diff --git a/nixos/tests/systemd-cryptenroll.nix b/nixos/tests/systemd-cryptenroll.nix
index 9ee2d280fbbe..055ae7d1681f 100644
--- a/nixos/tests/systemd-cryptenroll.nix
+++ b/nixos/tests/systemd-cryptenroll.nix
@@ -2,7 +2,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "systemd-cryptenroll";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ ymatsiuk ];
-    broken = true; # times out after two hours, details -> https://github.com/NixOS/nixpkgs/issues/167994
   };
 
   nodes.machine = { pkgs, lib, ... }: {
diff --git a/pkgs/applications/audio/aether-lv2/default.nix b/pkgs/applications/audio/aether-lv2/default.nix
index e912c7fa49a4..179c656968ce 100644
--- a/pkgs/applications/audio/aether-lv2/default.nix
+++ b/pkgs/applications/audio/aether-lv2/default.nix
@@ -18,6 +18,12 @@ stdenv.mkDerivation rec {
     lv2 libX11 libGL libGLU mesa
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=stringop-overflow"
+  ];
+
   installPhase = ''
     mkdir -p $out/lib/lv2
     cp -r aether.lv2 $out/lib/lv2
diff --git a/pkgs/applications/audio/bespokesynth/default.nix b/pkgs/applications/audio/bespokesynth/default.nix
index 6c48c756ab24..7fc921e59fbf 100644
--- a/pkgs/applications/audio/bespokesynth/default.nix
+++ b/pkgs/applications/audio/bespokesynth/default.nix
@@ -66,6 +66,10 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i Source/TitleBar.h # gcc12
+  '';
+
   cmakeBuildType = "Release";
 
   cmakeFlags = lib.optionals enableVST2 [ "-DBESPOKE_VST2_SDK_LOCATION=${vst-sdk}/VST2_SDK" ];
diff --git a/pkgs/applications/audio/calf/default.nix b/pkgs/applications/audio/calf/default.nix
index 4ab651e3fb84..b4c9781ced19 100644
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "17x4hylgq4dn9qycsdacfxy64f5cv57n2qgkvsdp524gnqzw4az3";
   };
 
+  outputs = [ "out" "doc" ];
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/audio/furnace/default.nix b/pkgs/applications/audio/furnace/default.nix
index 0f15775b38d5..f0bb039a79c4 100644
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@@ -63,6 +63,12 @@ stdenv.mkDerivation rec {
     "-DWARNINGS_ARE_ERRORS=ON"
   ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or aarch64 (old gcc)
+    "-Wno-error=mismatched-new-delete"
+    "-Wno-error=use-after-free"
+  ];
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Normal CMake install phase on Darwin only installs the binary, the user is expected to use CPack to build a
     # bundle. That adds alot of overhead for not much benefit (CPack is currently abit broken, and needs impure access
diff --git a/pkgs/applications/audio/jack-rack/default.nix b/pkgs/applications/audio/jack-rack/default.nix
index 420c11562e2a..8cf55289b2f3 100644
--- a/pkgs/applications/audio/jack-rack/default.nix
+++ b/pkgs/applications/audio/jack-rack/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libjack2 ladspaH gtk2 alsa-lib libxml2 lrdf ];
-  NIX_LDFLAGS = "-ldl -lm -lpthread";
+  NIX_LDFLAGS = "-lm -lpthread";
 
   meta = {
     description = ''An effects "rack" for the JACK low latency audio API'';
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index 70cb4d7f1109..36b6345c0f11 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -21,8 +21,6 @@ stdenv.mkDerivation rec {
   #       `l_notebook1'; jamin-callbacks.o:/build/jamin-0.95.0/src/hdeq.h:64: first defined here
   NIX_CFLAGS_COMPILE = "-fcommon";
 
-  NIX_LDFLAGS = "-ldl";
-
   postInstall = ''
     wrapProgram $out/bin/jamin --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa
   '';
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index dd00bd1f2c02..4e4612ef922c 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -4,19 +4,21 @@
 , ladspaH, php, libXrandr }:
 
 stdenv.mkDerivation rec {
-        pname = "lsp-plugins";
-        version = "1.2.5";
+  pname = "lsp-plugins";
+  version = "1.2.5";
 
-        src = fetchurl {
-                url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-                sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
-        };
+  src = fetchurl {
+    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
+    sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
+  };
 
-        nativeBuildInputs = [ pkg-config php makeWrapper ];
-        buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];
+  outputs = [ "out" "dev" "doc" ];
 
-        makeFlags = [
-                "PREFIX=${placeholder "out"}"
+  nativeBuildInputs = [ pkg-config php makeWrapper ];
+  buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
   ];
 
   NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
diff --git a/pkgs/applications/audio/mimic/default.nix b/pkgs/applications/audio/mimic/default.nix
index 7e11c0a8d75f..47e043f5d467 100644
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@@ -38,6 +38,11 @@ stdenv.mkDerivation rec {
     pcre2
   ] ++ lib.optional pulseaudioSupport libpulseaudio;
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=free-nonheap-object"
+  ];
+
   postInstall = ''
     wrapProgram $out/bin/mimic \
       --run "export ALSA_PLUGIN_DIR=${alsa-plugins}/lib/alsa-lib"
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 29f28203e138..3eb2cf20ee77 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mpg123";
-  version = "1.29.3";
+  version = "1.31.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ljiF2Mx3Ji8ot3GHx9GJ4yGV5kJE3iUwt5jd8yGD6Ec=";
+    sha256 = "sha256-sX8ikF4x9DtrQB399qce0Ru30Fb2jbRJ1wufmug5x94=";
   };
 
   outputs = [ "out" ] ++ lib.optionals withConplay [ "conplay" ];
diff --git a/pkgs/applications/audio/odin2/default.nix b/pkgs/applications/audio/odin2/default.nix
index beb126467935..de89f9aedead 100644
--- a/pkgs/applications/audio/odin2/default.nix
+++ b/pkgs/applications/audio/odin2/default.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-N96Nb7G6hqfh8DyMtHbttl/fRZUkS8f2KfPSqeMAhHY=";
   };
 
+  postPatch = ''
+    sed '1i#include <utility>' -i \
+      libs/JUCELV2/modules/juce_gui_basics/windows/juce_ComponentPeer.h # gcc12
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/applications/audio/opusfile/default.nix b/pkgs/applications/audio/opusfile/default.nix
index f86595361b65..47d7a64e3c20 100644
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, openssl, libogg, libopus }:
+{ lib, stdenv, fetchurl, pkg-config, openssl, libogg, libopus, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "opusfile";
@@ -12,7 +12,14 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl libogg ];
   propagatedBuildInputs = [ libopus ];
   outputs = [ "out" "dev" ];
-  patches = [ ./include-multistream.patch ]
+  patches = [
+    ./include-multistream.patch
+    (fetchpatch {
+      name = "CVE-2022-47021.patch";
+      url = "https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5.patch";
+      sha256 = "sha256-XThI/ys5caB+OncFVfxm5IsvQPy1MbLQKwIlYjPvTJQ=";
+    })
+  ]
     # fixes problem with openssl 1.1 dependency
     # see https://github.com/xiph/opusfile/issues/13
     ++ lib.optionals stdenv.hostPlatform.isWindows [ ./disable-cert-store.patch ];
diff --git a/pkgs/applications/audio/stochas/default.nix b/pkgs/applications/audio/stochas/default.nix
index 84376a1bbe9e..2b72664347e6 100644
--- a/pkgs/applications/audio/stochas/default.nix
+++ b/pkgs/applications/audio/stochas/default.nix
@@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    sed '1i#include <utility>' -i \
+      lib/JUCE/modules/juce_gui_basics/windows/juce_ComponentPeer.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index f5ed28cedf68..b7b70eb501ea 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (rec {
   pname = "ed";
-  version = "1.18";
+  version = "1.19";
 
   src = fetchurl {
     url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    sha256 = "sha256-rKjvrZgAxYdySiC5eqj8R+a1pH34Fgb+q6gxsHRGK08=";
+    hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/applications/editors/poke/default.nix b/pkgs/applications/editors/poke/default.nix
index 8f4bcfd67263..fba050a040cf 100644
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@@ -80,13 +80,13 @@ in stdenv.mkDerivation rec {
     moveToOutput share/vim "$out"
   '';
 
+  # Prevent tclPackageHook from auto-wrapping all binaries, we only
+  # need to wrap poke-gui
+  dontWrapTclBinaries = true;
+
   postFixup = lib.optionalString guiSupport ''
     wrapProgram "$out/bin/poke-gui" \
       --prefix TCLLIBPATH ' ' "$TCLLIBPATH"
-
-    # Prevent tclPackageHook from auto-wrapping all binaries, we only
-    # need to wrap poke-gui
-    unset TCLLIBPATH
   '';
 
   passthru = {
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index 084bf0745429..aedf42ee126b 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -117,6 +117,10 @@ stdenv.mkDerivation rec {
       --subst-var-by mamePath "$out/opt/mame"
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=use-after-free"
+  ];
+
   desktopItems = [
     (makeDesktopItem {
       name = "MAME";
diff --git a/pkgs/applications/emulators/rpcs3/default.nix b/pkgs/applications/emulators/rpcs3/default.nix
index b2861184a61b..b9efcaaf4f6e 100644
--- a/pkgs/applications/emulators/rpcs3/default.nix
+++ b/pkgs/applications/emulators/rpcs3/default.nix
@@ -1,4 +1,4 @@
-{ gcc11Stdenv, lib, fetchFromGitHub, wrapQtAppsHook, cmake, pkg-config, git
+{ gcc12Stdenv, lib, fetchFromGitHub, wrapQtAppsHook, cmake, pkg-config, git
 , qtbase, qtquickcontrols, qtmultimedia, openal, glew, vulkan-headers, vulkan-loader, libpng
 , ffmpeg, libevdev, libusb1, zlib, curl, wolfssl, python3, pugixml, faudio, flatbuffers
 , sdl2Support ? true, SDL2
@@ -21,7 +21,7 @@ let
     sha256 = "0c3g30rj1y8fbd2q4kwlpg1jdy02z4w5ryhj3yr9051pdnf4kndz";
   };
 in
-gcc11Stdenv.mkDerivation {
+gcc12Stdenv.mkDerivation {
   pname = "rpcs3";
   version = rpcs3Version;
 
diff --git a/pkgs/applications/graphics/foxotron/default.nix b/pkgs/applications/graphics/foxotron/default.nix
index e8fd0364808c..ca2aa96bea14 100644
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@@ -46,6 +46,11 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [ libX11 libXrandr libXinerama libXcursor libXi libXext alsa-lib fontconfig libGLU ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ AVFoundation Carbon Cocoa CoreAudio Kernel OpenGL ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index 325d1bcf083d..8f70d9273b7a 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons pkg-config wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+  ];
+
   NIX_LDFLAGS = "-lpthread";
 
   buildPhase = ''
diff --git a/pkgs/applications/graphics/hdrmerge/default.nix b/pkgs/applications/graphics/hdrmerge/default.nix
index b0e346331bce..d690f5e0671a 100644
--- a/pkgs/applications/graphics/hdrmerge/default.nix
+++ b/pkgs/applications/graphics/hdrmerge/default.nix
@@ -46,6 +46,11 @@ mkDerivation rec {
       url = "https://github.com/mkroehnert/hdrmerge/commit/472b2dfe7d54856158aea3d5412a02d0bab1da4c.patch";
       sha256 = "0jc713ajr4w08pfbi6bva442prj878nxp1fpl9112i3xj34x9sdi";
     })
+    (fetchpatch {
+      name = "support-libraw-0.21.patch";
+      url = "https://github.com/jcelaya/hdrmerge/commit/779e566b3e2807280b78c79affda2cdfa64bde87.diff";
+      sha256 = "48sivCfJWEtGiBXTrO+SWTVlT9xyx92w2kkB8Wt/clk=";
+    })
   ];
 
   desktopItems = [
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index cfb63e0e3f7c..e8e6a2cc9f86 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -1,7 +1,7 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  version = "5.1.4";
+  version = "5.1.5";
   kde-channel = "stable";
-  sha256 = "sha256-wisCCGJZbrL92RHhsXnbvOewgb4RFFei6sr2rhzKLcs=";
+  sha256 = "1lx4x4affkbh47b7w5qvahkkr4db0vcw6h24nykak6gpy2z5wxqw";
 })
diff --git a/pkgs/applications/misc/lyx/default.nix b/pkgs/applications/misc/lyx/default.nix
index d1a19eeccc5e..921ae570bca0 100644
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@@ -11,6 +11,12 @@ mkDerivation rec {
     sha256 = "sha256-xr7SYzQZiY4Bp8w1AxDX2TS/WRyrcln8JYGqTADq+ng=";
   };
 
+  # Needed with GCC 12
+  postPatch = ''
+    sed '1i#include <iterator>' -i src/lyxfind.cpp
+    sed '1i#include <cstring>'  -i src/insets/InsetListings.cpp
+  '';
+
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
   nativeBuildInputs = [ pkg-config makeWrapper ];
   buildInputs = [
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 935a9582fcac..e5e0f92ed1da 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -140,13 +140,16 @@ in stdenv.mkDerivation rec {
     patchShebangs tools/get_wb_version.sh
   '';
 
-  NIX_CFLAGS_COMPILE = toString ([
+  NIX_CFLAGS_COMPILE = [
     # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
     "-Wno-error=deprecated-declarations"
   ] ++ lib.optionals stdenv.isAarch64 [
     # error: narrowing conversion of '-1' from 'int' to 'char'
     "-Wno-error=narrowing"
-  ]);
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=maybe-uninitalized"
+  ];
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/networking/instant-messengers/jami/client.nix b/pkgs/applications/networking/instant-messengers/jami/client.nix
index f76d9ee9f12a..80efff68e65f 100644
--- a/pkgs/applications/networking/instant-messengers/jami/client.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/client.nix
@@ -9,7 +9,7 @@
 , python3
 , qttools # for translations
 , wrapQtAppsHook
-, ffmpeg-jami
+, ffmpeg_5
 , jami-daemon
 , libnotify
 , qt5compat
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
-    ffmpeg-jami
+    ffmpeg_5
     jami-daemon
     libnotify
     networkmanager
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common
deleted file mode 100644
index 0aac24e24bb6..000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common
+++ /dev/null
@@ -1,156 +0,0 @@
---disable-everything
---enable-zlib
---enable-gpl
---enable-swscale
---enable-bsfs
---disable-filters
---disable-programs
---disable-postproc
---disable-protocols
---enable-protocol=crypto
---enable-protocol=file
---enable-protocol=rtp
---enable-protocol=srtp
---enable-protocol=tcp
---enable-protocol=udp
---enable-protocol=unix
---enable-protocol=pipe
---disable-demuxers
---disable-muxers
---enable-muxer=rtp
---enable-muxer=g722
---enable-muxer=g723_1
---enable-muxer=g726
---enable-muxer=g726le
---enable-muxer=h263
---enable-muxer=h264
---enable-muxer=hevc
---enable-muxer=matroska
---enable-muxer=webm
---enable-muxer=ogg
---enable-muxer=pcm_s16be
---enable-muxer=pcm_s16le
---enable-demuxer=rtp
---enable-demuxer=mjpeg
---enable-demuxer=mjpeg_2000
---enable-demuxer=mpegvideo
---enable-demuxer=gif
---enable-demuxer=image_jpeg_pipe
---enable-demuxer=image_png_pipe
---enable-demuxer=image_webp_pipe
---enable-demuxer=matroska
---enable-demuxer=m4v
---enable-demuxer=mp3
---enable-demuxer=ogg
---enable-demuxer=flac
---enable-demuxer=wav
---enable-demuxer=ac3
---enable-demuxer=g722
---enable-demuxer=g723_1
---enable-demuxer=g726
---enable-demuxer=g726le
---enable-demuxer=pcm_mulaw
---enable-demuxer=pcm_alaw
---enable-demuxer=pcm_s16be
---enable-demuxer=pcm_s16le
---enable-demuxer=h263
---enable-demuxer=h264
---enable-demuxer=hevc
---enable-parser=h263
---enable-parser=h264
---enable-parser=hevc
---enable-parser=mpeg4video
---enable-parser=vp8
---enable-parser=vp9
---enable-parser=opus
---enable-encoder=adpcm_g722
---enable-decoder=adpcm_g722
---enable-encoder=adpcm_g726
---enable-decoder=adpcm_g726
---enable-encoder=adpcm_g726le
---enable-decoder=adpcm_g726le
---enable-decoder=g729
---enable-encoder=g723_1
---enable-decoder=g723_1
---enable-encoder=rawvideo
---enable-decoder=rawvideo
---enable-encoder=libx264
---enable-decoder=h264
---enable-encoder=pcm_alaw
---enable-decoder=pcm_alaw
---enable-encoder=pcm_mulaw
---enable-decoder=pcm_mulaw
---enable-encoder=mpeg4
---enable-decoder=mpeg4
---enable-encoder=libvpx_vp8
---enable-decoder=vp8
---enable-decoder=vp9
---enable-encoder=h263
---enable-encoder=h263p
---enable-decoder=h263
---enable-encoder=mjpeg
---enable-decoder=mjpeg
---enable-decoder=mjpegb
---enable-libspeex
---enable-libopus
---enable-libvpx
---enable-libx264
---enable-encoder=libspeex
---enable-decoder=libspeex
---enable-encoder=libopus
---enable-decoder=libopus
---enable-decoder=flac
---enable-decoder=vorbis
---enable-decoder=aac
---enable-decoder=ac3
---enable-decoder=eac3
---enable-decoder=mp3
---enable-decoder=pcm_u24be
---enable-decoder=pcm_u24le
---enable-decoder=pcm_u32be
---enable-decoder=pcm_u32le
---enable-decoder=pcm_u8
---enable-decoder=pcm_f16le
---enable-decoder=pcm_f24le
---enable-decoder=pcm_f32be
---enable-decoder=pcm_f32le
---enable-decoder=pcm_f64be
---enable-decoder=pcm_f64le
---enable-decoder=pcm_s16be
---enable-decoder=pcm_s16be_planar
---enable-decoder=pcm_s16le
---enable-decoder=pcm_s16le_planar
---enable-decoder=pcm_s24be
---enable-decoder=pcm_s24le
---enable-decoder=pcm_s24le_planar
---enable-decoder=pcm_s32be
---enable-decoder=pcm_s32le
---enable-decoder=pcm_s32le_planar
---enable-decoder=pcm_s64be
---enable-decoder=pcm_s64le
---enable-decoder=pcm_s8
---enable-decoder=pcm_s8_planar
---enable-decoder=pcm_u16be
---enable-decoder=pcm_u16le
---enable-encoder=gif
---enable-decoder=gif
---enable-encoder=jpegls
---enable-decoder=jpegls
---enable-encoder=ljpeg
---enable-decoder=jpeg2000
---enable-encoder=png
---enable-decoder=png
---enable-encoder=bmp
---enable-decoder=bmp
---enable-encoder=tiff
---enable-decoder=tiff
---enable-filter=scale
---enable-filter=overlay
---enable-filter=amix
---enable-filter=amerge
---enable-filter=aresample
---enable-filter=format
---enable-filter=aformat
---enable-filter=fps
---enable-filter=transpose
---enable-filter=pad
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux
deleted file mode 100644
index 6c40e8d2ea99..000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux
+++ /dev/null
@@ -1,18 +0,0 @@
---enable-pic
---target-os=linux
---enable-indev=v4l2
---enable-indev=xcbgrab
---enable-vdpau
---enable-hwaccel=h264_vdpau
---enable-hwaccel=mpeg4_vdpau
---enable-vaapi
---enable-hwaccel=h264_vaapi
---enable-hwaccel=mpeg4_vaapi
---enable-hwaccel=h263_vaapi
---enable-hwaccel=vp8_vaapi
---enable-hwaccel=mjpeg_vaapi
---enable-hwaccel=hevc_vaapi
---enable-encoder=h264_vaapi
---enable-encoder=vp8_vaapi
---enable-encoder=mjpeg_vaapi
---enable-encoder=hevc_vaapi
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86 b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86
deleted file mode 100644
index 2043aa3ee2d3..000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86
+++ /dev/null
@@ -1,10 +0,0 @@
---enable-cuvid
---enable-ffnvcodec
---enable-nvdec
---enable-nvenc
---enable-hwaccel=h264_nvdec
---enable-hwaccel=hevc_nvdec
---enable-hwaccel=vp8_nvdec
---enable-hwaccel=mjpeg_nvdec
---enable-encoder=h264_nvenc
---enable-encoder=hevc_nvenc
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches
deleted file mode 100644
index 28f884e66769..000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches
+++ /dev/null
@@ -1,7 +0,0 @@
-remove-mjpeg-log.patch
-change-RTCP-ratio.patch
-rtp_ext_abs_send_time.patch
-libopusdec-enable-FEC.patch
-libopusenc-reload-packet-loss-at-encode.patch
-ios-disable-b-frames.patch
-screen-sharing-x11-fix.patch
diff --git a/pkgs/applications/networking/instant-messengers/jami/daemon.nix b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
index 715560c6e128..bf2392f63153 100644
--- a/pkgs/applications/networking/instant-messengers/jami/daemon.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
@@ -9,7 +9,7 @@
 , asio
 , dbus
 , dbus_cplusplus
-, ffmpeg-jami
+, ffmpeg_5
 , fmt
 , gmp
 , gnutls
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     dbus
     dbus_cplusplus
     fmt
-    ffmpeg-jami
+    ffmpeg_5
     gmp
     gnutls
     http-parser
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index ea898c0da8c9..497616a6c038 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -4,7 +4,6 @@
 , fetchFromGitHub
 , fetchzip
 , fetchpatch
-, ffmpeg_5
 , pjsip
 , opendht
 , jack
@@ -41,31 +40,6 @@ let
   readLinesToList = with builtins; file: filter (s: isString s && stringLength s > 0) (split "\n" (readFile file));
 in
 rec {
-  ffmpeg-jami = (ffmpeg_5.override rec {
-    version = "5.0.1";
-    branch = version;
-    sha256 = "sha256-KN8z1AChwcGyDQepkZeAmjuI73ZfXwfcH/Bn+sZMWdY=";
-    doCheck = false;
-  }).overrideAttrs (old:
-    let
-      patch-src = src + "/daemon/contrib/src/ffmpeg/";
-    in
-    {
-      patches = old.patches ++ (map (x: patch-src + x) (readLinesToList ./config/ffmpeg_patches)) ++
-        # SDL2 recently changed their versioning
-        [
-          (fetchpatch {
-            url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
-            hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
-          })
-        ];
-      configureFlags = old.configureFlags
-        ++ (readLinesToList ./config/ffmpeg_args_common)
-        ++ lib.optionals stdenv.isLinux (readLinesToList ./config/ffmpeg_args_linux)
-        ++ lib.optionals (stdenv.isx86_32 || stdenv.isx86_64) (readLinesToList ./config/ffmpeg_args_x86);
-      outputs = [ "out" "doc" ];
-    });
-
   pjsip-jami = pjsip.overrideAttrs (old:
     let
       patch-src = src + "/daemon/contrib/src/pjproject/";
@@ -105,10 +79,10 @@ rec {
   };
 
   jami-daemon = callPackage ./daemon.nix {
-    inherit version src udev jack jami-meta ffmpeg-jami pjsip-jami opendht-jami;
+    inherit version src udev jack jami-meta pjsip-jami opendht-jami;
   };
 
   jami-client = qt6Packages.callPackage ./client.nix {
-    inherit version src ffmpeg-jami jami-meta;
+    inherit version src jami-meta;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
index e80ccd2105aa..9feb5ff10a07 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config, cmake, ninja, yasm
 , libjpeg, openssl_1_1, libopus, ffmpeg, alsa-lib, libpulseaudio, protobuf
 , openh264, usrsctp, libevent, libvpx
@@ -31,6 +31,14 @@ stdenv.mkDerivation {
     mesa libepoxy libglvnd
   ];
 
+  patches = [
+    # GCC 12 Fix
+    (fetchpatch {
+      url = "https://github.com/desktop-app/tg_owt/pull/101/commits/86d2bcd7afb8706663d29e30f65863de5a626142.patch";
+      hash = "sha256-iWS0mB8R0vqPU/0qf6Ax54UCAKYDVCPac2mi/VHbFm0=";
+    })
+  ];
+
   cmakeFlags = [
     # Building as a shared library isn't officially supported and may break at any time.
     "-DBUILD_SHARED_LIBS=OFF"
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 700a94429964..f9e9ec57704c 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -80,6 +80,11 @@ stdenv.mkDerivation rec {
   # guile warning
   GUILE_AUTO_COMPILE="0";
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=use-after-free"
+  ];
+
   # `make check` target does not define its prerequisites but expects them to
   # have already been built.  The list of targets below was built through trial
   # and error based on failing tests.
diff --git a/pkgs/applications/plasma-mobile/angelfish.nix b/pkgs/applications/plasma-mobile/angelfish.nix
index 1e1800fad451..7a7e48d736d0 100644
--- a/pkgs/applications/plasma-mobile/angelfish.nix
+++ b/pkgs/applications/plasma-mobile/angelfish.nix
@@ -3,7 +3,7 @@
 , cmake
 , corrosion
 , extra-cmake-modules
-, gcc11
+, gcc12
 , kconfig
 , kcoreaddons
 , kdbusaddons
@@ -46,7 +46,7 @@ mkDerivation rec {
     cmake
     corrosion
     extra-cmake-modules
-    gcc11 # doesn't build with GCC 9 from stdenv on aarch64
+    gcc12 # doesn't build with GCC 9 from stdenv on aarch64
   ] ++ (with rustPlatform; [
     cargoSetupHook
     rust.cargo
diff --git a/pkgs/applications/plasma-mobile/audiotube.nix b/pkgs/applications/plasma-mobile/audiotube.nix
index cb87fe0ed24d..14bfc6d18917 100644
--- a/pkgs/applications/plasma-mobile/audiotube.nix
+++ b/pkgs/applications/plasma-mobile/audiotube.nix
@@ -2,7 +2,7 @@
 , mkDerivation
 
 , extra-cmake-modules
-, gcc11
+, gcc12
 , wrapGAppsHook
 
 , gst_all_1
@@ -22,7 +22,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     extra-cmake-modules
     wrapGAppsHook
-    gcc11 # doesn't build with GCC 9 from stdenv on aarch64
+    gcc12 # doesn't build with GCC 9 from stdenv on aarch64
     python3Packages.wrapPython
     python3Packages.pybind11
   ];
diff --git a/pkgs/applications/plasma-mobile/neochat.nix b/pkgs/applications/plasma-mobile/neochat.nix
index 2f655d5a9e09..8b3da82b8b88 100644
--- a/pkgs/applications/plasma-mobile/neochat.nix
+++ b/pkgs/applications/plasma-mobile/neochat.nix
@@ -1,4 +1,4 @@
-{ gcc11Stdenv
+{ gcc12Stdenv
 , lib
 , srcs
 
@@ -31,7 +31,7 @@
 }:
 
 # Workaround for AArch64 not using GCC11 yet.
-gcc11Stdenv.mkDerivation rec {
+gcc12Stdenv.mkDerivation rec {
   pname = "neochat";
   inherit (srcs.neochat) version src;
 
diff --git a/pkgs/applications/plasma-mobile/spacebar.nix b/pkgs/applications/plasma-mobile/spacebar.nix
index 7a2a3c0af8fb..c120851e5b2e 100644
--- a/pkgs/applications/plasma-mobile/spacebar.nix
+++ b/pkgs/applications/plasma-mobile/spacebar.nix
@@ -1,6 +1,6 @@
 { lib
 , mkDerivation
-, gcc11Stdenv
+, gcc12Stdenv
 , srcs
 
 , cmake
@@ -24,8 +24,8 @@
 , qtquickcontrols2
 }:
 
-# Workaround for AArch64 not using GCC11 yet.
-gcc11Stdenv.mkDerivation rec {
+# Workaround for AArch64 still using GCC9.
+gcc12Stdenv.mkDerivation rec {
   pname = "spacebar";
   inherit (srcs.spacebar) version src;
 
diff --git a/pkgs/applications/science/biology/octopus/default.nix b/pkgs/applications/science/biology/octopus/default.nix
index 659b1e97f200..b7c8c138cb82 100644
--- a/pkgs/applications/science/biology/octopus/default.nix
+++ b/pkgs/applications/science/biology/octopus/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VaUr63v7mzhh4VBghH7a7qrqOYwl6vucmmKzTi9yAjY=";
   }) ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
   postInstall = ''
     mkdir $out/bin
     mv $out/octopus $out/bin
diff --git a/pkgs/applications/science/chemistry/octopus/default.nix b/pkgs/applications/science/chemistry/octopus/default.nix
index d0058c8650d8..cc145baef037 100644
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@@ -41,12 +41,12 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = with lib; [
-    "--with-yaml-prefix=${libyaml}"
+    "--with-yaml-prefix=${lib.getDev libyaml}"
     "--with-blas=-lblas"
     "--with-lapack=-llapack"
-    "--with-fftw-prefix=${fftw.dev}"
-    "--with-gsl-prefix=${gsl}"
-    "--with-libxc-prefix=${libxc}"
+    "--with-fftw-prefix=${lib.getDev fftw}"
+    "--with-gsl-prefix=${lib.getDev gsl}"
+    "--with-libxc-prefix=${lib.getDev libxc}"
     "--enable-openmp"
   ] ++ optional enableFma "--enable-fma3"
     ++ optional enableFma4 "--enable-fma4"
diff --git a/pkgs/applications/science/logic/cbmc/default.nix b/pkgs/applications/science/logic/cbmc/default.nix
index ba5719012ed6..d61a9893942f 100644
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@@ -60,9 +60,13 @@ stdenv.mkDerivation rec {
       --prefix PATH : "$out/share/cbmc" \
   '';
 
-  # fix "argument unused during compilation"
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
-    "-Wno-unused-command-line-argument";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    # fix "argument unused during compilation"
+    "-Wno-unused-command-line-argument"
+  ];
 
   # TODO: add jbmc support
   cmakeFlags = [ "-DWITH_JBMC=OFF" "-Dsat_impl=cadical" "-Dcadical_INCLUDE_DIR=${cadical.dev}/include" ];
diff --git a/pkgs/applications/science/math/mxnet/default.nix b/pkgs/applications/science/math/mxnet/default.nix
index dcba888ce2fb..021593124a37 100644
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@@ -54,6 +54,12 @@ stdenv.mkDerivation rec {
     ] else [ "-DUSE_CUDA=OFF" ])
     ++ lib.optional (!cudnnSupport) "-DUSE_CUDNN=OFF";
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
   postPatch = ''
     substituteInPlace 3rdparty/mkldnn/tests/CMakeLists.txt \
       --replace "/bin/bash" "${bash}/bin/bash"
diff --git a/pkgs/applications/version-management/fnc/default.nix b/pkgs/applications/version-management/fnc/default.nix
index a60aa27a8439..7fd1b34d4560 100644
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   preInstall = ''
     mkdir -p $out/bin
   '';
diff --git a/pkgs/applications/window-managers/cardboard/default.nix b/pkgs/applications/window-managers/cardboard/default.nix
index 5347b0961a54..6e483a40ef51 100644
--- a/pkgs/applications/window-managers/cardboard/default.nix
+++ b/pkgs/applications/window-managers/cardboard/default.nix
@@ -99,6 +99,8 @@ stdenv.mkDerivation rec {
      cp -r ${expected-wrap} ${expected-wrap.name}
      cp -r ${wlroots-wrap} ${wlroots-wrap.name}
     )
+
+    sed '1i#include <functional>' -i cardboard/ViewAnimation.h # gcc12
   '';
 
   # "Inherited" from Nixpkgs expression for wlroots
@@ -108,6 +110,8 @@ stdenv.mkDerivation rec {
     "-Dwlroots:libseat=disabled"
   ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ]; # gcc12
+
   meta = with lib; {
     homepage = "https://gitlab.com/cardboardwm/cardboard";
     description = "A scrollable, tiling Wayland compositor inspired on PaperWM";
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 33df804d5efe..2f3b2d8e3788 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -343,18 +343,11 @@ stdenv.mkDerivation {
     # compile, because it uses "#include_next <limits.h>" to find the
     # limits.h file in ../includes-fixed. To remedy the problem,
     # another -idirafter is necessary to add that directory again.
-    #
-    # We use --sysroot=/nix/store/does/not/exist to drop embedded default
-    # path to glibc headers gcc was built against. Without it -idirafter
-    # only appends to the list and outdated glibc headers end up being
-    # used. 'cc-cflags-before' is used to allow user's --sysroot= option
-    # to override our default.
     + optionalString (libc != null) (''
       touch "$out/nix-support/libc-cflags"
       touch "$out/nix-support/libc-ldflags"
       echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
     '' + optionalString (!(cc.langD or false)) ''
-      echo "--sysroot=/nix/store/does/not/exist" >> $out/nix-support/cc-cflags-before
       echo "-idirafter ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
     '' + optionalString (isGNU && (!(cc.langD or false))) ''
       for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
diff --git a/pkgs/build-support/libredirect/default.nix b/pkgs/build-support/libredirect/default.nix
index b5eb21e5ba4b..6e2de7fa11b0 100644
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@@ -46,14 +46,14 @@ else stdenv.mkDerivation rec {
       -L${llvmPackages_13.clang.libc}/lib \
       -Wl,-install_name,$libName \
       -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     '' else if stdenv.isDarwin then ''
     $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
       -Wl,-install_name,$out/lib/$libName \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     '' else ''
     $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
     ''}
 
     if [ -n "$doInstallCheck" ]; then
diff --git a/pkgs/build-support/libredirect/libredirect.c b/pkgs/build-support/libredirect/libredirect.c
index 1222d2ee75c6..9ecc16450cc2 100644
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@@ -201,6 +201,37 @@ WRAPPER(int, __xstat64)(int ver, const char * path, struct stat64 * st)
 WRAPPER_DEF(__xstat64)
 #endif
 
+#if defined(__linux__) && defined(STATX_TYPE)
+WRAPPER(int, statx)(int dirfd, const char * restrict pathname, int flags,
+    unsigned int mask, struct statx * restrict statxbuf)
+{
+    int (*statx_real) (int, const char * restrict, int,
+        unsigned int, struct statx * restrict) = LOOKUP_REAL(statx);
+    char buf[PATH_MAX];
+    return statx_real(dirfd, rewrite(pathname, buf), flags, mask, statxbuf);
+}
+WRAPPER_DEF(statx)
+#endif
+
+WRAPPER(int, fstatat)(int dirfd, const char * pathname, struct stat * statbuf, int flags)
+{
+    int (*fstatat_real) (int, const char *, struct stat *, int) = LOOKUP_REAL(fstatat);
+    char buf[PATH_MAX];
+    return fstatat_real(dirfd, rewrite(pathname, buf), statbuf, flags);
+}
+WRAPPER_DEF(fstatat);
+
+// In musl libc, fstatat64 is simply a macro for fstatat
+#if !defined(__APPLE__) && !defined(fstatat64)
+WRAPPER(int, fstatat64)(int dirfd, const char * pathname, struct stat64 * statbuf, int flags)
+{
+    int (*fstatat64_real) (int, const char *, struct stat64 *, int) = LOOKUP_REAL(fstatat64);
+    char buf[PATH_MAX];
+    return fstatat64_real(dirfd, rewrite(pathname, buf), statbuf, flags);
+}
+WRAPPER_DEF(fstatat64);
+#endif
+
 WRAPPER(int, stat)(const char * path, struct stat * st)
 {
     int (*__stat_real) (const char *, struct stat *) = LOOKUP_REAL(stat);
@@ -209,6 +240,17 @@ WRAPPER(int, stat)(const char * path, struct stat * st)
 }
 WRAPPER_DEF(stat)
 
+// In musl libc, stat64 is simply a macro for stat
+#if !defined(__APPLE__) && !defined(stat64)
+WRAPPER(int, stat64)(const char * path, struct stat64 * st)
+{
+    int (*stat64_real) (const char *, struct stat64 *) = LOOKUP_REAL(stat64);
+    char buf[PATH_MAX];
+    return stat64_real(rewrite(path, buf), st);
+}
+WRAPPER_DEF(stat64)
+#endif
+
 WRAPPER(int, access)(const char * path, int mode)
 {
     int (*access_real) (const char *, int mode) = LOOKUP_REAL(access);
@@ -346,6 +388,14 @@ WRAPPER(int, system)(const char *command)
 }
 WRAPPER_DEF(system)
 
+WRAPPER(int, chdir)(const char *path)
+{
+    int (*chdir_real) (const char *) = LOOKUP_REAL(chdir);
+    char buf[PATH_MAX];
+    return chdir_real(rewrite(path, buf));
+}
+WRAPPER_DEF(chdir);
+
 WRAPPER(int, mkdir)(const char *path, mode_t mode)
 {
     int (*mkdir_real) (const char *path, mode_t mode) = LOOKUP_REAL(mkdir);
diff --git a/pkgs/build-support/libredirect/test.c b/pkgs/build-support/libredirect/test.c
index 144e6d3d66dd..7dd384ae3ed7 100644
--- a/pkgs/build-support/libredirect/test.c
+++ b/pkgs/build-support/libredirect/test.c
@@ -63,6 +63,12 @@ int main(int argc, char *argv[])
     FILE *testfp;
     int testfd;
     struct stat testsb;
+#ifndef __APPLE__
+    struct stat64 testsb64;
+#endif
+#if defined(__linux__) && defined(STATX_TYPE)
+    struct statx testsbx;
+#endif
     char buf[PATH_MAX];
 
     testfp = fopen(TESTPATH, "r");
@@ -76,6 +82,20 @@ int main(int argc, char *argv[])
     assert(access(TESTPATH, X_OK) == 0);
 
     assert(stat(TESTPATH, &testsb) != -1);
+#ifndef __APPLE__
+    assert(stat64(TESTPATH, &testsb64) != -1);
+#endif
+    assert(fstatat(123, TESTPATH, &testsb, 0) != -1);
+#ifndef __APPLE__
+    assert(fstatat64(123, TESTPATH, &testsb64, 0) != -1);
+#endif
+#if defined(__linux__) && defined(STATX_TYPE)
+    assert(statx(123, TESTPATH, 0, STATX_ALL, &testsbx) != -1);
+#endif
+
+    assert(getcwd(buf, PATH_MAX) != NULL);
+    assert(chdir(TESTDIR) == 0);
+    assert(chdir(buf) == 0);
 
     assert(mkdir(TESTDIR "/dir-mkdir", 0777) == 0);
     assert(unlink(TESTDIR "/dir-mkdir") == -1); // it's a directory!
diff --git a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
index 1aa14cfeb7cc..1d43c8e162ab 100644
--- a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@@ -12,7 +12,7 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-set -- "$@" @addFlags@
+set -- @addFlags@ "$@"
 
 if (( ${#role_suffixes[@]} > 0 )); then
     # replace env var with nix-modified one
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 69ee4f56b98f..b057d1681b03 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -4,7 +4,6 @@
 , rust
 , stdenv
 , callPackage
-, cacert
 , cargoBuildHook
 , cargoCheckHook
 , cargoInstallHook
@@ -124,7 +123,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
       inherit cargo cargo-auditable;
     })
   ] ++ [
-    cacert
     cargoBuildHook
     (if useNextest then cargoNextestHook else cargoCheckHook)
     cargoInstallHook
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
index 7ca306b613bc..36ab93169741 100644
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@@ -73,6 +73,9 @@ in stdenv.mkDerivation ({
 
     ${cargoUpdateHook}
 
+    # Override the `http.cainfo` option usually specified in `.cargo/config`.
+    export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
+
     cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
 
     # Create an empty vendor directory when there is no dependency to vendor
diff --git a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
index f34353a7617b..b07b0c5ae804 100644
--- a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@@ -1,4 +1,6 @@
-postFixupHooks+=(_makeSymlinksRelative)
+# symlinks are often created in postFixup
+# don't use fixupOutputHooks, it is before postFixup
+postFixupHooks+=(_makeSymlinksRelativeInAllOutputs)
 
 # For every symlink in $output that refers to another file in $output
 # ensure that the symlink is relative. This removes references to the output
@@ -26,3 +28,10 @@ _makeSymlinksRelative() {
 
     done < <(find $prefix -type l -print0)
 }
+
+_makeSymlinksRelativeInAllOutputs() {
+  local output
+  for output in $(getAllOutputNames); do
+    prefix="${!output}" _makeSymlinksRelative
+  done
+}
diff --git a/pkgs/data/fonts/freefont-ttf/default.nix b/pkgs/data/fonts/freefont-ttf/default.nix
index 9d8c28681a9f..4bf50d338587 100644
--- a/pkgs/data/fonts/freefont-ttf/default.nix
+++ b/pkgs/data/fonts/freefont-ttf/default.nix
@@ -1,18 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "freefont-ttf";
   version = "20120503";
 
-  url = "mirror://gnu/freefont/freefont-ttf-${version}.zip";
+  src = fetchzip {
+    url = "mirror://gnu/freefont/freefont-ttf-${version}.zip";
+    hash = "sha256-K3kVHGcDTxQ7N7XqSdwRObriVkBoBYPKHbyYrYvm7VU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype
-    find $out -maxdepth 1 ! -type d -exec rm {} +
-  '';
+    mv *.ttf $out/share/fonts/truetype
 
