Merge #198236: staging-next 2022-10-28

2022-11-02 17:33:20 +01:00 · 2022-11-02 17:33:20 +01:00 · 27eae99b3e
commit 27eae99b3e
parent aaef5af8b9 ceefe5ed44
112 changed files with 771 additions and 829 deletions
--- a/nixos/modules/services/hardware/pcscd.nix
+++ b/nixos/modules/services/hardware/pcscd.nix
@ -5,6 +5,10 @@ with lib;
 let
  cfgFile = pkgs.writeText "reader.conf" config.services.pcscd.readerConfig;

+  package = if config.security.polkit.enable
+              then pkgs.pcscliteWithPolkit
+              else pkgs.pcsclite;
+
  pluginEnv = pkgs.buildEnv {
    name = "pcscd-plugins";
    paths = map (p: "${p}/pcsc/drivers") config.services.pcscd.plugins;
@ -49,8 +53,8 @@ in

    environment.etc."reader.conf".source = cfgFile;

-    environment.systemPackages = [ pkgs.pcsclite ];
-    systemd.packages = [ (getBin pkgs.pcsclite) ];
+    environment.systemPackages = [ package ];
+    systemd.packages = [ (getBin package) ];

    systemd.sockets.pcscd.wantedBy = [ "sockets.target" ];

@ -66,7 +70,7 @@ in
      # around it, we force the path to the cfgFile.
      #
      # https://github.com/NixOS/nixpkgs/issues/121088
-      serviceConfig.ExecStart = [ "" "${getBin pkgs.pcsclite}/bin/pcscd -f -x -c ${cfgFile}" ];
+      serviceConfig.ExecStart = [ "" "${getBin package}/bin/pcscd -f -x -c ${cfgFile}" ];
    };
  };
 }
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "fluidsynth";
-  version = "2.2.9";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "FluidSynth";
    repo = "fluidsynth";
    rev = "v${version}";
-    sha256 = "sha256-8vsYn/4qkANp6f6avtdaXHfJD+9NTHTrl7i4RTlKXPQ=";
+    sha256 = "sha256-7SuM7a8IIecAJ83QvJfUba/wArAEXywqL2HwVbeG8H4=";
  };

  nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
--- a/pkgs/applications/networking/qv2ray/default.nix
+++ b/pkgs/applications/networking/qv2ray/default.nix
@ -11,7 +11,6 @@
 , openssl
 , pkg-config
 , c-ares
-, abseil-cpp
 , libGL
 , zlib
 , curl
@ -51,7 +50,6 @@ mkDerivation rec {
    grpc
    protobuf
    openssl
-    abseil-cpp
    c-ares
  ];

--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.38.0";
+  version = "2.38.1";
  svn = subversionClient.override { perlBindings = perlSupport; };
  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-kj6t4msYFN540GvajgqfXai3xLMEs/kFD/tGTwMQMgo=";
+    sha256 = "sha256-l9346liiueD7wlCOJFAoynWRG9ONFVFhaxSMGqV0Ctk=";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
@ -207,6 +207,7 @@ stdenv.mkDerivation (finalAttrs: {
      # Also put git-http-backend into $PATH, so that we can use smart
      # HTTP(s) transports for pushing
      ln -s $out/libexec/git-core/git-http-backend $out/bin/git-http-backend
+      ln -s $out/share/git/contrib/git-jump/git-jump $out/bin/git-jump
    '' + lib.optionalString perlSupport ''
      # wrap perl commands
      makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc.perl" $out/bin/git-credential-netrc \
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -274,9 +274,7 @@ stdenv.mkDerivation {

  setupHooks = [
    ../setup-hooks/role.bash
-  ] ++ lib.optional (cc.langC or true)
-        # Temporary hack; see https://github.com/NixOS/nixpkgs/pull/191724#issuecomment-1278602576
-        (if stdenv.isLinux then ./setup-hook.sh else ./setup-hook-nonlinux.sh)
+  ] ++ lib.optional (cc.langC or true) ./setup-hook.sh
    ++ lib.optional (cc.langFortran or false) ./fortran-hook.sh;

  postFixup =
--- a/pkgs/build-support/cc-wrapper/setup-hook-nonlinux.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook-nonlinux.sh
@ -1,120 +0,0 @@
-# CC Wrapper hygiene
-#
-# For at least cross compilation, we need to depend on multiple cc-wrappers at
-# once---specifically up to one per sort of dependency. This follows from having
-# different tools targeting different platforms, and different flags for those
-# tools. For example:
-#
-#   # Flags for compiling (whether or not linking) C code for the...
-#   NIX_CFLAGS_COMPILE_FOR_BUILD  # ...build platform
-#   NIX_CFLAGS_COMPILE            # ...host platform
-#   NIX_CFLAGS_COMPILE_FOR_TARGET # ...target platform
-#
-# Notice that these platforms are the 3 *relative* to the package using
-# cc-wrapper, not absolute like `x86_64-pc-linux-gnu`.
-#
-# The simplest solution would be to have separate cc-wrappers per (3 intended
-# use-cases * n absolute concrete platforms). For the use-case axis, we would
-# @-splice in 'BUILD_' '' 'TARGET_' to use the write environment variables when
-# building the cc-wrapper, and likewise prefix the binaries' names so they didn't
-# clobber each other on the PATH. But the need for 3x cc-wrappers, along with
-# non-standard name prefixes, is annoying and liable to break packages' build
-# systems.
-#
-# Instead, we opt to have just one cc-wrapper per absolute platform. Matching
-# convention, the binaries' names can just be prefixed with their target
-# platform. On the other hand, that means packages will depend on not just
-# multiple cc-wrappers, but the exact same cc-wrapper derivation multiple ways.
-# That means the exact same cc-wrapper derivation must be able to avoid
-# conflicting with itself, despite the fact that `setup-hook.sh`, the `addCvars`
-# function, and `add-flags.sh` are all communicating with each other with
-# environment variables. Yuck.
-#
-# The basic strategy is:
-#
-#  - Everyone exclusively *adds information* to relative-platform-specific
-#    environment variables, like `NIX_CFLAGS_COMPILE_FOR_TARGET`, to communicate
-#    with the wrapped binaries.
-#
-#  - The wrapped binaries will exclusively *read* cc-wrapper-derivation-specific
-#    environment variables distinguished with with `suffixSalt`, like
-#    `NIX_CFLAGS_COMPILE_@suffixSalt@`.
-#
-#  - `add-flags`, beyond its old task of reading extra flags stuck inside the
-#    cc-wrapper derivation, will convert the relative-platform-specific
-#    variables to cc-wrapper-derivation-specific variables. This conversion is
-#    the only time all but one of the cc-wrapper-derivation-specific variables
-#    are set.
-#
-# This ensures the flow of information is exclusive from
-# relative-platform-specific variables to cc-wrapper-derivation-specific
-# variables. This allows us to support the general case of a many--many relation
-# between relative platforms and cc-wrapper derivations.
-#
-# For more details, read the individual files where the mechanisms used to
-# accomplish this will be individually documented.
-
-# Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
-# native compile.
-#
-# TODO(@Ericson2314): No native exception
-[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
-
-# It's fine that any other cc-wrapper will redefine this. Bash functions close
-# over no state, and there's no @-substitutions within, so any redefined
-# function is guaranteed to be exactly the same.
-ccWrapper_addCVars () {
-    # See ../setup-hooks/role.bash
-    local role_post
-    getHostRoleEnvHook
-
-    if [ -d "$1/include" ]; then
-        export NIX_CFLAGS_COMPILE${role_post}+=" -isystem $1/include"
-    fi
-
-    if [ -d "$1/Library/Frameworks" ]; then
-        export NIX_CFLAGS_COMPILE${role_post}+=" -iframework $1/Library/Frameworks"
-    fi
-}
-
-# See ../setup-hooks/role.bash
-getTargetRole
-getTargetRoleWrapper
-
-# We use the `targetOffset` to choose the right env hook to accumulate the right
-# sort of deps (those with that offset).
-addEnvHooks "$targetOffset" ccWrapper_addCVars
-
-# Note 1: these come *after* $out in the PATH (see setup.sh).
-# Note 2: phase separation makes this look useless to shellcheck.
-
-# shellcheck disable=SC2157
-if [ -n "@cc@" ]; then
-    addToSearchPath _PATH @cc@/bin
-fi
-
-# shellcheck disable=SC2157
-if [ -n "@libc_bin@" ]; then
-    addToSearchPath _PATH @libc_bin@/bin
-fi
-
-# shellcheck disable=SC2157
-if [ -n "@coreutils_bin@" ]; then
-    addToSearchPath _PATH @coreutils_bin@/bin
-fi
-
-# Export tool environment variables so various build systems use the right ones.
-
-export NIX_CC${role_post}=@out@
-
-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
-
-# If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
-export NIX_HARDENING_ENABLE
-
-# No local scope in sourced file
-unset -v role_post
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@ -69,12 +69,10 @@ ccWrapper_addCVars () {
    getHostRoleEnvHook

    if [ -d "$1/include" ]; then
-        (! echo "$NIX_CFLAGS_COMPILE" | grep -q -F "$1/include") &&
        export NIX_CFLAGS_COMPILE${role_post}+=" -isystem $1/include"
    fi

    if [ -d "$1/Library/Frameworks" ]; then
-        (! echo "$NIX_CFLAGS_COMPILE" | grep -q -F "$1/Library/Frameworks") &&
        export NIX_CFLAGS_COMPILE${role_post}+=" -iframework $1/Library/Frameworks"
    fi
 }
@ -109,8 +107,6 @@ fi

 export NIX_CC${role_post}=@out@

-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
 export CC${role_post}=@named_cc@
 export CXX${role_post}=@named_cxx@

--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "glslang";
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "glslang";
    rev = "sdk-${version}";
-    hash = "sha256-VEOENuy/VhYBBX52O4QHJFXUjsj6jL4vDD4cLDlQcIA=";
+    hash = "sha256-huPrQr+lPi7QCF8CufAavHEKGDDimGrcskiojhH9QYk=";
  };

  # These get set at all-packages, keep onto them for child drvs
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.18.7";
+  version = "1.18.8";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-lGfjO4Gfcb67IfsO4d1nlP0iRK6UkHqYQoZxL5g5qUQ=";
+    sha256 = "sha256-H3mAIwUBVHnnfYxkFTC8VOyZRlfVxSceAXLrcRg0ahI=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.19.2";
+  version = "1.19.3";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-LOkw1wqTHeZg/a8nHXAZJ5OxskAnJkW/AnV3n2cE32s=";
+    sha256 = "sha256-GKwmPjkhC89o2F9DcOl/sXNBZplaH2P7OLT24H2Q0hI=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/llvm/10/compiler-rt/X86-support-extension.patch
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/X86-support-extension.patch
@ -0,0 +1,23 @@
+diff --git a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
+index 3a66dd9c3fb..7efc85d9f9f 100644
+--- a/lib/builtins/CMakeLists.txt
+++ b/lib/builtins/CMakeLists.txt
+@@ -301,6 +301,10 @@ if (NOT MSVC)
+     i386/umoddi3.S
+   )
+ 
+  set(i486_SOURCES ${i386_SOURCES})
+  set(i586_SOURCES ${i386_SOURCES})
+  set(i686_SOURCES ${i386_SOURCES})
+
+   if (WIN32)
+     set(i386_SOURCES
+       ${i386_SOURCES}
+@@ -608,6 +612,7 @@ else ()
+   endif()
+ 
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
+      message("arch: ${arch}")
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+       if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@ -46,9 +46,7 @@ stdenv.mkDerivation {
  ] ++ lib.optionals (bareMetal) [
    "-DCOMPILER_RT_OS_DIR=baremetal"
  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-    # The compiler-rt build infrastructure sniffs supported platforms on Darwin
-    # and finds i386;x86_64;x86_64h. We only build for x86_64, so linking fails
-    # when it tries to use libc++ and libc++api for i386.
+    "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
    "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
    "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
  ];
@ -60,6 +58,7 @@ stdenv.mkDerivation {
    ./find-darwin-sdk-version.patch # don't test for macOS being >= 10.15
    ./gnu-install-dirs.patch
    ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
+    ./X86-support-extension.patch # backported from LLVM 11
  ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
@ -70,6 +69,8 @@ stdenv.mkDerivation {
  postPatch = lib.optionalString (!stdenv.isDarwin) ''
    substituteInPlace cmake/builtin-config-ix.cmake \
      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
  '' + lib.optionalString stdenv.isDarwin ''
    substituteInPlace cmake/config-ix.cmake \
      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
@ -88,8 +89,16 @@ stdenv.mkDerivation {
  '' + lib.optionalString (useLLVM) ''
    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtendS.o
    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  ''
+  # See https://reviews.llvm.org/D37278 for why android exception
+  + lib.optionalString (stdenv.hostPlatform.isx86_32 && !stdenv.hostPlatform.isAndroid) ''
+    for f in $out/lib/*/*builtins-i?86*; do
+      ln -s "$f" $(echo "$f" | sed -e 's/builtins-i.86/builtins-i386/')
+    done
  '';

  meta = llvm_meta // {
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@ -78,6 +78,8 @@ stdenv.mkDerivation {
  postPatch = lib.optionalString (!stdenv.isDarwin) ''
    substituteInPlace cmake/builtin-config-ix.cmake \
      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
  '' + lib.optionalString stdenv.isDarwin ''
    substituteInPlace cmake/config-ix.cmake \
      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
@ -96,8 +98,16 @@ stdenv.mkDerivation {
  '' + lib.optionalString (useLLVM) ''
    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtendS.o
    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  ''
+  # See https://reviews.llvm.org/D37278 for why android exception
+  + lib.optionalString (stdenv.hostPlatform.isx86_32 && !stdenv.hostPlatform.isAndroid) ''
+    for f in $out/lib/*/*builtins-i?86*; do
+      ln -s "$f" $(echo "$f" | sed -e 's/builtins-i.86/builtins-i386/')
+    done
  '';

  meta = llvm_meta // {
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@ -43,6 +43,7 @@ let
      mkdir "$rsrc"
      ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+      echo "-B $rsrc/lib" >> $out/nix-support/cc-cflags
    '';
    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@ -2,7 +2,7 @@
 , llvmShared, llvmSharedForBuild, llvmSharedForHost, llvmSharedForTarget, llvmPackages
 , fetchurl, file, python3
 , darwin, cmake, rust, rustPlatform
-, pkg-config, openssl
+, pkg-config, openssl, xz
 , libiconv
 , which, libffi
 , withBundledLLVM ? false
@ -41,6 +41,13 @@ in stdenv.mkDerivation rec {
  # See: https://github.com/NixOS/nixpkgs/pull/56540#issuecomment-471624656
  stripDebugList = [ "bin" ];

