diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index f5082bf226d7e..e8a21ad7661ea 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -16,8 +16,12 @@ In addition to numerous new and upgraded packages, this release has the followin
     It's recommended to use `nixos-rebuild boot` and `reboot`, rather than `nixos-rebuild switch` - since in some rare cases
     the switch of a live system might fail.
 
+  - glibc: 2.35 -\> 2.37
+
 - Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed.
 
+- GNOME has been upgraded to version 44. Please see the [release notes](https://release.gnome.org/44/) for details.
+
 - KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.
 
 - `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.
@@ -228,7 +232,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `vim_configurable` has been renamed to `vim-full` to avoid confusion: `vim-full`'s build-time features are configurable, but both `vim` and `vim-full` are _customizable_ (in the sense of user configuration, like vimrc).
 
-- Pantheon now defaults to Mutter 42 and GNOME settings daemon 42, all Pantheon packages are now tracking elementary OS 7 updates.
+- Pantheon now defaults to Mutter 43 and GNOME settings daemon 43, all Pantheon packages are now tracking elementary OS 7 updates.
 
 - The module for the application firewall `opensnitch` got the ability to configure rules. Available as [services.opensnitch.rules](#opt-services.opensnitch.rules)
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index ed6c12197668a..148722b6ad668 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -277,6 +277,7 @@
   ./security/doas.nix
   ./security/duosec.nix
   ./security/google_oslogin.nix
+  ./security/ipa.nix
   ./security/lock-kernel-modules.nix
   ./security/misc.nix
   ./security/oath.nix
diff --git a/nixos/modules/security/ipa.nix b/nixos/modules/security/ipa.nix
new file mode 100644
index 0000000000000..7075be95040ee
--- /dev/null
+++ b/nixos/modules/security/ipa.nix
@@ -0,0 +1,258 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.security.ipa;
+  pyBool = x:
+    if x
+    then "True"
+    else "False";
+
+  ldapConf = pkgs.writeText "ldap.conf" ''
+    # Turning this off breaks GSSAPI used with krb5 when rdns = false
+    SASL_NOCANON    on
+
+    URI ldaps://${cfg.server}
+    BASE ${cfg.basedn}
+    TLS_CACERT /etc/ipa/ca.crt
+  '';
+  nssDb =
+    pkgs.runCommand "ipa-nssdb"
+    {
+      nativeBuildInputs = [pkgs.nss.tools];
+    } ''
+      mkdir -p $out
+      certutil -d $out -N --empty-password
+      certutil -d $out -A --empty-password -n "${cfg.realm} IPA CA" -t CT,C,C -i ${cfg.certificate}
+    '';
+in {
+  options = {
+    security.ipa = {
+      enable = mkEnableOption (lib.mdDoc "FreeIPA domain integration");
+
+      certificate = mkOption {
+        type = types.package;
+        description = lib.mdDoc ''
+          IPA server CA certificate.
+
+          Use `nix-prefetch-url http://$server/ipa/config/ca.crt` to
+          obtain the file and the hash.
+        '';
+        example = literalExpression ''
+          pkgs.fetchurl {
+            url = http://ipa.example.com/ipa/config/ca.crt;
+            sha256 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+          };
+        '';
+      };
+
+      domain = mkOption {
+        type = types.str;
+        example = "example.com";
+        description = lib.mdDoc "Domain of the IPA server.";
+      };
+
+      realm = mkOption {
+        type = types.str;
+        example = "EXAMPLE.COM";
+        description = lib.mdDoc "Kerberos realm.";
+      };
+
+      server = mkOption {
+        type = types.str;
+        example = "ipa.example.com";
+        description = lib.mdDoc "IPA Server hostname.";
+      };
+
+      basedn = mkOption {
+        type = types.str;
+        example = "dc=example,dc=com";
+        description = lib.mdDoc "Base DN to use when performing LDAP operations.";
+      };
+
+      offlinePasswords = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Whether to store offline passwords when the server is down.";
+      };
+
+      cacheCredentials = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Whether to cache credentials.";
+      };
+
+      ifpAllowedUids = mkOption {
+        type = types.listOf types.string;
+        default = ["root"];
+        description = lib.mdDoc "A list of users allowed to access the ifp dbus interface.";
+      };
+
+      dyndns = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = lib.mdDoc "Whether to enable FreeIPA automatic hostname updates.";
+        };
+
+        interface = mkOption {
+          type = types.str;
+          example = "eth0";
+          default = "*";
+          description = lib.mdDoc "Network interface to perform hostname updates through.";
+        };
+      };
+
+      chromiumSupport = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Whether to whitelist the FreeIPA domain in Chromium.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !config.krb5.enable;
+        message = "krb5 must be disabled through `krb5.enable` for FreeIPA integration to work.";
+      }
+      {
+        assertion = !config.users.ldap.enable;
+        message = "ldap must be disabled through `users.ldap.enable` for FreeIPA integration to work.";
+      }
+    ];
+
+    environment.systemPackages = with pkgs; [krb5Full freeipa];
+
+    environment.etc = {
+      "ipa/default.conf".text = ''
+        [global]
+        basedn = ${cfg.basedn}
+        realm = ${cfg.realm}
+        domain = ${cfg.domain}
+        server = ${cfg.server}
+        host = ${config.networking.hostName}
+        xmlrpc_uri = https://${cfg.server}/ipa/xml
+        enable_ra = True
+      '';
+
+      "ipa/nssdb".source = nssDb;
+
+      "krb5.conf".text = ''
+        [libdefaults]
+         default_realm = ${cfg.realm}
+         dns_lookup_realm = false
+         dns_lookup_kdc = true
+         rdns = false
+         ticket_lifetime = 24h
+         forwardable = true
+         udp_preference_limit = 0
+
+        [realms]
+         ${cfg.realm} = {
+          kdc = ${cfg.server}:88
+          master_kdc = ${cfg.server}:88
+          admin_server = ${cfg.server}:749
+          default_domain = ${cfg.domain}
+          pkinit_anchors = FILE:/etc/ipa/ca.crt
+        }
+
+        [domain_realm]
+         .${cfg.domain} = ${cfg.realm}
+         ${cfg.domain} = ${cfg.realm}
+         ${cfg.server} = ${cfg.realm}
+
+        [dbmodules]
+          ${cfg.realm} = {
+            db_library = ${pkgs.freeipa}/lib/krb5/plugins/kdb/ipadb.so
+          }
+      '';
+
+      "openldap/ldap.conf".source = ldapConf;
+    };
+
+    environment.etc."chromium/policies/managed/freeipa.json" = mkIf cfg.chromiumSupport {
+      text = ''
+        { "AuthServerWhitelist": "*.${cfg.domain}" }
+      '';
+    };
+
+    system.activationScripts.ipa = stringAfter ["etc"] ''
+      # libcurl requires a hard copy of the certificate
+      if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
+        rm -f /etc/ipa/ca.crt
+        cp ${cfg.certificate} /etc/ipa/ca.crt
+      fi
+
+      if [ ! -f /etc/krb5.keytab ]; then
+        cat <<EOF
+
+          In order to complete FreeIPA integration, please join the domain by completing the following steps:
+          1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm}
+          2. Join the domain and obtain the keytab file: ipa-join
+          3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/
+          4. Restart sssd systemd service: sudo systemctl restart sssd
+
+      EOF
+      fi
+    '';
+
+    services.sssd.config = ''
+      [domain/${cfg.domain}]
+      id_provider = ipa
+      auth_provider = ipa
+      access_provider = ipa
+      chpass_provider = ipa
+
+      ipa_domain = ${cfg.domain}
+      ipa_server = _srv_, ${cfg.server}
+      ipa_hostname = ${config.networking.hostName}.${cfg.domain}
+
+      cache_credentials = ${pyBool cfg.cacheCredentials}
+      krb5_store_password_if_offline = ${pyBool cfg.offlinePasswords}
+      ${optionalString ((toLower cfg.domain) != (toLower cfg.realm))
+        "krb5_realm = ${cfg.realm}"}
+
+      dyndns_update = ${pyBool cfg.dyndns.enable}
+      dyndns_iface = ${cfg.dyndns.interface}
+
+      ldap_tls_cacert = /etc/ipa/ca.crt
+      ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber, lock:nsaccountlock
+
+      [sssd]
+      debug_level = 65510
+      services = nss, sudo, pam, ssh, ifp
+      domains = ${cfg.domain}
+
+      [nss]
+      homedir_substring = /home
+
+      [pam]
+      pam_pwd_expiration_warning = 3
+      pam_verbosity = 3
+
+      [sudo]
+      debug_level = 65510
+
+      [autofs]
+
+      [ssh]
+
+      [pac]
+
+      [ifp]
+      user_attributes = +mail, +telephoneNumber, +givenname, +sn, +lock
+      allowed_uids = ${concatStringsSep ", " cfg.ifpAllowedUids}
+    '';
+
+    services.ntp.servers = singleton cfg.server;
+    services.sssd.enable = true;
+    services.ntp.enable = true;
+
+    security.pki.certificateFiles = singleton cfg.certificate;
+  };
+}
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index 2b553adf2bd60..6204dc731ad96 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -85,7 +85,8 @@ in rec {
       stdenv
       subversion
       tarball
-      vim;
+      vim
+      tests-stdenv-gcc-stageCompare;
   };
 
   tested = let
@@ -135,6 +136,7 @@ in rec {
         "nixos.tests.proxy"
         "nixos.tests.simple"
         "nixpkgs.jdk"
+        "nixpkgs.tests-stdenv-gcc-stageCompare"
       ])
     ];
   };
diff --git a/nixos/tests/gnome-xorg.nix b/nixos/tests/gnome-xorg.nix
index 618458b1f6b5b..d616d4f02351a 100644
--- a/nixos/tests/gnome-xorg.nix
+++ b/nixos/tests/gnome-xorg.nix
@@ -24,7 +24,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
       services.xserver.desktopManager.gnome.enable = true;
       services.xserver.desktopManager.gnome.debug = true;
       services.xserver.displayManager.defaultSession = "gnome-xorg";
-      programs.gnome-terminal.enable = true;
 
       systemd.user.services = {
         "org.gnome.Shell@x11" = {
@@ -61,10 +60,10 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     # False when startup is done
     startingUp = su "${gdbus} ${eval} Main.layoutManager._startingUp";
 
-    # Start gnome-terminal
-    gnomeTerminalCommand = su "gnome-terminal";
+    # Start Console
+    launchConsole = su "${bus} gapplication launch org.gnome.Console";
 
-    # Hopefully gnome-terminal's wm class
+    # Hopefully Console's wm class
     wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
   in ''
       with subtest("Login to GNOME Xorg with GDM"):
@@ -82,13 +81,17 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
               "${startingUp} | grep -q 'true,..false'"
           )
 
-      with subtest("Open Gnome Terminal"):
+      with subtest("Open Console"):
+          # Close the Activities view so that Shell can correctly track the focused window.
+          machine.send_key("esc")
+
           machine.succeed(
-              "${gnomeTerminalCommand}"
+              "${launchConsole}"
           )
-          # correct output should be (true, '"Gnome-terminal"')
+          # correct output should be (true, '"kgx"')
+          # For some reason, this deviates from Wayland.
           machine.wait_until_succeeds(
-              "${wmClass} | grep -q  'true,...Gnome-terminal'"
+              "${wmClass} | grep -q  'true,...kgx'"
           )
           machine.sleep(20)
           machine.screenshot("screen")
diff --git a/nixos/tests/gnome.nix b/nixos/tests/gnome.nix
index 05619cbd7d82a..5a28e3bb0e810 100644
--- a/nixos/tests/gnome.nix
+++ b/nixos/tests/gnome.nix
@@ -22,14 +22,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
 
       services.xserver.desktopManager.gnome.enable = true;
       services.xserver.desktopManager.gnome.debug = true;
-      programs.gnome-terminal.enable = true;
-
-      environment.systemPackages = [
-        (pkgs.makeAutostartItem {
-          name = "org.gnome.Terminal";
-          package = pkgs.gnome.gnome-terminal;
-        })
-      ];
 
       systemd.user.services = {
         "org.gnome.Shell@wayland" = {
@@ -64,10 +56,10 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     # False when startup is done
     startingUp = su "${gdbus} ${eval} Main.layoutManager._startingUp";
 
-    # Start gnome-terminal
-    gnomeTerminalCommand = su "${bus} gnome-terminal";
+    # Start Console
+    launchConsole = su "${bus} gapplication launch org.gnome.Console";
 
-    # Hopefully gnome-terminal's wm class
+    # Hopefully Console's wm class
     wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
   in ''
       with subtest("Login to GNOME with GDM"):
@@ -86,10 +78,16 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
               "${startingUp} | grep -q 'true,..false'"
           )
 
-      with subtest("Open Gnome Terminal"):
-          # correct output should be (true, '"gnome-terminal-server"')
+      with subtest("Open Console"):
+          # Close the Activities view so that Shell can correctly track the focused window.
+          machine.send_key("esc")
+
+          machine.succeed(
+              "${launchConsole}"
+          )
+          # correct output should be (true, '"org.gnome.Console"')
           machine.wait_until_succeeds(
-              "${wmClass} | grep -q 'gnome-terminal-server'"
+              "${wmClass} | grep -q 'true,...org.gnome.Console'"
           )
           machine.sleep(20)
           machine.screenshot("screen")
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 3eb2cf20ee777..1e97b7badb48d 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , makeWrapper
 , pkg-config
-, perl
+, libOnly ? false # whether to build only the library
 , withAlsa ? stdenv.hostPlatform.isLinux
 , alsa-lib
 , withPulse ? stdenv.hostPlatform.isLinux
@@ -14,29 +14,36 @@
 , withJack ? stdenv.hostPlatform.isUnix
 , jack
 , withConplay ? !stdenv.hostPlatform.isWindows
+, perl
 }:
 
+assert withConplay -> !libOnly;
+
 stdenv.mkDerivation rec {
-  pname = "mpg123";
-  version = "1.31.2";
+  pname = "${lib.optionalString libOnly "lib"}mpg123";
+  version = "1.31.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-sX8ikF4x9DtrQB399qce0Ru30Fb2jbRJ1wufmug5x94=";
+    url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
+    hash = "sha256-HKd9Omml/4RbegU294P+5VThBBE5prl49q/hT1gUrRo=";
   };
 
-  outputs = [ "out" ] ++ lib.optionals withConplay [ "conplay" ];
+  outputs = [ "out" ] ++ lib.optional withConplay "conplay";
 
-  nativeBuildInputs = lib.optionals withConplay [ makeWrapper ]
-    ++ lib.optionals (withPulse || withJack) [ pkg-config ];
+  nativeBuildInputs = lib.optionals (!libOnly) (
+    lib.optionals withConplay [ makeWrapper ]
+    ++ lib.optionals (withPulse || withJack) [ pkg-config ]
+  );
 
-  buildInputs = lib.optionals withConplay [ perl ]
+  buildInputs = lib.optionals (!libOnly) (
+    lib.optionals withConplay [ perl ]
     ++ lib.optionals withAlsa [ alsa-lib ]
     ++ lib.optionals withPulse [ libpulseaudio ]
     ++ lib.optionals withCoreAudio [ AudioUnit AudioToolbox ]
-    ++ lib.optionals withJack [ jack ];
+    ++ lib.optionals withJack [ jack ]
+  );
 
-  configureFlags = [
+  configureFlags = lib.optionals (!libOnly) [
     "--with-audio=${lib.strings.concatStringsSep "," (
       lib.optional withJack "jack"
       ++ lib.optional withPulse "pulse"
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index b7b70eb501ea1..af6c8f7c6f8d5 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -1,12 +1,11 @@
-{ lib, stdenv, fetchurl, lzip
-}:
+{ lib, stdenv, fetchurl, lzip }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   pname = "ed";
   version = "1.19";
 
@@ -17,11 +16,14 @@ stdenv.mkDerivation (rec {
 
   nativeBuildInputs = [ lzip ];
 
-  doCheck = true; # not cross;
+  configureFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  doCheck = true;
 
   meta = {
     description = "An implementation of the standard Unix editor";
-
     longDescription = ''
       GNU ed is a line-oriented text editor.  It is used to create,
       display, modify and otherwise manipulate text files, both
@@ -32,17 +34,9 @@ stdenv.mkDerivation (rec {
       available.  For most purposes, however, it is superseded by
       full-screen editors such as GNU Emacs or GNU Moe.
     '';
-
     license = lib.licenses.gpl3Plus;
-
     homepage = "https://www.gnu.org/software/ed/";
-
     maintainers = [ ];
     platforms = lib.platforms.unix;
   };
-} // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
-  # This may be moved above during a stdenv rebuild.
-  preConfigure = ''
-    configureFlagsArray+=("CC=$CC")
-  '';
-})
+}
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index e7bfadfaf3f1e..53043294539a8 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -62,9 +62,17 @@ assert withXwidgets -> withGTK3 && webkitgtk != null;
 assert withTreeSitter -> tree-sitter != null;
 
 
+let
+  libGccJitLibraryPaths = [
+    "${lib.getLib libgccjit}/lib/gcc"
+    "${lib.getLib stdenv.cc.libc}/lib"
+  ] ++ lib.optionals (stdenv.cc?cc.libgcc) [
+    "${lib.getLib stdenv.cc.cc.libgcc}/lib"
+  ];
+in
 (if withMacport then llvmPackages_6.stdenv else stdenv).mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
   NATIVE_FULL_AOT = "1";
-  LIBRARY_PATH = "${lib.getLib stdenv.cc.libc}/lib";
+  LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
 } // {
   pname = pname + lib.optionalString ( !withX && !withNS && !withMacport && !withGTK2 && !withGTK3 ) "-nox";
   inherit version;
@@ -75,17 +83,15 @@ assert withTreeSitter -> tree-sitter != null;
             then ./native-comp-driver-options-28.patch
             else ./native-comp-driver-options.patch;
       backendPath = (lib.concatStringsSep " "
-        (builtins.map (x: ''"-B${x}"'') [
+        (builtins.map (x: ''"-B${x}"'') ([
           # Paths necessary so the JIT compiler finds its libraries:
           "${lib.getLib libgccjit}/lib"
-          "${lib.getLib libgccjit}/lib/gcc"
-          "${lib.getLib stdenv.cc.libc}/lib"
-
+        ] ++ libGccJitLibraryPaths ++ [
           # Executable paths necessary for compilation (ld, as):
           "${lib.getBin stdenv.cc.cc}/bin"
           "${lib.getBin stdenv.cc.bintools}/bin"
           "${lib.getBin stdenv.cc.bintools.bintools}/bin"
-        ]));
+        ])));
     })
   ];
 
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index d04e2507c9174..2e43f8b66eeac 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -5,7 +5,6 @@
 , desktop-file-utils
 , editorconfig-core-c
 , fetchurl
-, fetchpatch
 , flatpak
 , gnome
 , libgit2-glib
@@ -18,6 +17,7 @@
 , json-glib
 , jsonrpc-glib
 , libadwaita
+, libdex
 , libpanel
 , libpeas
 , libportal-gtk4
@@ -33,7 +33,7 @@
 , template-glib
 , vala
 , vte-gtk4
-, webkitgtk_5_0
+, webkitgtk_6_0
 , wrapGAppsHook4
 , dbus
 , xvfb-run
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-builder";
-  version = "43.6";
+  version = "44.1";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "m08hPdloyVL75CJoUPXJVk3f1XimoPiT06K2rhmjd6k=";
+    sha256 = "+Tmn+VtLbh0EvY20vpygtnsqp2W4bGP03yP9s6ftzz4=";
   };
 
   patches = [
@@ -92,6 +92,7 @@ stdenv.mkDerivation rec {
     json-glib
     jsonrpc-glib
     libadwaita
+    libdex
     libpanel
     libxml2
     ostree
@@ -101,7 +102,7 @@ stdenv.mkDerivation rec {
     sysprof
     template-glib
     vala
-    webkitgtk_5_0
+    webkitgtk_6_0
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index f963dfec66d02..e946139e6e832 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,15 +1,16 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1403";
+  version = "9.0.1441";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-z+zLRO0yqWu/l3eOzD7pmUvmqhmkH5W9z7wE9QWlsG0=";
+    hash = "sha256-tGWOIXx4gNMg0CB4ytUrj9bQLXw+4pl2lfgGR81+EJk=";
   };
 
   enableParallelBuilding = true;
+  enableParallelInstalling = false;
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/applications/graphics/gnome-photos/default.nix b/pkgs/applications/graphics/gnome-photos/default.nix
index d3d3d66feb976..7a51f037f9951 100644
--- a/pkgs/applications/graphics/gnome-photos/default.nix
+++ b/pkgs/applications/graphics/gnome-photos/default.nix
@@ -35,27 +35,17 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-photos";
-  version = "43.0";
+  version = "44.0";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "x6x0WNUz8p2VUBHHS3YiTXnqMbzBLp1tDOe2w3BNCOE=";
+    sha256 = "544hA5fTxigJxs1VIdpuzLShHd6lvyr4YypH9Npcgp4=";
   };
 
   patches = [
     ./installed-tests-path.patch
-
-    # Support babel 0.1.100
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gnome-photos/-/commit/64c6f733a44bac5b7f08445a686c000681f93f5f.patch";
-      hash = "sha256-iB5qCcDEH8pEX42ypEGJ9QMJWE8VXirv5JfdC1jP218=";
-    })
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gnome-photos/-/commit/9db32c3508a8c5d357a053d5f8278c34b4df18f3.patch";
-      hash = "sha256-iz6gSu5rUBZ3Ki5GSRVuLcwX0LRQvJT17XmXQ7WJSmI=";
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/komikku/default.nix b/pkgs/applications/graphics/komikku/default.nix
index 2e9847ca44f5c..564af456f0f16 100644
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitLab
+, fetchpatch
 , desktop-file-utils
 , gettext
 , glib
@@ -7,7 +8,7 @@
 , gtk4
 , libadwaita
 , libnotify
-, webkitgtk_5_0
+, webkitgtk_6_0
 , meson
 , ninja
 , pkg-config
@@ -29,6 +30,18 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-DxW9uefY6Fks3qSUeLMp3BB85SfLgzwBr4KO9do2y2o=";
   };
 
+  patches = [
+    # https://gitlab.com/valos/Komikku/-/merge_requests/208
+    (fetchpatch {
+      url = "https://gitlab.com/valos/Komikku/-/commit/c9a09817acd767a7cb4ceea9b212fffd798eae61.patch";
+      hash = "sha256-McjQApLY7OKbdelrTeh3aRw90B6T9V5FtLL5Y62BmGA=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/valos/Komikku/-/commit/bda93631420f6a69a50be0068f259d60b9558930.patch";
+      hash = "sha256-Xu+IaQKf0I99a2uh97j8xSlGYSJHuNPMy/zZtWRxLaM=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -45,7 +58,7 @@ python3.pkgs.buildPythonApplication rec {
     gtk4
     libadwaita
     libnotify
-    webkitgtk_5_0
+    webkitgtk_6_0
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/misc/feedbackd/default.nix b/pkgs/applications/misc/feedbackd/default.nix
index e3dd4f94b86bb..a8345035db076 100644
--- a/pkgs/applications/misc/feedbackd/default.nix
+++ b/pkgs/applications/misc/feedbackd/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch2
 , docbook-xsl-nons
 , docutils
 , gi-docgen
@@ -43,6 +44,13 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://source.puri.sm/Librem5/feedbackd/-/merge_requests/109.patch";
+      hash = "sha256-z3Ud6P2GHYOaGA2vJDD3Sz47+M8p0VcYZ5gbYcGydMk=";
+    })
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/applications/misc/girara/default.nix b/pkgs/applications/misc/girara/default.nix
index 841aeca58969a..a6736c7a2dd3a 100644
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@@ -1,21 +1,64 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, check, dbus, xvfb-run, glib, gtk, gettext, libiconv, json_c, libintl
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch2
+, meson
+, ninja
+, pkg-config
+, check
+, dbus
+, xvfb-run
+, glib
+, gtk
+, gettext
+, libiconv
+, json-glib
+, libintl
 }:
 
 stdenv.mkDerivation rec {
   pname = "girara";
-  version = "0.3.7";
+  version = "0.3.9";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://git.pwmt.org/pwmt/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-QTQiE/jnRSWPHbKMu2zMJ6YwCaXgAb95G74BzkNtTbc=";
+    hash = "sha256-DoqYykR/N17BHQ90GoLvAYluQ3odWPwUGRTacN6BiWU=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config gettext check dbus ];
-  buildInputs = [ libintl libiconv json_c ];
-  propagatedBuildInputs = [ glib gtk ];
-  nativeCheckInputs = [ xvfb-run ];
+  patches = [
+    # Fix memory management bug revealed by GLib 2.76.
+    # https://git.pwmt.org/pwmt/girara/-/issues/17
+    (fetchpatch2 {
+      url = "https://git.pwmt.org/pwmt/girara/-/commit/6926cc1234853ccf3010a1e2625aafcf462ed60e.patch";
+      hash = "sha256-uayT6ikXtaBPxhZFyskShug3Tbvy2a9qimLRwdiAsic=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    check
+    dbus
+  ];
+
+  buildInputs = [
+    libintl
+    libiconv
+    json-glib
+  ];
+
+  propagatedBuildInputs = [
+    glib
+    gtk
+  ];
+
+  nativeCheckInputs = [
+    xvfb-run
+  ];
 
   doCheck = !stdenv.isDarwin;
 
diff --git a/pkgs/applications/misc/orca/default.nix b/pkgs/applications/misc/orca/default.nix
index d88c4f549d319..e80da5170ac66 100644
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@@ -34,13 +34,13 @@
 
 buildPythonApplication rec {
   pname = "orca";
-  version = "43.1";
+  version = "44.0";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "9ljgSc4WknO4Q0aBBCTW9QkpHwXX7MOnegPZEqo+aEA=";
+    sha256 = "e8WX7AvBtnQgC2L995XUuulkemNxfXVN9hWHzCUFAs4=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index f7f94d9940ab4..f5e13987aff40 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -11,7 +11,8 @@ let
     packageOverrides = self: super: {
       sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.24";
-        src = oldAttrs.src.override {
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
           inherit version;
           hash = "sha256-67t3fL+TEjWbiXv4G6ANrg9ctp+6KhgmXcwYpvXvdRk=";
         };
diff --git a/pkgs/applications/networking/instant-messengers/tangram/default.nix b/pkgs/applications/networking/instant-messengers/tangram/default.nix
index 6f9b7269bf9ba..30727553248f7 100644
--- a/pkgs/applications/networking/instant-messengers/tangram/default.nix
+++ b/pkgs/applications/networking/instant-messengers/tangram/default.nix
@@ -18,7 +18,7 @@
 , ninja
 , pkg-config
 , python3
-, webkitgtk_5_0
+, webkitgtk_6_0
 , blueprint-compiler
 , wrapGAppsHook
 }:
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     gsettings-desktop-schemas
     gtk4
     libadwaita
-    webkitgtk_5_0
+    webkitgtk_6_0
   ] ++ (with gst_all_1; [
     gstreamer
     gst-libav
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
index 763ed658af88e..ab8a24bb09319 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@@ -1,7 +1,6 @@
 { lib
 , fetchFromGitHub
 , fetchpatch
-, fetchurl
 , callPackage
 , pkg-config
 , cmake
@@ -71,13 +70,6 @@ let
       cxxStandard = "20";
     };
   };
-  glibmm = glibmm_2_68.overrideAttrs (_: {
-    version = "2.76.0";
-    src = fetchurl {
-      url = "mirror://gnome/sources/glibmm/2.76/glibmm-2.76.0.tar.xz";
-      sha256 = "sha256-hjfYDOq9lP3dbkiXCggqJkVY1KuCaE4V/8h+fvNGKrI=";
-    };
-  });
 in
 stdenv.mkDerivation rec {
   pname = "telegram-desktop";
@@ -147,7 +139,7 @@ stdenv.mkDerivation rec {
     range-v3
     tl-expected
     hunspell
-    glibmm
+    glibmm_2_68
     webkitgtk_4_1
     jemalloc
     rnnoise
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index 65bb334611a6f..a7d902b2d3f9d 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -44,11 +44,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.46.4";
+  version = "3.48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "eghCMc7SRaNLcT141Dp3Zgyso79S5qT1AwpqCAxpez0=";
+    sha256 = "LYRygZWJ6S78zk8tw70STpPTedMwCXj2mpZTxZKmDvY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/abiword/default.nix b/pkgs/applications/office/abiword/default.nix
index c064ea94d04e9..954c50befc8a9 100644
--- a/pkgs/applications/office/abiword/default.nix
+++ b/pkgs/applications/office/abiword/default.nix
@@ -1,6 +1,22 @@
-{ lib, stdenv, fetchurl, pkg-config, gtk3, fribidi
-, libpng, popt, libgsf, enchant, wv, librsvg, bzip2, libjpeg, perl
-, boost, libxslt, goffice, wrapGAppsHook, gnome
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, gtk3
+, fribidi
+, libpng
+, popt
+, libgsf
+, enchant
+, wv
+, librsvg
+, bzip2
+, libjpeg
+, perl
+, boost
+, libxslt
+, goffice
+, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -12,15 +28,30 @@ stdenv.mkDerivation rec {
     hash = "sha256-ElckfplwUI1tFFbT4zDNGQnEtCsl4PChvDJSbW86IbQ=";
   };
 
-  enableParallelBuilding = true;
-
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook
+  ];
 
   buildInputs = [
-    gtk3 librsvg bzip2 fribidi libpng popt
-    libgsf enchant wv libjpeg perl boost libxslt goffice gnome.adwaita-icon-theme
+    gtk3
+    librsvg
+    bzip2
+    fribidi
+    libpng
+    popt
+    libgsf
+    enchant
+    wv
+    libjpeg
+    perl
+    boost
+    libxslt
+    goffice
   ];
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Word processing program, similar to Microsoft Word";
     homepage = "https://www.abisource.com/";
diff --git a/pkgs/applications/office/iotas/default.nix b/pkgs/applications/office/iotas/default.nix
index 0ec2939fa470b..532880f9e7b3c 100644
--- a/pkgs/applications/office/iotas/default.nix
+++ b/pkgs/applications/office/iotas/default.nix
@@ -14,7 +14,7 @@
 , libsecret
 , libadwaita
 , gtksourceview5
-, webkitgtk_5_0
+, webkitgtk_6_0
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -47,7 +47,7 @@ python3.pkgs.buildPythonApplication rec {
     libsecret
     libadwaita
     gtksourceview5
-    webkitgtk_5_0
+    webkitgtk_6_0
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index 574d9d17ccdf6..d7f3c357150b5 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -60,8 +60,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-4liPfNJ2JGniz8Os4Np+XSXCJBHND13XLPWDy3Gc/F8=";
 
-  auditable = true; # TODO: remove when this is the default
-
   nativeBuildInputs = [
     cmake
     installShellFiles
diff --git a/pkgs/applications/terminal-emulators/gnome-console/default.nix b/pkgs/applications/terminal-emulators/gnome-console/default.nix
index 95c4f0f71541a..460b6426cdfc8 100644
--- a/pkgs/applications/terminal-emulators/gnome-console/default.nix
+++ b/pkgs/applications/terminal-emulators/gnome-console/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-console";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-console/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "uWQkhaN6cOgswQVTsOJoF1a6Nh/15MvzGC8VAjH+qZ4=";
+    sha256 = "0cGv1eyNK9+Eo9sCmwSiQy7Me80kLCp0X+mYakKJiEQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/pitivi/default.nix b/pkgs/applications/video/pitivi/default.nix
index 7e6f89855ed2f..e15b0969e35d0 100644
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@@ -20,13 +20,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "pitivi";
-  version = "2022.06";
+  version = "2023.03";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pitivi/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Uz0448bSEcK9DpXiuWsPCDO98NXUd6zgffYRWDUGyDg=";
+    sha256 = "PX1OFEeavqMPvF613BKgxwErxqW2huw6mQxo8YpBS/M=";
   };
 
   patches = [
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index a7a71977c4ae3..c847e32d7a92a 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -117,6 +117,15 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-oC+bRjEHixv1QEFO9XAm4HHOwoiT+NkhknKGPydnZ5E=";
       revert = true;
     })
+    # glibc >=2.37 compat, see https://lore.kernel.org/qemu-devel/20230110174901.2580297-1-berrange@redhat.com/
+    (fetchpatch {
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/9f0246539ae84a5e21efd1cc4516fc343f08115a.patch";
+      sha256 = "sha256-1iWOWkLH0WP1Hk23fmrRVdX7YZWUXOvWRMTt8QM93BI=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/6003159ce18faad4e1bc7bf9c85669019cd4950e.patch";
+      sha256 = "sha256-DKGCbR+VDIFLp6FhER78gyJ3Rn1dD47pMtkcIIMd0B8=";
+    })
   ]
   ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;
 
