Merge #185426: staging-next 2022-08-06

2022-08-16 10:43:39 +02:00 · 2022-08-16 10:43:39 +02:00 · 6c6409e965
parent 985524984f 6bc8523e85
commit 6c6409e965
67 changed files with 452 additions and 435 deletions
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.0115";
+  version = "9.0.0135";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "sha256-McotjgjN+ze1jdaAxkdJGTqIIIuOlHENriHdMrYSf5w=";
+    sha256 = "sha256-xAIfGNJIPO9XoSbAQTRa36Tjln3y+oWQk0lADCnL25g=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/kde/messagelib.nix
+++ b/pkgs/applications/kde/messagelib.nix
@ -1,5 +1,6 @@
 {
  mkDerivation, lib, kdepimTeam,
+  cmake_3_23,
  extra-cmake-modules, kdoctools,
  akonadi, akonadi-mime, akonadi-notes, akonadi-search, gpgme, grantlee,
  grantleetheme, karchive, kcodecs, kconfig, kconfigwidgets, kcontacts,
@ -14,7 +15,7 @@ mkDerivation {
    license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
    maintainers = kdepimTeam;
  };
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  nativeBuildInputs = [ (extra-cmake-modules.override { cmake = cmake_3_23; }) kdoctools ];
  buildInputs = [
    akonadi-notes akonadi-search gpgme grantlee grantleetheme karchive kcodecs
    kconfig kconfigwidgets kiconthemes kio kjobwidgets kldap
--- a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
@ -36,11 +36,6 @@ buildPythonApplication rec {
      -e '/asyncio/d' \
      -e '/datetime/d' \
      setup.cfg requirements.txt
-
-    # Dependencies not correctly detected
-    sed -i \
-      -e '/dbus-python/d' \
-      setup.cfg requirements.txt
  '';

  propagatedBuildInputs = [
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@ -53,14 +53,9 @@ stdenv.mkDerivation rec {
    # disable the included zlib explicitly as it otherwise still compiles and
    # links them even.
    "--with-included-zlib=no"
-  ]
-  # Work around issue with cross-compilation:
-  #     configure.sh: error: cannot run test program while cross compiling
-  # Remove once 3.2.4 or more recent is released.
-  # The following PR should fix the cross-compilation issue.
-  # Test using `nix-build -A pkgsCross.aarch64-multiplatform.rsync`.
-  # https://github.com/WayneD/rsync/commit/b7fab6f285ff0ff3816b109a8c3131b6ded0b484
-  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--enable-simd=no";
+  ];
+
+  enableParallelBuilding = true;

  passthru.tests = { inherit (nixosTests) rsyncd; };

--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@ -50,9 +50,6 @@ python3.pkgs.buildPythonApplication rec {

  postPatch = ''
    patchShebangs tests po
-    # dbus-python is correctly passed in propagatedBuildInputs, but for some reason setup.py complains.
-    # The wrapped terminator has the correct path added, so ignore this.
-    substituteInPlace setup.py --replace "'dbus-python'," ""
  '';

  doCheck = false;
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchpatch
 , fetchurl
 , tzdata
 , iana-etc
@ -56,11 +55,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.18.4";
+  version = "1.18.5";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-RSWqaw487LV4RfQGCnB1qvyat1K7e2tM+KIS1DB44eQ=";
+    sha256 = "sha256-mSDTMGoaxTbN0seW1ss8VLxVnCJvw8w5wy8eC9f1DSo=";
  };

  strictDeps = true;
@ -168,11 +167,7 @@ stdenv.mkDerivation rec {
    touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
  '';

-  patches = let
-    fetchBase64Patch = args: (fetchpatch args).overrideAttrs (o: {
-      postFetch = "mv $out p; base64 -d p > $out; " + o.postFetch;
-    });
-  in [
+  patches = [
    ./remove-tools-1.11.patch
    ./ssl-cert-file-1.16.patch
    ./remove-test-pie-1.15.patch
@ -182,12 +177,6 @@ stdenv.mkDerivation rec {
    ./skip-nohup-tests.patch
    ./skip-cgo-tests-1.15.patch
    ./go_no_vendor_checks-1.16.patch
-
-    # https://go-review.googlesource.com/c/go/+/417615/
-    (fetchBase64Patch {
-      url = "https://go-review.googlesource.com/changes/go~417615/revisions/3/patch";
-      sha256 = "sha256-Gu5eZUwGGch7et75A/BNynbs4VlQUBClVUxjxPkdjOs=";
-    })
  ];

  postPatch = ''
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@ -198,14 +198,14 @@ let
      priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
    };
  } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "31dac3e264a7f1f53dbf49570771123ebd514055"; # May 03, 2022
+    crossVersion = "c876045741f5159318085d2737b0090f35a842ca"; # June 5, 2022

    perl-cross-src = fetchFromGitHub {
      name = "perl-cross-unstable-${crossVersion}";
      owner = "arsv";
      repo = "perl-cross";
      rev = crossVersion;
-      sha256 = "sha256-5hLUP34WwTFRsG0o8zSJm8WM3WfBAhHeYrrQF2MtMKc=";
+      sha256 = "sha256-m9UCoTQgXBxSgk9Q1Zv6wl3Qnd0aZm/jEPXkcMKti8U=";
    };

    depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@ -222,14 +222,6 @@ let
    setupHook = ./setup-hook-cross.sh;
  });
 in {
-  # Maint version
-  perl532 = common {
-    perl = pkgs.perl532;
-    buildPerl = buildPackages.perl532;
-    version = "5.32.1";
-    sha256 = "0b7brakq9xs4vavhg391as50nbhzryc7fy5i65r81bnq3j897dh3";
-  };
-
  # Maint version
  perl534 = common {
    perl = pkgs.perl534;
@ -238,11 +230,19 @@ in {
    sha256 = "sha256-NXlRpJGwuhzjYRJjki/ux4zNWB3dwkpEawM+JazyQqE=";
  };

+  # Maint version
+  perl536 = common {
+    perl = pkgs.perl536;
+    buildPerl = buildPackages.perl536;
+    version = "5.36.0";
+    sha256 = "sha256-4mCFr4rDlvYq3YpTPDoOqMhJfYNvBok0esWr17ek4Ao=";
+  };
+
  # the latest Devel version
  perldevel = common {
    perl = pkgs.perldevel;
    buildPerl = buildPackages.perldevel;
-    version = "5.35.9";
-    sha256 = "sha256-/nmSCIIXHXoC68DxFM9b5GM2AKU4WlLbfWLgduanL7U=";
+    version = "5.37.0";
+    sha256 = "sha256-8RQO6gtH+WmghqzRafbqAH1MhKv/vJCcvysi7/+T9XI=";
  };
 }
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -140,10 +140,10 @@ with pkgs;
      sourceVersion = {
        major = "3";
        minor = "10";
-        patch = "5";
+        patch = "6";
        suffix = "";
      };
-      sha256 = "sha256-hDfv1bEG7wp1qr+/I9iAYlEgpzqGoireTS4uaNe3RIY=";
+      sha256 = "sha256-95X/h9EdSwx8M7yIUbDChkjYpFg6ohAKmMIrQya20/M=";
    };
  };

--- a/pkgs/development/libraries/SDL/default.nix
+++ b/pkgs/development/libraries/SDL/default.nix
@ -104,6 +104,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/libsdl-org/SDL-1.2/commit/7933032ad4d57c24f2230db29f67eb7d21bb5654.patch";
      sha256 = "1by16firaxyr0hjvn35whsgcmq6bl0nwhnpjf75grjzsw9qvwyia";
    })
+    (fetchpatch {
+      name = "CVE-2022-34568.patch";
+      url = "https://github.com/libsdl-org/SDL-1.2/commit/d7e00208738a0bc6af302723fe64908ac35b777b.patch";
+      sha256 = "sha256-fuxXsqZW94/C8CKu9LakppCU4zHupj66O2MngQ4BO9o=";
+    })
  ];

  postInstall = ''
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@ -62,6 +62,15 @@ in stdenv.mkDerivation rec {
      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/e22d7212acb454daccc088619ee147af03883974.diff";
      sha256 = "sha256-8G98nsPz3MLEWPDX9F0jKgXC4hC4NNdFQLSpmW3ay2s=";
    })
+
+    # Fix unexpected color addition on grayscale images (usually text).
+    # Upstream fix: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114
+    # Can be removed after 1.18 release
+    (fetchpatch {
+      name = "fix-grayscale-anialias.patch";
+      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/4f4d89506f58a64b4829b1bb239bab9e46d63727.diff";
+      sha256 = "sha256-mbTg67e7APfdELsuMAgXdY3xokWbGtHF7VDD5UyYqKM=";
+    })
  ];

  outputs = [ "out" "dev" "devdoc" ];
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@ -5,7 +5,7 @@
 , pkg-config
 , expat
 , enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
-, systemd
+, systemdMinimal
 , audit
 , libapparmor
 , dbus
@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
      libX11
      libICE
      libSM
-    ]) ++ lib.optional enableSystemd systemd
+    ]) ++ lib.optional enableSystemd systemdMinimal
    ++ lib.optionals stdenv.isLinux [ audit libapparmor ];
  # ToDo: optional selinux?

