about summary refs log tree commit diff
path: root/pkgs/development
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/development')
-rw-r--r--pkgs/development/compilers/ghc/8.10.4.nix3
-rw-r--r--pkgs/development/compilers/ghc/8.8.4.nix3
-rw-r--r--pkgs/development/compilers/ghc/9.0.1.nix3
-rw-r--r--pkgs/development/compilers/ghc/head.nix3
-rw-r--r--pkgs/development/compilers/llvm/12/compiler-rt/darwin-targetconditionals.patch71
-rw-r--r--pkgs/development/compilers/llvm/12/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/ocaml/generic.nix18
-rw-r--r--pkgs/development/compilers/rust/1_54.nix (renamed from pkgs/development/compilers/rust/1_53.nix)30
-rw-r--r--pkgs/development/compilers/yasm/default.nix5
-rw-r--r--pkgs/development/interpreters/perl/default.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix16
-rw-r--r--pkgs/development/interpreters/python/cpython/3.9/darwin-tcl-tk.patch15
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix26
-rw-r--r--pkgs/development/libraries/boost/default.nix47
-rw-r--r--pkgs/development/libraries/boost/generic.nix60
-rw-r--r--pkgs/development/libraries/c-ares/default.nix6
-rw-r--r--pkgs/development/libraries/dav1d/default.nix4
-rw-r--r--pkgs/development/libraries/enchant/2.x.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg-full/default.nix10
-rw-r--r--pkgs/development/libraries/ffmpeg/2.8.nix1
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix10
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix15
-rw-r--r--pkgs/development/libraries/glew/default.nix3
-rw-r--r--pkgs/development/libraries/glib-networking/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/2.33-master.patch.gzbin56984 -> 58508 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/gpgme/default.nix20
-rw-r--r--pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff12
-rw-r--r--pkgs/development/libraries/gpgme/test_t-edit-sign.diff125
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix1
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix7
-rw-r--r--pkgs/development/libraries/gtk/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch34
-rw-r--r--pkgs/development/libraries/libaom/default.nix2
-rw-r--r--pkgs/development/libraries/libbfd/default.nix4
-rw-r--r--pkgs/development/libraries/libinput/default.nix45
-rw-r--r--pkgs/development/libraries/libmbim/default.nix11
-rw-r--r--pkgs/development/libraries/libqmi/default.nix5
-rw-r--r--pkgs/development/libraries/libsndfile/default.nix6
-rw-r--r--pkgs/development/libraries/libwacom/default.nix4
-rw-r--r--pkgs/development/libraries/libxml2/default.nix4
-rw-r--r--pkgs/development/libraries/lzo/default.nix4
-rw-r--r--pkgs/development/libraries/mlt/qt-5.nix34
-rw-r--r--pkgs/development/libraries/newt/default.nix9
-rw-r--r--pkgs/development/libraries/openal-soft/default.nix32
-rw-r--r--pkgs/development/libraries/openal-soft/search-out.patch18
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix20
-rw-r--r--pkgs/development/libraries/silgraphite/graphite2.nix4
-rw-r--r--pkgs/development/libraries/srtp/default.nix19
-rw-r--r--pkgs/development/libraries/zlib/default.nix10
-rw-r--r--pkgs/development/node-packages/node-packages.json2
-rw-r--r--pkgs/development/node-packages/node-packages.nix359
-rw-r--r--pkgs/development/ocaml-modules/bolt/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/easy-format/default.nix3
-rw-r--r--pkgs/development/ocaml-modules/gen/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/hacl-star/raw.nix2
-rw-r--r--pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix2
-rw-r--r--pkgs/development/ocaml-modules/janestreet/js-build-tools.nix2
-rw-r--r--pkgs/development/ocaml-modules/javalib/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/labltk/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ocamlnet/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-server/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/process/default.nix3
-rw-r--r--pkgs/development/ocaml-modules/sawja/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/seq/default.nix3
-rw-r--r--pkgs/development/ocaml-modules/syslog/default.nix3
-rw-r--r--pkgs/development/ocaml-modules/wasm/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/zarith/default.nix6
-rw-r--r--pkgs/development/python-modules/numpy/default.nix8
-rw-r--r--pkgs/development/python-modules/pbr/default.nix5
-rw-r--r--pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb1
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/boost-build/default.nix35
-rw-r--r--pkgs/development/tools/build-managers/cmake/application-services.patch26
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix52
-rw-r--r--pkgs/development/tools/build-managers/cmake/remove-systemconfiguration-dep.patch89
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.16.x.nix13
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix16
-rw-r--r--pkgs/development/tools/misc/binutils/gold-Update-GNU_PROPERTY_X86_XXX-macros.patch292
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix4
-rw-r--r--pkgs/development/tools/misc/patchelf/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/dune/1.nix8
-rw-r--r--pkgs/development/tools/ocaml/dune/2.nix5
-rw-r--r--pkgs/development/tools/ocaml/findlib/default.nix27
-rw-r--r--pkgs/development/tools/ocaml/ocamlbuild/default.nix10
-rw-r--r--pkgs/development/tools/ocaml/opaline/default.nix3
-rw-r--r--pkgs/development/tools/parsing/re2c/default.nix18
-rw-r--r--pkgs/development/tools/rust/cargo-c/default.nix9
-rw-r--r--pkgs/development/tools/rust/cbindgen/default.nix6
88 files changed, 1272 insertions, 565 deletions
diff --git a/pkgs/development/compilers/ghc/8.10.4.nix b/pkgs/development/compilers/ghc/8.10.4.nix
index 07784c426479..b0fb726e9c6f 100644
--- a/pkgs/development/compilers/ghc/8.10.4.nix
+++ b/pkgs/development/compilers/ghc/8.10.4.nix
@@ -122,7 +122,8 @@ let
   # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
   # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
   # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);
 
   runtimeDeps = [
     targetPackages.stdenv.cc.bintools
diff --git a/pkgs/development/compilers/ghc/8.8.4.nix b/pkgs/development/compilers/ghc/8.8.4.nix
index bb2267c930de..74260af7d31c 100644
--- a/pkgs/development/compilers/ghc/8.8.4.nix
+++ b/pkgs/development/compilers/ghc/8.8.4.nix
@@ -131,7 +131,8 @@ let
   # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
   # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
   # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);
 
   runtimeDeps = [
     targetPackages.stdenv.cc.bintools
diff --git a/pkgs/development/compilers/ghc/9.0.1.nix b/pkgs/development/compilers/ghc/9.0.1.nix
index 30a7f7a4f40a..37e03ccd4c9e 100644
--- a/pkgs/development/compilers/ghc/9.0.1.nix
+++ b/pkgs/development/compilers/ghc/9.0.1.nix
@@ -123,7 +123,8 @@ let
   # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
   # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
   # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);
 
   runtimeDeps = [
     targetPackages.stdenv.cc.bintools
diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix
index 35c0bd76214d..7aaaaeb417b0 100644
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@@ -133,7 +133,8 @@ let
   # Use gold either following the default, or to avoid the BFD linker due to some bugs / perf issues.
   # But we cannot avoid BFD when using musl libc due to https://sourceware.org/bugzilla/show_bug.cgi?id=23856
   # see #84670 and #49071 for more background.
-  useLdGold = targetPlatform.linker == "gold" || (targetPlatform.linker == "bfd" && !targetPlatform.isMusl);
+  useLdGold = targetPlatform.linker == "gold" ||
+    (targetPlatform.linker == "bfd" && (targetPackages.stdenv.cc.bintools.bintools.hasGold or false) && !targetPlatform.isMusl);
 
   runtimeDeps = [
     targetPackages.stdenv.cc.bintools
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/darwin-targetconditionals.patch b/pkgs/development/compilers/llvm/12/compiler-rt/darwin-targetconditionals.patch
deleted file mode 100644
index 425dc2af01e7..000000000000
--- a/pkgs/development/compilers/llvm/12/compiler-rt/darwin-targetconditionals.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-diff --git a/lib/sanitizer_common/sanitizer_mac.cpp b/lib/sanitizer_common/sanitizer_mac.cpp
---- a/lib/sanitizer_common/sanitizer_mac.cpp
-+++ b/lib/sanitizer_common/sanitizer_mac.cpp
-@@ -613,9 +613,15 @@ HandleSignalMode GetHandleSignalMode(int signum) {
- // Offset example:
- // XNU 17 -- macOS 10.13 -- iOS 11 -- tvOS 11 -- watchOS 4
- constexpr u16 GetOSMajorKernelOffset() {
--  if (TARGET_OS_OSX) return 4;
--  if (TARGET_OS_IOS || TARGET_OS_TV) return 6;
--  if (TARGET_OS_WATCH) return 13;
-+#if TARGET_OS_OSX
-+  return 4;
-+#endif
-+#if TARGET_OS_IOS || TARGET_OS_TV
-+  return 6;
-+#endif
-+#if TARGET_OS_WATCH
-+  return 13;
-+#endif
- }
- 
- using VersStr = char[64];
-@@ -627,13 +633,13 @@ static uptr ApproximateOSVersionViaKernelVersion(VersStr vers) {
-   u16 os_major = kernel_major - offset;
- 
-   const char *format = "%d.0";
--  if (TARGET_OS_OSX) {
--    if (os_major >= 16) {  // macOS 11+
--      os_major -= 5;
--    } else {  // macOS 10.15 and below
--      format = "10.%d";
--    }
-+#if TARGET_OS_OSX
-+  if (os_major >= 16) {  // macOS 11+
-+    os_major -= 5;
-+  } else {  // macOS 10.15 and below
-+    format = "10.%d";
-   }
-+#endif
-   return internal_snprintf(vers, sizeof(VersStr), format, os_major);
- }
- 
-@@ -681,15 +687,14 @@ void ParseVersion(const char *vers, u16 *major, u16 *minor) {
- // Aligned versions example:
- // macOS 10.15 -- iOS 13 -- tvOS 13 -- watchOS 6
- static void MapToMacos(u16 *major, u16 *minor) {
--  if (TARGET_OS_OSX)
--    return;
--
--  if (TARGET_OS_IOS || TARGET_OS_TV)
-+#if !TARGET_OS_OSX
-+#if TARGET_OS_IOS || TARGET_OS_TV
-     *major += 2;
--  else if (TARGET_OS_WATCH)
-+#elif TARGET_OS_WATCH
-     *major += 9;
--  else
-+#else
-     UNREACHABLE("unsupported platform");
-+#endif
- 
-   if (*major >= 16) {  // macOS 11+
-     *major -= 5;
-@@ -697,6 +702,7 @@ static void MapToMacos(u16 *major, u16 *minor) {
-     *minor = *major;
-     *major = 10;
-   }
-+#endif
- }
- 
- static MacosVersion GetMacosAlignedVersionInternal() {
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index 16f58616aab7..5f2cf9fd3fbd 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -59,8 +59,6 @@ stdenv.mkDerivation {
     # extra `/`.
     ./normalize-var.patch
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/ocaml/generic.nix b/pkgs/development/compilers/ocaml/generic.nix
index 2dd959600eac..e4cec4cf52ed 100644
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@@ -3,7 +3,7 @@
 let
   versionNoPatch = "${toString major_version}.${toString minor_version}";
   version = "${versionNoPatch}.${toString patch_version}";
-  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips);
+  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips || stdenv.hostPlatform.isStatic);
 in
 
 { lib, stdenv, fetchurl, ncurses, buildEnv, libunwind
@@ -13,7 +13,7 @@ in
 , spaceTimeSupport ? false
 }:
 
-assert useX11 -> !stdenv.isAarch32 && !stdenv.isMips;
+assert useX11 -> safeX11 stdenv;
 assert aflSupport -> lib.versionAtLeast version "4.05";
 assert flambdaSupport -> lib.versionAtLeast version "4.03";
 assert spaceTimeSupport -> lib.versionAtLeast version "4.04";
@@ -44,6 +44,8 @@ stdenv.mkDerivation (args // {
 
   inherit src;
 
+  strictDeps = true;
+
   prefixKey = "-prefix ";
   configureFlags =
     let flags = new: old:
@@ -56,7 +58,15 @@ stdenv.mkDerivation (args // {
   ++ optional aflSupport (flags "--with-afl" "-afl-instrument")
   ++ optional flambdaSupport (flags "--enable-flambda" "-flambda")
   ++ optional spaceTimeSupport (flags "--enable-spacetime" "-spacetime")
-  ;
+  ++ optional (stdenv.hostPlatform.isStatic && (lib.versionOlder version "4.08")) "-no-shared-libs"
+  ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && lib.versionOlder version "4.08") [
+    "-host ${stdenv.hostPlatform.config}"
+    "-target ${stdenv.targetPlatform.config}"
+  ];
+  dontAddStaticConfigureFlags = lib.versionOlder version "4.08";
+  configurePlatforms = lib.optionals (lib.versionAtLeast version "4.08") [ "host" "target" ];
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional (lib.versionAtLeast version "4.09" && stdenv.hostPlatform.isMusl) "pie";
 
   buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
   buildInputs = optional (!lib.versionAtLeast version "4.07") ncurses
@@ -70,6 +80,8 @@ stdenv.mkDerivation (args // {
     # Do what upstream does by default now: https://github.com/ocaml/ocaml/pull/10176
     # This is required for aarch64-darwin, everything else works as is.
     AS="${stdenv.cc}/bin/cc -c" ASPP="${stdenv.cc}/bin/cc -c"
+  '' + optionalString (lib.versionOlder version "4.08" && stdenv.hostPlatform.isStatic) ''
+    configureFlagsArray+=("-cc" "$CC" "-as" "$AS" "-partialld" "$LD -r")
   '';
   postBuild = ''
     mkdir -p $out/include
diff --git a/pkgs/development/compilers/rust/1_53.nix b/pkgs/development/compilers/rust/1_54.nix
index dda6d3931903..b31dbc8bb9a9 100644
--- a/pkgs/development/compilers/rust/1_53.nix
+++ b/pkgs/development/compilers/rust/1_54.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.53.0";
-  rustcSha256 = "1f95p259dfp5ca118bg107rj3rqwlswy65dxn3hg8sqgl4wwmxsw";
+  rustcVersion = "1.54.0";
+  rustcSha256 = "0xk9dhfff16caambmwij67zgshd8v9djw6ha0fnnanlv7rii31dc";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
@@ -34,24 +34,24 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.52.1";
+  bootstrapVersion = "1.53.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "c91f0431c8137a4e98e097ab47b49846820531aafb6e9c249b71b770771832e9";
-    x86_64-unknown-linux-gnu = "617ae06e212cb65bc4abbf52b158b0328b9f1a6c2f822c27c95b274d6fbc0627";
-    x86_64-unknown-linux-musl = "c3eae6e78ee29e03416897f89b54448b2a03d063f07a78cde41757ad2e02c2f0";
-    arm-unknown-linux-gnueabihf = "ef412d923a0c5a9fa54422f40cde62f2e85a62339057cb8b986a545b108d3347";
-    armv7-unknown-linux-gnueabihf = "ec47b3f5c801f8a4df7180e088dcc1817ee160df34ef64ddac4fa50f714f119f";
-    aarch64-unknown-linux-gnu = "17d9aa7bb73b819ef70d81013498727b7218533ee6cf3bd802c4eac29137fbcb";
-    aarch64-unknown-linux-musl = "f2bae2b32f05a90eec041352d9329deb3e907f5560b9fda525788df3b8008b6b";
-    x86_64-apple-darwin = "cfa73228ea54e2c94f75d1b142ea41444c463f4ee8562a3eca1b11b2fe8af95a";
-    aarch64-apple-darwin = "217e9723f828c5359467d69b363a342d702bdcbbcc4107be907e6bc4531f4912";
-    powerpc64le-unknown-linux-gnu = "f258c5d7d6d9022108672b7383412d930a5f59d7644d148e413c3ab0ae45604f";
-    riscv64gc-unknown-linux-gnu = "c1c98ccc8bb4147a819411a10162c8f8ce1aaa5c65cf2c74802dce4dacd6e64b";
+    i686-unknown-linux-gnu = "4ebeeba05448b9484bb2845dba2ff4c0e2b7208fa8b08bef2b2ca3b171d0db99";
+    x86_64-unknown-linux-gnu = "5e9e556d2ccce27aa8f01a528f1348bf8cdd34496c35ec2abf131660b9792fed";
+    x86_64-unknown-linux-musl = "908b6163b62660f289bcd1eda1a0eb6d849b4b29da12546d24a033e5718e93ff";
+    arm-unknown-linux-gnueabihf = "6ae3108f4a0b0478c76f5dbaf1827c9e4a983fa78a9f973b24d501e693cfdcab";
+    armv7-unknown-linux-gnueabihf = "886e78f7c5bd92e16322ca3af70d1899c064837343cdfeb9a216b76edfd18157";
+    aarch64-unknown-linux-gnu = "cba81d5c3d16deee04098ea18af8636bc7415315a44c9e44734fd669aa778040";
+    aarch64-unknown-linux-musl = "a0065a6313bf370f2844af6f3b47fe292360e9cca3da31b5f6cb32db311ba686";
+    x86_64-apple-darwin = "940a4488f907b871f9fb1be309086509e4a48efb19303f8b5fe115c6f12abf43";
+    aarch64-apple-darwin = "c519da905514c05240a8fe39e459de2c4ef5943535e3655502e8fb756070aee1";
+    powerpc64le-unknown-linux-gnu = "9f6c17427d1023b10694e4ba60d6d9deec0aeb07d051f99763789ed18e07e2e6";
+    riscv64gc-unknown-linux-gnu = "6ae23ac00269df72b0790f10f2d9a98d03acf542c6090f4d30a87365fafd14ed";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_53;
+  selectRustPackage = pkgs: pkgs.rust_1_54;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/yasm/default.nix b/pkgs/development/compilers/yasm/default.nix
index 48c251d828a2..b770f3b7dfdb 100644
--- a/pkgs/development/compilers/yasm/default.nix
+++ b/pkgs/development/compilers/yasm/default.nix
@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "yasm-1.3.0";
+  pname = "yasm";
+  version = "1.3.0";
 
   src = fetchurl {
-    url = "https://www.tortall.net/projects/yasm/releases/${name}.tar.gz";
+    url = "https://www.tortall.net/projects/yasm/releases/yasm-${version}.tar.gz";
     sha256 = "0gv0slmm0qpq91za3v2v9glff3il594x5xsrbgab7xcmnh0ndkix";
   };
 
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 3b39974c16b1..c1f1bfc0b4ad 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -86,6 +86,8 @@ let
 
     configureScript = optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
 
+    dontAddStaticConfigureFlags = true;
+
     dontAddPrefix = !crossCompiling;
 
     enableParallelBuilding = !crossCompiling;
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 5ee88ebb8810..fd7e684113e7 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -26,10 +26,10 @@
 , sourceVersion
 , sha256
 , passthruFun
-, static ? false
+, static ? stdenv.hostPlatform.isStatic
 , stripBytecode ? reproducibleBuild
 , rebuildBytecode ? true
-, reproducibleBuild ? true
+, reproducibleBuild ? false
 , enableOptimizations ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:
@@ -48,6 +48,8 @@ assert lib.assertMsg (reproducibleBuild -> stripBytecode)
 assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations))
   "Deterministic builds are not achieved when optimizations are enabled.";
 
+assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
+  "Deterministic builds are not achieved when (default unoptimized) bytecode is created.";
 
 with lib;
 
@@ -185,8 +187,9 @@ let
 
   configureFlags = optionals enableOptimizations [
     "--enable-optimizations"
-  ] ++ [
+  ] ++ optionals (!static) [
     "--enable-shared"
+  ] ++ [
     "--with-threads"
     "--enable-unicode=ucs${toString ucsEncoding}"
   ] ++ optionals (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) [
@@ -224,6 +227,7 @@ let
   ++ optional stdenv.hostPlatform.isLinux "ac_cv_func_lchmod=no"
   ++ optional static "LDFLAGS=-static";
 