+  # The Rust pkg-config crate does not support prefixed pkg-config executables[1],
+  # but it does support checking these idiosyncratic PKG_CONFIG_${TRIPLE}
+  # environment variables.
+  # [1]: https://github.com/rust-lang/pkg-config-rs/issues/53
+  "PKG_CONFIG_${builtins.replaceStrings ["-"] ["_"] (rust.toRustTarget stdenv.buildPlatform)}" =
+    "${pkgsBuildHost.stdenv.cc.targetPrefix}pkg-config";
+
  NIX_LDFLAGS = toString (
       # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
       optional (stdenv.isLinux && !withBundledLLVM) "--push-state --as-needed -lstdc++ --pop-state"
@ -148,9 +155,11 @@ in stdenv.mkDerivation rec {
  # use it for the normal build. This disables cmake in Nix.
  dontUseCmakeConfigure = true;

+  depsBuildBuild = [ pkgsBuildHost.stdenv.cc pkg-config ];
+
  nativeBuildInputs = [
    file python3 rustPlatform.rust.rustc cmake
-    which libffi removeReferencesTo pkg-config
+    which libffi removeReferencesTo pkg-config xz
  ];

  buildInputs = [ openssl ]
--- a/pkgs/development/interpreters/guile/2.0.nix
+++ b/pkgs/development/interpreters/guile/2.0.nix
@ -120,7 +120,7 @@ builder rec {
  + ''
    sed -i "$out/lib/pkgconfig/guile"-*.pc    \
        -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
-            s|^Cflags:\(.*\)$|Cflags: -I${libunistring}/include \1|g ;
+            s|^Cflags:\(.*\)$|Cflags: -I${libunistring.dev}/include \1|g ;
            s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
            s|includedir=$out|includedir=$dev|g
            "
--- a/pkgs/development/interpreters/guile/2.2.nix
+++ b/pkgs/development/interpreters/guile/2.2.nix
@ -111,7 +111,7 @@ builder rec {
  + ''
    sed -i "$out/lib/pkgconfig/guile"-*.pc    \
        -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
-            s|^Cflags:\(.*\)$|Cflags: -I${libunistring}/include \1|g ;
+            s|^Cflags:\(.*\)$|Cflags: -I${libunistring.dev}/include \1|g ;
            s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
            s|includedir=$out|includedir=$dev|g
            "
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@ -114,7 +114,7 @@ builder rec {
  + ''
    sed -i "$out/lib/pkgconfig/guile"-*.pc    \
        -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
-            s|^Cflags:\(.*\)$|Cflags: -I${libunistring}/include \1|g ;
+            s|^Cflags:\(.*\)$|Cflags: -I${libunistring.dev}/include \1|g ;
            s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
            s|includedir=$out|includedir=$dev|g
            "
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -121,19 +121,19 @@
      sourceVersion = {
        major = "3";
        minor = "9";
-        patch = "14";
+        patch = "15";
        suffix = "";
      };
-      sha256 = "sha256-ZRME0hbIID/grfGoCvRy2OksOw4KeJIiKuTZ865N688=";
+      sha256 = "sha256-Etr/aAlSjZ9hVCFpUEI8njDw5HM2y1fGqgtDh91etLI=";
    };
    python310 = {
      sourceVersion = {
        major = "3";
        minor = "10";
-        patch = "7";
+        patch = "8";
        suffix = "";
      };
-      sha256 = "sha256-bu2EFbdRb7LyYJBttdSN1MBqzAyySn1swVKWpgTc3Eg=";
+      sha256 = "sha256-ajDs3lnEcEgBPrWmWMm13sJ3ID0nk2Z/V433Zx9/A/M=";
    };
  };

--- a/pkgs/development/libraries/abseil-cpp/202206.nix
+++ b/pkgs/development/libraries/abseil-cpp/202206.nix
@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, static ? stdenv.hostPlatform.isStatic
+, cxxStandard ? null
+}:
+
+stdenv.mkDerivation rec {
+  pname = "abseil-cpp";
+  version = "20220623.1";
+
+  src = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Od1FZOOWEXVQsnZBwGjDIExi6LdYtomyL0STR44SsG8=";
+  };
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
+  ] ++ lib.optionals (cxxStandard != null) [
+    "-DCMAKE_CXX_STANDARD=${cxxStandard}"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "An open-source collection of C++ code designed to augment the C++ standard library";
+    homepage = "https://abseil.io/";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = [ maintainers.andersk ];
+  };
+}
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@ -3,7 +3,6 @@
 , fetchurl
 , fetchFromGitHub
 , fixDarwinDylibNames
-, abseil-cpp
 , autoconf
 , aws-sdk-cpp
 , boost
@ -147,10 +146,9 @@ stdenv.mkDerivation rec {
    protobuf
  ] ++ lib.optionals enableS3 [ aws-sdk-cpp openssl ]
  ++ lib.optionals enableGcs [
-    abseil-cpp
    crc32c
    curl
-    google-cloud-cpp
+    google-cloud-cpp grpc
    nlohmann_json
  ];

--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "enchant";
-  version = "2.3.2";
+  version = "2.3.3";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-zpukf9TTQDG9aURVmKaYpmEWArKw6R1wXpGm9QmerW4=";
+    sha256 = "sha256-PaEhA/Ec9Jw88v0s4wF1dcUyGkieW5v6gd2R7EE/OJE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/faad2/default.nix
+++ b/pkgs/development/libraries/faad2/default.nix
@ -14,13 +14,13 @@
 with lib;
 stdenv.mkDerivation rec {
  pname = "faad2";
-  version = "2.10.0";
+  version = "2.10.1";

  src = fetchFromGitHub {
    owner = "knik0";
    repo = "faad2";
-    rev = builtins.replaceStrings [ "." ] [ "_" ] version;
-    sha256 = "0q52kdd95ls6ihzyspx176wg9x22425v5qsknrmrjq30q25qmmlg";
+    rev = version;
+    sha256 = "sha256-k7y12OwCn3YkNZY9Ov5Y9EQtlrZh6oFUzM27JDR960w=";
  };

  configureFlags = []
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -71,6 +71,7 @@ stdenv.mkDerivation rec {
  configureFlags = filter (v: v != null) ([
      "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
      "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
+      "--pkg-config=${pkg-config.targetPrefix}pkg-config"
    # License
      "--enable-gpl"
      "--enable-version3"
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@ -23,14 +23,14 @@

 stdenv.mkDerivation rec {
  pname = "gdk-pixbuf";
-  version = "2.42.9";
+  version = "2.42.10";

  outputs = [ "out" "dev" "man" "devdoc" ]
    ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) "installedTests";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "KPeVjnvymjLU6WNVbSQdCkGmeGWC/2pa0RZl4DR/yWI=";
+    sha256 = "7ptsddE7oJaQei48aye2G80X9cfr6rWltDnS8uOf5Es=";
  };

  patches = [
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, abseil-cpp
 , c-ares
 , cmake
 , crc32c
@ -66,7 +65,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    abseil-cpp
    c-ares
    crc32c
    (curl.override { inherit openssl; })
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@ -21,7 +21,7 @@

 stdenv.mkDerivation rec {
  pname = "grpc";
-  version = "1.48.1"; # N.B: if you change this, please update:
+  version = "1.50.0"; # N.B: if you change this, please update:
    # pythonPackages.grpcio-tools
    # pythonPackages.grpcio-status

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    owner = "grpc";
    repo = "grpc";
    rev = "v${version}";
-    hash = "sha256-It9oFenKoPDCOVxiKCGJc8i18zdDZCceR22HR5Tu1sw=";
+    hash = "sha256-h79Ptx17tIMFpaaid4UGzbGDztee9JctfsEcetfude0=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@ -3,6 +3,9 @@
 , enableVmaf ? true, libvmaf
 }:

+let
+  isCross = stdenv.buildPlatform != stdenv.hostPlatform;
+in
 stdenv.mkDerivation rec {
  pname = "libaom";
  version = "3.5.0";
@ -45,7 +48,7 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
    # CPU detection isn't supported on Darwin and breaks the aarch64-darwin build:
    "-DCONFIG_RUNTIME_CPU_DETECT=0"
-  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+  ] ++ lib.optionals (isCross && !stdenv.hostPlatform.isx86) [
    "-DAS_EXECUTABLE=${stdenv.cc.targetPrefix}as"
  ] ++ lib.optionals stdenv.isAarch32 [
    # armv7l-hf-multiplatform does not support NEON
@ -55,6 +58,8 @@ stdenv.mkDerivation rec {

  postFixup = ''
    moveToOutput lib/libaom.a "$static"
+  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
+    ln -s $static $out
  '';

  outputs = [ "out" "bin" "dev" "static" ];
@ -70,6 +75,7 @@ stdenv.mkDerivation rec {
    changelog   = "https://aomedia.googlesource.com/aom/+/refs/tags/v${version}/CHANGELOG";
    maintainers = with maintainers; [ primeos kiloreux dandellion ];
    platforms   = platforms.all;
+    outputsToInstall = [ "bin" ];
    license = licenses.bsd2;
  };
 }
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@ -7,6 +7,7 @@
 , libpng
 , libjpeg
 , dav1d
+, libyuv
 }:

 stdenv.mkDerivation rec {
@ -41,6 +42,7 @@ stdenv.mkDerivation rec {
    libpng
    libjpeg
    dav1d
+    libyuv
  ];

  meta = with lib; {
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@ -1,28 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+
+# for passthru.tests
+, imagemagick
+, imagemagick6
+, libheif
+, imlib2Full
+, gst_all_1
+}:

 stdenv.mkDerivation rec {
-  version = "1.0.8";
+  version = "1.0.9";
  pname = "libde265";

  src = fetchFromGitHub {
    owner = "strukturag";
    repo = "libde265";
    rev = "v${version}";
-    sha256 = "1dzflqbk248lz5ws0ni5acmf32b3rmnq5gsfaz7691qqjxkl1zml";
+    sha256 = "sha256-OpiQapppuKCR27tIG5OW+KiNMP9ysv7CaobiBOW6VUI=";
  };

-  patches = [
-    (fetchpatch {
-      name = "CVE-2022-1253.patch";
-      url = "https://github.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8.patch";
-      sha256 = "sha256-F1BOWFx9oXR2trM22atyD3AJ5x6vVfURQ/PTlYP2Ibg=";
-    })
-  ];
-
  nativeBuildInputs = [ autoreconfHook pkg-config ];

  enableParallelBuilding = true;

+  passthru.tests = {
+    inherit imagemagick imagemagick6 libheif imlib2Full;
+    inherit (gst_all_1) gst-plugins-bad;
+  };
+
  meta = {
    homepage = "https://github.com/strukturag/libde265";
    description = "Open h.265 video codec implementation";
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
    "-Dinstall-test-programs=true"
    "-Domap=enabled"
    "-Dcairo-tests=disabled"
+    "-Dvalgrind=${if withValgrind then "enabled" else "disabled"}"
  ] ++ lib.optionals stdenv.hostPlatform.isAarch [
    "-Dtegra=enabled"
    "-Detnaviv=enabled"
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@ -5,15 +5,16 @@
  # dejagnu also requires tcl which can't be built statically at the moment
 , doCheck ? !(stdenv.hostPlatform.isStatic)
 , dejagnu
+, nix-update-script
 }:

 stdenv.mkDerivation rec {
  pname = "libffi";
-  version = "3.4.3";
+  version = "3.4.4";

  src = fetchurl {
    url = "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-RBbdkrauj8tbEEIecRxNPLMSA9d1Iad9hdAQIxHmw7g=";
+    sha256 = "sha256-1mxWrSWags8qnfxAizK/XaUjcVALhHRff7i2RXEt9nY=";
  };