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index cf9a351f39500..e8eb579e15add 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -46,6 +46,8 @@ while (( "$n" < "$nParams" )); do
         -nostdinc) cInclude=0 cxxInclude=0 ;;
         -nostdinc++) cxxInclude=0 ;;
         -nostdlib) cxxLibrary=0 ;;
+        -x*-header) dontLink=1 ;; # both `-x c-header` and `-xc-header` are accepted by clang
+        -xc++*) isCxx=1 ;;        # both `-xc++` and `-x c++` are accepted by clang
         -x)
             case "$p2" in
                 *-header) dontLink=1 ;;
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index d2a1ed39ee07f..597e8105fa1dd 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -17,9 +17,40 @@
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}
 , libcxx ? null
+
+# Whether or not to add `-B` and `-L` to `nix-support/cc-{c,ld}flags`
+, useCcForLibs ?
+
+  # Always add these flags for Clang, because in order to compile (most
+  # software) it needs libraries that are shipped and compiled with gcc.
+  if isClang then true
+
+  # Never add these flags for a build!=host cross-compiler or a host!=target
+  # ("cross-built-native") compiler; currently nixpkgs has a special build
+  # path for these (`crossStageStatic`).  Hopefully at some point that build
+  # path will be merged with this one and this conditional will be removed.
+  else if (with stdenvNoCC; buildPlatform != hostPlatform || hostPlatform != targetPlatform) then false
+
+  # Never add these flags when wrapping the bootstrapFiles' compiler; it has a
+  # /usr/-like layout with everything smashed into a single outpath, so it has
+  # no trouble finding its own libraries.
+  else if (cc.passthru.isFromBootstrapFiles or false) then false
+
+  # Add these flags when wrapping `xgcc` (the first compiler that nixpkgs builds)
+  else if (cc.passthru.isXgcc or false) then true
+
+  # Add these flags when wrapping `stdenv.cc`
+  else if (cc.stdenv.cc.cc.passthru.isXgcc or false) then true
+
+  # Do not add these flags in any other situation.  This is `false` mainly to
+  # prevent these flags from being added when wrapping *old* versions of gcc
+  # (e.g. `gcc6Stdenv`), since they will cause the old gcc to get `-B` and
+  # `-L` flags pointing at the new gcc's libstdc++ headers.  Example failure:
+  # https://hydra.nixos.org/build/213125495
+  else false
+
+# the derivation at which the `-B` and `-L` flags added by `useCcForLibs` will point
 , gccForLibs ? if useCcForLibs then cc else null
-# same as `gccForLibs`, but generalized beyond clang
-, useCcForLibs ? isClang
 }:
 
 with lib;
@@ -226,12 +257,10 @@ stdenv.mkDerivation {
         ln -s ${targetPrefix}clang++ $out/bin/${targetPrefix}c++
       fi
 
-      if [ -e $ccPath/cpp ]; then
-        wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
-    '' + lib.optionalString (hostPlatform != targetPlatform) ''
-      elif [ -e $ccPath/${targetPrefix}cpp ]; then
+      if [ -e $ccPath/${targetPrefix}cpp ]; then
         wrap ${targetPrefix}cpp $wrapper $ccPath/${targetPrefix}cpp
-    '' + ''
+      elif [ -e $ccPath/cpp ]; then
+        wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
       fi
     ''
 
@@ -323,7 +352,7 @@ stdenv.mkDerivation {
                       && targetPlatform.isLinux
                       && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
                       && !(stdenv.targetPlatform.useLLVM or false)
-                      && gccForLibs != null) ''
+                      && gccForLibs != null) (''
       echo "--gcc-toolchain=${gccForLibs}" >> $out/nix-support/cc-cflags
 
       # Pull in 'cc.out' target to get 'libstdc++fs.a'. It should be in
@@ -331,6 +360,11 @@ stdenv.mkDerivation {
       # TODO(trofi): remove once gcc is fixed to move libraries to .lib output.
       echo "-L${gccForLibs}/${optionalString (targetPlatform != hostPlatform) "/${targetPlatform.config}"}/lib" >> $out/nix-support/cc-ldflags
     ''
+    # this ensures that when clang passes -lgcc_s to lld (as it does
+    # when building e.g. firefox), lld is able to find libgcc_s.so
+    + lib.optionalString (gccForLibs?libgcc) ''
+      echo "-L${gccForLibs.libgcc}/lib" >> $out/nix-support/cc-ldflags
+    '')
 
     ##
     ## General libc support
diff --git a/pkgs/build-support/emacs/wrapper.nix b/pkgs/build-support/emacs/wrapper.nix
index 3f6a224fa6cd6..bd7702ebb9162 100644
--- a/pkgs/build-support/emacs/wrapper.nix
+++ b/pkgs/build-support/emacs/wrapper.nix
@@ -67,10 +67,12 @@ runCommand
     # Store all paths we want to add to emacs here, so that we only need to add
     # one path to the load lists
     deps = runCommand "emacs-packages-deps"
-      {
+      ({
         inherit explicitRequires lndir emacs;
         nativeBuildInputs = lib.optional nativeComp gcc;
-      }
+      } // lib.optionalAttrs nativeComp {
+        inherit (emacs) LIBRARY_PATH;
+      })
       ''
         findInputsOld() {
           local pkg="$1"; shift
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index aca313264a28c..9e401cc68aa2d 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -105,7 +105,7 @@ let
       runHook postConfigure
     '';
 
-    buildPhase = args.modBuildPhase or ''
+    buildPhase = args.modBuildPhase or (''
       runHook preBuild
     '' + lib.optionalString (deleteVendor == true) ''
       if [ ! -d vendor ]; then
@@ -133,7 +133,7 @@ let
       mkdir -p vendor
 
       runHook postBuild
-    '';
+    '');
 
     installPhase = args.modInstallPhase or ''
       runHook preInstall
@@ -176,7 +176,7 @@ let
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
     inherit CGO_ENABLED;
 
-    configurePhase = args.configurePhase or ''
+    configurePhase = args.configurePhase or (''
       runHook preConfigure
 
       export GOCACHE=$TMPDIR/go-cache
@@ -200,9 +200,9 @@ let
       fi
 
       runHook postConfigure
-    '';
+    '');
 
-    buildPhase = args.buildPhase or ''
+    buildPhase = args.buildPhase or (''
       runHook preBuild
 
       exclude='\(/_\|examples\|Godeps\|testdata'
@@ -282,7 +282,7 @@ let
       )
     '' + ''
       runHook postBuild
-    '';
+    '');
 
     doCheck = args.doCheck or true;
     checkPhase = args.checkPhase or ''
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index 9106bf9796ebb..e627058604d9b 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -99,7 +99,7 @@ let
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
 
-    configurePhase = args.configurePhase or ''
+    configurePhase = args.configurePhase or (''
       runHook preConfigure
 
       # Extract the source
@@ -141,7 +141,7 @@ let
       fi
 
       runHook postConfigure
-    '';
+    '');
 
     renameImports = args.renameImports or (
       let
@@ -151,7 +151,7 @@ let
         renames = p: lib.concatMapStringsSep "\n" (rename p.goPackagePath) p.goPackageAliases;
       in lib.concatMapStringsSep "\n" renames inputsWithAliases);
 
-    buildPhase = args.buildPhase or ''
+    buildPhase = args.buildPhase or (''
       runHook preBuild
 
       runHook renameImports
@@ -235,7 +235,7 @@ let
       )
     '' + ''
       runHook postBuild
-    '';
+    '');
 
     doCheck = args.doCheck or false;
     checkPhase = args.checkPhase or ''
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 2c5d4ae100031..a1bddeb6c49d2 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -45,7 +45,7 @@
 , buildFeatures ? [ ]
 , checkFeatures ? buildFeatures
 , useNextest ? false
-, auditable ? false # TODO: change to true
+, auditable ? true
 
 , depsExtraArgs ? {}
 
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
index adbfe98d81039..8c6a97888c10f 100644
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@@ -62,6 +62,10 @@ in stdenv.mkDerivation ({
     export CARGO_HOME=$(mktemp -d cargo-home.XXX)
     CARGO_CONFIG=$(mktemp cargo-config.XXXX)
 
+    # https://blog.rust-lang.org/2023/03/09/Rust-1.68.0.html#cargos-sparse-protocol
+    # planned to become the default in 1.70
+    export CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
+
     if [[ -n "$NIX_CRATES_INDEX" ]]; then
     cat >$CARGO_HOME/config.toml <<EOF
     [source.crates-io]
diff --git a/pkgs/build-support/rust/hooks/default.nix b/pkgs/build-support/rust/hooks/default.nix
index 168224e39b359..2eb388fe07ba8 100644
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@@ -76,37 +76,14 @@ in {
         # inputs do not cause us to find the wrong `diff`.
         diff = "${lib.getBin buildPackages.diffutils}/bin/diff";
 
-        # We want to specify the correct crt-static flag for both
-        # the build and host platforms. This is important when the wanted
-        # value for crt-static does not match the defaults in the rustc target,
-        # like for pkgsMusl or pkgsCross.musl64; Upstream rustc still assumes
-        # that musl = static[1].
-        #
-        # By default, Cargo doesn't apply RUSTFLAGS when building build.rs
-        # if --target is passed, so the only good way to set crt-static for
-        # build.rs files is to use the unstable -Zhost-config Cargo feature.
-        # This allows us to specify flags that should be passed to rustc
-        # when building for the build platform. We also need to use
-        # -Ztarget-applies-to-host, because using -Zhost-config requires it.
-        #
-        # When doing this, we also have to specify the linker, or cargo
-        # won't pass a -C linker= argument to rustc.  This will make rustc
-        # try to use its default value of "cc", which won't be available
-        # when cross-compiling.
-        #
-        # [1]: https://github.com/rust-lang/compiler-team/issues/422
         cargoConfig = ''
-          [host]
+          [target."${rust.toRustTarget stdenv.buildPlatform}"]
           "linker" = "${ccForBuild}"
-          "rustflags" = [ "-C", "target-feature=${if stdenv.buildPlatform.isStatic then "+" else "-"}crt-static" ]
-
-          [target."${shortTarget}"]
-          "linker" = "${ccForHost}"
+          ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
+            [target."${shortTarget}"]
+            "linker" = "${ccForHost}"
+          ''}
           "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
-
-          [unstable]
-          host-config = true
-          target-applies-to-host = true
         '';
       };
     } ./cargo-setup-hook.sh) {};
diff --git a/pkgs/build-support/rust/import-cargo-lock.nix b/pkgs/build-support/rust/import-cargo-lock.nix
index 0e1da7ce5f524..b23bae1090b70 100644
--- a/pkgs/build-support/rust/import-cargo-lock.nix
+++ b/pkgs/build-support/rust/import-cargo-lock.nix
@@ -10,6 +10,15 @@
   # Allow `builtins.fetchGit` to be used to not require hashes for git dependencies
 , allowBuiltinFetchGit ? false
 
+  # Additional registries to pull sources from
+  #   { "https://<registry index URL>" = "https://<registry download URL>"; }
+  # where:
+  # - "index URL" is the "index" value of the configuration entry for that registry
+  #   https://doc.rust-lang.org/cargo/reference/registries.html#using-an-alternate-registry
+  # - "download URL" is the "dl" value of its associated index configuration
+  #   https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
+, extraRegistries ? {}
+
   # Hashes for git dependencies.
 , outputHashes ? {}
 } @ args:
@@ -80,7 +89,7 @@ let
 
   # We can't use the existing fetchCrate function, since it uses a
   # recursive hash of the unpacked crate.
-  fetchCrate = pkg:
+  fetchCrate = pkg: downloadUrl:
     let
       checksum = pkg.checksum or parsedLockFile.metadata."checksum ${pkg.name} ${pkg.version} (${pkg.source})";
     in
@@ -89,10 +98,14 @@ let
     '';
     fetchurl {
       name = "crate-${pkg.name}-${pkg.version}.tar.gz";
-      url = "https://crates.io/api/v1/crates/${pkg.name}/${pkg.version}/download";
+      url = "${downloadUrl}/${pkg.name}/${pkg.version}/download";
       sha256 = checksum;
     };
 
+  registries = {
+    "https://github.com/rust-lang/crates.io-index" = "https://crates.io/api/v1/crates";
+  } // extraRegistries;
+
   # Replaces values inherited by workspace members.
   replaceWorkspaceValues = writers.writePython3 "replace-workspace-values"
     { libraries = with python3Packages; [ tomli tomli-w ]; flakeIgnore = [ "E501" ]; }
@@ -102,10 +115,11 @@ let
   mkCrate = pkg:
     let
       gitParts = parseGit pkg.source;
+      registryIndexUrl = lib.removePrefix "registry+" pkg.source;
     in
-      if pkg.source == "registry+https://github.com/rust-lang/crates.io-index" then
+      if lib.hasPrefix "registry+" pkg.source && builtins.hasAttr registryIndexUrl registries then
       let
-        crateTarball = fetchCrate pkg;
+        crateTarball = fetchCrate pkg registries.${registryIndexUrl};
       in runCommand "${pkg.name}-${pkg.version}" {} ''
         mkdir $out
         tar xf "${crateTarball}" -C $out --strip-components=1
@@ -213,15 +227,24 @@ let
     }
 
     cat > $out/.cargo/config <<EOF
-    [source.crates-io]
-    replace-with = "vendored-sources"
+[source.crates-io]
+replace-with = "vendored-sources"
 
-    [source.vendored-sources]
-    directory = "cargo-vendor-dir"
-    EOF
+[source.vendored-sources]
+directory = "cargo-vendor-dir"
+EOF
 
     declare -A keysSeen
 
+    for registry in ${toString (builtins.attrNames extraRegistries)}; do
+      cat >> $out/.cargo/config <<EOF
+
+[source."$registry"]
+registry = "$registry"
+replace-with = "vendored-sources"
+EOF
+    done
+
     for crate in ${toString depCrates}; do
       # Link the crate directory, removing the output path hash from the destination.
       ln -s "$crate" $out/$(basename "$crate" | cut -c 34-)
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 2a4e93f82dffe..8694c602a3b91 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -149,9 +149,11 @@ rec {
           echo -n "$text" > "$target"
         fi
 
-        eval "$checkPhase"
+        if [ -n "$executable" ]; then
+          chmod +x "$target"
+        fi
 
-        (test -n "$executable" && chmod +x "$target") || true
+        eval "$checkPhase"
       '';
 
   /*
@@ -412,7 +414,10 @@ rec {
         mkdir -p "$(dirname "$file")"
         cat $files > "$file"
 
-        (test -n "$executable" && chmod +x "$file") || true
+        if [ -n "$executable" ]; then
+          chmod +x "$file"
+        fi
+
         eval "$checkPhase"
       '';
 
diff --git a/pkgs/build-support/trivial-builders/test/write-shell-script.nix b/pkgs/build-support/trivial-builders/test/write-shell-script.nix
new file mode 100644
index 0000000000000..a5c9f1fae42f6
--- /dev/null
+++ b/pkgs/build-support/trivial-builders/test/write-shell-script.nix
@@ -0,0 +1,14 @@
+{ lib, writeShellScript }: let
+  output = "hello";
+in (writeShellScript "test-script" ''
+  echo ${lib.escapeShellArg output}
+'').overrideAttrs (old: {
+  checkPhase = old.checkPhase or "" + ''
+    expected=${lib.escapeShellArg output}
+    got=$("$target")
+    if [[ "$got" != "$expected" ]]; then
+      echo "wrong output: expected $expected, got $got"
+      exit 1
+    fi
+  '';
+})
diff --git a/pkgs/data/documentation/gnome-user-docs/default.nix b/pkgs/data/documentation/gnome-user-docs/default.nix
index 378f33be25268..cd506b61c59cf 100644
--- a/pkgs/data/documentation/gnome-user-docs/default.nix
+++ b/pkgs/data/documentation/gnome-user-docs/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-user-docs";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-user-docs/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "NgcWDv/W+R4lqHmLV977IJndcLj+5Ofi8g8mN6woyu4=";
+    sha256 = "z2zX65xBSd2Tlm9x+huQevyPZR7MOvVOEIW89K0hsb0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index a5c5fd88a0a23..de19347e34033 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20221107";
+  version = "20230316";
 
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-vucC9MfpCCPyST21n09QDrj3z3MzKdBGo/ONUQvuxxQ=";
+    sha256 = "sha256-5acFYPSwevEw5tZNbQDpui3stWuMdnhaKHqC8lhnsOY=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch b/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch
index d44481056c434..af90ce57949a3 100644
--- a/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch
+++ b/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch
@@ -2,7 +2,7 @@ diff --git a/Makefile b/Makefile
 index a9a989e..4da737b 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -579,8 +579,8 @@ install:	all $(DATA) $(REDO) $(MANS)
+@@ -606,8 +606,8 @@ install:	all $(DATA) $(REDO) $(MANS)
  			-t '$(DESTDIR)$(TZDEFAULT)'
  		cp -f $(TABDATA) '$(DESTDIR)$(TZDIR)/.'
  		cp tzselect '$(DESTDIR)$(BINDIR)/.'
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 81f23c9a828f0..98aeb7638e127 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2022g";
+  version = "2023c";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-RJHbgoGulKhNk55Ce92D3DifJnZNJ9mlxS14LBZ2RHg=";
+      hash = "sha256-P1ELXRtK6bs45IWqMCp3azF/s2N722QExK33tsrdllw=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-lhC7C5ZW/0BMNhpB8yhtpTBktUadhPAMnLIxTIYU2nQ=";
+      hash = "sha256-RtF/K7Ga1zKQ8DogMAYVLg+g17EeW3FGfEqCOBGyFOc=";
     })
   ];
 
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     "AR=${stdenv.cc.targetPrefix}ar"
   ] ++ lib.optionals stdenv.hostPlatform.isWindows [
     "CFLAGS+=-DHAVE_DIRECT_H"
+    "CFLAGS+=-DHAVE_SETENV=0"
     "CFLAGS+=-DHAVE_SYMLINK=0"
     "CFLAGS+=-DRESERVE_STD_EXT_IDS"
   ];
diff --git a/pkgs/desktops/gnome/apps/ghex/default.nix b/pkgs/desktops/gnome/apps/ghex/default.nix
index 4f036de24d730..96c1633b8da50 100644
--- a/pkgs/desktops/gnome/apps/ghex/default.nix
+++ b/pkgs/desktops/gnome/apps/ghex/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ghex";
-  version = "43.1";
+  version = "44.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/ghex/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "pUuUPv5CAQqcEuTc2ts3e/NslMOAB3i4Uww6g0QJ3Mc=";
+    sha256 = "WKpHz9vtEoCjwTGVHBokWWEpQEoLDTR6Pb//tv9oOXY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/apps/gnome-boxes/default.nix b/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
index 8b7a94668f238..4acb9b91eba17 100644
--- a/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
@@ -20,8 +20,6 @@
 , libsoup_3
 , libosinfo
 , systemd
-, tracker
-, tracker-miners
 , vala
 , libcap
 , yajl
@@ -38,7 +36,6 @@
 , libarchive
 , acl
 , libgudev
-, libsecret
 , libcap_ng
 , numactl
 , libapparmor
@@ -51,11 +48,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-boxes";
-  version = "43.3";
+  version = "44.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "7tu69YDZuC20vmV7k7zuXzioe3hScPxJVcC/OGIs7ZM=";
+    sha256 = "OJcGDWlvf6LZEudywnYdvlNDOrXxnr+kvE6Jc4X6ulM=";
   };
 
   patches = [
@@ -105,7 +102,6 @@ stdenv.mkDerivation rec {
     libhandy
     libosinfo
     librsvg
-    libsecret
     libsoup_3
     libusb1
     libvirt
@@ -115,8 +111,6 @@ stdenv.mkDerivation rec {
     spice-gtk
     spice-protocol
     systemd
-    tracker
-    tracker-miners
     vte
     webkitgtk_4_1
     yajl
diff --git a/pkgs/desktops/gnome/apps/gnome-calendar/default.nix b/pkgs/desktops/gnome/apps/gnome-calendar/default.nix
index 5782bb861da99..7c7b14b23e305 100644
--- a/pkgs/desktops/gnome/apps/gnome-calendar/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-calendar/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-calendar";
-  version = "43.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "r6X8ZuL2kVU8x9UX2yNjz/LWLNG130VeX09xMxOdIfI=";
+    sha256 = "lqzXTL9FZSk0UVzDRHo7iV6TP4YyTKkkNvZ93WPDqAI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/apps/gnome-characters/default.nix b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
index 5617272acc33e..08f730595026f 100644
--- a/pkgs/desktops/gnome/apps/gnome-characters/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -11,7 +10,6 @@
 , gtk4
 , pango
 , wrapGAppsHook4
-, python3
 , desktop-file-utils
 , gobject-introspection
 , gjs
@@ -23,27 +21,19 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-characters";
-  version = "43.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-characters/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sj4V2VCXizY8gaRyYe4aO0fbPGaX7haf8hPuplcqeEE=";
+    sha256 = "BbFcAozBkK75LmCS/YT6jV8kSODpB2RGo1ZvOggf9Qs=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-characters/-/commit/3e28a6ad668e2239b14f2e05bc477ec1bfb210ba.patch";
-      sha256 = "sha256-2N4eewknhOXBABs6BPA5/YuqZMT8dyXW857iamrrtuA=";
-    })
-  ];
-
   nativeBuildInputs = [
     gettext
     gobject-introspection
     meson
     ninja
     pkg-config
-    python3
     desktop-file-utils
     wrapGAppsHook4
   ];
@@ -60,11 +50,6 @@ stdenv.mkDerivation rec {
     pango
   ];
 
-  postPatch = ''
-    chmod +x meson_post_install.py # patchShebangs requires executable file
-    patchShebangs meson_post_install.py
-  '';
-
   dontWrapGApps = true;
 
   postFixup = ''
diff --git a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
index 98a623b9a06bb..4f9c2c1581909 100644
--- a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-clocks";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-clocks/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sHQ7cNAIgKo7zcx/fzTIwihiV7XIFzfU+YG8jE9PmB0=";
+    sha256 = "F9epc2XLjxoCOh1491AfM1Mhf6dXfXOv59DKHjtPODg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/apps/gnome-connections/default.nix b/pkgs/desktops/gnome/apps/gnome-connections/default.nix
index 6fc3519e5e54a..13dc7cd9690d0 100644
--- a/pkgs/desktops/gnome/apps/gnome-connections/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-connections/default.nix
@@ -7,7 +7,6 @@
 , vala
 , gettext
 , itstool
-, python3
 , appstream-glib
 , desktop-file-utils
 , wrapGAppsHook
@@ -23,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-connections";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-hdrYL5PAsvYJ/o7H7N7scGAKVWEq/A4/AndMJaC7MJ8=";
+    hash = "sha256-NMemu/7Jqaz6nC0tukslFDHNcYdPjwVcX/JvJvQkQZk=";
   };
 
   nativeBuildInputs = [
@@ -37,7 +36,6 @@ stdenv.mkDerivation rec {
     vala
     gettext
     itstool
-    python3
     appstream-glib
     desktop-file-utils
     glib # glib-compile-resources
@@ -54,11 +52,6 @@ stdenv.mkDerivation rec {
     gtk-frdp
   ];
 
-  postPatch = ''
-    chmod +x build-aux/meson/postinstall.py
-    patchShebangs build-aux/meson/postinstall.py
-  '';
-
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/desktops/gnome/apps/gnome-maps/default.nix b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
index ba83f42fce601..9ec1e46de36ee 100644
--- a/pkgs/desktops/gnome/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , gettext
@@ -28,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-maps";
-  version = "43.4";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-zlLVW6T2fYlu8tmZczc6iYZql7t0pLQCS23iZzx/8e8=";
+    sha256 = "sha256-YAPrc92f0mm0qRvtm/A+6askDFEk7tq/KL4io/77pZU=";
   };
 
   doCheck = true;
@@ -66,14 +65,6 @@ stdenv.mkDerivation rec {
     libsoup_3
   ];
 
-  patches = [
-    (fetchpatch {
-      name = "timeTest.patch";
-      url = "https://gitlab.gnome.org/GNOME/gnome-maps/-/commit/bec3d2f26de1b3a8c8b7e603f6d6a46c853426fa.diff";
-      sha256 = "sha256-7/ogIDG0piZOPaCPX4nUA3jHI7RGTd2KMZsp8z0XLcc=";
-    })
-  ];
-
   postPatch = ''
     # The .service file isn't wrapped with the correct environment
     # so misses GIR files when started. By re-pointing from the gjs
diff --git a/pkgs/desktops/gnome/apps/gnome-music/default.nix b/pkgs/desktops/gnome/apps/gnome-music/default.nix
index 445d667b8388b..d66efad0728db 100644
--- a/pkgs/desktops/gnome/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-music/default.nix
@@ -23,20 +23,20 @@
 , itstool
 , gnome
 , gst_all_1
-, libsoup
+, libsoup_3
 , libadwaita
 , gsettings-desktop-schemas
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gnome-music";
-  version = "42.1";
+  version = "44.0";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "x3R/pqhrVrGK1v+VD/kB5Z7n+sEcaLKmcnr4bq7tgnA=";
+    sha256 = "m9GqyVcuYkcgJKaVDYOubyhr4zzZx3fz1E+hbQOPHVE=";
   };
 
   nativeBuildInputs = [
@@ -64,7 +64,7 @@ python3.pkgs.buildPythonApplication rec {
     grilo
     grilo-plugins
     libnotify
-    libsoup
+    libsoup_3
     libadwaita
     gsettings-desktop-schemas
     tracker
diff --git a/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix b/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix
index ff2141030faa4..52d8680fb104a 100644
--- a/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix
@@ -11,6 +11,7 @@
 , wrapGAppsHook4
 , ninja
 , gnome
+, cairo
 , enchant
 , icu
 , itstool
@@ -24,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-text-editor";
-  version = "43.2";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-text-editor/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-MwRcehI/qife5+ubqabybxsXGMWg52M30Hmg1MkA4UY=";
+    sha256 = "sha256-9nvDeAc0/6gV/MTF2qe1VdJORZ+B6itUjmqFwWEqMco=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +45,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    cairo
     enchant
     icu
     glib
diff --git a/pkgs/desktops/gnome/apps/gnome-weather/default.nix b/pkgs/desktops/gnome/apps/gnome-weather/default.nix
index 1e7860a697876..51582a96c651c 100644
--- a/pkgs/desktops/gnome/apps/gnome-weather/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-weather/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-weather";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-weather/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "LxERf3VVK/G7ngHwHPs8L82mo/aQcP/gUZoHYVMrjyY=";
+    sha256 = "aw04rHhQQWmd9iiSbjXbe1/6CG7g1pNMIioZxrmSO68=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix b/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix
index 069d1d6040c45..8be9575b6de38 100644
--- a/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix
+++ b/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "adwaita-icon-theme";
-  version = "43";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "LjrHfTKmqlVUFV3zfo8KDdVPxaZf1yHojVBflw2jLsY=";
+    sha256 = "SInFYBu/7NJdgLo0IgnQqTbc9pHuVr1uykzeNh8aZkw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/baobab/default.nix b/pkgs/desktops/gnome/core/baobab/default.nix
index c7ff70d260701..d27c4947c33b2 100644
--- a/pkgs/desktops/gnome/core/baobab/default.nix
+++ b/pkgs/desktops/gnome/core/baobab/default.nix
@@ -7,7 +7,6 @@
 , meson
 , ninja
 , pkg-config
-, python3
 , gtk4
 , libadwaita
 , glib
@@ -19,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "baobab";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "UsaGQRj1aX9aVzaILc2ifbIuciC8SSg43uzGmSRs2yY=";
+    sha256 = "hFtju5Ej10VoyBJsVxu8dCc0g/+SAXmizx7du++hv8A=";
   };
 
   nativeBuildInputs = [
@@ -35,7 +34,6 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    python3
     vala
     wrapGAppsHook4
     # Prevents “error: Package `libadwaita-1' not found in specified Vala API
@@ -52,12 +50,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  postPatch = ''
-    # https://gitlab.gnome.org/GNOME/baobab/-/merge_requests/40
-    substituteInPlace build-aux/post-install.py \
-      --replace "gtk-update-icon-cache" "gtk4-update-icon-cache"
-  '';
-
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/desktops/gnome/core/eog/default.nix b/pkgs/desktops/gnome/core/eog/default.nix
index 909be8e04e3dc..4613df1caf319 100644
--- a/pkgs/desktops/gnome/core/eog/default.nix
+++ b/pkgs/desktops/gnome/core/eog/default.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eog";
-  version = "43.2";
+  version = "44.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-nc/c5VhakOK7HPV+N3yx6xLUG9m8ubus31BrwbE1Tvk=";
+    sha256 = "sha256-QdhfqwXEMImNv9hH5I4fW0k13Dy87lRudZqQftpnEFQ=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/epiphany/default.nix b/pkgs/desktops/gnome/core/epiphany/default.nix
index 8b5f935f49144..2c18f50dbd238 100644
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@@ -4,18 +4,16 @@
 , ninja
 , gettext
 , fetchurl
-, fetchpatch
 , pkg-config
-, gtk3
+, gtk4
 , glib
 , icu
-, wrapGAppsHook
+, wrapGAppsHook4
 , gnome
-, libportal-gtk3
+, libportal-gtk4
 , libxml2
-, libxslt
 , itstool
-, webkitgtk_4_1
+, webkitgtk_6_0
 , libsoup_3
 , glib-networking
 , libsecret
@@ -23,55 +21,42 @@
 , libarchive
 , p11-kit
 , sqlite
-, gcr
+, gcr_4
 , isocodes
 , desktop-file-utils
 , nettle
 , gdk-pixbuf
 , gst_all_1
 , json-glib
-, libdazzle
-, libhandy
+, libadwaita
 , buildPackages
 , withPantheon ? false
+, pantheon
 }:
 
 stdenv.mkDerivation rec {
   pname = "epiphany";
-  version = "43.1";
+  version = "44.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "6G6tJ8uZgoFRUGZN478g+vN193uAZbArMRgMZba767Q=";
+    sha256 = "u60o/HJzqGa5teXdVoa9BIQww/C+7UwIJgtNCN2P+Fs=";
   };
 
-  patches = lib.optionals withPantheon [
-    # Pantheon specific patches for epiphany
-    # https://github.com/elementary/browser
-    #
-    # Patch to unlink nav buttons
-    # https://github.com/elementary/browser/pull/18
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/elementary/browser/cc17559a7ac6effe593712b4f3d0bbefde6e3b62/navigation-buttons.patch";
-      sha256 = "sha256-G1/JUjn/8DyO9sgL/5Kq205KbTOs4EMi4Vf3cJ8FHXU=";
-    })
-  ];
-
   nativeBuildInputs = [
     desktop-file-utils
     gettext
     itstool
-    libxslt
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook4
     buildPackages.glib
-    buildPackages.gtk3
+    buildPackages.gtk4
   ];
 
   buildInputs = [
-    gcr
+    gcr_4
     gdk-pixbuf
     glib
     glib-networking
@@ -82,13 +67,12 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-ugly
     gst_all_1.gstreamer
-    gtk3
+    gtk4
     icu
     isocodes
     json-glib
-    libdazzle
-    libhandy
-    libportal-gtk3
+    libadwaita
+    libportal-gtk4
     libarchive
     libsecret
     libsoup_3
@@ -96,12 +80,16 @@ stdenv.mkDerivation rec {
     nettle
     p11-kit
     sqlite
-    webkitgtk_4_1
+    webkitgtk_6_0
+  ] ++ lib.optionals withPantheon [
+    pantheon.granite7
   ];
 
   # Tests need an X display
   mesonFlags = [
     "-Dunit_tests=disabled"
+  ] ++ lib.optionals withPantheon [
+    "-Dgranite=enabled"
   ];
 
   passthru = {
diff --git a/pkgs/desktops/gnome/core/evince/default.nix b/pkgs/desktops/gnome/core/evince/default.nix
index d561ad6646a2e..95b1c358b719c 100644
--- a/pkgs/desktops/gnome/core/evince/default.nix
+++ b/pkgs/desktops/gnome/core/evince/default.nix
@@ -7,6 +7,7 @@
 , gettext
 , libxml2
 , appstream
+, desktop-file-utils
 , glib
 , gtk3
 , pango
@@ -42,17 +43,18 @@
 
 stdenv.mkDerivation rec {
   pname = "evince";
-  version = "43.1";
+  version = "44.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "bXXKYrc7+7YA9xigmBA9xrgT+QULlZS+kp4ptFidIzU=";
+    sha256 = "Fa/TuxX/s4/sqzTCM1CVCtJwqwOoW5TjM9ndfuanQxQ=";
   };
 
   nativeBuildInputs = [
     appstream
+    desktop-file-utils
     gettext
     gobject-introspection
     gi-docgen
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index f5ea57f1f8001..aa78fb4d006f3 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -31,7 +31,7 @@
 , openldap
 , enableOAuth2 ? stdenv.isLinux
 , webkitgtk_4_1
-, webkitgtk_5_0
+, webkitgtk_6_0
 , libaccounts-glib
 , json-glib
 , glib
@@ -50,13 +50,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.46.4";
+  version = "3.48.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "pZslQUXFn6zXx7U4LbeNxfDtH2pum4/n1edZWfk8DMg=";
+    sha256 = "DyX3MzHt9TkJvkD0ErKoaTknAydRdhYwPzIt4VcIPDU=";
   };
 
   patches = [
@@ -111,7 +111,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals withGtk4 [
     gtk4
   ] ++ lib.optionals (withGtk4 && enableOAuth2) [
-    webkitgtk_5_0
+    webkitgtk_6_0
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
index c0cfade44b4eb..28a812493708f 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
+++ b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
@@ -1,8 +1,8 @@
 diff --git a/src/addressbook/libebook/e-book-client.c b/src/addressbook/libebook/e-book-client.c
-index 7888e69..27215e4 100644
+index bd479d8..bd049b3 100644
 --- a/src/addressbook/libebook/e-book-client.c
 +++ b/src/addressbook/libebook/e-book-client.c
-@@ -1983,7 +1983,18 @@ e_book_client_get_self (ESourceRegistry *registry,
+@@ -1997,7 +1997,18 @@ e_book_client_get_self (ESourceRegistry *registry,
  