+  strictDeps = true;
   buildInputs =
     optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++
     [ bzip2 openssl zlib ]
@@ -296,8 +300,10 @@ in with passthru; stdenv.mkDerivation ({
         # First we delete all old bytecode.
         find $out -name "*.pyc" -delete
         '' + optionalString rebuildBytecode ''
-        # Then, we build for the two optimization levels.
-        # We do not build unoptimized bytecode, because its not entirely deterministic yet.
+        # We build 3 levels of optimized bytecode. Note the default level, without optimizations,
+        # is not reproducible yet. https://bugs.python.org/issue29708
+        # Not creating bytecode will result in a large performance loss however, so we do build it.
+        find $out -name "*.py" | ${pythonForBuildInterpreter} -m compileall -q -f -x "lib2to3" -i -
         find $out -name "*.py" | ${pythonForBuildInterpreter} -O  -m compileall -q -f -x "lib2to3" -i -
         find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
       '' + optionalString stdenv.hostPlatform.isCygwin ''
diff --git a/pkgs/development/interpreters/python/cpython/3.9/darwin-tcl-tk.patch b/pkgs/development/interpreters/python/cpython/3.9/darwin-tcl-tk.patch
new file mode 100644
index 000000000000..a9b0c0677c5e
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.9/darwin-tcl-tk.patch
@@ -0,0 +1,15 @@
+diff --git a/setup.py b/setup.py
+index 04eb6b2..2e1160d 100644
+--- a/setup.py
++++ b/setup.py
+@@ -1981,8 +1981,8 @@ class PyBuildExt(build_ext):
+         # Rather than complicate the code below, detecting and building
+         # AquaTk is a separate method. Only one Tkinter will be built on
+         # Darwin - either AquaTk, if it is found, or X11 based Tk.
+-        if (MACOS and self.detect_tkinter_darwin()):
+-            return True
++        # if (MACOS and self.detect_tkinter_darwin()):
++        #     return True
+ 
+         # Assume we haven't found any of the libraries or include files
+         # The versions with dots are used on Unix, and the versions without
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index f52255f4748b..8e340dd3b146 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -35,7 +35,7 @@
 , stripTests ? false
 , stripTkinter ? false
 , rebuildBytecode ? true
-, stripBytecode ? reproducibleBuild
+, stripBytecode ? true
 , includeSiteCustomize ? true
 , static ? stdenv.hostPlatform.isStatic
 , enableOptimizations ? false
@@ -46,7 +46,7 @@
 # enabling LTO on 32bit arch causes downstream packages to fail when linking
 # enabling LTO on *-darwin causes python3 to fail when linking.
 , enableLTO ? stdenv.is64bit && stdenv.isLinux
-, reproducibleBuild ? true
+, reproducibleBuild ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:
 
@@ -73,6 +73,9 @@ assert lib.assertMsg (reproducibleBuild -> stripBytecode)
 assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations))
   "Deterministic builds are not achieved when optimizations are enabled.";
 
+assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
+  "Deterministic builds are not achieved when (default unoptimized) bytecode is created.";
+
 with lib;
 
 let
@@ -98,6 +101,8 @@ let
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
+  strictDeps = true;
+
   nativeBuildInputs = optionals (!stdenv.isDarwin) [
     autoreconfHook
   ] ++ optionals (!stdenv.isDarwin && passthru.pythonAtLeast "3.10") [
@@ -232,6 +237,9 @@ in with passthru; stdenv.mkDerivation {
       else
         ./3.5/profile-task.patch
     )
+  ] ++ optionals (pythonAtLeast "3.9" && stdenv.isDarwin) [
+    # Stop checking for TCL/TK in global macOS locations
+    ./3.9/darwin-tcl-tk.patch
   ] ++ optionals (isPy3k && hasDistutilsCxxPatch) [
     # Fix for http://bugs.python.org/issue1222585
     # Upstream distutils is calling C compiler to compile C++ code, which
@@ -281,10 +289,11 @@ in with passthru; stdenv.mkDerivation {
   PYTHONHASHSEED=0;
 
   configureFlags = [
-    "--enable-shared"
     "--without-ensurepip"
     "--with-system-expat"
     "--with-system-ffi"
+  ] ++ optionals (!static) [
+    "--enable-shared"
   ] ++ optionals enableOptimizations [
     "--enable-optimizations"
   ] ++ optionals enableLTO [
@@ -332,6 +341,8 @@ in with passthru; stdenv.mkDerivation {
   '' + optionalString stdenv.isDarwin ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -msse2"
     export MACOSX_DEPLOYMENT_TARGET=10.6
+    # Override the auto-detection in setup.py, which assumes a universal build
+    export PYTHON_DECIMAL_WITH_MACHINE=${if stdenv.isAarch64 then "uint128" else "x64"}
   '' + optionalString (isPy3k && pythonOlder "3.7") ''
     # Determinism: The interpreter is patched to write null timestamps when compiling Python files
     #   so Python doesn't try to update the bytecode when seeing frozen timestamps in Nix's store.
@@ -422,11 +433,14 @@ in with passthru; stdenv.mkDerivation {
     # First we delete all old bytecode.
     find $out -type d -name __pycache__ -print0 | xargs -0 -I {} rm -rf "{}"
     '' + optionalString rebuildBytecode ''
-    # Then, we build for the two optimization levels.
-    # We do not build unoptimized bytecode, because its not entirely deterministic yet.
     # Python 3.7 implements PEP 552, introducing support for deterministic bytecode.
-    # compileall uses this checked-hash method by default when `SOURCE_DATE_EPOCH` is set.
+    # compileall uses the therein introduced checked-hash method by default when
+    # `SOURCE_DATE_EPOCH` is set.
     # We exclude lib2to3 because that's Python 2 code which fails
+    # We build 3 levels of optimized bytecode. Note the default level, without optimizations,
+    # is not reproducible yet. https://bugs.python.org/issue29708
+    # Not creating bytecode will result in a large performance loss however, so we do build it.
+    find $out -name "*.py" | ${pythonForBuildInterpreter} -m compileall -q -f -x "lib2to3" -i -
     find $out -name "*.py" | ${pythonForBuildInterpreter} -O  -m compileall -q -f -x "lib2to3" -i -
     find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
   '';
diff --git a/pkgs/development/libraries/boost/default.nix b/pkgs/development/libraries/boost/default.nix
new file mode 100644
index 000000000000..3b79378605f2
--- /dev/null
+++ b/pkgs/development/libraries/boost/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, callPackage
+, boost-build
+, fetchurl
+}:
+
+let
+  # for boost 1.55 we need to use 1.56's b2
+  # since 1.55's build system is not working
+  # with our derivation
+  useBoost156 = rec {
+    version = "1.56.0";
+    src = fetchurl {
+      url = "mirror://sourceforge/boost/boost_${lib.replaceStrings ["."] ["_"] version}.tar.bz2";
+      sha256 = "07gz62nj767qzwqm3xjh11znpyph8gcii0cqhnx7wvismyn34iqk";
+    };
+  };
+
+  makeBoost = file:
+    lib.fix (self:
+      callPackage file {
+        boost-build = boost-build.override {
+          # useBoost allows us passing in src and version from
+          # the derivation we are building to get a matching b2 version.
+          useBoost =
+            if lib.versionAtLeast self.version "1.56"
+            then self
+            else useBoost156; # see above
+        };
+      }
+    );
+in {
+  boost155 = makeBoost ./1.55.nix;
+  boost159 = makeBoost ./1.59.nix;
+  boost160 = makeBoost ./1.60.nix;
+  boost165 = makeBoost ./1.65.nix;
+  boost166 = makeBoost ./1.66.nix;
+  boost167 = makeBoost ./1.67.nix;
+  boost168 = makeBoost ./1.68.nix;
+  boost169 = makeBoost ./1.69.nix;
+  boost170 = makeBoost ./1.70.nix;
+  boost171 = makeBoost ./1.71.nix;
+  boost172 = makeBoost ./1.72.nix;
+  boost173 = makeBoost ./1.73.nix;
+  boost174 = makeBoost ./1.74.nix;
+  boost175 = makeBoost ./1.75.nix;
+}
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 1f9bbe5ffcad..2d8d13482eac 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -1,8 +1,9 @@
 { lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv
+, boost-build
 , fetchpatch
 , which
-, buildPackages
 , toolset ? /**/ if stdenv.cc.isClang  then "clang"
+            else if stdenv.cc.isGNU    then "gcc"
             else null
 , enableRelease ? true
 , enableDebug ? false
@@ -67,6 +68,8 @@ let
     else
       "$NIX_BUILD_CORES";
 
+  needUserConfig = stdenv.hostPlatform != stdenv.buildPlatform || useMpi || stdenv.isDarwin;
+
   b2Args = concatStringsSep " " ([
     "--includedir=$dev/include"
     "--libdir=$out/lib"
@@ -95,7 +98,7 @@ let
     ++ optional (variant == "release") "debug-symbols=off"
     ++ optional (toolset != null) "toolset=${toolset}"
     ++ optional (!enablePython) "--without-python"
-    ++ optional (useMpi || stdenv.hostPlatform != stdenv.buildPlatform) "--user-config=user-config.jam"
+    ++ optional needUserConfig "--user-config=user-config.jam"
     ++ optionals (stdenv.hostPlatform.libc == "msvcrt") [
     "threadapi=win32"
   ] ++ extraB2Args
@@ -137,22 +140,39 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ peti ];
   };
 
-  preConfigure = ''
-    if test -f tools/build/src/tools/clang-darwin.jam ; then
-        substituteInPlace tools/build/src/tools/clang-darwin.jam \
-          --replace '@rpath/$(<[1]:D=)' "$out/lib/\$(<[1]:D=)";
-    fi;
-  '' + optionalString useMpi ''
+  preConfigure = optionalString useMpi ''
     cat << EOF >> user-config.jam
     using mpi : ${mpi}/bin/mpiCC ;
     EOF
-  '' + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+  ''
+  # On darwin we need to add the `$out/lib` to the libraries' rpath explicitly,
+  # otherwise the dynamic linker is unable to resolve the reference to @rpath
+  # when the boost libraries want to load each other at runtime.
+  + optionalString (stdenv.isDarwin && enableShared) ''
+    cat << EOF >> user-config.jam
+    using clang-darwin : : ${stdenv.cc.targetPrefix}c++
+      : <linkflags>"-rpath $out/lib/"
+      ;
+    EOF
+  ''
+  # b2 has trouble finding the correct compiler and tools for cross compilation
+  # since it apparently ignores $CC, $AR etc. Thus we need to set everything
+  # in user-config.jam. To keep things simple we just set everything in an
+  # uniform way for clang and gcc (which works thanks to our cc-wrapper).
+  # We pass toolset later which will make b2 invoke everything in the right
+  # way -- the other toolset in user-config.jam will be ignored.
+  + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     cat << EOF >> user-config.jam
-    using gcc : cross : ${stdenv.cc.targetPrefix}c++ ;
+    using gcc : cross : ${stdenv.cc.targetPrefix}c++
+      : <archiver>$AR
+        <ranlib>$RANLIB
+      ;
+
+    using clang : cross : ${stdenv.cc.targetPrefix}c++
+      : <archiver>$AR
+        <ranlib>$RANLIB
+      ;
     EOF
-    # Build b2 with buildPlatform CC/CXX.
-    sed '2i export CC=$CC_FOR_BUILD; export CXX=$CXX_FOR_BUILD' \
-      -i ./tools/build/src/engine/build.sh
   '';
 
   NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin
@@ -160,9 +180,8 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ which ]
+  nativeBuildInputs = [ which boost-build ]
     ++ optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ expat zlib bzip2 libiconv ]
     ++ optional (stdenv.hostPlatform == stdenv.buildPlatform) icu
     ++ optional enablePython python
@@ -170,16 +189,19 @@ stdenv.mkDerivation {
 
   configureScript = "./bootstrap.sh";
   configurePlatforms = [];
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
   configureFlags = [
     "--includedir=$(dev)/include"
     "--libdir=$(out)/lib"
+    "--with-bjam=b2" # prevent bootstrapping b2 in configurePhase
   ] ++ optional enablePython "--with-python=${python.interpreter}"
-    ++ [ (if stdenv.hostPlatform == stdenv.buildPlatform then "--with-icu=${icu.dev}" else "--without-icu") ]
-    ++ optional (toolset != null) "--with-toolset=${toolset}";
+    ++ optional (toolset != null) "--with-toolset=${toolset}"
+    ++ [ (if stdenv.hostPlatform == stdenv.buildPlatform then "--with-icu=${icu.dev}" else "--without-icu") ];
 
   buildPhase = ''
     runHook preBuild
-    ./b2 ${b2Args}
+    b2 ${b2Args}
     runHook postBuild
   '';
 
@@ -191,7 +213,7 @@ stdenv.mkDerivation {
     cp -a tools/boostbook/{xsl,dtd} $dev/share/boostbook/
 
     # Let boost install everything else
-    ./b2 ${b2Args} install
+    b2 ${b2Args} install
 
     runHook postInstall
   '';
diff --git a/pkgs/development/libraries/c-ares/default.nix b/pkgs/development/libraries/c-ares/default.nix
index 20bcf80d9e59..4f571b7f1dd9 100644
--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@@ -8,13 +8,15 @@
 let self =
 stdenv.mkDerivation rec {
   pname = "c-ares";
-  version = "1.17.1";
+  version = "1.17.2";
 
   src = fetchurl {
     url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
-    sha256 = "0h7wjfnk2092glqcp9mqaax7xx0s13m501z1gi0gsjl2vvvd0gfp";
+    sha256 = "sha256-SAPIRM4gzlEO8OuD+OpB+iTsqunSgMRoxYLSuyWzkT0=";
   };
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "A C library for asynchronous DNS requests";
     homepage = "https://c-ares.haxx.se";
diff --git a/pkgs/development/libraries/dav1d/default.nix b/pkgs/development/libraries/dav1d/default.nix
index fe6926fe809a..c85e14257885 100644
--- a/pkgs/development/libraries/dav1d/default.nix
+++ b/pkgs/development/libraries/dav1d/default.nix
@@ -10,14 +10,14 @@ assert useVulkan -> withExamples;
 
 stdenv.mkDerivation rec {
   pname = "dav1d";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = pname;
     rev = version;
-    sha256 = "0ki3wlyaqr80gl1srbbd18dd5bs1sl9icxym8ar62abpvgzxl5yk";
+    sha256 = "15ngaqyjbwkj0rd9mvxaqf3i9vzsnlrqgr50cnxxjqnpf7xdmslj";
   };
 
   nativeBuildInputs = [ meson ninja nasm pkg-config ];
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 237ecf148cb8..0d1374018b6c 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.3.0";
+  version = "2.3.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-32gGO2wTskX6ckaw4JigPnT3qRxtiUe8XE9CzlXi5B0=";
+    sha256 = "sha256-e0sa/PLNi/ppHe6mGIQE0zfyMXS7w5ucKt0r80Bzbpw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index 3dca11008f72..77bd473485b0 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -244,7 +244,7 @@ assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;
 
 stdenv.mkDerivation rec {
   pname = "ffmpeg-full";
-  inherit (ffmpeg) src version;
+  inherit (ffmpeg) src version patches;
 
   prePatch = ''
     patchShebangs .
@@ -447,6 +447,14 @@ stdenv.mkDerivation rec {
   buildFlags = [ "all" ]
     ++ optional qtFaststartProgram "tools/qt-faststart"; # Build qt-faststart executable
 
+  doCheck = true;
+  checkPhase = let
+    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+  in ''
+    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavresample:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
+      make check -j$NIX_BUILD_CORES
+  '';
+
   # Hacky framework patching technique borrowed from the phantomjs2 package
   postInstall = optionalString qtFaststartProgram ''
     cp -a tools/qt-faststart $out/bin/
diff --git a/pkgs/development/libraries/ffmpeg/2.8.nix b/pkgs/development/libraries/ffmpeg/2.8.nix
index 6d94c2e9974b..0df810ff10b0 100644
--- a/pkgs/development/libraries/ffmpeg/2.8.nix
+++ b/pkgs/development/libraries/ffmpeg/2.8.nix
@@ -7,4 +7,5 @@ callPackage ./generic.nix (rec {
   knownVulnerabilities = [
     "CVE-2021-30123"
   ];
+  doCheck = false;
 } // args)
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index d557c87ebdf6..f3758ca53924 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -13,6 +13,16 @@ callPackage ./generic.nix (rec {
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 
   patches = [
+    (fetchpatch {
+      name = "CVE-2021-33815.patch";
+      url = "https://github.com/FFmpeg/FFmpeg/commit/26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777.patch";
+      sha256 = "0l8dqga5845f7d3wdbvd05i23saldq4pm2cyfdgszbr0c18sxagf";
+    })
+    (fetchpatch {
+      name = "CVE-2021-38114.patch";
+      url = "https://github.com/FFmpeg/FFmpeg/commit/7150f9575671f898382c370acae35f9087a30ba1.patch";
+      sha256 = "0gwkc7v1wsh4j0am2nnskhsca1b5aqzhcfd41sd9mh2swsdyf27i";
+    })
     # Fix incorrect segment length in HLS child playlist with fmp4 segment format
     # FIXME remove in version 4.5
     # https://trac.ffmpeg.org/ticket/9193
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index d52abd4ab09f..876910da6d25 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -2,6 +2,7 @@
 , alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
 , libssh, libtheora, libva, libdrm, libvorbis, libvpx, xz, libpulseaudio, soxr
 , x264, x265, xvidcore, zlib, libopus, speex, nv-codec-headers, dav1d
+, srt ? null
 , openglSupport ? false, libGLU ? null, libGL ? null
 , libmfxSupport ? false, intel-media-sdk ? null
 , libaomSupport ? false, libaom ? null
@@ -17,7 +18,8 @@
 # Darwin frameworks
 , Cocoa, darwinFrameworks ? [ Cocoa ]
 # Inherit generics
-, branch, sha256, version, patches ? [], knownVulnerabilities ? [], ...
+, branch, sha256, version, patches ? [], knownVulnerabilities ? []
+, doCheck ? true, ...
 }:
 
 /* Maintainer notes:
@@ -94,6 +96,7 @@ stdenv.mkDerivation rec {
     # Build flags
       "--enable-shared"
       (ifMinVer "0.6" "--enable-pic")
+      (ifMinVer "4.0" (enableFeature (srt != null) "libsrt"))
       (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
       "--enable-hardcoded-tables"
     ] ++
@@ -171,7 +174,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zlib libopus speex nv-codec-headers
+    libvorbis xz soxr x264 x265 xvidcore zlib libopus speex srt nv-codec-headers
   ] ++ optionals openglSupport [ libGL libGLU ]
     ++ optional libmfxSupport intel-media-sdk
     ++ optional libaomSupport libaom
@@ -187,7 +190,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  doCheck = false; # fails
+  inherit doCheck;
+  checkPhase = let
+    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+  in ''
+    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavresample:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
+      make check -j$NIX_BUILD_CORES
+  '';
 