  # Note: this package is used for bootstrapping fetchurl, and thus
@ -52,6 +53,12 @@ stdenv.mkDerivation rec {

  checkInputs = [ dejagnu ];

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
  meta = with lib; {
    description = "A foreign function call interface library";
    longDescription = ''
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchurl
 , buildPackages
 , cmake
 , glib
@ -20,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "libical";
-  version = "3.0.15";
+  version = "3.0.16";

  outputs = [ "out" "dev" ]; # "devdoc" ];

@ -28,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "libical";
    repo = "libical";
    rev = "v${version}";
-    sha256 = "sha256-7M5GBteFKmKCB6556XXV4s6iIC/+3c3Ck17s/QX3Jus=";
+    sha256 = "sha256-3D/0leI3LLKDFOXkKSrmMamLoaXdi/2Z4iPUXqgwtg8=";
  };

  strictDeps = true;
@ -75,17 +74,6 @@ stdenv.mkDerivation rec {
    # Will appear in 3.1.0
    # https://github.com/libical/libical/issues/350
    ./respect-env-tzdir.patch
-
-    # Fixes tests with 32-bit time_t
-    # Remove with next version update (v3.0.16+)
-    (fetchurl {
-      url = "https://github.com/libical/libical/commit/4adc6f1d2b39a1cc3363b57215e12fa81076498b.patch";
-      sha256 = "1k3hav0z86kc1xd1sk23b57aqqjk4gf73574w7f1m66cyz98bxr3";
-    })
-    (fetchurl {
-      url = "https://github.com/libical/libical/commit/cce20bd051408b00521385c0bfb616ba068450d3.patch";
-      sha256 = "097hqmagl0q5p38r1kvx0592cfac2y7jbdqlis6m8gbs812pbqfc";
-    })
  ];

  # Using install check so we do not have to manually set
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , glib
 , meson
 , ninja
@ -11,9 +10,7 @@
 , sqlite
 , glib-networking
 , gobject-introspection
-, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 , vala
-, withVala ? stdenv.buildPlatform == stdenv.hostPlatform
 , libpsl
 , python3
 , gi-docgen
@ -23,21 +20,17 @@

 stdenv.mkDerivation rec {
  pname = "libsoup";
-  version = "3.2.0";
+  version = "3.2.1";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-KDI3BpjKj5+/F0w0W3PYm2BWEQOmJsLfcHJrBwf3m9M=";
+    sha256 = "sha256-ses9LDvkn7vQUacfZTLJYmvOzqaXgxkGkM1+Tf3yjyk=";
  };

-  # https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/310
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libsoup/-/commit/0fae143dc8b0e668b7a35a9c1364009e7cf06d0f.patch";
-      sha256 = "sha256-yAKC7WGk0aQxMkT4At6Qfx1QO2InNotITrl/Lim41Jk=";
-    })
+  depsBuildBuild = [
+    pkg-config
  ];

  nativeBuildInputs = [
@ -47,9 +40,7 @@ stdenv.mkDerivation rec {
    glib
    python3
    gi-docgen
-  ] ++ lib.optionals withIntrospection [
    gobject-introspection
-  ] ++ lib.optionals withVala [
    vala
  ];

@ -70,8 +61,8 @@ stdenv.mkDerivation rec {
  mesonFlags = [
    "-Dtls_check=false" # glib-networking is a runtime dependency, not a compile-time dependency
    "-Dgssapi=disabled"
-    "-Dvapi=${if withVala then "enabled" else "disabled"}"
-    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
+    "-Dvapi=enabled"
+    "-Dintrospection=enabled"
    "-Dntlm=disabled"
    # Requires wstest from autobahn-testsuite.
    "-Dautobahn=disabled"
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "libsoup";
-  version = "2.74.2";
+  version = "2.74.3";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8KQnZW5f4Z4d9xwQfojfobLmc8JcVHt4I7YBi0DQEVk=";
+    sha256 = "sha256-5Ld8Qc/EyMWgNfzcMgx7xs+3XvfFoDQVPfFBP6HZLxM=";
  };

  depsBuildBuild = [
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@ -46,6 +46,17 @@ stdenv.mkDerivation rec {
      url = "https://gitlab.com/libtiff/libtiff/-/commit/48d6ece8389b01129e7d357f0985c8f938ce3da3.patch";
      sha256 = "sha256-h9hulV+dnsUt/2Rsk4C1AKdULkvweM2ypIJXYQ3BqQU=";
    })
+    (fetchpatch {
+      name = "CVE-2022-3626.CVE-2022-3627.CVE-2022-3597.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047.patch";
+      excludes = [ "doc/tools/tiffcrop.rst" ];
+      sha256 = "sha256-L2EMmmfMM4oEYeLapO93wvNS+HlO0yXsKxijXH+Wuas=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-3598.CVE-2022-3570.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff.patch";
+      sha256 = "sha256-SLq2+JaDEUOPZ5mY4GPB6uwhQOG5cD4qyL5o9i8CVVs=";
+    })
  ];

  postPatch = ''
--- a/pkgs/development/libraries/libuninameslist/default.nix
+++ b/pkgs/development/libraries/libuninameslist/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "libuninameslist";
-  version = "20211114";
+  version = "20221022";

  src = fetchFromGitHub {
    owner = "fontforge";
    repo = pname;
    rev = version;
-    sha256 = "sha256-izxG2mx+D83s78eL19ERUaLrw9FPjlJRcFZw3+xzLDQ=";
+    sha256 = "sha256-YLlSe2++DpcptuAxLduTYAY2m9D8JSGDcvzijpAv1rU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libvorbis/default.nix
+++ b/pkgs/development/libraries/libvorbis/default.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
  version = "1.3.7";

  src = fetchurl {
-    url = "http://downloads.xiph.org/releases/vorbis/${pname}-${version}.tar.xz";
+    url = "https://downloads.xiph.org/releases/vorbis/${pname}-${version}.tar.xz";
    sha256 = "0jwmf87x5sdis64rbv0l87mdpah1rbilkkxszipbzg128f9w8g5k";
  };

@ -16,6 +16,12 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  # strip -mno-ieee-fp flag from configure and configure.ac when using
+  # clang as the flag is not recognized by the compiler
+  preConfigure = lib.optionalString (stdenv.cc.isClang or false) ''
+    sed s/\-mno\-ieee\-fp// -i {configure,configure.ac}
+  '';
+
  meta = with lib; {
    description = "Vorbis audio compression reference implementation";
    homepage = "https://xiph.org/vorbis/";
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@ -28,10 +28,10 @@ let
 in
  assert oldVer -> stdenv.isDarwin; # reduce likelihood of using old libxml2 unintentionally

-stdenv.mkDerivation rec {
+let
+libxml = stdenv.mkDerivation rec {
  pname = "libxml2";
-  version = if oldVer then "2.10.1" else
-    "2.10.2";
+  version = "2.10.3";

  outputs = [ "bin" "dev" "out" "doc" ]
    ++ lib.optional pythonSupport "py"
@ -39,9 +39,8 @@ stdenv.mkDerivation rec {
  outputMan = "bin";

  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = if oldVer then "21a9e13cc7c4717a6c36268d0924f92c3f67a1ece6b7ff9d588958a6db9fb9d8" else
-      "0kCr5tqcZcsZAN2b86NQHM+Is8Khy5gxfQPyct2lsmU=";
+    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+    sha256 = "XSzD14vsPb4hKp1/pimtolp9qSivQyyTBg/1wX7iipw=";
  };

  patches = [
@ -145,4 +144,15 @@ stdenv.mkDerivation rec {
    platforms = platforms.all;
    maintainers = with maintainers; [ eelco jtojnar ];
  };
-}
+};
+in
+if oldVer then
+  libxml.overrideAttrs (attrs: rec {
+    version = "2.10.1";
+    src = fetchurl {
+      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+      sha256 = "21a9e13cc7c4717a6c36268d0924f92c3f67a1ece6b7ff9d588958a6db9fb9d8";
+    };
+  })
+else
+  libxml
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch, buildPackages
+{ stdenv, lib, fetchurl
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
@ -9,6 +9,7 @@
 , galliumDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
+, vulkanLayers ? [ "device-select" "overlay" ]
 , OpenGL, Xplugin
 , withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light && !valgrind-light.meta.broken, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
@ -35,7 +36,7 @@ with lib;
 let
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.2.1";
+  version = "22.2.2";
  branch  = versions.major version;

 self = stdenv.mkDerivation {
@ -50,7 +51,7 @@ self = stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "0079beac0a33f45e7e0aec59e6913eafbc4268a3f1e2e330017440494f91b13c";
+    sha256 = "2de11fb74fc5cc671b818e49fe203cea0cd1d8b69756e97cdb06a2f4e78948f9";
  };

  # TODO:
@ -119,7 +120,8 @@ self = stdenv.mkDerivation {
    "-Dgallium-opencl=icd" # Enable the gallium OpenCL frontend
    "-Dclang-libdir=${llvmPackages.clang-unwrapped.lib}/lib"
  ] ++ optional enablePatentEncumberedCodecs
-    "-Dvideo-codecs=h264dec,h264enc,h265dec,h265enc,vc1dec";
+    "-Dvideo-codecs=h264dec,h264enc,h265dec,h265enc,vc1dec"
+  ++ optional (vulkanLayers != []) "-D vulkan-layers=${builtins.concatStringsSep "," vulkanLayers}";

  buildInputs = with xorg; [
    expat llvmPackages.libllvm libglvnd xorgproto
@ -195,6 +197,11 @@ self = stdenv.mkDerivation {
    # move libOSMesa to $osmesa, as it's relatively big
    mkdir -p $osmesa/lib
    mv -t $osmesa/lib/ $out/lib/libOSMesa*
+  '' + lib.optionalString (vulkanLayers != []) ''
+    mv -t $drivers/lib $out/lib/libVkLayer*
+    for js in $drivers/share/vulkan/{im,ex}plicit_layer.d/*.json; do
+      substituteInPlace "$js" --replace '"libVkLayer_' '"'"$drivers/lib/libVkLayer_"
+    done
  '';

  postFixup = optionalString stdenv.isLinux ''
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@ -3,6 +3,7 @@
 , sslSupport ? true, openssl ? null
 , static ? stdenv.hostPlatform.isStatic
 , shared ? !stdenv.hostPlatform.isStatic
+, bash
 }:

 assert compressionSupport -> zlib != null;
@ -25,9 +26,11 @@ stdenv.mkDerivation rec {
  patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [libxml2 openssl]
+  buildInputs = [libxml2 openssl bash]
    ++ lib.optional compressionSupport zlib;

+  strictDeps = true;
+
  configureFlags = [
    (lib.enableFeature shared "shared")
    (lib.enableFeature static "static")
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "nghttp3";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "ngtcp2";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-MZ5ynaGZTzO2w0hGHII19PFC0+kjfd+IlcsenGGgMgg=";
+    sha256 = "sha256-LSHhvRTzqpGJcyK3KoZZjbZVggXpgDEEVpp8gMoaE7U=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "ngtcp2";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "ngtcp2";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-nfXEX1GxtmOcb0reRyO0OyQkSHeUWtQW+SZ8thxor+s=";
+    sha256 = "sha256-zDiJlwcDTLCU+WpJ6Jz6tve4oV+XMRYOtppC2fj/HgU=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.1";
-  hash = "sha256-NwxS5niE0dnCG5d+lzPcwYzIR2WmsgGBT77VDCbfThQ=";
+  version = "3.79.2";
+  hash = "sha256-hwcHDI74CgYp2vhQyKspKQ6T/O55f6g/cZvb9z1np4E=";
 }
--- a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
+++ b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
@ -1,22 +1,25 @@
 diff --git a/Configure b/Configure
-index f0ad787bc4..a48d2008c6 100755
+index a558e5ab1a..9a884f0b0f 100755
 --- a/Configure
 +++ b/Configure
-@@ -1688,17 +1688,6 @@ unless ($disabled{devcryptoeng}) {
+@@ -1714,20 +1714,6 @@ unless ($disabled{devcryptoeng}) {
+ 
 unless ($disabled{ktls}) {
     $config{ktls}="";
-     if ($target =~ m/^linux/) {
-        my $usr = "/usr/$config{cross_compile_prefix}";
-        chop($usr);
-        if ($config{cross_compile_prefix} eq "") {
-            $usr = "/usr";
-        }
-        my $minver = (4 << 16) + (13 << 8) + 0;
-        my @verstr = split(" ",`cat $usr/include/linux/version.h | grep LINUX_VERSION_CODE`);
-
-        if ($verstr[2] < $minver) {
+-    my $cc = $config{CROSS_COMPILE}.$config{CC};
+-    if ($target =~ m/^linux/) {
+-        system("printf '#include <sys/types.h>\n#include <linux/tls.h>' | $cc -E - >/dev/null 2>&1");
+-        if ($? != 0) {
 -            disable('too-old-kernel', 'ktls');
 -        }
-     } elsif ($target =~ m/^BSD/) {
-         my $cc = $config{CROSS_COMPILE}.$config{CC};
-         system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+-    } elsif ($target =~ m/^BSD/) {
+-        system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+-        if ($? != 0) {
+-            disable('too-old-freebsd', 'ktls');
+-        }
+-    } else {
+-        disable('not-linux-or-freebsd', 'ktls');
+-    }
+ }
+ 
+ push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls});
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -130,7 +130,9 @@ let
      "-DUSE_CRYPTODEV_DIGESTS"
    ] ++ lib.optional enableSSL2 "enable-ssl2"
      ++ lib.optional enableSSL3 "enable-ssl3"
-      ++ lib.optional (lib.versionAtLeast version "3.0.0") "enable-ktls"
+      # We select KTLS here instead of the configure-time detection (which we patch out).
+      # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
+      ++ lib.optional (stdenv.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
      ++ lib.optional (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
      # OpenSSL needs a specific `no-shared` configure flag.
      # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
@ -228,8 +230,8 @@ in {
  };

  openssl_3 = common {
-    version = "3.0.5";
-    sha256 = "sha256-qn2Nm+9xrWUlxVuhHl9Dl4ic5Jwsk0nc6m0+TwsCSno=";
+    version = "3.0.7";
+    sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4=";
    patches = [
      ./3.0/nix-ssl-cert-file.patch

