diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index dac09bdf468a..0dce3b918458 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -38,6 +38,7 @@ with lib;
       gpsd = super.gpsd.override { guiSupport = false; };
       graphviz = super.graphviz-nox;
       gst_all_1 = super.gst_all_1 // {
+        gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; };
         gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableX11 = false; };
       };
       imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
diff --git a/nixos/tests/apparmor.nix b/nixos/tests/apparmor.nix
index 99a5cd558eb0..be91e9632849 100644
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, ... } : {
+import ./make-test-python.nix ({ pkgs, lib, ... } : {
   name = "apparmor";
   meta.maintainers = with lib.maintainers; [ julm ];
 
@@ -27,7 +27,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
       # 4. Using `diff` against the expected output.
       with subtest("apparmorRulesFromClosure"):
           machine.succeed(
-              "${pkgs.diffutils}/bin/diff ${pkgs.writeText "expected.rules" ''
+              "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''
                   mr ${pkgs.bash}/lib/**.so*,
                   r ${pkgs.bash},
                   r ${pkgs.bash}/etc/**,
@@ -64,6 +64,12 @@ import ./make-test-python.nix ({ pkgs, ... } : {
                   r ${pkgs.libunistring}/lib/**,
                   r ${pkgs.libunistring}/share/**,
                   x ${pkgs.libunistring}/foo/**,
+                  mr ${pkgs.glibc.libgcc}/lib/**.so*,
+                  r ${pkgs.glibc.libgcc},
+                  r ${pkgs.glibc.libgcc}/etc/**,
+                  r ${pkgs.glibc.libgcc}/lib/**,
+                  r ${pkgs.glibc.libgcc}/share/**,
+                  x ${pkgs.glibc.libgcc}/foo/**,
               ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
                   ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
                       pkgs.apparmorRulesFromClosure {
diff --git a/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch b/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch
new file mode 100644
index 000000000000..ef547c02f918
--- /dev/null
+++ b/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch
@@ -0,0 +1,25 @@
+From d87a7513c6f2f2824203032ef27caeb84892ed7e Mon Sep 17 00:00:00 2001
+From: Will Fancher <elvishjerricco@gmail.com>
+Date: Tue, 30 May 2023 16:53:20 -0400
+Subject: [PATCH] Intentionally break the fat driver
+
+---
+ FatPkg/EnhancedFatDxe/ReadWrite.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/FatPkg/EnhancedFatDxe/ReadWrite.c b/FatPkg/EnhancedFatDxe/ReadWrite.c
+index 8f525044d1f1..32c62ff7817b 100644
+--- a/FatPkg/EnhancedFatDxe/ReadWrite.c
++++ b/FatPkg/EnhancedFatDxe/ReadWrite.c
+@@ -216,6 +216,11 @@ FatIFileAccess (
+   Volume = OFile->Volume;
+   Task   = NULL;
+ 
++  if (*BufferSize > (10U * 1024U * 1024U)) {
++    IFile->Position += 10U * 1024U * 1024U;
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
+   //
+   // Write to a directory is unsupported
+   //
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index 94e269ff37bb..19034b299999 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -251,4 +251,29 @@ in
           machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/netbootxyz/netboot.xyz.efi")
     '';
   };
+
+  # See: [Firmware file size bug] in systemd/default.nix
+  uefiLargeFileWorkaround = makeTest {
+    name = "uefi-large-file-workaround";
+
+    nodes.machine = { pkgs, ... }: {
+      imports = [common];
+      virtualisation.efi.OVMF = pkgs.OVMF.overrideAttrs (old: {
+        # This patch deliberately breaks the FAT driver in EDK2 to
+        # exhibit (part of) the firmware bug that we are testing
+        # for. Files greater than 10MiB will fail to be read in a
+        # single Read() call, so systemd-boot will fail to load the
+        # initrd without a workaround. The number 10MiB was chosen
+        # because if it were smaller than the kernel size, even the
+        # LoadImage call would fail, which is not the failure mode
+        # we're testing for. It needs to be between the kernel size
+        # and the initrd size.
+        patches = old.patches or [] ++ [ ./systemd-boot-ovmf-broken-fat-driver.patch ];
+      });
+    };
+
+    testScript = ''
+      machine.wait_for_unit("multi-user.target")
+    '';
+  };
 }
diff --git a/pkgs/applications/audio/tetraproc/default.nix b/pkgs/applications/audio/tetraproc/default.nix
index b5012029480e..806f01dc1217 100644
--- a/pkgs/applications/audio/tetraproc/default.nix
+++ b/pkgs/applications/audio/tetraproc/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    # Make sure Jack is avalable in $PATH for tetraproc
+    # Make sure Jack is available in $PATH for tetraproc
     wrapProgram $out/bin/tetraproc --prefix PATH : "${jack2}/bin"
   '';
 
diff --git a/pkgs/applications/editors/thonny/default.nix b/pkgs/applications/editors/thonny/default.nix
index 40ba0701ce71..a6d698b65a13 100644
--- a/pkgs/applications/editors/thonny/default.nix
+++ b/pkgs/applications/editors/thonny/default.nix
@@ -42,7 +42,6 @@ buildPythonApplication rec {
 
   preFixup = ''
     wrapProgram "$out/bin/thonny" \
-       --set TK_LIBRARY "${tk}/lib/${tk.libPrefix}" \
        --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath ${python3.pkgs.jedi})
   '';
 
@@ -64,6 +63,6 @@ buildPythonApplication rec {
     homepage = "https://www.thonny.org/";
     license = licenses.mit;
     maintainers = with maintainers; [ leenaars ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/misc/audio/soxr/default.nix b/pkgs/applications/misc/audio/soxr/default.nix
index 45a5227404ce..604057ba65cb 100644
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     ./arm64-check.patch
   ];
 
-  outputs = [ "out" "doc" ]; # headers are just two and very small
+  outputs = [ "out" "dev" "doc" ];
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 812bc9a5d76d..c9523581b0a9 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -47,12 +47,12 @@ let
 
 in
 stdenv.mkDerivation rec {
-  version = "1.21.1";
+  version = "1.22.1";
   pname = "mupdf";
 
   src = fetchurl {
     url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "sha256-sk3b4SUGzILeCNXNSUYUugg0b4F12x2YvPk4/5SSWlQ=";
+    sha256 = "sha256-1i88DkVuu8QucfWkfw+M0SzsK/Co1yt541+jWmU4slo=";
   };
 
   patches = [ ./0001-Use-command-v-in-favor-of-which.patch
diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index dcddc2f5e187..9f20a2d0576e 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -35,6 +35,7 @@ let
     expat
     fontconfig
     freetype
+  ] ++ lib.optionals stdenv.isLinux [
     libGL
     xorg.libX11
     xorg.libXcursor
@@ -42,7 +43,6 @@ let
     xorg.libXrandr
     xorg.libXxf86vm
     xorg.libxcb
-  ] ++ lib.optionals stdenv.isLinux [
     libxkbcommon
     wayland
   ];
diff --git a/pkgs/applications/version-management/tig/default.nix b/pkgs/applications/version-management/tig/default.nix
index ada5f9fea640..188a0b115fdd 100644
--- a/pkgs/applications/version-management/tig/default.nix
+++ b/pkgs/applications/version-management/tig/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     cp contrib/vim.tigrc $out/etc/
 
     # Note: Until https://github.com/jonas/tig/issues/940 is resolved it is best
-    # not to install the ZSH completion so that the fallback implemenation from
+    # not to install the ZSH completion so that the fallback implementation from
     # ZSH can be used (Completion/Unix/Command/_git: "_tig () { _git-log }"):
     #install -D contrib/tig-completion.zsh $out/share/zsh/site-functions/_tig
 
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index fd263557d48a..c8f3a8b0954f 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -54,6 +54,7 @@
 , lua5
 , mpeg2dec
 , ncurses
+, openssl
 , perl
 , pkg-config
 , removeReferencesTo
@@ -158,6 +159,7 @@ stdenv.mkDerivation rec {
     libXvMC
     xcbutilkeysyms
   ])
+  ++ optional onlyLibVLC openssl # not sure why
   ++ optional (!stdenv.hostPlatform.isAarch && !onlyLibVLC) live555
   ++ optional jackSupport libjack2
   ++ optionals chromecastSupport [ libmicrodns protobuf ]
diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix
index dd84f642e32d..826cd8a3d9d8 100644
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation (rec {
     # Remove in-tree qemu stuff in case we build from a tar-ball
     rm -rf tools/qemu-xen tools/qemu-xen-traditional
 
-    # Fix shebangs, mainly for build-scipts
+    # Fix shebangs, mainly for build-scripts
     # We want to do this before getting prefetched stuff to speed things up
     # (prefetched stuff has lots of files)
     find . -type f | xargs sed -i 's@/usr/bin/\(python\|perl\)@/usr/bin/env \1@g'
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 1a0b3bc56919..ba2dfa2fb2c4 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -17,8 +17,8 @@ branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 out=${out:-}
 http_proxy=${http_proxy:-}
 
-# allow overwritting cacert's ca-bundle.crt with a custom one
-# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE enviroment variables for the nix-daemon
+# allow overwriting cacert's ca-bundle.crt with a custom one
+# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE environment variables for the nix-daemon
 GIT_SSL_CAINFO=${NIX_GIT_SSL_CAINFO:-$GIT_SSL_CAINFO}
 
 # populated by clone_user_rev()
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 650eeb9b4626..2f12be0a897d 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -57,8 +57,8 @@
 
   # GCC
   gcc = [
-    "https://bigsearcher.com/mirrors/gcc/"
     "https://mirror.koddos.net/gcc/"
+    "https://bigsearcher.com/mirrors/gcc/"
     "ftp://ftp.nluug.nl/mirror/languages/gcc/"
     "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
     "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 2432ac3a4982..61abd040a46f 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -6,9 +6,6 @@
 , passthru ? { }
 , patches ? [ ]
 
-  # Go tags, passed to go via -tag
-, tags ? [ ]
-
   # A function to override the go-modules derivation
 , overrideModAttrs ? (_oldAttrs: { })
 
@@ -201,7 +198,7 @@ let
 
         declare -a flags
         flags+=($buildFlags "''${buildFlagsArray[@]}")
-        flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
+        flags+=(''${tags:+-tags=''${tags// /,}})
         flags+=(''${ldflags:+-ldflags="$ldflags"})
         flags+=("-p" "$NIX_BUILD_CORES")
 
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index 9dd1cf151294..b4cb264d9f24 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -7,12 +7,6 @@
 , preFixup ? ""
 , shellHook ? ""
 
-# Go linker flags, passed to go via -ldflags
-, ldflags ? []
-
-# Go tags, passed to go via -tag
-, tags ? []
-
 # We want parallel builds by default
 , enableParallelBuilding ? true
 
@@ -49,9 +43,6 @@
 
 , meta ? {}, ... } @ args:
 
-
-with builtins;
-
 let
   dep2src = goDep:
     {
@@ -172,7 +163,7 @@ let
 
         declare -a flags
         flags+=($buildFlags "''${buildFlagsArray[@]}")
-        flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
+        flags+=(''${tags:+-tags=''${tags// /,}})
         flags+=(''${ldflags:+-ldflags="$ldflags"})
         flags+=("-p" "$NIX_BUILD_CORES")
 