@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
    "--with-systemduserunitdir=${placeholder "out"}/etc/systemd/user"
  ] ++ lib.optional (!x11Support) "--without-x"
  ++ lib.optionals stdenv.isLinux [ "--enable-apparmor" "--enable-libaudit" ]
-  ++ lib.optionals enableSystemd [ "SYSTEMCTL=${systemd}/bin/systemctl" ];
+  ++ lib.optionals enableSystemd [ "SYSTEMCTL=${systemdMinimal}/bin/systemctl" ];

  NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-Wl,--as-needed";

--- a/pkgs/development/libraries/freeglut/default.nix
+++ b/pkgs/development/libraries/freeglut/default.nix
@ -1,23 +1,14 @@
-{ lib, stdenv, fetchurl, fetchpatch, libXi, libXrandr, libXxf86vm, libGL, libGLU, xlibsWrapper, cmake }:
+{ lib, stdenv, fetchurl, libXi, libXrandr, libXxf86vm, libGL, libGLU, xlibsWrapper, cmake }:

 stdenv.mkDerivation rec {
  pname = "freeglut";
-  version = "3.2.1";
+  version = "3.2.2";

  src = fetchurl {
    url = "mirror://sourceforge/freeglut/freeglut-${version}.tar.gz";
-    sha256 = "0s6sk49q8ijgbsrrryb7dzqx2fa744jhx1wck5cz5jia2010w06l";
+    sha256 = "sha256-xZRKCC3wu6lrV1bd2x910M1yzie1OVxsHd6Fwv8pelA=";
  };

-  patches = [
-    (fetchpatch {
-      # upstream build fix against -fno-common compilers like >=gcc-10
-      url = "https://github.com/dcnieho/FreeGLUT/commit/b9998bbc1e1c329f6bf69c24606a2be7a4973b8c.patch";
-      sha256 = "0j43vrnm22mz3r3c43szgcnil19cx9vcydzky9gwzqlyacr51swd";
-      stripLen = 2;
-    })
-  ];
-
  outputs = [ "out" "dev" ];

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/libass/default.nix
+++ b/pkgs/development/libraries/libass/default.nix
@ -11,11 +11,11 @@ assert fontconfigSupport -> fontconfig != null;
 with lib;
 stdenv.mkDerivation rec {
  pname = "libass";
-  version = "0.15.2";
+  version = "0.16.0";

  src = fetchurl {
    url = "https://github.com/libass/libass/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-G+LfnESFpX14uxjAqO0Ve8h6Wo3UjGYZYcYlyxEoMv0=";
+    sha256 = "sha256-Xb3p4iM5EZz47tWe6mxiOgdG71qQtonmigkBCQeOPAg=";
  };

  configureFlags = [
--- a/pkgs/development/libraries/libdrm/cross-build-nm-path.patch
+++ b/pkgs/development/libraries/libdrm/cross-build-nm-path.patch
@ -1,47 +0,0 @@
-From 9e05fece7918edce9c6aa5a1f1ea375108e5b2be Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Fri, 2 Aug 2019 10:26:37 +0100
-Subject: [PATCH] meson: support for custom nm path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When cross-compiling target toolchains i.e. binutils are often
-prefixed by its target architecture. This patch gives the user
-to option to specify the nm used during the build process.
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
---
- meson.build       | 2 +-
- meson_options.txt | 6 ++++++
- 2 files changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
--- meson.build.orig	2020-06-18 11:13:57.716321962 +0200
-+++ meson.build	2020-06-18 11:19:50.456861311 +0200
-@@ -45,7 +45,7 @@
- cc = meson.get_compiler('c')
-
- symbols_check = find_program('symbols-check.py')
-prog_nm = find_program('nm')
-+prog_nm = find_program(get_option('nm-path'))
-
- # Check for atomics
- intel_atomics = false
-diff --git a/meson_options.txt b/meson_options.txt
-index 8af33f1c..b4f46a52 100644
--- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -141,3 +141,9 @@ option(
-   value : false,
-   description : 'Enable support for using udev instead of mknod.',
- )
-+option(
-+  'nm-path',
-+  type : 'string',
-+  description : 'path to nm',
-+  value : 'nm'
-+)
-- 
-2.22.0
-
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@ -18,10 +18,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ libpthreadstubs libpciaccess ]
    ++ lib.optional withValgrind valgrind-light;

-  patches = [ ./cross-build-nm-path.patch ];
-
  mesonFlags = [
-    "-Dnm-path=${stdenv.cc.targetPrefix}nm"
    "-Dinstall-test-programs=true"
    "-Domap=true"
  ] ++ lib.optionals stdenv.hostPlatform.isAarch [
--- a/pkgs/development/libraries/libdvdread/default.nix
+++ b/pkgs/development/libraries/libdvdread/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libdvdread";
-  version = "6.1.2";
+  version = "6.1.3";

  src = fetchurl {
    url = "http://get.videolan.org/libdvdread/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-zBkPVTdYztdXGFnjAfgCy0gh8WTQK/rP0yDBSk4Np2M=";
+    sha256 = "sha256-zjVFSZeiCMvlDpEjLw5z+xrDRxllgToTuHMKjxihU2k=";
  };

  buildInputs = [libdvdcss];
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@ -8,23 +8,26 @@
 , openssl
 , udev
 , zlib
+, pcsclite
 }:

 stdenv.mkDerivation rec {
  pname = "libfido2";
-  version = "1.10.0";
+  version = "1.11.0";

  # releases on https://developers.yubico.com/libfido2/Releases/ are signed
  src = fetchurl {
    url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Um79PVavcGwF0J89IfGO47CxWsDB9cXaGsvCfCcwuZs=";
+    sha256 = "sha256-CDDFhT47RAmalxZuDOxUpltUt/qqwHBxhy93uOTXswI=";
  };

  nativeBuildInputs = [ cmake pkg-config ];

-  buildInputs = [ libcbor openssl zlib ]
+  buildInputs = [ libcbor zlib ]
    ++ lib.optionals stdenv.isDarwin [ hidapi ]
-    ++ lib.optionals stdenv.isLinux [ udev ];
+    ++ lib.optionals stdenv.isLinux [ udev pcsclite ];
+
+  propagatedBuildInputs = [ openssl ];

  cmakeFlags = [
    "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
@ -33,6 +36,7 @@ stdenv.mkDerivation rec {
    "-DUSE_HIDAPI=1"
  ] ++ lib.optionals stdenv.isLinux [
    "-DNFC_LINUX=1"
+    "-DUSE_PCSC=1"
  ];

  meta = with lib; {
--- a/pkgs/development/libraries/libtiff/aarch64-darwin.nix
+++ b/pkgs/development/libraries/libtiff/aarch64-darwin.nix
@ -1,51 +0,0 @@
-{ lib, stdenv
-, fetchurl
-
-, pkg-config
-, cmake
-
-, libdeflate
-, libjpeg
-, xz
-, zlib
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libtiff";
-  version = "4.2.0";
-
-  src = fetchurl {
-    url = "https://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "1jrkjv0xya9radddn8idxvs2gqzp3l2b1s8knlizmn7ad3jq817b";
-  };
-
-  # FreeImage needs this patch
-  patches = [ ./headers-cmake.patch ];
-
-  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
-
-  postFixup = ''
-    moveToOutput include/tif_dir.h $dev_private
-    moveToOutput include/tif_config.h $dev_private
-    moveToOutput include/tiffiop.h $dev_private
-  '';
-
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  propagatedBuildInputs = [ libjpeg xz zlib ]; #TODO: opengl support (bogus configure detection)
-
-  buildInputs = [ libdeflate ]; # TODO: move all propagatedBuildInputs to buildInputs.
-
-  enableParallelBuilding = true;
-
-  doInstallCheck = true;
-  installCheckTarget = "test";
-
-  meta = with lib; {
-    description = "Library and utilities for working with the TIFF image file format";
-    homepage = "https://libtiff.gitlab.io/libtiff";
-    changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
-    license = licenses.libtiff;
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@ -21,8 +21,6 @@
 , imlib
 }:

-#FIXME: fix aarch64-darwin build and get rid of ./aarch64-darwin.nix
-
 stdenv.mkDerivation rec {
  pname = "libtiff";
  version = "4.4.0";
@ -38,6 +36,11 @@ stdenv.mkDerivation rec {
    # libc++abi 11 has an `#include <version>`, this picks up files name
    # `version` in the project's include paths
    ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2022-34526.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990.patch";
+      sha256 = "sha256-faKsdJjvQwNdkAKjYm4vubvZvnULt9zz4l53zBFr67s=";
+    })
  ];

  postPatch = ''
--- a/pkgs/development/libraries/libtiff/headers-cmake.patch
+++ b/pkgs/development/libraries/libtiff/headers-cmake.patch
@ -1,13 +0,0 @@
-diff -ruN a/libtiff/CMakeLists.txt b/libtiff/CMakeLists.txt
--- a/libtiff/CMakeLists.txt	2019-05-31 13:05:22.849705817 +0000
-+++ b/libtiff/CMakeLists.txt	2020-11-27 21:50:03.527831837 +0000
-@@ -42,6 +42,9 @@
-   libtiffxx.map)
- 
- set(tiff_HEADERS
-+  tiffiop.h
-+  ${CMAKE_CURRENT_BINARY_DIR}/tif_config.h
-+  tif_dir.h
-   tiff.h
-   tiffio.h
-   tiffvers.h)
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "libwebp";
-  version = "1.2.2";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner  = "webmproject";
    repo   = pname;
    rev    = "v${version}";
-    hash   = "sha256-WF2HZPS7mbotk+d1oLM/JC5l/FWfkrk+T3Z6EW9oYEI=";
+    hash   = "sha256-t27d+eJR4iTHSLlI3J7RqHgsWACThjsI9O6R2Zb9F1g=";
  };

  prePatch = "patchShebangs .";
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -81,19 +81,11 @@ self = stdenv.mkDerivation {
  postPatch = ''
    patchShebangs .

-    substituteInPlace meson.build --replace \
-      "find_program('pkg-config')" \
-      "find_program('${buildPackages.pkg-config.targetPrefix}pkg-config')"
-
    # The drirc.d directory cannot be installed to $drivers as that would cause a cyclic dependency:
    substituteInPlace src/util/xmlconfig.c --replace \
      'DATADIR "/drirc.d"' '"${placeholder "out"}/share/drirc.d"'
    substituteInPlace src/util/meson.build --replace \
      "get_option('datadir')" "'${placeholder "out"}/share'"
-  '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-    substituteInPlace meson.build --replace \
-      "find_program('nm')" \
-      "find_program('${stdenv.cc.targetPrefix}nm')"
  '';

  outputs = [ "out" "dev" "drivers" ]
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "nspr";
-  version = "4.34";
+  version = "4.34.1";

  src = fetchurl {
    url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "177rxcf3lglabs7sgwcvf72ww4v56qa71lc495wl13sxs4f03vxy";
+    hash = "sha256-xbg1TEi2Mrj0wZcGKBRsDgwMqPMscxXX1XNsAC4Dd08=";
  };

  patches = [
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@ -29,8 +29,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake pkg-config ];

-  buildInputs = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.cc.libc
-    ++ lib.optional alsaSupport alsa-lib
+  buildInputs = lib.optional alsaSupport alsa-lib
    ++ lib.optional dbusSupport dbus
    ++ lib.optional pipewireSupport pipewire
    ++ lib.optional pulseSupport libpulseaudio
@ -40,6 +39,9 @@ stdenv.mkDerivation rec {
    # Automatically links dependencies without having to rely on dlopen, thus
    # removes the need for NIX_LDFLAGS.
    "-DALSOFT_DLOPEN=OFF"
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    # https://github.com/NixOS/nixpkgs/issues/183774
+    "-DOSS_INCLUDE_DIR=${stdenv.cc.libc}/include"
  ];

  meta = with lib; {
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "openh264";
-  version = "2.2.0";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "cisco";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-l64xP39Uaislqh4D7oSxJiQGhXkklol4LgS9BVPbaGk=";
+    sha256 = "sha256-OSTsU2E4UWiwBqq3NqD0lj8uqVXeyd3MJ/gre6W2Jvs=";
  };

  nativeBuildInputs = [ nasm ];
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@ -22,7 +22,7 @@
 , gtk-doc
 , coreutils
 , useSystemd ? stdenv.isLinux
-, systemd
+, systemdMinimal
 , elogind
 # A few tests currently fail on musl (polkitunixusertest, polkitunixgrouptest, polkitidentitytest segfault).
 # Not yet investigated; it may be due to the "Make netgroup support optional"
@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
    duktape
  ] ++ lib.optionals stdenv.isLinux [
    # On Linux, fall back to elogind when systemd support is off.
-    (if useSystemd then systemd else elogind)
+    (if useSystemd then systemdMinimal else elogind)
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/libraries/wayland/add-placeholder-for-nm.patch
+++ b/pkgs/development/libraries/wayland/add-placeholder-for-nm.patch
@ -1,13 +0,0 @@
-diff --git a/egl/meson.build b/egl/meson.build
-index b3cbdf3..cdc15ca 100644
--- a/egl/meson.build
-+++ b/egl/meson.build
-@@ -11,7 +11,7 @@ wayland_egl = library(
-
- executable('wayland-egl-abi-check', 'wayland-egl-abi-check.c')
-
-nm_path = find_program('nm').full_path()
-+nm_path = find_program('@nm@').full_path()
-
- test(
-        'wayland-egl symbols check',
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@ -36,13 +36,6 @@ stdenv.mkDerivation rec {
    sha256 = "1b0ixya9bfw5c9jx8mzlr7yqnlyvd3jv5z8wln9scdv8q5zlvikd";
  };

-  patches = [
-    (substituteAll {
-      src = ./add-placeholder-for-nm.patch;
-      nm = "${stdenv.cc.targetPrefix}nm";
-    })
-  ];
-
  postPatch = lib.optionalString withDocumentation ''
    patchShebangs doc/doxygen/gen-doxygen.py
  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
--- a/pkgs/development/python-modules/attrs/default.nix
+++ b/pkgs/development/python-modules/attrs/default.nix
@ -2,15 +2,17 @@
 , callPackage
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "attrs";
-  version = "21.4.0";
+  version = "22.1.0";
+  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-YmuoI0IR25joad92IwoTfExAoS1yRFxF1fW3FvB24v0=";
+    hash = "sha256-Ka3CZlRH5RkdDnxWj954sh+WctNEKB0MbhqwhUKbIrY=";
  };

  outputs = [
@ -38,7 +40,7 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Python attributes without boilerplate";
-    homepage = "https://github.com/hynek/attrs";
+    homepage = "https://github.com/python-attrs/attrs";
    license = licenses.mit;
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/development/python-modules/cattrs/default.nix
+++ b/pkgs/development/python-modules/cattrs/default.nix
@ -2,6 +2,7 @@
 , attrs
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , exceptiongroup
 , hypothesis
 , immutables
@ -32,6 +33,14 @@ buildPythonPackage rec {
    hash = "sha256-C8uIsewpgJfB1yYckWTwF5K32+2AAOrxFKB9I18RENg=";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/python-attrs/cattrs/commit/290d162a589acf10ea63b825b7b283e23ca7698a.diff";
+      excludes = [ "poetry.lock" ];
+      hash = "sha256-n6c3qVg9umGKAxeTALq3QTJgO9DIj3SY0ZHhtsDeW94=";
+    })
+  ];
+
  nativeBuildInputs = [
    poetry-core
  ];
--- a/pkgs/development/python-modules/dbus/default.nix
+++ b/pkgs/development/python-modules/dbus/default.nix
@ -35,6 +35,10 @@ buildPythonPackage rec {
  doCheck = isPy3k;
  checkInputs = [ dbus.out pygobject3 ];

+  postInstall = ''
+    cp -r dbus_python.egg-info $out/${python.sitePackages}/
+  '';
+
  meta = with lib; {
    description = "Python DBus bindings";
    license = licenses.mit;
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "3.2.14";
+  version = "3.2.15";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    pname = "Django";
    inherit version;
-    sha256 = "sha256-Z3GCuotbKFpOBy86wXzu5q/xtc53/Rc8xbai09wCL88=";
+    hash = "sha256-9xk0sagi8UqGyayWNAU2iSec0ErmnLat5KWUcbiGWCs=";
  };

  patches = lib.optional withGdal
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@ -51,6 +51,7 @@ buildPythonPackage rec {
  disabledTests = [
    # Tests requires network access
    "test_017_ssl_zeroreturnerror"
+    "test_018b_http_10_keepalive_framing"
    "test_getaddrinfo"
    "test_hosts_no_network"
    "test_leakage_from_tracebacks"
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@ -20,7 +20,7 @@

 let
  pname = "hatchling";
-  version = "1.5.0";
+  version = "1.6.0";
 in
 buildPythonPackage {
  inherit pname version;
@ -28,7 +28,7 @@ buildPythonPackage {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-nKQJpBFAzGYhZGgLeK3NO6d7I6lFmEvZlw0R/jjoajg=";
+    sha256 = "sha256-vW6FBd5RGsQhf/UJJ/bRhFSUYI5AHmOmK4MMMfthNUQ=";
  };

