about summary refs log tree commit diff
path: root/pkgs/development
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/development')
-rw-r--r--pkgs/development/compilers/dmd/default.nix2
-rw-r--r--pkgs/development/compilers/edk2/default.nix2
-rw-r--r--pkgs/development/compilers/gcc/10/default.nix9
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix9
-rw-r--r--pkgs/development/compilers/gcc/12/default.nix10
-rw-r--r--pkgs/development/compilers/gforth/boot-forth.nix2
-rw-r--r--pkgs/development/compilers/ghdl/default.nix2
-rw-r--r--pkgs/development/compilers/go/1.18.nix4
-rw-r--r--pkgs/development/compilers/idris2/default.nix2
-rw-r--r--pkgs/development/compilers/idris2/tests.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/libcxx/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/11/libcxx/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/12/compiler-rt/default.nix13
-rw-r--r--pkgs/development/compilers/llvm/12/libcxx/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/12/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/13/compiler-rt/default.nix17
-rw-r--r--pkgs/development/compilers/llvm/13/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/14/clang/add-nostdlibinc-flag.patch18
-rw-r--r--pkgs/development/compilers/llvm/14/clang/default.nix5
-rw-r--r--pkgs/development/compilers/llvm/14/compiler-rt/default.nix17
-rw-r--r--pkgs/development/compilers/llvm/14/libcxxabi/default.nix13
-rw-r--r--pkgs/development/compilers/llvm/5/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/6/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/7/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/8/libcxx/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/9/libcxx/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/common/compiler-rt/darwin-plistbuddy-workaround.patch25
-rw-r--r--pkgs/development/compilers/llvm/git/clang/add-nostdlibinc-flag.patch18
-rw-r--r--pkgs/development/compilers/llvm/git/clang/default.nix5
-rw-r--r--pkgs/development/compilers/llvm/git/compiler-rt/default.nix15
-rw-r--r--pkgs/development/compilers/llvm/git/libcxxabi/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/rocm/llvm.nix3
-rw-r--r--pkgs/development/compilers/manticore/default.nix2
-rw-r--r--pkgs/development/compilers/orc/default.nix2
-rw-r--r--pkgs/development/compilers/p4c/default.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.0.8.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.0.9.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.1.1.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.1.10.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.1.11.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.1.2.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.1.9.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.2.4.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.2.6.nix4
-rw-r--r--pkgs/development/compilers/sbcl/2.x.nix (renamed from pkgs/development/compilers/sbcl/common.nix)54
-rw-r--r--pkgs/development/compilers/sbcl/bootstrap.nix4
-rw-r--r--pkgs/development/compilers/swi-prolog/default.nix4
-rw-r--r--pkgs/development/compilers/swift/default.nix2
-rw-r--r--pkgs/development/coq-modules/coq-record-update/default.nix2
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix28
-rw-r--r--pkgs/development/haskell-modules/hoogle.nix1
-rw-r--r--pkgs/development/interpreters/acl2/default.nix2
-rw-r--r--pkgs/development/interpreters/kerf/default.nix6
-rw-r--r--pkgs/development/interpreters/lua-5/default.nix1
-rw-r--r--pkgs/development/interpreters/perl/default.nix6
-rw-r--r--pkgs/development/interpreters/php/generic.nix4
-rw-r--r--pkgs/development/interpreters/python-cosmopolitan/default.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix6
-rw-r--r--pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh3
-rw-r--r--pkgs/development/interpreters/python/mk-python-derivation.nix2
-rw-r--r--pkgs/development/interpreters/python/rustpython/default.nix2
-rw-r--r--pkgs/development/interpreters/qnial/default.nix3
-rw-r--r--pkgs/development/interpreters/racket/default.nix4
-rw-r--r--pkgs/development/interpreters/racket/racket_7_9.nix4
-rw-r--r--pkgs/development/interpreters/ruby/default.nix2
-rw-r--r--pkgs/development/interpreters/spidermonkey/common.nix2
-rw-r--r--pkgs/development/interpreters/unicon-lang/default.nix4
-rw-r--r--pkgs/development/libraries/accountsservice/default.nix2
-rw-r--r--pkgs/development/libraries/ada/gnatcoll/db.nix2
-rw-r--r--pkgs/development/libraries/apr-util/default.nix24
-rw-r--r--pkgs/development/libraries/apr-util/fix-libxcrypt-build.patch14
-rw-r--r--pkgs/development/libraries/apr/default.nix2
-rw-r--r--pkgs/development/libraries/avahi/default.nix6
-rw-r--r--pkgs/development/libraries/boost/generic.nix4
-rw-r--r--pkgs/development/libraries/cosmopolitan/default.nix2
-rw-r--r--pkgs/development/libraries/cxxopts/default.nix4
-rw-r--r--pkgs/development/libraries/cyrus-sasl/default.nix6
-rw-r--r--pkgs/development/libraries/dbus/default.nix18
-rw-r--r--pkgs/development/libraries/drogon/default.nix2
-rw-r--r--pkgs/development/libraries/fcft/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix11
-rw-r--r--pkgs/development/libraries/ffmpeg/5.nix7
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix120
-rw-r--r--pkgs/development/libraries/galario/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/common.nix5
-rw-r--r--pkgs/development/libraries/glibc/default.nix3
-rw-r--r--pkgs/development/libraries/gnutls/default.nix2
-rw-r--r--pkgs/development/libraries/gpgme/default.nix2
-rw-r--r--pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch369
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix2
-rw-r--r--pkgs/development/libraries/gvm-libs/default.nix2
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix21
-rw-r--r--pkgs/development/libraries/hunspell/default.nix2
-rw-r--r--pkgs/development/libraries/json-glib/default.nix2
-rw-r--r--pkgs/development/libraries/kerberos/krb5.nix2
-rw-r--r--pkgs/development/libraries/libav/default.nix4
-rw-r--r--pkgs/development/libraries/libcli/default.nix4
-rw-r--r--pkgs/development/libraries/libdaemon/default.nix2
-rw-r--r--pkgs/development/libraries/libdeflate/default.nix2
-rw-r--r--pkgs/development/libraries/libeatmydata/default.nix2
-rw-r--r--pkgs/development/libraries/libff/default.nix2
-rw-r--r--pkgs/development/libraries/libfilezilla/default.nix3
-rw-r--r--pkgs/development/libraries/libguestfs/default.nix2
-rw-r--r--pkgs/development/libraries/libical/default.nix5
-rw-r--r--pkgs/development/libraries/liblc3/default.nix36
-rw-r--r--pkgs/development/libraries/libmcrypt/default.nix2
-rw-r--r--pkgs/development/libraries/libpam-wrapper/default.nix2
-rw-r--r--pkgs/development/libraries/libvdpau/default.nix2
-rw-r--r--pkgs/development/libraries/libvncserver/default.nix2
-rw-r--r--pkgs/development/libraries/libxcrypt/default.nix44
-rw-r--r--pkgs/development/libraries/libxml2/default.nix7
-rw-r--r--pkgs/development/libraries/libxslt/default.nix12
-rw-r--r--pkgs/development/libraries/mesa/default.nix2
-rw-r--r--pkgs/development/libraries/mimalloc/default.nix2
-rw-r--r--pkgs/development/libraries/nng/default.nix2
-rw-r--r--pkgs/development/libraries/openbsm/default.nix2
-rw-r--r--pkgs/development/libraries/opencv/3.x.nix2
-rw-r--r--pkgs/development/libraries/openldap/default.nix2
-rw-r--r--pkgs/development/libraries/openmpi/default.nix2
-rw-r--r--pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch33
-rw-r--r--pkgs/development/libraries/openssl/default.nix12
-rw-r--r--pkgs/development/libraries/openvino/default.nix4
-rw-r--r--pkgs/development/libraries/p11-kit/default.nix1
-rw-r--r--pkgs/development/libraries/pangomm/2.48.nix2
-rw-r--r--pkgs/development/libraries/physics/cernlib/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/default.nix15
-rw-r--r--pkgs/development/libraries/poppler/default.nix2
-rw-r--r--pkgs/development/libraries/precice/default.nix2
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtlocation.nix2
-rw-r--r--pkgs/development/libraries/redis-plus-plus/default.nix4
-rw-r--r--pkgs/development/libraries/rustc-demangle/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/faiss/default.nix2
-rw-r--r--pkgs/development/libraries/science/networking/ns-3/default.nix4
-rw-r--r--pkgs/development/libraries/sord/default.nix37
-rw-r--r--pkgs/development/libraries/speechd/default.nix16
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/talloc/default.nix2
-rw-r--r--pkgs/development/libraries/tdb/default.nix2
-rw-r--r--pkgs/development/libraries/vtk/generic.nix2
-rw-r--r--pkgs/development/libraries/wavpack/default.nix9
-rw-r--r--pkgs/development/libraries/x264/default.nix12
-rw-r--r--pkgs/development/libraries/zeroc-ice/default.nix4
-rw-r--r--pkgs/development/lua-modules/overrides.nix13
-rw-r--r--pkgs/development/mobile/androidenv/cmake.nix2
-rw-r--r--pkgs/development/mobile/androidenv/ndk-bundle/default.nix2
-rw-r--r--pkgs/development/mobile/androidenv/tools/25.nix2
-rw-r--r--pkgs/development/node-packages/overrides.nix23
-rw-r--r--pkgs/development/ocaml-modules/bz2/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/cudf/default.nix2
-rw-r--r--pkgs/development/python-modules/aiodns/default.nix2
-rw-r--r--pkgs/development/python-modules/ansible-runner/default.nix2
-rw-r--r--pkgs/development/python-modules/aspy-refactor-imports/default.nix2
-rw-r--r--pkgs/development/python-modules/asyncio_mqtt/default.nix2
-rw-r--r--pkgs/development/python-modules/azure-core/default.nix2
-rw-r--r--pkgs/development/python-modules/behave/default.nix4
-rw-r--r--pkgs/development/python-modules/betterproto/default.nix2
-rw-r--r--pkgs/development/python-modules/catboost/default.nix2
-rw-r--r--pkgs/development/python-modules/certifi/default.nix10
-rw-r--r--pkgs/development/python-modules/ciso8601/default.nix2
-rw-r--r--pkgs/development/python-modules/clintermission/default.nix21
-rw-r--r--pkgs/development/python-modules/coconut/default.nix4
-rw-r--r--pkgs/development/python-modules/deprecation/default.nix2
-rw-r--r--pkgs/development/python-modules/dnspython/default.nix2
-rw-r--r--pkgs/development/python-modules/drivelib/default.nix4
-rw-r--r--pkgs/development/python-modules/enlighten/default.nix2
-rw-r--r--pkgs/development/python-modules/expiringdict/default.nix15
-rw-r--r--pkgs/development/python-modules/filecheck/default.nix25
-rw-r--r--pkgs/development/python-modules/fixtures/default.nix2
-rw-r--r--pkgs/development/python-modules/funcsigs/default.nix2
-rw-r--r--pkgs/development/python-modules/gdown/default.nix4
-rw-r--r--pkgs/development/python-modules/gigalixir/default.nix70
-rw-r--r--pkgs/development/python-modules/glymur/default.nix2
-rw-r--r--pkgs/development/python-modules/gprof2dot/default.nix7
-rw-r--r--pkgs/development/python-modules/griffe/default.nix4
-rw-r--r--pkgs/development/python-modules/hupper/default.nix2
-rw-r--r--pkgs/development/python-modules/importlib-resources/default.nix2
-rw-r--r--pkgs/development/python-modules/iso8601/default.nix6
-rw-r--r--pkgs/development/python-modules/jaraco_text/default.nix4
-rw-r--r--pkgs/development/python-modules/jaxlib/default.nix6
-rw-r--r--pkgs/development/python-modules/jsbeautifier/default.nix4
-rw-r--r--pkgs/development/python-modules/language-data/default.nix4
-rw-r--r--pkgs/development/python-modules/lightgbm/default.nix2
-rw-r--r--pkgs/development/python-modules/markdown-it-py/default.nix2
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-autorefs/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-material/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-minify/default.nix10
-rw-r--r--pkgs/development/python-modules/mkdocs-redirects/default.nix13
-rw-r--r--pkgs/development/python-modules/mkdocstrings-python/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocstrings/default.nix4
-rw-r--r--pkgs/development/python-modules/mypy-protobuf/default.nix28
-rw-r--r--pkgs/development/python-modules/nipy/default.nix2
-rw-r--r--pkgs/development/python-modules/notebook/default.nix2
-rw-r--r--pkgs/development/python-modules/notifymuch/default.nix52
-rw-r--r--pkgs/development/python-modules/numba/default.nix2
-rw-r--r--pkgs/development/python-modules/paho-mqtt/default.nix2
-rw-r--r--pkgs/development/python-modules/peewee/default.nix4
-rw-r--r--pkgs/development/python-modules/phonemizer/default.nix9
-rw-r--r--pkgs/development/python-modules/pillow-simd/default.nix2
-rw-r--r--pkgs/development/python-modules/pillow/default.nix2
-rw-r--r--pkgs/development/python-modules/pillow/generic.nix2
-rw-r--r--pkgs/development/python-modules/poetry-core/default.nix22
-rw-r--r--pkgs/development/python-modules/poetry2conda/default.nix44
-rw-r--r--pkgs/development/python-modules/pygit2/default.nix4
-rw-r--r--pkgs/development/python-modules/pyls-mypy/default.nix2
-rw-r--r--pkgs/development/python-modules/pypass/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest-xdist/setup-hook.sh8
-rw-r--r--pkgs/development/python-modules/python-csxcad/default.nix2
-rw-r--r--pkgs/development/python-modules/python-glanceclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-heatclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-ironicclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-manilaclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-miio/default.nix2
-rw-r--r--pkgs/development/python-modules/python-openems/default.nix2
-rw-r--r--pkgs/development/python-modules/python-swiftclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-telegram-bot/default.nix2
-rw-r--r--pkgs/development/python-modules/qutip/default.nix2
-rw-r--r--pkgs/development/python-modules/rdflib/default.nix2
-rw-r--r--pkgs/development/python-modules/remarshal/default.nix4
-rw-r--r--pkgs/development/python-modules/rfc-bibtex/default.nix20
-rw-r--r--pkgs/development/python-modules/rich/default.nix4
-rw-r--r--pkgs/development/python-modules/scipy/default.nix1
-rw-r--r--pkgs/development/python-modules/screeninfo/default.nix4
-rw-r--r--pkgs/development/python-modules/simple-di/default.nix2
-rw-r--r--pkgs/development/python-modules/spacy/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix2
-rw-r--r--pkgs/development/python-modules/starlette/default.nix2
-rw-r--r--pkgs/development/python-modules/sybil/default.nix4
-rw-r--r--pkgs/development/python-modules/tempest/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorflow/bin.nix2
-rw-r--r--pkgs/development/python-modules/tensorflow/default.nix2
-rw-r--r--pkgs/development/python-modules/thinc/default.nix4
-rw-r--r--pkgs/development/python-modules/twisted/default.nix3
-rw-r--r--pkgs/development/python-modules/tzdata/default.nix2
-rw-r--r--pkgs/development/python-modules/wandb/default.nix2
-rw-r--r--pkgs/development/python-modules/web3/default.nix2
-rw-r--r--pkgs/development/python-modules/yamllint/default.nix2
-rw-r--r--pkgs/development/python-modules/yolk/default.nix23
-rw-r--r--pkgs/development/ruby-modules/bundler-app/default.nix4
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/analysis/radare2/default.nix8
-rw-r--r--pkgs/development/tools/analysis/rr/zen_workaround.nix2
-rw-r--r--pkgs/development/tools/analysis/sparse/default.nix2
-rw-r--r--pkgs/development/tools/codespell/default.nix (renamed from pkgs/development/python-modules/codespell/default.nix)16
-rw-r--r--pkgs/development/tools/database/prisma-engines/default.nix8
-rw-r--r--pkgs/development/tools/godot/default.nix2
-rw-r--r--pkgs/development/tools/godot/export-templates.nix2
-rw-r--r--pkgs/development/tools/godot/headless.nix2
-rw-r--r--pkgs/development/tools/godot/server.nix2
-rw-r--r--pkgs/development/tools/libsigrokdecode/default.nix4
-rw-r--r--pkgs/development/tools/misc/bashdb/default.nix2
-rw-r--r--pkgs/development/tools/misc/luarocks/default.nix37
-rw-r--r--pkgs/development/tools/misc/pahole/default.nix2
-rw-r--r--pkgs/development/tools/misc/pkg-config/default.nix4
-rw-r--r--pkgs/development/tools/misc/texinfo/common.nix2
-rw-r--r--pkgs/development/tools/mutmut/default.nix (renamed from pkgs/development/python-modules/mutmut/default.nix)11
-rw-r--r--pkgs/development/tools/ocaml/dune/2.nix2
-rw-r--r--pkgs/development/tools/ocaml/dune/3.nix2
-rw-r--r--pkgs/development/tools/parsing/ragel/default.nix2
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix10
-rw-r--r--pkgs/development/tools/summon/default.nix2
-rw-r--r--pkgs/development/web/nodejs/bypass-darwin-xcrun-node16.patch41
-rw-r--r--pkgs/development/web/nodejs/nodejs.nix3
-rw-r--r--pkgs/development/web/nodejs/v16.nix1
-rw-r--r--pkgs/development/web/nodejs/v18.nix5
273 files changed, 1464 insertions, 858 deletions
diff --git a/pkgs/development/compilers/dmd/default.nix b/pkgs/development/compilers/dmd/default.nix
index 1c15e8b970b7..b29190b9b834 100644
--- a/pkgs/development/compilers/dmd/default.nix
+++ b/pkgs/development/compilers/dmd/default.nix
@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper unzip which git ];
 
   buildInputs = [ gdb curl tzdata ]
-    ++ lib.optional stdenv.isDarwin [ Foundation gdb ];
+    ++ lib.optionals stdenv.isDarwin [ Foundation gdb ];
 
 
   osname = if stdenv.isDarwin then
diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix
index 90e570f7da40..d51601404868 100644
--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@@ -61,7 +61,7 @@ edk2 = buildStdenv.mkDerivation {
   ${"GCC5_${targetArch}_PREFIX"}=stdenv.cc.targetPrefix;
 
   makeFlags = [ "-C BaseTools" ]
-    ++ lib.optional (stdenv.cc.isClang) [ "BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang" ];
+    ++ lib.optionals (stdenv.cc.isClang) [ "BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang" ];
 
   NIX_CFLAGS_COMPILE = "-Wno-return-type" + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation";
 
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 78728c3c592b..207860b90c0e 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -26,6 +26,7 @@
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
+, libxcrypt
 }:
 
 # Make sure we get GNU sed.
@@ -172,7 +173,7 @@ stdenv.mkDerivation ({
     ++ optional targetPlatform.isLinux patchelf;
 
   buildInputs = [
-    gmp mpfr libmpc
+    gmp mpfr libmpc libxcrypt
     targetPackages.stdenv.cc.bintools # For linking code at run-time
   ] ++ (optional (isl != null) isl)
     ++ (optional (zlib != null) zlib)
@@ -182,10 +183,12 @@ stdenv.mkDerivation ({
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
-  preConfigure = import ../common/pre-configure.nix {
+  preConfigure = (import ../common/pre-configure.nix {
     inherit lib;
     inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit crossStageStatic enableMultilib;
-  };
+  }) + ''
+    ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
+  '';
 
   dontDisableStatic = true;
 
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 3a61c5820b11..3b03e185dd86 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -26,6 +26,7 @@
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
+, libxcrypt
 }:
 
 # Make sure we get GNU sed.
@@ -180,7 +181,7 @@ stdenv.mkDerivation ({
     ++ optional targetPlatform.isLinux patchelf;
 
   buildInputs = [
-    gmp mpfr libmpc
+    gmp mpfr libmpc libxcrypt
     targetPackages.stdenv.cc.bintools # For linking code at run-time
   ] ++ (optional (isl != null) isl)
     ++ (optional (zlib != null) zlib)
@@ -190,10 +191,12 @@ stdenv.mkDerivation ({
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
-  preConfigure = import ../common/pre-configure.nix {
+  preConfigure = (import ../common/pre-configure.nix {
     inherit lib;
     inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit crossStageStatic enableMultilib;
-  };
+  }) + ''
+    ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
+  '';
 
   dontDisableStatic = true;
 
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 10ce704382a7..c7fcd5475ade 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -26,6 +26,7 @@
 , gnused ? null
 , cloog # unused; just for compat with gcc4, as we override the parameter on some places
 , buildPackages
+, libxcrypt
 }:
 
 # Make sure we get GNU sed.
@@ -173,7 +174,7 @@ stdenv.mkDerivation ({
     ++ optional targetPlatform.isLinux patchelf;
 
   buildInputs = [
-    gmp mpfr libmpc
+    gmp mpfr libmpc libxcrypt
     targetPackages.stdenv.cc.bintools # For linking code at run-time
   ] ++ (optional (isl != null) isl)
     ++ (optional (zlib != null) zlib)
@@ -183,10 +184,13 @@ stdenv.mkDerivation ({
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
-  preConfigure = import ../common/pre-configure.nix {
+
+  preConfigure = (import ../common/pre-configure.nix {
     inherit lib;
     inherit version targetPlatform hostPlatform gnatboot langAda langGo langJit crossStageStatic enableMultilib;
-  };
+  }) + ''
+    ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
+  '';
 
   dontDisableStatic = true;
 
diff --git a/pkgs/development/compilers/gforth/boot-forth.nix b/pkgs/development/compilers/gforth/boot-forth.nix
index fc7b5ffa982d..74a267687b8f 100644
--- a/pkgs/development/compilers/gforth/boot-forth.nix
+++ b/pkgs/development/compilers/gforth/boot-forth.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ m4 ];
 
-  configureFlags = lib.optional stdenv.isDarwin [ "--build=x86_64-apple-darwin" ];
+  configureFlags = lib.optionals stdenv.isDarwin [ "--build=x86_64-apple-darwin" ];
 
   meta = {
     description = "The Forth implementation of the GNU project (outdated version used to bootstrap)";
diff --git a/pkgs/development/compilers/ghdl/default.nix b/pkgs/development/compilers/ghdl/default.nix
index 383fec786b91..0e11c703d7b6 100644
--- a/pkgs/development/compilers/ghdl/default.nix
+++ b/pkgs/development/compilers/ghdl/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     zlib
-  ] ++ lib.optional (backend == "llvm") [
+  ] ++ lib.optionals (backend == "llvm") [
     llvm
   ];
   propagatedBuildInputs = [
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index c3ec8ceac009..7490aa8a2484 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18.6";
+  version = "1.18.7";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-p/HVBCQ1XavOZtERKxyuQ5tu5eTxXtum8QTApLFz6JU=";
+    sha256 = "sha256-lGfjO4Gfcb67IfsO4d1nlP0iRK6UkHqYQoZxL5g5qUQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/idris2/default.nix b/pkgs/development/compilers/idris2/default.nix
index 9c7a9e53a2e6..bb7d7a7a131c 100644
--- a/pkgs/development/compilers/idris2/default.nix
+++ b/pkgs/development/compilers/idris2/default.nix
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   strictDeps = true;
   nativeBuildInputs = [ makeWrapper clang platformChez ]
-    ++ lib.optional stdenv.isDarwin [ zsh ];
+    ++ lib.optionals stdenv.isDarwin [ zsh ];
   buildInputs = [ platformChez gmp ];
 
   prePatch = ''
diff --git a/pkgs/development/compilers/idris2/tests.nix b/pkgs/development/compilers/idris2/tests.nix
index a8d48c26ca6f..54bb6d29eeef 100644
--- a/pkgs/development/compilers/idris2/tests.nix
+++ b/pkgs/development/compilers/idris2/tests.nix
@@ -11,7 +11,7 @@ let
       # is not the case with pure nix environments. Thus, we need to include zsh
       # when we build for darwin in tests. While this is impure, this is also what
       # we find in real darwin hosts.
-      nativeBuildInputs = lib.optional stdenv.isDarwin [ zsh ];
+      nativeBuildInputs = lib.optionals stdenv.isDarwin [ zsh ];
 
       buildCommand = ''
         set -eo pipefail
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index d74aa519b769..4ae59a431770 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, version, fetch, cmake, python3, libllvm, libcxxabi }:
+{ lib, stdenv, llvm_meta, version, fetch, cmake, python3, libllvm, libcxxabi, libxcrypt }:
 
 let
 
@@ -25,6 +25,8 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ lib.optionals (haveLibc && !isMusl) [
+    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
diff --git a/pkgs/development/compilers/llvm/10/libcxx/default.nix b/pkgs/development/compilers/llvm/10/libcxx/default.nix
index d438294bdd0b..6a4e645bb300 100644
--- a/pkgs/development/compilers/llvm/10/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxx/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
index 482ced8e0c3f..c61f48485580 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
@@ -42,11 +42,21 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index 4968c8bcfbd8..6790910ee830 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, version, fetch, cmake, python3, libllvm, libcxxabi }:
+{ lib, stdenv, llvm_meta, version, fetch, cmake, python3, xcbuild, libllvm, libcxxabi, libxcrypt }:
 
 let
 
@@ -15,7 +15,8 @@ stdenv.mkDerivation {
   inherit version;
   src = fetch "compiler-rt" "0x1j8ngf1zj63wlnns9vlibafq48qcm72p4jpaxkmkb4qw0grwfy";
 
-  nativeBuildInputs = [ cmake python3 libllvm.dev ];
+  nativeBuildInputs = [ cmake python3 libllvm.dev ]
+     ++ lib.optional stdenv.isDarwin xcbuild.xcrun;
 
   NIX_CFLAGS_COMPILE = [
     "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
@@ -25,6 +26,8 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ lib.optionals (haveLibc && !isMusl) [
+    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl || isNewDarwinBootstrap) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
@@ -59,8 +62,9 @@ stdenv.mkDerivation {
     # extra `/`.
     ./normalize-var.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
-  ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
-
+    ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
+    ./armv7l.patch
+  ];
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
     cmakeFlagsArray+=("-DCMAKE_LIPO=$(command -v ${stdenv.cc.targetPrefix}lipo)")
@@ -75,8 +79,6 @@ stdenv.mkDerivation {
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/builtin-config-ix.cmake \
-      --replace 'foreach(arch ''${ARM64})' 'foreach(arch)'
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/11/libcxx/default.nix b/pkgs/development/compilers/llvm/11/libcxx/default.nix
index 9aa49c9a009e..2a83b36fc425 100644
--- a/pkgs/development/compilers/llvm/11/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxx/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation {
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
index 6c4ca925ab11..2359820dddec 100644
--- a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
@@ -46,11 +46,21 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index d1497e6db1e3..ed34d06ed986 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, version, fetch, cmake, python3, libllvm, libcxxabi }:
+{ lib, stdenv, llvm_meta, version, fetch, cmake, python3, xcbuild, libllvm, libcxxabi, libxcrypt }:
 
 let
 
@@ -14,7 +14,8 @@ stdenv.mkDerivation {
   inherit version;
   src = fetch "compiler-rt" "1950rg294izdwkaasi7yjrmadc9mzdd5paf0q63jjcq2m3rdbj5l";
 
-  nativeBuildInputs = [ cmake python3 libllvm.dev ];
+  nativeBuildInputs = [ cmake python3 libllvm.dev ]
+    ++ lib.optional stdenv.isDarwin xcbuild.xcrun;
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   NIX_CFLAGS_COMPILE = [
@@ -25,6 +26,8 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ lib.optionals (haveLibc && !isMusl) [
+    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
@@ -59,7 +62,9 @@ stdenv.mkDerivation {
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
     # extra `/`.
     ./normalize-var.patch
-  ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
+    ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
+    ./armv7l.patch
+  ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
@@ -70,8 +75,6 @@ stdenv.mkDerivation {
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/builtin-config-ix.cmake \
-      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/12/libcxx/default.nix b/pkgs/development/compilers/llvm/12/libcxx/default.nix
index 3ddcb7997505..1386d3680f91 100644
--- a/pkgs/development/compilers/llvm/12/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxx/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
index 89b56ad230d8..c130a6c1c311 100644
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@@ -44,11 +44,21 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
index 7b9312eecf24..9124686705ae 100644
--- a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, version, src, cmake, python3, libllvm, libcxxabi }:
+{ lib, stdenv, llvm_meta, version, src, cmake, python3, xcbuild, libllvm, libcxxabi, libxcrypt }:
 
 let
 
@@ -16,7 +16,8 @@ stdenv.mkDerivation {
   inherit src;
   sourceRoot = "source/compiler-rt";
 