-  sha256 = "sha256-bdMZg/mHYc0N6HiR8uNl0CjeOwBou+OYj3LPkyEUHUA=";
+    runHook postInstall
+  '';
 
   meta = {
     description = "GNU Free UCS Outline Fonts";
@@ -24,6 +28,6 @@ fetchzip rec {
     homepage = "https://www.gnu.org/software/freefont/";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
-    maintainers = [];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/data/icons/capitaine-cursors-themed/default.nix b/pkgs/data/icons/capitaine-cursors-themed/default.nix
index d86ce3f8161a..bd0147fecde3 100644
--- a/pkgs/data/icons/capitaine-cursors-themed/default.nix
+++ b/pkgs/data/icons/capitaine-cursors-themed/default.nix
@@ -1,14 +1,22 @@
-{ lib, fetchzip }:
-fetchzip rec {
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
   pname = "capitaine-cursors-themed";
   version = "5";
-  stripRoot = false;
-  url = "https://github.com/sainnhe/capitaine-cursors/releases/download/r${version}/Linux.zip";
-  sha256 = "jQNAXuR/OtvohWziGYgb5Ni2/tEIGaY9HIyUUW793EY=";
 
-  postFetch = ''
+  src = fetchzip {
+    url = "https://github.com/sainnhe/capitaine-cursors/releases/download/r${version}/Linux.zip";
+    stripRoot = false;
+    hash = "sha256-ipPpmZKU/xLA45fdOvxVbtFDCUsCYIvzeps/DjhFkNg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/icons
     cp -r ./ $out/share/icons
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/misc/cldr-annotations/default.nix b/pkgs/data/misc/cldr-annotations/default.nix
index f19b666abeab..729d3cdbb7b8 100644
--- a/pkgs/data/misc/cldr-annotations/default.nix
+++ b/pkgs/data/misc/cldr-annotations/default.nix
@@ -1,23 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "cldr-annotations";
   version = "42.0";
 
-  url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
+  src = fetchzip {
+    url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-paRon3ecGXNp3ZDnN1DU9RVU2NDWTBiKjy0OP3vcPLE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  stripRoot = false;
-  postFetch = ''
     mkdir -p $out/share/unicode/cldr/common
-    mv $out/common/annotations{,Derived} -t $out/share/unicode/cldr/common
+    mv common/annotations{,Derived} -t $out/share/unicode/cldr/common
 
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+    runHook postInstall
   '';
 
-  hash = "sha256-9OOd69nBaDSt+ilL3PTGpcQgC60PnHqd8/CYa2LgeI0=";
-
   meta = with lib; {
     description = "Names and keywords for Unicode characters from the Common Locale Data Repository";
     homepage = "https://cldr.unicode.org";
diff --git a/pkgs/data/misc/publicsuffix-list/default.nix b/pkgs/data/misc/publicsuffix-list/default.nix
index 063e120d3c4b..02b0ba0b439b 100644
--- a/pkgs/data/misc/publicsuffix-list/default.nix
+++ b/pkgs/data/misc/publicsuffix-list/default.nix
@@ -1,20 +1,24 @@
-{ lib, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-let
+stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "2021-09-03";
-in fetchFromGitHub {
-  name = "${pname}-${version}";
-  owner = "publicsuffix";
-  repo = "list";
-  rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
-  sha256 = "sha256-Q8uIXM1CMu8dlWcVoL17M1XRGu3kG7Y7jpx0oHQh+2I=";
+  version = "unstable-2021-09-03";
 
-  postFetch = ''
-    install -Dm0444 $out/public_suffix_list.dat $out/tests/test_psl.txt -t $out/share/publicsuffix
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  src = fetchFromGitHub {
+    owner = "publicsuffix";
+    repo = "list";
+    rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
+    hash = "sha256-moibTN9KovABcg+ubKUgMXg4b8sMrTVo6Itmiati/Vk=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm0444 public_suffix_list.dat tests/test_psl.txt -t $out/share/publicsuffix
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/misc/unicode-emoji/default.nix b/pkgs/data/misc/unicode-emoji/default.nix
index bf27cb03e285..ae14a27c8b7f 100644
--- a/pkgs/data/misc/unicode-emoji/default.nix
+++ b/pkgs/data/misc/unicode-emoji/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenvNoCC
 , fetchurl
 , symlinkJoin
 }:
@@ -6,30 +7,40 @@
 let
   version = "15.0";
 
-  fetchData = { file, sha256 }: fetchurl {
-    url = "https://www.unicode.org/Public/emoji/${version}/${file}";
-    inherit sha256;
-    downloadToTemp = true;
-    recursiveHash = true;
-    postFetch = ''
+  fetchData = { suffix, hash }: stdenvNoCC.mkDerivation {
+    pname = "unicode-emoji-${suffix}";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://www.unicode.org/Public/emoji/${version}/emoji-${suffix}.txt";
+      inherit hash;
+    };
+
+    dontUnpack = true;
+
+    installPhase = ''
+      runHook preInstall
+
       installDir="$out/share/unicode/emoji"
       mkdir -p "$installDir"
-      mv "$downloadedFile" "$installDir/${file}"
+      cp "$src" "$installDir/emoji-${suffix}.txt"
+
+      runHook postInstall
     '';
   };
 
   srcs = {
     emoji-sequences = fetchData {
-      file = "emoji-sequences.txt";
-      sha256 = "sha256-vRpXHAcdY3arTnFwBH3WUW3DOh8B3L9+sRcecLHZ2lg=";
+      suffix = "sequences";
+      hash = "sha256-XCIi2KQy2JagMaaML1SwT79HsPzi5phT8euKPpRetW0=";
     };
     emoji-test = fetchData {
-      file = "emoji-test.txt";
-      sha256 = "sha256-3Rega6+ZJ5jXRhLFL/i/12V5IypEo5FaGG6Wf9Bj0UU=";
+      suffix = "test";
+      hash = "sha256-hEXyOsg4jglr4Z0CYuFPzv+Fb/Ugk/I1bciUhfGoU9s=";
     };
     emoji-zwj-sequences = fetchData {
-      file = "emoji-zwj-sequences.txt";
-      sha256 = "sha256-9AqrpyUCiBcR/fafa4VaH0pT5o1YzEZDVySsX4ja1u8=";
+      suffix = "zwj-sequences";
+      hash = "sha256-/jV/kRe3dGZ2Bjdl1YcTft+bJZA6eSvVSTW/CFZ5EYI=";
     };
   };
 in
diff --git a/pkgs/desktops/gnome/apps/seahorse/default.nix b/pkgs/desktops/gnome/apps/seahorse/default.nix
index 60de418f1e44..bbab612b9c8d 100644
--- a/pkgs/desktops/gnome/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome/apps/seahorse/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch
 , fetchurl
 , vala
 , meson
@@ -36,6 +37,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-Wx0b+6dPNlgifzyC4pbzMN0PzR70Y2tqIYIo/uXqgy0=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "gpg-2.4.patch";
+      url = "https://gitlab.gnome.org/GNOME/seahorse/-/commit/9260c74779be3d7a378db0671af862ffa3573d42.patch";
+      hash = "sha256-4QiFgH4jC1ucmA9fFozUQZ3Mat76SgpYkMpRz80RH64=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/desktops/rox/rox-filer/default.nix b/pkgs/desktops/rox/rox-filer/default.nix
index e26c90592252..b05be287a89d 100644
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
   buildInputs = [ libxml2 gtk shared-mime-info libSM ];
-  NIX_LDFLAGS = "-ldl -lm";
+  NIX_LDFLAGS = "-lm";
 
   patches = [
     ./rox-filer-2.11-in-source-build.patch
diff --git a/pkgs/development/compilers/dmd/generic.nix b/pkgs/development/compilers/dmd/generic.nix
index c1fb9abf77d7..3f8871df4f96 100644
--- a/pkgs/development/compilers/dmd/generic.nix
+++ b/pkgs/development/compilers/dmd/generic.nix
@@ -151,13 +151,6 @@ stdenv.mkDerivation rec {
     git
   ];
 
-  # Workaround cc-wrapper's --sysroot= value for `staging-next`: it
-  # breaks library lookup via RUNPATH:
-  #   ld: warning: libm.so.6, needed by ./generated/linux/release/64/lib.so, not found (try using -rpath or -rpath-link)
-  #   ld: /build/druntime/generated/linux/release/64/libdruntime.so: undefined reference to `log10@GLIBC_2.2.5'
-  # TODO(trofi): remove the workaround once cc-wrapper is fixed.
-  NIX_CFLAGS_COMPILE = [ "--sysroot=/" ];
-
   buildInputs = [
     curl
     tzdata
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 97ed0ee9b058..abe6d92cd0a6 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -222,7 +222,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
     ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
@@ -235,7 +235,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index f29da83bb570..1c6b7326c074 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -82,7 +82,10 @@ let majorVersion = "11";
       ++ optional (stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      # openjdk build fails without this on -march=opteron; is upstream in gcc12
+      ++ [ ./gcc-issue-103910.patch ];
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@@ -228,7 +231,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
     ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
@@ -241,7 +244,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch b/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch
new file mode 100644
index 000000000000..c3edd960f097
--- /dev/null
+++ b/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch
@@ -0,0 +1,41 @@
+From d243f4009d8071b734df16cd70f4c5d09a373769 Mon Sep 17 00:00:00 2001
+From: Andrew Pinski <apinski@marvell.com>
+Date: Wed, 5 Jan 2022 22:00:07 +0000
+Subject: [PATCH] Fix target/103910: missing GTY on x86_mfence causing PCH
+ usage to ICE
+
+With -O3 -march=opteron, a mfence builtin is added after the loop
+to say the nontemporal stores are no longer needed. This all good
+without precompiled headers as the function decl that is referneced
+by x86_mfence is referenced in another variable but with precompiled
+headers, x86_mfence is all messed up and the decl was GC'ed away.
+This fixes the problem by marking x86_mfence as GTY to save/restore
+during precompiled headers just like most other variables in
+the header file.
+
+Committed as obvious after a bootstrap/test on x86_64-linux-gnu.
+
+gcc/ChangeLog:
+
+	PR target/103910
+	* config/i386/i386.h (x86_mfence): Mark with GTY.
+---
+ gcc/config/i386/i386.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gcc/config/i386/i386.h b/gcc/config/i386/i386.h
+index f027608eefa..3ac0f698ae2 100644
+--- a/gcc/config/i386/i386.h
++++ b/gcc/config/i386/i386.h
+@@ -486,7 +486,7 @@ extern unsigned char ix86_prefetch_sse;
+ 
+ /* Fence to use after loop using storent.  */
+ 
+-extern tree x86_mfence;
++extern GTY(()) tree x86_mfence;
+ #define FENCE_FOLLOWING_MOVNT x86_mfence
+ 
+ /* Once GDB has been enhanced to deal with functions without frame
+-- 
+2.31.1
+
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 3a8af389469b..f0bdafd8c208 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -261,7 +261,7 @@ stdenv.mkDerivation ({
 
   inherit (callFile ../common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
 
   preConfigure = (callFile ../common/pre-configure.nix { }) + ''
@@ -275,7 +275,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index cee54a092178..7e6d4eb12239 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -246,7 +246,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index e1ae025cd272..4ea63d7c12e1 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -266,7 +266,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index c3410a72fc7d..039293dd86e4 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -276,7 +276,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -287,7 +287,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 4d8d1f51ff67..a02d1b6d2795 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -226,7 +226,7 @@ stdenv.mkDerivation ({
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
   NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -240,7 +240,6 @@ stdenv.mkDerivation ({
   ;
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index e19d0888f00b..b7e70f39471e 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -207,7 +207,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -218,7 +218,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index ae26908a10aa..484c89c0e902 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -221,7 +221,7 @@ stdenv.mkDerivation ({
   inherit (callFile ../common/dependencies.nix { })
     depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";
 
   preConfigure = callFile ../common/pre-configure.nix { };
 
@@ -232,7 +232,6 @@ stdenv.mkDerivation ({
   configureFlags = callFile ../common/configure-flags.nix { };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index dd5a8de76e2a..2d7a058fa015 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -203,17 +203,6 @@ preInstall() {
         ln -s lib "$out/${targetConfig}/lib32"
         ln -s lib "${!outputLib}/${targetConfig}/lib32"
     fi
-
-    # cc-wrappers uses --sysroot=/nix/store/does/not/exist as a way to
-    # drop default sysheaders search path. Unfortunately that switches
-    # clang++ into searching libraries in gcc in cross-compiler paths:
-    #   from ${!outputLib}/lib (native)
-    #   to ${!outputLib}/${targetPlatformConfig}/lib
-    # We create the symlink to make both native and cross paths
-    # available even if the toolchain is not the cross-compiler.
-    if [ ! -e ${!outputLib}/${targetPlatformConfig} ] ; then
-        ln -s . ${!outputLib}/${targetPlatformConfig}
-    fi
 }
 
 
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 3c089f02920a..b19fe44c1317 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , substituteAll
@@ -87,6 +88,12 @@ stdenv.mkDerivation rec {
     })
     ./remove-tools-1.11.patch
     ./go_no_vendor_checks-1.16.patch
+
+    # runtime: support riscv64 SV57 mode
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
+      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
+    })
   ];
 
   GOOS = stdenv.targetPlatform.parsed.kernel.name;
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 84a6059581e7..13cf14c77fa5 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , substituteAll
@@ -87,6 +88,12 @@ stdenv.mkDerivation rec {
     })
     ./remove-tools-1.11.patch
     ./go_no_vendor_checks-1.16.patch
+
+    # runtime: support riscv64 SV57 mode
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
+      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
+    })
   ];
 
   GOOS = stdenv.targetPlatform.parsed.kernel.name;
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 95eba5d7fb36..41c20ac47ebf 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -191,7 +192,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 2123efdf2351..93cf2757c652 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -203,7 +204,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index b04eeb3c7269..3d5592e19ee5 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -191,7 +192,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 32e96212fa57..e2d6da816f32 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -153,7 +154,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 5437735f78fe..d8010ecf893d 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -165,7 +166,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
index e0b79a9acfef..de98c4361531 100644
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -9,6 +9,7 @@
 , python3
 , python3Packages
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -327,7 +328,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index a4d04f0618c7..31b88098c83a 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libxml2
 , ncurses
@@ -168,10 +169,9 @@ stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ]
-  ++ lib.optional (!isDarwin)
+  ] ++ lib.optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ++ lib.optionals (isDarwin) [
+  ] ++ lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index d18bf2149e1d..954887cd2368 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -4,6 +4,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libxml2
 , ncurses
@@ -162,7 +163,7 @@ stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index da72bb8b35ae..eaeef3c2ef50 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -180,7 +181,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 5c381a896e15..aa76fc0c3cf7 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -173,7 +174,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index f8b6a8170f85..89bc014f5c65 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
@@ -188,7 +189,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index b4e2757f20ca..9a0d375df9c3 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , python3
 , libffi
+, enableGoldPlugin ? (!stdenv.isDarwin && !stdenv.targetPlatform.isWasi)
 , libbfd
 , libpfm
 , libxml2
@@ -151,7 +152,7 @@ in stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (!isDarwin) [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/mit-scheme/default.nix b/pkgs/development/compilers/mit-scheme/default.nix
index 5a96242da7b1..da668b51e278 100644
--- a/pkgs/development/compilers/mit-scheme/default.nix
+++ b/pkgs/development/compilers/mit-scheme/default.nix
@@ -49,6 +49,12 @@ stdenv.mkDerivation {
     runHook postConfigure
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-parameter"
+    "-Wno-error=use-after-free"
+  ];
+
   buildPhase = ''
     runHook preBuild
     cd src
diff --git a/pkgs/development/compilers/rust/1_66.nix b/pkgs/development/compilers/rust/1_66.nix
deleted file mode 100644
index 6aee98bdba06..000000000000
--- a/pkgs/development/compilers/rust/1_66.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_14, llvm_14
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.66.1";
-  rustcSha256 = "sha256-WzyTOpTHIYdwXU7ikxmLq/3QlEL1k3+9aF2zqB9JWbo=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_14.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_14;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.65.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "b29869f8e2c7029150a929b2c4e26843f363846ad99253a25be6abcfa8e84f46";
-    x86_64-unknown-linux-gnu = "8f754fdd5af783fe9020978c64e414cb45f3ad0a6f44d045219bbf2210ca3cb9";
-    x86_64-unknown-linux-musl = "716984def5509a844c2dde1c7be42bfadeb179f751d5c1a30c9c7198c8c089cd";
-    arm-unknown-linux-gnueabihf = "e27f835c16bfcb66ad022a17d5c4602899e021e483a432ca4cc2cb4ecd39e938";
-    armv7-unknown-linux-gnueabihf = "5376d467a29b32cacb771e0c76dc280bd623852709e7ffd92caabab076d5475f";
-    aarch64-unknown-linux-gnu = "f406136010e6a1cdce3fb6573506f00d23858af49dd20a46723c3fa5257b7796";
-    aarch64-unknown-linux-musl = "4b701dc3cbac04ebf0e336cff2f4ce5fc1a1984c183226863c9ed911eb00b07e";
-    x86_64-apple-darwin = "139087a3937799415fd829e5a88162a69a32c23725a44457f9c96b98e4d64a7c";
-    aarch64-apple-darwin = "7ddc335bd10fc32d3039ef36248a5d0c4865db2437c8aad20a2428a6cf41df09";
-    powerpc64le-unknown-linux-gnu = "3f1d0d5bb13213348dc65e373f8c412fc0a12ee55abc1c864f7e0300932fc687";
-    riscv64gc-unknown-linux-gnu = "aac7067348d218faa452b4bdc735778a51570a310ad645313ec767b5d7c88492";
-    mips64el-unknown-linux-gnuabi64 = "d91ed3857c5256720da890f6533684b684e880bf9006dc4e4f4181213a5c4a09";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_66;
-
-  rustcPatches = [
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_14" "llvm_14"])
diff --git a/pkgs/development/compilers/rust/1_67.nix b/pkgs/development/compilers/rust/1_67.nix
new file mode 100644
index 000000000000..a0a43f31386d
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_67.nix
@@ -0,0 +1,81 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_15, llvm_15
+, fetchpatch
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.67.0";
+  rustcSha256 = "sha256-0CnxT85Foux6mmBdKgpAquRznLL9rinun3pukCWn/eQ=";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_15.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackages = llvmPackages_15;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.66.1";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "823128f64e902ee8aff61488c552c983e17ccca10c3f46dd93fde924d5100eb3";
+    x86_64-unknown-linux-gnu = "7ecf79e9ea23d05917b0172f9f81fb1e47011d261a719998f8d5620a1e835023";
+    x86_64-unknown-linux-musl = "70b660148238b8a137c6f165b0bc7bdcb50204c22a314bed6174ecd672f02e57";
+    arm-unknown-linux-gnueabihf = "12c93efe71f3334ef6e718786f6a60b9566f097d23a7f1e8f38ed9add209126f";
+    armv7-unknown-linux-gnueabihf = "f43c8cd3fd7d1c1e08bd6317220b2ec9b25891f464604f80bb17985b09bbf62a";
+    aarch64-unknown-linux-gnu = "84b8a79803c1b91386460fe6a7d04c54002344452ff8e5c5631d5fa275ed0c9c";
+    aarch64-unknown-linux-musl = "b2665da33efd328cff192a67ad026ea84f9deab8d1971892f4bbc22647606163";
+    x86_64-apple-darwin = "0fcf341db2579aa6eb61a3430cd1dbc79b042dfe89686b93cc887d818d086c30";
+    aarch64-apple-darwin = "03469fcaa0d8c505e6db03c18ded73cfbb6a2ce159292f8cf06c042bfc9f7cf9";
+    powerpc64le-unknown-linux-gnu = "ccf915a0137bb83a9d9b133a234ae53cc099f2ba26e3cb09d209b47bbee2ade7";
+    riscv64gc-unknown-linux-gnu = "525cb05edaf3ed0560753b413c72dd1b06492df28bf3c427a66fda683fdca3fc";
+    mips64el-unknown-linux-gnuabi64 = "3c241cc80410fe389e8b04beda62c42496c225fe8776db9d55a498c53244f7a6";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_67;
+
+  rustcPatches = [
+    # fix thin archive reading
+    # https://github.com/rust-lang/rust/pull/107360
+    (fetchpatch {
+      name = "revert-back-to-llvmarchivebuilder-on-all-platforms.patch";
+      url = "https://github.com/rust-lang/rust/commit/de363d54c40a378717881240e719f5f7223ba376.patch";
+      hash = "sha256-3Xb803LZUZ1dldxGJ65Iw6gg1V1K827OB/0b32GqilU=";
+    })
+
+    # Fixes ICE.
+    # https://github.com/rust-lang/rust/pull/107688
+    (fetchpatch {
+      name = "re-erased-regions-are-local.patch";
+      url = "https://github.com/rust-lang/rust/commit/9d110847ab7f6aef56a8cd20cb6cea4fbcc51cd9.patch";
+      excludes = [ "*tests/*" ];
+      hash = "sha256-EZH5K1BEOOfi97xZr1xEHFP4jjvJ1+xqtRMvxBoL8pU=";
+    })
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_15" "llvm_15"])
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index d04eebe7eadf..481b4195891c 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
-, installShellFiles, makeWrapper, cacert, rustPlatform, rustc
+, installShellFiles, makeWrapper, rustPlatform, rustc
 , CoreFoundation, Security
 , auditable ? false # TODO: change to true when this is the default
 }:
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage {
     (lib.getDev pkgsHostHost.curl)
     zlib
   ];
-  buildInputs = [ cacert file curl python3 openssl zlib ]
+  buildInputs = [ file curl python3 openssl zlib ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
 
   # cargo uses git-rs which is made for a version of libgit2 from recent master that
@@ -39,14 +39,7 @@ rustPlatform.buildRustPackage {
   RUSTC_BOOTSTRAP = 1;
 
   postInstall = ''
-    # NOTE: We override the `http.cainfo` option usually specified in
-    # `.cargo/config`. This is an issue when users want to specify
-    # their own certificate chain as environment variables take
-    # precedence
-    wrapProgram "$out/bin/cargo" \
-      --suffix PATH : "${rustc}/bin" \
-      --set CARGO_HTTP_CAINFO "${cacert}/etc/ssl/certs/ca-bundle.crt" \
-      --set SSL_CERT_FILE "${cacert}/etc/ssl/certs/ca-bundle.crt"
+    wrapProgram "$out/bin/cargo" --suffix PATH : "${rustc}/bin"
 
     installManPage src/tools/cargo/src/etc/man/*
 
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 426f13778838..60f07a64299a 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -165,7 +165,6 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openssl ]
-    # TODO: remove libiconv once 1.66 is used to bootstrap
     ++ optionals stdenv.isDarwin [ libiconv Security ]
     ++ optional (!withBundledLLVM) llvmShared;
 
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index 159b1827fc8f..ed1d7fc57a64 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
         "-L${variables.libdir}"
         "-Wl,--rpath ${variables.libdir}"
         "-ltcc"
-        "-ldl"
       ];
       variables = rec {
         prefix = "${placeholder "out"}";
diff --git a/pkgs/development/compilers/urweb/default.nix b/pkgs/development/compilers/urweb/default.nix
index 67ebaa04699e..a881b2f1badb 100644
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@@ -33,6 +33,11 @@ stdenv.mkDerivation rec {
                    -L${sqlite.out}/lib";
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=use-after-free"
+  ];
+
   # Be sure to keep the statically linked libraries
   dontDisableStatic = true;
 
diff --git a/pkgs/development/interpreters/gnu-apl/default.nix b/pkgs/development/interpreters/gnu-apl/default.nix
index 3bcada9aa8f0..e413914aa39c 100644
--- a/pkgs/development/interpreters/gnu-apl/default.nix
+++ b/pkgs/development/interpreters/gnu-apl/default.nix
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
     "-Wno-error=maybe-uninitialized"
     # Needed with GCC 11
     "-Wno-error=misleading-indentation"
+    # Needed with GCC 12
+    "-Wno-error=nonnull"
+    "-Wno-error=stringop-overflow"
+    "-Wno-error=use-after-free"
    ]) ++ optional stdenv.cc.isClang "-Wno-error=null-dereference");
 
   patchPhase = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 57d1e6d84fe1..4461bd08365e 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -273,13 +273,13 @@ in {
   mkRuby = generic;
 
   ruby_2_7 = generic {
-    version = rubyVersion "2" "7" "6" "";
-    sha256 = "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877";
+    version = rubyVersion "2" "7" "7" "";
+    sha256 = "sha256-4QEn22kdf/NkAs/oj0GMjQJaPx7qkgRLFi3XLwuMe5A=";
   };
 
   ruby_3_0 = generic {
-    version = rubyVersion "3" "0" "4" "";
-    sha256 = "0avj4g3s2839b2y4m6pk8kid74r8nj7k0qm2rsdcwjzhg8h7rd3h";
+    version = rubyVersion "3" "0" "5" "";
+    sha256 = "sha256-mvxjgKAnpP4a4aPi7MtrSXucWsBjHBLKVvm3vrSEh3Y=";
   };
 
   ruby_3_1 = generic {
diff --git a/pkgs/development/interpreters/ruby/patchsets.nix b/pkgs/development/interpreters/ruby/patchsets.nix
index bdc4cf3690fe..2bf5bc7296c6 100644
--- a/pkgs/development/interpreters/ruby/patchsets.nix
+++ b/pkgs/development/interpreters/ruby/patchsets.nix
@@ -1,17 +1,15 @@
 { patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:
 
 {
-  "2.7.6" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-with-openssl-dir-option.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-fix-broken-tests-caused-by-ad.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-more-detailed-stacktrace.patch"
-    "${patchSet}/patches/ruby/2.7/head/railsexpress/05-malloc-trim.patch"
+  "2.7.7" = ops useRailsExpress [
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/02-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/03-more-detailed-stacktrace.patch"
+    "${patchSet}/patches/ruby/2.7/head/railsexpress/04-malloc-trim.patch"
   ];
-  "3.0.4" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-fix-with-openssl-dir-option.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/3.0/head/railsexpress/03-malloc-trim.patch"
+  "3.0.5" = ops useRailsExpress [
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/01-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/3.0/head/railsexpress/02-malloc-trim.patch"
   ];
   "3.1.2" = ops useRailsExpress [
     "${patchSet}/patches/ruby/3.1/head/railsexpress/01-improve-gc-stats.patch"
diff --git a/pkgs/development/interpreters/ruby/rvm-patchsets.nix b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
index 51c0a9a7dfb3..fbbfd4c97302 100644
--- a/pkgs/development/interpreters/ruby/rvm-patchsets.nix
+++ b/pkgs/development/interpreters/ruby/rvm-patchsets.nix
@@ -3,6 +3,6 @@
 fetchFromGitHub {
   owner  = "skaes";
   repo   = "rvm-patchsets";
-  rev    = "a6429bb1a7fb9b5798c22f43338739a6c192b42d";
-  sha256 = "sha256-NpSa+uGQA1rfHNcLzPNTK65J+Wk9ZlzhHFePDA4uuo0=";
+  rev    = "e6574c54a34fe6e4d45aa1433872a22ddfe14cf3";
+  hash   = "sha256-x2KvhgRVJ4Nc5v1j4DggKO1u3otG8HVMxhq4yuUKnds=";
 }
diff --git a/pkgs/development/interpreters/tcl/tcl-package-hook.sh b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
index 41603037931f..8548ac66402f 100644
--- a/pkgs/development/interpreters/tcl/tcl-package-hook.sh
+++ b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
@@ -41,6 +41,8 @@ findInstalledTclPkgs() {
 
 # Wrap any freshly-installed binaries and set up their TCLLIBPATH
 wrapTclBins() {
+    if [ "$dontWrapTclBinaries" ]; then return; fi
+
     if [[ -z "${TCLLIBPATH-}" ]]; then
         echo "skipping automatic Tcl binary wrapping (nothing to do)"
         return
diff --git a/pkgs/development/libraries/assimp/default.nix b/pkgs/development/libraries/assimp/default.nix
index 81d9e54de435..ed0476fea642 100644
--- a/pkgs/development/libraries/assimp/default.nix
+++ b/pkgs/development/libraries/assimp/default.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DASSIMP_BUILD_ASSIMP_TOOLS=ON" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   meta = with lib; {
     description = "A library to import various 3D model formats";
     homepage = "https://www.assimp.org/";
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 152572c6b16a..a76068548122 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -29,11 +29,14 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  NIX_CFLAGS_COMPILE = [
     "-Wno-error=cast-function-type"
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-overflow"
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs and probably clang
+    "-Wno-error=use-after-free"
   ];
 
   propagatedBuildInputs = [ libantlr3c mbedtls_2 bctoolbox belr ];
diff --git a/pkgs/development/libraries/boringssl/default.nix b/pkgs/development/libraries/boringssl/default.nix
index 61c2a27f3d85..955157d055a2 100644
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@@ -30,6 +30,11 @@ buildGoModule {
     export GOARCH=$(go env GOHOSTARCH)
   '';
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-Wno-error=stringop-overflow"
+  ];
+
   buildPhase = ''
     ninjaBuildPhase
   '';
diff --git a/pkgs/development/libraries/bzrtp/default.nix b/pkgs/development/libraries/bzrtp/default.nix
index 4bccc0c5cf2f..5791924ad14a 100644
--- a/pkgs/development/libraries/bzrtp/default.nix
+++ b/pkgs/development/libraries/bzrtp/default.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" "-DCMAKE_C_FLAGS=-Wno-error=cast-function-type" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   meta = with lib; {
     description = "An opensource implementation of ZRTP keys exchange protocol. Part of the Linphone project.";
     homepage = "https://gitlab.linphone.org/BC/public/bzrtp";
diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 861e9179e094..d928b814e826 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -30,11 +30,14 @@ stdenv.mkDerivation rec {
     "-DLUCENE_STATIC_CONSTANT_SYNTAX_EXITCODE__TRYRUN_OUTPUT="
   ];
 
-  patches = # From debian
-    [ ./Fix-pkgconfig-file-by-adding-clucene-shared-library.patch
-      ./Fixing_ZLIB_configuration_in_shared_CMakeLists.patch
-      ./Install-contribs-lib.patch
-    ] ++ lib.optionals stdenv.isDarwin [ ./fix-darwin.patch ];
+  patches = [
+    # From debian
+    ./Fix-pkgconfig-file-by-adding-clucene-shared-library.patch
+    ./Fixing_ZLIB_configuration_in_shared_CMakeLists.patch
+    ./Install-contribs-lib.patch
+    # From arch
+    ./fix-missing-include-time.patch
+  ] ++ lib.optionals stdenv.isDarwin [ ./fix-darwin.patch ];
 
   # fails with "Unable to find executable:
   # /build/clucene-core-2.3.3.4/build/bin/cl_test"
diff --git a/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch b/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch
new file mode 100644
index 000000000000..0ac26f76929a
--- /dev/null
+++ b/pkgs/development/libraries/clucene-core/fix-missing-include-time.patch
@@ -0,0 +1,49 @@
+From c1c2000c35ff39b09cb70fbdf66a107d3b17a674 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 12 Oct 2022 08:40:49 +0200
+Subject: [PATCH] Fix missing #include <time.h>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+At least on recent Fedora 37 beta, building now failed with
+
+> CLucene/document/DateTools.cpp:26:19: error: ‘gmtime’ was not declared in this scope
+>    26 |         tm *ptm = gmtime(&secs);
+>       |                   ^~~~~~
+
+etc.
+
+As it turns out, after 22f9d40320e3deeaa8d6aaa7a770077c20a21dae "git-svn-id:
+https://clucene.svn.sourceforge.net/svnroot/clucene/branches/lucene2_3_2@2672
+20ef185c-fe11-0410-a618-ba9304b01011" on 2008-06-26 had commented out
+_CL_TIME_WITH_SYS_TIME in clucene-config.h.cmake as "not actually used for
+anything", then cceccfb52917b5f4da447f1cf20c135952d41442 "Presenting DateTools
+and deprecating DateField. DateTools still requires some testing and its own
+unit testing" on 2008-06-29 had introduced this use of it (into then
+src/CLucene/document/DateTools.H).  And apparently most build environments have
+silently been happy ever since when the dead leading check for
+_CL_TIME_WITH_SYS_TIME didn't include both <sys/time.h> and <time.h>, but the
+following check for _CL_HAVE_SYS_TIME_H only included <sys/time.h> but not
+<time.h>.
+---
+ src/shared/CLucene/clucene-config.h.cmake | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/shared/CLucene/clucene-config.h.cmake b/src/shared/CLucene/clucene-config.h.cmake
+index bd8683a5..6fe0f92b 100644
+--- a/src/shared/CLucene/clucene-config.h.cmake
++++ b/src/shared/CLucene/clucene-config.h.cmake
+@@ -100,8 +100,7 @@ ${SYMBOL__T}
+ //#cmakedefine _CL_STAT_MACROS_BROKEN
+ 
+ /* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
+-//not actually used for anything...
+-//#cmakedefine _CL_TIME_WITH_SYS_TIME  1 
++#cmakedefine _CL_TIME_WITH_SYS_TIME  1 
+ 
+ /* Define that we will be using -fvisibility=hidden, and 
+  * make public classes visible using __attribute__ ((visibility("default")))
+-- 
+2.37.3
+
diff --git a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
index 44fcbe5463cb..38acb5def4a3 100644
--- a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
+++ b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation {
 