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.py b/pkgs/build-support/setup-hooks/auto-patchelf.py
index bb13d2473f6d..965384b876fc 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.py
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -109,7 +109,14 @@ def osabi_are_compatible(wanted: str, got: str) -> bool:
 
 
 def glob(path: Path, pattern: str, recursive: bool) -> Iterator[Path]:
-    return path.rglob(pattern) if recursive else path.glob(pattern)
+    if path.is_dir():
+        return path.rglob(pattern) if recursive else path.glob(pattern)
+    else:
+        # path.glob won't return anything if the path is not a directory.
+        # We extend that behavior by matching the file name against the pattern.
+        # This allows to pass single files instead of dirs to auto_patchelf,
+        # for greater control on the files to consider.
+        return [path] if path.match(pattern) else []
 
 
 cached_paths: Set[Path] = set()
@@ -305,16 +312,21 @@ def main() -> None:
         "--no-recurse",
         dest="recursive",
         action="store_false",
-        help="Patch only the provided paths, and ignore their children")
+        help="Disable the recursive traversal of paths to patch.")
     parser.add_argument(
         "--paths", nargs="*", type=Path,
-        help="Paths whose content needs to be patched.")
+        help="Paths whose content needs to be patched."
+             " Single files and directories are accepted."
+             " Directories are traversed recursively by default.")
     parser.add_argument(
         "--libs", nargs="*", type=Path,
-        help="Paths where libraries are searched for.")
+        help="Paths where libraries are searched for."
+             " Single files and directories are accepted."
+             " Directories are not searched recursively.")
     parser.add_argument(
         "--runtime-dependencies", nargs="*", type=Path,
-        help="Paths to prepend to the runtime path of executable binaries.")
+        help="Paths to prepend to the runtime path of executable binaries."
+             " Subject to deduplication, which may imply some reordering.")
     parser.add_argument(
         "--append-rpaths",
         nargs="*",
diff --git a/pkgs/build-support/setup-hooks/role.bash b/pkgs/build-support/setup-hooks/role.bash
index b2d34a1f8606..bfd6b61f0aed 100644
--- a/pkgs/build-support/setup-hooks/role.bash
+++ b/pkgs/build-support/setup-hooks/role.bash
@@ -1,8 +1,8 @@
-# Since the same derivation can be depend on in multiple ways, we need to
+# Since the same derivation can be depended on in multiple ways, we need to
 # accumulate *each* role (i.e. host and target platforms relative the depending
 # derivation) in which the derivation is used.
 #
-# The role is intened to be use as part of other variables names like
+# The role is intended to be used as part of other variables names like
 #  - $NIX_SOMETHING${role_post}
 
 function getRole() {
@@ -49,7 +49,7 @@ function getTargetRoleEnvHook() {
     getRole "$depTargetOffset"
 }
 
-# This variant is inteneded specifically for code-prodocing tool wrapper scripts
+# This variant is intended specifically for code-producing tool wrapper scripts
 # `NIX_@wrapperName@_TARGET_*_@suffixSalt@` tracks this (needs to be an exported
 # env var so can't use fancier data structures).
 function getTargetRoleWrapper() {
diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index 8669a3c7894b..44d98d8e36bd 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -31,23 +31,23 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-C7OzwY0zq+2CV3SB5unI7Ill2M3deF7FXeQE3B/Kx2s=";
     })
 
-    # meson.build: bump version to 1.7.0
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/64a907f08b9bedd89833c1eee674148cff2343c6.patch";
-      sha256 = "sha256-p2KGS5GW+3uIPgXfuIx6aDC54csM+5FZDkK03t58AL8=";
-    })
-
-    # Fix version in libfdt/meson.build
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/723545ebe9933b90ea58dc125e4987c6bcb04ade.patch";
-      sha256 = "sha256-5Oq7q+62ZObj3e7rguN9jhSpYoQkwjSfo/N893229dQ=";
-    })
-
     # Use #ifdef NO_VALGRIND
     (fetchpatch {
       url = "https://github.com/dgibson/dtc/commit/41821821101ad8a9f83746b96b163e5bcbdbe804.patch";
       sha256 = "sha256-7QEFDtap2DWbUGqtyT/RgJZJFldKB8oSubKiCtLZ0w4=";
     })
+
+    # dtc: Fix linker options so it also works in Darwin
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/3acde70714df3623e112cf3ec99fc9b5524220b8.patch";
+      sha256 = "sha256-uLXL0Sjcn+bnMuF+A6PjUW1Rq6uNg1dQl58zbeYpP/U=";
+    })
+
+    # meson: allow disabling tests
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/35f26d2921b68d97fefbd5a2b6e821a2f02ff65d.patch";
+      sha256 = "sha256-cO4f/jJX/pQL7kk4jpKUhsCVESW2ZuWaTr7z3BuvVkw=";
+    })
   ];
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -69,6 +69,12 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs setup.py
+
+    # meson.build: bump version to 1.7.0
+    substituteInPlace libfdt/meson.build \
+      --replace "version: '1.6.0'," "version: '${version}',"
+    substituteInPlace meson.build \
+      --replace "version: '1.6.0'," "version: '${version}',"
   '';
 
   # Required for installation of Python library and is innocuous otherwise.
@@ -77,12 +83,9 @@ stdenv.mkDerivation rec {
   mesonAutoFeatures = "auto";
   mesonFlags = [
     (lib.mesonBool "static-build" stdenv.hostPlatform.isStatic)
+    (lib.mesonBool "tests" doCheck)
   ];
 
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -id $out/lib/libfdt.dylib $out/lib/libfdt-${version}.dylib
-  '';
-
   # Checks are broken on aarch64 darwin
   # https://github.com/NixOS/nixpkgs/pull/118700#issuecomment-885892436
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 92bec39e7216..f0886f862c97 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -55,7 +55,7 @@ with lib;
 with builtins;
 
 let majorVersion = "12";
-    version = "${majorVersion}.2.0";
+    version = "${majorVersion}.3.0";
     disableBootstrap = !stdenv.hostPlatform.isDarwin && !profiledCompiler;
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -69,15 +69,19 @@ let majorVersion = "12";
         ../gcc-12-gfortran-driving.patch
         ../ppc-musl.patch
         ../install-info-files-serially.patch
+
+        # backport ICE fix on ccache code
+        ./lambda-ICE-PR109241.patch
       ]
       # We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
       # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
-      ++ optional (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) (fetchpatch {
-        name = "gcc-12-darwin-aarch64-support.patch";
-        url = "https://github.com/Homebrew/formula-patches/raw/1d184289/gcc/gcc-12.2.0-arm.diff";
-        sha256 = "sha256-omclLslGi/2yCV4pNBMaIpPDMW3tcz/RXdupbNbeOHA=";
-      })
-      ++ optional langD ../libphobos.patch
+      ++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) [
+        (fetchurl {
+          name = "gcc-12-darwin-aarch64-support.patch";
+          url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
+          sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
+        })
+      ] ++ optional langD ../libphobos.patch
 
       # backport fixes to build gccgo with musl libc
       ++ optionals (langGo && stdenv.hostPlatform.isMusl) [
@@ -206,7 +210,7 @@ lib.pipe (stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-5UnPnPNZSgDie2WJ1DItcOByDN0hPzm+tBgeBpJiMP8=";
+    sha256 = "sha256-lJpdT5nnhkIak7Uysi/6tVeN5zITaZdbka7Jet/ajDs=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch b/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
new file mode 100644
index 000000000000..a27a8a08d9d5
--- /dev/null
+++ b/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
@@ -0,0 +1,77 @@
+https://gcc.gnu.org/PR109241
+
+Fix ICE on ccache.
+
+From 396a4e76afec30d2461638f569cae18955eb4ad2 Mon Sep 17 00:00:00 2001
+From: Jason Merrill <jason@redhat.com>
+Date: Wed, 22 Mar 2023 16:11:47 -0400
+Subject: [PATCH] c++: local class in nested generic lambda [PR109241]
+
+In this testcase, the tree walk to look for bare parameter packs was
+confused by finding a type with no TREE_BINFO.  But it should be fine that
+it's unset; we already checked for unexpanded packs at parse time.
+
+I also tried doing the partial instantiation of the local class, which is
+probably the long-term direction we want to go, but for stage 4 let's go
+with this safer change.
+
+	PR c++/109241
+
+gcc/cp/ChangeLog:
+
+	* pt.cc (find_parameter_packs_r): Handle null TREE_BINFO.
+
+gcc/testsuite/ChangeLog:
+
+	* g++.dg/cpp1y/lambda-generic-local-class2.C: New test.
+---
+ gcc/cp/pt.cc                                        | 12 ++++++++----
+ .../g++.dg/cpp1y/lambda-generic-local-class2.C      | 13 +++++++++++++
+ 2 files changed, 21 insertions(+), 4 deletions(-)
+ create mode 100644 gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+
+diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
+index c7f4a95a723..79bc9c014c8 100644
+--- a/gcc/cp/pt.cc
++++ b/gcc/cp/pt.cc
+@@ -4106,10 +4106,14 @@ find_parameter_packs_r (tree *tp, int *walk_subtrees, void* data)
+     case TAG_DEFN:
+       t = TREE_TYPE (t);
+       if (CLASS_TYPE_P (t))
+-	/* Local class, need to look through the whole definition.  */
+-	for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
+-	  cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
+-			ppd, ppd->visited);
++	{
++	  /* Local class, need to look through the whole definition.
++	     TYPE_BINFO might be unset for a partial instantiation.  */
++	  if (TYPE_BINFO (t))
++	    for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
++	      cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
++			    ppd, ppd->visited);
++	}
+       else
+ 	/* Enum, look at the values.  */
+ 	for (tree l = TYPE_VALUES (t); l; l = TREE_CHAIN (l))
+diff --git a/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+new file mode 100644
+index 00000000000..83856de1f41
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+@@ -0,0 +1,13 @@
++// PR c++/109241
++// { dg-do compile { target c++14 } }
++// { dg-options "" } no pedantic
++
++void g() {
++  [](auto) {
++    [](auto) {
++      ({
++        struct A {};
++      });
++    };
++  }(1);
++}
+-- 
+2.40.1
+
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 139dd09e72a3..f4c622515d7d 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -77,29 +77,12 @@ in
 rec {
   lua5_4 = callPackage ./interpreter.nix {
     self = lua5_4;
-    version = "5.4.4";
-    hash = "sha256-Fkx4SWU7gK5nvsS3RzuIS/XMjS3KBWU0dewu0nuev2E=";
+    version = "5.4.6";
+    hash = "sha256-fV6huctqoLWco93hxq3LV++DobqOVDLA7NBr9DmzrYg=";
     makeWrapper = makeBinaryWrapper;
     inherit passthruFun;
 