-  nativeBuildInputs = [ cmake python3 libllvm.dev ];
+  nativeBuildInputs = [ cmake python3 libllvm.dev ]
+    ++ lib.optional stdenv.isDarwin xcbuild.xcrun;
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   NIX_CFLAGS_COMPILE = [
@@ -27,6 +28,8 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ lib.optionals (haveLibc && !isMusl) [
+    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl || isAarch64) [
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
@@ -62,9 +65,11 @@ stdenv.mkDerivation {
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
     # extra `/`.
     ./normalize-var.patch
-  ] # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
+    # Prevent a compilation error on darwin
+    ./darwin-targetconditionals.patch
+    ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
+    ./armv7l.patch
+  ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
@@ -75,8 +80,6 @@ stdenv.mkDerivation {
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/builtin-config-ix.cmake \
-      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
index 16ea0b113c75..5da86b96d5a7 100644
--- a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
@@ -41,11 +41,21 @@ stdenv.mkDerivation rec {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/14/clang/add-nostdlibinc-flag.patch b/pkgs/development/compilers/llvm/14/clang/add-nostdlibinc-flag.patch
new file mode 100644
index 000000000000..b73cd0185eb6
--- /dev/null
+++ b/pkgs/development/compilers/llvm/14/clang/add-nostdlibinc-flag.patch
@@ -0,0 +1,18 @@
+diff --git a/lib/Driver/Driver.cpp b/lib/Driver/Driver.cpp
+index 3bfddeefc7b2..05b11d9e562d 100644
+--- a/lib/Driver/Driver.cpp
++++ b/lib/Driver/Driver.cpp
+@@ -482,6 +482,13 @@ DerivedArgList *Driver::TranslateInputArgs(const InputArgList &Args) const {
+   }
+ #endif
+ 
++  {
++    Arg *A = DAL->MakeFlagArg(/*BaseArg=*/nullptr,
++                              Opts.getOption(options::OPT_nostdlibinc));
++    A->claim();
++    DAL->append(A);
++  }
++
+   return DAL;
+ }
+ 
diff --git a/pkgs/development/compilers/llvm/14/clang/default.nix b/pkgs/development/compilers/llvm/14/clang/default.nix
index 5ff02d68de42..6b775efcc039 100644
--- a/pkgs/development/compilers/llvm/14/clang/default.nix
+++ b/pkgs/development/compilers/llvm/14/clang/default.nix
@@ -45,6 +45,7 @@ let
       ./purity.patch
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
+      ./add-nostdlibinc-flag.patch
       (substituteAll {
         src = ../../clang-11-12-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
@@ -54,10 +55,6 @@ let
     postPatch = ''
       (cd tools && ln -s ../../clang-tools-extra extra)
 
-      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
-             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
-             lib/Driver/ToolChains/*.cpp
-
       # Patch for standalone doc building
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '' + lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
index 28c77d5ffb39..ef2495714e45 100644
--- a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta, version
 , monorepoSrc, runCommand
-, cmake, python3, libllvm, libcxxabi
+, cmake, python3, xcbuild, libllvm, libcxxabi, libxcrypt
 }:
 
 let
@@ -26,7 +26,8 @@ stdenv.mkDerivation {
   inherit src;
   sourceRoot = "${src.name}/${baseName}";
 
-  nativeBuildInputs = [ cmake python3 libllvm.dev ];
+  nativeBuildInputs = [ cmake python3 libllvm.dev ]
+    ++ lib.optional stdenv.isDarwin xcbuild.xcrun;
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   NIX_CFLAGS_COMPILE = [
@@ -37,6 +38,8 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ lib.optionals (haveLibc && !isMusl) [
+    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
@@ -73,9 +76,11 @@ stdenv.mkDerivation {
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
     # extra `/`.
     ./normalize-var.patch
-  ] # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
+    # Prevent a compilation error on darwin
+    ./darwin-targetconditionals.patch
+    ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
+    ./armv7l.patch
+  ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
@@ -86,8 +91,6 @@ stdenv.mkDerivation {
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/builtin-config-ix.cmake \
-      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
index d64708ab040a..0487f1d0de83 100644
--- a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
@@ -52,12 +52,23 @@ stdenv.mkDerivation rec {
   installPhase = if stdenv.isDarwin
     then ''
       for file in lib/*.dylib; do
+        # Fix up the install name. Preserve the basename, just replace the path.
+        installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
         # this should be done in CMake, but having trouble figuring out
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
         # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
+        ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+        # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+        # libcxxabi to sometimes link against a different version of itself.
+        # Here we simply make that second reference point to ourselves.
+        for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+          ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+        done
       done
+
       make install
       install -d 755 $out/include
       install -m 644 ../include/*.h $out/include
diff --git a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
index 60a41ab2d830..f2f707ec445d 100644
--- a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
@@ -27,11 +27,21 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/6/libcxxabi/default.nix b/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
index d7de130fbaaf..63e6eee6f596 100644
--- a/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
@@ -27,11 +27,21 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/7/libcxxabi/default.nix b/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
index 1bc9444feda1..721200136a57 100644
--- a/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
@@ -46,11 +46,21 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/8/libcxx/default.nix b/pkgs/development/compilers/llvm/8/libcxx/default.nix
index 87cd734899fa..536801129218 100644
--- a/pkgs/development/compilers/llvm/8/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxx/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
index 50a5eabc1703..5ade8a5ae66f 100644
--- a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
@@ -42,11 +42,21 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/9/libcxx/default.nix b/pkgs/development/compilers/llvm/9/libcxx/default.nix
index 271971103107..31a00ba54859 100644
--- a/pkgs/development/compilers/llvm/9/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxx/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
index ee6834affbcd..4a235f5c2ef7 100644
--- a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
@@ -42,11 +42,21 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/darwin-plistbuddy-workaround.patch b/pkgs/development/compilers/llvm/common/compiler-rt/darwin-plistbuddy-workaround.patch
new file mode 100644
index 000000000000..dae8b3a690ac
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/darwin-plistbuddy-workaround.patch
@@ -0,0 +1,25 @@
+CMake tries to read a list field from SDKSettings.plist, but the output of
+xcbuild PlistBuddy is incompatible with Apple's. (Plus we don't want it in our
+dependencies.)
+
+Simply assume ARM64 is supported by the SDK. We already limit the actual archs
+we build for by setting DARWIN_osx_BUILTIN_ARCHS explicitely.
+
+--- a/cmake/builtin-config-ix.cmake
++++ b/cmake/builtin-config-ix.cmake
+@@ -97,14 +97,7 @@ if(APPLE)
+   set(DARWIN_osx_BUILTIN_MIN_VER 10.5)
+   set(DARWIN_osx_BUILTIN_MIN_VER_FLAG
+       -mmacosx-version-min=${DARWIN_osx_BUILTIN_MIN_VER})
+-  set(DARWIN_osx_BUILTIN_ALL_POSSIBLE_ARCHS ${X86} ${X86_64})
+-  # Add support for arm64 macOS if available in SDK.
+-  foreach(arch ${ARM64})
+-    sdk_has_arch_support(${DARWIN_osx_SYSROOT} macosx ${arch} MACOS_ARM_SUPPORT)
+-    if (MACOS_ARM_SUPPORT)
+-     list(APPEND DARWIN_osx_BUILTIN_ALL_POSSIBLE_ARCHS ${arch})
+-    endif()
+-  endforeach(arch)
++  set(DARWIN_osx_BUILTIN_ALL_POSSIBLE_ARCHS ${X86} ${X86_64} ${ARM64})
+ 
+   if(COMPILER_RT_ENABLE_IOS)
+     list(APPEND DARWIN_EMBEDDED_PLATFORMS ios)
diff --git a/pkgs/development/compilers/llvm/git/clang/add-nostdlibinc-flag.patch b/pkgs/development/compilers/llvm/git/clang/add-nostdlibinc-flag.patch
new file mode 100644
index 000000000000..80c2eb362383
--- /dev/null
+++ b/pkgs/development/compilers/llvm/git/clang/add-nostdlibinc-flag.patch
@@ -0,0 +1,18 @@
+diff --git a/lib/Driver/Driver.cpp b/lib/Driver/Driver.cpp
+index 3f29afd35971..223d2769cdfc 100644
+--- a/lib/Driver/Driver.cpp
++++ b/lib/Driver/Driver.cpp
+@@ -491,6 +491,13 @@ DerivedArgList *Driver::TranslateInputArgs(const InputArgList &Args) const {
+   }
+ #endif
+ 
++  {
++    Arg *A = DAL->MakeFlagArg(/*BaseArg=*/nullptr,
++                              Opts.getOption(options::OPT_nostdlibinc));
++    A->claim();
++    DAL->append(A);
++  }
++
+   return DAL;
+ }
+ 
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index 3110bef09e96..3df0e5042b8d 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -46,6 +46,7 @@ let
       ./purity.patch
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
+      ./add-nostdlibinc-flag.patch
       (substituteAll {
         src = ../../clang-11-12-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
@@ -55,10 +56,6 @@ let
     postPatch = ''
       (cd tools && ln -s ../../clang-tools-extra extra)
 
-      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
-             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
-             lib/Driver/ToolChains/*.cpp
-
       # Patch for standalone doc building
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '' + lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/development/compilers/llvm/git/compiler-rt/default.nix b/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
index 7ac3e3801ffb..9fabce1895a8 100644
--- a/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta, version
 , monorepoSrc, runCommand
-, cmake, python3, libllvm, libcxxabi
+, cmake, python3, xcbuild, libllvm, libcxxabi
 }:
 
 let
@@ -26,7 +26,8 @@ stdenv.mkDerivation {
   inherit src;
   sourceRoot = "${src.name}/${baseName}";
 
-  nativeBuildInputs = [ cmake python3 libllvm.dev ];
+  nativeBuildInputs = [ cmake python3 libllvm.dev ]
+    ++ lib.optional stdenv.isDarwin xcbuild.xcrun;
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   NIX_CFLAGS_COMPILE = [
@@ -71,9 +72,11 @@ stdenv.mkDerivation {
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
     # extra `/`.
     ./normalize-var.patch
-  ] # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
+    # Prevent a compilation error on darwin
+    ./darwin-targetconditionals.patch
+    ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
+    ./armv7l.patch
+  ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
@@ -84,8 +87,6 @@ stdenv.mkDerivation {
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/builtin-config-ix.cmake \
-      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
index 2d4fe974c016..b478668ebded 100644
--- a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
@@ -70,11 +70,21 @@ stdenv.mkDerivation rec {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      # Fix up the install name. Preserve the basename, just replace the path.
+      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
       # if you fancy a try, take a look at
       # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-      install_name_tool -id $out/$file $file
+      ${stdenv.cc.targetPrefix}install_name_tool -id $installName $file
+
+      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
+      # libcxxabi to sometimes link against a different version of itself.
+      # Here we simply make that second reference point to ourselves.
+      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
+      done
     done
   '';
 
diff --git a/pkgs/development/compilers/llvm/rocm/llvm.nix b/pkgs/development/compilers/llvm/rocm/llvm.nix
index 557d19466860..c5ad96a6a189 100644
--- a/pkgs/development/compilers/llvm/rocm/llvm.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm.nix
@@ -9,6 +9,7 @@
 , libxml2
 , libffi
 , libbfd
+, libxcrypt
 , ncurses
 , zlib
 , debugVersion ? false
@@ -32,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ninja python3 ];
 
-  buildInputs = [ libxml2 ];
+  buildInputs = [ libxml2 libxcrypt ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/manticore/default.nix b/pkgs/development/compilers/manticore/default.nix
index 1919f9998058..b767ccf150a6 100644
--- a/pkgs/development/compilers/manticore/default.nix
+++ b/pkgs/development/compilers/manticore/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
 
   buildInputs = [ coreutils smlnj ];
 
-  autoreconfFlags = "-Iconfig -vfi";
+  autoreconfFlags = [ "-Iconfig" "-vfi" ];
 
   unpackPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index fa4bf686a2ac..5ea72781e41f 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
   outputBin = "dev"; # compilation tools
 
   mesonFlags =
-    optional (!buildDevDoc) [ "-Dgtk_doc=disabled" ]
+    optionals (!buildDevDoc) [ "-Dgtk_doc=disabled" ]
   ;
 
   nativeBuildInputs = [ meson ninja ]
diff --git a/pkgs/development/compilers/p4c/default.nix b/pkgs/development/compilers/p4c/default.nix
index 9233489b06ae..cf02a656b770 100644
--- a/pkgs/development/compilers/p4c/default.nix
+++ b/pkgs/development/compilers/p4c/default.nix
@@ -66,8 +66,8 @@ stdenv.mkDerivation rec {
     flex
     cmake
   ]
-  ++ lib.optional enableDocumentation [ doxygen graphviz ]
-  ++ lib.optional enableBPF [ libllvm libbpf ];
+  ++ lib.optionals enableDocumentation [ doxygen graphviz ]
+  ++ lib.optionals enableBPF [ libllvm libbpf ];
 
   buildInputs = [
     protobuf
diff --git a/pkgs/development/compilers/sbcl/2.0.8.nix b/pkgs/development/compilers/sbcl/2.0.8.nix
deleted file mode 100644
index bbc171a8d986..000000000000
--- a/pkgs/development/compilers/sbcl/2.0.8.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.0.8";
-  sha256 = "1xwrwvps7drrpyw3wg5h3g2qajmkwqs9gz0fdw1ns9adp7vld390";
-}
diff --git a/pkgs/development/compilers/sbcl/2.0.9.nix b/pkgs/development/compilers/sbcl/2.0.9.nix
deleted file mode 100644
index 80b30ec87f48..000000000000
--- a/pkgs/development/compilers/sbcl/2.0.9.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.0.9";
-  sha256 = "17wvrcwgp45z9b6arik31fjnz7908qhr5ackxq1y0gqi1hsh1xy4";
-}
diff --git a/pkgs/development/compilers/sbcl/2.1.1.nix b/pkgs/development/compilers/sbcl/2.1.1.nix
deleted file mode 100644
index a32f8a4a28b3..000000000000
--- a/pkgs/development/compilers/sbcl/2.1.1.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.1.1";
-  sha256 = "15wa66sachhzgvg5n35vihmkpasg100lh561c1d1bdrql0p8kbd9";
-}
diff --git a/pkgs/development/compilers/sbcl/2.1.10.nix b/pkgs/development/compilers/sbcl/2.1.10.nix
deleted file mode 100644
index 8cf6f50b5869..000000000000
--- a/pkgs/development/compilers/sbcl/2.1.10.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.1.10";
-  sha256 = "0f5ihj486m7ghh3nc0jlnqa656sbqcmhdv32syz2rjx5b47ky67b";
-}
diff --git a/pkgs/development/compilers/sbcl/2.1.11.nix b/pkgs/development/compilers/sbcl/2.1.11.nix
deleted file mode 100644
index abe48953a573..000000000000
--- a/pkgs/development/compilers/sbcl/2.1.11.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.1.11";
-  sha256 = "1zgypmn19c58pv7j33ga7m1l7lzghj70w3xbybpgmggxwwflihdz";
-}
diff --git a/pkgs/development/compilers/sbcl/2.1.2.nix b/pkgs/development/compilers/sbcl/2.1.2.nix
deleted file mode 100644
index 4f4c85b286c7..000000000000
--- a/pkgs/development/compilers/sbcl/2.1.2.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.1.2";
-  sha256 = "sha256:02scrqyp2izsd8xjm2k5j5lhn4pdhd202jlcb54ysmcqjd80awdp";
-}
diff --git a/pkgs/development/compilers/sbcl/2.1.9.nix b/pkgs/development/compilers/sbcl/2.1.9.nix
deleted file mode 100644
index da26a9aeffb7..000000000000
--- a/pkgs/development/compilers/sbcl/2.1.9.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.1.9";
-  sha256 = "189gjqzdz10xh3ybiy4ch1r98bsmkcb4hpnrmggd4y2g5kqnyx4y";
-}
diff --git a/pkgs/development/compilers/sbcl/2.2.4.nix b/pkgs/development/compilers/sbcl/2.2.4.nix
deleted file mode 100644
index 1be043f112ee..000000000000
--- a/pkgs/development/compilers/sbcl/2.2.4.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.2.4";
-  sha256 = "sha256-/N0lHLxl9/gI7QrXckaEjRvhZqppoX90mWABhLelcgI=";
-}
diff --git a/pkgs/development/compilers/sbcl/2.2.6.nix b/pkgs/development/compilers/sbcl/2.2.6.nix
deleted file mode 100644
index 6fb24da6abe5..000000000000
--- a/pkgs/development/compilers/sbcl/2.2.6.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "2.2.6";
-  sha256 = "sha256-PiMEjI+oJvuRMiC+sqw2l9vFwM3y6J/tjbOe0XEjBKA=";
-}
diff --git a/pkgs/development/compilers/sbcl/common.nix b/pkgs/development/compilers/sbcl/2.x.nix
index 05fa6b390897..ec12ccf17b72 100644
--- a/pkgs/development/compilers/sbcl/common.nix
+++ b/pkgs/development/compilers/sbcl/2.x.nix
@@ -1,5 +1,3 @@
-{ version, sha256 }:
-
 { lib, stdenv, fetchurl, fetchpatch, writeText, sbclBootstrap, zstd
 , sbclBootstrapHost ? "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
 , threadSupport ? (stdenv.hostPlatform.isx86 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
@@ -11,8 +9,54 @@
 , purgeNixReferences ? false
 , coreCompression ? lib.versionAtLeast version "2.2.6"
 , texinfo
+, version
 }:
 
+let
+  versionMap = {
+    "2.0.8" = {
+      sha256 = "1xwrwvps7drrpyw3wg5h3g2qajmkwqs9gz0fdw1ns9adp7vld390";
+    };
+
+    "2.0.9" = {
+      sha256 = "17wvrcwgp45z9b6arik31fjnz7908qhr5ackxq1y0gqi1hsh1xy4";
+    };
+
+    "2.1.1" = {
+      sha256 = "15wa66sachhzgvg5n35vihmkpasg100lh561c1d1bdrql0p8kbd9";
+    };
+
+    "2.1.2" = {
+      sha256 = "sha256:02scrqyp2izsd8xjm2k5j5lhn4pdhd202jlcb54ysmcqjd80awdp";
+    };
+
+    "2.1.9" = {
+      sha256 = "189gjqzdz10xh3ybiy4ch1r98bsmkcb4hpnrmggd4y2g5kqnyx4y";
+    };
+
+    "2.1.10" = {
+      sha256 = "0f5ihj486m7ghh3nc0jlnqa656sbqcmhdv32syz2rjx5b47ky67b";
+    };
+
+    "2.1.11" = {
+      sha256 = "1zgypmn19c58pv7j33ga7m1l7lzghj70w3xbybpgmggxwwflihdz";
+    };
+
+    "2.2.4" = {
+      sha256 = "sha256-/N0lHLxl9/gI7QrXckaEjRvhZqppoX90mWABhLelcgI=";
+    };
+
+    "2.2.6" = {
+      sha256 = "sha256-PiMEjI+oJvuRMiC+sqw2l9vFwM3y6J/tjbOe0XEjBKA=";
+    };
+
+    "2.2.9" = {
+      sha256 = "sha256-fr69bSAj//cHewNy+hFx+IBSm97GEE8gmDKXwv63wXI=";
+    };
+  };
+
+in with versionMap.${version};
+
 stdenv.mkDerivation rec {
   pname = "sbcl";
   inherit version;
@@ -32,8 +76,8 @@ stdenv.mkDerivation rec {
       url = "https://github.com/sbcl/sbcl/commit/8fa3f76fba2e8572e86ac6fc5754e6b2954fc774.patch";
       sha256 = "1ic531pjnws1k3xd03a5ixbq8cn10dlh2nfln59k0vbm0253g3lv";
     })
-  ++ lib.optionals (lib.versionAtLeast version "2.1.10") [
-      # Fix pending upstream inclusion on -fno-common toolchains:
+  ++ lib.optionals (lib.versionAtLeast version "2.1.10" && lib.versionOlder version "2.2.9") [
+      # Fix included in SBCL trunk since 2.2.9:
       #   https://bugs.launchpad.net/sbcl/+bug/1980570
       (fetchpatch {
         name = "darwin-fno-common.patch";
@@ -109,7 +153,7 @@ stdenv.mkDerivation rec {
     optional (!threadSupport) "sb-thread" ++
     optionals disableImmobileSpace [ "immobile-space" "immobile-code" "compact-instance-header" ];
 
-  NIX_CFLAGS_COMPILE = lib.optional (lib.versionOlder version "2.1.10") [
+  NIX_CFLAGS_COMPILE = lib.optionals (lib.versionOlder version "2.1.10") [
     # Workaround build failure on -fno-common toolchains like upstream
     # clang-13. Without the change build fails as:
     #   duplicate symbol '_static_code_space_free_pointer' in: alloc.o traceroot.o
diff --git a/pkgs/development/compilers/sbcl/bootstrap.nix b/pkgs/development/compilers/sbcl/bootstrap.nix
index eaf1ff24d3e7..b081df1572f5 100644
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@@ -8,9 +8,9 @@ let
       sha256 = "sha256-H0ALigXcWIypdA+fTf7jERscwbb7QIAfcoxCtGDh0RU=";
     };
     x86_64-darwin = {
-      version = "1.2.11";
+      version = "2.2.9";
       system = "x86-64-darwin";
-      sha256 = "0lh4gpvi8hl6g6b9321g5pwh8sk3218i7h4lx7p3vd9z0cf3lz85";
+      sha256 = "sha256-b1BLkoLIOELAYBYA9eBmMgm1OxMxJewzNP96C9ADfKY=";
     };
     x86_64-linux = {
       version = "1.3.16";
diff --git a/pkgs/development/compilers/swi-prolog/default.nix b/pkgs/development/compilers/swi-prolog/default.nix
index d53d1426a94b..a1eb060d6bab 100644
--- a/pkgs/development/compilers/swi-prolog/default.nix
+++ b/pkgs/development/compilers/swi-prolog/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, jdk, gmp, readline, openssl, unixODBC, zlib
-, libarchive, db, pcre, libedit, libossp_uuid, libXpm
+, libarchive, db, pcre, libedit, libossp_uuid, libxcrypt,libXpm
 , libSM, libXt, freetype, pkg-config, fontconfig
 , cmake, libyaml, Security
 , libjpeg, libX11, libXext, libXft, libXinerama
@@ -59,7 +59,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ gmp readline openssl
-    libarchive libyaml db pcre libedit libossp_uuid
+    libarchive libyaml db pcre libedit libossp_uuid libxcrypt
     zlib ]
   ++ lib.optionals (withGui && !stdenv.isDarwin) [ libXpm libX11 libXext libXft libXinerama libjpeg ]
   ++ extraLibraries
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index 4109d6ee6dac..0ea6e7b07596 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -14,6 +14,7 @@
 , python3
 , ncurses
 , libuuid
+, libxcrypt
 , icu
 , libgcc
 , libblocksruntime
@@ -195,6 +196,7 @@ let
     libedit
     libgcc
     libuuid
+    libxcrypt
     libxml2
     ncurses
     sqlite
diff --git a/pkgs/development/coq-modules/coq-record-update/default.nix b/pkgs/development/coq-modules/coq-record-update/default.nix
index fcc7b0362a0b..77c42fb48d4e 100644
--- a/pkgs/development/coq-modules/coq-record-update/default.nix
+++ b/pkgs/development/coq-modules/coq-record-update/default.nix
@@ -10,7 +10,7 @@ with lib; mkCoqDerivation rec {
   release."0.3.1".sha256 = "sha256-DyGxO2tqmYZZluXN6Oy5Tw6fuLMyuyxonj8CCToWKkk=";
   release."0.3.0".sha256 = "1ffr21dd6hy19gxnvcd4if2450iksvglvkd6q5713fajd72hmc0z";
   releaseRev = v: "v${v}";
-  buildFlags = "NO_TEST=1";
+  buildFlags = [ "NO_TEST=1" ];
   meta = {
     description = "Library to create Coq record update functions";
     maintainers = with maintainers; [ ineol ];
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 1f056ac25ef3..ccf0bdaeda85 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -2531,6 +2531,34 @@ self: super: {
   # Restrictive upper bound on base.
   # Remove once version 1.* is released
   monad-bayes = doJailbreak super.monad-bayes;
+
+  crypt-sha512 = overrideCabal (drv: {
+    librarySystemDepends = [
+      pkgs.libxcrypt
+    ];
+    # Test failure after libxcrypt migration, reported upstrem at
+    # https://github.com/phadej/crypt-sha512/issues/13
+    doCheck = false;
+  }) super.crypt-sha512;
+
+  nano-cryptr = overrideCabal (drv: {
+    librarySystemDepends = [
+      pkgs.libxcrypt
+    ];
+  }) super.nano-cryptr;
+
+  Unixutils = overrideCabal (drv: {
+    librarySystemDepends = [
+      pkgs.libxcrypt
+    ];
+  }) super.Unixutils;
+
+  xmonad-utils = overrideCabal (drv: {
+    librarySystemDepends = [
+      pkgs.libxcrypt
+    ];
+  }) super.xmonad-utils;
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super // (let
   # We need to build purescript with these dependencies and thus also its reverse
   # dependencies to avoid version mismatches in their dependency closure.
diff --git a/pkgs/development/haskell-modules/hoogle.nix b/pkgs/development/haskell-modules/hoogle.nix
index 4c8bf8c2d282..b5be7edb6e5a 100644
--- a/pkgs/development/haskell-modules/hoogle.nix
+++ b/pkgs/development/haskell-modules/hoogle.nix
@@ -36,7 +36,6 @@ let
       This index includes documentation for many Haskell modules.
     '';
 
-  # TODO: closePropagation is deprecated; replace
   docPackages = lib.closePropagation
     # we grab the doc outputs
     (map (lib.getOutput "doc") packages);
diff --git a/pkgs/development/interpreters/acl2/default.nix b/pkgs/development/interpreters/acl2/default.nix
index 1ca3742e737b..e42f26f0bdaf 100644
--- a/pkgs/development/interpreters/acl2/default.nix
+++ b/pkgs/development/interpreters/acl2/default.nix
@@ -77,7 +77,7 @@ in stdenv.mkDerivation rec {
   '';
 
   preBuild = "mkdir -p $HOME";
-  makeFlags = "LISP=${sbcl}/bin/sbcl ACL2_MAKE_LOG=NONE";
+  makeFlags = [ "LISP=${sbcl}/bin/sbcl" "ACL2_MAKE_LOG=NONE" ];
 
   doCheck = true;
   checkTarget = "mini-proveall";
diff --git a/pkgs/development/interpreters/kerf/default.nix b/pkgs/development/interpreters/kerf/default.nix
index 5b605c6564b3..96db9bbaeb13 100644
--- a/pkgs/development/interpreters/kerf/default.nix
+++ b/pkgs/development/interpreters/kerf/default.nix
@@ -18,9 +18,9 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/src";
   buildInputs = [ libedit zlib ncurses ]
-    ++ lib.optional stdenv.isDarwin ([
+    ++ lib.optionals stdenv.isDarwin ([
       Accelerate
-    ] ++ lib.optional stdenv.isx86_64 /* && isDarwin */ [
+    ] ++ lib.optionals stdenv.isx86_64 /* && isDarwin */ [
       CoreGraphics CoreVideo
     ]);
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     "implicit-function-declaration"
     "gnu-variable-sized-type-not-at-end"
     "unused-result"
-  ] ++ lib.optional stdenv.isDarwin [ "-fcommon" ];
+  ] ++ lib.optionals stdenv.isDarwin [ "-fcommon" ];
 
   patchPhase = ''
     substituteInPlace ./Makefile \
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index d236252e5bc7..59ae4a2db6f0 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -61,6 +61,7 @@ let
     in rec {
         buildEnv = callPackage ./wrapper.nix {
           lua = self;
+          makeWrapper = makeBinaryWrapper;
           inherit (luaPackages) requiredLuaModules;
         };
         withPackages = import ./with-packages.nix { inherit buildEnv luaPackages;};
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 79e2bf84a0cd..4d95ebf2052b 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -1,9 +1,12 @@
 { config, lib, stdenv, fetchurl, fetchFromGitHub, pkgs, buildPackages
 , callPackage
 , enableThreading ? true, coreutils, makeWrapper
+, enableCrypt ? true, libxcrypt ? null
 , zlib
 }:
 