  # listed in backend/src/hatchling/ouroboros.py
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pythonOlder

 # Build dependencies
@ -36,6 +37,17 @@ buildPythonPackage rec {
    sha256 = "f2db3a10254241d9b447232cec8b424847f338d9d36f9a577a6192c332a46abd";
  };

+  patches = [
+    (fetchpatch {
+      # The original URL might not be very stable, so let's prefer a copy.
+      urls = [
+        "https://raw.githubusercontent.com/bmwiedemann/openSUSE/9b35e4405a44aa737dda623a7dabe5384172744c/packages/p/python-ipython/ipython-pr13714-xxlimited.patch"
+        "https://github.com/ipython/ipython/pull/13714.diff"
+      ];
+      sha256 = "XPOcBo3p8mzMnP0iydns9hX8qCQXTmRgRD0TM+FESCI=";
+    })
+  ];
+
  nativeBuildInputs = [
    setuptools
  ];
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "jsonschema";
-  version = "4.7.2";
+  version = "4.9.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-c3ZPRh1h65egV8kpNoYQoTTR0f/9hYrP6Ihk7pTx8dM=";
+    sha256 = "sha256-QIxMjtDe3jsmj3pEF4T3QgY4CwT5PrLVN8e++z3zCZ8=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/loguru/default.nix
+++ b/pkgs/development/python-modules/loguru/default.nix
@ -21,6 +21,14 @@ buildPythonPackage rec {
    sha256 = "sha256-BmvQZ1jQpRPpg2/ZxrWnW/s/02hB9LmWvGC1R6MJ1Bw=";
  };

+  patches = [
+    (fetchpatch {
+      name = "fix-test-repr-infinite-recursion.patch";
+      url = "https://github.com/Delgan/loguru/commit/4fe21f66991abeb1905e24c3bc3c634543d959a2.patch";
+      hash = "sha256-NUOkgUS28TOazO0txMinFtaKwsi/J1Y7kqjjvMRCnR8=";
+    })
+  ];
+
  propagatedBuildInputs = lib.optionals (pythonOlder "3.7") [
    aiocontextvars
  ];
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@ -8,24 +8,27 @@
 , bluez
 , networkmanager
 , setuptools-scm
+, runCommand
 }:

-buildPythonPackage rec {
+let
+  # Cannot just add it to path in preCheck since that attribute will be passed to
+  # mkDerivation even with doCheck = false, causing a dependency cycle.
+  pbap-client = runCommand "pbap-client" { } ''
+    mkdir -p "$out/bin"
+    ln -s "${bluez.test}/test/pbap-client" "$out/bin/pbap-client"
+  '';
+in buildPythonPackage rec {
  pname = "python-dbusmock";
-  version = "0.28.3";
+  version = "0.28.4";

  src = fetchFromGitHub {
    owner = "martinpitt";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-LV94F2f0Ir2Ayzk2YLL76TqeUuC0f7e+bH3vC/xKgfU=";
+    sha256 = "sha256-gsGg9zHVyDTCVZmFUI8qqXDt0ui+o3hPwjRlsYUmShg=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '"dbus-python"' ""
-  '';
-
  SETUPTOOLS_SCM_PRETEND_VERSION = version;

  nativeBuildInputs = [
@ -40,7 +43,7 @@ buildPythonPackage rec {
    dbus
    pygobject3
    bluez
-    (lib.getOutput "test" bluez)
+    pbap-client
    networkmanager
    nose
  ];
@ -68,7 +71,6 @@ buildPythonPackage rec {
    # "test_networkmanager"
  ];

-
  checkPhase = ''
    runHook preCheck
    nosetests -v
--- a/pkgs/development/python-modules/swspotify/default.nix
+++ b/pkgs/development/python-modules/swspotify/default.nix
@ -35,12 +35,6 @@ buildPythonPackage rec {
    requests
  ];

-  postPatch = ''
-    # Detection of the  platform doesn't always works with 1.2.3
-    substituteInPlace pyproject.toml \
-      --replace 'dbus-python = {version = "^1.2.16", platform = "linux"}' ""
-  '';
-
  # Tests want to use Dbus
  doCheck = false;

--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@ -20,12 +20,12 @@

 buildPythonPackage rec {
  pname = "urllib3";
-  version = "1.26.10";
+  version = "1.26.11";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-h5uk0eiWVNl2nOExIeD5QxDqMujS+M9Ye3fAi7zbMNY=";
+    hash = "sha256-6m6PshCxnZUPq5O2DJAJImxjoogIvIOG4FMB4liDrAo=";
  };

  # FIXME: remove backwards compatbility hack
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@ -48,7 +48,6 @@ buildPythonPackage rec {
    # Depend on pyopenssl
    "--deselect tests/test_tcp.py::Test_UV_TCPSSL::test_flush_before_shutdown"
    "--deselect tests/test_tcp.py::Test_UV_TCPSSL::test_renegotiation"
-  ] ++ lib.optionals stdenv.hostPlatform.isAarch [
    # test gets stuck in epoll_pwait on hydras aarch64 builders
    # https://github.com/MagicStack/uvloop/issues/412
    "--deselect tests/test_tcp.py::Test_AIO_TCPSSL::test_remote_shutdown_receives_trailing_data"
--- a/pkgs/development/python2-modules/attrs/default.nix
+++ b/pkgs/development/python2-modules/attrs/default.nix
@ -0,0 +1,45 @@
+{ lib
+, callPackage
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "attrs";
+  version = "21.4.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-YmuoI0IR25joad92IwoTfExAoS1yRFxF1fW3FvB24v0=";
+  };
+
+  outputs = [
+    "out"
+    "testout"
+  ];
+
+  postInstall = ''
+    # Install tests as the tests output.
+    mkdir $testout
+    cp -R tests $testout/tests
+  '';
+
+  pythonImportsCheck = [
+    "attr"
+  ];
+
+  # pytest depends on attrs, so we can't do this out-of-the-box.
+  # Instead, we do this as a passthru.tests test.
+  doCheck = false;
+
+  passthru.tests = {
+    pytest = callPackage ./tests.nix { };
+  };
+
+  meta = with lib; {
+    description = "Python attributes without boilerplate";
+    homepage = "https://github.com/hynek/attrs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
--- a/pkgs/development/tools/analysis/rr/default.nix
+++ b/pkgs/development/tools/analysis/rr/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, libpfm, zlib, pkg-config, python3Packages, which, procps, gdb, capnproto }:

 stdenv.mkDerivation rec {
-  version = "5.5.0";
+  version = "5.6.0";
  pname = "rr";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "rr";
    rev = version;
-    sha256 = "sha256-ZZhkmDWGNWejwXZEcFO9p9NG1dopK7kXRj7OrkJCPR0=";
+    sha256 = "H39HPkAQGubXVQV3jCpH4Pz+7Q9n03PrS70utk7Tt2k=";
  };

