Merge #144730: branch 'staging-next'

2021-11-15 11:52:15 +01:00 · 2021-11-15 11:52:15 +01:00 · 64065d76f4
parent 49b08e4919 093d806878
commit 64065d76f4
250 changed files with 1951 additions and 1927 deletions
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -186,6 +186,33 @@ added. To find the correct hash, you can first use `lib.fakeSha256` or
 `lib.fakeHash` as a stub hash. Building the package (and thus the
 vendored dependencies) will then inform you of the correct hash.

+### Cargo features {#cargo-features}
+
+You can disable default features using `buildNoDefaultFeatures`, and
+extra features can be added with `buildFeatures`.
+
+If you want to use different features for check phase, you can use
+`checkNoDefaultFeatures` and `checkFeatures`. They are only passed to
+`cargo test` and not `cargo build`. If left unset, they default to
+`buildNoDefaultFeatures` and `buildFeatures`.
+
+For example:
+
+```nix
+rustPlatform.buildRustPackage rec {
+  pname = "myproject";
+  version = "1.0.0";
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "color" "net" ];
+
+  # disable network features in tests
+  checkFeatures = [ "color" ];
+
+  # ...
+}
+```
+
 ### Cross compilation {#cross-compilation}

 By default, Rust packages are compiled for the host platform, just like any
@ -261,7 +288,7 @@ rustPlatform.buildRustPackage {
 Please note that the code will be compiled twice here: once in `release` mode
 for the `buildPhase`, and again in `debug` mode for the `checkPhase`.

-Test flags, e.g., `--features xxx/yyy`, can be passed to `cargo test` via the
+Test flags, e.g., `--package foo`, can be passed to `cargo test` via the
 `cargoTestFlags` attribute.

 Another attribute, called `checkFlags`, is used to pass arguments to the test
@ -421,18 +448,20 @@ you of the correct hash.
 * `cargoBuildHook`: use Cargo to build a crate. If the crate to be
  built is a crate in e.g. a Cargo workspace, the relative path to the
  crate to build can be set through the optional `buildAndTestSubdir`
-  environment variable. Additional Cargo build flags can be passed
-  through `cargoBuildFlags`.
+  environment variable. Features can be specified with
+  `cargoBuildNoDefaultFeatures` and `cargoBuildFeatures`. Additional
+  Cargo build flags can be passed through `cargoBuildFlags`.
 * `maturinBuildHook`: use [Maturin](https://github.com/PyO3/maturin)
  to build a Python wheel. Similar to `cargoBuildHook`, the optional
  variable `buildAndTestSubdir` can be used to build a crate in a
  Cargo workspace. Additional Maturin flags can be passed through
  `maturinBuildFlags`.
 * `cargoCheckHook`: run tests using Cargo. The build type for checks
-  can be set using `cargoCheckType`. Additional flags can be passed to
-  the tests using `checkFlags` and `checkFlagsArray`. By default,
-  tests are run in parallel. This can be disabled by setting
-  `dontUseCargoParallelTests`.
+  can be set using `cargoCheckType`. Features can be specified with
+  `cargoCheckNoDefaultFeaatures` and `cargoCheckFeatures`. Additional
+  flags can be passed to the tests using `checkFlags` and
+  `checkFlagsArray`. By default, tests are run in parallel. This can
+  be disabled by setting `dontUseCargoParallelTests`.
 * `cargoInstallHook`: install binaries and static/shared libraries
  that were built using `cargoBuildHook`.

--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -1315,6 +1315,14 @@ Superuser created successfully.
          will no longer work and must be updated.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>fluidsynth_1</literal> attribute has been
+          removed, as this legacy version is no longer needed in
+          nixpkgs. The actively maintained 2.x series is available as
+          <literal>fluidsynth</literal> unchanged.
+        </para>
+      </listitem>
      <listitem>
        <para>
          Nextcloud 20 (<literal>pkgs.nextcloud20</literal>) has been
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -393,6 +393,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `services.mosquitto` module has been rewritten to support multiple listeners and per-listener configuration.
  Module configurations from previous releases will no longer work and must be updated.

+- The `fluidsynth_1` attribute has been removed, as this legacy version is no longer needed in nixpkgs. The actively maintained 2.x series is available as `fluidsynth` unchanged.
+
 - Nextcloud 20 (`pkgs.nextcloud20`) has been dropped because it was EOLed by upstream in 2021-10.

 - The `virtualisation.pathsInNixDB` option was renamed
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -197,6 +197,46 @@ let
        '';
      };

+      ttyAudit = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable or disable TTY auditing for specified users
+          '';
+        };
+
+        enablePattern = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            For each user matching one of comma-separated
+            glob patterns, enable TTY auditing
+          '';
+        };
+
+        disablePattern = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            For each user matching one of comma-separated
+            glob patterns, disable TTY auditing
+          '';
+        };
+
+        openOnly = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Set the TTY audit flag when opening the session,
+            but do not restore it when closing the session.
+            Using this option is necessary for some services
+            that don't fork() to run the authenticated session,
+            such as sudo.
+          '';
+        };
+      };
+
      forwardXAuth = mkOption {
        default = false;
        type = types.bool;
@ -482,6 +522,12 @@ let
              "session ${
                if config.boot.isContainer then "optional" else "required"
              } pam_loginuid.so"}
+          ${optionalString cfg.ttyAudit.enable
+              "session required ${pkgs.pam}/lib/security/pam_tty_audit.so
+                open_only=${toString cfg.ttyAudit.openOnly}
+                ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"}
+                ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"}
+              "}
          ${optionalString cfg.makeHomeDir
              "session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0077"}
          ${optionalString cfg.updateWtmp
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -219,6 +219,7 @@ in
  kerberos = handleTest ./kerberos/default.nix {};
  kernel-generic = handleTest ./kernel-generic.nix {};
  kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {};
+  kexec = handleTest ./kexec.nix {};
  keycloak = discoverTests (import ./keycloak.nix);
  keymap = handleTest ./keymap.nix {};
  knot = handleTest ./knot.nix {};
--- a/nixos/tests/kexec.nix
+++ b/nixos/tests/kexec.nix
@ -4,12 +4,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
  name = "kexec";
  meta = with lib.maintainers; {
    maintainers = [ eelco ];
-    # Currently hangs forever; last output is:
-    #     machine # [   10.239914] dhcpcd[707]: eth0: adding default route via fe80::2
-    #     machine: waiting for the VM to finish booting
-    #     machine # Cannot find the ESP partition mount point.
-    #     machine # [   28.681197] nscd[692]: 692 checking for monitored file `/etc/netgroup': No such file or directory
-    broken = true;
  };

  machine = { ... }:
@ -18,8 +12,11 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
  testScript =
    ''
      machine.wait_for_unit("multi-user.target")
+      machine.succeed('kexec --load /run/current-system/kernel --initrd /run/current-system/initrd --command-line "$(</proc/cmdline)"')
      machine.execute("systemctl kexec >&2 &", check_return=False)
      machine.connected = False
+      machine.connect()
      machine.wait_for_unit("multi-user.target")
+      machine.shutdown()
    '';
 })
--- a/pkgs/applications/audio/cdparanoia/default.nix
+++ b/pkgs/applications/audio/cdparanoia/default.nix
@ -35,6 +35,15 @@ stdenv.mkDerivation rec {
    cp ${gnu-config}/config.guess configure.guess
  '';

+  # Build system reuses the same object file names for shared and static
+  # library. Occasionally fails in the middle:
+  #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c
+  #    rm  -f *.o core *~ *.out
+  #    gcc -O2 -fsigned-char -g -O2 -fpic -c scan_devices.c
+  #    gcc -fpic -shared -o libcdda_interface.so.0.10.2 ... scan_devices.o ...
+  #    scan_devices.o: file not recognized: file format not recognized
+  enableParallelBuilding = false;
+
  meta = with lib; {
    homepage = "https://xiph.org/paranoia";
    description = "A tool and library for reading digital audio from CDs";
--- a/pkgs/applications/audio/espeak-ng/default.nix
+++ b/pkgs/applications/audio/espeak-ng/default.nix
@ -35,6 +35,12 @@ stdenv.mkDerivation rec {
    "--with-mbrola=${if mbrolaSupport then "yes" else "no"}"
  ];

+  # Current release lacks dependencies on local espeak-ng:
+  #  cd dictsource && ESPEAK_DATA_PATH=/build/espeak-ng LD_LIBRARY_PATH=../src: ../src/espeak-ng --compile=yue && cd ..
+  #  bash: line 1: ../src/espeak-ng: No such file or directory
+  # Should be fixed in next release: https://github.com/espeak-ng/espeak-ng/pull/1029
+  enableParallelBuilding = false;
+
  postInstall = lib.optionalString stdenv.isLinux ''
    patchelf --set-rpath "$(patchelf --print-rpath $out/bin/espeak-ng)" $out/bin/speak-ng
  '';
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@ -1,33 +1,17 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, cmake
 , alsa-lib, glib, libjack2, libsndfile, libpulseaudio
 , AudioUnit, CoreAudio, CoreMIDI, CoreServices
-, version ? "2"
 }:

-let
-  versionMap = {
-    "1" = {
-      fluidsynthVersion = "1.1.11";
-      sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
-    };
-    "2" = {
-      fluidsynthVersion = "2.2.3";
-      sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
-    };
-  };
-in
-
-with versionMap.${version};
-
-stdenv.mkDerivation  {
-  name = "fluidsynth-${fluidsynthVersion}";
-  version = fluidsynthVersion;
+stdenv.mkDerivation rec {
+  pname = "fluidsynth";
+  version = "2.2.3";

  src = fetchFromGitHub {
    owner = "FluidSynth";
    repo = "fluidsynth";
-    rev = "v${fluidsynthVersion}";
-    inherit sha256;
+    rev = "v${version}";
+    sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
  };

  nativeBuildInputs = [ pkg-config cmake ];
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@ -5,13 +5,6 @@
 , withMPRIS ? false, dbus ? null
 }:

-let
-  features = [ "cursive/pancurses-backend" ]
-    ++ lib.optional withALSA "alsa_backend"
-    ++ lib.optional withPulseAudio "pulseaudio_backend"
-    ++ lib.optional withPortAudio "portaudio_backend"
-    ++ lib.optional withMPRIS "mpris";
-in
 rustPlatform.buildRustPackage rec {
  pname = "ncspot";
  version = "0.9.0";
@ -25,8 +18,6 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "0sdbba32f56z2q7kha5fxw2f00hikbz9sf4zl4wfl2i9b13j7mj0";

-  cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
-
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ ncurses openssl ]
@ -36,6 +27,13 @@ rustPlatform.buildRustPackage rec {
    ++ lib.optional withPortAudio portaudio
    ++ lib.optional withMPRIS dbus;

+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "cursive/pancurses-backend" ]
+    ++ lib.optional withALSA "alsa_backend"
+    ++ lib.optional withPulseAudio "pulseaudio_backend"
+    ++ lib.optional withPortAudio "portaudio_backend"
+    ++ lib.optional withMPRIS "mpris";
+
  doCheck = false;

  meta = with lib; {
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@ -42,7 +42,7 @@ in python3.pkgs.buildPythonApplication rec {
    mutagen
    pycdio
    pygobject3
-    ruamel_yaml
+    ruamel-yaml
    discid
    pillow
  ];
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@ -26,6 +26,12 @@ in mkDerivation {
      url = "https://github.com/sddm/sddm/commit/e1dedeeab6de565e043f26ac16033e613c222ef9.patch";
      sha256 = "sha256-OPyrUI3bbH+PGDBfoL4Ohb4wIvmy9TeYZhE0JxR/D58=";
    })
+    # Fix build with Qt 5.15.3
+    # See: https://github.com/sddm/sddm/pull/1325
+    (fetchpatch {
+      url = "https://github.com/sddm/sddm/commit/e93bf95c54ad8c2a1604f8d7be05339164b19308.patch";
+      sha256 = "sha256:1rh6sdvzivjcl5b05fczarvxhgpjhi7019hvf2gadnwgwdg104r4";
+    })
  ];

  postPatch =
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@ -2,17 +2,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "helix";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "helix-editor";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-lScMHZ/pLcHkuvv8kSKnYK5AFVxyhOUMFdsu3nlDVD0=";
+    sha256 = "sha256-NoVg/8oJIgMQtxlCSjrLnYCG8shigYqZzWAQwmiqxgA=";
  };

-  cargoSha256 = "sha256-N5vlPoYyksHEZsyia8u8qtoEBY6qsXqO9CRBFaTQmiw=";
+  cargoSha256 = "sha256-kqPI8WpGpr0VL7CbBTSsjKl3xqJrv/6Qjr6UFnIgaVo=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.3337";
+  version = "8.2.3451";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "sha256-iwSGcLeqXH0bVIXEI5OnotG88Uv8ntycisD9EcHjz/c=";
+    sha256 = "sha256-8OaEaFyOaL59j0EZkUY+kuR6si79H2dN09f8SnltxbQ=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/graphics/epick/default.nix
+++ b/pkgs/applications/graphics/epick/default.nix
@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "epick";
-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "vv9k";
    repo = pname;
    rev = version;
-    sha256 = "0l7m45bqx62nrwi0r4pdwxcq37s7h3nnawk9nq2zpvl9wcgnx3gc";
+    sha256 = "sha256-x1C8kY9VpMg7aXgC/jRsLCeUV8uRLobgjSAQdK2/sHk=";
  };

-  cargoSha256 = "sha256-LERV3+zwt5oVfyueGfxM7HsOha4cuWTkPyvPQwHSZqo=";
+  cargoSha256 = "sha256-KgQOlvKRt47lg7NteqBa2DLKkDf93JTzp9EIHn3clxY=";

  nativeBuildInputs = lib.optional stdenv.isLinux python3;

--- a/pkgs/applications/graphics/menyoki/default.nix
+++ b/pkgs/applications/graphics/menyoki/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "menyoki";
-  version = "1.5.3";
+  version = "1.5.5";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "050c6c60il6cy0a8d3nw4z2cyp043912a7n4n44yjpmx047w7kc7";
+    sha256 = "sha256-wEPt96z/odQ05hosN+GB5KLsCu8onR9WWamofJayhwU=";
  };

