefile.am
-@@ -50,7 +50,7 @@
+@@ -50,7 +50,7 @@ man_5dir = $(mandir)/man5
  
  install-data-hook:
  	if test -z "$(DESTDIR)"; then \
@@ -34,12 +38,14 @@
  	fi
  
  EXTRA_DIST = \
+diff --git a/setup/ibus-setup.in b/setup/ibus-setup.in
+index 474ce8a8..ee30808e 100644
 --- a/setup/ibus-setup.in
 +++ b/setup/ibus-setup.in
-@@ -27,5 +27,5 @@
+@@ -27,5 +27,5 @@ export IBUS_PREFIX=@prefix@
  export IBUS_DATAROOTDIR=@datarootdir@
  export IBUS_LOCALEDIR=@localedir@
  export IBUS_LIBEXECDIR=${libexecdir}
--exec ${PYTHON:-@PYTHON@} @prefix@/share/ibus/setup/main.py $@
-+exec @pythonInterpreter@ @prefix@/share/ibus/setup/main.py $@
+-exec ${PYTHON:-@PYTHON@} @prefix@/share/ibus/setup/main.py "$@"
++exec @pythonInterpreter@ @prefix@/share/ibus/setup/main.py "$@"
  
diff --git a/nixpkgs/pkgs/tools/misc/coreboot-utils/default.nix b/nixpkgs/pkgs/tools/misc/coreboot-utils/default.nix
index 36e82903a7e4..783af7fda718 100644
--- a/nixpkgs/pkgs/tools/misc/coreboot-utils/default.nix
+++ b/nixpkgs/pkgs/tools/misc/coreboot-utils/default.nix
@@ -53,6 +53,7 @@ let
       pname = "intelmetool";
       meta.description = "Dump interesting things about Management Engine";
       buildInputs = [ pciutils zlib ];
+      meta.platforms = [ "x86_64-linux" "i686-linux" ];
     };
     cbfstool = generic {
       pname = "cbfstool";
@@ -77,6 +78,7 @@ let
       pname = "inteltool";
       meta.description = "Provides information about Intel CPU/chipset hardware configuration (register contents, MSRs, etc)";
       buildInputs = [ pciutils zlib ];
+      meta.platforms = [ "x86_64-linux" "i686-linux" ];
     };
     amdfwtool = generic {
       pname = "amdfwtool";
diff --git a/nixpkgs/pkgs/tools/misc/findutils/default.nix b/nixpkgs/pkgs/tools/misc/findutils/default.nix
index 8c8b8c7b2b43..3746c4b4657f 100644
--- a/nixpkgs/pkgs/tools/misc/findutils/default.nix
+++ b/nixpkgs/pkgs/tools/misc/findutils/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "findutils";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/${pname}-${version}.tar.xz";
-    sha256 = "0r3i72hnw0a30khlczi9k2c51aamaj6kfmp5mk3844nrjxz7n4jp";
+    sha256 = "sha256-or+4wJ1DZ3DtxZ9Q+kg+eFsWGjt7nVR1c8sIBl/UYv4=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/tools/misc/goreleaser/default.nix b/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
index ec3f480ebf1a..492e8a83a2fd 100644
--- a/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
+++ b/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.6.1";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MnsIm8E6CR5tEB6Oq35fJKQiPJfqP86/hp0t6lqJ0JE=";
+    sha256 = "sha256-ZNE+DfQdIlxA6sXMI8DAIQ3x+kcgXoGApUuoPncRfpc=";
   };
 
   vendorSha256 = "sha256-Kwa2hzsuw3BNLubcqd7Vmpg49P78Yjt3LboLotoGWYM=";
diff --git a/nixpkgs/pkgs/tools/misc/lbdb/default.nix b/nixpkgs/pkgs/tools/misc/lbdb/default.nix
index ce3a5acd4c9d..3a7338221bac 100644
--- a/nixpkgs/pkgs/tools/misc/lbdb/default.nix
+++ b/nixpkgs/pkgs/tools/misc/lbdb/default.nix
@@ -1,38 +1,49 @@
-{ lib, stdenv, fetchurl, fetchpatch, perl, finger_bsd
-, abook ? null
-, gnupg ? null
-, goobook ? null
-, khard ? null
-, mu ? null
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, perl
+, bsd-finger
+, withAbook ? true, abook
+, withGnupg ? true, gnupg
+, withGoobook ? true, goobook
+, withKhard ? true, khard
+, withMu ? true, mu
 }:
 