  postPatch = ''
--- a/pkgs/development/tools/build-managers/cmake/3_23.nix
+++ b/pkgs/development/tools/build-managers/cmake/3_23.nix
@ -0,0 +1,168 @@
+{ lib
+, stdenv
+, buildPackages
+, bzip2
+, curlMinimal
+, expat
+, fetchurl
+, libarchive
+, libuv
+, ncurses
+, openssl
+, pkg-config
+, qtbase
+, rhash
+, sphinx
+, texinfo
+, wrapQtAppsHook
+, xz
+, zlib
+, SystemConfiguration
+, ps ? null
+, isBootstrap ? false
+, useOpenSSL ? !isBootstrap
+, useSharedLibraries ? (!isBootstrap && !stdenv.isCygwin)
+, uiToolkits ? [] # can contain "ncurses" and/or "qt5"
+, buildDocs ? !(isBootstrap || (uiToolkits == []))
+}:
+
+let
+  cursesUI = lib.elem "ncurses" uiToolkits;
+  qt5UI = lib.elem "qt5" uiToolkits;
+in
+# Accepts only "ncurses" and "qt5" as possible uiToolkits
+assert lib.subtractLists [ "ncurses" "qt5" ] uiToolkits == [];
+stdenv.mkDerivation rec {
+  pname = "cmake"
+    + lib.optionalString isBootstrap "-boot"
+    + lib.optionalString cursesUI "-cursesUI"
+    + lib.optionalString qt5UI "-qt5UI";
+  version = "3.23.3";
+
+  src = fetchurl {
+    url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
+    sha256 = "sha256-Bv768K2UmJcktW9zMJPCYj9vhDVuW+uVWVf5zj7iiAk=";
+  };
+
+  patches = [
+    # Don't search in non-Nix locations such as /usr, but do search in our libc.
+    ./001-search-path.diff
+    # Don't depend on frameworks.
+    ./002-application-services.diff
+    # Derived from https://github.com/libuv/libuv/commit/1a5d4f08238dd532c3718e210078de1186a5920d
+    ./003-libuv-application-services.diff
+  ]
+  ++ lib.optional stdenv.isCygwin ./004-cygwin.diff
+  # Derived from https://github.com/curl/curl/commit/31f631a142d855f069242f3e0c643beec25d1b51
+  ++ lib.optional (stdenv.isDarwin && isBootstrap) ./005-remove-systemconfiguration-dep.diff
+  # On Darwin, always set CMAKE_SHARED_LIBRARY_RUNTIME_C_FLAG.
+  ++ lib.optional stdenv.isDarwin ./006-darwin-always-set-runtime-c-flag.diff;
+
+  outputs = [ "out" ] ++ lib.optionals buildDocs [ "man" "info" ];
+  setOutputFlags = false;
+
+  setupHook = ./setup-hook.sh;
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [
+    pkg-config
+    setupHook
+  ]
+  ++ lib.optionals buildDocs [ texinfo ]
+  ++ lib.optionals qt5UI [ wrapQtAppsHook ];
+
+  buildInputs = lib.optionals useSharedLibraries [
+    bzip2
+    curlMinimal
+    expat
+    libarchive
+    xz
+    zlib
+    libuv
+    rhash
+  ]
+  ++ lib.optional useOpenSSL openssl
+  ++ lib.optional cursesUI ncurses
+  ++ lib.optional qt5UI qtbase
+  ++ lib.optional (stdenv.isDarwin && !isBootstrap) SystemConfiguration;
+
+  propagatedBuildInputs = lib.optional stdenv.isDarwin ps;
+
+  preConfigure = ''
+    fixCmakeFiles .
+    substituteInPlace Modules/Platform/UnixPaths.cmake \
+      --subst-var-by libc_bin ${lib.getBin stdenv.cc.libc} \
+      --subst-var-by libc_dev ${lib.getDev stdenv.cc.libc} \
+      --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
+    # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
+    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags"
+  '';
+
+  configureFlags = [
+    "CXXFLAGS=-Wno-elaborated-enum-base"
+    "--docdir=share/doc/${pname}${version}"
+  ] ++ (if useSharedLibraries
+        then [ "--no-system-jsoncpp" "--system-libs" ]
+        else [ "--no-system-libs" ]) # FIXME: cleanup
+  ++ lib.optional qt5UI "--qt-gui"
+  ++ lib.optionals buildDocs [
+    "--sphinx-build=${sphinx}/bin/sphinx-build"
+    "--sphinx-info"
+    "--sphinx-man"
+  ]
+  # Workaround https://gitlab.kitware.com/cmake/cmake/-/issues/20568
+  ++ lib.optionals stdenv.hostPlatform.is32bit [
+    "CFLAGS=-D_FILE_OFFSET_BITS=64"
+    "CXXFLAGS=-D_FILE_OFFSET_BITS=64"
+  ]
+  ++ [
+    "--"
+    # We should set the proper `CMAKE_SYSTEM_NAME`.
+    # http://www.cmake.org/Wiki/CMake_Cross_Compiling
+    #
+    # Unfortunately cmake seems to expect absolute paths for ar, ranlib, and
+    # strip. Otherwise they are taken to be relative to the source root of the
+    # package being built.
+    "-DCMAKE_CXX_COMPILER=${stdenv.cc.targetPrefix}c++"
+    "-DCMAKE_C_COMPILER=${stdenv.cc.targetPrefix}cc"
+    "-DCMAKE_AR=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
+    "-DCMAKE_RANLIB=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ranlib"
+    "-DCMAKE_STRIP=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip"
+
+    "-DCMAKE_USE_OPENSSL=${if useOpenSSL then "ON" else "OFF"}"
+    # Avoid depending on frameworks.
+    "-DBUILD_CursesDialog=${if cursesUI then "ON" else "OFF"}"
+  ];
+
+  # make install attempts to use the just-built cmake
+  preInstall = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    sed -i 's|bin/cmake|${buildPackages.cmakeMinimal}/bin/cmake|g' Makefile
+  '';
+
+  dontUseCmakeConfigure = true;
+  enableParallelBuilding = true;
+
+  # This isn't an autoconf configure script; triples are passed via
+  # CMAKE_SYSTEM_NAME, etc.
+  configurePlatforms = [ ];
+
+  doCheck = false; # fails
+
+  meta = with lib; {
+    homepage = "https://cmake.org/";
+    description = "Cross-platform, open-source build system generator";
+    longDescription = ''
+      CMake is an open-source, cross-platform family of tools designed to build,
+      test and package software. CMake is used to control the software
+      compilation process using simple platform and compiler independent
+      configuration files, and generate native makefiles and workspaces that can
+      be used in the compiler environment of your choice.
+    '';
+    changelog = "https://cmake.org/cmake/help/v${lib.versions.majorMinor version}/release/${lib.versions.majorMinor version}.html";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ttuegel lnl7 AndersonTorres ];
+    platforms = platforms.all;
+    broken = (qt5UI && stdenv.isDarwin);
+  };
+}
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
    + lib.optionalString isBootstrap "-boot"
    + lib.optionalString cursesUI "-cursesUI"
    + lib.optionalString qt5UI "-qt5UI";
-  version = "3.23.2";
+  version = "3.24.0";

  src = fetchurl {
    url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-8xa0AFNGb5pBat+YHv2kGxYMqFnpf2pIS0R+opn/Jqo=";
+    sha256 = "sha256-wrYffN7LFXbK0l+Rio9CuGhdiKgy/UtiueD6MukVplg=";
  };

  patches = [
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@ -15,6 +15,9 @@ fixCmakeFiles() {
 cmakeConfigurePhase() {
    runHook preConfigure

+    # default to CMake defaults if unset
+    : ${cmakeBuildDir:=build}
+
    export CTEST_OUTPUT_ON_FAILURE=1
    if [ -n "${enableParallelChecking-1}" ]; then
        export CTEST_PARALLEL_LEVEL=$NIX_BUILD_CORES
@ -25,9 +28,11 @@ cmakeConfigurePhase() {
    fi

    if [ -z "${dontUseCmakeBuildDir-}" ]; then
-        mkdir -p build
-        cd build
-        cmakeDir=${cmakeDir:-..}
+        mkdir -p "$cmakeBuildDir"
+        cd "$cmakeBuildDir"
+        : ${cmakeDir:=..}
+    else
+        : ${cmakeDir:=.}
    fi

    if [ -z "${dontAddPrefix-}" ]; then
@ -118,7 +123,7 @@ cmakeConfigurePhase() {

    echo "cmake flags: $cmakeFlags ${cmakeFlagsArray[@]}"

-    cmake ${cmakeDir:-.} $cmakeFlags "${cmakeFlagsArray[@]}"
+    cmake "$cmakeDir" $cmakeFlags "${cmakeFlagsArray[@]}"

    if ! [[ -v enableParallelBuilding ]]; then
        enableParallelBuilding=1
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@ -29,6 +29,14 @@ python3.pkgs.buildPythonApplication rec {
    # https://github.com/mesonbuild/meson/pull/6827
    ./more-env-vars.patch

+    # Use more binutils variables, so we don't have to define them in stdenv.
+    # pr has been merged
+    # https://github.com/mesonbuild/meson/pull/10640
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/8a8ab9a8e0c2cefb6faa0734e52803c74790576c.patch";
+      sha256 = "sha256-BdBf1NB4SZLFyFRDzD0p//XUgUeAHpo6XXUtsHdCgKE=";
+    })
+
    # Unlike libtool, vanilla Meson does not pass any information
    # about the path library will be installed to to g-ir-scanner,
    # breaking the GIR when path other than ${!outputLib}/lib is used.
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "patchelf";
-  version = "0.14.5";
+  version = "0.15.0";

  src = fetchurl {
    url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-uaRvKYkyLrifpPYjfiCDbFe0VapDoyVF6gk7Qx2YL1w=";
+    sha256 = "sha256-9ANtPuTY4ijewb7/8PbkbYpA6eVw4AaOOdd+YuLIvcI=";
  };

  strictDeps = true;
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@ -12,7 +12,7 @@
 , pkg-config
 , python3
 , readline
-, systemd
+, systemdMinimal
 , udev
 , withExperimental ? false
 }: let
@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
    python3.pkgs.wrapPython
  ];