+assert (enableCrypt -> (libxcrypt != null));
+
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
@@ -33,6 +36,8 @@ let
       optional crossCompiling "mini";
     setOutputFlags = false;
 
+    propagatedBuildInputs = lib.optional enableCrypt libxcrypt;
+
     disallowedReferences = [ stdenv.cc ];
 
     patches =
@@ -82,6 +87,7 @@ let
       ++ optionals ((builtins.match ''5\.[0-9]*[13579]\..+'' version) != null) [ "-Dusedevel" "-Uversiononly" ]
       ++ optional stdenv.isSunOS "-Dcc=gcc"
       ++ optional enableThreading "-Dusethreads"
+      ++ optional (!enableCrypt) "-A clear:d_crypt_r"
       ++ optional stdenv.hostPlatform.isStatic "--all-static"
       ++ optionals (!crossCompiling) [
         "-Dprefix=${placeholder "out"}"
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 5984113574c2..d1b7c6829557 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -206,7 +206,7 @@ let
             [ pcre2 ]
 
             # Enable sapis
-            ++ lib.optional pearSupport [ libxml2.dev ]
+            ++ lib.optionals pearSupport [ libxml2.dev ]
 
             # Misc deps
             ++ lib.optional apxs2Support apacheHttpd
@@ -230,7 +230,7 @@ let
             ++ lib.optional (!cgiSupport) "--disable-cgi"
             ++ lib.optional (!cliSupport) "--disable-cli"
             ++ lib.optional fpmSupport "--enable-fpm"
-            ++ lib.optional pearSupport [ "--with-pear" "--enable-xml" "--with-libxml" ]
+            ++ lib.optionals pearSupport [ "--with-pear" "--enable-xml" "--with-libxml" ]
             ++ lib.optional pharSupport "--enable-phar"
             ++ lib.optional (!phpdbgSupport) "--disable-phpdbg"
 
diff --git a/pkgs/development/interpreters/python-cosmopolitan/default.nix b/pkgs/development/interpreters/python-cosmopolitan/default.nix
index a2a512b9cdf0..a513c097fbcb 100644
--- a/pkgs/development/interpreters/python-cosmopolitan/default.nix
+++ b/pkgs/development/interpreters/python-cosmopolitan/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ bintools-unwrapped unzip ];
 
   # slashes are significant because upstream uses o/$(MODE)/foo.o
-  buildFlags = "o//third_party/python";
+  buildFlags = [ "o//third_party/python" ];
   checkTarget = "o//third_party/python/test";
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 25446f5fca89..7da2a0047f33 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -166,7 +166,7 @@ let
       # only works for GCC and Apple Clang. This makes distutils to call C++
       # compiler when needed.
       ./python-2.7-distutils-C++.patch
-    ] ++ optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       ./cross-compile.patch
     ];
 
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index ddf0a5548475..424258167150 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -14,6 +14,7 @@
 , bluez ? null, bluezSupport ? false
 , zlib
 , tzdata ? null
+, libxcrypt
 , self
 , configd
 , autoreconfHook
@@ -353,6 +354,9 @@ in with passthru; stdenv.mkDerivation {
     # Never even try to use lchmod on linux,
     # don't rely on detecting glibc-isms.
     "ac_cv_func_lchmod=no"
+  ] ++ optionals (libxcrypt != null) [
+    "CFLAGS=-I${libxcrypt}/include"
+    "LIBS=-L${libxcrypt}/lib"
   ] ++ optionals tzdataSupport [
     "--with-tzpath=${tzdata}/share/zoneinfo"
   ] ++ optional static "LDFLAGS=-static";
@@ -388,7 +392,7 @@ in with passthru; stdenv.mkDerivation {
   postInstall = let
     # References *not* to nuke from (sys)config files
     keep-references = concatMapStringsSep " " (val: "-e ${val}") ([
-      (placeholder "out")
+      (placeholder "out") libxcrypt
     ] ++ optionals tzdataSupport [
       tzdata
     ]);
diff --git a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
index 82231ee3adc6..d404c6021f4f 100644
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@@ -80,6 +80,9 @@ pythonRelaxDepsHook() {
         @pythonInterpreter@ -m wheel pack "$unpack_dir/$pkg_name"
     done
 
+    # Remove the folder since it will otherwise be in the dist output.
+    rm -rf "$unpack_dir"
+
     popd
 }
 
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index abb1ceb7879e..bdb4969bf164 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -109,7 +109,7 @@ else
 let
   inherit (python) stdenv;
 
-  withDistOutput = lib.elem format ["pyproject" "setuptools" "flit"];
+  withDistOutput = lib.elem format ["pyproject" "setuptools" "flit" "wheel"];
 
   name_ = name;
 
diff --git a/pkgs/development/interpreters/python/rustpython/default.nix b/pkgs/development/interpreters/python/rustpython/default.nix
index 6f7704e72750..645b1de2d76b 100644
--- a/pkgs/development/interpreters/python/rustpython/default.nix
+++ b/pkgs/development/interpreters/python/rustpython/default.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-Pv7SK64+eoK1VUxDh1oH0g1veWoIvBhiZE9JI/alXJ4=";
 
   # freeze the stdlib into the rustpython binary
-  cargoBuildFlags = "--features=freeze-stdlib";
+  cargoBuildFlags = [ "--features=freeze-stdlib" ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ SystemConfiguration ];
 
diff --git a/pkgs/development/interpreters/qnial/default.nix b/pkgs/development/interpreters/qnial/default.nix
index 74360daa8766..ae68c1ad6af3 100644
--- a/pkgs/development/interpreters/qnial/default.nix
+++ b/pkgs/development/interpreters/qnial/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, unzip, pkg-config, makeWrapper, ncurses }:
+{ lib, stdenv, fetchFromGitHub, unzip, pkg-config, makeWrapper, ncurses, libxcrypt }:
 
 stdenv.mkDerivation {
   pname = "qnial";
@@ -26,6 +26,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
      ncurses
+     libxcrypt
   ];
 
   meta = {
diff --git a/pkgs/development/interpreters/racket/default.nix b/pkgs/development/interpreters/racket/default.nix
index 67609132c80d..479557e0890f 100644
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -128,8 +128,8 @@ stdenv.mkDerivation rec {
 
   shared = if stdenv.isDarwin then "dylib" else "shared";
   configureFlags = [ "--enable-${shared}"  "--enable-lt=${libtool}/bin/libtool" ]
-                   ++ lib.optional disableDocs [ "--disable-docs" ]
-                   ++ lib.optional stdenv.isDarwin [ "--enable-xonx" ];
+                   ++ lib.optionals disableDocs [ "--disable-docs" ]
+                   ++ lib.optionals stdenv.isDarwin [ "--enable-xonx" ];
 
   configureScript = "../configure";
 
diff --git a/pkgs/development/interpreters/racket/racket_7_9.nix b/pkgs/development/interpreters/racket/racket_7_9.nix
index 07c0376b42aa..ac4b6b5ba180 100644
--- a/pkgs/development/interpreters/racket/racket_7_9.nix
+++ b/pkgs/development/interpreters/racket/racket_7_9.nix
@@ -83,8 +83,8 @@ stdenv.mkDerivation rec {
 
   shared = if stdenv.isDarwin then "dylib" else "shared";
   configureFlags = [ "--enable-${shared}"  "--enable-lt=${libtool}/bin/libtool" ]
-                   ++ lib.optional disableDocs [ "--disable-docs" ]
-                   ++ lib.optional stdenv.isDarwin [ "--enable-xonx" ];
+                   ++ lib.optionals disableDocs [ "--disable-docs" ]
+                   ++ lib.optionals stdenv.isDarwin [ "--enable-xonx" ];
 
   configureScript = "../configure";
 
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 524734b5a5fa..dc7594da17d9 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -48,7 +48,7 @@ let
       , buildEnv, bundler, bundix
       , libiconv, libobjc, libunwind, Foundation
       , makeWrapper, buildRubyGem, defaultGemConfig
-      , baseRuby ? buildPackages.ruby.override {
+      , baseRuby ? buildPackages.ruby_3_1.override {
           useRailsExpress = false;
           docSupport = false;
           rubygemsSupport = false;
diff --git a/pkgs/development/interpreters/spidermonkey/common.nix b/pkgs/development/interpreters/spidermonkey/common.nix
index 1272e061b0d9..d12396396da4 100644
--- a/pkgs/development/interpreters/spidermonkey/common.nix
+++ b/pkgs/development/interpreters/spidermonkey/common.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: rec {
     inherit hash;
   };
 
-  patches = lib.optional (lib.versionOlder version "91") [
+  patches = lib.optionals (lib.versionOlder version "91") [
     # Fix build failure on armv7l using Debian patch
     # Upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1526653
     (fetchpatch {
diff --git a/pkgs/development/interpreters/unicon-lang/default.nix b/pkgs/development/interpreters/unicon-lang/default.nix
index 848c9541114e..593a955c798b 100644
--- a/pkgs/development/interpreters/unicon-lang/default.nix
+++ b/pkgs/development/interpreters/unicon-lang/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, unzip, libX11, libXt, libnsl }:
+{ lib, stdenv, fetchurl, unzip, libX11, libXt, libnsl, libxcrypt }:
 
 stdenv.mkDerivation {
   pname = "unicon-lang";
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1g9l2dfp99dqih2ir2limqfjgagh3v9aqly6x0l3qavx3qkkwf61";
   };
   nativeBuildInputs = [ unzip ];
-  buildInputs = [ libnsl libX11 libXt ];
+  buildInputs = [ libnsl libX11 libXt libxcrypt ];
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/development/libraries/accountsservice/default.nix b/pkgs/development/libraries/accountsservice/default.nix
index 4bd7a67871f9..694aab16d1ab 100644
--- a/pkgs/development/libraries/accountsservice/default.nix
+++ b/pkgs/development/libraries/accountsservice/default.nix
@@ -16,6 +16,7 @@
 , python3
 , vala
 , gettext
+, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -66,6 +67,7 @@ stdenv.mkDerivation rec {
     glib
     polkit
     systemd
+    libxcrypt
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/ada/gnatcoll/db.nix b/pkgs/development/libraries/ada/gnatcoll/db.nix
index 0c597f199c34..6c87d63063fa 100644
--- a/pkgs/development/libraries/ada/gnatcoll/db.nix
+++ b/pkgs/development/libraries/ada/gnatcoll/db.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
     # confusingly, for gprbuild --target is autoconf --host
     "TARGET=${stdenv.hostPlatform.config}"
     "prefix=${placeholder "out"}"
-  ] ++ lib.optional (component == "sqlite") [
+  ] ++ lib.optionals (component == "sqlite") [
     # link against packaged, not vendored libsqlite3
     "GNATCOLL_SQLITE=external"
   ];
diff --git a/pkgs/development/libraries/apr-util/default.nix b/pkgs/development/libraries/apr-util/default.nix
index 6f38bfa0d076..909965bb0688 100644
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@@ -2,7 +2,7 @@
 , sslSupport ? true, openssl
 , bdbSupport ? true, db
 , ldapSupport ? !stdenv.isCygwin, openldap
-, libiconv
+, libiconv, libxcrypt
 , cyrus_sasl, autoreconfHook
 }:
 
@@ -21,7 +21,10 @@ stdenv.mkDerivation rec {
     sha256 = "0nq3s1yn13vplgl6qfm09f7n0wm08malff9s59bqf9nid9xjzqfk";
   };
 
-  patches = optional stdenv.isFreeBSD ./include-static-dependencies.patch;
+  patches = [ ./fix-libxcrypt-build.patch ]
+    ++ optional stdenv.isFreeBSD ./include-static-dependencies.patch;
+
+  NIX_CFLAGS_LINK = [ "-lcrypt" ];
 
   outputs = [ "out" "dev" ];
   outputBin = "dev";
@@ -38,15 +41,18 @@ stdenv.mkDerivation rec {
         "--without-freetds" "--without-berkeley-db" "--without-crypto" ]
     ;
 
-  # For some reason, db version 6.9 is selected when cross-compiling.
-  # It's unclear as to why, it requires someone with more autotools / configure knowledge to go deeper into that.
-  # Always replacing the link flag with a generic link flag seems to help though, so let's do that for now.
-  postConfigure = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    substituteInPlace Makefile \
-      --replace "-ldb-6.9" "-ldb"
+  postConfigure = ''
+    echo '#define APR_HAVE_CRYPT_H 1' >> confdefs.h
+  '' +
+    # For some reason, db version 6.9 is selected when cross-compiling.
+    # It's unclear as to why, it requires someone with more autotools / configure knowledge to go deeper into that.
+    # Always replacing the link flag with a generic link flag seems to help though, so let's do that for now.
+    lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+      substituteInPlace Makefile \
+        --replace "-ldb-6.9" "-ldb"
   '';
 
-  propagatedBuildInputs = [ apr expat libiconv ]
+  propagatedBuildInputs = [ apr expat libiconv libxcrypt ]
     ++ optional sslSupport openssl
     ++ optional bdbSupport db
     ++ optional ldapSupport openldap
diff --git a/pkgs/development/libraries/apr-util/fix-libxcrypt-build.patch b/pkgs/development/libraries/apr-util/fix-libxcrypt-build.patch
new file mode 100644
index 000000000000..2994e5de0f78
--- /dev/null
+++ b/pkgs/development/libraries/apr-util/fix-libxcrypt-build.patch
@@ -0,0 +1,14 @@
+diff --git a/crypto/apr_passwd.c b/crypto/apr_passwd.c
+index c961de2..a397f27 100644
+--- a/crypto/apr_passwd.c
++++ b/crypto/apr_passwd.c
+@@ -24,9 +24,7 @@
+ #if APR_HAVE_STRING_H
+ #include <string.h>
+ #endif
+-#if APR_HAVE_CRYPT_H
+ #include <crypt.h>
+-#endif
+ #if APR_HAVE_UNISTD_H
+ #include <unistd.h>
+ #endif
diff --git a/pkgs/development/libraries/apr/default.nix b/pkgs/development/libraries/apr/default.nix
index 536c8a5613a9..0d980db9b5a8 100644
--- a/pkgs/development/libraries/apr/default.nix
+++ b/pkgs/development/libraries/apr/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
       configureFlagsArray+=("--with-installbuilddir=$dev/share/build")
     '';
 
-  configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # For cross builds, provide answers to the configure time tests.
     # These answers are valid on x86_64-linux and aarch64-linux.
     "ac_cv_file__dev_zero=yes"
diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index e24217434557..fe9ce9a42dcb 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -31,10 +31,16 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # CVE-2021-36217 / CVE-2021-3502
     (fetchpatch {
       url = "https://github.com/lathiat/avahi/commit/9d31939e55280a733d930b15ac9e4dda4497680c.patch";
       sha256 = "sha256-BXWmrLWUvDxKPoIPRFBpMS3T4gijRw0J+rndp6iDybU=";
     })
+    # CVE-2021-3468
+    (fetchpatch {
+      url = "https://github.com/lathiat/avahi/commit/447affe29991ee99c6b9732fc5f2c1048a611d3b.patch";
+      sha256 = "sha256-qWaCU1ZkCg2PmijNto7t8E3pYRN/36/9FrG8okd6Gu8=";
+    })
   ];
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 9c2072179b26..38631d3242d3 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv
+{ lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv, libxcrypt
 , boost-build
 , fetchpatch
 , which
@@ -214,7 +214,7 @@ stdenv.mkDerivation {
     ++ optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [ expat zlib bzip2 libiconv ]
     ++ optional (stdenv.hostPlatform == stdenv.buildPlatform) icu
-    ++ optional enablePython python
+    ++ optionals enablePython [ libxcrypt python ]
     ++ optional enableNumpy python.pkgs.numpy;
 
   configureScript = "./bootstrap.sh";
diff --git a/pkgs/development/libraries/cosmopolitan/default.nix b/pkgs/development/libraries/cosmopolitan/default.nix
index 63f45f62fd14..88e5bcf5d9d7 100644
--- a/pkgs/development/libraries/cosmopolitan/default.nix
+++ b/pkgs/development/libraries/cosmopolitan/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dist" ];
 
   # slashes are significant because upstream uses o/$(MODE)/foo.o
-  buildFlags = "o/cosmopolitan.h o//cosmopolitan.a o//libc/crt/crt.o o//ape/ape.o o//ape/ape.lds";
+  buildFlags = [ "o/cosmopolitan.h" "o//cosmopolitan.a" "o//libc/crt/crt.o" "o//ape/ape.o" "o//ape/ape.lds" ];
   checkTarget = "o//test";
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/cxxopts/default.nix b/pkgs/development/libraries/cxxopts/default.nix
index cf36a88a35be..a24127ab56d8 100644
--- a/pkgs/development/libraries/cxxopts/default.nix
+++ b/pkgs/development/libraries/cxxopts/default.nix
@@ -21,10 +21,10 @@ stdenv.mkDerivation rec {
   # CMake does not set CMAKE_LIBRARY_ARCHITECTURE variable in Nix, which breaks architecture-independent library path generation
   patches = [ ./fix-install-path.patch ];
 
-  buildInputs = lib.optional enableUnicodeHelp [ icu.dev ];
+  buildInputs = lib.optionals enableUnicodeHelp [ icu.dev ];
   cmakeFlags = [ "-DCXXOPTS_BUILD_EXAMPLES=OFF" ]
     ++ lib.optional enableUnicodeHelp "-DCXXOPTS_USE_UNICODE_HELP=TRUE";
-  nativeBuildInputs = [ cmake ] ++ lib.optional enableUnicodeHelp [ pkg-config ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals enableUnicodeHelp [ pkg-config ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index be20a9b1678d..632c8427e4db 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, openssl, openldap, libkrb5, db, gettext
-, pam, fixDarwinDylibNames, autoreconfHook, enableLdap ? false
+, pam, libxcrypt, fixDarwinDylibNames, autoreconfHook, enableLdap ? false
 , buildPackages, pruneLibtoolFiles, nixosTests }:
 
 with lib;
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pruneLibtoolFiles ]
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs =
-    [ openssl db gettext libkrb5 ]
+    [ openssl db gettext libkrb5 libxcrypt ]
     ++ lib.optional enableLdap openldap
     ++ lib.optional stdenv.isLinux pam;
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     "--enable-shared"
   ] ++ lib.optional enableLdap "--with-ldap=${openldap.dev}";
 
-  installFlags = lib.optional stdenv.isDarwin [ "framedir=$(out)/Library/Frameworks/SASL2.framework" ];
+  installFlags = lib.optionals stdenv.isDarwin [ "framedir=$(out)/Library/Frameworks/SASL2.framework" ];
 
   passthru.tests = {
     inherit (nixosTests) parsedmarc postfix;
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 075f2a67b70e..2cd6463d5c21 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , lib
-, fetchpatch
 , fetchurl
 , pkg-config
 , expat
@@ -20,27 +19,16 @@
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.14.0";
+  version = "1.14.4";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.xz";
-    sha256 = "sha256-zNfM43WW4KGVWP1mSNEnKrQ/AR2AyGNa6o/QutWK69Q=";
+    sha256 = "sha256-fA+bjl7A/yR5OD5iwAhKOimvme3xUU6fZZuBsw1ONT4=";
   };
 
-  patches = [
-    # Fix dbus-daemon crashing when running tests due to long XDG_DATA_DIRS.
-    # https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/302
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/dbus/dbus/-/commit/b551b3e9737958216a1a9d359150a4110a9d0549.patch";
-      sha256 = "kOVjlklZzKvBZXmmrE1UiO4XWRoBLViGwdn6/eDH+DY=";
-    })
-  ] ++ (lib.optional stdenv.isSunOS ./implement-getgrouplist.patch);
+  patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;
 
   postPatch = ''
-    # We need to generate the file ourselves.
-    # https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/317
-    rm doc/catalog.xml
-
     substituteInPlace bus/Makefile.am \
       --replace 'install-data-hook:' 'disabled:' \
       --replace '$(mkinstalldirs) $(DESTDIR)$(localstatedir)/run/dbus' ':'
diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index 9cc3503acd6e..de4aaf32d980 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional postgresSupport postgresql
     ++ lib.optional redisSupport hiredis
     # drogon uses mariadb for mysql (see https://github.com/drogonframework/drogon/wiki/ENG-02-Installation#Library-Dependencies)
-    ++ lib.optional mysqlSupport [ libmysqlclient mariadb ];
+    ++ lib.optionals mysqlSupport [ libmysqlclient mariadb ];
 
   patches = [
     # this part of the test would normally fail because it attempts to configure a CMake project that uses find_package on itself
diff --git a/pkgs/development/libraries/fcft/default.nix b/pkgs/development/libraries/fcft/default.nix
index 531276b90d79..ecc99092a905 100644
--- a/pkgs/development/libraries/fcft/default.nix
+++ b/pkgs/development/libraries/fcft/default.nix
@@ -20,14 +20,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fcft";
-  version = "3.1.4";
+  version = "3.1.5";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fcft";
     rev = version;
-    sha256 = "sha256-kSzUZR/5PcYTxPWNh/zAwLQbfeW/44u2elEmGR3NYcM=";
+    sha256 = "sha256-3gsaXnflGiGOpIkqDQe5u6x8d18x67/dc4Hh1iU89+o=";
   };
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index b518b7527ac0..e37e90d553a3 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,17 +1,12 @@
-{ callPackage, fetchpatch
-# Darwin frameworks
-, Cocoa, CoreMedia, VideoToolbox
-, stdenv, lib
-, ...
-}@args:
+{ callPackage, fetchpatch, ... }@args:
 
 callPackage ./generic.nix (rec {
   version = "4.4.2";
   branch = version;
   sha256 = "sha256-+YpIJSDEdQdSGpB5FNqp77wThOBZG1r8PaGKqJfeKUg=";
-  darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
+
   patches = [
-    #  sdl2 recently changed their versioning
+    # SDL2 recently changed their versioning
     (fetchpatch {
       url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
       hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index d09d7ccd1cec..b19c22a55f3a 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,12 +1,7 @@
-{ callPackage
-# Darwin frameworks
-, Cocoa, CoreMedia, VideoToolbox
-, ...
-}@args:
+{ callPackage, ... }@args:
 
 callPackage ./generic.nix (rec {
   version = "5.1.2";
   branch = version;
   sha256 = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
-  darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 } // args)
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 855586649b74..594adc046306 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,22 +1,23 @@
 { lib, stdenv, buildPackages, fetchurl, pkg-config, addOpenGLRunpath, perl, texinfo, yasm
 , alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
-, libssh, libtheora, libva, libdrm, libvorbis, libvpx, xz, soxr
+, libssh, libtheora, libva, libdrm, libvorbis, xz, soxr
 , x264, x265, xvidcore, zimg, zlib, libopus, speex, nv-codec-headers, dav1d
-, srt ? null
-, openglSupport ? false, libGLU ? null, libGL ? null
-, libmfxSupport ? false, intel-media-sdk ? null
-, libaomSupport ? false, libaom ? null
+, vpxSupport ? !stdenv.isAarch32, libvpx
+, srtSupport ? true, srt
+, vaapiSupport ? ((stdenv.isLinux || stdenv.isFreeBSD) && !stdenv.isAarch32)
+, openglSupport ? false, libGLU, libGL
+, libmfxSupport ? false, intel-media-sdk
+, libaomSupport ? false, libaom
 # Build options
 , runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime
 , multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, sdlSupport ? !stdenv.isAarch32, SDL ? null, SDL2 ? null
-, vdpauSupport ? !stdenv.isAarch32, libvdpau ? null
+, sdlSupport ? !stdenv.isAarch32, SDL2
+, vdpauSupport ? !stdenv.isAarch32, libvdpau
 # Developer options
 , debugDeveloper ? false
 , optimizationsDeveloper ? true
 , extraWarningsDeveloper ? false
-# Darwin frameworks
-, Cocoa, darwinFrameworks ? [ Cocoa ]
+, Cocoa, CoreMedia, VideoToolbox
 # Inherit generics
 , branch, sha256, version, patches ? [], knownVulnerabilities ? []
 , doCheck ? true
@@ -35,12 +36,6 @@
  *   pulseaudio
  *
  * Known issues:
- * 0.6     - fails to compile (unresolved) (so far, only disabling a number of
- *           features works, but that is not a feasible solution)
- * 0.6.90  - mmx: compile errors (fix: disable for 0.6.90-rc0)
- * 1.1     - libsoxr: compile error (fix: disable for 1.1)
- *           Support was initially added in 1.1 before soxr api change, fix
- *           would probably be to add soxr-1.0
  * ALL     - Cross-compiling will disable features not present on host OS
  *           (e.g. dxva2 support [DirectX] will not be enabled unless natively
  *           compiled on Cygwin)
@@ -48,34 +43,16 @@
  */
 
 let
-  inherit (stdenv) isDarwin isFreeBSD isLinux isAarch32;
   inherit (lib) optional optionals optionalString enableFeature filter;
 
-  cmpVer = builtins.compareVersions;
-  reqMin = requiredVersion: (cmpVer requiredVersion branch != 1);
-  reqMatch = requiredVersion: (cmpVer requiredVersion branch == 0);
+  reqMin = requiredVersion: (builtins.compareVersions requiredVersion branch != 1);
 
   ifMinVer = minVer: flag: if reqMin minVer then flag else null;
 
   ifVerOlder = maxVer: flag: if (lib.versionOlder branch maxVer) then flag else null;
-
-  # Version specific fix
-  verFix = withoutFix: fixVer: withFix: if reqMatch fixVer then withFix else withoutFix;
-
-  # Disable dependency that needs fixes before it will work on Darwin or Arm
-  disDarwinOrArmFix = origArg: minVer: fixArg: if ((isDarwin || isAarch32) && reqMin minVer) then fixArg else origArg;
-
-  vaapiSupport = reqMin "0.6" && ((isLinux || isFreeBSD) && !isAarch32);
-
-  vpxSupport = reqMin "0.6" && !isAarch32;
 in
 
-assert openglSupport -> libGL != null && libGLU != null;
-assert libmfxSupport -> intel-media-sdk != null;
-assert libaomSupport -> libaom != null;
-
 stdenv.mkDerivation rec {
-
   pname = "ffmpeg";
   inherit version;
 
@@ -87,8 +64,7 @@ stdenv.mkDerivation rec {
   postPatch = "patchShebangs .";
   inherit patches;
 
-  outputs = [ "bin" "dev" "out" "man" ]
-    ++ optional (reqMin "1.0") "doc" ; # just dev-doc
+  outputs = [ "bin" "dev" "out" "man" "doc" ];
   setOutputFlags = false; # doesn't accept all and stores configureFlags in libs!
 