 let
-  perl' = perl.withPackages (p: with p; [ ConvertASN1 perlldap AuthenSASL ]);
+  perl' = perl.withPackages (p: with p; [
+    AuthenSASL
+    ConvertASN1
+    perlldap
+  ]);
 in
 stdenv.mkDerivation rec {
   pname = "lbdb";
   version = "0.48.1";
+
   src = fetchurl {
     url = "https://www.spinnaker.de/lbdb/download/lbdb_${version}.tar.gz";
     sha256 = "1gr5l2fr9qbdccga8bhsrpvz6jxigvfkdxrln9wyf2xpps5cdjxh";
   };
 
-  buildInputs = [ goobook perl' ]
-    ++ lib.optional (!stdenv.isDarwin) finger_bsd
-    ++ lib.optional   (abook != null) abook
-    ++ lib.optional   (gnupg != null) gnupg
-    ++ lib.optional (goobook != null) goobook
-    ++ lib.optional   (khard != null) khard
-    ++ lib.optional      (mu != null) mu;
+  buildInputs = [ perl' ]
+    ++ lib.optional (!stdenv.isDarwin) bsd-finger
+    ++ lib.optional withAbook abook
+    ++ lib.optional withGnupg gnupg
+    ++ lib.optional withGoobook goobook
+    ++ lib.optional withKhard khard
+    ++ lib.optional withMu mu;
 
   configureFlags = [ ]
-    ++ lib.optional   (abook != null) "--with-abook"
-    ++ lib.optional   (gnupg != null) "--with-gpg"
-    ++ lib.optional (goobook != null) "--with-goobook"
-    ++ lib.optional   (khard != null) "--with-khard"
-    ++ lib.optional      (mu != null) "--with-mu";
+    ++ lib.optional withAbook "--with-abook"
+    ++ lib.optional withGnupg "--with-gpg"
+    ++ lib.optional withGoobook "--with-goobook"
+    ++ lib.optional withKhard "--with-khard"
+    ++ lib.optional withMu "--with-mu";
 
-  patches = [ ./add-methods-to-rc.patch
+  patches = [
+    ./add-methods-to-rc.patch
     # fix undefined exec_prefix. Remove with the next release
     (fetchpatch {
       url = "https://github.com/RolandRosenfeld/lbdb/commit/60b7bae255011f59212d96adfbded459d6a27129.patch";
@@ -43,9 +54,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.spinnaker.de/lbdb/";
+    description = "The Little Brother's Database";
     license = licenses.gpl2;
+    maintainers = with maintainers; [ kaiha bfortz ];
     platforms = platforms.all;
-    description = "The Little Brother's Database";
-    maintainers = [ maintainers.kaiha maintainers.bfortz ];
   };
 }
diff --git a/nixpkgs/pkgs/tools/misc/man-db/default.nix b/nixpkgs/pkgs/tools/misc/man-db/default.nix
index d495c912f599..7263e4de336b 100644
--- a/nixpkgs/pkgs/tools/misc/man-db/default.nix
+++ b/nixpkgs/pkgs/tools/misc/man-db/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-db";
-  version = "2.9.4";
+  version = "2.10.1";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/man-db-${version}.tar.xz";
-    sha256 = "sha256-tmyZ7frRatkoyIn4fPdjgCY8FgkyPCgLOp5pY/2xZ1Y=";
+    sha256 = "sha256-L/2PLoASL+cuYMdAyFHmo+FcmnkhGF60dSwcZygkvtY=";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/nixpkgs/pkgs/tools/misc/steampipe/default.nix b/nixpkgs/pkgs/tools/misc/steampipe/default.nix
index 554822ba8de3..cfdb2b79c6df 100644
--- a/nixpkgs/pkgs/tools/misc/steampipe/default.nix
+++ b/nixpkgs/pkgs/tools/misc/steampipe/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-xLw3y9DYkei0MoErsMpSDhEK73lK9b13st+DqHvvhys=";
+    sha256 = "sha256-+QtZmrPE3R98UVSwrC8xoehNKwd0Exg+AZ2BJxBIrfY=";
   };
 