-    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch
-      ++ [
-        (fetchpatch {
-          name = "CVE-2022-28805.patch";
-          url = "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa.patch";
-          sha256 = "sha256-YTwoolSnRNJIHFPVijSO6ZDw35BG5oWYralZ8qOb9y8=";
-          stripLen = 1;
-          extraPrefix = "src/";
-          excludes = [ "src/testes/*" ];
-        })
-        (fetchpatch {
-          name = "CVE-2022-33099.patch";
-          url = "https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf.patch";
-          sha256 = "sha256-qj1Dq1ojVoknALSa67jhgH3G3Kk4GtJP6ROFElVF+D0=";
-          stripLen = 1;
-          extraPrefix = "src/";
-        })
-      ];
+    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
   };
 
   lua5_4_compat = lua5_4.override({
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 8160554a0609..7fe3fb38a1f7 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
 
   dlopenPropagatedBuildInputs = [ ]
     # Propagated for #include <GLES/gl.h> in SDL_opengles.h.
-    ++ lib.optional openglSupport libGL
+    ++ lib.optional (openglSupport && !stdenv.isDarwin) libGL
     # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
     ++ lib.optionals x11Support [ libX11 ];
 
diff --git a/pkgs/development/libraries/SDL2_ttf/default.nix b/pkgs/development/libraries/SDL2_ttf/default.nix
index 06793ee5e551..66f53949c245 100644
--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ SDL2 freetype libGL ]
+  buildInputs = [ SDL2 freetype ]
+    ++ lib.optional (!stdenv.isDarwin) libGL
     ++ lib.optional stdenv.isDarwin darwin.libobjc;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 9b5839d1d122..f058be4b645d 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.10";
+  version = "0.7.1";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "wlvo3A2sI87AJUh+WPGV5NFPfZSu3dX+RrIcBPHOJ3Q=";
+    hash = "sha256-vxddJkSLsTP3RxTzqIWecAC5NSL7NXdVnf/ANxYZEPk=";
   };
 
   enableParallelBuilding = true;
@@ -39,9 +39,13 @@ stdenv.mkDerivation rec {
     portaudio
     libsndfile
     flac
-  ] ++ lib.optional usePulseAudio libpulseaudio;
+  ] ++ lib.optionals usePulseAudio [
+    libpulseaudio
+  ];
 
-  configureFlags = lib.optional (!usePulseAudio) "--without-pulseaudio";
+  configureFlags = [
+    (lib.strings.withFeature usePulseAudio "pulseaudio")
+  ];
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
diff --git a/pkgs/development/libraries/c-ares/default.nix b/pkgs/development/libraries/c-ares/default.nix
index 9c024211a71b..a48b6f4fa7f5 100644
--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@@ -13,14 +13,15 @@
 
 stdenv.mkDerivation rec {
   pname = "c-ares";
-  version = "1.19.0";
-  outputs = [ "out" "dev" ];
+  version = "1.19.1";
 
   src = fetchurl {
     url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-v866N+I/1TEpOCkALKwEAe9JptxVkj9/kiNlhbetHdM=";
+    sha256 = "sha256-MhcAOZty7Q4DfQB0xinndB9rLsLdqSlWq+PpZx0+Jo4=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   nativeBuildInputs = lib.optionals withCMake [ cmake ];
 
   cmakeFlags = [] ++ lib.optionals stdenv.hostPlatform.isStatic [
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index 70a59bfa0db7..f36adbda8920 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -63,6 +63,14 @@ in {
       sha256 = "sha256-8G98nsPz3MLEWPDX9F0jKgXC4hC4NNdFQLSpmW3ay2s=";
     })
 
+    # Fix clang build failures on newer LLVM versions
+    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/119
+    (fetchpatch {
+      name = "fix-types.patch";
+      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/38e486b34d435130f2fb38c429e6016c3c82cd53.patch";
+      sha256 = "sha256-vmluOJSuTRiQHmbBBVCxOIkZ0O0ZEo0J4mgrUPn0SIo=";
+    })
+
     # Fix unexpected color addition on grayscale images (usually text).
     # Upstream fix: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114
     # Can be removed after 1.18 release
@@ -71,6 +79,7 @@ in {
       url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/4f4d89506f58a64b4829b1bb239bab9e46d63727.diff";
       sha256 = "sha256-mbTg67e7APfdELsuMAgXdY3xokWbGtHF7VDD5UyYqKM=";
     })
+
   ];
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index f984f3310300..52928e1005ff 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -67,6 +67,8 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux [ audit libapparmor ];
   # ToDo: optional selinux?
 
+  __darwinAllowLocalNetworking = true;
+
   configureFlags = [
     "--enable-user-session"
     "--enable-xml-docs"
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 24b7aedb3ec2..905e93de7a7f 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,6 +1,6 @@
 import ./generic.nix rec {
-  version = "4.4.3";
-  sha256 = "sha256-zZDzG1hD+0AHqElzeGR6OVm+H5wqtdktloSPmEUzT/c=";
+  version = "4.4.4";
+  sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
   extraPatches = [
     {
       name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 92772c419c1e..12e59c939afe 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -126,7 +126,6 @@
 , withMultithread ? true # Multithreading via pthreads/win32 threads
 , withNetwork ? withHeadlessDeps # Network support
 , withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
-, withLTO ? false # build with link-time optimization
 /*
  *  Program options
  */
@@ -384,7 +383,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     (enableFeature withSmallBuild "small")
     (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
-    (enableFeature withLTO "lto")
     (enableFeature withGrayscale "gray")
     (enableFeature withSwscaleAlpha "swscale-alpha")
     (enableFeature withHardcodedTables "hardcoded-tables")
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 5443f1eeac0d..a8e8fde96f63 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gettext";
-  version = "0.21";
+  version = "0.21.1";
 
   src = fetchurl {
     url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
-    sha256 = "04kbg1sx0ncfrsbr85ggjslqkzzb243fcw9nyh3rrv1a22ihszf7";
+    sha256 = "sha256-6MNlDh2M7odcTzVWQjgsHfgwWL1aEe6FVcDPJ21kbUU=";
   };
   patches = [
     ./absolute-paths.diff
@@ -47,14 +47,6 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.hostPlatform.isCygwin ''
     sed -i -e "s/\(cldr_plurals_LDADD = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
     sed -i -e "s/\(libgettextsrc_la_LDFLAGS = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
-  '' +
-  # This change to gettext's vendored copy of gnulib is already
-  # merged upstream; we can drop this patch on the next version
-  # bump.  It must be applied twice because gettext vendors gnulib
-  # not once, but twice!
-  ''
-    patch -p2 -d gettext-tools/gnulib-lib/ < ${gnulib.passthru.longdouble-redirect-patch}
-    patch -p2 -d gettext-tools/libgrep/    < ${gnulib.passthru.longdouble-redirect-patch}
   '';
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 4da4eec78580..1bdd6890ab21 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnu-efi";
-  version = "3.0.17";
+  version = "3.0.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnu-efi/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-eAfpAzSTQ6ehQuu5NHA6KHIjXolojPWGwDKwoQh7yvQ=";
+    sha256 = "sha256-kxole5xcG6Zf9Rnxg3PEOKJoJfLbeGaxY+ltGxaPIOo=";
   };
 
   buildInputs = [ pciutils ];
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 1e5271d47709..1be64b11d991 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -68,6 +68,9 @@ stdenv.mkDerivation rec {
     protobuf
   ];
 
+  # https://hydra.nixos.org/build/222679737/nixlog/3/tail
+  NIX_CFLAGS_COMPILE = if stdenv.isAarch64 then "-Wno-error=maybe-uninitialized" else null;
+
   doInstallCheck = true;
 
   preInstallCheck =
@@ -126,6 +129,7 @@ stdenv.mkDerivation rec {
     license = with licenses; [ asl20 ];
     homepage = "https://github.com/googleapis/google-cloud-cpp";
     description = "C++ Idiomatic Clients for Google Cloud Platform services";
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ cpcloud ];
   };
 }
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 63c5b92e07ca..ccfbd892a97d 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -38,7 +38,6 @@
 , bluez
 , chromaprint
 , curl
-, directfb
 , fdk_aac
 , flite
 , gsm
@@ -104,6 +103,7 @@
 , microdnsSupport ? false
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
+, guiSupport ? true, directfb
 }:
 
 stdenv.mkDerivation rec {
@@ -183,9 +183,6 @@ stdenv.mkDerivation rec {
     libwebp
     xvidcore
     gnutls
-    libGL
-    libGLU
-    gtk3
     game-music-emu
     openssl
     libxml2
@@ -220,7 +217,6 @@ stdenv.mkDerivation rec {
     mjpegtools
 
     chromaprint
-    directfb
     flite
     libdrm
     libgudev
@@ -237,6 +233,13 @@ stdenv.mkDerivation rec {
     serd
     sord
     sratom
+
+    libGL
+    libGLU
+  ] ++ lib.optionals guiSupport [
+    gtk3
+  ] ++ lib.optionals (stdenv.isLinux && guiSupport) [
+    directfb
   ] ++ lib.optionals stdenv.isDarwin [
     # For unknown reasons the order is important, e.g. if
     # VideoToolbox is last, we get:
@@ -297,10 +300,11 @@ stdenv.mkDerivation rec {
     "-Ddoc=disabled" # needs gstcuda to be enabled which is Linux-only
     "-Dnvcodec=disabled" # Linux-only
     "-Dva=disabled" # see comment on `libva` in `buildInputs`
+  ] ++ lib.optionals (!stdenv.isLinux || !guiSupport) [
+    "-Ddirectfb=disabled"
   ]
   ++ lib.optionals stdenv.isDarwin [
     "-Dchromaprint=disabled"
-    "-Ddirectfb=disabled"
     "-Dflite=disabled"
     "-Dkms=disabled" # renders to libdrm output
     "-Dlv2=disabled"
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 370d868ec2c7..5c70b225e526 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -87,9 +87,9 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     libjpeg
     tremor
-    libGL
     pango
   ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
     libvisual
   ] ++ lib.optionals stdenv.isDarwin [
     OpenGL
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index 698be758ad3c..6f67ee6327ce 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -102,7 +102,7 @@ let
       "reqwest" # tests hang on darwin
       "threadshare" # tests cannot bind to localhost on darwin
       "webp" # not supported on darwin (upstream crate issue)
-    ] ++ lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
+    ] ++ lib.optionals (!gst-plugins-base.glEnabled) [
       # these require gstreamer-gl which requires darwin sdk bump
       "gtk4"
       "livesync"
@@ -206,7 +206,7 @@ stdenv.mkDerivation rec {
     export CSOUND_LIB_DIR=${lib.getLib csound}/lib
   '' + lib.optionalString (lib.mutuallyExclusive [ "webrtc" "webrtchttp" ] selectedPlugins) ''
     sed -i "/\['gstreamer-webrtc-1\.0', 'gst-plugins-bad', 'gstwebrtc_dep', 'gstwebrtc'\]/d" meson.build
-  '' + lib.optionalString (stdenv.isDarwin && !stdenv.isAarch64) ''
+  '' + lib.optionalString (!gst-plugins-base.glEnabled) ''
     sed -i "/\['gstreamer-gl-1\.0', 'gst-plugins-base', 'gst_gl_dep', 'gstgl'\]/d" meson.build
   '';
 
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 0662cdd8e429..c25aa55557aa 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -62,10 +62,11 @@ stdenv.mkDerivation rec {
     xorg.libXrandr
     xorg.libSM
     xorg.libICE
-    libGL
-    libGLU
     nasm
     libvpx
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
+    libGLU
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/http-parser/default.nix b/pkgs/development/libraries/http-parser/default.nix
index dd1ea3559d7a..327121dc6b1b 100644
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkTarget = "test";
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "An HTTP message parser written in C";
     homepage = "https://github.com/nodejs/http-parser";
diff --git a/pkgs/development/libraries/json-c/default.nix b/pkgs/development/libraries/json-c/default.nix
index d6aac7161d4f..785548c211a9 100644
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@@ -1,14 +1,24 @@
-{ lib, stdenv, fetchurl, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "json-c";
   version = "0.16";
 
-  src = fetchurl {
-    url    = "https://s3.amazonaws.com/json-c_releases/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-jkWsj5bsd5Hq87t+5Q6cIQC7vIe40PHQMMW6igKI2Ws=";
+  src = fetchFromGitHub {
+    owner = "json-c";
+    repo = "json-c";
+    rev = "json-c-0.16-20220414";
+    sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
   };
 