   NIX_CFLAGS_COMPILE = [
     "-Wno-error=range-loop-construct"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/dbus-cplusplus/default.nix b/pkgs/development/libraries/dbus-cplusplus/default.nix
index 005f1ac0302c..1e38ddf44e19 100644
--- a/pkgs/development/libraries/dbus-cplusplus/default.nix
+++ b/pkgs/development/libraries/dbus-cplusplus/default.nix
@@ -29,6 +29,12 @@ stdenv.mkDerivation rec {
           + "dbus-c++-threading.patch?id=7f371172f5c";
       sha256 = "1h362anx3wyxm5lq0v8girmip1jmkdbijrmbrq7k5pp47zkhwwrq";
     })
+    (fetchurl {
+      name = "template-operators.patch"; # since gcc12
+      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
+          + "dbus-c++-template-operators.patch?id=d3f0d8bb519c0af";
+      sha256 = "N25Y7jXDbr0qb7MfRr2yz3zRySppgGOe+oCfNQhRvVc=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
deleted file mode 100644
index a8acf7a7ce61..000000000000
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ /dev/null
@@ -1,511 +0,0 @@
-{ lib, stdenv, buildPackages, ffmpeg, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
-/*
- *  Licensing options (yes some are listed twice, filters and such are not listed)
- */
-, gplLicensing ? true # GPL: fdkaac,openssl,frei0r,cdio,samba,utvideo,vidstab,x265,x265,xavs,avid,zvbi,x11grab
-, version3Licensing ? true # (L)GPL3: libvmaf,opencore-amrnb,opencore-amrwb,samba,vo-aacenc,vo-amrwbenc
-, nonfreeLicensing ? false # NONFREE: openssl,fdkaac,blackmagic-design-desktop-video
-/*
- *  Build options
- */
-, smallBuild ? false # Optimize for size instead of speed
-, runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime (disable to compile natively)
-, grayBuild ? true # Full grayscale support
-, swscaleAlphaBuild ? true # Alpha channel support in swscale
-, hardcodedTablesBuild ? true # Hardcode decode tables instead of runtime generation
-, safeBitstreamReaderBuild ? true # Buffer boundary checking in bitreaders
-, multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, networkBuild ? true # Network support
-, pixelutilsBuild ? true # Pixel utils in libavutil
-, enableLto ? false # build with link-time optimization
-/*
- *  Program options
- */
-, ffmpegProgram ? true # Build ffmpeg executable
-, ffplayProgram ? true # Build ffplay executable
-, ffprobeProgram ? true # Build ffprobe executable
-, qtFaststartProgram ? true # Build qt-faststart executable
-/*
- *  Library options
- */
-, avcodecLibrary ? true # Build avcodec library
-, avdeviceLibrary ? true # Build avdevice library
-, avfilterLibrary ? true # Build avfilter library
-, avformatLibrary ? true # Build avformat library
-, avutilLibrary ? true # Build avutil library
-, postprocLibrary ? true # Build postproc library
-, swresampleLibrary ? true # Build swresample library
-, swscaleLibrary ? true # Build swscale library
-/*
- *  Documentation options
- */
-, htmlpagesDocumentation ? false # HTML documentation pages
-, manpagesDocumentation ? true # Man documentation pages
-, podpagesDocumentation ? false # POD documentation pages
-, txtpagesDocumentation ? false # Text documentation pages
-/*
- *  External libraries options
- */
-, alsa-lib ? null # Alsa in/output support
-#, avisynth ? null # Support for reading AviSynth scripts
-, bzip2 ? null
-, clang ? null
-, celt ? null # CELT decoder
-#, crystalhd ? null # Broadcom CrystalHD hardware acceleration
-, cuda ? !stdenv.isDarwin && !stdenv.isAarch64 # Dynamically linked CUDA
-, cuda-llvm ? !stdenv.isDarwin && !stdenv.isAarch64 # LLVM-based CUDA compilation
-, dav1d ? null # AV1 decoder (focused on speed and correctness)
-#, decklinkExtlib ? false, blackmagic-design-desktop-video ? null # Blackmagic Design DeckLink I/O support
-, fdkaacExtlib ? false, fdk_aac ? null # Fraunhofer FDK AAC de/encoder
-#, flite ? null # Flite (voice synthesis) support
-, fontconfig ? null # Needed for drawtext filter
-, freetype ? null # Needed for drawtext filter
-, frei0r ? null # frei0r video filtering
-, fribidi ? null # Needed for drawtext filter
-, game-music-emu ? null # Game Music Emulator
-, gnutls ? null
-, gsm ? null # GSM de/encoder
-#, ilbc ? null # iLBC de/encoder
-, libjack2 ? null # Jack audio (only version 2 is supported in this build)
-, ladspaH ? null # LADSPA audio filtering
-, lame ? null # LAME MP3 encoder
-, libass ? null # (Advanced) SubStation Alpha subtitle rendering
-, libaom ? null # AV1 encoder
-, libbluray ? null # BluRay reading
-, libbs2b ? null # bs2b DSP library
-, libcaca ? null # Textual display (ASCII art)
-#, libcdio-paranoia ? null # Audio CD grabbing
-, libdc1394 ? null, libraw1394 ? null # IIDC-1394 grabbing (ieee 1394)
-, libdrm ? null # libdrm support
-, libiconv ? null
-#, libiec61883 ? null, libavc1394 ? null # iec61883 (also uses libraw1394)
-, libmfx ? null # Hardware acceleration vis libmfx
-, libmodplug ? null # ModPlug support
-, libmysofa ? null # HRTF support via SOFAlizer
-#, libnut ? null # NUT (de)muxer, native (de)muser exists
-, libogg ? null # Ogg container used by vorbis & theora
-, libopenmpt ? null # Tracked music files decoder
-, libopus ? null # Opus de/encoder
-, librsvg ? null # SVG protocol
-, libssh ? null # SFTP protocol
-, libtheora ? null # Theora encoder
-, libv4l ? null # Video 4 Linux support
-, libva ? null # Vaapi hardware acceleration
-, libvdpau ? null # Vdpau hardware acceleration
-, libvmaf ? null # Netflix's VMAF (Video Multi-Method Assessment Fusion)
-, libvorbis ? null # Vorbis de/encoding, native encoder exists
-, libvpx ? null # VP8 & VP9 de/encoding
-, libwebp ? null # WebP encoder
-, libX11 ? null # Xlib support
-, libxcb ? null # X11 grabbing using XCB
-, libxcbshmExtlib ? true # X11 grabbing shm communication
-, libxcbxfixesExtlib ? true # X11 grabbing mouse rendering
-, libxcbshapeExtlib ? true # X11 grabbing shape rendering
-, libXv ? null # Xlib support
-, libXext ? null # Xlib support
-, libxml2 ? null # libxml2 support, for IMF and DASH demuxers
-, xz ? null # xz-utils
-, nv-codec-headers ? null
-, nvdec ? !stdenv.isDarwin && !stdenv.isAarch64 # NVIDIA NVDEC support
-, nvenc ? !stdenv.isDarwin && !stdenv.isAarch64 # NVIDIA NVENC support
-, openal ? null # OpenAL 1.1 capture support
-, ocl-icd ? null # OpenCL ICD
-, opencl-headers ? null # OpenCL headers
-, opencore-amr ? null # AMR-NB de/encoder & AMR-WB decoder
-#, opencv ? null # Video filtering
-, openglExtlib ? false, libGL ? null, libGLU ? null # OpenGL rendering
-, openh264 ? null # H.264/AVC encoder
-, openjpeg ? null # JPEG 2000 de/encoder
-, opensslExtlib ? false, openssl ? null
-, libpulseaudio ? null # Pulseaudio input support
-, rav1e ? null # AV1 encoder (focused on speed and safety)
-, svt-av1 ? null # AV1 encoder/decoder (focused on speed and correctness)
-, rtmpdump ? null # RTMP[E] support
-#, libquvi ? null # Quvi input support
-, samba ? null # Samba protocol
-#, schroedinger ? null # Dirac de/encoder
-, SDL2 ? null
-#, shine ? null # Fixed-point MP3 encoder
-, soxr ? null # Resampling via soxr
-, speex ? null # Speex de/encoder
-, srt ? null # Secure Reliable Transport (SRT) protocol
-#, twolame ? null # MP2 encoder
-#, utvideo ? null # Ut Video de/encoder
-, vid-stab ? null # Video stabilization
-#, vo-aacenc ? null # AAC encoder
-, vo-amrwbenc ? null # AMR-WB encoder
-, x264 ? null # H.264/AVC encoder
-, x265 ? null # H.265/HEVC encoder
-, xavs ? null # AVS encoder
-, xvidcore ? null # Xvid encoder, native encoder exists
-, zeromq4 ? null # Message passing
-, zimg ? null
-, zlib ? null
-, vulkan-loader ? null
-, glslang ? null
-#, zvbi ? null # Teletext support
-/*
- *  Developer options
- */
-, debugDeveloper ? false
-, optimizationsDeveloper ? true
-, extraWarningsDeveloper ? false
-, strippingDeveloper ? false
-/*
- *  Darwin frameworks
- */
-, Cocoa, CoreAudio, CoreServices, AVFoundation, MediaToolbox
-, VideoDecodeAcceleration, VideoToolbox
-}:
-
-/* Maintainer notes:
- *
- * Version bumps:
- * It should always be safe to bump patch releases (e.g. 2.1.x, x being a patch release)
- * If adding a new branch, note any configure flags that were added, changed, or deprecated/removed
- *   and make the necessary changes.
- *
- * Packages with errors:
- *   flite ilbc schroedinger
- *   opencv - circular dependency issue
- *
- * Not packaged:
- *   aacplus avisynth cdio-paranoia crystalhd libavc1394 libiec61883
- *   libnut libquvi nvenc oss shine twolame
- *   utvideo vo-aacenc vo-amrwbenc xvmc zvbi blackmagic-design-desktop-video
- *
- * Need fixes to support Darwin:
- *   gsm libjack2 libmodplug libmfx(intel-media-sdk) nvenc pulseaudio samba
- *   vid-stab
- *
- * Need fixes to support AArch64:
- *   libmfx(intel-media-sdk) nvenc
- *
- * Not supported:
- *   stagefright-h264(android only)
- *
- * Known issues:
- * flite: configure fails to find library
- *   Tried modifying ffmpeg's configure script and flite to use pkg-config
- * Cross-compiling will disable features not present on host OS
- *   (e.g. dxva2 support [DirectX] will not be enabled unless natively compiled on Cygwin)
- *
- */
-
-let
-  inherit (stdenv) isCygwin isDarwin isFreeBSD isLinux isAarch64;
-  inherit (lib) optional optionals optionalString enableFeature;
-in
-
-/*
- *  Licensing dependencies
- */
-assert version3Licensing -> gplLicensing;
-assert nonfreeLicensing -> gplLicensing && version3Licensing;
-/*
- *  Build dependencies
- */
-assert networkBuild -> gnutls != null || opensslExtlib;
-assert pixelutilsBuild -> avutilLibrary;
-/*
- *  Platform dependencies
- */
-assert isDarwin -> !nvenc;
-/*
- *  Program dependencies
- */
-assert ffmpegProgram -> avcodecLibrary
-                     && avfilterLibrary
-                     && avformatLibrary
-                     && swresampleLibrary;
-assert ffplayProgram -> avcodecLibrary
-                     && avformatLibrary
-                     && swscaleLibrary
-                     && swresampleLibrary
-                     && SDL2 != null;
-assert ffprobeProgram -> avcodecLibrary && avformatLibrary;
-/*
- *  Library dependencies
- */
-assert avcodecLibrary -> avutilLibrary; # configure flag since 0.6
-assert avdeviceLibrary -> avformatLibrary
-                       && avcodecLibrary
-                       && avutilLibrary; # configure flag since 0.6
-assert avformatLibrary -> avcodecLibrary && avutilLibrary; # configure flag since 0.6
-assert postprocLibrary -> avutilLibrary;
-assert swresampleLibrary -> soxr != null;
-assert swscaleLibrary -> avutilLibrary;
-/*
- *  External libraries
- */
-#assert decklinkExtlib -> blackmagic-design-desktop-video != null
-#                                       && !isCygwin && multithreadBuild # POSIX threads required
-#                                       && nonfreeLicensing;
-assert fdkaacExtlib -> fdk_aac != null && nonfreeLicensing;
-assert gnutls != null -> !opensslExtlib;
-assert libxcbshmExtlib -> libxcb != null;
-assert libxcbxfixesExtlib -> libxcb != null;
-assert libxcbshapeExtlib -> libxcb != null;
-assert openglExtlib -> libGL != null && libGLU != null;
-assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;
-
-stdenv.mkDerivation rec {
-  pname = "ffmpeg-full";
-  inherit (ffmpeg) src version patches;
-
-  prePatch = ''
-    patchShebangs .
-  '' + lib.optionalString stdenv.isDarwin ''
-    sed -i 's/#ifndef __MAC_10_11/#if 1/' ./libavcodec/audiotoolboxdec.c
-  '' + lib.optionalString (frei0r != null) ''
-    substituteInPlace libavfilter/vf_frei0r.c \
-      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-    substituteInPlace doc/filters.texi \
-      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-  '';
-
-  configurePlatforms = [];
-  configureFlags = [
-    "--target_os=${if stdenv.hostPlatform.isMinGW then "mingw64" else stdenv.hostPlatform.parsed.kernel.name}" #mingw32 and mingw64 doesn't have a difference here, it is internally rewritten as mingw32
-    "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-    /*
-     *  Licensing flags
-     */
-    (enableFeature gplLicensing "gpl")
-    (enableFeature version3Licensing "version3")
-    (enableFeature nonfreeLicensing "nonfree")
-    /*
-     *  Build flags
-     */
-    # On some ARM platforms --enable-thumb
-    "--enable-shared"
-    (enableFeature true "pic")
-    (enableFeature smallBuild "small")
-    (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
-    (enableFeature enableLto "lto")
-    (enableFeature grayBuild "gray")
-    (enableFeature swscaleAlphaBuild "swscale-alpha")
-    (enableFeature hardcodedTablesBuild "hardcoded-tables")
-    (enableFeature safeBitstreamReaderBuild "safe-bitstream-reader")
-    (if multithreadBuild then (
-       if stdenv.hostPlatform.isWindows then
-         "--disable-pthreads --enable-w32threads"
-       else # Use POSIX threads by default
-         "--enable-pthreads --disable-w32threads")
-     else
-       "--disable-pthreads --disable-w32threads")
-    "--disable-os2threads" # We don't support OS/2
-    (enableFeature networkBuild "network")
-    (enableFeature pixelutilsBuild "pixelutils")
-    /*
-     *  Program flags
-     */
-    (enableFeature ffmpegProgram "ffmpeg")
-    (enableFeature ffplayProgram "ffplay")
-    (enableFeature ffprobeProgram "ffprobe")
-    /*
-     *  Library flags
-     */
-    (enableFeature avcodecLibrary "avcodec")
-    (enableFeature avdeviceLibrary "avdevice")
-    (enableFeature avfilterLibrary "avfilter")
-    (enableFeature avformatLibrary "avformat")
-    (enableFeature avutilLibrary "avutil")
-    (enableFeature (postprocLibrary && gplLicensing) "postproc")
-    (enableFeature swresampleLibrary "swresample")
-    (enableFeature swscaleLibrary "swscale")
-    /*
-     *  Documentation flags
-     */
-    (enableFeature (htmlpagesDocumentation
-          || manpagesDocumentation
-          || podpagesDocumentation
-          || txtpagesDocumentation) "doc")
-    (enableFeature htmlpagesDocumentation "htmlpages")
-    (enableFeature manpagesDocumentation "manpages")
-    (enableFeature podpagesDocumentation "podpages")
-    (enableFeature txtpagesDocumentation "txtpages")
-    /*
-     *  External libraries
-     */
-    #(enableFeature avisynth "avisynth")
-    (enableFeature (bzip2 != null) "bzlib")
-    (enableFeature (celt != null) "libcelt")
-    (enableFeature cuda "cuda")
-    (enableFeature (clang != null && cuda-llvm) "cuda-llvm")
-    #(enableFeature crystalhd "crystalhd")
-    (enableFeature (dav1d != null) "libdav1d")
-    #(enableFeature decklinkExtlib "decklink")
-    (enableFeature (fdkaacExtlib && gplLicensing) "libfdk-aac")
-    #(enableFeature (flite != null) "libflite")
-    "--disable-libflite" # Force disable until a solution is found
-    (enableFeature (fontconfig != null) "fontconfig")
-    (enableFeature (freetype != null) "libfreetype")
-    (enableFeature (frei0r != null && gplLicensing) "frei0r")
-    (enableFeature (fribidi != null) "libfribidi")
-    (enableFeature (game-music-emu != null) "libgme")
-    (enableFeature (gnutls != null) "gnutls")
-    (enableFeature (gsm != null) "libgsm")
-    #(enableFeature (ilbc != null) "libilbc")
-    (enableFeature (ladspaH !=null) "ladspa")
-    (enableFeature (lame != null) "libmp3lame")
-    (enableFeature (libaom != null) "libaom")
-    (enableFeature (libass != null) "libass")
-    #(enableFeature (libavc1394 != null) null null)
-    (enableFeature (libbluray != null) "libbluray")
-    (enableFeature (libbs2b != null) "libbs2b")
-    #(enableFeature (libcaca != null) "libcaca")
-    #(enableFeature (cdio-paranoia != null && gplLicensing) "libcdio")
-    (enableFeature (if isLinux then libdc1394 != null && libraw1394 != null else false) "libdc1394")
-    (enableFeature ((isLinux || isFreeBSD) && libdrm != null) "libdrm")
-    (enableFeature (libiconv != null) "iconv")
-    (enableFeature (libjack2 != null) "libjack")
-    #(enableFeature (if isLinux then libiec61883 != null && libavc1394 != null && libraw1394 != null else false) "libiec61883")
-    (enableFeature (if isLinux && !isAarch64 then libmfx != null else false) "libmfx")
-    (enableFeature (libmodplug != null) "libmodplug")
-    (enableFeature (libmysofa != null) "libmysofa")
-    #(enableFeature (libnut != null) "libnut")
-    (enableFeature (libopenmpt != null) "libopenmpt")
-    (enableFeature (libopus != null) "libopus")
-    (enableFeature (librsvg != null) "librsvg")
-    (enableFeature (srt != null) "libsrt")
-    (enableFeature (libssh != null) "libssh")
-    (enableFeature (libtheora != null) "libtheora")
-    (enableFeature (if isLinux then libv4l != null else false) "libv4l2")
-    (enableFeature ((isLinux || isFreeBSD) && libva != null) "vaapi")
-    (enableFeature (libvdpau != null) "vdpau")
-    (enableFeature (libvorbis != null) "libvorbis")
-    (enableFeature (!isAarch64 && libvmaf != null && version3Licensing) "libvmaf")
-    (enableFeature (libvpx != null) "libvpx")
-    (enableFeature (libwebp != null) "libwebp")
-    (enableFeature (libX11 != null && libXv != null && libXext != null) "xlib")
-    (enableFeature (libxcb != null) "libxcb")
-    (enableFeature libxcbshmExtlib "libxcb-shm")
-    (enableFeature libxcbxfixesExtlib "libxcb-xfixes")
-    (enableFeature libxcbshapeExtlib "libxcb-shape")
-    (enableFeature (libxml2 != null) "libxml2")
-    (enableFeature (xz != null) "lzma")
-    (enableFeature nvdec "cuvid")
-    (enableFeature nvdec "nvdec")
-    (enableFeature nvenc "nvenc")
-    (enableFeature (openal != null) "openal")
-    (enableFeature (ocl-icd != null && opencl-headers != null) "opencl")
-    (enableFeature (opencore-amr != null && version3Licensing) "libopencore-amrnb")
-    #(enableFeature (opencv != null) "libopencv")
-    (enableFeature openglExtlib "opengl")
-    (enableFeature (openh264 != null) "libopenh264")
-    (enableFeature (openjpeg != null) "libopenjpeg")
-    (enableFeature (opensslExtlib && gplLicensing) "openssl")
-    (enableFeature (libpulseaudio != null) "libpulse")
-    #(enableFeature quvi "libquvi")
-    (enableFeature (rav1e != null) "librav1e")
-    (enableFeature (svt-av1 != null) "libsvtav1")
-    (enableFeature (rtmpdump != null) "librtmp")
-    #(enableFeature (schroedinger != null) "libschroedinger")
-    (enableFeature (SDL2 != null) "sdl2")
-    (enableFeature (soxr != null) "libsoxr")
-    (enableFeature (speex != null) "libspeex")
-    #(enableFeature (twolame != null) "libtwolame")
-    #(enableFeature (utvideo != null && gplLicensing) "libutvideo")
-    (enableFeature (vid-stab != null && gplLicensing) "libvidstab") # Actual min. version 2.0
-    #(enableFeature (vo-aacenc != null && version3Licensing) "libvo-aacenc")
-    (enableFeature (vo-amrwbenc != null && version3Licensing) "libvo-amrwbenc")
-    (enableFeature (x264 != null && gplLicensing) "libx264")
-    (enableFeature (x265 != null && gplLicensing) "libx265")
-    (enableFeature (xavs != null && gplLicensing) "libxavs")
-    (enableFeature (xvidcore != null && gplLicensing) "libxvid")
-    (enableFeature (zeromq4 != null) "libzmq")
-    (enableFeature (zimg != null) "libzimg")
-    (enableFeature (zlib != null) "zlib")
-    (enableFeature (isLinux && vulkan-loader != null) "vulkan")
-    (enableFeature (isLinux && vulkan-loader != null && glslang != null) "libglslang")
-    (enableFeature (samba != null && gplLicensing && version3Licensing) "libsmbclient")
-    #(enableFeature (zvbi != null && gplLicensing) "libzvbi")
-    /*
-     * Developer flags
-     */
-    (enableFeature debugDeveloper "debug")
-    (enableFeature optimizationsDeveloper "optimizations")
-    (enableFeature extraWarningsDeveloper "extra-warnings")
-    (enableFeature strippingDeveloper "stripping")
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--cross-prefix=${stdenv.cc.targetPrefix}"
-    "--enable-cross-compile"
-    "--host-cc=${buildPackages.stdenv.cc}/bin/cc"
-  ] ++ optionals stdenv.cc.isClang [
-    "--cc=clang"
-    "--cxx=clang++"
-  ];
-
-  nativeBuildInputs = [ addOpenGLRunpath perl pkg-config texinfo yasm ];
-
-  buildInputs = [
-    bzip2 celt dav1d fontconfig freetype frei0r fribidi game-music-emu gnutls gsm
-    libjack2 ladspaH lame libaom libass libbluray libbs2b libcaca libdc1394 libmodplug libmysofa
-    libogg libopenmpt libopus librsvg libssh libtheora libvdpau libvorbis libvpx libwebp libX11
-    libxcb libXv libXext libxml2 xz openal ocl-icd opencl-headers openjpeg libpulseaudio rav1e svt-av1 rtmpdump opencore-amr
-    samba SDL2 soxr speex srt vid-stab vo-amrwbenc x264 x265 xavs xvidcore
-    zeromq4 zimg zlib openh264
-  ] ++ optionals openglExtlib [ libGL libGLU ]
-    ++ optionals nonfreeLicensing [ fdk_aac openssl ]
-    ++ optional ((isLinux || isFreeBSD) && libva != null) libva
-    ++ optional ((isLinux || isFreeBSD) && libdrm != null) libdrm
-    ++ optional (!isAarch64 && libvmaf != null && version3Licensing) libvmaf
-    ++ optionals isLinux [ alsa-lib libraw1394 libv4l vulkan-loader glslang ]
-    ++ optional (isLinux && !isAarch64 && libmfx != null) libmfx
-    ++ optional (nvdec || nvenc) nv-codec-headers
-    ++ optional cuda-llvm clang
-    ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
-                                   MediaToolbox VideoDecodeAcceleration VideoToolbox
-                                   libiconv ];
-
-  buildFlags = [ "all" ]
-    ++ optional qtFaststartProgram "tools/qt-faststart"; # Build qt-faststart executable
-
-  doCheck = true;
-  checkPhase = let
-    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
-  in ''
-    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
-      make check -j$NIX_BUILD_CORES
-  '';
-
-  # Hacky framework patching technique borrowed from the phantomjs2 package
-  postInstall = optionalString qtFaststartProgram ''
-    cp -a tools/qt-faststart $out/bin/
-  '';
-
-  postFixup = optionalString stdenv.isLinux ''
-    # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
-    # See the explanation in addOpenGLRunpath.
-    addOpenGLRunpath $out/lib/libavcodec.so
-    addOpenGLRunpath $out/lib/libavutil.so
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "A complete, cross-platform solution to record, convert and stream audio and video";
-    homepage = "https://www.ffmpeg.org/";
-    changelog = "https://github.com/FFmpeg/FFmpeg/blob/n${version}/Changelog";
-    longDescription = ''
-      FFmpeg is the leading multimedia framework, able to decode, encode, transcode,
-      mux, demux, stream, filter and play pretty much anything that humans and machines
-      have created. It supports the most obscure ancient formats up to the cutting edge.
-      No matter if they were designed by some standards committee, the community or
-      a corporation.
-    '';
-    license = (
-      if nonfreeLicensing then
-        licenses.unfreeRedistributable
-      else if version3Licensing then
-        licenses.gpl3
-      else if gplLicensing then
-        licenses.gpl2Plus
-      else
-        licenses.lgpl21Plus
-    );
-    platforms = platforms.all;
-    maintainers = with maintainers; [ codyopel ];
-  };
-}
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index ac88df930768..7882c19da8f3 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,8 +1,4 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (rec {
+import ./generic.nix rec {
   version = "4.4.3";
-  branch = version;
-  sha256 = "sha256-M7jC281TD+HbVxBBU0Vgm0yiJ70NoeOpMy27DxH9Jzo=";
-
-} // args)
+  sha256 = "sha256-zZDzG1hD+0AHqElzeGR6OVm+H5wqtdktloSPmEUzT/c=";
+}
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index b19c22a55f3a..7ff9b1fc2e4c 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,7 +1,4 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (rec {
+import ./generic.nix rec {
   version = "5.1.2";
-  branch = version;
-  sha256 = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
-} // args)
+  sha256 = "sha256-4jcfwIE0/DgP7ibwkrSm/aPiHIMFn34JNcXkCMx4ceI=";
+}
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 01995e9237b1..dceada0f7f8f 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,205 +1,660 @@
-{ lib, stdenv, buildPackages, fetchurl, pkg-config, addOpenGLRunpath, perl, texinfo, yasm
-, alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
-, libssh, libtheora, libva, libdrm, libvorbis, xz, soxr
-, x264, x265, xvidcore, zimg, zlib, libopus, speex, nv-codec-headers, dav1d
-, vpxSupport ? !stdenv.isAarch32, libvpx
-, srtSupport ? true, srt
-, vaapiSupport ? ((stdenv.isLinux || stdenv.isFreeBSD) && !stdenv.isAarch32)
-, openglSupport ? false, libGLU, libGL
-, libmfxSupport ? false, intel-media-sdk
-, libaomSupport ? false, libaom
-# Build options
-, runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime
-, multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, sdlSupport ? !stdenv.isAarch32, SDL2
-, vdpauSupport ? !stdenv.isAarch32, libvdpau
-# Developer options
-, debugDeveloper ? false
-, optimizationsDeveloper ? true
-, extraWarningsDeveloper ? false
-, Cocoa, CoreMedia, VideoToolbox
-# Inherit generics
-, branch, sha256, version, patches ? [], knownVulnerabilities ? []
-, doCheck ? true
-, pulseaudioSupport ? stdenv.isLinux
+{ version, sha256, extraPatches ? [], knownVulnerabilities ? [] }:
+
+{ lib, stdenv, buildPackages, removeReferencesTo, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
+
+, ffmpegVariant ? "small" # Decides which dependencies are enabled by default
+
+  # Build with headless deps; excludes dependencies that are only necessary for
+  # GUI applications. To be used for purposes that don't generally need such
+  # components and i.e. only depend on libav
+, withHeadlessDeps ? ffmpegVariant == "headless" || withSmallDeps
+
+  # Dependencies a user might customarily expect from a regular ffmpeg build.
+  # /All/ packages that depend on ffmpeg and some of its feaures should depend
+  # on the small variant. Small means the minimal set of features that satisfies
+  # all dependants in Nixpkgs
+, withSmallDeps ? ffmpegVariant == "small" || withFullDeps
+
+  # Everything enabled; only guarded behind platform exclusivity or brokeness.
+  # If you need to depend on ffmpeg-full because ffmpeg is missing some feature
+  # your package needs, you should enable that feature in regular ffmpeg
+  # instead.
+, withFullDeps ? ffmpegVariant == "full"
+
+, fetchgit
+, fetchpatch
+
+  # Feature flags
+, withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
+, withAom ? withFullDeps # AV1 reference encoder
+, withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
+, withBluray ? withFullDeps # BluRay reading
+, withBs2b ? withFullDeps # bs2b DSP library
+, withBzlib ? withHeadlessDeps
+, withCaca ? withFullDeps # Textual display (ASCII art)
+, withCelt ? withFullDeps # CELT decoder
+, withCrystalhd ? withFullDeps
+, withCuda ? withFullDeps && (with stdenv; (!isDarwin && !isAarch64))
+, withCudaLLVM ? withFullDeps
+, withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
+, withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
+, withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
+, withFdkAac ? withFullDeps && withUnfree # Fraunhofer FDK AAC de/encoder
+, withFontconfig ? withHeadlessDeps # Needed for drawtext filter
+, withFreetype ? withHeadlessDeps # Needed for drawtext filter
+, withFrei0r ? withFullDeps # frei0r video filtering
+, withFribidi ? withFullDeps # Needed for drawtext filter
+, withGlslang ? withFullDeps && !stdenv.isDarwin
+, withGme ? withFullDeps # Game Music Emulator
+, withGnutls ? withHeadlessDeps
+, withGsm ? withFullDeps # GSM de/encoder
+, withIconv ? withHeadlessDeps
+, withIlbc ? withFullDeps
+, withJack ? withFullDeps && !stdenv.isDarwin # Jack audio
+, withLadspa ? withFullDeps # LADSPA audio filtering
+, withLzma ? withHeadlessDeps # xz-utils
+, withMfx ? withFullDeps && (with stdenv.targetPlatform; isLinux && !isAarch) # Hardware acceleration via intel-media-sdk/libmfx
+, withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
+, withMp3lame ? withHeadlessDeps # LAME MP3 encoder
+, withMysofa ? withFullDeps # HRTF support via SOFAlizer
+, withNvdec ? withHeadlessDeps && !stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform
+, withNvenc ? withHeadlessDeps && !stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform
+, withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
+, withOpenal ? withFullDeps # OpenAL 1.1 capture support
+, withOpencl ? withFullDeps
+, withOpencoreAmrnb ? withFullDeps # AMR-NB de/encoder & AMR-WB decoder
+, withOpengl ? false # OpenGL rendering
+, withOpenh264 ? withFullDeps # H.264/AVC encoder
+, withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
+, withOpenmpt ? withFullDeps # Tracked music files decoder
+, withOpus ? withHeadlessDeps # Opus de/encoder
+, withPulse ? withSmallDeps && !stdenv.isDarwin # Pulseaudio input support
+, withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
+, withRtmp ? false # RTMP[E] support
+, withSamba ? withFullDeps && !stdenv.isDarwin # Samba protocol
+, withSdl2 ? withSmallDeps
+, withSoxr ? withHeadlessDeps # Resampling via soxr
+, withSpeex ? withHeadlessDeps # Speex de/encoder
+, withSrt ? withHeadlessDeps # Secure Reliable Transport (SRT) protocol
+, withSsh ? withHeadlessDeps # SFTP protocol
+, withSvg ? withFullDeps # SVG protocol
+, withSvtav1 ? withFullDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
+, withTheora ? withHeadlessDeps # Theora encoder
+, withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
+, withV4l2M2m ? withV4l2
+, withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
+, withVdpau ? withSmallDeps # Vdpau hardware acceleration
+, withVidStab ? withFullDeps # Video stabilization
+, withVmaf ? withFullDeps && withGPLv3 && !stdenv.isAarch64 # Netflix's VMAF (Video Multi-Method Assessment Fusion)
+, withVoAmrwbenc ? withFullDeps # AMR-WB encoder
+, withVorbis ? withHeadlessDeps # Vorbis de/encoding, native encoder exists
+, withVpx ? withHeadlessDeps && stdenv.buildPlatform == stdenv.hostPlatform # VP8 & VP9 de/encoding
+, withVulkan ? withFullDeps && !stdenv.isDarwin
+, withWebp ? withFullDeps # WebP encoder
+, withX264 ? withHeadlessDeps # H.264/AVC encoder
+, withX265 ? withHeadlessDeps # H.265/HEVC encoder
+, withXavs ? withFullDeps # AVS encoder
+, withXcb ? withXcbShm || withXcbxfixes || withXcbShape # X11 grabbing using XCB
+, withXcbShape ? withFullDeps # X11 grabbing shape rendering
+, withXcbShm ? withFullDeps # X11 grabbing shm communication
+, withXcbxfixes ? withFullDeps # X11 grabbing mouse rendering
+, withXlib ? withFullDeps # Xlib support
+, withXml2 ? withFullDeps # libxml2 support, for IMF and DASH demuxers
+, withXvid ? withHeadlessDeps # Xvid encoder, native encoder exists
+, withZimg ? withHeadlessDeps
+, withZlib ? withHeadlessDeps
+, withZmq ? withFullDeps # Message passing
+
+/*
+ *  Licensing options (yes some are listed twice, filters and such are not listed)
+ */
+, withGPL ? true
+, withGPLv3 ? true
+, withUnfree ? false
+
+/*
+ *  Build options
+ */
+, withSmallBuild ? false # Optimize for size instead of speed
+, withRuntimeCPUDetection ? true # Detect CPU capabilities at runtime (disable to compile natively)
+, withGrayscale ? withFullDeps # Full grayscale support
+, withSwscaleAlpha ? buildSwscale # Alpha channel support in swscale. You probably want this when buildSwscale.
+, withHardcodedTables ? withHeadlessDeps # Hardcode decode tables instead of runtime generation
+, withSafeBitstreamReader ? withHeadlessDeps # Buffer boundary checking in bitreaders
+, withMultithread ? true # Multithreading via pthreads/win32 threads
+, withNetwork ? withHeadlessDeps # Network support
+, withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
+, withLTO ? false # build with link-time optimization
+/*
+ *  Program options
+ */
+, buildFfmpeg ? withHeadlessDeps # Build ffmpeg executable
+, buildFfplay ? withFullDeps # Build ffplay executable
+, buildFfprobe ? withHeadlessDeps # Build ffprobe executable
+, buildQtFaststart ? withFullDeps # Build qt-faststart executable
+, withBin ? buildFfmpeg || buildFfplay || buildFfprobe || buildQtFaststart
+/*
+ *  Library options
+ */
+, buildAvcodec ? withHeadlessDeps # Build avcodec library
+, buildAvdevice ? withHeadlessDeps # Build avdevice library
+, buildAvfilter ? withHeadlessDeps # Build avfilter library
+, buildAvformat ? withHeadlessDeps # Build avformat library
+# Deprecated but depended upon by some packages.
+# https://github.com/NixOS/nixpkgs/pull/211834#issuecomment-1417435991)
+, buildAvresample ? withHeadlessDeps && lib.versionOlder version "5" # Build avresample library
+, buildAvutil ? withHeadlessDeps # Build avutil library
+, buildPostproc ? withHeadlessDeps # Build postproc library
+, buildSwresample ? withHeadlessDeps # Build swresample library
+, buildSwscale ? withHeadlessDeps # Build swscale library
+, withLib ? buildAvcodec
+  || buildAvdevice
+  || buildAvfilter
+  || buildAvformat
+  || buildAvutil
+  || buildPostproc
+  || buildSwresample
+  || buildSwscale
+/*
+ *  Documentation options
+ */
+, withDocumentation ? withHtmlDoc || withManPages || withPodDoc || withTxtDoc
+, withHtmlDoc ? withHeadlessDeps # HTML documentation pages
+, withManPages ? withHeadlessDeps # Man documentation pages
+, withPodDoc ? withHeadlessDeps # POD documentation pages
+, withTxtDoc ? withHeadlessDeps # Text documentation pages
+# Whether a "doc" output will be produced. Note that withManPages does not produce
+# a "doc" output because its files go to "man".
+, withDoc ? withDocumentation && (withHtmlDoc || withPodDoc || withTxtDoc)
+
+/*
+ *  Developer options
+ */
+, withDebug ? false
+, withOptimisations ? true
+, withExtraWarnings ? false
+, withStripping ? false
+
+/*
+ *  External libraries options
+ */
+, alsa-lib
+, bzip2
+, clang
+, celt
+, dav1d
+, fdk_aac
+, fontconfig
+, freetype
+, frei0r
+, fribidi
+, game-music-emu
+, gnutls
+, gsm
+, libjack2
+, ladspaH
+, lame
+, libass
+, libaom
+, libbluray
+, libbs2b
+, libcaca
+, libdc1394
+, libraw1394
+, libdrm
+, libiconv
+, intel-media-sdk
+, libmodplug
+, libmysofa
+, libogg
+, libopenmpt
+, libopus
+, librsvg
+, libssh
+, libtheora
+, libv4l
+, libva
+, libva-minimal
+, libvdpau
+, libvmaf
+, libvorbis
+, libvpx
+, libwebp
+, libX11
+, libxcb
+, libXv
+, libXext
+, libxml2
+, xz
+, nv-codec-headers
+, openal
+, ocl-icd # OpenCL ICD
+, opencl-headers  # OpenCL headers
+, opencore-amr
+, libGL
+, libGLU
+, openh264
+, openjpeg
 , libpulseaudio
-, ...
+, rav1e
+, svt-av1
+, rtmpdump
+, samba
+, SDL2
+, soxr
+, speex
+, srt
+, vid-stab
+, vo-amrwbenc
+, x264
+, x265
+, xavs
+, xvidcore
+, zeromq4
+, zimg
+, zlib
+, vulkan-loader
+, glslang
+/*
+ *  Darwin frameworks
+ */
+, AVFoundation
+, Cocoa
+, CoreAudio
+, CoreMedia
+, CoreServices
+, MediaToolbox
+, VideoDecodeAcceleration
+, VideoToolbox
 }:
 
 /* Maintainer notes:
  *
- * THIS IS A MINIMAL BUILD OF FFMPEG, do not include dependencies unless
- * a build that depends on ffmpeg requires them to be compiled into ffmpeg,
- * see `ffmpeg-full' for an ffmpeg build with all features included.
- *
- * Need fixes to support Darwin:
- *   pulseaudio
+ * Version bumps:
+ * It should always be safe to bump patch releases (e.g. 2.1.x, x being a patch release)
+ * If adding a new branch, note any configure flags that were added, changed, or deprecated/removed
+ *   and make the necessary changes.
  *
  * Known issues:
- * ALL     - Cross-compiling will disable features not present on host OS
- *           (e.g. dxva2 support [DirectX] will not be enabled unless natively
- *           compiled on Cygwin)
+ * Cross-compiling will disable features not present on host OS
+ *   (e.g. dxva2 support [DirectX] will not be enabled unless natively compiled on Cygwin)
  *
  */
 
 let
-  inherit (lib) optional optionals optionalString enableFeature filter;
-
-  reqMin = requiredVersion: (builtins.compareVersions requiredVersion branch != 1);
-
-  ifMinVer = minVer: flag: if reqMin minVer then flag else null;
-
-  ifVerOlder = maxVer: flag: if (lib.versionOlder branch maxVer) then flag else null;
+  inherit (stdenv) isCygwin isDarwin isFreeBSD isLinux isAarch64;
+  inherit (lib) optional optionals optionalString enableFeature;
 in
 
+
+assert lib.elem ffmpegVariant [ "headless" "small" "full" ];
+
+/*
+ *  Licensing dependencies
+ */
+assert withGPLv3 -> withGPL;
+assert withUnfree -> withGPL && withGPLv3;
+/*
+ *  Build dependencies
+ */
+assert withPixelutils -> buildAvutil;
+/*
+ *  Program dependencies
+ */
+assert buildFfmpeg -> buildAvcodec
+                     && buildAvfilter
+                     && buildAvformat
+                     && (buildSwresample || buildAvresample);
+assert buildFfplay -> buildAvcodec
+                     && buildAvformat
+                     && buildSwscale
+                     && (buildSwresample || buildAvresample);
+assert buildFfprobe -> buildAvcodec && buildAvformat;
+/*
+ *  Library dependencies
+ */
+assert buildAvcodec -> buildAvutil; # configure flag since 0.6
+assert buildAvdevice -> buildAvformat
+                       && buildAvcodec
+                       && buildAvutil; # configure flag since 0.6
+assert buildAvformat -> buildAvcodec && buildAvutil; # configure flag since 0.6
+assert buildPostproc -> buildAvutil;
+assert buildSwscale -> buildAvutil;
+
 stdenv.mkDerivation rec {
-  pname = "ffmpeg";
+  pname = "ffmpeg" + (if ffmpegVariant == "small" then "" else "-${ffmpegVariant}");
   inherit version;
 
-  src = fetchurl {
-    url = "https://www.ffmpeg.org/releases/${pname}-${version}.tar.bz2";
+  src = fetchgit {
+    url = "https://git.ffmpeg.org/ffmpeg.git";
+    rev = "n${version}";
     inherit sha256;
   };
 
-  postPatch = "patchShebangs .";
-  inherit patches;
-
-  outputs = [ "bin" "dev" "out" "man" "doc" ];
-  setOutputFlags = false; # doesn't accept all and stores configureFlags in libs!
-
-  configurePlatforms = [];
-  configureFlags = filter (v: v != null) ([
-      "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-      "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
-      "--pkg-config=${buildPackages.pkg-config.targetPrefix}pkg-config"
-    # License
-      "--enable-gpl"
-      "--enable-version3"
-    # Build flags
-      "--enable-shared"
-      "--enable-pic"
-      (ifMinVer "4.0" (enableFeature srtSupport "libsrt"))
-      (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
-      "--enable-hardcoded-tables"
-    ] ++
-      (if multithreadBuild then (
-         if stdenv.isCygwin then
-           ["--disable-pthreads" "--enable-w32threads"]
-         else # Use POSIX threads by default
-           ["--enable-pthreads" "--disable-w32threads"])
-       else
-         ["--disable-pthreads" "--disable-w32threads"])
-    ++ [
-      "--disable-os2threads" # We don't support OS/2
-      "--enable-network"
-      "--enable-pixelutils"
-    # Executables
-      "--enable-ffmpeg"
-      "--disable-ffplay"
-      "--enable-ffprobe"
-      (ifVerOlder "4" "--disable-ffserver")
-    # Libraries
-      "--enable-avcodec"
-      "--enable-avdevice"
-      "--enable-avfilter"
-      "--enable-avformat"
-      (ifVerOlder "5.0" "--enable-avresample")
-      "--enable-avutil"
-      "--enable-postproc"
-      "--enable-swresample"
-      "--enable-swscale"
-    # Docs
-      "--disable-doc"
-    # External Libraries
-      "--enable-libass"
-      "--enable-bzlib"
-      "--enable-gnutls"
-      "--enable-fontconfig"
-      "--enable-libfreetype"
-      "--enable-libmp3lame"
-      "--enable-iconv"
-      "--enable-libtheora"
-      "--enable-libssh"
-      (enableFeature vaapiSupport "vaapi")
-      (enableFeature vaapiSupport "libdrm")
-      (enableFeature vdpauSupport "vdpau")
-      "--enable-libvorbis"
-      (enableFeature vpxSupport "libvpx")
-      "--enable-lzma"
-      (enableFeature openglSupport "opengl")
-      (ifMinVer "4.2" (enableFeature libmfxSupport "libmfx"))
-      (ifMinVer "4.2" (enableFeature libaomSupport "libaom"))
-      (lib.optionalString pulseaudioSupport "--enable-libpulse")
-      (enableFeature sdlSupport "sdl2")
-      "--enable-libsoxr"
-      "--enable-libx264"
-      "--enable-libxvid"
-      "--enable-libzimg"
-      "--enable-zlib"
-      "--enable-libopus"
-      "--enable-libspeex"
-      "--enable-libx265"
-      (ifMinVer "4.2" (enableFeature (reqMin "4.2") "libdav1d"))
-    # Developer flags
-      (enableFeature debugDeveloper "debug")
-      (enableFeature optimizationsDeveloper "optimizations")
-      (enableFeature extraWarningsDeveloper "extra-warnings")
-      "--disable-stripping"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "--cross-prefix=${stdenv.cc.targetPrefix}"
-      "--enable-cross-compile"
-  ] ++ optional stdenv.cc.isClang "--cc=clang");
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ addOpenGLRunpath perl pkg-config texinfo yasm ];
-
-  buildInputs = [
-    bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex nv-codec-headers
-  ] ++ optionals openglSupport [ libGL libGLU ]
-    ++ optional libmfxSupport intel-media-sdk
-    ++ optional libaomSupport libaom
-    ++ optional vpxSupport libvpx
-    ++ optionals (!stdenv.isDarwin && pulseaudioSupport) [ libpulseaudio ] # Need to be fixed on Darwin
-    ++ optionals vaapiSupport [ libva libdrm ]
-    ++ optional stdenv.isLinux alsa-lib
-    ++ optionals stdenv.isDarwin [ Cocoa CoreMedia VideoToolbox ]
-    ++ optional vdpauSupport libvdpau
-    ++ optional sdlSupport SDL2
-    ++ optional srtSupport srt
-    ++ optional (reqMin "4.2") dav1d;
-
-  enableParallelBuilding = true;
-
-  inherit doCheck;
-  checkPhase = let
-    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
-  in ''
-    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavresample:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
-      make check -j$NIX_BUILD_CORES
+  postPatch = ''
+    patchShebangs .
+  '' + lib.optionalString withFrei0r ''
+    substituteInPlace libavfilter/vf_frei0r.c \
+      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
+    substituteInPlace doc/filters.texi \
+      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
   '';
 