  	*out_client = book_client;
  
@@ -22,7 +22,7 @@ index 7888e69..27215e4 100644
  	uid = g_settings_get_string (settings, SELF_UID_KEY);
  	g_object_unref (settings);
  
-@@ -2051,7 +2062,18 @@ e_book_client_set_self (EBookClient *client,
+@@ -2065,7 +2076,18 @@ e_book_client_set_self (EBookClient *client,
  	g_return_val_if_fail (
  		e_contact_get_const (contact, E_CONTACT_UID) != NULL, FALSE);
  
@@ -42,7 +42,7 @@ index 7888e69..27215e4 100644
  	g_settings_set_string (
  		settings, SELF_UID_KEY,
  		e_contact_get_const (contact, E_CONTACT_UID));
-@@ -2087,8 +2109,18 @@ e_book_client_is_self (EContact *contact)
+@@ -2101,8 +2123,18 @@ e_book_client_is_self (EContact *contact)
  	 * unfortunately the API doesn't allow that.
  	 */
  	g_mutex_lock (&mutex);
@@ -64,7 +64,7 @@ index 7888e69..27215e4 100644
  	g_mutex_unlock (&mutex);
  
 diff --git a/src/addressbook/libebook/e-book.c b/src/addressbook/libebook/e-book.c
-index 8dfff6d..fb4434b 100644
+index e85a56b..59d3fe2 100644
 --- a/src/addressbook/libebook/e-book.c
 +++ b/src/addressbook/libebook/e-book.c
 @@ -2587,7 +2587,18 @@ e_book_get_self (ESourceRegistry *registry,
@@ -128,10 +128,10 @@ index 8dfff6d..fb4434b 100644
  	g_object_unref (settings);
  
 diff --git a/src/addressbook/libedata-book/e-book-meta-backend.c b/src/addressbook/libedata-book/e-book-meta-backend.c
-index d3f130e..bc820e9 100644
+index 127dcd1..5fa62f6 100644
 --- a/src/addressbook/libedata-book/e-book-meta-backend.c
 +++ b/src/addressbook/libedata-book/e-book-meta-backend.c
-@@ -135,7 +135,18 @@ ebmb_is_power_saver_enabled (void)
+@@ -136,7 +136,18 @@ ebmb_is_power_saver_enabled (void)
  	GSettings *settings;
  	gboolean enabled = FALSE;
  
@@ -176,10 +176,10 @@ index 42f3457..b4926af 100644
  	cbc->priv->update_alarms_id = 0;
  	cbc->priv->alarm_enabled = FALSE;
 diff --git a/src/calendar/libecal/e-reminder-watcher.c b/src/calendar/libecal/e-reminder-watcher.c
-index 52095a4..184b657 100644
+index 5087de1..5c24b87 100644
 --- a/src/calendar/libecal/e-reminder-watcher.c
 +++ b/src/calendar/libecal/e-reminder-watcher.c
-@@ -2555,7 +2555,19 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
+@@ -2578,7 +2578,19 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
  
  	watcher->priv = e_reminder_watcher_get_instance_private (watcher);
  	watcher->priv->cancellable = g_cancellable_new ();
@@ -298,10 +298,10 @@ index e61160c..b6553a4 100644
  		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
  	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index 28755e2..da8c40c 100644
+index 95918a0..a7fc669 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
-@@ -5593,7 +5593,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
+@@ -5591,7 +5591,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
  	if (!skip_old_flags_update) {
  		GSettings *eds_settings;
  
@@ -322,10 +322,10 @@ index 28755e2..da8c40c 100644
  		if (g_settings_get_boolean (eds_settings, "limit-operations-in-power-saver-mode")) {
  			GPowerProfileMonitor *power_monitor;
 diff --git a/src/camel/providers/smtp/camel-smtp-transport.c b/src/camel/providers/smtp/camel-smtp-transport.c
-index f535ad6..918975d 100644
+index effaf06..1b2a003 100644
 --- a/src/camel/providers/smtp/camel-smtp-transport.c
 +++ b/src/camel/providers/smtp/camel-smtp-transport.c
-@@ -1458,7 +1458,18 @@ smtp_helo (CamelSmtpTransport *transport,
+@@ -1462,7 +1462,18 @@ smtp_helo (CamelSmtpTransport *transport,
  		transport->authtypes = NULL;
  	}
  
@@ -370,7 +370,7 @@ index 188f276..939f89b 100644
  		settings, "network-monitor-gio-name",
  		object, "gio-name",
 diff --git a/src/libedataserver/e-oauth2-service-google.c b/src/libedataserver/e-oauth2-service-google.c
-index f215388..501222e 100644
+index ec08afe..7b31227 100644
 --- a/src/libedataserver/e-oauth2-service-google.c
 +++ b/src/libedataserver/e-oauth2-service-google.c
 @@ -71,7 +71,18 @@ eos_google_read_settings (EOAuth2Service *service,
@@ -394,7 +394,7 @@ index f215388..501222e 100644
  		g_object_unref (settings);
  
 diff --git a/src/libedataserver/e-oauth2-service-outlook.c b/src/libedataserver/e-oauth2-service-outlook.c
-index 9cff0d0..4c9a203 100644
+index 7633e93..2328048 100644
 --- a/src/libedataserver/e-oauth2-service-outlook.c
 +++ b/src/libedataserver/e-oauth2-service-outlook.c
 @@ -71,7 +71,18 @@ eos_outlook_read_settings (EOAuth2Service *service,
@@ -418,7 +418,7 @@ index 9cff0d0..4c9a203 100644
  		g_object_unref (settings);
  
 diff --git a/src/libedataserver/e-oauth2-service-yahoo.c b/src/libedataserver/e-oauth2-service-yahoo.c
-index 8e4ee81..cc94026 100644
+index 3bb1071..199e822 100644
 --- a/src/libedataserver/e-oauth2-service-yahoo.c
 +++ b/src/libedataserver/e-oauth2-service-yahoo.c
 @@ -67,7 +67,18 @@ eos_yahoo_read_settings (EOAuth2Service *service,
@@ -442,7 +442,7 @@ index 8e4ee81..cc94026 100644
  		g_object_unref (settings);
  
 diff --git a/src/libedataserver/e-oauth2-service.c b/src/libedataserver/e-oauth2-service.c
-index b0c2410..ca915e0 100644
+index 7eca355..795d822 100644
 --- a/src/libedataserver/e-oauth2-service.c
 +++ b/src/libedataserver/e-oauth2-service.c
 @@ -94,7 +94,18 @@ eos_default_guess_can_process (EOAuth2Service *service,
diff --git a/pkgs/desktops/gnome/core/gdm/default.nix b/pkgs/desktops/gnome/core/gdm/default.nix
index a2265387e1ef7..55044682da116 100644
--- a/pkgs/desktops/gnome/core/gdm/default.nix
+++ b/pkgs/desktops/gnome/core/gdm/default.nix
@@ -4,7 +4,6 @@
 , substituteAll
 , meson
 , ninja
-, python3
 , rsync
 , pkg-config
 , glib
@@ -44,13 +43,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gdm";
-  version = "43.0";
+  version = "44.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdm/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "lNcNbtffWfp/3k/QL+0RaFk6itzhD87hE8FI1Ss5IpQ=";
+    sha256 = "ziCwoiHb+M3gBktQH9jzj3ODkVKFfEU1M36wnMUvf2w=";
   };
 
   mesonFlags = [
@@ -71,7 +70,6 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    python3
     rsync
     gobject-introspection
   ];
@@ -126,8 +124,6 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    patchShebangs build-aux/meson_post_install.py
-
     # Upstream checks some common paths to find an `X` binary. We already know it.
     echo #!/bin/sh > build-aux/find-x-server.sh
     echo "echo ${lib.getBin xorg.xorgserver}/bin/X" >> build-aux/find-x-server.sh
diff --git a/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix b/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix
index eeee846ad190a..3710866a41a86 100644
--- a/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-backgrounds";
-  version = "43.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-backgrounds/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "jkWcrTinV0aDpV5ed2kOZYxvn+ruycuCA5qyW6K8oF0=";
+    sha256 = "SoOTs4cTXypqQkoaDDrJTgdCtiuCNaCSPJKfUeBL4E4=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-calculator/default.nix b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
index f84c9ab65a88c..6d3d4b394f5e8 100644
--- a/pkgs/desktops/gnome/core/gnome-calculator/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-calculator";
-  version = "43.0.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-calculator/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "AsEt7Tz1BT0XU32V7GlYf0uRmJnXcm7O7NtLR/+xyQ8=";
+    sha256 = "FOdjMp+IMJp+FSeA1XNhtUMQDjI5BrNOBlX9wxW3EEM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-contacts/default.nix b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
index 560d40ddc115e..a8e99ecec45e7 100644
--- a/pkgs/desktops/gnome/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
@@ -13,6 +13,7 @@
 , libportal-gtk4
 , gnome-desktop
 , gnome-online-accounts
+, qrencode
 , wrapGAppsHook4
 , folks
 , libxml2
@@ -26,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-contacts";
-  version = "43.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Ug3IjJAce4/n4SoBOhQlz+2R8vhAhIWitJ+SxnWZACA=";
+    sha256 = "fdEWO8HwavY4La5AFcQ0Q+4sEpKBKPyZ/USSktDee+0=";
   };
 
   nativeBuildInputs = [
@@ -57,6 +58,7 @@ stdenv.mkDerivation rec {
     libadwaita
     libxml2
     gnome-online-accounts
+    qrencode
   ];
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/default.nix b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
index 0b4d71adc5fe9..f61c49fe4cf08 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@@ -64,11 +64,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-control-center";
-  version = "43.4.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-AA+XBRroJHJJOSsB+/uiCv7lZiZxlscNVEChisBY2Z4=";
+    sha256 = "sha256-vb+rTPI9BXNAltsfn2+sfu0/y52jK/Sx8m7ToE5avGY=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix b/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix
index 4cf083ed5644f..5613207b3e101 100644
--- a/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-disk-utility";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-disk-utility/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-evypgFprkttpM91+/OxK+DhsAbvB+HHi2uTe9+GSosU=";
+    sha256 = "sha256-AgMQl4ls2zfYcXpYI/k+NyPU385/3EACyd/LFrfno+8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix b/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix
index 9a684cdaeaa67..30fafeee2ae83 100644
--- a/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-font-viewer";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-font-viewer/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "gca/+wbVMyNG4A6uyuwb3P1hfFHf2VvNBY1sdsdt0rk=";
+    sha256 = "oVEd8wsijMLvEXXdnSuTQ46pEuJZE0BLJjzz1Fe7n5c=";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
index 0bfa9226e0d4e..31950375369cb 100644
--- a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
@@ -27,7 +27,7 @@
 , networkmanager
 , pango
 , polkit
-, webkitgtk_5_0
+, webkitgtk_6_0
 , systemd
 , libadwaita
 , libnma-gtk4
@@ -38,11 +38,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-initial-setup";
-  version = "43.2";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "I9eWOlTUlZRQTQ6s2FCWyvtfhvHnSljgQGdbbnmK5pg=";
+    sha256 = "WTz8bcj4KphnG5TANbl9vojvVucIeAsq0dIyTk0Eu/8=";
   };
 
   patches = [
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     networkmanager
     pango
     polkit
-    webkitgtk_5_0
+    webkitgtk_6_0
   ];
 
   mesonFlags = [
diff --git a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
index a853a2457d158..32d1b6a072243 100644
--- a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-remote-desktop";
-  version = "43.3";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-EdRR0f3kTxgJ6/Ya/0vqX570/cAjWaiWR/bp59RUKaw=";
+    hash = "sha256-9+UIjBj9sIaQrgNL92oa6tWafc0Xsm4ffJl1SAUQoP0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-session/default.nix b/pkgs/desktops/gnome/core/gnome-session/default.nix
index 03082f7879e20..dcafff9e0ecf9 100644
--- a/pkgs/desktops/gnome/core/gnome-session/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-session/default.nix
@@ -31,13 +31,13 @@
 stdenv.mkDerivation rec {
   pname = "gnome-session";
   # Also bump ./ctl.nix when bumping major version.
-  version = "43.0";
+  version = "44.0";
 
   outputs = [ "out" "sessions" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-session/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "P7mUlQE4XIwUYY548XjZUt+YrYyRCA9MXhVoxzk64fI=";
+    sha256 = "zPgpqWUmE16en5F1JlFdNqUJK9+jFvNzfdjFpSTb8sY=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-settings-daemon/42/default.nix b/pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix
similarity index 82%
rename from pkgs/desktops/gnome/core/gnome-settings-daemon/42/default.nix
rename to pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix
index e05040cc6e4cf..95eb6fe1d25e1 100644
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/42/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix
@@ -37,17 +37,17 @@
 , python3
 , tzdata
 , nss
-, gcr
+, gcr_4
 , gnome-session-ctl
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-settings-daemon";
-  version = "42.2";
+  version = "43.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-settings-daemon/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "nESXFKqOwSccDbUTffNFgZWUPwXM0KyJNdkzl3cLqwA=";
+    sha256 = "NRO7JPxvgYFmciOmSgZ1NP3M879mMmqUA9OLDw1gE9A=";
   };
 
   patches = [
@@ -61,13 +61,6 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit tzdata;
     })
-
-    # Use geocode-glib_2 dependency
-    # https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/merge_requests/300
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/commit/03739474621e579e10b72577960ff94b4001e7ff.patch";
-      sha256 = "W4uD4ChNPZSsmQfmfmmXFA2Sm1RDkV7MqG8DmT4qeCY=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -106,7 +99,7 @@ stdenv.mkDerivation rec {
     systemd
     libgudev
     libwacom
-    gcr
+    gcr_4
   ];
 
   mesonFlags = [
@@ -119,7 +112,7 @@ stdenv.mkDerivation rec {
   env.NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
-    for f in gnome-settings-daemon/codegen.py plugins/power/gsd-power-constants-update.pl meson_post_install.py; do
+    for f in gnome-settings-daemon/codegen.py plugins/power/gsd-power-constants-update.pl; do
       chmod +x $f
       patchShebangs $f
     done
diff --git a/pkgs/desktops/gnome/core/gnome-settings-daemon/42/fix-paths.patch b/pkgs/desktops/gnome/core/gnome-settings-daemon/43/fix-paths.patch
similarity index 100%
rename from pkgs/desktops/gnome/core/gnome-settings-daemon/42/fix-paths.patch
rename to pkgs/desktops/gnome/core/gnome-settings-daemon/43/fix-paths.patch
diff --git a/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix b/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
index e494a46d16d09..d93384f9b9f16 100644
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-settings-daemon";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-settings-daemon/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "NRO7JPxvgYFmciOmSgZ1NP3M879mMmqUA9OLDw1gE9A=";
+    sha256 = "tBetocE0KozymDfs8t7Jvc23VCNbGhYbZDXD0R8hCZk=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-settings-daemon/global-backlight-helper.patch b/pkgs/desktops/gnome/core/gnome-settings-daemon/global-backlight-helper.patch
deleted file mode 100644
index 8f3951af2da85..0000000000000
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/global-backlight-helper.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/plugins/power/gsd-backlight.c b/plugins/power/gsd-backlight.c
-index d7d10fd2..5619d6ad 100644
---- a/plugins/power/gsd-backlight.c
-+++ b/plugins/power/gsd-backlight.c
-@@ -358,7 +358,7 @@ gsd_backlight_run_set_helper (GsdBacklight *backlight, GTask *task)
-                 proc = g_subprocess_new (G_SUBPROCESS_FLAGS_STDOUT_SILENCE,
-                                          &error,
-                                          "pkexec",
--                                         LIBEXECDIR "/gsd-backlight-helper",
-+                                         "/run/current-system/sw/bin/gnome-settings-daemon/gsd-backlight-helper",
-                                          g_udev_device_get_sysfs_path (backlight->udev_device),
-                                          data->value_str, NULL);
-         } else {
-diff --git a/plugins/power/org.gnome.settings-daemon.plugins.power.policy.in.in b/plugins/power/org.gnome.settings-daemon.plugins.power.policy.in.in
-index f16300f8..79d6bd17 100644
---- a/plugins/power/org.gnome.settings-daemon.plugins.power.policy.in.in
-+++ b/plugins/power/org.gnome.settings-daemon.plugins.power.policy.in.in
-@@ -25,7 +25,7 @@
-       <allow_inactive>no</allow_inactive>
-       <allow_active>yes</allow_active>
-     </defaults>
--    <annotate key="org.freedesktop.policykit.exec.path">@libexecdir@/gsd-backlight-helper</annotate>
-+    <annotate key="org.freedesktop.policykit.exec.path">/run/current-system/sw/bin/gnome-settings-daemon/gsd-backlight-helper</annotate>
-   </action>
-
- </policyconfig>
diff --git a/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix b/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
index b7f8a0ac83aea..56f0e6102298f 100644
--- a/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extensions";
-  version = "43.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "rd4EvZRqExE1V+TDTIkLvpB3UFpqPwdV8XvqHG5KLRc=";
+    sha256 = "jDRecvMaHjf1UGPgsVmXMBsBGU7WmHcv2HrrUMuxAas=";
   };
 
   patches = [
@@ -40,23 +40,23 @@ stdenv.mkDerivation rec {
   ];
 
   preFixup = ''
-    # The meson build doesn't compile the schemas.
-    # Fixup adapted from export-zips.sh in the source.
+    # Since we do not install the schemas to central location,
+    # let’s link them to where extensions installed
+    # through the extension portal would look for them.
+    # Adapted from export-zips.sh in the source.
 
     extensiondir=$out/share/gnome-shell/extensions
     schemadir=${glib.makeSchemaPath "$out" "$name"}
 
-    glib-compile-schemas $schemadir
-
     for f in $extensiondir/*; do
-      name=`basename ''${f%%@*}`
-      uuid=$name@gnome-shell-extensions.gcampax.github.com
+      name=$(basename "''${f%%@*}")
       schema=$schemadir/org.gnome.shell.extensions.$name.gschema.xml
+      schemas_compiled=$schemadir/gschemas.compiled
 
-      if [ -f $schema ]; then
-        mkdir $f/schemas
-        ln -s $schema $f/schemas;
-        glib-compile-schemas $f/schemas
+      if [[ -f $schema ]]; then
+        mkdir "$f/schemas"
+        ln -s "$schema" "$f/schemas"
+        ln -s "$schemas_compiled" "$f/schemas"
       fi
     done
   '';
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index 86a63876c670e..8421d8ed04bf3 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -36,7 +36,7 @@
 , gdm
 , upower
 , ibus
-, libnma
+, libnma-gtk4
 , libgnomekbd
 , gnome-desktop
 , gsettings-desktop-schemas
@@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gnome-shell";
-  version = "43.3";
+  version = "44.0";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Sf+NBfVfpPHCLwXQOFhSzrQpprY4DBuoRh5ipG1MBx4=";
+    sha256 = "MxCtwd1OIQmY1Z84cbwx9+BJFUKNnO2IwqZrKwXWwAo=";
   };
 
   patches = [
@@ -104,6 +104,14 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/rpms/gnome-shell/raw/9a647c460b651aaec0b8a21f046cc289c1999416/f/0001-gdm-Work-around-failing-fingerprint-auth.patch";
       sha256 = "pFvZli3TilUt6YwdZztpB8Xq7O60XfuWUuPMMVSpqLw=";
     })
+
+    # Logout/reboot/poweroff timeout leaves the session in a broken state
+    # https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6506
+    # Should be part of 44.1
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/5766d4111ac065b37417bedcc1b998ab6bee5514.patch";
+      sha256 = "d9oEzRnVbaFeCaBFhfLnW/Z8FzyQ7J8L7eAQe91133k=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -164,7 +172,7 @@ stdenv.mkDerivation rec {
 
     # not declared at build time, but typelib is needed at runtime
     libgweather
-    libnma
+    libnma-gtk4
 
     # for gnome-extension tool
     bash-completion
@@ -177,6 +185,7 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dgtk_doc=true"
+    "-Dtests=false"
   ];
 
   postPatch = ''
@@ -185,6 +194,13 @@ stdenv.mkDerivation rec {
     # We can generate it ourselves.
     rm -f man/gnome-shell.1
     rm data/theme/gnome-shell.css
+
+    # Build fails with -Dgtk_doc=true
+    # https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6486
+    # element include: XInclude error : could not load xxx, and no fallback was found
+    substituteInPlace docs/reference/shell/shell-docs.sgml \
+      --replace '<xi:include href="xml/shell-embedded-window.xml"/>' ' ' \
+      --replace '<xi:include href="xml/shell-gtk-embed.xml"/>' ' '
   '';
 
   postInstall = ''
diff --git a/pkgs/desktops/gnome/core/gnome-software/default.nix b/pkgs/desktops/gnome/core/gnome-software/default.nix
index 591bd397c0ac3..6302a5d8a2c46 100644
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnome-software";
-  version = "43.4";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "6d8GDrq1n0lpfV7yYw7DbeYEVBadwZGvYNNINyCq2z4=";
+    sha256 = "YZcZ+VKeC7Ha0w+tu3gNex2ZlAptsfcd9RvHNzQYMK8=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix b/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix
index cbce4ad8b05cb..f3e2677d6e0da 100644
--- a/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-system-monitor";
-  version = "42.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-system-monitor/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "EyOdIgMiAaIr0pgzxXW2hIFnANLeFooVMCI1d8XAddw=";
+    sha256 = "wrq37dupKCfEyN5EKT5+PITJ5QdvMZhYh/+Jac7EXm4=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-system-monitor/fix-paths.patch b/pkgs/desktops/gnome/core/gnome-system-monitor/fix-paths.patch
index ab6e845ae4bf3..967ef5e155421 100644
--- a/pkgs/desktops/gnome/core/gnome-system-monitor/fix-paths.patch
+++ b/pkgs/desktops/gnome/core/gnome-system-monitor/fix-paths.patch
@@ -1,13 +1,12 @@
 diff --git a/src/gsm_pkexec.cpp b/src/gsm_pkexec.cpp
-index 868969ba..51eb93b5 100644
+index 5e1edf2f..717d7bf1 100644
 --- a/src/gsm_pkexec.cpp
 +++ b/src/gsm_pkexec.cpp
-@@ -33,6 +33,7 @@ gboolean gsm_pkexec_create_root_password_dialog(const char *command)
+@@ -36,5 +36,6 @@ gsm_pkexec_create_root_password_dialog (const char *command)
  gboolean
- procman_has_pkexec(void)
+ procman_has_pkexec (void)
  {
--    return g_file_test("/usr/bin/pkexec", G_FILE_TEST_EXISTS);
-+    return g_file_test("/run/wrappers/bin/pkexec", G_FILE_TEST_EXISTS)
-+        || g_file_test("/usr/bin/pkexec", G_FILE_TEST_EXISTS);
+-  return g_file_test ("/usr/bin/pkexec", G_FILE_TEST_EXISTS);
++  return g_file_test ("/run/wrappers/bin/pkexec", G_FILE_TEST_EXISTS)
++      || g_file_test ("/usr/bin/pkexec", G_FILE_TEST_EXISTS);
  }
- 
diff --git a/pkgs/desktops/gnome/core/gnome-terminal/default.nix b/pkgs/desktops/gnome/core/gnome-terminal/default.nix
index 7ce5c4a67b85d..b1db819e1c2b8 100644
--- a/pkgs/desktops/gnome/core/gnome-terminal/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-terminal/default.nix
@@ -1,14 +1,13 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , meson
 , ninja
 , pkg-config
 , python3
 , libxml2
 , gnome
-, nix-update-script
+, gitUpdater
 , nautilus
 , glib
 , gtk4
@@ -30,25 +29,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-terminal";
-  version = "3.47.0";
+  version = "3.48.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gnome-terminal";
     rev = version;
-    sha256 = "sha256-CriI1DtDBeujaz0HtXCyzoGxnas7NmD6EMQ+gLph3E4=";
+    sha256 = "sha256-Co0RnDprY1eJhXdOzs43nniXzpaFtBpnr13StMDw4+8=";
   };
 
-  patches = [
-    # Fix Nautilus extension build.
-    # https://gitlab.gnome.org/GNOME/gnome-terminal/-/issues/7916
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-terminal/-/commit/614ea99b16fb09e10341fc6ccf5e115ac3f93caf.patch";
-      sha256 = "K7JHPfXywF3QSjSjyUnNZ11/ed+QXHQ47i135QBMIR8=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -87,11 +77,14 @@ stdenv.mkDerivation rec {
     patchShebangs \
       data/icons/meson_updateiconcache.py \
       data/meson_desktopfile.py \
+      data/meson_metainfofile.py \
       src/meson_compileschemas.py
   '';
 
   passthru = {
-    updateScript = nix-update-script { };
+    updateScript = gitUpdater {
+      odd-unstable = true;
+    };
 
     tests = {
       test = nixosTests.terminal-emulators.gnome-terminal;
diff --git a/pkgs/desktops/gnome/core/gnome-tour/default.nix b/pkgs/desktops/gnome/core/gnome-tour/default.nix
index c7edd87d122d9..c471417d61650 100644
--- a/pkgs/desktops/gnome/core/gnome-tour/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-tour/default.nix
@@ -11,7 +11,7 @@
 , gdk-pixbuf
 , desktop-file-utils
 , appstream-glib
-, wrapGAppsHook
+, wrapGAppsHook4
 , python3
 , gnome
 , libadwaita
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-tour";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-E1HkGWJ/vXx3GTKm7xrYDAvy5oKMSUigYgaJhN2zzIg=";
+    hash = "sha256-Bt52d90cWQ0OozoDLJzPTDfGK8ViFbgjyHnkLuYwwrY=";
   };
 
   cargoVendorDir = "vendor";
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     python3
     rustPlatform.cargoSetupHook
     rustc
-    wrapGAppsHook
+    wrapGAppsHook4
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/mutter/42/fix-paths.patch b/pkgs/desktops/gnome/core/mutter/42/fix-paths.patch
deleted file mode 100644
index 6ac0a431f61ff..0000000000000
--- a/pkgs/desktops/gnome/core/mutter/42/fix-paths.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/core/util.c b/src/core/util.c
-index 57b73747d..f424cc81c 100644
---- a/src/core/util.c
-+++ b/src/core/util.c
-@@ -636,7 +636,7 @@ meta_show_dialog (const char *type,
- 
-   args = g_ptr_array_new ();
- 
--  append_argument (args, "zenity");
-+  append_argument (args, "@zenity@/bin/zenity");
-   append_argument (args, type);
- 
-   if (display)
diff --git a/pkgs/desktops/gnome/core/mutter/42/default.nix b/pkgs/desktops/gnome/core/mutter/43/default.nix
similarity index 68%
rename from pkgs/desktops/gnome/core/mutter/42/default.nix
rename to pkgs/desktops/gnome/core/mutter/43/default.nix
index 3ee9f155df4f4..5953d00de45f9 100644
--- a/pkgs/desktops/gnome/core/mutter/42/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/43/default.nix
@@ -1,18 +1,18 @@
 { fetchurl
-, fetchpatch
-, substituteAll
 , runCommand
 , lib
+, fetchpatch
 , stdenv
 , pkg-config
 , gnome
 , gettext
 , gobject-introspection
 , cairo
+, colord
+, lcms2
 , pango
 , json-glib
 , libstartup_notification
-, zenity
 , libcanberra
 , ninja
 , xvfb-run
@@ -38,6 +38,7 @@
 , xorgserver
 , python3
 , wrapGAppsHook
+, gi-docgen
 , sysprof
 , libsysprof-capture
 , desktop-file-utils
@@ -47,15 +48,15 @@
 , wayland-protocols
 }:
 
-let self = stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "42.7";
+  version = "43.4";
 
-  outputs = [ "out" "dev" "man" ];
+  outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/mutter/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "OwmmsHDRMHwD2EMorIS0+m1jmfk4MEo4wpTxso3yipM=";
+    url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
+    sha256 = "FiU2cxEaLsyW/I0tFfrdobVU0B3CioMEE11J1rqHsUA=";
   };
 
   patches = [
@@ -66,10 +67,13 @@ let self = stdenv.mkDerivation rec {
       sha256 = "/npUE3idMSTVlFptsDpZmGWjZ/d2gqruVlJKq4eF4xU=";
     })
 
-    (substituteAll {
-      src = ./fix-paths.patch;
-      inherit zenity;
-    })
+    # GLib 2.76 switches from using its own slice allocator to using the system malloc instead.
+    # This makes dragging window between workspace in multitasking view crashes Pantheon's Gala.
+    # Inspiration https://github.com/mate-desktop/mate-desktop/pull/538
+    # Backtrace https://github.com/elementary/gala/issues/1580
+    # Upstream report https://gitlab.gnome.org/GNOME/mutter/-/issues/2495
+    # The patch will not apply on 44.0+, make sure this is fixed when trying to clean this up.
+    ./glib-2-76-gala-crash.patch
   ];
 
   mesonFlags = [
@@ -81,6 +85,7 @@ let self = stdenv.mkDerivation rec {
     # This should be auto detected, but it looks like it manages a false
     # positive.
     "-Dxwayland_initfd=disabled"
+    "-Ddocs=true"
   ];
 
   propagatedBuildInputs = [
@@ -102,6 +107,7 @@ let self = stdenv.mkDerivation rec {
     pkg-config
     python3
     wrapGAppsHook
+    gi-docgen
     xorgserver
   ];
 
@@ -123,6 +129,8 @@ let self = stdenv.mkDerivation rec {
     libxkbcommon
     libxkbfile
     libXdamage
+    colord
+    lcms2
     pango
     pipewire
     sysprof # for D-Bus interfaces
@@ -140,16 +148,24 @@ let self = stdenv.mkDerivation rec {
     ${glib.dev}/bin/glib-compile-schemas "$out/share/glib-2.0/schemas"
   '';
 
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    # TODO: Move this into a directory devhelp can find.
+    moveToOutput "share/mutter-11/doc" "$devdoc"
+  '';
+
   # Install udev files into our own tree.
   PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
 
+  separateDebugInfo = true;
+
   passthru = {
-    libdir = "${self}/lib/mutter-10";
+    libdir = "${finalAttrs.finalPackage}/lib/mutter-11";
 
     tests = {
       libdirExists = runCommand "mutter-libdir-exists" {} ''
-        if [[ ! -d ${self.libdir} ]]; then
-          echo "passthru.libdir should contain a directory, “${self.libdir}” is not one."
+        if [[ ! -d ${finalAttrs.finalPackage.libdir} ]]; then
+          echo "passthru.libdir should contain a directory, “${finalAttrs.finalPackage.libdir}” is not one."
           exit 1
         fi
         touch $out
@@ -164,5 +180,4 @@ let self = stdenv.mkDerivation rec {
     maintainers = teams.pantheon.members;
     platforms = platforms.linux;
   };
-};
-in self
+})
diff --git a/pkgs/desktops/gnome/core/mutter/43/glib-2-76-gala-crash.patch b/pkgs/desktops/gnome/core/mutter/43/glib-2-76-gala-crash.patch
new file mode 100644
index 0000000000000..895cabcdbdb42
--- /dev/null
+++ b/pkgs/desktops/gnome/core/mutter/43/glib-2-76-gala-crash.patch
@@ -0,0 +1,25 @@
+diff --git a/clutter/clutter/clutter-actor.c b/clutter/clutter/clutter-actor.c
+index d34c8f59f..8835a6a33 100644
+--- a/clutter/clutter/clutter-actor.c
++++ b/clutter/clutter/clutter-actor.c
+@@ -12304,7 +12304,7 @@ clutter_actor_run_actions (ClutterActor       *self,
+                            ClutterEventPhase   phase)
+ {
+   ClutterActorPrivate *priv;
+-  const GList *actions, *l;
++  const GList *actions, *l, *next;
+   gboolean retval = CLUTTER_EVENT_PROPAGATE;
+ 
+   priv = self->priv;
+@@ -12313,9 +12313,10 @@ clutter_actor_run_actions (ClutterActor       *self,
+ 
+   actions = _clutter_meta_group_peek_metas (priv->actions);
+ 
+-  for (l = actions; l; l = l->next)
++  for (l = actions; l; l = next)
+     {
+       ClutterAction *action = l->data;
++      next = l->next;
+       ClutterEventPhase action_phase;
+ 
+       action_phase = clutter_action_get_phase (action);
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index f07443cb24965..76228560bba1c 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -1,7 +1,6 @@
 { fetchurl
 , runCommand
 , lib
-, fetchpatch
 , stdenv
 , pkg-config
 , gnome
@@ -16,28 +15,44 @@
 , libcanberra
 , ninja
 , xvfb-run
-, xkeyboard_config
 , libxcvt
-, libxkbfile
+, libICE
+, libX11
+, libXcomposite
+, libXcursor
 , libXdamage
-, libxkbcommon
+, libXext
+, libXfixes
+, libXi
 , libXtst
+, libxkbfile
+, xkeyboard_config
+, libxkbcommon
+, libXrender
+, libxcb
+, libXrandr
+, libXinerama
+, libXau
 , libinput
 , libdrm
 , gsettings-desktop-schemas
 , glib
-, gtk3
+, atk
+, gtk4
+, fribidi
+, harfbuzz
 , gnome-desktop
 , pipewire
 , libgudev
 , libwacom
+, libSM
 , xwayland
 , mesa
 , meson
 , gnome-settings-daemon
 , xorgserver
 , python3
-, wrapGAppsHook
+, wrapGAppsHook4
 , gi-docgen
 , sysprof
 , libsysprof-capture
@@ -50,34 +65,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "43.3";
+  version = "44.0";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    sha256 = "Z75IINmycMnDxl44lHvwUtLC/xiunnBCHUklnvrACn0=";
+    sha256 = "chSwfhNYnvfB31U8ftEaAnmOQ62mwiiRP056Zm7vusQ=";
   };
 