   # ffmpeg 3+ generates pkg-config (.pc) files that don't have the
   # form automatically handled by the multiple-outputs hooks.
diff --git a/pkgs/development/libraries/glew/default.nix b/pkgs/development/libraries/glew/default.nix
index 53c9b5a30dc9..ae32bbe95223 100644
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@@ -43,6 +43,9 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "SYSTEM=${if stdenv.hostPlatform.isMinGW then "mingw" else stdenv.hostPlatform.parsed.kernel.name}"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "LD=${stdenv.cc.targetPrefix}cc"
+    "AR=${stdenv.cc.targetPrefix}ar"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index 690279fcf213..6842470be4c0 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glib-networking";
-  version = "2.68.1";
+  version = "2.68.2";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0c1vylxly8k7g454g02spi44ybjidlwg461vp713zxd94k8qnpfh";
+    sha256 = "U168BU72l9tWpP/+2RvA4RyO4cmstIqtKMjh1cPVmU8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glibc/2.33-master.patch.gz b/pkgs/development/libraries/glibc/2.33-master.patch.gz
index 59230761cd43..95edf3cfedd5 100644
--- a/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.33-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index e651a8effac9..d2d7b6cc064c 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -42,7 +42,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-47";
+  patchSuffix = "-49";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -61,7 +61,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-47-gb5711025bc
+          glibc-2.33-49-g22d37364ae
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 9cbf5c39a7e7..c1c9460fad69 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -21,22 +21,10 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchpatch { # probably included in > 1.16.0
-      name = "test_t-edit-sign.diff"; # we experienced segmentation fault in this test
-      urls = [
-        "https://files.gnupg.net/file/data/w43xz2zf73pnyqk5mm5l/PHID-FILE-hm2x5mjntsdyxrxve5tb/file"
-        "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=patch;h=81a33ea5e1b86d586b956e893a5b25c4cd41c969"
-      ];
-      sha256 = "1xxvv0kc9wdj5hzpddzs3cn8dhmm2cb29224a7h9vairraq5272h";
-    })
-    (fetchpatch { # gpg: Send --with-keygrip when listing keys
-      name = "c4cf527ea227edb468a84bf9b8ce996807bd6992.patch";
-      urls = [
-        "https://files.gnupg.net/file/data/2ufcg7ny5jdnv7hmewb4/PHID-FILE-7iwvryn2btti6txr3bsz/file"
-        "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=patch;h=c4cf527ea227edb468a84bf9b8ce996807bd6992"
-      ];
-      sha256 = "0y0b0lb2nq5p9kx13b59b2jaz157mvflliw1qdvg1v1hynvgb8m4";
-    })
+    # probably included in > 1.16.0
+    ./test_t-edit-sign.diff
+    # https://dev.gnupg.org/rMc4cf527ea227edb468a84bf9b8ce996807bd6992
+    ./fix_gpg_list_keys.diff
     # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
     (fetchpatch {
       name = "0001-Fix-python-tests-on-non-Linux.patch";
diff --git a/pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff b/pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff
new file mode 100644
index 000000000000..bd8da4edd6e0
--- /dev/null
+++ b/pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff
@@ -0,0 +1,12 @@
+diff --git a/src/engine-gpg.c b/src/engine-gpg.c
+index b51ea173..4e74665e 100644
+--- a/src/engine-gpg.c
++++ b/src/engine-gpg.c
+@@ -3005,6 +3005,7 @@ gpg_keylist_build_options (engine_gpg_t gpg, int secret_only,
+   gpg_error_t err;
+ 
+   err = add_arg (gpg, "--with-colons");
++  err = add_arg (gpg, "--with-keygrip");
+ 
+   /* Since gpg 2.1.15 fingerprints are always printed, thus there is
+    * no more need to explicitly request them.  */
\ No newline at end of file
diff --git a/pkgs/development/libraries/gpgme/test_t-edit-sign.diff b/pkgs/development/libraries/gpgme/test_t-edit-sign.diff
new file mode 100644
index 000000000000..55075b9eb126
--- /dev/null
+++ b/pkgs/development/libraries/gpgme/test_t-edit-sign.diff
@@ -0,0 +1,125 @@
+From 81a33ea5e1b86d586b956e893a5b25c4cd41c969 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
+Date: Sat, 26 Jun 2021 18:02:47 +0200
+Subject: [PATCH] core: Fix use-after-free issue in test
+
+* tests/gpg/t-edit-sign.c (sign_key, verify_key_signature): New.
+(main): Factored out signing and verifying the result.
+--
+
+Factoring the two steps of the test into different functions fixes the
+use-after-free issue that was caused by accidentaly using a variable
+of the first step in the second step.
+
+GnuPG-bug-id: 5509
+---
+ tests/gpg/t-edit-sign.c | 54 ++++++++++++++++++++++++++++-------------
+ 1 file changed, 37 insertions(+), 17 deletions(-)
+
+diff --git a/tests/gpg/t-edit-sign.c b/tests/gpg/t-edit-sign.c
+index 2f983622..e0494c54 100644
+--- a/tests/gpg/t-edit-sign.c
++++ b/tests/gpg/t-edit-sign.c
+@@ -107,31 +107,19 @@ interact_fnc (void *opaque, const char *status, const char *args, int fd)
+ }
+ 
+ 
+-int
+-main (int argc, char **argv)
++void
++sign_key (const char *key_fpr, const char *signer_fpr)
+ {
+   gpgme_ctx_t ctx;
+   gpgme_error_t err;
+   gpgme_data_t out = NULL;
+-  const char *signer_fpr = "A0FF4590BB6122EDEF6E3C542D727CC768697734"; /* Alpha Test */
+   gpgme_key_t signing_key = NULL;
+-  const char *key_fpr = "D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2"; /* Bravo Test */
+   gpgme_key_t key = NULL;
+-  gpgme_key_t signed_key = NULL;
+-  gpgme_user_id_t signed_uid = NULL;
+-  gpgme_key_sig_t key_sig = NULL;
+   char *agent_info;
+-  int mode;
+-
+-  (void)argc;
+-  (void)argv;
+-
+-  init_gpgme (GPGME_PROTOCOL_OpenPGP);
+ 
+   err = gpgme_new (&ctx);
+   fail_if_err (err);
+ 
+-  /* Sign the key */
+   agent_info = getenv("GPG_AGENT_INFO");
+   if (!(agent_info && strchr (agent_info, ':')))
+     gpgme_set_passphrase_cb (ctx, passphrase_cb, 0);
+@@ -159,8 +147,23 @@ main (int argc, char **argv)
+   gpgme_data_release (out);
+   gpgme_key_unref (key);
+   gpgme_key_unref (signing_key);
++  gpgme_release (ctx);
++}
++
++
++void
++verify_key_signature (const char *key_fpr, const char *signer_keyid)
++{
++  gpgme_ctx_t ctx;
++  gpgme_error_t err;
++  gpgme_key_t signed_key = NULL;
++  gpgme_user_id_t signed_uid = NULL;
++  gpgme_key_sig_t key_sig = NULL;
++  int mode;
++
++  err = gpgme_new (&ctx);
++  fail_if_err (err);
+ 
+-  /* Verify the key signature */
+   mode  = gpgme_get_keylist_mode (ctx);
+   mode |= GPGME_KEYLIST_MODE_SIGS;
+   err = gpgme_set_keylist_mode (ctx, mode);
+@@ -168,7 +171,7 @@ main (int argc, char **argv)
+   err = gpgme_get_key (ctx, key_fpr, &signed_key, 0);
+   fail_if_err (err);
+ 
+-  signed_uid = key->uids;
++  signed_uid = signed_key->uids;
+   if (!signed_uid)
+     {
+       fprintf (stderr, "Signed key has no user IDs\n");
+@@ -180,7 +183,7 @@ main (int argc, char **argv)
+       exit (1);
+     }
+   key_sig = signed_uid->signatures->next;
+-  if (strcmp ("2D727CC768697734", key_sig->keyid))
++  if (strcmp (signer_keyid, key_sig->keyid))
+     {
+       fprintf (stderr, "Unexpected key ID in second user ID sig: %s\n",
+                 key_sig->keyid);
+@@ -196,6 +199,23 @@ main (int argc, char **argv)
+ 
+   gpgme_key_unref (signed_key);
+   gpgme_release (ctx);
++}
++
++
++int
++main (int argc, char **argv)
++{
++  const char *signer_fpr = "A0FF4590BB6122EDEF6E3C542D727CC768697734"; /* Alpha Test */
++  const char *signer_keyid = signer_fpr + strlen(signer_fpr) - 16;
++  const char *key_fpr = "D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2"; /* Bravo Test */
++
++  (void)argc;
++  (void)argv;
++
++  init_gpgme (GPGME_PROTOCOL_OpenPGP);
++
++  sign_key (key_fpr, signer_fpr);
++  verify_key_signature (key_fpr, signer_keyid);
+ 
+   return 0;
+ }
+-- 
+2.32.0
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 3e00050ada2f..1edadf0a51bc 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -107,6 +107,7 @@ stdenv.mkDerivation rec {
     "-Dgl_winsys=${lib.concatStringsSep "," (lib.optional enableX11 "x11" ++ lib.optional enableWayland "wayland" ++ lib.optional enableCocoa "cocoa")}"
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "-Dintrospection=disabled"
+    "-Dtests=disabled"
   ]
   ++ lib.optional (!enableX11) "-Dx11=disabled"
   # TODO How to disable Wayland?
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 01b98d06bf30..7999d62b9112 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -76,12 +76,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./patches/3.0-immodules.cache.patch
-
-    (fetchpatch {
-      name = "Xft-setting-fallback-compute-DPI-properly.patch";
-      url = "https://bug757142.bugzilla-attachments.gnome.org/attachment.cgi?id=344123";
-      sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
-    })
+    ./patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
   ] ++ lib.optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it
diff --git a/pkgs/development/libraries/gtk/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch b/pkgs/development/libraries/gtk/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
new file mode 100644
index 000000000000..247dd3ea8456
--- /dev/null
+++ b/pkgs/development/libraries/gtk/patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
@@ -0,0 +1,34 @@
+From 269f2d80ea41cde17612600841fbdc32e99010f5 Mon Sep 17 00:00:00 2001
+From: Giuseppe Bilotta <giuseppe.bilotta@gmail.com>
+Date: Tue, 24 Jan 2017 12:30:08 +0100
+Subject: [PATCH] Xft setting fallback: compute DPI properly
+
+This is a partial revert of bdf0820c501437a2150d8ff0d5340246e713f73f. If
+the Xft DPI settings are not explicitly set, use the values provided by
+the X server rather than hard-coding the fallback value of 96.
+
+While an auto-configured Xorg already reports 96, this value can be
+overriden by the user, and we should respect the user choice in this
+case. There is no need to require them to set the same value in
+different places (the Xorg DPI settings and Xft.dpi).
+---
+ gdk/x11/gdkxftdefaults.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/gdk/x11/gdkxftdefaults.c b/gdk/x11/gdkxftdefaults.c
+index fa1cfde2ec..c462b78c4b 100644
+--- a/gdk/x11/gdkxftdefaults.c
++++ b/gdk/x11/gdkxftdefaults.c
+@@ -174,7 +174,8 @@ init_xft_settings (GdkScreen *screen)
+     x11_screen->xft_rgba = FC_RGBA_UNKNOWN;
+ 
+   if (!get_double_default (xdisplay, "dpi", &dpi_double))
+-    dpi_double = 96.0;
++    dpi_double = (DisplayHeight(xdisplay, x11_screen->screen_num)*25.4)/
++		    DisplayHeightMM(xdisplay, x11_screen->screen_num);
+ 
+   x11_screen->xft_dpi = (int)(0.5 + PANGO_SCALE * dpi_double);
+ }
+-- 
+2.11.0.616.gd72966cf44.dirty
+
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 4a78f3c5e51d..83bfffe6b975 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # CPU detection isn't supported on Darwin and breaks the aarch64-darwin build:
     "-DCONFIG_RUNTIME_CPU_DETECT=0"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "-DAS_EXECUTABLE=${stdenv.cc.targetPrefix}as"
   ];
 
   postFixup = ''
diff --git a/pkgs/development/libraries/libbfd/default.nix b/pkgs/development/libraries/libbfd/default.nix
index 499f04349b5d..1e2938d3a8e0 100644
--- a/pkgs/development/libraries/libbfd/default.nix
+++ b/pkgs/development/libraries/libbfd/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation {
   # We update these ourselves
   dontUpdateAutotoolsGnuConfigScripts = true;
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook bison ];
   buildInputs = [ libiberty zlib.dev ];
 
@@ -37,9 +38,8 @@ stdenv.mkDerivation {
   configureFlags = [
     "--enable-targets=all" "--enable-64-bit-bfd"
     "--enable-install-libbfd"
-    "--enable-shared"
     "--with-system-zlib"
-  ];
+  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 8f1511de3304..375154ea46ad 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -1,14 +1,10 @@
-{ lib, stdenv, fetchFromGitLab, pkg-config, meson, ninja
+{ lib, stdenv, fetchurl, pkg-config, meson, ninja
 , libevdev, mtdev, udev, libwacom
-, documentationSupport ? false, doxygen ? null, graphviz ? null # Documentation
-, eventGUISupport ? false, cairo ? null, glib ? null, gtk3 ? null # GUI event viewer support
-, testsSupport ? false, check ? null, valgrind ? null, python3 ? null
+, documentationSupport ? false, doxygen, graphviz # Documentation
+, eventGUISupport ? false, cairo, glib, gtk3 # GUI event viewer support
+, testsSupport ? false, check, valgrind, python3
 }:
 
-assert documentationSupport -> doxygen != null && graphviz != null && python3 != null;
-assert eventGUISupport -> cairo != null && glib != null && gtk3 != null;
-assert testsSupport -> check != null && valgrind != null && python3 != null;
-
 let
   mkFlag = optSet: flag: "-D${flag}=${lib.boolToString optSet}";
 
@@ -24,17 +20,13 @@ let
   else null;
 in
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.16.4";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.freedesktop.org";
-    owner = pname;
-    repo = pname;
-    rev = version;
-    sha256 = "1c81429kh9av9fanxmnjw5rvsjbzcyi7d0dx0gkyq5yysmpmrppi";
+  version = "1.18.1";
+
+  src = fetchurl {
+    url = "https://www.freedesktop.org/software/libinput/libinput-${version}.tar.xz";
+    sha256 = "1jx7y48ym89grjz67jmn80h5j8c36qgwb0h5c703nln2zchl18cw";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -48,7 +40,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkg-config meson ninja ]
-    ++ optionals documentationSupport [ doxygen graphviz sphinx-build ];
+    ++ lib.optionals documentationSupport [ doxygen graphviz sphinx-build ];
 
   buildInputs = [
     libevdev
@@ -60,8 +52,7 @@ stdenv.mkDerivation rec {
       pyyaml
       setuptools
     ]))
-  ]
-    ++ optionals eventGUISupport [ cairo glib gtk3 ];
+  ] ++ lib.optionals eventGUISupport [ cairo glib gtk3 ];
 
   checkInputs = [
     check
@@ -73,15 +64,19 @@ stdenv.mkDerivation rec {
   patches = [ ./udev-absolute-path.patch ];
 
   postPatch = ''
-    patchShebangs tools/helper-copy-and-exec-from-tmp.sh
-    patchShebangs test/symbols-leak-test
-    patchShebangs test/check-leftover-udev-rules.sh
-    patchShebangs test/helper-copy-and-exec-from-tmp.sh
+    patchShebangs \
+      tools/helper-copy-and-exec-from-tmp.sh \
+      test/symbols-leak-test \
+      test/check-leftover-udev-rules.sh \
+      test/helper-copy-and-exec-from-tmp.sh
+
+    # Don't create an empty /etc directory.
+    sed -i "/install_subdir('libinput', install_dir : dir_etc)/d" meson.build
   '';
 
   doCheck = testsSupport && stdenv.hostPlatform == stdenv.buildPlatform;
 
-  meta = {
+  meta = with lib; {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
     homepage    = "https://www.freedesktop.org/wiki/Software/libinput/";
     license     = licenses.mit;
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 43a88f9dd5fb..83950e982583 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -1,21 +1,21 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , pkg-config
 , glib
 , python3
 , systemd
-, libgudev
 , withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.24.8";
+  version = "1.26.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "sha256-AlkHNhY//xDlcyGR/MwbmSCWlhbdxZYToAMFKhFqPCU=";
+    sha256 = "1kqkx139z62w391bz6lwmcjg7v12jxlcm7hj88222xrcn8k0j7qy";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -33,7 +33,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
-    libgudev
     systemd
   ];
 
@@ -43,6 +42,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.freedesktop.org/wiki/Software/libmbim/";
     description = "Library for talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 157445cfee82..196b9d3ad521 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.28.6";
+  version = "1.28.8";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "1zg5k8f6l87iy9hmzwckdx532s845z9c5npblmpf1pp17n4r1f6b";
+    sha256 = "sha256-bju70gC8G2SyP2JU/vkhLyaZ7HfPsyB10rpQecc6n3g=";
   };
 
   nativeBuildInputs = [
@@ -64,5 +64,6 @@ stdenv.mkDerivation rec {
       # Tools
       gpl2Plus
     ];
+    changelog = "https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/blob/${version}/NEWS";
   };
 }
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index 61e6d9cd7652..dbe108f586f4 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsndfile";
-  version = "1.0.30";
+  version = "1.0.31";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1rh79y4s4m2wcm2kahmzs2kijpdpayif2gyca6m71f3k7jbhgcwa";
+    rev = version;
+    sha256 = "1alba3iv8i7i2jb5fd6q5s7j9bcj48sf28nfjd3qigz2n2is5jl2";
   };
 
   nativeBuildInputs = [ autoreconfHook autogen pkg-config python3 ];
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 5bb6445ac38f..0d7caf8ba5c4 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "1.10";
+  version = "1.11";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "sha256-Q7b54AMAxdIzN7TUuhIdlrXaVtj2szV4n3y9bAE0LsU=";
+    sha256 = "sha256-HDBWycdZf/pUL7ZzCuF55tfby3GW0WW6Vq3htPWT1v4=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja doxygen python3 ];
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 1b58b4539e46..c98a1cbce0e9 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -2,7 +2,7 @@
 , zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
-, enableShared ? stdenv.hostPlatform.libc != "msvcrt"
+, enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
 , enableStatic ? !enableShared
 }:
 
@@ -40,6 +40,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
 
+  strictDeps = true;
+
   buildInputs = lib.optional pythonSupport python
     ++ lib.optional (pythonSupport && python?isPy2 && python.isPy2) gettext
     ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses
diff --git a/pkgs/development/libraries/lzo/default.nix b/pkgs/development/libraries/lzo/default.nix
index f5b0111a1a78..480e2bb909cd 100644
--- a/pkgs/development/libraries/lzo/default.nix
+++ b/pkgs/development/libraries/lzo/default.nix
@@ -9,12 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "0wm04519pd3g8hqpjqhfr72q8qmbiwqaxcs3cndny9h86aa95y60";
   };
 
-  configureFlags = [ "--enable-shared" ];
+  configureFlags = lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared" ;
 
   enableParallelBuilding = true;
 
   doCheck = true; # not cross;
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "Real-time data (de)compression library";
     longDescription = ''
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index f8724703f049..948de303cefa 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, cmake
 , SDL
 , ffmpeg
 , frei0r
@@ -26,13 +27,13 @@
 
 mkDerivation rec {
   pname = "mlt";
-  version = "6.24.0";
+  version = "7.0.1";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     rev = "v${version}";
-    sha256 = "1my43ica2qax2622307dv4gn3w8hkchy643i9pq8r9yh2hd4pvs9";
+    sha256 = "13c5miph9jjbz69dhy0zvbkk5zbb05dr3vraaci0d5fdbrlhyscf";
   };
 
   buildInputs = [
@@ -56,42 +57,15 @@ mkDerivation rec {
     ladspaPlugins
   ];
 
-  nativeBuildInputs = [ which ];
+  nativeBuildInputs = [ cmake which ];
 
   outputs = [ "out" "dev" ];
 
-  # Mostly taken from:
-  # http://www.kdenlive.org/user-manual/downloading-and-installing-kdenlive/installing-source/installing-mlt-rendering-engine
-  configureFlags = [
-    "--avformat-swscale"
-    "--enable-gpl"
-    "--enable-gpl3"
-    "--enable-opengl"
-  ];
-
-  # mlt is unable to cope with our multi-prefix Qt build
-  # because it does not use CMake or qmake.
-  NIX_CFLAGS_COMPILE = "-I${lib.getDev qtsvg}/include/QtSvg";
-
-  CXXFLAGS = "-std=c++11";
-
   qtWrapperArgs = [
     "--prefix FREI0R_PATH : ${frei0r}/lib/frei0r-1"
     "--prefix LADSPA_PATH : ${ladspaPlugins}/lib/ladspa"
   ];
 
-  postInstall = ''
-    # Remove an unnecessary reference to movit.dev.
-    s=${movit.dev}/include
-    t=$(for ((i = 0; i < ''${#s}; i++)); do echo -n X; done)
-    sed -i $out/lib/mlt/libmltopengl.so -e "s|$s|$t|g"
-
-    # Remove an unnecessary reference to movit.dev.
-    s=${qtbase.dev}/include
-    t=$(for ((i = 0; i < ''${#s}; i++)); do echo -n X; done)
-    sed -i $out/lib/mlt/libmltqt.so -e "s|$s|$t|g"
-  '';
-
   passthru = {
     inherit ffmpeg;
   };
diff --git a/pkgs/development/libraries/newt/default.nix b/pkgs/development/libraries/newt/default.nix
index dc6b604bd8e2..7b5316b144a2 100644
--- a/pkgs/development/libraries/newt/default.nix
+++ b/pkgs/development/libraries/newt/default.nix
@@ -12,16 +12,21 @@ stdenv.mkDerivation rec {
     sha256 = "0cdvbancr7y4nrj8257y5n45hmhizr8isynagy4fpsnpammv8pi6";
   };
 
-  patchPhase = ''
+  postPatch = ''
     sed -i -e s,/usr/bin/install,install, -e s,-I/usr/include/slang,, Makefile.in po/Makefile
 
     substituteInPlace configure \
       --replace "/usr/include/python" "${pythonIncludePath}"
     substituteInPlace configure.ac \
       --replace "/usr/include/python" "${pythonIncludePath}"
+
+    substituteInPlace Makefile.in \
+      --replace "ar rv" "${stdenv.cc.targetPrefix}ar rv"
   '';
 
-  buildInputs = [ slang popt python ];
+  strictDeps = true;
+  nativeBuildInputs = [ python ];
+  buildInputs = [ slang popt ];
 
   NIX_LDFLAGS = "-lncurses";
 
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index 2d469a406dec..d28f7b25792e 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -1,45 +1,39 @@
 { lib, stdenv, fetchFromGitHub, cmake
-, alsaSupport ? !stdenv.isDarwin, alsa-lib ? null
-, pulseSupport ? !stdenv.isDarwin, libpulseaudio ? null
+, alsaSupport ? !stdenv.isDarwin, alsa-lib
+, pulseSupport ? !stdenv.isDarwin, libpulseaudio
 , CoreServices, AudioUnit, AudioToolbox
 }:
 
-with lib;
-
-assert alsaSupport -> alsa-lib != null;
-assert pulseSupport -> libpulseaudio != null;
-
 stdenv.mkDerivation rec {
-  version = "1.19.1";
   pname = "openal-soft";
+  version = "1.21.1";
 
   src = fetchFromGitHub {
     owner = "kcat";
     repo = "openal-soft";
-    rev = "${pname}-${version}";
-    sha256 = "0b0g0q1c36nfb289xcaaj3cmyfpiswvvgky3qyalsf9n4dj7vnzi";
+    rev = version;
+    sha256 = "sha256-rgc6kjXaZb6sCR+e9Gu7BEEHIiCHMygpLIeSqgWkuAg=";
   };
 