-  outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";
+  outputs = [ "out" "dev" "test" ];

  patches = [
    # https://github.com/bluez/bluez/commit/0905a06410d4a5189f0be81e25eb3c3e8a2199c5
@ -63,7 +63,7 @@ in stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace tools/hid2hci.rules \
-      --replace /sbin/udevadm ${systemd}/bin/udevadm \
+      --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
      --replace "hid2hci " "$out/lib/udev/hid2hci "
    # Disable some tests:
    # - test-mesh-crypto depends on the following kernel settings:
@ -107,7 +107,7 @@ in stdenv.mkDerivation rec {

  doCheck = stdenv.hostPlatform.isx86_64;

-  postInstall = lib.optionalString doCheck ''
+  postInstall = ''
    mkdir -p $test/{bin,test}
    cp -a test $test
    pushd $test/test
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@ -7,14 +7,14 @@

 stdenv.mkDerivation rec {
  pname = "ell";
-  version = "0.51";
+  version = "0.52";

  outputs = [ "out" "dev" ];

  src = fetchgit {
    url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
    rev = version;
-    sha256 = "sha256-UGc6msj+V3U7IzquD4+KDLWt1vUxdV2Qm9Y0FOmsqtc=";
+    sha256 = "sha256-JnkNWWdr0CSlwME619BBWkvelFZoZpzmAR53nm2bSqM=";
  };

  nativeBuildInputs = [
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@ -12,12 +12,12 @@

 stdenv.mkDerivation rec {
  pname = "iwd";
-  version = "1.28";
+  version = "1.29";

  src = fetchgit {
    url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
    rev = version;
-    sha256 = "sha256-UAhgmXTbCgxja8nniexr6+jkzHIOMn9k1Cp8oMuskk0=";
+    sha256 = "sha256-W2MOK6aIa1whkj13OeuibNjL/2LWt7TO8h4JeoUrZnQ=";
  };

  outputs = [ "out" "man" "doc" ]
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@ -84,18 +84,15 @@ let
 in {
  inherit makeLinuxHeaders;

-  linuxHeaders = let version = "5.18"; in
+  linuxHeaders = let version = "5.19"; in
    makeLinuxHeaders {
      inherit version;
      src = fetchurl {
        url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "1vjwhl4s8qxfg1aabn8xnpjza3qzrjcp5450h9qpjvl999lg3wsi";
+        sha256 = "1a05a3hw4w3k530mxhns96xw7hag743xw5w967yazqcykdbhq97z";
      };
      patches = [
         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
-
-         # 5.19 backport. Can be removed on update.
-         ./restore-__bitwise__.patch
      ];
    };
 }
--- a/pkgs/os-specific/linux/kernel-headers/restore-bitwise.patch
+++ b/pkgs/os-specific/linux/kernel-headers/restore-bitwise.patch
@ -1,15 +0,0 @@
-https://github.com/torvalds/linux/commit/caa28984163cb63ea0be4cb8dbf05defdc7303f9
-
-Fixes openiscsi build.
--- a/include/uapi/linux/types.h
-+++ b/include/uapi/linux/types.h
-@@ -26,6 +26,9 @@
- #define __bitwise
- #endif
- 
-+/* The kernel doesn't use this legacy form, but user space does */
-+#define __bitwise__ __bitwise
-+
- typedef __u16 __bitwise __le16;
- typedef __u16 __bitwise __be16;
- typedef __u32 __bitwise __le32;
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@ -7,11 +7,11 @@ assert usePam -> pam != null;

 stdenv.mkDerivation rec {
  pname = "libcap";
-  version = "2.63";
+  version = "2.65";

  src = fetchurl {
    url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-DGN7j0T8fYYneH6c9X8VrAbB3cy1PkH+7FSWvjRm938=";
+    sha256 = "sha256-c+NQAgzDH+FTYIedGThP+jOVqCXwZfz2vaOlzfllvr0=";
  };

  outputs = [ "out" "dev" "lib" "man" "doc" ]
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "libnl";
-  version = "3.5.0";
+  version = "3.7.0";

  src = fetchFromGitHub {
    repo = "libnl";
    owner = "thom311";
    rev = "libnl${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "1ak30jcx52gl5yz1691qq0b76ldbcp2z6vsvdr2mrrwqiplqbcs2";
+    sha256 = "sha256-Ty9NdWKWB29MTRfG5OJlSE0mSTN3Wy+sR4KtuExXcB4=";
  };

  outputs = [ "bin" "dev" "out" "man" ] ++ lib.optional pythonSupport "py";
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@ -21,7 +21,6 @@ in stdenv.mkDerivation {
  enableParallelBuilding = true;

  buildInputs = [ windows.mingw_w64_headers ];
-  dontStrip = true;
  hardeningDisable = [ "stackprotector" "fortify" ];

  meta = {
--- a/pkgs/servers/gpm/default.nix
+++ b/pkgs/servers/gpm/default.nix
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
  configureFlags = [
    "--sysconfdir=/etc"
    "--localstatedir=/var"
-    (if ncurses == null then "--without-curses" else "--with-curses")
+    (if withNcurses then "--with-curses" else "--without-curses")
  ];

  enableParallelBuilding = true;
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@ -3,8 +3,8 @@
 , withPython3 ? true, python3, ncurses
 , withPHP80 ? false, php80
 , withPHP81 ? true, php81
-, withPerl532 ? false, perl532
-, withPerl534 ? true, perl534
+, withPerl534 ? false, perl534
+, withPerl536 ? true, perl536
 , withPerldevel ? false, perldevel
 , withRuby_2_7 ? true, ruby_2_7
 , withRuby_3_0 ? false, ruby_3_0
@ -46,8 +46,8 @@ in stdenv.mkDerivation rec {
    ++ optionals withPython3 [ python3 ncurses ]
    ++ optional withPHP80 php80-unit
    ++ optional withPHP81 php81-unit
-    ++ optional withPerl532 perl532
    ++ optional withPerl534 perl534
+    ++ optional withPerl536 perl536
    ++ optional withPerldevel perldevel
    ++ optional withRuby_2_7 ruby_2_7
    ++ optional withRuby_3_0 ruby_3_0
@ -71,8 +71,8 @@ in stdenv.mkDerivation rec {
    ${optionalString withPython3    "./configure python --module=python3  --config=python3-config  --lib-path=${python3}/lib"}
    ${optionalString withPHP80      "./configure php    --module=php80    --config=${php80-unit.unwrapped.dev}/bin/php-config --lib-path=${php80-unit}/lib"}
    ${optionalString withPHP81      "./configure php    --module=php81    --config=${php81-unit.unwrapped.dev}/bin/php-config --lib-path=${php81-unit}/lib"}
-    ${optionalString withPerl532    "./configure perl   --module=perl532  --perl=${perl532}/bin/perl"}
    ${optionalString withPerl534    "./configure perl   --module=perl534  --perl=${perl534}/bin/perl"}
+    ${optionalString withPerl536    "./configure perl   --module=perl536  --perl=${perl536}/bin/perl"}
    ${optionalString withPerldevel  "./configure perl   --module=perldev  --perl=${perldevel}/bin/perl"}
    ${optionalString withRuby_2_7   "./configure ruby   --module=ruby27   --ruby=${ruby_2_7}/bin/ruby"}
    ${optionalString withRuby_3_0   "./configure ruby   --module=ruby30   --ruby=${ruby_3_0}/bin/ruby"}
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@ -384,7 +384,7 @@ else let

          crossFile = builtins.toFile "cross-file.conf" ''
            [properties]
-            needs_exe_wrapper = true
+            needs_exe_wrapper = ${lib.boolToString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform)}

            [host_machine]
            system = '${stdenv.targetPlatform.parsed.kernel.name}'
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@ -48,11 +48,11 @@

 stdenv.mkDerivation rec {
  pname = "unbound";
-  version = "1.16.0";
+  version = "1.16.2";

  src = fetchurl {
    url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-ZwFTTJOOsBliZgEZHtxtAS/FNMCdJBjVuSgn2wy+SKU=";
+    hash = "sha256-LjLyg4IMJMUcod2K/s/bdHxzhaE3q+hlyZ20sldANYE=";
  };

  outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
@ -156,7 +156,7 @@ stdenv.mkDerivation rec {
    description = "Validating, recursive, and caching DNS resolver";
    license = licenses.bsd3;
    homepage = "https://www.unbound.net";
-    maintainers = with maintainers; [ fpletz globin ];
+    maintainers = with maintainers; [ ajs124 ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@ -1,33 +1,28 @@
 { fetchurl, fetchpatch, lib, stdenv, pkg-config, libgcrypt, libassuan, libksba
 , libgpg-error, libiconv, npth, gettext, texinfo, buildPackages
-
-# Each of the dependencies below are optional.
-# Gnupg can be built without them at the cost of reduced functionality.
 , guiSupport ? stdenv.isDarwin, enableMinimal ? false
-, adns ? null, bzip2 ? null , gnutls ? null , libusb1 ? null , openldap ? null
-, tpm2-tss ? null
-, pcsclite ? null , pinentry ? null , readline ? null , sqlite ? null , zlib ? null
+, adns, bzip2, gnutls, libusb1, openldap
+, tpm2-tss, pcsclite, pinentry, readline, sqlite, zlib
 }:

-with lib;
-
-assert guiSupport -> pinentry != null && enableMinimal == false;
+assert guiSupport -> enableMinimal == false;

 stdenv.mkDerivation rec {
  pname = "gnupg";
-  version = "2.3.6";
+  version = "2.3.7";

  src = fetchurl {
    url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Iff+L8XC8hQYSrBQl37HqOME5Yv64qsJj+xp+Pq9qcE=";
+    sha256 = "sha256-7hY6X7nsmf/BsY5l+u+NCGgAxXE9FaZyq1fTeZ2oNmk=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ pkg-config texinfo ];
  buildInputs = [
    libgcrypt libassuan libksba libiconv npth gettext
+  ] ++ lib.optionals (!enableMinimal) ([
    readline libusb1 gnutls adns openldap zlib bzip2 sqlite
-  ] ++ optional (!stdenv.isDarwin) tpm2-tss ;
+  ] ++ lib.optional (!stdenv.isDarwin) tpm2-tss);

  patches = [
    ./fix-libusb-include-path.patch
@ -35,15 +30,12 @@ stdenv.mkDerivation rec {
    ./allow-import-of-previously-known-keys-even-without-UI.patch
    ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch

-    # Patch from upstream 34c649b36013, https://dev.gnupg.org/T6027
-    ./CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
-
    # Patch for DoS vuln from https://seclists.org/oss-sec/2022/q3/27
    ./v3-0001-Disallow-compressed-signatures-and-certificates.patch
  ];
  postPatch = ''
    sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
-  '' + lib.optionalString (stdenv.isLinux && pcsclite != null) ''
+  '' + lib.optionalString (stdenv.isLinux && (!enableMinimal)) ''
    sed -i 's,"libpcsclite\.so[^"]*","${lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
  '';

@ -54,8 +46,8 @@ stdenv.mkDerivation rec {
    "--with-libassuan-prefix=${libassuan.dev}"
    "--with-ksba-prefix=${libksba.dev}"
    "--with-npth-prefix=${npth}"
-  ] ++ optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}"
-  ++ optional ( (!stdenv.isDarwin) && (tpm2-tss != null) ) "--with-tss=intel";
+  ] ++ lib.optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}"
+  ++ lib.optional ((!stdenv.isDarwin) && (!enableMinimal)) "--with-tss=intel";
  postInstall = if enableMinimal
  then ''
    rm -r $out/{libexec,sbin,share}
--- a/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
+++ b/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
@ -1,45 +0,0 @@
-commit 34c649b3601383cd11dbc76221747ec16fd68e1b
-Author: Werner Koch <wk@gnupg.org>
-Date:   2022-06-14 11:33:27 +0200
-
-    g10: Fix garbled status messages in NOTATION_DATA
-    
-    * g10/cpr.c (write_status_text_and_buffer): Fix off-by-one
-    --
-    
-    Depending on the escaping and line wrapping the computed remaining
-    buffer length could be wrong.  Fixed by always using a break to
-    terminate the escape detection loop.  Might have happened for all
-    status lines which may wrap.
-    
-    GnuPG-bug-id: T6027
-
-diff --git a/g10/cpr.c b/g10/cpr.c
-index 9bfdd3c34..fa8005d6f 100644
--- a/g10/cpr.c
-+++ b/g10/cpr.c
-@@ -372,20 +372,15 @@ write_status_text_and_buffer (int no, const char *string,
-             }
-           first = 0;
-         }
-      for (esc=0, s=buffer, n=len; n && !esc; s++, n--)
-+      for (esc=0, s=buffer, n=len; n; s++, n--)
-         {
-           if (*s == '%' || *(const byte*)s <= lower_limit
-               || *(const byte*)s == 127 )
-             esc = 1;
-           if (wrap && ++count > wrap)
-            {
-              dowrap=1;
-              break;
-            }
-        }
-      if (esc)
-        {
-          s--; n++;
-+            dowrap=1;
-+          if (esc || dowrap)
-+            break;
-         }
-       if (s != buffer)
-         es_fwrite (buffer, s-buffer, 1, statusfp);
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@ -8,7 +8,7 @@
 , python3
 , dbus
 , polkit
-, systemd
+, systemdMinimal
 , IOKit
 }:

@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config perl ];

  buildInputs = [ python3 ]
-    ++ lib.optionals stdenv.isLinux [ dbus polkit systemd ]
+    ++ lib.optionals stdenv.isLinux [ dbus polkit systemdMinimal ]
    ++ lib.optionals stdenv.isDarwin [ IOKit ];

  meta = with lib; {
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, perl
-, ghostscript #for postscript and html output
-, psutils, netpbm #for html output
+, enableGhostscript ? false, ghostscript # for postscript and html output
+, enableHtml ? false, psutils, netpbm # for html output
 , buildPackages
 , autoreconfHook
 , pkg-config
@ -38,11 +38,9 @@ stdenv.mkDerivation rec {
    # BASH_PROG gets replaced with a path to the build bash which doesn't get automatically patched by patchShebangs
    substituteInPlace contrib/gdiffmk/gdiffmk.sh \
      --replace "@BASH_PROG@" "/bin/sh"
-  '' + lib.optionalString (psutils != null) ''
-    substituteInPlace src/preproc/html/pre-html.cpp \
-      --replace "psselect" "${psutils}/bin/psselect"
-  '' + lib.optionalString (netpbm != null) ''
+  '' + lib.optionalString enableHtml ''
    substituteInPlace src/preproc/html/pre-html.cpp \
+      --replace "psselect" "${psutils}/bin/psselect" \
      --replace "pnmcut" "${lib.getBin netpbm}/bin/pnmcut" \
      --replace "pnmcrop" "${lib.getBin netpbm}/bin/pnmcrop" \
      --replace "pnmtopng" "${lib.getBin netpbm}/bin/pnmtopng"
@ -53,8 +51,10 @@ stdenv.mkDerivation rec {
  '';

  strictDeps = true;
-  buildInputs = [ ghostscript psutils netpbm perl bash ];
  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
+  buildInputs = [ perl bash ]
+    ++ lib.optionals enableGhostscript [ ghostscript ]
+    ++ lib.optionals enableHtml [ psutils netpbm ];

  # Builds running without a chroot environment may detect the presence
  # of /usr/X11 in the host system, leading to an impure build of the
@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
  configureFlags = [
    "--without-x"
    "ac_cv_path_PERL=${buildPackages.perl}/bin/perl"
-  ] ++ lib.optionals (ghostscript != null) [
+  ] ++ lib.optionals enableGhostscript [
    "--with-gs=${ghostscript}/bin/gs"
  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
    "gl_cv_func_signbit=yes"
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7036,11 +7036,7 @@ with pkgs;

  grive2 = callPackage ../tools/filesystems/grive2 { };

-  groff = callPackage ../tools/text/groff {
-    ghostscript = null;
-    psutils = null;
-    netpbm = null;
-  };
+  groff = callPackage ../tools/text/groff { };

  gromit-mpx = callPackage ../tools/graphics/gromit-mpx {
    gtk = gtk3;
@ -15784,6 +15780,11 @@ with pkgs;
    inherit (libsForQt5) qtbase wrapQtAppsHook;
  };

+  cmake_3_23 = callPackage ../development/tools/build-managers/cmake/3_23.nix {
+    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
+    inherit (libsForQt5) qtbase wrapQtAppsHook;
+  };
+
  cmakeMinimal = callPackage ../development/tools/build-managers/cmake {
    isBootstrap = true;
    qtbase = null;
@ -19835,9 +19836,7 @@ with pkgs;

  libtifiles2 = callPackage ../development/libraries/libtifiles2 { };

-  libtiff = if stdenv.isDarwin && stdenv.isAarch64
-    then callPackage ../development/libraries/libtiff/aarch64-darwin.nix { }
-    else callPackage ../development/libraries/libtiff { };
+  libtiff = callPackage ../development/libraries/libtiff { };

  libtiger = callPackage ../development/libraries/libtiger { };

