Merge master into haskell-updates

2022-09-13 00:16:44 +00:00 · 2022-09-13 00:16:44 +00:00 · 464616ef3c
parent 05f6bd4f6c 994df04c3c
commit 464616ef3c
230 changed files with 2790 additions and 2083 deletions
--- a/.github/workflows/manual-rendering.yml
+++ b/.github/workflows/manual-rendering.yml
@ -13,7 +13,7 @@ permissions:
 jobs:
  check-rendering-equivalence:
    permissions:
-      issues: write  # for peter-evans/create-or-update-comment to create or update comment
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
    if: github.repository_owner == 'NixOS'
    runs-on: ubuntu-latest
    steps:
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@ -21,7 +21,7 @@ jobs:
  periodic-merge:
    permissions:
      contents: write  # for devmasx/merge-branch to merge branches
-      issues: write  # for peter-evans/create-or-update-comment to create or update comment
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
    if: github.repository_owner == 'NixOS'
    runs-on: ubuntu-latest
    strategy:
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@ -21,7 +21,7 @@ jobs:
  periodic-merge:
    permissions:
      contents: write  # for devmasx/merge-branch to merge branches
-      issues: write  # for peter-evans/create-or-update-comment to create or update comment
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
    if: github.repository_owner == 'NixOS'
    runs-on: ubuntu-latest
    strategy:
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@ -12,8 +12,7 @@ jobs:
  tf-providers:
    permissions:
      contents: write  # for peter-evans/create-pull-request to create branch
-      issues: write  # for peter-evans/create-or-update-comment to create or update comment
-      pull-requests: write  # for peter-evans/create-pull-request to create a PR
+      pull-requests: write  # for peter-evans/create-pull-request to create a PR, for peter-evans/create-or-update-comment to create or update comment
    if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
    runs-on: ubuntu-latest
    steps:
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9395,6 +9395,13 @@
    githubId = 137805;
    name = "Alexander Tsvyashchenko";
  };
+  Necior = {
+    email = "adrian@sadlocha.eu";
+    github = "Necior";
+    githubId = 2404518;
+    matrix = "@n3t:matrix.org";
+    name = "Adrian Sadłocha";
+  };
  neeasade = {
    email = "nathanisom27@gmail.com";
    github = "neeasade";
@ -10971,6 +10978,13 @@
    githubId = 314564;
    name = "Ryan Lahfa";
  };
+  raphaelr = {
+    email = "raphael-git@tapesoftware.net";
+    matrix = "@raphi:tapesoftware.net";
+    github = "raphaelr";
+    githubId = 121178;
+    name = "Raphael Robatsch";
+  };
  raquelgb = {
    email = "raquel.garcia.bautista@gmail.com";
    github = "raquelgb";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -130,6 +130,11 @@
          slick-greeter as lightdm greeter to match upstream.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          OpenSSL now defaults to OpenSSL 3, updated from 1.1.1.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>hardware.nvidia</literal> has a new option
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -53,6 +53,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - Cinnamon has been updated to 5.4. While at it, the cinnamon module now defaults to
  blueman as bluetooth manager and slick-greeter as lightdm greeter to match upstream.

+- OpenSSL now defaults to OpenSSL 3, updated from 1.1.1.
+
 - `hardware.nvidia` has a new option `open` that can be used to opt in the opensource version of NVIDIA kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [NVIDIA Releases Open-Source GPU Kernel Modules](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for the official announcement.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -282,7 +282,7 @@ in
      serviceConfig = defaultServiceConfig // {
        User = cfg.user;
        ExecStart = ''
-          ${pkgs.python3Packages.gunicorn}/bin/gunicorn \
+          ${pkg.python.pkgs.gunicorn}/bin/gunicorn \
            -c ${pkg}/lib/paperless-ngx/gunicorn.conf.py paperless.asgi:application
        '';
        Restart = "on-failure";
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@ -197,6 +197,7 @@ in {
        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
        StateDirectory = "bitwarden_rs";
        StateDirectoryMode = "0700";
+        Restart = "always";
      };
      wantedBy = [ "multi-user.target" ];
    };
@ -209,6 +210,8 @@ in {
        BACKUP_FOLDER = cfg.backupDir;
      };
      path = with pkgs; [ sqlite ];
+      # if both services are started at the same time, vaultwarden fails with "database is locked"
+      before = [ "vaultwarden.service" ];
      serviceConfig = {
        SyslogIdentifier = "backup-vaultwarden";
        Type = "oneshot";
@ -220,7 +223,7 @@ in {
    };

    systemd.timers.backup-vaultwarden = mkIf (cfg.backupDir != null) {
-      aliases = [ "backup-bitwarden_rs.service" ];
+      aliases = [ "backup-bitwarden_rs.timer" ];
      description = "Backup vaultwarden on time";
      timerConfig = {
        OnCalendar = mkDefault "23:00";
--- a/nixos/modules/services/system/self-deploy.nix
+++ b/nixos/modules/services/system/self-deploy.nix
@ -139,6 +139,7 @@ in

      path = with pkgs; [
        git
+        gnutar
        nix
      ] ++ lib.optionals (cfg.switchCommand == "boot") [ systemd ];

--- a/nixos/modules/services/web-apps/lemmy.md
+++ b/nixos/modules/services/web-apps/lemmy.md
@ -13,13 +13,10 @@ services.lemmy = {
    hostname = "lemmy.union.rocks";
    database.createLocally = true;
  };
-  jwtSecretPath = "/run/secrets/lemmyJwt";
  caddy.enable = true;
 }
 ```

-(note that you can use something like agenix to get your secret jwt to the specified path)
-
 this will start the backend on port 8536 and the frontend on port 1234.
 It will expose your instance with a caddy reverse proxy to the hostname you've provided.
 Postgres will be initialized on that same instance automatically.
--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@ -10,15 +10,14 @@ in
  # `pandoc lemmy.md -t docbook --top-level-division=chapter --extract-media=media -f markdown+smart > lemmy.xml`
  meta.doc = ./lemmy.xml;

+  imports = [
+    (mkRemovedOptionModule [ "services" "lemmy" "jwtSecretPath" ] "As of v0.13.0, Lemmy auto-generates the JWT secret.")
+  ];
+
  options.services.lemmy = {

    enable = mkEnableOption (lib.mdDoc "lemmy a federated alternative to reddit in rust");

-    jwtSecretPath = mkOption {
-      type = types.path;
-      description = lib.mdDoc "Path to read the jwt secret from.";
-    };
-
    ui = {
      port = mkOption {
        type = types.port;
@ -168,18 +167,11 @@ in

        requires = lib.optionals cfg.settings.database.createLocally [ "lemmy-postgresql.service" ];

-        # script is needed here since loadcredential is not accessible on ExecPreStart
-        script = ''
-          ${pkgs.coreutils}/bin/install -m 600 ${settingsFormat.generate "config.hjson" cfg.settings} /run/lemmy/config.hjson
-          jwtSecret="$(< $CREDENTIALS_DIRECTORY/jwt_secret )"
-          ${pkgs.jq}/bin/jq ".jwt_secret = \"$jwtSecret\"" /run/lemmy/config.hjson | ${pkgs.moreutils}/bin/sponge /run/lemmy/config.hjson
-          ${pkgs.lemmy-server}/bin/lemmy_server
-        '';
-
        serviceConfig = {
          DynamicUser = true;
          RuntimeDirectory = "lemmy";
-          LoadCredential = "jwt_secret:${cfg.jwtSecretPath}";
+          ExecStartPre = "${pkgs.coreutils}/bin/install -m 600 ${settingsFormat.generate "config.hjson" cfg.settings} /run/lemmy/config.hjson";
+          ExecStart = "${pkgs.lemmy-server}/bin/lemmy_server";
        };
      };

--- a/nixos/modules/services/web-apps/lemmy.xml
+++ b/nixos/modules/services/web-apps/lemmy.xml
@ -8,21 +8,16 @@
    <para>
      the minimum to start lemmy is
    </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.lemmy = {
  enable = true;
  settings = {
    hostname = &quot;lemmy.union.rocks&quot;;
    database.createLocally = true;
  };
-  jwtSecretPath = &quot;/run/secrets/lemmyJwt&quot;;
  caddy.enable = true;
 }
 </programlisting>
-    <para>
-      (note that you can use something like agenix to get your secret
-      jwt to the specified path)
-    </para>
    <para>
      this will start the backend on port 8536 and the frontend on port
      1234. It will expose your instance with a caddy reverse proxy to
--- a/nixos/modules/system/boot/systemd/nspawn.nix
+++ b/nixos/modules/system/boot/systemd/nspawn.nix
@ -27,12 +27,12 @@ let
    (assertOnlyFields [
      "ReadOnly" "Volatile" "Bind" "BindReadOnly" "TemporaryFileSystem"
      "Overlay" "OverlayReadOnly" "PrivateUsersChown" "BindUser"
-      "Inaccessible" "PrivateUserOwnership"
+      "Inaccessible" "PrivateUsersOwnership"
    ])
    (assertValueOneOf "ReadOnly" boolValues)
    (assertValueOneOf "Volatile" (boolValues ++ [ "state" ]))
    (assertValueOneOf "PrivateUsersChown" boolValues)
-    (assertValueOneOf "PrivateUserOwnership" [ "off" "chown" "map" "auto" ])
+    (assertValueOneOf "PrivateUsersOwnership" [ "off" "chown" "map" "auto" ])
  ];

  checkNetwork = checkUnitConfig "Network" [
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -547,6 +547,7 @@ in {
  systemd-analyze = handleTest ./systemd-analyze.nix {};
  systemd-binfmt = handleTestOn ["x86_64-linux"] ./systemd-binfmt.nix {};
  systemd-boot = handleTest ./systemd-boot.nix {};
+  systemd-bpf = handleTest ./systemd-bpf.nix {};
  systemd-confinement = handleTest ./systemd-confinement.nix {};
  systemd-coredump = handleTest ./systemd-coredump.nix {};
  systemd-cryptenroll = handleTest ./systemd-cryptenroll.nix {};
--- a/nixos/tests/installed-tests/default.nix
+++ b/nixos/tests/installed-tests/default.nix
@ -98,6 +98,7 @@ in
  gnome-photos = callInstalledTest ./gnome-photos.nix {};
  graphene = callInstalledTest ./graphene.nix {};
  gsconnect = callInstalledTest ./gsconnect.nix {};
+  json-glib = callInstalledTest ./json-glib.nix {};
  ibus = callInstalledTest ./ibus.nix {};
  libgdata = callInstalledTest ./libgdata.nix {};
  librsvg = callInstalledTest ./librsvg.nix {};
--- a/nixos/tests/installed-tests/json-glib.nix
+++ b/nixos/tests/installed-tests/json-glib.nix
@ -0,0 +1,5 @@
+{ pkgs, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.json-glib;
+}
--- a/nixos/tests/lemmy.nix
+++ b/nixos/tests/lemmy.nix
@ -14,10 +14,6 @@ in
    "${lemmyNodeName}" = {
      services.lemmy = {
        enable = true;
-        jwtSecretPath = pkgs.writeTextFile {
-          name = "lemmy-secret";
-          text = "very-secret-password123";
-        };
        ui.port = uiPort;
        settings = {
          hostname = "http://${lemmyNodeName}";
--- a/nixos/tests/systemd-bpf.nix
+++ b/nixos/tests/systemd-bpf.nix
@ -0,0 +1,42 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "systemd-bpf";
+  meta = with lib.maintainers; {
+    maintainers = [ veehaitch ];
+  };
+  nodes = {
+    node1 = {
+      virtualisation.vlans = [ 1 ];
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+        interfaces.eth1.ipv4.addresses = [
+          { address = "192.168.1.1"; prefixLength = 24; }
+        ];
+      };
+    };
+
+    node2 = {
+      virtualisation.vlans = [ 1 ];
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+        interfaces.eth1.ipv4.addresses = [
+          { address = "192.168.1.2"; prefixLength = 24; }
+        ];
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    node1.wait_for_unit("systemd-networkd-wait-online.service")
+    node2.wait_for_unit("systemd-networkd-wait-online.service")
+
+    with subtest("test RestrictNetworkInterfaces= works"):
+      node1.succeed("ping -c 5 192.168.1.2")
+      node1.succeed("systemd-run -t -p RestrictNetworkInterfaces='eth1' ping -c 5 192.168.1.2")
+      node1.fail("systemd-run -t -p RestrictNetworkInterfaces='lo' ping -c 5 192.168.1.2")
+  '';
+})
--- a/pkgs/applications/audio/mopidy/iris.nix
+++ b/pkgs/applications/audio/mopidy/iris.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "Mopidy-Iris";
-  version = "3.60.0";
+  version = "3.64.0";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "18w6qqmxzn8psiacybryxailm826f3j1wgiv0c03fbdsy6kr5f7l";
+    sha256 = "062x73glhn1x4wgc7zmb9y3cq15d5grgqf5drdpbp6p3cgk4s2vc";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/audio/mopidy/ytmusic.nix
+++ b/pkgs/applications/audio/mopidy/ytmusic.nix
@ -2,19 +2,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "mopidy-ytmusic";
-  version = "0.3.5";
+  version = "0.3.7";

  src = python3Packages.fetchPypi {
    inherit version;
    pname = "Mopidy-YTMusic";
-    sha256 = "0pncyxfqxvznb9y4ksndbny1yf5mxh4089ak0yz86dp2qi5j99iv";
+    sha256 = "0gqjvi3nfzkqvbdhihzai241p1h5p037bj2475cc93xwzyyqxcrq";
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'ytmusicapi>=0.20.0,<0.21.0' 'ytmusicapi>=0.20.0'
-  '';
-
  propagatedBuildInputs = [
    mopidy
    python3Packages.ytmusicapi
--- a/pkgs/applications/audio/tidal-hifi/default.nix
+++ b/pkgs/applications/audio/tidal-hifi/default.nix
@ -36,11 +36,11 @@

 stdenv.mkDerivation rec {
  pname = "tidal-hifi";
-  version = "4.1.1";
+  version = "4.1.2";

  src = fetchurl {
    url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${version}/tidal-hifi_${version}_amd64.deb";
-    sha256 = "1l8axsf9d7a370fs96j16bnsi8fcdgwq036yxc4r4ykpnnskf1ds";
+    sha256 = "sha256-HurREfN4VxhFiyP+oAx8QeTfoZTk+PlRX5pVWyU+Dwg=";
  };

  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];
--- a/pkgs/applications/blockchains/alfis/default.nix
+++ b/pkgs/applications/blockchains/alfis/default.nix
@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "alfis";
-  version = "0.7.7";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "Revertron";
    repo = "Alfis";
    rev = "v${version}";
-    sha256 = "sha256-I9vJc3J3OoUA6GOc8NkWBKSCkjHC4KOztglJOg9S0Eo=";
+    sha256 = "sha256-E0n1keNk5jNnErNvYhb8oe26kK9Opl+IJ5zpsvrqS84=";
  };

-  cargoSha256 = "sha256-VVBO2w6iwZ+K4gnN6+TckgBXCCc/dGO6/yZEunWGK8g=";
+  cargoSha256 = "sha256-kbo3OMLYA/5xctz/YhQNd8IYlyCQB7D/8rCHZwjvlMI=";

  checkFlags = [
    # these want internet access, disable them
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,11 +2,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.46.2";
+  version = "2.47.0";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-fSfES+6+LCRTLdOy3RJaHzv0zRXkqT+0Rsdt2kSeU18=";
+    hash = "sha256-KmNiyWF74hHLLu+uQDiFAMJJvyU/rgyrBhh6O6iMVIg=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, callPackage, fetchurl
-, jdk, cmake, gdb, zlib, python3
+, jdk, cmake, gdb, zlib, python3, icu
 , lldb
 , dotnet-sdk_6
 , maven
@ -211,6 +211,8 @@ let
    (mkJetBrainsProduct {
      inherit pname version src wmClass jdk;
      product = "Rider";
+      # icu is required by Rider.Backend
+      extraLdPath = [ icu ];
      meta = with lib; {
        homepage = "https://www.jetbrains.com/rider/";
        inherit description license platforms;
@ -222,13 +224,15 @@ let
          apps, services and libraries, Unity games, ASP.NET and
          ASP.NET Core web applications.