--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@ -188,7 +188,7 @@ stdenv.mkDerivation rec {
    homepage = "http://www.freedesktop.org/wiki/Software/polkit";
    description = "A toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes";
    license = licenses.lgpl2Plus;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
    maintainers = teams.freedesktop.members ++ (with maintainers; [ ]);
  };
 }
--- a/pkgs/development/libraries/protobuf/3.19.nix
+++ b/pkgs/development/libraries/protobuf/3.19.nix
@ -1,6 +1,6 @@
 { callPackage, ... }:

 callPackage ./generic-v3.nix {
-  version = "3.19.5";
-  sha256 = "sha256-C5ZfPXHtUtNjPGS4tbswCwVH1gjd6A64KtIR16DgHzQ=";
+  version = "3.19.6";
+  sha256 = "sha256-+ul9F8tyrwk2p25Dd9ragqwpYzdxdeGjpXhLAwKYWfM=";
 }
--- a/pkgs/development/libraries/protobuf/3.20.nix
+++ b/pkgs/development/libraries/protobuf/3.20.nix
@ -1,6 +1,6 @@
 { callPackage, abseil-cpp, ... }:

 callPackage ./generic-v3.nix {
-  version = "3.20.2";
-  sha256 = "sha256-7hLTIujvYIGRqBQgPHrCq0XOh0GJrePBszXJnBFaXVM=";
+  version = "3.20.3";
+  sha256 = "sha256-u/1Yb8+mnDzc3OwirpGESuhjkuKPgqDAvlgo3uuzbbk=";
 }
--- a/pkgs/development/libraries/protobuf/3.21.nix
+++ b/pkgs/development/libraries/protobuf/3.21.nix
@ -1,6 +1,6 @@
 { callPackage, abseil-cpp, ... }:

 callPackage ./generic-v3-cmake.nix {
-  version = "3.21.6";
-  sha256 = "sha256-6Omd2O/eIZIgod3YV+zIIv+GqT+trith6+eepFEJIWM=";
+  version = "3.21.8";
+  sha256 = "sha256-cSNHX18CvMmydpYWqfe6WWk9rGxIlFfY/85rfSyznU4=";
 }
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@ -1,207 +1,207 @@
 {
  "qt3d": {
    "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "fe5fca853c09c7e03a2ff66dac21584e3307984d",
-    "sha256": "0z8vkr3a20sb428m5kizgj33fkrznqzhwc0mh1rdqivlcsfp4kfi"
+    "rev": "0ff905d194e273e04e95b72dbbfd4e58193ecbaa",
+    "sha256": "1jv4xjxdr6xbm4q8fk0ijhl845qnnhxqmwkzqg2ssxdn015iabj9"
  },
  "qtactiveqt": {
    "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "ccc9a61d10404a4999dec61fdb513aa50f265cc3",
-    "sha256": "1l4h721shvc5cy5n2ykj0bhi5bgn3c8w1dmiwxh45rnb6qz971da"
+    "rev": "80b43bfe4109820fb7feddb4a16e227a03bc1c4e",
+    "sha256": "1m3c0znrm63b2wbz7vghxrh22lxdp1s7bwc00qfwhgjn1ajyrp71"
  },
  "qtandroidextras": {
    "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "1d9324ce38ce5100d827942eda67fe634753655b",
-    "sha256": "1k00pibnadgjnvv42kfq5pynr0gljv35hri6k5gfswqw347dr6f8"
+    "rev": "3f8c9f144acbe921a759d261e1314614793f89e0",
+    "sha256": "1k680n1gvj55i0yb7zrlbai4w3mvhhcbbpmcgm1wlv29rg268gi4"
  },
  "qtbase": {
    "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "e44097b63d17ba3178a637df7fac51ddc51cb48b",
-    "sha256": "071q48qnszwqkmdpf14nqzbyqs62apfjhm0640fggv5ydgrbqw6j"
+    "rev": "98c727f273fc83c24550274bd2728e1aafbd213a",
+    "sha256": "1hwswan0yw6l4rka60ch173sd71ijx0y15gb2hnd3mhzws8gjsb5"
  },
  "qtcharts": {
    "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "841083c263f16f8acb81e4915bf24bbed0461c9a",
-    "sha256": "1iic9q8qj6bz6qznfr0jdjdi3a72lb433d0k711cfz2np2i8ajz1"
+    "rev": "055c6d6e49c5ea369990e7078fd534392a0ba6b9",
+    "sha256": "0r07yjdlxzk34br905da5kcm6xda50907nrffkw99683ix9y64ag"
  },
  "qtconnectivity": {
    "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "01e8b04b121712ea0a2b2793ce13f4dd5e9cfcf8",
-    "sha256": "1mgm4dpsw7k79znw0h72h614i0lvivvbp8w67np2nqp411wghgaa"
+    "rev": "6796953f92a1d3af30d0676e56ec5dfd82199611",
+    "sha256": "16zh10rm2b4sk9mn4r4sfp2mzvrxlz4nqj8bpiy055mplz5day39"
  },
  "qtdatavis3d": {
    "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "502612c72a2cd3b3b0c4cff926e7764d74106d33",
-    "sha256": "0g9y0gi78v256zv70dl3fbpwr4ihs2i99pis3x4m3br5w1p7lknq"
+    "rev": "8e1a57efa1ba3eabbf44098ce6ede3d130c57b5d",
+    "sha256": "19v7la492414d0qzqdqnbhpxpg0hsqll6ixhv4jrckvdaqv7iqxz"
  },
  "qtdeclarative": {
    "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "b3aaf1482c48bbc0ca4f7c7934597c055afe4b6a",
-    "sha256": "12ia5zr7ajlfxjsdc4qhwjcyyc7vwr4ihs244v40y8ym2p0hm02l"
+    "rev": "45d43c04088efb8346979f633f72bb1f23183461",
+    "sha256": "1ad6r1zwzzvl1i2rxkjgp8x5k4ahcf6grfq6xarbbj9qvvb08ny4"
  },
  "qtdoc": {
    "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "032bc4f434e1a914dfc29651533d491160d06add",
-    "sha256": "1r2az30pv2kvj6hif6ngmc8b2nf0rwv2rgss5mf9ks85kglvmy51"
+    "rev": "e3e926a66f0a4ffbf82f0df1a5f570d759faad4f",
+    "sha256": "1ji5qn9bhyz30z12dvh97xxi3ga9b4lymdc7kmzmcd37y56q9s5c"
  },
  "qtgamepad": {
    "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "0a2d4651362810600d2ff7272772d5908bb8714b",
-    "sha256": "1qzfyarc910rg308lydaniwbr49a6wl0hwh74a5w223bl9qqi5mj"
+    "rev": "ce0202d67bf1ab2bb887f58122b20eab5b6c1d5d",
+    "sha256": "11c24b2pzjcv14xix96fghyx3j3kw6rmhh499wqwc0qy5mjb6kpw"
  },
  "qtgraphicaleffects": {
    "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "e6e1e58ec28fd0f2e6426e6962cc4ccddb493349",
-    "sha256": "1780flyc57bvicvgp071590kmhgm4nfrfys2b0adbmnkwb3fm3ij"
+    "rev": "a2b1600300cda89804d48ec90e0068a075fecc8b",
+    "sha256": "0ca666260mvvlf551076840pvh9r67v2bhmf0yf1xp06rxc205zq"
  },
  "qtimageformats": {
    "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "9044695f4b1acdd7ec24e7b01f6a6ca61f982a75",
-    "sha256": "1rzshk2s4prglwcvr2wfr7qk0m3x3gq0d2wk741ifl7gb5nidsd5"
+    "rev": "1b83a9c73d6e5459ec4c2221b2bd7e5396b5e874",
+    "sha256": "07ry1bfim24aa530xslp8njn1bzalrmrwcx0xz2p2jilhfvvp5fc"
  },
  "qtlocation": {
    "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "ebdf5b38da6e3fe0a183702bcca395c589c459ed",
-    "sha256": "17igx94c3qx0ahpnkpxip4db4413q3hcr19hcs0j4wc03vkcmafr"
+    "rev": "f920a6cc2931402023840c223fce2fed321e28ea",
+    "sha256": "08r6h5d120x6lnzrjwscvv1dbjf720mg508wkyf8f999xncmp0yi"
  },
  "qtlottie": {
    "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "d40b67401afe7156b03c62c9a4d517b07555fe64",
-    "sha256": "1w9qcx7aczkf03qwm2jzjlj9k0qb8j0x4lfrj4lw7pwggb16f6p0"
+    "rev": "8bb9237e4e1462f405d931a8a513ed4c27632d9e",
+    "sha256": "1qd86wrvf3487s3f39m6pvcipa5s7zhn99kbfnmrhg0q35cr2816"
  },
  "qtmacextras": {
    "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "c9bf2516187331033f0860976497eab0828cf25e",
-    "sha256": "0242gbj3rmkx4s1jzrb3kz07pl06xcfy0aqyb5xanzkg4sllrsaw"
+    "rev": "e7d4c37810976b6a1730d842cbca04b66ca7de30",
+    "sha256": "01kxc4185kb3pq2dfcjyl3n765gjwpf9l2r4q6gncy5v75a2y700"
  },
  "qtmultimedia": {
    "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "76f84c545429a1b988b79f971734ef4bc3e6643f",
-    "sha256": "1i1ca3n9i1rwpsxda2xm9ap3ys7a5jazbgzcwnwjb4qsxvjss6gz"
+    "rev": "f3dc18968c437c993886d3bfb668b62344a10860",
+    "sha256": "0li29bvvjcck1y4zhhc6imxa8ip3988yv2zz5k6anyasb0ywbip8"
  },
  "qtnetworkauth": {
    "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "01315e31c5164c896a524175854c4b6df17fe166",
-    "sha256": "03vpynmkcb58x13mxjsjl07kh3jymcf295z5vybssqimyijlfw0m"
+    "rev": "f34ac77b5955126be60faa2b801be2d19dff896f",
+    "sha256": "1ip0sp70q4mircngs77p2m8njh8aw6f1q1w6f7nm0i2vkydpqfy2"
  },
  "qtpurchasing": {
    "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "fa07915d5b7c5ba16f2e8ba32a9066fe7eed0cb1",
-    "sha256": "1khpg9dfd0bgmqffzi4f2sgm8hnwzq9fqfg32y857mbc85f346bv"
+    "rev": "25ead89b0834f669e0a193e6d6cf2da25d33a452",
+    "sha256": "1jx44zr8kpjjg92by6sb9p5nqkadsqdhprngdbzyvxzhh1bplg1h"
  },
  "qtquick3d": {
    "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "5cf67a0a93026ffd41d2ea5a11b289f46a518376",
-    "sha256": "13yjb9y69by7jqw7l2qvmpi8835x7j0vxcy2slkjjw2msrj0mq2y"
+    "rev": "95f52cb212f66e6022661fb7f2eb81a8c21e9f22",
+    "sha256": "0j508pc4fyz7gi9bjmyq4i0q9kmfhcckgwp38wcvgr6xm83f224n"
  },
  "qtquickcontrols": {
    "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "e62b8b6d2f45a79652238b33f4bbe23023004ae7",
-    "sha256": "0598ckgkmqayq0c4c5fq6fyi098m74249qvz98m61bkk5629s24c"
+    "rev": "c7dae5f6041d6c076311f2d8ed13fcfe3598be70",
+    "sha256": "1fxvhrikjywh7gbz4lyivkvmsfnlqb7sd7r5rzqg6xi61x7i3fm4"
  },
  "qtquickcontrols2": {
    "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "74e8db97fdb9b55c4b4614b83f4bf17e00df55e9",
-    "sha256": "1f8hjsy3qyljyrpdjvwgq6a6ixlxyz3xjn32irzxx9vfxlp54wxf"
+    "rev": "9ff77702cc3649cbaf94046742d682d77cdea698",
+    "sha256": "0sq2j94csmd7ifd1hw4lwv7b82l59iz2258jg50d0j5hcf3acydz"
  },
  "qtquicktimeline": {
    "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "87ad61716a7cba5a070d8a7b1756c8b2b48d5d53",
-    "sha256": "02rhr3qk2k3g8ydv7w3pkkk4vdlq0jbmsbp78k1difadsxhnw563"
+    "rev": "e2438e010a98d731317c10a64c095e0282b51ab0",
+    "sha256": "0bbj0blxz3zbz03a85drwysshl0qib0fl46ln22ll52819qw111v"
  },
  "qtremoteobjects": {
    "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "aa705010da0f658b78c1155babce7091ae44529a",
-    "sha256": "1lkrxjk11qwanr7l84hqxlgk9y4shgznnxhlmfkp61ysnqladilx"
+    "rev": "5f2a598a9134167a0da2efcbf1249fc167ae3750",
+    "sha256": "1c3cg8fq681wrqk2xhajym1l9f8vfsffc8g0xp06m7lp11hr9bmq"
  },
  "qtscript": {
    "url": "https://invent.kde.org/qt/qt/qtscript.git",
-    "rev": "197f10dad6213ec4bb2e1a8305f19ec7475a6266",
-    "sha256": "1hksdl3ran5nv0q0idrdq78nk2qqmszq911fgxwfhifqakdqxyvp"
+    "rev": "b169b3e6ac1f9d66834ad61fbe35d3e25ff204bc",
+    "sha256": "01nfg53ixlggam5id16n1lc9n2anclrk6prvawi2fhpcnw4dpdza"
  },
  "qtscxml": {
    "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "631fd7bcc34802b7650c2b1dc73691463954d982",
-    "sha256": "17r19f5s2lmj6avic2sx2hm1xlcl3gnnmigvjla6gc1wr71wbgaw"
+    "rev": "e1faea1db52b91d90ef64dd57eb6529e323b5526",
+    "sha256": "1j1ckm2jca0h8zyfyq3kzf0dwp8jw9xwlpg7f7qi5dd8wd9dncmi"
  },
  "qtsensors": {
    "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "35eb5ac7eaef4745a38958c3ca780d7baa2e4f30",
-    "sha256": "0c6p495rmfw741xp8vfjxkac3d144id0gjccgshp8xh4syld52q9"
+    "rev": "5f1f73fdba8906f58c4554cbef9c1a72edcf0230",
+    "sha256": "0y7zyx9br4scbgkja5smkmyhlb6snqhir8mypsgdc4kllnbr4wkh"
  },
  "qtserialbus": {
    "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "f9f7eee60adac72fcf6617d164e3bf61222bb5c5",
-    "sha256": "1ixnagxhxd54y9kn27jmhgb41zg5dzxywvai3gg7jh0v7gxr8pxp"
+    "rev": "180cb13048a24510f9a1b20796772d27da762bdd",
+    "sha256": "1s7y7rdicb50aa2kfsl74y0dm1qd2kd6fncyqaq55w0rn95fks87"
  },
  "qtserialport": {
    "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "c9abfcd5d88cb43c2a7c1d5ddecbff4cdd320694",
-    "sha256": "180ypj7k36c64vgq5028hxh22vfc9bk8s4vczc1dzri8sw8pnpmm"
+    "rev": "966cf2a2077a8470715894363ad46ea7df0665fa",
+    "sha256": "1a3f3fhwblifgsn3x6qhx4fmpxp458q4x8vp3jdxmynnkfiigafp"
  },
  "qtspeech": {
    "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "d1273416f25a15a6edf6ea56a07602cd7d99fe48",
-    "sha256": "00ikp6zv96g253msfrcvxavpyw9lv2ia5pjsysmxb4vikrk7j8vr"
+    "rev": "d32f4a479d38a11f547598004b975f4356424a16",
+    "sha256": "1n0f2pym6kl0fh5iqrln7z45hwmw8bha5s7bzswsihrq6zxkca4f"
  },
  "qtsvg": {
    "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "a9752b00a03438de8e5b080073816e12409404b7",
-    "sha256": "1m3bg2xb1sa0r3dv5jljk8hsj3gw71qqzk9bsa7j2jn50inb2fh5"
+    "rev": "83296f10ebdb9a666b11dc69f3a148c38b9c425c",
+    "sha256": "0gifl43lnddp0shbyhmijlm2qpqj6fp2xip96nxn1ql3g70f9kyv"
  },
  "qttools": {
    "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "32912a06aadfc3dcbc34e0a668ce2c78351eee6e",
-    "sha256": "096gdp349n94d9y5zy9k3k1xrf5g7lbla3j1cm4dala8rrnachg5"
+    "rev": "c4750dd02070ce246ff98cc5d137193825043912",
+    "sha256": "0zryql6g77hdqsh10gzmw9n8ibki35b5jvh96gjl29yrvan9w5v7"
  },
  "qttranslations": {
    "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "d4db9d8a4893a70e7ba3a6d5fe62f24f9ce745ca",
-    "sha256": "0srprryw0fr13d3wqpdjbcc9n6mcq1cwsdd5mdilqr7bz375qz8d"
+    "rev": "c38edd3a5501bcd53132e1e4abb7d25a98e0e1a9",
+    "sha256": "0if1mx6jic67pzv1p0xqb5fknfbawvzxw7fx90hc4kkrwjm73q7m"
  },
  "qtvirtualkeyboard": {
    "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "9fbb837b55887bec5d73fad142c853ef68db35b3",
-    "sha256": "12769162183qyxgr5p1bx2p2wlnkqg3fgz86ya9g4iznx0nagx19"
+    "rev": "8aebadb96c1e57ba89bba2e5962399f676207a32",
+    "sha256": "0hygidp8l580d10c1g6pgdxd3g6lza0dkgfm6bd2kjrigg71fzh0"
  },
  "qtwayland": {
    "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "8faf74a7966b520f0ac3eb4d88235f8ec63b31b8",
-    "sha256": "1khbpg9wds1gg6z7nj58hflzhy2gjaiy3v6pa930hb1r8sisp154"
+    "rev": "9c607c771acdb3d820be7f112db99213a6c6d7eb",
+    "sha256": "1dbilhkldvhwwd2j0g7mwz1jyw9zgzwyyx43rsmnmv9lh36pb3dc"
  },
  "qtwebchannel": {
    "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "fb1ca87aa1a12048199d2aabe9015b7222d2b773",
-    "sha256": "1rsx3zf0xnvayanxwpr5yniiyw2a8bwifhrkw2gzdczdyasxdfw7"
+    "rev": "4e35fe9429920067c17596986b486fb1c1e95db0",
+    "sha256": "1j74hfrrrb1irchlgqclbk3zjgg98clndfw576psa3zm8xg3szin"
  },
  "qtwebglplugin": {
    "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "68a322c391c2eb92876fce42b9fc23ad2f3a1ecb",
-    "sha256": "0rd1zr39nckqlxmmgxf4zhkrh8vb3098z33ajsizz9ld5ylwkyw7"
+    "rev": "3087cdd0758258163299602550f7d4e72edf2a80",
+    "sha256": "19gsc842njdgmiqhkl7xqqry1d40phjwixzajzphv4s5vmcbxn5w"
  },
  "qtwebsockets": {
    "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "a066371747a7eb9de9b1ae38fbc41b2059080802",
-    "sha256": "0cjy399xx15z2y00bvh7jn8m8wjpx65gwg4gwrn3r2zpdw8aqqrb"
+    "rev": "594477769ecac4032ba116196493f3ba3db1aaed",
+    "sha256": "102r5jam8kc46bjlxf3jdjsr1jzdj5vfwmf4yypbhihwz436z791"
  },
  "qtwebview": {
    "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "87577dde04ed219bda776dabca86176149736331",
-    "sha256": "070s9ml8ixbmd7a7b49mnc0fya4wy3mx174n50acb99mmi7ar6z3"
+    "rev": "b1605fea61a6bbb599b720c54282bc8ddb0aacf0",
+    "sha256": "158hiqrshblw3axpryv0lqk74691njdc8qmdxbz28hzaaq6rxj5n"
  },
  "qtwinextras": {
    "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "a2ef397d1833c7417138a14ae23c880ae434d8a6",
-    "sha256": "1jqx03wwklqak8sjjlgmi55r2l07ylsfdar1j9kb0zn1krh7d9mw"
+    "rev": "2a04b162451460ffc208c2c27acce16a18f763ce",
+    "sha256": "17h5bd94jhwqgzlb5w75rfgb3v0jkg6fm79kd0byzp7bvp7i7ibj"
  },
  "qtx11extras": {
    "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "982f20eb585d77e5b5c721e05a466d7161f7f2d1",
-    "sha256": "0zl4bdxvdx2kfjwkd0rxvh70580g6idrgj4m3pyyw7z2jbzawpv3"
+    "rev": "9134cdba9386e408ce2ffe515ca0c3f6f6c66685",
+    "sha256": "03qs1griqx3bccaqas8mifbj4f4bhwfzc3f6knws3zy3mc9l8qzq"
  },
  "qtxmlpatterns": {
    "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "30e6c84fe2752cde8b53aff9d38c2095cd7c8761",
-    "sha256": "04i1282hyqqspdlvny1dz5006svq84rpqvnvlvsas83vxzhr1g1k"
+    "rev": "b798a0f0265538a9dd12b5c7e4dad84ba8e1db4e",
+    "sha256": "1lh9rci7bqrjw912blns369qs76c7lywnxmmmlhchrhk9l89ailk"
  }
 }
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@ -1,7 +1,7 @@
 { lib, fetchgit, fetchFromGitHub }:

 let
-  version = "5.15.6";
+  version = "5.15.7";
  overrides = {};

  mk = name: args:
--- a/pkgs/development/libraries/quictls/default.nix
+++ b/pkgs/development/libraries/quictls/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "quictls";
-  version = "3.0.5+quick_unstable-2022-07.05";
+  version = "3.0.7+quic1";

  src = fetchFromGitHub {
    owner = "quictls";
    repo = "openssl";
-    rev = "75e940831d0570d6b020cfebf128ae500f424867";
-    sha256 = "sha256-1HBGKafcCbM0RZWLvyl3vpSfGBsAcGDgjz1Nm/qclWM=";
+    rev = "openssl-${version}";
+    sha256 = "sha256-ZRS0ZV+/U4PD2lVE+PsUAWSuk5EFg5mOKYlwgY3Ecus=";
  };

  patches = [
@ -108,6 +108,9 @@ stdenv.mkDerivation rec {
    "-DUSE_CRYPTODEV_DIGESTS"
  ] ++ lib.optional enableSSL2 "enable-ssl2"
    ++ lib.optional enableSSL3 "enable-ssl3"
+    # We select KTLS here instead of the configure-time detection (which we patch out).
+    # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
+    ++ lib.optional (stdenv.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
    ++ lib.optional stdenv.hostPlatform.isAarch64 "no-afalgeng"
    # OpenSSL needs a specific `no-shared` configure flag.
    # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@ -1,16 +1,13 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, nix-update-script
-
-# for passthru.tests
-, bazel
+, cmake
+, ninja
 , chromium
 , grpc
 , haskellPackages
 , mercurial
-, ninja
-, python3
+, python3Packages
 }:

 stdenv.mkDerivation rec {
@ -21,48 +18,54 @@ stdenv.mkDerivation rec {
    owner = "google";
    repo = "re2";
    rev = version;
-    sha256 = "sha256-UontAjOXpnPcOgoFHjf+1WSbCR7h58/U7nn4meT200Y=";
+    hash = "sha256-UontAjOXpnPcOgoFHjf+1WSbCR7h58/U7nn4meT200Y=";
  };

-  preConfigure = ''
-    substituteInPlace Makefile --replace "/usr/local" "$out"
-    # we're using gnu sed, even on darwin
-    substituteInPlace Makefile  --replace "SED_INPLACE=sed -i '''" "SED_INPLACE=sed -i"
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ cmake ninja ];
+
+  postPatch = ''
+    substituteInPlace re2Config.cmake.in \
+      --replace "\''${PACKAGE_PREFIX_DIR}/" ""
  '';

-  buildFlags = lib.optionals stdenv.hostPlatform.isStatic [ "static" ];
+  # Needed for case-insensitive filesystems (i.e. MacOS) because a file named
+  # BUILD already exists.
+  cmakeBuildDir = "build_dir";

-  enableParallelBuilding = true;
+  cmakeFlags = lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS:BOOL=ON";
+
+  # This installs a pkg-config definition.
+  postInstall = ''
+    pushd "$src"
+    make common-install prefix="$dev" SED_INPLACE="sed -i"
+    popd
+  '';

-  preCheck = "patchShebangs runtests";
  doCheck = true;
-  checkTarget = if stdenv.hostPlatform.isStatic then "static-test" else "test";