   configurePlatforms = [];
@@ -100,8 +76,8 @@ stdenv.mkDerivation rec {
       "--enable-version3"
     # Build flags
       "--enable-shared"
-      (ifMinVer "0.6" "--enable-pic")
-      (ifMinVer "4.0" (enableFeature (srt != null) "libsrt"))
+      "--enable-pic"
+      (ifMinVer "4.0" (enableFeature srtSupport "libsrt"))
       (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
       "--enable-hardcoded-tables"
     ] ++
@@ -113,63 +89,61 @@ stdenv.mkDerivation rec {
        else
          ["--disable-pthreads" "--disable-w32threads"])
     ++ [
-      (ifMinVer "0.9" "--disable-os2threads") # We don't support OS/2
+      "--disable-os2threads" # We don't support OS/2
       "--enable-network"
-      (ifMinVer "2.4" "--enable-pixelutils")
+      "--enable-pixelutils"
     # Executables
       "--enable-ffmpeg"
       "--disable-ffplay"
-      (ifMinVer "0.6" "--enable-ffprobe")
-      (if reqMin "4" then null else "--disable-ffserver")
+      "--enable-ffprobe"
+      (ifVerOlder "4" "--disable-ffserver")
     # Libraries
-      (ifMinVer "0.6" "--enable-avcodec")
-      (ifMinVer "0.6" "--enable-avdevice")
+      "--enable-avcodec"
+      "--enable-avdevice"
       "--enable-avfilter"
-      (ifMinVer "0.6" "--enable-avformat")
-      (ifMinVer "1.0" (ifVerOlder "5.0" "--enable-avresample"))
-      (ifMinVer "1.1" "--enable-avutil")
+      "--enable-avformat"
+      (ifVerOlder "5.0" "--enable-avresample")
+      "--enable-avutil"
       "--enable-postproc"
-      (ifMinVer "0.9" "--enable-swresample")
+      "--enable-swresample"
       "--enable-swscale"
     # Docs
-      (ifMinVer "0.6" "--disable-doc")
+      "--disable-doc"
     # External Libraries
       "--enable-libass"
       "--enable-bzlib"
       "--enable-gnutls"
-      (ifMinVer "1.0" "--enable-fontconfig")
-      (ifMinVer "0.7" "--enable-libfreetype")
+      "--enable-fontconfig"
+      "--enable-libfreetype"
       "--enable-libmp3lame"
-      (ifMinVer "1.2" "--enable-iconv")
+      "--enable-iconv"
       "--enable-libtheora"
-      (ifMinVer "2.1" "--enable-libssh")
-      (ifMinVer "0.6" (enableFeature vaapiSupport "vaapi"))
-      (ifMinVer "3.4" (enableFeature vaapiSupport "libdrm"))
+      "--enable-libssh"
+      (enableFeature vaapiSupport "vaapi")
+      (enableFeature vaapiSupport "libdrm")
       (enableFeature vdpauSupport "vdpau")
       "--enable-libvorbis"
-      (ifMinVer "0.6" (enableFeature vpxSupport "libvpx"))
-      (ifMinVer "2.4" "--enable-lzma")
-      (ifMinVer "2.2" (enableFeature openglSupport "opengl"))
+      (enableFeature vpxSupport "libvpx")
+      "--enable-lzma"
+      (enableFeature openglSupport "opengl")
       (ifMinVer "4.2" (enableFeature libmfxSupport "libmfx"))
       (ifMinVer "4.2" (enableFeature libaomSupport "libaom"))
-      (disDarwinOrArmFix (ifMinVer "0.9" (lib.optionalString pulseaudioSupport "--enable-libpulse")) "0.9" "--disable-libpulse")
-      (ifMinVer "2.5" (if sdlSupport && reqMin "3.2" then "--enable-sdl2" else if sdlSupport then "--enable-sdl" else null)) # autodetected before 2.5, SDL1 support removed in 3.2 for SDL2
-      (ifMinVer "1.2" "--enable-libsoxr")
+      (lib.optionalString pulseaudioSupport "--enable-libpulse")
+      (enableFeature sdlSupport "sdl2")
+      "--enable-libsoxr"
       "--enable-libx264"
       "--enable-libxvid"
       "--enable-libzimg"
       "--enable-zlib"
-      (ifMinVer "2.8" "--enable-libopus")
+      "--enable-libopus"
       "--enable-libspeex"
-      (ifMinVer "2.8" "--enable-libx265")
-      (ifMinVer "4.2" (enableFeature (dav1d != null) "libdav1d"))
+      "--enable-libx265"
+      (ifMinVer "4.2" (enableFeature (reqMin "4.2") "libdav1d"))
     # Developer flags
       (enableFeature debugDeveloper "debug")
       (enableFeature optimizationsDeveloper "optimizations")
       (enableFeature extraWarningsDeveloper "extra-warnings")
       "--disable-stripping"
-    # Disable mmx support for 0.6.90
-      (verFix null "0.6.90" "--disable-mmx")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       "--cross-prefix=${stdenv.cc.targetPrefix}"
       "--enable-cross-compile"
@@ -180,18 +154,18 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex srt nv-codec-headers
+    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex nv-codec-headers
   ] ++ optionals openglSupport [ libGL libGLU ]
     ++ optional libmfxSupport intel-media-sdk
     ++ optional libaomSupport libaom
     ++ optional vpxSupport libvpx
-    ++ optionals (!isDarwin && !isAarch32 && pulseaudioSupport) [ libpulseaudio ] # Need to be fixed on Darwin and ARM
-    ++ optional ((isLinux || isFreeBSD) && !isAarch32) libva
-    ++ optional ((isLinux || isFreeBSD) && !isAarch32) libdrm
-    ++ optional isLinux alsa-lib
-    ++ optionals isDarwin darwinFrameworks
+    ++ optionals (!stdenv.isDarwin && !stdenv.isAarch32 && pulseaudioSupport) [ libpulseaudio ] # Need to be fixed on Darwin and ARM
+    ++ optionals vaapiSupport [ libva libdrm ]
+    ++ optional stdenv.isLinux alsa-lib
+    ++ optionals stdenv.isDarwin [ Cocoa CoreMedia VideoToolbox ]
     ++ optional vdpauSupport libvdpau
-    ++ optional sdlSupport (if reqMin "3.2" then SDL2 else SDL)
+    ++ optional sdlSupport SDL2
+    ++ optional srtSupport srt
     ++ optional (reqMin "4.2") dav1d;
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/galario/default.nix b/pkgs/development/libraries/galario/default.nix
index ac7e4f4255e8..7f757fd48197 100644
--- a/pkgs/development/libraries/galario/default.nix
+++ b/pkgs/development/libraries/galario/default.nix
@@ -34,13 +34,13 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.isDarwin llvmPackages.openmp
   ;
 
-  propagatedBuildInputs = lib.optional enablePython [
+  propagatedBuildInputs = lib.optionals enablePython [
     pythonPackages.numpy
     pythonPackages.cython
     pythonPackages.pytest
   ];
 
-  checkInputs = lib.optional enablePython [ pythonPackages.scipy pythonPackages.pytest-cov ];
+  checkInputs = lib.optionals enablePython [ pythonPackages.scipy pythonPackages.pytest-cov ];
 
   preConfigure = ''
     mkdir -p build/external/src
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 6ed0a4d4da0f..83cde0774949 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -36,6 +36,7 @@
 , withLinuxHeaders ? false
 , profilingLibraries ? false
 , withGd ? false
+, withLibcrypt ? false
 , meta
 , extraBuildInputs ? []
 , extraNativeBuildInputs ? []
@@ -183,7 +184,9 @@ stdenv.mkDerivation ({
       # To avoid linking with -lgcc_s (dynamic link)
       # so the glibc does not depend on its compiler store path
       "libc_cv_as_needed=no"
-    ] ++ lib.optional withGd "--with-gd";
+    ]
+    ++ lib.optional withGd "--with-gd"
+    ++ lib.optional (!withLibcrypt) "--disable-crypt";
 
   makeFlags = [
     "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 728b97d2f5f4..8602498f01b9 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -2,6 +2,7 @@
 , withLinuxHeaders ? true
 , profilingLibraries ? false
 , withGd ? false
+, withLibcrypt? false
 , buildPackages
 }:
 
@@ -16,7 +17,7 @@ in
 callPackage ./common.nix { inherit stdenv; } {
     pname = "glibc" + lib.optionalString withGd "-gd";
 
-    inherit withLinuxHeaders profilingLibraries withGd;
+    inherit withLinuxHeaders profilingLibraries withGd withLibcrypt;
 
     # Note:
     # Things you write here override, and do not add to,
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index d04fda98c7fe..f1ec87ba008d 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     "--with-unbound-root-key-file=${dns-root-data}/root.key"
     (lib.withFeature withP11-kit "p11-kit")
     (lib.enableFeature cxxBindings "cxx")
-  ] ++ lib.optional guileBindings [
+  ] ++ lib.optionals guileBindings [
     "--enable-guile"
     "--with-guile-site-dir=\${out}/share/guile/site"
     "--with-guile-site-ccache-dir=\${out}/share/guile/site"
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 8d4e2e7271d4..8470c62a8906 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Fix compilation on i686, would not be needed after 1.18.1 releases, https://dev.gnupg.org/T5522
+    ./t-addexistingsubkey-i686.patch
     # https://dev.gnupg.org/rMc4cf527ea227edb468a84bf9b8ce996807bd6992
     ./fix_gpg_list_keys.diff
     # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
diff --git a/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch b/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch
new file mode 100644
index 000000000000..348bd8fa596a
--- /dev/null
+++ b/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch
@@ -0,0 +1,369 @@
+From c977424a1d39751fc5055131ad3f7819d421dcc8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Wed, 17 Aug 2022 14:51:19 +0200
+Subject: [PATCH 1/5] qt: Make sure expiration time is interpreted as unsigned
+ number
+
+* lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp (add_subkey): Convert
+expiration time to uint_least32_t.
+--
+
+This fixes the corresponding test on 32-bit systems where time_t (the
+return type of expirationTime()) is a signed 32-bit integer type.
+
+GnuPG-bug-id: 6137
+---
+ lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp b/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
+index 32e2c292..b74e7a06 100644
+--- a/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
++++ b/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
+@@ -64,7 +64,8 @@ static QGpgMEAddExistingSubkeyJob::result_type add_subkey(Context *ctx, const Ke
+     std::unique_ptr<GpgAddExistingSubkeyEditInteractor> interactor{new GpgAddExistingSubkeyEditInteractor{subkey.keyGrip()}};
+ 
+     if (!subkey.neverExpires()) {
+-        const auto expiry = QDateTime::fromSecsSinceEpoch(subkey.expirationTime(), Qt::UTC).toString(u"yyyyMMdd'T'hhmmss").toStdString();
++        const auto expiry = QDateTime::fromSecsSinceEpoch(uint_least32_t(subkey.expirationTime()),
++                                                          Qt::UTC).toString(u"yyyyMMdd'T'hhmmss").toStdString();
+         interactor->setExpiry(expiry);
+     }
+ 
+-- 
+2.36.0.windows.1
+
+
+From 81d4b7f2d7077297d76af5728949d8f2bdff8cd5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Wed, 17 Aug 2022 14:56:13 +0200
+Subject: [PATCH 2/5] qt,tests: Log the actual error code if the assertion
+ fails
+
+* lang/qt/tests/t-addexistingsubkey.cpp (
+AddExistingSubkeyJobTest::testAddExistingSubkeyAsync,
+AddExistingSubkeyJobTest::testAddExistingSubkeySync,
+AddExistingSubkeyJobTest::testAddExistingSubkeyWithExpiration): Use
+QCOMPARE instead of QVERIFY for asserting equality.
+--
+
+GnuPG-bug-id: 6137
+---
+ lang/qt/tests/t-addexistingsubkey.cpp | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
+index 589c90bf..2e654cec 100644
+--- a/lang/qt/tests/t-addexistingsubkey.cpp
++++ b/lang/qt/tests/t-addexistingsubkey.cpp
+@@ -168,7 +168,7 @@ private Q_SLOTS:
+         QSignalSpy spy (this, SIGNAL(asyncDone()));
+         QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+ 
+-        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
++        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
+         key.update();
+         QCOMPARE(key.numSubkeys(), 3u);
+     }
+@@ -190,7 +190,7 @@ private Q_SLOTS:
+ 
+         const auto result = job->exec(key, sourceSubkey);
+ 
+-        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
++        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
+         key.update();
+         QCOMPARE(key.numSubkeys(), 3u);
+         QCOMPARE(key.subkey(2).expirationTime(), 0);
+@@ -213,7 +213,7 @@ private Q_SLOTS:
+ 
+         const auto result = job->exec(key, sourceSubkey);
+ 
+-        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
++        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
+         key.update();
+         QCOMPARE(key.numSubkeys(), 3u);
+ 
+-- 
+2.36.0.windows.1
+
+
+From f2b48de26b8f8c48c293423eda712831544924f6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Wed, 17 Aug 2022 15:22:29 +0200
+Subject: [PATCH 3/5] qt,tests: Make sure expiration time is interpreted as
+ unsigned number
+
+* lang/qt/tests/t-addexistingsubkey.cpp,
+lang/qt/tests/t-changeexpiryjob.cpp: Convert expiration time to
+uint_least32_t.
+--
+
+This doesn't change the outcome of the tests (they also pass without
+this change because of the expiration dates of the test keys), but it's
+still good practise to treat the expiration time as an unsigned number
+if the assertions check that the expiration time is in some range.
+
+GnuPG-bug-id: 6137
+---
+ lang/qt/tests/t-addexistingsubkey.cpp |  6 +++---
+ lang/qt/tests/t-changeexpiryjob.cpp   | 26 +++++++++++++-------------
+ 2 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
+index 2e654cec..87eadf43 100644
+--- a/lang/qt/tests/t-addexistingsubkey.cpp
++++ b/lang/qt/tests/t-addexistingsubkey.cpp
+@@ -222,9 +222,9 @@ private Q_SLOTS:
+         // several times
+         const auto allowedDeltaTSeconds = 1;
+         const auto expectedExpirationRange = std::make_pair(
+-            sourceSubkey.expirationTime() - allowedDeltaTSeconds,
+-            sourceSubkey.expirationTime() + allowedDeltaTSeconds);
+-        const auto actualExpiration = key.subkey(2).expirationTime();
++            uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
++            uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
++        const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
+         QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                  ("actual: " + std::to_string(actualExpiration) +
+                   "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+diff --git a/lang/qt/tests/t-changeexpiryjob.cpp b/lang/qt/tests/t-changeexpiryjob.cpp
+index 090002f3..3da74d46 100644
+--- a/lang/qt/tests/t-changeexpiryjob.cpp
++++ b/lang/qt/tests/t-changeexpiryjob.cpp
+@@ -70,7 +70,7 @@ private Q_SLOTS:
+         QVERIFY(!key.isNull());
+         QVERIFY(!key.subkey(0).isNull());
+         QVERIFY(!key.subkey(1).isNull());
+-        const auto subkeyExpiration = key.subkey(1).expirationTime();
++        const auto subkeyExpiration = uint_least32_t(key.subkey(1).expirationTime());
+ 
+         {
+             // Create the job
+@@ -101,7 +101,7 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(1).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -110,7 +110,7 @@ private Q_SLOTS:
+                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QCOMPARE(actualExpiration, subkeyExpiration);  // unchanged
+             }
+         }
+@@ -133,7 +133,7 @@ private Q_SLOTS:
+         QVERIFY(!key.isNull());
+         QVERIFY(!key.subkey(0).isNull());
+         QVERIFY(!key.subkey(1).isNull());
+-        const auto primaryKeyExpiration = key.subkey(0).expirationTime();
++        const auto primaryKeyExpiration = uint_least32_t(key.subkey(0).expirationTime());
+ 
+         {
+             // Create the job
+@@ -164,11 +164,11 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(2).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QCOMPARE(actualExpiration, primaryKeyExpiration);  // unchanged
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -196,7 +196,7 @@ private Q_SLOTS:
+         QVERIFY(!key.isNull());
+         QVERIFY(!key.subkey(0).isNull());
+         QVERIFY(!key.subkey(1).isNull());
+-        const auto subkeyExpiration = key.subkey(1).expirationTime();
++        const auto subkeyExpiration = uint_least32_t(key.subkey(1).expirationTime());
+ 
+         {
+             // Create the job
+@@ -228,7 +228,7 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(3).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -237,7 +237,7 @@ private Q_SLOTS:
+                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QCOMPARE(actualExpiration, subkeyExpiration);  // unchanged
+             }
+         }
+@@ -291,7 +291,7 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(4).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -300,7 +300,7 @@ private Q_SLOTS:
+                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                           "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -359,7 +359,7 @@ private Q_SLOTS:
+                 newExpirationDate.toSecsSinceEpoch() - 10,
+                 QDateTime::currentDateTime().addDays(5).toSecsSinceEpoch());
+             {
+-                const auto actualExpiration = key.subkey(0).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+@@ -368,7 +368,7 @@ private Q_SLOTS:
+                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
+             }
+             {
+-                const auto actualExpiration = key.subkey(1).expirationTime();
++                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
+                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+                         ("actual: " + std::to_string(actualExpiration) +
+                           "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+-- 
+2.36.0.windows.1
+
+
+From 2fa5c80aeba4528b3bdf41ec5740e7db5d4b6d2b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Thu, 18 Aug 2022 10:43:19 +0200
+Subject: [PATCH 4/5] cpp: Fix handling of "no key" or "invalid time"
+ situations
+
+* lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
+(GpgAddExistingSubkeyEditInteractor::Private::nextState): Fix inverted
+logic of string comparisons.
+--
+
+This fixes the problem that the interactor didn't return the proper
+error code if gpg didn't accept the key grip or the expiration date.
+
+GnuPG-bug-id: 6137
+---
+ lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp b/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
+index 547e613d..8eec7460 100644
+--- a/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
++++ b/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
+@@ -136,7 +136,7 @@ unsigned int GpgAddExistingSubkeyEditInteractor::Private::nextState(unsigned int
+                 strcmp(args, "keygen.flags") == 0) {
+             return FLAGS;
+         } else if (status == GPGME_STATUS_GET_LINE &&
+-                   strcmp(args, "keygen.keygrip")) {
++                   strcmp(args, "keygen.keygrip") == 0) {
+             err = NO_KEY_ERROR;
+             return ERROR;
+         }
+@@ -157,7 +157,7 @@ unsigned int GpgAddExistingSubkeyEditInteractor::Private::nextState(unsigned int
+                 strcmp(args, "keyedit.prompt") == 0) {
+             return QUIT;
+         } else if (status == GPGME_STATUS_GET_LINE &&
+-                   strcmp(args, "keygen.valid")) {
++                   strcmp(args, "keygen.valid") == 0) {
+             err = INV_TIME_ERROR;
+             return ERROR;
+         }
+-- 
+2.36.0.windows.1
+
+
+From 2e7a61b898fccc1c20000b79dee83cd980901fa9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Thu, 18 Aug 2022 10:55:09 +0200
+Subject: [PATCH 5/5] qt,tests: Make test pass on 32-bit systems
+
+* lang/qt/tests/t-addexistingsubkey.cpp
+(AddExistingSubkeyJobTest::testAddExistingSubkeyWithExpiration): Handle
+negative expiration date.
+--
+
+On 32-bit systems the expiration date of the test key overflows. This
+will cause the AddExistingSubkeyJob to fail. We expect it to fail with
+an "invalid time" error.
+
+GnuPG-bug-id: 6137
+---
+ lang/qt/tests/t-addexistingsubkey.cpp | 42 +++++++++++++++------------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
+index 87eadf43..c0eee57b 100644
+--- a/lang/qt/tests/t-addexistingsubkey.cpp
++++ b/lang/qt/tests/t-addexistingsubkey.cpp
+@@ -213,24 +213,30 @@ private Q_SLOTS:
+ 
+         const auto result = job->exec(key, sourceSubkey);
+ 
+-        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
+-        key.update();
+-        QCOMPARE(key.numSubkeys(), 3u);
+-
+-        // allow 1 second different expiration because gpg calculates with
+-        // expiration as difference to current time and takes current time
+-        // several times
+-        const auto allowedDeltaTSeconds = 1;
+-        const auto expectedExpirationRange = std::make_pair(
+-            uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
+-            uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
+-        const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
+-        QVERIFY2(actualExpiration >= expectedExpirationRange.first,
+-                 ("actual: " + std::to_string(actualExpiration) +
+-                  "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
+-        QVERIFY2(actualExpiration <= expectedExpirationRange.second,
+-                 ("actual: " + std::to_string(actualExpiration) +
+-                  "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
++        if (sourceSubkey.expirationTime() > 0) {
++            QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
++            key.update();
++            QCOMPARE(key.numSubkeys(), 3u);
++
++            // allow 1 second different expiration because gpg calculates with
++            // expiration as difference to current time and takes current time
++            // several times
++            const auto allowedDeltaTSeconds = 1;
++            const auto expectedExpirationRange = std::make_pair(
++                uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
++                uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
++            const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
++            QVERIFY2(actualExpiration >= expectedExpirationRange.first,
++                    ("actual: " + std::to_string(actualExpiration) +
++                    "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
++            QVERIFY2(actualExpiration <= expectedExpirationRange.second,
++                    ("actual: " + std::to_string(actualExpiration) +
++                    "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
++        } else {
++            // on 32-bit systems the expiration date of the test key overflows;
++            // in this case we expect an appropriate error code
++            QCOMPARE(result.code(), static_cast<int>(GPG_ERR_INV_TIME));
++        }
+     }
+ 
+ private:
+-- 
+2.36.0.windows.1
+
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index a53ffb4f1b3a..dac712e82387 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     libjpeg
     tremor
     libGL
-  ] ++ lib.optional (!stdenv.isDarwin) [
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     libvisual
   ] ++ lib.optionals stdenv.isDarwin [
     pango
diff --git a/pkgs/development/libraries/gvm-libs/default.nix b/pkgs/development/libraries/gvm-libs/default.nix
index a141d36e3300..ba08fc61f568 100644
--- a/pkgs/development/libraries/gvm-libs/default.nix
+++ b/pkgs/development/libraries/gvm-libs/default.nix
@@ -12,6 +12,7 @@
 , libpcap
 , libssh
 , libuuid
+, libxcrypt
 , libxml2
 , pkg-config
 , zlib
@@ -46,6 +47,7 @@ stdenv.mkDerivation rec {
     libpcap
     libssh
     libuuid
+    libxcrypt
     libxml2
     zlib
   ];
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index c9f8f83f0f88..0bb6546543dc 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
-, fetchFromGitHub
-, fetchpatch
+, fetchurl
 , pkg-config
 , glib
 , freetype
@@ -31,7 +30,7 @@
 }:
 
 let
-  version = "5.1.0";
+  version = "5.2.0";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -41,21 +40,11 @@ stdenv.mkDerivation {
   pname = "harfbuzz${optionalString withIcu "-icu"}";
   inherit version;
 
-  src = fetchFromGitHub {
-    owner = "harfbuzz";
-    repo = "harfbuzz";
-    rev = version;
-    sha256 = "sha256-K6iScmg1vNfwb1UYqtXsnijLVpcC+am2ZL+W5bLFzsI=";
+  src = fetchurl {
+    url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
+    sha256 = "0b4lpkidwx0lf8slczjji652yll6g5zgmm5lmisnb4s7gf8r8nkk";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "aarch64-test-narrowing.diff";
-      url = "https://github.com/harfbuzz/harfbuzz/commit/04d28d94e576aab099891e6736fd0088dfac3366.diff";
-      sha256 = "sha256-099GP8t1G0kyYl79A6xJhfyrs3WXYitvn+He7sEz+Oo=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs src/*.py test
   '' + lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index baaa07d7e7ea..8b82af586704 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     patchShebangs tests
   '';
 
-  autoreconfFlags = "-vfi";
+  autoreconfFlags = [ "-vfi" ];
 
   configureFlags = [ "--with-ui" "--with-readline" ];
 
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index e095945dabaa..9885384e00e1 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     libxslt
     gobject-introspection
     gi-docgen
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin [
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     fixDarwinDylibNames
   ];
 
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index a7197f9ff984..fc8fb7398701 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--localstatedir=/var/lib" ]
     # krb5's ./configure does not allow passing --enable-shared and --enable-static at the same time.
     # See https://bbs.archlinux.org/viewtopic.php?pid=1576737#p1576737
-    ++ lib.optional staticOnly [ "--enable-static" "--disable-shared" ]
+    ++ lib.optionals staticOnly [ "--enable-static" "--disable-shared" ]
     ++ lib.optional stdenv.isFreeBSD ''WARN_CFLAGS=""''
     ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
        [ "krb5_cv_attr_constructor_destructor=yes,yes"
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
index a3de9225d1ce..283c2034be7e 100644
--- a/pkgs/development/libraries/libav/default.nix
+++ b/pkgs/development/libraries/libav/default.nix
@@ -17,7 +17,7 @@
 
 assert faacSupport -> enableUnfree;
 
-let inherit (lib) optional hasPrefix enableFeature; in
+let inherit (lib) optional optionals hasPrefix enableFeature; in
 
 /* ToDo:
     - more deps, inspiration: https://packages.ubuntu.com/raring/libav-tools
@@ -77,7 +77,7 @@ let
       (enableFeature vaapiSupport "vaapi")
       (enableFeature vdpauSupport "vdpau")
       (enableFeature freetypeSupport "libfreetype")
-    ] ++ optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       "--cross-prefix=${stdenv.cc.targetPrefix}"
       "--enable-cross-compile"
     ];
diff --git a/pkgs/development/libraries/libcli/default.nix b/pkgs/development/libraries/libcli/default.nix
index 8aa06bfb19bc..da076a590e19 100644
--- a/pkgs/development/libraries/libcli/default.nix
+++ b/pkgs/development/libraries/libcli/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "libcli";
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
       })
     ];
 
+  buildInputs = [ libxcrypt ];
+
   enableParallelBuilding = true;
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "AR=${stdenv.cc.targetPrefix}ar" "PREFIX=$(out)" ];
diff --git a/pkgs/development/libraries/libdaemon/default.nix b/pkgs/development/libraries/libdaemon/default.nix
index 51df45809789..581cc723dc41 100644
--- a/pkgs/development/libraries/libdaemon/default.nix
+++ b/pkgs/development/libraries/libdaemon/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   patches = [ ./fix-includes.patch ];
 
   configureFlags = [ "--disable-lynx" ]
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform)
     [ # Can't run this test while cross-compiling
       "ac_cv_func_setpgrp_void=yes"
     ];
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index 449a3d309cd1..39b80238b719 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace /usr/local $out
   '';
 
-  makeFlags = lib.optional stdenv.hostPlatform.isStatic [ "DISABLE_SHARED=1"];
+  makeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "DISABLE_SHARED=1"];
 
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/libraries/libeatmydata/default.nix b/pkgs/development/libraries/libeatmydata/default.nix
index 3a3abdc5e9ac..886caaada47b 100644
--- a/pkgs/development/libraries/libeatmydata/default.nix
+++ b/pkgs/development/libraries/libeatmydata/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./find-shell-lib.patch ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   postPatch = ''
     substituteInPlace eatmydata.in \
diff --git a/pkgs/development/libraries/libff/default.nix b/pkgs/development/libraries/libff/default.nix
index 35b7a33cc38f..36e8bb78c839 100644
--- a/pkgs/development/libraries/libff/default.nix
+++ b/pkgs/development/libraries/libff/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = [ "-DWITH_PROCPS=Off" ]
-    ++ lib.optional stdenv.isAarch64 [ "-DCURVE=ALT_BN128" "-DUSE_ASM=OFF" ];
+    ++ lib.optionals stdenv.isAarch64 [ "-DCURVE=ALT_BN128" "-DUSE_ASM=OFF" ];
 
   # CMake is hardcoded to always build static library which causes linker
   # failure for Haskell applications depending on haskellPackages.hevm on macOS.
diff --git a/pkgs/development/libraries/libfilezilla/default.nix b/pkgs/development/libraries/libfilezilla/default.nix
index 16c09b65ff1e..bc70e1fde3ac 100644
--- a/pkgs/development/libraries/libfilezilla/default.nix
+++ b/pkgs/development/libraries/libfilezilla/default.nix
@@ -6,6 +6,7 @@
 , nettle
 , pkg-config
 , libiconv
+, libxcrypt
 , ApplicationServices
 }:
 
@@ -20,7 +21,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
-  buildInputs = [ gettext gnutls nettle ]
+  buildInputs = [ gettext gnutls nettle libxcrypt ]
     ++ lib.optionals stdenv.isDarwin [ libiconv ApplicationServices ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index e2da1a30ff14..745b1a180008 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , autoreconfHook
 , makeWrapper
+, libxcrypt
 , ncurses
 , cpio
 , gperf
@@ -65,6 +66,7 @@ stdenv.mkDerivation rec {
   ] ++ (with perlPackages; [ perl libintl-perl GetoptLong ModuleBuild ])
   ++ (with ocamlPackages; [ ocaml findlib ]);
   buildInputs = [
+    libxcrypt
     ncurses
     jansson
     pcre2
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 3fef461874c9..4dfb28108743 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.14";
+  version = "3.0.15";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "sha256-gZ6IBjG5pNKJ+hWcTzXMP7yxL4he4LTklZGoC9vXra8=";
+    sha256 = "sha256-7M5GBteFKmKCB6556XXV4s6iIC/+3c3Ck17s/QX3Jus=";
   };
 
   strictDeps = true;
@@ -98,7 +98,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     homepage = "https://github.com/libical/libical";
     description = "An Open Source implementation of the iCalendar protocols";
     license = licenses.mpl20;
diff --git a/pkgs/development/libraries/liblc3/default.nix b/pkgs/development/libraries/liblc3/default.nix
new file mode 100644
index 000000000000..d0d95fd47da7
--- /dev/null
+++ b/pkgs/development/libraries/liblc3/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+}:
+
+let
+  name = "liblc3";
+  version = "1.0.1";
+in
+stdenv.mkDerivation {
+  pname = name;
+  version = version;
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "liblc3";
+    rev = "v${version}";
+    sha256 = "sha256-W0pCfFmM+6N6+HdGdQ/GBNHjBspkwtlxZC2m2noKGx0=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  meta = with lib; {
+    description = "LC3 (Low Complexity Communication Codec) is an efficient low latency audio codec";
+    homepage = "https://github.com/google/liblc3";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jansol ];
+  };
+}
+
diff --git a/pkgs/development/libraries/libmcrypt/default.nix b/pkgs/development/libraries/libmcrypt/default.nix
index 50bbf8383e61..953a6d03e5e6 100644
--- a/pkgs/development/libraries/libmcrypt/default.nix
+++ b/pkgs/development/libraries/libmcrypt/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = optional stdenv.isDarwin darwin.cctools;
 