        '';
-        maintainers = [ ];
+        maintainers = with maintainers; [ raphaelr ];
      };
    }).overrideAttrs (attrs: {
      postPatch = lib.optionalString (!stdenv.isDarwin) (attrs.postPatch + ''
+        interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
+        patchelf --set-interpreter $interp lib/ReSharperHost/linux-x64/Rider.Backend
+
        rm -rf lib/ReSharperHost/linux-x64/dotnet
-        mkdir -p lib/ReSharperHost/linux-x64/dotnet/
-        ln -s ${dotnet-sdk_6}/bin/dotnet lib/ReSharperHost/linux-x64/dotnet/dotnet
+        ln -s ${dotnet-sdk_6} lib/ReSharperHost/linux-x64/dotnet
      '');
    });

--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.0180";
+  version = "9.0.0244";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-38l97auTi6cue457bfRHme5fvsAmvk1MT2va1E/qguw=";
+    hash = "sha256-l6fLM6+tc1Wy1mjNPa/s73GKhhGBLz3OXUJgJN1wuxY=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -3392,6 +3392,18 @@ final: prev:
    meta.homepage = "https://github.com/neovimhaskell/haskell-vim/";
  };

+  haskell-with-unicode-vim = buildVimPluginFrom2Nix {
+    pname = "haskell-with-unicode.vim";
+    version = "2022-09-11";
+    src = fetchFromGitHub {
+      owner = "wenzel-hoffman";
+      repo = "haskell-with-unicode.vim";
+      rev = "28899d6795efe2feaca6b53c20ec5ef3b5a1b761";
+      sha256 = "11a3a981x4av2lvknq1xbxbr8ybgazxfikr45qdm1mby6533kx69";
+    };
+    meta.homepage = "https://github.com/wenzel-hoffman/haskell-with-unicode.vim/";
+  };
+
  hasksyn = buildVimPluginFrom2Nix {
    pname = "hasksyn";
    version = "2014-09-04";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -284,6 +284,7 @@ https://github.com/junegunn/gv.vim/,,
 https://git.sr.ht/~sircmpwn/hare.vim,HEAD,
 https://github.com/ThePrimeagen/harpoon/,,
 https://github.com/neovimhaskell/haskell-vim/,,
+https://github.com/wenzel-hoffman/haskell-with-unicode.vim/,HEAD,
 https://github.com/travitch/hasksyn/,,
 https://github.com/Yggdroot/hiPairs/,,
 https://github.com/mpickering/hlint-refactor-vim/,,
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/release-service/22.08.0/src -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/release-service/22.08.1/src -A '*.tar.xz' )
--- a/pkgs/applications/kde/kleopatra.nix
+++ b/pkgs/applications/kde/kleopatra.nix
@ -1,5 +1,5 @@
 {
-  mkDerivation, fetchpatch, lib, kdepimTeam,
+  mkDerivation, lib, kdepimTeam,
  extra-cmake-modules, kdoctools,
  boost, gpgme, kcmutils, kdbusaddons, kiconthemes, kitemmodels, kmime,
  knotifications, kwindowsystem, kxmlgui, libkleo, kcrash
@ -8,13 +8,6 @@
 mkDerivation {
  pname = "kleopatra";

-  patches = [
-    (fetchpatch {
-      url = "https://invent.kde.org/pim/kleopatra/-/commit/87d8b00d4b2286489d5fadc9cfa07f1d721cdfe3.patch";
-      sha256 = "sha256-s1tXB7h0KtFwwZHx8rhpI0nLZmwhWAiraHEF3KzncMc=";
-    })
-  ];
-
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];

  buildInputs = [
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/aitrack/default.nix
+++ b/pkgs/applications/misc/aitrack/default.nix
@ -0,0 +1,51 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkg-config
+, qmake
+, wrapQtAppsHook
+, opencv
+, spdlog
+, onnxruntime
+, qtx11extras
+}: stdenv.mkDerivation {
+  pname = "aitrack";
+  version = "0.6.5";
+
+  src = fetchFromGitHub {
+    owner = "mdk97";
+    repo = "aitrack-linux";
+    rev = "00bcca9b685abf3a19e4eab653198ca2b1895ae4";
+    sha256 = "sha256-pPvYVLUPYdjtJKdxqZI+JN7OZ4xw9gZ3baYTnJUSTGE=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    qmake
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    opencv
+    spdlog
+    qtx11extras
+    onnxruntime
+  ];
+
+  postPatch = ''
+    substituteInPlace Client/src/Main.cpp \
+      --replace "/usr/share/" "$out/share/"
+  '';
+
+  postInstall = ''
+    install -Dt $out/bin aitrack
+    install -Dt $out/share/aitrack/models models/*
+  '';
+
+  meta = with lib; {
+    description = "6DoF Head tracking software";
+    maintainers = with maintainers; [ ck3d ];
+    platforms = platforms.linux;
+    license = licenses.mit;
+  };
+}
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "blender";
-  version = "3.2.0";
+  version = "3.3.0";

  src = fetchurl {
    url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    hash = "sha256-k78LL1urcQWxnF1lSoSi3CH3Ylhzo2Bk2Yvq5zbTYEo=";
+    hash = "sha256-IsUaTmY4XLFIGKpNdtz3+m1uEDr7DTaRbhLqFZiNIfA=";
  };

  patches = lib.optional stdenv.isDarwin ./darwin.patch;
--- a/pkgs/applications/misc/mpvc/default.nix
+++ b/pkgs/applications/misc/mpvc/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, socat, fetchFromGitHub, makeWrapper }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "mpvc";
-  version = "unstable-2017-03-18";
+  version = "1.3";

  src = fetchFromGitHub {
-    owner = "wildefyr";
+    owner = "lwilletts";
    repo = "mpvc";
-    rev = "aea5c661455248cde7ac9ddba5f63cc790d26512";
-    sha256 = "0qiyvb3ck1wyd3izajwvlq4bwgsbq7x8ya3fgi5i0g2qr39a1qml";
+    rev = version;
+    sha256 = "sha256-wPETEG0BtNBEj3ZyP70byLzIP+NMUKbnjQ+kdvrvK3s=";
  };

  makeFlags = [ "PREFIX=$(out)" ];
@ -23,7 +23,7 @@ stdenv.mkDerivation {

  meta = with lib; {
    description = "A mpc-like control interface for mpv";
-    homepage = "https://github.com/wildefyr/mpvc";
+    homepage = "https://github.com/lwilletts/mpvc";
    license = licenses.mit;
    maintainers = [ maintainers.neeasade ];
    platforms = platforms.linux;
--- a/pkgs/applications/misc/xplr/default.nix
+++ b/pkgs/applications/misc/xplr/default.nix
@ -2,18 +2,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "xplr";
-  version = "0.19.0";
+  version = "0.19.3";

  src = fetchFromGitHub {
    owner = "sayanarijit";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-rvqx0s56VozG8M0m3uZsHuugx0BXucSFqLbq0L1KhAM=";
+    sha256 = "sha256-0aNtBf3np9cq9JTgHRWy73i4AKaVEOluhSMSUyobduI=";
  };

  buildInputs = lib.optional stdenv.isDarwin libiconv;

-  cargoSha256 = "sha256-CyHkjXZVISkQJEQx5vNBGBf6zZrVv/cLWIYeOq9Ac5k=";
+  cargoSha256 = "sha256-DXPpW7vls4yDEMiRrqDndxEKSA7Uncrt6n8nmsBXHcU=";

  meta = with lib; {
    description = "A hackable, minimal, fast TUI file explorer";
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -147,7 +147,7 @@ let
        // extraPolicies;
      };

-      mozillaCfg =  writeText "mozilla.cfg" ''
+      mozillaCfg = ''
        // First line must be a comment

        // Disables addon signature checking
@ -155,7 +155,6 @@ let
        // Security is maintained because only user whitelisted addons
        // with a checksum can be installed
        ${ lib.optionalString usesNixExtensions ''lockPref("xpinstall.signatures.required", false)'' };
-        ${extraPrefs}
      '';

      #############################
@ -345,13 +344,19 @@ let
        echo 'pref("general.config.filename", "mozilla.cfg");' > "$out/lib/${libName}/defaults/pref/autoconfig.js"
        echo 'pref("general.config.obscure_value", 0);' >> "$out/lib/${libName}/defaults/pref/autoconfig.js"

-        cat > "$out/lib/${libName}/mozilla.cfg" < ${mozillaCfg}
+        cat > "$out/lib/${libName}/mozilla.cfg" << EOF
+        ${mozillaCfg}
+        EOF

        extraPrefsFiles=(${builtins.toString extraPrefsFiles})
        for extraPrefsFile in "''${extraPrefsFiles[@]}"; do
          cat "$extraPrefsFile" >> "$out/lib/${libName}/mozilla.cfg"
        done

+        cat >> "$out/lib/${libName}/mozilla.cfg" << EOF
+        ${extraPrefs}
+        EOF
+
        mkdir -p $out/lib/${libName}/distribution/extensions

        #############################
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@ -50,11 +50,11 @@ let
 in stdenv.mkDerivation rec {

  pname = "opera";
-  version = "90.0.4480.48";
+  version = "90.0.4480.84";

  src = fetchurl {
    url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    sha256 = "sha256-nFReaBvtIQ1N5lfOJHoayiI4TWlfmGocNWirbvPRbnM=";
+    sha256 = "sha256-GMcBTY3Ab8lYWv1IPdCeKPZwbY19NPHYmK7ATzvq0cg=";