+  patches = [
+    # needed for emscripten, which uses LLVM 15+
+    (fetchpatch {
+      url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
+      sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 4047c7bbefd0..fa9562947f81 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -33,7 +33,10 @@ stdenv.mkDerivation rec {
     "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${addOpenGLRunpath.driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""
 
     "-Wno-error=array-bounds"
-  ] ++ lib.optional stdenv.cc.isClang "-Wno-error");
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error"
+    "-Wno-int-conversion"
+  ]);
 
   configureFlags  = []
     # Indirectly: https://bugs.freedesktop.org/show_bug.cgi?id=35268
diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix
index 2c4041a9cfa7..0782f94f41e5 100644
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@@ -18,8 +18,6 @@ stdenv.mkDerivation rec {
   # Beware: non-bootstrap libidn2 is overridden by ./hack.nix
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];
 
-  patches = lib.optional stdenv.isDarwin ./fix-error-darwin.patch;
-
   enableParallelBuilding = true;
 
   # The above patch causes the documentation to be regenerated, so the
diff --git a/pkgs/development/libraries/libidn2/fix-error-darwin.patch b/pkgs/development/libraries/libidn2/fix-error-darwin.patch
deleted file mode 100644
index e2202abd947c..000000000000
--- a/pkgs/development/libraries/libidn2/fix-error-darwin.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/src/idn2.c b/src/idn2.c
-index 6abbc72..804f0f2 100644
---- a/src/idn2.c
-+++ b/src/idn2.c
-@@ -31,7 +31,6 @@
- #include <unistr.h>
- 
- /* Gnulib headers. */
--#include "error.h"
- #include "gettext.h"
- #define _(String) dgettext (PACKAGE, String)
- #include "progname.h"
-@@ -222,7 +219,7 @@ main (int argc, char *argv[])
-     }
- 
-   if (ferror (stdin))
--    error (EXIT_FAILURE, errno, "%s", _("input error"));
-+    perror (_("input error"));
- 
-   cmdline_parser_free (&args_info);
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index 737ee55d41a6..00cb7e042c97 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -33,6 +33,10 @@ stdenv.mkDerivation rec {
     sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
   '';
 
+  # Don’t build examples, which are not installed and require additional dependencies not
+  # included in `buildInputs` such as libX11.
+  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
+
   # single output, otherwise cmake and .pc files point to the wrong directory
   # outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index ce496637fcc2..ba1455350e60 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -2,21 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh2";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://www.libssh2.org/download/libssh2-${version}.tar.gz";
-    sha256 = "sha256-LWTpDz3tOUuR06LndMogOkF59prr7gMAPlpvpiHkHVE=";
+    sha256 = "sha256-NzYWHkHiaTMk3rOMJs/cPv5iCdY0ukJY2xzs/2pa1GE=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
 
-  patches = [
-    # https://github.com/libssh2/libssh2/pull/700
-    # openssl: add support for LibreSSL 3.5.x
-    ./openssl_add_support_for_libressl_3_5.patch
-  ];
-
   buildInputs = [ openssl zlib ]
     ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;
 
diff --git a/pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch b/pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch
deleted file mode 100644
index d72a67a63403..000000000000
--- a/pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From f0681a4573d7c7f7484d3157ddff7063a200295b Mon Sep 17 00:00:00 2001
-From: Viktor Szakats <commit@vsz.me>
-Date: Thu, 19 May 2022 13:25:06 +0000
-Subject: [PATCH] openssl: add support for LibreSSL 3.5.x
-
-LibreSSL 3.5.0 made more structures opaque, so let's enable existing
-support for that when building against these LibreSSL versions.
-
-Ref: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.0-relnotes.txt
----
- src/openssl.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/openssl.h b/src/openssl.h
-index 658b040..1733b9e 100644
---- a/src/openssl.h
-+++ b/src/openssl.h
-@@ -58,7 +58,8 @@
- #include <openssl/rand.h>
-
- #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
--    !defined(LIBRESSL_VERSION_NUMBER)
-+    !defined(LIBRESSL_VERSION_NUMBER) || \
-+    LIBRESSL_VERSION_NUMBER >= 0x3050000fL
- # define HAVE_OPAQUE_STRUCTS 1
- #endif
diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index bbbceab3ab78..27ce41d20f62 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -8,11 +8,11 @@
 stdenv.mkDerivation rec {
   pname = "libvterm-neovim";
   # Releases are not tagged, look at commit history to find latest release
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchurl {
     url = "https://www.leonerd.org.uk/code/libvterm/libvterm-${version}.tar.gz";
-    sha256 = "sha256-JaitnBVIU2jf0Kip3KGuyP6lwn2j+nTsUY1dN4fww5c=";
+    sha256 = "sha256-ketQiAafTm7atp4UxCEvbaAZLmVpWVbcBIAWoNq4vPY=";
   };
 
   nativeBuildInputs = [ perl libtool ];
diff --git a/pkgs/development/libraries/mesa/22.3.nix b/pkgs/development/libraries/mesa/22.3.nix
deleted file mode 100644
index 1a1127dae508..000000000000
--- a/pkgs/development/libraries/mesa/22.3.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "22.3.7";
-  hash = "sha256-iUzi9KHC52F3zdIoRiAZLQ2jBmskPuwvux18838TBCw=";
-}
diff --git a/pkgs/development/libraries/mesa/23.0.nix b/pkgs/development/libraries/mesa/23.0.nix
deleted file mode 100644
index 323e00196181..000000000000
--- a/pkgs/development/libraries/mesa/23.0.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "23.0.3";
-  hash = "sha256-OGNipdgN87CWY2tn80Dhzme3BbRHZ9W90R0u0QNxktU=";
-}
diff --git a/pkgs/development/libraries/mesa/generic.nix b/pkgs/development/libraries/mesa/default.nix
similarity index 97%
rename from pkgs/development/libraries/mesa/generic.nix
rename to pkgs/development/libraries/mesa/default.nix
index ea7c1cb8b7b5..38afcd174db3 100644
--- a/pkgs/development/libraries/mesa/generic.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,12 +1,10 @@
-{ version, hash }:
-
 { stdenv, lib, fetchurl, fetchpatch
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages_15, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
-, libglvnd, libunwind
+, libglvnd, libunwind, lm_sensors
 , vulkan-loader, glslang
 , galliumDrivers ?
   if stdenv.isLinux then
@@ -87,6 +85,9 @@
 */
 
 let
+  version = "23.1.1";
+  hash = "sha256-omeQMe1bc7KcTwQqxk2W+DsM/khYYX3jLi78GWxlOkA=";
+
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
   branch = lib.versions.major version;
@@ -145,11 +146,6 @@ self = stdenv.mkDerivation {
       "get_option('datadir')" "'${placeholder "out"}/share'"
     substituteInPlace src/amd/vulkan/meson.build --replace \
       "get_option('datadir')" "'${placeholder "out"}/share'"
-  ''
-  # TODO: can be removed >= 23.0.4 (most likely)
-  # https://gitlab.freedesktop.org/mesa/mesa/-/commit/035aa34ed5eb418339c0e2d2
-  + ''
-    sed '/--size_t-is-usize/d' -i src/gallium/frontends/rusticl/meson.build
   '';
 
   outputs = [ "out" "dev" "drivers" ]
@@ -197,6 +193,10 @@ self = stdenv.mkDerivation {
 
     # To enable non-mesa gbm backends to be found (e.g. Nvidia)
     "-Dgbm-backends-path=${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm"
+
+    # meson auto_features enables these features, but we do not want them
+    "-Dandroid-libbacktrace=disabled"
+
   ] ++ lib.optionals stdenv.isLinux [
     "-Dglvnd=true"
 
@@ -219,10 +219,9 @@ self = stdenv.mkDerivation {
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
     libffi libvdpau libelf libXvMC
     libpthreadstubs openssl /*or another sha1 provider*/
-    zstd
+    zstd libunwind
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev ]
-    ++ lib.optionals stdenv.isDarwin [ libunwind ]
+    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
     ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator' ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader
@@ -253,6 +252,7 @@ self = stdenv.mkDerivation {
     if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
       # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
       mv -t $drivers/lib       \
+        $out/lib/libpowervr_rogue* \
         $out/lib/libxatracker* \
         $out/lib/libvulkan_*
     fi
@@ -371,6 +371,9 @@ self = stdenv.mkDerivation {
     license = licenses.mit; # X11 variant, in most files
     platforms = platforms.mesaPlatforms;
     maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
+
+    # https://gitlab.freedesktop.org/mesa/mesa/-/issues/8634
+    broken = stdenv.isDarwin;
   };
 };
 
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index 445f26c6bd10..fe51c79d7a06 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -10,16 +10,18 @@ diff --git a/meson_options.txt b/meson_options.txt
 index b8f753e2e1a..70d9071c8be 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -452,6 +452,12 @@ option(
+@@ -452,7 +452,14 @@ option(
    value : true,
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
+ 
 +option(
 +  'disk-cache-key',
 +  type : 'string',
 +  value : '',
 +  description : 'Mesa cache key.'
 +)
++
  option('egl-lib-suffix',
    type : 'string',
    value : '',
diff --git a/pkgs/development/libraries/nss/gcc-13-esr.patch b/pkgs/development/libraries/nss/gcc-13-esr.patch
new file mode 100644
index 000000000000..547ee0bd3761
--- /dev/null
+++ b/pkgs/development/libraries/nss/gcc-13-esr.patch
@@ -0,0 +1,44 @@
+https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
+https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+
+# HG changeset patch
+# User Sergei Trofimovich <slyich@gmail.com>
+# Date 1653552519 0
+# Node ID 21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+# Parent  ad1046e9eee5f5dc17dac7c9343e2f7f0da44b4e
+Bug 1771273 - cpputil/databuffer.h: add missing <cstdint> include r=nss-reviewers,mt
+
+Without the change build fails on this week's gcc-13 snapshot as:
+
+    ../../cpputil/databuffer.h:20:20: error: 'uint8_t' does not name a type
+       20 |   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
+          |                    ^~~~~~~
+    ../../cpputil/databuffer.h:14:1: note: 'uint8_t' is defined in header '<cstdint>'; did you forget to '#include <cstdint>'?
+       13 | #include <iostream>
+      +++ |+#include <cstdint>
+       14 |
+
+Differential Revision: https://phabricator.services.mozilla.com/D147404
+
+diff --git a/cpputil/databuffer.h b/cpputil/databuffer.h
+--- nss/cpputil/databuffer.h
++++ nss/cpputil/databuffer.h
+@@ -6,16 +6,17 @@
+ 
+ #ifndef databuffer_h__
+ #define databuffer_h__
+ 
+ #include <algorithm>
+ #include <cstring>
+ #include <iomanip>
+ #include <iostream>
++#include <cstdint>
+ 
+ namespace nss_test {
+ 
+ class DataBuffer {
+  public:
+   DataBuffer() : data_(nullptr), len_(0) {}
+   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
+     Assign(d, l);
+
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index be2196d6d2fc..b2d1c1e15fd8 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -47,6 +47,11 @@ stdenv.mkDerivation rec {
       ./85_security_load_3.85+.patch
     )
     ./fix-cross-compilation.patch
+  ] ++ lib.optionals (lib.versionOlder version "3.89") [
+    # Backport gcc-13 build fix:
+    #  https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
+    #  https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+    ./gcc-13-esr.patch
   ];
 
   patchFlags = [ "-p0" ];
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 5f9948848618..3f120e2558f3 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , unzip
@@ -275,6 +276,21 @@ stdenv.mkDerivation {
   # Ensures that we use the system OpenEXR rather than the vendored copy of the source included with OpenCV.
   patches = [
     ./cmake-don-t-use-OpenCVFindOpenEXR.patch
+  ] ++ lib.optionals enableContrib [
+    (fetchpatch {
+      name = "CVE-2023-2617.patch";
+      url = "https://github.com/opencv/opencv_contrib/commit/ccc277247ac1a7aef0a90353edcdec35fbc5903c.patch";
+      stripLen = 2;
+      extraPrefix = [ "opencv_contrib/" ];
+      sha256 = "sha256-drZ+DVn+Pk4zAZJ+LgX5u3Tz7MU0AEI/73EVvxDP3AU=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-2618.patch";
+      url = "https://github.com/opencv/opencv_contrib/commit/ec406fa4748fb4b0630c1b986469e7918d5e8953.patch";
+      stripLen = 2;
+      extraPrefix = [ "opencv_contrib/" ];
+      sha256 = "sha256-cB5Tsh2fDOsc0BNtSzd6U/QoCjkd9yMW1QutUU69JJ0=";
+    })
   ] ++ lib.optional enableCuda ./cuda_opt_flow.patch;
 