-  # ffmpeg 3+ generates pkg-config (.pc) files that don't have the
-  # form automatically handled by the multiple-outputs hooks.
-  postFixup = ''
-    moveToOutput bin "$bin"
-    moveToOutput share/ffmpeg/examples "$doc"
-    for pc in ''${!outputDev}/lib/pkgconfig/*.pc; do
-      substituteInPlace $pc \
-        --replace "includedir=$out" "includedir=''${!outputInclude}"
-    done
-  '' + optionalString stdenv.isLinux ''
-    # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
-    # See the explanation in addOpenGLRunpath.
+  patches = map (patch: fetchpatch patch) extraPatches;
+
+  configurePlatforms = [];
+  setOutputFlags = false; # Only accepts some of them
+  configureFlags = [
+    #mingw64 is internally treated as mingw32, so 32 and 64 make no difference here
+    "--target_os=${if stdenv.hostPlatform.isMinGW then "mingw64" else stdenv.hostPlatform.parsed.kernel.name}"
+    "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
+    "--pkg-config=${buildPackages.pkg-config.targetPrefix}pkg-config"
+    /*
+     *  Licensing flags
+     */
+    (enableFeature withGPL "gpl")
+    (enableFeature withGPLv3 "version3")
+    (enableFeature withUnfree "nonfree")
+    /*
+     *  Build flags
+     */
+    # On some ARM platforms --enable-thumb
+    "--enable-shared"
+    "--enable-pic"
+
+    (enableFeature withSmallBuild "small")
+    (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
+    (enableFeature withLTO "lto")
+    (enableFeature withGrayscale "gray")
+    (enableFeature withSwscaleAlpha "swscale-alpha")
+    (enableFeature withHardcodedTables "hardcoded-tables")
+    (enableFeature withSafeBitstreamReader "safe-bitstream-reader")
+
+    (enableFeature (withMultithread && stdenv.targetPlatform.isUnix) "pthreads")
+    (enableFeature (withMultithread && stdenv.targetPlatform.isWindows) "w32threads")
+    "--disable-os2threads" # We don't support OS/2
+
+    (enableFeature withNetwork "network")
+    (enableFeature withPixelutils "pixelutils")
+
+    "--datadir=${placeholder "data"}/share/ffmpeg"
+
+    /*
+     *  Program flags
+     */
+    (enableFeature buildFfmpeg "ffmpeg")
+    (enableFeature buildFfplay "ffplay")
+    (enableFeature buildFfprobe "ffprobe")
+  ] ++ optionals withBin [
+    "--bindir=${placeholder "bin"}/bin"
+  ] ++ [
+    /*
+     *  Library flags
+     */
+    (enableFeature buildAvcodec "avcodec")
+    (enableFeature buildAvdevice "avdevice")
+    (enableFeature buildAvfilter "avfilter")
+    (enableFeature buildAvformat "avformat")
+  ] ++ optionals (lib.versionOlder version "5") [
+    # Ffmpeg > 4 doesn't know about the flag anymore
+    (enableFeature buildAvresample "avresample")
+  ] ++ [
+    (enableFeature buildAvutil "avutil")
+    (enableFeature (buildPostproc && withGPL) "postproc")
+    (enableFeature buildSwresample "swresample")
+    (enableFeature buildSwscale "swscale")
+  ] ++ optionals withLib [
+    "--libdir=${placeholder "lib"}/lib"
+    "--incdir=${placeholder "dev"}/include"
+  ] ++ [
+    /*
+     *  Documentation flags
+     */
+    (enableFeature withDocumentation "doc")
+    (enableFeature withHtmlDoc "htmlpages")
+    (enableFeature withManPages "manpages")
+  ] ++ optionals withManPages [
+    "--mandir=${placeholder "man"}/share/man"
+  ] ++ [
+    (enableFeature withPodDoc "podpages")
+    (enableFeature withTxtDoc "txtpages")
+  ] ++ optionals withDoc [
+    "--docdir=${placeholder "doc"}/share/doc/ffmpeg"
+  ] ++ [
+    /*
+     *  External libraries
+     */
+    (enableFeature withAlsa "alsa")
+    (enableFeature withBzlib "bzlib")
+    (enableFeature withCelt "libcelt")
+    (enableFeature withCuda "cuda")
+    (enableFeature withCudaLLVM "cuda-llvm")
+    (enableFeature withDav1d "libdav1d")
+    (enableFeature withFdkAac "libfdk-aac")
+    "--disable-libflite" # Force disable until a solution is found
+    (enableFeature withFontconfig "fontconfig")
+    (enableFeature withFreetype "libfreetype")
+    (enableFeature withFrei0r "frei0r")
+    (enableFeature withFribidi "libfribidi")
+    (enableFeature withGme "libgme")
+    (enableFeature withGnutls "gnutls")
+    (enableFeature withGsm "libgsm")
+    (enableFeature withLadspa "ladspa")
+    (enableFeature withMp3lame "libmp3lame")
+    (enableFeature withAom "libaom")
+    (enableFeature withAss "libass")
+    (enableFeature withBluray "libbluray")
+    (enableFeature withBs2b "libbs2b")
+    (enableFeature withDc1394 "libdc1394")
+    (enableFeature withDrm "libdrm")
+    (enableFeature withIconv "iconv")
+    (enableFeature withJack "libjack")
+    (enableFeature withMfx "libmfx")
+    (enableFeature withModplug "libmodplug")
+    (enableFeature withMysofa "libmysofa")
+    (enableFeature withOpus "libopus")
+    (enableFeature withSvg "librsvg")
+    (enableFeature withSrt "libsrt")
+    (enableFeature withSsh "libssh")
+    (enableFeature withTheora "libtheora")
+    (enableFeature withV4l2 "libv4l2")
+    (enableFeature withV4l2M2m "v4l2-m2m")
+    (enableFeature withVaapi "vaapi")
+    (enableFeature withVdpau "vdpau")
+    (enableFeature withVorbis "libvorbis")
+    (enableFeature withVmaf "libvmaf")
+    (enableFeature withVpx "libvpx")
+    (enableFeature withWebp "libwebp")
+    (enableFeature withXlib "xlib")
+    (enableFeature withXcb "libxcb")
+    (enableFeature withXcbShm "libxcb-shm")
+    (enableFeature withXcbxfixes "libxcb-xfixes")
+    (enableFeature withXcbShape "libxcb-shape")
+    (enableFeature withXml2 "libxml2")
+    (enableFeature withLzma "lzma")
+    (enableFeature withNvdec "cuvid")
+    (enableFeature withNvdec "nvdec")
+    (enableFeature withNvenc "nvenc")
+    (enableFeature withOpenal "openal")
+    (enableFeature withOpencl "opencl")
+    (enableFeature withOpencoreAmrnb "libopencore-amrnb")
+    (enableFeature withOpengl "opengl")
+    (enableFeature withOpenh264 "libopenh264")
+    (enableFeature withOpenjpeg "libopenjpeg")
+    (enableFeature withOpenmpt "libopenmpt")
+    (enableFeature withPulse "libpulse")
+    (enableFeature withRav1e "librav1e")
+    (enableFeature withSvtav1 "libsvtav1")
+    (enableFeature withRtmp "librtmp")
+    (enableFeature withSdl2 "sdl2")
+    (enableFeature withSoxr "libsoxr")
+    (enableFeature withSpeex "libspeex")
+    (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
+    (enableFeature withVoAmrwbenc "libvo-amrwbenc")
+    (enableFeature withX264 "libx264")
+    (enableFeature withX265 "libx265")
+    (enableFeature withXavs "libxavs")
+    (enableFeature withXvid "libxvid")
+    (enableFeature withZmq "libzmq")
+    (enableFeature withZimg "libzimg")
+    (enableFeature withZlib "zlib")
+    (enableFeature withVulkan "vulkan")
+    (enableFeature withGlslang "libglslang")
+    (enableFeature withSamba "libsmbclient")
+    /*
+     * Developer flags
+     */
+    (enableFeature withDebug "debug")
+    (enableFeature withOptimisations "optimizations")
+    (enableFeature withExtraWarnings "extra-warnings")
+    (enableFeature withStripping "stripping")
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "--cross-prefix=${stdenv.cc.targetPrefix}"
+    "--enable-cross-compile"
+    "--host-cc=${buildPackages.stdenv.cc}/bin/cc"
+  ] ++ optionals stdenv.cc.isClang [
+    "--cc=clang"
+    "--cxx=clang++"
+  ];
+
+  # ffmpeg embeds the configureFlags verbatim in its binaries and because we
+  # configure binary, include, library dir etc., this causes references in
+  # outputs where we don't want them. Patch the generated config.h to remove all
+  # such references except for data.
+  postConfigure = let
+    toStrip = lib.remove "data" outputs; # We want to keep references to the data dir.
+  in
+    "remove-references-to ${lib.concatStringsSep " " (map (o: "-t ${placeholder o}") toStrip)} config.h";
+
+  nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ];
+
+  # TODO This was always in buildInputs before, why?
+  buildInputs = optionals withFullDeps [ libdc1394 ]
+  ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
+  ++ optionals (withNvdec || withNvenc) [ nv-codec-headers ]
+  ++ optionals withAlsa [ alsa-lib ]
+  ++ optionals withAom [ libaom ]
+  ++ optionals withAss [ libass ]
+  ++ optionals withBluray [ libbluray ]
+  ++ optionals withBs2b [ libbs2b ]
+  ++ optionals withBzlib [ bzip2 ]
+  ++ optionals withCaca [ libcaca ]
+  ++ optionals withCelt [ celt ]
+  ++ optionals withCudaLLVM [ clang ]
+  ++ optionals withDav1d [ dav1d ]
+  ++ optionals withDrm [ libdrm ]
+  ++ optionals withFdkAac [ fdk_aac ]
+  ++ optionals withFontconfig [ fontconfig ]
+  ++ optionals withFreetype [ freetype ]
+  ++ optionals withFrei0r [ frei0r ]
+  ++ optionals withFribidi [ fribidi ]
+  ++ optionals withGlslang [ glslang ]
+  ++ optionals withGme [ game-music-emu ]
+  ++ optionals withGnutls [ gnutls ]
+  ++ optionals withGsm [ gsm ]
+  ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
+  ++ optionals withJack [ libjack2 ]
+  ++ optionals withLadspa [ ladspaH ]
+  ++ optionals withLzma [ xz ]
+  ++ optionals withMfx [ intel-media-sdk ]
+  ++ optionals withModplug [ libmodplug ]
+  ++ optionals withMp3lame [ lame ]
+  ++ optionals withMysofa [ libmysofa ]
+  ++ optionals withOgg [ libogg ]
+  ++ optionals withOpenal [ openal ]
+  ++ optionals withOpencl [ ocl-icd opencl-headers ]
+  ++ optionals withOpencoreAmrnb [ opencore-amr ]
+  ++ optionals withOpengl [ libGL libGLU ]
+  ++ optionals withOpenh264 [ openh264 ]
+  ++ optionals withOpenjpeg [ openjpeg ]
+  ++ optionals withOpenmpt [ libopenmpt ]
+  ++ optionals withOpus [ libopus ]
+  ++ optionals withPulse [ libpulseaudio ]
+  ++ optionals withRav1e [ rav1e ]
+  ++ optionals withRtmp [ rtmpdump ]
+  ++ optionals withSamba [ samba ]
+  ++ optionals withSdl2 [ SDL2 ]
+  ++ optionals withSoxr [ soxr ]
+  ++ optionals withSpeex [ speex ]
+  ++ optionals withSrt [ srt ]
+  ++ optionals withSsh [ libssh ]
+  ++ optionals withSvg [ librsvg ]
+  ++ optionals withSvtav1 [ svt-av1 ]
+  ++ optionals withTheora [ libtheora ]
+  ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
+  ++ optionals withVdpau [ libvdpau ]
+  ++ optionals withVidStab [ vid-stab ]
+  ++ optionals withVmaf [ libvmaf ]
+  ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
+  ++ optionals withVorbis [ libvorbis ]
+  ++ optionals withVpx [ libvpx ]
+  ++ optionals withV4l2 [ libv4l ]
+  ++ optionals withVulkan [ vulkan-loader ]
+  ++ optionals withWebp [ libwebp ]
+  ++ optionals withX264 [ x264 ]
+  ++ optionals withX265 [ x265 ]
+  ++ optionals withXavs [ xavs ]
+  ++ optionals withXcb [ libxcb ]
+  ++ optionals withXlib [ libX11 libXv libXext ]
+  ++ optionals withXml2 [ libxml2 ]
+  ++ optionals withXvid [ xvidcore ]
+  ++ optionals withZimg [ zimg ]
+  ++ optionals withZlib [ zlib ]
+  ++ optionals withZmq [ zeromq4 ]
+  ++ optionals stdenv.isDarwin [
+    # TODO fine-grained flags
+    AVFoundation
+    Cocoa
+    CoreAudio
+    CoreMedia
+    CoreServices
+    MediaToolbox
+    VideoDecodeAcceleration
+    VideoToolbox
+  ];
+
+  buildFlags = [ "all" ]
+    ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
+
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+
+  # Fails with SIGABRT otherwise FIXME: Why?
+  checkPhase = let
+    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+    libsToLink = [ ]
+      ++ optional buildAvcodec "libavcodec"
+      ++ optional buildAvdevice "libavdevice"
+      ++ optional buildAvfilter "libavfilter"
+      ++ optional buildAvformat "libavformat"
+      ++ optional buildAvresample "libavresample"
+      ++ optional buildAvutil "libavutil"
+      ++ optional buildPostproc "libpostproc"
+      ++ optional buildSwresample "libswresample"
+      ++ optional buildSwscale "libswscale"
+    ;
+  in ''
+    ${ldLibraryPathEnv}="${lib.concatStringsSep ":" libsToLink}" make check -j$NIX_BUILD_CORES
+  '';
+
+  outputs = optionals withBin [ "bin" ] # The first output is the one that gets symlinked by default!
+    ++ optionals withLib [ "lib" "dev" ]
+    ++ optionals withDoc [ "doc" ]
+    ++ optionals withManPages [ "man" ]
+    ++ [ "data" "out" ] # We need an "out" output because we get an error otherwise. It's just an empty dir.
+  ;
+
+  postInstall = optionalString buildQtFaststart ''
+    install -D tools/qt-faststart -t $bin/bin
+  '';
+
+  # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
+  # See the explanation in addOpenGLRunpath.
+  postFixup = optionalString stdenv.isLinux ''
     addOpenGLRunpath $out/lib/libavcodec.so
     addOpenGLRunpath $out/lib/libavutil.so
   '';
 
-  installFlags = [ "install-man" ];
-
-  passthru = {
-    inherit vaapiSupport vdpauSupport;
-  };
+  enableParallelBuilding = true;
 
   meta = with lib; {
     description = "A complete, cross-platform solution to record, convert and stream audio and video";
@@ -212,9 +667,11 @@ stdenv.mkDerivation rec {
       No matter if they were designed by some standards committee, the community or
       a corporation.
     '';
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ ];
+    license = with licenses; [ lgpl21Plus ]
+      ++ optional withGPL gpl2Plus
+      ++ optional withGPLv3 gpl3Plus
+      ++ optional withUnfree unfreeRedistributable;
     platforms = platforms.all;
-    inherit branch knownVulnerabilities;
+    maintainers = with maintainers; [ atemu ];
   };
 }
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index 61106d7f620e..5400c1de5927 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -47,6 +47,15 @@ stdenv.mkDerivation rec {
     sha256 = "zd6A0VpJ2rmmFO+Y+ATIzm5M/hM5o8JAw08/tFQ2uF0=";
   };
 
+  patches = [
+    (fetchurl {
+      name = "libraw.patch";
+      url = "https://src.fedoraproject.org/cgit/rpms/gegl04.git/plain/"
+          + "libraw.patch?id=5efd0c16a7b0e73abcaecc48af544ef027f4531b";
+      hash = "sha256-ZgVigN1T7JmeBMwSdBsMsmXx0h7UW4Ft9HlSqeB0se8=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     gettext
diff --git a/pkgs/development/libraries/gloox/default.nix b/pkgs/development/libraries/gloox/default.nix
index 8fc57d865fd7..69243a13ef30 100644
--- a/pkgs/development/libraries/gloox/default.nix
+++ b/pkgs/development/libraries/gloox/default.nix
@@ -14,6 +14,13 @@ stdenv.mkDerivation rec{
     sha256 = "1jgrd07qr9jvbb5hcmhrqz4w4lvwc51m30jls1fgxf1f5az6455f";
   };
 
+  # needed since gcc12
+  postPatch = ''
+    sed '1i#include <ctime>' -i \
+      src/tests/{tag/tag_perf.cpp,zlib/zlib_perf.cpp} \
+      src/examples/*.cpp
+  '';
+
   buildInputs = [ ]
     ++ lib.optional zlibSupport zlib
     ++ lib.optional sslSupport openssl
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index 0d14630bda3b..590a4508c9b9 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "gsl";
   version = "2.7.1";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnu/gsl/${pname}-${version}.tar.gz";
     sha256 = "sha256-3LD71DBIgyt1f/mUJpGo3XACbV2g/4VgHlJof23us0s=";
@@ -13,6 +15,10 @@ stdenv.mkDerivation rec {
     MACOSX_DEPLOYMENT_TARGET=10.16
   '' else null;
 
+  postInstall = ''
+    moveToOutput bin/gsl-config "$dev"
+  '';
+
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isx86_64 "-mno-fma";
 
diff --git a/pkgs/development/libraries/gsmlib/default.nix b/pkgs/development/libraries/gsmlib/default.nix
index ec6646d98f57..f993eeedc33b 100644
--- a/pkgs/development/libraries/gsmlib/default.nix
+++ b/pkgs/development/libraries/gsmlib/default.nix
@@ -2,13 +2,21 @@
 stdenv.mkDerivation rec {
   pname = "gsmlib";
   version = "unstable-2017-10-06";
+
   src = fetchFromGitHub {
     owner = "x-logLT";
     repo = "gsmlib";
     rev = "4f794b14450132f81673f7d3570c5a859aecf7ae";
     sha256 = "16v8aj914ac1ipf14a867ljib3gy7fhzd9ypxnsg9l0zi8mm3ml5";
   };
+
   nativeBuildInputs = [ autoreconfHook ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   meta = with lib; {
     description = "Library to access GSM mobile phones through GSM modems";
     homepage = "https://github.com/x-logLT/gsmlib";
diff --git a/pkgs/development/libraries/gtest/default.nix b/pkgs/development/libraries/gtest/default.nix
index 049d202a71ec..8e60c08d3600 100644
--- a/pkgs/development/libraries/gtest/default.nix
+++ b/pkgs/development/libraries/gtest/default.nix
@@ -19,7 +19,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ninja ];
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+  ] ++ lib.optionals (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0")) [
+    # Enable C++17 support
+    # https://github.com/google/googletest/issues/3081
+    "-DCMAKE_CXX_STANDARD=17"
+  ];
 
   meta = with lib; {
     description = "Google's framework for writing C++ tests";
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 782823cd6748..7a9904f31dab 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -90,7 +90,6 @@ stdenv.mkDerivation rec {
   # Slightly hacky; some pkgs expect them in a single directory.
   postFixup = lib.optionalString withIcu ''
     rm "$out"/lib/libharfbuzz.* "$dev/lib/pkgconfig/harfbuzz.pc"
-    ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.la
     ln -s {'${harfbuzz.dev}',"$dev"}/lib/pkgconfig/harfbuzz.pc
     ${lib.optionalString stdenv.isDarwin ''
       ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.dylib
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index 66441a911607..324b4337c874 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, ncurses, readline, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "1.7.1";
+  version = "1.7.2";
   pname = "hunspell";
 
   src = fetchFromGitHub {
     owner = "hunspell";
     repo = "hunspell";
     rev = "v${version}";
-    sha256 = "sha256-J1kgNUElRO63mtU62qU7asf7hht9oyplMIO9I/E6BPU=";
+    sha256 = "sha256-x2FXxnVIqsf5/UEQcvchAndXBv/3mW8Z55djQAFgNA8=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/development/libraries/iqueue/default.nix b/pkgs/development/libraries/iqueue/default.nix
index 04fd7202d1d1..ab873f82c579 100644
--- a/pkgs/development/libraries/iqueue/default.nix
+++ b/pkgs/development/libraries/iqueue/default.nix
@@ -12,6 +12,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libbsd microsoft_gsl ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-parameter"
+    "-Wno-error=misleading-indentation"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/twosigma/iqueue";
     description = "Indexed queue";
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 22b29151caa5..4caea890e705 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "krb5-${version}/src";
 
+  postPatch = ''
+    substituteInPlace config/shlib.conf \
+        --replace "'ld " "'${stdenv.cc.targetPrefix}ld "
+  '';
+
   libFolders = [ "util" "include" "lib" "build-tools" ];
 
   buildPhase = lib.optionalString libOnly ''
diff --git a/pkgs/development/libraries/libassuan/default.nix b/pkgs/development/libraries/libassuan/default.nix
index 3a00ca498cbe..e2fbb3f9287c 100644
--- a/pkgs/development/libraries/libassuan/default.nix
+++ b/pkgs/development/libraries/libassuan/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ npth gettext ];
 
   configureFlags = [
+    # Required for cross-compilation.
     "--with-libgpg-error-prefix=${libgpg-error.dev}"
   ];
 
diff --git a/pkgs/development/libraries/libbladeRF/default.nix b/pkgs/development/libraries/libbladeRF/default.nix
index 4b2c48824fb7..e5e51a447b48 100644
--- a/pkgs/development/libraries/libbladeRF/default.nix
+++ b/pkgs/development/libraries/libbladeRF/default.nix
@@ -46,6 +46,11 @@ in stdenv.mkDerivation rec {
     "-DBLADERF_GROUP=bladerf"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   hardeningDisable = [ "fortify" ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index d03783f2fd90..11c8ce9e097e 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-0/wvH07bJRKFwYnOARRJNzH8enIX3TNnWQnJdfpfvgE=";
   };
 
+  outputs = [ "out" "dev" "doc" ];
+
   postPatch = ''
     patchShebangs utils/
   '';
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 7abbd944ed01..8f8e33cbeab4 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -13,28 +13,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "0.10.0";
+  version = "unstable-2023-01-29"; # Musl fix hasn't been released yet.
 
   src = fetchFromGitHub {
     owner = "PJK";
-    repo = finalAttrs.pname;
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-YJSIZ7o191/0QJf1fH6LUYykS2pvP17knSeRO2WcDeM=";
+    repo = "libcbor";
+    rev = "cb4162f40d94751141b4d43b07c4add83e738a68";
+    sha256 = "sha256-ZTa+wG1g9KsVoqJG/yqxo2fJ7OhPnaI9QcfOmpOT3pg=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-    "-DBUILD_SHARED_LIBS=on"
-  ] ++ lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON";
+  cmakeFlags = lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON"
+    ++ lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS=ON";
 
-  # 2 tests are not 32-bit clean: overflow size_t:
-  #   https://github.com/PJK/libcbor/issues/263
-  doCheck =
-    !stdenv.hostPlatform.is32bit
-    && (!stdenv.hostPlatform.isStatic)
+  # Tests are restricted while pkgsStatic.cmocka is broken. Tracked at:
+  # https://github.com/NixOS/nixpkgs/issues/213623
+  doCheck = !stdenv.hostPlatform.isStatic
     && stdenv.hostPlatform == stdenv.buildPlatform;
+
   nativeCheckInputs = [ cmocka ];
 
   passthru.tests = {
diff --git a/pkgs/development/libraries/libcli/default.nix b/pkgs/development/libraries/libcli/default.nix
index da076a590e19..6e38c1ab84f1 100644
--- a/pkgs/development/libraries/libcli/default.nix
+++ b/pkgs/development/libraries/libcli/default.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "AR=${stdenv.cc.targetPrefix}ar" "PREFIX=$(out)" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+  ];
+
   meta = with lib; {
     description = "Emulate a Cisco-style telnet command-line interface";
     homepage = "http://sites.dparrish.com/libcli";
diff --git a/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch b/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
index e12b584d16eb..19aa27b549c2 100644
--- a/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
+++ b/pkgs/development/libraries/libcryptui/fix-latest-gnupg.patch
@@ -17,7 +17,7 @@ index 4486e7b2..be5b28b4 100644
  
  if test	"$DO_CHECK" = "yes"; then
 -	accepted_versions="1.2 1.4 2.0"
-+	accepted_versions="1.2 1.4 2.0 2.2 2.3"
++	accepted_versions="1.2 1.4 2.0 2.2 2.3 2.4"
  	AC_PATH_PROGS(GNUPG, [gpg gpg2], no)
  	AC_DEFINE_UNQUOTED(GNUPG, "$GNUPG", [Path to gpg executable.])
  	ok="no"
diff --git a/pkgs/development/libraries/libdatrie/default.nix b/pkgs/development/libraries/libdatrie/default.nix
index 257673b1a96d..57d30124a6fd 100644
--- a/pkgs/development/libraries/libdatrie/default.nix
+++ b/pkgs/development/libraries/libdatrie/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  buildInputs = [ libiconv ];
 
   preAutoreconf = let
     reports = "https://github.com/tlwg/libdatrie/issues";
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 18b8d6ba5d6f..7cbcbe238ea1 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 
@@ -12,16 +13,25 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.9";
+  version = "1.0.10";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "sha256-OpiQapppuKCR27tIG5OW+KiNMP9ysv7CaobiBOW6VUI=";
+    sha256 = "sha256-d2TJKPvOAqLe+ZO1+Rd/yRIn3W1u1q62ZH20/9N2Shw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "revert-cmake-change-pkg-config.patch";
+      url = "https://github.com/strukturag/libde265/commit/388b61459c2abe2b949114ab54e83fb4dbfa8ba0.patch";
+      sha256 = "sha256-b6wwSvZpK7lIu0uD1SqK2zGBUjb/25+JW1Pf1fvHc0I=";
+      revert = true;
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libdynd/default.nix b/pkgs/development/libraries/libdynd/default.nix
index b418279e477b..6018e00f944e 100644
--- a/pkgs/development/libraries/libdynd/default.nix
+++ b/pkgs/development/libraries/libdynd/default.nix
@@ -15,14 +15,17 @@ stdenv.mkDerivation rec {
     "-DDYND_BUILD_BENCHMARKS=OFF"
   ];
 
-  # added to fix build with gcc7+
   NIX_CFLAGS_COMPILE = builtins.toString [
+    # added to fix build with gcc7+
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=nonnull"
     "-Wno-error=tautological-compare"
     "-Wno-error=class-memaccess"
     "-Wno-error=parentheses"
     "-Wno-error=deprecated-copy"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=maybe-uninitialized"
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libepoxy/default.nix b/pkgs/development/libraries/libepoxy/default.nix
index 196ac1afaae5..8b35097778de 100644
--- a/pkgs/development/libraries/libepoxy/default.nix
+++ b/pkgs/development/libraries/libepoxy/default.nix
@@ -50,8 +50,10 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dtests=${if doCheck then "true" else "false"}"
+    "-Degl=${if x11Support then "yes" else "no"}"
     "-Dglx=${if x11Support then "yes" else "no"}"
+    "-Dtests=${lib.boolToString doCheck}"
+    "-Dx11=${lib.boolToString x11Support}"
   ];
 
   NIX_CFLAGS_COMPILE = lib.optionalString x11Support ''-DLIBGL_PATH="${getLib libGL}/lib"'';
diff --git a/pkgs/development/libraries/libfaketime/default.nix b/pkgs/development/libraries/libfaketime/default.nix
index ac501c660b02..e58c74f2c675 100644
--- a/pkgs/development/libraries/libfaketime/default.nix
+++ b/pkgs/development/libraries/libfaketime/default.nix
@@ -1,19 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, perl, coreutils }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "libfaketime";
-  version = "0.9.9";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "wolfcw";
     repo = "libfaketime";
     rev = "v${version}";
-    sha256 = "sha256-P1guVggteGtoq8+eeE966hDPkRwsn0m7oLCohyPrIb4=";
+    sha256 = "sha256-DYRuQmIhQu0CNEboBAtHOr/NnWxoXecuPMSR/UQ/VIQ=";
   };
 
   patches = [
-    ./no-date-in-gzip-man-page.patch
     ./nix-store-date.patch
+    (fetchpatch {
+      name = "0001-libfaketime.c-wrap-timespec_get-in-TIME_UTC-macro.patch";
+      url = "https://github.com/wolfcw/libfaketime/commit/e0e6b79568d36a8fd2b3c41f7214769221182128.patch";
+      sha256 = "sha256-KwwP76v0DXNW73p/YBvwUOPdKMAcVdbQSKexD/uFOYo=";
+    })
   ] ++ (lib.optionals stdenv.cc.isClang [
     # https://github.com/wolfcw/libfaketime/issues/277
     ./0001-Remove-unsupported-clang-flags.patch
diff --git a/pkgs/development/libraries/libfaketime/nix-store-date.patch b/pkgs/development/libraries/libfaketime/nix-store-date.patch
index b88245dfe8fb..e93a7ec76507 100644
--- a/pkgs/development/libraries/libfaketime/nix-store-date.patch
+++ b/pkgs/development/libraries/libfaketime/nix-store-date.patch
@@ -13,9 +13,9 @@ index af618f2..48e47da 100644
 +++ b/src/faketime.c
 @@ -50,11 +50,7 @@
  
- const char version[] = "0.9.9";
+ const char version[] = "0.9.10";
  
--#ifdef __APPLE__
+-#if (defined __APPLE__) || (defined __sun)
 -static const char *date_cmd = "gdate";
 -#else
 -static const char *date_cmd = "date";
diff --git a/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch b/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch
deleted file mode 100644
index 7b7e362fbf0f..000000000000
--- a/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -ur libfaketime-0.9.5.orig/man/Makefile libfaketime-0.9.5/man/Makefile
---- libfaketime-0.9.5.orig/man/Makefile	2013-10-13 11:19:30.000000000 +0200
-+++ libfaketime-0.9.5/man/Makefile	2014-04-13 01:22:14.362296519 +0200
-@@ -6,7 +6,7 @@
- 
- install:
- 	$(INSTALL) -Dm0644 faketime.1 "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
--	gzip -f "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
-+	gzip -9nf "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
- 
- uninstall:
- 	rm -f "${DESTDIR}${PREFIX}/share/man/man1/faketime.1.gz"
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index bf43bb1b50e4..0b983e6edf41 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "glvnd";
     repo = "libglvnd";
     rev = "v${version}";
-    sha256 = "sha256-yXSuG8UwD5KZbn4ysDStTdOGD4uHigjOhazlHT9ndNs=";
+    sha256 = "sha256-p/vLxagN9nCYw1JpUmZetgctQbrp3Wo33OVFrtvmnjQ=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config python3 addOpenGLRunpath ];
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index fcd7946a1351..d8c5d87b1656 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -17,17 +17,22 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.45";
+  version = "1.46";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Vw+O5PtL/3t0lc/5IMJ1ACrqIUfpodIgwGghMmf4CiY=";
+    sha256 = "sha256-t+EaZCRrvl7zd0jeQ7JFq9cs/NU8muXn/FylnxyBJo0=";
   };
 
   postPatch = ''
     sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
   '';
 
+  configureFlags = [
+    # See https://dev.gnupg.org/T6257#164567
+    "--enable-install-gpg-error-config"
+  ];
+
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev"; # deps want just the lib, most likely
 
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index 3dddc02aeabd..10a12dbfa771 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -25,11 +25,11 @@ let
   ;
 in stdenv.mkDerivation rec {
   pname = "libpsl";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchurl {
     url = "https://github.com/rockdaboot/libpsl/releases/download/${version}/libpsl-${version}.tar.lz";
-    sha256 = "1a9kp2rj71jb9q030lmp3zhy33rqxscawbfzhp288fxvazapahv4";
+    sha256 = "sha256-qj1wbEUnhtE0XglNriAc022B8Dz4HWNtXPwQ02WQfxc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libraw/default.nix b/pkgs/development/libraries/libraw/default.nix
index 758b00febf5f..26d7616ba8f0 100644
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, lcms2, pkg-config }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "libraw";
-  version = "0.20.2.p2";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "LibRaw";
     repo = "LibRaw";
-    rev = "fedad11e87daad7b7d389a3ef84ccf10b5e84710"; # current 0.20-stable branch
-    sha256 = "1mklf8lzybzyg75ja34822xlv6h9nw93griyrjjna7darl1dyvja";
+    rev = version;
+    sha256 = "sha256-K9mULf6V/TCl5Vu4iuIdSGF9HzQlgNQLRFHIpNbmAlY";
   };
 
   outputs = [ "out" "lib" "dev" "doc" ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others)";
     homepage = "https://www.libraw.org/";
-    license = licenses.gpl2Plus;
+    license = with licenses; [ cddl lgpl2Plus ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libraw/unstable.nix b/pkgs/development/libraries/libraw/unstable.nix
deleted file mode 100644
index 3f19bb53c4e6..000000000000
--- a/pkgs/development/libraries/libraw/unstable.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ libraw, fetchFromGitHub }:
-
-libraw.overrideAttrs (_: rec {
-  version = "unstable-2021-12-03";
-
-  src = fetchFromGitHub {
-    owner = "LibRaw";
-    repo = "LibRaw";
-    rev = "52b2fc52e93a566e7e05eaa44cada58e3360b6ad";
-    sha256 = "kW0R4iPuqnFuWYDrl46ok3kaPcGgY2MqZT7mqVX+BDQ=";
-  };
-})
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index dd202d4a2954..b1cb2fc4570c 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh";
-  version = "0.10.0";
+  version = "0.10.4";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-DcFYxTTNg4rQt4WoLexYbeQNp+CWUjrmwIybe9KvC1c=";
+    sha256 = "sha256-BzksVKthR2KI0cHwp8VXtQIReXrQDDTDryu8TbxL2X0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 892ed71583d3..f2147632eb7c 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitLab
+, fetchpatch
 , nix-update-script
 
 , autoreconfHook
@@ -38,6 +39,11 @@ stdenv.mkDerivation rec {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2022-48281.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5.diff";
+      sha256 = "sha256-FWUlyJyHXac6fuM5f9PG33kcF5Bm4fyFmYnaDal46iM=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 7da2c46fafe2..8c899268f7d1 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -37,7 +37,8 @@ stdenv.mkDerivation rec {
         ./unistdio/test-u16-vasnprintf3.sh: line 16: ./test-u16-vasnprintf1: No such file or directory
         FAIL unistdio/test-u16-vasnprintf3.sh (exit status: 1)
   */
-  enableParallelBuilding = false;
+  enableParallelChecking = false;
+  enableParallelBuilding = true;
 
   meta = {
     homepage = "https://www.gnu.org/software/libunistring/";
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index a350cd378bce..8a86bc46d4da 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices, pkgsStatic }:
 
 stdenv.mkDerivation rec {
   version = "1.44.2";
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-K6v+00basjI32ON27ZjC5spQi/zWCcslDwQwyosq2iY=";
   };
 
+  patches = [
+    # Fix tests for statically linked variant upstream PR is
+    # https://github.com/libuv/libuv/pull/3735
+    (fetchpatch {
+      url = "https://github.com/libuv/libuv/commit/9d898acc564351dde74e9ed9865144e5c41f5beb.patch";
+      sha256 = "sha256-6XsjrseD8a+ny887EKOX0NmHocLMXGf2YL13vkNHUZ0=";
+    })
+  ];
+
   postPatch = let
     toDisable = [
       "getnameinfo_basic" "udp_send_hang_loop" # probably network-dependent
@@ -21,6 +30,10 @@ stdenv.mkDerivation rec {
       "get_passwd" # passed on NixOS but failed on other Linuxes
       "tcp_writealot" "udp_multicast_join" "udp_multicast_join6" # times out sometimes
       "fs_fstat" # https://github.com/libuv/libuv/issues/2235#issuecomment-1012086927
+
+      # Assertion failed in test/test-tcp-bind6-error.c on line 60: r == UV_EADDRINUSE
+      # Assertion failed in test/test-tcp-bind-error.c on line 99: r == UV_EADDRINUSE
+      "tcp_bind6_error_addrinuse" "tcp_bind_error_addrinuse_listen"
     ] ++ lib.optionals stdenv.isDarwin [
         # Sometimes: timeout (no output), failed uv_listen. Someone
         # should report these failures to libuv team. There tests should
@@ -66,6 +79,8 @@ stdenv.mkDerivation rec {
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
 
+  passthru.tests.static = pkgsStatic.libuv;
+
   meta = with lib; {
     description = "A multi-platform support library with a focus on asynchronous I/O";
     homepage    = "https://libuv.org/";
diff --git a/pkgs/development/libraries/libvisual/default.nix b/pkgs/development/libraries/libvisual/default.nix
index 3e61ee8a6a13..f32ee433694c 100644
--- a/pkgs/development/libraries/libvisual/default.nix
+++ b/pkgs/development/libraries/libvisual/default.nix
@@ -1,18 +1,22 @@
-{ lib, stdenv, fetchurl, pkg-config, glib }:
+{ lib
+, stdenv
+, fetchurl
+, SDL
+, glib
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
   pname = "libvisual";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/libvisual/${pname}-${version}.tar.gz";
-    sha256 = "1my1ipd5k1ixag96kwgf07bgxkjlicy9w22jfxb2kq95f6wgsk8b";
+    hash = "sha256-qhKHdBf3bTZC2fTHIzAjgNgzF1Y51jpVZB0Bkopd230=";
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib ];
-
-  hardeningDisable = [ "format" ];
+  buildInputs = [ SDL glib ];
 
   configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index ca16063cca6b..bbbceab3ab78 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -8,11 +8,11 @@
 stdenv.mkDerivation rec {
   pname = "libvterm-neovim";
   # Releases are not tagged, look at commit history to find latest release
-  version = "0.3";
+  version = "0.3.1";
 
   src = fetchurl {
     url = "https://www.leonerd.org.uk/code/libvterm/libvterm-${version}.tar.gz";
-    sha256 = "sha256-YesNZijFK98CkA39RGiqhqGnElIourimcyiYGIdIM1g=";
+    sha256 = "sha256-JaitnBVIU2jf0Kip3KGuyP6lwn2j+nTsUY1dN4fww5c=";
   };
 
   nativeBuildInputs = [ perl libtool ];
diff --git a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
index 6578a86e35b1..3997ceb623f3 100644
--- a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
+++ b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     "--with-x-locale-root=${libX11.out}/share/X11/locale"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   preBuild = lib.optionalString stdenv.isDarwin ''
     sed -i 's/,--version-script=.*$//' Makefile
   '';
diff --git a/pkgs/development/libraries/maplibre-gl-native/default.nix b/pkgs/development/libraries/maplibre-gl-native/default.nix
index 568f3fbe64e2..8d6c0664ca13 100644
--- a/pkgs/development/libraries/maplibre-gl-native/default.nix
+++ b/pkgs/development/libraries/maplibre-gl-native/default.nix
@@ -9,6 +9,7 @@
 , libuv
 , glfw3
 , rapidjson
+, stdenv
 }:
 
 mkDerivation rec {
@@ -55,6 +56,11 @@ mkDerivation rec {
     "-DMBGL_WITH_QT_HEADLESS=OFF"
   ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=use-after-free"
+  ];
+
   meta = with lib; {
     description = "Open-source alternative to Mapbox GL Native";
     homepage = "https://maplibre.org/";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 56fa74e5c0c5..52633a6d2164 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -28,9 +28,9 @@
       "tegra" # Nvidia Tegra SoCs
       "v3d" # Broadcom VC5 (Raspberry Pi 4)
       "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
-    ] ++ lib.optionals stdenv.isx86_64 [
-      "iris" # new Intel, could work on non-x86_64 with PCIe cards, but doesn't build as of 22.3.4
-      "crocus" # Intel legacy, x86_64 only
+    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+      "iris" # new Intel, could work on non-x86 with PCIe cards, but doesn't build as of 22.3.4
+      "crocus" # Intel legacy, x86 only
     ]
   else [ "auto" ]
 , vulkanDrivers ?
@@ -326,10 +326,6 @@ self = stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [ "-fno-common" ] ++ lib.optionals enableOpenCL [
     "-UPIPE_SEARCH_DIR"
     "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
-
-    # Work around regression from https://github.com/NixOS/nixpkgs/pull/210004
-    # TODO(trofi): remove
-    "--sysroot=/"
   ];
 
   passthru = {
diff --git a/pkgs/development/libraries/newt/default.nix b/pkgs/development/libraries/newt/default.nix
index 6114c4c70d0f..3ba07c7b5be9 100644
--- a/pkgs/development/libraries/newt/default.nix
+++ b/pkgs/development/libraries/newt/default.nix
@@ -5,11 +5,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "newt";
-  version = "0.52.21";
+  version = "0.52.23";
 
   src = fetchurl {
     url = "https://releases.pagure.org/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0cdvbancr7y4nrj8257y5n45hmhizr8isynagy4fpsnpammv8pi6";
+    sha256 = "sha256-yqNykHsU7Oz+KY8NUSpi9B0zspBhAkSliu0Hu8WtoSo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/octomap/default.nix b/pkgs/development/libraries/octomap/default.nix
index 9b1635511ec6..5a2064eb595d 100644
--- a/pkgs/development/libraries/octomap/default.nix
+++ b/pkgs/development/libraries/octomap/default.nix
@@ -10,10 +10,16 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     hash = "sha256-qE5i4dGugm7tR5tgDCpbla/R7hYR/PI8BzrZQ4y6Yz8=";
   };
+
   sourceRoot = "source/octomap";
 
   nativeBuildInputs = [ cmake ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
   meta = with lib; {
     description = "A probabilistic, flexible, and compact 3D mapping library for robotic systems";
     homepage = "https://octomap.github.io/";
diff --git a/pkgs/development/libraries/openbabel/2.nix b/pkgs/development/libraries/openbabel/2.nix
index 3e989561470c..0cc752d993fb 100644
--- a/pkgs/development/libraries/openbabel/2.nix
+++ b/pkgs/development/libraries/openbabel/2.nix
@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i include/openbabel/obutil.h # gcc12
+  '';
+
   buildInputs = [ zlib libxml2 eigen python3 cairo pcre ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/openbabel/default.nix b/pkgs/development/libraries/openbabel/default.nix
index a23382d3f892..fe12bbffa531 100644
--- a/pkgs/development/libraries/openbabel/default.nix
+++ b/pkgs/development/libraries/openbabel/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wQpgdfCyBAoh4pmj9j7wPTlMtraJ62w/EShxi/olVMY=";
   };
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i include/openbabel/obutil.h # gcc12
+  '';
+
   buildInputs = [ zlib libxml2 eigen python cairo pcre swig rapidjson ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 2c676e008f00..4a9af9a5388f 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -15,6 +15,7 @@
 , ocl-icd
 , buildPackages
 , qimgv
+, opencv4
 
 , enableJPEG ? true
 , libjpeg
@@ -31,8 +32,8 @@
 , openjpeg
 , enableEigen ? true
 , eigen
-, enableOpenblas ? true
-, openblas
+, enableBlas ? true
+, blas
 , enableContrib ? true
 
 , enableCuda ? (config.cudaSupport or false) && stdenv.hostPlatform.isx86_64
@@ -74,6 +75,7 @@
 , CoreMedia
 , MediaToolbox
 , bzip2
+, callPackage
 }:
 
 let
@@ -93,6 +95,13 @@ let
     sha256 = "sha256-meya0J3RdOIeMM46e/6IOVwrKn3t/c0rhwP2WQaybkE=";
   };
 