-  cargoSha256 = "0wwcda2w8jg3q132cvhdgfmjc0rz93fx6fai93g5w8br98aq9qzx";
+  cargoSha256 = "sha256-nwxBreouL3Z47zHSH+Y/ej7KU2/bXyMQ+Tb7R4U+yKk=";

  nativeBuildInputs = [ installShellFiles ]
    ++ lib.optional stdenv.isLinux pkg-config;
@ -37,8 +37,8 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "Screen{shot,cast} and perform ImageOps on the command line";
    homepage = "https://menyoki.cli.rs/";
+    changelog = "https://github.com/orhun/menyoki/blob/v${version}/CHANGELOG.md";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ figsoda ];
-    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/applications/misc/khard/default.nix
+++ b/pkgs/applications/misc/khard/default.nix
@ -17,10 +17,9 @@ python3.pkgs.buildPythonApplication rec {
  propagatedBuildInputs = with python3.pkgs; [
    atomicwrites
    configobj
-    vobject
-    ruamel_yaml
-    ruamel_base
+    ruamel-yaml
    unidecode
+    vobject
  ];

  postInstall = ''
@ -32,6 +31,8 @@ python3.pkgs.buildPythonApplication rec {
    export COLUMNS=80
  '';

+  pythonImportsCheck = [ "khard" ];
+
  meta = {
    homepage = "https://github.com/scheibler/khard";
    description = "Console carddav client";
--- a/pkgs/applications/misc/robo3t/default.nix
+++ b/pkgs/applications/misc/robo3t/default.nix
@ -15,7 +15,7 @@
 }:

 let
-  curlWithGnuTls = curl.override { gnutlsSupport = true; sslSupport = false; };
+  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
 in

 stdenv.mkDerivation rec {
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -110,7 +110,10 @@ let
  # When LTO for Darwin is fixed, the following will need updating as lld
  # doesn't work on it. For now it is fine since ltoSupport implies no Darwin.
  buildStdenv = if ltoSupport
-                then overrideCC stdenv llvmPackages.clangUseLLVM
+                # LTO requires LLVM bintools including ld.lld and llvm-ar.
+                then overrideCC llvmPackages.stdenv (llvmPackages.stdenv.cc.override {
+                  inherit (llvmPackages) bintools;
+                })
                else stdenv;

  # --enable-release adds -ffunction-sections & LTO that require a big amount of
@ -131,6 +134,12 @@ buildStdenv.mkDerivation ({
  ] ++
  lib.optional (lib.versionAtLeast version "86") ./env_var_for_system_dir-ff86.patch ++
  lib.optional (lib.versionAtLeast version "90") ./no-buildconfig-ffx90.patch ++
+  # This fixes a race condition causing deadlock.
+  # https://phabricator.services.mozilla.com/D128657
+  lib.optional (lib.versionAtLeast version "94") (fetchpatch {
+    url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/9c7f25d45bb1dd6b1a865780bc249cdaa619aa83/trunk/0002-Bug-1735905-Upgrade-cubeb-pulse-to-fix-a-race-condit.patch";
+    sha256 = "l4bMK/YDXcDpIjPy9DPuUSFyDpzVQca201A4h9eav5g=";
+  }) ++
  patches;

  # Ignore trivial whitespace changes in patches, this fixes compatibility of
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -78,6 +78,8 @@ in (mkDrv rec {
    tar -xf ${srcs.translations}
  '';

+  patches = [ ./skip-failed-test-with-icu70.patch ];
+
  ### QT/KDE
  #
  # We have to resort to the ugly patching of configure.ac as it assumes that
--- a/pkgs/applications/office/libreoffice/skip-failed-test-with-icu70.patch
+++ b/pkgs/applications/office/libreoffice/skip-failed-test-with-icu70.patch
@ -0,0 +1,29 @@
+--- a/i18npool/qa/cppunit/test_breakiterator.cxx
+++ b/i18npool/qa/cppunit/test_breakiterator.cxx
+@@ -35,7 +35,7 @@ public:
+     void testWeak();
+     void testAsian();
+     void testThai();
+-#if (U_ICU_VERSION_MAJOR_NUM > 51)
+#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
+     void testLao();
+ #ifdef TODO
+     void testNorthernThai();
+@@ -52,7 +52,7 @@ public:
+     CPPUNIT_TEST(testWeak);
+     CPPUNIT_TEST(testAsian);
+     CPPUNIT_TEST(testThai);
+-#if (U_ICU_VERSION_MAJOR_NUM > 51)
+#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
+     CPPUNIT_TEST(testLao);
+ #ifdef TODO
+     CPPUNIT_TEST(testKhmer);
+@@ -843,7 +843,7 @@ void TestBreakIterator::testAsian()
+     }
+ }
+ 
+-#if (U_ICU_VERSION_MAJOR_NUM > 51)
+#if (U_ICU_VERSION_MAJOR_NUM > 51 && U_ICU_VERSION_MAJOR_NUM < 70)
+ //A test to ensure that our Lao word boundary detection is useful
+ void TestBreakIterator::testLao()
+ {
--- a/pkgs/applications/office/libreoffice/src-still/override.nix
+++ b/pkgs/applications/office/libreoffice/src-still/override.nix
@ -9,5 +9,5 @@ attrs:
    "--with-commons-logging-jar=${commonsLogging}/share/java/commons-logging-1.2.jar"
    "--without-system-qrcodegen"
  ];
-  patches = [ ../xdg-open-brief.patch ]; # drop this when switching to 7.2
+  patches = attrs.patches or [] ++ [ ../xdg-open-brief.patch ]; # drop this when switching to 7.2
 }
--- a/pkgs/applications/office/libreoffice/src-still/primary.nix
+++ b/pkgs/applications/office/libreoffice/src-still/primary.nix
@ -8,7 +8,7 @@ rec {

  major = "7";
  minor = "1";
-  patch = "6";
+  patch = "7";
  tweak = "2";

  subdir = "${major}.${minor}.${patch}";
@ -17,13 +17,13 @@ rec {

  src = fetchurl {
    url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1g1nlnmgxka1xj3800ra7j28y08k1irz7a24awx1gyjs9fci58qq";
+    sha256 = "T98ICdiAM4i9E6zis0V/Cmq5+e98mNb0bMZA//xelLo=";
  };

  # FIXME rename
  translations = fetchSrc {
    name = "translations";
-    sha256 = "0kblfwcnsc0pz96wxmkghmchjd31h0w1wjxlqxqbqqpz3vbr61k3";
+    sha256 = "g8skm02R5nRyF09ZbL9kJqMxRqaQ0AfpletDK3AAggk=";
  };

  # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@ -31,6 +31,6 @@ rec {

  help = fetchSrc {
    name = "help";
-    sha256 = "1b28xqgvfnx62zgnxfisi58r7nhixvz35pmq8cb20ayxhdfg6v31";
+    sha256 = "jAFrO4RyONhPH3H5QW0SL8Id53bBvJ7AYxSNtLhG4rQ=";
  };
 }
--- a/pkgs/applications/version-management/git-and-tools/lucky-commit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lucky-commit/default.nix
@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
  cargoBuildFlags = lib.optional (!withOpenCL) "--no-default-features";

  # disable tests that require gpu
-  cargoTestFlags = [ "--no-default-features" ];
+  checkNoDefaultFeatures = true;

  meta = with lib; {
    description = "Change the start of your git commit hashes to whatever you want";
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -9,7 +9,7 @@
 with lib;

 let
-  curlWithGnuTls = curl.override { gnutlsSupport = true; sslSupport = false; };
+  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
  pname = "gitkraken";
  version = "8.1.0";

--- a/pkgs/applications/video/corrscope/default.nix
+++ b/pkgs/applications/video/corrscope/default.nix
@ -34,7 +34,7 @@ mkDerivationWith python3Packages.buildPythonApplication rec {

  buildInputs = [ ffmpeg qtbase ];

-  propagatedBuildInputs = with python3Packages; [ appdirs atomicwrites attrs click matplotlib numpy pyqt5 ruamel_yaml ];
+  propagatedBuildInputs = with python3Packages; [ appdirs atomicwrites attrs click matplotlib numpy pyqt5 ruamel-yaml ];

  dontWrapQtApps = true;

--- a/pkgs/applications/video/filebot/default.nix
+++ b/pkgs/applications/video/filebot/default.nix
@ -4,7 +4,7 @@

 let
  # FileBot requires libcurl-gnutls.so to build
-  curlWithGnuTls = curl.override { gnutlsSupport = true; sslSupport = false; };
+  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };

 in

--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -106,7 +106,7 @@ rec {
      xorg.libICE
      gnome2.GConf
      freetype
-      (curl.override { gnutlsSupport = true; sslSupport = false; })
+      (curl.override { gnutlsSupport = true; opensslSupport = false; })
      nspr
      nss
      fontconfig
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@ -36,6 +36,10 @@
 , cargoLock ? null
 , cargoVendorDir ? null
 , checkType ? buildType
+, buildNoDefaultFeatures ? false
+, checkNoDefaultFeatures ? buildNoDefaultFeatures
+, buildFeatures ? [ ]
+, checkFeatures ? buildFeatures
 , depsExtraArgs ? {}

 # Toggles whether a custom sysroot is created when the target is a .json file.
@ -103,6 +107,14 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoLock" ]) // lib.o

  cargoCheckType = checkType;

+  cargoBuildNoDefaultFeatures = buildNoDefaultFeatures;
+
+  cargoCheckNoDefaultFeatures = checkNoDefaultFeatures;
+
+  cargoBuildFeatures = buildFeatures;
+
+  cargoCheckFeatures = checkFeatures;
+
  patchRegistryDeps = ./patch-registry-deps;

  nativeBuildInputs = nativeBuildInputs ++ [
--- a/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@ -13,6 +13,14 @@ cargoBuildHook() {
        cargoBuildProfileFlag="--${cargoBuildType}"
    fi

+    if [ -n "${cargoBuildNoDefaultFeatures-}" ]; then
+        cargoBuildNoDefaultFeaturesFlag=--no-default-features
+    fi
+
+    if [ -n "${cargoBuildFeatures-}" ]; then
+        cargoBuildFeaturesFlag="--features=${cargoBuildFeatures// /,}"
+    fi
+
    (
    set -x
    env \
@ -24,6 +32,8 @@ cargoBuildHook() {
        --target @rustTargetPlatformSpec@ \
        --frozen \
        ${cargoBuildProfileFlag} \
+        ${cargoBuildNoDefaultFeaturesFlag} \
+        ${cargoBuildFeaturesFlag} \
        ${cargoBuildFlags}
    )

--- a/pkgs/build-support/rust/hooks/cargo-check-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
@ -20,7 +20,16 @@ cargoCheckHook() {
        cargoCheckProfileFlag="--${cargoCheckType}"
    fi

-    argstr="${cargoCheckProfileFlag} --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}";
+    if [ -n "${cargoCheckNoDefaultFeatures-}" ]; then
+        cargoCheckNoDefaultFeaturesFlag=--no-default-features
+    fi
+
+    if [ -n "${cargoCheckFeatures-}" ]; then
+        cargoCheckFeaturesFlag="--features=${cargoCheckFeatures// /,}"
+    fi
+
+    argstr="${cargoCheckProfileFlag} ${cargoCheckNoDefaultFeaturesFlag} ${cargoCheckFeaturesFlag}
+        --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}"

    (
        set -x
--- a/pkgs/build-support/setup-hooks/validate-pkg-config.sh
+++ b/pkgs/build-support/setup-hooks/validate-pkg-config.sh
@ -7,7 +7,7 @@ _validatePkgConfig() {
    for pc in $(find "$prefix" -name '*.pc'); do
        # Do not fail immediately. It's nice to see all errors when
        # there are multiple pkgconfig files.
-        if ! pkg-config --validate "$pc"; then
+        if ! $PKG_CONFIG --validate "$pc"; then
            bail=1
        fi
    done
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@ -57,7 +57,7 @@ with lib;
 with builtins;

 let majorVersion = "11";
-    version = "${majorVersion}.1.0";
+    version = "${majorVersion}.2.0";

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;

@ -78,9 +78,7 @@ let majorVersion = "11";
      })

      # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
-
-      ++ [ ../libsanitizer-no-cyclades.patch ];
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;

    /* Cross-gcc settings (build == host != target) */
    crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@ -97,7 +95,7 @@ stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "1pwxrjhsymv90xzh0x42cxfnmhjinf2lnrrf3hj5jq1rm2w6yjjc";
+    sha256 = "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os=";
  };

  inherit patches;
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@ -74,6 +74,12 @@ let
      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
    ]);

+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
    buildFlags = [ "all" ];

    installPhase = ''
--- a/pkgs/development/compilers/openjdk/12.nix
+++ b/pkgs/development/compilers/openjdk/12.nix
@ -83,6 +83,12 @@ let
      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
    ];

+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
    buildFlags = [ "all" ];

    installPhase = ''
--- a/pkgs/development/compilers/openjdk/13.nix
+++ b/pkgs/development/compilers/openjdk/13.nix
@ -83,6 +83,12 @@ let
      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
    ]);

+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
    buildFlags = [ "all" ];

    installPhase = ''
--- a/pkgs/development/compilers/openjdk/14.nix
+++ b/pkgs/development/compilers/openjdk/14.nix
@ -78,6 +78,12 @@ let
      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
    ]);

+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
    buildFlags = [ "all" ];

    installPhase = ''
--- a/pkgs/development/compilers/openjdk/15.nix
+++ b/pkgs/development/compilers/openjdk/15.nix
@ -78,6 +78,12 @@ let
      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
    ]);

+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
    buildFlags = [ "all" ];

    installPhase = ''
--- a/pkgs/development/compilers/openjdk/16.nix
+++ b/pkgs/development/compilers/openjdk/16.nix
@ -84,6 +84,12 @@ let
      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
    ]);

+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
    buildFlags = [ "all" ];

    installPhase = ''
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@ -86,6 +86,12 @@ let
      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
    ]);

+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
    buildFlags = [ "images" ];

    installPhase = ''
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@ -155,6 +155,12 @@ let
      "-lgtk-x11-2.0" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
    ]);