-  vendorSha256 = "sha256-hqjjwYBVnuw7Bt2901tPIkfvYLy955IdeMbeSWTjtL0=";
+  vendorSha256 = "sha256-rRp8pR2cpW88o0KPwuvgSkE263S5oGK/4df4CQSOlRo=";
   proxyVendor = true;
 
   # tests are failing for no obvious reasons
diff --git a/nixpkgs/pkgs/tools/networking/bsd-finger/default.nix b/nixpkgs/pkgs/tools/networking/bsd-finger/default.nix
index a83a02bd0978..12e429b7bcba 100644
--- a/nixpkgs/pkgs/tools/networking/bsd-finger/default.nix
+++ b/nixpkgs/pkgs/tools/networking/bsd-finger/default.nix
@@ -1,26 +1,47 @@
-{ lib, stdenv, fetchurl }:
-
-# !!! Duplication: this package is almost exactly the same as `bsd-finger'.
+{ lib
+, stdenv
+, fetchurl
+, buildClient ? true
+}:
 
 stdenv.mkDerivation rec {
-  pname = "bsd-finger";
+  srcName = "bsd-finger";
+  pname = srcName + lib.optionalString (!buildClient) "d";
   version = "0.17";
 
   src = fetchurl {
-    url = "mirror://ibiblioPubLinux/system/network/finger/bsd-finger-${version}.tar.gz";
-    sha256 = "1yhkiv0in588il7f84k2xiy78g9lv12ll0y7047gazhiimk5v244";
+    url = "mirror://ibiblioPubLinux/system/network/finger/${srcName}-${version}.tar.gz";
+    hash = "sha256-hIhdZo0RfvUOAccDSkXYND10fOxiEuQOjQgVG8GOE/o=";
   };
 
+  # outputs = [ "out" "man" ];
+
   NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
-  patches = [ ./ubuntu-0.17-9.patch ];
+  patches = [
+    ./ubuntu-0.17-9.patch
+  ];
 
-  preBuild = "cd finger";
+  preBuild = let
+    srcdir = if buildClient then "finger" else "fingerd";
+  in ''
+    cd ${srcdir}
+  '';
 
-  preInstall = "mkdir -p $out/man/man1 $out/bin ";
+  preInstall = let
+    bindir = if buildClient then "bin" else "sbin";
+    mandir = if buildClient then "man/man1" else "man/man8";
+  in ''
+    mkdir -p $out/${bindir} $out/${mandir}
+  '';
 
   meta = with lib; {
+    description =
+      if buildClient
+      then "User information lookup program"
+      else "Remote user information server";
     platforms = platforms.linux;
     license = licenses.bsdOriginal;
   };
 }
+# TODO: multiple outputs (manpage)
diff --git a/nixpkgs/pkgs/tools/networking/iperf/3.nix b/nixpkgs/pkgs/tools/networking/iperf/3.nix
index f32a4249c006..9ec491f1c570 100644
--- a/nixpkgs/pkgs/tools/networking/iperf/3.nix
+++ b/nixpkgs/pkgs/tools/networking/iperf/3.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iperf";
-  version = "3.10.1";
+  version = "3.11";
 
   src = fetchurl {
     url = "https://downloads.es.net/pub/iperf/iperf-${version}.tar.gz";
-    sha256 = "0nkisr2215w68ivadg3sx3q50iwamznwigs63lclb8jlrih9gg03";
+    sha256 = "0pvy1cj92phpbldw0bdc0ds70n8irqcyn1ybyis0a6nnz84v936y";
   };
 