-  configureFlags = optional disablePosixThreads
+  configureFlags = optionals disablePosixThreads
     [ "--disable-posix-threads" ];
 
   meta = {
diff --git a/pkgs/development/libraries/libpam-wrapper/default.nix b/pkgs/development/libraries/libpam-wrapper/default.nix
index 10d5c98b6687..0701ae0fc55f 100644
--- a/pkgs/development/libraries/libpam-wrapper/default.nix
+++ b/pkgs/development/libraries/libpam-wrapper/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sha256 = "00mqhsashx7njrvxz085d0b88nizhdy7m3x17ip5yhvwsl63km6p";
   };
 
-  nativeBuildInputs = [ cmake ] ++ lib.optional enablePython [ python ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals enablePython [ python ];
 
   # We must use linux-pam, using openpam will result in broken fprintd.
   buildInputs = [ linux-pam ];
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index e3be4db26cd8..906a3c59234a 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ xorg.libX11 ];
 
-  mesonFlags = lib.optional stdenv.isLinux
+  mesonFlags = lib.optionals stdenv.isLinux
     [ "-Dmoduledir=${mesa.drivers.driverLink}/lib/vdpau" ];
 
   NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lX11";
diff --git a/pkgs/development/libraries/libvncserver/default.nix b/pkgs/development/libraries/libvncserver/default.nix
index b9da7135f92e..c111a81b0ccb 100644
--- a/pkgs/development/libraries/libvncserver/default.nix
+++ b/pkgs/development/libraries/libvncserver/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     libpng
   ] ++ lib.optionals stdenv.isLinux [
     systemd
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     Carbon
   ];
 
diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index eadf6f91e1e0..db5f5026f2c1 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -1,44 +1,44 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, pkg-config, perl, fetchpatch }:
+{ lib, stdenv, fetchurl, perl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "libxcrypt";
   version = "4.4.28";
 
-  src = fetchFromGitHub {
-    owner = "besser82";
-    repo = "libxcrypt";
-    rev = "v${version}";
-    sha256 = "sha256-Ohf+RCOXnoCxAFnXXV9e2TCqpfZziQl+FGJTGDSQTF0=";
+  src = fetchurl {
+    url = "https://github.com/besser82/libxcrypt/releases/download/v${version}/libxcrypt-${version}.tar.xz";
+    sha256 = "sha256-npNoEfn60R28ozyhm9l8VcUus8oVkB8nreBGzHnmnoc=";
   };
 
-  patches = [
-    # Fix for tests on musl is being upstreamed:
-    # https://github.com/besser82/libxcrypt/pull/157
-    # Applied in all environments to prevent patchrot
-    (fetchpatch {
-      url = "https://github.com/besser82/libxcrypt/commit/a4228faa0b96986abc076125cf97d352a063d92f.patch";
-      sha256 = "sha256-iGNz8eer6OkA0yR74WisE6GbFTYyXKw7koXl/R7DhVE=";
-    })
+  outputs = [
+    "out"
+    "man"
   ];
 
-  preConfigure = ''
-    patchShebangs autogen.sh
-    ./autogen.sh
-  '';
-
   configureFlags = [
+    "--enable-hashes=all"
+    "--enable-obsolete-api=glibc"
+    "--disable-failure-tokens"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     "--disable-werror"
   ];
 
-  nativeBuildInputs = [ autoconf automake libtool pkg-config perl ];
+  nativeBuildInputs = [
+    perl
+  ];
+
+  enableParallelBuilding = true;
 
-  doCheck = true;
+  doCheck = !stdenv.hostPlatform.isMusl;
+
+  passthru.tests = {
+    inherit (nixosTests) login shadow;
+  };
 
   meta = with lib; {
     description = "Extended crypt library for descrypt, md5crypt, bcrypt, and others";
     homepage = "https://github.com/besser82/libxcrypt/";
     platforms = platforms.all;
-    maintainers = with maintainers; [ dottedmag ];
+    maintainers = with maintainers; [ dottedmag hexa ];
     license = licenses.lgpl21Plus;
   };
 }
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 474afc4ba6ca..3fe272591e10 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -12,7 +12,7 @@
 , ncurses
 , findXMLCatalogs
 , libiconv
-, pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
+, pythonSupport ? enableShared
 , icuSupport ? false
 , icu
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
@@ -60,6 +60,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
@@ -94,7 +96,8 @@ stdenv.mkDerivation rec {
     (lib.enableFeature enableStatic "static")
     (lib.enableFeature enableShared "shared")
     (lib.withFeature icuSupport "icu")
-    (lib.withFeatureAs pythonSupport "python" python)
+    (lib.withFeature pythonSupport "python")
+    (lib.optionalString pythonSupport "PYTHON=${python.pythonForBuild.interpreter}")
   ];
 
   installFlags = lib.optionals pythonSupport [
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index 29c693891162..5e520c315f7d 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -8,9 +8,10 @@
 , gettext
 , python
 , ncurses
+, libxcrypt
 , libgcrypt
 , cryptoSupport ? false
-, pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
+, pythonSupport ? true
 , gnome
 }:
 
@@ -26,14 +27,16 @@ stdenv.mkDerivation rec {
     sha256 = "EoSPCkQI9ltTDTlizZ/2cLaueWGRz+/zdSK1dy3o3I4=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
   ];
 
   buildInputs = [
-    libxml2.dev
-  ] ++ lib.optional stdenv.isDarwin [
+    libxml2.dev libxcrypt
+  ] ++ lib.optionals stdenv.isDarwin [
     gettext
   ] ++ lib.optionals pythonSupport [
     libxml2.py
@@ -51,7 +54,8 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-    (lib.withFeatureAs pythonSupport "python" python)
+    (lib.withFeature pythonSupport "python")
+    (lib.optionalString pythonSupport "PYTHON=${python.pythonForBuild.interpreter}")
   ] ++ lib.optionals (!cryptoSupport) [
     "--without-crypto"
   ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 6b78a570cccb..65dd547c6ab7 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -86,6 +86,8 @@ self = stdenv.mkDerivation {
       'DATADIR "/drirc.d"' '"${placeholder "out"}/share/drirc.d"'
     substituteInPlace src/util/meson.build --replace \
       "get_option('datadir')" "'${placeholder "out"}/share'"
+    substituteInPlace src/amd/vulkan/meson.build --replace \
+      "get_option('datadir')" "'${placeholder "out"}/share'"
   '';
 
   outputs = [ "out" "dev" "drivers" ]
diff --git a/pkgs/development/libraries/mimalloc/default.nix b/pkgs/development/libraries/mimalloc/default.nix
index cc67e2070949..6dcf1978edcf 100644
--- a/pkgs/development/libraries/mimalloc/default.nix
+++ b/pkgs/development/libraries/mimalloc/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake ninja ];
-  cmakeFlags = [ "-DMI_INSTALL_TOPLEVEL=ON" ] ++ lib.optional secureBuild [ "-DMI_SECURE=ON" ];
+  cmakeFlags = [ "-DMI_INSTALL_TOPLEVEL=ON" ] ++ lib.optionals secureBuild [ "-DMI_SECURE=ON" ];
 
   postInstall = let
     rel = lib.versions.majorMinor version;
diff --git a/pkgs/development/libraries/nng/default.nix b/pkgs/development/libraries/nng/default.nix
index 9acc64fea642..7f0bd15aa542 100644
--- a/pkgs/development/libraries/nng/default.nix
+++ b/pkgs/development/libraries/nng/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ninja ]
     ++ lib.optionals mbedtlsSupport [ mbedtls ];
 
-  buildInputs = lib.optional mbedtlsSupport [ mbedtls ];
+  buildInputs = lib.optionals mbedtlsSupport [ mbedtls ];
 
   cmakeFlags = [ "-G Ninja" "-DNNG_ENABLE_TLS=ON" ]
     ++ lib.optionals mbedtlsSupport [ "-DMBEDTLS_ROOT_DIR=${mbedtls}" ];
diff --git a/pkgs/development/libraries/openbsm/default.nix b/pkgs/development/libraries/openbsm/default.nix
index 4719b7fb7470..627e9b830714 100644
--- a/pkgs/development/libraries/openbsm/default.nix
+++ b/pkgs/development/libraries/openbsm/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0b98359hd8mm585sh145ss828pg2y8vgz38lqrb7nypapiyqdnd1";
   };
 
-  patches = lib.optional stdenv.isDarwin [ ./bsm-add-audit_token_to_pid.patch ];
+  patches = lib.optionals stdenv.isDarwin [ ./bsm-add-audit_token_to_pid.patch ];
 
   preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
     MACOSX_DEPLOYMENT_TARGET=10.16
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 550a7f39373a..56b022d03b9b 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -248,7 +248,7 @@ stdenv.mkDerivation {
     "-DBUILD_opencv_videoio=OFF"
   ] ++ lib.optionals enablePython [
     "-DOPENCV_SKIP_PYTHON_LOADER=ON"
-  ] ++ lib.optional enableEigen [
+  ] ++ lib.optionals enableEigen [
     # Autodetection broken by https://github.com/opencv/opencv/pull/13337
     "-DEIGEN_INCLUDE_PATH=${eigen}/include/eigen3"
   ];
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index f357b8d4b720..64b6c8c23445 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -11,6 +11,7 @@
 , libtool
 , openssl
 , systemdMinimal
+, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
     libsodium
     libtool
     openssl
+    libxcrypt
   ] ++ lib.optionals (stdenv.isLinux) [
     systemdMinimal
   ];
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 723f1848c6a0..f2392bb00726 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
     ++ lib.optionals cudaSupport [ cudatoolkit ]
     ++ [ libevent hwloc ]
     ++ lib.optional (stdenv.isLinux || stdenv.isFreeBSD) rdma-core
-    ++ lib.optional fabricSupport [ libpsm2 libfabric ];
+    ++ lib.optionals fabricSupport [ libpsm2 libfabric ];
 
   nativeBuildInputs = [ perl ]
     ++ lib.optionals fortranSupport [ gfortran ];
diff --git a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
index baf162e88d09..04585565a331 100644
--- a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
+++ b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
@@ -1,22 +1,25 @@
 diff --git a/Configure b/Configure
-index f0ad787bc4..a48d2008c6 100755
+index a558e5ab1a..9a884f0b0f 100755
 --- a/Configure
 +++ b/Configure
-@@ -1688,17 +1688,6 @@ unless ($disabled{devcryptoeng}) {
+@@ -1714,20 +1714,6 @@ unless ($disabled{devcryptoeng}) {
+ 
  unless ($disabled{ktls}) {
      $config{ktls}="";
-     if ($target =~ m/^linux/) {
--        my $usr = "/usr/$config{cross_compile_prefix}";
--        chop($usr);
--        if ($config{cross_compile_prefix} eq "") {
--            $usr = "/usr";
--        }
--        my $minver = (4 << 16) + (13 << 8) + 0;
--        my @verstr = split(" ",`cat $usr/include/linux/version.h | grep LINUX_VERSION_CODE`);
--
--        if ($verstr[2] < $minver) {
+-    my $cc = $config{CROSS_COMPILE}.$config{CC};
+-    if ($target =~ m/^linux/) {
+-        system("printf '#include <sys/types.h>\n#include <linux/tls.h>' | $cc -E - >/dev/null 2>&1");
+-        if ($? != 0) {
 -            disable('too-old-kernel', 'ktls');
 -        }
-     } elsif ($target =~ m/^BSD/) {
-         my $cc = $config{CROSS_COMPILE}.$config{CC};
-         system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+-    } elsif ($target =~ m/^BSD/) {
+-        system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+-        if ($? != 0) {
+-            disable('too-old-freebsd', 'ktls');
+-        }
+-    } else {
+-        disable('not-linux-or-freebsd', 'ktls');
+-    }
+ }
+ 
+ push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls});
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 78cc680c7be5..689f74ee5c51 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -16,14 +16,14 @@
 # files.
 
 let
-  common = { version, sha256, patches ? [], withDocs ? false, extraMeta ? {} }:
+  common = { version, hash, patches ? [], withDocs ? false, extraMeta ? {} }:
    stdenv.mkDerivation rec {
     pname = "openssl";
     inherit version;
 
     src = fetchurl {
       url = "https://www.openssl.org/source/${pname}-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
     };
 
     inherit patches;
@@ -213,8 +213,8 @@ in {
 
 
   openssl_1_1 = common rec {
-    version = "1.1.1q";
-    sha256 = "sha256-15Oc5hQCnN/wtsIPDi5XAxWKSJpyslB7i9Ub+Mj9EMo=";
+    version = "1.1.1r";
+    hash = "sha256-44k1KuPVrk04WXv4pU8dy2+zyLUPT+WKlLsb9/hdgqA=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -228,8 +228,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.5";
-    sha256 = "sha256-qn2Nm+9xrWUlxVuhHl9Dl4ic5Jwsk0nc6m0+TwsCSno=";
+    version = "3.0.6";
+    hash = "sha256-5KEKKYaUXj8aHy69aKx4BEmhdzuWtqF0/fZQ1ryWEfE=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/openvino/default.nix b/pkgs/development/libraries/openvino/default.nix
index dabf56d9056b..e3ebb97cbdff 100644
--- a/pkgs/development/libraries/openvino/default.nix
+++ b/pkgs/development/libraries/openvino/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     "-DNGRAPH_UNIT_TEST_ENABLE:BOOL=OFF"
     "-DENABLE_SAMPLES:BOOL=OFF"
     "-DENABLE_CPPLINT:BOOL=OFF"
-  ] ++ lib.optional enablePython [
+  ] ++ lib.optionals enablePython [
     "-DENABLE_PYTHON:BOOL=ON"
   ];
 
@@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
     python
     tbb
     shellcheck
-  ] ++ lib.optional enablePython (with python.pkgs; [
+  ] ++ lib.optionals enablePython (with python.pkgs; [
     cython
     pybind11
   ]);
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index fee4a2e8259f..1f2646a03638 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
       "/etc/ssl/certs/ca-certificates.crt"     # NixOS + Debian/Ubuntu/Arch/Gentoo...
       "/etc/pki/tls/certs/ca-bundle.crt"       # Fedora/CentOS
       "/var/lib/ca-certificates/ca-bundle.pem" # openSUSE
+      "/etc/ssl/cert.pem"                      # Darwin/macOS
     ]}"
   ];
 
diff --git a/pkgs/development/libraries/pangomm/2.48.nix b/pkgs/development/libraries/pangomm/2.48.nix
index 478378f64c27..52affe360f84 100644
--- a/pkgs/development/libraries/pangomm/2.48.nix
+++ b/pkgs/development/libraries/pangomm/2.48.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     python3
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices
   ];
 
diff --git a/pkgs/development/libraries/physics/cernlib/default.nix b/pkgs/development/libraries/physics/cernlib/default.nix
index 77ad6e201a32..8eae6fcaad55 100644
--- a/pkgs/development/libraries/physics/cernlib/default.nix
+++ b/pkgs/development/libraries/physics/cernlib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gfortran, imake, makedepend, motif, xorg }:
+{ lib, stdenv, fetchurl, gfortran, imake, makedepend, motif, xorg, libxcrypt }:
 
 stdenv.mkDerivation rec {
   version = "2006";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0awla1rl96z82br7slcmg8ks1d2a7slk6dj79ywb871j2ksi3fky";
   };
 
-  buildInputs = with xorg; [ gfortran motif libX11 libXft libXt ];
+  buildInputs = with xorg; [ gfortran motif libX11 libXft libXt libxcrypt ];
   nativeBuildInputs = [ imake makedepend ];
   sourceRoot = ".";
 
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index a02ecc1e9b74..f2907afab018 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPackages
 , fetchFromGitLab
+, fetchpatch
 , removeReferencesTo
 , python3
 , meson
@@ -45,6 +46,7 @@
 , sbc
 , libfreeaptx
 , ldacbt
+, liblc3
 , fdk_aac
 , libopus
 , nativeHspSupport ? true
@@ -70,7 +72,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.58";
+    version = "0.3.59";
 
     outputs = [
       "out"
@@ -88,7 +90,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-r8sDXyXwtA2o2xqglOI8XflttSScrqJ57cj1//k2tZ8=";
+      sha256 = "sha256-4wDtdgkjBRlthhwbI3cSQFnbr+gxPQP5j5YnrWiQVp4=";
     };
 
     patches = [
@@ -104,6 +106,12 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
+
+      # remove when updating to 0.3.60
+      (fetchpatch { # filter-chain: iterate the port correctly
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/94a64268613adac8ef6f3e6c1f04468220540d00.patch";
+        sha256 = "sha256-IDTB7NgadgR3vKv97Nvd9pBfnOnMi21YsvLdD1Ew7HE=";
+      })
     ];
 
     nativeBuildInputs = [
@@ -134,7 +142,7 @@ let
     ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
     ++ lib.optionals libcameraSupport [ libcamera libdrm ]
     ++ lib.optional ffmpegSupport ffmpeg
-    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt sbc fdk_aac libopus ]
+    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt liblc3 sbc fdk_aac libopus ]
     ++ lib.optional pulseTunnelSupport libpulseaudio
     ++ lib.optional zeroconfSupport avahi
     ++ lib.optional raopSupport openssl
@@ -167,6 +175,7 @@ let
       "-Dbluez5-backend-ofono=${mesonEnableFeature ofonoSupport}"
       "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
       "-Dbluez5-codec-lc3plus=disabled"
+      "-Dbluez5-codec-lc3=${mesonEnableFeature bluezSupport}"
       "-Dsysconfdir=/etc"
       "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
       "-Draop=${mesonEnableFeature raopSupport}"
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index cba1af704607..8ff218b79316 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: rec {
     pcre
     libiconv
     libintl
-  ] ++ lib.optional withData [
+  ] ++ lib.optionals withData [
     poppler_data
   ];
 
diff --git a/pkgs/development/libraries/precice/default.nix b/pkgs/development/libraries/precice/default.nix
index bc6a9359e614..01ab32577cb2 100644
--- a/pkgs/development/libraries/precice/default.nix
+++ b/pkgs/development/libraries/precice/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     "-DPYTHON_INCLUDE_DIR=${python3}/include/${python3.libPrefix}"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [ "-D_GNU_SOURCE" ];
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [ "-D_GNU_SOURCE" ];
 
   nativeBuildInputs = [ cmake gcc ];
   buildInputs = [ boost eigen libxml2 mpi python3 python3.pkgs.numpy ];
diff --git a/pkgs/development/libraries/qt-5/modules/qtlocation.nix b/pkgs/development/libraries/qt-5/modules/qtlocation.nix
index 687571f18d29..b5fdc918dc69 100644
--- a/pkgs/development/libraries/qt-5/modules/qtlocation.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtlocation.nix
@@ -4,7 +4,7 @@ qtModule {
   pname = "qtlocation";
   qtInputs = [ qtbase qtmultimedia ];
   outputs = [ "bin" "out" "dev" ];
-  qmakeFlags = lib.optional stdenv.isDarwin [
+  qmakeFlags = lib.optionals stdenv.isDarwin [
      # boost uses std::auto_ptr which has been disabled in clang with libcxx
      # This flag re-enables this feature
      # https://libcxx.llvm.org/docs/UsingLibcxx.html#c-17-specific-configuration-macros
diff --git a/pkgs/development/libraries/redis-plus-plus/default.nix b/pkgs/development/libraries/redis-plus-plus/default.nix
index 7d3d7d486714..61e593d28c93 100644
--- a/pkgs/development/libraries/redis-plus-plus/default.nix
+++ b/pkgs/development/libraries/redis-plus-plus/default.nix
@@ -22,9 +22,9 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DREDIS_PLUS_PLUS_BUILD_TEST=OFF"
-  ] ++ lib.optional (!enableShared) [
+  ] ++ lib.optionals (!enableShared) [
     "-DREDIS_PLUS_PLUS_BUILD_SHARED=OFF"
-  ] ++ lib.optional (!enableStatic) [
+  ] ++ lib.optionals (!enableStatic) [
     "-DREDIS_PLUS_PLUS_BUILD_STATIC=OFF"
   ];
 
diff --git a/pkgs/development/libraries/rustc-demangle/default.nix b/pkgs/development/libraries/rustc-demangle/default.nix
index be02fedfde71..e0329085bd56 100644
--- a/pkgs/development/libraries/rustc-demangle/default.nix
+++ b/pkgs/development/libraries/rustc-demangle/default.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
     ./add-Cargo.lock.patch
   ];
   cargoSha256 = "sha256-1tW5TOap5MstxTXAFij3IB8TIpI+FryEX9TXlVXjRl4=";
-  cargoBuildFlags = "-p rustc-demangle-capi";
+  cargoBuildFlags = [ "-p" "rustc-demangle-capi" ];
   postInstall = ''
     mkdir -p $out/lib
     cp target/${rust.toRustTargetSpec stdenv.hostPlatform}/release/librustc_demangle.so $out/lib
diff --git a/pkgs/development/libraries/science/math/faiss/default.nix b/pkgs/development/libraries/science/math/faiss/default.nix
index f2d5e29f6a4a..9c83a1220e46 100644
--- a/pkgs/development/libraries/science/math/faiss/default.nix
+++ b/pkgs/development/libraries/science/math/faiss/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake ] ++ lib.optionals cudaSupport [
     cudatoolkit
     addOpenGLRunpath
-  ] ++ lib.optional pythonSupport [
+  ] ++ lib.optionals pythonSupport [
     pythonPackages.python
   ];
 
diff --git a/pkgs/development/libraries/science/networking/ns-3/default.nix b/pkgs/development/libraries/science/networking/ns-3/default.nix
index b9f7946f7161..9f80470eff2c 100644
--- a/pkgs/development/libraries/science/networking/ns-3/default.nix
+++ b/pkgs/development/libraries/science/networking/ns-3/default.nix
@@ -53,8 +53,8 @@ stdenv.mkDerivation rec {
 
   # ncurses is a hidden dependency of waf when checking python
   buildInputs = lib.optionals pythonSupport [ castxml ncurses ]
-    ++ lib.optional enableDoxygen [ doxygen graphviz imagemagick ]
-    ++ lib.optional withManual [ dia tetex ghostscript texlive.combined.scheme-medium ];
+    ++ lib.optionals enableDoxygen [ doxygen graphviz imagemagick ]
+    ++ lib.optionals withManual [ dia tetex ghostscript texlive.combined.scheme-medium ];
 
   propagatedBuildInputs = [ pythonEnv ];
 
diff --git a/pkgs/development/libraries/sord/default.nix b/pkgs/development/libraries/sord/default.nix
index dee53bd3b2a7..efb8bf0b8952 100644
--- a/pkgs/development/libraries/sord/default.nix
+++ b/pkgs/development/libraries/sord/default.nix
@@ -1,31 +1,42 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, python3, serd, pcre, wafHook }:
+{ lib
+, stdenv
+, doxygen
+, fetchFromGitHub
+, meson
+, ninja
+, pcre
+, pkg-config
+, python3
+, serd
+}:
 
 stdenv.mkDerivation rec {
   pname = "sord";
-  version = "unstable-2021-01-12";
+  version = "0.16.14";
 
-  # Commit picked in mitigation of #109729
   src = fetchFromGitHub {
     owner = "drobilla";
     repo = pname;
-    rev = "d2efdb2d026216449599350b55c2c85c0d3efb89";
-    sha256 = "hHTwK+K6cj9MGO77a1IXiUZtEbXZ08cLGkYZ5eMOIVA=";
-    fetchSubmodules = true;
+    rev = "v${version}";
+    hash = "sha256-S22Szpg6iXeana5t6EpbOtRstthgrJ4Z2cBrf7a9ZBk=";
   };
 
-  preConfigure = ''
-    export PKGCONFIG="$PKG_CONFIG"
-  '';
-
-  nativeBuildInputs = [ pkg-config python3 wafHook ];
+  nativeBuildInputs = [
+    doxygen
+    meson
+    ninja
+    pkg-config
+    python3
+  ];
   buildInputs = [ pcre ];
   propagatedBuildInputs = [ serd ];
-  dontAddWafCrossFlags = true;
+
+  doCheck = true;
 
   meta = with lib; {
     homepage = "http://drobilla.net/software/sord";
     description = "A lightweight C library for storing RDF data in memory";
-    license = licenses.mit;
+    license = with licenses; [ bsd0 isc ];
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/libraries/speechd/default.nix b/pkgs/development/libraries/speechd/default.nix
index d27eabecf465..021246d73028 100644
--- a/pkgs/development/libraries/speechd/default.nix
+++ b/pkgs/development/libraries/speechd/default.nix
@@ -69,9 +69,9 @@ in stdenv.mkDerivation rec {
     espeak
     sonic
     pcaudiolib
-  ] ++ lib.optional withFlite [
+  ] ++ lib.optionals withFlite [
     flite
-  ] ++ lib.optional withPico [
+  ] ++ lib.optionals withPico [
     svox
   ];
 
@@ -83,17 +83,17 @@ in stdenv.mkDerivation rec {
     # Audio method falls back from left to right.
     "--with-default-audio-method=\"libao,pulse,alsa,oss\""
     "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-  ] ++ lib.optional withPulse [
+  ] ++ lib.optionals withPulse [
   "--with-pulse"
-  ] ++ lib.optional withAlsa [
+  ] ++ lib.optionals withAlsa [
     "--with-alsa"
-  ] ++ lib.optional withLibao [
+  ] ++ lib.optionals withLibao [
     "--with-libao"
-  ] ++ lib.optional withOss [
+  ] ++ lib.optionals withOss [
     "--with-oss"
-  ] ++ lib.optional withEspeak [
+  ] ++ lib.optionals withEspeak [
     "--with-espeak-ng"
-  ] ++ lib.optional withPico [
+  ] ++ lib.optionals withPico [
     "--with-pico"
   ];
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 786c3c9e313c..085e330bed48 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${optionalString interactive "-interactive"}";
-  version = "3.39.3";
+  version = "3.39.4";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-eGj7MIK+Pyz0SRxvum3ivdy8KTo1/vsGJO48E/AUIrk=";
+    sha256 = "sha256-8x1EW0jmfihM8gZxfMFwq2PL5P1/eagnk7dyKF54/bs=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 92d521b1916c..4467f38b0479 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.39.3";
+    version = "3.39.4";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-GMEvLh2hEkIRc8hcT4rtQyYScsGwR0qgdZKI/TD6ufw=";
+      sha256 = "sha256-AtlsbM+BGrm2ORnvcX9+UqRQxCDga9Ep+0g81ww7O7o=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index cb7af61a63ed..fb52f75f8c10 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , readline
 , libxslt
+, libxcrypt
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , fixDarwinDylibNames
@@ -33,6 +34,7 @@ stdenv.mkDerivation rec {
     python3
     readline
     libxslt
+    libxcrypt
   ];
 
   wafPath = "buildtools/bin/waf";
diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index f040022cc91b..9a534c4c1465 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -5,6 +5,7 @@
 , python3
 , readline
 , libxslt
+, libxcrypt
 , docbook-xsl-nons
 , docbook_xml_dtd_45
 }:
@@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     python3
     readline # required to build python
+    libxcrypt
   ];
 
   wafPath = "buildtools/bin/waf";
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index b88ddee6b249..555e7d0a45de 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
       ImageIO
       OpenGL
       GLUT
-    ] ++ optional enablePython [
+    ] ++ optionals enablePython [
       pythonInterpreter
     ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ libobjc ];
diff --git a/pkgs/development/libraries/wavpack/default.nix b/pkgs/development/libraries/wavpack/default.nix
index e3527ac32a46..67d8bccf51f0 100644
--- a/pkgs/development/libraries/wavpack/default.nix
+++ b/pkgs/development/libraries/wavpack/default.nix
@@ -1,19 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, libiconv }:
+{ lib, stdenv, fetchFromGitHub, gettext, autoreconfHook, libiconv }:
 
 stdenv.mkDerivation rec {
   pname = "wavpack";
-  version = "5.4.0";
+  version = "5.5.0";
 