-  installTargets = lib.optionals stdenv.hostPlatform.isStatic [ "static-install" ];
-
-  doInstallCheck = true;
-  installCheckTarget = if stdenv.hostPlatform.isStatic then "static-testinstall" else "testinstall";
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
-    tests = {
-      inherit
-        chromium
-        grpc
-        mercurial;
-      inherit (python3.pkgs)
-        fb-re2
-        google-re2;
-      haskellPackages-re2 = haskellPackages.re2;
-    };
+  passthru.tests = {
+    inherit
+      chromium
+      grpc
+      mercurial;
+    inherit (python3Packages)
+      fb-re2
+      google-re2;
+    haskell-re2 = haskellPackages.re2;
  };

-  meta = {
+  meta = with lib; {
+    description = "A regular expression library";
+    longDescription = ''
+      RE2 is a fast, safe, thread-friendly alternative to backtracking regular
+      expression engines like those used in PCRE, Perl, and Python. It is a C++
+      library.
+    '';
+    license = licenses.bsd3;
    homepage = "https://github.com/google/re2";
-    description = "An efficient, principled regular expression library";
-    license = lib.licenses.bsd3;
-    platforms = with lib.platforms; all;
+    maintainers = with maintainers; [ azahi ];
+    platforms = platforms.all;
  };
 }
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "spirv-headers";
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "SPIRV-Headers";
    rev = "sdk-${version}";
-    hash = "sha256-qYhFoRrQOlvYvVXhIFsa3dZuORDpZyVC5peeYmGNimw=";
+    hash = "sha256-lUWgZYGPu+IaLUrbtyC7R0o3Hq/q7C7BE8r7DAsiC30=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
  pname = "vulkan-headers";
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  nativeBuildInputs = [ cmake ];

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    owner = "KhronosGroup";
    repo = "Vulkan-Headers";
    rev = "sdk-${version}";
-    hash = "sha256-zUT5+Ttmkrj51a9FS1tQxoYMS0Y0xV8uaCEJNur4khc=";
+    hash = "sha256-EoD48jBoJmIet4BDC6bYxOsKK2358SZ/NcZeM61q/5g=";
  };

  meta = with lib; {
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@ -3,14 +3,14 @@

 stdenv.mkDerivation rec {
  pname = "vulkan-loader";
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  src = (assert version == vulkan-headers.version;
    fetchFromGitHub {
      owner = "KhronosGroup";
      repo = "Vulkan-Loader";
      rev = "sdk-${version}";
-      hash = "sha256-lmdImPeosHbAbEzPVW4K9Wkz/mF6gr8MVroGf0bDEPc=";
+      hash = "sha256-HWaa3JT0znhvqbvZdcsAwy8Dr6HDQp4rgpVmMOuCo0s=";
    });

  patches = [ ./fix-pkgconfig.patch ];
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "wayland-protocols";
-  version = "1.26";
+  version = "1.27";

  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;

  src = fetchurl {
-    url = "https://wayland.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "04vgllmpmrv14x3x64ns01vgwx4hriljayjkz9idgbv83i63hly5";
+    url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
+    hash = "sha256-kEbxCkJdTioAlloDrPtrP7V1pWUDrHLCuGghxpZTN1w=";
  };

  postPatch = lib.optionalString doCheck ''
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@ -25,6 +25,8 @@
 let
  mkFlag = optSet: flag: if optSet then "-D${flag}=ON" else "-D${flag}=OFF";

+  isCross = stdenv.buildPlatform != stdenv.hostPlatform;
+
  cmakeCommonFlags = [
    "-Wno-dev"
    (mkFlag custatsSupport "DETAILED_CU_STATS")
@ -81,6 +83,8 @@ stdenv.mkDerivation rec {
      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/x265/files/test-ns.patch?id=1d1de341e1404a46b15ae3e84bc400d474cf1a2c";
      sha256 = "0zg3g53l07yh7ar5c241x50y5zp7g8nh8rh63ad4bdpchpc2f52d";
    })
+    # Fix detection of NEON (and armv6 build) :
+    ./fix-neon-detection.patch
  ];

  postPatch = ''
@ -107,7 +111,7 @@ stdenv.mkDerivation rec {
    "-DENABLE_SHARED=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
    "-DHIGH_BIT_DEPTH=OFF"
    "-DENABLE_HDR10_PLUS=ON"
-  ] ++ [
+    (mkFlag (isCross && stdenv.hostPlatform.isAarch) "CROSS_COMPILE_ARM")
    (mkFlag cliSupport "ENABLE_CLI")
    (mkFlag unittestsSupport "ENABLE_TESTS")
  ] ++ lib.optionals (multibitdepthSupport) [
--- a/pkgs/development/libraries/x265/fix-neon-detection.patch
+++ b/pkgs/development/libraries/x265/fix-neon-detection.patch
@ -0,0 +1,28 @@
+commit 72489cd0a1c229258abe4f20e4fdfd414dfa88da
+Author: rnhmjoj <rnhmjoj@inventati.org>
+Date:   Sun Oct 2 00:15:24 2022 +0200
+
+    Fix NEON detection
+
+diff --git a/cmake/FindNeon.cmake b/cmake/FindNeon.cmake
+index 0062449..9c436d9 100644
+--- a/cmake/FindNeon.cmake
+++ b/cmake/FindNeon.cmake
+@@ -1,10 +1,11 @@
+ include(FindPackageHandleStandardArgs)
+ 
+ # Check the version of neon supported by the ARM CPU
+-execute_process(COMMAND cat /proc/cpuinfo | grep Features | grep neon
+-                OUTPUT_VARIABLE neon_version
+-                ERROR_QUIET
+-                OUTPUT_STRIP_TRAILING_WHITESPACE)
+-if(neon_version)
+-    set(CPU_HAS_NEON 1)
+message(STATUS "Detecting NEON support")
+execute_process(COMMAND sed -n "/Features.* neon/q 1" /proc/cpuinfo
+                RESULT_VARIABLE CPU_HAS_NEON)
+if(CPU_HAS_NEON)
+    message(STATUS "Detecting NEON support - supported")
+else()
+    message(STATUS "Detecting NEON support - not supported" )
+ endif()
--- a/pkgs/development/libraries/zlib/CVE-2022-37434.patch
+++ b/pkgs/development/libraries/zlib/CVE-2022-37434.patch
@ -1,62 +0,0 @@
-From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
-From: Mark Adler <fork@madler.net>
-Date: Sat, 30 Jul 2022 15:51:11 -0700
-Subject: [PATCH] Fix a bug when getting a gzip header extra field with
- inflate().
-
-If the extra field was larger than the space the user provided with
-inflateGetHeader(), and if multiple calls of inflate() delivered
-the extra header data, then there could be a buffer overflow of the
-provided space. This commit assures that provided space is not
-exceeded.
---
- inflate.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/inflate.c b/inflate.c
-index 7be8c6366..7a7289749 100644
--- a/inflate.c
-+++ b/inflate.c
-@@ -763,9 +763,10 @@ int flush;
-                 copy = state->length;
-                 if (copy > have) copy = have;
-                 if (copy) {
-+                    len = state->head->extra_len - state->length;
-                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
-+                        state->head->extra != Z_NULL &&
-+                        len < state->head->extra_max) {
-                         zmemcpy(state->head->extra + len, next,
-                                 len + copy > state->head->extra_max ?
-                                 state->head->extra_max - len : copy);
-
-From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001
-From: Mark Adler <fork@madler.net>
-Date: Mon, 8 Aug 2022 10:50:09 -0700
-Subject: [PATCH] Fix extra field processing bug that dereferences NULL
- state->head.
-
-The recent commit to fix a gzip header extra field processing bug
-introduced the new bug fixed here.
---
- inflate.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/inflate.c b/inflate.c
-index 7a7289749..2a3c4fe98 100644
--- a/inflate.c
-+++ b/inflate.c
-@@ -763,10 +763,10 @@ int flush;
-                 copy = state->length;
-                 if (copy > have) copy = have;
-                 if (copy) {
-                    len = state->head->extra_len - state->length;
-                     if (state->head != Z_NULL &&
-                         state->head->extra != Z_NULL &&
-                        len < state->head->extra_max) {
-+                        (len = state->head->extra_len - state->length) <
-+                            state->head->extra_max) {
-                         zmemcpy(state->head->extra + len, next,
-                                 len + copy > state->head->extra_max ?
-                                 state->head->extra_max - len : copy);
--- a/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch
+++ b/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch
@ -1,51 +0,0 @@
-From ec3df00224d4b396e2ac6586ab5d25f673caa4c2 Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Wed, 30 Mar 2022 11:14:53 -0700
-Subject: [PATCH] Correct incorrect inputs provided to the CRC functions.
-
-The previous releases of zlib were not sensitive to incorrect CRC
-inputs with bits set above the low 32. This commit restores that
-behavior, so that applications with such bugs will continue to
-operate as before.
---
- crc32.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/crc32.c b/crc32.c
-index a1bdce5c2..451887bc7 100644
--- a/crc32.c
-+++ b/crc32.c
-@@ -630,7 +630,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
- #endif /* DYNAMIC_CRC_TABLE */
- 
-     /* Pre-condition the CRC */
-    crc ^= 0xffffffff;
-+    crc = (~crc) & 0xffffffff;
- 
-     /* Compute the CRC up to a word boundary. */
-     while (len && ((z_size_t)buf & 7) != 0) {
-@@ -749,7 +749,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
- #endif /* DYNAMIC_CRC_TABLE */
- 
-     /* Pre-condition the CRC */
-    crc ^= 0xffffffff;
-+    crc = (~crc) & 0xffffffff;
- 
- #ifdef W
- 
-@@ -1077,7 +1077,7 @@ uLong ZEXPORT crc32_combine64(crc1, crc2, len2)
- #ifdef DYNAMIC_CRC_TABLE
-     once(&made, make_crc_table);
- #endif /* DYNAMIC_CRC_TABLE */
-    return multmodp(x2nmodp(len2, 3), crc1) ^ crc2;
-+    return multmodp(x2nmodp(len2, 3), crc1) ^ (crc2 & 0xffffffff);
- }
- 
- /* ========================================================================= */
-@@ -1112,5 +1112,5 @@ uLong crc32_combine_op(crc1, crc2, op)
-     uLong crc2;
-     uLong op;
- {
-    return multmodp(op, crc1) ^ crc2;
-+    return multmodp(op, crc1) ^ (crc2 & 0xffffffff);
- }
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@ -21,16 +21,18 @@ assert shared || static;

 assert splitStaticOutput -> static;

-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
  pname = "zlib";
-  version = "1.2.12";
+  version = "1.2.13";

  src = fetchurl {
-    urls =
-      [ "https://www.zlib.net/fossils/zlib-${version}.tar.gz"  # stable archive path
-        "mirror://sourceforge/libpng/zlib/${version}/zlib-${version}.tar.gz"
-      ];
-    sha256 = "91844808532e5ce316b3c010929493c0244f3d37593afd6de04f71821d5136d9";
+    urls = [
+      # This URL works for 1.2.13 only; hopefully also for future releases.
+      "https://github.com/madler/zlib/releases/download/v${version}/zlib-${version}.tar.gz"
+      # Stable archive path, but captcha can be encountered, causing hash mismatch.
+      "https://www.zlib.net/fossils/zlib-${version}.tar.gz"
+    ];
+    hash = "sha256-s6JN6XqP28g1uYMxaVAQMLiXcDG8tUs7OsE3QPhGqzA=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
@ -40,23 +42,18 @@ stdenv.mkDerivation (rec {
      --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
  '';

-  patches = [
-    ./fix-configure-issue-cross.patch
-    # Starting zlib 1.2.12, zlib is stricter to incorrect CRC inputs
-    # with bits set above the low 32.
-    # see https://github.com/madler/zlib/issues/618
-    # TODO: remove the patch if upstream releases https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2
-    # see https://github.com/NixOS/nixpkgs/issues/170539 for history.
-    ./comprehensive-crc-validation-for-wrong-implementations.patch
-    ./CVE-2022-37434.patch
-  ];
-
  strictDeps = true;
  outputs = [ "out" "dev" ]
    ++ lib.optional splitStaticOutput "static";
  setOutputFlags = false;
  outputDoc = "dev"; # single tiny man3 page

+  dontConfigure = stdenv.hostPlatform.libc == "msvcrt";
+
+  preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    export CHOST=${stdenv.hostPlatform.config}
+  '';
+
  # For zlib's ./configure (as of verion 1.2.11), the order
  # of --static/--shared flags matters!
  # `--shared --static` builds only static libs, while
@ -128,20 +125,10 @@ stdenv.mkDerivation (rec {
    "SHARED_MODE=1"
  ];