   # this will make it find its own data files (e.g. HRTF profiles)
   # without any other configuration
   patches = [ ./search-out.patch ];
   postPatch = ''
-    substituteInPlace Alc/helpers.c \
+    substituteInPlace alc/helpers.cpp \
       --replace "@OUT@" $out
   '';
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = []
-    ++ optional alsaSupport alsa-lib
-    ++ optional pulseSupport libpulseaudio
-    ++ optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
+  buildInputs = lib.optional alsaSupport alsa-lib
+    ++ lib.optional pulseSupport libpulseaudio
+    ++ lib.optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
 
-  NIX_LDFLAGS = toString ([]
-    ++ optional alsaSupport "-lasound"
-    ++ optional pulseSupport "-lpulse");
+  NIX_LDFLAGS = toString (
+    lib.optional alsaSupport "-lasound"
+    ++ lib.optional pulseSupport "-lpulse");
 
-  meta = {
+  meta = with lib; {
     description = "OpenAL alternative";
     homepage = "https://kcat.strangesoft.net/openal.html";
     license = licenses.lgpl2;
diff --git a/pkgs/development/libraries/openal-soft/search-out.patch b/pkgs/development/libraries/openal-soft/search-out.patch
index 0f9c2abad3c3..796642aa3c89 100644
--- a/pkgs/development/libraries/openal-soft/search-out.patch
+++ b/pkgs/development/libraries/openal-soft/search-out.patch
@@ -1,12 +1,12 @@
-diff -Nuar a/Alc/helpers.c b/Alc/helpers.c
---- a/Alc/helpers.c	1970-01-01 00:00:01.000000000 +0000
-+++ b/Alc/helpers.c	1970-01-01 00:00:02.000000000 +0000
-@@ -951,6 +951,8 @@
-             }
-         }
+diff --git a/alc/helpers.cpp b/alc/helpers.cpp
+index 8c1c856..19bbc0f 100644
+--- a/alc/helpers.cpp
++++ b/alc/helpers.cpp
+@@ -402,6 +402,7 @@ al::vector<std::string> SearchDataFiles(const char *ext, const char *subdir)
  
-+        DirectorySearch("@OUT@/share", ext, &results);
-+
-         alstr_reset(&path);
+         DirectorySearch(path.c_str(), ext, &results);
      }
++    DirectorySearch("@OUT@/share/", ext, &results);
  
+     return results;
+ }
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 5d3c3f40f1d4..bf7eb3d0d38c 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, which
+{ lib, stdenv, fetchFromGitHub, perl, which
 # Most packages depending on openblas expect integer width to match
 # pointer width, but some expect to use 32-bit integers always
 # (for compatibility with reference BLAS).
@@ -129,7 +129,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.15";
+  version = "0.3.17";
 
   outputs = [ "out" "dev" ];
 
@@ -137,23 +137,9 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "1qjr02cqncv20abdp1yzr55n7smhx6h9chqvb0xbp18byynvj87w";
+    sha256 = "11j103s851mml6kns781kha0asxjz6b6s1vbv80aq3b6g7p05pms";
   };
 
-  # remove both patches when updating to 0.3.16
-  patches = [
-    (fetchpatch {
-      name = "riscv64-imin-fix-wrong-comparison.patch";
-      url = "https://github.com/xianyi/OpenBLAS/commit/1e0192a5ccac28fc0c749f49d36ec7eda9757428.patch";
-      sha256 = "0kjkmrj8023vcjxhgin5dqs5w3gf93hzhwdhg0vsjhdra2ghkwzj";
-    })
-    (fetchpatch {
-      name = "riscv64-generic-use-generic-kernel-for-dsdot.patch";
-      url = "https://github.com/xianyi/OpenBLAS/commit/3521cd48cbfb3d50f6ae9a10377382d37075c696.patch";
-      sha256 = "0ljwbldff4db377s8rzmqxrszilqdivy656yqvfq46x5338v3gi0";
-    })
-  ];
-
   inherit blas64;
 
   # Some hardening features are disabled due to sporadic failures in
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index b047d6870746..f0ecab9d1274 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -5,6 +5,7 @@
 , freetype
 , cmake
 , static ? stdenv.hostPlatform.isStatic
+, libgcc
 }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +19,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config cmake ];
-  buildInputs = [ freetype ];
+  buildInputs = [ freetype ]
+    ++ lib.optionals (!stdenv.cc.isGNU) [ libgcc ];
 
   patches = lib.optionals stdenv.isDarwin [ ./macosx.patch ];
 
diff --git a/pkgs/development/libraries/srtp/default.nix b/pkgs/development/libraries/srtp/default.nix
index 0dbfef2c6394..8bf6c6d11d5a 100644
--- a/pkgs/development/libraries/srtp/default.nix
+++ b/pkgs/development/libraries/srtp/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config
-, openssl ? null, libpcap ? null
+, openssl, libpcap, cmake
 }:
 
 with lib;
@@ -16,21 +16,26 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config cmake ];
 
   # libsrtp.pc references -lcrypto -lpcap without -L
   propagatedBuildInputs = [ openssl libpcap ];
 
-  configureFlags = [
-    "--disable-debug"
-  ] ++ optional (openssl != null) "--enable-openssl";
-
-  buildFlags = [ "shared_library" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DENABLE_OPENSSL=ON"
+    "-DBUILD_TESTING=ON"
+  ];
 
   postInstall = ''
     rm -rf $out/bin
   '';
 
+  doCheck = true;
+  preCheck = ''
+    export LD_PRELOAD=./libsrtp2.so
+  '';
+
   meta = {
     homepage = "https://github.com/cisco/libsrtp";
     description = "Secure RTP (SRTP) Reference Implementation";
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index a9fadf46c4b2..8d7cb3a48c88 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -57,11 +57,13 @@ stdenv.mkDerivation (rec {
   # and giving nothing builds both.
   # So we have 3 possible ways to build both:
   # `--static --shared`, `--shared` and giving nothing.
-  # Of these, we choose `--shared`, only because that's
-  # what we did in the past and we can avoid mass rebuilds this way.
-  # As a result, we pass `--static` only when we want just static.
-  configureFlags = lib.optional (static && !shared) "--static"
+  # Of these, we choose `--static --shared`, for clarity and simpler
+  # conditions.
+  configureFlags = lib.optional static "--static"
                    ++ lib.optional shared "--shared";
+  # We do the right thing manually, above, so don't need these.
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
 