+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
    buildFlags = [ "all" ];

    doCheck = false; # fails with "No rule to make target 'y'."
--- a/pkgs/development/compilers/rust/1_55.nix
+++ b/pkgs/development/compilers/rust/1_55.nix
@ -1,63 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_12, llvm_12
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.55.0";
-  rustcSha256 = "07l28f7grdmi65naq71pbmvdd61hwcpi40ry7kp7dy7m233rldxj";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_12.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_12;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.54.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "1cd06090463711d50d98374ef52c1a84b9f4e3e35febaaef4890fb10536ceb3a";
-    x86_64-unknown-linux-gnu = "350354495b1d4b6dd2ec7cf96aa9bc61d031951cf667a31e8cf401dc508639e6";
-    x86_64-unknown-linux-musl = "3571db0018fcd32f3b579a32b2301826dbd1cce44b373aed8e8a31c2a6f52fe8";
-    arm-unknown-linux-gnueabihf = "77f4e4c2195f75466c6de0b1d8fd7fb8cef3d12666e3aae777dcfd0d71d080ca";
-    armv7-unknown-linux-gnueabihf = "dd01ccb6a53d5e895a6755a78c213ae601a347366688941d5c543b5af5835d6d";
-    aarch64-unknown-linux-gnu = "33a50c5366a57aaab43c1c19e4a49ab7d8ffcd99a72925c315fb1f9389139e6f";
-    aarch64-unknown-linux-musl = "49d94116a357ea13f5a3231de2472f59210028c3cf81f158b8a367c3155ac544";
-    x86_64-apple-darwin = "5eb27a4f5f7a4699bc70cf1848e340ddd74e151488bfcb26853fd584958e3d33";
-    aarch64-apple-darwin = "801b3b15b992b0321261de8b8ea2728e9a74822c6cb99bf978b34e217c7825ba";
-    powerpc64le-unknown-linux-gnu = "67cadf7ac5bd2e3d5fb4baede69846059f17c4e099f771329b266d08b875ed71";
-    riscv64gc-unknown-linux-gnu = "6113a6cce3500033d0dc0d170b54c5f22562ef3025fd58d804c822a2499c74d7";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_55;
-
-  rustcPatches = [
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_12" "llvm_12"])
--- a/pkgs/development/compilers/rust/1_56.nix
+++ b/pkgs/development/compilers/rust/1_56.nix
@ -0,0 +1,63 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_13, llvm_13
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.56.1";
+  rustcSha256 = "04cmqx7nn63hzz7z27b2b0dj2qx18rck9ifvip43s6dampx8v2f3";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_13.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackagesForBuild = pkgsBuildBuild.llvmPackages_13;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.55.0";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "6e42b6c44d2eb4170f4144423fa3c33338d8d5c3ea00b03bbac200c877bc9e98";
+    x86_64-unknown-linux-gnu = "2080253a2ec36ac8ed6e060d30802d888533124b8d16545cfd4af898b365eaac";
+    x86_64-unknown-linux-musl = "f24f68587253c4bfbe59d3d10fe4897068d9130538de6b2d02097a25718030c2";
+    arm-unknown-linux-gnueabihf = "483444153d35cda51c6aec2c24bc4c97fa4fd30b28df4b60bf9763bd6e06da3a";
+    armv7-unknown-linux-gnueabihf = "8c72f0eb75b10db970fb546c3b41f5e97df294d5dbbf0b8fa96e17f2b281ee9c";
+    aarch64-unknown-linux-gnu = "eebdb2e659ed14884a49f0457d44e5e8c9f89fca3414533752c6dbb96232c156";
+    aarch64-unknown-linux-musl = "2ce36a7d34f1f2aa43b4cbc0b437d96eefb45743828bf9ae699ff581ae257f28";
+    x86_64-apple-darwin = "2e345ac7724c192c9487a2c6bd4f6c52c884d791981510288830d27d9a0bf2f3";
+    aarch64-apple-darwin = "70c71d30d0de76912fcd88d503a6cb4323cfe6250c1a255be7e0d4e644b3d40a";
+    powerpc64le-unknown-linux-gnu = "12bf6447d338cbe2b55539b84e6369b17e7eefe938d1ba7e3dd69781c9cc9812";
+    riscv64gc-unknown-linux-gnu = "effceb45346fef3b0b54b357336e6f374f788b803bb1bee4084f25eace8907f3";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_56;
+
+  rustcPatches = [
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_13" "llvm_13"])
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@ -129,13 +129,13 @@ in rec {
  };

  vala_0_52 = generic {
-    version = "0.52.5";
-    sha256 = "sha256-hKG7MSs+Xcrkt7JcRVmNN14stpIzzvtZoV0jUMdr3ZE=";
+    version = "0.52.6";
+    sha256 = "sha256-FNfrTZZLfDrcFuRTcTIIbdxmJO0eDruBEeKsgierOnI=";
  };

  vala_0_54 = generic {
-    version = "0.54.1";
-    sha256 = "0jlhd6hr9mai7hhc2c78w6zmnzf7xncp7fhyiavkqqzhhsn7gpjx";
+    version = "0.54.2";
+    sha256 = "iE3nRTF9TVbk6M7emT3I8E1Qz8o2z2DS8vJ4wwwrExE=";
  };

  vala = vala_0_54;
--- a/pkgs/development/libraries/adns/default.nix
+++ b/pkgs/development/libraries/adns/default.nix
@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
  preConfigure =
    lib.optionalString stdenv.isDarwin "sed -i -e 's|-Wl,-soname=$(SHLIBSONAME)||' configure";

+  # Autogenerated headers miss interdependencies in Makefile, fail parallel build:
+  #  https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51329
+  enableParallelBuilding = false;
+
  # https://www.mail-archive.com/nix-dev@cs.uu.nl/msg01347.html for details.
  doCheck = false;

--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@ -3,7 +3,7 @@
 , fetchurl
 , pkg-config
 , expat
-, enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isMusl
+, enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , systemd
 , audit
 , libapparmor
--- a/pkgs/development/libraries/directfb/default.nix
+++ b/pkgs/development/libraries/directfb/default.nix
@ -48,6 +48,17 @@ stdenv.mkDerivation rec {
    "--with-smooth-scaling"
  ] ++ lib.optional enableX11 "--enable-x11";

+  # Disable parallel building as parallel builds fail due to incomplete
+  # depends between autogenerated CoreSlave.h and it's include sites:
+  #    CC       prealloc_surface_pool_bridge.lo
+  #    prealloc_surface_pool_bridge.c:41:10:
+  #        fatal error: core/CoreSlave.h: No such file or directory
+  #
+  # Dependencies are specified manually in src/core/Makefile.am. Instead
+  # of fixing them one by one locally let's disable parallel builds until
+  # upstream fixes them.
+  enableParallelBuilding = false;
+
  meta = with lib; {
    description = "Graphics and input library designed with embedded systems in mind";
    longDescription = ''
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@ -2,48 +2,12 @@
 # Darwin frameworks
 , Cocoa, CoreMedia, VideoToolbox
 , stdenv, lib
-, fetchpatch
 , ...
 }@args:

 callPackage ./generic.nix (rec {
-  version = "4.4";
-  branch = "4.4";
-  sha256 = "03kxc29y8190k4y8s8qdpsghlbpmchv1m8iqygq2qn0vfm4ka2a2";
+  version = "4.4.1";
+  branch = version;
+  sha256 = "0hmck0placn12kd9l0wam70mrpgfs2nlfmi8krd135gdql5g5jcg";
  darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
-
-  patches = [
-    (fetchpatch {
-      name = "CVE-2021-33815.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777.patch";
-      sha256 = "0l8dqga5845f7d3wdbvd05i23saldq4pm2cyfdgszbr0c18sxagf";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38114.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/7150f9575671f898382c370acae35f9087a30ba1.patch";
-      sha256 = "0gwkc7v1wsh4j0am2nnskhsca1b5aqzhcfd41sd9mh2swsdyf27i";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38171.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6.patch";
-      sha256 = "0b8hsb45izw7w1vb2b94k9f6kvn2shxrap5ip1krdxg6hs7an0x8";
-    })
-    (fetchpatch {
-      name = "CVE-2021-38291.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/e01d306c647b5827102260b885faa223b646d2d1.patch";
-      sha256 = "0p2p8gcnb5j469xa3czfssm09w3jk08kz8rnl8wi2l9aj9l08my9";
-    })
-    # Fix incorrect segment length in HLS child playlist with fmp4 segment format
-    # FIXME remove in version 4.5
-    # https://trac.ffmpeg.org/ticket/9193
-    # https://trac.ffmpeg.org/ticket/9205
-    (fetchpatch {
-      name = "ffmpeg_fix_incorrect_segment_length_in_hls.patch";
-      url = "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff_plain;h=59032494e81a1a65c0b960aaae7ec4c2cc9db35a";
-      sha256 = "03zz1lw51kkc3g3vh47xa5hfiz3g3g1rbrll3kcnslvwylmrqmy3";
-    })
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Work around https://trac.ffmpeg.org/ticket/9242
-    ./v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch
-  ];
 } // args)
--- a/pkgs/development/libraries/ffmpeg/v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch
+++ b/pkgs/development/libraries/ffmpeg/v2-0001-avcodec-videotoolboxenc-define-TARGET_CPU_ARM64-t.patch
@ -1,35 +0,0 @@
-From 5b562aaddbc6e7a94a079c2e88230b205a7f4d73 Mon Sep 17 00:00:00 2001
-From: Zane van Iperen <zane@zanevaniperen.com>
-Date: Sat, 15 May 2021 19:33:52 +1000
-Subject: [PATCH v2] avcodec/videotoolboxenc: #define TARGET_CPU_ARM64 to 0 if
- not provided by the SDK
-
-Fixes build failure on older SDKs without it.
-
-Fixes #9242
-
-Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
---
- libavcodec/videotoolboxenc.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-NB: This is untested, I do not have a Mac to try it on.
-
-diff --git a/libavcodec/videotoolboxenc.c b/libavcodec/videotoolboxenc.c
-index 58239e0ab9..f063a86e73 100644
--- a/libavcodec/videotoolboxenc.c
-+++ b/libavcodec/videotoolboxenc.c
-@@ -50,6 +50,10 @@ enum { kCVPixelFormatType_420YpCbCr10BiPlanarFullRange = 'xf20' };
- enum { kCVPixelFormatType_420YpCbCr10BiPlanarVideoRange = 'x420' };
- #endif
- 
-+#ifndef TARGET_CPU_ARM64
-+#   define TARGET_CPU_ARM64 0
-+#endif
-+
- typedef OSStatus (*getParameterSetAtIndex)(CMFormatDescriptionRef videoDesc,
-                                            size_t parameterSetIndex,
-                                            const uint8_t **parameterSetPointerOut,
-- 
-2.29.3
-
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@ -22,6 +22,8 @@ stdenvNoLibs.mkDerivation rec {
    sourceRoot=$(readlink -e "./libgcc")
  '';

+  hardeningDisable = [ "pie" ];
+
  preConfigure = ''
    cd "$buildRoot"
  ''
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -45,11 +45,11 @@ in

 stdenv.mkDerivation rec {
  pname = "glib";
-  version = "2.70.0";
+  version = "2.70.1";

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0hh7hk02fkm1bn48k4z8f3kgv9qbni5z22gizd567fn527w7s390";
+    sha256 = "+be85/UXU6H0OFO7ysqL8J4V6ZQmjinP16dvZWNiY8A=";
  };

  patches = optionals stdenv.isDarwin [
@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
    ./quark_init_on_demand.patch
    ./gobject_init_on_demand.patch
  ] ++ [
+    ./glib-appinfo-watch.patch
    ./schema-override-variable.patch

    # GLib contains many binaries used for different purposes;
--- a/pkgs/development/libraries/glib/glib-appinfo-watch.patch
+++ b/pkgs/development/libraries/glib/glib-appinfo-watch.patch
@ -0,0 +1,102 @@
+This patch lets GLib's GDesktopAppInfo API watch and notice changes
+to the Nix user and system profiles.  That way, the list of available
+applications shown by the desktop environment is immediately updated
+when the user installs or removes any
+(see <https://issues.guix.gnu.org/35594>).
+
+It does so by monitoring /nix/var/nix/profiles (for changes to the system
+profile) and /nix/var/nix/profiles/per-user/USER (for changes to the user
+profile) as well as /etc/profiles/per-user (for chanes to the user
+environment profile) and crawling their share/applications sub-directory when
+changes happen.
+
+diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
+index b779b30..31069f7 100644
+--- a/gio/gdesktopappinfo.c
+++ b/gio/gdesktopappinfo.c
+@@ -150,6 +150,7 @@ typedef struct
+   gchar                      *alternatively_watching;
+   gboolean                    is_config;
+   gboolean                    is_setup;
+  gchar                      *nix_profile_watch_dir;
+   GFileMonitor               *monitor;
+   GHashTable                 *app_names;
+   GHashTable                 *mime_tweaks;
+@@ -181,6 +182,7 @@ desktop_file_dir_unref (DesktopFileDir *dir)
+     {
+       desktop_file_dir_reset (dir);
+       g_free (dir->path);
+      g_free (dir->nix_profile_watch_dir);
+       g_free (dir);
+     }
+ }
+@@ -205,6 +207,14 @@ desktop_file_dir_get_alternative_dir (DesktopFileDir *dir)
+ {
+   gchar *parent;
+ 
+  /* If DIR is a profile, watch the specified directory--e.g.,
+   * /nix/var/nix/profiles/per-user/$USER/ for the user profile.  Do not watch
+   * ~/.nix-profile or /run/current-system/sw because GFileMonitor does
+   * not pass IN_DONT_FOLLOW and thus cannot notice any change.
+   * /etc/profiles/per-user is monitored directly for the same reason. */
+  if (dir->nix_profile_watch_dir != NULL)
+    return g_strdup (dir->nix_profile_watch_dir);
+
+   /* If the directory itself exists then we need no alternative. */
+   if (g_access (dir->path, R_OK | X_OK) == 0)
+     return NULL;
+@@ -250,11 +260,11 @@ desktop_file_dir_changed (GFileMonitor      *monitor,
+    *
+    * If this is a notification for a parent directory (because the
+    * desktop directory didn't exist) then we shouldn't fire the signal
+-   * unless something actually changed.
+   * unless something actually changed or it's part of a Nix profile.
+    */
+   g_mutex_lock (&desktop_file_dir_lock);
+ 
+-  if (dir->alternatively_watching)
+  if (dir->alternatively_watching && dir->nix_profile_watch_dir == NULL)
+     {
+       gchar *alternative_dir;
+ 
+@@ -1556,6 +1566,40 @@ desktop_file_dirs_lock (void)
+       for (i = 0; dirs[i]; i++)
+         g_ptr_array_add (desktop_file_dirs, desktop_file_dir_new (dirs[i]));
+ 
+      {
+        /* Monitor the system and user profile under /nix/var/nix/profiles and
+         * treat modifications to them as if they were modifications to their
+         * /share sub-directory.  */
+        const gchar *user;
+        DesktopFileDir *system_profile_dir, *user_profile_dir, *user_env_dir;
+
+        system_profile_dir =
+          desktop_file_dir_new ("/nix/var/nix/profiles/system/sw/share");
+        system_profile_dir->nix_profile_watch_dir = g_strdup ("/nix/var/nix/profiles");
+        g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (system_profile_dir));
+
+        user = g_get_user_name ();
+        if (user != NULL)
+          {
+            gchar *profile_dir, *user_data_dir, *env_dir, *env_data_dir;
+
+            profile_dir = g_build_filename ("/nix/var/nix/profiles/per-user", user, NULL);
+            user_data_dir = g_build_filename (profile_dir, "profile", "share", NULL);
+            user_profile_dir = desktop_file_dir_new (user_data_dir);
+            user_profile_dir->nix_profile_watch_dir = profile_dir;
+            
+            env_dir = g_build_filename ("/etc/profiles/per-user", NULL);
+            env_data_dir = g_build_filename (env_dir, user, "share", NULL);
+            user_env_dir = desktop_file_dir_new (env_data_dir);
+            user_env_dir->nix_profile_watch_dir = env_dir;
+
+            g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (user_profile_dir));
+            g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (user_env_dir));
+            g_free (user_data_dir);
+            g_free (env_data_dir);
+          }
+      }
+
+       /* The list of directories will never change after this, unless
+        * g_get_user_config_dir() changes due to %G_TEST_OPTION_ISOLATE_DIRS. */
+       desktop_file_dirs_config_dir = user_config_dir;
--- a/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.33-master.patch.gz
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@ -37,12 +37,14 @@
 , profilingLibraries ? false
 , withGd ? false
 , meta
+, extraBuildInputs ? []
+, extraNativeBuildInputs ? []
 , ...
 } @ args:

 let
  version = "2.33";
-  patchSuffix = "-55";
+  patchSuffix = "-56";
  sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in