   # This prevents cmake from using libraries in impure paths (which
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 69c331698660..0f659654e243 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     "devdoc"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 303016ab8698..0449651090fe 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -240,8 +240,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.8";
-    sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4=";
+    version = "3.0.9";
+    sha256 = "sha256-6xqwR4FHQ2D3fDGKuJ2MWgOrw45j1lpgPKu/GwCh3JA=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 03c409a38196..20649c6f83a1 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "d3b21bc8b70eaa1af848371dc1d34c4617c1f73c",
-    "sha256": "11yww09fgcqsxv4sk4cflxdsdpdqc0x9b3qw63asfpwrnv9qry0a"
+    "rev": "a196623892558623e467f20b67edb78794252a09",
+    "sha256": "0yna2k1w595xwh9bk268h31fjl2ff8cm185dmm0v5gr4w8h9yr4g"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -26,8 +26,8 @@
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "0f9e49cde3b7ca40cd94e63d2f5d29f5b586d3d6",
-    "sha256": "1iwqa98ihzqqpqgwsj0lm4zkfwgag9k634sxjnx6gxvfq0h6d4nx"
+    "rev": "e6d37133affc71451129d84790c6c22227e64aff",
+    "sha256": "1bc1d0h2f1q0xfvr8p5fq1580bl8cs0qhdncm600v590z56cyika"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "0e1bed3c3e27d44d86d6f68a8b93b96a4821575c",
-    "sha256": "0v4c3pls67ww6ffiscbp05yb2vv583zrxj8p4jcy3yxa06khniy5"
+    "rev": "039ce261b0f8061f8485f9c2eaf497a4d4395baa",
+    "sha256": "1kp2pnwfcwsxhy2w1sdg722d0kb1i6kx3a9r42gl1i9d73k8afi2"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -61,8 +61,8 @@
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "2a8a48e9101236f118c2c4f0d79fae9c9d7b3f2a",
-    "sha256": "0ajvlqkm2641ahms34kg6a2hykvql1hxlm5nsaba7233hnfv3nsy"
+    "rev": "30fb93cf8521f2c0b3803903153d9034b7d7bcc2",
+    "sha256": "1b027hfc1m2nz0v906w08srmpyci3362arxc18cin334yhgghbx1"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
@@ -101,8 +101,8 @@
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "86a84eaa74c4071e5750f23b6e9911762880d391",
-    "sha256": "1zywq3ll49bzzvl6rzn4zpp96a4mdx0b9l5ic0x6zc4dr8c8jk5m"
+    "rev": "68a48018e34322edaf611639710b3edbe389e8c2",
+    "sha256": "04hswsamjmwgn63gs3rhxygvwjfqx5f0qifzp3gp6q4fw8lkgwpf"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@@ -146,8 +146,8 @@
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "9b5ab29cbba1908fd4928e2bda2b93e418e36187",
-    "sha256": "0vnwhbkk40wj9rfy3fhjm9slra3y3j1mk67n3vnrzvmzrmpl4443"
+    "rev": "837b5163e17edbd3a9f098e9a1ab73febab419b4",
+    "sha256": "082i9q36d44g5a3jbw3ahvmmxikfai50wd2yq8xvkh8kr8xr7n5z"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
diff --git a/pkgs/development/libraries/sord/default.nix b/pkgs/development/libraries/sord/default.nix
index efb8bf0b8952..54ae9261f810 100644
--- a/pkgs/development/libraries/sord/default.nix
+++ b/pkgs/development/libraries/sord/default.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-S22Szpg6iXeana5t6EpbOtRstthgrJ4Z2cBrf7a9ZBk=";
   };
 
+  outputs = [ "out" "dev" "doc" "man" ];
+
   nativeBuildInputs = [
     doxygen
     meson
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 961a0c9e3195..a3006e1236a6 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.41.2";
+  version = "3.42.0";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-6YwQDdHaTjD6Rgdh2rfAuRpQt4XhZ/jFesxGUU+ulJk=";
+    hash = "sha256-erz9FhxuJ0LKXGwIldH4U8lA8gMwSgtJ2k4eyl0IjKY=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 9943184bd1f3..c30ce8d45d9a 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.41.2";
+    version = "3.42.0";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-hxkfzsuLcH2aEO2xNgdoYxfXFpwIC5vcXTnQY1g3bMw=";
+      hash = "sha256-OMpWoxe+N/sAvZK8KA2bkgm9QAiyl9SDxB7B9geb+20=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/tk/8.6.nix b/pkgs/development/libraries/tk/8.6.nix
index 3e3d8ad54011..fbf456051754 100644
--- a/pkgs/development/libraries/tk/8.6.nix
+++ b/pkgs/development/libraries/tk/8.6.nix
@@ -14,4 +14,8 @@ callPackage ./generic.nix (args // {
     sha256 = "sha256-LmX6BpojNlRAo8VsVWuGc7XjKig4ANjZslfj9YTOBnU=";
   };
 
+  patches = [
+    ./tk-8_6_13-find-library.patch
+  ];
+
 })
diff --git a/pkgs/development/libraries/tk/tk-8_6_13-find-library.patch b/pkgs/development/libraries/tk/tk-8_6_13-find-library.patch
new file mode 100644
index 000000000000..a055ade80cc0
--- /dev/null
+++ b/pkgs/development/libraries/tk/tk-8_6_13-find-library.patch
@@ -0,0 +1,25 @@
+diff --git a/generic/tkWindow.c b/generic/tkWindow.c
+index fa25553..ad45598 100644
+--- a/generic/tkWindow.c
++++ b/generic/tkWindow.c
+@@ -1045,6 +1045,7 @@ TkCreateMainWindow(
+ 
+     Tcl_SetVar2(interp, "tk_patchLevel", NULL, TK_PATCH_LEVEL, TCL_GLOBAL_ONLY);
+     Tcl_SetVar2(interp, "tk_version",    NULL, TK_VERSION,     TCL_GLOBAL_ONLY);
++    Tcl_SetVar2(interp, "tk_library",    NULL, TK_LIBRARY,     TCL_GLOBAL_ONLY);
+ 
+     tsdPtr->numMainWindows++;
+     return tkwin;
+diff --git a/unix/Makefile.in b/unix/Makefile.in
+index e98070e..f417753 100644
+--- a/unix/Makefile.in
++++ b/unix/Makefile.in
+@@ -1033,7 +1033,7 @@ tkVisual.o: $(GENERIC_DIR)/tkVisual.c
+ 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkVisual.c
+ 
+ tkWindow.o: $(GENERIC_DIR)/tkWindow.c tkUuid.h
+-	$(CC) -c $(CC_SWITCHES) -I. $(GENERIC_DIR)/tkWindow.c
++	$(CC) -c $(CC_SWITCHES) -I. -DTK_LIBRARY=\"${TK_LIBRARY}\" $(GENERIC_DIR)/tkWindow.c
+ 
+ tkButton.o: $(GENERIC_DIR)/tkButton.c
+ 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkButton.c
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 4ba70506b718..1df7553e6c69 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@@ -40,6 +41,16 @@ stdenv.mkDerivation rec {
     sha256 = "+XLVCse6/czxE7HrmdyuNUBGhameVb/vFvOsg7Tel00=";
   };
 
+  patches = [
+    # Backport sqlite-3.42.0 compatibility:
+    #   https://gitlab.gnome.org/GNOME/tracker/-/merge_requests/600
+    (fetchpatch {
+      name = "sqlite-3.42.0.patch";
+      url = "https://gitlab.gnome.org/GNOME/tracker/-/commit/4cbbd1773a7367492fa3b3e3804839654e18a12a.patch";
+      hash = "sha256-w5D9I0P1DdyILhpjslh6ifojmlUiBoeFnxHPIr0rO3s=";
+    })
+  ];
+
   strictDeps = true;
 
   depsBuildBuild = [
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 5153a2b4d262..82874b9a3132 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -3,38 +3,44 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+
+# build-system
 , setuptools
 , setuptools-scm
+
+# dependencies
+, exceptiongroup
 , idna
 , sniffio
-, typing-extensions
-, curio
+
+# optionals
+, trio
+
+# tests
 , hypothesis
-, mock
+, psutil
 , pytest-mock
 , pytest-xdist
 , pytestCheckHook
-, trio
 , trustme
 , uvloop
 }:
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "3.6.2";
+  version = "3.7.0";
   format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "agronholm";
     repo = pname;
     rev = version;
-    hash = "sha256-bootaulvx9zmobQGDirsMz5uxuLeCD9ggAvYkPaKnWo=";
+    hash = "sha256-uXPp2ycYl3T/ybZihDchImC/Yi4qgHI37ZeA+I6dg4c=";
   };
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION=${version}
-  '';
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     setuptools
@@ -44,51 +50,52 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     idna
     sniffio
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    exceptiongroup
   ];
 