   # Note we don't need to set `dontDisableStatic`, because static-disabling
   # works by grepping for `enable-static` in the `./configure` script
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 5981b2d7683f..6092e8f13c25 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -113,6 +113,7 @@
 , "git-ssb"
 , "git-standup"
 , "gitmoji-cli"
+, "glob"
 , "graphql-cli"
 , "grunt-cli"
 , "makam"
@@ -161,6 +162,7 @@
 , "less-plugin-clean-css"
 , "live-server"
 , "livedown"
+, "lodash"
 , {"lumo-build-deps": "../interpreters/clojurescript/lumo" }
 , "madoko"
 , "markdownlint-cli"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 1c5f7dd8f61d..5e9fa75e4ea0 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -6853,13 +6853,13 @@ let
         sha512 = "8nbbyD3zABRA9ePoBgAl2ym8cIwKQXTfv1gaIRTdY99yEOCaHfmjBeRp+BIemS8NtOqoWK7mfzWxjNrxLK3T5w==";
       };
     };
-    "@types/hast-2.3.2" = {
+    "@types/hast-2.3.3" = {
       name = "_at_types_slash_hast";
       packageName = "@types/hast";
-      version = "2.3.2";
+      version = "2.3.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/hast/-/hast-2.3.2.tgz";
-        sha512 = "Op5W7jYgZI7AWKY5wQ0/QNMzQM7dGQPyW1rXKNiymVCy5iTfdPuGu4HhYNOM2sIv8gUfIuIdcYlXmAepwaowow==";
+        url = "https://registry.npmjs.org/@types/hast/-/hast-2.3.3.tgz";
+        sha512 = "QmFclP7FX/XZ7k81+fS6K5pQ3qxRu9bVqEoUeJrPtcmX9st3pyeluIWy6olFCr2/kUqnb4LwxtMCxZsXWkObbA==";
       };
     };
     "@types/hls.js-0.13.1" = {
@@ -7132,13 +7132,13 @@ let
         sha512 = "559S2XW9YMwHznROJ4WFhZJOerJPuxLfqOX+LIKukyLo2NbVgpULwXUsrBlCwhZ4+ACHgVAE23CC3RS52lFxwA==";
       };
     };
-    "@types/mdast-3.0.8" = {
+    "@types/mdast-3.0.9" = {
       name = "_at_types_slash_mdast";
       packageName = "@types/mdast";
-      version = "3.0.8";
+      version = "3.0.9";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/mdast/-/mdast-3.0.8.tgz";
-        sha512 = "HdUXWDNtDenuVJFrV2xBCLEMiw1Vn7FMuJxqJC5oBvC2adA3pgtp6CPCIMQdz3pmWxGuJjT+hOp6FnOXy6dXoQ==";
+        url = "https://registry.npmjs.org/@types/mdast/-/mdast-3.0.9.tgz";
+        sha512 = "IUlIhG2KNPjOEuXIblTjovD1XW8HPGeulA12nEyc6xhO4Yrrcs+xczAl4ucR3cpwVlE+vb2x9Z7pRmVP4bUHng==";
       };
     };
     "@types/mime-1.3.2" = {
@@ -7285,13 +7285,13 @@ let
         sha512 = "oTQgnd0hblfLsJ6BvJzzSL+Inogp3lq9fGgqRkMB/ziKMgEUaFl801OncOzUmalfzt14N0oPHMK47ipl+wbTIw==";
       };
     };
-    "@types/node-14.17.10" = {
+    "@types/node-14.17.11" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "14.17.10";
+      version = "14.17.11";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-14.17.10.tgz";
-        sha512 = "09x2d6kNBwjHgyh3jOUE2GE4DFoxDriDvWdu6mFhMP1ysynGYazt4ecZmJlL6/fe4Zi2vtYvTvtL7epjQQrBhA==";
+        url = "https://registry.npmjs.org/@types/node/-/node-14.17.11.tgz";
+        sha512 = "n2OQ+0Bz6WEsUjrvcHD1xZ8K+Kgo4cn9/w94s1bJS690QMUWfJPW/m7CCb7gPkA1fcYwL2UpjXP/rq/Eo41m6w==";
       };
     };
     "@types/node-15.12.5" = {
@@ -7303,13 +7303,13 @@ let
         sha512 = "se3yX7UHv5Bscf8f1ERKvQOD6sTyycH3hdaoozvaLxgUiY5lIGEeH37AD0G0Qi9kPqihPn0HOfd2yaIEN9VwEg==";
       };
     };
-    "@types/node-15.14.8" = {
+    "@types/node-15.14.9" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "15.14.8";
+      version = "15.14.9";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-15.14.8.tgz";
-        sha512 = "+ZjmmoGV7WBwhzNh/GkwehB7uyXn9HFwzQUfj9pbyR8eFAq20Qguoh93sPbWzzhsbhTme6YE92/iJ54Z0WRH7A==";
+        url = "https://registry.npmjs.org/@types/node/-/node-15.14.9.tgz";
+        sha512 = "qjd88DrCxupx/kJD5yQgZdcYKZKSIGBVDIBE1/LTGcNm3d2Np/jxojkdePDdfnBHJc5W7vSMpbJ1aB7p/Py69A==";
       };
     };
     "@types/node-15.6.1" = {
@@ -7348,22 +7348,13 @@ let
         sha512 = "Sr7BhXEAer9xyGuCN3Ek9eg9xPviCF2gfu9kTfuU2HkTVAMYSDeX40fvpmo72n5nansg3nsBjuQBrsS28r+NUw==";
       };
     };
-    "@types/node-16.6.2" = {
-      name = "_at_types_slash_node";
-      packageName = "@types/node";
-      version = "16.6.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-16.6.2.tgz";
-        sha512 = "LSw8TZt12ZudbpHc6EkIyDM3nHVWKYrAvGy6EAJfNfjusbwnThqjqxUKKRwuV3iWYeW/LYMzNgaq3MaLffQ2xA==";
-      };
-    };
-    "@types/node-16.7.0" = {
+    "@types/node-16.7.1" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "16.7.0";
+      version = "16.7.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-16.7.0.tgz";
-        sha512 = "e66BrnjWQ3BRBZ2+iA5e85fcH9GLNe4S0n1H0T3OalK2sXg5XWEFTO4xvmGrYQ3edy+q6fdOh5t0/HOY8OAqBg==";
+        url = "https://registry.npmjs.org/@types/node/-/node-16.7.1.tgz";
+        sha512 = "ncRdc45SoYJ2H4eWU9ReDfp3vtFqDYhjOsKlFFUDEn8V1Bgr2RjYal8YT5byfadWIRluhPFU6JiDOl0H6Sl87A==";
       };
     };
     "@types/node-6.14.13" = {
@@ -11731,15 +11722,6 @@ let
         sha512 = "tbMZ/Y2rRo6R6TTBODJXTiil+MXaoT6Qzotws3yvI1IWGpYxKo7N/3L06XB8ul8tCG0TigxIOY70SMICM70Ppg==";
       };
     };
-    "aws-sdk-2.972.0" = {
-      name = "aws-sdk";
-      packageName = "aws-sdk";
-      version = "2.972.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.972.0.tgz";
-        sha512 = "oRRjz68Yej/wz5JLc41zeG1m7QCvSj+Y2IOFqDflgwpDy4/M7Lp5HmCK2IK0d62FsKvG63b/9JL6+60ybGcsow==";
-      };
-    };
     "aws-sdk-2.973.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
@@ -15332,13 +15314,13 @@ let
         sha512 = "U7esrJ2aQ89ACJY8TD0UWgP0dC30V+vy5ZZ8zSiHJyM5JL4N61pLWXDlrKAhpI3rFlrZn6h8YefkQJRM5aC2gw==";
       };
     };
-    "cdk8s-plus-17-1.0.0-beta.52" = {
+    "cdk8s-plus-17-1.0.0-beta.53" = {
       name = "cdk8s-plus-17";
       packageName = "cdk8s-plus-17";
-      version = "1.0.0-beta.52";
+      version = "1.0.0-beta.53";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s-plus-17/-/cdk8s-plus-17-1.0.0-beta.52.tgz";
-        sha512 = "SGYJinLrJMk5DFVg3a0KsW0cahUGeyJvN5fRFfx7ZmdDjdcOPBRwCj08fGP2ont7xvNkFEgHopNfImOkFbd7fw==";
+        url = "https://registry.npmjs.org/cdk8s-plus-17/-/cdk8s-plus-17-1.0.0-beta.53.tgz";
+        sha512 = "y7S90dym7QyEhCwXccA8Dt8mupCfHi/7RHnkAcRo1cJLeRxYnoi3OTzGqKTDSakxwKmc69cieEdTLs/Mq9JXsA==";
       };
     };
     "cdktf-0.5.0" = {
@@ -17906,13 +17888,13 @@ let
         sha1 = "c20b96d8c617748aaf1c16021760cd27fcb8cb75";
       };
     };
-    "constructs-3.3.128" = {
+    "constructs-3.3.129" = {
       name = "constructs";
       packageName = "constructs";
-      version = "3.3.128";
+      version = "3.3.129";
       src = fetchurl {
-        url = "https://registry.npmjs.org/constructs/-/constructs-3.3.128.tgz";
-        sha512 = "rTU6aYZf0EZHpoMQ4mU23zZQAVYwmBPC/78w75diEmBs9DN4VSQ2tXm2um4OwpPUCu5jLMkhcdsRwdFpAlQdxQ==";
+        url = "https://registry.npmjs.org/constructs/-/constructs-3.3.129.tgz";
+        sha512 = "XSQ/TTinb25oA8KxlPXbAIo3SnkIRdgl6lX8qTze2cKrxdTtmjgaapO7fdv7bVj+Sd0v5ld9dE2K8P+j3b8z/g==";
       };
     };
     "consume-http-header-1.0.0" = {
@@ -23037,15 +23019,6 @@ let
         sha512 = "1sQ1DRtQGpglFhc3urD4olMJzt/wxlbnAAsf+WY2xHf5c50ZovivZvCXSpVgTOP9f4TzOMvelWyspyfhxQKHzQ==";
       };
     };
-    "electron-to-chromium-1.3.813" = {
-      name = "electron-to-chromium";
-      packageName = "electron-to-chromium";
-      version = "1.3.813";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.813.tgz";
-        sha512 = "YcSRImHt6JZZ2sSuQ4Bzajtk98igQ0iKkksqlzZLzbh4p0OIyJRSvUbsgqfcR8txdfsoYCc4ym306t4p2kP/aw==";
-      };
-    };
     "electron-to-chromium-1.3.814" = {
       name = "electron-to-chromium";
       packageName = "electron-to-chromium";
@@ -34633,13 +34606,13 @@ let
         sha512 = "cUhDs2V2wYg7LFgm/X/uken8oF9re3vRORD08s0+z9Re8tt0pEehKmCotx3HYFhYrRhCEVvm66xjQt0t62GzXg==";
       };
     };
-    "jsii-srcmak-0.1.329" = {
+    "jsii-srcmak-0.1.330" = {
       name = "jsii-srcmak";
       packageName = "jsii-srcmak";
-      version = "0.1.329";
+      version = "0.1.330";
       src = fetchurl {
-        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.329.tgz";
-        sha512 = "H4Sw8Ek33JeP7cHHAe6m4BZivwRqW6rq8X/IMleaLpzK9QAiJykf7wYV4+TSpeBUpdoipshFcnefzXtNny8iwA==";
+        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.330.tgz";
+        sha512 = "Bj0MGezO6cHra9hxpW1/4k2H/wH7WnvpOSOvC50uThnMCvpPmmVdl8UyNtw9YPk0iJRb/5/CTEn9BIwib7dMjg==";
       };
     };
     "json-bigint-1.0.0" = {
@@ -34939,13 +34912,13 @@ let
         sha512 = "0/4Lv6IenJV0qj2oBdgPIAmFiKKnh8qh7bmLFJ+/ZZHLjSeiL3fKKGX3UryvKPbxFbhV+JcYo9KUC19GJ/Z/4A==";
       };
     };
-    "json2jsii-0.2.1" = {
+    "json2jsii-0.2.2" = {
       name = "json2jsii";
       packageName = "json2jsii";
-      version = "0.2.1";
+      version = "0.2.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/json2jsii/-/json2jsii-0.2.1.tgz";
-        sha512 = "e7440eXg2IgXd/C/clf9+ttc/DGoUTrOUErumLKaalc4oVi9S6yDyd7sWS3cxoUBtq8+USCON2OTyDHII6x60g==";
+        url = "https://registry.npmjs.org/json2jsii/-/json2jsii-0.2.2.tgz";
+        sha512 = "hFtcsJOD59znja0YMY8aNzefV9pq9JyIuzbEzVAWbzpS1+a0xmg6vTd92W62ZSze6U2mwx5yPkvjTvFyEbMXmg==";
       };
     };
     "json3-3.2.6" = {
@@ -50136,13 +50109,13 @@ let
         sha1 = "15931d3cd967ade52206f523aa7331aef7d43af7";
       };
     };
-    "pyright-1.1.162" = {
+    "pyright-1.1.163" = {
       name = "pyright";
       packageName = "pyright";
-      version = "1.1.162";
+      version = "1.1.163";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pyright/-/pyright-1.1.162.tgz";
-        sha512 = "3YEM8rf/39CtuHMzZmVjsV/2cJJB6N3RfCuNR5QgUeib0VRQ303zhb4jh5RRRF9P6JpZku/waX+i16TrfSqDEQ==";
+        url = "https://registry.npmjs.org/pyright/-/pyright-1.1.163.tgz";
+        sha512 = "CU0WPzr+6ZKIqCqqVrOtxMFWdzdOV18zKmC7dVBzp3snuun8JafnnmUzNJpO8IJLN/bQNSLb3riLtXFM/8Xxbg==";
       };
     };
     "q-0.9.7" = {
@@ -57354,13 +57327,13 @@ let
         sha512 = "zZ/Q1M+9ZWlrchgh4QauD/MEUFa6eC6H6FYq6T8Of/y82JqsQBLwN6YlzbO09evE7Rx6x0oliXDCnQSjwGwQRA==";
       };
     };
-    "sscaff-1.2.50" = {
+    "sscaff-1.2.51" = {
       name = "sscaff";
       packageName = "sscaff";
-      version = "1.2.50";
+      version = "1.2.51";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.50.tgz";
-        sha512 = "uEcxq341buXVnoWpzwHahKuTw4WkauXv+TFZMY2ljjlKQMRoaJm1rgsSFJEDe1w53pL+qgvFUziV/zKmbA1P5g==";
+        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.51.tgz";
+        sha512 = "JhqvBcuiCOE9n5sK1IIl7AOvNiFEL3he3HJw8d3RfJ71HEZpuIYc0JMmPLbrrbbryxb++LuQW69oBp7R3n1/qA==";
       };
     };
     "ssh-config-1.1.6" = {
@@ -67762,22 +67735,22 @@ let
         sha512 = "9Ni+uXWeFix9+1t7s1q40zZdbcpdi/OwgD4N4cVaqI+bppPciOOXQ/RSggannwZu8m8zrSWELn6/93G7308jgg==";
       };
     };
-    "yeoman-environment-3.5.1" = {
+    "yeoman-environment-3.6.0" = {
       name = "yeoman-environment";
       packageName = "yeoman-environment";
-      version = "3.5.1";
+      version = "3.6.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/yeoman-environment/-/yeoman-environment-3.5.1.tgz";
-        sha512 = "XIJoCQDNlttjFubWL+tpf+t1MkFUdsqwtJvR2qhfzhHi8Z7ZzAwiBPgCtTiLK1mwPTfqzV/V0E9l7zX7hrhBdg==";
+        url = "https://registry.npmjs.org/yeoman-environment/-/yeoman-environment-3.6.0.tgz";
+        sha512 = "X16N9lhzRdUKFT8MZrpwjLDKsdgAUqh4VPR2wAXeAqjJJaUxYBxCQGFxtZVTf3vbyNuIHXPunwOLtK60bpapbg==";
       };
     };
-    "yeoman-generator-5.4.1" = {
+    "yeoman-generator-5.4.2" = {
       name = "yeoman-generator";
       packageName = "yeoman-generator";
-      version = "5.4.1";
+      version = "5.4.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/yeoman-generator/-/yeoman-generator-5.4.1.tgz";
-        sha512 = "ZlO++ByvxiapJo3TZy1/Bx5S2LRnNoQ7IMnJRjMtP6bWP1BldfoPMJAP4PztQOc6okufBFDUVR9Yjt6MB2G9YA==";
+        url = "https://registry.npmjs.org/yeoman-generator/-/yeoman-generator-5.4.2.tgz";
+        sha512 = "xgS3A4r5VoEYq3vPdk1fWPVZ30y5NHlT2hn0OEyhKG79xojCtPkPkfWcKQamgvC9QLhaotVGvambBxwxwBeDTg==";
       };
     };
     "yesno-0.3.1" = {
@@ -68749,7 +68722,7 @@ in
       sources."@hyperswarm/hypersign-2.1.1"
       sources."@hyperswarm/network-2.1.0"
       sources."@leichtgewicht/ip-codec-2.0.3"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."abstract-extension-3.1.1"
       sources."abstract-leveldown-6.2.3"
       sources."ansi-colors-3.2.3"
@@ -69283,7 +69256,7 @@ in
       sources."@types/eslint-scope-3.7.1"
       sources."@types/estree-0.0.50"
       sources."@types/json-schema-7.0.9"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/parse-json-4.0.0"
       sources."@webassemblyjs/ast-1.11.1"
       sources."@webassemblyjs/floating-point-hex-parser-1.11.1"
@@ -69349,7 +69322,7 @@ in
       sources."cross-spawn-7.0.3"
       sources."deepmerge-4.2.2"
       sources."defaults-1.0.3"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-8.0.0"
       sources."end-of-stream-1.4.4"
       (sources."enhanced-resolve-5.8.2" // {
@@ -69815,7 +69788,7 @@ in
       sources."@types/long-4.0.1"
       sources."@types/mime-1.3.2"
       sources."@types/minimatch-3.0.5"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/qs-6.9.7"
       sources."@types/range-parser-1.2.4"
@@ -70086,7 +70059,7 @@ in
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
       sources."ejs-2.7.4"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-7.0.3"
       sources."encodeurl-1.0.2"
       sources."end-of-stream-1.4.4"
@@ -71110,7 +71083,7 @@ in
       sources."convert-source-map-1.8.0"
       sources."debug-4.3.2"
       sources."ejs-3.1.6"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."ensure-posix-path-1.1.1"
       sources."escalade-3.1.1"
       sources."escape-string-regexp-1.0.5"
@@ -71204,7 +71177,7 @@ in
     dependencies = [
       sources."@types/glob-7.1.4"
       sources."@types/minimatch-3.0.5"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."balanced-match-1.0.2"
       sources."brace-expansion-1.1.11"
       sources."chromium-pickle-js-0.2.0"
@@ -71232,16 +71205,16 @@ in
   autoprefixer = nodeEnv.buildNodePackage {
     name = "autoprefixer";
     packageName = "autoprefixer";
-    version = "10.3.1";
+    version = "10.3.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.3.1.tgz";
-      sha512 = "L8AmtKzdiRyYg7BUXJTzigmhbQRCXFKz6SA1Lqo0+AR2FBbQ4aTAPFSDlOutnFkjhiz8my4agGXog1xlMjPJ6A==";
+      url = "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.3.2.tgz";
+      sha512 = "RHKq0YCvhxAn9987n0Gl6lkzLd39UKwCkUPMFE0cHhxU0SvcTjBxWG/CtkZ4/HvbqK9U5V8j03nAcGBlX3er/Q==";
     };
     dependencies = [
       sources."browserslist-4.16.8"
       sources."caniuse-lite-1.0.30001251"
       sources."colorette-1.3.0"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."escalade-3.1.1"
       sources."fraction.js-4.1.1"
       sources."node-releases-1.1.75"
@@ -71268,14 +71241,14 @@ in
     };
     dependencies = [
       sources."@tootallnate/once-1.1.2"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/yauzl-2.9.2"
       sources."agent-base-6.0.2"
       sources."ansi-escapes-4.3.2"
       sources."ansi-regex-5.0.0"
       sources."ansi-styles-4.3.0"
       sources."ast-types-0.13.4"
-      (sources."aws-sdk-2.972.0" // {
+      (sources."aws-sdk-2.973.0" // {
         dependencies = [
           sources."uuid-3.3.2"
         ];
@@ -71495,7 +71468,7 @@ in
       sources."@cto.af/textdecoder-0.0.0"
       (sources."@grpc/grpc-js-1.3.2" // {
         dependencies = [
-          sources."@types/node-16.6.2"
+          sources."@types/node-16.7.1"
         ];
       })
       sources."@grpc/proto-loader-0.6.2"
@@ -72043,7 +72016,7 @@ in
       sources."process-nextick-args-2.0.1"
       (sources."protobufjs-6.11.2" // {
         dependencies = [
-          sources."@types/node-16.6.2"
+          sources."@types/node-16.7.1"
         ];
       })
       sources."proxy-addr-2.0.7"
@@ -73391,7 +73364,7 @@ in
       sources."@protobufjs/pool-1.1.0"
       sources."@protobufjs/utf8-1.1.0"
       sources."@types/long-4.0.1"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."addr-to-ip-port-1.5.4"
       sources."airplay-js-0.2.16"
       sources."ajv-6.12.6"
@@ -73793,10 +73766,10 @@ in
   cdk8s-cli = nodeEnv.buildNodePackage {
     name = "cdk8s-cli";
     packageName = "cdk8s-cli";
-    version = "1.0.0-beta.41";
+    version = "1.0.0-beta.42";
     src = fetchurl {
-      url = "https://registry.npmjs.org/cdk8s-cli/-/cdk8s-cli-1.0.0-beta.41.tgz";
-      sha512 = "+j1dwqcDj+qwYLkzgJa6fFkvV4f/4z67ULg8yyu2CGhJewqbd1c4klFbzJnjvljbqV5/d/uI6lfcMTRHvnZtAQ==";
+      url = "https://registry.npmjs.org/cdk8s-cli/-/cdk8s-cli-1.0.0-beta.42.tgz";
+      sha512 = "oFESit6p/6wQ5EYbjgaIwrmTg8SYEUSNywhwsSwHFjLccq/bNXLHMknxvis8c/6yXcykrNO8UvWvWrWARezOaA==";
     };
     dependencies = [
       sources."@jsii/check-node-1.33.0"
@@ -73810,7 +73783,7 @@ in
       sources."camelcase-6.2.0"
       sources."case-1.6.3"
       sources."cdk8s-1.0.0-beta.30"
-      sources."cdk8s-plus-17-1.0.0-beta.52"
+      sources."cdk8s-plus-17-1.0.0-beta.53"
       sources."chalk-4.1.2"
       sources."cliui-7.0.4"
       sources."clone-2.1.2"
@@ -73823,7 +73796,7 @@ in
       sources."color-name-1.1.4"
       sources."colors-1.4.0"
       sources."commonmark-0.30.0"
-      sources."constructs-3.3.128"
+      sources."constructs-3.3.129"
       sources."date-format-3.0.0"
       sources."debug-4.3.2"
       sources."decamelize-5.0.0"
@@ -73899,13 +73872,13 @@ in
           sources."yargs-16.2.0"
         ];
       })
-      (sources."jsii-srcmak-0.1.329" // {
+      (sources."jsii-srcmak-0.1.330" // {
         dependencies = [
           sources."fs-extra-9.1.0"
         ];
       })
       sources."json-schema-0.3.0"
-      sources."json2jsii-0.2.1"
+      sources."json2jsii-0.2.2"
       sources."jsonfile-6.1.0"
       sources."jsonschema-1.4.0"
       sources."locate-path-5.0.0"
@@ -73941,7 +73914,7 @@ in
       sources."snake-case-3.0.4"
       sources."sort-json-2.0.0"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.50"
+      sources."sscaff-1.2.51"
       (sources."streamroller-2.2.4" // {
         dependencies = [
           sources."date-format-2.1.0"
@@ -74086,7 +74059,7 @@ in
       sources."@types/express-serve-static-core-4.17.24"
       sources."@types/long-4.0.1"
       sources."@types/mime-1.3.2"
-      sources."@types/node-14.17.10"
+      sources."@types/node-14.17.11"
       sources."@types/node-fetch-2.5.12"
       sources."@types/qs-6.9.7"
       sources."@types/range-parser-1.2.4"
@@ -74205,7 +74178,7 @@ in
         ];
       })
       sources."concat-map-0.0.1"
-      sources."constructs-3.3.128"
+      sources."constructs-3.3.129"
       (sources."content-disposition-0.5.3" // {
         dependencies = [
           sources."safe-buffer-5.1.2"
@@ -74405,7 +74378,7 @@ in
           sources."yargs-16.2.0"
         ];
       })
-      (sources."jsii-srcmak-0.1.329" // {
+      (sources."jsii-srcmak-0.1.330" // {
         dependencies = [
           sources."fs-extra-9.1.0"
         ];
@@ -74563,7 +74536,7 @@ in
       sources."sort-json-2.0.0"
       sources."source-map-0.5.7"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.50"
+      sources."sscaff-1.2.51"
       (sources."stack-utils-2.0.3" // {
         dependencies = [
           sources."escape-string-regexp-2.0.0"
@@ -75690,7 +75663,7 @@ in
       sources."domutils-1.7.0"
       sources."dot-prop-5.3.0"
       sources."duplexer3-0.1.4"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-8.0.0"
       sources."end-of-stream-1.4.4"
       sources."enquirer-2.3.6"
@@ -76495,7 +76468,7 @@ in
       sha512 = "FD/aHp65QH2dDH3+0vdEPfJi7BVndL6DFa1OF+87OHQZ+wCuMPfFWcd1/izj8y907cpwv1/nCg9y/lvxJfrrRg==";
     };
     dependencies = [
-      sources."pyright-1.1.162"
+      sources."pyright-1.1.163"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -76677,7 +76650,7 @@ in
       sources."@nodelib/fs.walk-1.2.8"
       sources."@stylelint/postcss-css-in-js-0.37.2"
       sources."@stylelint/postcss-markdown-0.36.2"
-      sources."@types/mdast-3.0.8"
+      sources."@types/mdast-3.0.9"
       sources."@types/minimist-1.2.2"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/parse-json-4.0.0"
@@ -76739,7 +76712,7 @@ in
       sources."domelementtype-1.3.1"
       sources."domhandler-2.4.2"
       sources."domutils-1.7.0"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-8.0.0"
       sources."entities-1.1.2"
       sources."error-ex-1.3.2"
@@ -78380,7 +78353,7 @@ in
       sources."@types/glob-7.1.4"
       sources."@types/minimatch-3.0.5"
       sources."@types/minimist-1.2.2"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/normalize-package-data-2.4.1"
       sources."aggregate-error-3.1.0"
       sources."ansi-styles-3.2.1"
@@ -78751,7 +78724,7 @@ in
       sources."@cycle/run-3.4.0"
       sources."@cycle/time-0.10.1"
       sources."@types/cookiejar-2.1.2"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/superagent-3.8.2"
       sources."ansi-escapes-3.2.0"
       sources."ansi-regex-2.1.1"
@@ -79868,7 +79841,7 @@ in
       sources."@types/geojson-7946.0.8"
       sources."@types/mapbox-gl-0.54.5"
       sources."@types/mime-types-2.1.1"
-      sources."@types/node-14.17.10"
+      sources."@types/node-14.17.11"
       sources."@types/node-fetch-2.5.12"
       sources."@types/prop-types-15.7.4"
       sources."@types/rc-1.2.0"
@@ -79995,7 +79968,7 @@ in
       sources."duplexer3-0.1.4"
       sources."earcut-2.2.3"
       sources."electron-13.2.1"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-js-clean-4.0.0"
       sources."emoji-mart-3.0.1"
       sources."emoji-regex-9.2.2"
@@ -80583,7 +80556,7 @@ in
     dependencies = [
       sources."@fast-csv/format-4.3.5"
       sources."@fast-csv/parse-4.3.6"
-      sources."@types/node-14.17.10"
+      sources."@types/node-14.17.11"
       sources."JSONStream-1.3.5"
       sources."ajv-6.12.6"
       sources."asn1-0.2.4"
@@ -80782,7 +80755,7 @@ in
       sources."@types/http-cache-semantics-4.0.1"
       sources."@types/keyv-3.1.2"
       sources."@types/minimatch-3.0.5"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/responselike-1.0.0"
       sources."@types/yauzl-2.9.2"
       sources."abbrev-1.1.1"
@@ -81435,7 +81408,7 @@ in
       sources."@types/http-cache-semantics-4.0.1"
       sources."@types/keyv-3.1.2"
       sources."@types/minimist-1.2.2"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/responselike-1.0.0"
       sources."@types/yoga-layout-1.9.2"
@@ -81507,7 +81480,7 @@ in
       })
       sources."defer-to-connect-2.0.1"
       sources."dot-prop-5.3.0"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-8.0.0"
       sources."emojilib-2.4.0"
       sources."end-of-stream-1.4.4"
@@ -84551,7 +84524,7 @@ in
       sources."duplexify-3.7.1"
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       (sources."elliptic-6.5.4" // {
         dependencies = [
           sources."bn.js-4.12.0"
@@ -86265,7 +86238,7 @@ in
       sources."@babel/traverse-7.15.0"
       sources."@babel/types-7.15.0"
       sources."@types/minimist-1.2.2"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/yauzl-2.9.2"
       sources."@types/yoga-layout-1.9.2"
@@ -86317,7 +86290,7 @@ in
       })
       sources."delay-5.0.0"
       sources."devtools-protocol-0.0.869402"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-8.0.0"
       sources."end-of-stream-1.4.4"
       sources."error-ex-1.3.2"
@@ -87228,7 +87201,7 @@ in
       sources."@types/json-schema-7.0.9"
       sources."@types/long-4.0.1"
       sources."@types/minimatch-3.0.5"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."JSONStream-1.3.5"
       sources."abbrev-1.1.1"
       sources."abort-controller-3.0.0"
@@ -88334,7 +88307,7 @@ in
     dependencies = [
       sources."@types/atob-2.1.2"
       sources."@types/inquirer-6.5.0"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/through-0.0.30"
       sources."ajv-6.12.6"
       sources."ansi-escapes-4.3.2"
@@ -89117,7 +89090,7 @@ in
       sources."@types/istanbul-lib-report-3.0.0"
       sources."@types/istanbul-reports-1.1.2"
       sources."@types/json-patch-0.0.30"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/node-fetch-2.5.12"
       sources."@types/unist-2.0.6"
       sources."@types/yargs-15.0.14"
@@ -89280,7 +89253,7 @@ in
       sources."dotenv-8.6.0"
       sources."duplexer3-0.1.4"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-7.0.3"
       sources."encodeurl-1.0.2"
       sources."end-of-stream-1.4.4"
@@ -89931,7 +89904,7 @@ in
       })
       sources."wrappy-1.0.2"
       sources."yallist-4.0.0"
-      (sources."yeoman-generator-5.4.1" // {
+      (sources."yeoman-generator-5.4.2" // {
         dependencies = [
           sources."debug-4.3.2"
           sources."ms-2.1.2"
@@ -90581,6 +90554,36 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  glob = nodeEnv.buildNodePackage {
+    name = "glob";
+    packageName = "glob";
+    version = "7.1.7";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/glob/-/glob-7.1.7.tgz";
+      sha512 = "OvD9ENzPLbegENnYP5UUfJIirTg4+XwMWGaQfQTY0JenxNvvIKP3U3/tAQSPIu/lHxXYSZmpXlUHeqAIdKzBLQ==";
+    };
+    dependencies = [
+      sources."balanced-match-1.0.2"
+      sources."brace-expansion-1.1.11"
+      sources."concat-map-0.0.1"
+      sources."fs.realpath-1.0.0"
+      sources."inflight-1.0.6"
+      sources."inherits-2.0.4"
+      sources."minimatch-3.0.4"
+      sources."once-1.4.0"
+      sources."path-is-absolute-1.0.1"
+      sources."wrappy-1.0.2"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "a little globber";
+      homepage = "https://github.com/isaacs/node-glob#readme";
+      license = "ISC";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   graphql-cli = nodeEnv.buildNodePackage {
     name = "graphql-cli";
     packageName = "graphql-cli";
@@ -90694,7 +90697,7 @@ in
       sources."@nodelib/fs.walk-1.2.8"
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
-      sources."@types/node-16.6.2"
+      sources."@types/node-16.7.1"
       sources."@types/parse-json-4.0.0"
       sources."@types/websocket-1.0.2"
       sources."abort-controller-3.0.0"
@@ -94134,7 +94137,7 @@ in
         ];
       })
       sources."ecc-jsbn-0.1.2"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-8.0.0"
       (sources."emphasize-1.5.0" // {
         dependencies = [
@@ -96378,7 +96381,7 @@ in
       sources."@types/component-emitter-1.2.10"
       sources."@types/cookie-0.4.1"
       sources."@types/cors-2.8.12"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."accepts-1.3.7"
       sources."ansi-regex-5.0.0"
       sources."ansi-styles-4.3.0"
@@ -99064,6 +99067,24 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  lodash = nodeEnv.buildNodePackage {
+    name = "lodash";
+    packageName = "lodash";
+    version = "4.17.21";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz";
+      sha512 = "v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==";
+    };
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Lodash modular utilities.";
+      homepage = "https://lodash.com/";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   "lumo-build-deps-../interpreters/clojurescript/lumo" = nodeEnv.buildNodePackage {
     name = "lumo-build-deps";
     packageName = "lumo-build-deps";
@@ -99197,7 +99218,7 @@ in
       sources."@types/istanbul-lib-report-3.0.0"
       sources."@types/istanbul-reports-1.1.2"
       sources."@types/json-schema-7.0.9"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/resolve-0.0.8"
       sources."@types/yargs-15.0.14"
@@ -99494,7 +99515,7 @@ in
       sources."duplexer2-0.1.4"
       sources."duplexify-3.7.1"
       sources."ecc-jsbn-0.1.2"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       (sources."elliptic-6.5.4" // {
         dependencies = [
           sources."bn.js-4.12.0"
@@ -100835,7 +100856,7 @@ in
       sources."@percy/config-1.0.0-beta.65"
       sources."@percy/logger-1.0.0-beta.65"
       sources."@percy/migrate-0.10.0"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/parse-json-4.0.0"
       sources."@types/yauzl-2.9.2"
       sources."agent-base-6.0.2"
@@ -100982,7 +101003,7 @@ in
       sources."devtools-protocol-0.0.901419"
       sources."dir-glob-3.0.1"
       sources."dompurify-2.3.0"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-8.0.0"
       sources."end-of-stream-1.4.4"
       sources."error-ex-1.3.2"
@@ -101412,7 +101433,7 @@ in
       sources."@microsoft/load-themed-styles-1.10.203"
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/uuid-3.4.10"
       sources."@types/ws-6.0.4"
       sources."accepts-1.3.7"
@@ -102230,7 +102251,7 @@ in
       sources."@netlify/open-api-2.5.0"
       (sources."@netlify/plugin-edge-handlers-1.11.22" // {
         dependencies = [
-          sources."@types/node-14.17.10"
+          sources."@types/node-14.17.11"
         ];
       })
       sources."@netlify/plugins-list-3.3.0"
@@ -102418,7 +102439,7 @@ in
       sources."@types/istanbul-reports-3.0.1"
       sources."@types/keyv-3.1.2"
       sources."@types/minimatch-3.0.5"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/node-fetch-2.5.12"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/resolve-1.17.1"
@@ -102839,7 +102860,7 @@ in
       })
       sources."duplexer3-0.1.4"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."elegant-spinner-1.0.1"
       sources."elf-cam-0.1.1"
       sources."emoji-regex-8.0.0"
@@ -104537,7 +104558,7 @@ in
       sources."@types/cacheable-request-6.0.2"
       sources."@types/http-cache-semantics-4.0.1"
       sources."@types/keyv-3.1.2"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/responselike-1.0.0"
       sources."abbrev-1.1.1"
       sources."accepts-1.3.7"
@@ -105297,7 +105318,7 @@ in
       sources."@types/http-cache-semantics-4.0.1"
       sources."@types/keyv-3.1.2"
       sources."@types/minimist-1.2.2"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/parse-json-4.0.0"
       sources."@types/responselike-1.0.0"
@@ -106800,7 +106821,7 @@ in
       sources."duplexer2-0.1.4"
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       (sources."elliptic-6.5.4" // {
         dependencies = [
           sources."bn.js-4.12.0"
@@ -109560,10 +109581,10 @@ in
   pyright = nodeEnv.buildNodePackage {
     name = "pyright";
     packageName = "pyright";
-    version = "1.1.162";
+    version = "1.1.163";
     src = fetchurl {
-      url = "https://registry.npmjs.org/pyright/-/pyright-1.1.162.tgz";
-      sha512 = "3YEM8rf/39CtuHMzZmVjsV/2cJJB6N3RfCuNR5QgUeib0VRQ303zhb4jh5RRRF9P6JpZku/waX+i16TrfSqDEQ==";
+      url = "https://registry.npmjs.org/pyright/-/pyright-1.1.163.tgz";
+      sha512 = "CU0WPzr+6ZKIqCqqVrOtxMFWdzdOV18zKmC7dVBzp3snuun8JafnnmUzNJpO8IJLN/bQNSLb3riLtXFM/8Xxbg==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -110048,7 +110069,7 @@ in
       sources."@types/glob-7.1.4"
       sources."@types/json-schema-7.0.9"
       sources."@types/minimatch-3.0.5"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/parse-json-4.0.0"
       sources."@types/q-1.5.5"
       sources."@webassemblyjs/ast-1.9.0"
@@ -110465,7 +110486,7 @@ in
       sources."duplexify-3.7.1"
       sources."ee-first-1.1.1"
       sources."ejs-2.7.4"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       (sources."elliptic-6.5.4" // {
         dependencies = [
           sources."bn.js-4.12.0"
@@ -111857,12 +111878,12 @@ in
       sources."@redocly/ajv-8.6.2"
       (sources."@redocly/openapi-core-1.0.0-beta.55" // {
         dependencies = [
-          sources."@types/node-14.17.10"
+          sources."@types/node-14.17.11"
         ];
       })
       sources."@redocly/react-dropdown-aria-2.0.12"
       sources."@types/json-schema-7.0.9"
-      sources."@types/node-15.14.8"
+      sources."@types/node-15.14.9"
       sources."ansi-regex-5.0.0"
       sources."ansi-styles-3.2.1"
       sources."anymatch-3.1.2"
@@ -112386,7 +112407,7 @@ in
       sources."@types/json-schema-7.0.9"
       sources."@types/minimatch-3.0.5"
       sources."@types/mocha-8.2.3"
-      sources."@types/node-14.17.10"
+      sources."@types/node-14.17.11"
       sources."@types/node-fetch-2.5.12"
       sources."@types/vscode-1.59.0"
       sources."@typescript-eslint/eslint-plugin-4.29.2"
@@ -113173,7 +113194,7 @@ in
       sources."@types/keyv-3.1.2"
       sources."@types/lodash-4.14.172"
       sources."@types/long-4.0.1"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/request-2.48.7"
       sources."@types/request-promise-native-1.0.18"
       sources."@types/responselike-1.0.0"
@@ -115285,7 +115306,7 @@ in
       sources."@types/component-emitter-1.2.10"
       sources."@types/cookie-0.4.1"
       sources."@types/cors-2.8.12"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."accepts-1.3.7"
       sources."base64-arraybuffer-0.1.4"
       sources."base64id-2.0.0"
@@ -117326,7 +117347,7 @@ in
       sources."@nodelib/fs.walk-1.2.8"
       sources."@stylelint/postcss-css-in-js-0.37.2"
       sources."@stylelint/postcss-markdown-0.36.2"
-      sources."@types/mdast-3.0.8"
+      sources."@types/mdast-3.0.9"
       sources."@types/minimist-1.2.2"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/parse-json-4.0.0"
@@ -117388,7 +117409,7 @@ in
       sources."domelementtype-1.3.1"
       sources."domhandler-2.4.2"
       sources."domutils-1.7.0"
-      sources."electron-to-chromium-1.3.813"
+      sources."electron-to-chromium-1.3.814"
       sources."emoji-regex-8.0.0"
       sources."entities-1.1.2"
       sources."error-ex-1.3.2"
@@ -117627,7 +117648,7 @@ in
       sha512 = "eGEuZ3UEanOhlpQhICLjKejDxcZ9uYJlGnBGKAPW7uugolaBE6HpEBIiKFZN/TMRFFHQUURgGvsVn8/HJUBfeQ==";
     };
     dependencies = [
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/pug-2.0.5"
       sources."@types/sass-1.16.1"
       sources."ansi-styles-4.3.0"
@@ -117698,7 +117719,7 @@ in
       sources."@emmetio/abbreviation-2.2.2"
       sources."@emmetio/css-abbreviation-2.1.4"
       sources."@emmetio/scanner-1.0.0"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/pug-2.0.5"
       sources."@types/sass-1.16.1"
       sources."anymatch-3.1.2"
@@ -118765,7 +118786,7 @@ in
       sources."@textlint/textlint-plugin-text-12.0.2"
       sources."@textlint/types-12.0.2"
       sources."@textlint/utils-12.0.2"
-      sources."@types/mdast-3.0.8"
+      sources."@types/mdast-3.0.9"
       sources."@types/unist-2.0.6"
       sources."ajv-8.6.2"
       sources."ansi-regex-2.1.1"
@@ -119053,7 +119074,7 @@ in
       sources."@szmarczak/http-timer-1.1.2"
       sources."@textlint/ast-node-types-4.4.3"
       sources."@textlint/types-1.5.5"
-      sources."@types/hast-2.3.2"
+      sources."@types/hast-2.3.3"
       sources."@types/minimist-1.2.2"
       sources."@types/normalize-package-data-2.4.1"
       sources."@types/parse5-5.0.3"
@@ -119863,7 +119884,7 @@ in
       sources."@types/cacheable-request-6.0.2"
       sources."@types/http-cache-semantics-4.0.1"
       sources."@types/keyv-3.1.2"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/responselike-1.0.0"
       sources."abbrev-1.1.1"
       sources."abstract-logging-2.0.1"
@@ -120877,7 +120898,7 @@ in
       sources."@types/component-emitter-1.2.10"
       sources."@types/cookie-0.4.1"
       sources."@types/cors-2.8.12"
-      sources."@types/node-14.17.10"
+      sources."@types/node-14.17.11"
       sources."abbrev-1.1.1"
       sources."accepts-1.3.7"
       sources."ansi-regex-5.0.0"
@@ -121158,7 +121179,7 @@ in
       sha512 = "N+ENrder8z9zJQF9UM7K3/1LcfVW60omqeyaQsu6GN1BGdCgPm8gdHssn7WRD7vx+ABKc82IE1+pJyHOPkwe+w==";
     };
     dependencies = [
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/unist-2.0.6"
       sources."@types/vfile-3.0.2"
       sources."@types/vfile-message-2.0.0"
@@ -121536,7 +121557,7 @@ in
     dependencies = [
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@vercel/build-utils-2.12.2"
       sources."@vercel/go-1.2.3"
       sources."@vercel/node-1.12.1"
@@ -122733,7 +122754,7 @@ in
       sources."@starptech/rehype-webparser-0.10.0"
       sources."@starptech/webparser-0.10.0"
       sources."@szmarczak/http-timer-1.1.2"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/unist-2.0.6"
       sources."@types/vfile-3.0.2"
       sources."@types/vfile-message-2.0.0"
@@ -123914,7 +123935,7 @@ in
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
       sources."@types/minimatch-3.0.5"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/yauzl-2.9.1"
       sources."acorn-7.4.1"
       sources."acorn-jsx-5.3.2"
@@ -124485,7 +124506,7 @@ in
       sources."@types/eslint-scope-3.7.1"
       sources."@types/estree-0.0.50"
       sources."@types/json-schema-7.0.9"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@webassemblyjs/ast-1.11.1"
       sources."@webassemblyjs/floating-point-hex-parser-1.11.1"
       sources."@webassemblyjs/helper-api-error-1.11.1"
@@ -124653,7 +124674,7 @@ in
       sources."@nodelib/fs.walk-1.2.8"
       sources."@types/http-proxy-1.17.7"
       sources."@types/json-schema-7.0.9"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/retry-0.12.1"
       sources."accepts-1.3.7"
       sources."aggregate-error-3.1.0"
@@ -125036,7 +125057,7 @@ in
       sources."@protobufjs/pool-1.1.0"
       sources."@protobufjs/utf8-1.1.0"
       sources."@types/long-4.0.1"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."addr-to-ip-port-1.5.4"
       sources."airplay-js-0.3.0"
       sources."ansi-regex-5.0.0"
@@ -125514,7 +125535,7 @@ in
       sources."@tootallnate/once-1.1.2"
       sources."@types/expect-1.20.4"
       sources."@types/minimatch-3.0.5"
-      sources."@types/node-15.14.8"
+      sources."@types/node-15.14.9"
       sources."@types/vinyl-2.0.5"
       sources."abbrev-1.1.1"
       (sources."agent-base-6.0.2" // {
@@ -126308,7 +126329,7 @@ in
         ];
       })
       sources."yeoman-doctor-5.0.0"
-      (sources."yeoman-environment-3.5.1" // {
+      (sources."yeoman-environment-3.6.0" // {
         dependencies = [
           sources."ansi-escapes-4.3.2"
           sources."ansi-regex-2.1.1"
@@ -126406,7 +126427,7 @@ in
       sources."@nodelib/fs.walk-1.2.8"
       sources."@types/fs-extra-9.0.12"
       sources."@types/minimist-1.2.2"
-      sources."@types/node-16.7.0"
+      sources."@types/node-16.7.1"
       sources."@types/node-fetch-2.5.12"
       sources."ansi-styles-4.3.0"
       sources."array-union-3.0.1"
diff --git a/pkgs/development/ocaml-modules/bolt/default.nix b/pkgs/development/ocaml-modules/bolt/default.nix
index 54bc28697ec4..ea32d659f646 100644
--- a/pkgs/development/ocaml-modules/bolt/default.nix
+++ b/pkgs/development/ocaml-modules/bolt/default.nix
@@ -42,6 +42,8 @@ EOF
   # The custom `configure` script does not expect the --prefix
   # option. Installation is handled by ocamlfind.
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/easy-format/default.nix b/pkgs/development/ocaml-modules/easy-format/default.nix
index 6a3566fda2b6..161e263e129b 100644
--- a/pkgs/development/ocaml-modules/easy-format/default.nix
+++ b/pkgs/development/ocaml-modules/easy-format/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation {
     sha256 = "00ga7mrlycjc99gzp3bgx6iwhf7i6j8856f8xzrf1yas7zwzgzm9";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/gen/default.nix b/pkgs/development/ocaml-modules/gen/default.nix
index 04d1a0816606..77fc0b63c55e 100644
--- a/pkgs/development/ocaml-modules/gen/default.nix
+++ b/pkgs/development/ocaml-modules/gen/default.nix
@@ -12,7 +12,9 @@ stdenv.mkDerivation {
     sha256 = "14b8vg914nb0yp1hgxzm29bg692m0gqncjj43b599s98s1cwl92h";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild qtest ounit ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ qtest ounit ];
+  strictDeps = true;
 