   buildInputs = [ openssl ];
diff --git a/nixpkgs/pkgs/tools/networking/minio-client/default.nix b/nixpkgs/pkgs/tools/networking/minio-client/default.nix
index eb73a33e01f7..c90ba9cfc640 100644
--- a/nixpkgs/pkgs/tools/networking/minio-client/default.nix
+++ b/nixpkgs/pkgs/tools/networking/minio-client/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2022-03-09T02-08-36Z";
+  version = "2022-03-13T22-34-00Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-OaV0Xb3nNeZJLayGperQah0JQ7BlGFPWa1//Kt5+EiU=";
+    sha256 = "sha256-NIhowfkG2bFIcCNXUQ3cETHsR5/NLvIHQ9LeftgSyd0=";
   };
 
   vendorSha256 = "sha256-Wdw9mZ3UupoJ4yDwS4f3mOmCn+7TvHmx4aRu+96pHM4=";
diff --git a/nixpkgs/pkgs/tools/package-management/cargo-about/default.nix b/nixpkgs/pkgs/tools/package-management/cargo-about/default.nix
index 17c9f690d0af..a61aff2107de 100644
--- a/nixpkgs/pkgs/tools/package-management/cargo-about/default.nix
+++ b/nixpkgs/pkgs/tools/package-management/cargo-about/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-about";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-about";
     rev = version;
-    sha256 = "sha256-KrUb71/wEQnAD2VVkufw12kXrz35sU5fNciSJsMyGrc=";
+    sha256 = "sha256-cKzGg3fAXKqnBZES3YUMbv1ZAcLqo6AdrXKXSFSAnis=";
   };
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
 
-  cargoSha256 = "sha256-JewI+23eNrMHfSUwsA3CaeTvG61/ZOFFLpm7rKZKsoU=";
+  cargoSha256 = "sha256-OLrxqbTIhHMNPEnSAUbTqoYnaZi/BxbWUCxaTo9Zyww=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/nixpkgs/pkgs/tools/package-management/cargo-outdated/default.nix b/nixpkgs/pkgs/tools/package-management/cargo-outdated/default.nix
index d15cbe8a9ccb..a1f783a7fe48 100644
--- a/nixpkgs/pkgs/tools/package-management/cargo-outdated/default.nix
+++ b/nixpkgs/pkgs/tools/package-management/cargo-outdated/default.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-outdated";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-U6qElZkray4kjScv9X4I5m2z1ZWQzqcPYAuPzpyRpW0=";
+    sha256 = "sha256-43PqIM61MXY35BSprRNPTMyVUEVD15sq4+6PHS/P2o0=";
   };
 
-  cargoSha256 = "sha256-0J02Uz184zx5xZYhqUmyaAFCQ0aogwy0fQTXbteBdV8=";
+  cargoSha256 = "sha256-ue93L8pyjKR+bxNdltQcsHSPJ3Iz+4gpeskIhhR2/wI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/nixpkgs/pkgs/tools/package-management/disnix/disnixos/default.nix b/nixpkgs/pkgs/tools/package-management/disnix/disnixos/default.nix
index 35541fa36ac5..05a9e45c9562 100644
--- a/nixpkgs/pkgs/tools/package-management/disnix/disnixos/default.nix
+++ b/nixpkgs/pkgs/tools/package-management/disnix/disnixos/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "disnixos";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchurl {
     url = "https://github.com/svanderburg/disnixos/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "0zcghb9nm911bfwpzcgj4ga2cndxbzp5pmrxff711qydrwgy7sg7";
+    sha256 = "0nm7g184xh6xzjz4a40a7kgfnpmq043x6v0cynpffa6wd9jv89s9";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix b/nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix
index 678f0a9be8b7..f07aade89ca1 100644
--- a/nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix
+++ b/nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, netcat
 