  };

  unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles, stdenv }:

 let
-  version = "0.33.0";
-  sha256 = "1rrx2sq9wap7xzvqa6dw54kmmlnj4d45y8ziaxkyibz7hsqvzyqk";
-  manifestsSha256 = "0zzv5mkcnxcrd6yq330bm4b1bvlp93qv80n4yb4y7g16d0a2xp9a";
+  version = "0.34.0";
+  sha256 = "1znxhjqvch0z0s98v3hvvh1pa3nlv0l6qhlm0f61z64srz3i5d1k";
+  manifestsSha256 = "1fchzr7fb894hdya9bbh59avqsa66wcz06fck60wmwpc93m64cqs";

  manifests = fetchzip {
    url =
@ -23,7 +23,7 @@ in buildGoModule rec {
    inherit sha256;
  };

-  vendorSha256 = "sha256-jKluPTBg7wVbbApKul/68qC1xoMyp86/ok2UZLAoRUY=";
+  vendorSha256 = "sha256-0oHcitczG+sW9mkwxY6hCdR2ASpat2XQ+IsLAiqCUb8=";

  postUnpack = ''
    cp -r ${manifests} source/cmd/flux/manifests
--- a/pkgs/applications/networking/feedreaders/rsstail/default.nix
+++ b/pkgs/applications/networking/feedreaders/rsstail/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation {
    sha256 = "12p69i3g1fwlw0bds9jqsdmzkid3k5a41w31d227i7vm12wcvjf6";
    rev = "6f2436185372b3f945a4989406c4b6a934fe8a95";
    repo = "rsstail";
-    owner = "flok99";
+    owner = "folkertvanheusden";
  };

  buildInputs = [ libmrss ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
@ -31,6 +31,7 @@ stdenv.mkDerivation {
    '';
    homepage = "http://www.vanheusden.com/rsstail/";
    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.Necior ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@ -8,6 +8,7 @@
 , pkg-config
 , gst_all_1
 , cairo
+, gtk3
 , mpg123
 , alsa-lib
 , SDL2
@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
    libre
    librem
    cairo
+    gtk3
    mpg123
    alsa-lib
    SDL2
@ -75,6 +77,7 @@ stdenv.mkDerivation rec {
    "USE_FFMPEG=1"
    "USE_GSM=1"
    "USE_GST1=1"
+    "USE_GTK=1"
    "USE_L16=1"
    "USE_MPG123=1"
    "USE_OSS=1"
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@ -42,6 +42,11 @@ in stdenv.mkDerivation rec {
    runHook preConfigure

    export HOME=$PWD/tmp
+    # with the update of openssl3, some key ciphers are not supported anymore
+    # this flag will allow those codecs again as a workaround
+    # see https://medium.com/the-node-js-collection/node-js-17-is-here-8dba1e14e382#5f07
+    # and https://github.com/vector-im/element-web/issues/21043
+    export NODE_OPTIONS=--openssl-legacy-provider
    mkdir -p $HOME

    fixup_yarn_lock yarn.lock
--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@ -33,13 +33,13 @@

 mkDerivation rec {
  pname = "nheko";
-  version = "0.10.0";
+  version = "0.10.1-1";

  src = fetchFromGitHub {
    owner = "Nheko-Reborn";
    repo = "nheko";
    rev = "v${version}";
-    sha256 = "sha256-JNAI1+GmRgee7bqeJi8JadV3W7vXMpEvvKqqinb97Ng=";
+    sha256 = "sha256-Bpf38BAGfvmVyrAptIsQ9HaRUopqvytko6unlWLooUo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/mailreaders/trojita/default.nix
+++ b/pkgs/applications/networking/mailreaders/trojita/default.nix
@ -1,6 +1,6 @@
 { akonadi-contacts
 , cmake
-, fetchgit
+, fetchFromGitLab
 , fetchsvn
 , gnupg
 , gpgme
@ -29,12 +29,14 @@ let
  };
 in mkDerivation rec {
  pname = "trojita";
-  version = "unstable-2020-07-06";
+  version = "unstable-2022-08-22";

-  src = fetchgit {
-    url = "https://anongit.kde.org/trojita.git";
-    rev = "e973a5169f18ca862ceb8ad749c93cd621d86e14";
-    sha256 = "0r8nmlqwgsqkk0k8xh32fkwvv6iylj35xq2h8b7l3g03yc342kbn";
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "pim";
+    repo = "trojita";
+    rev = "91087933c5e7a03a8097c0ffe5f7289abcfc123b";
+    sha256 = "sha256-15G9YjT3qBKbeOKfb/IgXOO+DaJaTULP9NJn/MFYZS8=";
  };

  patches = (substituteAll {
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , perl
 , libiconv
 , zlib
@ -16,27 +15,18 @@
 , xxHash
 , enableZstd ? true
 , zstd
-, enableCopyDevicesPatch ? false
 , nixosTests
 }:

 stdenv.mkDerivation rec {
  pname = "rsync";
-  version = "3.2.4";
+  version = "3.2.5";

-  srcs = [
-    (fetchurl {
-      # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
-      url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-      sha256 = "sha256-b3YYONCAUrC2V5z39nN9k+R/AfTaBMXSTTRHt/Kl+tE=";
-    })
-  ] ++ lib.optional enableCopyDevicesPatch (fetchurl {
+  src = fetchurl {
    # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
-    url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz";
-    sha256 = "1wj21v57v135n6fnm2m2dxmb9lhrrg62jgkggldp1gb7d6s4arny";
-  });
-
-  patches = lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff";
+    url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
+    sha256 = "sha256-KsTSFjXN95GGe8N3w1ym3af1DZGaWL5FBX/VFgDGmro=";
+  };

  nativeBuildInputs = [ perl ];

@ -64,6 +54,6 @@ stdenv.mkDerivation rec {
    homepage = "https://rsync.samba.org/";
    license = licenses.gpl3Plus;
    platforms = platforms.unix;
-    maintainers = with lib.maintainers; [ ehmry kampfschlaefer ];
+    maintainers = with lib.maintainers; [ ehmry kampfschlaefer ivan ];
  };
 }
--- a/pkgs/applications/networking/sync/rsync/rrsync.nix
+++ b/pkgs/applications/networking/sync/rsync/rrsync.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation {
  pname = "rrsync";
-  inherit (rsync) version srcs;
+  inherit (rsync) version src;

  buildInputs = [
    rsync
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -3,7 +3,7 @@
 , nixosTests
 , python3
 , ghostscript
-, imagemagick
+, imagemagickBig
 , jbig2enc
 , optipng
 , pngquant
@ -49,7 +49,16 @@ let
    };
  };

-  path = lib.makeBinPath [ ghostscript imagemagick jbig2enc optipng pngquant qpdf tesseract4 unpaper ];
+  path = lib.makeBinPath [
+    ghostscript
+    imagemagickBig
+    jbig2enc
+    optipng
+    pngquant
+    qpdf
+    tesseract4
+    unpaper
+  ];
 in
 python.pkgs.pythonPackages.buildPythonApplication rec {
  pname = "paperless-ngx";
--- a/pkgs/applications/radio/tqsl/default.nix
+++ b/pkgs/applications/radio/tqsl/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
    openssl
    zlib
    db
-    curl
+    (curl.override { inherit openssl; })
    wxGTK
  ];

--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@ -25,14 +25,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.73";
+  version = "14.32.74";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-95bZ6SYPKH+CGHETfdt/0YcUiZaP1gBiNf70GfUd4+M=";
+    sha256 = "sha256-wqZJn/kp3nd94AVe1kJpIa6VU1HYhiM4WoY6fRaJoNg=";
  };

  patchPhase = ''
--- a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
@ -37,6 +37,11 @@ stdenv.mkDerivation rec {
    "DOCBOOK_XSL=${docbook_xsl}/share/xml/docbook-xsl-nons/manpages/docbook.xsl"
  ];

+  # https://github.com/AGWA/git-crypt/issues/232
+  CXXFLAGS = [
+    "-DOPENSSL_API_COMPAT=0x30000000L"
+  ];
+
  postFixup = ''
    wrapProgram $out/bin/git-crypt \
      --suffix PATH : ${lib.makeBinPath [ git gnupg ]}
--- a/pkgs/applications/version-management/got/default.nix
+++ b/pkgs/applications/version-management/got/default.nix
@ -1,19 +1,28 @@
-{ lib, stdenv, fetchurl, pkg-config, openssl, libbsd, libuuid, libossp_uuid, libmd, zlib, ncurses }:
+{ lib, stdenv, fetchurl
+, pkg-config, openssl, libbsd, libevent, libuuid, libossp_uuid, libmd, zlib, ncurses, bison
+}:

 stdenv.mkDerivation rec {
  pname = "got";
-  version = "0.74";
+  version = "0.75";

  src = fetchurl {
    url = "https://gameoftrees.org/releases/portable/got-portable-${version}.tar.gz";
-    sha256 = "sha256-XElSCdFh24rf2gosjS0BG+VNqLZNLYeYkUy4t5RIdv4=";
+    sha256 = "sha256-s1MkiTya771r9JYCpsm7nW4gZwr/PJc0/v6tAgW7nLI=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config bison ];

-  buildInputs = [ openssl libbsd libuuid libmd zlib ncurses ]
+  buildInputs = [ openssl libbsd libevent libuuid libmd zlib ncurses ]
  ++ lib.optionals stdenv.isDarwin [ libossp_uuid ];

+  preConfigure = lib.optionals stdenv.isDarwin ''
+    # The configure script assumes dependencies on Darwin are install via
+    # Homebrew or MacPorts and hardcodes assumptions about the paths of
+    # dependencies which fails the nixpkgs configurePhase.