@ -61,7 +63,7 @@ stdenv.mkDerivation ({
    [
      /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
          $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-55-g4b95183785
+          glibc-2.33-56-g6090cf1330
          $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz

         To compare the archive contents zdiff can be used.
@ -189,8 +191,8 @@ stdenv.mkDerivation ({
  outputs = [ "out" "bin" "dev" "static" ];

  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ bison python3Minimal ];
-  buildInputs = [ linuxHeaders ] ++ lib.optionals withGd [ gd libpng ];
+  nativeBuildInputs = [ bison python3Minimal ] ++ extraNativeBuildInputs;
+  buildInputs = [ linuxHeaders ] ++ lib.optionals withGd [ gd libpng ] ++ extraBuildInputs;

  # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
  # prevent a retained dependency on the bootstrap tools in the stdenv-linux
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@ -6,7 +6,7 @@
   https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED
 */

-{ lib, stdenv, buildPackages, callPackage, writeText
+{ lib, stdenv, buildPackages, callPackage, writeText, glibc
 , allLocales ? true, locales ? [ "en_US.UTF-8/UTF-8" ]
 }:

@ -17,6 +17,8 @@ callPackage ./common.nix { inherit stdenv; } {

  outputs = [ "out" ];

+  extraNativeBuildInputs = [ glibc ];
+
  # Awful hack: `localedef' doesn't allow the path to `locale-archive'
  # to be overriden, but you *can* specify a prefix, i.e. it will use
  # <prefix>/<path-to-glibc>/lib/locale/locale-archive.  So we use
@ -24,7 +26,7 @@ callPackage ./common.nix { inherit stdenv; } {
  # $TMPDIR/nix/store/...-glibc-.../lib/locale/locale-archive.
  buildPhase =
    ''
-      mkdir -p $TMPDIR/"${buildPackages.stdenv.cc.libc.out}/lib/locale"
+      mkdir -p $TMPDIR/"${buildPackages.glibc.out}/lib/locale"

      echo 'C.UTF-8/UTF-8 \' >> ../glibc-2*/localedata/SUPPORTED

--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@ -1,6 +1,6 @@
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip
 , perl, gmp, autoconf, automake, libidn, p11-kit, libiconv
-, unbound, dns-root-data, gettext, cacert, util-linux
+, unbound, dns-root-data, gettext, util-linux
 , guileBindings ? config.gnutls.guile or false, guile
 , tpmSupport ? false, trousers, which, nettools, libunistring
 , withSecurity ? false, Security  # darwin Security.framework
@ -77,9 +77,9 @@ stdenv.mkDerivation rec {
  propagatedBuildInputs = [ nettle ];

  inherit doCheck;
-  # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` broke tests with:
-  #   Error setting the x509 trust file: Error while reading file.
-  checkInputs = [ cacert ];
+  # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
+  # Also empty files won't work, and we want to avoid potentially impure /etc/
+  preCheck = "NIX_SSL_CERT_FILE=${./dummy.crt}";

  # Fixup broken libtool and pkg-config files
  preFixup = lib.optionalString (!isDarwin) ''
--- a/pkgs/development/libraries/gnutls/dummy.crt
+++ b/pkgs/development/libraries/gnutls/dummy.crt
@ -0,0 +1,45 @@
+ACCVRAIZ1
+-----BEGIN CERTIFICATE-----
+MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE
+AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw
+CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ
+BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND
+VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb
+qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY
+HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo
+G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA
+lHPrzg5XPAOBOp0KoVdDaaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhr
+IA8wKFSVf+DuzgpmndFALW4ir50awQUZ0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/
+0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH
+k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47
+4KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMO
+m3WR5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpa
+cXpkatcnYGMN285J9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPl
+uUsXQA+xtrn13k/c4LOsOxFwYIRKQ26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYI
+KwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRwOi8vd3d3LmFjY3YuZXMvZmls
+ZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEuY3J0MB8GCCsG
+AQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2
+VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeT
+VfZW6oHlNsyMHj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIG
+CCsGAQUFBwICMIIBFB6CARAAQQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUA
+cgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBhAO0AegAgAGQAZQAgAGwAYQAgAEEA
+QwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUAYwBuAG8AbABvAGcA
+7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBjAHQA
+cgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAA
+QwBQAFMAIABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUA
+czAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu
+aHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt
+aW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud
+DwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZIhvcNAQEF
+BQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdp
+D70ER9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gU
+JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m
+AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD
+vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms
+tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH
+7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h
+I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA
+h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF
+d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H
+pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7
+-----END CERTIFICATE-----
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "gperftools";
-  version = "2.8.1";
+  version = "2.9.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "19bj2vlsbfwq7m826v2ccqg47kd7cb5vcz1yw2x0v5qzhaxbakk1";
+    sha256 = "sha256-loUlC6mtR3oyS5opSmicCnfUqcefSk8+kKDcHNmC/oo=";
  };

  patches = [
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@ -148,6 +148,8 @@ stdenv.mkDerivation rec {
    "-Dtests=false"
    "-Dtracker3=${lib.boolToString trackerSupport}"
    "-Dbroadway_backend=${lib.boolToString broadwaySupport}"
+    "-Dx11_backend=${lib.boolToString x11Support}"
+    "-Dquartz_backend=${lib.boolToString (stdenv.isDarwin && !x11Support)}"
  ];

  doCheck = false; # needs X11
@ -159,6 +161,10 @@ stdenv.mkDerivation rec {
  NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";

  postPatch = ''
+    # See https://github.com/NixOS/nixpkgs/issues/132259
+    substituteInPlace meson.build \
+      --replace "x11_enabled = false" ""
+
    files=(
      build-aux/meson/post-install.py
      demos/gtk-demo/geninclude.py
--- a/pkgs/development/libraries/icu/70.nix
+++ b/pkgs/development/libraries/icu/70.nix
@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "70.1";
+  sha256 = "1m9zgkaf5lyh65nyc6n0n5bs2f5k53nnj1ih6nskpwbvq4l5884d";
+}
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@ -43,7 +43,7 @@ let

    meta = with lib; {
      description = "Unicode and globalization support library";
-      homepage = "http://site.icu-project.org/";
+      homepage = "https://icu.unicode.org/";
      maintainers = with maintainers; [ raskin ];
      platforms = platforms.all;
    };
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@ -9,22 +9,20 @@
 , withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 , gobject-introspection
 , fixDarwinDylibNames
-, gtk-doc
-, docbook-xsl-nons
-, docbook_xml_dtd_43
+, gi-docgen
 , gnome
 }:

 stdenv.mkDerivation rec {
  pname = "json-glib";
-  version = "1.6.2";
+  version = "1.6.6";

  outputs = [ "out" "dev" ]
    ++ lib.optional withIntrospection "devdoc";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "092g2dyy1hhl0ix9kp33wcab0pg1qicnsv0cj5ms9g9qs336cgd3";
+    sha256 = "luyYvnqR9t3jNjZyDj2i/27LuQ52zKpJSX8xpoVaSQ4=";
  };

  strictDeps = true;
@ -39,13 +37,11 @@ stdenv.mkDerivation rec {
    pkg-config
    gettext
    glib
-    docbook-xsl-nons
-    docbook_xml_dtd_43
  ] ++ lib.optional stdenv.hostPlatform.isDarwin [
    fixDarwinDylibNames
  ] ++ lib.optionals withIntrospection [
    gobject-introspection
-    gtk-doc
+    gi-docgen
  ];

  propagatedBuildInputs = [
@ -54,12 +50,23 @@ stdenv.mkDerivation rec {

  mesonFlags = lib.optionals (!withIntrospection) [
    "-Dintrospection=disabled"
-    # doc gen uses introspection, doesn't work properly
+    # gi-docgen relies on introspection data
    "-Dgtk_doc=disabled"
  ];

  doCheck = true;

+  postFixup = ''
+    # Move developer documentation to devdoc output.
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    if [[ -d "$out/share/doc" ]]; then
+        find -L "$out/share/doc" -type f -regex '.*\.devhelp2?' -print0 \
+          | while IFS= read -r -d ''' file; do
+            moveToOutput "$(dirname "''${file/"$out/"/}")" "$devdoc"
+        done
+    fi
+  '';
+
  passthru = {
    updateScript = gnome.updateScript {
      packageName = pname;
--- a/pkgs/development/libraries/kde-frameworks/sonnet.nix
+++ b/pkgs/development/libraries/kde-frameworks/sonnet.nix
@ -1,10 +1,18 @@
 { mkDerivation
+, fetchpatch
 , extra-cmake-modules
 , aspell, qtbase, qttools
 }:

 mkDerivation {
  name = "sonnet";
+  patches = [
+    # Pull upstream path to fix determinism.
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/sonnet/-/commit/a01fc66b8affb01221d1fdf84146a78c172d4c6b.patch";
+      sha256 = "1jzd65rmgvfpcxrsnsmdz8ac1ldqs9rjfryy8fryy0ibzbhc1050";
+    })
+  ];
  nativeBuildInputs = [ extra-cmake-modules ];
  buildInputs = [ aspell qttools ];
  propagatedBuildInputs = [ qtbase ];
--- a/pkgs/development/libraries/keybinder3/default.nix
+++ b/pkgs/development/libraries/keybinder3/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    description = "Library for registering global key bindings";
    homepage = "https://github.com/kupferlauncher/keybinder/";
    license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = [ maintainers.cstrahan ];
  };
 }
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libaom";
-  version = "3.1.3";
+  version = "3.2.0";

  src = fetchzip {
    url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "08rk31d2cp9k9nj37s6a4n7klpfqfbj62anwyiggzsz7b68psjq3";
+    sha256 = "0fmnbzpl481i7kchx4hbvb507r5pfgyrzfrlrs7jk3bicycm75qv";
    stripRoot = false;
  };

--- a/pkgs/development/libraries/libb64/default.nix
+++ b/pkgs/development/libraries/libb64/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "libb64";
@ -11,6 +11,18 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-9loDftr769qnIi00MueO86kjha2EiG9pnCLogp0Iq3c=";
  };

+  patches = [
+    # Fix parallel build failure: https://github.com/libb64/libb64/pull/9
+    #  make[1]: *** No rule to make target 'libb64.a', needed by 'c-example1'.  Stop.
+    (fetchpatch {
+      name = "parallel-make.patch";
+      url = "https://github.com/libb64/libb64/commit/4fe47c052e9123da8f751545deb48be08c3411f6.patch";
+      sha256 = "18b3np3gpyzimqmk6001riqv5n70wfbclky6zzsrvj5zl1dj4ljf";
+    })
+  ];
+
+  enableParallelBuilding = true;
+
  installPhase = ''
    mkdir -p $out $out/lib $out/bin $out/include
    cp -r include/* $out/include/
--- a/pkgs/development/libraries/libmediainfo/default.nix
+++ b/pkgs/development/libraries/libmediainfo/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, zlib }:
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, zlib, fetchpatch }:

 stdenv.mkDerivation rec {
  version = "21.09";
@ -11,7 +11,15 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ autoreconfHook pkg-config ];
  buildInputs = [ libzen zlib ];

-  sourceRoot = "./MediaInfoLib/Project/GNU/Library/";
+  patches = [
+    # fixes pkgsMusl.libmediainfo build
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/libmediainfo/fix-include-signal.patch?id=b8d666a3d33575c184308e1176f4de9e519af577";
+      sha256 = "sha256-b3HoIwy/hKSh8jUakwVJpnPmYw5KUwZXgLW7IPMY4/c=";
+    })
+  ];
+
+  postPatch = "cd Project/GNU/Library";

  configureFlags = [ "--enable-shared" ];

--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@ -17,6 +17,10 @@ stdenv.mkDerivation rec {
    ./fno-common.patch
  ];

+  # Disable parallel build as it fails as:
+  #    ld: cannot find -lomxil-bellagio
+  enableParallelBuilding = false;
+
  doCheck = false; # fails