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
+  # autogen.sh:9
+  preAutoreconf = "cp ${gettext}/share/gettext/config.rpath .";
+
   src = fetchFromGitHub {
     owner = "dbry";
     repo = "WavPack";
     rev = version;
-    sha256 = "1b6szk2vmnqnv5w7h8yc1iazjlidlraq1lwjbmc3fi0snbn6qj44";
+    hash = "sha256-4QDtLywu0PT+YsMV26M74bL2P7p4s1tk8ZBQtQcubaU=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index df248f6b4d43..153790002390 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitLab, nasm
+{ stdenv, lib, fetchFromGitLab, fetchpatch, nasm
 , enableShared ? !stdenv.hostPlatform.isStatic
  }:
 
@@ -16,7 +16,15 @@ stdenv.mkDerivation rec {
 
   # Upstream ./configure greps for (-mcpu|-march|-mfpu) in CFLAGS, which in nix
   # is put in the cc wrapper anyway.
-  patches = [ ./disable-arm-neon-default.patch ];
+  patches = [
+    ./disable-arm-neon-default.patch
+    (fetchpatch {
+      # https://code.videolan.org/videolan/x264/-/merge_requests/114
+      name = "fix-parallelism.patch";
+      url = "https://code.videolan.org/videolan/x264/-/commit/e067ab0b530395f90b578f6d05ab0a225e2efdf9.patch";
+      hash = "sha256-16h2IUCRjYlKI2RXYq8QyXukAdfoQxyBKsK/nI6vhRI=";
+    })
+  ];
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/zeroc-ice/default.nix b/pkgs/development/libraries/zeroc-ice/default.nix
index 4eef03c4a619..3050525c2a29 100644
--- a/pkgs/development/libraries/zeroc-ice/default.nix
+++ b/pkgs/development/libraries/zeroc-ice/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub
-, bzip2, expat, libedit, lmdb, openssl
+, bzip2, expat, libedit, lmdb, openssl, libxcrypt
 , python3 # for tests only
 , cpp11 ? false
 }:
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-h455isEmnRyoasXhh1UaA5PICcEEM8/C3IJf5yHRl5g=";
   };
 
-  buildInputs = [ zeroc_mcpp bzip2 expat libedit lmdb openssl ];
+  buildInputs = [ zeroc_mcpp bzip2 expat libedit lmdb openssl libxcrypt ];
 
   preBuild = ''
     makeFlagsArray+=(
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index a59f1d94da91..5becc91699bf 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -22,6 +22,7 @@
 , libmysqlclient
 , libuuid
 , libuv
+, libxcrypt
 , libyaml
 , mariadb
 , mpfr
@@ -336,6 +337,12 @@ with prev;
     ];
   });
 
+  luaposix = prev.luaLib.overrideLuarocks prev.luaposix (drv: {
+    externalDeps = [
+      { name = "CRYPT"; dep = libxcrypt; }
+    ];
+  });
+
   luasec = prev.luaLib.overrideLuarocks prev.luasec (drv: {
     externalDeps = [
       { name = "OPENSSL"; dep = openssl_1_1; }
@@ -513,7 +520,6 @@ with prev;
       make all
     '';
   });
-
   vusted = prev.vusted.overrideAttrs (_: {
     # make sure vusted_entry.vim doesn't get wrapped
     postInstall = ''
@@ -521,11 +527,6 @@ with prev;
     '';
   });
 
-  # TODO just while testing, remove afterwards
-  # toVimPlugin should do it instead
-  gitsigns-nvim = prev.gitsigns-nvim.overrideAttrs (oa: {
-    nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ vimUtils.vimGenDocHook ];
-  });
 
   # aliases
   cjson = prev.lua-cjson;
diff --git a/pkgs/development/mobile/androidenv/cmake.nix b/pkgs/development/mobile/androidenv/cmake.nix
index 3abad6b41f62..7df24ad4cc22 100644
--- a/pkgs/development/mobile/androidenv/cmake.nix
+++ b/pkgs/development/mobile/androidenv/cmake.nix
@@ -3,7 +3,7 @@
 deployAndroidPackage {
   inherit package os;
   nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
-  buildInputs = lib.optional (os == "linux") [ pkgs.stdenv.cc.libc pkgs.stdenv.cc.cc pkgs.ncurses5 ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.stdenv.cc.libc pkgs.stdenv.cc.cc pkgs.ncurses5 ];
   patchInstructions = lib.optionalString (os == "linux") ''
     autoPatchelf $packageBaseDir/bin
   '';
diff --git a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
index 0f3e7e4faa23..ad729e24fb8a 100644
--- a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
+++ b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
@@ -12,7 +12,7 @@ deployAndroidPackage {
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
   autoPatchelfIgnoreMissingDeps = true;
-  buildInputs = lib.optional (os == "linux") [ pkgs.zlib ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.zlib ];
   patchInstructions = lib.optionalString (os == "linux") (''
     patchShebangs .
 
diff --git a/pkgs/development/mobile/androidenv/tools/25.nix b/pkgs/development/mobile/androidenv/tools/25.nix
index 28ea249df25c..82642e04280b 100644
--- a/pkgs/development/mobile/androidenv/tools/25.nix
+++ b/pkgs/development/mobile/androidenv/tools/25.nix
@@ -3,7 +3,7 @@
 deployAndroidPackage {
   name = "androidsdk";
   nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
-  buildInputs = lib.optional (os == "linux") [ pkgs.glibc pkgs.xorg.libX11 pkgs.xorg.libXext pkgs.xorg.libXdamage pkgs.xorg.libxcb pkgs.xorg.libXfixes pkgs.xorg.libXrender pkgs.fontconfig.lib pkgs.freetype pkgs.libGL pkgs.zlib pkgs.ncurses5 pkgs.libpulseaudio pkgs_i686.glibc pkgs_i686.xorg.libX11 pkgs_i686.xorg.libXrender pkgs_i686.fontconfig pkgs_i686.freetype pkgs_i686.zlib ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.xorg.libX11 pkgs.xorg.libXext pkgs.xorg.libXdamage pkgs.xorg.libxcb pkgs.xorg.libXfixes pkgs.xorg.libXrender pkgs.fontconfig.lib pkgs.freetype pkgs.libGL pkgs.zlib pkgs.ncurses5 pkgs.libpulseaudio pkgs_i686.glibc pkgs_i686.xorg.libX11 pkgs_i686.xorg.libXrender pkgs_i686.fontconfig pkgs_i686.freetype pkgs_i686.zlib ];
   inherit package os;
 
   patchInstructions = ''
diff --git a/pkgs/development/node-packages/overrides.nix b/pkgs/development/node-packages/overrides.nix
index 7c5a408706e4..57cb62dc52d1 100644
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -96,13 +96,13 @@ final: prev: {
     nativeBuildInputs = with pkgs; [
       pkg-config
     ] ++ lib.optionals stdenv.isDarwin [
-      xcbuild
       darwin.apple_sdk.frameworks.CoreText
     ];
     buildInputs = with pkgs; [
       pixman
       cairo
       pango
+      giflib
     ];
   };
 
@@ -147,14 +147,13 @@ final: prev: {
   # ../../applications/video/epgstation
   epgstation = prev."epgstation-../../applications/video/epgstation".override (oldAttrs: {
     buildInputs = [ pkgs.postgresql ];
-    nativeBuildInputs = [ final.node-pre-gyp final.node-gyp-build pkgs.which ] ++ lib.optionals stdenv.isDarwin [ pkgs.xcbuild ];
+    nativeBuildInputs = [ final.node-pre-gyp final.node-gyp-build pkgs.which ];
     meta = oldAttrs.meta // { platforms = lib.platforms.none; };
   });
 
   # NOTE: this is a stub package to fetch npm dependencies for
   # ../../applications/video/epgstation/client
   epgstation-client = prev."epgstation-client-../../applications/video/epgstation/client".override (oldAttrs: {
-    nativeBuildInputs = lib.optionals stdenv.isDarwin [ pkgs.xcbuild ];
     meta = oldAttrs.meta // { platforms = lib.platforms.none; };
   });
 
@@ -222,11 +221,7 @@ final: prev: {
   });
 
   joplin = prev.joplin.override {
-    nativeBuildInputs = with pkgs; [
-      pkg-config
-    ] ++ lib.optionals stdenv.isDarwin [
-      xcbuild
-    ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
     buildInputs = with pkgs; [
       # required by sharp
       # https://sharp.pixelplumbing.com/install
@@ -292,10 +287,6 @@ final: prev: {
     '';
   };
 
-  mastodon-bot = prev.mastodon-bot.override {
-    nativeBuildInputs = lib.optionals stdenv.isDarwin [ pkgs.xcbuild ];
-  };
-
   mermaid-cli = prev."@mermaid-js/mermaid-cli".override (
   if stdenv.isDarwin
   then {}
@@ -432,7 +423,7 @@ final: prev: {
 
   pulp = prev.pulp.override {
     # tries to install purescript
-    npmFlags = "--ignore-scripts";
+    npmFlags = builtins.toString [ "--ignore-scripts" ];
 
     nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
     postInstall =  ''
@@ -513,11 +504,7 @@ final: prev: {
   };
 
   thelounge-plugin-giphy = prev.thelounge-plugin-giphy.override {
-    nativeBuildInputs = [
-      final.node-pre-gyp
-    ] ++ lib.optionals stdenv.isDarwin [
-      pkgs.xcbuild
-    ];
+    nativeBuildInputs = [ final.node-pre-gyp ];
   };
 
   thelounge-theme-flat-blue = prev.thelounge-theme-flat-blue.override {
diff --git a/pkgs/development/ocaml-modules/bz2/default.nix b/pkgs/development/ocaml-modules/bz2/default.nix
index 6d8b56ae232d..835570dc9ab6 100644
--- a/pkgs/development/ocaml-modules/bz2/default.nix
+++ b/pkgs/development/ocaml-modules/bz2/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-jBFEkLN2fbC3LxTu7C0iuhvNg64duuckBHWZoBxrV/U=";
   };
 
-  autoreconfFlags = "-I .";
+  autoreconfFlags = [ "-I" "." ];
 
   nativeBuildInputs = [
     autoreconfHook
diff --git a/pkgs/development/ocaml-modules/cudf/default.nix b/pkgs/development/ocaml-modules/cudf/default.nix
index fe9793ea532f..54e96e047e5d 100644
--- a/pkgs/development/ocaml-modules/cudf/default.nix
+++ b/pkgs/development/ocaml-modules/cudf/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   doCheck = true;
 
   preInstall = "mkdir -p $OCAMLFIND_DESTDIR";
-  installFlags = "BINDIR=$(out)/bin";
+  installFlags = [ "BINDIR=$(out)/bin" ];
 
   meta = with lib; {
     description = "A library for CUDF format";
diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 9c626618ff0a..a5cf035aa060 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     pycares
-  ] ++ lib.optional (pythonOlder "3.7") [
+  ] ++ lib.optionals (pythonOlder "3.7") [
     typing
   ];
 
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index c261e5b163b7..14dfb65cfea8 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -65,7 +65,7 @@ buildPythonPackage rec {
     "test_large_stdout_blob"
     # Failed: DID NOT RAISE <class 'RuntimeError'>
     "test_validate_pattern"
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     # test_process_isolation_settings is currently broken on Darwin Catalina
     # https://github.com/ansible/ansible-runner/issues/413
     "process_isolation_settings"
diff --git a/pkgs/development/python-modules/aspy-refactor-imports/default.nix b/pkgs/development/python-modules/aspy-refactor-imports/default.nix
index cfe935e16e80..a19002449dfa 100644
--- a/pkgs/development/python-modules/aspy-refactor-imports/default.nix
+++ b/pkgs/development/python-modules/aspy-refactor-imports/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   ];
 
   # fails on darwin due to case-insensitive file system
-  disabledTests = lib.optional stdenv.isDarwin ["test_application_directory_case"];
+  disabledTests = lib.optionals stdenv.isDarwin ["test_application_directory_case"];
 
   meta = with lib; {
     description = "Utilities for refactoring imports in python-like syntax.";
diff --git a/pkgs/development/python-modules/asyncio_mqtt/default.nix b/pkgs/development/python-modules/asyncio_mqtt/default.nix
index c0ae1cea95f7..a87bca439643 100644
--- a/pkgs/development/python-modules/asyncio_mqtt/default.nix
+++ b/pkgs/development/python-modules/asyncio_mqtt/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     paho-mqtt
-  ] ++ lib.optional (pythonOlder "3.7") [
+  ] ++ lib.optionals (pythonOlder "3.7") [
     async_generator
   ];
 
diff --git a/pkgs/development/python-modules/azure-core/default.nix b/pkgs/development/python-modules/azure-core/default.nix
index 5237130f59f8..75cf39587615 100644
--- a/pkgs/development/python-modules/azure-core/default.nix
+++ b/pkgs/development/python-modules/azure-core/default.nix
@@ -63,7 +63,7 @@ buildPythonPackage rec {
   # disable 8 tests failing on some darwin machines with errors:
   # azure.core.polling.base_polling.BadStatus: Invalid return status 403 for 'GET' operation
   # azure.core.exceptions.HttpResponseError: Operation returned an invalid status 'Forbidden'
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     "location_polling_fail"
   ];
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/behave/default.nix b/pkgs/development/python-modules/behave/default.nix
index 5254f79c4b2f..1030e589a21d 100644
--- a/pkgs/development/python-modules/behave/default.nix
+++ b/pkgs/development/python-modules/behave/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchFromGitHub
-, buildPythonApplication, python
+, buildPythonPackage, python
 , pytestCheckHook, mock, path, pyhamcrest, pytest-html
 , glibcLocales
 , colorama, cucumber-tag-expressions, parse, parse-type, six
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "behave";
   version = "1.2.7.dev2";
 
diff --git a/pkgs/development/python-modules/betterproto/default.nix b/pkgs/development/python-modules/betterproto/default.nix
index 2f6ba2e29a23..b49204ee8c44 100644
--- a/pkgs/development/python-modules/betterproto/default.nix
+++ b/pkgs/development/python-modules/betterproto/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     grpclib
     python-dateutil
-  ] ++ lib.optional (pythonOlder "3.7") [
+  ] ++ lib.optionals (pythonOlder "3.7") [
     dataclasses
   ];
 
diff --git a/pkgs/development/python-modules/catboost/default.nix b/pkgs/development/python-modules/catboost/default.nix
index 02e107f27e19..9a395bc6c98e 100644
--- a/pkgs/development/python-modules/catboost/default.nix
+++ b/pkgs/development/python-modules/catboost/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [ clang_12 python2 ];
 
   propagatedBuildInputs = [ graphviz matplotlib numpy pandas scipy plotly six ]
-    ++ lib.optional withCuda [ cudatoolkit ];
+    ++ lib.optionals withCuda [ cudatoolkit ];
 
   patches = [
     ./nix-support.patch
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index 674fc1183d8e..ecf7ed49aa5c 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -7,22 +7,24 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2022.06.15";
+  version = "2022.09.24";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    sha256 = "sha256-CKO8wF5FMGLIZbTd7YrKE9OWV9MbfQ2+BMc5IPk1FFU=";
+    hash = "sha256-B6LO6AfG9cfpyNI7hj3VjmGTFsrrIkDYO4gPMkZY74w=";
   };
 
   checkInputs = [
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "certifi" ];
+  pythonImportsCheck = [
+    "certifi"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/certifi/python-certifi";
diff --git a/pkgs/development/python-modules/ciso8601/default.nix b/pkgs/development/python-modules/ciso8601/default.nix
index e210e974414d..79afe8500072 100644
--- a/pkgs/development/python-modules/ciso8601/default.nix
+++ b/pkgs/development/python-modules/ciso8601/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytz
-  ] ++ lib.optional (isPy27) [
+  ] ++ lib.optionals (isPy27) [
     unittest2
   ];
 
diff --git a/pkgs/development/python-modules/clintermission/default.nix b/pkgs/development/python-modules/clintermission/default.nix
index a0e5dcb7142f..b5df005978c4 100644
--- a/pkgs/development/python-modules/clintermission/default.nix
+++ b/pkgs/development/python-modules/clintermission/default.nix
@@ -1,8 +1,15 @@
-{ lib, buildPythonApplication, fetchFromGitHub, isPy3k, prompt-toolkit }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, prompt-toolkit }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "clintermission";
   version = "0.2.0";
+  format = "setuptools";
+
+  disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "sebageek";
@@ -11,14 +18,16 @@ buildPythonApplication rec {
     sha256 = "09wl0rpw6c9hab51rs957z64b0v9j4fcbqbn726wnapf4z5w6yxv";
   };
 
-  propagatedBuildInputs = [ prompt-toolkit ];
-
-  disabled = !isPy3k;
+  propagatedBuildInputs = [
+    prompt-toolkit
+  ];
 
   # repo contains no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "clintermission" ];
+  pythonImportsCheck = [
+    "clintermission"
+  ];
 
   meta = with lib; {
     description = "Non-fullscreen command-line selection menu";
diff --git a/pkgs/development/python-modules/coconut/default.nix b/pkgs/development/python-modules/coconut/default.nix
index b7301cf1e73a..dec024fa8385 100644
--- a/pkgs/development/python-modules/coconut/default.nix
+++ b/pkgs/development/python-modules/coconut/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , cpyparsing
 , ipykernel
@@ -12,7 +12,7 @@
 , watchdog
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "coconut";
   version = "1.6.0";
 
diff --git a/pkgs/development/python-modules/deprecation/default.nix b/pkgs/development/python-modules/deprecation/default.nix
index 441971fa6e70..0e15f2d74c61 100644
--- a/pkgs/development/python-modules/deprecation/default.nix
+++ b/pkgs/development/python-modules/deprecation/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
 
   # avoiding mass rebuilds for python3.9, but no longer
   # needed with patch
-  checkInputs = [ unittestCheckHook ] ++ lib.optional (pythonOlder "3.10") [
+  checkInputs = [ unittestCheckHook ] ++ lib.optionals (pythonOlder "3.10") [
     unittest2
   ];
 
diff --git a/pkgs/development/python-modules/dnspython/default.nix b/pkgs/development/python-modules/dnspython/default.nix
index 1dbbba48b104..4b7148596492 100644
--- a/pkgs/development/python-modules/dnspython/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytestCheckHook
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     cacert
   ];
 
diff --git a/pkgs/development/python-modules/drivelib/default.nix b/pkgs/development/python-modules/drivelib/default.nix
index 526e58d14340..7b0a629e8a89 100644
--- a/pkgs/development/python-modules/drivelib/default.nix
+++ b/pkgs/development/python-modules/drivelib/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , expiringdict
 , google-auth-httplib2
@@ -7,7 +7,7 @@
 , google-api-python-client
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "drivelib";
   version = "0.3.0";
 
diff --git a/pkgs/development/python-modules/enlighten/default.nix b/pkgs/development/python-modules/enlighten/default.nix
index 8ac970ebd784..1946aa614974 100644
--- a/pkgs/development/python-modules/enlighten/default.nix
+++ b/pkgs/development/python-modules/enlighten/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   disabledTests = [
     # AssertionError: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'> is not...
     "test_init"
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     # https://github.com/Rockhopper-Technologies/enlighten/issues/44
     "test_autorefresh"
   ];
diff --git a/pkgs/development/python-modules/expiringdict/default.nix b/pkgs/development/python-modules/expiringdict/default.nix
index 942feff4513f..9dfe60aca7e3 100644
--- a/pkgs/development/python-modules/expiringdict/default.nix
+++ b/pkgs/development/python-modules/expiringdict/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , dill
 , coverage
@@ -8,16 +8,17 @@
 , nose
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "expiringdict";
   version = "1.2.2";
+  format = "setuptools";
 
   # use fetchFromGitHub instead of fetchPypi because the test suite of
   # the package is not included into the PyPI tarball
   src = fetchFromGitHub {
     owner = "mailgun";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     sha256 = "sha256-vRhJSHIqc51I+s/wndtfANM44CKW3QS1iajqyoSBf0I=";
   };
 
@@ -30,14 +31,18 @@ buildPythonApplication rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
     nosetests -v --with-coverage --cover-package=expiringdict
+    runHook postCheck
   '';
 
-  pythonImportsCheck = [ "expiringdict" ];
+  pythonImportsCheck = [
+    "expiringdict"
+  ];
 
   meta = with lib; {
     description = "Dictionary with auto-expiring values for caching purposes";
-    homepage = "https://pypi.org/project/expiringdict/";
+    homepage = "https://github.com/mailgun/expiringdict";
     license = licenses.asl20;
     maintainers = with maintainers; [ gravndal ];
   };
diff --git a/pkgs/development/python-modules/filecheck/default.nix b/pkgs/development/python-modules/filecheck/default.nix
index 2480c196881a..9cbd8bde2117 100644
--- a/pkgs/development/python-modules/filecheck/default.nix
+++ b/pkgs/development/python-modules/filecheck/default.nix
@@ -1,10 +1,11 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
-, poetry
+, poetry-core
+, pytestCheckHook
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "filecheck";
   version = "0.0.22";
   format = "pyproject";
@@ -16,9 +17,23 @@ buildPythonApplication rec {
     sha256 = "sha256-I2SypKkgcVuLyLiwNw5oWDb9qT56TbC6vbui8PEcziI=";
   };
 
-  nativeBuildInputs = [ poetry ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry>=0.12" "poetry-core" \
+      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
 
-  pythonImportsCheck = [ "filecheck" ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "filecheck"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/mull-project/FileCheck.py";
diff --git a/pkgs/development/python-modules/fixtures/default.nix b/pkgs/development/python-modules/fixtures/default.nix
index 3e9f9943327d..2bc6612ba70d 100644
--- a/pkgs/development/python-modules/fixtures/default.nix
+++ b/pkgs/development/python-modules/fixtures/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     sha256 = "fcf0d60234f1544da717a9738325812de1f42c2fa085e2d9252d8fff5712b2ef";
   };
 
-  patches = lib.optional (pythonAtLeast "3.9") [
+  patches = lib.optionals (pythonAtLeast "3.9") [
     # drop tests that try to monkeypatch a classmethod, which fails on python3.9
     # https://github.com/testing-cabal/fixtures/issues/44
     (fetchpatch {
diff --git a/pkgs/development/python-modules/funcsigs/default.nix b/pkgs/development/python-modules/funcsigs/default.nix
index 115d358cb786..a59b6f33b5f6 100644
--- a/pkgs/development/python-modules/funcsigs/default.nix
+++ b/pkgs/development/python-modules/funcsigs/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage rec {
   };
 
   # https://github.com/testing-cabal/funcsigs/issues/10
-  patches = lib.optional (isPyPy && isPy3k) [ ./fix-pypy3-tests.patch ];
+  patches = lib.optionals (isPyPy && isPy3k) [ ./fix-pypy3-tests.patch ];
 
   # requires, unittest2 and package hasn't been maintained since 2013
   doCheck = false;
diff --git a/pkgs/development/python-modules/gdown/default.nix b/pkgs/development/python-modules/gdown/default.nix
index 3368706c8c12..bd29bec95433 100644
--- a/pkgs/development/python-modules/gdown/default.nix
+++ b/pkgs/development/python-modules/gdown/default.nix
@@ -1,6 +1,6 @@
 { lib
 , beautifulsoup4
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , filelock
 , requests
@@ -9,7 +9,7 @@
 , six
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "gdown";
   version = "4.5.1";
   format = "setuptools";
diff --git a/pkgs/development/python-modules/gigalixir/default.nix b/pkgs/development/python-modules/gigalixir/default.nix
deleted file mode 100644
index c32c98fb3dd2..000000000000
--- a/pkgs/development/python-modules/gigalixir/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ stdenv
-, lib
-, buildPythonApplication
-, click
-, fetchPypi
-, git
-, httpretty
-, qrcode
-, pygments
-, pyopenssl
-, pytestCheckHook
-, requests
-, rollbar
-, stripe
-, pythonOlder
-, sure
-}:
-
-buildPythonApplication rec {
-  pname = "gigalixir";
-  version = "1.3.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-kNtybgv8j7t1tl6R5ZuC4vj5fnEcEenuNt0twA1kAh0=";
-  };
-
-  propagatedBuildInputs = [
-    click
-    pygments
-    pyopenssl
-    qrcode
-    requests
-    rollbar
-    stripe
-  ];
-
-  checkInputs = [
-    git
-    httpretty
-    pytestCheckHook
-    sure
-  ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'pytest-runner'," "" \
-      --replace "cryptography==" "cryptography>="
-  '';
-
-  disabledTests = [
-    # Test requires network access
-    "test_rollback_without_version"
-  ];
-
-  pythonImportsCheck = [
-    "gigalixir"
-  ];
-
-  meta = with lib; {
-    broken = stdenv.isDarwin;
-    description = "Gigalixir Command-Line Interface";
-    homepage = "https://github.com/gigalixir/gigalixir-cli";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/glymur/default.nix b/pkgs/development/python-modules/glymur/default.nix
index 40748f86954e..9c652994a8c3 100644
--- a/pkgs/development/python-modules/glymur/default.nix
+++ b/pkgs/development/python-modules/glymur/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     numpy
-  ] ++ lib.optional isPy27 [ contextlib2 mock importlib-resources ];
+  ] ++ lib.optionals isPy27 [ contextlib2 mock importlib-resources ];
 
   checkInputs = [
     scikitimage
diff --git a/pkgs/development/python-modules/gprof2dot/default.nix b/pkgs/development/python-modules/gprof2dot/default.nix
index 4eb3a79e5e87..1536c5fcbdb3 100644
--- a/pkgs/development/python-modules/gprof2dot/default.nix
+++ b/pkgs/development/python-modules/gprof2dot/default.nix
@@ -1,13 +1,14 @@
 { lib
 , fetchFromGitHub
-, buildPythonApplication
+, buildPythonPackage
 , python
 , graphviz
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "gprof2dot";
   version = "2021.02.21";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jrfonseca";
@@ -36,6 +37,6 @@ buildPythonApplication rec {
     homepage = "https://github.com/jrfonseca/gprof2dot";
     description = "Python script to convert the output from many profilers into a dot graph";
     license = licenses.lgpl3Plus;
-    maintainers = [ maintainers.pmiddend ];
+    maintainers = with maintainers; [ pmiddend ];
   };
 }
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index f7e9fd75855f..43191ca0b892 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -1,6 +1,6 @@
 { lib
 , aiofiles
-, buildPythonApplication
+, buildPythonPackage
 , cached-property
 , fetchFromGitHub
 , git
@@ -9,7 +9,7 @@
 , pythonOlder
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "griffe";
   version = "0.22.0";
   format = "pyproject";
diff --git a/pkgs/development/python-modules/hupper/default.nix b/pkgs/development/python-modules/hupper/default.nix
index 972606974602..a9e8bd112163 100644
--- a/pkgs/development/python-modules/hupper/default.nix
+++ b/pkgs/development/python-modules/hupper/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   # segfaults in the testsuite that end up failing the tests in a background thread (in myapp)
   checkInputs = [
     pytestCheckHook
-  ] ++ lib.optional (!stdenv.isDarwin) [
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     watchdog
   ];
 
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 7e5d7e1448ac..124733568723 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     importlib-metadata
-  ] ++ lib.optional (pythonOlder "3.5") [
+  ] ++ lib.optionals (pythonOlder "3.5") [
     typing
   ];
 
diff --git a/pkgs/development/python-modules/iso8601/default.nix b/pkgs/development/python-modules/iso8601/default.nix
index 14cef7c62a8c..e189e3778bc8 100644
--- a/pkgs/development/python-modules/iso8601/default.nix
+++ b/pkgs/development/python-modules/iso8601/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "iso8601";
-  version = "1.0.2";
+  version = "1.1.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-J/UDIg5oRdnblU+yErlbA2LYt+bBsjJqhwYcPek1lLE=";
+    hash = "sha256-MoEee4He7iBj6m0ulPiBmobR84EeSdI2I6QfqDK+8D8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jaraco_text/default.nix b/pkgs/development/python-modules/jaraco_text/default.nix
index 341c744a4293..4891b2ea38c5 100644
--- a/pkgs/development/python-modules/jaraco_text/default.nix
+++ b/pkgs/development/python-modules/jaraco_text/default.nix
@@ -37,13 +37,13 @@ buildPythonPackage rec {
     jaraco-context
     jaraco_functools
     inflect
-  ] ++ lib.optional (pythonOlder "3.9") [
+  ] ++ lib.optionals (pythonOlder "3.9") [
     importlib-resources
   ];
 
   checkInputs = [
     pytestCheckHook
-  ] ++ lib.optional (pythonOlder "3.10") [
+  ] ++ lib.optionals (pythonOlder "3.10") [
     pathlib2
   ];
 