-  patches = [
-    # Fix build with separate sysprof.
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2572
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/285a5a4d54ca83b136b787ce5ebf1d774f9499d5.patch";
-      sha256 = "/npUE3idMSTVlFptsDpZmGWjZ/d2gqruVlJKq4eF4xU=";
-    })
-
-    # Fix focus regression.
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2848
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/12ce58dba4f96f6a948c1d166646d263253e3ee0.patch";
-      sha256 = "CGu11aLFs8VEt8NiIkih+cXZzU82oxY6Ko9QRKOkM98=";
-    })
-  ];
-
   mesonFlags = [
     "-Degl_device=true"
     "-Dinstalled_tests=false" # TODO: enable these
+    "-Dtests=false"
     "-Dwayland_eglstream=true"
     "-Dprofiler=true"
     "-Dxwayland_path=${xwayland}/bin/Xwayland"
@@ -90,7 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [
     # required for pkg-config to detect mutter-clutter
     json-glib
-    libXtst
     libcap_ng
     graphene
   ];
@@ -105,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
     xvfb-run
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook4
     gi-docgen
     xorgserver
   ];
@@ -118,25 +117,44 @@ stdenv.mkDerivation (finalAttrs: {
     gnome-settings-daemon
     gobject-introspection
     gsettings-desktop-schemas
-    gtk3
+    atk
+    fribidi
+    harfbuzz
     libcanberra
     libdrm
     libgudev
     libinput
     libstartup_notification
     libwacom
-    libxkbcommon
-    libxkbfile
-    libXdamage
+    libSM
     colord
     lcms2
     pango
     pipewire
     sysprof # for D-Bus interfaces
     libsysprof-capture
-    xkeyboard_config
     xwayland
     wayland-protocols
+  ] ++ [
+    # X11 client
+    gtk4
+    libICE
+    libX11
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXtst
+    libxkbfile
+    xkeyboard_config
+    libxkbcommon
+    libXrender
+    libxcb
+    libXrandr
+    libXinerama
+    libXau
   ];
 
   postPatch = ''
@@ -150,7 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
     # TODO: Move this into a directory devhelp can find.
-    moveToOutput "share/mutter-11/doc" "$devdoc"
+    moveToOutput "share/mutter-12/doc" "$devdoc"
   '';
 
   # Install udev files into our own tree.
@@ -159,7 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
   separateDebugInfo = true;
 
   passthru = {
-    libdir = "${finalAttrs.finalPackage}/lib/mutter-11";
+    libdir = "${finalAttrs.finalPackage}/lib/mutter-12";
 
     tests = {
       libdirExists = runCommand "mutter-libdir-exists" {} ''
diff --git a/pkgs/desktops/gnome/core/nautilus/default.nix b/pkgs/desktops/gnome/core/nautilus/default.nix
index 5addc8311c96b..11dac0484ba2b 100644
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -38,13 +38,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nautilus";
-  version = "43.2";
+  version = "44.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "qGqap6RVURsCnOSaHYtGWcPDVbXYHXNgu00N5jev7eA=";
+    sha256 = "V7meu44rnBUS04HlMJYYjAh7M0ENbFLYeie9YO52rH8=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/rygel/default.nix b/pkgs/desktops/gnome/core/rygel/default.nix
index 6c5d6bc64b74b..b9491a236dfd2 100644
--- a/pkgs/desktops/gnome/core/rygel/default.nix
+++ b/pkgs/desktops/gnome/core/rygel/default.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rygel";
-  version = "0.42.1";
+  version = "0.42.2";
 
   # TODO: split out lib
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "BfMrbray/j8dg8Vp3QKnRnfN5nyTpb3O6JXiPr+omD0=";
+    sha256 = "FYHjkw9dOv4XSHLJawoc014UJ5VCUffnMs5iZlOBioc=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/simple-scan/default.nix b/pkgs/desktops/gnome/core/simple-scan/default.nix
index 07910cd8c7687..9d7e60eed64dc 100644
--- a/pkgs/desktops/gnome/core/simple-scan/default.nix
+++ b/pkgs/desktops/gnome/core/simple-scan/default.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "simple-scan";
-  version = "42.5";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-BfXfpOniBu+p1ATJhh3XxEIJF5PnNMQXGXOZFyUOQFA=";
+    sha256 = "sha256-Obhw/Ub0R/dH6uzC3yYEnvdzGFCZ8OE8Z1ZWJk3ZjpU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/zenity/default.nix b/pkgs/desktops/gnome/core/zenity/default.nix
index f5eb4c5e80dfc..b5968f92f3d77 100644
--- a/pkgs/desktops/gnome/core/zenity/default.nix
+++ b/pkgs/desktops/gnome/core/zenity/default.nix
@@ -6,26 +6,22 @@
 , pkg-config
 , libxml2
 , gnome
-, gtk3
+, gtk4
 , gettext
-, libX11
+, libadwaita
 , itstool
-, wrapGAppsHook
+, wrapGAppsHook4
 }:
 
 stdenv.mkDerivation rec {
   pname = "zenity";
-  version = "3.44.0";
+  version = "3.91.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/zenity/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "wVWCMB7ZC51CzlIdvM+ZqYnyLxIEG91SecZjbamev2U=";
+    sha256 = "N2GeCYAwgXj9vPaDItmaB7MzbBwLuY7ysyycsQkCI5k=";
   };
 
-  patches = [
-    ./fix-icon-install.patch
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -33,12 +29,12 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     libxml2
-    wrapGAppsHook
+    wrapGAppsHook4
   ];
 
   buildInputs = [
-    gtk3
-    libX11
+    gtk4
+    libadwaita
   ];
 
   passthru = {
@@ -51,6 +47,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Tool to display dialogs from the commandline and shell scripts";
     homepage = "https://wiki.gnome.org/Projects/Zenity";
+    license = licenses.lgpl21Plus;
     platforms = platforms.unix;
     maintainers = teams.gnome.members;
   };
diff --git a/pkgs/desktops/gnome/core/zenity/fix-icon-install.patch b/pkgs/desktops/gnome/core/zenity/fix-icon-install.patch
deleted file mode 100644
index d412cc4a5bf04..0000000000000
--- a/pkgs/desktops/gnome/core/zenity/fix-icon-install.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/data/meson.build b/data/meson.build
-index 339b3cff..aca65efd 100644
---- a/data/meson.build
-+++ b/data/meson.build
-@@ -9,5 +9,6 @@ install_data(
-     'zenity-text.png',
-     'zenity-scale.png',
-     'zenity-entry.png',
--    'zenity-notification.png']
-+    'zenity-notification.png'],
-+  install_dir: zenity_prefix / get_option('datadir') / 'icons/hicolor/48x48/apps',
-   )
diff --git a/pkgs/desktops/gnome/default.nix b/pkgs/desktops/gnome/default.nix
index 155d8413ee2ac..62af89161e7f6 100644
--- a/pkgs/desktops/gnome/default.nix
+++ b/pkgs/desktops/gnome/default.nix
@@ -75,8 +75,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gnome-settings-daemon = callPackage ./core/gnome-settings-daemon { };
 
-  # Using 42 to match Mutter used in Pantheon
-  gnome-settings-daemon42 = callPackage ./core/gnome-settings-daemon/42 { };
+  # Using 43 to match Mutter used in Pantheon
+  gnome-settings-daemon43 = callPackage ./core/gnome-settings-daemon/43 { };
 
   gnome-software = callPackage ./core/gnome-software { };
 
@@ -97,7 +97,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   mutter = callPackage ./core/mutter { };
 
   # Needed for elementary's gala, wingpanel and greeter until support for higher versions is provided
-  mutter42 = callPackage ./core/mutter/42 { };
+  mutter43 = callPackage ./core/mutter/43 { };
 
   nautilus = callPackage ./core/nautilus { };
 
@@ -272,5 +272,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   gnome-devel-docs = throw "The ‘gnome.gnome-devel-docs’ package was removed as it is outdated and no longer relevant."; # added 2022-10-26
 
   mutter338 = throw "The ‘gnome.mutter338’ package was removed as it is no longer needed by Pantheon."; # added 2023-02-22
+  mutter42 = throw "The ‘gnome.mutter42’ package was removed as it is no longer needed by Pantheon."; # added 2023-03-23
   gnome-settings-daemon338 = throw "The ‘gnome.gnome-settings-daemon338’ package was removed as it is no longer needed by Pantheon."; # added 2023-02-22
+  gnome-settings-daemon42 = throw "The ‘gnome.gnome-settings-daemon42’ package was removed as it is no longer needed by Pantheon."; # added 2023-03-23
 }
diff --git a/pkgs/desktops/gnome/games/atomix/default.nix b/pkgs/desktops/gnome/games/atomix/default.nix
index 43278a05b4d64..0d43c8e2ee7d0 100644
--- a/pkgs/desktops/gnome/games/atomix/default.nix
+++ b/pkgs/desktops/gnome/games/atomix/default.nix
@@ -1,33 +1,43 @@
-{ lib, stdenv, fetchurl, fetchpatch
-, meson, ninja, pkg-config, wrapGAppsHook, python3
-, gettext, gnome, glib, gtk3, libgnome-games-support, gdk-pixbuf }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook
+, python3
+, gettext
+, gnome
+, glib
+, gtk3
+, libgnome-games-support
+, gdk-pixbuf
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "atomix";
-  version = "3.34.0";
+  version = "44.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/atomix/${lib.versions.majorMinor version}/atomix-${version}.tar.xz";
-    sha256 = "0h909a4mccf160hi0aimyicqhq2b0gk1dmqp7qwf87qghfrw6m00";
+    url = "mirror://gnome/sources/atomix/${lib.versions.major finalAttrs.version}/atomix-${finalAttrs.version}.tar.xz";
+    sha256 = "yISTF2iNh9pzTJBjA1YxBSAH8qh5m2xsyRUmWIC1X7Q=";
   };
 
-  patches = [
-    # Pull upstream fix for -fno-common toolchains like gcc-10:
-    #  https://gitlab.gnome.org/GNOME/atomix/-/merge_requests/2
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://gitlab.gnome.org/GNOME/atomix/-/commit/be7f44f1945a569494d46c60eaf6e7b39b2bb48b.patch";
-      sha256 = "0nrwl6kb1als9mxd5s0la45z63xwshqlnxqjaax32w8yrl6kz7l8";
-    })
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    wrapGAppsHook
+    python3
   ];
 
-  nativeBuildInputs = [ meson ninja pkg-config gettext wrapGAppsHook python3 ];
-  buildInputs = [ glib gtk3 gdk-pixbuf libgnome-games-support gnome.adwaita-icon-theme ];
-
-  # When building with clang ceil() is not inlined:
-  # ld: src/libatomix.a.p/canvas_helper.c.o: undefined reference to symbol 'ceil@@GLIBC_2.2.5'
-  #  https://gitlab.gnome.org/GNOME/atomix/-/merge_requests/3
-  NIX_LDFLAGS = "-lm";
+  buildInputs = [
+    glib
+    gtk3
+    gdk-pixbuf
+    libgnome-games-support
+  ];
 
   postPatch = ''
     chmod +x meson_post_install.py
@@ -36,8 +46,8 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "gnome.${pname}";
+      packageName = "atomix";
+      attrPath = "gnome.atomix";
     };
   };
 
@@ -48,4 +58,4 @@ stdenv.mkDerivation rec {
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/desktops/gnome/games/gnome-chess/default.nix b/pkgs/desktops/gnome/games/gnome-chess/default.nix
index e431d2de012f8..43b4628d2bb6d 100644
--- a/pkgs/desktops/gnome/games/gnome-chess/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-chess/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-chess";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-chess/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "c08JLZX8YECe6so0J7WkjLm1mdoRmVEZ2FuqmWU+ApI=";
+    sha256 = "NIUI+PbnRRwHNE/6egmpkM8dKIO8z1M0CdvgKSaNSfI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/games/gnome-sudoku/default.nix b/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
index 9018df07e9cd6..fc26ab94f7240 100644
--- a/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-sudoku";
-  version = "43.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-sudoku/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "we6/QJPzNrSJ+5HHMO2mcdpo7vZeYZehKYqVRseImZ8=";
+    sha256 = "ZRjZIzpG1+E4Bax4dme6RwGUjZ7UGke4h5f826Q7j7o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/games/hitori/default.nix b/pkgs/desktops/gnome/games/hitori/default.nix
index 092735d55a173..e416a7f0343fd 100644
--- a/pkgs/desktops/gnome/games/hitori/default.nix
+++ b/pkgs/desktops/gnome/games/hitori/default.nix
@@ -16,13 +16,13 @@
 , desktop-file-utils
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hitori";
-  version = "3.38.4";
+  version = "44.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/hitori/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "iZPMkfuSN4jjieA+wqp4dtFcErrZIEz2Wy/6DtOSL30=";
+    url = "mirror://gnome/sources/hitori/${lib.versions.major finalAttrs.version}/hitori-${finalAttrs.version}.tar.xz";
+    sha256 = "QicL1PlSXRgNMVG9ckUzXcXPJIqYTgL2j/kw2nmeWDs=";
   };
 
   nativeBuildInputs = [
@@ -50,8 +50,8 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "gnome.${pname}";
+      packageName = "hitori";
+      attrPath = "gnome.hitori";
     };
   };
 
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Apps/Hitori";
     description = "GTK application to generate and let you play games of Hitori";
     maintainers = teams.gnome.members;
-    license = licenses.gpl2;
+    license = licenses.gpl3Plus;
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/desktops/gnome/misc/gnome-autoar/default.nix b/pkgs/desktops/gnome/misc/gnome-autoar/default.nix
index 683b5c22626f7..8d1adac088e88 100644
--- a/pkgs/desktops/gnome/misc/gnome-autoar/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-autoar/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-autoar";
-  version = "0.4.3";
+  version = "0.4.4";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-autoar/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "e98HiVU0lqvdw8ljsM5zY4BcDALAJf7d68qsx4cknog=";
+    sha256 = "wK++MzvPPLFEGh9XTMjsexuBl3eRRdTt7uKJb9rPw8I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/misc/gnome-panel/default.nix b/pkgs/desktops/gnome/misc/gnome-panel/default.nix
index 503fc34bae87d..aedcfec4337e8 100644
--- a/pkgs/desktops/gnome/misc/gnome-panel/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-panel/default.nix
@@ -14,7 +14,6 @@
 , gtk3
 , itstool
 , libgweather
-, libsoup
 , libwnck
 , libxml2
 , pkg-config
@@ -25,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-panel";
-  version = "3.46.0";
+  version = "3.47.1";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-zsehG3DFJLXo121Nfk2DXuYHq9outC9N92GeYusGrrE=";
+    hash = "sha256-2PbixllmjHffgsPdlboE/O+MQMIo4sImBfmhepFh7IM=";
   };
 
   patches = [
@@ -77,7 +76,6 @@ stdenv.mkDerivation rec {
     gnome-menus
     gtk3
     libgweather
-    libsoup
     libwnck
     polkit
     systemd
diff --git a/pkgs/desktops/gnome/misc/gpaste/default.nix b/pkgs/desktops/gnome/misc/gpaste/default.nix
index adee04a0df805..c549533f8ddd0 100644
--- a/pkgs/desktops/gnome/misc/gpaste/default.nix
+++ b/pkgs/desktops/gnome/misc/gpaste/default.nix
@@ -1,8 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, appstream-glib
-, clutter
 , gjs
 , glib
 , gobject-introspection
@@ -21,14 +19,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "43.1";
+  version = "44.0";
   pname = "gpaste";
 
   src = fetchFromGitHub {
     owner = "Keruspe";
     repo = "GPaste";
     rev = "v${version}";
-    sha256 = "sha256-wOxhaYWX76jSur3uh75vDfAedbiLh2ikoMuobCZx3jE=";
+    sha256 = "sha256-mYbyu3IIF6pQz1oEqEWLe7jdR99M3LxiMiRR9x7qFh8=";
   };
 
   patches = [
@@ -47,7 +45,6 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    appstream-glib
     gobject-introspection
     meson
     ninja
@@ -58,7 +55,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    clutter # required by mutter-clutter
     gjs
     glib
     gtk3
@@ -70,7 +66,6 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dgcr3=false" # Build with gcr4
     "-Dcontrol-center-keybindings-dir=${placeholder "out"}/share/gnome-control-center/keybindings"
     "-Ddbus-services-dir=${placeholder "out"}/share/dbus-1/services"
     "-Dsystemd-user-unit-dir=${placeholder "out"}/etc/systemd/user"
diff --git a/pkgs/desktops/pantheon/default.nix b/pkgs/desktops/pantheon/default.nix
index a96cce755c976..9ba16c2eb765d 100644
--- a/pkgs/desktops/pantheon/default.nix
+++ b/pkgs/desktops/pantheon/default.nix
@@ -40,10 +40,10 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   maintainers = lib.teams.pantheon.members;
 
-  mutter = pkgs.gnome.mutter42;
+  mutter = pkgs.gnome.mutter43;
 
-  # Using 42 to match Mutter used in Pantheon
-  gnome-settings-daemon = pkgs.gnome.gnome-settings-daemon42;
+  # Using 43 to match Mutter used in Pantheon
+  gnome-settings-daemon = pkgs.gnome.gnome-settings-daemon43;
 
   elementary-gsettings-schemas = callPackage ./desktop/elementary-gsettings-schemas { };
 
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index f470cb120de1f..b6899e98b9395 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -58,6 +58,7 @@ let majorVersion = "10";
         url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
         sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
       })
+      ../11/fix-struct-redefinition-on-glibc-2.36.patch
     ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index b2330abd4b75b..cdd82f0631a78 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -28,6 +28,8 @@
 , buildPackages
 , libxcrypt
 , disableGdbPlugin ? !enablePlugin
+, nukeReferences
+, callPackage
 }:
 
 # Make sure we get GNU sed.
@@ -49,7 +51,7 @@ with builtins;
 
 let majorVersion = "11";
     version = "${majorVersion}.3.0";
-    disableBootstrap = !(with stdenv; targetPlatform == hostPlatform && hostPlatform == buildPlatform);
+    disableBootstrap = !stdenv.hostPlatform.isDarwin;
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -60,6 +62,7 @@ let majorVersion = "11";
         url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
         sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
       })
+      ./fix-struct-redefinition-on-glibc-2.36.patch
     ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
@@ -159,7 +162,7 @@ let majorVersion = "11";
 
 in
 
-stdenv.mkDerivation ({
+lib.pipe (stdenv.mkDerivation ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
@@ -250,9 +253,8 @@ stdenv.mkDerivation ({
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
 
   buildFlags =
-    let target =
-          lib.optionalString (profiledCompiler) "profiled" +
-          lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+    let target = lib.optionalString (profiledCompiler) "profiled"
+      + lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
     in lib.optional (target != "") target;
 
   inherit (callFile ../common/strip-attributes.nix { })
@@ -310,4 +312,8 @@ stdenv.mkDerivation ({
 }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
-)
+))
+[
+  (callPackage ../common/libgcc.nix   { inherit langC langCC langJit; })
+  (callPackage ../common/checksum.nix { inherit langC langCC; })
+]
diff --git a/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch b/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch
new file mode 100644
index 0000000000000..3f5f64a3d0748
--- /dev/null
+++ b/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch
@@ -0,0 +1,41 @@
+From d2356ebb0084a0d80dbfe33040c9afe938c15d19 Mon Sep 17 00:00:00 2001
+From: Martin Liska <mliska@suse.cz>
+Date: Mon, 11 Jul 2022 22:03:14 +0200
+Subject: [PATCH] libsanitizer: cherry-pick 9cf13067cb5088626ba7 from upstream
+
+9cf13067cb5088626ba7ee1ec4c42ec59c7995a0 [sanitizer] Remove #include <linux/fs.h> to resolve fsconfig_command/mount_attr conflict with glibc 2.36
+
+(cherry picked from commit 2701442d0cf6292f6624443c15813d6d1a3562fe)
+---
+ .../sanitizer_platform_limits_posix.cpp                | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
+index 025e575b5bc7..5743516c0460 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
+@@ -72,7 +72,9 @@
+ #include <sys/vt.h>
+ #include <linux/cdrom.h>
+ #include <linux/fd.h>
++#if SANITIZER_ANDROID
+ #include <linux/fs.h>
++#endif
+ #include <linux/hdreg.h>
+ #include <linux/input.h>
+ #include <linux/ioctl.h>
+@@ -828,10 +830,10 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+   unsigned IOCTL_EVIOCGPROP = IOCTL_NOT_PRESENT;
+   unsigned IOCTL_EVIOCSKEYCODE_V2 = IOCTL_NOT_PRESENT;
+ #endif
+-  unsigned IOCTL_FS_IOC_GETFLAGS = FS_IOC_GETFLAGS;
+-  unsigned IOCTL_FS_IOC_GETVERSION = FS_IOC_GETVERSION;
+-  unsigned IOCTL_FS_IOC_SETFLAGS = FS_IOC_SETFLAGS;
+-  unsigned IOCTL_FS_IOC_SETVERSION = FS_IOC_SETVERSION;
++  unsigned IOCTL_FS_IOC_GETFLAGS = _IOR('f', 1, long);
++  unsigned IOCTL_FS_IOC_GETVERSION = _IOR('v', 1, long);
++  unsigned IOCTL_FS_IOC_SETFLAGS = _IOW('f', 2, long);
++  unsigned IOCTL_FS_IOC_SETVERSION = _IOW('v', 2, long);
+   unsigned IOCTL_GIO_CMAP = GIO_CMAP;
+   unsigned IOCTL_GIO_FONT = GIO_FONT;
+   unsigned IOCTL_GIO_UNIMAP = GIO_UNIMAP;
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 78dc30a34463e..ffe94eab3ce39 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -29,6 +29,8 @@
 , buildPackages
 , libxcrypt
 , disableGdbPlugin ? !enablePlugin
+, nukeReferences
+, callPackage
 }:
 
 # Make sure we get GNU sed.
@@ -54,7 +56,7 @@ with builtins;
 
 let majorVersion = "12";
     version = "${majorVersion}.2.0";
-    disableBootstrap = !(with stdenv; targetPlatform == hostPlatform && hostPlatform == buildPlatform);
+    disableBootstrap = !stdenv.hostPlatform.isDarwin;
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -177,6 +179,7 @@ let majorVersion = "12";
         mpfr
         name
         noSysDirs
+        nukeReferences
         patchelf
         perl
         profiledCompiler
@@ -194,7 +197,7 @@ let majorVersion = "12";
 
 in
 
-stdenv.mkDerivation ({
+lib.pipe (stdenv.mkDerivation ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
@@ -344,4 +347,9 @@ stdenv.mkDerivation ({
 }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
-)
+))
+[
+  (callPackage ../common/libgcc.nix   { inherit langC langCC langJit; })
+  (callPackage ../common/checksum.nix { inherit langC langCC; })
+]
+
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index d966b75d377be..90880752ca7a6 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -60,7 +60,8 @@ let majorVersion = "4";
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
     patches =
-      [ ../use-source-date-epoch.patch ../parallel-bconfig.patch ./parallel-strsignal.patch
+      [ ../9/fix-struct-redefinition-on-glibc-2.36.patch ../use-source-date-epoch.patch
+        ../parallel-bconfig.patch ./parallel-strsignal.patch
         ./libsanitizer.patch
         (fetchpatch {
           name = "avoid-ustat-glibc-2.28.patch";
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 953f931fa8190..1c0f727cbb98a 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -62,7 +62,8 @@ let majorVersion = "6";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches = optionals (!stdenv.targetPlatform.isRedox) [
+    patches = [ ../9/fix-struct-redefinition-on-glibc-2.36.patch ]
+    ++ optionals (!stdenv.targetPlatform.isRedox) [
       ../use-source-date-epoch.patch ./0001-Fix-build-for-glibc-2.31.patch
 
       # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
@@ -77,6 +78,7 @@ let majorVersion = "6";
       ++ optional langAda ./gnat-glibc234.patch
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
+      ++ optional langGo ./gogcc-workaround-glibc-2.36.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
       ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch
diff --git a/pkgs/development/compilers/gcc/6/gogcc-workaround-glibc-2.36.patch b/pkgs/development/compilers/gcc/6/gogcc-workaround-glibc-2.36.patch
new file mode 100644
index 0000000000000..bc11f990e5e92
--- /dev/null
+++ b/pkgs/development/compilers/gcc/6/gogcc-workaround-glibc-2.36.patch
@@ -0,0 +1,14 @@
+diff --git a/libgo/mksysinfo.sh b/libgo/mksysinfo.sh
+index dd456e907..24e607c7b 100755
+--- a/libgo/mksysinfo.sh
++++ b/libgo/mksysinfo.sh
+@@ -148,9 +148,6 @@ cat > sysinfo.c <<EOF
+ #if defined(HAVE_LINUX_ETHER_H)
+ #include <linux/ether.h>
+ #endif
+-#if defined(HAVE_LINUX_FS_H)
+-#include <linux/fs.h>
+-#endif
+ #if defined(HAVE_LINUX_REBOOT_H)
+ #include <linux/reboot.h>
+ #endif
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index ab80d31893774..d6329c8661467 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -63,6 +63,8 @@ let majorVersion = "7";
           url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
           sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
         })
+
+        ../9/fix-struct-redefinition-on-glibc-2.36.patch
       ]
       ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optionals targetPlatform.isNetBSD [
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index a929663dca2e4..1484a92565723 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -53,6 +53,7 @@ let majorVersion = "8";
         url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
         sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
       })
+      ../9/fix-struct-redefinition-on-glibc-2.36.patch
     ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional targetPlatform.isNetBSD ../libstdc++-netbsd-ctypes.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 6da17fb09451e..ce109a532af7a 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -56,6 +56,7 @@ let majorVersion = "9";
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
     patches = [
+      ./fix-struct-redefinition-on-glibc-2.36.patch
       # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
       (fetchurl {
         name = "fix-bug-80431.patch";
diff --git a/pkgs/development/compilers/gcc/9/fix-struct-redefinition-on-glibc-2.36.patch b/pkgs/development/compilers/gcc/9/fix-struct-redefinition-on-glibc-2.36.patch
new file mode 100644
index 0000000000000..5b4abfd02e0bf
--- /dev/null
+++ b/pkgs/development/compilers/gcc/9/fix-struct-redefinition-on-glibc-2.36.patch
@@ -0,0 +1,31 @@
+Derived from ../11/fix-struct-redefinition-on-glibc-2.36.patch (upstream commit d2356ebb0084a0d80dbfe33040c9afe938c15d19)
+
+diff --git a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
+index e8fce8a02..cb1ac806e 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
+@@ -65,7 +65,9 @@
+ #include <sys/vt.h>
+ #include <linux/cdrom.h>
+ #include <linux/fd.h>
++#if SANITIZER_ANDROID
+ #include <linux/fs.h>
++#endif
+ #include <linux/hdreg.h>
+ #include <linux/input.h>
+ #include <linux/ioctl.h>
+@@ -846,10 +848,10 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+   unsigned IOCTL_EVIOCGPROP = IOCTL_NOT_PRESENT;
+   unsigned IOCTL_EVIOCSKEYCODE_V2 = IOCTL_NOT_PRESENT;
+ #endif
+-  unsigned IOCTL_FS_IOC_GETFLAGS = FS_IOC_GETFLAGS;
+-  unsigned IOCTL_FS_IOC_GETVERSION = FS_IOC_GETVERSION;
+-  unsigned IOCTL_FS_IOC_SETFLAGS = FS_IOC_SETFLAGS;
+-  unsigned IOCTL_FS_IOC_SETVERSION = FS_IOC_SETVERSION;
++  unsigned IOCTL_FS_IOC_GETFLAGS = _IOR('f', 1, long);
++  unsigned IOCTL_FS_IOC_GETVERSION = _IOR('v', 1, long);
++  unsigned IOCTL_FS_IOC_SETFLAGS = _IOW('f', 2, long);
++  unsigned IOCTL_FS_IOC_SETVERSION = _IOW('v', 2, long);
+   unsigned IOCTL_GIO_CMAP = GIO_CMAP;
+   unsigned IOCTL_GIO_FONT = GIO_FONT;
+   unsigned IOCTL_GIO_UNIMAP = GIO_UNIMAP;
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 52e044ad6b58a..a2155360edeed 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -262,7 +262,7 @@ postInstall() {
     fi
 
     # Get rid of some "fixed" header files
-    rm -rfv $out/lib/gcc/*/*/include-fixed/{root,linux}
+    rm -rfv $out/lib/gcc/*/*/include-fixed/{root,linux,sys/mount.h}
 