  # Fix for #40213, probably permanent, because upstream doesn't seem to be
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "librsvg";
-  version = "2.52.0";
+  version = "2.52.3";

  outputs = [ "out" "dev" "installedTests" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "14zkdd7a9mymnfs3laqj0gr69c16nwixvbc5a4gvd534w6riz0mx";
+    sha256 = "Nuf1vIjXhgjqf2wF5K/krMFga5rxPChF1DhQc9CCuKQ=";
  };

  cargoVendorDir = "vendor";
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libseccomp";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchurl {
    url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "0m8dlg1v7kflcxvajs4p76p275qwsm2abbf5mfapkakp7hw7wc7f";
+    sha256 = "sha256-F6ZS37SR2Wvok5YOm3kZFJNu4WwTt3ejyvVi/kjLh98=";
  };

  outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "High level library for the Linux Kernel seccomp filter";
    homepage = "https://github.com/seccomp/libseccomp";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
    platforms = platforms.linux;
    badPlatforms = [
      "alpha-linux"
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "libsoup";
-  version = "3.0.1";
+  version = "3.0.2";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bwwxbRD4RYuW9WTHZEvjwgEb11rVBUyNsmr7DJqRvEc=";
+    sha256 = "sha256-mO9T7ZtIFewFIyFVNxr4A6mSj0ZSrMaF/wIIa+FqP/U=";
  };

  nativeBuildInputs = [
@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    glib
+    python3
  ] ++ lib.optionals withIntrospection [
    gobject-introspection
  ] ++ lib.optionals withVala [
@ -42,7 +43,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    python3
    sqlite
    libpsl
    glib.out
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "libsoup";
-  version = "2.74.0";
+  version = "2.74.1";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-M7HU4NY5RWxnXCJ4d+lKgHjXMSM+LVdonBGrzvfTxI4=";
+    sha256 = "sha256-3CejuPowvI/5ULWnWVh1fSJC4+UeTi2cTmI+9195O/g=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@ -56,13 +56,13 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;

 stdenv.mkDerivation rec {
  pname = "libvpx";
-  version = "1.10.0";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "webmproject";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-EZP33U10fchyqy7Jr26vHgUUfWR6xtG3fcMWUII0m9w=";
+    sha256 = "00f1jrclai2b6ys78dpsg6r1mvcyxlna93vxcz8zjyia24c2pjsb";
  };

  postPatch = ''
@ -180,6 +180,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "WebM VP8/VP9 codec SDK";
    homepage    = "https://www.webmproject.org/";
+    changelog   = "https://github.com/webmproject/libvpx/raw/v${version}/CHANGELOG";
    license     = licenses.bsd3;
    maintainers = with maintainers; [ codyopel ];
    platforms   = platforms.all;
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -54,16 +54,22 @@ self = stdenv.mkDerivation {
  #  revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved
  #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
  patches = [
-    ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
+    # fixes pkgsMusl.mesa build
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl.patch";
+      sha256 = "sha256-Jyl7ILLhn8hBJG7afnEjE8H56Wz/1bxkvlqfrXK5U7I=";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-endian.patch";
+      sha256 = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk=";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-stacksize.patch";
+      sha256 = "sha256-bEp0AWddsw1Pc3rxdKN8fsrX4x2TQEzMUa5afhLXGsg=";
+    })
+
    ./opencl.patch
    ./disk_cache-include-dri-driver-path-in-cache-key.patch
-    # Fix `-Werror=int-conversion` pthread warnings on musl.
-    # TODO: Remove when https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6121 is merged and available
-    (fetchpatch {
-      name = "nine_debug-Make-tid-more-type-correct";
-      url = "https://gitlab.freedesktop.org/mesa/mesa/commit/aebbf819df6d1e.patch";
-      sha256 = "17248hyzg43d73c86p077m4lv1pkncaycr3l27hwv9k4ija9zl8q";
-    })
  ] ++ optionals (stdenv.isDarwin && stdenv.isAarch64) [
    # Fix aarch64-darwin build, remove when upstreaam supports it out of the box.
    # See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/1020
--- a/pkgs/development/libraries/mesa/missing-includes.patch
+++ b/pkgs/development/libraries/mesa/missing-includes.patch
@ -1,22 +0,0 @@
--- ./src/gallium/winsys/svga/drm/vmw_screen.h.orig
-+++ ./src/gallium/winsys/svga/drm/vmw_screen.h
-@@ -34,7 +34,7 @@
- #ifndef VMW_SCREEN_H_
- #define VMW_SCREEN_H_
- 
-
-+#include <sys/stat.h>
- #include "pipe/p_compiler.h"
- #include "pipe/p_state.h"
- 
--- a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
-+++ b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
-@@ -28,6 +28,8 @@
- #ifndef RADV_AMDGPU_WINSYS_H
- #define RADV_AMDGPU_WINSYS_H
-
-+#include <sys/types.h>
-+
- #include <amdgpu.h>
- #include <pthread.h>
- #include "util/list.h"
--- a/pkgs/development/libraries/ncurses/clang.patch
+++ b/pkgs/development/libraries/ncurses/clang.patch
@ -1,42 +0,0 @@
-diff -ruNp ncurses-5.8.orig/c++/cursesf.h ncurses-5.8/c++/cursesf.h
--- ncurses-5.8.orig/c++/cursesf.h	2005-08-13 21:08:24.000000000 +0300
-+++ ncurses-5.8/c++/cursesf.h	2011-04-03 18:29:29.000000000 +0300
-@@ -681,7 +681,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Fields=FALSE)
-    : NCursesForm (Fields, with_frame, autoDelete_Fields) {
-+    : NCursesForm (&Fields, with_frame, autoDelete_Fields) {
-       if (form)
- 	set_user (const_cast<void *>(p_UserData));
-   };
-@@ -694,7 +694,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Fields=FALSE)
-    : NCursesForm (Fields, nlines, ncols, begin_y, begin_x,
-+    : NCursesForm (&Fields, nlines, ncols, begin_y, begin_x,
- 		   with_frame, autoDelete_Fields) {
-       if (form)
- 	set_user (const_cast<void *>(p_UserData));
-diff -ruNp ncurses-5.8.orig/c++/cursesm.h ncurses-5.8/c++/cursesm.h
--- ncurses-5.8.orig/c++/cursesm.h	2005-08-13 21:10:36.000000000 +0300
-+++ ncurses-5.8/c++/cursesm.h	2011-04-03 18:31:42.000000000 +0300
-@@ -639,7 +639,7 @@ public:
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE,
- 		   bool autoDelete_Items=FALSE)
-    : NCursesMenu (Items, with_frame, autoDelete_Items) {
-+    : NCursesMenu (&Items, with_frame, autoDelete_Items) {
-       if (menu)
- 	set_user (const_cast<void *>(p_UserData));
-   };
-@@ -651,7 +651,7 @@ public:
- 		   int begin_x = 0,
- 		   const T* p_UserData = STATIC_CAST(T*)(0),
- 		   bool with_frame=FALSE)
-    : NCursesMenu (Items, nlines, ncols, begin_y, begin_x, with_frame) {
-+    : NCursesMenu (&Items, nlines, ncols, begin_y, begin_x, with_frame) {
-       if (menu)
- 	set_user (const_cast<void *>(p_UserData));
-   };
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@ -27,8 +27,6 @@ stdenv.mkDerivation rec {
    sha256 = "15r2456g0mlq2q7gh2z52vl6zv6y0z8sdchrs80kg4idqd8sm8fd";
  };

-  patches = lib.optional (!stdenv.cc.isClang) ./clang.patch;
-
  outputs = [ "out" "dev" "man" ];
  setOutputFlags = false; # some aren't supported

--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@ -1,7 +1,28 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, expat, pam, perl, fetchpatch
-, intltool, spidermonkey_78, gobject-introspection, libxslt, docbook_xsl, dbus
-, docbook_xml_dtd_412, gtk-doc, coreutils
-, useSystemd ? (stdenv.isLinux && !stdenv.hostPlatform.isMusl), systemd, elogind
+{ lib
+, stdenv
+, fetchFromGitLab
+, pkg-config
+, glib
+, expat
+, pam
+, meson
+, ninja
+, perl
+, rsync
+, python3
+, fetchpatch
+, gettext
+, spidermonkey_78
+, gobject-introspection
+, libxslt
+, docbook-xsl-nons
+, dbus
+, docbook_xml_dtd_412
+, gtk-doc
+, coreutils
+, useSystemd ? stdenv.isLinux
+, systemd
+, elogind
 # needed until gobject-introspection does cross-compile (https://github.com/NixOS/nixpkgs/pull/88222)
 , withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
 # A few tests currently fail on musl (polkitunixusertest, polkitunixgrouptest, polkitidentitytest segfault).
@ -12,54 +33,111 @@
 }:

 let
-
  system = "/run/current-system/sw";
  setuid = "/run/wrappers/bin";
-
 in
-
 stdenv.mkDerivation rec {
  pname = "polkit";
-  version = "0.119";
+  version = "0.120";

-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/${pname}/releases/${pname}-${version}.tar.gz";
-    sha256 = "0p0zzmr0kh3mpmqya4q27y4h9b920zp5ya0i8909ahp9hvdrymy8";
+  outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
+
+  # Tarballs do not contain subprojects.
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "polkit";
+    repo = "polkit";
+    rev = version;
+    sha256 = "oEaRf1g13zKMD+cP1iwIA6jaCDwvNfGy2i8xY8vuVSo=";
  };

-  patches = lib.optionals stdenv.hostPlatform.isMusl [
+  patches = [
+    # Allow changing base for paths in pkg-config file as before.
+    # https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/100
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/7ba07551dfcd4ef9a87b8f0d9eb8b91fabcb41b3.patch";
+      sha256 = "ebbLILncq1hAZTBMsLm+vDGw6j0iQ0crGyhzyLZQgKA=";
+    })
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
    # Make netgroup support optional (musl does not have it)
    # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10
    # We use the version of the patch that Alpine uses successfully.
    (fetchpatch {
      name = "make-innetgr-optional.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/polkit/make-innetgr-optional.patch?id=391e7de6ced1a96c2dac812e0b12f1d7e0ea705e";
-      sha256 = "1p9qqqhnrfyjvvd50qh6vpl256kyfblm1qnhz5pm09klrl1bh1n4";
+      url = "https://git.alpinelinux.org/aports/plain/community/polkit/make-innetgr-optional.patch?id=424ecbb6e9e3a215c978b58c05e5c112d88dddfc";
+      sha256 = "0iyiksqk29sizwaa4623bv683px1fny67639qpb1him89hza00wy";
    })
  ];

-  postPatch = lib.optionalString stdenv.isDarwin ''
-    sed -i -e "s/-Wl,--as-needed//" configure.ac
-  '';
+  nativeBuildInputs = [
+    glib
+    gtk-doc
+    pkg-config
+    gettext
+    meson
+    ninja
+    perl
+    rsync
+    (python3.withPackages (pp: with pp; [
+      dbus-python
+      (python-dbusmock.overridePythonAttrs (attrs: {
+        # Avoid dependency cycle.
+        doCheck = false;
+      }))
+    ]))

-  outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
+    # man pages
+    libxslt
+    docbook-xsl-nons
+    docbook_xml_dtd_412
+  ];

-  nativeBuildInputs =
-    [ glib gtk-doc pkg-config intltool perl ]
-    ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ]; # man pages
-  buildInputs =
-    [ expat pam spidermonkey_78 ]
+  buildInputs = [
+    expat
+    pam
+    spidermonkey_78
+  ] ++ lib.optionals stdenv.isLinux [
    # On Linux, fall back to elogind when systemd support is off.
-    ++ lib.optional stdenv.isLinux (if useSystemd then systemd else elogind)
-    ++ lib.optional withIntrospection gobject-introspection;
+    (if useSystemd then systemd else elogind)
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ];

  propagatedBuildInputs = [
    glib # in .pc Requires
  ];

-  preConfigure = ''
-    chmod +x test/mocklibc/bin/mocklibc{,-test}.in
-    patchShebangs .
+  checkInputs = [
+    dbus
+  ];
+
+  mesonFlags = [
+    "--datadir=${system}/share"
+    "--sysconfdir=/etc"
+    "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    "-Dpolkitd_user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
+    "-Dos_type=redhat" # only affects PAM includes
+    "-Dintrospection=${lib.boolToString withIntrospection}"
+    "-Dtests=${lib.boolToString doCheck}"
+    "-Dgtk_doc=${lib.boolToString true}"
+    "-Dman=true"
+  ] ++ lib.optionals stdenv.isLinux [
+    "-Dsession_tracking=${if useSystemd then "libsystemd-login" else "libelogind"}"
+  ];
+
+  # HACK: We want to install policy files files to $out/share but polkit
+  # should read them from /run/current-system/sw/share on a NixOS system.
+  # Similarly for config files in /etc.
+  # With autotools, it was possible to override Make variables
+  # at install time but Meson does not support this
+  # so we need to convince it to install all files to a temporary
+  # location using DESTDIR and then move it to proper one in postInstall.
+  DESTDIR = "${placeholder "out"}/dest";
+
+  inherit doCheck;
+
+  postPatch = ''
+    patchShebangs test/polkitbackend/polkitbackendjsauthoritytest-wrapper.py

    # ‘libpolkit-agent-1.so’ should call the setuid wrapper on
    # NixOS.  Hard-coding the path is kinda ugly.  Maybe we can just
@ -69,45 +147,40 @@ stdenv.mkDerivation rec {
    substituteInPlace test/data/etc/polkit-1/rules.d/10-testing.rules \
      --replace   /bin/true ${coreutils}/bin/true \
      --replace   /bin/false ${coreutils}/bin/false
-
-  '' + lib.optionalString useSystemd /* bogus chroot detection */ ''
-    sed '/libsystemd autoconfigured/s/.*/:/' -i configure
  '';

-  configureFlags = [
-    "--datadir=${system}/share"
-    "--sysconfdir=/etc"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--with-polkitd-user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
-    "--with-os-type=NixOS" # not recognized but prevents impurities on non-NixOS
-    (if withIntrospection then "--enable-introspection" else "--disable-introspection")
-  ] ++ lib.optional (!doCheck) "--disable-test";
+  postConfigure = ''
+    # Unpacked by meson
+    chmod +x subprojects/mocklibc-1.0/bin/mocklibc
+    patchShebangs subprojects/mocklibc-1.0/bin/mocklibc
+  '';

-  makeFlags = [
-    "INTROSPECTION_GIRDIR=${placeholder "out"}/share/gir-1.0"
-    "INTROSPECTION_TYPELIBDIR=${placeholder "out"}/lib/girepository-1.0"
-  ];
-
-  installFlags = [
-    "datadir=${placeholder "out"}/share"
-    "sysconfdir=${placeholder "out"}/etc"
-  ];
-
-  inherit doCheck;
-  checkInputs = [ dbus ];
  checkPhase = ''
    runHook preCheck

-    # unfortunately this test needs python-dbusmock, but python-dbusmock needs polkit,
-    # leading to a circular dependency
-    substituteInPlace test/Makefile --replace polkitbackend ""
-
    # tests need access to the system bus
-    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS make check'
+    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS meson test --print-errorlogs'

    runHook postCheck
  '';