 # Optional packages
-, systemd ? null, ejabberd ? null, mysql ? null, postgresql ? null, subversion ? null
+, systemd ? null, ejabberd ? null, mariadb ? null, postgresql ? null, subversion ? null
 , mongodb ? null, mongodb-tools ? null, influxdb ? null, supervisor ? null, docker ? null
 , nginx ? null, s6-rc ? null, xinetd ? null
 
@@ -26,7 +26,7 @@
 , getopt
 }:
 
-assert enableMySQLDatabase -> mysql != null;
+assert enableMySQLDatabase -> mariadb != null;
 assert enablePostgreSQLDatabase -> postgresql != null;
 assert enableSubversionRepository -> subversion != null;
 assert enableEjabberdDump -> ejabberd != null;
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ getopt netcat ]
     ++ lib.optional stdenv.isLinux systemd
     ++ lib.optional enableEjabberdDump ejabberd
-    ++ lib.optional enableMySQLDatabase mysql.out
+    ++ lib.optional enableMySQLDatabase mariadb.out
     ++ lib.optional enablePostgreSQLDatabase postgresql
     ++ lib.optional enableSubversionRepository subversion
     ++ lib.optionals enableMongoDatabase [ mongodb mongodb-tools ]
diff --git a/nixpkgs/pkgs/tools/security/gnupg/23.nix b/nixpkgs/pkgs/tools/security/gnupg/23.nix
index ef7a5cf85e71..e80804cd002f 100644
--- a/nixpkgs/pkgs/tools/security/gnupg/23.nix
+++ b/nixpkgs/pkgs/tools/security/gnupg/23.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null && enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "0dz9x0r5021bhk1kjh29m1q13xbslwb8yn9qzcp7b9m1lrnvi2ap";
+    sha256 = "sha256-80aOyvsdf5rXtR/R23rr8XzridLvqKBc8vObTUBUAq4=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -34,19 +34,9 @@ stdenv.mkDerivation rec {
     ./tests-add-test-cases-for-import-without-uid.patch
     ./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
-  ] ++ lib.optional stdenv.isDarwin [
-    # Remove an innocent warning printed on systems without procfs
-    # https://dev.gnupg.org/T5656
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/890be5f6af88e7913d177af87a50129049e681bb/gnupg/2.3.3-proc-error.patch";
-      sha256 = "sha256-oiTa7Nf+AEmhZ683CJEaCb559PXJ6RpSSgRLpxz4CKU=";
-    })
   ];
   postPatch = ''
-    sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' configure doc/dirmngr.texi doc/gnupg.info-1
-    # Fix broken SOURCE_DATE_EPOCH usage - remove on the next upstream update
-    sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.am
-    sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.in
+    sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
   '' + lib.optionalString (stdenv.isLinux && pcsclite != null) ''
     sed -i 's,"libpcsclite\.so[^"]*","${lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   '';
diff --git a/nixpkgs/pkgs/top-level/aliases.nix b/nixpkgs/pkgs/top-level/aliases.nix
index 46a74b391a51..f4bb9c1ebc6c 100644
--- a/nixpkgs/pkgs/top-level/aliases.nix
+++ b/nixpkgs/pkgs/top-level/aliases.nix
@@ -320,6 +320,8 @@ mapAliases ({
   fedora-coreos-config-transpiler = throw "fedora-coreos-config-transpiler has been renamed to 'butane'."; # Added 2021-04-13
   fetchFromGithub = throw "You meant fetchFromGitHub, with a capital H.";
   ffadoFull = throw "'ffadoFull' has been renamed to/replaced by 'ffado'"; # Converted to throw 2022-02-22
+  finger_bsd = bsd-finger;
+  fingerd_bsd = bsd-fingerd;
   firefox-esr-68 = throw "Firefox 68 ESR was removed because it reached end of life with its final release 68.12esr on 2020-08-25.";
   firefox-esr-wrapper = throw "'firefox-esr-wrapper' has been renamed to/replaced by 'firefox-esr'"; # Converted to throw 2022-02-22
   firefoxWrapper = throw "'firefoxWrapper' has been renamed to/replaced by 'firefox'"; # Converted to throw 2022-02-22
diff --git a/nixpkgs/pkgs/top-level/all-packages.nix b/nixpkgs/pkgs/top-level/all-packages.nix
index 76957ac997ab..cba32d94217a 100644
--- a/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/nixpkgs/pkgs/top-level/all-packages.nix
@@ -147,9 +147,14 @@ with pkgs;
 
   autorestic = callPackage ../tools/backup/autorestic { };
 