     # Replace hard links for i686-pc-linux-gnu-gcc etc. with symlinks.
     for i in $out/bin/*-gcc*; do
diff --git a/pkgs/development/compilers/gcc/common/checksum.nix b/pkgs/development/compilers/gcc/common/checksum.nix
new file mode 100644
index 0000000000000..7a20ed1b8ba36
--- /dev/null
+++ b/pkgs/development/compilers/gcc/common/checksum.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, nukeReferences
+, langC
+, langCC
+, runtimeShell
+}:
+
+let
+  enableChecksum = (with stdenv; buildPlatform == hostPlatform && hostPlatform == targetPlatform) && langC && langCC && !stdenv.hostPlatform.isDarwin;
+in
+(pkg: pkg.overrideAttrs (previousAttrs: lib.optionalAttrs enableChecksum {
+  outputs = previousAttrs.outputs ++ lib.optionals enableChecksum [ "checksum" ];
+  # This is a separate phase because gcc assembles its phase scripts
+  # in bash instead of nix (we should fix that).
+  preFixupPhases = (previousAttrs.preFixupPhases or []) ++ [ "postInstallSaveChecksumPhase" ];
+  #
+  # gcc uses an auxiliary utility `genchecksum` to md5-hash (most of) its
+  # `.o` and `.a` files prior to linking (in case the linker is
+  # nondeterministic).  Since we want to compare across gccs built from two
+  # separate derivations, we wrap `genchecksum` with a `nuke-references`
+  # call.  We also stash copies of the inputs to `genchecksum` in
+  # `$checksum/inputs/` -- this is extremely helpful for debugging since
+  # it's hard to get Nix to not delete the $NIX_BUILD_TOP of a successful
+  # build.
+  #
+  postInstallSaveChecksumPhase = ''
+    mv gcc/build/genchecksum gcc/build/.genchecksum-wrapped
+    cat > gcc/build/genchecksum <<\EOF
+    #!${runtimeShell}
+    ${nukeReferences}/bin/nuke-refs $@
+    for INPUT in "$@"; do install -Dt $INPUT $checksum/inputs/; done
+    exec build/.genchecksum-wrapped $@
+    EOF
+    chmod +x gcc/build/genchecksum
+    rm gcc/*-checksum.*
+    make -C gcc cc1-checksum.o cc1plus-checksum.o
+    install -Dt $checksum/checksums/ gcc/cc*-checksum.o
+  '';
+}))
diff --git a/pkgs/development/compilers/gcc/common/libgcc.nix b/pkgs/development/compilers/gcc/common/libgcc.nix
new file mode 100644
index 0000000000000..198b5d446b81c
--- /dev/null
+++ b/pkgs/development/compilers/gcc/common/libgcc.nix
@@ -0,0 +1,96 @@
+{ lib
+, stdenv
+, langC
+, langCC
+, langJit
+}:
+
+let
+  enableLibGccOutput = (with stdenv; targetPlatform == hostPlatform) && !langJit && !stdenv.hostPlatform.isDarwin;
+in
+(pkg: pkg.overrideAttrs (previousAttrs: lib.optionalAttrs ((!langC) || langJit || enableLibGccOutput) {
+  outputs = previousAttrs.outputs ++ lib.optionals enableLibGccOutput [ "libgcc" ];
+  # This is a separate phase because gcc assembles its phase scripts
+  # in bash instead of nix (we should fix that).
+  preFixupPhases = (previousAttrs.preFixupPhases or []) ++ [ "preFixupLibGccPhase" ];
+  preFixupLibGccPhase =
+    # delete extra/unused builds of libgcc_s in non-langC builds
+    # (i.e. libgccjit, gnat, etc) to avoid potential confusion
+    lib.optionalString (!langC) ''
+      rm -f $out/lib/libgcc_s.so*
+    ''
+
+    # TODO(amjoseph): remove the `libgcc_s.so` symlinks below and replace them
+    # with a `-L${gccForLibs.libgcc}/lib` in cc-wrapper's
+    # `$out/nix-support/cc-flags`.  See also:
+    # - https://github.com/NixOS/nixpkgs/pull/209870#discussion_r1130614895
+    # - https://github.com/NixOS/nixpkgs/pull/209870#discussion_r1130635982
+    # - https://github.com/NixOS/nixpkgs/commit/404155c6acfa59456aebe6156b22fe385e7dec6f
+    #
+    # move `libgcc_s.so` into its own output, `$libgcc`
+    + lib.optionalString enableLibGccOutput (''
+      # move libgcc from lib to its own output (libgcc)
+      mkdir -p $libgcc/lib
+      mv    $lib/lib/libgcc_s.so      $libgcc/lib/
+      mv    $lib/lib/libgcc_s.so.1    $libgcc/lib/
+      ln -s $libgcc/lib/libgcc_s.so   $lib/lib/
+      ln -s $libgcc/lib/libgcc_s.so.1 $lib/lib/
+    ''
+    #
+    # Nixpkgs ordinarily turns dynamic linking into pseudo-static linking:
+    # libraries are still loaded dynamically, exactly which copy of each
+    # library is loaded is permanently fixed at compile time (via RUNPATH).
+    # For libgcc_s we must revert to the "impure dynamic linking" style found
+    # in imperative software distributions.  We must do this because
+    # `libgcc_s` calls `malloc()` and therefore has a `DT_NEEDED` for `libc`,
+    # which creates two problems:
+    #
+    #  1. A circular package dependency `glibc`<-`libgcc`<-`glibc`
+    #
+    #  2. According to the `-Wl,-rpath` flags added by Nixpkgs' `ld-wrapper`,
+    #     the two versions of `glibc` in the cycle above are actually
+    #     different packages.  The later one is compiled by this `gcc`, but
+    #     the earlier one was compiled by the compiler *that compiled* this
+    #     `gcc` (usually the bootstrapFiles).  In any event, the `glibc`
+    #     dynamic loader won't honor that specificity without namespaced
+    #     manual loads (`dlmopen()`).  Once a `libc` is present in the address
+    #     space of a process, that `libc` will be used to satisfy all
+    #     `DT_NEEDED`s for `libc`, regardless of `RUNPATH`s.
+    #
+    # So we wipe the RUNPATH using `patchelf --set-rpath ""`.  We can't use
+    # `patchelf --remove-rpath`, because at least as of patchelf 0.15.0 it
+    # will leave the old RUNPATH string in the file where the reference
+    # scanner can still find it:
+    #
+    #   https://github.com/NixOS/patchelf/issues/453
+    #
+    # Note: we might be using the bootstrapFiles' copy of patchelf, so we have
+    # to keep doing it this way until both the issue is fixed *and* all the
+    # bootstrapFiles are regenerated, on every platform.
+    #
+    # This patchelfing is *not* effectively equivalent to copying
+    # `libgcc_s` into `glibc`'s outpath.  There is one minor and one
+    # major difference:
+    #
+    # 1. (Minor): multiple builds of `glibc` (say, with different
+    #    overrides or parameters) will all reference a single store
+    #    path:
+    #
+    #      /nix/store/xxx...xxx-gcc-libgcc/lib/libgcc_s.so.1
+    #
+    #    This many-to-one referrer relationship will be visible in the store's
+    #    dependency graph, and will be available to `nix-store -q` queries.
+    #    Copying `libgcc_s` into each of its referrers would lose that
+    #    information.
+    #
+    # 2. (Major): by referencing `libgcc_s.so.1`, rather than copying it, we
+    #    are still able to run `nix-store -qd` on it to find out how it got
+    #    built!  Most importantly, we can see from that deriver which compiler
+    #    was used to build it (or if it is part of the unpacked
+    #    bootstrap-files).  Copying `libgcc_s.so.1` from one outpath to
+    #    another eliminates the ability to make these queries.
+    #
+    + ''
+      patchelf --set-rpath "" $libgcc/lib/libgcc_s.so.1
+    '');
+}))
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index e0e980483064b..8eb10fe843972 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = "sdk-${version}";
-    hash = "sha256-P2HG/oJXdB5nvU3zVnj2vSLJGQuDcZiQBfBBvuR66Kk=";
+    hash = "sha256-U45/7G02o82EP4zh7i2Go0VCnsO1B7vxDwIokjyo5Rk=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
@@ -28,11 +28,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 bison jq ];
 
   patches = [
-    (fetchpatch {
-      name = "Use-CMAKE_INSTALL_FULL_LIBDIR-in-compat-cmake-files.patch";
-      url = "https://github.com/KhronosGroup/glslang/commit/7627bd89583c5aafb8b38c81c15494019271fabf.patch";
-      hash = "sha256-1Dwhn78PG4gAGgEwTXpC+mkZRyvy8sTIsEvihXFeNaQ=";
-    })
+    # Related PR: https://github.com/KhronosGroup/glslang/pull/3067
+    ./use-CMAKE_INSTALL_FULL_LIBDIR-in-compat-cmake-files.patch
     # Upstream tries to detect the Darwin linker by checking for AppleClang, but it’s just Clang in nixpkgs.
     # Revert the commit to allow the build to work on Darwin with the nixpkg Darwin Clang toolchain.
     (fetchpatch {
diff --git a/pkgs/development/compilers/glslang/use-CMAKE_INSTALL_FULL_LIBDIR-in-compat-cmake-files.patch b/pkgs/development/compilers/glslang/use-CMAKE_INSTALL_FULL_LIBDIR-in-compat-cmake-files.patch
new file mode 100644
index 0000000000000..43ab219635274
--- /dev/null
+++ b/pkgs/development/compilers/glslang/use-CMAKE_INSTALL_FULL_LIBDIR-in-compat-cmake-files.patch
@@ -0,0 +1,139 @@
+commit 0bcfd795469c6067d1e891198d9177afa5cce1c9
+Author: Chuang Zhu <git@chuang.cz>
+Date:   Sat Nov 19 12:03:20 2022 +0800
+
+    Use CMAKE_INSTALL_FULL_LIBDIR in compat cmake files
+    
+    According to
+    https://cmake.org/cmake/help/v3.25/module/GNUInstallDirs.html,
+    CMAKE_INSTALL_LIBDIR can be an absolute path. For instance, Nixpkgs
+    [defined it to an absolute path in /nix/store](https://github.com/NixOS/nixpkgs/blob/3d17b4c305cefef284109fa9d426b00f3e5072c6/pkgs/development/tools/build-managers/cmake/setup-hook.sh#L101).
+    The output in this case is:
+    
+            # result-glslang/lib/cmake/glslangTargets.cmake:5
+            include("${CMAKE_CURRENT_LIST_DIR}/../..//nix/store/3mif2zibig0cilk5dbz334278n0vlq9s-glslang-1.3.231.0/lib/glslang/glslang-targets.cmake")
+    
+    Signed-off-by: Chuang Zhu <git@chuang.cz>
+
+diff --git a/OGLCompilersDLL/CMakeLists.txt b/OGLCompilersDLL/CMakeLists.txt
+index 33f16b0d..71a5675d 100644
+--- a/OGLCompilersDLL/CMakeLists.txt
++++ b/OGLCompilersDLL/CMakeLists.txt
+@@ -49,7 +49,7 @@ if(ENABLE_GLSLANG_INSTALL AND NOT BUILD_SHARED_LIBS)
+         message(WARNING \"Using `OGLCompilerTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+         if (NOT TARGET glslang::OGLCompiler)
+-            include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++            include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+         endif()
+ 
+         add_library(OGLCompiler ALIAS glslang::OGLCompiler)
+diff --git a/SPIRV/CMakeLists.txt b/SPIRV/CMakeLists.txt
+index 35b74621..b31bdd63 100644
+--- a/SPIRV/CMakeLists.txt
++++ b/SPIRV/CMakeLists.txt
+@@ -125,7 +125,7 @@ if(ENABLE_GLSLANG_INSTALL)
+             message(WARNING \"Using `SPVRemapperTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+             if (NOT TARGET glslang::SPVRemapper)
+-                include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++                include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+             endif()
+ 
+             add_library(SPVRemapper ALIAS glslang::SPVRemapper)
+@@ -137,7 +137,7 @@ if(ENABLE_GLSLANG_INSTALL)
+         message(WARNING \"Using `SPIRVTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+         if (NOT TARGET glslang::SPIRV)
+-            include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++            include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+         endif()
+ 
+         add_library(SPIRV ALIAS glslang::SPIRV)
+diff --git a/StandAlone/CMakeLists.txt b/StandAlone/CMakeLists.txt
+index b1ba18f6..8ddef104 100644
+--- a/StandAlone/CMakeLists.txt
++++ b/StandAlone/CMakeLists.txt
+@@ -101,7 +101,7 @@ if(ENABLE_GLSLANG_INSTALL)
+         message(WARNING \"Using `glslangValidatorTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+         if (NOT TARGET glslang::glslangValidator)
+-            include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++            include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+         endif()
+ 
+         add_library(glslangValidator ALIAS glslang::glslangValidator)
+@@ -116,7 +116,7 @@ if(ENABLE_GLSLANG_INSTALL)
+             message(WARNING \"Using `spirv-remapTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+             if (NOT TARGET glslang::spirv-remap)
+-                include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++                include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+             endif()
+ 
+             add_library(spirv-remap ALIAS glslang::spirv-remap)
+diff --git a/glslang/CMakeLists.txt b/glslang/CMakeLists.txt
+index 7d8790c4..4d8a537b 100644
+--- a/glslang/CMakeLists.txt
++++ b/glslang/CMakeLists.txt
+@@ -234,7 +234,7 @@ if(ENABLE_GLSLANG_INSTALL)
+             message(WARNING \"Using `glslangTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+             if (NOT TARGET glslang::glslang)
+-                include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++                include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+             endif()
+ 
+             if(${BUILD_SHARED_LIBS})
+diff --git a/glslang/OSDependent/Unix/CMakeLists.txt b/glslang/OSDependent/Unix/CMakeLists.txt
+index 7ed71fbf..acb74275 100644
+--- a/glslang/OSDependent/Unix/CMakeLists.txt
++++ b/glslang/OSDependent/Unix/CMakeLists.txt
+@@ -60,7 +60,7 @@ if(ENABLE_GLSLANG_INSTALL AND NOT BUILD_SHARED_LIBS)
+         message(WARNING \"Using `OSDependentTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+         if (NOT TARGET glslang::OSDependent)
+-            include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++            include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+         endif()
+ 
+         add_library(OSDependent ALIAS glslang::OSDependent)
+diff --git a/glslang/OSDependent/Windows/CMakeLists.txt b/glslang/OSDependent/Windows/CMakeLists.txt
+index 67976da8..882133ab 100644
+--- a/glslang/OSDependent/Windows/CMakeLists.txt
++++ b/glslang/OSDependent/Windows/CMakeLists.txt
+@@ -55,7 +55,7 @@ if(ENABLE_GLSLANG_INSTALL)
+         message(WARNING \"Using `OSDependentTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+         if (NOT TARGET glslang::OSDependent)
+-            include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++            include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+         endif()
+ 
+         add_library(OSDependent ALIAS glslang::OSDependent)
+diff --git a/gtests/CMakeLists.txt b/gtests/CMakeLists.txt
+index 203812d8..408a92db 100644
+--- a/gtests/CMakeLists.txt
++++ b/gtests/CMakeLists.txt
+@@ -76,7 +76,7 @@ if(BUILD_TESTING)
+                 message(WARNING \"Using `glslangtestsTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+                 if (NOT TARGET glslang::glslangtests)
+-                    include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++                    include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+                 endif()
+ 
+                 add_library(glslangtests ALIAS glslang::glslangtests)
+diff --git a/hlsl/CMakeLists.txt b/hlsl/CMakeLists.txt
+index 4d5f15fd..16c82a67 100644
+--- a/hlsl/CMakeLists.txt
++++ b/hlsl/CMakeLists.txt
+@@ -53,7 +53,7 @@ if(ENABLE_GLSLANG_INSTALL)
+         message(WARNING \"Using `HLSLTargets.cmake` is deprecated: use `find_package(glslang)` to find glslang CMake targets.\")
+ 
+         if (NOT TARGET glslang::HLSL)
+-            include(\"\${CMAKE_CURRENT_LIST_DIR}/../../${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
++            include(\"${CMAKE_INSTALL_FULL_LIBDIR}/cmake/${PROJECT_NAME}/glslang-targets.cmake\")
+         endif()
+ 
+         add_library(HLSL ALIAS glslang::HLSL)
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index a6ecf62bbcb76..2e05fac64ffc0 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -149,13 +149,13 @@ stdenv.mkDerivation rec {
     # Contains the wrong perl shebang when cross compiling,
     # since it is not used for anything we can deleted as well.
     rm src/regexp/syntax/make_perl_groups.pl
-  '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
+  '' + (if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
     ''}
-  '' else lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
+  '' else lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
     rm -rf bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index f9e93570bdb40..1891e9c9cf2ee 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -149,13 +149,13 @@ stdenv.mkDerivation rec {
     # Contains the wrong perl shebang when cross compiling,
     # since it is not used for anything we can deleted as well.
     rm src/regexp/syntax/make_perl_groups.pl
-  '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
+  '' + (if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
     ''}
-  '' else lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
+  '' else lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
     rm -rf bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index 6d08c18b143ed..a7b36e4e7dfb1 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.20.2";
+  version = "1.20.3";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-TQ4oUNGXtN2tO9sBljABedCVuzrv1N+8OzZwLDco+Ks=";
+    hash = "sha256-5Ee0mM3lAhXE92GeUSSw/E4l+10W6kcnHEfyeOeqdjo=";
   };
 
   strictDeps = true;
@@ -141,13 +141,13 @@ stdenv.mkDerivation rec {
     # Contains the wrong perl shebang when cross compiling,
     # since it is not used for anything we can deleted as well.
     rm src/regexp/syntax/make_perl_groups.pl
-  '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
+  '' + (if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
     ''}
-  '' else lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
+  '' else lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
     rm -rf bin/*_*
     ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
       rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
diff --git a/pkgs/development/compilers/lesscpy/default.nix b/pkgs/development/compilers/lesscpy/default.nix
new file mode 100644
index 0000000000000..30429f1a9f286
--- /dev/null
+++ b/pkgs/development/compilers/lesscpy/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, lib, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  pname   = "lesscpy";
+  version = "0.13.0";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "1bbjag13kawnjdn7q4flfrkd0a21rgn9ycfqsgfdmg658jsx1ipk";
+  };
+
+  checkInputs = with python3Packages; [ pytestCheckHook ];
+  pythonImportsCheck = [ "lesscpy" ];
+  propagatedBuildInputs = with python3Packages; [ ply six ];
+
+  doCheck = false; # Really weird test failures (`nix-build-python2.css not found`)
+
+  meta = with lib; {
+    description = "Python LESS Compiler";
+    homepage    = "https://github.com/lesscpy/lesscpy";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ s1341 ];
+  };
+}
diff --git a/pkgs/development/compilers/rust/1_67.nix b/pkgs/development/compilers/rust/1_67.nix
deleted file mode 100644
index 2d22432798a41..0000000000000
--- a/pkgs/development/compilers/rust/1_67.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_15, llvm_15
-, fetchpatch
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.67.1";
-  rustcSha256 = "sha256-Rkg9Pl3oWjvUb456OuGDdJY5EGfb5xOiXTzwUbPZ/24=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_15.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_15;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.66.1";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "823128f64e902ee8aff61488c552c983e17ccca10c3f46dd93fde924d5100eb3";
-    x86_64-unknown-linux-gnu = "7ecf79e9ea23d05917b0172f9f81fb1e47011d261a719998f8d5620a1e835023";
-    x86_64-unknown-linux-musl = "70b660148238b8a137c6f165b0bc7bdcb50204c22a314bed6174ecd672f02e57";
-    arm-unknown-linux-gnueabihf = "12c93efe71f3334ef6e718786f6a60b9566f097d23a7f1e8f38ed9add209126f";
-    armv7-unknown-linux-gnueabihf = "f43c8cd3fd7d1c1e08bd6317220b2ec9b25891f464604f80bb17985b09bbf62a";
-    aarch64-unknown-linux-gnu = "84b8a79803c1b91386460fe6a7d04c54002344452ff8e5c5631d5fa275ed0c9c";
-    aarch64-unknown-linux-musl = "b2665da33efd328cff192a67ad026ea84f9deab8d1971892f4bbc22647606163";
-    x86_64-apple-darwin = "0fcf341db2579aa6eb61a3430cd1dbc79b042dfe89686b93cc887d818d086c30";
-    aarch64-apple-darwin = "03469fcaa0d8c505e6db03c18ded73cfbb6a2ce159292f8cf06c042bfc9f7cf9";
-    powerpc64le-unknown-linux-gnu = "ccf915a0137bb83a9d9b133a234ae53cc099f2ba26e3cb09d209b47bbee2ade7";
-    riscv64gc-unknown-linux-gnu = "525cb05edaf3ed0560753b413c72dd1b06492df28bf3c427a66fda683fdca3fc";
-    mips64el-unknown-linux-gnuabi64 = "3c241cc80410fe389e8b04beda62c42496c225fe8776db9d55a498c53244f7a6";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_67;
-
-  rustcPatches = [
-    # Fixes ICE.
-    # https://github.com/rust-lang/rust/pull/107688
-    (fetchpatch {
-      name = "re-erased-regions-are-local.patch";
-      url = "https://github.com/rust-lang/rust/commit/9d110847ab7f6aef56a8cd20cb6cea4fbcc51cd9.patch";
-      excludes = [ "*tests/*" ];
-      hash = "sha256-EZH5K1BEOOfi97xZr1xEHFP4jjvJ1+xqtRMvxBoL8pU=";
-    })
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_15" "llvm_15"])
diff --git a/pkgs/development/compilers/rust/1_68.nix b/pkgs/development/compilers/rust/1_68.nix
new file mode 100644
index 0000000000000..d691a30c51b5f
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_68.nix
@@ -0,0 +1,63 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_15, llvm_15
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.68.2";
+  rustcSha256 = "sha256-kzOcI/fNTQxF21jhi0xuFtYHD0J3qtnSSS0jKUvzLpY=";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_15.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackages = llvmPackages_15;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.67.1";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "4fe2128cfc32687e4717da4c6cb21aa563c36802c8e695cd3537a45efc5b8729";
+    x86_64-unknown-linux-gnu = "652a8966436c4e97b127721d9130810e1cdc8dfdf526fad68c9c1f6281bd02a3";
+    x86_64-unknown-linux-musl = "6fdc9379f662f8e9edd2d23e0a3ebcda502cc9f9a381b7c7d5fa38c326a82ad1";
+    arm-unknown-linux-gnueabihf = "eb919ef62a084797c148574abe39f2fb1e52d20b004041090811a6d479eb6503";
+    armv7-unknown-linux-gnueabihf = "09614988feb6310f64eaadf609c92dba5da5ebdbb5531b43a2b18d5336296b67";
+    aarch64-unknown-linux-gnu = "8edee248eed4b17c09b3d7b0096944b7e5992dd1119a28429c0b6b4d39a9613c";
+    aarch64-unknown-linux-musl = "05d03936493c19483eec4dc63d03f9e7a13f356d1147d1b8d7fc5dbfe508b4ed";
+    x86_64-apple-darwin = "020702c9564f53e18ac880db77c2f6b660a24ea372e4fda3f0c1ef2f8b9c74b9";
+    aarch64-apple-darwin = "8b07560267ec85703a5a9397a1746170fd7013e29fcfb9ffb8daa9bbf1e3211a";
+    powerpc64le-unknown-linux-gnu = "1d4d8b75c72362bb6e02bf56b53af9287806c4ef08187b8d166af0557a7c0096";
+    riscv64gc-unknown-linux-gnu = "a1a33154aeb5498c0c24a2ba77ec63e31a40df5e0861c0afda8d5867289c5984";
+    mips64el-unknown-linux-gnuabi64 = "6d70fe81e4f52ce5d87bcf95b60587f43f68e6730d2def7872646a9c561017ca";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_68;
+
+  rustcPatches = [ ];
+}
+
+(builtins.removeAttrs args [ "pkgsBuildHost" "llvmPackages_11" "llvmPackages_15" "llvm_15"])
diff --git a/pkgs/development/compilers/rust/cargo-auditable.nix b/pkgs/development/compilers/rust/cargo-auditable.nix
index 1745ae266c28c..34549e1982ed6 100644
--- a/pkgs/development/compilers/rust/cargo-auditable.nix
+++ b/pkgs/development/compilers/rust/cargo-auditable.nix
@@ -41,8 +41,6 @@ let
 in
 
 rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; } (args // {
-  auditable = true; # TODO: remove when this is the default
-
   nativeBuildInputs = [
     installShellFiles
   ];
@@ -50,4 +48,8 @@ rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; } (args //
   postInstall = ''
     installManPage cargo-auditable/cargo-auditable.1
   '';
+
+  passthru = {
+    inherit bootstrap;
+  };
 })
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index a98608b001c0b..7c094ac4ef9cb 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,11 +1,14 @@
-{ lib, stdenv, pkgsHostHost
+{ lib, stdenv, pkgsBuildHost, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, rustPlatform, rustc
 , CoreFoundation, Security
-, auditable ? false # TODO: change to true when this is the default
+, auditable ? true
+, cargo-auditable
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage.override {
+  cargo-auditable = cargo-auditable.bootstrap;
+} {
   pname = "cargo";
   inherit (rustc) version src;
 
@@ -20,6 +23,42 @@ rustPlatform.buildRustPackage {
     inherit (rustc) tests;
   };
 
+  # Upstream rustc still assumes that musl = static[1].  The fix for
+  # this is to disable crt-static by default for non-static musl
+  # targets.
+  #
+  # For every package apart from Cargo, we can fix this by just
+  # patching rustc to not have crt-static by default.  But Cargo is
+  # built with the upstream bootstrap binary for rustc, which we can't
+  # easily patch.  This means we need to find another way to make sure
+  # crt-static is not used during the build of pkgsMusl.cargo.
+  #
+  # By default, Cargo doesn't apply RUSTFLAGS when building build.rs
+  # if --target is passed, so the only good way to set -crt-static for
+  # build.rs files used in the Cargo build is to use the unstable
+  # -Zhost-config Cargo feature.  This allows us to specify flags that
+  # should be passed to rustc when building for the build platform.
+  # We also need to use -Ztarget-applies-to-host, because using
+  # -Zhost-config requires it.
+  #
+  # When doing this, we also have to specify the linker, or cargo
+  # won't pass a -C linker= argument to rustc.  This will make rustc
+  # try to use its default value of "cc", which won't be available
+  # when cross-compiling.
+  #
+  # [1]: https://github.com/rust-lang/compiler-team/issues/422
+  postPatch = lib.optionalString (with stdenv.buildPlatform; isMusl && !isStatic) ''
+    mkdir -p .cargo
+    cat <<EOF >> .cargo/config
+    [host]
+    rustflags = "-C target-feature=-crt-static"
+    linker = "${pkgsBuildHost.stdenv.cc}/bin/${pkgsBuildHost.stdenv.cc.targetPrefix}cc"
+    [unstable]
+    host-config = true
+    target-applies-to-host = true
+    EOF
+  '';
+
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
 
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 7cb6f22c949b4..f9068a7999a20 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -147,6 +147,18 @@ in stdenv.mkDerivation rec {
 
     # Useful debugging parameter
     # export VERBOSE=1
+  '' + lib.optionalString (stdenv.targetPlatform.isMusl && !stdenv.targetPlatform.isStatic) ''
+    # Upstream rustc still assumes that musl = static[1].  The fix for
+    # this is to disable crt-static by default for non-static musl
+    # targets.
+    #
+    # Even though Cargo will build build.rs files for the build platform,
+    # cross-compiling _from_ musl appears to work fine, so we only need
+    # to do this when rustc's target platform is dynamically linked musl.
+    #
+    # [1]: https://github.com/rust-lang/compiler-team/issues/422
+    substituteInPlace compiler/rustc_target/src/spec/linux_musl_base.rs \
+        --replace "base.crt_static_default = true" "base.crt_static_default = false"
   '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
     # See https://github.com/jemalloc/jemalloc/issues/1997
     # Using a value of 48 should work on both emulated and native x86_64-darwin.
diff --git a/pkgs/development/compilers/rust/rustfmt.nix b/pkgs/development/compilers/rust/rustfmt.nix
index 2c2a144609315..1ff36e71e82ba 100644
--- a/pkgs/development/compilers/rust/rustfmt.nix
+++ b/pkgs/development/compilers/rust/rustfmt.nix
@@ -11,7 +11,9 @@ rustPlatform.buildRustPackage rec {
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
 
-  buildInputs = lib.optional stdenv.isDarwin Security;
+  buildInputs = [
+    rustPlatform.rust.rustc.llvm
+  ] ++ lib.optional stdenv.isDarwin Security;
 
   # As of 1.0.0 and rustc 1.30 rustfmt requires a nightly compiler
   RUSTC_BOOTSTRAP = 1;
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index fd3007cc15e23..3a97fd2eda6a7 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -103,8 +103,8 @@ in rec {
   };
 
   vala_0_56 = generic {
-    version = "0.56.4";
-    sha256 = "hixB2ThUPtPY2GyCGaYQh3lxk97+6NoMUMr0mZPGa2o=";
+    version = "0.56.6";
+    sha256 = "BQ6EHL/iuOfQ+zUMlQa9dVe+HNhqkMiWdl8aCaGHABM=";
   };
 
   vala = vala_0_56;
diff --git a/pkgs/development/interpreters/lua-5/build-lua-package.nix b/pkgs/development/interpreters/lua-5/build-lua-package.nix
index c86e71ad366b1..0ae950216d8de 100644
--- a/pkgs/development/interpreters/lua-5/build-lua-package.nix
+++ b/pkgs/development/interpreters/lua-5/build-lua-package.nix
@@ -14,7 +14,7 @@
 , rockspecVersion ? version
 
 # by default prefix `name` e.g. "lua5.2-${name}"
-, namePrefix ? "${lua.pname}${lib.versions.majorMinor version}-"
+, namePrefix ? "${lua.pname}${lib.versions.majorMinor lua.version}-"
 
 # Dependencies for building the package
 , buildInputs ? []
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index dfbbdd74c7184..4643980a66ceb 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -121,20 +121,20 @@
       sourceVersion = {
         major = "3";
         minor = "10";
-        patch = "10";
+        patch = "11";
         suffix = "";
       };
-      hash = "sha256-BBnpCFv1G3pnIAmz9Q2/GFms3xi6cl0OwZqlyFA/DqM=";
+      hash = "sha256-PDvDBIMDchyQSgPrgya2Mekh8RzDvimIRWpC8RXa8Ew=";
     };
 
     python311 = {
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "2";
+        patch = "3";
         suffix = "";
       };
-      hash = "sha256-KeS49fFlhUKowT4t0nc1jJxI8rL3MYZS7xZ15AK50q8=";
+      hash = "sha256-il25nJYafs8nx1lWGJyWAslodR8R2+riuQDb/xwIW14=";
     };
   };
 
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index f34262b03f2d8..4502b4afa38d2 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -18,17 +18,18 @@
 , libXi
 , libXext
 , gnome
+, systemd
 }:
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.46.0";
+  version = "2.48.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "qgyGx596jWe65JpbelqwhDDGCM/+bjO/R6cvQasDw9A=";
+    sha256 = "kFpbbxeQto7oA7/6n1+rTOtZH7T64LL4xhLFTx1OijA=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +50,9 @@ stdenv.mkDerivation rec {
     libXi
     # libXext is a transitive dependency of libXi
     libXext
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    # libsystemd is a needed for dbus-broker support
+    systemd
   ];
 
   # In atspi-2.pc dbus-1 glib-2.0
@@ -67,6 +71,9 @@ stdenv.mkDerivation rec {
     # including the entire dbus closure in libraries linked with
     # the at-spi2-core libraries.
     "-Ddbus_daemon=/run/current-system/sw/bin/dbus-daemon"
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    # Same as the above, but for dbus-broker
+    "-Ddbus_broker=/run/current-system/sw/bin/dbus-broker-launch"
   ];
 
   passthru = {
diff --git a/pkgs/development/libraries/audio/lv2/default.nix b/pkgs/development/libraries/audio/lv2/default.nix
index 6371a52b4dff5..d0f85c95a077f 100644
--- a/pkgs/development/libraries/audio/lv2/default.nix
+++ b/pkgs/development/libraries/audio/lv2/default.nix
@@ -1,45 +1,59 @@
 { stdenv
 , lib
 , fetchurl
-, libsndfile
-, pkg-config
-, python3
-, wafHook
+, meson
+, ninja
+
 , pipewire
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "lv2";
-  version = "1.18.2";
+  version = "1.18.10";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "https://lv2plug.in/spec/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-TokfvHRMBYVb6136gugisUkX3Wbpj4K4Iw29HHqy4F4=";
+    url = "https://lv2plug.in/spec/${pname}-${version}.tar.xz";
+    hash = "sha256-eMUbzyG1Tli7Yymsy7Ta4Dsu15tSD5oB5zS9neUwlT8=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
-    pkg-config
-    wafHook
-    python3
+    meson
+    ninja
   ];
 
-  buildInputs = [
-    libsndfile
-    python3
-  ];
+  buildInputs = [ ];
 
-  wafConfigureFlags = [
-    "--includedir=${placeholder "dev"}/include"
+  mesonFlags = [
+    # install validators to $dev
     "--bindir=${placeholder "dev"}/bin"
+
+    # These are just example plugins. They pull in outdated gtk-2
+    # dependency and many other things. Upstream would like to
+    # eventually move them of the project:
+    #   https://gitlab.com/lv2/lv2/-/issues/57#note_1096060029
+    "-Dplugins=disabled"
+    # Pulls in spell checkers among other things.
+    "-Dtests=disabled"
+    # Avoid heavyweight python dependencies.
+    "-Ddocs=disabled"
   ] ++ lib.optionals stdenv.isDarwin [
-    "--lv2dir=${placeholder "out"}/lib/lv2"
+    "-Dlv2dir=${placeholder "out"}/lib/lv2"
   ];
-  dontAddWafCrossFlags = true;
 
-  passthru.tests = {
-    inherit pipewire;
+  passthru = {
+    tests = {
+      inherit pipewire;
+    };
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://gitlab.com/lv2/lv2.git";
+      rev-prefix = "v";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
index 287ce2a700846..7b3dfee253de5 100644
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -13,13 +13,15 @@
   libunwind,
   pulseaudioSupport ? true,
   libpulseaudio,
+  opensslSupport ? true,
+  openssl,
   soxSupport ? true,
   sox
 }:
 
 stdenv.mkDerivation rec {
   pname = "roc-toolkit";
-  version = "0.2.1";
+  version = "0.2.3";
 
   outputs = [ "out" "dev" ];
 
@@ -27,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "roc-streaming";
     repo = "roc-toolkit";
     rev = "v${version}";
-    sha256 = "sha256-W8PiI5W1T6pNaYzR4u6fPtkP8DKq/Z85Kq/WF5dXVxo=";
+    hash = "sha256-wwcc2r1hrM9zryMJp+DOifSh0g6T/gdZJMpVdhqhjR8=";
   };
 
   nativeBuildInputs = [
@@ -43,12 +45,14 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional openfecSupport openfec
     ++ lib.optional libunwindSupport libunwind
     ++ lib.optional pulseaudioSupport libpulseaudio
+    ++ lib.optional opensslSupport openssl
     ++ lib.optional soxSupport sox;
 
   sconsFlags =
     [ "--build=${stdenv.buildPlatform.config}"
       "--host=${stdenv.hostPlatform.config}"
       "--prefix=${placeholder "out"}" ] ++
+    lib.optional (!opensslSupport) "--disable-openssl" ++
     lib.optional (!soxSupport) "--disable-sox" ++
     lib.optional (!libunwindSupport) "--disable-libunwind" ++
     lib.optional (!pulseaudioSupport) "--disable-pulseaudio" ++
@@ -57,13 +61,6 @@ stdenv.mkDerivation rec {
        else [ "--with-libraries=${openfec}/lib"
               "--with-openfec-includes=${openfec.dev}/include" ]);
 