+  testDataSrc = fetchFromGitHub {
+    owner = "opencv";
+    repo = "opencv_extra";
+    rev = version;
+    sha256 = "sha256-6hAdJdaUgtRGQanQKuY/q6fcXWXFZ3K/oLbGxvksry0=";
+  };
+
   # Contrib must be built in order to enable Tesseract support:
   buildContrib = enableContrib || enableTesseract || enableOvis;
 
@@ -171,10 +180,10 @@ let
   ade = rec {
     src = fetchurl {
       url = "https://github.com/opencv/ade/archive/${name}";
-      sha256 = "04n9na2bph706bdxnnqfcbga4cyj8kd9s9ni7qyvnpj5v98jwvlm";
+      sha256 = "sha256-TjLRbFbC7MDY9PxIy560ryviBI58cbQwqgc7A7uOHkg=";
     };
-    name = "v0.1.1f.zip";
-    md5 = "b624b995ec9c439cbc2e9e6ee940d3a2";
+    name = "v0.1.2a.zip";
+    md5 = "fa4b3e25167319cb0fa9432ef8281945";
     dst = ".cache/ade";
   };
 
@@ -208,13 +217,24 @@ let
 
   opencvFlag = name: enabled: "-DWITH_${name}=${printEnabled enabled}";
 
+  runAccuracyTests = true;
+  runPerformanceTests = false;
   printEnabled = enabled: if enabled then "ON" else "OFF";
+  withOpenblas = (enableBlas && blas.provider.pname == "openblas");
+  #multithreaded openblas conflicts with opencv multithreading, which manifest itself in hung tests
+  #https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+  openblas_ = blas.provider.override { singleThreaded = true; };
 in
 
 stdenv.mkDerivation {
   pname = "opencv";
   inherit version src;
 
+  outputs = [
+    "out"
+    "package_tests"
+  ];
+
   postUnpack = lib.optionalString buildContrib ''
     cp --no-preserve=mode -r "${contribSrc}/modules" "$NIX_BUILD_TOP/source/opencv_contrib"
   '';
@@ -263,12 +283,12 @@ stdenv.mkDerivation {
     ++ lib.optional enableFfmpeg ffmpeg
     ++ lib.optionals (enableFfmpeg && stdenv.isDarwin)
       [ VideoDecodeAcceleration bzip2 ]
-    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base ])
+    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ])
     ++ lib.optional enableOvis ogre
     ++ lib.optional enableGPhoto2 libgphoto2
     ++ lib.optional enableDC1394 libdc1394
     ++ lib.optional enableEigen eigen
-    ++ lib.optional enableOpenblas openblas
+    ++ lib.optional enableBlas blas.provider
     # There is seemingly no compile-time flag for Tesseract.  It's
     # simply enabled automatically if contrib is built, and it detects
     # tesseract & leptonica.
@@ -290,7 +310,8 @@ stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
-  OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
+  OpenBLAS_HOME = lib.optionalString withOpenblas openblas_.dev;
+  OpenBLAS = lib.optionalString withOpenblas openblas_;
 
   cmakeFlags = [
     "-DOPENCV_GENERATE_PKGCONFIG=ON"
@@ -299,8 +320,9 @@ stdenv.mkDerivation {
     "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf}"
     "-DPROTOBUF_UPDATE_FILES=ON"
     "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
-    "-DBUILD_TESTS=OFF"
-    "-DBUILD_PERF_TESTS=OFF"
+    "-DBUILD_TESTS=${printEnabled runAccuracyTests}"
+    "-DBUILD_PERF_TESTS=${printEnabled runPerformanceTests}"
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
     "-DBUILD_DOCS=${printEnabled enableDocs}"
     # "OpenCV disables pkg-config to avoid using of host libraries. Consider using PKG_CONFIG_LIBDIR to specify target SYSROOT"
     # but we have proper separation of build and host libs :), fixes cross
@@ -334,6 +356,14 @@ stdenv.mkDerivation {
     make doxygen
   '';
 
+  preInstall =
+    lib.optionalString (runAccuracyTests || runPerformanceTests) ''
+    mkdir $package_tests
+    cp -R $src/samples $package_tests/
+    ''
+    + lib.optionalString runAccuracyTests "mv ./bin/*test* $package_tests/ \n"
+    + lib.optionalString runPerformanceTests "mv ./bin/*perf* $package_tests/";
+
   # By default $out/lib/pkgconfig/opencv4.pc looks something like this:
   #
   #   prefix=/nix/store/g0wnfyjjh4rikkvp22cpkh41naa43i4i-opencv-4.0.0
@@ -368,16 +398,23 @@ stdenv.mkDerivation {
 
   passthru = {
     tests = {
-      inherit qimgv;
       inherit (gst_all_1) gst-plugins-bad;
-    } // lib.optionalAttrs (!enablePython) { pythonEnabled = pythonPackages.opencv4; };
+    }
+    // lib.optionalAttrs (!stdenv.isDarwin) { inherit qimgv; }
+    // lib.optionalAttrs (!enablePython) { pythonEnabled = pythonPackages.opencv4; }
+    // lib.optionalAttrs (stdenv.buildPlatform != "x86_64-darwin") {
+      opencv4-tests = callPackage ./tests.nix {
+        inherit enableGStreamer enableGtk2 enableGtk3 runAccuracyTests runPerformanceTests testDataSrc;
+        inherit opencv4;
+        };
+      };
   } // lib.optionalAttrs enablePython { pythonPath = [ ]; };
 
   meta = with lib; {
     description = "Open Computer Vision Library with more than 500 algorithms";
     homepage = "https://opencv.org/";
     license = with licenses; if enableUnfree then unfree else bsd3;
-    maintainers = with maintainers; [ mdaiter basvandijk ];
+    maintainers = with maintainers; [ basvandijk ];
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/libraries/opencv/tests.nix b/pkgs/development/libraries/opencv/tests.nix
new file mode 100644
index 000000000000..5a155a9119b0
--- /dev/null
+++ b/pkgs/development/libraries/opencv/tests.nix
@@ -0,0 +1,70 @@
+{ opencv4
+, testDataSrc
+, stdenv
+, lib
+, runCommand
+, gst_all_1
+, runAccuracyTests
+, runPerformanceTests
+, enableGStreamer
+, enableGtk2
+, enableGtk3
+, xvfb-run
+}:
+let
+  testNames = [
+    "calib3d"
+    "core"
+    "features2d"
+    "flann"
+    "imgcodecs"
+    "imgproc"
+    "ml"
+    "objdetect"
+    "photo"
+    "stitching"
+    "video"
+    #"videoio" # - a lot of GStreamer warnings and failed tests
+    #"dnn" #- some caffe tests failed, probably because github workflow also downloads additional models
+  ] ++ lib.optionals (!stdenv.isAarch64 && enableGStreamer) [ "gapi" ]
+  ++ lib.optionals (enableGtk2 || enableGtk3) [ "highgui" ];
+  perfTestNames = [
+    "calib3d"
+    "core"
+    "features2d"
+    "imgcodecs"
+    "imgproc"
+    "objdetect"
+    "photo"
+    "stitching"
+    "video"
+  ] ++ lib.optionals (!stdenv.isAarch64 && enableGStreamer) [ "gapi" ];
+  testRunner = if stdenv.isDarwin then "" else "${lib.getExe xvfb-run} -a ";
+  testsPreparation = ''
+    touch $out
+    # several tests want a write access, so we have to copy files
+    tmpPath="$(mktemp -d "/tmp/opencv_extra_XXXXXX")"
+    cp -R ${testDataSrc} $tmpPath/opencv_extra
+    chmod -R +w $tmpPath/opencv_extra
+    export OPENCV_TEST_DATA_PATH="$tmpPath/opencv_extra/testdata"
+    export OPENCV_SAMPLES_DATA_PATH="${opencv4.package_tests}/samples/data"
+
+    #ignored tests because of gtest error - "Test code is not available due to compilation error with GCC 11"
+    export GTEST_FILTER="-AsyncAPICancelation/cancel*"
+  '';
+  accuracyTests = lib.optionalString runAccuracyTests ''
+    ${ builtins.concatStringsSep "\n"
+      (map (test: "${testRunner}${opencv4.package_tests}/opencv_test_${test} --test_threads=$NIX_BUILD_CORES --gtest_filter=$GTEST_FILTER" ) testNames)
+    }
+  '';
+  perfomanceTests = lib.optionalString runPerformanceTests ''
+    ${ builtins.concatStringsSep "\n"
+      (map (test: "${testRunner}${opencv4.package_tests}/opencv_perf_${test} --perf_impl=plain --perf_min_samples=10 --perf_force_samples=10 --perf_verify_sanity --skip_unstable=1 --gtest_filter=$GTEST_FILTER") perfTestNames)
+    }
+  '';
+in
+runCommand "opencv4-tests"
+{
+  nativeBuildInputs = lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ]);
+}
+  (testsPreparation + accuracyTests + perfomanceTests)
diff --git a/pkgs/development/libraries/opendbx/default.nix b/pkgs/development/libraries/opendbx/default.nix
index 0460f012424c..ce8064cdc1eb 100644
--- a/pkgs/development/libraries/opendbx/default.nix
+++ b/pkgs/development/libraries/opendbx/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline libmysqlclient postgresql sqlite ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-std=c++14"
+  ];
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "Extremely lightweight but extensible database access library written in C";
diff --git a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch b/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
deleted file mode 100644
index 2acedda0e3a4..000000000000
--- a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001
-From: Pauli <pauli@openssl.org>
-Date: Fri, 11 Nov 2022 09:40:19 +1100
-Subject: [PATCH] x509: fix double locking problem
-
-This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the
-redundant flag setting.
-
-Fixes #19643
-
-Fixes LOW CVE-2022-3996
-
-Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/19652)
-
-(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5)
----
- crypto/x509/pcy_map.c | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c
-index 05406c6493fc..60dfd1e3203b 100644
---- a/crypto/x509/pcy_map.c
-+++ b/crypto/x509/pcy_map.c
-@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
- 
-     ret = 1;
-  bad_mapping:
--    if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) {
--        x->ex_flags |= EXFLAG_INVALID_POLICY;
--        CRYPTO_THREAD_unlock(x->lock);
--    }
-     sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
-     return ret;
- 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 4c322997963a..488613fd489a 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -216,8 +216,8 @@ in {
 
 
   openssl_1_1 = common {
-    version = "1.1.1s";
-    sha256 = "sha256-xawB52Dub/Dath1rK70wFGck0GPrMiGAxvGKb3Tktqo=";
+    version = "1.1.1t";
+    sha256 = "sha256-je6bJL2x3L8MPR6bAvuPa/IhZegH9Fret8lndTaFnTs=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -229,8 +229,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.7";
-    sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4=";
+    version = "3.0.8";
+    sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
@@ -241,9 +241,6 @@ in {
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
-
-       # Remove with 3.0.8 release
-       ./3.0/CVE-2022-3996.patch
     ];
 
     withDocs = true;
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 8da35364e2b8..53d465542b2b 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -109,8 +109,16 @@ let
         url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/fba7083f8ceb210c7c20aceafeb5c9a8767cf705.patch";
         hash = "sha256-aZQ4OzK0B5YPq+jQNygxPE0coG2qB0ukbYzyI8E24XM=";
       })
+
+      # backport a fix for rust-cbindgen errors in downstream packages
+      # See https://github.com/NixOS/nixpkgs/pull/211872#issuecomment-1415981135 for details.
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/caf58ecffb4dc8e2bfa7898d0ed910cf0a82d65f.patch";
+        hash = "sha256-kCQNG0j3lwT01WNfGsdUmKvDHg8tvMfS2eunPyXBV1E=";
+      })
     ];
 
+    strictDeps = true;
     nativeBuildInputs = [
       docutils
       doxygen
@@ -119,6 +127,7 @@ let
       ninja
       pkg-config
       python3
+      glib
     ];
 
     buildInputs = [
diff --git a/pkgs/development/libraries/qcoro/default.nix b/pkgs/development/libraries/qcoro/default.nix
index 4a288702e2f2..fb5c7570b75b 100644
--- a/pkgs/development/libraries/qcoro/default.nix
+++ b/pkgs/development/libraries/qcoro/default.nix
@@ -1,5 +1,5 @@
 { stdenv
-, gcc11Stdenv
+, gcc12Stdenv
 , lib
 , fetchFromGitHub
 , cmake
@@ -9,7 +9,7 @@
 , wrapQtAppsHook
 }:
 
-gcc11Stdenv.mkDerivation rec {
+gcc12Stdenv.mkDerivation rec {
   pname = "qcoro";
   version = "0.7.0";
 
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 2829bb0be027..7d876d884b37 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -64,6 +64,12 @@ let
         extraPrefix = "src/3rdparty/";
         hash = "sha256-MZGYeMdGzwypfKoSUaa56K3inbcGRx7he/+AFyk5ekA=";
       })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/Homebrew/formula-patches/7ae178a617d1e0eceb742557e63721af949bd28a/qt5/qt5-webengine-gcc12.patch";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/";
+        hash = "sha256-s4GsGMJTBNWw2gTJuIEP3tqT82AmTsR2mbj59m2p6rM=";
+      })
     ] ++ lib.optionals stdenv.isDarwin [
       ./qtwebengine-darwin-no-platform-check.patch
       ./qtwebengine-mac-dont-set-dsymutil-path.patch
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 19f36c337e5c..0603ae077e47 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -42,7 +42,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
   qtwebengine =
     let
-      branchName = "5.15.11";
+      branchName = "5.15.12";
       rev = "v${branchName}-lts";
     in
     {
@@ -50,7 +50,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 
       src = fetchgit {
         url = "https://github.com/qt/qtwebengine.git";
-        sha256 = "sha256-yrKPof18G10VjrwCn/4E/ywlpATJQZjvmVeM+9hLY0U=";
+        sha256 = "sha256-8EQqSvxw9rqf+64CIbcCb1VXhNx1GNC8eDIgLyYDyvk=";
         inherit rev branchName;
         fetchSubmodules = true;
         leaveDotGit = true;
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 40b927ff0b8f..79cd1b86fadb 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -40,8 +40,16 @@ stdenv.mkDerivation rec {
     "tools"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move"
-    + lib.optionalString stdenv.cc.isClang "-Wno-error=unused-private-field -faligned-allocation";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    "-Wno-error=deprecated-copy"
+    "-Wno-error=pessimizing-move"
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=unused-private-field"
+    "-faligned-allocation"
+  ];
 
   cmakeFlags = [
     "-DPORTABLE=1"
diff --git a/pkgs/development/libraries/roctracer/default.nix b/pkgs/development/libraries/roctracer/default.nix
index ee844bb417ba..87cf7d0819ad 100644
--- a/pkgs/development/libraries/roctracer/default.nix
+++ b/pkgs/development/libraries/roctracer/default.nix
@@ -62,6 +62,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   postPatch = ''
     export HIP_DEVICE_LIB_PATH=${rocm-device-libs}/amdgcn/bitcode
   '' + lib.optionalString (!buildTests) ''
diff --git a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
index c4faadd2a5eb..7144a17c18b4 100644
--- a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
@@ -48,6 +48,8 @@ stdenv.mkDerivation rec {
         --replace "/etc/udev/rules.d" "lib/udev/rules.d" \
         --replace "/lib/firmware" "lib/firmware"
     done
+
+    sed '1i#include <ctime>' -i indi-duino/libfirmata/src/firmata.cpp # gcc12
   '';
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/swiftshader/default.nix b/pkgs/development/libraries/swiftshader/default.nix
index 2c508a3735f9..28aabc03682b 100644
--- a/pkgs/development/libraries/swiftshader/default.nix
+++ b/pkgs/development/libraries/swiftshader/default.nix
@@ -13,6 +13,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 jq ];
   buildInputs = [ libX11 libXext zlib ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=uninitialized"
+  ];
+
   # Make sure we include the drivers and icd files in the output as the cmake
   # generated install command only puts in the spirv-tools stuff.
   installPhase = ''
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index 21fddb165627..e0c48bc6dcef 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
   pname = "tbb";
   version = "2020.3";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneTBB";
diff --git a/pkgs/development/libraries/unittest-cpp/default.nix b/pkgs/development/libraries/unittest-cpp/default.nix
index 6f27a71b3ee4..e9f67a74f9a3 100644
--- a/pkgs/development/libraries/unittest-cpp/default.nix
+++ b/pkgs/development/libraries/unittest-cpp/default.nix
@@ -1,4 +1,9 @@
-{lib, stdenv, fetchFromGitHub, cmake}:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+}:
 
 stdenv.mkDerivation rec {
   pname = "unittest-cpp";
@@ -11,6 +16,14 @@ stdenv.mkDerivation rec {
     sha256 = "0sxb3835nly1jxn071f59fwbdzmqi74j040r81fanxyw3s1azw0i";
   };
 
+  patches = [
+    # GCC12 Patch
+    (fetchpatch {
+      url = "https://github.com/unittest-cpp/unittest-cpp/pull/185/commits/f361c2a1034c02ba8059648f9a04662d6e2b5553.patch";
+      hash = "sha256-xyhV2VBelw/uktUXSZ3JBxgG+8/Mout/JiXEZVV2+2Y=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = false;
diff --git a/pkgs/development/libraries/uri/default.nix b/pkgs/development/libraries/uri/default.nix
index 980d073f1281..6189fcf016de 100644
--- a/pkgs/development/libraries/uri/default.nix
+++ b/pkgs/development/libraries/uri/default.nix
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "148361pixrm94q6v04k13s1msa04bx9yc3djb0lxpa7dlw19vhcd";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=parentheses"
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=nonnull"
+  ];
 
   nativeBuildInputs = [ cmake doxygen ];
 
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 7cdad40d9701..4b2117503bda 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -110,6 +110,7 @@ stdenv.mkDerivation rec {
         --replace "-Wl,-fatal_warnings" ""
     ''}
     touch build/config/gclient_args.gni
+    sed '1i#include <utility>' -i src/heap/cppgc/prefinalizer-handler.h # gcc12
   '';
 
   llvmCcAndBintools = symlinkJoin { name = "llvmCcAndBintools"; paths = [ stdenv.cc llvmPackages.llvm ]; };
diff --git a/pkgs/development/libraries/wildmidi/default.nix b/pkgs/development/libraries/wildmidi/default.nix
index 5e8adaf0c425..8877365e1dd6 100644
--- a/pkgs/development/libraries/wildmidi/default.nix
+++ b/pkgs/development/libraries/wildmidi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wildmidi";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "Mindwerks";
     repo = "wildmidi";
     rev = "${pname}-${version}";
-    sha256 = "08fbbsvw6pkwwqarjwcvdp8mq4zn5sgahf025hynwc6rvf4sp167";
+    sha256 = "sha256-5El8aDpAgjrW0/4lphZEF+Hfv9Xr7J4DMk1b/Tb+0TU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index 00aef53cc1b2..5366fb078678 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -24,12 +24,12 @@ let
 
 in buildPythonPackage rec {
   pname = "cython";
-  version = "0.29.32";
+  version = "0.29.33";
 
   src = fetchPypi {
     pname = "Cython";
     inherit version;
-    hash = "sha256-hzPPR1i3kwTypOOev6xekjQbzke8zrJsElQ5iy+MGvc=";
+    hash = "sha256-UEB2TEpNLOlko5XaJPDRrlgUSZXauSxrlvRMP01yKGo=";
   };
 
   nativeBuildInputs = [
@@ -46,11 +46,7 @@ in buildPythonPackage rec {
     # backport Cython 3.0 trashcan support (https://github.com/cython/cython/pull/2842) to 0.X series.
     # it does not affect Python code unless the code explicitly uses the feature.
     # trashcan support is needed to avoid stack overflows during object deallocation in sage (https://trac.sagemath.org/ticket/27267)
-    (fetchpatch {
-      name = "trashcan.patch";
-      url = "https://github.com/cython/cython/commit/f781880b6780117660b2026caadf4a6d7905722f.patch";
-      sha256 = "sha256-SnjaJdBZxm3O5gJ5Dxut6+eeVtZv+ygUUNwAwgoiFxg=";
-    })
+    ./trashcan.patch
     # The above commit introduces custom trashcan macros, as well as
     # compiler changes to use them in Cython-emitted code. The latter
     # change is still useful, but the former has been upstreamed as of
@@ -79,6 +75,7 @@ in buildPythonPackage rec {
   # doCheck = !stdenv.isDarwin;
 
   meta = {
+    changelog = "https://github.com/cython/cython/blob/${version}/CHANGES.rst";
     description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
     homepage = "https://cython.org";
     license = lib.licenses.asl20;
diff --git a/pkgs/development/python-modules/Cython/trashcan.patch b/pkgs/development/python-modules/Cython/trashcan.patch
new file mode 100644
index 000000000000..398422e76f39
--- /dev/null
+++ b/pkgs/development/python-modules/Cython/trashcan.patch
@@ -0,0 +1,354 @@
+From 1b77e35d848340f2c5f4c9b82965c25a0572d48f Mon Sep 17 00:00:00 2001
+From: Jeroen Demeyer <J.Demeyer@UGent.be>
+Date: Thu, 14 Feb 2019 10:02:41 +0100
+Subject: [PATCH] @cython.trashcan directive to enable the Python trashcan for
+ deallocations
+
+---
+ Cython/Compiler/ModuleNode.py   |  10 +++
+ Cython/Compiler/Options.py      |   2 +
+ Cython/Compiler/PyrexTypes.py   |   8 +-
+ Cython/Compiler/Symtab.py       |  18 +++-
+ Cython/Utility/ExtensionTypes.c |  43 ++++++++++
+ tests/run/trashcan.pyx          | 148 ++++++++++++++++++++++++++++++++
+ 6 files changed, 227 insertions(+), 2 deletions(-)
+ create mode 100644 tests/run/trashcan.pyx
+
+diff --git a/Cython/Compiler/ModuleNode.py b/Cython/Compiler/ModuleNode.py
+index 56845330d..3a3e8a956 100644
+--- a/Cython/Compiler/ModuleNode.py
++++ b/Cython/Compiler/ModuleNode.py
+@@ -1443,6 +1443,7 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+ 
+         is_final_type = scope.parent_type.is_final_type
+         needs_gc = scope.needs_gc()
++        needs_trashcan = scope.needs_trashcan()
+ 
+         weakref_slot = scope.lookup_here("__weakref__") if not scope.is_closure_class_scope else None
+         if weakref_slot not in scope.var_entries:
+@@ -1481,6 +1482,11 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+             # running this destructor.
+             code.putln("PyObject_GC_UnTrack(o);")
+ 
++        if needs_trashcan:
++            code.globalstate.use_utility_code(
++                UtilityCode.load_cached("PyTrashcan", "ExtensionTypes.c"))
++            code.putln("__Pyx_TRASHCAN_BEGIN(o, %s)" % slot_func_cname)
++
+         # call the user's __dealloc__
+         self.generate_usr_dealloc_call(scope, code)
+ 
+@@ -1554,6 +1560,10 @@ class ModuleNode(Nodes.Node, Nodes.BlockNode):
+             code.putln("(*Py_TYPE(o)->tp_free)(o);")
+             if freelist_size:
+                 code.putln("}")
++
++        if needs_trashcan:
++            code.putln("__Pyx_TRASHCAN_END")
++
+         code.putln(
+             "}")
+ 
+diff --git a/Cython/Compiler/Options.py b/Cython/Compiler/Options.py
+index d03119fca..05a728135 100644
+--- a/Cython/Compiler/Options.py
++++ b/Cython/Compiler/Options.py
+@@ -319,6 +319,7 @@ directive_types = {
+     'freelist': int,
+     'c_string_type': one_of('bytes', 'bytearray', 'str', 'unicode'),
+     'c_string_encoding': normalise_encoding_name,
++    'trashcan': bool,
+     'cpow': bool
+ }
+ 
+@@ -362,6 +363,7 @@ directive_scopes = {  # defaults to available everywhere
+     'np_pythran': ('module',),
+     'fast_gil': ('module',),
+     'iterable_coroutine': ('module', 'function'),
++    'trashcan' : ('cclass',),
+ }
+ 
+ 
+diff --git a/Cython/Compiler/PyrexTypes.py b/Cython/Compiler/PyrexTypes.py
+index c309bd04b..9231130b5 100644
+--- a/Cython/Compiler/PyrexTypes.py
++++ b/Cython/Compiler/PyrexTypes.py
+@@ -1129,6 +1129,7 @@ class PyObjectType(PyrexType):
+     is_extern = False
+     is_subclassed = False
+     is_gc_simple = False
++    builtin_trashcan = False  # builtin type using trashcan
+ 
+     def __str__(self):
+         return "Python object"
+@@ -1183,10 +1184,14 @@ class PyObjectType(PyrexType):
+ 
+ 
+ builtin_types_that_cannot_create_refcycles = set([
+-    'bool', 'int', 'long', 'float', 'complex',
++    'object', 'bool', 'int', 'long', 'float', 'complex',
+     'bytearray', 'bytes', 'unicode', 'str', 'basestring'
+ ])
+ 
++builtin_types_with_trashcan = set([
++    'dict', 'list', 'set', 'frozenset', 'tuple', 'type',
++])
++
+ 
+ class BuiltinObjectType(PyObjectType):
+     #  objstruct_cname  string           Name of PyObject struct
+@@ -1211,6 +1216,7 @@ class BuiltinObjectType(PyObjectType):
+         self.typeptr_cname = "(&%s)" % cname
+         self.objstruct_cname = objstruct_cname
+         self.is_gc_simple = name in builtin_types_that_cannot_create_refcycles
++        self.builtin_trashcan = name in builtin_types_with_trashcan
+         if name == 'type':
+             # Special case the type type, as many C API calls (and other
+             # libraries) actually expect a PyTypeObject* for type arguments.
+diff --git a/Cython/Compiler/Symtab.py b/Cython/Compiler/Symtab.py
+index 7361a55ae..f0c311ba6 100644
+--- a/Cython/Compiler/Symtab.py
++++ b/Cython/Compiler/Symtab.py
+@@ -2043,7 +2043,7 @@ class PyClassScope(ClassScope):
+ class CClassScope(ClassScope):
+     #  Namespace of an extension type.
+     #
+-    #  parent_type           CClassType
++    #  parent_type           PyExtensionType
+     #  #typeobj_cname        string or None
+     #  #objstruct_cname      string
+     #  method_table_cname    string
+@@ -2087,6 +2087,22 @@ class CClassScope(ClassScope):
+             return not self.parent_type.is_gc_simple
+         return False
+ 
++    def needs_trashcan(self):
++        # If the trashcan directive is explicitly set to False,
++        # unconditionally disable the trashcan.
++        directive = self.directives.get('trashcan')
++        if directive is False:
++            return False
++        # If the directive is set to True and the class has Python-valued
++        # C attributes, then it should use the trashcan in tp_dealloc.
++        if directive and self.has_cyclic_pyobject_attrs:
++            return True
++        # Use the trashcan if the base class uses it
++        base_type = self.parent_type.base_type
++        if base_type and base_type.scope is not None:
++            return base_type.scope.needs_trashcan()
++        return self.parent_type.builtin_trashcan
++
+     def needs_tp_clear(self):
+         """
+         Do we need to generate an implementation for the tp_clear slot? Can
+diff --git a/Cython/Utility/ExtensionTypes.c b/Cython/Utility/ExtensionTypes.c
+index dc187ab49..f359165df 100644
+--- a/Cython/Utility/ExtensionTypes.c
++++ b/Cython/Utility/ExtensionTypes.c
+@@ -119,6 +119,49 @@ static int __Pyx_PyType_Ready(PyTypeObject *t) {
+     return r;
+ }
+ 
++/////////////// PyTrashcan.proto ///////////////
++
++// These macros are taken from https://github.com/python/cpython/pull/11841
++// Unlike the Py_TRASHCAN_SAFE_BEGIN/Py_TRASHCAN_SAFE_END macros, they
++// allow dealing correctly with subclasses.
++
++// This requires CPython version >= 2.7.4
++// (or >= 3.2.4 but we don't support such old Python 3 versions anyway)
++#if CYTHON_COMPILING_IN_CPYTHON && PY_VERSION_HEX >= 0x02070400
++#define __Pyx_TRASHCAN_BEGIN_CONDITION(op, cond) \
++    do { \
++        PyThreadState *_tstate = NULL; \
++        // If "cond" is false, then _tstate remains NULL and the deallocator
++        // is run normally without involving the trashcan
++        if (cond) { \
++            _tstate = PyThreadState_GET(); \
++            if (_tstate->trash_delete_nesting >= PyTrash_UNWIND_LEVEL) { \
++                // Store the object (to be deallocated later) and jump past
++                // Py_TRASHCAN_END, skipping the body of the deallocator
++                _PyTrash_thread_deposit_object((PyObject*)(op)); \
++                break; \
++            } \
++            ++_tstate->trash_delete_nesting; \
++        }
++        // The body of the deallocator is here.
++#define __Pyx_TRASHCAN_END \
++        if (_tstate) { \
++            --_tstate->trash_delete_nesting; \
++            if (_tstate->trash_delete_later && _tstate->trash_delete_nesting <= 0) \
++                _PyTrash_thread_destroy_chain(); \
++        } \
++    } while (0);
++
++#define __Pyx_TRASHCAN_BEGIN(op, dealloc) __Pyx_TRASHCAN_BEGIN_CONDITION(op, \
++        Py_TYPE(op)->tp_dealloc == (destructor)(dealloc))
++
++#else
++// The trashcan is a no-op on other Python implementations
++// or old CPython versions
++#define __Pyx_TRASHCAN_BEGIN(op, dealloc)
++#define __Pyx_TRASHCAN_END
++#endif
++
+ /////////////// CallNextTpDealloc.proto ///////////////
+ 
+ static void __Pyx_call_next_tp_dealloc(PyObject* obj, destructor current_tp_dealloc);
+diff --git a/tests/run/trashcan.pyx b/tests/run/trashcan.pyx
+new file mode 100644
+index 000000000..93a501ff8
+--- /dev/null
++++ b/tests/run/trashcan.pyx
+@@ -0,0 +1,148 @@
++# mode: run
++
++cimport cython
++
++
++# Count number of times an object was deallocated twice. This should remain 0.
++cdef int double_deallocations = 0
++def assert_no_double_deallocations():
++    global double_deallocations
++    err = double_deallocations
++    double_deallocations = 0
++    assert not err
++
++
++# Compute x = f(f(f(...(None)...))) nested n times and throw away the result.
++# The real test happens when exiting this function: then a big recursive
++# deallocation of x happens. We are testing two things in the tests below:
++# that Python does not crash and that no double deallocation happens.
++# See also https://github.com/python/cpython/pull/11841
++def recursion_test(f, int n=2**20):
++    x = None
++    cdef int i
++    for i in range(n):
++        x = f(x)
++
++
++@cython.trashcan(True)
++cdef class Recurse:
++    """
++    >>> recursion_test(Recurse)
++    >>> assert_no_double_deallocations()
++    """
++    cdef public attr
++    cdef int deallocated
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.deallocated
++        self.deallocated = 1
++
++
++cdef class RecurseSub(Recurse):
++    """
++    >>> recursion_test(RecurseSub)
++    >>> assert_no_double_deallocations()
++    """
++    cdef int subdeallocated
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.subdeallocated
++        self.subdeallocated = 1
++
++
++@cython.freelist(4)
++@cython.trashcan(True)
++cdef class RecurseFreelist:
++    """
++    >>> recursion_test(RecurseFreelist)
++    >>> recursion_test(RecurseFreelist, 1000)
++    >>> assert_no_double_deallocations()
++    """
++    cdef public attr
++    cdef int deallocated
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        # Check that we're not being deallocated twice
++        global double_deallocations
++        double_deallocations += self.deallocated
++        self.deallocated = 1
++
++
++# Subclass of list => uses trashcan by default
++# As long as https://github.com/python/cpython/pull/11841 is not fixed,
++# this does lead to double deallocations, so we skip that check.
++cdef class RecurseList(list):
++    """
++    >>> RecurseList(42)
++    [42]
++    >>> recursion_test(RecurseList)
++    """
++    def __init__(self, x):
++        super().__init__((x,))
++
++
++# Some tests where the trashcan is NOT used. When the trashcan is not used
++# in a big recursive deallocation, the __dealloc__s of the base classs are
++# only run after the __dealloc__s of the subclasses.
++# We use this to detect trashcan usage.
++cdef int base_deallocated = 0
++cdef int trashcan_used = 0
++def assert_no_trashcan_used():
++    global base_deallocated, trashcan_used
++    err = trashcan_used
++    trashcan_used = base_deallocated = 0
++    assert not err
++
++
++cdef class Base:
++    def __dealloc__(self):
++        global base_deallocated
++        base_deallocated = 1
++
++
++# Trashcan disabled by default
++cdef class Sub1(Base):
++    """
++    >>> recursion_test(Sub1, 100)
++    >>> assert_no_trashcan_used()
++    """
++    cdef public attr
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        global base_deallocated, trashcan_used
++        trashcan_used += base_deallocated
++
++
++@cython.trashcan(True)
++cdef class Middle(Base):
++    cdef public foo
++
++
++# Trashcan disabled explicitly
++@cython.trashcan(False)
++cdef class Sub2(Middle):
++    """
++    >>> recursion_test(Sub2, 1000)
++    >>> assert_no_trashcan_used()
++    """
++    cdef public attr
++
++    def __init__(self, x):
++        self.attr = x
++
++    def __dealloc__(self):
++        global base_deallocated, trashcan_used
++        trashcan_used += base_deallocated
+-- 
+2.39.0
+
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 44d6e6f97833..bcdd7614ecd5 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -56,6 +56,8 @@ buildPythonPackage rec {
     "ignore::DeprecationWarning"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTests = [
     # Tests often fail with StopIteration
     "test_isolat"
diff --git a/pkgs/development/python-modules/cvxopt/default.nix b/pkgs/development/python-modules/cvxopt/default.nix
index c546d11ec3f6..d47debe407e9 100644
--- a/pkgs/development/python-modules/cvxopt/default.nix
+++ b/pkgs/development/python-modules/cvxopt/default.nix
@@ -51,16 +51,16 @@ buildPythonPackage rec {
     export CVXOPT_SUITESPARSE_INC_DIR=${lib.getDev suitesparse}/include
   '' + lib.optionalString withGsl ''
     export CVXOPT_BUILD_GSL=1
-    export CVXOPT_GSL_LIB_DIR=${gsl}/lib
-    export CVXOPT_GSL_INC_DIR=${gsl}/include
+    export CVXOPT_GSL_LIB_DIR=${lib.getLib gsl}/lib
+    export CVXOPT_GSL_INC_DIR=${lib.getDev gsl}/include
   '' + lib.optionalString withGlpk ''
     export CVXOPT_BUILD_GLPK=1
-    export CVXOPT_GLPK_LIB_DIR=${glpk}/lib
-    export CVXOPT_GLPK_INC_DIR=${glpk}/include
+    export CVXOPT_GLPK_LIB_DIR=${lib.getLib glpk}/lib
+    export CVXOPT_GLPK_INC_DIR=${lib.getDev glpk}/include
   '' + lib.optionalString withFftw ''
     export CVXOPT_BUILD_FFTW=1
-    export CVXOPT_FFTW_LIB_DIR=${fftw}/lib
-    export CVXOPT_FFTW_INC_DIR=${fftw.dev}/include
+    export CVXOPT_FFTW_LIB_DIR=${lib.getLib fftw}/lib
+    export CVXOPT_FFTW_INC_DIR=${lib.getDev fftw}/include
   '';
 
   nativeCheckInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/datafusion/Cargo.lock.patch b/pkgs/development/python-modules/datafusion/Cargo.lock.patch
deleted file mode 100644
index e4e5eca8af4c..000000000000
--- a/pkgs/development/python-modules/datafusion/Cargo.lock.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index fa84a54c..3d790e1c 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -57,9 +57,9 @@ checksum = "be4dc07131ffa69b8072d35f5007352af944213cde02545e2103680baed38fcd"
- 
- [[package]]
- name = "arrow"
--version = "6.0.0"
-+version = "6.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "337e668497751234149fd607f5cb41a6ae7b286b6329589126fe67f0ac55d637"
-+checksum = "216c6846a292bdd93c2b93c1baab58c32ff50e2ab5e8d50db333ab518535dd8b"
- dependencies = [
-  "bitflags",
-  "chrono",
-@@ -212,9 +212,9 @@ dependencies = [
- 
- [[package]]
- name = "comfy-table"
--version = "4.1.1"
-+version = "5.0.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "11e95a3e867422fd8d04049041f5671f94d53c32a9dcd82e2be268714942f3f3"
-+checksum = "c42350b81f044f576ff88ac750419f914abb46a03831bb1747134344ee7a4e64"
- dependencies = [
-  "strum",
-  "strum_macros",
-@@ -279,7 +279,7 @@ dependencies = [
- 
- [[package]]
- name = "datafusion"
--version = "5.1.0"
-+version = "6.0.0"
- dependencies = [
-  "ahash",
-  "arrow",
-@@ -310,7 +310,7 @@ dependencies = [
- 
- [[package]]
- name = "datafusion-python"
--version = "0.3.0"
-+version = "0.4.0"
- dependencies = [
-  "datafusion",
-  "pyo3",
-@@ -877,9 +877,9 @@ dependencies = [
- 
- [[package]]
- name = "parquet"
--version = "6.0.0"
-+version = "6.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d263b9b59ba260518de9e57bd65931c3f765fea0fabacfe84f40d6fde38e841a"
-+checksum = "788d9953f4cfbe9db1beff7bebd54299d105e34680d78b82b1ddc85d432cac9d"
- dependencies = [
-  "arrow",
-  "base64",
-@@ -1228,15 +1228,15 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
- 
- [[package]]
- name = "strum"
--version = "0.21.0"
-+version = "0.22.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "aaf86bbcfd1fa9670b7a129f64fc0c9fcbbfe4f1bc4210e9e98fe71ffc12cde2"
-+checksum = "f7ac893c7d471c8a21f31cfe213ec4f6d9afeed25537c772e08ef3f005f8729e"
- 
- [[package]]
- name = "strum_macros"
--version = "0.21.1"
-+version = "0.22.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d06aaeeee809dbc59eb4556183dd927df67db1540de5be8d3ec0b6636358a5ec"
-+checksum = "339f799d8b549e3744c7ac7feb216383e4005d94bdb22561b3ab8f3b808ae9fb"
- dependencies = [
-  "heck",
-  "proc-macro2",
diff --git a/pkgs/development/python-modules/datafusion/default.nix b/pkgs/development/python-modules/datafusion/default.nix
index fb991dabf3d2..84afbfc3a1c1 100644
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -5,54 +5,42 @@
 , fetchPypi
 , fetchFromGitHub
 , rustPlatform
-, maturin
 , pytestCheckHook
 , libiconv
 , numpy
 , pandas
 , pyarrow
-, pytest
 }:
+
 let
-  # le sigh, the perils of unrelated versions of software living in the same
-  # repo: there's no obvious way to map the top level source repo
-  # (arrow-datafusion) version to the version of contained repo
-  # (arrow-datafusion/python)
-  #
-  # A commit hash will do in a pinch, and ultimately the sha256 has the final
-  # say of what the content is when building
-  cargoLock = fetchurl {
-    url = "https://raw.githubusercontent.com/apache/arrow-datafusion/6.0.0/python/Cargo.lock";
-    sha256 = "sha256-xiv3drEU5jOGsEIh0U01ZQ1NBKobxO2ctp4mxy9iigw=";
+  arrow-testing = fetchFromGitHub {
+    owner = "apache";
+    repo = "arrow-testing";
+    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
+    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
   };
 
-  postUnpack = ''
-    cp "${cargoLock}" $sourceRoot/Cargo.lock
-    chmod u+w $sourceRoot/Cargo.lock
-  '';
+  parquet-testing = fetchFromGitHub {
+    owner = "apache";
+    repo = "parquet-testing";
+    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
+    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
+  };
 in
+
 buildPythonPackage rec {
   pname = "datafusion";
-  version = "0.4.0";
+  version = "0.7.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-+YqogteKfNhtI2QbVXv/5CIWm3PcOH653dwONm5ZcL8=";
+    sha256 = "sha256-XYXZMorPs2Ue7E38DASd4rmxvX0wlx8A6sCpAbYUh4I=";
   };
 
-  inherit postUnpack;
-
-  # TODO: remove the patch hacking and postUnpack hooks after
-  # https://github.com/apache/arrow-datafusion/pull/1508 is merged
-  #
-  # the lock file isn't up to date as of 6.0.0 so we need to patch the source
-  # lockfile and the vendored cargo deps lockfile
-  patches = [ ./Cargo.lock.patch ];
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src pname version postUnpack;
-    sha256 = "sha256-JGyDxpfBXzduJaMF1sbmRm7KJajHYdVSj+WbiSETiY0=";
-    patches = [ ./Cargo.lock.patch ];
+    inherit src pname version;
+    sha256 = "sha256-6mPdKwsEN09Gf4eNsd/v3EBHVezHmff/KYB2lsXgzcA=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -68,13 +56,18 @@ buildPythonPackage rec {
     pyarrow
   ];
 