-  autoPatchelfHook = makeSetupHook
-    { name = "auto-patchelf-hook"; deps = [ bintools ]; }
-    ../build-support/setup-hooks/auto-patchelf.sh;
+  autoPatchelfHook = makeSetupHook {
+    name = "auto-patchelf-hook";
+    deps = [ bintools ];
+    substitutions = {
+      pythonInterpreter = "${python3.withPackages (ps: [ ps.pyelftools ])}/bin/python";
+      autoPatchelfScript = ../build-support/setup-hooks/auto-patchelf.py;
+    };
+  } ../build-support/setup-hooks/auto-patchelf.sh;
 
   appflowy = callPackage ../applications/office/appflowy { };
 
@@ -5477,7 +5482,8 @@ with pkgs;
 
   findutils = callPackage ../tools/misc/findutils { };
 
-  finger_bsd = callPackage ../tools/networking/bsd-finger { };
+  bsd-finger = callPackage ../tools/networking/bsd-finger { };
+  bsd-fingerd = bsd-finger.override({ buildClient = false; });
 
   iprange = callPackage ../applications/networking/firehol/iprange.nix {};
 
@@ -8596,7 +8602,7 @@ with pkgs;
   openrgb = libsForQt5.callPackage ../applications/misc/openrgb { };
 
   openrussian-cli = callPackage ../misc/openrussian-cli {
-    luaPackages = lua53Packages;
+    lua = lua5_3;
   };
 
   opensbi = callPackage ../misc/opensbi { };
@@ -13328,6 +13334,7 @@ with pkgs;
   cargo-msrv = callPackage ../development/tools/rust/cargo-msrv {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
+  cargo-nextest = callPackage ../development/tools/rust/cargo-nextest { };
   cargo-play = callPackage ../development/tools/rust/cargo-play { };
   cargo-raze = callPackage ../development/tools/rust/cargo-raze {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -14063,8 +14070,18 @@ with pkgs;
 
   pipenv = callPackage ../development/tools/pipenv {};
 
-  pipewire = callPackage ../development/libraries/pipewire {};
+  pipewire = callPackage ../development/libraries/pipewire {
+    # ffmpeg depends on SDL2 which depends on pipewire by default.
+    # Break the cycle by disabling pipewire support in our ffmpeg.
+    ffmpeg = ffmpeg.override {
+      SDL2 = SDL2.override {
+        pipewireSupport = false;
+      };
+    };
+  };
+
   pipewire-media-session = callPackage ../development/libraries/pipewire/media-session.nix {};
+
   pipewire_0_2 = callPackage ../development/libraries/pipewire/0.2.nix {};
   wireplumber = callPackage ../development/libraries/pipewire/wireplumber.nix {};
 
@@ -20661,41 +20678,27 @@ with pkgs;
   wxformbuilder = callPackage ../development/tools/wxformbuilder { };
 
   wxGTK = wxGTK28;
-  wxGTK30 = wxGTK30-gtk2;
-  wxGTK31 = wxGTK31-gtk2;
 
-  wxGTK28 = callPackage ../development/libraries/wxwidgets/2.8 { };
+  wxGTK28 = callPackage ../development/libraries/wxwidgets/wxGTK28.nix { };
 
-  wxGTK29 = callPackage ../development/libraries/wxwidgets/2.9 {
+  wxGTK29 = callPackage ../development/libraries/wxwidgets/wxGTK29.nix {
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QuickTime;
   };
 