+    substituteInPlace configure --replace 'xdarwin' 'xhomebrew'
+  '';
+
  doInstallCheck = true;

  installCheckPhase = ''
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@ -212,6 +212,7 @@ let
        flags+=("-v" "-p" "$NIX_BUILD_CORES")

        if [ "$cmd" = "test" ]; then
+          flags+=(-vet=off)
          flags+=($checkFlags)
        fi

--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@ -171,6 +171,7 @@ let
        flags+=("-v" "-p" "$NIX_BUILD_CORES")

        if [ "$cmd" = "test" ]; then
+          flags+=(-vet=off)
          flags+=($checkFlags)
        fi

--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@ -2,16 +2,16 @@

 stdenv.mkDerivation rec {
  pname = "tzdata";
-  version = "2022b";
+  version = "2022c";

  srcs = [
    (fetchurl {
      url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-9ZDq8Eo5UkVCbCvk+uccFDrqXOvBEIi3oKVwRGHfOX0=";
+      hash = "sha256-aXT040i/IyMnS1bf+edQAkfjFZ6qS0hd+gzWbnXBS/4=";
    })
    (fetchurl {
      url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-urINlD5ZoyGENfSNhopOVS8Y1tfz3RKGYMVmDIC4oF8=";
+      hash = "sha256-Pnzh82IMwEgZB8fgdNaZEHkyhb/+DKMx7xptGuPqkMw=";
    })
  ];

--- a/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
+++ b/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "sierra-breeze-enhanced";
-  version = "1.2.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "kupiqu";
    repo = "SierraBreezeEnhanced";
    rev = "V${version}";
-    sha256 = "sha256-Tzd8ATdmOjVe8OCSdcB9h7r6sqtb+24Fq80t/hmGJcE=";
+    sha256 = "sha256-x3OTLH8gcWrqpFGQPZHwvyPFwLhEGeHhU4cRqvtPupQ=";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@ -150,7 +150,7 @@ stdenv.mkDerivation rec {
    sed "s|/usr/share/sounds|/run/current-system/sw/share/sounds|g" -i ./files/usr/share/cinnamon/cinnamon-settings/bin/SettingsWidgets.py

    sed "s|/usr/bin/upload-system-info|${xapp}/bin/upload-system-info|g" -i ./files/usr/share/cinnamon/cinnamon-settings/modules/cs_info.py
-    sed "s|upload-system-info|${xapp}/bin/upload-system-info|g" -i ./files/usr/share/cinnamon/cinnamon-settings/modules/cs_info.py
+    sed "s|\"upload-system-info\"|\"${xapp}/bin/upload-system-info\"|g" -i ./files/usr/share/cinnamon/cinnamon-settings/modules/cs_info.py

    sed "s|/usr/bin/cinnamon-control-center|${cinnamon-control-center}/bin/cinnamon-control-center|g" -i ./files/usr/bin/cinnamon-settings
    # this one really IS optional
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.25.4/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.25.5/ -A '*.tar.xz' )
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@ -4,427 +4,427 @@

 {
  bluedevil = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/bluedevil-5.25.4.tar.xz";
-      sha256 = "1cygnmigwqx1mqynfafcypkvf9bmz05rmrfwlxsksvll8yd9xn84";
-      name = "bluedevil-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/bluedevil-5.25.5.tar.xz";
+      sha256 = "1dsah7rcx2brcd1d5x7bvhrixx5nvwp1fwq9b8k2zc038xzpx6ys";
+      name = "bluedevil-5.25.5.tar.xz";
    };
  };
  breeze = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/breeze-5.25.4.tar.xz";
-      sha256 = "0lw0vj07z8l19v2z31d601kfanqixy3dbsv0lf8q273xv3li9sbp";
-      name = "breeze-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/breeze-5.25.5.tar.xz";
+      sha256 = "0m3ggv5znzfcp25afgl7v5w7m27v5hdvv6jw9vrvwbqj8lzq1hlx";
+      name = "breeze-5.25.5.tar.xz";
    };
  };
  breeze-grub = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/breeze-grub-5.25.4.tar.xz";
-      sha256 = "10n380h77czwgbpcjhriai43pk9q08l9j819nqm9wbwmsw7gj31s";
-      name = "breeze-grub-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/breeze-grub-5.25.5.tar.xz";
+      sha256 = "1w5lrnfhnzd9mjs93r1y8f9mlpqd7jlrjwzfryy919alqsxfpyyl";
+      name = "breeze-grub-5.25.5.tar.xz";
    };
  };
  breeze-gtk = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/breeze-gtk-5.25.4.tar.xz";
-      sha256 = "1x9a74f2anybvgmj4yl7pzz14jckjly55sb8hhlyrd1mp2k8p4mi";
-      name = "breeze-gtk-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/breeze-gtk-5.25.5.tar.xz";
+      sha256 = "0wj8qzy2104ggczxagxm45zwsvvpwd6jjnbv1893mhlr6f2zrbmh";
+      name = "breeze-gtk-5.25.5.tar.xz";
    };
  };
  breeze-plymouth = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/breeze-plymouth-5.25.4.tar.xz";
-      sha256 = "0wfhhaknvy51zrgfkcjrgc5s3q8y3pqb4r92nr37055cdvncwz79";
-      name = "breeze-plymouth-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/breeze-plymouth-5.25.5.tar.xz";
+      sha256 = "1p9xgcxx543dddpz7sahk1ky6inzl9lyaf0z506vh91xs5rn0srv";
+      name = "breeze-plymouth-5.25.5.tar.xz";
    };
  };
  discover = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/discover-5.25.4.tar.xz";
-      sha256 = "154sjr7c8dwlf1m22vh3wqiyfii8xpmxmfrf36i9r0xyb0zb5zg6";
-      name = "discover-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/discover-5.25.5.tar.xz";
+      sha256 = "01vdi66c7v60db25p0qi0q73wgqw6dy2kirbk34bvhld41gpxhhv";
+      name = "discover-5.25.5.tar.xz";
    };
  };
  drkonqi = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/drkonqi-5.25.4.tar.xz";
-      sha256 = "06na44x22bxd94r24xkzc373d0rhmv6l1awfq0bzh9cxpy8yg3f4";
-      name = "drkonqi-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/drkonqi-5.25.5.tar.xz";
+      sha256 = "0vw4bfld2jdiwm4g3008x8s1lq1ydf87ckb0fvyzsp11hq9nnnk7";
+      name = "drkonqi-5.25.5.tar.xz";
    };
  };
  kactivitymanagerd = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kactivitymanagerd-5.25.4.tar.xz";
-      sha256 = "1cpz08jkmxw9576h9mkn15vwg3bxgk8k6w4f38rkiasxzj6zfamd";
-      name = "kactivitymanagerd-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kactivitymanagerd-5.25.5.tar.xz";
+      sha256 = "0hsllhqi46n25sr27crnad053ghk3hni2w496g6d2qfmi20l3g4n";
+      name = "kactivitymanagerd-5.25.5.tar.xz";
    };
  };
  kde-cli-tools = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kde-cli-tools-5.25.4.tar.xz";
-      sha256 = "00p6vm9qw871hjclvw21nh93dq60r1ylb95hscx917gfx42dan8x";
-      name = "kde-cli-tools-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kde-cli-tools-5.25.5.tar.xz";
+      sha256 = "0i1lnkyb2bdvbhnr2wsgjy2sjichzxxqkvn30ca85rj21cavk2z3";
+      name = "kde-cli-tools-5.25.5.tar.xz";
    };
  };
  kde-gtk-config = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kde-gtk-config-5.25.4.tar.xz";
-      sha256 = "03cr5v7sr67vhcidr87min8z1ld5dm0n6yh79c1ghp1hp5ndscl8";
-      name = "kde-gtk-config-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kde-gtk-config-5.25.5.tar.xz";
+      sha256 = "0zr4626fmx5adg65qa0npc222kjxmhml1i014gsrmjmsp0s5w8pw";
+      name = "kde-gtk-config-5.25.5.tar.xz";
    };
  };
  kdecoration = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kdecoration-5.25.4.tar.xz";
-      sha256 = "1yw7qjrf0c9xl2mncasbh3c1nf3c8x1v8ccfnp540z9slqi5qfmi";
-      name = "kdecoration-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kdecoration-5.25.5.tar.xz";
+      sha256 = "1x3scszz5nfwqciwc3bv0r04wgqlxs0c9j1090zvn6mjjg2nsyb7";
+      name = "kdecoration-5.25.5.tar.xz";
    };
  };
  kdeplasma-addons = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kdeplasma-addons-5.25.4.tar.xz";
-      sha256 = "1lgmmqr798cfxmllalgzixf3v9xbiiazbn3vkcdqxcj6cjf730c0";
-      name = "kdeplasma-addons-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kdeplasma-addons-5.25.5.tar.xz";
+      sha256 = "1a5cq0jz69hlcr22wxi2p5mzxv5xcp88220irxmq0dhpk85kywlx";
+      name = "kdeplasma-addons-5.25.5.tar.xz";
    };
  };
  kgamma5 = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kgamma5-5.25.4.tar.xz";
-      sha256 = "1m72dl1rxsh56pmacx0q0qda7lr4359azik2lnhw7nhs30z4p25a";
-      name = "kgamma5-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kgamma5-5.25.5.tar.xz";
+      sha256 = "1c305bs50km7bsn0phz7yj4x2168sxwsw9zxbpcgw4q3r53c0ywz";
+      name = "kgamma5-5.25.5.tar.xz";
    };
  };
  khotkeys = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/khotkeys-5.25.4.tar.xz";
-      sha256 = "0hkicwkcjb4p4k5yh8d60h6khsvrqkhjx42aby6rxd3mgvrqd3xy";
-      name = "khotkeys-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/khotkeys-5.25.5.tar.xz";
+      sha256 = "0c9i4vxiiv90dpzsd2hjwavks87cvwplkj63751z8mazax6r95as";
+      name = "khotkeys-5.25.5.tar.xz";
    };
  };
  kinfocenter = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kinfocenter-5.25.4.tar.xz";
-      sha256 = "0ns2xsqghglg4ikq7w556y1kh20gs677km1vs0paw50xhi7jzbd2";
-      name = "kinfocenter-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kinfocenter-5.25.5.tar.xz";
+      sha256 = "0zvki76yghkn158s7hb5g9drz7xaqxkmp2747404n2n0gmnmsdif";
+      name = "kinfocenter-5.25.5.tar.xz";
    };
  };
  kmenuedit = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kmenuedit-5.25.4.tar.xz";
-      sha256 = "1y3ml4jscb28nvadh7iq2y240qifv71dv2nkd32i69h52xdrvz27";
-      name = "kmenuedit-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kmenuedit-5.25.5.tar.xz";
+      sha256 = "0z85w7w207dnsinsz8yg6s408pwfy3l7wjkcsjpyg8aj8s9x6nl7";
+      name = "kmenuedit-5.25.5.tar.xz";
    };
  };
  kscreen = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kscreen-5.25.4.tar.xz";
-      sha256 = "1wjpyq56iw8axbjhsa82w67g54v6y3rv5nx623d1kddvlzlhh8pf";
-      name = "kscreen-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kscreen-5.25.5.tar.xz";
+      sha256 = "0361202n0366jiyv61w06jikh2i4s1fzr6x3chmdykx4fgvbqj7s";
+      name = "kscreen-5.25.5.tar.xz";
    };
  };
  kscreenlocker = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kscreenlocker-5.25.4.tar.xz";
-      sha256 = "0zfvkdvyqxxxgpiimqjxhavwna0z94i28ky8qmvbcmn1705x5lvx";
-      name = "kscreenlocker-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kscreenlocker-5.25.5.tar.xz";
+      sha256 = "0mivx0l266310iy52qi94b6wi8w2a8nl7cjn5750x66dz81jl3yj";
+      name = "kscreenlocker-5.25.5.tar.xz";
    };
  };
  ksshaskpass = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/ksshaskpass-5.25.4.tar.xz";
-      sha256 = "0dzhddylzigaaigacynncd5q0s4884dgr4wyrrdpqj42d47wjikz";
-      name = "ksshaskpass-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/ksshaskpass-5.25.5.tar.xz";
+      sha256 = "0z8pp2mh4s98jh8jkf6r8v014gb6svapmp0m1npzw7zcmr6jvpn6";
+      name = "ksshaskpass-5.25.5.tar.xz";
    };
  };
  ksystemstats = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/ksystemstats-5.25.4.tar.xz";
-      sha256 = "0ray2v90vv1j1sbd7fx4x5n7s7xwlil1zynwi4pzpgnyi13zq60x";
-      name = "ksystemstats-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/ksystemstats-5.25.5.tar.xz";
+      sha256 = "07xm6gn2k3vsl1pkrd2n9w8w8b7jq26h3cpslqha4ipw0by2mlqa";
+      name = "ksystemstats-5.25.5.tar.xz";
    };
  };
  kwallet-pam = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kwallet-pam-5.25.4.tar.xz";
-      sha256 = "14j3xngwliqhhvw60izv5kdjvv8xhqw8cjsc4l22v8jj4m8yw2xk";
-      name = "kwallet-pam-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kwallet-pam-5.25.5.tar.xz";
+      sha256 = "14w803lc3s2c0f4mqzzdhpfy5qnlz7wv00pbrc3v4k3zv381ci8n";
+      name = "kwallet-pam-5.25.5.tar.xz";
    };
  };
  kwayland-integration = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kwayland-integration-5.25.4.tar.xz";
-      sha256 = "1iqnwcp08kg91pwm3i4grd0i4bqf8h1z0n0fhcw6l0cbhdkcad39";
-      name = "kwayland-integration-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kwayland-integration-5.25.5.tar.xz";
+      sha256 = "10xl7yrj519b9s5vq0hqqfz3vvg1fdwggw96snzm44iwycqbgss8";
+      name = "kwayland-integration-5.25.5.tar.xz";
    };
  };
  kwin = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kwin-5.25.4.tar.xz";
-      sha256 = "0zahw7hd3g775a6iyglvv60h9vw52jc9pg9ffkg4mpqb00f159p8";
-      name = "kwin-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kwin-5.25.5.tar.xz";
+      sha256 = "1dh7ydwxbb9r53p353d53gq7w9vmp7idvsr4s5ldxmah35436v2s";
+      name = "kwin-5.25.5.tar.xz";
    };
  };
  kwrited = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/kwrited-5.25.4.tar.xz";