-  prePatch = lib.optionalString stdenv.isAarch64
-    "sed -i 's/c++98/c++11/g' SConstruct";
-
-  patches = [
-    ./fix-pkgconfig-installation.patch
-  ];
-
   meta = with lib; {
     description = "Roc is a toolkit for real-time audio streaming over the network";
     homepage = "https://github.com/roc-streaming/roc-toolkit";
diff --git a/pkgs/development/libraries/audio/roc-toolkit/fix-pkgconfig-installation.patch b/pkgs/development/libraries/audio/roc-toolkit/fix-pkgconfig-installation.patch
deleted file mode 100644
index 8c6982f1f7c10..0000000000000
--- a/pkgs/development/libraries/audio/roc-toolkit/fix-pkgconfig-installation.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/SConscript b/src/SConscript
-index b59f67a7..9f16e0a2 100644
---- a/src/SConscript
-+++ b/src/SConscript
-@@ -141,7 +141,7 @@ if not GetOption('disable_shared') or GetOption('enable_static') or GetOption('e
-                 desc='Real-time audio streaming over the network.',
-                 url='https://roc-streaming.org',
-                 version=env['ROC_VERSION'])
--            env.AddDistFile(env['PKG_CONFIG_PATH'], pc_file)
-+            env.AddDistFile(os.path.join(env['ROC_SYSTEM_LIBDIR'], 'pkgconfig'), pc_file)
- 
- if GetOption('enable_examples'):
-     examples_env = subenvs.examples.Clone()
diff --git a/pkgs/development/libraries/audio/sratom/default.nix b/pkgs/development/libraries/audio/sratom/default.nix
index 67a66dbfe5a29..3de4ed8e774a5 100644
--- a/pkgs/development/libraries/audio/sratom/default.nix
+++ b/pkgs/development/libraries/audio/sratom/default.nix
@@ -1,20 +1,65 @@
-{ lib, stdenv, fetchurl, lv2, pkg-config, python3, serd, sord, wafHook }:
+{ lib
+, stdenv
+, fetchurl
+, lv2
+, meson
+, ninja
+, pkg-config
+, serd
+, sord
+, writeScript
+}:
 
 stdenv.mkDerivation rec {
   pname = "sratom";
-  version = "0.6.8";
+  version = "0.6.14";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Ossysa3Forf6za3i4IGLzWxx8j+EoevBeBW7eg0tAt8=";
+    url = "https://download.drobilla.net/${pname}-${version}.tar.xz";
+    hash = "sha256-mYL69A24Ou3Zs4UOSZ/s1oUri0um3t5RQBNlXP+soeY=";
   };
 
-  nativeBuildInputs = [ pkg-config wafHook python3 ];
-  buildInputs = [ lv2 serd sord ];
-  dontAddWafCrossFlags = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    lv2
+    serd
+    sord
+  ];
+
+  postPatch = ''
+    patchShebangs --build scripts/dox_to_sphinx.py
+  '';
+
+  mesonFlags = [
+    "-Ddocs=disabled"
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-sratom" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl pcre common-updater-scripts
+
+      set -eu -o pipefail
+
+      # Expect the text in format of 'download.drobilla.net/sratom-0.30.16.tar.xz">'
+      new_version="$(curl -s https://drobilla.net/category/sratom/ |
+          pcregrep -o1 'download.drobilla.net/sratom-([0-9.]+).tar.xz' |
+          head -n1)"
+      update-source-version ${pname} "$new_version"
+    '';
+  };
 
   meta = with lib; {
-    homepage = "http://drobilla.net/software/sratom";
+    homepage = "https://drobilla.net/software/sratom";
     description = "A library for serialising LV2 atoms to/from RDF";
     license = licenses.mit;
     maintainers = [ maintainers.goibhniu ];
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 20856f2ad9b86..f984f33103001 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.14.4";
+  version = "1.14.6";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.xz";
-    sha256 = "sha256-fA+bjl7A/yR5OD5iwAhKOimvme3xUU6fZZuBsw1ONT4=";
+    sha256 = "sha256-/SvfG7idw2WkZTG/9jFTbyKw0cbVzixcXlm1UmWz1ms=";
   };
 
   patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;
diff --git a/pkgs/development/libraries/dee/default.nix b/pkgs/development/libraries/dee/default.nix
index 25cf88253e6e3..4a2199f450e63 100644
--- a/pkgs/development/libraries/dee/default.nix
+++ b/pkgs/development/libraries/dee/default.nix
@@ -56,6 +56,10 @@ stdenv.mkDerivation rec {
     "--with-pygi-overrides-dir=${placeholder "py"}/${python3.sitePackages}/gi/overrides"
   ];
 
+  # Compilation fails after a change in glib where
+  # g_string_free now returns a value
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/directfb/default.nix b/pkgs/development/libraries/directfb/default.nix
index 0f4e62789a27b..6e2b28a46168e 100644
--- a/pkgs/development/libraries/directfb/default.nix
+++ b/pkgs/development/libraries/directfb/default.nix
@@ -25,6 +25,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    # https://github.com/deniskropp/DirectFB/blob/master/src/core/Makefile.am#L15
+    # BUILDTIME is embedded in the result
+    # if switching to cmake then a similar substitution has to be done
+    substituteInPlace src/core/Makefile.am \
+      --replace '`date -u "+%Y-%m-%d %H:%M"`' "`date -u \"+%Y-%m-%d %H:%M\" --date="@''${SOURCE_DATE_EPOCH}"`"
+  '';
+
   nativeBuildInputs = [ autoreconfHook perl pkg-config flux ];
 
   buildInputs = [ zlib libjpeg freetype giflib libpng ]
diff --git a/pkgs/development/libraries/folks/default.nix b/pkgs/development/libraries/folks/default.nix
index 57e90cd87f076..b3c6f0a591561 100644
--- a/pkgs/development/libraries/folks/default.nix
+++ b/pkgs/development/libraries/folks/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , pkg-config
 , meson
 , ninja
@@ -28,23 +27,15 @@
 
 stdenv.mkDerivation rec {
   pname = "folks";
-  version = "0.15.5";
+  version = "0.15.6";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "D/+KiWMwzYKu5FmDJPflQciE0DN1NiEnI7S+s4x1kIY=";
+    sha256 = "yGZjDFU/Kc6b4cemAmfLQICmvM9LjVUdxMfmI02EAkg=";
   };
 
-  patches = [
-    # Do not check for unneeded GTK dependency.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/folks/-/commit/686d58fb2454e5038bb951423245ed8c2d4b5cf6.patch";
-      sha256 = "0ydafVKhSrkHZK8bitPF5mNDTG5GrixGzBgBLNzLuXQ=";
-    })
-  ];
-
   nativeBuildInputs = [
     gettext
     gobject-introspection
@@ -117,7 +108,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A library that aggregates people from multiple sources to create metacontacts";
     homepage = "https://wiki.gnome.org/Projects/Folks";
-    license = licenses.lgpl2Plus;
+    license = licenses.lgpl21Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/libraries/gcr/4.nix b/pkgs/development/libraries/gcr/4.nix
index 28ca262ead15c..650d87958c5ea 100644
--- a/pkgs/development/libraries/gcr/4.nix
+++ b/pkgs/development/libraries/gcr/4.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gcr";
-  version = "4.0.0";
+  version = "4.1.0";
 
   outputs = [ "out" "bin" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "xFhVkk8O57q0Pi3Ti/r9KsgVxumGQ0HAFh4XEXPc7Hw=";
+    sha256 = "nOqtKShLqRm5IW4oiMGOxnJAwsk7OkhWvFSIu8Hzo4M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index ecf9090864dd1..bd4aea3210f2c 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -37,14 +37,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gegl";
-  version = "0.4.42";
+  version = "0.4.44";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "q6g6DLqmxW7cKeoi8ugXKVClO5bapRWSCD1ZIivd4C0=";
+    sha256 = "CkzbQWNeQGoISc0NPwPK99l8q4qhPShwfVMtAInVYSY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gjs/default.nix b/pkgs/development/libraries/gjs/default.nix
index 3cac2db1702c1..3db1a36e3f3c5 100644
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@@ -31,13 +31,13 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "gjs";
-  version = "1.74.2";
+  version = "1.76.0";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-pAb9ahZSz2bcqyKAYr0Wp19bM3gkjfu74BayEnRKMLY=";
+    sha256 = "sha256-pj8VaWSxNgU+q1HqATEU59fBk7dRjSjAQLawLDyTOm0=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index a9a214c542c32..35091bcbcfcdf 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glib-networking";
-  version = "2.74.0";
+  version = "2.76.0";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "HxharvCUEj+OJdj6VWYbP9cQIBY6AXSts1o3aFzaYTs=";
+    sha256 = "FJoFoXnmKaU4viVmKqMktJnXxFScUVHbU3PngKG/G5o=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index cf14aa610756c..d52ea735f8f0b 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -2,7 +2,7 @@
 , lib
 , stdenv
 , fetchurl
-, fetchpatch
+, fetchpatch2
 , gettext
 , meson
 , ninja
@@ -56,11 +56,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.74.5";
+  version = "2.76.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "zrqDpZmc6zGkxPyZISB8uf//0qsdbsA8Fi0/YIpcFMg=";
+    sha256 = "Q9wPahJpWPW0VBNsQ5jqtCAknBYXGnaXhEhuJfL9oZ8=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
@@ -68,27 +68,11 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch
-
-    # Fix error about missing sentinel in glib/tests/cxx.cpp
-    # These two commits are part of already merged glib MRs 3033 and 3031:
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3033
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/0ca5254c5d92aec675b76b4bfa72a6885cde6066.patch";
-      sha256 = "OfD5zO/7JIgOMLc0FAgHV9smWugFJuVPHCn9jTsMQJg=";
-    })
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3031
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/7dc19632f3115e3f517c6bc80436fe72c1dcdeb4.patch";
-      sha256 = "v28Yk+R0kN9ssIcvJudRZ4vi30rzQEE8Lsd1kWp5hbM=";
-    })
   ] ++ [
     ./glib-appinfo-watch.patch
     ./schema-override-variable.patch
 
-    # Add support for the GNOME’s default terminal emulator.
-    # https://gitlab.gnome.org/GNOME/glib/-/issues/2618
-    ./gnome-console-support.patch
-    # Do the same for Pantheon’s terminal emulator.
+    # Add support for Pantheon’s terminal emulator.
     ./elementary-terminal-support.patch
 
     # GLib contains many binaries used for different purposes;
@@ -195,6 +179,7 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs glib/gen-unicode-tables.pl
     patchShebangs glib/tests/gen-casefold-txt.py
     patchShebangs glib/tests/gen-casemap-txt.py
+    patchShebangs tools/gen-visibility-macros.py
 
     # Needs machine-id, comment the test
     sed -e '/\/gdbus\/codegen-peer-to-peer/ s/^\/*/\/\//' -i gio/tests/gdbus-peer.c
diff --git a/pkgs/development/libraries/glib/elementary-terminal-support.patch b/pkgs/development/libraries/glib/elementary-terminal-support.patch
index 0b8c8a70871cf..34a56c8487aee 100644
--- a/pkgs/development/libraries/glib/elementary-terminal-support.patch
+++ b/pkgs/development/libraries/glib/elementary-terminal-support.patch
@@ -1,16 +1,12 @@
 diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
-index a441bfec9..6bcd3e690 100644
+index 30fcb2937..a6a7163a7 100644
 --- a/gio/gdesktopappinfo.c
 +++ b/gio/gdesktopappinfo.c
-@@ -2678,6 +2678,11 @@ prepend_terminal_to_vector (int    *argc,
-             if (check != NULL)
-               pass_cmd_as_single_arg = TRUE;
-           }
-+          if (check == NULL) {
-+            check = g_find_program_in_path ("io.elementary.terminal");
-+            if (check != NULL)
-+              pass_cmd_as_single_arg = TRUE;
-+          }
-           if (check == NULL)
-             check = g_find_program_in_path ("tilix");
-           if (check == NULL)
+@@ -2704,6 +2704,7 @@ prepend_terminal_to_vector (int          *argc,
+     { "gnome-terminal", "--" },
+     { "mate-terminal", "-x" },
+     { "xfce4-terminal", "-x" },
++    { "io.elementary.terminal", "-x" },
+     { "tilix", "-e" },
+     { "konsole", "-e" },
+     { "nxterm", "-e" },
diff --git a/pkgs/development/libraries/glib/gnome-console-support.patch b/pkgs/development/libraries/glib/gnome-console-support.patch
deleted file mode 100644
index 7f6894a5cec9f..0000000000000
--- a/pkgs/development/libraries/glib/gnome-console-support.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
-index 60d6debb2..a441bfec9 100644
---- a/gio/gdesktopappinfo.c
-+++ b/gio/gdesktopappinfo.c
-@@ -2627,6 +2627,7 @@ prepend_terminal_to_vector (int    *argc,
-   int i, j;
-   char **term_argv = NULL;
-   int term_argc = 0;
-+  gboolean pass_cmd_as_single_arg = FALSE;
-   char *check;
-   char **the_argv;
- 
-@@ -2672,6 +2673,11 @@ prepend_terminal_to_vector (int    *argc,
-         }
-       else
-         {
-+          if (check == NULL) {
-+            check = g_find_program_in_path ("kgx");
-+            if (check != NULL)
-+              pass_cmd_as_single_arg = TRUE;
-+          }
-           if (check == NULL)
-             check = g_find_program_in_path ("tilix");
-           if (check == NULL)
-@@ -2697,14 +2703,27 @@ prepend_terminal_to_vector (int    *argc,
-         }
-     }
- 
--  real_argc = term_argc + *argc;
-+  real_argc = term_argc + (pass_cmd_as_single_arg ? 1 : *argc);
-   real_argv = g_new (char *, real_argc + 1);
- 
-   for (i = 0; i < term_argc; i++)
-     real_argv[i] = term_argv[i];
- 
--  for (j = 0; j < *argc; j++, i++)
--    real_argv[i] = (char *)the_argv[j];
-+  if (pass_cmd_as_single_arg) {
-+    char **quoted_argv = g_new (char *, *argc + 1);
-+
-+    for (j = 0; j < *argc; j++) {
-+      quoted_argv[j] = g_shell_quote (the_argv[j]);
-+      g_free (the_argv[j]);
-+    }
-+    quoted_argv[j] = NULL;
-+
-+    real_argv[i++] = g_strjoinv (" ", quoted_argv);
-+    g_strfreev (quoted_argv);
-+  } else {
-+    for (j = 0; j < *argc; j++, i++)
-+      real_argv[i] = (char *)the_argv[j];
-+  }
- 
-   real_argv[i] = NULL;
- 
diff --git a/pkgs/development/libraries/glib/split-dev-programs.patch b/pkgs/development/libraries/glib/split-dev-programs.patch
index 247db2150ede1..f0a217f65702e 100644
--- a/pkgs/development/libraries/glib/split-dev-programs.patch
+++ b/pkgs/development/libraries/glib/split-dev-programs.patch
@@ -1,8 +1,8 @@
 diff --git a/gio/gdbus-2.0/codegen/meson.build b/gio/gdbus-2.0/codegen/meson.build
-index f0a256898..9c8497cd0 100644
+index 65faae9b2..4297513d4 100644
 --- a/gio/gdbus-2.0/codegen/meson.build
 +++ b/gio/gdbus-2.0/codegen/meson.build
-@@ -19,7 +19,7 @@ gdbus_codegen_conf.set('DATADIR', glib_datadir)
+@@ -20,7 +20,7 @@ gdbus_codegen_conf.set('DATADIR', glib_datadir)
  # Install gdbus-codegen executable
  gdbus_codegen = configure_file(input : 'gdbus-codegen.in',
    output : 'gdbus-codegen',
@@ -12,10 +12,10 @@ index f0a256898..9c8497cd0 100644
    configuration : gdbus_codegen_conf
  )
 diff --git a/gio/meson.build b/gio/meson.build
-index fdd2528df..cf359c7d7 100644
+index 462606f3b..a3047fca1 100644
 --- a/gio/meson.build
 +++ b/gio/meson.build
-@@ -859,14 +859,15 @@ pkg.generate(libgio,
+@@ -880,14 +880,15 @@ pkg.generate(libgio,
    variables : ['datadir=' + join_paths('${prefix}', get_option('datadir')),
                 'schemasdir=' + join_paths('${datadir}', schemas_subdir),
                 'bindir=' + join_paths('${prefix}', get_option('bindir')),
@@ -36,7 +36,7 @@ index fdd2528df..cf359c7d7 100644
                 'gsettings=' + join_paths('${bindir}', 'gsettings')],
    version : glib_version,
    install_dir : glib_pkgconfigreldir,
-@@ -968,6 +969,7 @@ executable('gio', gio_tool_sources,
+@@ -989,6 +990,7 @@ executable('gio', gio_tool_sources,
  
  executable('gresource', 'gresource-tool.c',
    install : true,
@@ -44,7 +44,7 @@ index fdd2528df..cf359c7d7 100644
    install_tag : 'bin',
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
-@@ -975,7 +977,7 @@ executable('gresource', 'gresource-tool.c',
+@@ -996,7 +998,7 @@ executable('gresource', 'gresource-tool.c',
  
  gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodule-priv.c',
    install : true,
@@ -53,7 +53,7 @@ index fdd2528df..cf359c7d7 100644
    install_tag : 'bin',
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
-@@ -985,7 +987,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
+@@ -1006,7 +1008,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
  glib_compile_schemas = executable('glib-compile-schemas',
    ['glib-compile-schemas.c'],
    install : true,
@@ -62,7 +62,7 @@ index fdd2528df..cf359c7d7 100644
    install_tag : 'bin',
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
-@@ -994,6 +996,7 @@ glib_compile_schemas = executable('glib-compile-schemas',
+@@ -1015,6 +1017,7 @@ glib_compile_schemas = executable('glib-compile-schemas',
  glib_compile_resources = executable('glib-compile-resources',
    [gconstructor_as_data_h, 'glib-compile-resources.c'],
    install : true,
@@ -71,10 +71,10 @@ index fdd2528df..cf359c7d7 100644
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
 diff --git a/glib/meson.build b/glib/meson.build
-index 1e6dc36be..6b5de6c86 100644
+index da76fc005..8e2ef990c 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
-@@ -396,9 +396,10 @@ pkg.generate(libglib,
+@@ -441,9 +441,10 @@ pkg.generate(libglib,
    subdirs : ['glib-2.0'],
    extra_cflags : ['-I${libdir}/glib-2.0/include'] + win32_cflags,
    variables : ['bindir=' + join_paths('${prefix}', get_option('bindir')),
@@ -88,7 +88,7 @@ index 1e6dc36be..6b5de6c86 100644
    version : glib_version,
    install_dir : glib_pkgconfigreldir,
    filebase : 'glib-2.0',
-@@ -435,6 +436,7 @@ if host_system == 'windows'
+@@ -480,6 +481,7 @@ if host_system == 'windows'
  else
    gtester = executable('gtester', 'gtester.c',
      install : true,
@@ -96,7 +96,7 @@ index 1e6dc36be..6b5de6c86 100644
      install_tag : 'bin-devel',
      c_args : ['-UG_DISABLE_ASSERT'],
      include_directories : configinc,
-@@ -447,7 +449,7 @@ report_conf.set('PYTHON', python_name)
+@@ -492,7 +494,7 @@ report_conf.set('PYTHON', python_name)
  configure_file(
    input: 'gtester-report.in',
    output: 'gtester-report',
@@ -106,10 +106,10 @@ index 1e6dc36be..6b5de6c86 100644
    configuration: report_conf,
    install_mode: 'rwxr-xr-x'
 diff --git a/gobject/meson.build b/gobject/meson.build
-index a994eb591..36b36b925 100644
+index 2129aaf8a..da8462428 100644
 --- a/gobject/meson.build
 +++ b/gobject/meson.build
-@@ -79,7 +79,7 @@ foreach tool: python_tools
+@@ -94,7 +94,7 @@ foreach tool: python_tools
      input : tool + '.in',
      output : tool,
      configuration : python_tools_conf,
@@ -118,32 +118,32 @@ index a994eb591..36b36b925 100644
      install_tag : 'bin-devel',
    )
  
-@@ -155,6 +155,7 @@ meson.override_dependency('gobject-2.0', libgobject_dep)
+@@ -172,6 +172,7 @@ meson.override_dependency('gobject-2.0', libgobject_dep)
  
- executable('gobject-query', 'gobject-query.c',
+ gobject_query = executable('gobject-query', 'gobject-query.c',
    install : true,
 +  install_dir : get_option('devbindir'),
    install_tag : 'bin-devel',
    dependencies : [libglib_dep, libgobject_dep])
  
 diff --git a/meson_options.txt b/meson_options.txt
-index f13cbfdd5..f218db581 100644
+index 517d5757c..198cc1b3c 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -3,6 +3,11 @@ option('runtime_libdir',
-        value : '',
-        description : 'install runtime libraries relative to libdir')
+@@ -4,6 +4,11 @@ option('runtime_libdir',
+        description : 'install runtime libraries relative to libdir',
+        deprecated: true)
  
 +option('devbindir',
 +       type : 'string',
 +       value : '',
 +       description : 'bindir for development tools')
 +
- option('iconv',
-        type : 'combo',
-        choices : ['auto', 'libc', 'external'],
+ option('charsetalias_dir',
+        type : 'string',
+        value : '',
 diff --git a/tools/meson.build b/tools/meson.build
-index 0542fb89b..bfb10cd80 100644
+index 2d4192e46..d7e710d6f 100644
 --- a/tools/meson.build
 +++ b/tools/meson.build
 @@ -8,7 +8,7 @@ if have_sh
diff --git a/pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch b/pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch
index b2c998aabbef5..b7658b59fb1e5 100644
--- a/pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch
+++ b/pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch
@@ -1,4 +1,4 @@
-From faeeb0f353f5540da2015a41cb60fe43d199a1ac Mon Sep 17 00:00:00 2001
+From cdd0c4b168fe228de97778556cea5c0f936e0e79 Mon Sep 17 00:00:00 2001
 From: Bernardo Meurer <bernardo@meurer.org>
 Date: Fri, 22 Jul 2022 22:11:07 -0700
 Subject: [PATCH] Revert "Remove all usage of @BASH@ or ${BASH} in installed
@@ -22,10 +22,10 @@ Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>
  8 files changed, 15 insertions(+), 10 deletions(-)
 
 diff --git a/debug/Makefile b/debug/Makefile
-index 96029f32ee..cbbdeda277 100644
+index 52f9a7852c..22e4ae5461 100644
 --- a/debug/Makefile
 +++ b/debug/Makefile
-@@ -238,7 +238,8 @@ $(objpfx)pcprofiledump: $(objpfx)pcprofiledump.o
+@@ -265,8 +265,9 @@ $(objpfx)pcprofiledump: $(objpfx)pcprofiledump.o
  
  $(objpfx)xtrace: xtrace.sh
  	rm -f $@.new
@@ -36,21 +36,22 @@ index 96029f32ee..cbbdeda277 100644
 +	    -e 's|@PKGVERSION@|$(PKGVERSION)|' \
  	    -e 's|@REPORT_BUGS_TO@|$(REPORT_BUGS_TO)|' $^ > $@.new \
  	&& rm -f $@ && mv $@.new $@ && chmod +x $@
+ 
 diff --git a/debug/xtrace.sh b/debug/xtrace.sh
-index 8c56e01449..c760391a33 100755
+index 3d1f2af43a..eb2ba7ad4a 100755
 --- a/debug/xtrace.sh
 +++ b/debug/xtrace.sh
 @@ -1,4 +1,4 @@
 -#!/bin/bash
 +#! @BASH@
- # Copyright (C) 1999-2022 Free Software Foundation, Inc.
+ # Copyright (C) 1999-2023 Free Software Foundation, Inc.
  # This file is part of the GNU C Library.
  
 diff --git a/elf/Makefile b/elf/Makefile
-index 3536b6af5e..83521d9dbc 100644
+index 0d19964d42..ee8ee1cd41 100644
 --- a/elf/Makefile
 +++ b/elf/Makefile
-@@ -256,7 +256,8 @@ $(objpfx)sotruss-lib.so: $(common-objpfx)libc.so $(objpfx)ld.so \
+@@ -250,7 +250,8 @@ $(objpfx)sotruss-lib.so: $(common-objpfx)libc.so $(objpfx)ld.so \
  	$(common-objpfx)libc_nonshared.a
  
  $(objpfx)sotruss: sotruss.sh $(common-objpfx)config.make
@@ -60,7 +61,7 @@ index 3536b6af5e..83521d9dbc 100644
  	    -e 's%@TEXTDOMAINDIR@%$(localedir)%g' \
  	    -e 's%@PREFIX@%$(prefix)%g' \
  	    -e 's|@PKGVERSION@|$(PKGVERSION)|g' \
-@@ -1363,6 +1364,7 @@ ldd-rewrite = -e 's%@RTLD@%$(rtlddir)/$(rtld-installed-name)%g' \
+@@ -1396,6 +1397,7 @@ ldd-rewrite = -e 's%@RTLD@%$(rtlddir)/$(rtld-installed-name)%g' \
  	      -e 's%@VERSION@%$(version)%g' \
  	      -e 's|@PKGVERSION@|$(PKGVERSION)|g' \
  	      -e 's|@REPORT_BUGS_TO@|$(REPORT_BUGS_TO)|g' \
@@ -69,30 +70,30 @@ index 3536b6af5e..83521d9dbc 100644
  
  ifeq ($(ldd-rewrite-script),no)
 diff --git a/elf/ldd.bash.in b/elf/ldd.bash.in
-index 3253b32ef8..127eb59206 100644
+index e45dec5894..e09428506e 100644
 --- a/elf/ldd.bash.in
 +++ b/elf/ldd.bash.in
 @@ -1,4 +1,4 @@
 -#!/bin/bash
 +#! @BASH@
- # Copyright (C) 1996-2022 Free Software Foundation, Inc.
+ # Copyright (C) 1996-2023 Free Software Foundation, Inc.
  # This file is part of the GNU C Library.
  
 diff --git a/elf/sotruss.sh b/elf/sotruss.sh
-index 22327eac5c..7d15bf4fc8 100755
+index 874a6bed3f..7cc154561e 100755
 --- a/elf/sotruss.sh
 +++ b/elf/sotruss.sh
 @@ -1,4 +1,4 @@
 -#!/bin/bash
 +#! @BASH@
- # Copyright (C) 2011-2022 Free Software Foundation, Inc.
+ # Copyright (C) 2011-2023 Free Software Foundation, Inc.
  # This file is part of the GNU C Library.
  
 diff --git a/malloc/Makefile b/malloc/Makefile
-index 2329cf718a..5d7de4bee7 100644
+index dfb51d344c..574b5e9579 100644
 --- a/malloc/Makefile
 +++ b/malloc/Makefile
-@@ -307,8 +307,9 @@ $(objpfx)mtrace: mtrace.pl
+@@ -306,8 +306,9 @@ $(objpfx)mtrace: mtrace.pl
  
  $(objpfx)memusage: memusage.sh
  	rm -f $@.new
@@ -105,20 +106,20 @@ index 2329cf718a..5d7de4bee7 100644
  	&& rm -f $@ && mv $@.new $@ && chmod +x $@
  
 diff --git a/malloc/memusage.sh b/malloc/memusage.sh
-index f447160b7d..faa4936639 100755
+index b1f5848b74..329e36ef8a 100755
 --- a/malloc/memusage.sh
 +++ b/malloc/memusage.sh
 @@ -1,4 +1,4 @@
 -#!/bin/bash
 +#! @BASH@
- # Copyright (C) 1999-2022 Free Software Foundation, Inc.
+ # Copyright (C) 1999-2023 Free Software Foundation, Inc.
  # This file is part of the GNU C Library.
  
 diff --git a/timezone/Makefile b/timezone/Makefile
-index a789c22d26..d65bdf2391 100644
+index 0306c0bca9..de9bbcc815 100644
 --- a/timezone/Makefile
 +++ b/timezone/Makefile
-@@ -130,7 +130,8 @@ $(testdata)/XT5: testdata/gen-XT5.sh
+@@ -132,7 +132,8 @@ $(testdata)/XT5: testdata/gen-XT5.sh
  	mv $@.tmp $@
  
  $(objpfx)tzselect: tzselect.ksh $(common-objpfx)config.make
@@ -129,5 +130,5 @@ index a789c22d26..d65bdf2391 100644
  	    -e '/PKGVERSION=/s|=.*|="$(PKGVERSION)"|' \
  	    -e '/REPORT_BUGS_TO=/s|=.*|="$(REPORT_BUGS_TO)"|' \
 -- 
-2.37.0
+2.38.4
 
diff --git a/pkgs/development/libraries/glibc/2.35-master.patch.gz b/pkgs/development/libraries/glibc/2.35-master.patch.gz
deleted file mode 100644
index 7b8423c5b61b8..0000000000000
Binary files a/pkgs/development/libraries/glibc/2.35-master.patch.gz and /dev/null differ
diff --git a/pkgs/development/libraries/glibc/2.37-master.patch.gz b/pkgs/development/libraries/glibc/2.37-master.patch.gz
new file mode 100644
index 0000000000000..04b4e264751ed
Binary files /dev/null and b/pkgs/development/libraries/glibc/2.37-master.patch.gz differ
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index a3c2e4618493d..00b78f57db617 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -43,9 +43,9 @@
 } @ args:
 
 let
-  version = "2.35";
-  patchSuffix = "-224";
-  sha256 = "sha256-USNzL2tnzNMZMF79OZlx1YWSEivMKmUYob0lEN0M9S4=";
+  version = "2.37";
+  patchSuffix = "-8";
+  sha256 = "sha256-Ilfv8RGhgV109GhW2q9AsBnB5VMVbGnUi6DL/Bu5GkM=";
 in
 
 assert withLinuxHeaders -> linuxHeaders != null;
@@ -59,14 +59,14 @@ stdenv.mkDerivation ({
   patches =
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
-          $ git fetch --all -p && git checkout origin/release/2.35/master && git describe
-          glibc-2.35-210-ge123f08ad5
-          $ git show --minimal --reverse glibc-2.35.. | gzip -9n --rsyncable - > 2.35-master.patch.gz
+          $ git fetch --all -p && git checkout origin/release/2.36/master && git describe
+          glibc-2.37-8-g590d0e089b
+          $ git show --minimal --reverse glibc-2.37.. | gzip -9n --rsyncable - > 2.37-master.patch.gz
 
          To compare the archive contents zdiff can be used.
-          $ zdiff -u 2.35-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.35-master.patch.gz
+          $ zdiff -u 2.37-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.37-master.patch.gz
        */
-      ./2.35-master.patch.gz
+      ./2.37-master.patch.gz
 
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
@@ -88,6 +88,13 @@ stdenv.mkDerivation ({
       ./nix-nss-open-files.patch
 
       ./0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch
+
+      /* Patch derived from archlinux (at the time of adding they're at 2.37),
+         https://github.com/archlinux/svntogit-packages/blob/packages/glibc/trunk/reenable_DT_HASH.patch
+
+        See https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991 for context.
+      */
+      ./reenable_DT_HASH.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
     ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index e1a427e35b658..8ad9c90ff7ac7 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -66,33 +66,26 @@ in
         ]);
     };
 
-    # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
-    # any program we run, because the gcc will have been placed at a new
-    # store path than that determined when built (as a source for the
-    # bootstrap-tools tarball)
-    # Building from a proper gcc staying in the path where it was installed,
-    # libgcc_s will now be at {gcc}/lib, and gcc's libgcc will be found without
-    # any special hack.
-    # TODO: remove this hack. Things that rely on this hack today:
-    # - dejagnu: during linux bootstrap tcl SIGSEGVs
-    # - clang-wrapper in cross-compilation
-    # Last attempt: https://github.com/NixOS/nixpkgs/pull/36948
-    preInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
-      if [ -f ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
-          mkdir -p $out/lib
-          cp ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
-          # the .so It used to be a symlink, but now it is a script
-          cp -a ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so $out/lib/libgcc_s.so
-          # wipe out reference to previous libc it was built against
-          chmod +w $out/lib/libgcc_s.so.1
-          # rely on default RUNPATHs of the binary and other libraries
-          # Do no force-pull wrong glibc.
-          patchelf --remove-rpath $out/lib/libgcc_s.so.1
-          # 'patchelf' does not remove the string itself. Wipe out
-          # string reference to avoid possible link to bootstrapTools
-          ${buildPackages.nukeReferences}/bin/nuke-refs $out/lib/libgcc_s.so.1
-      fi
-    '';
+    # glibc needs to `dlopen()` `libgcc_s.so` but does not link
+    # against it.  Furthermore, glibc doesn't use the ordinary
+    # `dlopen()` call to do this; instead it uses one which ignores
+    # most paths:
+    #
+    #   https://sourceware.org/legacy-ml/libc-help/2013-11/msg00026.html
+    #
+    # In order to get it to not ignore `libgcc_s.so`, we have to add its path to
+    # `user-defined-trusted-dirs`:
+    #
+    #   https://sourceware.org/git/?p=glibc.git;a=blob;f=elf/Makefile;h=b509b3eada1fb77bf81e2a0ca5740b94ad185764#l1355
+    #
+    # Conveniently, this will also inform Nix of the fact that glibc depends on
+    # gcc.libgcc, since the path will be embedded in the resulting binary.
+    #
+    makeFlags =
+      (previousAttrs.makeFlags or [])
+      ++ lib.optionals (stdenv.cc.cc?libgcc) [
+        "user-defined-trusted-dirs=${stdenv.cc.cc.libgcc}/lib"
+      ];
 
     postInstall = (if stdenv.hostPlatform == stdenv.buildPlatform then ''
       echo SUPPORTED-LOCALES=C.UTF-8/UTF-8 > ../glibc-2*/localedata/SUPPORTED
@@ -164,6 +157,12 @@ in
 
     separateDebugInfo = true;
 