+  passthru.optional-dependencies = {
+    trio = [
+      trio
+    ];
+  };
+
   # trustme uses pyopenssl
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
 
   nativeCheckInputs = [
-    curio
     hypothesis
+    psutil
     pytest-mock
     pytest-xdist
     pytestCheckHook
-    trio
     trustme
+  ] ++ lib.optionals (pythonOlder "3.12") [
     uvloop
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    mock
-  ];
+  ] ++ passthru.optional-dependencies.trio;
 
   pytestFlagsArray = [
     "-W" "ignore::trio.TrioDeprecationWarning"
+    "-m" "'not network'"
   ];
 
   disabledTests = [
-    # block devices access
-    "test_is_block_device"
     # INTERNALERROR> AttributeError: 'NonBaseMultiError' object has no attribute '_exceptions'. Did you mean: 'exceptions'?
     "test_exception_group_children"
     "test_exception_group_host"
     "test_exception_group_filtering"
-    # regression in python 3.11.3 and 3.10.11
-    # https://github.com/agronholm/anyio/issues/550
-    "TestTLSStream"
-    "TestTLSListener"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # PermissionError: [Errno 1] Operation not permitted: '/dev/console'
+    "test_is_block_device"
   ];
 
   disabledTestPaths = [
     # lots of DNS lookups
     "tests/test_sockets.py"
-  ] ++ lib.optionals stdenv.isDarwin [
-    # darwin sandboxing limitations
-    "tests/streams/test_tls.py"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "anyio" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/apsw/default.nix b/pkgs/development/python-modules/apsw/default.nix
index 4da1eea51c22..5964274881c6 100644
--- a/pkgs/development/python-modules/apsw/default.nix
+++ b/pkgs/development/python-modules/apsw/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.41.0.0";
+  version = "3.42.0.0";
   format = "setuptools";
 
   disabled = isPyPy;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "rogerbinns";
     repo = "apsw";
     rev = "refs/tags/${version}";
-    hash = "sha256-U7NhC83wBaUONLsQbL+j9866u4zs58O6AQxwzS3e0qM=";
+    hash = "sha256-pLkYTyf2BGRLs4bChb+eo2i5gRRUUJDFyfCBTSJ1RkQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff b/pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff
new file mode 100644
index 000000000000..75b2677e380e
--- /dev/null
+++ b/pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff
@@ -0,0 +1,11 @@
+diff -r c649a735cf82 testing/support.py
+--- a/testing/support.py	Thu Feb 23 05:42:01 2023 +0100
++++ b/testing/support.py	Sat May 20 21:46:56 2023 -0400
+@@ -112,6 +112,7 @@
+                               '-Wno-unreachable-code']
+         # special things for clang
+         extra_compile_args.append('-Qunused-arguments')
++        extra_compile_args.append('-Wno-null-pointer-subtraction')
+     else:
+         # assume a standard gcc
+         extra_compile_args = ['-Werror', '-Wall', '-Wextra', '-Wconversion',
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 5d3e220e98de..0d93941b974d 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -50,6 +50,12 @@ if isPyPy then null else buildPythonPackage rec {
       ];
       hash = "sha256-+2daRTvxtyrCPimOEAmVbiVm1Bso9hxGbaAbd03E+ws=";
     })
+  ] ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc) "13") [
+    # -Wnull-pointer-subtraction is enabled with -Wextra. Suppress it to allow the following tests
+    # to run and pass when cffi is built with newer versions of clang:
+    # - testing/cffi1/test_verify1.py::test_enum_usage
+    # - testing/cffi1/test_verify1.py::test_named_pointer_as_argument
+    ./clang-pointer-substraction-warning.diff
   ] ++  lib.optionals (pythonAtLeast "3.11") [
     # Fix test that failed because python seems to have changed the exception format in the
     # final release. This patch should be included in the next version and can be removed when
diff --git a/pkgs/development/python-modules/flask/default.nix b/pkgs/development/python-modules/flask/default.nix
index 03b1873edc5f..4bcb02880671 100644
--- a/pkgs/development/python-modules/flask/default.nix
+++ b/pkgs/development/python-modules/flask/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "flask";
-  version = "2.2.3";
+  version = "2.2.5";
 
   src = fetchPypi {
     pname = "Flask";
     inherit version;
-    hash = "sha256-frNzmEvxx3ACP86dsWTtDDNTzQtT8TD0aT2gynVqLm0=";
+    hash = "sha256-7e6bCn/yZiG9WowQ/0hK4oc3okENmbC7mmhQx/uXeqA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/imageio/default.nix b/pkgs/development/python-modules/imageio/default.nix
index d919c00e74a6..6989a12bf865 100644
--- a/pkgs/development/python-modules/imageio/default.nix
+++ b/pkgs/development/python-modules/imageio/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     hash = "sha256-XbUIe+XIFOz34sfTChoVyX7Kl9jCbzHdxU12fUpDvOg=";
   };
 
-  patches = [
+  patches = lib.optionals (!stdenv.isDarwin) [
     (substituteAll {
       src = ./libgl-path.patch;
       libgl = "${libGL.out}/lib/libGL${stdenv.hostPlatform.extensions.sharedLibrary}";
diff --git a/pkgs/development/python-modules/mike/default.nix b/pkgs/development/python-modules/mike/default.nix
new file mode 100644
index 000000000000..f107d8e632bd
--- /dev/null
+++ b/pkgs/development/python-modules/mike/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, git
+, importlib-metadata
+, importlib-resources
+, jinja2
+, mkdocs
+, pythonOlder
+, pyyaml
+, unittestCheckHook
+, verspec
+}:
+
+buildPythonPackage rec {
+  pname = "mike";
+  version = "unstable-2023-05-06";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "jimporter";
+    repo = pname;
+    rev = "300593c338b18f61f604d18457c351e166318020";
+    hash = "sha256-Sjj2275IJDtLjG6uO9h4FbgxXTMgqD8c/rJj6iOxfuI=";
+  };
+
+  propagatedBuildInputs = [
+    importlib-metadata
+    importlib-resources
+    jinja2
+    mkdocs
+    pyyaml
+    verspec
+  ];
+
+  nativeCheckInputs = [
+    git
+    unittestCheckHook
+  ];
+
+  preCheck = ''
+    export PATH=$out/bin:$PATH
+  '';
+
+  # Difficult to setup
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "mike"
+  ];
+
+  meta = with lib; {
+    description = "Manage multiple versions of your MkDocs-powered documentation";
+    homepage = "https://github.com/jimporter/mike";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ marsam ];
+  };
+}
diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index 9e7e7bd978ff..daf45528202f 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -73,6 +73,8 @@ buildPythonPackage rec {
     "poetry"
   ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion";
+
   meta = with lib; {
     changelog = "https://github.com/python-poetry/poetry-core/blob/${src.rev}/CHANGELOG.md";
     description = "Core utilities for Poetry";
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 3674c0d74974..1a2851158c52 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -18,6 +18,7 @@
 , withDocs ? (stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.isDarwin && pythonAtLeast "3.10")
 , ansi2html
 , markdown-include
+, mike
 , mkdocs
 , mkdocs-exclude
 , mkdocs-material
@@ -31,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "1.10.7";
+  version = "1.10.8";
   format = "setuptools";
 
   outputs = [
@@ -43,10 +44,10 @@ buildPythonPackage rec {
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
-    owner = "samuelcolvin";
+    owner = "pydantic";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7X7rlHJ5Q01CuB9FZzoUfyfwx6AMXtE1BV5t+LnZKIM=";
+    hash = "sha256-4oJoDlP1grLblF0ppqYM1GYEyNMEM9FssFQjacipmms=";
   };
 
   postPatch = ''
@@ -65,6 +66,7 @@ buildPythonPackage rec {
     ansi2html
     markdown-include
     mdx-truly-sane-lists
+    mike
     mkdocs
     mkdocs-exclude
     mkdocs-material
@@ -120,8 +122,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pydantic" ];
 
   meta = with lib; {
-    homepage = "https://github.com/samuelcolvin/pydantic";
     description = "Data validation and settings management using Python type hinting";
+    homepage = "https://github.com/pydantic/pydantic";
+    changelog = "https://github.com/pydantic/pydantic/blob/v${version}/HISTORY.md";
     license = licenses.mit;
     maintainers = with maintainers; [ wd15 ];
   };
diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index ecc0e307e7f3..94b5d38d3fc8 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -18,17 +18,14 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ pillow ];
 
   patchPhase = let
-    ext = stdenv.hostPlatform.extensions.sharedLibrary; in ''
+    ext = stdenv.hostPlatform.extensions.sharedLibrary; in lib.optionalString (!stdenv.isDarwin) ''
     # Theses lines are patching the name of dynamic libraries
     # so pyopengl can find them at runtime.
     substituteInPlace OpenGL/platform/glx.py \
       --replace "'GL'" "'${pkgs.libGL}/lib/libGL${ext}'" \
       --replace "'GLU'" "'${pkgs.libGLU}/lib/libGLU${ext}'" \
       --replace "'glut'" "'${pkgs.freeglut}/lib/libglut${ext}'"
-    substituteInPlace OpenGL/platform/darwin.py \
-      --replace "'OpenGL'" "'${pkgs.libGL}/lib/libGL${ext}'" \
-      --replace "'GLUT'" "'${pkgs.freeglut}/lib/libglut${ext}'"
-
+  '' + ''
     # https://github.com/NixOS/nixpkgs/issues/76822
     # pyopengl introduced a new "robust" way of loading libraries in 3.1.4.
     # The later patch of the filepath does not work anymore because
diff --git a/pkgs/development/python-modules/verspec/default.nix b/pkgs/development/python-modules/verspec/default.nix
new file mode 100644
index 000000000000..05a6a446c23e
--- /dev/null
+++ b/pkgs/development/python-modules/verspec/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pretend
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "verspec";
+  version = "0.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-xFBMppeyBWzbS/pxIUYfWg6BgJJVtBwD3aS6gjY3wB4=";
+  };
+
+  nativeCheckInputs = [
+    pretend
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # Import fail
+    "test/test_specifiers.py"
+  ];
+
+  pythonImportsCheck = [
+    "verspec"
+  ];
+
+  meta = with lib; {
+    description = "Flexible version handling";
+    homepage = "https://github.com/jimporter/verspec";
+    changelog = "https://github.com/jimporter/averspec/releases/tag/v${version}";
+    license = with licenses; [ bsd2 /* and */ asl20 ];
+    maintainers = with maintainers; [ marsam ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
new file mode 100644
index 000000000000..2de9484226b1
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
@@ -0,0 +1,51 @@
+From 1643ed0d8a9201732905bee51b096605d26aaaac Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Fri, 26 May 2023 00:10:45 -0400
+Subject: [PATCH] Fix test failures on Darwin on a case-sensitive fs
+
+This issue was encounetered while working on a contribution to nixpkgs.
+Nix allows the store to be installed on a separate, case-sensitive APFS
+volume. When the store is on a case-sensitive volume, these tests fail
+because they try to use `foundation` instead of `Foundation`.
+---
+ .../failing/78 framework dependency with version/meson.build    | 2 +-
+ test cases/objc/2 nsstring/meson.build                          | 2 +-
+ test cases/osx/6 multiframework/meson.build                     | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/test cases/failing/78 framework dependency with version/meson.build b/test cases/failing/78 framework dependency with version/meson.build
+index b7e04bab446..ee315ebcbd7 100644
+--- a/test cases/failing/78 framework dependency with version/meson.build	
++++ b/test cases/failing/78 framework dependency with version/meson.build	
+@@ -5,4 +5,4 @@ if host_machine.system() != 'darwin'
+ endif
+ 
+ # do individual frameworks have a meaningful version to test?  And multiple frameworks might be listed...
+-dep = dependency('appleframeworks', modules: 'foundation', version: '>0')
++dep = dependency('appleframeworks', modules: 'Foundation', version: '>0')
+diff --git a/test cases/objc/2 nsstring/meson.build b/test cases/objc/2 nsstring/meson.build
+index 94d2cf18ab4..2c483d50d68 100644
+--- a/test cases/objc/2 nsstring/meson.build	
++++ b/test cases/objc/2 nsstring/meson.build	
+@@ -1,7 +1,7 @@
+ project('nsstring', 'objc')
+ 
+ if host_machine.system() == 'darwin'
+-  dep = dependency('appleframeworks', modules : 'foundation')
++  dep = dependency('appleframeworks', modules : 'Foundation')
+ elif host_machine.system() == 'cygwin'
+   error('MESON_SKIP_TEST GNUstep is not packaged for Cygwin.')
+ else
+diff --git a/test cases/osx/6 multiframework/meson.build b/test cases/osx/6 multiframework/meson.build
+index 28846243b21..57e5d61560b 100644
+--- a/test cases/osx/6 multiframework/meson.build	
++++ b/test cases/osx/6 multiframework/meson.build	
+@@ -4,7 +4,7 @@ project('multiframework', 'objc')
+ # that causes a build failure when defining two modules. The
+ # arguments for the latter module overwrote the arguments for
+ # the first one rather than adding to them.
+-cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'foundation'])
++cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'Foundation'])
+ 
+ executable('deptester',
+   'main.m',
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index f6004285ddb4..3914f6584096 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -26,6 +26,10 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   patches = [
+    # Fix Meson tests that fail when the Nix store is case-sensitive APFS.
+    # https://github.com/mesonbuild/meson/pull/11820
+    ./darwin-case-sensitive-fs.patch
+
     # Meson is currently inspecting fewer variables than autoconf does, which
     # makes it harder for us to use setup hooks, etc.  Taken from
     # https://github.com/mesonbuild/meson/pull/6827
diff --git a/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch b/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch
new file mode 100644
index 000000000000..838fbf722761
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch
@@ -0,0 +1,23 @@
+diff --git a/bfd/elf.c b/bfd/elf.c
+index 027d0143735..185028cbd97 100644
+--- a/bfd/elf.c
++++ b/bfd/elf.c
+@@ -9030,6 +9030,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return_verdef;
+ 	}
++
++      if (amt == 0)
++	goto error_return_verdef;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return_verdef;
+@@ -9133,6 +9136,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return;
+ 	}
++      if (amt == 0)
++	goto error_return;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return;
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 0db491f225c1..0a2610ffd2e7 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -88,6 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
     # not need to know binutils' BINDIR at all. It's an absolute path
     # where libraries are stored.
     ./plugins-no-BINDIR.patch
+
+    # CVE-2023-1972 fix to bfd/elf.c from:
+    # https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57
+    ./CVE-2023-1972.patch
   ]
   ++ lib.optional targetPlatform.isiOS ./support-ios.patch
   # Adds AVR-specific options to "size" for compatibility with Atmel's downstream distribution
diff --git a/pkgs/development/tools/misc/gperf/default.nix b/pkgs/development/tools/misc/gperf/default.nix
index d836e5a973ae..c6b6e89495c0 100644
--- a/pkgs/development/tools/misc/gperf/default.nix
+++ b/pkgs/development/tools/misc/gperf/default.nix
@@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "1qispg6i508rq8pkajh26cznwimbnj06wq9sd85vg95v8nwld1aq";
   };
 