-      sha256 = "0xn20irka7adbqfc8w6gnhwp0pbv7bz7l7g16qddv1wq3xix9053";
-      name = "kwrited-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/kwrited-5.25.5.tar.xz";
+      sha256 = "03gw3czdgyf35n6x79x416rk6f7w1ayzmy5pb65v9733nx1j34mh";
+      name = "kwrited-5.25.5.tar.xz";
    };
  };
  layer-shell-qt = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/layer-shell-qt-5.25.4.tar.xz";
-      sha256 = "0pd88nnp925l09gzq4cajjnx810df4n0ssd65i1bmvgnxynzh5i7";
-      name = "layer-shell-qt-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/layer-shell-qt-5.25.5.tar.xz";
+      sha256 = "1mvhklq7n9hhjing704jr3ybq58ixwr9fdg3phnqhmdnqc2q3w0l";
+      name = "layer-shell-qt-5.25.5.tar.xz";
    };
  };
  libkscreen = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/libkscreen-5.25.4.tar.xz";
-      sha256 = "17ib0sgrhmmf3f8w3fni0825xz5581av5vnz8gca41vyf12css25";
-      name = "libkscreen-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/libkscreen-5.25.5.tar.xz";
+      sha256 = "17f2pbbkpmw3a32nsqlwd0x5xb71l6dzrh7ldwcqv46nvb54yhfa";
+      name = "libkscreen-5.25.5.tar.xz";
    };
  };
  libksysguard = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/libksysguard-5.25.4.tar.xz";
-      sha256 = "1kzpimhkagsmqj0cky4cfav1kbzyfjaj2l5xdapnmaygbm6r8086";
-      name = "libksysguard-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/libksysguard-5.25.5.tar.xz";
+      sha256 = "1gqsjsdkp25abqqp4f6cv6ih199q9ad7q1a4lkhjgsh4h8jq1856";
+      name = "libksysguard-5.25.5.tar.xz";
    };
  };
  milou = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/milou-5.25.4.tar.xz";
-      sha256 = "17npfn7gwiqrvy5w8vzpc38c4bgkx3vjgjkm1caizn04zfk7xar7";
-      name = "milou-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/milou-5.25.5.tar.xz";
+      sha256 = "0ijdbiq169sy47g0x22pj9x6abldpfxcnski4w1jh9hi9qz1rc25";
+      name = "milou-5.25.5.tar.xz";
    };
  };
  oxygen = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/oxygen-5.25.4.tar.xz";
-      sha256 = "1cd76fa2szhb3apabyvl76p8vdk97229g5sgv94xx9pr7rx8a67y";
-      name = "oxygen-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/oxygen-5.25.5.tar.xz";
+      sha256 = "1szkaln4if8rafvjg2yjxarspf7lqls2pk0gzac89ncr7840c970";
+      name = "oxygen-5.25.5.tar.xz";
    };
  };
  oxygen-sounds = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/oxygen-sounds-5.25.4.tar.xz";
-      sha256 = "0v8j8kf86ri1z14mgqc1c6kkpsbih8rjph35sr5y0i4av9mh6p9b";
-      name = "oxygen-sounds-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/oxygen-sounds-5.25.5.tar.xz";
+      sha256 = "04rn3ccqszznknvblz2i8r406m32hk4d3yzma4vzq93jfk57hdf1";
+      name = "oxygen-sounds-5.25.5.tar.xz";
    };
  };
  plasma-browser-integration = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-browser-integration-5.25.4.tar.xz";
-      sha256 = "1l3n4psbqimfar5qsmrfp3nhgg3v9yy93rkjpvyqgdmizi44scqw";
-      name = "plasma-browser-integration-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-browser-integration-5.25.5.tar.xz";
+      sha256 = "18pbn5ic5l3m8i1y99yprpwd4x4746aq3abqn1f2cq5h2683h2ia";
+      name = "plasma-browser-integration-5.25.5.tar.xz";
    };
  };
  plasma-desktop = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-desktop-5.25.4.tar.xz";
-      sha256 = "1jkjc412n1wn17qrmx0sv91pzv5xjsljms3bsln6bbxj5fkhmkfm";
-      name = "plasma-desktop-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-desktop-5.25.5.tar.xz";
+      sha256 = "05s1pkwr4xmkghp8jrwcyrvjm83n68ngmk2694055xcfgi0pxicg";
+      name = "plasma-desktop-5.25.5.tar.xz";
    };
  };
  plasma-disks = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-disks-5.25.4.tar.xz";
-      sha256 = "04hs8jg7f5bm5rjcb6i6zidyamq6cfry5sm5mj6hqdj0qmn9i396";
-      name = "plasma-disks-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-disks-5.25.5.tar.xz";
+      sha256 = "0vci2cf8vx2lclypys9rmvjb8haakv6ksrvqm5j28pazbq2kskvl";
+      name = "plasma-disks-5.25.5.tar.xz";
    };
  };
  plasma-firewall = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-firewall-5.25.4.tar.xz";
-      sha256 = "12rmf7x8dyyb1k5ycj43kn4c0wzidig4h5wdh1igrgcvyypmjjcl";
-      name = "plasma-firewall-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-firewall-5.25.5.tar.xz";
+      sha256 = "0k3pc0dcsjr2hhh4hr8vhsvaddn66s6imm8skrr02icxqvljs6jh";
+      name = "plasma-firewall-5.25.5.tar.xz";
    };
  };
  plasma-integration = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-integration-5.25.4.tar.xz";
-      sha256 = "1cbcp722pzbfiqfl5rcw6py74jbxg83k96kdx2m0g3ix1f0dmkbi";
-      name = "plasma-integration-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-integration-5.25.5.tar.xz";
+      sha256 = "1pab56cg2zi8fcaar53lhhh98iw7l07f5lkymkqhsh8a5crfc3yr";
+      name = "plasma-integration-5.25.5.tar.xz";
    };
  };
  plasma-mobile = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-mobile-5.25.4.tar.xz";
-      sha256 = "0b0n3mjlj33191jgs8xqbk35y5nglfz4d8dih3qmg3kbs81qizwy";
-      name = "plasma-mobile-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-mobile-5.25.5.tar.xz";
+      sha256 = "1q4amdqvjbcx88qdyvhhl6j5f0f9p41b3k99zsqv381f94dpybn9";
+      name = "plasma-mobile-5.25.5.tar.xz";
    };
  };
  plasma-nano = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-nano-5.25.4.tar.xz";
-      sha256 = "1pn6025wb3w855f3vy77879qlrb266bikw3nhar1dzv3sfgxw4w9";
-      name = "plasma-nano-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-nano-5.25.5.tar.xz";
+      sha256 = "1kgglhr3cvg0crfr6di21kp1pfdc017qh3jnaf25f15bllypznq9";
+      name = "plasma-nano-5.25.5.tar.xz";
    };
  };
  plasma-nm = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-nm-5.25.4.tar.xz";
-      sha256 = "147p572pmkrgg52pvwhzs8lvxy3rs8y622n9lj7hjc6hrlh14qk2";
-      name = "plasma-nm-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-nm-5.25.5.tar.xz";
+      sha256 = "036bx0qjrjanfxy8aiy6ab7rmm2h8l7wlkvlwhzw2hgl1w03xjps";
+      name = "plasma-nm-5.25.5.tar.xz";
    };
  };
  plasma-pa = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-pa-5.25.4.tar.xz";
-      sha256 = "0v92jk826jj2kf11hlxh3xrxl9nsj6835ik2pmb192xbn6gpb4lm";
-      name = "plasma-pa-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-pa-5.25.5.tar.xz";
+      sha256 = "0g06pm1isnzx4hv6380rjpyr22s4j5iw9083s71vnl4npx28npvb";
+      name = "plasma-pa-5.25.5.tar.xz";
    };
  };
  plasma-sdk = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-sdk-5.25.4.tar.xz";
-      sha256 = "00s345l5jj1kfdvyyfq8718khfy88n6gyajb07n582q266mry39l";
-      name = "plasma-sdk-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-sdk-5.25.5.tar.xz";
+      sha256 = "1z0cn0aiiivdb02r5vn8hm8hj9wbx053ksh5jgx2x048g67gmq96";
+      name = "plasma-sdk-5.25.5.tar.xz";
    };
  };
  plasma-systemmonitor = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-systemmonitor-5.25.4.tar.xz";
-      sha256 = "1fj0vyjdk6h3f4p9aagh03hyhbf69y2qwlavs2zr7d0iadih7b4c";
-      name = "plasma-systemmonitor-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-systemmonitor-5.25.5.tar.xz";
+      sha256 = "0rs3avhpmfapzha8dkir9ny60ba2m92bbfv4avsd85vz5kggg29h";
+      name = "plasma-systemmonitor-5.25.5.tar.xz";
    };
  };
  plasma-tests = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-tests-5.25.4.tar.xz";
-      sha256 = "0d86zmlmagik2chagsm549yg78vy2qw3kl67skrlrmbkv82dhrz2";
-      name = "plasma-tests-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-tests-5.25.5.tar.xz";
+      sha256 = "14gdnyxl4fb5rqv1gpmp2wgx3x30pli919wjn835lbd2mf4rzwfq";
+      name = "plasma-tests-5.25.5.tar.xz";
    };
  };
  plasma-thunderbolt = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-thunderbolt-5.25.4.tar.xz";
-      sha256 = "0hjvkss0qfmwhrsba83wfxwxhikvzf56faan325ic0iv7fdaj3ns";
-      name = "plasma-thunderbolt-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-thunderbolt-5.25.5.tar.xz";
+      sha256 = "1lbs4y163ccvd5zllazlp0f5v0g0rii1apbji9j7mr1n4w10wp16";
+      name = "plasma-thunderbolt-5.25.5.tar.xz";
    };
  };
  plasma-vault = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-vault-5.25.4.tar.xz";
-      sha256 = "10ym2gk46yr1vgjnm1li1shdawklvvy3yvjcanm8ic5llchbxvzq";
-      name = "plasma-vault-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-vault-5.25.5.tar.xz";
+      sha256 = "15nf4myl6sry0930m8qiixpr1i8bh1g58cy2gf304h029vr2fn5j";
+      name = "plasma-vault-5.25.5.tar.xz";
    };
  };
  plasma-workspace = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-workspace-5.25.4.tar.xz";
-      sha256 = "1aw9ms6rzxrk384xzdc3sqwqs1shbnkap40vfwxp4jamjk0pyglw";
-      name = "plasma-workspace-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-workspace-5.25.5.tar.xz";
+      sha256 = "0pxwg3i07sipfchn4qkmlr6kcgqbhj2s10xq69wi32x1fc13jx5x";
+      name = "plasma-workspace-5.25.5.tar.xz";
    };
  };
  plasma-workspace-wallpapers = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plasma-workspace-wallpapers-5.25.4.tar.xz";
-      sha256 = "1vjrfmzib17cb9r2q17rv4zmnqsk5mf55vy8kzx71djjif7gaqiy";
-      name = "plasma-workspace-wallpapers-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plasma-workspace-wallpapers-5.25.5.tar.xz";
+      sha256 = "0pdgg8h6zwyxf1pj241mg3hd94wh38bqxj68af5jfp10xrwkzcyr";
+      name = "plasma-workspace-wallpapers-5.25.5.tar.xz";
    };
  };
  plymouth-kcm = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/plymouth-kcm-5.25.4.tar.xz";
-      sha256 = "1wbgcccc1ili3j0k1njgj1q6jl35s20gf9m25s9d3mjwd9xnxrbv";
-      name = "plymouth-kcm-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/plymouth-kcm-5.25.5.tar.xz";
+      sha256 = "1knywmc6wdjqfq1xqli8hyi69kj7fvc0x0s246y7nrkskfc9ah67";
+      name = "plymouth-kcm-5.25.5.tar.xz";
    };
  };
  polkit-kde-agent = {
-    version = "1-5.25.4";
+    version = "1-5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/polkit-kde-agent-1-5.25.4.tar.xz";
-      sha256 = "0skadgzv97vfl4n2x889fiy5gsr6n894fr5viq3rizs0qsqc68b5";
-      name = "polkit-kde-agent-1-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/polkit-kde-agent-1-5.25.5.tar.xz";
+      sha256 = "1qb9nxlkgcv0c30l2vqgf9xs9d220q5pg7ikpb6zjzvj4wsvlvwd";
+      name = "polkit-kde-agent-1-5.25.5.tar.xz";
    };
  };
  powerdevil = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/powerdevil-5.25.4.tar.xz";
-      sha256 = "1nznjxi59xc6pmyh0vainznhp9ig1ini3i87iapayawpnpf8sdxx";
-      name = "powerdevil-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/powerdevil-5.25.5.tar.xz";
+      sha256 = "0anisirn7z8aw442npdnk1csb5ghpzj2hx49gpw4l6ijk70b76pr";
+      name = "powerdevil-5.25.5.tar.xz";
    };
  };
  qqc2-breeze-style = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/qqc2-breeze-style-5.25.4.tar.xz";
-      sha256 = "0sylffvbfdi44lmz6s78scf2p2iswf6p8g209wbd5fm1dgi6yi2z";
-      name = "qqc2-breeze-style-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/qqc2-breeze-style-5.25.5.tar.xz";
+      sha256 = "0z71kmhajk1jyp0f32kpl4pklbvxc34jp9jzq09gkq5vpsdccy6g";
+      name = "qqc2-breeze-style-5.25.5.tar.xz";
    };
  };
  sddm-kcm = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/sddm-kcm-5.25.4.tar.xz";
-      sha256 = "1gqz9j6vha8i6bra63pfqrpl5wsg9a7qz351z5rkj5jwnkw1dxl7";
-      name = "sddm-kcm-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/sddm-kcm-5.25.5.tar.xz";
+      sha256 = "1hvwjcgsjvlg61rfrak5111828lxf0lfh5p95d5kw1x4y2wlr756";
+      name = "sddm-kcm-5.25.5.tar.xz";
    };
  };
  systemsettings = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/systemsettings-5.25.4.tar.xz";
-      sha256 = "130739bfxl1jwkn3f4h7dnr7dv2i76g6sd2svmg0qy60cnwvcgcv";
-      name = "systemsettings-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/systemsettings-5.25.5.tar.xz";
+      sha256 = "0n7mf6ygi8fgn1m6pk2fadnqj1h58mxqni3h19xbi373wfypq5fl";
+      name = "systemsettings-5.25.5.tar.xz";
    };
  };
  xdg-desktop-portal-kde = {
-    version = "5.25.4";