-  nativeCheckInputs = [ pytest ];
+  nativeCheckInputs = [ pytestCheckHook ];
   pythonImportsCheck = [ "datafusion" ];
+  pytestFlagsArray = [ "--pyargs" pname ];
 
-  checkPhase = ''
-    runHook preCheck
-    pytest --pyargs "${pname}"
-    runHook postCheck
+  preCheck = ''
+    pushd $TMPDIR
+    ln -s ${arrow-testing} ./testing
+    ln -s ${parquet-testing} ./parquet
+  '';
+
+  postCheck = ''
+    popd
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index f881ed5221ae..f54562742b15 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "3.2.16";
+  version = "3.2.17";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Django";
     inherit version;
-    hash = "sha256-OtwoUSQkRySjlPqbmDnMjNEW+vfRWVVMQ+zaqM3wuU0=";
+    hash = "sha256-ZEKINB8G6+STjuxoAba9WaZTSnjkrt3ioVMHXREUOJQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/hatch-requirements-txt/default.nix b/pkgs/development/python-modules/hatch-requirements-txt/default.nix
index b68506ecd352..af74b15b0214 100644
--- a/pkgs/development/python-modules/hatch-requirements-txt/default.nix
+++ b/pkgs/development/python-modules/hatch-requirements-txt/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, hatch
 , hatchling
 , packaging
 , pytestCheckHook
@@ -20,7 +19,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    hatch
+    hatchling
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index a49f7c684aab..173991f04df6 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -16,6 +16,7 @@
 , geoalchemy2
 , geopandas
 , graphviz-nox
+, hypothesis
 , lz4
 , multipledispatch
 , numpy
@@ -30,8 +31,9 @@
 , pymysql
 , pyspark
 , pytest-benchmark
-, pytest-randomly
 , pytest-mock
+, pytest-randomly
+, pytest-snapshot
 , pytest-xdist
 , python
 , pytz
@@ -62,7 +64,7 @@ in
 
 buildPythonPackage rec {
   pname = "ibis-framework";
-  version = "3.2.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -71,10 +73,12 @@ buildPythonPackage rec {
     repo = "ibis";
     owner = "ibis-project";
     rev = version;
-    hash = "sha256-YRP1nGJs4btqXQirm0GfEDKNPCVXexVrwQ6sE8JtD2o=";
+    hash = "sha256-G3kMd6Jyib7ZXHFP6t2CEPlDD5n5zHE2jq/0he3U4Nk=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   propagatedBuildInputs = [
     atpublic
@@ -95,29 +99,31 @@ buildPythonPackage rec {
     pytestCheckHook
     click
     filelock
+    hypothesis
     pytest-benchmark
     pytest-mock
     pytest-randomly
+    pytest-snapshot
     pytest-xdist
     rsync
   ] ++ lib.concatMap (name: passthru.optional-dependencies.${name}) testBackends;
 
-  preBuild = ''
-    # setup.py exists only for developer convenience and is automatically generated
-    # it gets in the way in nixpkgs so we remove it
-    rm setup.py
-  '';
-
   pytestFlagsArray = [
     "--dist=loadgroup"
     "-m"
     "'${lib.concatStringsSep " or " testBackends} or core'"
-    # this test fails on nixpkgs datafusion version (0.4.0), but works on
-    # datafusion 0.6.0
-    "-k"
-    "'not datafusion-no_op'"
   ];
 
+  # remove when sqlalchemy backend no longer uses deprecated methods
+  SQLALCHEMY_SILENCE_UBER_WARNING = 1;
+
+  # patch out tests that check formatting with black
+  postPatch = ''
+    find ibis/tests -type f -name '*.py' -exec sed -i \
+      -e '/^ *assert_decompile_roundtrip/d' \
+      -e 's/^\( *\)code = ibis.decompile(expr, format=True)/\1code = ibis.decompile(expr)/g' {} +
+  '';
+
   preCheck = ''
     set -eo pipefail
 
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index 90ebd4a3a997..a330a9392876 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , python
+, pythonAtLeast
 , pythonOlder
 , arrow-cpp
 , cffi
@@ -122,6 +123,9 @@ buildPythonPackage rec {
     "--deselect=pyarrow/tests/test_flight.py::test_none_action_side_effect"
     # fails to compile
     "--deselect=pyarrow/tests/test_cython.py::test_cython_api"
+  ] ++ lib.optionals (pythonAtLeast "3.11") [
+    # Repr output is printing number instead of enum name so these tests fail
+    "--deselect=pyarrow/tests/test_fs.py::test_get_file_info"
   ] ++ lib.optionals stdenv.isLinux [
     # this test requires local networking
     "--deselect=pyarrow/tests/test_fs.py::test_filesystem_from_uri_gcs"
diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index 1c69f426b169..feae84901304 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -37,6 +37,12 @@ buildPythonPackage rec {
     toml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
+  disabledTests = [
+    "test_wait_raise_assertion_false" # racy
+  ];
+
   pythonImportsCheck = [
     "pytest_httpserver"
   ];
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index a0e9bb1fb2a6..c6e8b7e915d6 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -1,23 +1,31 @@
-{ lib, buildPythonPackage, pythonOlder, fetchPypi, pytest, mock }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, setuptools
+, packaging
+, pytest
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "10.3";
+  version = "11.0";
+  format = "pyproject";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2CRNeZ+Jpu215XMB3a6ztvENZpFjjVHoCzcTEVkuKMY=";
+    hash = "sha256-zuWeTm8Nc65j+6CZhlMUupuRW3GTSVQREPoBL/tu+xM=";
   };
 
+  nativeBuildInputs = [ setuptools ];
+
   buildInputs = [ pytest ];
+  propagatedBuildInputs = [ packaging ];
 
-  nativeCheckInputs = [ mock pytest ];
-
-  checkPhase = ''
-    py.test test_pytest_rerunfailures.py
-  '';
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Pytest plugin to re-run tests to eliminate flaky failures";
diff --git a/pkgs/development/python-modules/python-magic/default.nix b/pkgs/development/python-modules/python-magic/default.nix
index 725849fee078..358a647d52d9 100644
--- a/pkgs/development/python-modules/python-magic/default.nix
+++ b/pkgs/development/python-modules/python-magic/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , file
 , pytestCheckHook
@@ -23,6 +24,11 @@ buildPythonPackage rec {
       src = ./libmagic-path.patch;
       libmagic = "${file}/lib/libmagic${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
+    (fetchpatch {
+      name = "update-test-for-upstream-added-gzip-extensions.patch";
+      url = "https://github.com/ahupp/python-magic/commit/4ffcd59113fa26d7c2e9d5897b1eef919fd4b457.patch";
+      hash = "sha256-67GpjlGiR4/os/iZ69V+ZziVLpjmid+7t+gQ2aQy9I0=";
+    })
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index e162a4a6cb61..b8594e51f839 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2022.7";
+  version = "2022.7.1";
 
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fM+ue0ssBnRkpnM8YmFnP9uP0b6QVGA5a5egc+n6aDo=";
+    hash = "sha256-AaBoHEuWhKKDBGFeulXRqzGuAL9o7BV+w3CKgYLbvNA=";
   };
 
   nativeCheckInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 7f9091d87f14..13bc07faed3a 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -67,6 +67,8 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
+  requiredSystemFeatures = [ "big-parallel" ]; # the tests need lots of CPU time
+
   passthru = {
     blas = numpy.blas;
   };
diff --git a/pkgs/development/python-modules/sqlglot/default.nix b/pkgs/development/python-modules/sqlglot/default.nix
index 05dfba949729..3d12618b8e45 100644
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@@ -5,10 +5,11 @@
 , pytestCheckHook
 , python-dateutil
 , duckdb
+, pyspark
 }:
 buildPythonPackage rec {
   pname = "sqlglot";
-  version = "6.0.7";
+  version = "10.5.2";
 
   disabled = pythonOlder "3.8";
 
@@ -16,12 +17,15 @@ buildPythonPackage rec {
     repo = "sqlglot";
     owner = "tobymao";
     rev = "v${version}";
-    hash = "sha256-7PBhf9NN/mCi92xSkB9ygfmfxTyOYaEyrNvL309sG5Y=";
+    hash = "sha256-ZFc2aOhCTRFlrzgnYDSdIZxRqKZ8FvkYSZRU0OMHI34=";
   };
 
   propagatedBuildInputs = [ python-dateutil ];
 
-  nativeCheckInputs = [ pytestCheckHook duckdb ];
+  nativeCheckInputs = [ pytestCheckHook duckdb pyspark ];
+
+  # these integration tests assume a running Spark instance
+  disabledTestPaths = [ "tests/dataframe/integration" ];
 
   pythonImportsCheck = [ "sqlglot" ];
 
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index c64f36c8df32..f1a8e72a591d 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -111,6 +111,15 @@ in buildPythonPackage rec {
     # base is 10.12. Until we upgrade, we can fall back on the older
     # pthread support.
     ./pthreadpool-disable-gcd.diff
+  ] ++ [
+    # PyTorch fails to build on gcc 12 due to gloo
+    # https://github.com/pytorch/pytorch/issues/77614
+    (fetchpatch {
+      url = "https://github.com/facebookincubator/gloo/commit/4a5e339b764261d20fc409071dc7a8b8989aa195.patch";
+      stripLen = 1;
+      extraPrefix = "third_party/gloo/";
+      hash = "sha256-UxR1r7F6g76BWj3GBIrSy5t+YZDCWy6mMddwx+hon5w=";
+    })
   ];
 
   postPatch = lib.optionalString rocmSupport ''
@@ -204,7 +213,11 @@ in buildPythonPackage rec {
   #
   # Also of interest: pytorch ignores CXXFLAGS uses CFLAGS for both C and C++:
   # https://github.com/pytorch/pytorch/blob/v1.11.0/setup.py#L17
-  NIX_CFLAGS_COMPILE = lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ];
+  NIX_CFLAGS_COMPILE = lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ]
+  # Suppress gcc regression: avx512 math function raises uninitialized variable warning
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105593
+  # See also: Fails to compile with GCC 12.1.0 https://github.com/pytorch/pytorch/issues/77939
+  ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=maybe-uninitialized" "-Wno-error=uninitialized" ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch b/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
index 93db54b0c6e6..8e70f0069d65 100644
--- a/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
+++ b/pkgs/development/python-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
@@ -20,18 +20,15 @@ name that has the same encoding in each normal form.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
-index 651c034..9b94ac8 100644
+index 5a6db16..42cf121 100644
 --- a/tests/test_bdist_wheel.py
 +++ b/tests/test_bdist_wheel.py
-@@ -58,7 +58,7 @@ def test_unicode_record(wheel_paths):
+@@ -69,7 +69,7 @@ def test_unicode_record(wheel_paths):
      with ZipFile(path) as zf:
-         record = zf.read('unicode.dist-0.1.dist-info/RECORD')
+         record = zf.read("unicode.dist-0.1.dist-info/RECORD")
  
--    assert u'åäö_日本語.py'.encode('utf-8') in record
-+    assert u'æɐø_日本價.py'.encode('utf-8') in record
+-    assert "åäö_日本語.py".encode() in record
++    assert "æɐø_日本價.py".encode() in record
  
  
- def test_licenses_default(dummy_dist, monkeypatch, tmpdir):
--- 
-2.17.2 (Apple Git-113)
-
+ UTF8_PKG_INFO = """\
diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 8735a37b21ff..3be508a0ec59 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.37.1";
+  version = "0.38.4";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-JlTmUPY3yo/uROyd3nW1dJa23zbLhgQTwcmqZkPOrHs=";
+    hash = "sha256-yZLU0t/nz6kfnnoLL15bybOxN4+SJUaTJsCpGffl1QU=";
     name = "${pname}-${version}-source";
     postFetch = ''
       cd $out
diff --git a/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch b/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
new file mode 100644
index 000000000000..93db54b0c6e6
--- /dev/null
+++ b/pkgs/development/python2-modules/wheel/0001-tests-Rename-a-a-o-_-.py-_-.py.patch
@@ -0,0 +1,37 @@
+From 5879a4bbc34d1eb25e160b15b2f5a4f10eac6bd2 Mon Sep 17 00:00:00 2001
+From: toonn <toonn@toonn.io>
+Date: Mon, 13 Sep 2021 18:07:26 +0200
+Subject: [PATCH] =?UTF-8?q?tests:=20Rename=20a=CC=8Aa=CC=88o=CC=88=5F?=
+ =?UTF-8?q?=E6=97=A5=E6=9C=AC=E8=AA=9E.py=20=3D>=20=C3=A6=C9=90=C3=B8=5F?=
+ =?UTF-8?q?=E6=97=A5=E6=9C=AC=E5=83=B9.py?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+`åäö_日本語.py` normalizes differently in NFC and NFD normal forms. This
+means a hash generated for the source directory can differ depending on
+whether or not the filesystem is normalizing and which normal form it
+uses.
+
+By renaming the file to `æɐø_日本價.py` we avoid this issue by using a
+name that has the same encoding in each normal form.
+---
+ tests/test_bdist_wheel.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
+index 651c034..9b94ac8 100644
+--- a/tests/test_bdist_wheel.py
++++ b/tests/test_bdist_wheel.py
+@@ -58,7 +58,7 @@ def test_unicode_record(wheel_paths):
+     with ZipFile(path) as zf:
+         record = zf.read('unicode.dist-0.1.dist-info/RECORD')
+ 
+-    assert u'åäö_日本語.py'.encode('utf-8') in record
++    assert u'æɐø_日本價.py'.encode('utf-8') in record
+ 
+ 
+ def test_licenses_default(dummy_dist, monkeypatch, tmpdir):
+-- 
+2.17.2 (Apple Git-113)
+
diff --git a/pkgs/development/python2-modules/wheel/default.nix b/pkgs/development/python2-modules/wheel/default.nix
new file mode 100644
index 000000000000..8735a37b21ff
--- /dev/null
+++ b/pkgs/development/python2-modules/wheel/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, bootstrapped-pip
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "wheel";
+  version = "0.37.1";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-JlTmUPY3yo/uROyd3nW1dJa23zbLhgQTwcmqZkPOrHs=";
+    name = "${pname}-${version}-source";
+    postFetch = ''
+      cd $out
+      mv tests/testdata/unicode.dist/unicodedist/åäö_日本語.py \
+        tests/testdata/unicode.dist/unicodedist/æɐø_日本價.py
+      patch -p1 < ${./0001-tests-Rename-a-a-o-_-.py-_-.py.patch}
+    '';
+  };
+
+  nativeBuildInputs = [
+    bootstrapped-pip
+    setuptools
+  ];
+
+  # No tests in archive
+  doCheck = false;
+  pythonImportsCheck = [ "wheel" ];
+
+  # We add this flag to ignore the copy installed by bootstrapped-pip
+  pipInstallFlags = [ "--ignore-installed" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pypa/wheel";
+    description = "A built-package format for Python";
+    longDescription = ''
+      This library is the reference implementation of the Python wheel packaging standard,
+      as defined in PEP 427.
+
+      It has two different roles:
+
+      - A setuptools extension for building wheels that provides the bdist_wheel setuptools command
+      - A command line tool for working with wheel files
+
+      It should be noted that wheel is not intended to be used as a library,
+      and as such there is no stable, public API.
+    '';
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ siriobalmelli ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/rr/default.nix b/pkgs/development/tools/analysis/rr/default.nix
index e9437d718cf7..40a7909f34a1 100644
--- a/pkgs/development/tools/analysis/rr/default.nix
+++ b/pkgs/development/tools/analysis/rr/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace src/Command.cc --replace '_BSD_SOURCE' '_DEFAULT_SOURCE'
     sed '7i#include <math.h>' -i src/Scheduler.cc
+    sed '1i#include <ctime>' -i src/test-monitor/test-monitor.cc
     patchShebangs .
   '';
 
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 3bec558803b4..9949ec7ec7c7 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Fix build on ELFv2 powerpc64
+    # https://bugs.kde.org/show_bug.cgi?id=398883
+    (fetchurl {
+      url = "https://github.com/void-linux/void-packages/raw/3e16b4606235885463fc9ab45b4c120f1a51aa28/srcpkgs/valgrind/patches/elfv2-ppc64-be.patch";
+      sha256 = "NV/F+5aqFZz7+OF5oN5MUTpThv4H5PEY9sBgnnWohQY=";
+    })
     # Fix checks on Musl.
     # https://bugs.kde.org/show_bug.cgi?id=453929
     (fetchpatch {
diff --git a/pkgs/development/tools/build-managers/cmake/002-application-services.diff b/pkgs/development/tools/build-managers/cmake/002-application-services.diff
index 7c77336b41be..56f7cd266b7a 100644
--- a/pkgs/development/tools/build-managers/cmake/002-application-services.diff
+++ b/pkgs/development/tools/build-managers/cmake/002-application-services.diff
@@ -1,20 +1,18 @@
-diff --git a/Source/CMakeLists.txt b/Source/CMakeLists.txt
-index 9a18184fd3..278d146dd1 100644
---- a/Source/CMakeLists.txt
-+++ b/Source/CMakeLists.txt
-@@ -933,7 +933,6 @@ endif()
+diff -Naur cmake-3.25.1-old/Source/CMakeLists.txt cmake-3.25.1-new/Source/CMakeLists.txt
+--- cmake-3.25.1-old/Source/CMakeLists.txt	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Source/CMakeLists.txt	2022-12-19 01:00:08.412064304 -0300
+@@ -916,7 +916,6 @@
  # On Apple we need CoreFoundation and CoreServices
  if(APPLE)
-   target_link_libraries(CMakeLib "-framework CoreFoundation")
--  target_link_libraries(CMakeLib "-framework CoreServices")
+   target_link_libraries(CMakeLib PUBLIC "-framework CoreFoundation")
+-  target_link_libraries(CMakeLib PUBLIC "-framework CoreServices")
  endif()
  
  if(WIN32 AND NOT UNIX)
-diff --git a/Source/cmGlobalXCodeGenerator.cxx b/Source/cmGlobalXCodeGenerator.cxx
-index 77403b076a..d5aac95e1e 100644
---- a/Source/cmGlobalXCodeGenerator.cxx
-+++ b/Source/cmGlobalXCodeGenerator.cxx
-@@ -49,10 +49,6 @@ struct cmLinkImplementation;
+diff -Naur cmake-3.25.1-old/Source/cmGlobalXCodeGenerator.cxx cmake-3.25.1-new/Source/cmGlobalXCodeGenerator.cxx
+--- cmake-3.25.1-old/Source/cmGlobalXCodeGenerator.cxx	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Source/cmGlobalXCodeGenerator.cxx	2022-12-19 01:00:56.065135169 -0300
+@@ -56,10 +56,6 @@
  
  #if !defined(CMAKE_BOOTSTRAP) && defined(__APPLE__)
  #  include <CoreFoundation/CoreFoundation.h>
@@ -25,19 +23,17 @@ index 77403b076a..d5aac95e1e 100644
  #endif
  
  #if !defined(CMAKE_BOOTSTRAP)
-diff --git a/Utilities/cmlibarchive/CMakeLists.txt b/Utilities/cmlibarchive/CMakeLists.txt
-index 79452ffff6..a848731b7e 100644
---- a/Utilities/cmlibarchive/CMakeLists.txt
-+++ b/Utilities/cmlibarchive/CMakeLists.txt
-@@ -2013,11 +2013,6 @@ IF(ENABLE_TEST)
+diff -Naur cmake-3.25.1-old/Utilities/cmlibarchive/CMakeLists.txt cmake-3.25.1-new/Utilities/cmlibarchive/CMakeLists.txt
+--- cmake-3.25.1-old/Utilities/cmlibarchive/CMakeLists.txt	2022-11-30 10:57:03.000000000 -0300
++++ cmake-3.25.1-new/Utilities/cmlibarchive/CMakeLists.txt	2022-12-19 01:01:43.392205981 -0300
+@@ -2041,10 +2041,6 @@
+   ADD_CUSTOM_TARGET(run_all_tests)
  ENDIF(ENABLE_TEST)
- ENDIF()
  
 -# We need CoreServices on Mac OS.
 -IF(APPLE)
 -  LIST(APPEND ADDITIONAL_LIBS "-framework CoreServices")
 -ENDIF(APPLE)
--
+ 
  add_subdirectory(libarchive)
  IF(0) # CMake does not build libarchive's command-line tools.
- add_subdirectory(cat)
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 0a1e191ba360..2aff749ebcb0 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -40,11 +40,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.24.3";
+  version = "3.25.1";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-tTqhD6gr/4TM21kGWSe3LTvuSfTYYmEkn8CYSzs2cpE=";
+    sha256 = "sha256-HFEdCVFq9JNpTtm68TxVlHo2OJZ01lei1eDM7caykdg=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 5591b1634236..d0306dd33a49 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,19 +1,26 @@
 { lib
+, stdenv
 , fetchpatch
 , installShellFiles
 , ninja
 , pkg-config
 , python3
+, zlib
+, coreutils
 , substituteAll
+, Foundation
+, OpenGL
+, AppKit
+, Cocoa
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "0.64.1";
+  version = "1.0.0";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Oo4DDCM094IIX4FicGLMbUpnce3zHgVf/jdPnmsImrk=";
+    hash = "sha256-qlCkukVXwl59SERqv96FeVfc31g4X/++Zwug6O+szgU=";
   };
 
   patches = [
@@ -61,17 +68,38 @@ python3.pkgs.buildPythonApplication rec {
         "docs/yaml/objects/dep.yaml"
       ];
     })
-  ];
+
+    # tests: avoid unexpected failure when cmake is not installed
+    # https://github.com/mesonbuild/meson/pull/11321
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/a38ad3039d0680f3ac34a6dc487776c79c48acf3.patch";
+      hash = "sha256-9YaXwc+F3Pw4BjuOXqva4MD6DAxX1k5WLbn0xzwuEmw=";
+    })
+  ]
+    # Nixpkgs cctools does not have bitcode support.
+    ++ lib.optional stdenv.isDarwin ./disable-bitcode.patch;
+
+  postPatch = if stdenv.isDarwin then ''
+    rm -r 'test cases/osx/7 bitcode'
+  '' else null;
 
   setupHook = ./setup-hook.sh;
 
-  # Meson included tests since 0.45, however they fail in Nixpkgs because they
-  # require a typical building environment (including C compiler and stuff).
-  # Just for the sake of documentation, the next lines are maintained here.
-  doCheck = false;
   nativeCheckInputs = [ ninja pkg-config ];
+  checkInputs = [ zlib ]
+    ++ lib.optionals stdenv.isDarwin [ Foundation OpenGL AppKit Cocoa ];
   checkPhase = ''
-    python ./run_project_tests.py
+    patchShebangs "test cases"
+    substituteInPlace "test cases/native/8 external program shebang parsing/script.int.in" \
+      --replace /usr/bin/env ${coreutils}/bin/env
+    # requires git, creating cyclic dependency
+    rm -r "test cases/common/66 vcstag"
+    # requires glib, creating cyclic dependency
+    rm -r "test cases/linuxlike/6 subdir include order"
+    rm -r "test cases/linuxlike/9 compiler checks with dependencies"
+    # requires static zlib, see #66461
+    rm -r "test cases/linuxlike/14 static dynamic linkage"
+    HOME="$TMPDIR" python ./run_project_tests.py
   '';
 
   postFixup = ''
@@ -84,6 +112,9 @@ python3.pkgs.buildPythonApplication rec {
 
     # Do not propagate Python
     rm $out/nix-support/propagated-build-inputs
+
+    substituteInPlace "$out/share/bash-completion/completions/meson" \
+      --replace "python3 -c " "${python3.interpreter} -c "
   '';
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/build-managers/meson/disable-bitcode.patch b/pkgs/development/tools/build-managers/meson/disable-bitcode.patch
new file mode 100644
index 000000000000..a72997c10439
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/disable-bitcode.patch
@@ -0,0 +1,24 @@
+--- a/mesonbuild/compilers/mixins/clang.py
++++ b/mesonbuild/compilers/mixins/clang.py
+@@ -56,10 +56,6 @@ class ClangCompiler(GnuLikeCompiler):
+             {OptionKey('b_colorout'), OptionKey('b_lto_threads'), OptionKey('b_lto_mode'), OptionKey('b_thinlto_cache'),
+              OptionKey('b_thinlto_cache_dir')})
+ 
+-        # TODO: this really should be part of the linker base_options, but
+-        # linkers don't have base_options.
+-        if isinstance(self.linker, AppleDynamicLinker):
+-            self.base_options.add(OptionKey('b_bitcode'))
+         # All Clang backends can also do LLVM IR
+         self.can_compile_suffixes.add('ll')
+ 
+--- a/mesonbuild/linkers/linkers.py
++++ b/mesonbuild/linkers/linkers.py
+@@ -785,7 +785,7 @@ class AppleDynamicLinker(PosixDynamicLinkerMixin, DynamicLinker):
+         return self._apply_prefix('-headerpad_max_install_names')
+ 
+     def bitcode_args(self) -> T.List[str]:
+-        return self._apply_prefix('-bitcode_bundle')
++        raise MesonException('Nixpkgs cctools does not support bitcode bundles')
+ 
+     def fatal_warnings(self) -> T.List[str]:
+         return self._apply_prefix('-fatal_warnings')
diff --git a/pkgs/development/tools/build-managers/waf/default.nix b/pkgs/development/tools/build-managers/waf/default.nix
index 8fcb5f2dbac1..4e42927d0293 100644
--- a/pkgs/development/tools/build-managers/waf/default.nix
+++ b/pkgs/development/tools/build-managers/waf/default.nix
@@ -8,13 +8,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "waf";
-  version = "2.0.24";
+  version = "2.0.25";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "${pname}-${version}";
-    sha256 = "sha256-nunPDYAy0yfDJpsc+E8SyyFLny19wwrVzxeUOhh7nc4=";
+    sha256 = "sha256-wqZEAfGRHhcd7Xm2pQ0FTjZGfuPafRrZAUdpc7ACoEA=";
   };
 
   nativeBuildInputs = [ python3 ensureNewerSourcesForZipFilesHook ];
diff --git a/pkgs/development/tools/glslviewer/default.nix b/pkgs/development/tools/glslviewer/default.nix
index fcebe93aaa2d..06016bec25b5 100644
--- a/pkgs/development/tools/glslviewer/default.nix
+++ b/pkgs/development/tools/glslviewer/default.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
     sha256 = "0v7x93b61ama0gmzlx1zc56jgi7bvzsfvbkfl82xzwf2h5g1zni7";
   };
 
+  postPatch = ''
+    sed '1i#include <cstring>' -i src/tools/text.cpp # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config ensureNewerSourcesForZipFilesHook python3Packages.six ];
   buildInputs = [
     glfw libGLU glfw libXrandr libXdamage
diff --git a/pkgs/development/tools/misc/binutils/build-components-separately.patch b/pkgs/development/tools/misc/binutils/build-components-separately.patch
deleted file mode 100644
index 0b4162d84880..000000000000
--- a/pkgs/development/tools/misc/binutils/build-components-separately.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-diff --git a/bfd/configure.ac b/bfd/configure.ac
-index fec067b2135..377e1f5443f 100644
---- a/bfd/configure.ac
-+++ b/bfd/configure.ac
-@@ -292,30 +292,16 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
- 
- LT_LIB_M
- 
--# When building a shared libbfd, link against the pic version of libiberty
--# so that apps that use libbfd won't need libiberty just to satisfy any
--# libbfd references.
--# We can't do that if a pic libiberty is unavailable since including non-pic
--# code would insert text relocations into libbfd.
- SHARED_LIBADD=
--SHARED_LDFLAGS=
-+SHARED_LDFLAGS=-liberty
- if test "$enable_shared" = "yes"; then
--changequote(,)dnl
--  x=`sed -n -e 's/^[ 	]*PICFLAG[ 	]*=[ 	]*//p' < ../libiberty/Makefile | sed -n '$p'`
--changequote([,])dnl
--  if test -n "$x"; then
--    SHARED_LIBADD="-L`pwd`/../libiberty/pic -liberty"
--  fi
--fi
--
- SHARED_LIBADD="$SHARED_LIBADD $LIBINTL"
- 
--if test "$enable_shared" = "yes"; then
-   case "${host}" in
-   # More hacks to build DLLs on Windows.
-   *-*-cygwin*)
-     SHARED_LDFLAGS="-no-undefined"
--    SHARED_LIBADD="-L`pwd`/../libiberty -liberty $SHARED_LIBADD -lcygwin -lkernel32"
-+    SHARED_LIBADD="-liberty $SHARED_LIBADD -lcygwin -lkernel32"
-   ;;
-   esac
- 
-diff --git a/opcodes/Makefile.am b/opcodes/Makefile.am
-index 0e04b4c05c4..848a02662e7 100644
---- a/opcodes/Makefile.am
-+++ b/opcodes/Makefile.am
-@@ -51,7 +51,7 @@ libopcodes_la_LDFLAGS += -rpath $(rpath_bfdlibdir)
- endif
- 
- # This is where bfd.h lives.
--BFD_H = ../bfd/bfd.h
-+BFD_H = $(BFDDIR)/bfd.h
- 
- BUILD_LIBS = @BUILD_LIBS@
- BUILD_LIB_DEPS = @BUILD_LIB_DEPS@
-@@ -303,7 +303,7 @@ OFILES = @BFD_MACHINES@
- # development.sh is used to determine -Werror default.
- CONFIG_STATUS_DEPENDENCIES = $(BFDDIR)/development.sh
- 
--AM_CPPFLAGS = -I. -I$(srcdir) -I../bfd -I$(INCDIR) -I$(BFDDIR) @HDEFINES@ @INCINTL@
-+AM_CPPFLAGS = -I. -I$(srcdir) -I$(INCDIR) -I$(BFDDIR) @HDEFINES@ @INCINTL@
- 
- disassemble.lo: disassemble.c
- if am__fastdepCC
-@@ -327,9 +327,18 @@ libopcodes_la_SOURCES =  dis-buf.c disassemble.c dis-init.c
--libopcodes_la_DEPENDENCIES = $(OFILES) @SHARED_DEPENDENCIES@
-+libopcodes_la_DEPENDENCIES = $(OFILES) @SHARED_DEPENDENCIES@ libtool-soversion
- libopcodes_la_LIBADD = $(OFILES) @SHARED_LIBADD@
--libopcodes_la_LDFLAGS += -release `cat ../bfd/libtool-soversion` @SHARED_LDFLAGS@
-+libopcodes_la_LDFLAGS += -release `cat libtool-soversion` @SHARED_LDFLAGS@
- # Allow dependency tracking to work on all the source files.
- EXTRA_libopcodes_la_SOURCES = $(LIBOPCODES_CFILES)
- 
-+libtool-soversion:
-+	@echo "creating $@"
-+	bfd_soversion="$(VERSION)" ;\
-+	. $(BFDDIR)/development.sh ;\
-+	if test "$$development" = true ; then \
-+	  bfd_soversion="$(VERSION).$${bfd_version_date}" ;\
-+	fi ;\
-+	echo "$${bfd_soversion}" > $@
-+
- # libtool will build .libs/libopcodes.a.  We create libopcodes.a in
- # the build directory so that we don't have to convert all the
- # programs that use libopcodes.a simultaneously.  This is a hack which
-diff --git a/opcodes/configure.ac b/opcodes/configure.ac
-index e564f067334..5da62a3d58b 100644
---- a/opcodes/configure.ac
-+++ b/opcodes/configure.ac
-@@ -98,6 +98,8 @@ BFD_64_BIT
- AC_SUBST(HDEFINES)
- AC_PROG_INSTALL
- 
-+GCC_HEADER_STDINT(bfd_stdint.h)
-+
- AC_CHECK_DECLS([basename, stpcpy])
- 
- # Check if sigsetjmp is available.  Using AC_CHECK_FUNCS won't do
-@@ -148,44 +150,21 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
- 
- LT_LIB_M
- 
--#Libs for generator progs
--if test "x$cross_compiling" = "xno"; then
--  BUILD_LIBS=../libiberty/libiberty.a
--  BUILD_LIB_DEPS=$BUILD_LIBS
--else
--  # if cross-compiling, assume that the system provides -liberty
--  # and that the version is compatible with new headers.
--  BUILD_LIBS=-liberty
--  BUILD_LIB_DEPS=
--fi
--BUILD_LIBS="$BUILD_LIBS $LIBINTL"
--BUILD_LIB_DEPS="$BUILD_LIB_DEPS $LIBINTL_DEP"
-+BUILD_LIBS="-liberty $LIBINTL"
-+BUILD_LIB_DEPS="$LIBINTL_DEP"
- 
- AC_SUBST(BUILD_LIBS)
- AC_SUBST(BUILD_LIB_DEPS)
- 
- # Horrible hacks to build DLLs on Windows and a shared library elsewhere.
- SHARED_LDFLAGS=
--SHARED_LIBADD=
-+SHARED_LIBADD=-liberty
- SHARED_DEPENDENCIES=
--if test "$enable_shared" = "yes"; then
--# When building a shared libopcodes, link against the pic version of libiberty
--# so that apps that use libopcodes won't need libiberty just to satisfy any
--# libopcodes references.
--# We can't do that if a pic libiberty is unavailable since including non-pic
--# code would insert text relocations into libopcodes.
- # Note that linking against libbfd as we do here, which is itself linked
- # against libiberty, may not satisfy all the libopcodes libiberty references
- # since libbfd may not pull in the entirety of libiberty.
- # Also, jam libintl into the right place in all of this: after libiberty,
- # which uses it, but before -lcygwin, which it uses.
--changequote(,)dnl
--  x=`sed -n -e 's/^[ 	]*PICFLAG[ 	]*=[ 	]*//p' < ../libiberty/Makefile | sed -n '$p'`
--changequote([,])dnl
--  if test -n "$x"; then
--    SHARED_LIBADD="-L`pwd`/../libiberty/pic -liberty"
--  fi
--fi
- 
- SHARED_LIBADD="$SHARED_LIBADD $LIBINTL"
- 
-@@ -193,11 +172,10 @@ if test "$enable_shared" = "yes"; then
-   case "${host}" in
-     *-*-cygwin*)
-       SHARED_LDFLAGS="-no-undefined"
--      SHARED_LIBADD="-L`pwd`/../bfd -lbfd -L`pwd`/../libiberty -liberty $SHARED_LIBADD"
-+      SHARED_LIBADD="-lbfd -liberty $SHARED_LIBADD"
-       ;;
-     *)
--      SHARED_LIBADD="../bfd/libbfd.la ${SHARED_LIBADD}"
--      SHARED_DEPENDENCIES="../bfd/libbfd.la"
-+      SHARED_LIBADD="-lbfd ${SHARED_LIBADD}"
-       ;;
-   esac
- 
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 39e852a60bbb..208b404f1ead 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -31,12 +31,12 @@ assert enableGold -> withGold stdenv.targetPlatform;
 let
   inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-  version = "2.39";
+  version = "2.40";
 
   srcs = {
     normal = fetchurl {
       url = "mirror://gnu/binutils/binutils-${version}.tar.bz2";
-      sha256 = "sha256-2iSoT+8iAQLdJAQt8G/eqFHCYUpTd/hu/6KPM7exYUg=";
+      hash = "sha256-+CmOsVOks30RLpRapcsoUAQLzyaj6mW1pxXIOv4F5Io=";
     };
     vc4-none = fetchFromGitHub {
       owner = "itszor";
@@ -84,12 +84,10 @@ stdenv.mkDerivation (finalAttrs: {
     # cross-compiling.
     ./always-search-rpath.patch
 
-    # Upstream backport of https://sourceware.org/PR29451:
-    # Don't emit 0-sized debug entries for objects without size.
-    # Without the change elfutils on i686-linux fail dwarf validity test:
-    #    https://sourceware.org/PR29450
-    # Remove once 2.40 releases.
-    ./gas-dwarf-zero-PR29451.patch
+    # Avoid `lib -> out -> lib` reference. Normally `bfd-plugins` does
+    # not need to know binutils' BINDIR at all. It's an absolute path
+    # where libraries are stored.
+    ./plugins-no-BINDIR.patch
   ]
   ++ lib.optional targetPlatform.isiOS ./support-ios.patch
   # Adds AVR-specific options to "size" for compatibility with Atmel's downstream distribution
@@ -105,7 +103,15 @@ stdenv.mkDerivation (finalAttrs: {
       else ./mips64-default-n64.patch)
   ;
 
-  outputs = [ "out" "info" "man" ];
+  outputs = [ "out" "info" "man" "dev" ]
+  # Ideally we would like to always install 'lib' into a separate
+  # target. Unfortunately cross-compiled binutils installs libraries
+  # across both `$lib/lib/` and `$out/$target/lib` with a reference
+  # from $out to $lib. Probably a binutils bug: all libraries should go
+  # to $lib as binutils does not build target libraries. Let's make our
+  # life slightly simpler by installing everything into $out for
+  # cross-binutils.
+  ++ lib.optionals (targetPlatform == hostPlatform) [ "lib" ];
 
   strictDeps = true;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -196,8 +202,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Unconditionally disable:
     # - musl target needs porting: https://sourceware.org/PR29477
-    # - all targets rely on javac: https://sourceware.org/PR29479
     "--disable-gprofng"
+
+    # By default binutils searches $libdir for libraries. This brings in
+    # libbfd and libopcodes into a default visibility. Drop default lib
+    # path to force users to declare their use of these libraries.
+    "--with-lib-path=:"
   ]
   ++ lib.optionals withAllTargets [ "--enable-targets=all" ]
   ++ lib.optionals enableGold [ "--enable-gold" "--enable-plugins" ]
@@ -218,10 +228,26 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  # For the same reason we don't split "lib" output we undo the $target/
+  # prefix for installed headers and libraries we link:
+  #   $out/$host/$target/lib/*     to $out/lib/
+  #   $out/$host/$target/include/* to $dev/include/*
+  # TODO(trofi): fix installation paths upstream so we could remove this
+  # code and have "lib" output unconditionally.
+  postInstall = lib.optionalString (hostPlatform.config != targetPlatform.config) ''
+    ln -s $out/${hostPlatform.config}/${targetPlatform.config}/lib/*     $out/lib/
+    ln -s $out/${hostPlatform.config}/${targetPlatform.config}/include/* $dev/include/
+  '';
+
   passthru = {
     inherit targetPrefix;
     hasGold = enableGold;
     isGNU = true;
+    # Having --enable-plugins is not enough, system has to support
+    # dlopen() or equivalent. See config/plugins.m4 and configure.ac
+    # (around PLUGINS) for cases that support or not support plugins.
+    # No platform specific filters yet here.
+    hasPluginAPI = enableGold;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch b/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch
deleted file mode 100644
index 5f1293f8f732..000000000000
--- a/pkgs/development/tools/misc/binutils/gas-dwarf-zero-PR29451.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=d7abcbcea5ddd40a3bf28758b62f35933c59f996
-
-Don't emit 0-sized debug entries for objects without size.
-Without the change elfutils on i686-linux fail dwarf validity test:
-    https://sourceware.org/PR29450
---- a/gas/dwarf2dbg.c
-+++ b/gas/dwarf2dbg.c
-@@ -2882,6 +2882,7 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	{
- 	  const char *name;
- 	  size_t len;
-+	  expressionS size = { .X_op = O_constant };
- 
- 	  /* Skip warning constructs (see above).  */
- 	  if (symbol_get_bfdsym (symp)->flags & BSF_WARNING)
-@@ -2895,6 +2896,18 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	  if (!S_IS_DEFINED (symp) || !S_IS_FUNCTION (symp))
- 	    continue;
- 
-+#if defined (OBJ_ELF) /* || defined (OBJ_MAYBE_ELF) */
-+	  size.X_add_number = S_GET_SIZE (symp);
-+	  if (size.X_add_number == 0 && IS_ELF
-+	      && symbol_get_obj (symp)->size != NULL)
-+	    {
-+	      size.X_op = O_add;
-+	      size.X_op_symbol = make_expr_symbol (symbol_get_obj (symp)->size);
-+	    }
-+#endif
-+	  if (size.X_op == O_constant && size.X_add_number == 0)
-+	    continue;
-+
- 	  subseg_set (str_seg, 0);
- 	  name_sym = symbol_temp_new_now_octets ();
- 	  name = S_GET_NAME (symp);
-@@ -2920,29 +2933,17 @@ out_debug_info (segT info_seg, segT abbrev_seg, segT line_seg, segT str_seg,
- 	  emit_expr (&exp, sizeof_address);
- 
- 	  /* DW_AT_high_pc */
--	  exp.X_op = O_constant;
--#if defined (OBJ_ELF) /* || defined (OBJ_MAYBE_ELF) */
--	  exp.X_add_number = S_GET_SIZE (symp);
--	  if (exp.X_add_number == 0 && IS_ELF
--	      && symbol_get_obj (symp)->size != NULL)
--	    {
--	      exp.X_op = O_add;
--	      exp.X_op_symbol = make_expr_symbol (symbol_get_obj (symp)->size);
--	    }
--#else
--	  exp.X_add_number = 0;
--#endif
- 	  if (DWARF2_VERSION < 4)
- 	    {
--	      if (exp.X_op == O_constant)
--		exp.X_op = O_symbol;
--	      exp.X_add_symbol = symp;
--	      emit_expr (&exp, sizeof_address);
-+	      if (size.X_op == O_constant)
-+		size.X_op = O_symbol;
-+	      size.X_add_symbol = symp;
-+	      emit_expr (&size, sizeof_address);
- 	    }
--	  else if (exp.X_op == O_constant)
--	    out_uleb128 (exp.X_add_number);
-+	  else if (size.X_op == O_constant)
-+	    out_uleb128 (size.X_add_number);
- 	  else
--	    emit_leb128_expr (symbol_get_value_expression (exp.X_op_symbol), 0);
-+	    emit_leb128_expr (symbol_get_value_expression (size.X_op_symbol), 0);
- 	}
- 
-       /* End of children.  */
diff --git a/pkgs/development/tools/misc/binutils/libbfd.nix b/pkgs/development/tools/misc/binutils/libbfd.nix
index 16737a7b5ee8..dca62b82eead 100644
--- a/pkgs/development/tools/misc/binutils/libbfd.nix
+++ b/pkgs/development/tools/misc/binutils/libbfd.nix
@@ -1,45 +1,22 @@
 { lib, stdenv
-, buildPackages
-, gnu-config, autoreconfHook, bison, binutils-unwrapped, texinfo
-, libiberty, libintl, zlib
+, binutils-unwrapped-all-targets
 }:
 
 stdenv.mkDerivation {
   pname = "libbfd";
-  inherit (binutils-unwrapped) version src;
+  inherit (binutils-unwrapped-all-targets) version;
 