-  wxGTK30-gtk2 = callPackage ../development/libraries/wxwidgets/3.0 {
-    withGtk2 = true;
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
-  };
-
-  wxGTK30-gtk3 = callPackage ../development/libraries/wxwidgets/3.0 {
-    withGtk2 = false;
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
-  };
-
-  wxGTK31-gtk2 = callPackage ../development/libraries/wxwidgets/3.1 {
+  wxGTK30 = callPackage ../development/libraries/wxwidgets/wxGTK30.nix {
     withGtk2 = true;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
   };
+  wxGTK30-gtk2 = wxGTK30.override { withGtk2 = true; };
+  wxGTK30-gtk3 = wxGTK30.override { withGtk2 = false; };
 
-  wxGTK31-gtk3 = callPackage ../development/libraries/wxwidgets/3.1 {
-    withGtk2 = false;
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
-  };
+  wxmac = callPackage ../development/libraries/wxwidgets/wxmac30.nix { };
 
-  wxmac = callPackage ../development/libraries/wxwidgets/3.0/mac.nix { };
+  wxGTK31 = callPackage ../development/libraries/wxwidgets/wxGTK31.nix { };
+  wxGTK31-gtk2 = wxGTK31.override { withGtk2 = true; };
+  wxGTK31-gtk3 = wxGTK31.override { withGtk2 = false; };
 
   wxSVG = callPackage ../development/libraries/wxSVG {
     wxGTK = wxGTK30-gtk3;
@@ -21297,8 +21300,6 @@ with pkgs;
 
   felix_remoteshell = callPackage ../servers/felix/remoteshell.nix { };
 
-  fingerd_bsd = callPackage ../servers/fingerd/bsd-fingerd { };
-
   inherit (callPackages ../servers/firebird { }) firebird_4 firebird_3 firebird_2_5 firebird;
 
   freeradius = callPackage ../servers/freeradius { };
@@ -25537,6 +25538,10 @@ with pkgs;
 
   fnott = callPackage ../applications/misc/fnott { };
 
+  furnace = callPackage ../applications/audio/furnace {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
+
   gg-scm = callPackage ../applications/version-management/git-and-tools/gg { };
 
   gigalixir = with python3Packages; toPythonApplication gigalixir;
@@ -26945,6 +26950,8 @@ with pkgs;
 
   kapow = libsForQt5.callPackage ../applications/misc/kapow { };
 
+  kchmviewer = libsForQt5.callPackage ../applications/misc/kchmviewer { };
+
   kappanhang = callPackage ../applications/radio/kappanhang { };
 
   okteta = libsForQt5.callPackage ../applications/editors/okteta { };
@@ -27170,7 +27177,7 @@ with pkgs;
 
   caps = callPackage ../applications/audio/caps { };
 
-  lbdb = callPackage ../tools/misc/lbdb { abook = null; gnupg = null; goobook = null; khard = null; mu = null; };
+  lbdb = callPackage ../tools/misc/lbdb { };
 
   lbry = callPackage ../applications/video/lbry { };
 
@@ -27342,6 +27349,8 @@ with pkgs;
 
   luddite = with python3Packages; toPythonApplication luddite;
 
+  goobook = with python3Packages; toPythonApplication goobook;
+
   lumail = callPackage ../applications/networking/mailreaders/lumail {
     lua = lua5_1;
   };
@@ -32289,6 +32298,8 @@ with pkgs;
 
   blas = callPackage ../build-support/alternatives/blas { };
 
+  blas-ilp64 = blas.override { isILP64 = true; };
+
   blas-reference = callPackage ../development/libraries/science/math/blas { };
 
   bonmin = callPackage ../development/libraries/science/math/bonmin { };
@@ -32313,6 +32324,8 @@ with pkgs;
 
   lapack = callPackage ../build-support/alternatives/lapack { };
 
+  lapack-ilp64 = lapack.override { isILP64 = true; };
+
   lapack-reference = callPackage ../development/libraries/science/math/liblapack { };
   liblapack = lapack-reference;
 
@@ -32654,6 +32667,8 @@ with pkgs;
 
   monosat = callPackage ../applications/science/logic/monosat {};
 