+    version = "5.25.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.25.4/xdg-desktop-portal-kde-5.25.4.tar.xz";
-      sha256 = "13gva3mci9gawlxpw4ymdma8w6lc2b3y8z36699kmzli4vib214g";
-      name = "xdg-desktop-portal-kde-5.25.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.25.5/xdg-desktop-portal-kde-5.25.5.tar.xz";
+      sha256 = "0l3lmwihxyl65y0mkyg3afk1k6gc0ldjw2vg92g7yydbgmn39q7k";
+      name = "xdg-desktop-portal-kde-5.25.5.tar.xz";
    };
  };
 }
--- a/pkgs/development/compilers/dotnet/build-dotnet.nix
+++ b/pkgs/development/compilers/dotnet/build-dotnet.nix
@ -15,7 +15,7 @@ assert if type == "sdk" then packages != null else true;
 , autoPatchelfHook
 , makeWrapper
 , libunwind
-, openssl
+, openssl_1_1
 , libuuid
 , zlib
 , curl
@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    icu
    libunwind
    libuuid
-    openssl
+    openssl_1_1
  ] ++ lib.optional stdenv.isLinux lttng-ust_2_12);

  nativeBuildInputs = [
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@ -14,7 +14,6 @@
 , texinfo ? null
 , perl ? null # optional, for texi2pod (then pod2man)
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
 , gnatboot ? null
@ -29,11 +28,8 @@
 , buildPackages
 }:

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -159,6 +155,9 @@ stdenv.mkDerivation ({
  nativeBuildInputs = [ texinfo which gettext ]
    ++ (optional (perl != null) perl)
    ++ (optional langAda gnatboot)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
    ;

  # For building runtime libs
@ -173,13 +172,10 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -203,7 +199,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl

      enableLTO
      enableMultilib
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@ -14,7 +14,6 @@
 , texinfo ? null
 , perl ? null # optional, for texi2pod (then pod2man)
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
 , gnatboot ? null
@ -29,11 +28,8 @@
 , buildPackages
 }:

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -167,6 +163,9 @@ stdenv.mkDerivation ({
  nativeBuildInputs = [ texinfo which gettext ]
    ++ (optional (perl != null) perl)
    ++ (optional langAda gnatboot)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
    ;

  # For building runtime libs
@ -181,13 +180,10 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -211,7 +207,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl

      enableLTO
      enableMultilib
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@ -14,7 +14,6 @@
 , texinfo ? null
 , perl ? null # optional, for texi2pod (then pod2man)
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
 , gnatboot ? null
@ -29,11 +28,8 @@
 , buildPackages
 }:

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -162,6 +158,9 @@ stdenv.mkDerivation ({
  nativeBuildInputs = [ texinfo which gettext ]
    ++ (optional (perl != null) perl)
    ++ (optional langAda gnatboot)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
    ;

  # For building runtime libs
@ -176,13 +175,10 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -206,7 +202,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl

      enableLTO
      enableMultilib
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@ -13,7 +13,6 @@
 , texinfo ? null
 , perl ? null # optional, for texi2pod (then pod2man); required for Java
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , cloog ? null, isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null, boehmgc ? null
 , zip ? null, unzip ? null, pkg-config ? null
@ -39,11 +38,8 @@ assert langJava     -> zip != null && unzip != null
 # We enable the isl cloog backend.
 assert cloog != null -> isl != null;

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -165,7 +161,11 @@ stdenv.mkDerivation ({
  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ texinfo which gettext ]
    ++ (optional (perl != null) perl)
-    ++ (optional javaAwtGtk pkg-config);
+    ++ (optional javaAwtGtk pkg-config)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
+    ;

  # For building runtime libs
  depsBuildTarget =
@ -179,16 +179,13 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (cloog != null) cloog)
    ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
    ++ (optionals langJava [ boehmgc zip unzip ])
    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -210,7 +207,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl
      cloog

      enableLTO
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -13,7 +13,6 @@
 , texinfo ? null
 , perl ? null # optional, for texi2pod (then pod2man); required for Java
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , cloog ? null, isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null, boehmgc ? null
 , zip ? null, unzip ? null, pkg-config ? null
@ -39,11 +38,8 @@ assert langJava     -> zip != null && unzip != null
 # We enable the isl cloog backend.
 assert cloog != null -> isl != null;

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -185,7 +181,11 @@ stdenv.mkDerivation ({
  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ texinfo which gettext ]
    ++ (optional (perl != null) perl)
-    ++ (optional javaAwtGtk pkg-config);
+    ++ (optional javaAwtGtk pkg-config)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
+    ;

  # For building runtime libs
  depsBuildTarget =
@ -199,16 +199,13 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (cloog != null) cloog)
    ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
    ++ (optionals langJava [ boehmgc zip unzip ])
    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -230,7 +227,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl
      cloog

      enableLTO
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -15,7 +15,6 @@
 , flex
 , perl ? null # optional, for texi2pod (then pod2man); required for Java
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null, boehmgc ? null
 , gnatboot ? null
@ -40,11 +39,8 @@ assert langJava     -> zip != null && unzip != null
                       && zlib != null && boehmgc != null
                       && perl != null;  # for `--enable-java-home'

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -196,6 +192,9 @@ stdenv.mkDerivation ({
    ++ (optional javaAwtGtk pkg-config)
    ++ (optional (with stdenv.targetPlatform; isVc4 || isRedox) flex)
    ++ (optional langAda gnatboot)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
    ;

  # For building runtime libs
@ -210,15 +209,12 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
    ++ (optionals langJava [ boehmgc zip unzip ])
    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -242,7 +238,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl

      enableLTO
      enableMultilib
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@ -12,7 +12,6 @@
 , texinfo ? null
 , perl ? null # optional, for texi2pod (then pod2man)
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
 , enableMultilib ? false
@ -26,11 +25,8 @@
 , buildPackages
 }:

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -164,7 +160,11 @@ stdenv.mkDerivation ({

  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl);
+    ++ (optional (perl != null) perl)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
+    ;

  # For building runtime libs
  depsBuildTarget =
@ -178,13 +178,10 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -209,7 +206,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl

      enableLTO
      enableMultilib
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@ -12,7 +12,6 @@
 , texinfo ? null
 , perl ? null # optional, for texi2pod (then pod2man)
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
 , enableMultilib ? false
@ -26,11 +25,8 @@
 , buildPackages
 }:

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -148,7 +144,11 @@ stdenv.mkDerivation ({

  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl);
+    ++ (optional (perl != null) perl)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
+    ;

  # For building runtime libs
  depsBuildTarget =
@ -162,13 +162,10 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -192,7 +189,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl

      enableLTO
      enableMultilib
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -14,7 +14,6 @@
 , texinfo ? null
 , perl ? null # optional, for texi2pod (then pod2man)
 , gmp, mpfr, libmpc, gettext, which, patchelf
-, libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
 , gnatboot ? null
@ -34,11 +33,8 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.

-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
 # Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
+assert stdenv.buildPlatform.isDarwin -> gnused != null;

 # The go frontend is written in c++
 assert langGo -> langCC;
@ -161,6 +157,9 @@ stdenv.mkDerivation ({
  nativeBuildInputs = [ texinfo which gettext ]
    ++ (optional (perl != null) perl)
    ++ (optional langAda gnatboot)
+    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+    ++ (optional buildPlatform.isDarwin gnused)
    ;

  # For building runtime libs
@ -175,13 +174,10 @@ stdenv.mkDerivation ({
    ++ optional targetPlatform.isLinux patchelf;

  buildInputs = [
-    gmp mpfr libmpc libelf
+    gmp mpfr libmpc
    targetPackages.stdenv.cc.bintools # For linking code at run-time
  ] ++ (optional (isl != null) isl)
    ++ (optional (zlib != null) zlib)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
    ;

  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@ -205,7 +201,7 @@ stdenv.mkDerivation ({
      crossStageStatic libcCross
      version

-      gmp mpfr libmpc libelf isl
+      gmp mpfr libmpc isl

      enableLTO
      enableMultilib
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@ -4,7 +4,7 @@
 , crossStageStatic, libcCross
 , version

-, gmp, mpfr, libmpc, libelf, isl
+, gmp, mpfr, libmpc, isl
 , cloog ? null

 , enableLTO
@ -110,7 +110,6 @@ let
      "--with-mpfr-lib=${mpfr.out}/lib"
      "--with-mpc=${libmpc}"
    ]
-    ++ lib.optional (libelf != null) "--with-libelf=${libelf}"
    ++ lib.optionals (!crossStageStatic) [
      (if libcCross == null
       then "--with-native-system-header-dir=${lib.getDev stdenv.cc.libc}/include"
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "glslang";
-  version = "1.3.216.0";
+  version = "1.3.224.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "glslang";
    rev = "sdk-${version}";
-    hash = "sha256-sjidkiPtRADhyOEKDb2cHCBXnFjLwk2F5Lppv5/fwNQ=";
+    hash = "sha256-+NKp/4e3iruAcTunpxksvCHxoVYmPd0kFI8JDJJUVg4=";
  };

  # These get set at all-packages, keep onto them for child drvs
--- a/pkgs/development/compilers/hip/default.nix
+++ b/pkgs/development/compilers/hip/default.nix
@ -21,6 +21,7 @@
 , rocm-runtime
 , rocm-thunk
 , rocminfo
+, substituteAll
 , writeScript
 , writeText
 }:
@ -37,6 +38,14 @@ let
      hash = "sha256-QaN666Rku2Tkio2Gm5/3RD8D5JgmCZLe0Yun1fGxa8U=";
    };

+    patches = [
+      (substituteAll {
+        src = ./hip-config-paths.patch;
+        inherit llvm;
+        rocm_runtime = rocm-runtime;
+      })
+    ];
+
    # - fix bash paths
    # - fix path to rocm_agent_enumerator
    # - fix hcc path
@ -121,6 +130,14 @@ stdenv.mkDerivation rec {
    rocminfo
  ];

+  patches = [
+    (substituteAll {
+      src = ./hipamd-config-paths.patch;
+      inherit llvm hip;
+      rocm_runtime = rocm-runtime;
+    })
+  ];
+
  preConfigure = ''
    export HIP_CLANG_PATH=${clang}/bin
    export DEVICE_LIB_PATH=${rocm-device-libs}/lib
--- a/pkgs/development/compilers/hip/hip-config-paths.patch
+++ b/pkgs/development/compilers/hip/hip-config-paths.patch
@ -0,0 +1,36 @@
+diff --git a/hip-lang-config.cmake.in b/hip-lang-config.cmake.in
+index 1a72643a..7f35031f 100644
+--- a/hip-lang-config.cmake.in
+++ b/hip-lang-config.cmake.in
+@@ -72,8 +72,8 @@ get_filename_component(_IMPORT_PREFIX "${_DIR}/../../../" REALPATH)
+ 
+ 
+ #need _IMPORT_PREFIX to be set #FILE_REORG_BACKWARD_COMPATIBILITY