-  outputs = [ "out" "dev" ];
-
-  patches = binutils-unwrapped.patches ++ [
-    ./build-components-separately.patch
+  dontUnpack = true;
+  dontBuild = true;
+  dontInstall = true;
+  propagatedBuildInputs = [
+    binutils-unwrapped-all-targets.dev
+    binutils-unwrapped-all-targets.lib
   ];
 
-  # We just want to build libbfd
-  postPatch = ''
-    cd bfd
-  '';
-
-  postAutoreconf = ''
-    echo "Updating config.guess and config.sub from ${gnu-config}"
-    cp -f ${gnu-config}/config.{guess,sub} ../
-  '';
-
-  # We update these ourselves
-  dontUpdateAutotoolsGnuConfigScripts = true;
-
-  strictDeps = true;
-  nativeBuildInputs = [ autoreconfHook bison texinfo ];
-  buildInputs = [ libiberty zlib ] ++ lib.optionals stdenv.isDarwin [ libintl ];
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  configurePlatforms = [ "build" "host" ];
-  configureFlags = [
-    "--enable-targets=all" "--enable-64-bit-bfd"
-    "--enable-install-libbfd"
-    "--with-system-zlib"
-  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared";
-
-  enableParallelBuilding = true;
+  passthru = {
+    inherit (binutils-unwrapped-all-targets) dev hasPluginAPI;
+  };
 
   meta = with lib; {
     description = "A library for manipulating containers of machine code";
diff --git a/pkgs/development/tools/misc/binutils/libopcodes.nix b/pkgs/development/tools/misc/binutils/libopcodes.nix
index e4b6cec41b4f..e067282a0e5e 100644
--- a/pkgs/development/tools/misc/binutils/libopcodes.nix
+++ b/pkgs/development/tools/misc/binutils/libopcodes.nix
@@ -1,38 +1,22 @@
-{ lib, stdenv, buildPackages
-, autoreconfHook, bison, binutils-unwrapped
-, libiberty, libbfd
+{ lib, stdenv
+, binutils-unwrapped-all-targets
 }:
 
 stdenv.mkDerivation {
   pname = "libopcodes";
-  inherit (binutils-unwrapped) version src;
+  inherit (binutils-unwrapped-all-targets) version;
 
-  outputs = [ "out" "dev" ];
-
-  patches = binutils-unwrapped.patches ++ [
-    ./build-components-separately.patch
+  dontUnpack = true;
+  dontBuild = true;
+  dontInstall = true;
+  propagatedBuildInputs = [
+    binutils-unwrapped-all-targets.dev
+    binutils-unwrapped-all-targets.lib
   ];
 
-  # We just want to build libopcodes
-  postPatch = ''
-    cd opcodes
-    find . ../include/opcode -type f -exec sed {} -i -e 's/"bfd.h"/<bfd.h>/' \;
-  '';
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ autoreconfHook bison ];
-  buildInputs = [ libiberty ];
-  # dis-asm.h includes bfd.h
-  propagatedBuildInputs = [ libbfd ];
-
-  configurePlatforms = [ "build" "host" ];
-  configureFlags = [
-    "--enable-targets=all" "--enable-64-bit-bfd"
-    "--enable-install-libbfd"
-    "--enable-shared"
-  ];
-
-  enableParallelBuilding = true;
+  passthru = {
+    inherit (binutils-unwrapped-all-targets) dev hasPluginAPI;
+  };
 
   meta = with lib; {
     description = "A library from binutils for manipulating machine code";
diff --git a/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch b/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch
new file mode 100644
index 000000000000..562aad33eccd
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/plugins-no-BINDIR.patch
@@ -0,0 +1,25 @@
+Avoid `lib -> out -> lib` reference. Normally `bfd-plugins` does not
+need to know binutils' BINDIR at all. It's an absolute path where
+libraries are stored.
+--- a/bfd/plugin.c
++++ b/bfd/plugin.c
+@@ -493,7 +493,7 @@ build_plugin_list (bfd *abfd)
+      when configuring binutils using --libdir.  Search in the proper
+      path first, then the old one for backwards compatibility.  */
+   static const char *path[]
+-    = { LIBDIR "/bfd-plugins", BINDIR "/../lib/bfd-plugins" };
++    = { LIBDIR "/bfd-plugins", };
+   struct stat last_st;
+   unsigned int i;
+ 
+@@ -508,9 +508,7 @@ build_plugin_list (bfd *abfd)
+   last_st.st_ino = 0;
+   for (i = 0; i < sizeof (path) / sizeof (path[0]); i++)
+     {
+-      char *plugin_dir = make_relative_prefix (plugin_program_name,
+-					       BINDIR,
+-					       path[i]);
++      char *plugin_dir = xstrdup (path[i]);
+       if (plugin_dir)
+ 	{
+ 	  struct stat st;
diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index 6c2799cfadf7..5c7720a2024b 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -36,8 +36,11 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    wrapProgram "$out/bin/runtest" \
-      --prefix PATH ":" "${expect}/bin"
+    # 'runtest' and 'dejagnu' look up 'expect' in their 'bin' path
+    # first. We avoid use of 'wrapProgram' here because  wrapping
+    # of shell scripts does not preserve argv[0] for schell scripts:
+    #   https://sourceware.org/PR30052#c5
+    ln -s ${expect}/bin/expect $out/bin/expect
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/edb/default.nix b/pkgs/development/tools/misc/edb/default.nix
index ec65ca62fa30..2203863264f3 100644
--- a/pkgs/development/tools/misc/edb/default.nix
+++ b/pkgs/development/tools/misc/edb/default.nix
@@ -30,6 +30,8 @@ mkDerivation rec {
 
     # Change default optional terminal program path to one that is more likely to work on NixOS.
     substituteInPlace ./src/Configuration.cpp --replace "/usr/bin/xterm" "xterm";
+
+    sed '1i#include <memory>' -i include/{RegisterViewModelBase,State,IState}.h # gcc12
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/gperf/default.nix b/pkgs/development/tools/misc/gperf/default.nix
index 71b0bbd0b0d6..d836e5a973ae 100644
--- a/pkgs/development/tools/misc/gperf/default.nix
+++ b/pkgs/development/tools/misc/gperf/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qispg6i508rq8pkajh26cznwimbnj06wq9sd85vg95v8nwld1aq";
   };
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "Perfect hash function generator";
 
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 1d25dc8c6e0d..5c54941b9077 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "help2man";
-  version = "1.49.2";
+  version = "1.49.3";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ni4OITp+CjYkTu1iBNkCtlBGAqV4tuzRUmixRU3q3TY=";
+    url = "mirror://gnu/help2man/help2man-${version}.tar.xz";
+    sha256 = "sha256-TX5P3vLspq/geiaCFRzqeHgeCk6PliIULZ9wwIOi/U8=";
   };
 
   strictDeps = true;
@@ -25,9 +25,9 @@ stdenv.mkDerivation rec {
     "--enable-nls"
   ];
 
-  doCheck = false;                                # target `check' is missing
+  doCheck = false; # target `check' is missing
 
-  patches = if stdenv.hostPlatform.isCygwin then [ ./1.40.4-cygwin-nls.patch ] else null;
+  patches = lib.optional stdenv.hostPlatform.isCygwin ./1.40.4-cygwin-nls.patch;
 
   # We don't use makeWrapper here because it uses substitutions our
   # bootstrap shell can't handle.
@@ -36,8 +36,7 @@ stdenv.mkDerivation rec {
     cat > $out/bin/help2man <<EOF
     #! $SHELL -e
     export PERL5LIB=\''${PERL5LIB:+:}${perlPackages.LocaleGettext}/${perlPackages.perl.libPrefix}
-    ${lib.optionalString stdenv.hostPlatform.isCygwin
-        ''export PATH=\''${PATH:+:}${gettext}/bin''}
+    ${lib.optionalString stdenv.hostPlatform.isCygwin ''export PATH=\''${PATH:+:}${gettext}/bin''}
     exec -a \$0 $out/bin/.help2man-wrapped "\$@"
     EOF
     chmod +x $out/bin/help2man
@@ -45,14 +44,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Generate man pages from `--help' output";
-
-    longDescription =
-      '' help2man produces simple manual pages from the ‘--help’ and
-         ‘--version’ output of other commands.
-      '';
-
+    longDescription = ''
+      help2man produces simple manual pages from the ‘--help’ and ‘--version’ output of other commands.
+    '';
     homepage = "https://www.gnu.org/software/help2man/";
-
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = with maintainers; [ pSub ];
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index 017367e90ba6..2faefedd6656 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -6,13 +6,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.96.5";
+  version = "4.98.0";
 
   src = fetchFromGitHub {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    hash = "sha256-3ZEGCKc7inbqcE4LuhfKON3C8LebVOlZPEhOHVgx8Lo=";
+    sha256 = "sha256-DQLY0a0sOCZFEJA4Y4b18OcWZw47RyqKZ0mVG0CDVTI=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/misc/lsof/no-build-info.patch b/pkgs/development/tools/misc/lsof/no-build-info.patch
index c433fd6e08f8..3c518896b045 100644
--- a/pkgs/development/tools/misc/lsof/no-build-info.patch
+++ b/pkgs/development/tools/misc/lsof/no-build-info.patch
@@ -1,6 +1,6 @@
---- a/usage.c	2018-02-14 15:20:32.000000000 +0100
-+++ b/usage.c	2018-10-08 21:57:45.718560869 +0200
-@@ -930,24 +930,6 @@
+--- a/usage.c
++++ b/usage.c
+@@ -931,24 +931,6 @@ usage(err, fh, version)
  		(void) fprintf(stderr, "    configuration info: %s\n", cp);
  #endif	/* defined(LSOF_CINFO) */
  
@@ -19,22 +19,22 @@
 -		    cp1 ? cp1 : "",
 -		    (cp && cp1) ? "@" : "",
 -		    cp  ? cp  : ""
--		);
+-		    );
 -	    }
 -
  #if	defined(LSOF_BLDCMT)
  	    if ((cp = isnullstr(LSOF_BLDCMT)))
  		(void) fprintf(stderr, "    builder's comment: %s\n", cp);
-@@ -959,12 +939,8 @@
+@@ -958,12 +940,6 @@ usage(err, fh, version)
  		(void) fprintf(stderr, "    compiler: %s\n", cp);
  	    if ((cp = isnullstr(LSOF_CCV)))
  		(void) fprintf(stderr, "    compiler version: %s\n", cp);
 -	    if ((cp = isnullstr(LSOF_CCFLAGS)))
 -		(void) fprintf(stderr, "    compiler flags: %s\n", cp);
- 	    if ((cp = isnullstr(LSOF_LDFLAGS)))
- 		(void) fprintf(stderr, "    loader flags: %s\n", cp);
+-	    if ((cp = isnullstr(LSOF_LDFLAGS)))
+-		(void) fprintf(stderr, "    loader flags: %s\n", cp);
 -	    if ((cp = isnullstr(LSOF_SYSINFO)))
 -		(void) fprintf(stderr, "    system info: %s\n", cp);
- 	    (void) report_SECURITY("    ", ".\n");
- 	    (void) report_WARNDEVACCESS("    ", "are", ".\n");
- 	    (void) report_HASKERNIDCK("    K", "is");
+ 	    // display configurations that might affect output
+ 	    char *features[] = {
+ #if	defined(HASEFFNLINK)
diff --git a/pkgs/development/tools/misc/pahole/default.nix b/pkgs/development/tools/misc/pahole/default.nix
index ec9fb436f764..39b6baabc836 100644
--- a/pkgs/development/tools/misc/pahole/default.nix
+++ b/pkgs/development/tools/misc/pahole/default.nix
@@ -2,11 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pahole";
-  version = "1.24";
+  # Need a revision that supports DW_TAG_unspecified_type(0x3b).
+  # Was added after 1.24 release in a series of changes.
+  # Can switch back to release tags once 1.25 is cut.
+  version = "1.24-unstable-2022-11-24";
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/devel/pahole/pahole.git";
-    rev = "v${version}";
-    sha256 = "sha256-OPseVKt5kIKgK096+ufKrWMS1E/7Z0uxNqCMN6wKfKg=";
+    rev = "02d67c51765dfbd5893087da63744c864c7cc9e0";
+    hash = "sha256-hKc8UKxPtEM2zlYmolSt1pXJKNRt4wC/Uf+dP/Sb7+s=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index 84f1670e6dff..8799fbd62d39 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -19,6 +19,7 @@ let
     nativeBuildInputs = [ pkg-config cpio python3 python3.pkgs.setuptools ];
     buildInputs = [ elfutils gettext ];
     enableParallelBuilding = true;
+    NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ]; # Needed with GCC 12
   };
 
   ## a kernel build dir as expected by systemtap
diff --git a/pkgs/development/tools/wlcs/default.nix b/pkgs/development/tools/wlcs/default.nix
index 7a5470a33423..4ec4403987a3 100644
--- a/pkgs/development/tools/wlcs/default.nix
+++ b/pkgs/development/tools/wlcs/default.nix
@@ -42,6 +42,11 @@ stdenv.mkDerivation rec {
     wayland
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
   };
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index fa6dcbf28a77..86accf5977b3 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
diff --git a/pkgs/games/cataclysm-dda/stable.nix b/pkgs/games/cataclysm-dda/stable.nix
index 3bf2f884ab36..da84422308cc 100644
--- a/pkgs/games/cataclysm-dda/stable.nix
+++ b/pkgs/games/cataclysm-dda/stable.nix
@@ -44,6 +44,11 @@ let
       "VERSION=${version}"
     ];
 
+    NIX_CFLAGS_COMPILE = [
+      # Needed with GCC 12
+      "-Wno-error=array-bounds"
+    ];
+
     meta = common.meta // {
       maintainers = with lib.maintainers;
         common.meta.maintainers ++ [ skeidel ];
diff --git a/pkgs/games/cdogs-sdl/default.nix b/pkgs/games/cdogs-sdl/default.nix
index 23eb6e96dcb8..a4943187dd69 100644
--- a/pkgs/games/cdogs-sdl/default.nix
+++ b/pkgs/games/cdogs-sdl/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
     "-DCMAKE_C_FLAGS=-Wno-error=array-bounds"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake
diff --git a/pkgs/games/eboard/default.nix b/pkgs/games/eboard/default.nix
index 293811e9b040..81bc6d365a0c 100644
--- a/pkgs/games/eboard/default.nix
+++ b/pkgs/games/eboard/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
   '';
 
   NIX_CFLAGS_COMPILE = "-fpermissive";
-  NIX_LDFLAGS = "-ldl";
 
   meta = {
     homepage = "http://www.bergo.eng.br/eboard/";
diff --git a/pkgs/games/gimx/default.nix b/pkgs/games/gimx/default.nix
index 785d38a759a0..410228c4f02f 100644
--- a/pkgs/games/gimx/default.nix
+++ b/pkgs/games/gimx/default.nix
@@ -38,6 +38,14 @@ in stdenv.mkDerivation rec {
   '';
 
   makeFlags = [ "build-core" ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=use-after-free"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/games/liquidwar/default.nix b/pkgs/games/liquidwar/default.nix
index e012886c884d..9d9e4243452c 100644
--- a/pkgs/games/liquidwar/default.nix
+++ b/pkgs/games/liquidwar/default.nix
@@ -30,11 +30,15 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE =
-    "-Wno-error=deprecated-declarations" +
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ] ++ [
+    "-Wno-error=deprecated-declarations"
     # Avoid GL_GLEXT_VERSION double definition
     " -DNO_SDL_GLEXT"
-  ;
+  ];
 
   # To avoid problems finding SDL_types.h.
   configureFlags = [ "CFLAGS=-I${lib.getDev SDL}/include/SDL" ];
diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
index 389f59f91a6a..8df88c92ff1c 100644
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@@ -63,6 +63,10 @@ mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    sed '1i#include <memory>' -i components/myguiplatform/myguidatamanager.cpp # gcc12
+  '';
+
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
 
   buildInputs = [
diff --git a/pkgs/games/openrct2/default.nix b/pkgs/games/openrct2/default.nix
index d474b0eae92a..10914d410774 100644
--- a/pkgs/games/openrct2/default.nix
+++ b/pkgs/games/openrct2/default.nix
@@ -94,6 +94,11 @@ stdenv.mkDerivation {
     "-DDOWNLOAD_TITLE_SEQUENCES=OFF"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   postUnpack = ''
     cp -r ${objects-src}         $sourceRoot/data/object
     cp -r ${title-sequences-src} $sourceRoot/data/sequence
diff --git a/pkgs/games/stepmania/default.nix b/pkgs/games/stepmania/default.nix
index 2445ee9096c9..6cb7a23dff5f 100644
--- a/pkgs/games/stepmania/default.nix
+++ b/pkgs/games/stepmania/default.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
     ./0001-fix-build-with-ffmpeg-4.patch
   ];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i src/arch/ArchHooks/ArchHooks.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake nasm ];
 
   buildInputs = [
diff --git a/pkgs/games/supertux/default.nix b/pkgs/games/supertux/default.nix
index 679500f974c3..857617bc4bfa 100644
--- a/pkgs/games/supertux/default.nix
+++ b/pkgs/games/supertux/default.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
     sha256 = "1xkr3ka2sxp5s0spp84iv294i29s1vxqzazb6kmjc0n415h0x57p";
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i external/partio_zip/zip_manager.hpp # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config cmake ];
 
   buildInputs = [
diff --git a/pkgs/games/zod/default.nix b/pkgs/games/zod/default.nix
index 737fed1e7f64..e0c2031dde25 100644
--- a/pkgs/games/zod/default.nix
+++ b/pkgs/games/zod/default.nix
@@ -22,6 +22,9 @@ let
     url = "mirror://sourceforge/zod/linux_releases/zod_linux-${version}.tar.gz";
     sha256 = "017v96aflrv07g8j8zk9mq8f8rqxl5228rjff5blq8dxpsv1sx7h";
   };
+  postPatch = ''
+    sed '1i#include <ctime>' -i zod_src/common.cpp # gcc12
+  '';
   nativeBuildInputs = [
     makeWrapper
   ];
@@ -37,7 +40,7 @@ let
   hardeningDisable = [ "format" ];
   NIX_LDFLAGS = "-L${libmysqlclient}/lib/mysql";
   zod_engine = stdenv.mkDerivation {
-    inherit version src nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
+    inherit version src postPatch nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
     pname = "${name}-engine";
     enableParallelBuilding = true;
     preBuild = "cd zod_src";
@@ -48,7 +51,7 @@ let
     '';
   };
   zod_map_editor = stdenv.mkDerivation {
-    inherit version src nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
+    inherit version src postPatch nativeBuildInputs buildInputs hardeningDisable NIX_LDFLAGS;
     pname = "${name}-map_editor";
     enableParallelBuilding = true;
     preBuild = "cd zod_src";
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 42d7021f3452..a36005872500 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -92,16 +92,6 @@ let
 
     passAsFile = [ "extraConfig" ];
 
-    # Workaround '-idirafter' ordering bug in staging-next:
-    #   https://github.com/NixOS/nixpkgs/pull/210004
-    # where libc '-idirafter' gets added after user's idirafter and
-    # breaks.
-    # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-    preConfigure = ''
-      export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] buildPackages.stdenv.hostPlatform.config}=$(< ${buildPackages.stdenv.cc}/nix-support/libc-cflags)
-      export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"]               stdenv.hostPlatform.config}=$(<               ${stdenv.cc}/nix-support/libc-cflags)
-    '';
-
     configurePhase = ''
       runHook preConfigure
 
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
index d8fc4648029a..560f2bf30147 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.7.2";
+  version = "1.2.8";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ijW3IY5Q8qLHk0LQ3pje2BQ5zhnhKAk4Xsm+lZbefC8=";
+    hash = "sha256-GrAbdOM0JcqZwuNsCET9aIgnMZO9iYJA/o+TrMvL80c=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
index 512fe605b6e5..4568ecf1e7a8 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-ucm-conf";
-  version = "1.2.7.1";
+  version = "1.2.8";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    hash = "sha256-rFsqEnV4Pv8H4cs0w2xsWYd0JnmjQAN1B8BKncHSLKw=";
+    hash = "sha256-/uSnN4MP0l+WnYPaRqKyMb6whu/ZZvzAfSJeeCMmCug=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index 2a98aa82ebbd..9c41a217badc 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -85,6 +85,11 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
+  # Flag needed by GCC 12 but unrecognized by GCC 9 (aarch64-linux default now)
+  NIX_CFLAGS_COMPILE = lib.optionals (with stdenv; cc.isGNU && lib.versionAtLeast cc.version "12") [
+    "-Wno-error=mismatched-new-delete"
+  ];
+
   patchPhase = ''
     patchShebangs scripts
 
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index 886bf3e6fee8..8312d64acddc 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -31,7 +31,6 @@ stdenv.mkDerivation {
 
   preBuild = ''
     substituteInPlace Makefile \
-      --replace "\$(shell uname -r)" "${kernel.modDirVersion}" \
       --replace "/lib/modules" "${kernel.dev}/lib/modules"
   '';
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 8fb826833704..d7a13faf4a0b 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.364";
+  version = "0.366";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-9fGYoyj7vN3j72H+6jv/R0MaWPZ+4UNQhCSWnZRZZS4=";
+    sha256 = "sha256-Qn5fx4EiE4bGmPaMcB3ne0wS5ZRRgZC+cYEH5HCRQ7g=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index 198cd8681646..efc64e81af55 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -65,8 +65,8 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
   GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
   GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 310178b9a1fd..18c32930f368 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -57,8 +57,12 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [ perl libelf ]
-    ++ optional (lib.versionAtLeast version "5.13") zstd;
+  moduleBuildDependencies = [
+    perl
+    libelf
+    # module makefiles often run uname commands to find out the kernel version
+    (buildPackages.deterministic-uname.override { inherit modDirVersion; })
+  ] ++ optional (lib.versionAtLeast version "5.13") zstd;
 
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
     let
diff --git a/pkgs/os-specific/linux/mxu11x0/default.nix b/pkgs/os-specific/linux/mxu11x0/default.nix
index ee29180a8d9d..17d0c6938206 100644
--- a/pkgs/os-specific/linux/mxu11x0/default.nix
+++ b/pkgs/os-specific/linux/mxu11x0/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
 
   version = mxu_version + "-${kernel.version}";
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   preBuild = ''
-    sed -i -e "s/\$(uname -r).*/${kernel.modDirVersion}/g" driver/mxconf
-    sed -i -e "s/\$(shell uname -r).*/${kernel.modDirVersion}/g" driver/Makefile
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/mxconf
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/Makefile
   '';
diff --git a/pkgs/os-specific/linux/ocf-resource-agents/default.nix b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
index 8d7f2b527144..976c5f1779d7 100644
--- a/pkgs/os-specific/linux/ocf-resource-agents/default.nix
+++ b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
@@ -42,6 +42,11 @@ let
       python3
     ];
 
+    NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+      # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+      "-Wno-error=maybe-uninitialized"
+    ];
+
     meta = with lib; {
       homepage = "https://github.com/ClusterLabs/resource-agents";
       description = "Combined repository of OCF agents from the RHCS and Linux-HA projects";
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index 3aeef4625562..7cb364597bb6 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -25,6 +25,7 @@ in stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
     dpdk_19_11
     libconfig
@@ -38,6 +39,12 @@ in stdenv.mkDerivation rec {
     libbpf
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
   # binaries will segfault otherwise
   dontStrip = true;
 
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 20db1cdd74f9..60a55096b446 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -46,6 +46,12 @@ stdenv.mkDerivation rec {
   RTE_SDK = dpdk;
   GUI = lib.optionalString withGtk "true";
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ];
+
   # requires symbols from this file
   NIX_LDFLAGS = "-lrte_net_bond";
 
diff --git a/pkgs/os-specific/linux/projecteur/default.nix b/pkgs/os-specific/linux/projecteur/default.nix
index 63de7453935c..ecb0fe535d35 100644
--- a/pkgs/os-specific/linux/projecteur/default.nix
+++ b/pkgs/os-specific/linux/projecteur/default.nix
@@ -13,6 +13,10 @@ mkDerivation rec {
     sha256 = "sha256-kg6oYtJ4H5A6RNATBg+XvMfCb9FlhEBFjfxamGosMQg=";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i src/device.h # gcc12
+  '';
+
   buildInputs = [ qtbase qtgraphicaleffects ];
   nativeBuildInputs = [ wrapQtAppsHook cmake pkg-config ];
 
diff --git a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
index 0f2e00c8382f..ecfd6a87e6b4 100644
--- a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
@@ -14,7 +14,6 @@ stdenv.mkDerivation {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -30,9 +29,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ bc ];
-
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
 
   preInstall = ''
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index e50129f1e2b9..a89eb3702e8b 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation rec {
 
   prePatch = ''
     substituteInPlace ./Makefile --replace /lib/modules/ "${kernel.dev}/lib/modules/"
-    substituteInPlace ./Makefile --replace '$(shell uname -r)' "${kernel.modDirVersion}"
     substituteInPlace ./Makefile --replace /sbin/depmod \#
     substituteInPlace ./Makefile --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8723ds/default.nix b/pkgs/os-specific/linux/rtl8723ds/default.nix
index 4aa408eec414..be4b954c1b61 100644
--- a/pkgs/os-specific/linux/rtl8723ds/default.nix
+++ b/pkgs/os-specific/linux/rtl8723ds/default.nix
@@ -13,8 +13,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
@@ -25,7 +24,6 @@ stdenv.mkDerivation {
   postPatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace "/sbin/depmod" "#" \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index 84ad6a314e15..bd682ec5933d 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -11,21 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-25NaMQq9H6mqVynNQJXpqISAslxfEVSt3ELzG7s4mV4=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" "format" ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index dd0b32c53801..d8825f018979 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821au/default.nix b/pkgs/os-specific/linux/rtl8821au/default.nix
index 6a0da0c5e19b..7ba338d37859 100644
--- a/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -11,8 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wx7xQBCfLu3UWB7ghp8dZ7OB2MFd5i8X0/ygyvW2K50=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
 
@@ -20,7 +19,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
     ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
@@ -30,7 +28,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
index 674af264c39c..476bce22fb11 100644
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -24,7 +24,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index edc2d5bc44c0..35b068fd8d08 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl88x2bu/default.nix b/pkgs/os-specific/linux/rtl88x2bu/default.nix
index 38ded6041f59..d3560aca91ad 100644
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
index 80c14a0b3834..a2f7ca0e815d 100644
--- a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
@@ -14,14 +14,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-JUyUOqLMD9nSo6i87K/6Ljp+pWSqSBz/IZiFWu03rQw=";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index e871d6618c34..b03f3c3c16c6 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -131,7 +131,7 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "252.4";
+  version = "252.5";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -148,7 +148,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-8ejSEt3QyCSARGGVbXWac2dB9jdUpC4eX2rN0iENQX0=";
+    hash = "sha256-cNZRTuYFMR1z6KpELeQoJahMhRl4fKuRuc3xXH3KzlM=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
diff --git a/pkgs/os-specific/linux/vmware/default.nix b/pkgs/os-specific/linux/vmware/default.nix
index 162ae766a845..73c579288bca 100644
--- a/pkgs/os-specific/linux/vmware/default.nix
+++ b/pkgs/os-specific/linux/vmware/default.nix
@@ -20,14 +20,12 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace Makefile \
       --replace '/lib/modules/$(VM_UNAME)/misc' "$out/lib/modules/${kernel.modDirVersion}/misc" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/modinfo "${kmod}/bin/modinfo" \
       --replace 'test -z "$(DESTDIR)"' "0"
 
     for module in "vmmon-only" "vmnet-only"; do
       substituteInPlace "./$module/Makefile" \
         --replace '/lib/modules/' "${kernel.dev}/lib/modules/" \
-        --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
         --replace /bin/grep "${gnugrep}/bin/grep"
     done
   '';
diff --git a/pkgs/servers/foundationdb/cmake.nix b/pkgs/servers/foundationdb/cmake.nix
index 9d65198c8cef..436f0a7fc4d1 100644
--- a/pkgs/servers/foundationdb/cmake.nix
+++ b/pkgs/servers/foundationdb/cmake.nix
@@ -60,6 +60,11 @@ let
             (lib.optionalString (!useClang) "-DUSE_LD=GOLD")
           ];
 
+        NIX_CFLAGS_COMPILE = [
+          # Needed with GCC 12
+          "-Wno-error=missing-template-keyword"
+        ];
+
         inherit patches;
 
         # fix up the use of the very weird and custom 'fdb_install' command by just
diff --git a/pkgs/servers/mail/exim/default.nix b/pkgs/servers/mail/exim/default.nix
index cd407ef37ec7..1a911668a540 100644
--- a/pkgs/servers/mail/exim/default.nix
+++ b/pkgs/servers/mail/exim/default.nix
@@ -64,8 +64,8 @@ stdenv.mkDerivation rec {
       ${lib.optionalString enableMySQL ''
         s:^# \(LOOKUP_MYSQL=yes\)$:\1:
         s:^# \(LOOKUP_MYSQL_PC=libmysqlclient\)$:\1:
-        s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -ldl -lm -lpthread -lz:
-        s:^# \(LOOKUP_LIBS\)=.*:\1=-lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -ldl -lm -lpthread -lz:
+        s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -lm -lpthread -lz:
+        s:^# \(LOOKUP_LIBS\)=.*:\1=-lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -lm -lpthread -lz:
         s:^# \(LOOKUP_INCLUDE\)=.*:\1=-I${libmysqlclient.dev}/include/mysql/:
       ''}
       ${lib.optionalString enableAuthDovecot ''
diff --git a/pkgs/servers/monitoring/nagios/default.nix b/pkgs/servers/monitoring/nagios/default.nix
index a58ec2bf7b29..edf82742bc53 100644
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--localstatedir=/var/lib/nagios" ];
   buildFlags = [ "all" ];
-  CFLAGS = "-ldl";
 
   # Do not create /var directories
   preInstall = ''
diff --git a/pkgs/servers/nosql/influxdb/default.nix b/pkgs/servers/nosql/influxdb/default.nix
index 185c246e6fac..a80975926e8d 100644
--- a/pkgs/servers/nosql/influxdb/default.nix
+++ b/pkgs/servers/nosql/influxdb/default.nix
@@ -33,7 +33,7 @@ let
       Version: ${libflux_version}
       Description: Library for the InfluxData Flux engine
       Cflags: -I/out/include
-      Libs: -L/out/lib -lflux -ldl -lpthread
+      Libs: -L/out/lib -lflux -lpthread
     '';
     passAsFile = [ "pkgcfg" ];
     postInstall = ''
diff --git a/pkgs/servers/nosql/influxdb2/default.nix b/pkgs/servers/nosql/influxdb2/default.nix
index 41bba89996bf..4f86cc4da530 100644
--- a/pkgs/servers/nosql/influxdb2/default.nix
+++ b/pkgs/servers/nosql/influxdb2/default.nix
@@ -51,7 +51,7 @@ let
       Version: ${libflux_version}
       Description: Library for the InfluxData Flux engine
       Cflags: -I/out/include
-      Libs: -L/out/lib -lflux -ldl -lpthread
+      Libs: -L/out/lib -lflux -lpthread
     '';
     passAsFile = [ "pkgcfg" ];
     postInstall = ''
diff --git a/pkgs/servers/openafs/1.8/default.nix b/pkgs/servers/openafs/1.8/default.nix
index d6e2f20ecdbe..8ebed1c27464 100644
--- a/pkgs/servers/openafs/1.8/default.nix
+++ b/pkgs/servers/openafs/1.8/default.nix
@@ -89,7 +89,6 @@ stdenv.mkDerivation {
     )
   '' + optionalString withTsm ''
     export XBSA_CFLAGS="-Dxbsa -DNEW_XBSA -I${tsm-client}/lib64/sample -DXBSA_TSMLIB=\\\"${tsm-client}/lib64/libApiTSM64.so\\\""
-    export XBSA_XLIBS="-ldl"
   '';
 
   buildFlags = [ "all_nolibafs" ];
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index ed163f2547df..cddda5d399f2 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bzip2 libxml2 libzip boost lua luabind tbb expat ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=stringop-overflow"
+    "-Wno-error=uninitialized"
+  ];
+
   postInstall = "mkdir -p $out/share/osrm-backend && cp -r ../profiles $out/share/osrm-backend/profiles";
 
   meta = {
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 93df798c8bcb..c5e08b8279a3 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -207,45 +207,45 @@ let
 in self: {
 
   postgresql_11 = self.callPackage generic {
-    version = "11.18";
+    version = "11.19";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    hash = "sha256-0k8g78UukYrPvMoh6c6ijg4mO4RqDECPz6w7PEoPdQQ=";
+    hash = "sha256-ExCeK3HxE5QFwnIB2jczphrOcu4cIo2cnwMg4GruFMI=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.13";
+    version = "12.14";
     psqlSchema = "12";
-    hash = "sha256-tsYjBGr0VI8RqEtAeTTWddEe0HDHk9FbBGg79fMi4C0=";
+    hash = "sha256-eFYQI304LIQtNW40cTjljAb/6uJA5swLUqxevMMNBD4=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.9";
+    version = "13.10";
     psqlSchema = "13";
-    hash = "sha256-7xlmwKXkn77TNwrSgkkoy2sRZGF67q4WBtooP38zpBU=";
+    hash = "sha256-W7z1pW2FxE86iwWPtGhi/0nLyRg00H4pXQLm3jwhbfI=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.6";
+    version = "14.7";
     psqlSchema = "14";
-    hash = "sha256-UIhA/BgJ05q3InTV8Tfau5/X+0+TPaQWiu67IAae3yI=";
+    hash = "sha256-zvYPAJj6gQHBVG9CVORbcir1QxM3lFs3ryBwB2MNszE=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
   };
 
   postgresql_15 = self.callPackage generic {
-    version = "15.1";
+    version = "15.2";
     psqlSchema = "15";
-    hash = "sha256-ZP3yPXNK+tDf5Ad9rKlqxR3NaX5ori09TKbEXLFOIa4=";
+    hash = "sha256-maIXH8PWtbX1a3V6ejy4XVCaOOQnOAXe8jlB7SuEaMc=";
     this = self.postgresql_15;
     thisAttr = "postgresql_15";
     inherit self;
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 833d31de4013..325632da48ce 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -78,6 +78,9 @@ in stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = [
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-truncation"
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but unrecognized with GCC 9
+    "-Wno-error=use-after-free"
   ];
 
   configureFlags = [
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 0907d814171f..e46d8e750a03 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -22,18 +22,18 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  bdftopcf = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
+  bdftopcf = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
     pname = "bdftopcf";
-    version = "1.1";
+    version = "1.1.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/bdftopcf-1.1.tar.bz2";
-      sha256 = "18hiscgljrz10zjcws25bis32nyrg3hzgmiq6scrh7izqmgz0kab";
+      url = "https://xorg.freedesktop.org/archive/individual/util/bdftopcf-1.1.1.tar.xz";
+      sha256 = "026rzs92h9jsc7r0kvvyvwhm22q0805gp38rs14x6ghg7kam7j8i";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ ];
+    buildInputs = [ xorgproto ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
@@ -178,11 +178,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontalias = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
     pname = "font-alias";
-    version = "1.0.3";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/font/font-alias-1.0.3.tar.bz2";
-      sha256 = "16ic8wfwwr3jicaml7b5a0sk6plcgc1kg84w02881yhwmqm3nicb";
+      url = "mirror://xorg/individual/font/font-alias-1.0.4.tar.bz2";
+      sha256 = "0xjjjindczv3g7m1597l0x19zz75xy70wh5garghz61fpzl1l4gk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -890,18 +890,18 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libxcb, xtrans }: stdenv.mkDerivation {
+  libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpthreadstubs, libxcb, xtrans }: stdenv.mkDerivation {
     pname = "libX11";
-    version = "1.8.1";
+    version = "1.8.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.8.1.tar.xz";
-      sha256 = "1xyry8i7zqmlkvpbyyqwi18rrdw6ycczlvfp63rh2570pfhimi0v";
+      url = "mirror://xorg/individual/lib/libX11-1.8.3.tar.xz";
+      sha256 = "1gc5cnfys48m1y9y1cidph89fww5c209qff93phbidh68346a5g3";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ xorgproto libxcb xtrans ];
+    buildInputs = [ xorgproto libpthreadstubs libxcb xtrans ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
@@ -1516,11 +1516,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   lndir = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
     pname = "lndir";
-    version = "1.0.3";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/util/lndir-1.0.3.tar.bz2";
-      sha256 = "0pdngiy8zdhsiqx2am75yfcl36l7kd7d7nl0rss8shcdvsqgmx29";
+      url = "mirror://xorg/individual/util/lndir-1.0.4.tar.xz";
+      sha256 = "11syg5hx3f7m1d2p7zw717lryk819h6wk8h4vmapfdxvsflkfd1y";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3436,11 +3436,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xset = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, libXmu, xorgproto, libXxf86misc }: stdenv.mkDerivation {
     pname = "xset";
-    version = "1.2.4";
+    version = "1.2.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xset-1.2.4.tar.bz2";
-      sha256 = "0my987wjvra7l92ry6q44ky383yg3phzxhdbn3lqhapm1ll9bzg4";
+      url = "mirror://xorg/individual/app/xset-1.2.5.tar.xz";
+      sha256 = "0bsyyx3k32k9vpb8x3ks7hlfr03nm0i14fv3cg6n4f2vcdajsscz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index b0530977f7e2..d0a2ec881219 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -184,6 +184,7 @@ self: super:
     propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ xorg.libSM ];
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     CPP = if stdenv.isDarwin then "clang -E -" else "${stdenv.cc.targetPrefix}cc -E -";
+    outputDoc = "devdoc";
     outputs = [ "out" "dev" "devdoc" ];
   });
 
@@ -591,6 +592,7 @@ self: super:
 
   xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
     buildInputs =  attrs.buildInputs ++ [ mesa mesa.driversdev llvm ]; # for libxatracker
+    NIX_CFLAGS_COMPILE = [ "-Wno-error=address" ]; # gcc12
     meta = attrs.meta // {
       platforms = ["i686-linux" "x86_64-linux"];
     };
@@ -861,6 +863,11 @@ self: super:
             url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/ccdd431cd8f1cabae9d744f0514b6533c438908c.diff";
             sha256 = "sha256-IGPsjS7KgRPLrs1ImBXvIFCa8Iu5ZiAHRZvHlBYP8KQ=";
           })
+          (fetchpatch {
+            name = "CVE-2023-0494.diff";
+            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec.diff";
+            sha256 = "sha256-/+IuGk09OYVEIB/Y+DTKf7kfHyukEFX/6u1FDIGJieY=";
+          })
         ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
         propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
@@ -886,6 +893,11 @@ self: super:
           "--disable-tls"
         ];
 