   configureFlags = [
     "--enable-tests"
diff --git a/pkgs/development/ocaml-modules/hacl-star/raw.nix b/pkgs/development/ocaml-modules/hacl-star/raw.nix
index cd1217b97101..aa787c9a91a0 100644
--- a/pkgs/development/ocaml-modules/hacl-star/raw.nix
+++ b/pkgs/development/ocaml-modules/hacl-star/raw.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
   installTargets = "install-hacl-star-raw";
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   buildInputs = [
     which
diff --git a/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix b/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
index fdb0d8034e69..62876e5eaf94 100644
--- a/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
+++ b/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
@@ -17,6 +17,8 @@ buildOcaml (args // {
   buildInputs = [ ocaml_oasis js_build_tools opaline ] ++ buildInputs;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   configurePhase = "./configure --prefix $out";
 
diff --git a/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix b/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
index ff03c209190d..2f68ee8230e7 100644
--- a/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
+++ b/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
@@ -16,6 +16,8 @@ buildOcaml rec {
   buildInputs = [ ocaml_oasis opaline ];
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
   configurePhase = "./configure --prefix $prefix";
   installPhase = "opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR ${name}.install";
 
diff --git a/pkgs/development/ocaml-modules/javalib/default.nix b/pkgs/development/ocaml-modules/javalib/default.nix
index d158e4216ab4..15678f89da3c 100644
--- a/pkgs/development/ocaml-modules/javalib/default.nix
+++ b/pkgs/development/ocaml-modules/javalib/default.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
 
   configureScript = "./configure.sh";
   dontAddPrefix = "true";
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   propagatedBuildInputs = [ camlzip extlib ];
 
diff --git a/pkgs/development/ocaml-modules/labltk/default.nix b/pkgs/development/ocaml-modules/labltk/default.nix
index 5a6daa54de39..3161b56239d0 100644
--- a/pkgs/development/ocaml-modules/labltk/default.nix
+++ b/pkgs/development/ocaml-modules/labltk/default.nix
@@ -51,6 +51,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--use-findlib" "--installbindir" "$(out)/bin" ];
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   buildFlags = [ "all" "opt" ];
 
diff --git a/pkgs/development/ocaml-modules/ocamlnet/default.nix b/pkgs/development/ocaml-modules/ocamlnet/default.nix
index bdbbf1d8c67f..5c3ca95bb0d8 100644
--- a/pkgs/development/ocaml-modules/ocamlnet/default.nix
+++ b/pkgs/development/ocaml-modules/ocamlnet/default.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   createFindlibDestdir = true;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   preConfigure = ''
     configureFlagsArray=(
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index 25d45d9aed9b..96a66874c759 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -40,6 +40,8 @@ buildDunePackage rec {
   configureFlags = [ "--root $(out)" "--prefix /" ];
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   postConfigure = ''
     make -C src confs
diff --git a/pkgs/development/ocaml-modules/process/default.nix b/pkgs/development/ocaml-modules/process/default.nix
index 34ca51f07392..aecf03987ab1 100644
--- a/pkgs/development/ocaml-modules/process/default.nix
+++ b/pkgs/development/ocaml-modules/process/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0m1ldah5r9gcq09d9jh8lhvr77910dygx5m309k1jm60ah9mdcab";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/sawja/default.nix b/pkgs/development/ocaml-modules/sawja/default.nix
index 68a8731201d6..30ac2cfb22dd 100644
--- a/pkgs/development/ocaml-modules/sawja/default.nix
+++ b/pkgs/development/ocaml-modules/sawja/default.nix
@@ -31,6 +31,8 @@ stdenv.mkDerivation {
 
   configureScript = "./configure.sh";
   dontAddPrefix = "true";
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   propagatedBuildInputs = [ javalib ];
 
diff --git a/pkgs/development/ocaml-modules/seq/default.nix b/pkgs/development/ocaml-modules/seq/default.nix
index aa0546dd390b..44503668ff0a 100644
--- a/pkgs/development/ocaml-modules/seq/default.nix
+++ b/pkgs/development/ocaml-modules/seq/default.nix
@@ -20,7 +20,8 @@ stdenv.mkDerivation ({
     sha256 = "1cjpsc7q76yfgq9iyvswxgic4kfq2vcqdlmxjdjgd4lx87zvcwrv";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/syslog/default.nix b/pkgs/development/ocaml-modules/syslog/default.nix
index c97f1225663e..9614c404c5b9 100644
--- a/pkgs/development/ocaml-modules/syslog/default.nix
+++ b/pkgs/development/ocaml-modules/syslog/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1kqpc55ppzv9n555qgqpda49n7nvkqimzisyjx2a7338r7q4r5bw";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   buildFlags = [ "all" "opt" ];
 
diff --git a/pkgs/development/ocaml-modules/wasm/default.nix b/pkgs/development/ocaml-modules/wasm/default.nix
index c89449264889..4befff2721b9 100644
--- a/pkgs/development/ocaml-modules/wasm/default.nix
+++ b/pkgs/development/ocaml-modules/wasm/default.nix
@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
     sha256 = "1kp72yv4k176i94np0m09g10cviqp2pnpm7jmiq6ik7fmmbknk7c";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
+
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
   makeFlags = [ "-C" "interpreter" ];
 
diff --git a/pkgs/development/ocaml-modules/zarith/default.nix b/pkgs/development/ocaml-modules/zarith/default.nix
index eed6b158d4a6..95351caee307 100644
--- a/pkgs/development/ocaml-modules/zarith/default.nix
+++ b/pkgs/development/ocaml-modules/zarith/default.nix
@@ -17,11 +17,13 @@ stdenv.mkDerivation rec {
     sha256 = "1jslm1rv1j0ya818yh23wf3bb6hz7qqj9pn5fwl45y9mqyqa01s9";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ pkg-config ocaml findlib ];
   propagatedBuildInputs = [ gmp ];
+  strictDeps = true;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
   configureFlags = [ "-installdir ${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib" ];
 
   preInstall = "mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs";
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index dbbd750acf5b..9071cec1b03d 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -40,14 +40,14 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.20.3";
+  version = "1.21.1";
   format = "pyproject.toml";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "e55185e51b18d788e49fe8305fd73ef4470596b33fc2c1ceb304566b99c71a69";
+    sha256 = "1za22ggjxzm7drs2vd15s81ad9rlshk4p7pv7mxcbz4acdiszx6z";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
@@ -73,6 +73,10 @@ in buildPythonPackage rec {
     ln -s ${cfg} site.cfg
   '';
 
+  # Workaround flakey compiler feature detection
+  # https://github.com/numpy/numpy/issues/19624
+  hardeningDisable = [ "strictoverflow" ];
+
   enableParallelBuilding = true;
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index 9ce3d72a20d9..9c69e2fea544 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, setuptools }:
 
 buildPythonPackage rec {
   pname = "pbr";
@@ -9,8 +9,11 @@ buildPythonPackage rec {
     sha256 = "42df03e7797b796625b1029c0400279c7c34fd7df24a7d7818a1abb5b38710dd";
   };
 
+  propagatedBuildInputs = [ setuptools ];
+
   # circular dependencies with fixtures
   doCheck = false;
+  pythonImportsCheck = [ "pbr" ];
 
   meta = with lib; {
     homepage = "http://docs.openstack.org/developer/pbr/";
diff --git a/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb b/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb
index 2bf9d84caa06..3106e9c24ca7 100644
--- a/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb
+++ b/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb
@@ -34,6 +34,7 @@ paths.each do |path|
 ENV["BUNDLE_GEMFILE"] = #{gemfile.dump}
 ENV.delete 'BUNDLE_PATH'
 ENV['BUNDLE_FROZEN'] = '1'
+ENV['BUNDLE_IGNORE_CONFIG'] = '1'
 
 Gem.paths = { 'GEM_HOME' => #{bundle_path.dump} }
 
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 912bace20201..330664836821 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.2.20";
-  source.sha256 = "259ba486173d72a71df43fee8e3bc8dcb868c8a65e0c4020af3a6f13c3a57ff8";
+  version = "2.2.24";
+  source.sha256 = "1x3czmqhlyb593ap7mxkk47idi2jnbnrpwj8xlsjdpi7iair9y62";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/boost-build/default.nix b/pkgs/development/tools/boost-build/default.nix
index 5016aa590b5f..c6c66d4d212d 100644
--- a/pkgs/development/tools/boost-build/default.nix
+++ b/pkgs/development/tools/boost-build/default.nix
@@ -2,18 +2,36 @@
 , stdenv
 , fetchFromGitHub
 , bison
+# boost derivation to use for the src and version.
+# This is used by the boost derivation to build
+# a b2 matching their version (by overriding this
+# argument). Infinite recursion is not an issue
+# since we only look at src and version of boost.
+, useBoost ? {}
 }:
 
-stdenv.mkDerivation rec {
+let
+  defaultVersion = "4.4.1";
+in
+
+stdenv.mkDerivation {
   pname = "boost-build";
-  version = "4.4.1";
+  version =
+    if useBoost ? version
+    then "boost-${useBoost.version}"
+    else defaultVersion;
 