+  patches = [
+    # Clang 16 defaults to C++17, which does not allow `register` as a storage class specifier.
+    ./gperf-c++17-register-fix.patch
+  ];
+
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch b/pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch
new file mode 100644
index 000000000000..bb8c414a1a26
--- /dev/null
+++ b/pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/getline.cc b/lib/getline.cc
+index c57c633..0984a7c 100644
+--- a/lib/getline.cc
++++ b/lib/getline.cc
+@@ -55,7 +55,7 @@ getstr (char **lineptr, size_t *n, FILE *stream, char terminator, size_t offset)
+ 
+   for (;;)
+     {
+-      register int c = getc (stream);
++      int c = getc (stream);
+ 
+       /* We always want at least one char left in the buffer, since we
+          always (unless we get an error while reading the first char)
diff --git a/pkgs/development/tools/misc/pkg-config/default.nix b/pkgs/development/tools/misc/pkg-config/default.nix
index d4feca6dfe6e..b883dab6cc14 100644
--- a/pkgs/development/tools/misc/pkg-config/default.nix
+++ b/pkgs/development/tools/misc/pkg-config/default.nix
@@ -35,6 +35,9 @@ stdenv.mkDerivation rec {
          "ac_cv_func_posix_getgrgid_r=yes"
        ];
 
+  # Silence "incompatible integer to pointer conversion passing 'gsize'" when building with Clang.
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion";
+
   enableParallelBuilding = true;
   doCheck = true;
 
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index d9f136f81389..44e46355d0bf 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchurl
-, fetchpatch
 , pkg-config
 , removeReferencesTo
 , zlib
@@ -24,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cups";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchurl {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "sha256-8DzLQLCH0eMJQKQOAUHcu6Jj85l0wg658lIQZsnGyQg=";
+    sha256 = "sha256-nd65jyDpyfSvEhwrEFPnQgt5vWdw8a3tKGYwPSdSb28=";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];
@@ -41,6 +40,9 @@ stdenv.mkDerivation rec {
       # service would stop the socket and break subsequent socket activations.
       # See https://github.com/apple/cups/issues/6005
       sed -i '/PartOf=cups.service/d' scheduler/cups.socket.in
+  '' + lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "12") ''
+    substituteInPlace backend/usb-darwin.c \
+      --replace "kIOMainPortDefault" "kIOMasterPortDefault"
   '';
 
   nativeBuildInputs = [ pkg-config removeReferencesTo ];
@@ -134,7 +136,12 @@ stdenv.mkDerivation rec {
         --replace "Exec=htmlview" "Exec=xdg-open"
     '';
 
-  passthru.tests.nixos = nixosTests.printing;
+  passthru.tests = {
+    inherit (nixosTests)
+      printing-service
+      printing-socket
+    ;
+  };
 
   meta = with lib; {
     homepage = "https://openprinting.github.io/cups/";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
index 910b42b0c9d4..7d1066a25915 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
@@ -32,6 +32,9 @@ in appleDerivation {
 
     substituteInPlace Makefile --replace perl true
 
+    substituteInPlace colldef.tproj/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
+
     for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
       substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
         --replace /usr/share/locale "" \
@@ -42,6 +45,10 @@ in appleDerivation {
 
   preBuild = ''
     cp -r --no-preserve=all ${recentAdvCmds}/colldef .
+
+    substituteInPlace colldef/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
+
     pushd colldef
     mv locale/collate.h .
     flex -t -8 -i scan.l > scan.c
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index 9c7d4f7702fb..e44241171c60 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -6,6 +6,8 @@ appleDerivation {
   patchPhase = ''
     substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
       --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
+    substituteInPlace colldef/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
   '';
 
   # pkill requires special private headers that are unavailable in
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 262cb3d6a387..62003a6e4a6c 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -34,7 +34,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
       --replace "-Werror " ""
 
     substituteInPlace SETUP/kextsymboltool/Makefile \
-      --replace "-lstdc++" "-lc++"
+      --replace "-lstdc++" "-lc++ -lc++abi"
 
     substituteInPlace libsyscall/xcodescripts/mach_install_mig.sh \
       --replace "/usr/include" "/include" \
diff --git a/pkgs/os-specific/darwin/rewrite-tbd/default.nix b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
index e5ef118e514c..5cf63754dfbb 100644
--- a/pkgs/os-specific/darwin/rewrite-tbd/default.nix
+++ b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, libyaml }:
+{ stdenv, lib, fetchFromGitHub, libyaml }:
 
 stdenv.mkDerivation {
   pname = "rewrite-tbd";
@@ -11,9 +11,17 @@ stdenv.mkDerivation {
     sha256 = "08sk91zwj6n9x2ymwid2k7y0rwv5b7p6h1b25ipx1dv0i43p6v1a";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  # Nix takes care of these paths. Avoiding the use of `pkg-config` prevents an infinite recursion.
+  postPatch = ''
+    substituteInPlace Makefile.boot \
+      --replace '$(shell pkg-config --cflags yaml-0.1)' "" \
+      --replace '$(shell pkg-config --libs yaml-0.1)' "-lyaml"
+  '';
+
   buildInputs = [ libyaml ];
 
+  makeFlags = [ "-f" "Makefile.boot" "PREFIX=${placeholder "out"}"];
+
   meta = with lib; {
     homepage = "https://github.com/thefloweringash/rewrite-tbd/";
     description = "Rewrite filepath in .tbd to Nix applicable format";
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index c71980d94373..33cdc0fb8450 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  apparmor-version = "3.1.3";
+  apparmor-version = "3.1.4";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -36,7 +36,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-6N1BStOXKui6BxSriWVoOkvyGRUJ4btsloHh/SsG/JE=";
+    hash = "sha256-YWPdIUd+2x74tqiW+YX8NKh3jxSKhD+5zdiDMjhPzpE=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 0dd9fcb45bf4..bde39a41b525 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.56";
+  version = "0.57";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-aCQ7I4XgxswQRfzzZG3MYe+W3dPWWex5MErMc0ZilSA=";
+    sha256 = "sha256-9d9WMCByQ1TKWpzWe5msts1LG+BKKqwCgaMBbD74/+4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch b/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch
deleted file mode 100644
index 2b59a508fdac..000000000000
--- a/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 1640688018f329559c61352646f283f98938af31 Mon Sep 17 00:00:00 2001
-From: Cole Helbling <cole.helbling@determinate.systems>
-Date: Thu, 16 Feb 2023 09:30:21 -0800
-Subject: [PATCH] Revert "RDMA/irdma: Report the correct link speed"
-
-This reverts commit 425c9bd06b7a70796d880828d15c11321bdfb76d.
-
-Some Equinix Metal instances, such as a3.large.x86, m3.large.x86
-(specific hardware revisions), and n3.large.x86, use the `ice` kernel
-driver for their network cards, in conjunction with bonded devices.
-However, this commit caused a regression where these bonded devices
-would deadlock. This was initially reported by Jaroslav Pulchart on
-the netdev mailing list[1], and there were follow-up patches from Dave
-Ertman[2][3] that attempted to fix this but were not up to snuff for
-various reasons[4].
-
-Specifically, v2 of the patch ([3]) appears to fix the issue on some
-devices (tested with 8086:159B network cards), while it is still broken
-on others (such as an 8086:1593 network card).
-
-We revert the patch exposing the issue until upstream has a working
-solution in order to make Equinix Metal instances work reliably again.
-
-[1]: https://lore.kernel.org/netdev/CAK8fFZ6A_Gphw_3-QMGKEFQk=sfCw1Qmq0TVZK3rtAi7vb621A@mail.gmail.com/
-[2]: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230111183145.1497367-1-david.m.ertman@intel.com/
-[3]: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230215191757.1826508-1-david.m.ertman@intel.com/
-[4]: https://lore.kernel.org/netdev/cb31a911-ba80-e2dc-231f-851757cfd0b8@intel.com/T/#m6e53f8c43093693c10268140126abe99e082dc1c
----
- drivers/infiniband/hw/irdma/verbs.c | 35 ++++++++++++++++++++++++++---
- 1 file changed, 32 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
-index c5971a840b87..911902d2b93e 100644
---- a/drivers/infiniband/hw/irdma/verbs.c
-+++ b/drivers/infiniband/hw/irdma/verbs.c
-@@ -60,6 +60,36 @@ static int irdma_query_device(struct ib_device *ibdev,
- 	return 0;
- }
- 
-+/**
-+ * irdma_get_eth_speed_and_width - Get IB port speed and width from netdev speed
-+ * @link_speed: netdev phy link speed
-+ * @active_speed: IB port speed
-+ * @active_width: IB port width
-+ */
-+static void irdma_get_eth_speed_and_width(u32 link_speed, u16 *active_speed,
-+					  u8 *active_width)
-+{
-+	if (link_speed <= SPEED_1000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_SDR;
-+	} else if (link_speed <= SPEED_10000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_FDR10;
-+	} else if (link_speed <= SPEED_20000) {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_DDR;
-+	} else if (link_speed <= SPEED_25000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_EDR;
-+	} else if (link_speed <= SPEED_40000) {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_FDR10;
-+	} else {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_EDR;
-+	}
-+}
-+
- /**
-  * irdma_query_port - get port attributes
-  * @ibdev: device pointer from stack
-@@ -87,9 +117,8 @@ static int irdma_query_port(struct ib_device *ibdev, u32 port,
- 		props->state = IB_PORT_DOWN;
- 		props->phys_state = IB_PORT_PHYS_STATE_DISABLED;
- 	}
--
--	ib_get_eth_speed(ibdev, port, &props->active_speed,
--			 &props->active_width);
-+	irdma_get_eth_speed_and_width(SPEED_100000, &props->active_speed,
-+				      &props->active_width);
- 
- 	if (rdma_protocol_roce(ibdev, 1)) {
- 		props->gid_tbl_len = 32;
--- 
-2.39.0
-
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index f2225096dd5c..972235c7f852 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -58,11 +58,6 @@
     patch = ./export-rt-sched-migrate.patch;
   };
 