+  postInstall = ''
+    # Move stuff from DESTDIR to proper location.
+    # We use rsync to merge the directories.
+    rsync --archive "${DESTDIR}/etc" "$out"
+    rm --recursive "${DESTDIR}/etc"
+    rsync --archive "${DESTDIR}${system}"/* "$out"
+    rm --recursive "${DESTDIR}${system}"/*
+    rmdir --parents --ignore-fail-on-non-empty "${DESTDIR}${system}"
+    for o in $outputs; do
+        rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
+        rm --recursive "${DESTDIR}/''${!o}"
+    done
+    # Ensure the DESTDIR is removed.
+    destdirContainer="$(dirname "${DESTDIR}")"
+    pushd "$destdirContainer"; rmdir --parents "''${DESTDIR##$destdirContainer/}${builtins.storeDir}"; popd
+  '';
+
  meta = with lib; {
    homepage = "http://www.freedesktop.org/wiki/Software/polkit";
    description = "A toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes";
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@ -29,6 +29,13 @@ stdenv.mkDerivation rec {

  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ AudioUnit AudioToolbox CoreAudio CoreServices Carbon ];

+  # Disable parallel build as it fails as:
+  #   make: *** No rule to make target '../../../lib/libportaudio.la',
+  #     needed by 'libportaudiocpp.la'.  Stop.
+  # Next release should address it with
+  #     https://github.com/PortAudio/portaudio/commit/28d2781d9216115543aa3f0a0ffb7b4ee0fac551.patch
+  enableParallelBuilding = false;
+
  # not sure why, but all the headers seem to be installed by the make install
  installPhase = ''
    make install
--- a/pkgs/development/libraries/protobuf/3.18.nix
+++ b/pkgs/development/libraries/protobuf/3.18.nix
@ -1,6 +1,6 @@
 { callPackage, ... }:

 callPackage ./generic-v3.nix {
-  version = "3.18.0";
-  sha256 = "0nhjw4m4dm6wqwwsi0b18js5wbh3ibrpsq195g6mk9cx54fx097f";
+  version = "3.18.1";
+  sha256 = "sha256-5PK0uuk7Du9hX/hHy0gninHIKu6b8THdfVh87Gn7y2Q=";
 }
--- a/pkgs/development/libraries/protobuf/3.19.nix
+++ b/pkgs/development/libraries/protobuf/3.19.nix
@ -0,0 +1,6 @@
+{ callPackage, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.19.0";
+  sha256 = "0rx4r4d7hqr0gi3v90jbkm2lnkj9p37dhgwx9d0w7kgh3rvr4i7g";
+}
--- a/pkgs/development/libraries/pth/default.nix
+++ b/pkgs/development/libraries/pth/default.nix
@ -14,6 +14,13 @@ stdenv.mkDerivation rec {
    configureFlagsArray+=("ac_cv_check_sjlj=ssjlj")
  '';

+  # Fails parallel build due to missing dependency on autogenrated
+  # 'pth_p.h' file:
+  #     ./shtool scpp -o pth_p.h ...
+  #     ./libtool --mode=compile --quiet gcc -c -I. -O2 -pipe pth_uctx.c
+  #     pth_uctx.c:31:10: fatal error: pth_p.h: No such file
+  enableParallelBuilding = false;
+
  meta = with lib; {
    description = "The GNU Portable Threads library";
    homepage = "https://www.gnu.org/software/pth";
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@ -2,15 +2,8 @@

 # Updates

-Before a major version update, make a copy of this directory. (We like to
-keep the old version around for a short time after major updates.) Add a
-top-level attribute to `top-level/all-packages.nix`.
-
-1. Update the URL in `pkgs/development/libraries/qt-5/$VERSION/fetch.sh`.
-2. From the top of the Nixpkgs tree, run
-   `./maintainers/scripts/fetch-kde-qt.sh pkgs/development/libraries/qt-5/$VERSION`.
-3. Check that the new packages build correctly.
-4. Commit the changes and open a pull request.
+Run `./fetch.sh` to update package sources from Git.
+Check for any minor version changes.

 */

@ -28,58 +21,12 @@ top-level attribute to `top-level/all-packages.nix`.

 let

+  srcs = import ./srcs.nix { inherit lib fetchgit fetchFromGitHub; };
+
  qtCompatVersion = srcs.qtbase.version;

  stdenvActual = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;

-  mirror = "https://download.qt.io";
-  srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; } // {
-    # qtwebkit does not have an official release tarball on the qt mirror and is
-    # mostly maintained by the community.
-    qtwebkit = rec {
-      src = fetchFromGitHub {
-        owner = "qt";
-        repo = "qtwebkit";
-        rev = "v${version}";
-        sha256 = "0x8rng96h19xirn7qkz3lydal6v4vn00bcl0s3brz36dfs0z8wpg";
-      };
-      version = "5.212.0-alpha4";
-    };
-    qtwebengine =
-      let
-        branchName = "5.15.6";
-        rev = "v${branchName}-lts";
-      in
-      {
-        version = "${branchName}-${lib.substring 0 7 rev}";
-
-        src = fetchgit {
-          url = "https://github.com/qt/qtwebengine.git";
-          sha256 = "17bw9yf04zmr9ck5jkrd435c8b03zpf937vn2nwgsr8p78wkg3kr";
-          inherit rev branchName;
-          fetchSubmodules = true;
-          leaveDotGit = true;
-          name = "qtwebengine-${lib.substring 0 7 rev}.tar.gz";
-          postFetch = ''
-            # remove submodule .git directory
-            rm -rf "$out/src/3rdparty/.git"
-
-            # compress to not exceed the 2GB output limit
-            # try to make a deterministic tarball
-            tar -I 'gzip -n' \
-              --sort=name \
-              --mtime=1970-01-01 \
-              --owner=root --group=root \
-              --numeric-owner --mode=go=rX,u+rw,a-s \
-              --transform='s@^@source/@' \
-              -cf temp  -C "$out" .
-            rm -r "$out"
-            mv temp "$out"
-          '';
-        };
-      };
-  };
-
  patches = {
    qtbase = lib.optionals stdenv.isDarwin [
      ./qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
@ -107,16 +54,6 @@ let
      ./qtbase.patch.d/0009-qtbase-qtpluginpath.patch
      ./qtbase.patch.d/0010-qtbase-assert.patch
      ./qtbase.patch.d/0011-fix-header_module.patch
-      (fetchpatch { # This can be removed when https://codereview.qt-project.org/c/qt/qtbase/+/339323 is included in an release.
-        name = "0014-gcc11-compat.patch";
-        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=049e14870c13235cd066758f29c42dc96c1ccdf8";
-        sha256 = "1cb2hwi859hds0fa2cbap014qaa7mah9p0rcxcm2cvj2ybl33qfc";
-      })
-      (fetchpatch { # This can be removed when https://codereview.qt-project.org/c/qt/qtbase/+/363880/3 is included in an release.
-        name = "qtbase-mysql-version-vs-functionality-check.patch";
-        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=211369133cf40b2f522caaff259c19069ed23ca4";
-        sha256 = "19kq9h10qm344fpdqa9basrbzh1y5kr48c6jzz3nvk61pk4ja1k4";
-      })
    ];
    qtdeclarative = [ ./qtdeclarative.patch ];
    qtscript = [ ./qtscript.patch ];
--- a/pkgs/development/libraries/qt-5/5.15/fetch.sh
+++ b/pkgs/development/libraries/qt-5/5.15/fetch.sh
@ -1,2 +1,17 @@
-WGET_ARGS=( http://download.qt.io/official_releases/qt/5.15/5.15.2/submodules/ \
-            -A '*.tar.xz' )
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-prefetch-scripts jq
+
+set -eox pipefail
+
+here="$(dirname "${BASH_SOURCE[0]}")"
+modules="${here}/modules"
+srcs="${here}/srcs-generated.json"
+
+while read -r module; do
+    if [[ -z "$module" ]]; then continue; fi
+    url="https://invent.kde.org/qt/qt/${module}.git"
+    nix-prefetch-git --url $url --rev refs/heads/kde/5.15 \
+        | jq "{key: \"${module}\", value: {url,rev,sha256}}"
+done < "$modules" | jq -s 'from_entries' > "${srcs}.tmp"
+
+mv "${srcs}.tmp" "$srcs"
--- a/pkgs/development/libraries/qt-5/5.15/modules
+++ b/pkgs/development/libraries/qt-5/5.15/modules
@ -0,0 +1,41 @@
+qt3d
+qtactiveqt
+qtandroidextras
+qtbase
+qtcharts
+qtconnectivity
+qtdatavis3d
+qtdeclarative
+qtdoc
+qtgamepad
+qtgraphicaleffects
+qtimageformats
+qtlocation
+qtlottie
+qtmacextras
+qtmultimedia
+qtnetworkauth
+qtpurchasing
+qtquick3d
+qtquickcontrols
+qtquickcontrols2
+qtquicktimeline
+qtremoteobjects
+qtscript
+qtscxml
+qtsensors
+qtserialbus
+qtserialport
+qtspeech
+qtsvg
+qttools
+qttranslations
+qtvirtualkeyboard
+qtwayland
+qtwebchannel
+qtwebglplugin
+qtwebsockets
+qtwebview
+qtwinextras
+qtx11extras
+qtxmlpatterns
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@ -0,0 +1,207 @@
+{
+  "qt3d": {
+    "url": "https://invent.kde.org/qt/qt/qt3d.git",
+    "rev": "7edec6e014de27b9dd03f63875c471aac606a918",
+    "sha256": "0qv4vhciigqd8bnqzrs7y71ls7jx1p9cal2rh78m42qgskk1ci59"
+  },
+  "qtactiveqt": {
+    "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
+    "rev": "f0d03da0e37a84029a4eae1733813521482ac1fb",
+    "sha256": "0llk76lf0mh4mzj7pwd8cs55wpmfq8v1bsdzvizb1sx0vfbjh8g6"
+  },
+  "qtandroidextras": {
+    "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
+    "rev": "8cce1098c59534352aa0f343ea73861f603ac04a",
+    "sha256": "130a1yda2m7pa10as3rccz84m3617422n6s51pdn4kp8p8rk7cs6"
+  },
+  "qtbase": {
+    "url": "https://invent.kde.org/qt/qt/qtbase.git",
+    "rev": "c9fde86b0a2440133bc08f4811b6ca793be47f0a",
+    "sha256": "1fqhdkv3sp3nbzqi2a5wvxn5d4v0xcrq2bl609bdyj4nx367a8wp"
+  },
+  "qtcharts": {
+    "url": "https://invent.kde.org/qt/qt/qtcharts.git",
+    "rev": "130463160b4923069eb98da49edaf7d93180f4f8",
+    "sha256": "19g35cddbfh307mk76wac1ps03warynlsj7xi8i596bxiaf7i4pw"
+  },
+  "qtconnectivity": {
+    "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
+    "rev": "69a87a9b831e36a578594a0a13130c384ad03121",
+    "sha256": "0ph07rdf9qfxnw3z2nqbmh6na65z0p2snmlzdw80amd7s0g255kw"
+  },
+  "qtdatavis3d": {
+    "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
+    "rev": "c085311c02dd216e5a041b90c164d55b3cf3ce92",
+    "sha256": "0xya1m2csb42yisl90s9822p9q92n7ags909nlbapfsb49qwsqnj"
+  },
+  "qtdeclarative": {
+    "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
+    "rev": "55324650f9e759a43dce927f823c9858574106c3",
+    "sha256": "0cxz4pqvb8l0wqpc4hr0xmc72csqf7dpbbzdqgil9nyyg21ihkz0"
+  },
+  "qtdoc": {
+    "url": "https://invent.kde.org/qt/qt/qtdoc.git",
+    "rev": "897e90fe304d844beaf694b82a93a50237fa8b9e",
+    "sha256": "1c4m9vlgg6bfw7hwzanl5s4vslg0r7xiz50lanhqrlcrr9i36xs1"
+  },
+  "qtgamepad": {
+    "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
+    "rev": "64afa18a0a1e9588060e2e6d917bb01ccdd48a81",
+    "sha256": "1h9yb0asprynnb2qyjbmyglrkk9f9v19g6zzpk0gmixrp0h8gk46"
+  },
+  "qtgraphicaleffects": {
+    "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
+    "rev": "c36998dc1581167b12cc3de8e4ac68c2a5d9f76e",
+    "sha256": "0x11n2fym765z3gyb4xnfl7v6zrip1wjkkl6nx1bxaya173fvdw8"
+  },
+  "qtimageformats": {
+    "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
+    "rev": "cb82c74310837fe4e832c8ab72176a5d63e4355f",
+    "sha256": "0j4cv5sa6mm3adcjw8cv6kbzrslmhjc1rgxqgc130l8vm3vmgbkr"
+  },
+  "qtlocation": {
+    "url": "https://invent.kde.org/qt/qt/qtlocation.git",
+    "rev": "861e372b6ad81570d4f496e42fb25a6699b72f2f",
+    "sha256": "1g24pg9v6sv5zf80r48innp3h4g0hss69hnr7ygfzfvfnmmn6g52"
+  },
+  "qtlottie": {
+    "url": "https://invent.kde.org/qt/qt/qtlottie.git",
+    "rev": "fa8c8bfc6742ab98b61d1351e054e0e73e9a42f4",
+    "sha256": "1xgykaw8qjnaip6h9jx0nfadc9amb6aclk758vm5pp43dvs5j96r"
+  },
+  "qtmacextras": {
+    "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
+    "rev": "e72896968697e2a8af16a312e1560948e4c40f30",
+    "sha256": "1hndpbr1nnybn7frg76q99bk1c8fhvra6wjm0q78p4a8pinrvcms"
+  },
+  "qtmultimedia": {
+    "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
+    "rev": "bd29c87027637a013f2c5e3b549fcda84e4d7545",
+    "sha256": "11pz9zzrhsr3n78ga7l3kp3gi20rpxsa4iz3wclhcbcm2xr3nd94"
+  },
+  "qtnetworkauth": {
+    "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
+    "rev": "53870ee9bb9117702cd1f11cb1c5d1cfc2d5394a",
+    "sha256": "0idaysqpwrghih7ijrm9hagj9jw3fy9nw539fr4d9rmcggnkkzn2"
+  },
+  "qtpurchasing": {
+    "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
+    "rev": "cbf444fb570ca4f4ca21d963d2ae4010f10d473e",
+    "sha256": "1cki7n62wqm3xxn36mka0y67ngn7jvjkrvr08vsassbjb7kfsmxp"
+  },
+  "qtquick3d": {
+    "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
+    "rev": "3e3e53c834b25dc2959dd30f319d12d6f84ee1e3",
+    "sha256": "1b1khfg26zl3p28yvhwjfldqy3flh10pb5hm5z0av03rz7jy7l8s"
+  },
+  "qtquickcontrols": {
+    "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
+    "rev": "cf3f6d7fec824cdf01f9b329ab3b92b1c0e0a420",
+    "sha256": "1vxp0kwigwhqyyfm0xg8llyd1l1f4l18hmk6xqkm57xpi15x55bc"
+  },
+  "qtquickcontrols2": {
+    "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
+    "rev": "be66bf9a5618c745d2a6ee2262967af6307b3b07",
+    "sha256": "11h3f3rb2kqgsw7njzhjwazw1k03v12i83irjndylafiaqw6c6ks"
+  },
+  "qtquicktimeline": {
+    "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
+    "rev": "67503cdadea43b95ddad0de1a04951aff0ce1a07",
+    "sha256": "0h4b3ibcf6rsmqmcfbwbk9pbvw3b9cac8nx2538aqvnpyyp1vhid"
+  },
+  "qtremoteobjects": {
+    "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
+    "rev": "4d6d1e35fb8e0cb900b5e5e9266edea51dc4f735",
+    "sha256": "1zbxl5jk7x8qklrnbbaikymyviigqdq7vf0wc8gzls4126vcx146"
+  },
+  "qtscript": {
+    "url": "https://invent.kde.org/qt/qt/qtscript.git",
+    "rev": "5cec94b2c1503f106f4ef4778d016410ebb86211",
+    "sha256": "1xdri98cw7m78k9kfb53cgh8wyz98q3i623jhhcv01rvy1zsf8m1"
+  },
+  "qtscxml": {
+    "url": "https://invent.kde.org/qt/qt/qtscxml.git",
+    "rev": "7a15000f42c7a3171719727cd056f82a78244ed7",
+    "sha256": "1i2ajsj9pb1s4lk4djj1h1ay9mkz1z3m75a747cspyc1p1iymipq"
+  },
+  "qtsensors": {
+    "url": "https://invent.kde.org/qt/qt/qtsensors.git",
+    "rev": "921a31375f29e429e95352b08b2b9dbfea663cb1",
+    "sha256": "1ijayk6lf34nwv7s3ib3cfqx9sjrmr1c6jnziwmxa1l6fy3ik4g8"
+  },
+  "qtserialbus": {
+    "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
+    "rev": "8884c5e43df846deac5a0c7c290eeb633d6bfe32",
+    "sha256": "1ydb5x21j26pl58mr6klnwixkqx8h119nvnzvyawz83gji3ay3a5"
+  },
+  "qtserialport": {
+    "url": "https://invent.kde.org/qt/qt/qtserialport.git",
+    "rev": "941d1d8560d1f3e40077c251fbde6fd6a5b0f0d4",
+    "sha256": "0x7ly67gddmz0hqls9109bk4rgaa97ksyv24qk4brrhzkpr7q9cx"
+  },
+  "qtspeech": {
+    "url": "https://invent.kde.org/qt/qt/qtspeech.git",
+    "rev": "a0efc38377e5bf7eed2d354d1cb4d7a0d5dc7e1b",
+    "sha256": "1ljf45f65pfp8x367qnzl0ssz7n17cxhk29qvqpz9z7rh65zqix5"
+  },
+  "qtsvg": {
+    "url": "https://invent.kde.org/qt/qt/qtsvg.git",
+    "rev": "24128cdf8bef53eddf31a5709bbbc46293006b1c",
+    "sha256": "0vinjcbq4saxhlmvb5i93bzgg30qc3j8r2qfwrzaxc4vmfhfgi56"
+  },
+  "qttools": {
+    "url": "https://invent.kde.org/qt/qt/qttools.git",
+    "rev": "33693a928986006d79c1ee743733cde5966ac402",
+    "sha256": "02n0lppsp6g4s9bdvnfxpf7ndkbs9bzm0clcwvirwf2cd8q95a4n"
+  },
+  "qttranslations": {
+    "url": "https://invent.kde.org/qt/qt/qttranslations.git",
+    "rev": "8fbbdf21f127197f97b58c7d80d2fa2a59135638",
+    "sha256": "06r2jb2fsdr5fvxs748war0lr4mm3l3d3b37xc4n73y294vwrmn7"
+  },
+  "qtvirtualkeyboard": {
+    "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
+    "rev": "353b75b2e34bdae901625bbddf5c5e3f3e6c0de5",
+    "sha256": "12nv773zc05yrbai1z6i481yinih0kxcjzgm9pa0580qz69gd9a5"
+  },
+  "qtwayland": {
+    "url": "https://invent.kde.org/qt/qt/qtwayland.git",
+    "rev": "992833ca741efe8f533c61abfaf129a1d8bfcfee",
+    "sha256": "1w8mq38k6s0fncqv113bw1pc7g10ysfmsbyg23hxh9fr5q4ia4q7"
+  },
+  "qtwebchannel": {
+    "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
+    "rev": "47be9a51b01d9fd9e7f6dca81e98d4eedcec6d38",
+    "sha256": "167rp43c86xr4grzxs4bl46y6sf1q9xa0641mgp4r94g2ipxyc1d"
+  },
+  "qtwebglplugin": {
+    "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
+    "rev": "550a8cee241bbf8c11863dec9587d579dcb1108b",
+    "sha256": "0p1y0b8zsm7rrkhhylndp282ghgki2cjrgc4n5zhjn732ahxg515"
+  },
+  "qtwebsockets": {
+    "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
+    "rev": "e7883bc64440b1ff4666272ac6eb710ee4bc221b",
+    "sha256": "1rj99y1f0wn6g1m2k53xkni5v79zgq25yv8b9wx2bz0n2r9iasca"
+  },
+  "qtwebview": {
+    "url": "https://invent.kde.org/qt/qt/qtwebview.git",
+    "rev": "920de5f1cd9f9001cfef1bfd2c19e6720793362f",
+    "sha256": "04hnqalabhypkd2hgl45jxf9p1p6dgjwlc5b7gs4f6588lafgd3f"
+  },
+  "qtwinextras": {
+    "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
+    "rev": "3df03dab21f3e84d5a7274c64dd879854ca1bfe7",
+    "sha256": "12dkw982xcm7hxw3lxhg34wny4srbickxm9s3nz7bdyp9dmqnygx"
+  },
+  "qtx11extras": {
+    "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
+    "rev": "3898f5484fd4864b047729bfeda9a1222f32364f",
+    "sha256": "04rp8arml19b03iybd7sa78dsdv7386m9ymmgqciwl13dhwjssra"
+  },
+  "qtxmlpatterns": {
+    "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
+    "rev": "189e28d0aff1f3d7960228ba318b83e3cadac98c",
+    "sha256": "0vs9j2i1dnlivcrzz175zz66ql1m8mrdqkglvyqjqv6cb7mpskrq"
+  }
+}
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@ -1,342 +1,72 @@
-# DO NOT EDIT! This file is generated automatically.
-# Command: ./maintainers/scripts/fetch-kde-qt.sh pkgs/development/libraries/qt-5/5.15
-{ fetchurl, mirror }:
+{ lib, fetchgit, fetchFromGitHub }:

-{
-  qt3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qt3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "03ed6a48c813c75296c19f5d721184ab168280b69d2656cf16f877d3d4c55c1d";
-      name = "qt3d-everywhere-src-5.15.2.tar.xz";
-    };
+let
+  version = "5.15.3";
+  overrides = {
+    qtscript.version = "5.15.4";
  };
-  qtactiveqt = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtactiveqt-everywhere-src-5.15.2.tar.xz";
-      sha256 = "868161fee0876d17079cd5bed58d1667bf19ffd0018cbe515129f11510ad2a5c";
-      name = "qtactiveqt-everywhere-src-5.15.2.tar.xz";
+
+  mk = name: args:
+    let
+      override = overrides.${name} or {};
+    in
+    {
+      version = override.version or version;
+      src = override.src or
+        fetchgit {
+          inherit (args) url rev sha256;
+          fetchLFS = false;
+          fetchSubmodules = false;
+          deepClone = false;
+          leaveDotGit = false;
+        };
    };
-  };
-  qtandroidextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtandroidextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "5813278690d89a9c232eccf697fc280034de6f9f02a7c40d95ad5fcf8ac8dabd";
-      name = "qtandroidextras-everywhere-src-5.15.2.tar.xz";
+in
+lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
+// {
+  # qtwebkit does not have an official release tarball on the qt mirror and is
+  # mostly maintained by the community.
+  qtwebkit = rec {
+    src = fetchFromGitHub {
+      owner = "qt";
+      repo = "qtwebkit";
+      rev = "v${version}";
+      sha256 = "0x8rng96h19xirn7qkz3lydal6v4vn00bcl0s3brz36dfs0z8wpg";
    };
+    version = "5.212.0-alpha4";
  };
-  qtbase = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtbase-everywhere-src-5.15.2.tar.xz";
-      sha256 = "909fad2591ee367993a75d7e2ea50ad4db332f05e1c38dd7a5a274e156a4e0f8";
-      name = "qtbase-everywhere-src-5.15.2.tar.xz";
+
+  qtwebengine =
+    let
+      branchName = "5.15.6";
+      rev = "v${branchName}-lts";
+    in
+    {
+      version = "${branchName}-${lib.substring 0 7 rev}";
+
+      src = fetchgit {
+        url = "https://github.com/qt/qtwebengine.git";
+        sha256 = "17bw9yf04zmr9ck5jkrd435c8b03zpf937vn2nwgsr8p78wkg3kr";
+        inherit rev branchName;
+        fetchSubmodules = true;
+        leaveDotGit = true;
+        name = "qtwebengine-${lib.substring 0 7 rev}.tar.gz";
+        postFetch = ''
+          # remove submodule .git directory
+          rm -rf "$out/src/3rdparty/.git"
+
+          # compress to not exceed the 2GB output limit
+          # try to make a deterministic tarball
+          tar -I 'gzip -n' \
+            --sort=name \
+            --mtime=1970-01-01 \
+            --owner=root --group=root \
+            --numeric-owner --mode=go=rX,u+rw,a-s \
+            --transform='s@^@source/@' \
+            -cf temp  -C "$out" .
+          rm -r "$out"
+          mv temp "$out"
+        '';
+      };
    };
-  };
-  qtcharts = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtcharts-everywhere-src-5.15.2.tar.xz";
-      sha256 = "e0750e4195bd8a8b9758ab4d98d437edbe273cd3d289dd6a8f325df6d13f3d11";
-      name = "qtcharts-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtconnectivity = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtconnectivity-everywhere-src-5.15.2.tar.xz";
-      sha256 = "0380327871f76103e5b8c2a305988d76d352b6a982b3e7b3bc3cdc184c64bfa0";
-      name = "qtconnectivity-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdatavis3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdatavis3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "226a6575d573ad78aca459709722c496c23aee526aa0c38eb7c93b0bea1eb6fd";
-      name = "qtdatavis3d-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdeclarative = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdeclarative-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c600d09716940f75d684f61c5bdaced797f623a86db1627da599027f6c635651";
-      name = "qtdeclarative-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtdoc = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtdoc-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a47809f00f1bd690ca4e699cb32ffe7717d43da84e0167d1f562210da7714ce4";
-      name = "qtdoc-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtgamepad = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtgamepad-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c77611f7898326d69176ad67a9b886f617cdedc368ec29f223d63537d25b075c";
-      name = "qtgamepad-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtgraphicaleffects = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtgraphicaleffects-everywhere-src-5.15.2.tar.xz";
-      sha256 = "ec8d67f64967d5046410490b549c576f9b9e8b47ec68594ae84aa8870173dfe4";
-      name = "qtgraphicaleffects-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtimageformats = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtimageformats-everywhere-src-5.15.2.tar.xz";
-      sha256 = "bf8285c7ce04284527ab823ddc7cf48a1bb79131db3a7127342167f4814253d7";
-      name = "qtimageformats-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtlocation = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtlocation-everywhere-src-5.15.2.tar.xz";
-      sha256 = "984fcb09e108df49a8dac35d5ce6dffc49caafd2acb1c2f8a5173a6a21f392a0";
-      name = "qtlocation-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtlottie = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtlottie-everywhere-src-5.15.2.tar.xz";
-      sha256 = "cec6095ab8f714e609d2ad3ea8c4fd819461ce8793adc42abe37d0f6dc432517";
-      name = "qtlottie-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtmacextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtmacextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "6959b0f2cec71cd66800f36cab797430860e55fa33c9c23698d6a08fc2b8776e";
-      name = "qtmacextras-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtmultimedia = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtmultimedia-everywhere-src-5.15.2.tar.xz";
-      sha256 = "0c3758810e5131aabcf76e4965e4c18b8911af54d9edd9305d2a8278d8346df5";
-      name = "qtmultimedia-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtnetworkauth = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtnetworkauth-everywhere-src-5.15.2.tar.xz";
-      sha256 = "fcc2ec42faa68561efa8f00cd72e662fbc06563ebc6de1dc42d96bb2997acd85";
-      name = "qtnetworkauth-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtpurchasing = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtpurchasing-everywhere-src-5.15.2.tar.xz";
-      sha256 = "87120d319ff2f8106e78971f7296d72a66dfe91e763d213199aea55046e93227";
-      name = "qtpurchasing-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquick3d = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquick3d-everywhere-src-5.15.2.tar.xz";
-      sha256 = "5b0546323365ce34e4716f22f305ebb4902e222c1a0910b65ee448443c2f94bb";
-      name = "qtquick3d-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquickcontrols = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquickcontrols-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c393fb7384b1f047f10e91a6832cf3e6a4c2a41408b8cb2d05af2283e8549fb5";
-      name = "qtquickcontrols-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquickcontrols2 = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquickcontrols2-everywhere-src-5.15.2.tar.xz";
-      sha256 = "671b6ce5f4b8ecc94db622d5d5fb29ef4ff92819be08e5ea55bfcab579de8919";
-      name = "qtquickcontrols2-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtquicktimeline = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtquicktimeline-everywhere-src-5.15.2.tar.xz";
-      sha256 = "b9c247227607437acec7c7dd18ad46179d20369c9d22bdb1e9fc128dfb832a28";
-      name = "qtquicktimeline-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtremoteobjects = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtremoteobjects-everywhere-src-5.15.2.tar.xz";
-      sha256 = "6781b6bc90888254ea77ce812736dac00c67fa4eeb3095f5cd65e4b9c15dcfc2";
-      name = "qtremoteobjects-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtscript = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtscript-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a299715369afbd1caa4d7fa2875d442eab91adcaacafce54a36922442624673e";
-      name = "qtscript-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtscxml = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtscxml-everywhere-src-5.15.2.tar.xz";
-      sha256 = "60b9590b9a41c60cee7b8a8c8410ee4625f0389c1ff8d79883ec5a985638a7dc";
-      name = "qtscxml-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtsensors = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtsensors-everywhere-src-5.15.2.tar.xz";
-      sha256 = "3f0011f9e9942cad119146b54d960438f4568a22a274cdad4fae06bb4e0e4839";
-      name = "qtsensors-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtserialbus = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtserialbus-everywhere-src-5.15.2.tar.xz";
-      sha256 = "aeeb7e5c0d3f8503215b22e1a84c0002ca67cf63862f6e3c6ef44a67ca31bd88";
-      name = "qtserialbus-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtserialport = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtserialport-everywhere-src-5.15.2.tar.xz";
-      sha256 = "59c559d748417306bc1b2cf2315c1e63eed011ace38ad92946af71f23e2ef79d";
-      name = "qtserialport-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtspeech = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtspeech-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c810fb9eecb08026434422a32e79269627f3bc2941be199e86ec410bdfe883f5";
-      name = "qtspeech-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtsvg = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtsvg-everywhere-src-5.15.2.tar.xz";
-      sha256 = "8bc3c2c1bc2671e9c67d4205589a8309b57903721ad14c60ea21a5d06acb585e";
-      name = "qtsvg-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qttools = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qttools-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c189d0ce1ff7c739db9a3ace52ac3e24cb8fd6dbf234e49f075249b38f43c1cc";
-      name = "qttools-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qttranslations = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qttranslations-everywhere-src-5.15.2.tar.xz";
-      sha256 = "d5788e86257b21d5323f1efd94376a213e091d1e5e03b45a95dd052b5f570db8";
-      name = "qttranslations-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtvirtualkeyboard = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtvirtualkeyboard-everywhere-src-5.15.2.tar.xz";
-      sha256 = "9a3193913be30f09a896e3b8c2f9696d2e9b3f88a63ae9ca8c97a2786b68cf55";
-      name = "qtvirtualkeyboard-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwayland = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwayland-everywhere-src-5.15.2.tar.xz";
-      sha256 = "193732229ff816f3aaab9a5e2f6bed71ddddbf1988ce003fe8dd84a92ce9aeb5";
-      name = "qtwayland-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebchannel = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebchannel-everywhere-src-5.15.2.tar.xz";
-      sha256 = "127fe79c43b386713f151ed7d411cd81e45e29f9c955584f29736f78c9303ec1";
-      name = "qtwebchannel-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebengine = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebengine-everywhere-src-5.15.2.tar.xz";
-      sha256 = "c8afca0e43d84f7bd595436fbe4d13a5bbdb81ec5104d605085d07545b6f91e0";
-      name = "qtwebengine-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebglplugin = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebglplugin-everywhere-src-5.15.2.tar.xz";
-      sha256 = "81e782b517ed29e10bea1aa90c9f59274c98a910f2c8b105fa78368a36b41446";
-      name = "qtwebglplugin-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebsockets = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebsockets-everywhere-src-5.15.2.tar.xz";
-      sha256 = "a0b42d85dd34ff6e2d23400e02f83d8b85bcd80e60efd1521d12d9625d4a233f";
-      name = "qtwebsockets-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwebview = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwebview-everywhere-src-5.15.2.tar.xz";
-      sha256 = "be9f46167e4977ead5ef5ecf883fdb812a4120f2436383583792f65557e481e7";
-      name = "qtwebview-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtwinextras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtwinextras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "65b8272005dec00791ab7d81ab266d1e3313a3bbd8e54e546d984cf4c4ab550e";
-      name = "qtwinextras-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtx11extras = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtx11extras-everywhere-src-5.15.2.tar.xz";
-      sha256 = "7014702ee9a644a5a93da70848ac47c18851d4f8ed622b29a72eed9282fc6e3e";
-      name = "qtx11extras-everywhere-src-5.15.2.tar.xz";
-    };
-  };
-  qtxmlpatterns = {
-    version = "5.15.2";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.15/5.15.2/submodules/qtxmlpatterns-everywhere-src-5.15.2.tar.xz";
-      sha256 = "76ea2162a7c349188d7e7e4f6c77b78e8a205494c90fee3cea3487a1ae2cf2fa";
-      name = "qtxmlpatterns-everywhere-src-5.15.2.tar.xz";
-    };
-  };
 }
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@ -115,6 +115,8 @@ stdenv.mkDerivation {
    sed -i '/PATHS.*NO_DEFAULT_PATH/ d' src/corelib/Qt5CoreMacros.cmake
    sed -i 's/NO_DEFAULT_PATH//' src/gui/Qt5GuiConfigExtras.cmake.in
    sed -i '/PATHS.*NO_DEFAULT_PATH/ d' mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+  '' + lib.optionalString (compareVersion "5.15.0" >= 0) ''
+    patchShebangs ./bin
  '' + (
    if stdenv.isDarwin then ''
        sed -i \
@ -149,6 +151,8 @@ stdenv.mkDerivation {
    ''}