-  src = fetchFromGitHub {
+  src = useBoost.src or (fetchFromGitHub {
     owner = "boostorg";
     repo = "build";
-    rev = version;
+    rev = defaultVersion;
     sha256 = "1r4rwlq87ydmsdqrik4ly5iai796qalvw7603mridg2nwcbbnf54";
-  };
+  });
+
+  # b2 is in a subdirectory of boost source tarballs
+  postUnpack = lib.optionalString (useBoost ? src) ''
+    sourceRoot="$sourceRoot/tools/build"
+  '';
 
   patches = [
     # Upstream defaults to gcc on darwin, but we use clang.
@@ -32,8 +50,13 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
+
     ./b2 install --prefix="$out"
-    ln -s b2 "$out/bin/bjam"
+
+    # older versions of b2 created this symlink,
+    # which we want to support building via useBoost.
+    test -e "$out/bin/bjam" || ln -s b2 "$out/bin/bjam"
+
     runHook postInstall
   '';
 
diff --git a/pkgs/development/tools/build-managers/cmake/application-services.patch b/pkgs/development/tools/build-managers/cmake/application-services.patch
index f64e220eb29b..7c77336b41be 100644
--- a/pkgs/development/tools/build-managers/cmake/application-services.patch
+++ b/pkgs/development/tools/build-managers/cmake/application-services.patch
@@ -1,8 +1,8 @@
 diff --git a/Source/CMakeLists.txt b/Source/CMakeLists.txt
-index 1b6bb00d4c..487114daa8 100644
+index 9a18184fd3..278d146dd1 100644
 --- a/Source/CMakeLists.txt
 +++ b/Source/CMakeLists.txt
-@@ -893,7 +893,6 @@ endif()
+@@ -933,7 +933,6 @@ endif()
  # On Apple we need CoreFoundation and CoreServices
  if(APPLE)
    target_link_libraries(CMakeLib "-framework CoreFoundation")
@@ -11,27 +11,25 @@ index 1b6bb00d4c..487114daa8 100644
  
  if(WIN32 AND NOT UNIX)
 diff --git a/Source/cmGlobalXCodeGenerator.cxx b/Source/cmGlobalXCodeGenerator.cxx
-index a5ce5d18f4..3d6838ce82 100644
+index 77403b076a..d5aac95e1e 100644
 --- a/Source/cmGlobalXCodeGenerator.cxx
 +++ b/Source/cmGlobalXCodeGenerator.cxx
-@@ -43,11 +43,10 @@
- 
- struct cmLinkImplementation;
+@@ -49,10 +49,6 @@ struct cmLinkImplementation;
  
  #if !defined(CMAKE_BOOTSTRAP) && defined(__APPLE__)
--#  define HAVE_APPLICATION_SERVICES
--#  include <ApplicationServices/ApplicationServices.h>
-+#  include <CoreFoundation/CoreFoundation.h>
+ #  include <CoreFoundation/CoreFoundation.h>
+-#  if !TARGET_OS_IPHONE
+-#    define HAVE_APPLICATION_SERVICES
+-#    include <ApplicationServices/ApplicationServices.h>
+-#  endif
  #endif
-
- #if !defined(CMAKE_BOOTSTRAP)
- #  include "cmXMLParser.h"
  
+ #if !defined(CMAKE_BOOTSTRAP)
 diff --git a/Utilities/cmlibarchive/CMakeLists.txt b/Utilities/cmlibarchive/CMakeLists.txt
-index bfcaf30bb7..1da540aee5 100644
+index 79452ffff6..a848731b7e 100644
 --- a/Utilities/cmlibarchive/CMakeLists.txt
 +++ b/Utilities/cmlibarchive/CMakeLists.txt
-@@ -2007,11 +2007,6 @@ IF(ENABLE_TEST)
+@@ -2013,11 +2013,6 @@ IF(ENABLE_TEST)
  ENDIF(ENABLE_TEST)
  ENDIF()
  
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index a29ac38eb136..a4532781943f 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -2,6 +2,7 @@
 , bzip2, curlMinimal, expat, libarchive, xz, zlib, libuv, rhash
 , buildPackages
 # darwin attributes
+, SystemConfiguration
 , ps
 , isBootstrap ? false
 , useSharedLibraries ? (!isBootstrap && !stdenv.isCygwin)
@@ -13,15 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cmake"
-          + lib.optionalString isBootstrap "-boot"
-          + lib.optionalString useNcurses "-cursesUI"
-          + lib.optionalString withQt5 "-qt5UI";
-  version = "3.19.7";
+    + lib.optionalString isBootstrap "-boot"
+    + lib.optionalString useNcurses "-cursesUI"
+    + lib.optionalString withQt5 "-qt5UI";
+  version = "3.21.1";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "sha256-WKFfDVagr8zDzFNxI0/Oc/zGyPnb13XYmOUQuDF1WI4=";
+    sha256 = "sha256-+sORUXHU3/JZE5ddcS925prvRL9zi6e5dnk6RYtM/tQ=";
   };
 
   patches = [
@@ -34,7 +34,9 @@ stdenv.mkDerivation rec {
     # Derived from https://github.com/libuv/libuv/commit/1a5d4f08238dd532c3718e210078de1186a5920d
     ./libuv-application-services.patch
 
-  ] ++ lib.optional stdenv.isCygwin ./3.2.2-cygwin.patch;
+  ] ++ lib.optional stdenv.isCygwin ./3.2.2-cygwin.patch
+  # Derived from https://github.com/curl/curl/commit/31f631a142d855f069242f3e0c643beec25d1b51
+  ++ lib.optional (stdenv.isDarwin && isBootstrap) ./remove-systemconfiguration-dep.patch;
 
   outputs = [ "out" ]
     ++ lib.optionals buildDocs [ "man" "info" ];
@@ -48,11 +50,11 @@ stdenv.mkDerivation rec {
     ++ lib.optionals buildDocs [ texinfo ]
     ++ lib.optionals withQt5 [ wrapQtAppsHook ];
 
-  buildInputs = []
-    ++ lib.optionals useSharedLibraries [ bzip2 curlMinimal expat libarchive xz zlib libuv rhash ]
+  buildInputs = lib.optionals useSharedLibraries [ bzip2 curlMinimal expat libarchive xz zlib libuv rhash ]
     ++ lib.optional useOpenSSL openssl
     ++ lib.optional useNcurses ncurses
-    ++ lib.optional withQt5 qtbase;
+    ++ lib.optional withQt5 qtbase
+    ++ lib.optional (stdenv.isDarwin && !isBootstrap) SystemConfiguration;
 
   propagatedBuildInputs = lib.optional stdenv.isDarwin ps;
 
@@ -62,27 +64,24 @@ stdenv.mkDerivation rec {
       --subst-var-by libc_bin ${lib.getBin stdenv.cc.libc} \
       --subst-var-by libc_dev ${lib.getDev stdenv.cc.libc} \
       --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
-  ''
-  # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
-  + ''
+    # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
     configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags"
   '';
 
   configureFlags = [
     "--docdir=share/doc/${pname}${version}"
   ] ++ (if useSharedLibraries then [ "--no-system-jsoncpp" "--system-libs" ] else [ "--no-system-libs" ]) # FIXME: cleanup
-    ++ lib.optional withQt5 "--qt-gui"
-    ++ lib.optionals buildDocs [
-      "--sphinx-build=${sphinx}/bin/sphinx-build"
-      "--sphinx-man"
-      "--sphinx-info"
-    ]
-    # Workaround https://gitlab.kitware.com/cmake/cmake/-/issues/20568
-    ++ lib.optionals stdenv.hostPlatform.is32bit [
-      "CFLAGS=-D_FILE_OFFSET_BITS=64"
-      "CXXFLAGS=-D_FILE_OFFSET_BITS=64"
-    ]
-    ++ [
+  ++ lib.optional withQt5 "--qt-gui"
+  ++ lib.optionals buildDocs [
+    "--sphinx-build=${sphinx}/bin/sphinx-build"
+    "--sphinx-man"
+    "--sphinx-info"
+  ]
+  # Workaround https://gitlab.kitware.com/cmake/cmake/-/issues/20568
+  ++ lib.optionals stdenv.hostPlatform.is32bit [
+    "CFLAGS=-D_FILE_OFFSET_BITS=64"
+    "CXXFLAGS=-D_FILE_OFFSET_BITS=64"
+  ] ++ [
     "--"
     # We should set the proper `CMAKE_SYSTEM_NAME`.
     # http://www.cmake.org/Wiki/CMake_Cross_Compiling
@@ -117,8 +116,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://cmake.org/";
-    changelog = "https://cmake.org/cmake/help/v${lib.versions.majorMinor version}/"
-      + "release/${lib.versions.majorMinor version}.html";
+    changelog = "https://cmake.org/cmake/help/v${lib.versions.majorMinor version}/release/${lib.versions.majorMinor version}.html";
     description = "Cross-Platform Makefile Generator";
     longDescription = ''
       CMake is an open-source, cross-platform family of tools designed to
diff --git a/pkgs/development/tools/build-managers/cmake/remove-systemconfiguration-dep.patch b/pkgs/development/tools/build-managers/cmake/remove-systemconfiguration-dep.patch
new file mode 100644
index 000000000000..984aaf983067
--- /dev/null
+++ b/pkgs/development/tools/build-managers/cmake/remove-systemconfiguration-dep.patch
@@ -0,0 +1,89 @@
+From 76523ca5b2227085bb65253900e866b08a2b5efb Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Fri, 30 Jul 2021 10:50:16 +0200
+Subject: [PATCH] Disable NAT64 address synthesis on darwin
+
+This intentionally breaks the feature by partially reverting
+https://github.com/curl/curl/commit/31f631a142d855f069242f3e0c643beec25d1b51
+
+This is a stop-gap to get CMake to build without the SystemConfiguration
+framework.
+---
+ Utilities/cmcurl/CMakeLists.txt   |  8 --------
+ Utilities/cmcurl/lib/curl_setup.h |  4 ----
+ Utilities/cmcurl/lib/hostip.c     | 17 -----------------
+ 3 files changed, 29 deletions(-)
+
+diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
+index 16ef037ccc..17564bbb69 100644
+--- a/Utilities/cmcurl/CMakeLists.txt
++++ b/Utilities/cmcurl/CMakeLists.txt
+@@ -511,14 +511,6 @@ if(CMAKE_USE_SECTRANSP)
+   list(APPEND CURL_LIBS "${COREFOUNDATION_FRAMEWORK}" "${SECURITY_FRAMEWORK}")
+ endif()
+ 
+-if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
+-  find_library(SYSTEMCONFIGURATION_FRAMEWORK "SystemConfiguration")
+-  if(NOT SYSTEMCONFIGURATION_FRAMEWORK)
+-     message(FATAL_ERROR "SystemConfiguration framework not found")
+-  endif()
+-  list(APPEND CURL_LIBS "${SYSTEMCONFIGURATION_FRAMEWORK}")
+-endif()
+-
+ if(CMAKE_USE_OPENSSL)
+   find_package(OpenSSL)
+   if(NOT OpenSSL_FOUND)
+diff --git a/Utilities/cmcurl/lib/curl_setup.h b/Utilities/cmcurl/lib/curl_setup.h
+index 2d13a40a55..35160bc0f5 100644
+--- a/Utilities/cmcurl/lib/curl_setup.h
++++ b/Utilities/cmcurl/lib/curl_setup.h
+@@ -251,11 +251,7 @@
+  * performing this task will result in a synthesized IPv6 address.
+  */
+ #if defined(__APPLE__) && !defined(USE_ARES)
+-#include <TargetConditionals.h>
+ #define USE_RESOLVE_ON_IPS 1
+-#  if defined(TARGET_OS_OSX) && TARGET_OS_OSX
+-#    define CURL_OSX_CALL_COPYPROXIES 1
+-#  endif
+ #endif
+ 
+ #ifdef USE_LWIPSOCK
+diff --git a/Utilities/cmcurl/lib/hostip.c b/Utilities/cmcurl/lib/hostip.c
+index e0e3cfc2cb..45190a100b 100644
+--- a/Utilities/cmcurl/lib/hostip.c
++++ b/Utilities/cmcurl/lib/hostip.c
+@@ -68,10 +68,6 @@
+ #include "curl_memory.h"
+ #include "memdebug.h"
+ 
+-#if defined(ENABLE_IPV6) && defined(CURL_OSX_CALL_COPYPROXIES)
+-#include <SystemConfiguration/SCDynamicStoreCopySpecific.h>
+-#endif
+-
+ #if defined(CURLRES_SYNCH) && \
+     defined(HAVE_ALARM) && defined(SIGALRM) && defined(HAVE_SIGSETJMP)
+ /* alarm-based timeouts can only be used with all the dependencies satisfied */
+@@ -533,19 +529,6 @@ enum resolve_t Curl_resolv(struct Curl_easy *data,
+         return CURLRESOLV_ERROR;
+     }
+ 
+-#if defined(ENABLE_IPV6) && defined(CURL_OSX_CALL_COPYPROXIES)
+-    /*
+-     * The automagic conversion from IPv4 literals to IPv6 literals only works
+-     * if the SCDynamicStoreCopyProxies system function gets called first. As
+-     * Curl currently doesn't support system-wide HTTP proxies, we therefore
+-     * don't use any value this function might return.
+-     *
+-     * This function is only available on a macOS and is not needed for
+-     * IPv4-only builds, hence the conditions above.
+-     */
+-    SCDynamicStoreCopyProxies(NULL);
+-#endif
+-
+ #ifndef USE_RESOLVE_ON_IPS
+     /* First check if this is an IPv4 address string */
+     if(Curl_inet_pton(AF_INET, hostname, &in) > 0)
+-- 
+2.32.0
+
diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 042aff09a5fc..4547f745a98f 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -2,10 +2,11 @@
 
 stdenv.mkDerivation rec {
   # When updating, beware of https://github.com/NixOS/nixpkgs/pull/131928#issuecomment-896614165
-  name = "automake-1.16.3";
+  pname = "automake";
+  version = "1.16.3";
 
   src = fetchurl {
-    url = "mirror://gnu/automake/${name}.tar.xz";
+    url = "mirror://gnu/automake/automake-${version}.tar.xz";
     sha256 = "0fmz2fhmzcpacnprl5msphvaflwiy0hvpgmqlgfny72ddijzfazz";
   };
 
@@ -27,18 +28,16 @@ stdenv.mkDerivation rec {
   # "fixed" path in generated files!
   dontPatchShebangs = true;
 
-  meta = {
+  meta = with lib; {
     branch = "1.16";
     homepage = "https://www.gnu.org/software/automake/";
     description = "GNU standard-compliant makefile generator";
-    license = lib.licenses.gpl2Plus;
-
+    license = licenses.gpl2Plus;
     longDescription = ''
       GNU Automake is a tool for automatically generating
       `Makefile.in' files compliant with the GNU Coding
       Standards.  Automake requires the use of Autoconf.
     '';
-
-    platforms = lib.platforms.all;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 7a06e290a966..97f7a6dd8d03 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -1,16 +1,24 @@
+let
+  execFormatIsELF = platform: platform.parsed.kernel.execFormat.name == "elf";
+in
+
 { stdenv, lib, buildPackages
 , fetchFromGitHub, fetchurl, zlib, autoreconfHook, gettext
 # Enabling all targets increases output size to a multiple.
 , withAllTargets ? false, libbfd, libopcodes
 , enableShared ? !stdenv.hostPlatform.isStatic
 , noSysDirs
-, gold ? true
+, gold ? execFormatIsELF stdenv.targetPlatform
 , bison ? null
 , flex
 , texinfo
 , perl
 }:
 
+# configure silently disables ld.gold if it's unsupported,
+# so we need to make sure that intent matches result ourselves.
+assert gold -> execFormatIsELF stdenv.targetPlatform;
+
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
@@ -70,6 +78,11 @@ stdenv.mkDerivation {
     #     https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=956ea65cd707707c0f725930214cbc781367a831
     ./bfd-elf-Dont-read-non-existing-secondary-relocs.patch
 
+    # Fix building plv8’s v8.
+    # https://github.com/NixOS/nixpkgs/issues/134190
+    # Obtained from: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=586e30940e640f67bd55bd72e1d1355a4faf8079
+    ./gold-Update-GNU_PROPERTY_X86_XXX-macros.patch
+
     ./CVE-2020-35448.patch
   ] ++ lib.optional stdenv.targetPlatform.isiOS ./support-ios.patch
     ++ # This patch was suggested by Nick Clifton to fix
@@ -163,6 +176,7 @@ stdenv.mkDerivation {
 
   passthru = {
     inherit targetPrefix;
+    hasGold = gold;
     isGNU = true;
   };
 