-  passthru = {
-    inherit version;
-  };
-
  meta = with lib; {
    homepage = "https://zlib.net";
    description = "Lossless data-compression library";
    license = licenses.zlib;
    platforms = platforms.all;
  };
-} // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
-  preConfigure = ''
-    export CHOST=${stdenv.hostPlatform.config}
-  '';
-} // lib.optionalAttrs (stdenv.hostPlatform.libc == "msvcrt") {
-  dontConfigure = true;
-})
+}
--- a/pkgs/development/libraries/zlib/fix-configure-issue-cross.patch
+++ b/pkgs/development/libraries/zlib/fix-configure-issue-cross.patch
@ -1,24 +0,0 @@
-From 05796d3d8d5546cf1b4dfe2cd72ab746afae505d Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Mon, 28 Mar 2022 18:34:10 -0700
-Subject: [PATCH] Fix configure issue that discarded provided CC definition.
-
---
- configure | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/configure b/configure
-index 52ff4a04e..3fa3e8618 100755
--- a/configure
-+++ b/configure
-@@ -174,7 +174,10 @@ if test -z "$CC"; then
-   else
-     cc=${CROSS_PREFIX}cc
-   fi
-+else
-+  cc=${CC}
- fi
-+
- cflags=${CFLAGS-"-O3"}
- # to force the asm version use: CFLAGS="-O3 -DASMV" ./configure
- case "$cc" in
--- a/pkgs/development/python-modules/colorama/default.nix
+++ b/pkgs/development/python-modules/colorama/default.nix
@ -1,24 +1,26 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib, fetchPypi, buildPythonPackage, hatchling, pytestCheckHook }:

 buildPythonPackage rec {
  pname = "colorama";
-  version = "0.4.5";
+  version = "0.4.6";
+  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-5sa0M0/FCYimOdm5iqQpoLV9puF7mkTwRR+TC2lnt6Q=";
+    sha256 = "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44";
  };

-  # No tests in archive
-  doCheck = false;
+  nativeBuildInputs = [ hatchling ];
+
+  checkInputs = [ pytestCheckHook ];

  pythonImportsCheck = [ "colorama" ];

  meta = with lib; {
    description = "Cross-platform colored terminal text";
    homepage = "https://github.com/tartley/colorama";
+    changelog = "https://github.com/tartley/colorama/raw/${version}/CHANGELOG.rst";
    license = licenses.bsd3;
    maintainers = with maintainers; [ ];
  };
 }
-
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPy3k
 , fetchFromGitHub
+, fetchpatch
 , python-dateutil
 , pytz
 , regex
@ -31,17 +32,17 @@ buildPythonPackage rec {

  patches = [
    ./regex-compat.patch
+    (fetchpatch {
+      name = "tests-31st.patch";
+      url = "https://github.com/scrapinghub/dateparser/commit/b132381b9c15e560a0be5183c7d96180119a7b4f.diff";
+      sha256 = "nQUWtfku5sxx/C45KJnfwvDXiccXGeVM+cQDKX9lxbE=";
+    })
  ];

  postPatch = ''
    substituteInPlace setup.py --replace \
      'regex !=2019.02.19,!=2021.8.27,<2022.3.15' \
      'regex'
-
-    # https://github.com/scrapinghub/dateparser/issues/1053
-    substituteInPlace tests/test_search.py --replace \
-      "('June 2020', datetime.datetime(2020, 6, datetime.datetime.utcnow().day, 0, 0))," \
-      "('June 2020', datetime.datetime(2020, 6, min(30, datetime.datetime.utcnow().day), 0, 0)),"
  '';

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/frozenlist/default.nix
+++ b/pkgs/development/python-modules/frozenlist/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "frozenlist";
-  version = "1.3.0";
+  version = "1.3.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "aio-libs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-cHKqkvsBUN7If+8swbd6aafFrSgnop3YlweBLPOHzyU=";
+    hash = "sha256-nOzS004uduS5C8y4ig0IaYyfk+h94uTiN048X66HO+Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@ -9,16 +9,21 @@

 buildPythonPackage rec {
  pname = "grpcio-status";
-  version = "1.48.1";
+  version = "1.50.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "655af4d0d6e67586cb2ca24c3db5fe08e4e2972d17f295f6b546fa7bd7eef1f6";
+    sha256 = "69be81c4317ec77983fb0eab80221a01e86e833e0fcf2f6acea0a62597c84b93";
  };

+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'protobuf>=4.21.6' 'protobuf'
+  '';
+
  propagatedBuildInputs = [
    googleapis-common-protos
    grpcio
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@ -2,16 +2,16 @@

 buildPythonPackage rec {
  pname = "grpcio-tools";
-  version = "1.48.1";
+  version = "1.50.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1178f2ea531f80cc2027ec64728df6ffc8e98cf1df61652a496eafd612127183";
+    sha256 = "88b75f2afd889c7c6939f58d76b58ab84de4723c7de882a1f8448af6632e256f";
  };

  postPatch = ''
    substituteInPlace setup.py \
-    --replace 'protobuf>=3.12.0, < 4.0dev' 'protobuf'
+      --replace 'protobuf>=4.21.6,<5.0dev' 'protobuf'
  '';

  outputs = [ "out" "dev" ];
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , buildPythonPackage
-, fetchpatch
 , grpc
 , six
 , protobuf
@ -17,15 +16,7 @@
 buildPythonPackage rec {
  inherit (grpc) src version;
  pname = "grpcio";
-
-  patches = [
-    # Fix build on armv6l
-    # https://github.com/grpc/grpc/pull/30401
-    (fetchpatch {
-      url = "https://github.com/grpc/grpc/commit/65dc9f3edeee4c2d0e9b30d5a3ee63175437bea3.patch";
-      hash = "sha256-pS4FsCcSjmjSs3J5Y96UonkxqPwfpkyhrEM0t6HaMd0=";
-    })
-  ];
+  format = "setuptools";

  outputs = [ "out" "dev" ];

--- a/pkgs/development/python-modules/mdurl/default.nix
+++ b/pkgs/development/python-modules/mdurl/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "mdurl";
-  version = "0.1.1";
+  version = "0.1.2";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "hukkin";
    repo = pname;
    rev = version;
-    sha256 = "sha256-SBJSs+i+I0jF90i3o6BUgLCDR6Et34fXEmQ7fbDoAbA=";
+    sha256 = "sha256-wxV8DKeTwKpFTUBuGTQXaVHc0eW1//Y+2V8Kgs85TDM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@ -1,41 +1,14 @@
 { buildPackages
 , lib
-, fetchpatch
-, python
 , buildPythonPackage
-, isPy37
 , protobuf
-, google-apputils ? null
-, six
 , pyext
-, isPy27
-, disabled
-, doCheck ? true
+, isPyPy
 }:

 buildPythonPackage {
  inherit (protobuf) pname src version;
-  inherit disabled;
-  doCheck = doCheck && !isPy27; # setuptools>=41.4 no longer collects correctly on python2
-
-  propagatedBuildInputs = [ six ] ++ lib.optionals isPy27 [ google-apputils ];
-  propagatedNativeBuildInputs = let
-    protobufVersion = "${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}";
-  in [
-    buildPackages."protobuf${protobufVersion}" # For protoc of the same version.
-  ];
-
-  nativeBuildInputs = [ pyext ] ++ lib.optionals isPy27 [ google-apputils ];
-  buildInputs = [ protobuf ];
-
-  patches = lib.optional (isPy37 && (lib.versionOlder protobuf.version "3.6.1.2"))
-    # Python 3.7 compatibility (not needed for protobuf >= 3.6.1.2)
-    (fetchpatch {
-      url = "https://github.com/protocolbuffers/protobuf/commit/0a59054c30e4f0ba10f10acfc1d7f3814c63e1a7.patch";
-      sha256 = "09hw22y3423v8bbmc9xm07znwdxfbya6rp78d4zqw6fisdvjkqf1";
-      stripLen = 1;
-    })
-  ;
+  disabled = isPyPy;

  prePatch = ''
    while [ ! -d python ]; do
@ -44,21 +17,30 @@ buildPythonPackage {
    cd python
  '';

-  setupPyGlobalFlags = lib.optional (lib.versionAtLeast protobuf.version "2.6.0")
-    "--cpp_implementation";
+  nativeBuildInputs = [ pyext ];
+
+  buildInputs = [ protobuf ];
+
+  propagatedNativeBuildInputs = [
+    # For protoc of the same version.
+    buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
+  ];
+
+  setupPyGlobalFlags = "--cpp_implementation";

  pythonImportsCheck = [
    "google.protobuf"
-  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "2.6.0") [
    "google.protobuf.internal._api_implementation" # Verify that --cpp_implementation worked
  ];

+  passthru = {
+    inherit protobuf;
+  };
+
  meta = with lib; {
    description = "Protocol Buffers are Google's data interchange format";
    homepage = "https://developers.google.com/protocol-buffers/";
    license = licenses.bsd3;
    maintainers = with maintainers; [ knedlsepp ];
  };
-
-  passthru.protobuf = protobuf;
 }
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@ -39,7 +39,7 @@

 buildPythonPackage rec {
  pname = "SQLAlchemy";
-  version = "1.4.41";
+  version = "1.4.41"; # TODO: check python3Packages.fastapi when updating to >= 1.4.42
  disabled = pythonOlder "3.7";

  src = fetchPypi {
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , aiofiles
 , anyio
 , contextlib2
@ -33,6 +34,14 @@ buildPythonPackage rec {
    hash = "sha256-vP2TJPn9lRGnLGkO8lUmnsoT6rSnhuWDD3WqNk76SM0=";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/encode/starlette/commit/ab70211f0e1fb7390668bf4891eeceda8d9723a0.diff";
+      excludes = [ "requirements.txt" ]; # conflicts
+      hash = "sha256-UHf4c4YUWp/1I1vD8J0hMewdlfkmluA+FyGf9ZsSv3Y=";
+    })
+  ];
+
  postPatch = ''
    # remove coverage arguments to pytest
    sed -i '/--cov/d' setup.cfg
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@ -8,6 +8,7 @@
 , pytest-timeout
 , pytestCheckHook
 , CoreServices
+, fetchpatch
 }:

 buildPythonPackage rec {
@ -22,6 +23,12 @@ buildPythonPackage rec {

  patches = lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
    ./force-kqueue.patch
+  ] ++ [
+    (fetchpatch {
+      url = "https://github.com/gorakhargosh/watchdog/commit/255d1e45c17929dd5ba8a6f91aa28771109931cd.patch";
+      sha256 = "sha256-gGgEGuB/0g+4Pv1dXMvIdObjqKruWKkxtufS/dzSlY8=";
+      excludes = [ "changelog.rst" ];
+    })
  ];

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
@ -41,11 +48,6 @@ buildPythonPackage rec {
    substituteInPlace setup.cfg \
      --replace "--cov=watchdog" "" \
      --replace "--cov-report=term-missing" ""
-  '' + lib.optionalString stdenv.hostPlatform.isMusl
-  # https://github.com/gorakhargosh/watchdog/issues/920
-  ''
-    substituteInPlace tests/test_inotify_c.py \
-      --replace "Unknown error -1" "No error information"
  '';

  disabledTests = [
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@ -4,8 +4,8 @@ buildRubyGem rec {
  inherit ruby;
  name = "${gemName}-${version}";
  gemName = "bundler";
-  version = "2.3.23";
-  source.sha256 = "sha256-xYrUhtzNfN3X9r8GqGj9d1aeZkcPozFrk/2c9oVkKx8=";
+  version = "2.3.24";
+  source.sha256 = "sha256-6qLrjDiS6HD5eSUrIZa9d+tVHh2/PNxOsWS6AexEOMQ=";
  dontPatchShebangs = true;

  passthru.updateScript = writeScript "gem-update-script" ''
--- a/pkgs/development/tools/build-managers/bear/default.nix
+++ b/pkgs/development/tools/build-managers/bear/default.nix
@ -9,7 +9,6 @@
 , gtest
 , spdlog
 , c-ares
-, abseil-cpp
 , zlib
 , sqlite
 , re2
@ -36,7 +35,6 @@ stdenv.mkDerivation rec {
    gtest
    spdlog
    c-ares
-    abseil-cpp
    zlib
    sqlite
    re2
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@ -32,6 +32,11 @@ python3.pkgs.buildPythonApplication rec {
    passthru.respect_xml_catalog_files_var_patch
  ];

+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace "pkg-config" "$PKG_CONFIG"
+  '';
+
  strictDeps = true;

  depsBuildBuild = [
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@ -90,6 +90,7 @@ stdenv.mkDerivation rec {
    # subset of the platform description.
    "--program-prefix=${targetPrefix}"

+    "--disable-werror"
    "--enable-targets=all" "--enable-64-bit-bfd"
    "--disable-install-libbfd"
    "--disable-shared" "--enable-static"
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "spirv-tools";
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  src = (assert version == spirv-headers.version;
    fetchFromGitHub {
      owner = "KhronosGroup";
      repo = "SPIRV-Tools";
      rev = "sdk-${version}";
-      hash = "sha256-jpVvjrNrTAKUY4sjUT/gCUElLtW4BrznH1DbStojGB8=";
+      hash = "sha256-sqjQoz9v9alSPc0ujEcWZxDAWh2S6oAPP1+JZmNCpA0=";
    }
  );

--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@ -22,7 +22,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "vulkan-validation-layers";
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  # If we were to use "dev" here instead of headers, the setupHook would be
  # placed in that output instead of "out".
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
      owner = "KhronosGroup";
      repo = "Vulkan-ValidationLayers";
      rev = "sdk-${version}";
-      hash = "sha256-5To5Llxl1i1XLaU2tR/O7g7dn2iV3FwLH7gFdXTMXxo=";
+      hash = "sha256-5bzUauu8081zyRaWmRUtOxHjUU4gc1GWoJtU783Msh0=";
    });