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index 12ba67b71244..c745737d3523 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -219,11 +219,11 @@ let
     # relevant dependencies can be downloaded.
     bazelFlags = [
       "-c opt"
-    ] ++ lib.optional (stdenv.targetPlatform.isx86_64 && stdenv.targetPlatform.isUnix) [
+    ] ++ lib.optionals (stdenv.targetPlatform.isx86_64 && stdenv.targetPlatform.isUnix) [
       "--config=avx_posix"
-    ] ++ lib.optional cudaSupport [
+    ] ++ lib.optionals cudaSupport [
       "--config=cuda"
-    ] ++ lib.optional mklSupport [
+    ] ++ lib.optionals mklSupport [
       "--config=mkl_open_source_only"
     ] ++ lib.optionals stdenv.cc.isClang [
       # bazel depends on the compiler frontend automatically selecting these flags based on file
diff --git a/pkgs/development/python-modules/jsbeautifier/default.nix b/pkgs/development/python-modules/jsbeautifier/default.nix
index 242b282d4dd2..62ca71d52fda 100644
--- a/pkgs/development/python-modules/jsbeautifier/default.nix
+++ b/pkgs/development/python-modules/jsbeautifier/default.nix
@@ -1,13 +1,13 @@
 { lib
 , fetchPypi
-, buildPythonApplication
+, buildPythonPackage
 , editorconfig
 , pytestCheckHook
 , pythonOlder
 , six
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "jsbeautifier";
   version = "1.14.6";
   format = "setuptools";
diff --git a/pkgs/development/python-modules/language-data/default.nix b/pkgs/development/python-modules/language-data/default.nix
index 803df3abaea5..ff04b036dc05 100644
--- a/pkgs/development/python-modules/language-data/default.nix
+++ b/pkgs/development/python-modules/language-data/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , marisa-trie
 , poetry-core
@@ -7,7 +7,7 @@
 , setuptools
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "language-data";
   version = "1.0.1";
   format = "pyproject";
diff --git a/pkgs/development/python-modules/lightgbm/default.nix b/pkgs/development/python-modules/lightgbm/default.nix
index 015417151b7a..ad54268c8cf5 100644
--- a/pkgs/development/python-modules/lightgbm/default.nix
+++ b/pkgs/development/python-modules/lightgbm/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  buildInputs = lib.optional stdenv.cc.isClang [ llvmPackages.openmp ];
+  buildInputs = lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
   propagatedBuildInputs = [
     numpy
     scipy
diff --git a/pkgs/development/python-modules/markdown-it-py/default.nix b/pkgs/development/python-modules/markdown-it-py/default.nix
index f4c83d5df348..d408c0071003 100644
--- a/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     attrs
     linkify-it-py
     mdurl
-  ] ++ lib.optional (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.8") [
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index ad32c3db7eb6..6a507d01ef3b 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -39,9 +39,9 @@ buildPythonPackage rec {
   buildInputs = [
     which
     sphinx
-  ] ++ lib.optional enableGhostscript [
+  ] ++ lib.optionals enableGhostscript [
     ghostscript
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     Cocoa
   ];
 
diff --git a/pkgs/development/python-modules/mkdocs-autorefs/default.nix b/pkgs/development/python-modules/mkdocs-autorefs/default.nix
index ea1dffdf0db0..dd88bd332e0e 100644
--- a/pkgs/development/python-modules/mkdocs-autorefs/default.nix
+++ b/pkgs/development/python-modules/mkdocs-autorefs/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , markdown
 , mkdocs
@@ -8,7 +8,7 @@
 , pythonOlder
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mkdocs-autorefs";
   version = "0.4.1";
   format = "pyproject";
diff --git a/pkgs/development/python-modules/mkdocs-material/default.nix b/pkgs/development/python-modules/mkdocs-material/default.nix
index f58bbf2e69d6..d82c1a654362 100644
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@@ -1,6 +1,6 @@
 { lib
 , callPackage
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , jinja2
 , markdown
@@ -11,7 +11,7 @@
 , pythonOlder
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mkdocs-material";
   version = "8.4.3";
   format = "setuptools";
diff --git a/pkgs/development/python-modules/mkdocs-minify/default.nix b/pkgs/development/python-modules/mkdocs-minify/default.nix
index 0beeb5164160..ee6765d31751 100644
--- a/pkgs/development/python-modules/mkdocs-minify/default.nix
+++ b/pkgs/development/python-modules/mkdocs-minify/default.nix
@@ -1,14 +1,15 @@
 { lib
 , callPackage
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , mkdocs
 , csscompressor
 , htmlmin
 , jsmin
+, pytestCheckHook
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mkdocs-minify";
   version = "0.5.0";
 
@@ -26,6 +27,11 @@ buildPythonApplication rec {
     mkdocs
   ];
 
+  checkInputs = [
+    mkdocs
+    pytestCheckHook
+  ];
+
   pythonImportsCheck = [ "mkdocs" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/mkdocs-redirects/default.nix b/pkgs/development/python-modules/mkdocs-redirects/default.nix
index 94bf504a76b6..9394692fc5cf 100644
--- a/pkgs/development/python-modules/mkdocs-redirects/default.nix
+++ b/pkgs/development/python-modules/mkdocs-redirects/default.nix
@@ -1,11 +1,12 @@
 { lib
 , callPackage
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , mkdocs
+, pytestCheckHook
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mkdocs-redirects";
   version = "1.2.0";
 
@@ -20,7 +21,13 @@ buildPythonApplication rec {
     mkdocs
   ];
 
-  pythonImportsCheck = [ "mkdocs" ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "mkdocs_redirects"
+  ];
 
   meta = with lib; {
     description = "Open source plugin for Mkdocs page redirects";
diff --git a/pkgs/development/python-modules/mkdocstrings-python/default.nix b/pkgs/development/python-modules/mkdocstrings-python/default.nix
index 4e10c4287d8c..58ead5774496 100644
--- a/pkgs/development/python-modules/mkdocstrings-python/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings-python/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , griffe
 , mkdocs-material
@@ -9,7 +9,7 @@
 , pythonOlder
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mkdocstrings-python";
   version = "0.7.1";
   format = "pyproject";
diff --git a/pkgs/development/python-modules/mkdocstrings/default.nix b/pkgs/development/python-modules/mkdocstrings/default.nix
index b151727a8fbd..5d20ea1a6e97 100644
--- a/pkgs/development/python-modules/mkdocstrings/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 , jinja2
 , markdown
@@ -12,7 +12,7 @@
 , pythonOlder
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mkdocstrings";
   version = "0.19.0";
   format = "pyproject";
diff --git a/pkgs/development/python-modules/mypy-protobuf/default.nix b/pkgs/development/python-modules/mypy-protobuf/default.nix
index 007fd2fd015f..c63910abc56c 100644
--- a/pkgs/development/python-modules/mypy-protobuf/default.nix
+++ b/pkgs/development/python-modules/mypy-protobuf/default.nix
@@ -1,6 +1,14 @@
-{ lib, fetchPypi, buildPythonApplication, protobuf, types-protobuf, grpcio-tools, pythonOlder }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, protobuf
+, types-protobuf
+, grpcio-tools
+, pytestCheckHook
+, pythonOlder
+}:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mypy-protobuf";
   version = "3.3.0";
   format = "pyproject";
@@ -12,7 +20,21 @@ buildPythonApplication rec {
     sha256 = "sha256-JPOwrssGZW6YP1jgfHMqkFd7nXrz4QZvwrZju/A3Akg=";
   };
 
-  propagatedBuildInputs = [ protobuf types-protobuf grpcio-tools ];
+  propagatedBuildInputs = [
+    protobuf
+    types-protobuf
+    grpcio-tools
+  ];
+
+  doCheck = false; # ModuleNotFoundError: No module named 'testproto'
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "mypy_protobuf"
+  ];
 
   meta = with lib; {
     description = "Generate mypy stub files from protobuf specs";
diff --git a/pkgs/development/python-modules/nipy/default.nix b/pkgs/development/python-modules/nipy/default.nix
index 5bdf6fdcd443..d5e399701dc8 100644
--- a/pkgs/development/python-modules/nipy/default.nix
+++ b/pkgs/development/python-modules/nipy/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     sha256 = "a8a2c97ce854fece4aced5a6394b9fdca5846150ad6d2a36b86590924af3c848";
   };
 
-  buildInputs = lib.optional doCheck [ nose ];
+  buildInputs = lib.optionals doCheck [ nose ];
   propagatedBuildInputs = [ matplotlib nibabel numpy scipy sympy ];
 
   checkPhase = ''    # wants to be run in a different directory
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index 4efaaf3f9ec9..fdb599466ff2 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -68,7 +68,7 @@ buildPythonPackage rec {
     "sock_server"
     "test_list_formats" # tries to find python MIME type
     "KernelCullingTest" # has a race condition failing on slower hardware
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     "test_delete"
     "test_checkpoints_follow_file"
   ];
diff --git a/pkgs/development/python-modules/notifymuch/default.nix b/pkgs/development/python-modules/notifymuch/default.nix
deleted file mode 100644
index bc1610e2ca94..000000000000
--- a/pkgs/development/python-modules/notifymuch/default.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{ lib
-, buildPythonApplication
-, isPy3k
-, fetchFromGitHub
-, notmuch
-, pygobject3
-, gobject-introspection
-, libnotify
-, wrapGAppsHook
-, gtk3
-}:
-
-buildPythonApplication rec {
-  pname = "notifymuch";
-  version = "0.1";
-  disabled = !isPy3k;
-
-  src = fetchFromGitHub {
-    owner = "kspi";
-    repo = "notifymuch";
-    # https://github.com/kspi/notifymuch/issues/11
-    rev = "9d4aaf54599282ce80643b38195ff501120807f0";
-    sha256 = "1lssr7iv43mp5v6nzrfbqlfzx8jcc7m636wlfyhhnd8ydd39n6k4";
-  };
-
-  propagatedBuildInputs = [
-    notmuch
-    pygobject3
-    libnotify
-    gtk3
-  ];
-
-  nativeBuildInputs = [
-    gobject-introspection
-    wrapGAppsHook
-  ];
-
-  dontWrapGApps = true;
-
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
-  strictDeps = false;
-
-  meta = with lib; {
-    description = "Display desktop notifications for unread mail in a notmuch database";
-    homepage = "https://github.com/kspi/notifymuch";
-    maintainers = with maintainers; [ arjan-s ];
-    license = licenses.gpl3;
-  };
-}
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index 2ca0e08ba5b1..965130658c44 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -40,7 +40,7 @@ in buildPythonPackage rec {
 
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
-  nativeBuildInputs = lib.optional cudaSupport [
+  nativeBuildInputs = lib.optionals cudaSupport [
     addOpenGLRunpath
   ];
 
diff --git a/pkgs/development/python-modules/paho-mqtt/default.nix b/pkgs/development/python-modules/paho-mqtt/default.nix
index fb249acf6333..e25f54748685 100644
--- a/pkgs/development/python-modules/paho-mqtt/default.nix
+++ b/pkgs/development/python-modules/paho-mqtt/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
     six
-  ] ++ lib.optional (!isPy3k) [
+  ] ++ lib.optionals (!isPy3k) [
     mock
   ];
 
diff --git a/pkgs/development/python-modules/peewee/default.nix b/pkgs/development/python-modules/peewee/default.nix
index 86fcd3948a6c..bb1370fe0737 100644
--- a/pkgs/development/python-modules/peewee/default.nix
+++ b/pkgs/development/python-modules/peewee/default.nix
@@ -34,9 +34,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     apsw
-  ] ++ lib.optional withPostgres [
+  ] ++ lib.optionals withPostgres [
     psycopg2
-  ] ++ lib.optional withMysql [
+  ] ++ lib.optionals withMysql [
     mysql-connector
   ];
 
diff --git a/pkgs/development/python-modules/phonemizer/default.nix b/pkgs/development/python-modules/phonemizer/default.nix
index 550a4fefd25a..38e5f8533eb3 100644
--- a/pkgs/development/python-modules/phonemizer/default.nix
+++ b/pkgs/development/python-modules/phonemizer/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , substituteAll
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , joblib
 , segments
@@ -13,17 +13,18 @@
 , pytest-cov
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "phonemizer";
   version = "3.2.1";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Bo+F+FqKmtxjijeHrqyvcaU+R1eLEtdzwJdDNQDNiSs=";
+    hash = "sha256-Bo+F+FqKmtxjijeHrqyvcaU+R1eLEtdzwJdDNQDNiSs=";
   };
 
   postPatch = ''
-    sed -i -e '/\'pytest-runner\'/d setup.py
+    sed -i '/pytest-runner/d setup.py
   '';
 
   patches = [
diff --git a/pkgs/development/python-modules/pillow-simd/default.nix b/pkgs/development/python-modules/pillow-simd/default.nix
index e856c2f57852..b39a86a7fbfc 100644
--- a/pkgs/development/python-modules/pillow-simd/default.nix
+++ b/pkgs/development/python-modules/pillow-simd/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPythonPackage, fetchFromGitHub, isPyPy, isPy3k
-, olefile, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2
+, olefile, freetype, libjpeg, zlib, libtiff, libwebp, libxcrypt, tcl, lcms2
 , libxcb, tk, libX11, openjpeg, libimagequant, pyroma, numpy, defusedxml
 , pytestCheckHook
 }@args:
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 017069a7dd2d..6e50be53f99d 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 , fetchPypi
 , isPyPy
-, defusedxml, olefile, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
+, defusedxml, olefile, freetype, libjpeg, zlib, libtiff, libwebp, libxcrypt, tcl, lcms2, tk, libX11
 , libxcb, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook
 # for passthru.tests
 , imageio, matplotlib, pilkit, pydicom, reportlab
diff --git a/pkgs/development/python-modules/pillow/generic.nix b/pkgs/development/python-modules/pillow/generic.nix
index ec4f05263820..54f730751076 100644
--- a/pkgs/development/python-modules/pillow/generic.nix
+++ b/pkgs/development/python-modules/pillow/generic.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
 
   checkInputs = [ pytestCheckHook pyroma numpy ];
 
-  buildInputs = [ freetype libjpeg openjpeg libimagequant zlib libtiff libwebp tcl lcms2 ]
+  buildInputs = [ freetype libjpeg openjpeg libimagequant zlib libtiff libwebp libxcrypt tcl lcms2 ]
     ++ lib.optionals (lib.versionAtLeast version "7.1.0") [ libxcb ]
     ++ lib.optionals (isPyPy) [ tk libX11 ];
 
diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index 737985ece249..b009ec945724 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -15,15 +15,16 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    sha256 = "sha256-WUgBrO9h1E7N2SVFD47UPv39DMx1yQviV5tcNPmR+/g=";
+    hash = "sha256-d/VhnG+6qabgLMb8ki46R9+lpCwZNlS8QpM8u3VYmWs=";
   };
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
@@ -41,13 +42,20 @@ buildPythonPackage rec {
     virtualenv
   ];
 
-  # requires git history to work correctly
-  disabledTests = [ "default_with_excluded_data" "default_src_with_excluded_data" ];
+  # Requires git history to work correctly
+  disabledTests = [
+    "default_with_excluded_data"
+    "default_src_with_excluded_data"
+  ];
 
-  pythonImportsCheck = [ "poetry.core" ];
+  pythonImportsCheck = [
+    "poetry.core"
+  ];
 
-  # allow for package to use pep420's native namespaces
-  pythonNamespaces = [ "poetry" ];
+  # Allow for package to use pep420's native namespaces
+  pythonNamespaces = [
+    "poetry"
+  ];
 
   meta = with lib; {
     description = "Core utilities for Poetry";
diff --git a/pkgs/development/python-modules/poetry2conda/default.nix b/pkgs/development/python-modules/poetry2conda/default.nix
deleted file mode 100644
index 7f5268a23dc4..000000000000
--- a/pkgs/development/python-modules/poetry2conda/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ lib
-, buildPythonApplication
-, fetchFromGitHub
-, pytest-mock
-, pytestCheckHook
-, toml
-, poetry
-, poetry-semver
-, pyyaml
-}:
-
-buildPythonApplication rec {
-  pname = "poetry2conda";
-  version = "0.3.0";
-
-  format = "pyproject";
-
-  src = fetchFromGitHub {
-    owner = "dojeda";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-UqNoEGgStvqtxhYwExk7wO4SvATaM2kGaFbB5ViJa7U=";
-  };
-
-  nativeBuildInputs = [ poetry ];
-
-  propagatedBuildInputs = [
-    poetry-semver
-    toml
-  ];
-
-  checkInputs = [
-    pytest-mock
-    pytestCheckHook
-    pyyaml
-  ];
-
-  meta = with lib; {
-    description = "A script to convert a Python project declared on a pyproject.toml to a conda environment";
-    homepage = "https://github.com/dojeda/poetry2conda";
-    license = licenses.mit;
-    maintainers = with maintainers; [ cpcloud ];
-  };
-}
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index 565cd6d67ec9..413b79c562b1 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -35,11 +35,11 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     cached-property
     pycparser
-  ] ++ lib.optional (!isPyPy) [
+  ] ++ lib.optionals (!isPyPy) [
     cffi
   ];
 
-  propagatedNativeBuildInputs = lib.optional (!isPyPy) [
+  propagatedNativeBuildInputs = lib.optionals (!isPyPy) [
     cffi
   ];
 
diff --git a/pkgs/development/python-modules/pyls-mypy/default.nix b/pkgs/development/python-modules/pyls-mypy/default.nix
index acce4469eed4..ad387106e885 100644
--- a/pkgs/development/python-modules/pyls-mypy/default.nix
+++ b/pkgs/development/python-modules/pyls-mypy/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     mypy python-language-server configparser
-  ] ++ lib.optional (isPy27) [
+  ] ++ lib.optionals (isPy27) [
     future
   ];
 
diff --git a/pkgs/development/python-modules/pypass/default.nix b/pkgs/development/python-modules/pypass/default.nix
index 85d6c9d49bb0..f70e40029992 100644
--- a/pkgs/development/python-modules/pypass/default.nix
+++ b/pkgs/development/python-modules/pypass/default.nix
@@ -18,10 +18,8 @@
 , xclip
 }:
 
-# NOTE: pypass can also be used as an application, but probably the most
-# important usecase is as a library. So, let's use buildPythonPackage and
-# support any Python version instead of defining it as an application with
-# buildPythonApplication.
+# Use the `pypass` top-level attribute, if you're interested in the
+# application
 buildPythonPackage rec {
   pname = "pypass";
   version = "0.2.1";
diff --git a/pkgs/development/python-modules/pytest-xdist/setup-hook.sh b/pkgs/development/python-modules/pytest-xdist/setup-hook.sh
index 5523a7f360f5..61d0f64d1a4d 100644
--- a/pkgs/development/python-modules/pytest-xdist/setup-hook.sh
+++ b/pkgs/development/python-modules/pytest-xdist/setup-hook.sh
@@ -3,6 +3,14 @@ pytestXdistHook() {
         "--numprocesses=$NIX_BUILD_CORES"
         "--forked"
     )
+
+    # Using --forked on darwin leads to crashes when fork safety is
+    # enabled. This often happens when urllib tries to request proxy
+    # settings on MacOS through `urllib.request.getproxies()`
+    # - https://github.com/python/cpython/issues/77906
+    if [[ "$OSTYPE" == "darwin"* ]]; then
+        export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+    fi
 }
 
 # the flags should be added before pytestCheckHook runs so
diff --git a/pkgs/development/python-modules/python-csxcad/default.nix b/pkgs/development/python-modules/python-csxcad/default.nix
index e6f22d37b55d..66c1939c7edc 100644
--- a/pkgs/development/python-modules/python-csxcad/default.nix
+++ b/pkgs/development/python-modules/python-csxcad/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     matplotlib
   ];
 
-  setupPyBuildFlags = "-I${openems}/include -L${openems}/lib -R${openems}/lib";
+  setupPyBuildFlags = [ "-I${openems}/include" "-L${openems}/lib" "-R${openems}/lib" ];
 
   meta = with lib; {
     description = "Python interface to CSXCAD";
diff --git a/pkgs/development/python-modules/python-glanceclient/default.nix b/pkgs/development/python-modules/python-glanceclient/default.nix
index 4f63cca8a8b1..390aad8b55cd 100644
--- a/pkgs/development/python-modules/python-glanceclient/default.nix
+++ b/pkgs/development/python-modules/python-glanceclient/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , coreutils
 , pbr
@@ -18,7 +18,7 @@
 , requests-mock
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "python-glanceclient";
   version = "4.1.0";
   format = "setuptools";
diff --git a/pkgs/development/python-modules/python-heatclient/default.nix b/pkgs/development/python-modules/python-heatclient/default.nix
index c51c222dd6fa..df1fc0dc4597 100644
--- a/pkgs/development/python-modules/python-heatclient/default.nix
+++ b/pkgs/development/python-modules/python-heatclient/default.nix
@@ -1,6 +1,6 @@
 { lib
 , babel
-, buildPythonApplication
+, buildPythonPackage
 , cliff
 , fetchPypi
 , iso8601
@@ -20,7 +20,7 @@
 , testscenarios
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "python-heatclient";
   version = "3.1.0";
   format = "setuptools";
diff --git a/pkgs/development/python-modules/python-ironicclient/default.nix b/pkgs/development/python-modules/python-ironicclient/default.nix
index 5f0f1d8dea53..bf41e95739e9 100644
--- a/pkgs/development/python-modules/python-ironicclient/default.nix
+++ b/pkgs/development/python-modules/python-ironicclient/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , pbr
 , appdirs
@@ -18,7 +18,7 @@
 , oslotest
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "python-ironicclient";
   version = "5.0.1";
 
diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index 9a9e01ff4be7..301ce42f0c77 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , installShellFiles
 , pbr
@@ -21,7 +21,7 @@
 , pythonOlder
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "python-manilaclient";
   version = "4.1.0";
   format = "setuptools";
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
index d1497c43bcb7..32d5d542c30a 100644
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     pyyaml
     tqdm
     zeroconf
-  ] ++ lib.optional (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ];
 
diff --git a/pkgs/development/python-modules/python-openems/default.nix b/pkgs/development/python-modules/python-openems/default.nix
index dd669cf54754..348f10b3aeed 100644
--- a/pkgs/development/python-modules/python-openems/default.nix
+++ b/pkgs/development/python-modules/python-openems/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     h5py
   ];
 
-  setupPyBuildFlags = "-I${openems}/include -L${openems}/lib -R${openems}/lib";
+  setupPyBuildFlags = [ "-I${openems}/include" "-L${openems}/lib" "-R${openems}/lib" ];
   pythonImportsCheck = [ "openEMS" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/python-swiftclient/default.nix b/pkgs/development/python-modules/python-swiftclient/default.nix
index 3329753d6334..f5a15a34f0ca 100644
--- a/pkgs/development/python-modules/python-swiftclient/default.nix
+++ b/pkgs/development/python-modules/python-swiftclient/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , installShellFiles
 , mock
@@ -10,7 +10,7 @@
 , stestr
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "python-swiftclient";
   version = "4.1.0";
   format = "setuptools";
diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
index 677322fc50d1..47d716d1c868 100644
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -43,7 +43,7 @@ buildPythonPackage rec {
       --replace "tornado==6.1" "tornado"
   '';
 
-  setupPyGlobalFlags = "--with-upstream-urllib3";
+  setupPyGlobalFlags = [ "--with-upstream-urllib3" ];
 
   # tests not included with release
   doCheck = false;
diff --git a/pkgs/development/python-modules/qutip/default.nix b/pkgs/development/python-modules/qutip/default.nix
index e99deef489f3..519cb9957bcc 100644
--- a/pkgs/development/python-modules/qutip/default.nix
+++ b/pkgs/development/python-modules/qutip/default.nix
@@ -46,7 +46,7 @@ buildPythonPackage rec {
   ] ++ passthru.optional-dependencies.graphics;
 
   # Disabling OpenMP support on Darwin.
-  setupPyGlobalFlags = lib.optional (!stdenv.isDarwin) [
+  setupPyGlobalFlags = lib.optionals (!stdenv.isDarwin) [
     "--with-openmp"
   ];
 
diff --git a/pkgs/development/python-modules/rdflib/default.nix b/pkgs/development/python-modules/rdflib/default.nix
index 1aa995d85d77..27356390cfda 100644
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@@ -68,7 +68,7 @@ buildPythonPackage rec {
     # Requires network access
     "test_service"
     "testGuessFormatForParse"
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     # Require loopback network access
     "TestGraphHTTP"
   ];
diff --git a/pkgs/development/python-modules/remarshal/default.nix b/pkgs/development/python-modules/remarshal/default.nix
index 99c868eb0b80..2b7a20a2dd00 100644
--- a/pkgs/development/python-modules/remarshal/default.nix
+++ b/pkgs/development/python-modules/remarshal/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchFromGitHub
 
 # build deps
@@ -16,7 +16,7 @@
 , pytestCheckHook
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "remarshal";
   version = "0.14.0";
   format = "pyproject";
diff --git a/pkgs/development/python-modules/rfc-bibtex/default.nix b/pkgs/development/python-modules/rfc-bibtex/default.nix
deleted file mode 100644
index b9b7cdb76c4f..000000000000
--- a/pkgs/development/python-modules/rfc-bibtex/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, buildPythonApplication, fetchPypi, isPy3k }:
-
-buildPythonApplication rec {
-  pname = "rfc-bibtex";
-  version = "0.3.2";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "60419a2043ef37ac2438f3eae7a3207d0a4cb2dd56ab21697f874a35ee52927f";
-  };
-
-  disabled = !isPy3k;
-
-  meta = with lib; {
-    homepage = "https://github.com/iluxonchik/rfc-bibtex/";
-    description = "Generate Bibtex entries for IETF RFCs and Internet-Drafts";
-    license = licenses.mit;
-    maintainers = with maintainers; [ teto ];
-  };
-}
diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index 36e7ca24fbdb..c2cd935c651f 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -35,9 +35,9 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     CommonMark
     pygments
-  ] ++ lib.optional (pythonOlder "3.7") [
+  ] ++ lib.optionals (pythonOlder "3.7") [
     dataclasses
-  ] ++ lib.optional (pythonOlder "3.9") [
+  ] ++ lib.optionals (pythonOlder "3.9") [
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index aa578d21d257..e791454b9018 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -54,6 +54,7 @@ buildPythonPackage rec {
   checkPhase = ''
     runHook preCheck
     pushd "$out"
+    export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
     ${python.interpreter} -c "import scipy; scipy.test('fast', verbose=10, parallel=$NIX_BUILD_CORES)"
     popd
     runHook postCheck
diff --git a/pkgs/development/python-modules/screeninfo/default.nix b/pkgs/development/python-modules/screeninfo/default.nix
index f67d68b0dddd..574d3159494a 100644
--- a/pkgs/development/python-modules/screeninfo/default.nix
+++ b/pkgs/development/python-modules/screeninfo/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, buildPythonApplication
+, buildPythonPackage
 , dataclasses
 , fetchFromGitHub
 , libX11
@@ -11,7 +11,7 @@
 , pythonOlder
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "screeninfo";
   version = "0.8.1";
   format = "pyproject";
diff --git a/pkgs/development/python-modules/simple-di/default.nix b/pkgs/development/python-modules/simple-di/default.nix
index c79b58f8a629..150eb52f8d4e 100644
--- a/pkgs/development/python-modules/simple-di/default.nix
+++ b/pkgs/development/python-modules/simple-di/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     setuptools
     typing-extensions
-  ] ++ lib.optional (pythonOlder "3.7") [
+  ] ++ lib.optionals (pythonOlder "3.7") [
     dataclasses
   ];
 