+    passthru =
+      (previousAttrs.passthru or {})
+      // lib.optionalAttrs (stdenv.cc.cc?libgcc) {
+        inherit (stdenv.cc.cc) libgcc;
+      };
+
   meta = (previousAttrs.meta or {}) // { description = "The GNU C Library"; };
 })
 
diff --git a/pkgs/development/libraries/glibc/reenable_DT_HASH.patch b/pkgs/development/libraries/glibc/reenable_DT_HASH.patch
new file mode 100644
index 0000000000000..f828b011bd9fe
--- /dev/null
+++ b/pkgs/development/libraries/glibc/reenable_DT_HASH.patch
@@ -0,0 +1,145 @@
+From e47de5cb2d4dbecb58f569ed241e8e95c568f03c Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 29 Apr 2022 16:37:51 +0200
+Subject: [PATCH] Do not use --hash-style=both for building glibc shared
+ objects
+
+The comment indicates that --hash-style=both was used to maintain
+compatibility with static dlopen, but we had many internal ABI
+changes since then, so this compatiblity does not add value anymore.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+---
+ Makeconfig     |  9 +++++++++
+ Makerules      |  7 +++++++
+ config.make.in |  1 +
+ configure      | 28 ++++++++++++++++++++++++++++
+ configure.ac   | 16 ++++++++++++++++
+ 5 files changed, 61 insertions(+)
+
+diff --git b/Makeconfig a/Makeconfig
+index 760f14e92f..0aa5fb0099 100644
+--- b/Makeconfig
++++ a/Makeconfig
+@@ -362,6 +362,15 @@ relro-LDFLAGS = -Wl,-z,relro
+ LDFLAGS.so += $(relro-LDFLAGS)
+ LDFLAGS-rtld += $(relro-LDFLAGS)
+ 
++ifeq (yes,$(have-hash-style))
++# For the time being we unconditionally use 'both'.  At some time we
++# should declare statically linked code as 'out of luck' and compile
++# with --hash-style=gnu only.
++hashstyle-LDFLAGS = -Wl,--hash-style=both
++LDFLAGS.so += $(hashstyle-LDFLAGS)
++LDFLAGS-rtld += $(hashstyle-LDFLAGS)
++endif
++
+ ifeq (no,$(build-pie-default))
+ pie-default = $(no-pie-ccflag)
+ else # build-pie-default
+diff --git b/Makerules a/Makerules
+index 354528b8c7..428464f092 100644
+--- b/Makerules
++++ a/Makerules
+@@ -557,6 +557,13 @@ $(common-objpfx)shlib.lds: $(common-objpfx)config.make $(..)Makerules
+ 		  -Wl,--verbose 2>/dev/null | \
+ 	  sed > $@T \
+ 	      -e '/^=========/,/^=========/!d;/^=========/d' \
++	      $(if $(filter yes,$(have-hash-style)), \
++		   -e 's/^.*\.gnu\.hash[ 	]*:.*$$/  .note.ABI-tag : { *(.note.ABI-tag) } &/' \
++		   -e '/^[ 	]*\.hash[ 	]*:.*$$/{h;d;}' \
++		   -e '/DATA_SEGMENT_ALIGN/{H;g}' \
++		, \
++		   -e 's/^.*\.hash[ 	]*:.*$$/  .note.ABI-tag : { *(.note.ABI-tag) } &/' \
++	       ) \
+ 	      -e 's/^.*\*(\.dynbss).*$$/& \
+ 		 PROVIDE(__start___libc_freeres_ptrs = .); \
+ 		 *(__libc_freeres_ptrs) \
+diff --git b/config.make.in a/config.make.in
+index fff4c78dd0..bf728c71c0 100644
+--- b/config.make.in
++++ a/config.make.in
+@@ -70,6 +70,7 @@ have-libcap = @have_libcap@
+ have-cc-with-libunwind = @libc_cv_cc_with_libunwind@
+ fno-unit-at-a-time = @fno_unit_at_a_time@
+ bind-now = @bindnow@
++have-hash-style = @libc_cv_hashstyle@
+ use-default-link = @use_default_link@
+ have-cxx-thread_local = @libc_cv_cxx_thread_local@
+ have-loop-to-function = @libc_cv_cc_loop_to_function@
+diff --git b/configure a/configure
+index 716dc041b6..5a730dc5fc 100755
+--- b/configure
++++ a/configure
+@@ -622,6 +622,7 @@ libc_cv_cc_nofma
+ libc_cv_mtls_dialect_gnu2
+ fno_unit_at_a_time
+ libc_cv_has_glob_dat
++libc_cv_hashstyle
+ libc_cv_fpie
+ libc_cv_z_execstack
+ ASFLAGS_config
+@@ -6193,6 +6194,33 @@ $as_echo "$libc_cv_fpie" >&6; }
+ 
+ 
+ 
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for --hash-style option" >&5
++$as_echo_n "checking for --hash-style option... " >&6; }
++if ${libc_cv_hashstyle+:} false; then :
++  $as_echo_n "(cached) " >&6
++else
++  cat > conftest.c <<EOF
++int _start (void) { return 42; }
++EOF
++if { ac_try='${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
++			    -fPIC -shared -o conftest.so conftest.c
++			    -Wl,--hash-style=both -nostdlib 1>&5'
++  { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
++  (eval $ac_try) 2>&5
++  ac_status=$?
++  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++  test $ac_status = 0; }; }
++then
++  libc_cv_hashstyle=yes
++else
++  libc_cv_hashstyle=no
++fi
++rm -f conftest*
++fi
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $libc_cv_hashstyle" >&5
++$as_echo "$libc_cv_hashstyle" >&6; }
++
++
+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GLOB_DAT reloc" >&5
+ $as_echo_n "checking for GLOB_DAT reloc... " >&6; }
+ if ${libc_cv_has_glob_dat+:} false; then :
+diff --git b/configure.ac a/configure.ac
+index d08ad4d64e..a045f6608e 100644
+--- b/configure.ac
++++ a/configure.ac
+@@ -1360,6 +1360,22 @@ LIBC_TRY_CC_OPTION([-fpie], [libc_cv_fpie=yes], [libc_cv_fpie=no])
+ 
+ AC_SUBST(libc_cv_fpie)
+ 
++AC_CACHE_CHECK(for --hash-style option,
++	       libc_cv_hashstyle, [dnl
++cat > conftest.c <<EOF
++int _start (void) { return 42; }
++EOF
++if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
++			    -fPIC -shared -o conftest.so conftest.c
++			    -Wl,--hash-style=both -nostdlib 1>&AS_MESSAGE_LOG_FD])
++then
++  libc_cv_hashstyle=yes
++else
++  libc_cv_hashstyle=no
++fi
++rm -f conftest*])
++AC_SUBST(libc_cv_hashstyle)
++
+ AC_CACHE_CHECK(for GLOB_DAT reloc,
+ 	       libc_cv_has_glob_dat, [dnl
+ cat > conftest.c <<EOF
+-- 
+2.37.1
+
diff --git a/pkgs/development/libraries/glibmm/2.68.nix b/pkgs/development/libraries/glibmm/2.68.nix
index 531d487cb9334..ece609893f7e7 100644
--- a/pkgs/development/libraries/glibmm/2.68.nix
+++ b/pkgs/development/libraries/glibmm/2.68.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.74.0";
+  version = "2.76.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-K0cmlsuseduOQFckEY7JRSGcW5sYr2PcjPt/HYmw8fo=";
+    sha256 = "sha256-hjfYDOq9lP3dbkiXCggqJkVY1KuCaE4V/8h+fvNGKrI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index 9f4a16a0ce41a..8800070ab61fb 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.66.5";
+  version = "2.66.6";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ezhGYt1uw7hsBXAzHTKvBdsr2Zp5FgK3Z7SgslZuwUk=";
+    sha256 = "sha256-U1h0JZgYHlNR17+NoHK/k+bdXxeNJ2QNTkYryPFOFS8=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gnome-desktop/default.nix b/pkgs/development/libraries/gnome-desktop/default.nix
index 0cf7afd41e874..db95029c804e6 100644
--- a/pkgs/development/libraries/gnome-desktop/default.nix
+++ b/pkgs/development/libraries/gnome-desktop/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "43.2";
+  version = "44.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-oLmrINKKY99s5+keq7Xjr4ZjC/UitaiZfASXG9VR1zA=";
+    sha256 = "sha256-QsdzdF2EuhS8HPHExvRgYUiAOlzTN5QcY5ZHlfPFnUI=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/libraries/gnome-online-accounts/default.nix b/pkgs/development/libraries/gnome-online-accounts/default.nix
index 2028e3eaef632..6cdc54acd290b 100644
--- a/pkgs/development/libraries/gnome-online-accounts/default.nix
+++ b/pkgs/development/libraries/gnome-online-accounts/default.nix
@@ -32,17 +32,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-online-accounts";
-  version = "3.46.0";
+  version = "3.48.0";
 
   outputs = [ "out" "dev" ] ++ lib.optionals enableBackend [ "man" "devdoc" ];
 
-  # https://gitlab.gnome.org/GNOME/gnome-online-accounts/issues/87
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gnome-online-accounts";
     rev = version;
-    sha256 = "sha256-qVd55fmhY05zJ871OWc3hd1eWjYbYJuxlE/T2i3VCUA=";
+    sha256 = "sha256-USl0Qay9pSgbbp3n/L8eBaRQwaBYledht5j+afmo++o=";
   };
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index 0b7650199923e..be804859deb5e 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -1,20 +1,20 @@
 { lib, stdenv, fetchurl }:
 
 let
-  rev = "6faca61810d335c7837f320733fe8e15a1431fc2";
+  rev = "63acb96f92473ceb5e21d873d7c0aee266b3d6d3";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "06wkkhpbx9slmknr2g7mcd8x3zsdhnmmay25l31h3rkdp1wkq7kx";
+    sha256 = "049qgfh4xjd4fxd7ygm1phd5faqphfvhfcv8dsdldprsp86lf55v";
   };
   configSub = fetchurl {
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "1qkph8cqanmgy3s4a18bm1a4vk62i8pf8cy5pc1hkpqwn4g6l0di";
+    sha256 = "1rk30y27mzls49wyfdb5jhzjr08hkxl7xqhnxmhcmkvqlmpsjnxl";
   };
 in stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2021-01-25";
+  version = "2023-01-21";
 
   buildCommand = ''
     mkdir -p $out
@@ -34,7 +34,7 @@ in stdenv.mkDerivation {
     #   configuration script generated by Autoconf, you may include it under
     #   the same distribution terms that you use for the rest of that
     #   program.
-    maintainers = [ maintainers.dezgeg ];
+    maintainers = with maintainers; [ dezgeg emilytrau ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 02d2dbb6a5326..ea22633704529 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -36,7 +36,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gobject-introspection";
-  version = "1.74.0";
+  version = "1.76.1";
 
   # outputs TODO: share/gobject-introspection-1.0/tests is needed during build
   # by pygobject3 (and maybe others), but it's only searched in $out
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gobject-introspection/${lib.versions.majorMinor finalAttrs.version}/gobject-introspection-${finalAttrs.version}.tar.xz";
-    sha256 = "NHs6cZ5oukxp/y1X7iaJIz6owH/EkiBeVzOGd55C1lM=";
+    sha256 = "GWF4v2Q0VQHc3E2EabNqpv6ASJNU7+cct8uKuCo3OL8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index d5882c861682b..2079123ed1a34 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -27,36 +27,19 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-Nh1OrkfOkl26DqVpr0DntSxkXEri5l5WIb8bbN2LDp4=";
+    hash = "sha256-y1hJTcQV+6nusSuCZVCtMZDckuJlxbsq4aIckoQc/Tg=";
   };
 
   patches = [
-    # Fix compilation on i686, would not be needed after 1.18.1 releases, https://dev.gnupg.org/T5522
-    ./t-addexistingsubkey-i686.patch
-    # https://dev.gnupg.org/rMc4cf527ea227edb468a84bf9b8ce996807bd6992
-    ./fix_gpg_list_keys.diff
-    # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
-    (fetchpatch {
-      name = "0001-Fix-python-tests-on-non-Linux.patch";
-      url = "https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20200415/f7be62d1/attachment.obj";
-      sha256 = "00d4sxq63601lzdp2ha1i8fvybh7dzih4531jh8bx07fab3sw65g";
-    })
     # Support Python 3.10 version detection without distutils, https://dev.gnupg.org/D545
     ./python-310-detection-without-distutils.patch
-    # Find correct version string for Python >= 3.10, https://dev.gnupg.org/D546
-    ./python-find-version-string-above-310.patch
     # Fix a test after disallowing compressed signatures in gpg (PR #180336)
     ./test_t-verify_double-plaintext.patch
-
-    # Disable python tests on Darwin as they use gpg (see configureFlags below)
-  ] ++ lib.optional stdenv.isDarwin ./disable-python-tests.patch
-  # Fix _AC_UNDECLARED_WARNING for autoconf>=2.70
-  # See https://lists.gnupg.org/pipermail/gnupg-devel/2020-November/034643.html
-  ++ lib.optional stdenv.cc.isClang ./fix-clang-autoconf-undeclared-warning.patch;
+  ];
 
   outputs = [ "out" "dev" "info" ];
 
diff --git a/pkgs/development/libraries/gpgme/disable-python-tests.patch b/pkgs/development/libraries/gpgme/disable-python-tests.patch
deleted file mode 100644
index 285af14fcc3ec..0000000000000
--- a/pkgs/development/libraries/gpgme/disable-python-tests.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur --strip-trailing-cr gpgme-1.13.1.org/lang/python/Makefile.am gpgme-1.13.1/lang/python/Makefile.am
---- gpgme-1.13.1.org/lang/python/Makefile.am	2019-06-04 07:27:49.000000000 +0100
-+++ gpgme-1.13.1/lang/python/Makefile.am	2020-04-15 14:27:34.810172944 +0100
-@@ -23,7 +23,7 @@
- 	gpgme.i \
- 	helpers.c helpers.h private.h
- 
--SUBDIRS = . tests examples doc src
-+SUBDIRS = . examples doc src
- 
- .PHONY: prepare
- prepare: copystamp
diff --git a/pkgs/development/libraries/gpgme/fix-clang-autoconf-undeclared-warning.patch b/pkgs/development/libraries/gpgme/fix-clang-autoconf-undeclared-warning.patch
deleted file mode 100644
index 2d08f982ce6f6..0000000000000
--- a/pkgs/development/libraries/gpgme/fix-clang-autoconf-undeclared-warning.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-diff -Naur gpgme.old/configure.ac gpgme.new/configure.ac
---- gpgme.old/configure.ac	2020-11-12 04:19:50.000000000 -0500
-+++ gpgme.new/configure.ac	2021-01-08 03:04:38.000000000 -0500
-@@ -166,6 +166,16 @@
-                           mym4_minor mym4_micro)
- AC_SUBST(VERSION_NUMBER)
- 
-+# Try to find a thread-safe version of ttyname().
-+gnupg_REPLACE_TTYNAME_R
-+if test "$ac_cv_func_ttyname_r" != yes; then
-+  AC_MSG_WARN([
-+***
-+*** ttyname() is not thread-safe and ttyname_r() does not exist
-+***])
-+fi
-+
-+
- # We need to compile and run a program on the build machine.  A
- # comment in libgpg-error says that the AC_PROG_CC_FOR_BUILD macro in
- # the AC archive is broken for autoconf 2.57.  Given that there is no
-@@ -658,15 +668,6 @@
- 
- AC_FUNC_FSEEKO
- 
--# Try to find a thread-safe version of ttyname().
--gnupg_REPLACE_TTYNAME_R
--if test "$ac_cv_func_ttyname_r" != yes; then
--  AC_MSG_WARN([
--***
--*** ttyname() is not thread-safe and ttyname_r() does not exist
--***])
--fi
--
- # Try to find a thread-safe version of getenv().
- have_thread_safe_getenv=no
- jm_GLIBC21
diff --git a/pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff b/pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff
deleted file mode 100644
index bd8da4edd6e0c..0000000000000
--- a/pkgs/development/libraries/gpgme/fix_gpg_list_keys.diff
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/src/engine-gpg.c b/src/engine-gpg.c
-index b51ea173..4e74665e 100644
---- a/src/engine-gpg.c
-+++ b/src/engine-gpg.c
-@@ -3005,6 +3005,7 @@ gpg_keylist_build_options (engine_gpg_t gpg, int secret_only,
-   gpg_error_t err;
- 
-   err = add_arg (gpg, "--with-colons");
-+  err = add_arg (gpg, "--with-keygrip");
- 
-   /* Since gpg 2.1.15 fingerprints are always printed, thus there is
-    * no more need to explicitly request them.  */
\ No newline at end of file
diff --git a/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch b/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch
deleted file mode 100644
index ef2f563e459ce..0000000000000
--- a/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch
+++ /dev/null
@@ -1,373 +0,0 @@
-diff --git a/configure.ac b/configure.ac
---- a/configure.ac
-+++ b/configure.ac
-@@ -425,11 +425,12 @@
- 	if test "$found_py" = "1" -o "$found_py3" = "1"; then
- 	  # Reset everything, so that we can look for another Python.
-           m4_foreach([mym4pythonver],
--                     [[2.7],[3.4],[3.5],[3.6],[3.7],[3.8],[3.9],[all]],
-+                     [[2.7],[3.4],[3.5],[3.6],[3.7],[3.8],[3.9],[3.10],[3.11],[all]],
-            [unset PYTHON
- 	    unset PYTHON_VERSION
- 	    unset PYTHON_CPPFLAGS
- 	    unset PYTHON_LDFLAGS
-+	    unset PYTHON_LIBS
- 	    unset PYTHON_SITE_PKG
- 	    unset PYTHON_EXTRA_LIBS
- 	    unset PYTHON_EXTRA_LDFLAGS
-diff --git a/m4/python.m4 b/m4/python.m4
---- a/m4/python.m4
-+++ b/m4/python.m4
-@@ -1,10 +1,10 @@
- ## ------------------------                                 -*- Autoconf -*-
- ## Python file handling
- ## From Andrew Dalke
--## Updated by James Henstridge
-+## Updated by James Henstridge and other contributors.
- ## Updated by Werner Koch 2018-10-17
--## ---------------------------------
--# Copyright (C) 1999-2017 Free Software Foundation, Inc.
-+## ------------------------
-+# Copyright (C) 1999-2021 Free Software Foundation, Inc.
- #
- # This file is free software; the Free Software Foundation
- # gives unlimited permission to copy and/or distribute it,
-@@ -36,13 +36,12 @@
- # numbers and dots only.
- AC_DEFUN([AM_PATH_PYTHON],
-  [
--  dnl Find a Python interpreter.  Python versions prior to 2.0 are not
--  dnl supported. (2.0 was released on October 16, 2000).  Python 3.0
--  dnl through to Python 3.9 are also not supported.
-+  dnl Find a Python interpreter.  Python versions prior to 2.7 are not
-+  dnl supported. Python 3.0 through to Python 3.3 are also not supported.
-   m4_define_default([_AM_PYTHON_INTERPRETER_LIST],
- [python2 python2.7 dnl
-  python dnl
-- python3 python3.9 python3.8 python3.7 python3.6 python3.5 python3.4
-+ python3 python3.10 python3.11, python3.9 python3.8 python3.7 python3.6 python3.5 python3.4
-  ])
- 
-   AC_ARG_VAR([PYTHON], [the Python interpreter])
-@@ -85,34 +84,141 @@
-   ])
- 
-   if test "$PYTHON" = :; then
--  dnl Run any user-specified action, or abort.
-+    dnl Run any user-specified action, or abort.
-     m4_default([$3], [AC_MSG_ERROR([no suitable Python interpreter found])])
-   else
- 
--  dnl Query Python for its version number.  Getting [:3] seems to be
--  dnl the best way to do this; it's what "site.py" does in the standard
--  dnl library.
--
-+  dnl Query Python for its version number.  Although site.py simply uses
-+  dnl sys.version[:3], printing that failed with Python 3.10, since the
-+  dnl trailing zero was eliminated. So now we output just the major
-+  dnl and minor version numbers, as numbers. Apparently the tertiary
-+  dnl version is not of interest.
-+  dnl
-   AC_CACHE_CHECK([for $am_display_PYTHON version], [am_cv_python_version],
--    [am_cv_python_version=`$PYTHON -c "import sys; sys.stdout.write(sys.version[[:3]])"`])
-+    [am_cv_python_version=`$PYTHON -c "import sys; print ('%u.%u' % sys.version_info[[:2]])"`])
-   AC_SUBST([PYTHON_VERSION], [$am_cv_python_version])
- 
--  dnl Use the values of $prefix and $exec_prefix for the corresponding
--  dnl values of PYTHON_PREFIX and PYTHON_EXEC_PREFIX.  These are made
--  dnl distinct variables so they can be overridden if need be.  However,
--  dnl general consensus is that you shouldn't need this ability.
--
--  AC_SUBST([PYTHON_PREFIX], ['${prefix}'])
--  AC_SUBST([PYTHON_EXEC_PREFIX], ['${exec_prefix}'])
--
--  dnl At times (like when building shared libraries) you may want
-+  dnl At times, e.g., when building shared libraries, you may want
-   dnl to know which OS platform Python thinks this is.
--
-+  dnl
-   AC_CACHE_CHECK([for $am_display_PYTHON platform], [am_cv_python_platform],
-     [am_cv_python_platform=`$PYTHON -c "import sys; sys.stdout.write(sys.platform)"`])
-   AC_SUBST([PYTHON_PLATFORM], [$am_cv_python_platform])
- 
--  # Just factor out some code duplication.
-+  dnl emacs-page
-+  dnl If --with-python-sys-prefix is given, use the values of sys.prefix
-+  dnl and sys.exec_prefix for the corresponding values of PYTHON_PREFIX
-+  dnl and PYTHON_EXEC_PREFIX. Otherwise, use the GNU ${prefix} and
-+  dnl ${exec_prefix} variables.
-+  dnl
-+  dnl The two are made distinct variables so they can be overridden if
-+  dnl need be, although general consensus is that you shouldn't need
-+  dnl this separation.
-+  dnl
-+  dnl Also allow directly setting the prefixes via configure options,
-+  dnl overriding any default.
-+  dnl
-+  if test "x$prefix" = xNONE; then
-+    am__usable_prefix=$ac_default_prefix
-+  else
-+    am__usable_prefix=$prefix
-+  fi
-+
-+  # Allow user to request using sys.* values from Python,
-+  # instead of the GNU $prefix values.
-+  AC_ARG_WITH([python-sys-prefix],
-+  [AS_HELP_STRING([--with-python-sys-prefix],
-+                  [use Python's sys.prefix and sys.exec_prefix values])],
-+  [am_use_python_sys=:],
-+  [am_use_python_sys=false])
-+
-+  # Allow user to override whatever the default Python prefix is.
-+  AC_ARG_WITH([python_prefix],
-+  [AS_HELP_STRING([--with-python_prefix],
-+                  [override the default PYTHON_PREFIX])],
-+  [am_python_prefix_subst=$withval
-+   am_cv_python_prefix=$withval
-+   AC_MSG_CHECKING([for explicit $am_display_PYTHON prefix])
-+   AC_MSG_RESULT([$am_cv_python_prefix])],
-+  [
-+   if $am_use_python_sys; then
-+     # using python sys.prefix value, not GNU
-+     AC_CACHE_CHECK([for python default $am_display_PYTHON prefix],
-+     [am_cv_python_prefix],
-+     [am_cv_python_prefix=`$PYTHON -c "import sys; sys.stdout.write(sys.prefix)"`])
-+
-+     dnl If sys.prefix is a subdir of $prefix, replace the literal value of
-+     dnl $prefix with a variable reference so it can be overridden.
-+     case $am_cv_python_prefix in
-+     $am__usable_prefix*)
-+       am__strip_prefix=`echo "$am__usable_prefix" | sed 's|.|.|g'`
-+       am_python_prefix_subst=`echo "$am_cv_python_prefix" | sed "s,^$am__strip_prefix,\\${prefix},"`
-+       ;;
-+     *)
-+       am_python_prefix_subst=$am_cv_python_prefix
-+       ;;
-+     esac
-+   else # using GNU prefix value, not python sys.prefix
-+     am_python_prefix_subst='${prefix}'
-+     am_python_prefix=$am_python_prefix_subst
-+     AC_MSG_CHECKING([for GNU default $am_display_PYTHON prefix])
-+     AC_MSG_RESULT([$am_python_prefix])
-+   fi])
-+  # Substituting python_prefix_subst value.
-+  AC_SUBST([PYTHON_PREFIX], [$am_python_prefix_subst])
-+
-+  # emacs-page Now do it all over again for Python exec_prefix, but with yet
-+  # another conditional: fall back to regular prefix if that was specified.
-+  AC_ARG_WITH([python_exec_prefix],
-+  [AS_HELP_STRING([--with-python_exec_prefix],
-+                  [override the default PYTHON_EXEC_PREFIX])],
-+  [am_python_exec_prefix_subst=$withval
-+   am_cv_python_exec_prefix=$withval
-+   AC_MSG_CHECKING([for explicit $am_display_PYTHON exec_prefix])
-+   AC_MSG_RESULT([$am_cv_python_exec_prefix])],
-+  [
-+   # no explicit --with-python_exec_prefix, but if
-+   # --with-python_prefix was given, use its value for python_exec_prefix too.
-+   AS_IF([test -n "$with_python_prefix"],
-+   [am_python_exec_prefix_subst=$with_python_prefix
-+    am_cv_python_exec_prefix=$with_python_prefix
-+    AC_MSG_CHECKING([for python_prefix-given $am_display_PYTHON exec_prefix])
-+    AC_MSG_RESULT([$am_cv_python_exec_prefix])],
-+   [
-+    # Set am__usable_exec_prefix whether using GNU or Python values,
-+    # since we use that variable for pyexecdir.
-+    if test "x$exec_prefix" = xNONE; then
-+      am__usable_exec_prefix=$am__usable_prefix
-+    else
-+      am__usable_exec_prefix=$exec_prefix
-+    fi
-+    #
-+    if $am_use_python_sys; then # using python sys.exec_prefix, not GNU
-+      AC_CACHE_CHECK([for python default $am_display_PYTHON exec_prefix],
-+      [am_cv_python_exec_prefix],
-+      [am_cv_python_exec_prefix=`$PYTHON -c "import sys; sys.stdout.write(sys.exec_prefix)"`])
-+      dnl If sys.exec_prefix is a subdir of $exec_prefix, replace the
-+      dnl literal value of $exec_prefix with a variable reference so it can
-+      dnl be overridden.
-+      case $am_cv_python_exec_prefix in
-+      $am__usable_exec_prefix*)
-+        am__strip_prefix=`echo "$am__usable_exec_prefix" | sed 's|.|.|g'`
-+        am_python_exec_prefix_subst=`echo "$am_cv_python_exec_prefix" | sed "s,^$am__strip_prefix,\\${exec_prefix},"`
-+        ;;
-+      *)
-+        am_python_exec_prefix_subst=$am_cv_python_exec_prefix
-+        ;;
-+     esac
-+   else # using GNU $exec_prefix, not python sys.exec_prefix
-+     am_python_exec_prefix_subst='${exec_prefix}'
-+     am_python_exec_prefix=$am_python_exec_prefix_subst
-+     AC_MSG_CHECKING([for GNU default $am_display_PYTHON exec_prefix])
-+     AC_MSG_RESULT([$am_python_exec_prefix])
-+   fi])])
-+  # Substituting python_exec_prefix_subst.
-+  AC_SUBST([PYTHON_EXEC_PREFIX], [$am_python_exec_prefix_subst])
-+
-+  # Factor out some code duplication into this shell variable.
-   am_python_setup_sysconfig="\
- import sys
- # Prefer sysconfig over distutils.sysconfig, for better compatibility
-@@ -132,96 +238,95 @@
- except ImportError:
-     pass"
- 
--  dnl Set up 4 directories:
-+  dnl emacs-page Set up 4 directories:
- 
--  dnl pythondir -- where to install python scripts.  This is the
--  dnl   site-packages directory, not the python standard library
--  dnl   directory like in previous automake betas.  This behavior
--  dnl   is more consistent with lispdir.m4 for example.
-+  dnl 1. pythondir: where to install python scripts.  This is the
-+  dnl    site-packages directory, not the python standard library
-+  dnl    directory like in previous automake betas.  This behavior
-+  dnl    is more consistent with lispdir.m4 for example.
-   dnl Query distutils for this directory.
--  AC_CACHE_CHECK([for $am_display_PYTHON script directory],
--    [am_cv_python_pythondir],
--    [if test "x$prefix" = xNONE
--     then
--       am_py_prefix=$ac_default_prefix
--     else
--       am_py_prefix=$prefix
--     fi
--     am_cv_python_pythondir=`$PYTHON -c "
-+  dnl
-+  AC_CACHE_CHECK([for $am_display_PYTHON script directory (pythondir)],
-+  [am_cv_python_pythondir],
-+  [if test "x$am_cv_python_prefix" = x; then
-+     am_py_prefix=$am__usable_prefix
-+   else
-+     am_py_prefix=$am_cv_python_prefix
-+   fi
-+   am_cv_python_pythondir=`$PYTHON -c "
- $am_python_setup_sysconfig
- if can_use_sysconfig:
--    sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'})
-+  sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'})
- else:
--    from distutils import sysconfig
--    sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix')
-+  from distutils import sysconfig
-+  sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix')
- sys.stdout.write(sitedir)"`
--     case $am_cv_python_pythondir in
--     $am_py_prefix*)
--       am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'`
--       am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,$PYTHON_PREFIX,"`
--       ;;
--     *)
--       case $am_py_prefix in
--         /usr|/System*) ;;
--         *)
--	  am_cv_python_pythondir=$PYTHON_PREFIX/lib/python$PYTHON_VERSION/site-packages
--	  ;;
--       esac
--       ;;
-+   #
-+   case $am_cv_python_pythondir in
-+   $am_py_prefix*)
-+     am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'`
-+     am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,\\${PYTHON_PREFIX},"`
-+     ;;
-+   *)
-+     case $am_py_prefix in
-+       /usr|/System*) ;;
-+       *) am_cv_python_pythondir="\${PYTHON_PREFIX}/lib/python$PYTHON_VERSION/site-packages"
-+          ;;
-      esac
--    ])
-+     ;;
-+   esac
-+  ])
-   AC_SUBST([pythondir], [$am_cv_python_pythondir])
- 
--  dnl pkgpythondir -- $PACKAGE directory under pythondir.  Was
--  dnl   PYTHON_SITE_PACKAGE in previous betas, but this naming is
--  dnl   more consistent with the rest of automake.
--
-+  dnl 2. pkgpythondir: $PACKAGE directory under pythondir.  Was
-+  dnl    PYTHON_SITE_PACKAGE in previous betas, but this naming is
-+  dnl    more consistent with the rest of automake.
-+  dnl
-   AC_SUBST([pkgpythondir], [\${pythondir}/$PACKAGE])
- 
--  dnl pyexecdir -- directory for installing python extension modules
--  dnl   (shared libraries)
-+  dnl 3. pyexecdir: directory for installing python extension modules
-+  dnl    (shared libraries).
-   dnl Query distutils for this directory.
--  AC_CACHE_CHECK([for $am_display_PYTHON extension module directory],
--    [am_cv_python_pyexecdir],
--    [if test "x$exec_prefix" = xNONE
--     then
--       am_py_exec_prefix=$am_py_prefix
--     else
--       am_py_exec_prefix=$exec_prefix
--     fi
--     am_cv_python_pyexecdir=`$PYTHON -c "
-+  dnl
-+  AC_CACHE_CHECK([for $am_display_PYTHON extension module directory (pyexecdir)],
-+  [am_cv_python_pyexecdir],
-+  [if test "x$am_cv_python_exec_prefix" = x; then
-+     am_py_exec_prefix=$am__usable_exec_prefix
-+   else
-+     am_py_exec_prefix=$am_cv_python_exec_prefix
-+   fi
-+   am_cv_python_pyexecdir=`$PYTHON -c "
- $am_python_setup_sysconfig
- if can_use_sysconfig:
--    sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_prefix'})
-+  sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_exec_prefix'})
- else:
--    from distutils import sysconfig
--    sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_prefix')
-+  from distutils import sysconfig
-+  sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_exec_prefix')
- sys.stdout.write(sitedir)"`
--     case $am_cv_python_pyexecdir in
--     $am_py_exec_prefix*)
--       am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'`
--       am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,$PYTHON_EXEC_PREFIX,"`
--       ;;
--     *)
--       case $am_py_exec_prefix in
--         /usr|/System*) ;;
--         *)
--	   am_cv_python_pyexecdir=$PYTHON_EXEC_PREFIX/lib/python$PYTHON_VERSION/site-packages
--	   ;;
--       esac
--       ;;
-+   #
-+   case $am_cv_python_pyexecdir in
-+   $am_py_exec_prefix*)
-+     am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'`
-+     am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,\\${PYTHON_EXEC_PREFIX},"`
-+     ;;
-+   *)
-+     case $am_py_exec_prefix in
-+       /usr|/System*) ;;
-+       *) am_cv_python_pyexecdir="\${PYTHON_EXEC_PREFIX}/lib/python$PYTHON_VERSION/site-packages"
-+          ;;
-      esac
--    ])
-+     ;;
-+   esac
-+  ])
-   AC_SUBST([pyexecdir], [$am_cv_python_pyexecdir])
- 
--  dnl pkgpyexecdir -- $(pyexecdir)/$(PACKAGE)
--
-+  dnl 4. pkgpyexecdir: $(pyexecdir)/$(PACKAGE)
-+  dnl
-   AC_SUBST([pkgpyexecdir], [\${pyexecdir}/$PACKAGE])
- 
-   dnl Run any user-specified action.
-   $2
-   fi
--
- ])
- 
- 
-
diff --git a/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch b/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch
deleted file mode 100644
index 348bd8fa596a4..0000000000000
--- a/pkgs/development/libraries/gpgme/t-addexistingsubkey-i686.patch
+++ /dev/null
@@ -1,369 +0,0 @@
-From c977424a1d39751fc5055131ad3f7819d421dcc8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
-Date: Wed, 17 Aug 2022 14:51:19 +0200
-Subject: [PATCH 1/5] qt: Make sure expiration time is interpreted as unsigned
- number
-
-* lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp (add_subkey): Convert
-expiration time to uint_least32_t.
---
-
-This fixes the corresponding test on 32-bit systems where time_t (the
-return type of expirationTime()) is a signed 32-bit integer type.
-
-GnuPG-bug-id: 6137
----
- lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp b/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
-index 32e2c292..b74e7a06 100644
---- a/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
-+++ b/lang/qt/src/qgpgmeaddexistingsubkeyjob.cpp
-@@ -64,7 +64,8 @@ static QGpgMEAddExistingSubkeyJob::result_type add_subkey(Context *ctx, const Ke
-     std::unique_ptr<GpgAddExistingSubkeyEditInteractor> interactor{new GpgAddExistingSubkeyEditInteractor{subkey.keyGrip()}};
- 
-     if (!subkey.neverExpires()) {
--        const auto expiry = QDateTime::fromSecsSinceEpoch(subkey.expirationTime(), Qt::UTC).toString(u"yyyyMMdd'T'hhmmss").toStdString();
-+        const auto expiry = QDateTime::fromSecsSinceEpoch(uint_least32_t(subkey.expirationTime()),
-+                                                          Qt::UTC).toString(u"yyyyMMdd'T'hhmmss").toStdString();
-         interactor->setExpiry(expiry);
-     }
- 
--- 
-2.36.0.windows.1
-
-
-From 81d4b7f2d7077297d76af5728949d8f2bdff8cd5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
-Date: Wed, 17 Aug 2022 14:56:13 +0200
-Subject: [PATCH 2/5] qt,tests: Log the actual error code if the assertion
- fails
-
-* lang/qt/tests/t-addexistingsubkey.cpp (
-AddExistingSubkeyJobTest::testAddExistingSubkeyAsync,
-AddExistingSubkeyJobTest::testAddExistingSubkeySync,
-AddExistingSubkeyJobTest::testAddExistingSubkeyWithExpiration): Use
-QCOMPARE instead of QVERIFY for asserting equality.
---
-
-GnuPG-bug-id: 6137
----
- lang/qt/tests/t-addexistingsubkey.cpp | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
-index 589c90bf..2e654cec 100644
---- a/lang/qt/tests/t-addexistingsubkey.cpp
-+++ b/lang/qt/tests/t-addexistingsubkey.cpp
-@@ -168,7 +168,7 @@ private Q_SLOTS:
-         QSignalSpy spy (this, SIGNAL(asyncDone()));
-         QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
- 
--        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
-+        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
-         key.update();
-         QCOMPARE(key.numSubkeys(), 3u);
-     }
-@@ -190,7 +190,7 @@ private Q_SLOTS:
- 
-         const auto result = job->exec(key, sourceSubkey);
- 
--        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
-+        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
-         key.update();
-         QCOMPARE(key.numSubkeys(), 3u);
-         QCOMPARE(key.subkey(2).expirationTime(), 0);
-@@ -213,7 +213,7 @@ private Q_SLOTS:
- 
-         const auto result = job->exec(key, sourceSubkey);
- 
--        QVERIFY(result.code() == GPG_ERR_NO_ERROR);
-+        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
-         key.update();
-         QCOMPARE(key.numSubkeys(), 3u);
- 
--- 
-2.36.0.windows.1
-
-
-From f2b48de26b8f8c48c293423eda712831544924f6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
-Date: Wed, 17 Aug 2022 15:22:29 +0200
-Subject: [PATCH 3/5] qt,tests: Make sure expiration time is interpreted as
- unsigned number
-
-* lang/qt/tests/t-addexistingsubkey.cpp,
-lang/qt/tests/t-changeexpiryjob.cpp: Convert expiration time to
-uint_least32_t.
---
-
-This doesn't change the outcome of the tests (they also pass without
-this change because of the expiration dates of the test keys), but it's
-still good practise to treat the expiration time as an unsigned number
-if the assertions check that the expiration time is in some range.
-
-GnuPG-bug-id: 6137
----
- lang/qt/tests/t-addexistingsubkey.cpp |  6 +++---
- lang/qt/tests/t-changeexpiryjob.cpp   | 26 +++++++++++++-------------
- 2 files changed, 16 insertions(+), 16 deletions(-)
-
-diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
-index 2e654cec..87eadf43 100644
---- a/lang/qt/tests/t-addexistingsubkey.cpp
-+++ b/lang/qt/tests/t-addexistingsubkey.cpp
-@@ -222,9 +222,9 @@ private Q_SLOTS:
-         // several times
-         const auto allowedDeltaTSeconds = 1;
-         const auto expectedExpirationRange = std::make_pair(
--            sourceSubkey.expirationTime() - allowedDeltaTSeconds,
--            sourceSubkey.expirationTime() + allowedDeltaTSeconds);
--        const auto actualExpiration = key.subkey(2).expirationTime();
-+            uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
-+            uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
-+        const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
-         QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-                  ("actual: " + std::to_string(actualExpiration) +
-                   "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
-diff --git a/lang/qt/tests/t-changeexpiryjob.cpp b/lang/qt/tests/t-changeexpiryjob.cpp
-index 090002f3..3da74d46 100644
---- a/lang/qt/tests/t-changeexpiryjob.cpp
-+++ b/lang/qt/tests/t-changeexpiryjob.cpp
-@@ -70,7 +70,7 @@ private Q_SLOTS:
-         QVERIFY(!key.isNull());
-         QVERIFY(!key.subkey(0).isNull());
-         QVERIFY(!key.subkey(1).isNull());
--        const auto subkeyExpiration = key.subkey(1).expirationTime();
-+        const auto subkeyExpiration = uint_least32_t(key.subkey(1).expirationTime());
- 
-         {
-             // Create the job
-@@ -101,7 +101,7 @@ private Q_SLOTS:
-                 newExpirationDate.toSecsSinceEpoch() - 10,
-                 QDateTime::currentDateTime().addDays(1).toSecsSinceEpoch());
-             {
--                const auto actualExpiration = key.subkey(0).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
-                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-                         ("actual: " + std::to_string(actualExpiration) +
-                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
-@@ -110,7 +110,7 @@ private Q_SLOTS:
-                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
-             }
-             {
--                const auto actualExpiration = key.subkey(1).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
-                 QCOMPARE(actualExpiration, subkeyExpiration);  // unchanged
-             }
-         }
-@@ -133,7 +133,7 @@ private Q_SLOTS:
-         QVERIFY(!key.isNull());
-         QVERIFY(!key.subkey(0).isNull());
-         QVERIFY(!key.subkey(1).isNull());
--        const auto primaryKeyExpiration = key.subkey(0).expirationTime();
-+        const auto primaryKeyExpiration = uint_least32_t(key.subkey(0).expirationTime());
- 
-         {
-             // Create the job
-@@ -164,11 +164,11 @@ private Q_SLOTS:
-                 newExpirationDate.toSecsSinceEpoch() - 10,
-                 QDateTime::currentDateTime().addDays(2).toSecsSinceEpoch());
-             {
--                const auto actualExpiration = key.subkey(0).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
-                 QCOMPARE(actualExpiration, primaryKeyExpiration);  // unchanged
-             }
-             {
--                const auto actualExpiration = key.subkey(1).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
-                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-                         ("actual: " + std::to_string(actualExpiration) +
-                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
-@@ -196,7 +196,7 @@ private Q_SLOTS:
-         QVERIFY(!key.isNull());
-         QVERIFY(!key.subkey(0).isNull());
-         QVERIFY(!key.subkey(1).isNull());
--        const auto subkeyExpiration = key.subkey(1).expirationTime();
-+        const auto subkeyExpiration = uint_least32_t(key.subkey(1).expirationTime());
- 
-         {
-             // Create the job
-@@ -228,7 +228,7 @@ private Q_SLOTS:
-                 newExpirationDate.toSecsSinceEpoch() - 10,
-                 QDateTime::currentDateTime().addDays(3).toSecsSinceEpoch());
-             {
--                const auto actualExpiration = key.subkey(0).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
-                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-                         ("actual: " + std::to_string(actualExpiration) +
-                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
-@@ -237,7 +237,7 @@ private Q_SLOTS:
-                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
-             }
-             {
--                const auto actualExpiration = key.subkey(1).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
-                 QCOMPARE(actualExpiration, subkeyExpiration);  // unchanged
-             }
-         }
-@@ -291,7 +291,7 @@ private Q_SLOTS:
-                 newExpirationDate.toSecsSinceEpoch() - 10,
-                 QDateTime::currentDateTime().addDays(4).toSecsSinceEpoch());
-             {
--                const auto actualExpiration = key.subkey(0).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
-                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-                         ("actual: " + std::to_string(actualExpiration) +
-                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
-@@ -300,7 +300,7 @@ private Q_SLOTS:
-                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
-             }
-             {
--                const auto actualExpiration = key.subkey(1).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
-                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-                         ("actual: " + std::to_string(actualExpiration) +
-                           "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
-@@ -359,7 +359,7 @@ private Q_SLOTS:
-                 newExpirationDate.toSecsSinceEpoch() - 10,
-                 QDateTime::currentDateTime().addDays(5).toSecsSinceEpoch());
-             {
--                const auto actualExpiration = key.subkey(0).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(0).expirationTime());
-                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-                         ("actual: " + std::to_string(actualExpiration) +
-                          "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
-@@ -368,7 +368,7 @@ private Q_SLOTS:
-                          "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
-             }
-             {
--                const auto actualExpiration = key.subkey(1).expirationTime();
-+                const auto actualExpiration = uint_least32_t(key.subkey(1).expirationTime());
-                 QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-                         ("actual: " + std::to_string(actualExpiration) +
-                           "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
--- 
-2.36.0.windows.1
-
-
-From 2fa5c80aeba4528b3bdf41ec5740e7db5d4b6d2b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
-Date: Thu, 18 Aug 2022 10:43:19 +0200
-Subject: [PATCH 4/5] cpp: Fix handling of "no key" or "invalid time"
- situations
-
-* lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
-(GpgAddExistingSubkeyEditInteractor::Private::nextState): Fix inverted
-logic of string comparisons.
---
-
-This fixes the problem that the interactor didn't return the proper
-error code if gpg didn't accept the key grip or the expiration date.
-
-GnuPG-bug-id: 6137
----
- lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp b/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
-index 547e613d..8eec7460 100644
---- a/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
-+++ b/lang/cpp/src/gpgaddexistingsubkeyeditinteractor.cpp
-@@ -136,7 +136,7 @@ unsigned int GpgAddExistingSubkeyEditInteractor::Private::nextState(unsigned int
-                 strcmp(args, "keygen.flags") == 0) {
-             return FLAGS;
-         } else if (status == GPGME_STATUS_GET_LINE &&
--                   strcmp(args, "keygen.keygrip")) {
-+                   strcmp(args, "keygen.keygrip") == 0) {
-             err = NO_KEY_ERROR;
-             return ERROR;
-         }
-@@ -157,7 +157,7 @@ unsigned int GpgAddExistingSubkeyEditInteractor::Private::nextState(unsigned int
-                 strcmp(args, "keyedit.prompt") == 0) {
-             return QUIT;
-         } else if (status == GPGME_STATUS_GET_LINE &&
--                   strcmp(args, "keygen.valid")) {
-+                   strcmp(args, "keygen.valid") == 0) {
-             err = INV_TIME_ERROR;
-             return ERROR;
-         }
--- 
-2.36.0.windows.1
-
-
-From 2e7a61b898fccc1c20000b79dee83cd980901fa9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
-Date: Thu, 18 Aug 2022 10:55:09 +0200
-Subject: [PATCH 5/5] qt,tests: Make test pass on 32-bit systems
-
-* lang/qt/tests/t-addexistingsubkey.cpp
-(AddExistingSubkeyJobTest::testAddExistingSubkeyWithExpiration): Handle
-negative expiration date.
---
-
-On 32-bit systems the expiration date of the test key overflows. This
-will cause the AddExistingSubkeyJob to fail. We expect it to fail with
-an "invalid time" error.
-
-GnuPG-bug-id: 6137
----
- lang/qt/tests/t-addexistingsubkey.cpp | 42 +++++++++++++++------------
- 1 file changed, 24 insertions(+), 18 deletions(-)
-
-diff --git a/lang/qt/tests/t-addexistingsubkey.cpp b/lang/qt/tests/t-addexistingsubkey.cpp
-index 87eadf43..c0eee57b 100644
---- a/lang/qt/tests/t-addexistingsubkey.cpp
-+++ b/lang/qt/tests/t-addexistingsubkey.cpp
-@@ -213,24 +213,30 @@ private Q_SLOTS:
- 
-         const auto result = job->exec(key, sourceSubkey);
- 
--        QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
--        key.update();
--        QCOMPARE(key.numSubkeys(), 3u);
--
--        // allow 1 second different expiration because gpg calculates with
--        // expiration as difference to current time and takes current time
--        // several times
--        const auto allowedDeltaTSeconds = 1;
--        const auto expectedExpirationRange = std::make_pair(
--            uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
--            uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
--        const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
--        QVERIFY2(actualExpiration >= expectedExpirationRange.first,
--                 ("actual: " + std::to_string(actualExpiration) +
--                  "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
--        QVERIFY2(actualExpiration <= expectedExpirationRange.second,
--                 ("actual: " + std::to_string(actualExpiration) +
--                  "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
-+        if (sourceSubkey.expirationTime() > 0) {
-+            QCOMPARE(result.code(), static_cast<int>(GPG_ERR_NO_ERROR));
-+            key.update();
-+            QCOMPARE(key.numSubkeys(), 3u);
-+
-+            // allow 1 second different expiration because gpg calculates with
-+            // expiration as difference to current time and takes current time
-+            // several times
-+            const auto allowedDeltaTSeconds = 1;
-+            const auto expectedExpirationRange = std::make_pair(
-+                uint_least32_t(sourceSubkey.expirationTime()) - allowedDeltaTSeconds,
-+                uint_least32_t(sourceSubkey.expirationTime()) + allowedDeltaTSeconds);
-+            const auto actualExpiration = uint_least32_t(key.subkey(2).expirationTime());
-+            QVERIFY2(actualExpiration >= expectedExpirationRange.first,
-+                    ("actual: " + std::to_string(actualExpiration) +
-+                    "; expected: " + std::to_string(expectedExpirationRange.first)).c_str());
-+            QVERIFY2(actualExpiration <= expectedExpirationRange.second,
-+                    ("actual: " + std::to_string(actualExpiration) +
-+                    "; expected: " + std::to_string(expectedExpirationRange.second)).c_str());
-+        } else {
-+            // on 32-bit systems the expiration date of the test key overflows;
-+            // in this case we expect an appropriate error code
-+            QCOMPARE(result.code(), static_cast<int>(GPG_ERR_INV_TIME));
-+        }
-     }
- 
- private:
--- 
-2.36.0.windows.1
-
diff --git a/pkgs/development/libraries/grilo-plugins/default.nix b/pkgs/development/libraries/grilo-plugins/default.nix
index 9643efc851415..966e85a4bca32 100644
--- a/pkgs/development/libraries/grilo-plugins/default.nix
+++ b/pkgs/development/libraries/grilo-plugins/default.nix
@@ -11,7 +11,7 @@
 , libsoup_3
 , gnome
 , libxml2
-, lua5_3
+, lua5_4
 , liboauth
 , libgdata
 , libmediaart
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grilo-plugins";
-  version = "0.3.15";
+  version = "0.3.16";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "hRjD2VT5MJXZVWJKBEzhanNFUy+BHSmdv6HhFM/rqzM=";
+    sha256 = "/m9Nvlhsa4uiQGOU4gLyLQCdZCqW6zpU8y9qIdCEzcs=";
   };
 