  # Include absolute paths to layer libraries in their associated
--- a/pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch
+++ b/pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch
@ -0,0 +1,16 @@
+Disable v8 system instrumentation on Darwin
+
+On Darwin, the v8 system instrumentation requires the header "os/signpost.h"
+which is available since apple_sdk 11+. See: https://github.com/nodejs/node/issues/39584
+
+--- old/tools/v8_gypfiles/features.gypi
+++ new/tools/v8_gypfiles/features.gypi
+@@ -62,7 +62,7 @@
+       }, {
+         'is_component_build': 0,
+       }],
+-      ['OS == "win" or OS == "mac"', {
+      ['OS == "win"', {
+         # Sets -DENABLE_SYSTEM_INSTRUMENTATION. Enables OS-dependent event tracing
+         'v8_enable_system_instrumentation': 1,
+       }, {
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@ -67,7 +67,7 @@ let
    configureFlags = let
      isCross = stdenv.hostPlatform != stdenv.buildPlatform;
      inherit (stdenv.hostPlatform) gcc isAarch32;
-    in sharedConfigureFlags ++ [
+    in sharedConfigureFlags ++ optionals (versionOlder version "19") [
      "--without-dtrace"
    ] ++ (optionals isCross [
      "--cross-compiling"
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@ -8,18 +8,10 @@ let
 in
  buildNodejs {
    inherit enableNpm;
-    version = "16.17.1";
-    sha256 = "sha256-ZyH+tBUtVtLGs1jOOXq9Wn8drwnuLiXFAhubTT+GozA=";
+    version = "16.18.0";
+    sha256 = "sha256-/P5q0jQPIpBh0+galN8Wf+P3fgFxLe3AFEoOfVjixps=";
    patches = [
      ./disable-darwin-v8-system-instrumentation.patch
      ./bypass-darwin-xcrun-node16.patch
-      # Fix npm silently fail without a HOME directory https://github.com/npm/cli/issues/4996
-      (fetchpatch {
-        url = "https://github.com/npm/cli/commit/9905d0e24c162c3f6cc006fa86b4c9d0205a4c6f.patch";
-        sha256 = "sha256-RlabXWtjzTZ5OgrGf4pFkolonvTDIPlzPY1QcYDd28E=";
-        includes = [ "deps/npm/lib/npm.js" "deps/npm/lib/utils/log-file.js" ];
-        stripLen = 1;
-        extraPrefix = "deps/npm/";
-      })
    ];
  }
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@ -8,8 +8,8 @@ let
 in
 buildNodejs {
  inherit enableNpm;
-  version = "18.10.0";
-  sha256 = "17z8081bqsldx4dl7399dp9gdsmd04lgnwvwycj7sjmyw9a1nwdd";
+  version = "18.12.0";
+  sha256 = "sha256-c6fwHimZ6xl3Y87WZqbNVErVgOrvtz4KhJYDs+gE9C4=";
  patches = [
    (fetchpatch {
      # Fixes cross compilation to aarch64-linux by reverting https://github.com/nodejs/node/pull/43200
--- a/pkgs/development/web/nodejs/v19.nix
+++ b/pkgs/development/web/nodejs/v19.nix
@ -0,0 +1,25 @@
+{ callPackage, openssl, fetchpatch, python3, enableNpm ? true }:
+
+let
+  buildNodejs = callPackage ./nodejs.nix {
+    inherit openssl;
+    python = python3;
+  };
+in
+buildNodejs {
+  inherit enableNpm;
+  version = "19.0.0";
+  sha256 = "sha256-C3LSB6WBXxznskezPL+aLIb20BJT+jmQyXROJdl1BQ0=";
+  patches = [
+    (fetchpatch {
+      # Fixes cross compilation to aarch64-linux by reverting https://github.com/nodejs/node/pull/43200
+      name = "revert-arm64-pointer-auth.patch";
+      url = "https://github.com/nodejs/node/pull/43200/commits/d42c42cc8ac652ab387aa93205aed6ece8a5040a.patch";
+      sha256 = "sha256-ipGzg4lEoftTJbt6sW+0QJO/AZqHvUkFKe0qlum+iLY=";
+      revert = true;
+    })
+
+    ./disable-darwin-v8-system-instrumentation-node19.patch
+    ./bypass-darwin-xcrun-node16.patch
+  ];
+}
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@ -70,6 +70,7 @@ stdenv.mkDerivation rec {

  propagatedBuildInputs = [ gmp ];

+  configurePlatforms = [ "build" "host" ];
  configureFlags = [
    "--localstatedir=/var"
    "--sysconfdir=/etc"
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -78,6 +78,7 @@ let
      INTEL_RAPL                       = whenAtLeast "5.3" module;
      X86_INTEL_LPSS                   = yes;
      X86_INTEL_PSTATE                 = yes;
+      X86_AMD_PSTATE                   = whenAtLeast "5.17" module;
    };

    external-firmware = {
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@ -137,7 +137,7 @@ let
    makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
      ++ extraMakeFlags;

-    prePatch = kernel.prePatch + ''
+    postPatch = kernel.postPatch + ''
      # Patch kconfig to print "###" after every question so that
      # generate-config.pl from the generic builder can answer them.
      sed -e '/fflush(stdout);/i\printf("###");' -i scripts/kconfig/conf.c
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@ -105,7 +105,7 @@ let
        # Fixes determinism by normalizing metadata for the archive of kheaders
        ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;

-      prePatch = ''
+      postPatch = ''
        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'

        # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
@ -118,14 +118,9 @@ let
        # See also https://kernelnewbies.org/BuildId
        sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'

-        # Some linux-hardened patches now remove certain files in the scripts directory, so we cannot
-        # patch all scripts until after patches are applied.
-        # However, scripts/ld-version.sh is still ran when generating a configfile for a kernel, so it needs
-        # to be patched prior to patchPhase
-        patchShebangs scripts/ld-version.sh
-      '';
+        # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
+        [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh

-      postPatch = ''
        # Set randstruct seed to a deterministic but diversified value. Note:
        # we could have instead patched gen-random-seed.sh to take input from
        # the buildFlags, but that would require also patching the kernel's
@ -135,7 +130,7 @@ let
          if [ -f "$file" ]; then
            substituteInPlace "$file" \
              --replace NIXOS_RANDSTRUCT_SEED \
-              $(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+              $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
            break
          fi
        done
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, fetchpatch }:

 stdenv.mkDerivation rec {
-  version = "0.3.112";
+  version = "0.3.113";
  pname = "libaio";

  src = fetchurl {
    url = "https://pagure.io/libaio/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.gz";
-    sha256 = "0wi2myh191sja13qj3claxhpfkngvy10x30f78hm9cxzkfr97kxp";
+    sha256 = "sha256-cWxwWXAyRzROsGa1TsvDyiE08BAzBxkubCt9q1+VKKs=";
  };

  postPatch = ''
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -85,7 +85,7 @@
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
-, withLibBPF ? true
+, withLibBPF ? lib.versionAtLeast llvmPackages.clang.version "10.0"
 , withLocaled ? true
 , withLogind ? true
 , withMachined ? true
--- a/pkgs/servers/rippled/default.nix
+++ b/pkgs/servers/rippled/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, fetchurl, git, cmake, pkg-config
-, openssl, boost, grpc, abseil-cpp, protobuf, libnsl }:
+, openssl, boost, grpc, protobuf, libnsl }:

 let
  sqlite3 = fetchurl rec {
@ -130,7 +130,7 @@ in stdenv.mkDerivation rec {
  cmakeFlags = ["-Dstatic=OFF" "-DBoost_NO_BOOST_CMAKE=ON"];

  nativeBuildInputs = [ pkg-config cmake git ];
-  buildInputs = [ openssl openssl.dev boostSharedStatic grpc abseil-cpp protobuf libnsl ];
+  buildInputs = [ openssl openssl.dev boostSharedStatic grpc protobuf libnsl ];

  preConfigure = ''
    export HOME=$PWD
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@ -7,14 +7,6 @@
 let
  py = python3.override {
    packageOverrides = self: super: {
-      # TODO: https://github.com/aws/aws-cli/pull/5712
-      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
-        version = "0.4.3";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "189n8hpijy14jfan4ha9f5n06mnl33cxz7ay92wjqgkr639s0vg9";
-        };
-      });
      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
        version = "5.4.1";
        src = fetchFromGitHub {
@ -47,6 +39,7 @@ with py.pkgs; buildPythonApplication rec {
  postPatch = ''
    substituteInPlace setup.py \
      --replace "docutils>=0.10,<0.17" "docutils>=0.10" \
+      --replace "colorama>=0.2.5,<0.4.5" "colorama>=0.2.5,<0.5" \
      --replace "rsa>=3.1.2,<4.8" "rsa<5,>=3.1.2"
  '';

--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@ -30,23 +30,15 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "graphviz";
-  version = "5.0.1";
+  version = "7.0.0";

  src = fetchFromGitLab {
    owner = "graphviz";
    repo = "graphviz";
    rev = version;
-    sha256 = "sha256-lcU6Pb45kg7AxXQ9lmqwAazT2JpGjBz4PzK+S5lpYa0=";
+    sha256 = "sha256-n+g4XNTSbCXOoL7JIE6uP9AZJj3YDfTG9EcmUA+r8hY=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.com/graphviz/graphviz/-/commit/8d662734b6a34709d9475b120e7ce3de872339e2.diff";
-      includes = [ "lib/*" ];
-      sha256 = "sha256-cqzUpK//2TnzWb7oSa/g8LJ61yr3O+Wiq5LsZzw34NE=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "vulkan-extension-layer";
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  src = (assert version == vulkan-headers.version;
    fetchFromGitHub {
      owner = "KhronosGroup";
      repo = "Vulkan-ExtensionLayer";
      rev = "sdk-${version}";
-      hash = "sha256-KOlwtfuAYWzUFtf0NOJCNzWW+/ogRUgkaWw8NdW2vb8=";
+      hash = "sha256-8Z9w+3WFPYp8QKEUVkEQCGy9LXMWYlZDgGt8i34T5DU=";
    });

  nativeBuildInputs = [ cmake jq ];
@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
    export XDG_DATA_DIRS=@out@/share:$XDG_DATA_DIRS
  '';

+  # Tests are not for gpu-less and headless environments
+  cmakeFlags = [
+    "-DBUILD_TESTS=false"
+  ];
+
  # Include absolute paths to layer libraries in their associated
  # layer definition json files.
  preFixup = ''
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@ -23,14 +23,14 @@
 stdenv.mkDerivation rec {
  pname = "vulkan-tools-lunarg";
  # The version must match that in vulkan-headers
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  src = (assert version == vulkan-headers.version;
    fetchFromGitHub {
      owner = "LunarG";
      repo = "VulkanTools";
      rev = "sdk-${version}";
-      hash = "sha256-YQv6YboyQJjLTEKspZQdV8YFhHux/4RIncHXOsz1cBw=";
+      hash = "sha256-qomhouuKVv4Dat9Sv7X68Dw6bRnaUjj6iEXC9pCqX4E=";
      fetchSubmodules = true;
    });

--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@ -21,17 +21,17 @@

 stdenv.mkDerivation rec {
  pname = "vulkan-tools";
-  version = "1.3.224.1";
+  version = "1.3.231.0";

  # It's not strictly necessary to have matching versions here, however
  # since we're using the SDK version we may as well be consistent with
  # the rest of nixpkgs.
-  src = (assert version == vulkan-headers.version;
+  src = (assert (version) == vulkan-headers.version;
    fetchFromGitHub {
      owner = "KhronosGroup";
      repo = "Vulkan-Tools";
      rev = "sdk-${version}";
-      hash = "sha256-Z+QJBd2LBdiJD1fHhBLbOfOoLhqTg0J3tq+XQRSiQaY=";
+      hash = "sha256-6oimP4ISa0dX4bLU3Nch8Ur6MzEMQscnL8EfRrqT/Es=";
    });

  nativeBuildInputs = [
--- a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
+++ b/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
@ -31,9 +31,9 @@ index 99048c489..19abfbbac 100644
 --- a/lib/curl_setup.h
 +++ b/lib/curl_setup.h
@@ -247,19 +247,6 @@
- #  include "setup-win32.h"
- #endif
- 
+
+ #include <curl/system.h>
+
 -/*
 - * Use getaddrinfo to resolve the IPv4 address literal. If the current network
 - * interface doesn't support IPv4, but supports IPv6, NAT64, and DNS64,
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@ -47,14 +47,14 @@ assert !(opensslSupport && wolfsslSupport);

 stdenv.mkDerivation (finalAttrs: {
  pname = "curl";
-  version = "7.85.0";
+  version = "7.86.0";

  src = fetchurl {
    urls = [
      "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.bz2"
      "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.bz2"
    ];
-    sha256 = "sha256-IafoNijulhZKwrNv9r+Z1GfHsLYhwffjF9jw2WARU5w=";
+    sha256 = "sha256-9cpp2wPuoX+ocFvfsan1jXakbJAQUYEJuzjzExN+Cig=";
  };

  patches = [
--- a/Show more
+++ b/Show more