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index cc1c01adf288..f197b1080fb3 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -63,7 +63,7 @@ buildPythonPackage rec {
     tqdm
     typer
     wasabi
-  ] ++ lib.optional (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.8") [
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 0983fb7e7a73..5a27f04bd0ee 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -107,7 +107,7 @@ buildPythonPackage rec {
     # requires imagemagick (increases build closure size), doesn't
     # test anything substantial
     "test_ext_imgconverter"
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     # Due to lack of network sandboxing can't guarantee port 7777 isn't bound
     "test_inspect_main_url"
     "test_auth_header_uses_first_match"
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index d1e8f789fc38..78a428a2a724 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     typing-extensions
   ] ++ lib.optionals (pythonOlder "3.7") [
     contextlib2
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices
   ];
 
diff --git a/pkgs/development/python-modules/sybil/default.nix b/pkgs/development/python-modules/sybil/default.nix
index 41baf697fff3..2667f0af5464 100644
--- a/pkgs/development/python-modules/sybil/default.nix
+++ b/pkgs/development/python-modules/sybil/default.nix
@@ -1,11 +1,11 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "sybil";
   version = "3.0.1";
   format = "setuptools";
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index 7f50fc8f3023..654c8a9e2ab0 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
 , fetchPypi
 , pbr
 , cliff
@@ -26,7 +26,7 @@
 , python
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "tempest";
   version = "32.0.0";
 
diff --git a/pkgs/development/python-modules/tensorflow/bin.nix b/pkgs/development/python-modules/tensorflow/bin.nix
index b266f837f849..ca3c818d34af 100644
--- a/pkgs/development/python-modules/tensorflow/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/bin.nix
@@ -82,7 +82,7 @@ in buildPythonPackage {
     ++ lib.optionals (pythonOlder "3.4") [ backports_weakref ];
 
   # remove patchelfUnstable once patchelf 0.14 with https://github.com/NixOS/patchelf/pull/256 becomes the default
-  nativeBuildInputs = [ wheel ] ++ lib.optional cudaSupport [ addOpenGLRunpath patchelfUnstable ];
+  nativeBuildInputs = [ wheel ] ++ lib.optionals cudaSupport [ addOpenGLRunpath patchelfUnstable ];
 
   preConfigure = ''
     unset SOURCE_DATE_EPOCH
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 31fff4832052..c8308b2f80ac 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -483,7 +483,7 @@ in buildPythonPackage {
   ];
 
   # remove patchelfUnstable once patchelf 0.14 with https://github.com/NixOS/patchelf/pull/256 becomes the default
-  nativeBuildInputs = lib.optional cudaSupport [ addOpenGLRunpath patchelfUnstable ];
+  nativeBuildInputs = lib.optionals cudaSupport [ addOpenGLRunpath patchelfUnstable ];
 
   postFixup = lib.optionalString cudaSupport ''
     find $out -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
diff --git a/pkgs/development/python-modules/thinc/default.nix b/pkgs/development/python-modules/thinc/default.nix
index 51ee2803f3cf..6da1ae894450 100644
--- a/pkgs/development/python-modules/thinc/default.nix
+++ b/pkgs/development/python-modules/thinc/default.nix
@@ -66,9 +66,9 @@ buildPythonPackage rec {
     tqdm
     pydantic
     wasabi
-  ] ++ lib.optional (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.8") [
     typing-extensions
-  ] ++ lib.optional (pythonOlder "3.7") [
+  ] ++ lib.optionals (pythonOlder "3.7") [
     contextvars
     dataclasses
   ];
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index fa6c4726222c..fae5ef8cf103 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -97,6 +97,9 @@ buildPythonPackage rec {
     echo 'MulticastTests.test_multicast.skip = "Reactor was unclean"'>> src/twisted/test/test_udp.py
     echo 'MulticastTests.test_multiListen.skip = "No such device"'>> src/twisted/test/test_udp.py
 
+    # fails since migrating to libxcrypt
+    echo 'HelperTests.test_refuteCryptedPassword.skip = "OSError: Invalid argument"' >> src/twisted/conch/test/test_checkers.py
+
     # not packaged
     substituteInPlace src/twisted/test/test_failure.py \
       --replace "from cython_test_exception_raiser import raiser  # type: ignore[import]" "raiser = None"
diff --git a/pkgs/development/python-modules/tzdata/default.nix b/pkgs/development/python-modules/tzdata/default.nix
index c701d3683cdb..d1fed0b21fa9 100644
--- a/pkgs/development/python-modules/tzdata/default.nix
+++ b/pkgs/development/python-modules/tzdata/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
     pytest-subtests
-  ] ++ lib.optional (pythonOlder "3.7") [
+  ] ++ lib.optionals (pythonOlder "3.7") [
     importlib-resources
   ];
 
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index b1ad380f04b9..090b7a247651 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -157,7 +157,7 @@ buildPythonPackage rec {
 
   # Disable test that fails on darwin due to issue with python3Packages.psutil:
   # https://github.com/giampaolo/psutil/issues/1219
-  disabledTests = lib.optional stdenv.isDarwin [
+  disabledTests = lib.optionals stdenv.isDarwin [
     "test_tpu_system_stats"
   ];
 
diff --git a/pkgs/development/python-modules/web3/default.nix b/pkgs/development/python-modules/web3/default.nix
index b07bc9cee9d7..8515ccda3625 100644
--- a/pkgs/development/python-modules/web3/default.nix
+++ b/pkgs/development/python-modules/web3/default.nix
@@ -56,7 +56,7 @@ buildPythonPackage rec {
     protobuf
     requests
     websockets
-  ] ++ lib.optional (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.8") [
     typing-extensions
   ] ++ eth-hash.optional-dependencies.pycryptodome;
 
diff --git a/pkgs/development/python-modules/yamllint/default.nix b/pkgs/development/python-modules/yamllint/default.nix
index 58d47d1fff9c..ca092cef8c72 100644
--- a/pkgs/development/python-modules/yamllint/default.nix
+++ b/pkgs/development/python-modules/yamllint/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   disabledTests = [
     # test failure reported upstream: https://github.com/adrienverge/yamllint/issues/373
     "test_find_files_recursively"
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     # locale tests are broken on BSDs; see https://github.com/adrienverge/yamllint/issues/307
     "test_locale_accents"
     "test_locale_case"
diff --git a/pkgs/development/python-modules/yolk/default.nix b/pkgs/development/python-modules/yolk/default.nix
deleted file mode 100644
index d241e3f8edc0..000000000000
--- a/pkgs/development/python-modules/yolk/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ lib, fetchurl, buildPythonApplication, pythonPackages }:
-
-with lib;
-
-buildPythonApplication rec {
-  pname = "yolk";
-  version = "0.4.3";
-
-  src = fetchurl {
-    url = "mirror://pypi/y/yolk/yolk-${version}.tar.gz";
-    sha256 = "1f6xwx210jnl5nq0m3agh2p1cxmaizawaf3fwq43q4yw050fn1qw";
-  };
-
-  buildInputs = with pythonPackages; [ nose ];
-
-  meta = {
-    description = "Command-line tool for querying PyPI and Python packages installed on your system";
-    homepage = "https://github.com/cakebread/yolk";
-    maintainers = with maintainers; [];
-    license = licenses.bsd3;
-  };
-}
-
diff --git a/pkgs/development/ruby-modules/bundler-app/default.nix b/pkgs/development/ruby-modules/bundler-app/default.nix
index 826ce9e59379..5bb9e47cf5a6 100644
--- a/pkgs/development/ruby-modules/bundler-app/default.nix
+++ b/pkgs/development/ruby-modules/bundler-app/default.nix
@@ -35,7 +35,9 @@
 }@args:
 
 let
-  basicEnv = (callPackage ../bundled-common {}) args;
+  basicEnv = (callPackage ../bundled-common {
+    inherit ruby;
+  }) args;
 
   cmdArgs = removeAttrs args [ "pname" "postBuild" "gemConfig" "passthru" "gemset" "gemdir" ] // {
     inherit preferLocalBuild allowSubstitutes; # pass the defaults
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 4961173658ed..13848a602dcf 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.3.22";
-  source.sha256 = "sha256-vOfZB6poOsiYPULaGhUXD9aSxlBGeK2ghF70ouz0IJ4=";
+  version = "2.3.23";
+  source.sha256 = "sha256-xYrUhtzNfN3X9r8GqGj9d1aeZkcPozFrk/2c9oVkKx8=";
   dontPatchShebangs = true;
 
   passthru.updateScript = writeScript "gem-update-script" ''
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index 63594300e835..905e78fd7655 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -97,10 +97,10 @@ stdenv.mkDerivation rec {
     zlib
     openssl
     libuv
-  ] ++ lib.optional useX11 [ gtkdialog vte gtk2 ]
-    ++ lib.optional rubyBindings [ ruby ]
-    ++ lib.optional pythonBindings [ python3 ]
-    ++ lib.optional luaBindings [ lua ];
+  ] ++ lib.optionals useX11 [ gtkdialog vte gtk2 ]
+    ++ lib.optionals rubyBindings [ ruby ]
+    ++ lib.optionals pythonBindings [ python3 ]
+    ++ lib.optionals luaBindings [ lua ];
 
   propagatedBuildInputs = [
     # radare2 exposes r_lib which depends on these libraries
diff --git a/pkgs/development/tools/analysis/rr/zen_workaround.nix b/pkgs/development/tools/analysis/rr/zen_workaround.nix
index 193e70d0d95d..3ec69aabf8d2 100644
--- a/pkgs/development/tools/analysis/rr/zen_workaround.nix
+++ b/pkgs/development/tools/analysis/rr/zen_workaround.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   postConfigure = ''
     makeFlags="$makeFlags M=$(pwd)"
   '';
-  buildFlags = "modules";
+  buildFlags = [ "modules" ];
 
   installPhase = let
     modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel"; #TODO: longer path?
diff --git a/pkgs/development/tools/analysis/sparse/default.nix b/pkgs/development/tools/analysis/sparse/default.nix
index ecc57a58b4b2..7842954cde6a 100644
--- a/pkgs/development/tools/analysis/sparse/default.nix
+++ b/pkgs/development/tools/analysis/sparse/default.nix
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ gtk3 libxml2 llvm perl sqlite ];
   doCheck = true;
-  buildFlags = "GCC_BASE:=${GCC_BASE}";
+  buildFlags = [ "GCC_BASE:=${GCC_BASE}" ];
 
   passthru.tests = {
     simple-execution = callPackage ./tests.nix { };
diff --git a/pkgs/development/python-modules/codespell/default.nix b/pkgs/development/tools/codespell/default.nix
index e8be4644910c..07b1b4c96c3e 100644
--- a/pkgs/development/python-modules/codespell/default.nix
+++ b/pkgs/development/tools/codespell/default.nix
@@ -1,8 +1,13 @@
-{ lib, buildPythonApplication, fetchFromGitHub, pytestCheckHook, pytest-dependency, aspell-python, aspellDicts, chardet }:
+{ lib
+, fetchFromGitHub
+, aspellDicts
+, python3
+}:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "codespell";
   version = "2.2.1";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "codespell-project";
@@ -17,7 +22,12 @@ buildPythonApplication rec {
       --replace "--cov-report=" ""
   '';
 
-  checkInputs = [ aspell-python chardet pytestCheckHook pytest-dependency ];
+  checkInputs = with python3.pkgs; [
+    aspell-python
+    chardet
+    pytestCheckHook
+    pytest-dependency
+  ];
 
   preCheck = ''
     export ASPELL_CONF="dict-dir ${aspellDicts.en}/lib/aspell"
diff --git a/pkgs/development/tools/database/prisma-engines/default.nix b/pkgs/development/tools/database/prisma-engines/default.nix
index fd25a497dc00..984b94cdc107 100644
--- a/pkgs/development/tools/database/prisma-engines/default.nix
+++ b/pkgs/development/tools/database/prisma-engines/default.nix
@@ -45,7 +45,13 @@ rustPlatform.buildRustPackage rec {
     export SQLITE_MAX_EXPR_DEPTH=10000
   '';
 
-  cargoBuildFlags = "-p query-engine -p query-engine-node-api -p migration-engine-cli -p introspection-core -p prisma-fmt";
+  cargoBuildFlags = [
+    "-p" "query-engine"
+    "-p" "query-engine-node-api"
+    "-p" "migration-engine-cli"
+    "-p" "introspection-core"
+    "-p" "prisma-fmt"
+  ];
 
   postInstall = ''
     mv $out/lib/libquery_engine${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libquery_engine.node
diff --git a/pkgs/development/tools/godot/default.nix b/pkgs/development/tools/godot/default.nix
index f04d4e9ab7c3..97c9786e8fd2 100644
--- a/pkgs/development/tools/godot/default.nix
+++ b/pkgs/development/tools/godot/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  sconsFlags = "target=release_debug platform=x11";
+  sconsFlags = [ "target=release_debug" "platform=x11" ];
   preConfigure = ''
     sconsFlags+=" ${
       lib.concatStringsSep " "
diff --git a/pkgs/development/tools/godot/export-templates.nix b/pkgs/development/tools/godot/export-templates.nix
index 9d306365f190..74a78573a983 100644
--- a/pkgs/development/tools/godot/export-templates.nix
+++ b/pkgs/development/tools/godot/export-templates.nix
@@ -3,7 +3,7 @@
 # https://docs.godotengine.org/en/stable/development/compiling/compiling_for_x11.html#building-export-templates
 godot.overrideAttrs (oldAttrs: rec {
   pname = "godot-export-templates";
-  sconsFlags = "target=release platform=x11 tools=no";
+  sconsFlags = [ "target=release" "platform=x11" "tools=no" ];
   installPhase = ''
     # The godot export command expects the export templates at
     # .../share/godot/templates/3.2.3.stable with 3.2.3 being the godot version.
diff --git a/pkgs/development/tools/godot/headless.nix b/pkgs/development/tools/godot/headless.nix
index a8d640eba1aa..3e43a4f27f0c 100644
--- a/pkgs/development/tools/godot/headless.nix
+++ b/pkgs/development/tools/godot/headless.nix
@@ -1,7 +1,7 @@
 { godot, lib }:
 godot.overrideAttrs (oldAttrs: rec {
   pname = "godot-headless";
-  sconsFlags = "target=release_debug platform=server tools=yes";
+  sconsFlags = [ "target=release_debug" "platform=server" "tools=yes" ];
   installPhase = ''
     mkdir -p "$out/bin"
     cp bin/godot_server.* $out/bin/godot-headless
diff --git a/pkgs/development/tools/godot/server.nix b/pkgs/development/tools/godot/server.nix
index 4254dc746b66..06adf1bbfeb7 100644
--- a/pkgs/development/tools/godot/server.nix
+++ b/pkgs/development/tools/godot/server.nix
@@ -1,7 +1,7 @@
 { godot, lib }:
 godot.overrideAttrs (oldAttrs: rec {
   pname = "godot-server";
-  sconsFlags = "target=release platform=server tools=no";
+  sconsFlags = [ "target=release" "platform=server" "tools=no" ];
   installPhase = ''
     mkdir -p "$out/bin"
     cp bin/godot_server.* $out/bin/godot-server
diff --git a/pkgs/development/tools/libsigrokdecode/default.nix b/pkgs/development/tools/libsigrokdecode/default.nix
index 06b5f5c35bba..672dddfc5ca2 100644
--- a/pkgs/development/tools/libsigrokdecode/default.nix
+++ b/pkgs/development/tools/libsigrokdecode/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, python3, check }:
+{ lib, stdenv, fetchurl, pkg-config, glib, python3, check, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "libsigrokdecode";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib python3 ];
+  buildInputs = [ glib python3 libxcrypt ];
   checkInputs = [ check ];
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/bashdb/default.nix b/pkgs/development/tools/misc/bashdb/default.nix
index 918dd90aa83f..c7d261e6f5ac 100644
--- a/pkgs/development/tools/misc/bashdb/default.nix
+++ b/pkgs/development/tools/misc/bashdb/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
       sha256 = "19zfzcnxavndyn6kfxp775kjcd0gigsm4y3bnh6fz5ilhnnbbbgr";
     })
   ];
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 01b0f39567eb..da61e1f8a41d 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -1,23 +1,30 @@
-{lib, stdenv, fetchFromGitHub, buildPackages
+{ lib
+, stdenv
+, fetchFromGitHub
 , fetchpatch
-, curl, makeWrapper, which, unzip
+, curl
+, makeWrapper
+, which
+, unzip
 , lua
-# for 'luarocks pack'
+, file
+, nix-prefetch-git
+  # for 'luarocks pack'
 , zip
 , nix-update-script
-# some packages need to be compiled with cmake
+  # some packages need to be compiled with cmake
 , cmake
 , installShellFiles
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
   pname = "luarocks";
   version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "luarocks";
     repo = "luarocks";
-    rev = "v${version}";
+    rev = "v${self.version}";
     sha256 = "sha256-G6HDap3pspeQtGDBq+ukN7kftDaT/CozMVdYM60F6HI=";
   };
 
@@ -67,12 +74,16 @@ stdenv.mkDerivation rec {
               --suffix LUA_PATH ";" "$(echo "$out"/share/lua/*/)?.lua" \
               --suffix LUA_PATH ";" "$(echo "$out"/share/lua/*/)?/init.lua" \
               --suffix LUA_CPATH ";" "$(echo "$out"/lib/lua/*/)?.so" \
-              --suffix LUA_CPATH ";" "$(echo "$out"/share/lua/*/)?/init.lua"
+              --suffix LUA_CPATH ";" "$(echo "$out"/share/lua/*/)?/init.lua" \
+              --suffix PATH : ${lib.makeBinPath ([ unzip ] ++
+                lib.optionals (self.pname == "luarocks-nix") [ file nix-prefetch-git ])}
         }
     done
   '' + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd luarocks --bash <($out/bin/luarocks completion bash)
-    installShellCompletion --cmd luarocks --zsh <($out/bin/luarocks completion zsh)
+    installShellCompletion --cmd luarocks \
+      --bash <($out/bin/luarocks completion bash) \
+      --fish <($out/bin/luarocks completion fish) \
+      --zsh <($out/bin/luarocks completion zsh)
   '';
 
   propagatedBuildInputs = [ zip unzip cmake ];
@@ -94,15 +105,15 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = nix-update-script {
-      attrPath = pname;
+      attrPath = self.pname;
     };
   };
 
   meta = with lib; {
     description = "A package manager for Lua";
-    license = licenses.mit ;
-    maintainers = with maintainers; [raskin teto];
+    license = licenses.mit;
+    maintainers = with maintainers; [ raskin teto ];
     platforms = platforms.linux ++ platforms.darwin;
     downloadPage = "http://luarocks.org/releases/";
   };
-}
+})
diff --git a/pkgs/development/tools/misc/pahole/default.nix b/pkgs/development/tools/misc/pahole/default.nix
index 1e923c380d6d..7a60da1e53a3 100644
--- a/pkgs/development/tools/misc/pahole/default.nix
+++ b/pkgs/development/tools/misc/pahole/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ elfutils zlib libbpf ]
-    ++ lib.optional stdenv.hostPlatform.isMusl [
+    ++ lib.optionals stdenv.hostPlatform.isMusl [
     argp-standalone
     musl-obstack
   ];
diff --git a/pkgs/development/tools/misc/pkg-config/default.nix b/pkgs/development/tools/misc/pkg-config/default.nix
index 70370e421261..f2721ab952c6 100644
--- a/pkgs/development/tools/misc/pkg-config/default.nix
+++ b/pkgs/development/tools/misc/pkg-config/default.nix
@@ -28,9 +28,9 @@ stdenv.mkDerivation rec {
   buildInputs = optional (stdenv.isCygwin || stdenv.isDarwin || stdenv.isSunOS) libiconv;
 
   configureFlags = [ "--with-internal-glib" ]
-    ++ optional (stdenv.isSunOS) [ "--with-libiconv=gnu" "--with-system-library-path" "--with-system-include-path" "CFLAGS=-DENABLE_NLS" ]
+    ++ optionals (stdenv.isSunOS) [ "--with-libiconv=gnu" "--with-system-library-path" "--with-system-include-path" "CFLAGS=-DENABLE_NLS" ]
        # Can't run these tests while cross-compiling
-    ++ optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform)
        [ "glib_cv_stack_grows=no"
          "glib_cv_uscore=no"
          "ac_cv_func_posix_getpwuid_r=yes"
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index df3b12ea5b68..036e992e9731 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
     && !stdenv.isDarwin
     && !stdenv.isSunOS; # flaky
 
-  checkFlagsArray = [
+  checkFlags = lib.optionals (!stdenv.hostPlatform.isMusl) [
     # Test is known to fail on various locales on texinfo-6.8:
     #   https://lists.gnu.org/r/bug-texinfo/2021-07/msg00012.html
     "XFAIL_TESTS=test_scripts/layout_formatting_fr_icons.sh"
diff --git a/pkgs/development/python-modules/mutmut/default.nix b/pkgs/development/tools/mutmut/default.nix
index 626c768f2a81..4b40930c646d 100644
--- a/pkgs/development/python-modules/mutmut/default.nix
+++ b/pkgs/development/tools/mutmut/default.nix
@@ -1,16 +1,9 @@
 { lib
 , fetchFromGitHub
-, buildPythonApplication
-, click
-, glob2
-, parso
-, pony
-, junit-xml
-, pythonOlder
-, testers
+, python3
 }:
 
-let self = buildPythonApplication rec {
+let self = with python3.pkgs; buildPythonApplication rec {
   pname = "mutmut";
   version = "2.2.0";
 
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index 30962eeba311..65f8c7eda3ca 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ ocaml findlib ];
   strictDeps = true;
 
-  buildFlags = "release";
+  buildFlags = [ "release" ];
 
   dontAddPrefix = true;
   dontAddStaticConfigureFlags = true;
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index 2917a4905bda..01145e0237cb 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  buildFlags = "release";
+  buildFlags = [ "release" ];
 
   dontAddPrefix = true;
   dontAddStaticConfigureFlags = true;
diff --git a/pkgs/development/tools/parsing/ragel/default.nix b/pkgs/development/tools/parsing/ragel/default.nix
index 81d7d9f0b35e..0e8777e9f3f9 100644
--- a/pkgs/development/tools/parsing/ragel/default.nix
+++ b/pkgs/development/tools/parsing/ragel/default.nix
@@ -13,7 +13,7 @@ let
         inherit sha256;
       };
 
-      buildInputs = lib.optional build-manual [ fig2dev ghostscript tex ];
+      buildInputs = lib.optionals build-manual [ fig2dev ghostscript tex ];
 
       preConfigure = lib.optionalString build-manual ''
         sed -i "s/build_manual=no/build_manual=yes/g" DIST
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index 50d3889e3733..e169aced4a15 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -385,7 +385,7 @@ lib.composeManyExtensions [
           (
             old: {
               nativeBuildInputs = (old.nativeBuildInputs or [ ])
-                ++ lib.optional (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
+                ++ lib.optionals (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
                 ++ lib.optional (!self.isPyPy) pyBuildPackages.cffi
                 ++ lib.optional (lib.versionAtLeast old.version "3.5" && !isWheel)
                 (with pkgs.rustPlatform; [ cargoSetupHook rust.cargo rust.rustc ]);
@@ -1061,9 +1061,9 @@ lib.composeManyExtensions [
 
           buildInputs = old.buildInputs or [ ] ++ [
             pkgs.which
-          ] ++ lib.optional enableGhostscript [
+          ] ++ lib.optionals enableGhostscript [
             pkgs.ghostscript
-          ] ++ lib.optional stdenv.isDarwin [
+          ] ++ lib.optionals stdenv.isDarwin [
             Cocoa
           ];
 
@@ -1080,7 +1080,7 @@ lib.composeManyExtensions [
 
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
             pkg-config
-          ] ++ lib.optional (lib.versionAtLeast super.matplotlib.version "3.5.0") [
+          ] ++ lib.optionals (lib.versionAtLeast super.matplotlib.version "3.5.0") [
             self.setuptools-scm
             self.setuptools-scm-git-archive
           ];
@@ -2030,7 +2030,7 @@ lib.composeManyExtensions [
         if old.format != "wheel" then {
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++
             [ pkgs.gfortran ] ++
-            lib.optional (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ];
+            lib.optionals (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ];
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pybind11 ];
           setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
           enableParallelBuilding = true;
diff --git a/pkgs/development/tools/summon/default.nix b/pkgs/development/tools/summon/default.nix
index 5c811aaf2391..2ed17061c219 100644
--- a/pkgs/development/tools/summon/default.nix
+++ b/pkgs/development/tools/summon/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   # Patches provider resolver to support resolving unqualified names
   # from $PATH, e.g. `summon -p gopass` instead of `summon -p $(which gopass)`
-  patches = optional patchResolver [ ./resolve-paths.patch ];
+  patches = optionals patchResolver [ ./resolve-paths.patch ];
 
   postInstall = ''
     mv $out/bin/cmd $out/bin/summon
diff --git a/pkgs/development/web/nodejs/bypass-darwin-xcrun-node16.patch b/pkgs/development/web/nodejs/bypass-darwin-xcrun-node16.patch
new file mode 100644
index 000000000000..e86fcc4d2973
--- /dev/null
+++ b/pkgs/development/web/nodejs/bypass-darwin-xcrun-node16.patch
@@ -0,0 +1,41 @@
+Avoids needing xcrun or xcodebuild in PATH for native package builds
+
+diff --git a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
+index a75d8ee..476440d 100644
+--- a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
++++ b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
+@@ -522,7 +522,13 @@ class XcodeSettings:
+         # Since the CLT has no SDK paths anyway, returning None is the
+         # most sensible route and should still do the right thing.
+         try:
+-            return GetStdoutQuiet(["xcrun", "--sdk", sdk, infoitem])
++            #return GetStdoutQuiet(["xcrun", "--sdk", sdk, infoitem])
++            return {
++                "--show-sdk-platform-path": "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform",
++                "--show-sdk-path": "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk",
++                "--show-sdk-build-version": "19A547",
++                "--show-sdk-version": "10.15"
++            }[infoitem]
+         except GypError:
+             pass
+ 
+@@ -1499,7 +1505,8 @@ def XcodeVersion():
+     version = ""
+     build = ""
+     try:
+-        version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
++        #version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
++        version_list = []
+         # In some circumstances xcodebuild exits 0 but doesn't return
+         # the right results; for example, a user on 10.7 or 10.8 with
+         # a bogus path set via xcode-select
+@@ -1510,7 +1517,8 @@ def XcodeVersion():
+         version = version_list[0].split()[-1]  # Last word on first line
+         build = version_list[-1].split()[-1]  # Last word on last line
+     except GypError:  # Xcode not installed so look for XCode Command Line Tools
+-        version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
++        #version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
++        version = "11.0.0.0.1.1567737322"
+         if not version:
+             raise GypError("No Xcode or CLT version detected!")
+     # Be careful to convert "4.2.3" to "0423" and "11.0.0" to "1100":
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index ab9a8b95d1a0..6d9a3392a7a9 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -123,7 +123,6 @@ let
           --replace "/usr/bin/env" "${coreutils}/bin/env"
       done
     '' + optionalString stdenv.isDarwin ''
-      sed -i 's/raise.*No Xcode or CLT version detected.*/version = "7.0.0"/' tools/gyp/pylib/gyp/xcode_emulation.py
       sed -i -e "s|tr1/type_traits|type_traits|g" \
              -e "s|std::tr1|std|" src/util.h
     '';
@@ -176,8 +175,6 @@ let
       Libs: -L$libv8/lib -lv8 -pthread -licui18n
       Cflags: -I$libv8/include
       EOF
-    '' + optionalString (stdenv.isDarwin && enableNpm) ''
-      sed -i 's/raise.*No Xcode or CLT version detected.*/version = "7.0.0"/' $out/lib/node_modules/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
     '';
 
     passthru.updateScript = import ./update.nix {
diff --git a/pkgs/development/web/nodejs/v16.nix b/pkgs/development/web/nodejs/v16.nix
index 0b6a127bd269..5e0ea0a996cc 100644
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@@ -12,6 +12,7 @@ in
     sha256 = "sha256-ZyH+tBUtVtLGs1jOOXq9Wn8drwnuLiXFAhubTT+GozA=";
     patches = [
       ./disable-darwin-v8-system-instrumentation.patch
+      ./bypass-darwin-xcrun-node16.patch
       # Fix npm silently fail without a HOME directory https://github.com/npm/cli/issues/4996
       (fetchpatch {
         url = "https://github.com/npm/cli/commit/9905d0e24c162c3f6cc006fa86b4c9d0205a4c6f.patch";
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index c4050087cfe7..9cb626a93d98 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -8,8 +8,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "18.9.1";
-  sha256 = "sha256-84GWPUNWi6aZkVyIYp3G2koZY4BNzTey5uHRDZI91dk=";
+  version = "18.10.0";
+  sha256 = "17z8081bqsldx4dl7399dp9gdsmd04lgnwvwycj7sjmyw9a1nwdd";
   patches = [
     (fetchpatch {
       # Fixes cross compilation to aarch64-linux by reverting https://github.com/nodejs/node/pull/43200
@@ -20,5 +20,6 @@ buildNodejs {
     })
 
     ./disable-darwin-v8-system-instrumentation.patch
+    ./bypass-darwin-xcrun-node16.patch
   ];
 }