@ -22158,14 +22157,14 @@ with pkgs;
  ### DEVELOPMENT / PERL MODULES

  perlInterpreters = callPackages ../development/interpreters/perl {};
-  inherit (perlInterpreters) perl532 perl534 perldevel;
+  inherit (perlInterpreters) perl534 perl536 perldevel;

-  perl532Packages = recurseIntoAttrs perl532.pkgs;
  perl534Packages = recurseIntoAttrs perl534.pkgs;
+  perl536Packages = recurseIntoAttrs perl536.pkgs;
  perldevelPackages = perldevel.pkgs;

-  perl = perl534;
-  perlPackages = perl534Packages;
+  perl = perl536;
+  perlPackages = perl536Packages;

  ack = perlPackages.ack;

@ -23798,14 +23797,14 @@ with pkgs;
  gomplate = callPackage ../development/tools/gomplate { };

  gpm = callPackage ../servers/gpm {
-    ncurses = null;  # Keep curses disabled for lack of value
+    withNcurses = false; # Keep curses disabled for lack of value

    # latest 6.8 mysteriously fails to parse '@headings single':
    #   https://lists.gnu.org/archive/html/bug-texinfo/2021-09/msg00011.html
    texinfo = buildPackages.texinfo6_7;
  };

-  gpm-ncurses = gpm.override { inherit ncurses; };
+  gpm-ncurses = gpm.override { withNcurses = true; };

  gpu-switch = callPackage ../os-specific/linux/gpu-switch { };

@ -24570,16 +24569,6 @@ with pkgs;
    gnupg = callPackage ../tools/security/gnupg/23.nix {
      enableMinimal = true;
      guiSupport = false;
-      pcsclite = null;
-      sqlite = null;
-      pinentry = null;
-      adns = null;
-      gnutls = null;
-      libusb1 = null;
-      openldap = null;
-      readline = null;
-      zlib = null;
-      bzip2 = null;
    };
  };
  systemdMinimal = systemd.override {
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -1549,10 +1549,10 @@ let

  BKeywords = buildPerlPackage rec {
    pname = "B-Keywords";
-    version = "1.22";
+    version = "1.24";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/B-Keywords-${version}.tar.gz";
-      sha256 = "0i2ksp0w9wv1qc22hrdl3k48cww64syhmv8zf6x0kgyd4081hr56";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/B-Keywords-1.24.tar.gz";
+      sha256 = "sha256-pc9rsoXQbRfO4id4O3I7snQhP9QVOl3uMR0kDhFpYG4=";
    };
    meta = {
      description = "Lists of reserved barewords and symbol names";
@ -4178,10 +4178,10 @@ let

  CpanelJSONXS = buildPerlPackage {
    pname = "Cpanel-JSON-XS";
-    version = "4.25";
+    version = "4.31";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.25.tar.gz";
-      sha256 = "061940vyj9y3rzwq47z2a3f5i5rfpa90ccz7fgz228zr7njkvfpr";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.31.tar.gz";
+      sha256 = "sha256-AqZ6zuPeJKcow5ZIaADiojVZGlQ9B5REmtOI/j1c/yk=";
    };
    meta = {
      description = "CPanel fork of JSON::XS, fast and correct serializing";
@ -5046,10 +5046,10 @@ let

  CryptX = buildPerlPackage {
    pname = "CryptX";
-    version = "0.069";
+    version = "0.076";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIK/CryptX-0.069.tar.gz";
-      sha256 = "b5503a35046a973174234a823dba63403b080957c4a370d60d66aa7c7587d850";
+      url = "mirror://cpan/authors/id/M/MI/MIK/CryptX-0.076.tar.gz";
+      sha256 = "sha256-u4SsASQ4x87NtRpab/+08f7jsOrgAi6WzrwuFnUiYhw=";
    };
    meta = {
      description = "Crypto toolkit";
@ -6450,18 +6450,11 @@ let

  DBIxClass = buildPerlPackage {
    pname = "DBIx-Class";
-    version = "0.082842";
+    version = "0.082843";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RI/RIBASUSHI/DBIx-Class-0.082842.tar.gz";
-      sha256 = "1rh7idjjbibc1zmiaaarask434lh0lx7f2xyfwmy37k9fa0xcpmh";
+      url = "mirror://cpan/authors/id/R/RI/RIBASUSHI/DBIx-Class-0.082843.tar.gz";
+      sha256 = "sha256-NB4Lbssp2MSRdKbAnXxtvzhym6QBXuf9cDYKT/7h8lE=";
    };
-    patches = [
-      # https://github.com/Perl5/DBIx-Class/pull/141
-      (fetchpatch {
-        url = "https://github.com/Perl5/DBIx-Class/commit/fb896701d23fa4da622b5b1b2afbbba3da2dd8f3.patch";
-        sha256 = "sha256-MSbV9UfHu90NCdC5IFwuy/vpSDw4atfellYh7Ydvkm4=";
-      })
-    ];
    buildInputs = [ DBDSQLite TestDeep TestException TestWarn ];
    propagatedBuildInputs = [ ClassAccessorGrouped ClassC3Componentised ConfigAny ContextPreserve DBI DataDumperConcise DataPage DevelGlobalDestruction ModuleFind PathClass SQLAbstractClassic ScopeGuard SubName namespaceclean ];
    meta = {
@ -7740,10 +7733,10 @@ let

  Encode = buildPerlPackage {
    pname = "Encode";
-    version = "3.08";
+    version = "3.19";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DA/DANKOGAI/Encode-3.08.tar.gz";
-      sha256 = "0nvvs5a7sz2x38isr5na31fa6ja85cpvmbn07qx0l50ss00ks1pd";
+      url = "mirror://cpan/authors/id/D/DA/DANKOGAI/Encode-3.19.tar.gz";
+      sha256 = "sha256-kWP4SO72nk1MyIODl/CGH9nqft4AERfb2WlPjZUFLvU=";
    };
    meta = {
      description = "Character encodings in Perl";
@ -19834,10 +19827,10 @@ let

  ScopeUpper = buildPerlPackage {
    pname = "Scope-Upper";
-    version = "0.32";
+    version = "0.33";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/V/VP/VPIT/Scope-Upper-0.32.tar.gz";
-      sha256 = "ccaff3251c092f2af8b5ad840b76655c4bc4ccf504ff7bde233811822a40abcf";
+      url = "mirror://cpan/authors/id/V/VP/VPIT/Scope-Upper-0.33.tar.gz";
+      sha256 = "sha256-XzO+Aa1o/L7G74HusDs1EaL18HUq1RPZk6TBOl+xpkg=";
    };
    meta = {
      description = "Act on upper scopes";
@ -19878,10 +19871,10 @@ let

  SerealDecoder = buildPerlPackage {
    pname = "Sereal-Decoder";
-    version = "4.018";
+    version = "4.025";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-4.018.tar.gz";
-      sha256 = "0wfdixpm3p94mnng474l0nh9mjiy8q8hbrbh2af4vwn2hmazr91f";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-4.025.tar.gz";
+      sha256 = "sha256-jg47mprxp3i33iFQb6MHl/sbUg3NAC8/KebctSRG3qU=";
    };
    buildInputs = [ TestDeep TestDifferences TestLongString TestWarn ];
    preBuild = "ls";
@ -19895,10 +19888,10 @@ let

  SerealEncoder = buildPerlPackage {
    pname = "Sereal-Encoder";
-    version = "4.018";
+    version = "4.025";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-4.018.tar.gz";
-      sha256 = "0z9dbkr8ggjqb5g1sikxhy1a359bg08gs3vfg9icqm6xx4gjsv6p";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-4.025.tar.gz";
+      sha256 = "sha256-D9UbpggwJmUNCFJnWCYRc8GKuCNMVSb6x+25GtnGAm4=";
    };
    buildInputs = [ SerealDecoder TestDeep TestDifferences TestLongString TestWarn ];
    meta = {
@ -19911,10 +19904,10 @@ let

  Sereal = buildPerlPackage {
    pname = "Sereal";
-    version = "4.018";
+    version = "4.025";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-4.018.tar.gz";
-      sha256 = "0pqygrl88jp2w73jd9cw4k22fhvh5vcwqbiwl9wpxm67ql95cwwa";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-4.025.tar.gz";
+      sha256 = "sha256-C+X+VStQtnhjk+Q+qczldzpItf80o6zyopWqdgmgYrk=";
    };
    buildInputs = [ TestDeep TestLongString TestWarn ];
    propagatedBuildInputs = [ SerealDecoder SerealEncoder ];
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@ -5,6 +5,7 @@
 self: super:

 with self; with super; {
+  attrs = callPackage ../development/python2-modules/attrs { };

  bootstrapped-pip = callPackage ../development/python2-modules/bootstrapped-pip { };