    NIX_CFLAGS_COMPILE+=" -DNIXPKGS_QT_PLUGIN_PREFIX=\"$qtPluginPrefix\""
+  '' + lib.optionalString (compareVersion "5.15.0" >= 0) ''
+    ./bin/syncqt.pl -version $version
  '';

  postConfigure = ''
--- a/pkgs/development/libraries/qt-5/qtModule.nix
+++ b/pkgs/development/libraries/qt-5/qtModule.nix
@ -31,6 +31,23 @@ mkDerivation (args // {
    ${args.preConfigure or ""}

    fixQtBuiltinPaths . '*.pr?'
+  '' + lib.optionalString (builtins.compareVersions "5.15.0" version <= 0)
+  # Note: We use ${version%%-*} to remove any tag from the end of the version
+  # string. Version tags are added by Nixpkgs maintainers and not reflected in
+  # the source version.
+  ''
+    if [[ -z "$dontCheckQtModuleVersion" ]] \
+        && grep -q '^MODULE_VERSION' .qmake.conf 2>/dev/null \
+        && ! grep -q -F "''${version%%-*}" .qmake.conf 2>/dev/null
+    then
+      echo >&2 "error: could not find version ''${version%%-*} in .qmake.conf"
+      echo >&2 "hint: check .qmake.conf and update the package version in Nixpkgs"
+      exit 1
+    fi
+
+    if [[ -z "$dontSyncQt" && -f sync.profile ]]; then
+      syncqt.pl -version "''${version%%-*}"
+    fi
  '';

  dontWrapQtApps = args.dontWrapQtApps or true;
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@ -1,19 +1,26 @@
 { lib, stdenv, fetchFromGitHub, cmake
+, fetchpatch
 , static ? stdenv.hostPlatform.isStatic
 }:

 stdenv.mkDerivation rec {
  pname = "snappy";
-  version = "1.1.8";
+  version = "1.1.9";

  src = fetchFromGitHub {
    owner = "google";
    repo = "snappy";
    rev = version;
-    sha256 = "1j0kslq2dvxgkcxl1gakhvsa731yrcvcaipcp5k8k7ayicvkv9jv";
+    sha256 = "sha256-JXWl63KVP+CDNWIXYtz+EKqWLJbPKl3ifhr8dKAp/w8=";
  };

-  patches = [ ./disable-benchmark.patch ];
+  patches = [
+    (fetchpatch {
+      name = "clang-7-compat.patch";
+      url = "https://github.com/google/snappy/pull/142/commits/658cb2fcf67b626fff2122a3dbf7a3560c58f7ee.patch";
+      sha256 = "1kg3lxjwmhc7gjx36nylilnf444ddbnr3px1wpvyc6l1nh6zh4al";
+    })
+  ];

  outputs = [ "out" "dev" ];

@ -22,16 +29,28 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
+    "-DSNAPPY_BUILD_TESTS=OFF"
+    "-DSNAPPY_BUILD_BENCHMARKS=OFF"
  ];

  postInstall = ''
    substituteInPlace "$out"/lib/cmake/Snappy/SnappyTargets.cmake \
      --replace 'INTERFACE_INCLUDE_DIRECTORIES "''${_IMPORT_PREFIX}/include"' 'INTERFACE_INCLUDE_DIRECTORIES "'$dev'"'
+
+    mkdir -p $dev/lib/pkgconfig
+    cat <<EOF > $dev/lib/pkgconfig/snappy.pc
+      Name: snappy
+      Description: Fast compressor/decompressor library.
+      Version: ${version}
+      Libs: -L$out/lib -lsnappy
+      Cflags: -I$dev/include
+    EOF
  '';

-  checkTarget = "test";
+  #checkTarget = "test";

-  doCheck = true;
+  # requires gbenchmark and gtest but it also installs them out $dev
+  doCheck = false;

  meta = with lib; {
    homepage = "https://google.github.io/snappy/";
--- a/pkgs/development/libraries/snappy/disable-benchmark.patch
+++ b/pkgs/development/libraries/snappy/disable-benchmark.patch
@ -1,5 +0,0 @@
--- a/snappy-test.cc
-+++ b/snappy-test.cc
-@@ -46 +46 @@
-DEFINE_bool(run_microbenchmarks, true,
-+DEFINE_bool(run_microbenchmarks, false,
--- a/pkgs/development/libraries/srtp/default.nix
+++ b/pkgs/development/libraries/srtp/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "libsrtp";
-  version = "2.4.0";
+  version = "2.4.2";

  src = fetchFromGitHub {
    owner = "cisco";
    repo = "libsrtp";
    rev = "v${version}";
-    sha256 = "0syl2ywddgqz29h43d6rc7waf3hp2yc14yhnrvdsja2bg8wrv6sb";
+    sha256 = "sha256-6FAkfxC7Tg7uIAmTmRt5Sn8/YofILfpe7Y4pSaq8XL8=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/xalanc/default.nix
+++ b/pkgs/development/libraries/xalanc/default.nix
@ -22,6 +22,15 @@ in stdenv.mkDerivation rec {

  buildInputs = [ xercesc getopt ];

+  # Parallel build fails as:
+  #   c++ ... -c ... ExecutionContext.cpp
+  #   ProblemListenerBase.hpp:28:10: fatal error: LocalMsgIndex.hpp: No such file or directory
+  # The build failure happens due to missing intra-project dependencies
+  # against generated headers. Future 1.12 version dropped
+  # autotools-based build system. Let's disable parallel builds until
+  # next release.
+  enableParallelBuilding = false;
+
  meta = {
    homepage = "http://xalan.apache.org/";
    description = "A XSLT processor for transforming XML documents";
--- a/pkgs/development/python-modules/Nikola/default.nix
+++ b/pkgs/development/python-modules/Nikola/default.nix
@ -30,7 +30,7 @@
 , pytestCheckHook
 , pythonOlder
 , requests
-, ruamel_yaml
+, ruamel-yaml
 , stdenv
 , toml
 , typogrify
@ -75,7 +75,7 @@ buildPythonPackage rec {
    pyphen
    PyRSS2Gen
    requests
-    ruamel_yaml
+    ruamel-yaml
    toml
    typogrify
    unidecode
--- a/pkgs/development/python-modules/argon2_cffi/default.nix
+++ b/pkgs/development/python-modules/argon2_cffi/default.nix
@ -8,19 +8,25 @@
 , fetchPypi
 , isPy3k
 , lib
+, stdenv
 }:

 buildPythonPackage rec {
  pname = "argon2_cffi";
-  version = "20.1.0";
+  version = "21.1.0";

  src = fetchPypi {
    pname = "argon2-cffi";
    inherit version;
-    sha256 = "0zgr4mnnm0p4i99023safb0qb8cgvl202nly1rvylk2b7qnrn0nq";
+    sha256 = "sha256-9xC2EQPRofaSyj7L0Tc+KKpeVFrGJboGf/L+yhsruHA=";
  };

  propagatedBuildInputs = [ cffi six ] ++ lib.optional (!isPy3k) enum34;
+
+  propagatedNativeBuildInputs = [ cffi ];
+
+  ARGON2_CFFI_USE_SSE2 = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) "0";
+
  checkInputs = [ hypothesis pytest wheel ];
  checkPhase = ''
    pytest tests
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@ -1,27 +1,29 @@
-{ stdenv
+{ lib
+, stdenv
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
-, lib
 }:

 buildPythonPackage rec {
-  version = "3.3.4";
+  version = "3.4.1";
  pname = "asgiref";

-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "django";
    repo = pname;
    rev = version;
-    sha256 = "1rr76252l6p12yxc0q4k9wigg1jz8nsqga9c0nixy9q77zhvh9n2";
+    sha256 = "sha256-aXD46qH5sTTmp0rlzQGLAN+MfIz1u6obCwtfqoIYgBA=";
  };

-  propagatedBuildInputs = [ async-timeout ];
+  propagatedBuildInputs = [
+    async-timeout
+  ];

  checkInputs = [
    pytestCheckHook
@ -32,9 +34,12 @@ buildPythonPackage rec {
    "test_multiprocessing"
  ];

+  pythonImportsCheck = [ "asgiref" ];
+
  meta = with lib; {
    description = "Reference ASGI adapters and channel layers";
-    license = licenses.bsd3;
    homepage = "https://github.com/django/asgiref";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/bcrypt/default.nix
+++ b/pkgs/development/python-modules/bcrypt/default.nix
@ -15,6 +15,8 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ six ] ++ lib.optional (!isPyPy) cffi;

+  propagatedNativeBuildInputs = lib.optional (!isPyPy) cffi;
+
  meta = with lib; {
    maintainers = with maintainers; [ domenkozar ];
    description = "Modern password hashing for your software and your servers";
--- a/pkgs/development/python-modules/brotlicffi/default.nix
+++ b/pkgs/development/python-modules/brotlicffi/default.nix
@ -22,6 +22,10 @@ buildPythonPackage rec {
    brotli
  ];

+  propagatedNativeBuildInputs = [
+    cffi
+  ];
+
  propagatedBuildInputs = [
    cffi
  ];
--- a/pkgs/development/python-modules/brotlipy/default.nix
+++ b/pkgs/development/python-modules/brotlipy/default.nix
@ -19,6 +19,8 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ cffi enum34 construct ];

+  propagatedNativeBuildInputs = [ cffi ];
+
  checkInputs = [ pytest hypothesis ];

  checkPhase = ''
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@ -8,7 +8,6 @@
 , makeFontsConf
 , freefont_ttf
 , pytest
-, pytest-runner
 , glibcLocales
 , cairo
 , cffi
--- a/Show more
+++ b/Show more