diff --git a/pkgs/development/tools/misc/binutils/gold-Update-GNU_PROPERTY_X86_XXX-macros.patch b/pkgs/development/tools/misc/binutils/gold-Update-GNU_PROPERTY_X86_XXX-macros.patch
new file mode 100644
index 000000000000..c4eef87a0c8d
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/gold-Update-GNU_PROPERTY_X86_XXX-macros.patch
@@ -0,0 +1,292 @@
+From 586e30940e640f67bd55bd72e1d1355a4faf8079 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Tue, 13 Oct 2020 05:20:49 -0700
+Subject: [PATCH] gold: Update GNU_PROPERTY_X86_XXX macros
+
+This patch updates GNU_PROPERTY_X86_XXX macros for gold:
+
+1. GNU_PROPERTY_X86_UINT32_AND_XXX: A 4-byte unsigned integer property.
+A bit is set if it is set in all relocatable inputs:
+
+ #define GNU_PROPERTY_X86_UINT32_AND_LO      0xc0000002
+ #define GNU_PROPERTY_X86_UINT32_AND_HI      0xc0007fff
+
+2. GNU_PROPERTY_X86_UINT32_OR_XXX: A 4-byte unsigned integer property.
+A bit is set if it is set in any relocatable inputs:
+
+ #define GNU_PROPERTY_X86_UINT32_OR_LO    0xc0008000
+ #define GNU_PROPERTY_X86_UINT32_OR_HI    0xc000ffff
+
+3. GNU_PROPERTY_X86_UINT32_OR_AND_XXX: A 4-byte unsigned integer property.
+A bit is set if it is set in any relocatable inputs and the property is
+present in all relocatable inputs:
+
+ #define GNU_PROPERTY_X86_UINT32_OR_AND_LO   0xc0010000
+ #define GNU_PROPERTY_X86_UINT32_OR_AND_HI   0xc0017fff
+
+4. GNU_PROPERTY_X86_FEATURE_2_NEEDED, GNU_PROPERTY_X86_FEATURE_2_USED
+and GNU_PROPERTY_X86_FEATURE_2_XXX bits.
+
+GNU_PROPERTY_X86_FEATURE_1_AND is unchanged.  GNU_PROPERTY_X86_ISA_1_USED
+and GNU_PROPERTY_X86_ISA_1_NEEDED are updated to better support targeted
+processors since GNU_PROPERTY_X86_ISA_1_?86 aren't isn't very useful.
+A new set of GNU_PROPERTY_X86_ISA_1_XXX bits are defined.  The previous
+GNU_PROPERTY_X86_ISA_1_XXX macros are deprecated and renamed to
+GNU_PROPERTY_X86_COMPAT_ISA_1_XXX and GNU_PROPERTY_X86_COMPAT_2_ISA_1_XXX.
+
+elfcpp/
+
+	* elfcpp.h (GNU_PROPERTY_X86_ISA_1_USED): Renamed to ...
+	(GNU_PROPERTY_X86_COMPAT_ISA_1_USED): This.
+	(GNU_PROPERTY_X86_ISA_1_NEEDED): Renamed to ...
+	(GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED): This.
+	(GNU_PROPERTY_X86_UINT32_AND_LO): New.
+	(GNU_PROPERTY_X86_UINT32_AND_HI): Likewise.
+	(GNU_PROPERTY_X86_UINT32_OR_LO): Likewise.
+	(GNU_PROPERTY_X86_UINT32_OR_HI): Likewise.
+	(GNU_PROPERTY_X86_UINT32_OR_AND_LO): Likewise.
+	(GNU_PROPERTY_X86_UINT32_OR_AND_HI): Likewise.
+	(GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED): New.
+	(GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED): Likewise.
+	(GNU_PROPERTY_X86_FEATURE_1_AND): Updated to
+	(GNU_PROPERTY_X86_UINT32_AND_LO + 0).
+	(GNU_PROPERTY_X86_ISA_1_NEEDED): New.  Defined to
+	GNU_PROPERTY_X86_UINT32_OR_LO + 2.
+	(GNU_PROPERTY_X86_FEATURE_2_NEEDED): New.  Defined to
+	(GNU_PROPERTY_X86_UINT32_OR_LO + 1).
+	(GNU_PROPERTY_X86_ISA_1_USED): New.  Defined to
+	GNU_PROPERTY_X86_UINT32_OR_AND_LO + 2.
+	(GNU_PROPERTY_X86_FEATURE_2_USED): New.  Defined to
+	(GNU_PROPERTY_X86_UINT32_OR_AND_LO + 1).
+
+gold/
+
+	* x86_64.cc (Target_x86_64::Target_x86_64): Initialize
+	feature_2_used_, feature_2_needed_ and object_feature_2_used_.
+	(Target_x86_64::feature_2_used_): New data member.
+	(Target_x86_64::feature_2_needed_): Likewise.
+	(Target_x86_64::object_isa_1_used_): Likewise.
+	(Target_x86_64::record_gnu_property): Support
+	GNU_PROPERTY_X86_COMPAT_ISA_1_USED,
+	GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED,
+	GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED,
+	GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED,
+	GNU_PROPERTY_X86_FEATURE_2_USED and
+	GNU_PROPERTY_X86_FEATURE_2_NEEDED.
+	(Target_x86_64::merge_gnu_properties): Merge FEATURE_2_USED bits.
+	Initialize object_feature_2_used_.
+	(Target_x86_64::do_finalize_gnu_properties): Support
+	GNU_PROPERTY_X86_FEATURE_2_USED and
+	GNU_PROPERTY_X86_FEATURE_2_NEEDED.
+	* testsuite/gnu_property_a.S (GNU_PROPERTY_X86_ISA_1_USED): Set
+	to 0xc0010002.
+	(GNU_PROPERTY_X86_ISA_1_NEEDED): Set to 0xc0008002.
+	* testsuite/gnu_property_b.S (GNU_PROPERTY_X86_ISA_1_USED): Set
+	to 0xc0010002.
+	(GNU_PROPERTY_X86_ISA_1_NEEDED): Set to 0xc0008002.
+	* testsuite/gnu_property_c.S (GNU_PROPERTY_X86_ISA_1_USED): Set
+	to 0xc0010002.
+	(GNU_PROPERTY_X86_ISA_1_NEEDED): Set to 0xc0008002.
+	* testsuite/gnu_property_test.sh: Updated.
+---
+ elfcpp/ChangeLog                    | [omitted]
+ elfcpp/elfcpp.h                     | 18 ++++++++++++---
+ gold/ChangeLog                      | [omitted]
+ gold/testsuite/gnu_property_a.S     |  4 ++--
+ gold/testsuite/gnu_property_b.S     |  4 ++--
+ gold/testsuite/gnu_property_c.S     |  4 ++--
+ gold/testsuite/gnu_property_test.sh |  4 ++--
+ gold/x86_64.cc                      | 34 +++++++++++++++++++++++++++--
+ 8 files changed, 110 insertions(+), 13 deletions(-)
+
+diff --git a/elfcpp/elfcpp.h b/elfcpp/elfcpp.h
+index 65d803c00e2..4b6ff94a654 100644
+--- a/elfcpp/elfcpp.h
++++ b/elfcpp/elfcpp.h
+@@ -1013,9 +1013,21 @@ enum
+   GNU_PROPERTY_STACK_SIZE = 1,
+   GNU_PROPERTY_NO_COPY_ON_PROTECTED = 2,
+   GNU_PROPERTY_LOPROC = 0xc0000000,
+-  GNU_PROPERTY_X86_ISA_1_USED = 0xc0000000,
+-  GNU_PROPERTY_X86_ISA_1_NEEDED = 0xc0000001,
+-  GNU_PROPERTY_X86_FEATURE_1_AND = 0xc0000002,
++  GNU_PROPERTY_X86_COMPAT_ISA_1_USED = 0xc0000000,
++  GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED = 0xc0000001,
++  GNU_PROPERTY_X86_UINT32_AND_LO = 0xc0000002,
++  GNU_PROPERTY_X86_UINT32_AND_HI = 0xc0007fff,
++  GNU_PROPERTY_X86_UINT32_OR_LO = 0xc0008000,
++  GNU_PROPERTY_X86_UINT32_OR_HI = 0xc000ffff,
++  GNU_PROPERTY_X86_UINT32_OR_AND_LO = 0xc0010000,
++  GNU_PROPERTY_X86_UINT32_OR_AND_HI = 0xc0017fff,
++  GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 0,
++  GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 0,
++  GNU_PROPERTY_X86_FEATURE_1_AND = GNU_PROPERTY_X86_UINT32_AND_LO + 0,
++  GNU_PROPERTY_X86_ISA_1_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 2,
++  GNU_PROPERTY_X86_FEATURE_2_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 1,
++  GNU_PROPERTY_X86_ISA_1_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 2,
++  GNU_PROPERTY_X86_FEATURE_2_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 1,
+   GNU_PROPERTY_HIPROC = 0xdfffffff,
+   GNU_PROPERTY_LOUSER = 0xe0000000,
+   GNU_PROPERTY_HIUSER = 0xffffffff
+diff --git a/gold/testsuite/gnu_property_a.S b/gold/testsuite/gnu_property_a.S
+index 463bc8e52fe..5fbbbc9c4bb 100644
+--- a/gold/testsuite/gnu_property_a.S
++++ b/gold/testsuite/gnu_property_a.S
+@@ -1,8 +1,8 @@
+ #define NT_GNU_PROPERTY_TYPE_0 5
+ 
+ #define GNU_PROPERTY_STACK_SIZE 1
+-#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
+-#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
++#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
++#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
+ #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
+ 
+ #if __SIZEOF_PTRDIFF_T__  == 8
+diff --git a/gold/testsuite/gnu_property_b.S b/gold/testsuite/gnu_property_b.S
+index 0c0c038ead1..7028f73d7ab 100644
+--- a/gold/testsuite/gnu_property_b.S
++++ b/gold/testsuite/gnu_property_b.S
+@@ -2,8 +2,8 @@
+ 
+ #define GNU_PROPERTY_STACK_SIZE 1
+ #define GNU_PROPERTY_NO_COPY_ON_PROTECTED 2
+-#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
+-#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
++#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
++#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
+ #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
+ 
+ #if __SIZEOF_PTRDIFF_T__  == 8
+diff --git a/gold/testsuite/gnu_property_c.S b/gold/testsuite/gnu_property_c.S
+index ace159a9a9d..c8cbd8bce28 100644
+--- a/gold/testsuite/gnu_property_c.S
++++ b/gold/testsuite/gnu_property_c.S
+@@ -2,8 +2,8 @@
+ 
+ #define GNU_PROPERTY_STACK_SIZE 1
+ #define GNU_PROPERTY_NO_COPY_ON_PROTECTED 2
+-#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
+-#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
++#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
++#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
+ #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
+ 
+ #if __SIZEOF_PTRDIFF_T__  == 8
+diff --git a/gold/testsuite/gnu_property_test.sh b/gold/testsuite/gnu_property_test.sh
+index 1806d3474cc..a4096005b78 100755
+--- a/gold/testsuite/gnu_property_test.sh
++++ b/gold/testsuite/gnu_property_test.sh
+@@ -77,8 +77,8 @@ check_count gnu_property_test.stdout "^  NOTE" 2
+ 
+ check gnu_property_test.stdout "stack size: 0x111100"
+ check gnu_property_test.stdout "no copy on protected"
+-check gnu_property_test.stdout "x86 ISA used: i486, SSE2, SSE4_2, AVX512CD"
+-check gnu_property_test.stdout "x86 ISA needed: i486, SSE2, SSE4_2, AVX512CD"
++check gnu_property_test.stdout "x86 ISA used: x86-64-v2, <unknown: 10>, <unknown: 100>, <unknown: 1000>"
++check gnu_property_test.stdout "x86 ISA needed: x86-64-v2, <unknown: 10>, <unknown: 100>, <unknown: 1000>"
+ check gnu_property_test.stdout "x86 feature: IBT"
+ 
+ exit 0
+diff --git a/gold/x86_64.cc b/gold/x86_64.cc
+index 9cb2cf0a322..378bac16f78 100644
+--- a/gold/x86_64.cc
++++ b/gold/x86_64.cc
+@@ -706,8 +706,9 @@ class Target_x86_64 : public Sized_target<size, false>
+       rela_irelative_(NULL), copy_relocs_(elfcpp::R_X86_64_COPY),
+       got_mod_index_offset_(-1U), tlsdesc_reloc_info_(),
+       tls_base_symbol_defined_(false), isa_1_used_(0), isa_1_needed_(0),
+-      feature_1_(0), object_isa_1_used_(0), object_feature_1_(0),
+-      seen_first_object_(false)
++      feature_1_(0), feature_2_used_(0), feature_2_needed_(0),
++      object_isa_1_used_(0), object_feature_1_(0),
++      object_feature_2_used_(0), seen_first_object_(false)
+   { }
+ 
+   // Hook for a new output section.
+@@ -1382,6 +1383,8 @@ class Target_x86_64 : public Sized_target<size, false>
+   uint32_t isa_1_used_;
+   uint32_t isa_1_needed_;
+   uint32_t feature_1_;
++  uint32_t feature_2_used_;
++  uint32_t feature_2_needed_;
+   // Target-specific properties from the current object.
+   // These bits get ORed into ISA_1_USED_ after all properties for the object
+   // have been processed. But if either is all zeroes (as when the property
+@@ -1391,6 +1394,7 @@ class Target_x86_64 : public Sized_target<size, false>
+   // These bits get ANDed into FEATURE_1_ after all properties for the object
+   // have been processed.
+   uint32_t object_feature_1_;
++  uint32_t object_feature_2_used_;
+   // Whether we have seen our first object, for use in initializing FEATURE_1_.
+   bool seen_first_object_;
+ };
+@@ -1594,9 +1598,15 @@ Target_x86_64<size>::record_gnu_property(
+ 
+   switch (pr_type)
+     {
++    case elfcpp::GNU_PROPERTY_X86_COMPAT_ISA_1_USED:
++    case elfcpp::GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED:
++    case elfcpp::GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED:
++    case elfcpp::GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED:
+     case elfcpp::GNU_PROPERTY_X86_ISA_1_USED:
+     case elfcpp::GNU_PROPERTY_X86_ISA_1_NEEDED:
+     case elfcpp::GNU_PROPERTY_X86_FEATURE_1_AND:
++    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED:
++    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED:
+       if (pr_datasz != 4)
+ 	{
+ 	  gold_warning(_("%s: corrupt .note.gnu.property section "
+@@ -1625,6 +1635,12 @@ Target_x86_64<size>::record_gnu_property(
+       // If we see multiple feature props in one object, OR them together.
+       this->object_feature_1_ |= val;
+       break;
++    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED:
++      this->object_feature_2_used_ |= val;
++      break;
++    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED:
++      this->feature_2_needed_ |= val;
++      break;
+     }
+ }
+ 
+@@ -1642,15 +1658,23 @@ Target_x86_64<size>::merge_gnu_properties(const Object*)
+       else if (this->isa_1_used_ != 0)
+ 	this->isa_1_used_ |= this->object_isa_1_used_;
+       this->feature_1_ &= this->object_feature_1_;
++      // If any object is missing the FEATURE_2_USED property, we must
++      // omit it from the output file.
++      if (this->object_feature_2_used_ == 0)
++	this->feature_2_used_ = 0;
++      else if (this->feature_2_used_ != 0)
++	this->feature_2_used_ |= this->object_feature_2_used_;
+     }
+   else
+     {
+       this->isa_1_used_ = this->object_isa_1_used_;
+       this->feature_1_ = this->object_feature_1_;
++      this->feature_2_used_ = this->object_feature_2_used_;
+       this->seen_first_object_ = true;
+     }
+   this->object_isa_1_used_ = 0;
+   this->object_feature_1_ = 0;
++  this->object_feature_2_used_ = 0;
+ }
+ 
+ static inline void
+@@ -1676,6 +1700,12 @@ Target_x86_64<size>::do_finalize_gnu_properties(Layout* layout) const
+   if (this->feature_1_ != 0)
+     add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_1_AND,
+ 		 this->feature_1_);
++  if (this->feature_2_used_ != 0)
++    add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED,
++		 this->feature_2_used_);
++  if (this->feature_2_needed_ != 0)
++    add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED,
++		 this->feature_2_needed_);
+ }
+ 
+ // Write the first three reserved words of the .got.plt section.
+-- 
+2.27.0
+
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index ffe1fa3662f8..ea0002d78c0a 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -4,7 +4,7 @@
 , fetchurl, pkg-config, perl, texinfo, setupDebugInfoDirs, buildPackages
 
 # Run time
-, ncurses, readline, gmp, mpfr, expat, libipt, zlib, dejagnu
+, ncurses, readline, gmp, mpfr, expat, libipt, zlib, dejagnu, sourceHighlight
 
 , pythonSupport ? stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isCygwin, python3 ? null
 , guile ? null
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config texinfo perl setupDebugInfoDirs ];
 
-  buildInputs = [ ncurses readline gmp mpfr expat libipt zlib guile ]
+  buildInputs = [ ncurses readline gmp mpfr expat libipt zlib guile sourceHighlight ]
     ++ lib.optional pythonSupport python3
     ++ lib.optional doCheck dejagnu;
 
diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index a0c002d8a8c5..28eead7c2e53 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "0.12";
+  version = "0.13";
 
   src = fetchurl {
     url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "14npmdxppmh0ci140w8i8cy7zg1pnqg81a1mdsnza711ab7k36k9";
+    sha256 = "1v8px6g0zvhfxqa1inmdqfj4gc8dm70x7874hri4s48szjyd8zjc";
   };
 
   setupHook = [ ./setup-hook.sh ];
diff --git a/pkgs/development/tools/ocaml/dune/1.nix b/pkgs/development/tools/ocaml/dune/1.nix
index ad908787911b..74deb9d2fa55 100644
--- a/pkgs/development/tools/ocaml/dune/1.nix
+++ b/pkgs/development/tools/ocaml/dune/1.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, ocaml, findlib }:
+{ stdenv, lib, fetchurl, ocaml, findlib, ncurses }:
 
 if !lib.versionAtLeast ocaml.version "4.02"
 || lib.versionAtLeast ocaml.version "4.12"
@@ -13,7 +13,9 @@ stdenv.mkDerivation rec {
     sha256 = "1rkc8lqw30ifjaz8d81la6i8j05ffd0whpxqsbg6dci16945zjvp";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  buildInputs = [ ncurses ];
+  strictDeps = true;
 
   buildFlags = [ "release" ];
   makeFlags = [
@@ -22,6 +24,8 @@ stdenv.mkDerivation rec {
   ];
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   meta = with lib; {
     homepage = "https://dune.build/";
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index 3945389e8cd1..16f33268cf1e 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -13,11 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "07m476kgagpd6kzm3jq30yfxqspr2hychah0xfqs14z82zxpq8dv";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   buildFlags = "release";
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   installFlags = [ "PREFIX=${placeholder "out"}" "LIBDIR=$(OCAMLFIND_DESTDIR)" ];
 
diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index 2286c0945fcf..497a8ce91c1d 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -9,25 +9,23 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-K0K4vVRIjWTEvzy3BUtLN70wwdwSvUMeoeTXrYqYD+I=";
   };
 
-  buildInputs = [m4 ncurses ocaml];
+  nativeBuildInputs = [m4 ocaml];
+  buildInputs = [ ncurses ];
 
   patches = [ ./ldconf.patch ./install_topfind.patch ];
 
   dontAddPrefix=true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
-  preConfigure=''
-    configureFlagsArray=(
-      -bindir $out/bin
-      -mandir $out/share/man
-      -sitelib $out/lib/ocaml/${ocaml.version}/site-lib
-      -config $out/etc/findlib.conf
-    )
-  '';
+  configureFlags = [
+      "-bindir" "${placeholder "out"}/bin"
+      "-mandir" "${placeholder "out"}/share/man"
+      "-sitelib" "${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib"
+      "-config" "${placeholder "out"}/etc/findlib.conf"
+  ];
 
-  buildPhase = ''
-    make all
-    make opt
-  '';
+  buildFlags = [ "all" "opt" ];
 
   setupHook = writeText "setupHook.sh" ''
     addOCamlPath () {
@@ -37,6 +35,8 @@ stdenv.mkDerivation rec {
         if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"; then
             export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"
         fi
+    }
+    createOcamlDestDir () {
         export OCAMLFIND_DESTDIR="''$out/lib/ocaml/${ocaml.version}/site-lib/"
         if test -n "''${createFindlibDestdir-}"; then
           mkdir -p $OCAMLFIND_DESTDIR
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
     }
 
     addEnvHooks "$targetOffset" addOCamlPath
+    preConfigureHooks+=(createOcamlDestDir)
   '';
 
   meta = {
diff --git a/pkgs/development/tools/ocaml/ocamlbuild/default.nix b/pkgs/development/tools/ocaml/ocamlbuild/default.nix
index 926838ede545..e3043d46ee5e 100644
--- a/pkgs/development/tools/ocaml/ocamlbuild/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlbuild/default.nix
@@ -12,14 +12,22 @@ stdenv.mkDerivation rec {
 
   createFindlibDestdir = true;
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
+
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
   configurePhase = ''
+  runHook preConfigure
+
   make -f configure.make Makefile.config \
     "OCAMLBUILD_PREFIX=$out" \
     "OCAMLBUILD_BINDIR=$out/bin" \
     "OCAMLBUILD_MANDIR=$out/share/man" \
     "OCAMLBUILD_LIBDIR=$OCAMLFIND_DESTDIR"
+
+  runHook postConfigure
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/ocaml/opaline/default.nix b/pkgs/development/tools/ocaml/opaline/default.nix
index 9cdacd289d49..d9ba33bb473e 100644
--- a/pkgs/development/tools/ocaml/opaline/default.nix
+++ b/pkgs/development/tools/ocaml/opaline/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1aj1fdqymq3pnr39h47hn3kxk5v9pnwx0jap1z2jzh78x970z21m";
   };
 
-  buildInputs = with ocamlPackages; [ ocaml findlib ocamlbuild opam-file-format ];
+  nativeBuildInputs = with ocamlPackages; [ ocaml findlib ocamlbuild ];
+  buildInputs = with ocamlPackages; [ opam-file-format ];
 
   preInstall = "mkdir -p $out/bin";
 
diff --git a/pkgs/development/tools/parsing/re2c/default.nix b/pkgs/development/tools/parsing/re2c/default.nix
index a945f3bdde03..c3b09b71d173 100644
--- a/pkgs/development/tools/parsing/re2c/default.nix
+++ b/pkgs/development/tools/parsing/re2c/default.nix
@@ -1,23 +1,31 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, python3
+}:
 
 stdenv.mkDerivation rec {
   pname = "re2c";
-  version = "2.1.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner  = "skvadrik";
     repo   = "re2c";
     rev    = version;
-    sha256 = "06nvk5sf4vrc2bvpj4vi2xwy3ggv548sn530drz5fi67nhzgga26";
+    sha256 = "0snfxk1cf2f4dy4hcxd1fx1grav3di0qjgqqn97k85zsf9f6ys78";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    python3
+  ];
 
   doCheck = true;
   enableParallelBuilding = true;
 
   preCheck = ''
-    patchShebangs run_tests.sh
+    patchShebangs run_tests.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/rust/cargo-c/default.nix b/pkgs/development/tools/rust/cargo-c/default.nix
index 71394c098907..f2540f259f4d 100644
--- a/pkgs/development/tools/rust/cargo-c/default.nix
+++ b/pkgs/development/tools/rust/cargo-c/default.nix
@@ -5,7 +5,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-c";
-  version = "0.8.1";
+  version = "0.9.2";
 
   src = stdenv.mkDerivation rec {
     name = "${pname}-source-${version}";
@@ -14,11 +14,11 @@ rustPlatform.buildRustPackage rec {
       owner = "lu-zero";
       repo = pname;
       rev = "v${version}";
-      sha256 = "0fd0xql5cbqgmir2z3ah91iasaq9133wmi5bnhiy3dv7drcqv4rc";
+      sha256 = "0hvlrhmbplx4cj4l5fynihgr9cdh0rkpwvipizk1gpp6p1ksr5hz";
     };
     cargoLock = fetchurl {
       url = "https://github.com/lu-zero/${pname}/releases/download/v${version}/Cargo.lock";
-      sha256 = "1xlh3h77rxhqyr1nkqyanb120lwdks6fklh202camqpmznd763g5";
+      sha256 = "0ckn31asz7013206j153ig96602dxvxm6skdz1plan0h05j5mgah";
     };
 
     installPhase = ''
@@ -28,7 +28,8 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "0b952xkg0l31laqlhsv3cqdag7v15k9na6xr6q9y8xwy1fjh9gzv";
+  cargoSha256 = "0c0vn2pcy5px02mc0l4a3w7z9n8hc6br5w3ww6nrav5w6911jp52";
+
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ]
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index c1bc2fb4c07b..69963ea7d1fa 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-cbindgen";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "eqrion";
     repo = "cbindgen";
     rev = "v${version}";
-    sha256 = "0753dklr5lm1dmk6hy5khh8k3xyr5srfsq11l07685h71j7z0r00";
+    sha256 = "sha256-BLiAFYkqVJSpeNPW7UF2PpAttd6ADGeQ9yneiVfNi4g=";
   };
 
-  cargoSha256 = "0qyw0iqin7i31kk23ddsmywk7z0xxpd5n4q6dr6mf44y35a8krm8";
+  cargoSha256 = "sha256-P58qANcl0mYqJDP1QnSx560y8BLH+ePTZ+uHuix89R4=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;