+-file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS "${_IMPORT_PREFIX}/../llvm/lib/clang/*/include")
+-file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG "${_IMPORT_PREFIX}/llvm/lib/clang/*/include")
+file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS "@llvm@/lib/clang/*/include")
+file(GLOB HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG "@llvm@/lib/clang/*/include")
+ find_path(HIP_CLANG_INCLUDE_PATH __clang_cuda_math.h
+     HINTS ${HIP_CLANG_INCLUDE_SEARCH_PATHS}
+           ${HIP_CLANG_INCLUDE_SEARCH_PATHS_REORG}
+@@ -88,10 +88,7 @@ endif()
+ #if HSA is not under ROCm then provide CMAKE_PREFIX_PATH=<HSA_PATH>
+ find_path(HSA_HEADER hsa/hsa.h
+   PATHS
+-    "${_IMPORT_PREFIX}/../include" #FILE_REORG_BACKWARD_COMPATIBILITY
+-    "${_IMPORT_PREFIX}/include"
+-    "${ROCM_PATH}/include"
+-    /opt/rocm/include
+    "@rocm_runtime@/include"
+ )
+ 
+ if (HSA_HEADER-NOTFOUND)
+@@ -99,7 +96,7 @@ if (HSA_HEADER-NOTFOUND)
+ endif()
+ 
+ get_filename_component(HIP_COMPILER_INSTALL_PATH ${CMAKE_HIP_COMPILER} DIRECTORY)
+-file(GLOB HIP_CLANGRT_LIB_SEARCH_PATHS "${HIP_COMPILER_INSTALL_PATH}/../lib/clang/*/lib/*")
+file(GLOB HIP_CLANGRT_LIB_SEARCH_PATHS "@llvm@/lib/clang/*/lib/*")
+ find_library(CLANGRT_BUILTINS
+     NAMES
+       clang_rt.builtins
--- a/pkgs/development/compilers/hip/hipamd-config-paths.patch
+++ b/pkgs/development/compilers/hip/hipamd-config-paths.patch
@ -0,0 +1,47 @@
+diff --git a/hip-config.cmake.in b/hip-config.cmake.in
+index 89d1224e..120b68c6 100755
+--- a/hip-config.cmake.in
+++ b/hip-config.cmake.in
+@@ -142,7 +142,7 @@ if(HIP_COMPILER STREQUAL "clang")
+       file(TO_CMAKE_PATH "${HIP_PATH}/../lc" HIP_CLANG_ROOT)
+     endif()
+   else()
+-    set(HIP_CLANG_ROOT "${ROCM_PATH}/llvm")
+    set(HIP_CLANG_ROOT "@llvm@")
+   endif()
+   if(NOT HIP_CXX_COMPILER)
+     set(HIP_CXX_COMPILER ${CMAKE_CXX_COMPILER})
+@@ -206,10 +206,7 @@ if(NOT WIN32)
+   #if HSA is not under ROCm then provide CMAKE_PREFIX_PATH=<HSA_PATH>
+   find_path(HSA_HEADER hsa/hsa.h
+     PATHS
+-      "${_IMPORT_PREFIX}/include"
+-      #FILE_REORG_BACKWARD_COMPATIBILITY ${_IMPORT_PREFIX}/../include is for Backward compatibility
+-      "${_IMPORT_PREFIX}/../include"
+-      ${ROCM_PATH}/include
+      "@rocm_runtime@/include"
+   )
+
+   if (NOT HSA_HEADER)
+@@ -224,8 +221,8 @@ set_target_properties(hip::host PROPERTIES
+
+ if(HIP_RUNTIME MATCHES "rocclr")
+   set_target_properties(hip::amdhip64 PROPERTIES
+-    INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include;${HSA_HEADER}"
+-    INTERFACE_SYSTEM_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include;${HSA_HEADER}"
+    INTERFACE_INCLUDE_DIRECTORIES "@hip@/include;${HSA_HEADER}"
+    INTERFACE_SYSTEM_INCLUDE_DIRECTORIES "@hip@/include;${HSA_HEADER}"
+   )
+
+   get_target_property(amdhip64_type hip::amdhip64 TYPE)
+@@ -233,8 +230,8 @@ if(HIP_RUNTIME MATCHES "rocclr")
+
+   if(NOT WIN32)
+     set_target_properties(hip::device PROPERTIES
+-      INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
+-      INTERFACE_SYSTEM_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
+      INTERFACE_INCLUDE_DIRECTORIES "@hip@/include"
+      INTERFACE_SYSTEM_INCLUDE_DIRECTORIES "@hip@/include"
+     )
+   endif()
+ endif()
--- a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
@ -40,28 +40,20 @@ stdenv.mkDerivation {
    "-DLIBCXXABI_ENABLE_SHARED=OFF"
  ];

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 ../include/cxxabi.h $out/include
-    '' + lib.optionalString enableShared ''
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
@ -44,28 +44,20 @@ stdenv.mkDerivation {
    "-DLIBCXXABI_ENABLE_SHARED=OFF"
  ];

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        ${stdenv.cc.targetPrefix}install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 ../include/cxxabi.h $out/include
-    '' + lib.optionalString enableShared ''
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@ -42,28 +42,20 @@ stdenv.mkDerivation {
    "-DLIBCXXABI_ENABLE_SHARED=OFF"
  ];

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        ${stdenv.cc.targetPrefix}install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 ../include/cxxabi.h $out/include
-    '' + lib.optionalString enableShared ''
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
@ -39,28 +39,20 @@ stdenv.mkDerivation rec {
    "-DLIBCXXABI_ENABLE_SHARED=OFF"
  ];

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 ../include/cxxabi.h $out/include
-    '' + lib.optionalString enableShared ''
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
@ -25,27 +25,20 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ cmake ];
  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
-      install -m 644 ../include/cxxabi.h $out/include
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
@ -25,27 +25,20 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ cmake ];
  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
-      install -m 644 ../include/cxxabi.h $out/include
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
@ -44,27 +44,20 @@ stdenv.mkDerivation {
    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
  ] ++ lib.optional (!enableShared) "-DLIBCXXABI_ENABLE_SHARED=OFF";

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      ${lib.optionalString enableShared "install -m 644 lib/libc++abi.so.1.0 $out/lib"}
-      install -m 644 ../include/cxxabi.h $out/include
-      ${lib.optionalString enableShared "ln -s libc++abi.so.1.0 $out/lib/libc++abi.so"}
-      ${lib.optionalString enableShared "ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1"}
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
@ -40,28 +40,20 @@ stdenv.mkDerivation {
    "-DLIBCXXABI_ENABLE_SHARED=OFF"
  ];

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 ../include/cxxabi.h $out/include
-    '' + lib.optionalString enableShared ''
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
@ -40,28 +40,20 @@ stdenv.mkDerivation {
    "-DLIBCXXABI_ENABLE_SHARED=OFF"
  ];

-  installPhase = if stdenv.isDarwin
-    then ''
-      for file in lib/*.dylib; do
-        # this should be done in CMake, but having trouble figuring out
-        # the magic combination of necessary CMake variables
-        # if you fancy a try, take a look at
-        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
-      done
-      make install
-      install -d 755 $out/include
-      install -m 644 ../include/*.h $out/include
-    ''
-    else ''
-      install -d -m 755 $out/include $out/lib
-      install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 ../include/cxxabi.h $out/include
-    '' + lib.optionalString enableShared ''
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
-    '';
+  preInstall = lib.optionalString stdenv.isDarwin ''
+    for file in lib/*.dylib; do
+      # this should be done in CMake, but having trouble figuring out
+      # the magic combination of necessary CMake variables
+      # if you fancy a try, take a look at
+      # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+      install_name_tool -id $out/$file $file
+    done
+  '';
+
+  postInstall = ''
+    mkdir -p "$dev/include"
+    install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
+  '';

  meta = llvm_meta // {
    homepage = "https://libcxxabi.llvm.org/";
--- a/pkgs/development/compilers/mrustc/bootstrap.nix
+++ b/pkgs/development/compilers/mrustc/bootstrap.nix
@ -71,7 +71,8 @@ stdenv.mkDerivation rec {
    # for rustc
    llvm_7 libffi zlib libxml2
    # for cargo
-    openssl curl
+    openssl
+    (curl.override { inherit openssl; })
  ];

  makeFlags = [
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -2376,6 +2376,9 @@ self: super: {
    '';
  }) super.linear-base;

+  # https://github.com/peti/hopenssl/issues/5
+  hopenssl = super.hopenssl.override { openssl = pkgs.openssl_1_1; };
+
  # Fixes compilation with GHC 9.0 and above
  # https://hub.darcs.net/shelarcy/regex-compat-tdfa/issue/3
  regex-compat-tdfa = appendPatches [
--- a/pkgs/development/interpreters/joker/default.nix
+++ b/pkgs/development/interpreters/joker/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "joker";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "candid82";
    repo = "joker";
-    sha256 = "sha256-SlkhxALJwrZ/DOuBbqjb+wHEfT5mhd3lSD6E0geFP4Y=";
+    sha256 = "sha256-yetHt8zrIEenb1Z5L3oUmgVGxWaYOu4Nk4pbJD6K3zA=";
  };

  vendorSha256 = "sha256-AYoespfzFLP/jIIxbw5K653wc7sSfLY8K7di8GZ64wA=";
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@ -39,6 +39,9 @@ let
      [
        # Do not look in /usr etc. for dependencies.
        ./no-sys-dirs-5.31.patch
+
+        # Enable TLS/SSL verification in HTTP::Tiny by default
+        ./http-tiny-verify-ssl-by-default.patch
      ]
      ++ optional stdenv.isSunOS ./ld-shared.patch
      ++ optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
--- a/pkgs/development/interpreters/perl/http-tiny-verify-ssl-by-default.patch
+++ b/pkgs/development/interpreters/perl/http-tiny-verify-ssl-by-default.patch
@ -0,0 +1,79 @@
+Patch for HTTP::Tiny that defaults verify_SSL to 1
+
+Based on proposed Debian patch by Dominic Hargreaves:
+https://salsa.debian.org/perl-team/interpreter/perl/-/commit/1490431e40e22052f75a0b3449f1f53cbd27ba92
+
+
+diff --git a/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm b/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm
+index 5803e4599..88ba51461 100644
+--- a/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm
+++ b/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm
+@@ -40,7 +40,7 @@ sub _croak { require Carp; Carp::croak(@_) }
+ #pod * C<timeout> — Request timeout in seconds (default is 60) If a socket open,
+ #pod   read or write takes longer than the timeout, an exception is thrown.
+ #pod * C<verify_SSL> — A boolean that indicates whether to validate the SSL
+-#pod   certificate of an C<https> — connection (default is false)
+#pod   certificate of an C<https> — connection (default is true)
+ #pod * C<SSL_options> — A hashref of C<SSL_*> — options to pass through to
+ #pod   L<IO::Socket::SSL>
+ #pod
+@@ -112,7 +112,7 @@ sub new {
+         max_redirect => 5,
+         timeout      => defined $args{timeout} ? $args{timeout} : 60,
+         keep_alive   => 1,
+-        verify_SSL   => $args{verify_SSL} || $args{verify_ssl} || 0, # no verification by default
+        verify_SSL   => $args{verify_SSL} // $args{verify_ssl} // 1, # verification by default
+         no_proxy     => $ENV{no_proxy},
+     };
+ 
+@@ -1038,7 +1038,7 @@ sub new {
+         timeout          => 60,
+         max_line_size    => 16384,
+         max_header_lines => 64,
+-        verify_SSL       => 0,
+        verify_SSL       => 1,
+         SSL_options      => {},
+         %args
+     }, $class;
+@@ -1765,7 +1765,7 @@ C<timeout> — Request timeout in seconds (default is 60) If a socket open, read
+ 
+ =item *
+ 
+-C<verify_SSL> — A boolean that indicates whether to validate the SSL certificate of an C<https> — connection (default is false)
+C<verify_SSL> — A boolean that indicates whether to validate the SSL certificate of an C<https> — connection (default is true)
+ 
+ =item *
+ 
+@@ -2035,7 +2035,7 @@ Verification of server identity
+ 
+ =back
+ 
+-B<By default, HTTP::Tiny does not verify server identity>.
+B<By default, HTTP::Tiny in NixOS verifies server identity>.
+ 
+ Server identity verification is controversial and potentially tricky because it
+ depends on a (usually paid) third-party Certificate Authority (CA) trust model
+@@ -2043,16 +2043,14 @@ to validate a certificate as legitimate.  This discriminates against servers
+ with self-signed certificates or certificates signed by free, community-driven
+ CA's such as L<CAcert.org|http://cacert.org>.
+ 
+-By default, HTTP::Tiny does not make any assumptions about your trust model,
+-threat level or risk tolerance.  It just aims to give you an encrypted channel
+-when you need one.