+        NIX_CFLAGS_COMPILE = [
+          # Needed with GCC 12
+          "-Wno-error=array-bounds"
+        ];
+
         postInstall = ''
           rm -fr $out/share/X11/xkb/compiled # otherwise X will try to write in it
           ( # assert() keeps runtime reference xorgserver-dev in xf86-video-intel and others
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 9a82416d3050..dd09fbba34f5 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -8,7 +8,7 @@ https://xcb.freedesktop.org/dist/xcb-util-keysyms-0.4.0.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-renderutil-0.3.9.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-wm-0.4.1.tar.bz2
 mirror://xorg/individual/app/appres-1.0.5.tar.bz2
-mirror://xorg/individual/app/bdftopcf-1.1.tar.bz2
+https://xorg.freedesktop.org/archive/individual/util/bdftopcf-1.1.1.tar.xz
 mirror://xorg/individual/app/bitmap-1.0.9.tar.gz
 mirror://xorg/individual/app/editres-1.0.7.tar.bz2
 mirror://xorg/individual/app/fonttosfnt-1.2.2.tar.bz2
@@ -64,7 +64,7 @@ mirror://xorg/individual/app/xprop-1.2.6.tar.xz
 mirror://xorg/individual/app/xrandr-1.5.1.tar.xz
 mirror://xorg/individual/app/xrdb-1.2.1.tar.bz2
 mirror://xorg/individual/app/xrefresh-1.0.6.tar.bz2
-mirror://xorg/individual/app/xset-1.2.4.tar.bz2
+mirror://xorg/individual/app/xset-1.2.5.tar.xz
 mirror://xorg/individual/app/xsetroot-1.1.2.tar.bz2
 mirror://xorg/individual/app/xsm-1.0.4.tar.bz2
 mirror://xorg/individual/app/xstdcmap-1.0.4.tar.bz2
@@ -135,7 +135,7 @@ mirror://xorg/individual/font/font-adobe-75dpi-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.4.tar.bz2
-mirror://xorg/individual/font/font-alias-1.0.3.tar.bz2
+mirror://xorg/individual/font/font-alias-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-arabic-misc-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-bh-100dpi-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-bh-75dpi-1.0.3.tar.bz2
@@ -174,7 +174,7 @@ mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.8.1.tar.xz
+mirror://xorg/individual/lib/libX11-1.8.3.tar.xz
 mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2
 mirror://xorg/individual/lib/libxcb-1.14.tar.xz
@@ -213,7 +213,7 @@ mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
 mirror://xorg/individual/proto/xorgproto-2021.5.tar.bz2
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
 mirror://xorg/individual/util/imake-1.0.8.tar.bz2
-mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
+mirror://xorg/individual/util/lndir-1.0.4.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2
 mirror://xorg/individual/util/util-macros-1.19.3.tar.bz2
 mirror://xorg/individual/util/xorg-cf-files-1.0.7.tar.bz2
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 1b787e56076b..932e81a5177e 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
+  separateDebugInfo = true;
+
   NIX_CFLAGS_COMPILE = ''
     -DSYS_BASHRC="/etc/bashrc"
     -DSYS_BASH_LOGOUT="/etc/bash_logout"
@@ -52,13 +54,14 @@ stdenv.mkDerivation rec {
 
   patchFlags = [ "-p0" ];
 
-  patches = upstreamPatches
-    ++ [ ./pgrp-pipe-5.patch ]
-    ++ lib.optional stdenv.hostPlatform.isStatic (fetchurl {
+  patches = upstreamPatches ++ [
+    ./pgrp-pipe-5.patch
+    (fetchurl {
       name = "fix-static.patch";
       url = "https://cgit.freebsd.org/ports/plain/shells/bash/files/patch-configure?id=3e147a1f594751a68fea00a28090d0792bee0b51";
       sha256 = "XHFMQ6eXTReNoywdETyrfQEv1rKF8+XFbQZP4YoVKFk=";
-    });
+    })
+  ];
 
   configureFlags = [
     (if interactive then "--with-installed-readline" else "--disable-readline")
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 46929315f07a..6cc6271eedbe 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -736,6 +736,7 @@ rec {
         pcre.out
         gettext
         binutils.bintools
+        binutils.bintools.lib
         darwin.binutils
         darwin.binutils.bintools
         curl.out
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 3c5a1bd543d5..3d60934557c6 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -173,6 +173,13 @@ let
   separateDebugInfo' = separateDebugInfo && stdenv.hostPlatform.isLinux && !(stdenv.hostPlatform.useLLVM or false);
   outputs' = outputs ++ lib.optional separateDebugInfo' "debug";
 
+  # Turn a derivation into its outPath without a string context attached.
+  # See the comment at the usage site.
+  unsafeDerivationToUntrackedOutpath = drv:
+    if lib.isDerivation drv
+    then builtins.unsafeDiscardStringContext drv.outPath
+    else drv;
+
   noNonNativeDeps = builtins.length (depsBuildTarget ++ depsBuildTargetPropagated
                                   ++ depsHostHost ++ depsHostHostPropagated
                                   ++ buildInputs ++ propagatedBuildInputs
@@ -444,6 +451,40 @@ else let
         "/bin/sh"
       ];
       __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
+    } //
+    # If we use derivations directly here, they end up as build-time dependencies.
+    # This is especially problematic in the case of disallowed*, since the disallowed
+    # derivations will be built by nix as build-time dependencies, while those
+    # derivations might take a very long time to build, or might not even build
+    # successfully on the platform used.
+    # We can improve on this situation by instead passing only the outPath,
+    # without an attached string context, to nix. The out path will be a placeholder
+    # which will be replaced by the actual out path if the derivation in question
+    # is part of the final closure (and thus needs to be built). If it is not
+    # part of the final closure, then the placeholder will be passed along,
+    # but in that case we know for a fact that the derivation is not part of the closure.
+    # This means that passing the out path to nix does the right thing in either
+    # case, both for disallowed and allowed references/requisites, and we won't
+    # build the derivation if it wouldn't be part of the closure, saving time and resources.
+    # While the problem is less severe for allowed*, since we want the derivation
+    # to be built eventually, we would still like to get the error early and without
+    # having to wait while nix builds a derivation that might not be used.
+    # See also https://github.com/NixOS/nix/issues/4629
+    lib.optionalAttrs (attrs ? disallowedReferences) {
+      disallowedReferences =
+        map unsafeDerivationToUntrackedOutpath attrs.disallowedReferences;
+    } //
+    lib.optionalAttrs (attrs ? disallowedRequisites) {
+      disallowedRequisites =
+        map unsafeDerivationToUntrackedOutpath attrs.disallowedRequisites;
+    } //
+    lib.optionalAttrs (attrs ? allowedReferences) {
+      allowedReferences =
+        lib.mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedReferences;
+    } //
+    lib.optionalAttrs (attrs ? allowedRequisites) {
+      allowedRequisites =
+        lib.mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedRequisites;
     };
 
   validity = checkMeta { inherit meta attrs; };
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index b1b982ecdffc..cbf2a2ceb8de 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -992,13 +992,22 @@ stripHash() {
 unpackCmdHooks+=(_defaultUnpack)
 _defaultUnpack() {
     local fn="$1"
+    local destination
 
     if [ -d "$fn" ]; then
 
+        destination="$(stripHash "$fn")"
+
+        if [ -e "$destination" ]; then
+            echo "Cannot copy $fn to $destination: destination already exists!"
+            echo "Did you specify two \"srcs\" with the same \"name\"?"
+            return 1
+        fi
+
         # We can't preserve hardlinks because they may have been
         # introduced by store optimization, which might break things
         # in the build.
-        cp -pr --reflink=auto -- "$fn" "$(stripHash "$fn")"
+        cp -pr --reflink=auto -- "$fn" "$destination"
 
     else
 
diff --git a/pkgs/test/stdenv/hooks.nix b/pkgs/test/stdenv/hooks.nix
index 7f25d7dbd2db..3d72efae6c47 100644
--- a/pkgs/test/stdenv/hooks.nix
+++ b/pkgs/test/stdenv/hooks.nix
@@ -23,19 +23,29 @@
     };
   make-symlinks-relative = stdenv.mkDerivation {
     name = "test-make-symlinks-relative";
+    outputs = [ "out" "man" ];
     buildCommand = ''
       mkdir -p $out/{bar,baz}
+      mkdir -p $man/share/{x,y}
       source1="$out/bar/foo"
       destination1="$out/baz/foo"
+      source2="$man/share/x/file1"
+      destination2="$man/share/y/file2"
       echo foo > $source1
+      echo foo > $source2
       ln -s $source1 $destination1
+      ln -s $source2 $destination2
       echo "symlink before patching: $(readlink $destination1)"
+      echo "symlink before patching: $(readlink $destination2)"
 
-      _makeSymlinksRelative
+      _makeSymlinksRelativeInAllOutputs
 
       echo "symlink after patching: $(readlink $destination1)"
       ([[ -e $destination1 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
       ([[ $(readlink $destination1) == "../bar/foo" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
+      echo "symlink after patching: $(readlink $destination2)"
+      ([[ -e $destination2 ]] && echo "symlink isn't broken") || (echo "symlink is broken" && exit 1)
+      ([[ $(readlink $destination2) == "../x/file1" ]] && echo "absolute symlink was made relative") || (echo "symlink was not made relative" && exit 1)
     '';
   };
   move-docs = stdenv.mkDerivation {
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index e4933986176e..2c282514d330 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-77X+AvHFWfYYIio3c+EYf11jg/1IbYhNUweRIDHMOZw=";
   };
 
-
   patches = [
     (fetchpatch {
       url = "https://patch-diff.githubusercontent.com/raw/TigerVNC/tigervnc/pull/1383.patch";
@@ -65,6 +64,10 @@ stdenv.mkDerivation rec {
     "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "out"}/bin"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=array-bounds"
+  ];
+
   postBuild = lib.optionalString stdenv.isLinux ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=int-to-pointer-cast -Wno-error=pointer-to-int-cast"
     export CXXFLAGS="$CXXFLAGS -fpermissive"
diff --git a/pkgs/tools/archivers/arc_unpacker/default.nix b/pkgs/tools/archivers/arc_unpacker/default.nix
index ab018fde3d64..2ade0f88a8d0 100644
--- a/pkgs/tools/archivers/arc_unpacker/default.nix
+++ b/pkgs/tools/archivers/arc_unpacker/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp tests/test_support/catch.h
+    sed '1i#include <limits>' -i src/dec/eagls/pak_archive_decoder.cc # gcc12
   '';
 
   checkPhase = ''
diff --git a/pkgs/tools/audio/mpris-scrobbler/default.nix b/pkgs/tools/audio/mpris-scrobbler/default.nix
index 35685fd5fb2f..0c051047c0fc 100644
--- a/pkgs/tools/audio/mpris-scrobbler/default.nix
+++ b/pkgs/tools/audio/mpris-scrobbler/default.nix
@@ -53,14 +53,17 @@ stdenv.mkDerivation rec {
     "-Dversion=${version}"
   ];
 
-  NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=address"
+  ] ++ lib.optionals stdenv.isDarwin [
     "-Wno-sometimes-uninitialized"
     "-Wno-tautological-pointer-compare"
   ] ++ lib.optionals stdenv.isLinux [
     "-Wno-array-bounds"
     "-Wno-free-nonheap-object"
     "-Wno-stringop-truncation"
-  ]);
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index a620a07d4753..b9bed9cc20c0 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -24,7 +24,11 @@ in stdenv.mkDerivation rec {
   pname = "blobfuse";
   inherit version src;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=catch-value"
+  ];
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse boost cpplite ];
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index d9ec176220ba..e2677957e9cd 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, runCommand, fetchurl
+{ lib, stdenv, runCommand, fetchurl, fetchpatch
 , ensureNewerSourcesHook
 , cmake, pkg-config
 , which, git
@@ -152,6 +152,21 @@ in rec {
 
     patches = [
       ./0000-fix-SPDK-build-env.patch
+      # pacific: include/buffer: include <memory>
+      # fixes build with gcc 12
+      # https://github.com/ceph/ceph/pull/47295
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/df88789a38c053513d3b2a9b7d12a952fc0c9042.patch";
+        hash = "sha256-je65kBfa5hR0ZKo6ZI10XmD5ZUbKj5rxlGxxI9ZJVfo=";
+      })
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/2abcbe4e47705e6e0fcc7d9d9b75625f563199af.patch";
+        hash = "sha256-8sWQKoZNHuGuhzX/F+3fY4+kjsrwsfoMdVpfVSj2x5w=";
+      })
+      (fetchpatch {
+        url = "https://github.com/ceph/ceph/pull/47295/commits/13dc077cf6c65a3b8c4f13d896847b9964b3fcbb.patch";
+        hash = "sha256-byfiZh9OJrux/y5m3QCPg0LET6q33ZDXmp/CN+yOSQQ=";
+      })
     ];
 
     nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/idsk/default.nix b/pkgs/tools/filesystems/idsk/default.nix
index 39052ecba935..34a32c4a6dfe 100644
--- a/pkgs/tools/filesystems/idsk/default.nix
+++ b/pkgs/tools/filesystems/idsk/default.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-std=c++14"
+  ];
+
   installPhase = ''
     mkdir -p $out/bin
     cp iDSK $out/bin
diff --git a/pkgs/tools/graphics/argyllcms/default.nix b/pkgs/tools/graphics/argyllcms/default.nix
index 2b17fa796e84..f06021693504 100644
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
 
       LINKFLAGS +=
         ${lib.concatStringsSep " " (map (x: "-L${x}/lib") buildInputs)}
-        -ldl -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
+        -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
         -ljpeg -ltiff -lpng -lssl ;
     '';
   in ''
diff --git a/pkgs/tools/graphics/libyafaray/default.nix b/pkgs/tools/graphics/libyafaray/default.nix
index db48aa678cc5..22bbfddbcf5d 100644
--- a/pkgs/tools/graphics/libyafaray/default.nix
+++ b/pkgs/tools/graphics/libyafaray/default.nix
@@ -26,6 +26,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-UVBA1vXOuLg4RT+BdF4rhbZ6I9ySeZX0N81gh3MH84I=";
   };
 
+  postPatch = ''
+    sed '1i#include <memory>' -i \
+      include/geometry/poly_double.h include/noise/noise_generator.h # gcc12
+  '';
+
   preConfigure = ''
     NIX_CFLAGS_COMPILE+=" -isystem ${ilmbase.dev}/include/OpenEXR"
   '';
diff --git a/pkgs/tools/graphics/pikchr/default.nix b/pkgs/tools/graphics/pikchr/default.nix
index aed3d485c4ad..d750d243fc36 100644
--- a/pkgs/tools/graphics/pikchr/default.nix
+++ b/pkgs/tools/graphics/pikchr/default.nix
@@ -1,6 +1,9 @@
 { lib
 , stdenv
 , fetchfossil
+, tcl
+
+, enableTcl ? true
 }:
 
 stdenv.mkDerivation {
@@ -19,14 +22,27 @@ stdenv.mkDerivation {
     substituteInPlace Makefile --replace open "test -f"
   '';
 
+  nativeBuildInputs = lib.optional enableTcl tcl.tclPackageHook;
+
+  buildInputs = lib.optional enableTcl tcl;
+
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
+  buildFlags = [ "pikchr" ] ++ lib.optional enableTcl "piktcl";
+
   installPhase = ''
+    runHook preInstall
     install -Dm755 pikchr $out/bin/pikchr
     install -Dm755 pikchr.out $out/lib/pikchr.o
     install -Dm644 pikchr.h $out/include/pikchr.h
+  '' + lib.optionalString enableTcl ''
+    cp -r piktcl $out/lib/piktcl
+  '' + ''
+    runHook postInstall
   '';
 
+  dontWrapTclBinaries = true;
+
   doCheck = true;
   checkTarget = "test";
 
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index 5ebbbe1e118b..5850fada2a70 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , libmnl
 , pkg-config
 , writeScript
@@ -8,13 +9,23 @@
 
 stdenv.mkDerivation rec {
   pname = "ethtool";
-  version = "6.0";
+  version = "6.1";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-1URsk95XDOaPOx6mnb+hL8/Wf8GYl/ZV0/GCMeK4GNY=";
+    sha256 = "sha256-xB/Igf+lpAQy0t2CnrRMZKSd7kgucWuqz5Jixk2qj5A=";
   };
 
+  patches = [
+    # Patch that fixes build with musl libc
+    # NOTE remove on next release, since it is applied in upstream
+    (fetchpatch {
+      name = "Fix-build-with-musl-libc.patch";
+      url = "https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/patch/marvell.c?id=41be533331fc3c6b711dbe532405782d3b8be5d1";
+      sha256 = "sha256-CItvt/eeNJkr1sOzaaHZhAnaybDutL9cT2O6XwQll+M=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 03be0c8b3be3..806d1bc24bdc 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "file";
-  version = "5.43";
+  version = "5.44";
 
   src = fetchurl {
     urls = [
       "https://astron.com/pub/file/${pname}-${version}.tar.gz"
       "https://distfiles.macports.org/file/${pname}-${version}.tar.gz"
     ];
-    sha256 = "sha256-jIAV6Rrg6NAyHZTHgjmJLvnbxwxK3gAIwOlYlKv7GZE=";
+    sha256 = "sha256-N1HH+6jbyDHLjXzIr/IQNUWbjOUVXviwiAon0ChHXzs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 65c88eac4e88..c3a0c5aa906d 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -48,16 +48,6 @@ stdenv.mkDerivation rec {
     substituteInPlace src/util/genfsimg --replace "	syslinux " "	true "
   ''; # calling syslinux on a FAT image isn't going to work
 
-  # Workaround '-idirafter' ordering bug in staging-next:
-  #   https://github.com/NixOS/nixpkgs/pull/210004
-  # where libc '-idirafter' gets added after user's idirafter and
-  # breaks.
-  # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-  preConfigure = ''
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] buildPackages.stdenv.hostPlatform.config}=$(< ${buildPackages.stdenv.cc}/nix-support/libc-cflags)
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"]               stdenv.hostPlatform.config}=$(<               ${stdenv.cc}/nix-support/libc-cflags)
-  '';
-
   # not possible due to assembler code
   hardeningDisable = [ "pic" "stackprotector" ];
 
diff --git a/pkgs/tools/misc/lockfile-progs/default.nix b/pkgs/tools/misc/lockfile-progs/default.nix
index e245a05182da..8fdee47befbf 100644
--- a/pkgs/tools/misc/lockfile-progs/default.nix
+++ b/pkgs/tools/misc/lockfile-progs/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ liblockfile ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-overflow"
+  ];
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin $out/man/man1
diff --git a/pkgs/tools/misc/mpdscribble/default.nix b/pkgs/tools/misc/mpdscribble/default.nix
index dc446d3f0a19..46bf31ed667e 100644
--- a/pkgs/tools/misc/mpdscribble/default.nix
+++ b/pkgs/tools/misc/mpdscribble/default.nix
@@ -28,6 +28,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3wLfQvbwx+OFrCl5vMV7Zps4e4iEYFhqPiVCo5hDqgw=";
   })];
 
+  postPatch = ''
+    sed '1i#include <ctime>' -i src/Log.cxx # gcc12
+  '';
+
   nativeBuildInputs = [ pkg-config meson ninja ];
   buildInputs = [
     libmpdclient
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index 12c411f3ef43..267272b0b664 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -13,18 +13,14 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/src";
 
-  # Workaround '-idirafter' ordering bug in staging-next:
-  #   https://github.com/NixOS/nixpkgs/pull/210004
-  # where libc '-idirafter' gets added after user's idirafter and
-  # breaks.
-  # TODO(trofi): remove it in staging once fixed in cc-wrapper.
-  preConfigure = ''
-    export NIX_CFLAGS_COMPILE_BEFORE_${lib.replaceStrings ["-" "."] ["_" "_"] stdenv.hostPlatform.config}=$(< ${stdenv.cc}/nix-support/libc-cflags)
-  '';
-
   buildInputs = [ libbfd zlib libiberty ];
   makeFlags = [ "wimboot.x86_64.efi" ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
   installPhase = ''
     mkdir -p $out/share/wimboot/
     cp wimboot.x86_64.efi $out/share/wimboot
diff --git a/pkgs/tools/misc/yafetch/default.nix b/pkgs/tools/misc/yafetch/default.nix
index f55926d0ae39..4ebaea963c29 100644
--- a/pkgs/tools/misc/yafetch/default.nix
+++ b/pkgs/tools/misc/yafetch/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./config.h --replace \
       "#include \"ascii/gnu.h\"" "#include \"ascii/nixos.h\""
+
+    sed '1i#include <array>' -i config.h # gcc12
   '';
 
   # Fixes installation path
diff --git a/pkgs/tools/networking/dsniff/default.nix b/pkgs/tools/networking/dsniff/default.nix
index 8e641ec83e73..5d0c92f2bfb5 100644
--- a/pkgs/tools/networking/dsniff/default.nix
+++ b/pkgs/tools/networking/dsniff/default.nix
@@ -60,7 +60,7 @@ in gcc9Stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook rpcsvc-proto ];
   buildInputs = [ glib pcap libtirpc libnsl ];
-  NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ldl -ltirpc";
+  NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ltirpc";
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
   postPatch = ''
     for patch in debian/patches/*.patch; do
diff --git a/pkgs/tools/networking/ip2unix/default.nix b/pkgs/tools/networking/ip2unix/default.nix
index c4c03cae3a7f..fabbbb40e7a7 100644
--- a/pkgs/tools/networking/ip2unix/default.nix
+++ b/pkgs/tools/networking/ip2unix/default.nix
@@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "1pl8ayadxb0zzh5s26yschkjhr1xffbzzv347m88f9y0jv34d24r";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i src/dynports/dynports.cc # gcc12
+  '';
+
   nativeBuildInputs = [
     meson ninja pkg-config asciidoc libxslt.bin docbook_xml_dtd_45 docbook_xsl
     libxml2.bin docbook5 python3Packages.pytest python3Packages.pytest-timeout
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index be50397bf1d0..4238391fdaea 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -53,6 +53,14 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lcrypt";
 
+  # This can probably be removed if version > 2.4.9, as IPX support
+  # has been removed upstream[1].  Just check whether pkgsMusl.ppp
+  # still builds.
+  #
+  # [1]: https://github.com/ppp-project/ppp/commit/c2881a6b71a36d28a89166e82820dc5e711fd775
+  NIX_CFLAGS_COMPILE =
+    lib.optionalString stdenv.hostPlatform.isMusl "-UIPX_CHANGE";
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 73ccdb43fef8..9ccf68aa5437 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tcpdump";
-  version = "4.99.1";
+  version = "4.99.3";
 
   src = fetchurl {
-    url = "http://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ebNphfsnAxRmGNh8Ss3j4Gi5HFU/uT8CGjN/F1/RDr4=";
+    url = "http://www.tcpdump.org/release/tcpdump-${version}.tar.gz";
+    sha256 = "sha256-rXWm7T3A2XMpRbLlSDy0Hci0tSihaTFeSZxoYZUuc7M=";
   };
 
   postPatch = ''
@@ -17,9 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libpcap ];
 
-  configureFlags = lib.optional
-    (stdenv.hostPlatform != stdenv.buildPlatform)
-    "ac_cv_linux_vers=2";
+  configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "ac_cv_linux_vers=2";
 
   meta = with lib; {
     description = "Network sniffer";
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 3d67bbb07932..bf2587d8c658 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
     "SD_NOTIFY=1"
   ];
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
   installFlags = [
     "sysconfdir=${placeholder "out"}/etc"
   ];
diff --git a/pkgs/tools/networking/uqmi/default.nix b/pkgs/tools/networking/uqmi/default.nix
index 17a55d86b9a3..067bc51854ad 100644
--- a/pkgs/tools/networking/uqmi/default.nix
+++ b/pkgs/tools/networking/uqmi/default.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ libubox json_c ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=dangling-pointer"
+  ];
+
   meta = with lib; {
     description = "Tiny QMI command line utility";
     homepage = "https://git.openwrt.org/?p=project/uqmi.git;a=summary";
diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix
index c25db9e2d398..7817329f06de 100644
--- a/pkgs/tools/security/aflplusplus/default.nix
+++ b/pkgs/tools/security/aflplusplus/default.nix
@@ -51,6 +51,11 @@ let
         --replace '"clang++"' '"clang++-UNSUPPORTED"'
     '';
 
+    NIX_CFLAGS_COMPILE = [
+      # Needed with GCC 12
+      "-Wno-error=use-after-free"
+    ];
+
     makeFlags = [ "PREFIX=$(out)" ];
     buildPhase = ''
       common="$makeFlags -j$NIX_BUILD_CORES"
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index edb10f384bdf..b897fe618710 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -40,6 +40,11 @@ python3.pkgs.buildPythonApplication rec {
     mkdir -p $CHIPSEC_BUILD_LIB/chipsec/helper/linux
   '';
 
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=dangling-pointer"
+  ];
+
   preInstall = lib.optionalString withDriver ''
     mkdir -p $out/${python3.pkgs.python.sitePackages}/drivers/linux
     mv $CHIPSEC_BUILD_LIB/chipsec/helper/linux/chipsec.ko \
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/24.nix
similarity index 87%
rename from pkgs/tools/security/gnupg/23.nix
rename to pkgs/tools/security/gnupg/24.nix
index 0f56c4a8c15b..c1f2825e8e93 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -12,11 +12,11 @@ assert guiSupport -> enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.3.7";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-7hY6X7nsmf/BsY5l+u+NCGgAxXE9FaZyq1fTeZ2oNmk=";
+    sha256 = "sha256-HXkVjdAdmSQx3S4/rLif2slxJ/iXhOosthDGAPsMFIM=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -30,19 +30,13 @@ stdenv.mkDerivation rec {
   patches = [
     ./fix-libusb-include-path.patch
     ./tests-add-test-cases-for-import-without-uid.patch
-    ./allow-import-of-previously-known-keys-even-without-UI.patch
+    # TODO: Refresh patch? Doesn't apply on 2.4.0
+    #./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
 
     # Patch for DoS vuln from https://seclists.org/oss-sec/2022/q3/27
     ./v3-0001-Disallow-compressed-signatures-and-certificates.patch
 
-    # Fix regression when using YubiKey devices as smart cards.
-    # See https://dev.gnupg.org/T6070 for details.
-    # Committed upstream, remove this patch when updating to the next release.
-    (fetchpatch {
-      url = "https://dev.gnupg.org/rGf34b9147eb3070bce80d53febaa564164cd6c977?diff=1";
-      sha256 = "sha256-J/PLSz8yiEgtGv+r3BTGTHrikV70AbbHQPo9xbjaHFE=";
-    })
   ];
   postPatch = ''
     sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 88f39e8a63e4..98ac2254fb6e 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -29,7 +29,11 @@ stdenv.mkDerivation rec {
     "iasl"
   ];
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  NIX_CFLAGS_COMPILE = [
+    "-O3"
+    # Needed with GCC 12
+    "-Wno-dangling-pointer"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index de4acffa63e4..0e746b0d07a4 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
+  postPatch = ''
+    sed '1i#include <array>' -i lib/src/facts/glib/load_average_resolver.cc # gcc12
+  '';
+
   CXXFLAGS = lib.optionalString stdenv.cc.isGNU "-fpermissive -Wno-error=catch-value";
   NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lblkid";
 
diff --git a/pkgs/tools/system/rocm-smi/default.nix b/pkgs/tools/system/rocm-smi/default.nix
index 47542d25370d..d7e23a9acb01 100644
--- a/pkgs/tools/system/rocm-smi/default.nix
+++ b/pkgs/tools/system/rocm-smi/default.nix
@@ -17,6 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-nkidiDNNU6MGhne9EbYClkODJZw/zZu3LWzlniJKyJE=";
   };
 
+  postPatch = ''
+    sed '1i#include <cstring>' -i src/rocm_smi{,_gpu_metrics}.cc # since gcc12 probably
+  '';
+
   nativeBuildInputs = [ cmake wrapPython ];
 
   patches = [ ./cmake.patch ];
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index a38251557c09..215f7e7d25b8 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -5,6 +5,7 @@
 , autoreconfHook
 , pkg-config
 , texinfo
+, bison
 , bash
 }:
 
@@ -51,7 +52,9 @@ stdenv.mkDerivation rec {
   '';
 
   strictDeps = true;
-  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
+  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ]
+    # Required due to the patch that changes .ypp files.
+    ++ lib.optional (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "9") bison;
   buildInputs = [ perl bash ]
     ++ lib.optionals enableGhostscript [ ghostscript ]
     ++ lib.optionals enableHtml [ psutils netpbm ];
diff --git a/pkgs/tools/text/justify/default.nix b/pkgs/tools/text/justify/default.nix
index 1e18e22db8e2..86de7365663e 100644
--- a/pkgs/tools/text/justify/default.nix
+++ b/pkgs/tools/text/justify/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-406OhJt2Ila/LIhfqJXhbFqFxJJiRyMVI4/VK8Y43kc=";
   };
 
+  postPatch = ''
+    sed '1i#include <algorithm>' -i src/stringHelper.h # gcc12
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   installPhase = ''
diff --git a/pkgs/tools/text/qgrep/default.nix b/pkgs/tools/text/qgrep/default.nix
index 032e9474128a..4145ec656d20 100644
--- a/pkgs/tools/text/qgrep/default.nix
+++ b/pkgs/tools/text/qgrep/default.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices CoreFoundation ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=mismatched-new-delete"
+  ];
+
   postPatch = lib.optionalString stdenv.isAarch64 ''
     substituteInPlace Makefile \
       --replace "-msse2" "" --replace "-DUSE_SSE2" ""
diff --git a/pkgs/tools/text/tab/default.nix b/pkgs/tools/text/tab/default.nix
index 0802f7b98361..0ddd7509c9f1 100644
--- a/pkgs/tools/text/tab/default.nix
+++ b/pkgs/tools/text/tab/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AhgWeV/ojB8jM16A5ggrOD1YjWfRVcoQbkd3S2bgdyE=";
   };
 
+  # gcc12; see https://github.com/ivan-tkatchev/tab/commit/673bdac998
+  postPatch = ''
+    sed '1i#include <cstring>' -i deps.h
+  '';
+
   nativeCheckInputs = [ python3 ];
 
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c364a4cb8e05..e37d309a2146 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -807,6 +807,7 @@ mapAliases ({
   libpulseaudio-vanilla = libpulseaudio; # Added 2022-04-20
   libqmatrixclient = throw "libqmatrixclient was renamed to libquotient"; # Added 2020-04-09
   libqrencode = throw "'libqrencode' has been renamed to/replaced by 'qrencode'"; # Converted to throw 2022-02-22
+  libraw_unstable = throw "'libraw_unstable' has been removed, please use libraw"; # Added 2023-01-30
   librdf = lrdf; # Added 2020-03-22
   librecad2 = throw "'librecad2' has been renamed to/replaced by 'librecad'"; # Converted to throw 2022-02-22
   libressl_3_2 = throw "'libressl_3_2' has reached end-of-life "; # Added 2022-03-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a143d5bddf97..0ee84cd2bbd1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1252,7 +1252,6 @@ with pkgs;
 
   arc_unpacker = callPackage ../tools/archivers/arc_unpacker {
     boost = boost16x; # checkPhase fails with Boost 1.77
-    stdenv = gcc10StdenvCompat;
   };
 
   adminer = callPackage ../servers/adminer { };
@@ -2548,7 +2547,7 @@ with pkgs;
 
   writefreely = callPackage ../applications/misc/writefreely { };
 
-  iqueue = callPackage ../development/libraries/iqueue { stdenv = gcc10StdenvCompat; };
+  iqueue = callPackage ../development/libraries/iqueue { };
 
   lifecycled = callPackage ../tools/misc/lifecycled { };
 
@@ -4922,11 +4921,11 @@ with pkgs;
   };
 
   hyprland = callPackage ../applications/window-managers/hyprwm/hyprland {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   hyprpaper = callPackage ../applications/window-managers/hyprwm/hyprpaper {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   hysteria = callPackage ../tools/networking/hysteria { };
@@ -5146,7 +5145,9 @@ with pkgs;
 
   merriweather-sans = callPackage ../data/fonts/merriweather-sans { };
 
-  meson = callPackage ../development/tools/build-managers/meson { };
+  meson = callPackage ../development/tools/build-managers/meson {
+    inherit (darwin.apple_sdk.frameworks) Foundation OpenGL AppKit Cocoa;
+  };
 
   # while building documentation meson may want to run binaries for host
   # which needs an emulator
@@ -7749,11 +7750,11 @@ with pkgs;
   gnupg1orig = callPackage ../tools/security/gnupg/1.nix { };
   gnupg1compat = callPackage ../tools/security/gnupg/1compat.nix { };
   gnupg1 = gnupg1compat;    # use config.packageOverrides if you prefer original gnupg1
-  gnupg23 = callPackage ../tools/security/gnupg/23.nix {
+  gnupg24 = callPackage ../tools/security/gnupg/24.nix {
     guiSupport = stdenv.isDarwin;
     pinentry = if stdenv.isDarwin then pinentry_mac else pinentry-gtk2;
   };
-  gnupg = gnupg23;
+  gnupg = gnupg24;
 
   gnupg-pkcs11-scd = callPackage ../tools/security/gnupg-pkcs11-scd { };
 
@@ -14320,7 +14321,7 @@ with pkgs;
       num =
         if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
         else if (stdenv.targetPlatform.isAarch64 && stdenv.isLinux) then 9
-        else 11;
+        else 12;
       numS = toString num;
     in {
       gcc = pkgs.${"gcc${numS}"};
@@ -14358,7 +14359,8 @@ with pkgs;
   gcc11Stdenv = overrideCC gccStdenv buildPackages.gcc11;
   gcc12Stdenv = overrideCC gccStdenv buildPackages.gcc12;
 
-  gcc10StdenvCompat = if stdenv.cc.isGNU && lib.versions.major stdenv.cc.version == "11" then gcc10Stdenv else stdenv;
+  # Meant for packages that fail with newer than gcc10.
+  gcc10StdenvCompat = if stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11" then gcc10Stdenv else stdenv;
 
   # This is not intended for use in nixpkgs but for providing a faster-running
   # compiler to nixpkgs users by building gcc with reproducibility-breaking
@@ -15285,7 +15287,7 @@ with pkgs;
   mitama-cpp-result = callPackage ../development/libraries/mitama-cpp-result { };
 
   mitscheme = callPackage ../development/compilers/mit-scheme
-    { stdenv = gcc10StdenvCompat; texLive = texlive.combine { inherit (texlive) scheme-small epsf texinfo; }; };
+    { texLive = texlive.combine { inherit (texlive) scheme-small epsf texinfo; }; };
 
   mitschemeX11 = mitscheme.override {
     enableX11 = true;
@@ -15665,13 +15667,13 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_66 = callPackage ../development/compilers/rust/1_66.nix {
+  rust_1_67 = callPackage ../development/compilers/rust/1_67.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
-    llvm_14 = llvmPackages_14.libllvm;
+    llvm_15 = llvmPackages_15.libllvm;
     # https://github.com/NixOS/nixpkgs/issues/201254
     stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;
   };
-  rust = rust_1_66;
+  rust = rust_1_67;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -15680,8 +15682,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_66 = rust_1_66.packages.stable;
-  rustPackages = rustPackages_1_66;
+  rustPackages_1_67 = rust_1_67.packages.stable;
+  rustPackages = rustPackages_1_67;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -17210,13 +17212,9 @@ with pkgs;
     libc = preLibcCrossHeaders;
   };
 
-  libbfd = callPackage ../development/tools/misc/binutils/libbfd.nix {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  libbfd = callPackage ../development/tools/misc/binutils/libbfd.nix { };
 
-  libopcodes = callPackage ../development/tools/misc/binutils/libopcodes.nix {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  libopcodes = callPackage ../development/tools/misc/binutils/libopcodes.nix { };
 
   # Held back 2.38 release. Remove once all dependencies are ported to 2.39.
   binutils-unwrapped_2_38 = callPackage ../development/tools/misc/binutils/2.38 {
@@ -17548,6 +17546,7 @@ with pkgs;
 
   libgcc = callPackage ../development/libraries/gcc/libgcc {
     stdenvNoLibs = gccStdenvNoLibs; # cannot be built with clang it seems
+    gcc = gcc11; # fails to build with gcc12
   };
 
   # This is for e.g. LLVM libraries on linux.
@@ -19567,30 +19566,28 @@ with pkgs;
 
   linbox = callPackage ../development/libraries/linbox { };
 
-  ffmpeg_4-headless = callPackage ../development/libraries/ffmpeg/4.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
-
-    sdlSupport = false;
-    vdpauSupport = false;
-    pulseaudioSupport = false;
-    libva = libva-minimal;
-  };
-
   ffmpeg_4 = callPackage ../development/libraries/ffmpeg/4.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
+    inherit (darwin.apple_sdk.frameworks)
+      Cocoa CoreServices CoreAudio CoreMedia AVFoundation MediaToolbox
+      VideoDecodeAcceleration VideoToolbox;
   };
-
-  ffmpeg_5-headless = callPackage ../development/libraries/ffmpeg/5.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
-
-    sdlSupport = false;
-    vdpauSupport = false;
-    pulseaudioSupport = false;
-    libva = libva-minimal;
+  ffmpeg_4-headless = ffmpeg_4.override {
+    ffmpegVariant = "headless";
+  };
+  ffmpeg_4-full = ffmpeg.override {
+    ffmpegVariant = "full";
   };
 
   ffmpeg_5 = callPackage ../development/libraries/ffmpeg/5.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia VideoToolbox;
+    inherit (darwin.apple_sdk.frameworks)
+      Cocoa CoreServices CoreAudio CoreMedia AVFoundation MediaToolbox
+      VideoDecodeAcceleration VideoToolbox;
+  };
+  ffmpeg_5-headless = ffmpeg_5.override {
+    ffmpegVariant = "headless";
+  };
+  ffmpeg_5-full = ffmpeg_5.override {
+    ffmpegVariant = "full";
   };
 
   # Aliases
@@ -19599,26 +19596,8 @@ with pkgs;
   # Packages which use ffmpeg as a library, should pin to the relevant major
   # version number which the upstream support.
   ffmpeg = ffmpeg_4;
-
   ffmpeg-headless = ffmpeg_4-headless;
-
-  ffmpeg-full = callPackage ../development/libraries/ffmpeg-full {
-    svt-av1 = if stdenv.isAarch64 then null else svt-av1;
-    rtmpdump = null; # Prefer the built-in RTMP implementation
-    # The following need to be fixed on Darwin
-    libjack2 = if stdenv.isDarwin then null else libjack2;
-    libmodplug = if stdenv.isDarwin then null else libmodplug;
-    libmfx = if stdenv.isDarwin then null else intel-media-sdk;
-    libpulseaudio = if stdenv.isDarwin then null else libpulseaudio;
-    samba = if stdenv.isDarwin then null else samba;
-    inherit (darwin.apple_sdk.frameworks)
-      Cocoa CoreServices CoreAudio AVFoundation MediaToolbox
-      VideoDecodeAcceleration VideoToolbox;
-  };
-
-  ffmpeg_5-full = ffmpeg-full.override {
-    ffmpeg = ffmpeg_5;
-  };
+  ffmpeg-full = ffmpeg_4-full;
 
   ffmpegthumbnailer = callPackage ../development/libraries/ffmpegthumbnailer { };
 
@@ -19681,7 +19660,6 @@ with pkgs;
 
   freeimage = callPackage ../development/libraries/freeimage {
     inherit (darwin) autoSignDarwinBinariesHook;
-    libraw = libraw_unstable;
   };
 
   freetts = callPackage ../development/libraries/freetts {
@@ -20633,7 +20611,7 @@ with pkgs;
   lmdbxx = callPackage ../development/libraries/lmdbxx { };
 
   lemon-graph = callPackage ../development/libraries/lemon-graph {
-    stdenv = if stdenv.isLinux then gcc11Stdenv else stdenv;
+    stdenv = if stdenv.isLinux then gcc12Stdenv else stdenv;
   };
 
   levmar = callPackage ../development/libraries/levmar { };
@@ -23644,7 +23622,10 @@ with pkgs;
 
   vte = callPackage ../development/libraries/vte {
     # Needs GCC ≥10 but aarch64 defaults to GCC 9.
-    stdenv = clangStdenv;
+    stdenv =
+      if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU
+      then clangStdenv
+      else stdenv;
   };
 
   vte-gtk4 = vte.override {
@@ -25849,7 +25830,7 @@ with pkgs;
   };
 
   btop = callPackage ../tools/system/btop {
-    stdenv = gcc11Stdenv;
+    stdenv = gcc12Stdenv;
   };
 
   nmon = callPackage ../os-specific/linux/nmon { };
@@ -26118,7 +26099,6 @@ with pkgs;
   };
 
   libraw = callPackage ../development/libraries/libraw { };
-  libraw_unstable = callPackage ../development/libraries/libraw/unstable.nix { };
 
   libraw1394 = callPackage ../development/libraries/libraw1394 { };
 
@@ -26452,7 +26432,7 @@ with pkgs;
 
   pipework = callPackage ../os-specific/linux/pipework { };
 
-  pktgen = callPackage ../os-specific/linux/pktgen { stdenv = gcc10StdenvCompat; };
+  pktgen = callPackage ../os-specific/linux/pktgen { };
 
   plymouth = callPackage ../os-specific/linux/plymouth { };
 
@@ -26628,7 +26608,7 @@ with pkgs;
     # break some cyclic dependencies
     util-linux = util-linuxMinimal;
     # provide a super minimal gnupg used for systemd-machined
-    gnupg = callPackage ../tools/security/gnupg/23.nix {
+    gnupg = gnupg.override {
       enableMinimal = true;
       guiSupport = false;
     };
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 83a90a2a5e6d..a79dc31ed9dd 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -83,6 +83,8 @@ with self; with super; {
     doCheck = false;  # circular dependency with pytest
   });
 
+  wheel = callPackage ../development/python2-modules/wheel { };
+
   zeek = disabled super.zeek;
 
   zipp = callPackage ../development/python2-modules/zipp { };