+  nuXmv = callPackage ../applications/science/logic/nuXmv {};
+
   opensmt = callPackage ../applications/science/logic/opensmt { };
 
   ott = callPackage ../applications/science/logic/ott { };
@@ -33763,7 +33778,9 @@ with pkgs;
 
   disnixos = callPackage ../tools/package-management/disnix/disnixos { };
 
-  DisnixWebService = callPackage ../tools/package-management/disnix/DisnixWebService { };
+  DisnixWebService = callPackage ../tools/package-management/disnix/DisnixWebService {
+    jdk = jdk8;
+  };
 
   i3a = callPackage ../misc/i3a { };
 
diff --git a/nixpkgs/pkgs/top-level/python-aliases.nix b/nixpkgs/pkgs/top-level/python-aliases.nix
index 2ac1f83917a0..4718d942d8ee 100644
--- a/nixpkgs/pkgs/top-level/python-aliases.nix
+++ b/nixpkgs/pkgs/top-level/python-aliases.nix
@@ -85,6 +85,7 @@ mapAliases ({
   pylibgen = throw "pylibgen is unmaintained upstreamed, and removed from nixpkgs"; # added 2020-06-20
   pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04
   pysmart-smartx = pysmart; # added 2021-10-22
+  pytest_6 = pytest; # added 2022-02-10
   pytestcov = pytest-cov; # added 2021-01-04
   pytest-pep8 = pytestpep8; # added 2021-01-04
   pytestpep8 = throw "pytestpep8 was removed because it is abandoned and no longer compatible with pytest v6.0"; # added 2020-12-10
diff --git a/nixpkgs/pkgs/top-level/python-packages.nix b/nixpkgs/pkgs/top-level/python-packages.nix
index 19465727dc47..cc1f72bcadd7 100644
--- a/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/nixpkgs/pkgs/top-level/python-packages.nix
@@ -137,16 +137,6 @@ in {
     venvShellHook
     wheelUnpackHook;
 
-  # Not all packages are compatible with the latest pytest yet.
-  # We need to override the hook to select an older pytest, however,
-  # it should not override the version of pytest that is used for say
-  # Python 2. This is an ugly hack that is needed now because the hook
-  # propagates the package.
-  pytestCheckHook_6_1 = if isPy3k then
-    self.pytestCheckHook.override { pytest = self.pytest_6_1; }
-  else
-    self.pytestCheckHook;
-
   # helpers
 
   # We use build packages because we are making a setup hook to be used as a
@@ -2222,7 +2212,7 @@ in {
 
   distutils_extra = callPackage ../development/python-modules/distutils_extra { };
 
-  django = self.django_2;
+  django = self.django_3;
 
   # Current LTS
   django_2 = callPackage ../development/python-modules/django/2.nix { };
@@ -7787,28 +7777,12 @@ in {
 
   pytesseract = callPackage ../development/python-modules/pytesseract { };
 
-  pytest = self.pytest_6;
-
-  pytest_6 =
-    callPackage ../development/python-modules/pytest {
-      # hypothesis tests require pytest that causes dependency cycle
-      hypothesis = self.hypothesis.override {
-        doCheck = false;
-      };
+  pytest = callPackage ../development/python-modules/pytest {
+    # hypothesis tests require pytest that causes dependency cycle
+    hypothesis = self.hypothesis.override {
+      doCheck = false;
     };
-
-  pytest_6_1 = self.pytest_6.overridePythonAttrs (oldAttrs: rec {
-    version = "6.1.2";
-    src = oldAttrs.src.override {
-      inherit version;
-      sha256 = "c0a7e94a8cdbc5422a51ccdad8e6f1024795939cc89159a0ae7f0b316ad3823e";
-    };
-
-    postPatch = ''
-      substituteInPlace setup.cfg \
-        --replace "pluggy>=0.12,<1.0" "pluggy>=0.12,<2.0"
-    '';
-  });
+  };
 
   pytest-aio = callPackage ../development/python-modules/pytest-aio { };