+-
+ Setting the C<verify_SSL> attribute to a true value will make HTTP::Tiny verify
+ that an SSL connection has a valid SSL certificate corresponding to the host
+ name of the connection and that the SSL certificate has been verified by a CA.
+ Assuming you trust the CA, this will protect against a L<man-in-the-middle
+-attack|http://en.wikipedia.org/wiki/Man-in-the-middle_attack>.  If you are
+-concerned about security, you should enable this option.
+attack|http://en.wikipedia.org/wiki/Man-in-the-middle_attack>.
+
+If you are not concerned about security, and this default in NixOS causes
+problems, you should disable this option.
+ 
+ Certificate verification requires a file containing trusted CA certificates.
+ 
+-- 
+
+
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.0.22";
-    hash = "sha256-40KRjT7NQi8QAy3wrD/7Dhf1aPrWz44jK296ah/cPJw=";
+    version = "8.0.23";
+    hash = "sha256-FBLbRoAKRc7Td8KJLsYmGzxBLxPcEzv8mYz7LxR7QM8=";
  });

 in
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.1.9";
-    hash = "sha256-nrsOLlcdtv1ZMEKNyy0Z7T4FAzjsHxNHwoLK6S/Ahv8=";
+    version = "8.1.10";
+    hash = "sha256-LejgQCKF98Voh97+ZRkiMIre1YumC+/PO3dyAgnjHxA=";
  });

 in
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -7,6 +7,7 @@
 , mailcap, mimetypesSupport ? true
 , ncurses
 , openssl
+, openssl_1_1
 , readline
 , sqlite
 , tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
@ -75,6 +76,10 @@ assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
 with lib;

 let
+  # cpython does support/build with openssl 3.0, but some libraries using the ssl module seem to have issues with it
+  # null check for Minimal
+  openssl' = if openssl != null then openssl_1_1 else null;
+
  buildPackages = pkgsBuildHost;
  inherit (passthru) pythonForBuild;

@ -115,7 +120,7 @@ let
  ];

  buildInputs = filter (p: p != null) ([
-    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl ]
+    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl' ]
    ++ optionals x11Support [ tcl tk libX11 xorgproto ]
    ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
    ++ optionals stdenv.isDarwin [ configd ])
@ -321,8 +326,8 @@ in with passthru; stdenv.mkDerivation {
    "--with-threads"
  ] ++ optionals (sqlite != null && isPy3k) [
    "--enable-loadable-sqlite-extensions"
-  ] ++ optionals (openssl != null) [
-    "--with-openssl=${openssl.dev}"
+  ] ++ optionals (openssl' != null) [
+    "--with-openssl=${openssl'.dev}"
  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    "ac_cv_buggy_getaddrinfo=no"
    # Assume little-endian IEEE 754 floating point when cross compiling
@ -484,7 +489,7 @@ in with passthru; stdenv.mkDerivation {
  # Enforce that we don't have references to the OpenSSL -dev package, which we
  # explicitly specify in our configure flags above.
  disallowedReferences =
-    lib.optionals (openssl != null && !static) [ openssl.dev ]
+    lib.optionals (openssl' != null && !static) [ openssl'.dev ]
    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    # Ensure we don't have references to build-time packages.
    # These typically end up in shebangs.
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -1,9 +1,10 @@
 { stdenv, buildPackages, lib
 , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
-, zlib, openssl, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
+, zlib, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
 , buildEnv, bundler, bundix
 , makeWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
+, openssl, openssl_1_1
 } @ args:

 let
@ -26,7 +27,7 @@ let
      , useRailsExpress ? true
      , rubygemsSupport ? true
      , zlib, zlibSupport ? true
-      , openssl, opensslSupport ? true
+      , openssl, openssl_1_1, opensslSupport ? true
      , gdbm, gdbmSupport ? true
      , ncurses, readline, cursesSupport ? true
      , groff, docSupport ? true
@ -75,7 +76,8 @@ let
          ++ (op fiddleSupport libffi)
          ++ (ops cursesSupport [ ncurses readline ])
          ++ (op zlibSupport zlib)
-          ++ (op opensslSupport openssl)
+          ++ (op (lib.versionOlder ver.majMin "3.0" && opensslSupport) openssl_1_1)
+          ++ (op (atLeast30 && opensslSupport) openssl_1_1)
          ++ (op gdbmSupport gdbm)
          ++ (op yamlSupport libyaml)
          # Looks like ruby fails to build on darwin without readline even if curses
--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "SDL2_ttf";
-  version = "2.0.18";
+  version = "2.20.1";

  src = fetchurl {
    url = "https://www.libsdl.org/projects/SDL_ttf/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-cjTriINRTgGed0fHA+SndFdbGNQ1wipKKdBoy3aKIlE=";
+    sha256 = "sha256-eM2tUfPMOtppMrG7bpFLM3mKuXCh6Bd2PyLdv9l9DFc=";
  };

  configureFlags = lib.optional stdenv.isDarwin "--disable-sdltest";
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@ -99,6 +99,11 @@ stdenv.mkDerivation rec {
  ] ++ lib.optional (apis != ["*"])
    "-DBUILD_ONLY=${lib.concatStringsSep ";" apis}";

+  NIX_CFLAGS_COMPILE = [
+    # openssl 3 generates several deprecation warnings
+    "-Wno-error=deprecated-declarations"
+  ];
+
  # aws-cpp-sdk-core-tests/aws/client/AWSClientTest.cpp
  # seem to have a datarace
  enableParallelChecking = false;
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
    abseil-cpp
    c-ares
    crc32c
-    curl
+    (curl.override { inherit openssl; })
    grpc
    nlohmann_json
    openssl
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@ -110,8 +110,13 @@ stdenv.mkDerivation rec {
    ++ lib.optional stdenv.hostPlatform.is32bit "-D_FILE_OFFSET_BITS=64"
  );

+  # prevent tests from being run during the buildPhase
+  makeFlags = [ "tests=" ];
+
  doCheck = true;

+  checkFlags = [ "-C" "tests" ];
+
  passthru.tests = {
    python = python3.pkgs.gpgme;
    qt = libsForQt5.qgpgme;
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@ -1,14 +1,16 @@
 { lib, stdenv, fetchurl
 # Image file formats
-, libjpeg, libtiff, giflib, libpng, libwebp
+, libjpeg, libtiff, giflib, libpng, libwebp, libjxl
+, libspectre
 # imlib2 can load images from ID3 tags.
 , libid3tag, librsvg, libheif
 , freetype , bzip2, pkg-config
 , x11Support ? true, xlibsWrapper ? null
-# Compilation error on Darwin with librsvg. For more information see:
-# https://github.com/NixOS/nixpkgs/pull/166452#issuecomment-1090725613
-, svgSupport ? !stdenv.isDarwin
-, heifSupport ? !stdenv.isDarwin
+, svgSupport ? false
+, heifSupport ? false
+, webpSupport ? false
+, jxlSupport ? false
+, psSupport ? false

 # for passthru.tests
 , libcaca
@ -33,11 +35,14 @@ stdenv.mkDerivation rec {
  };

  buildInputs = [
-    libjpeg libtiff giflib libpng libwebp
+    libjpeg libtiff giflib libpng
    bzip2 freetype libid3tag
  ] ++ optional x11Support xlibsWrapper
    ++ optional heifSupport libheif
-    ++ optional svgSupport librsvg;
+    ++ optional svgSupport librsvg
+    ++ optional webpSupport libwebp
+    ++ optional jxlSupport libjxl
+    ++ optional psSupport libspectre;

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/development/libraries/jemalloc/default.nix
+++ b/pkgs/development/libraries/jemalloc/default.nix
@ -30,6 +30,9 @@ stdenv.mkDerivation rec {
      "--disable-thp"
      "je_cv_thp=no"
    ]
+    # AArch64 has configurable page size up to 64k. The default configuration
+    # for jemalloc only supports 4k page sizes.
+    ++ lib.optional stdenv.isAarch64 "--with-lg-page=16"
  ;

  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-error=array-bounds";
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@ -4,6 +4,7 @@
 , glib
 , meson
 , ninja
+, nixosTests
 , pkg-config
 , gettext
 , gobject-introspection
@ -17,13 +18,18 @@ stdenv.mkDerivation rec {
  pname = "json-glib";
  version = "1.6.6";

-  outputs = [ "out" "dev" "devdoc" ];
+  outputs = [ "out" "dev" "devdoc" "installedTests" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
    sha256 = "luyYvnqR9t3jNjZyDj2i/27LuQ52zKpJSX8xpoVaSQ4=";
  };

+  patches = [
+    # Add option for changing installation path of installed tests.
+    ./meson-add-installed-tests-prefix-option.patch
+  ];
+
  strictDeps = true;

  depsBuildBuild = [
@ -49,6 +55,9 @@ stdenv.mkDerivation rec {
    glib
  ];

+  mesonFlags = [
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+  ];

  # Run-time dependency gi-docgen found: NO (tried pkgconfig and cmake)
  # it should be a build-time dep for build
@ -73,6 +82,10 @@ stdenv.mkDerivation rec {
  '';

  passthru = {
+    tests = {
+      installedTests = nixosTests.installed-tests.json-glib;
+    };
+
    updateScript = gnome.updateScript {
      packageName = pname;
      versionPolicy = "odd-unstable";
--- a/pkgs/development/libraries/json-glib/meson-add-installed-tests-prefix-option.patch
+++ b/pkgs/development/libraries/json-glib/meson-add-installed-tests-prefix-option.patch
@ -0,0 +1,27 @@
+diff --git a/json-glib/tests/meson.build b/json-glib/tests/meson.build
+index 1eb56c8..dca444e 100644
+--- a/json-glib/tests/meson.build
+++ b/json-glib/tests/meson.build
+@@ -21,8 +21,9 @@ test_data = [
+   'stream-load.json',
+ ]
+ 
+-installed_test_bindir = join_paths(json_libexecdir, 'installed-tests', json_api_name)
+-installed_test_datadir = join_paths(json_datadir, 'installed-tests', json_api_name)
+installed_test_prefix = get_option('installed_test_prefix')
+installed_test_bindir = join_paths(installed_test_prefix, 'libexec', 'installed-tests', json_api_name)
+installed_test_datadir = join_paths(installed_test_prefix, 'share', 'installed-tests', json_api_name)
+ 
+ install_data(test_data, install_dir: installed_test_bindir)
+ 
+diff --git a/meson_options.txt b/meson_options.txt
+index 068a03f..03f398a 100644
+--- a/meson_options.txt
+++ b/meson_options.txt
+@@ -10,3 +10,6 @@ option('man',
+ option('tests',
+        type: 'boolean', value: true,
+        description: 'Build the tests')
+option('installed_test_prefix',
+       description: 'Prefix for installed tests',
+       type: 'string')
--- a/pkgs/development/libraries/libewf/default.nix
+++ b/pkgs/development/libraries/libewf/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, zlib, openssl, libuuid, pkg-config, bzip2 }:
+{ fetchurl, fetchpatch, lib, stdenv, zlib, openssl, libuuid, pkg-config, bzip2 }:

 stdenv.mkDerivation rec {
  version = "20201230";
@ -6,9 +6,17 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/libyal/libewf/releases/download/${version}/libewf-experimental-${version}.tar.gz";
-    sha256 = "sha256-10r4jPzsA30nHQzjdg/VkwTG1PwOskwv8Bra34ZPMgc=";
+    hash = "sha256-10r4jPzsA30nHQzjdg/VkwTG1PwOskwv8Bra34ZPMgc=";
  };

+  patches = [
+    # fix build with OpenSSL 3.0
+    (fetchpatch {
+      url = "https://github.com/libyal/libewf/commit/033ea5b4e5f8f1248f74a2ec61fc1be183c6c46b.patch";
+      hash = "sha256-R4+NO/91kiZP48SJyVF9oYjKCg1h/9Kh8/0VOEmJXPQ=";
+    })
+  ];
+
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ zlib openssl libuuid ]
    ++ lib.optionals stdenv.isDarwin [ bzip2 ];
--- a/pkgs/development/libraries/libglibutil/default.nix
+++ b/pkgs/development/libraries/libglibutil/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libglibutil";
-  version = "1.0.66";
+  version = "1.0.67";

  src = fetchFromGitHub {
    owner = "sailfishos";
    repo = pname;
    rev = version;
-    sha256 = "sha256-CYZDlmnHOCT0HC7sG0dN7zWkhcSRzX6XXPrEFmFEye8=";
+    sha256 = "sha256-SXyMmkyC1RZLIYhrG2TDcH/PDCHfrJOVZOX1PC3EDLg=";
  };

  outputs = [ "out" "dev" ];
--- a/Show more
+++ b/Show more