-  fix-em-ice-bonding = {
-    name = "fix-em-ice-bonding";
-    patch = ./fix-em-ice-bonding.patch;
-  };
-
   CVE-2023-32233 = rec {
     name = "CVE-2023-32233";
     patch = fetchpatch {
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 1ba14c5f4714..0f60a8655ced 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   configureFlags = [
     "--without-python"
   ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index fbf56b8c30af..7275d275f74b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -190,6 +190,16 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-inherit-systemd-environment-when-calling-generators.patch
     ./0018-core-don-t-taint-on-unmerged-usr.patch
     ./0019-tpm2_context_init-fix-driver-name-checking.patch
+
+    (fetchpatch {
+      # https://github.com/systemd/systemd/pull/25948
+      #
+      # [Firmware file size bug]: Some UEFI firmwares fail on large
+      # reads. Now that systemd-boot loads initrd itself, systems with
+      # such firmware won't boot without this fix
+      url = "https://github.com/systemd/systemd/commit/3ed1d966f00b002ed822ca9de116252bd91fe6c3.patch";
+      hash = "sha256-pwXrLTScqgnvfddlzUBZpwsoMrvRLcZPp6e4whMcyL4=";
+    })
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 3b8d5f53e787..7b98c6bcd9d2 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, zlib, shadow
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, zlib, shadow
 , capabilitiesSupport ? stdenv.isLinux
 , libcap_ng
 , libxcrypt
@@ -28,6 +28,16 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
+
+    # FIXME: backport mount fixes for older kernels, remove in next release
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/f94a7760ed7ce81389a6059f020238981627a70d.diff";
+      hash = "sha256-UorqDeECK8pBePkmpo2x90p/jP3rCMshyPCyijSX1wo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/1bd85b64632280d6bf0e86b4ff29da8b19321c5f.diff";
+      hash = "sha256-dgu4de5ul/si7Vzwe8lr9NvsdI1CWfDQKuqvARaY6sE=";
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "lib" "man" ];
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 1861b044a394..1f596ada5a0b 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -29,13 +29,23 @@ if [ -n "$__structuredAttrs" ]; then
         export "$outputName=${outputs[$outputName]}"
     done
 
+    # Before Nix 2.4, $NIX_ATTRS_*_FILE was named differently:
+    # https://github.com/NixOS/nix/commit/27ce722
+    if [[ -n "${ATTRS_JSON_FILE:-}" ]]; then
+        export NIX_ATTRS_JSON_FILE="$ATTRS_JSON_FILE"
+    fi
+
+    if [[ -n "${ATTRS_SH_FILE:-}" ]]; then
+        export NIX_ATTRS_SH_FILE="$ATTRS_SH_FILE"
+    fi
+
     # $NIX_ATTRS_JSON_FILE pointed to the wrong location in sandbox
     # https://github.com/NixOS/nix/issues/6736; please keep around until the
     # fix reaches *every patch version* that's >= lib/minver.nix
-    if ! [[ -e "$NIX_ATTRS_JSON_FILE" ]]; then
+    if ! [[ -e "${NIX_ATTRS_JSON_FILE:-}" ]]; then
         export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
     fi
-    if ! [[ -e "$NIX_ATTRS_SH_FILE" ]]; then
+    if ! [[ -e "${NIX_ATTRS_SH_FILE:-}" ]]; then
         export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
     fi
 else
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index 584b000a3e29..f745f4f091ab 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
   ]
     # TODO make full dictionary
     ++ lib.optional stdenv.hostPlatform.isMinGW "TARGET_OS=MINGW"
+    ++ lib.optional stdenv.hostPlatform.isLinux "TARGET_OS=Linux"
     ;
 
   doCheck = false; # tests take a very long time
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index ee7350fbc9db..5ecb8642c5b0 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -10,7 +10,6 @@
 , fontconfig
 , gd
 , gts
-, libdevil
 , libjpeg
 , libpng
 , libtool
@@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
     fontconfig
     gd
     gts
-    libdevil
     pango
     bash
   ] ++ optionals withXorg (with xorg; [ libXrender libXaw libXpm ])
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 8ecbe342034a..beee4241c541 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -32,18 +32,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "coreutils" + (optionalString (!minimal) "-full");
-  version = "9.1";
+  version = "9.3";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz";
-    sha256 = "sha256-YaH0ENeLp+fzelpPUObRMgrKMzdUhKMlXt3xejhYBCM=";
+    hash = "sha256-rbz8/omSNbceh2jc8HzVMlILf1T5qAZIQ/jRmakEu6o=";
   };
 
-  patches = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
-    # Workaround for https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51433
-    ./disable-seek-hole.patch
-  ];
-
   postPatch = ''
     # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh
diff --git a/pkgs/tools/misc/coreutils/disable-seek-hole.patch b/pkgs/tools/misc/coreutils/disable-seek-hole.patch
deleted file mode 100644
index 89503287980d..000000000000
--- a/pkgs/tools/misc/coreutils/disable-seek-hole.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-diff --git a/src/copy.c b/src/copy.c
-index cb9018f93..2a4ccc061 100644
---- a/src/copy.c
-+++ b/src/copy.c
-@@ -502,7 +502,7 @@ write_zeros (int fd, off_t n_bytes)
-   return true;
- }
-
--#ifdef SEEK_HOLE
-+#if 0
- /* Perform an efficient extent copy, if possible.  This avoids
-    the overhead of detecting holes in hole-introducing/preserving
-    copy, and thus makes copying sparse files much more efficient.
-@@ -1095,7 +1095,7 @@ infer_scantype (int fd, struct stat const *sb,
-          && ST_NBLOCKS (*sb) < sb->st_size / ST_NBLOCKSIZE))
-     return PLAIN_SCANTYPE;
-
--#ifdef SEEK_HOLE
-+#if 0
-   scan_inference->ext_start = lseek (fd, 0, SEEK_DATA);
-   if (0 <= scan_inference->ext_start)
-     return LSEEK_SCANTYPE;
-@@ -1377,7 +1377,7 @@ copy_reg (char const *src_name, char const *dst_name,
-       off_t n_read;
-       bool wrote_hole_at_eof = false;
-       if (! (
--#ifdef SEEK_HOLE
-+#if 0
-              scantype == LSEEK_SCANTYPE
-              ? lseek_copy (source_desc, dest_desc, buf, buf_size, hole_size,
-                            scan_inference.ext_start, src_open_sb.st_size,
-diff --git a/tests/seek-data-capable b/tests/seek-data-capable
-index cc6372214..6e7a9ec1e 100644
---- a/tests/seek-data-capable
-+++ b/tests/seek-data-capable
-@@ -1,5 +1,7 @@
- import sys, os, errno, platform
-
-+sys.exit(1)
-+
- # Pass an _empty_ file
- if len(sys.argv) != 2:
-     sys.exit(1)
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 1ea893948dc5..8cce7012f028 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -5,10 +5,10 @@ let
   };
 in rec {
   openconnect = common rec {
-    version = "9.01";
+    version = "9.12";
     src = fetchurl {
       url = "ftp://ftp.infradead.org/pub/openconnect/openconnect-${version}.tar.gz";
-      sha256 = "sha256-s9f6+DDpeTKZ1qQegdhM1KPieJwUjJ5ZjkWFAQCQ5Mc=";
+      sha256 = "sha256-or7c46pN/nXjbkB+SOjovJHUbe9TNayVZPv5G9SyQT4=";
     };
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6089c2a28597..d1008c0c5d95 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8253,7 +8253,6 @@ with pkgs;
   graphviz-nox = callPackage ../tools/graphics/graphviz {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
     withXorg = false;
-    libdevil = libdevil-nox;
   };
 
   grass-sass = callPackage ../tools/misc/grass-sass { };
@@ -23089,17 +23088,10 @@ with pkgs;
   # Default libGLU
   libGLU = mesa_glu;
 
-  # Keep Mesa 22.3 for now because 23.0 does not build on Darwin.
-  # FIXME: remove, also investigate why we even need Mesa on Darwin.
-  mesa_22_3 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/22.3.nix {
+  mesa = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa {
     inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
     inherit (darwin.apple_sdk_11_0.libs) Xplugin;
   };
-  mesa_23_0 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/23.0.nix {
-    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
-    inherit (darwin.apple_sdk_11_0.libs) Xplugin;
-  };
-  mesa = if stdenv.isDarwin then mesa_22_3 else mesa_23_0;
 
   mesa_glu =  callPackage ../development/libraries/mesa-glu {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index 15baf5ba7291..f4d2fd06a90c 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -66,7 +66,10 @@ rec {
         echo "Compiling a custom test"
         set -x
         emcc -O2 -s EMULATE_FUNCTION_POINTER_CASTS=1 xmllint.o \
-        ./.libs/libxml2.a `pkg-config zlib --cflags` `pkg-config zlib --libs` -o ./xmllint.test.js \
+        ./.libs/''
+      + pkgs.lib.optionalString pkgs.stdenv.isDarwin "libxml2.dylib "
+      + pkgs.lib.optionalString (!pkgs.stdenv.isDarwin) "libxml2.a "
+      + '' `pkg-config zlib --cflags` `pkg-config zlib --libs` -o ./xmllint.test.js \
         --embed-file ./test/xmlid/id_err1.xml
 
         echo "Using node to execute the test which basically outputs an error on stderr which we grep for"
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index caaf18b35717..4c0d727f5a17 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -154,7 +154,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
@@ -170,7 +169,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
@@ -178,7 +176,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
         kernelPatches.export-rt-sched-migrate
       ];
     };
@@ -187,7 +184,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 08421b557c20..3d9f828e8366 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6230,6 +6230,8 @@ self: super: with self; {
 
   migen = callPackage ../development/python-modules/migen { };
 
+  mike = callPackage ../development/python-modules/mike { };
+
   milc = callPackage ../development/python-modules/milc { };
 
   milksnake = callPackage ../development/python-modules/milksnake { };
@@ -12816,6 +12818,8 @@ self: super: with self; {
 
   versiontools = callPackage ../development/python-modules/versiontools { };
 
+  verspec = callPackage ../development/python-modules/verspec { };
+
   vertica-python = callPackage ../development/python-modules/vertica-python { };
 
   veryprettytable = callPackage ../development/python-modules/veryprettytable { };
diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix
index 333e285cef0a..f2cc7ae471a4 100644
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@@ -89,7 +89,7 @@ with import ./release-lib.nix { inherit supportedSystems nixpkgsArgs; };
   man-pages = linux;
   mc = all;
   mdadm = linux;
-  mesa = mesaPlatforms;
+  mesa = linux;
   mingetty = linux;
   mktemp = all;
   monotone = linux;