   patches = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     grilo
     libxml2
     # libgdata
-    lua5_3
+    lua5_4
     liboauth
     sqlite
     gnome-online-accounts
diff --git a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
index df677194dad7d..3f3bb65fbe474 100644
--- a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
+++ b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
@@ -7,18 +7,17 @@
 , withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , meson
 , ninja
-, python3
   # just for passthru
 , gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "gsettings-desktop-schemas";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "XVVoKCqzi5V1nUJUAfdHblb4y/JimIVYdDn0O9C4S74=";
+    sha256 = "6y3kXK2QWZSEnmQqYjret11BshsGJtQNKge46igf7A4=";
   };
 
   strictDeps = true;
@@ -28,7 +27,6 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    python3
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
   ];
@@ -37,11 +35,6 @@ stdenv.mkDerivation rec {
     (lib.mesonBool "introspection" withIntrospection)
   ];
 
-  postPatch = ''
-    chmod +x build-aux/meson/post-install.py
-    patchShebangs build-aux/meson/post-install.py
-  '';
-
   preInstall = ''
     # Meson installs the schemas to share/glib-2.0/schemas
     # We add the override file there too so it will be compiled and later moved by
diff --git a/pkgs/development/libraries/gssdp/1.6.nix b/pkgs/development/libraries/gssdp/1.6.nix
index 80b518ab27b88..9479a9cfe88db 100644
--- a/pkgs/development/libraries/gssdp/1.6.nix
+++ b/pkgs/development/libraries/gssdp/1.6.nix
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch
 , fetchurl
 , meson
 , ninja
@@ -19,14 +20,26 @@ stdenv.mkDerivation rec {
   pname = "gssdp";
   version = "1.6.2";
 
-  outputs = [ "out" "dev" ]
-    ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "QQs3be7O2YNrV/SI+ABS/koU+J4HWxzszyjlH0kPn7k=";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://gitlab.gnome.org/GNOME/gssdp/-/merge_requests/11
+      name = "gi-docgen-as-native-dep.patch";
+      url = "https://gitlab.gnome.org/GNOME/gssdp/-/commit/db9d02c22005be7e5e81b43a3ab777250bd7b27b.diff";
+      hash = "sha256-Q2kwZlpNvSzIcMalrOm5lO5iFe+myS7J0S0vkcp10cw=";
+    })
+  ];
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -47,14 +60,13 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dgtk_doc=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
+    "-Dgtk_doc=true"
     "-Dsniffer=false"
-    "-Dintrospection=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
   ];
 
   doCheck = true;
 
-  postFixup = lib.optionalString (stdenv.buildPlatform == stdenv.hostPlatform) ''
+  postFixup = ''
     # Move developer documentation to devdoc output.
     # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
     find -L "$out/share/doc" -type f -regex '.*\.devhelp2?' -print0 \
diff --git a/pkgs/development/libraries/gssdp/default.nix b/pkgs/development/libraries/gssdp/default.nix
index 434655cb0c744..14bac6c2fec22 100644
--- a/pkgs/development/libraries/gssdp/default.nix
+++ b/pkgs/development/libraries/gssdp/default.nix
@@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Dgtk_doc=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
     "-Dsniffer=false"
-    "-Dintrospection=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
   ];
 
   # Bail out! GLib-GIO-FATAL-CRITICAL: g_inet_address_to_string: assertion 'G_IS_INET_ADDRESS (address)' failed
diff --git a/pkgs/development/libraries/gtk-frdp/default.nix b/pkgs/development/libraries/gtk-frdp/default.nix
index 450fdc6024d7e..24f768a678a09 100644
--- a/pkgs/development/libraries/gtk-frdp/default.nix
+++ b/pkgs/development/libraries/gtk-frdp/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gtk-frdp";
-  version = "unstable-2022-04-11";
+  version = "unstable-2023-03-03";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = pname;
-    rev = "d7f408fb23adc01db14c708b35b74a317418de4b";
-    sha256 = "EyReJX3f7G5+EEB/gbLTnrxdltedbzm7Bg02hCb+XO0=";
+    rev = "3f991a22c025cad3016a7aa55988e51884964050";
+    sha256 = "jzum4/iU1oSr5t/IrSOLFyZcj38VIL7ooIbfoJZhk+g=";
   };
 
   nativeBuildInputs = [
@@ -39,9 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   passthru = {
-    updateScript = unstableGitUpdater {
-      branch = "gtk-frdp-0-1";
-    };
+    updateScript = unstableGitUpdater { };
   };
 
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 5a1cc8ca9c5e6..33e4c44641021 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -63,7 +63,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk+3";
-  version = "3.24.36";
+  version = "3.24.37";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
   outputBin = "dev";
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
   in fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-J6bvFXdDNQyAf/6lm6odcCJtvt6CpelT/9WOpgWf5pE=";
+    sha256 = "sha256-Z0XwtMBTeUFR/Q8OJHSwd8zP9fg+ndG/PTn+n+X7f1c=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 764dc36d7db9c..9283ec59a30d2 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -63,7 +63,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.8.3";
+  version = "4.10.1";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "s2L5aNCFtNPZNA1NOMcGN33tnVN05pSitrfmKS48unQ=";
+    sha256 = "6PysBLx3FbnaZnyRGl7o8mLiANHWpQrfI2RcqM/NAxE=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gtkmm/4.x.nix b/pkgs/development/libraries/gtkmm/4.x.nix
index ffb2e123c87bd..e1ed8307a39d7 100644
--- a/pkgs/development/libraries/gtkmm/4.x.nix
+++ b/pkgs/development/libraries/gtkmm/4.x.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
-  version = "4.8.0";
+  version = "4.10.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "yCeG1G4rBzRrY5fKfxkp2VL0ki+lyds97ghJi5oTbPU=";
+    sha256 = "4bEJdxVX7MU8upFagLbt6Cf/29AEnGL9+L1/p5r8xus=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index 230047daa04f2..ae0a640234cb0 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch2
 , meson
 , ninja
 , pkg-config
@@ -25,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
-  version = "5.6.2";
+  version = "5.8.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
@@ -33,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "HxRsFW8TWmBJnZeeNXfJm24VoRFEV2er5iGbs0xUXHc=";
+    sha256 = "EQ3Uwg3vIYhvv3dymP4O+Mwq1gI7jzbHQkQRpBSBiTM=";
   };
 
   patches = [
@@ -41,13 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
     # but not from its own datadr (it assumes it will be in XDG_DATA_DIRS).
     # Since this is not generally true with Nix, let’s add $out/share unconditionally.
     ./4.x-nix_share_path.patch
-
-    # Add Nix syntax highlighting.
-    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/303
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gtksourceview/-/commit/2cc7fd079f9fc8b593c727c68a2c783c82299562.patch";
-      sha256 = "bTYWjEDpdbnUxcYNKl2YtSLfYlMfcbQSSYQjhixOGS8=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -86,13 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dgtk_doc=true"
   ];
 
-  postPatch = ''
-    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/295
-    # build: drop unnecessary vapigen check
-    substituteInPlace meson.build \
-      --replace "if generate_vapi" "if false"
-  '';
-
   doCheck = stdenv.isLinux;
 
   checkPhase = ''
diff --git a/pkgs/development/libraries/gupnp/1.6.nix b/pkgs/development/libraries/gupnp/1.6.nix
index 9145420ad2523..2b3cd2566b5b0 100644
--- a/pkgs/development/libraries/gupnp/1.6.nix
+++ b/pkgs/development/libraries/gupnp/1.6.nix
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch
 , fetchurl
 , meson
 , ninja
@@ -25,6 +26,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-T09Biwe4EWTfH3q2EuKOTAFsLQhbik85+XlF+LFe4kg=";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/32
+      name = "gi-docgen-as-native-dep.patch";
+      url = "https://gitlab.gnome.org/GNOME/gupnp/-/commit/11d4a33cff1f5d8b8ad4b80c4506246a9e0dff8f.diff";
+      hash = "sha256-+p4vzUG2v+7mxtQ5AUcEI7SW0cDX6XlzqlyegF+I1Go=";
+    })
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];
@@ -47,7 +57,6 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dgtk_doc=true"
-    "-Dintrospection=true"
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/gupnp/default.nix b/pkgs/development/libraries/gupnp/default.nix
index 9484467adf94a..bebf109d27786 100644
--- a/pkgs/development/libraries/gupnp/default.nix
+++ b/pkgs/development/libraries/gupnp/default.nix
@@ -64,7 +64,6 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dgtk_doc=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
-    "-Dintrospection=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
   ];
 
   # Bail out! ERROR:../tests/test-bugs.c:168:test_on_timeout: code should not be reached
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index c4604a28a41ec..39c06d23fdb23 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -45,11 +45,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gvfs";
-  version = "1.50.3";
+  version = "1.50.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "aJcRnpe7FgKdJ3jhpaVKamWSYx+LLzoqHepO8rAYA/0=";
+    sha256 = "q5BZpnalN+2+ohOIwqr+Gn4sjxrC39xtZFUCMwdUV/0=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 0b5cb9ae8ef59..32d8ae0bafeb1 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "7.0.1";
+  version = "7.1.0";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
-    hash = "sha256-LPTT2PIlAHURmQo2o0GV8NZWLKVt8KiwiFs4KDeUgZk=";
+    hash = "sha256-8TWmHNRkye1ryYI3ZMGI8nbDhQqNyQRijeKoeWa3B3s=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/jsonrpc-glib/default.nix b/pkgs/development/libraries/jsonrpc-glib/default.nix
index fb828e5b57146..855c3cfcf2cd2 100644
--- a/pkgs/development/libraries/jsonrpc-glib/default.nix
+++ b/pkgs/development/libraries/jsonrpc-glib/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jsonrpc-glib";
-  version = "3.42.0";
+  version = "3.44.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "IhmJpXyoKhJGfcQngizXZRsMrQOBQMkxAnvxB0IIJ2s=";
+    sha256 = "aUBqAlDQzFF1QIyufsqAwMa/rvxK4YMLNUwEM7zVzgY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 4caea890e7051..aefbaa6d41df6 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, perl, bison, bootstrap_cmds
-, openssl, openldap, libedit, keyutils
+, openssl, openldap, libedit, keyutils, libverto
 
 # for passthru.tests
 , bind
@@ -14,6 +14,7 @@
 # This is called "staticOnly" because krb5 does not support
 # builting both static and shared, see below.
 , staticOnly ? false
+, withVerto ? false
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -39,6 +40,7 @@ stdenv.mkDerivation rec {
     # krb5's ./configure does not allow passing --enable-shared and --enable-static at the same time.
     # See https://bbs.archlinux.org/viewtopic.php?pid=1576737#p1576737
     ++ lib.optionals staticOnly [ "--enable-static" "--disable-shared" ]
+    ++ lib.optional withVerto "--with-system-verto"
     ++ lib.optional stdenv.isFreeBSD ''WARN_CFLAGS=""''
     ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
        [ "krb5_cv_attr_constructor_destructor=yes,yes"
@@ -53,7 +55,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl ]
     ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.libc != "bionic" && !(stdenv.hostPlatform.useLLVM or false)) [ keyutils ]
-    ++ lib.optionals (!libOnly) [ openldap libedit ];
+    ++ lib.optionals (!libOnly) [ openldap libedit ]
+    ++ lib.optionals withVerto [ libverto ];
 
   sourceRoot = "krb5-${version}/src";
 
diff --git a/pkgs/development/libraries/libadwaita/default.nix b/pkgs/development/libraries/libadwaita/default.nix
index 75e70ff1dddc6..daf02487d08e0 100644
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libadwaita";
-  version = "1.2.3";
+  version = "1.3.1";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "libadwaita";
     rev = version;
-    hash = "sha256-m69TpXCs6QpVrN+6auig71ik+HvVprHi0OnlyDwTL7U=";
+    hash = "sha256-RIJtlSBZX4+rMOGQaFn31CCEKkWtPjtzO4fcX+iApvs=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 8f8e33cbeab4d..fff5f705d7ce5 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -22,8 +22,13 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-ZTa+wG1g9KsVoqJG/yqxo2fJ7OhPnaI9QcfOmpOT3pg=";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ cmake ];
 
+  buildInputs = [
+    cmocka # cmake expects cmocka module
+  ];
+
   cmakeFlags = lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON"
     ++ lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS=ON";
 
diff --git a/pkgs/development/libraries/libcdio/default.nix b/pkgs/development/libraries/libcdio/default.nix
index aacb7555a4b6f..c2bdea588dc0c 100644
--- a/pkgs/development/libraries/libcdio/default.nix
+++ b/pkgs/development/libraries/libcdio/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Fixes test failure of realpath test with glibc-2.36
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/libcdio/raw/d49ccdd9c8b4e9d57c01539f4c8948f28ce82bca/f/realpath-test-fix.patch";
+      sha256 = "sha256-ldAGlcf79uQ8QAt4Au8Iv6jsI6ICZXtXOKZBpyELtN8=";
+    })
+
     # pull pending upstream patch to fix build on ncurses-6.3:
     #  https://savannah.gnu.org/patch/index.php?10130
     (fetchpatch {
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index acbed23326cc1..6494f16a876cb 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "libdeflate";
-  version = "1.17";
+  version = "1.18";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${version}";
-    sha256 = "sha256-tKs8feGbeodOID8FPIUc/1LfBz1p0oN1Jfkv2OnA2qc=";
+    sha256 = "sha256-dWSDAYn36GDtkghmouGhHzxpa6EVwCslIPqejlLMZNM=";
   };
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "-DLIBDEFLATE_BUILD_SHARED_LIB=OFF" ];
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
     description = "Fast DEFLATE/zlib/gzip compressor and decompressor";
     license = licenses.mit;
     homepage = "https://github.com/ebiggers/libdeflate";
+    changelog = "https://github.com/ebiggers/libdeflate/blob/v${version}/NEWS.md";
     platforms = platforms.unix;
     maintainers = with maintainers; [ orivej kaction ];
   };
diff --git a/pkgs/development/libraries/libdex/default.nix b/pkgs/development/libraries/libdex/default.nix
new file mode 100644
index 0000000000000..7e17773f3f4c0
--- /dev/null
+++ b/pkgs/development/libraries/libdex/default.nix
@@ -0,0 +1,65 @@
+{ stdenv
+, lib
+, fetchFromGitLab
+, gi-docgen
+, gobject-introspection
+, meson
+, ninja
+, pkg-config
+, vala
+, glib
+, liburing
+, gnome
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libdex";
+  version = "0.2.0";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libdex";
+    rev = version;
+    sha256 = "54TwMdO29jordVqlBsMZOVtHc7s7ivf/4OkpCSNu7VE=";
+  };
+
+  nativeBuildInputs = [
+    gi-docgen
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+    vala
+  ];
+
+  buildInputs = [
+    glib
+    liburing
+  ];
+
+  mesonFlags = [
+    "-Ddocs=true"
+  ];
+
+  doCheck = true;
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
+  passthru.updateScript = gnome.updateScript {
+    packageName = "libdex";
+  };
+
+  meta = with lib; {
+    description = "Library supporting deferred execution for GNOME and GTK";
+    homepage = "https://gitlab.gnome.org/GNOME/libdex";
+    maintainers = teams.gnome.members;
+    platforms = platforms.linux;
+    license = licenses.lgpl21Plus;
+  };
+}
diff --git a/pkgs/development/libraries/libelf/default.nix b/pkgs/development/libraries/libelf/default.nix
index 4002146d4d5c2..3302d127d4d3e 100644
--- a/pkgs/development/libraries/libelf/default.nix
+++ b/pkgs/development/libraries/libelf/default.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
   ];
 
   enableParallelBuilding = true;
+  # Lacks dependencies:
+  #   mkdir ...-libelf-0.8.13/lib
+  #   mkdir ...-libelf-0.8.13/lib
+  # mkdir: cannot create directory '...-libelf-0.8.13/lib': File exists
+  enableParallelInstalling = false;
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/libgit2/default.nix b/pkgs/development/libraries/libgit2/default.nix
index c560b55a15f85..f5b0ff72ff0d0 100644
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libgit2";
-  version = "1.6.2";
+  version = "1.6.3";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    hash = "sha256-XmGlh0iehQIufAPpndSkYy4EQ8vG0I6MGB+jQQpCe9k=";
+    hash = "sha256-MiEw5UbmcPfW0SlqLdYEnBdOp29YIVdKXE588uUjqck=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libgtop/default.nix b/pkgs/development/libraries/libgtop/default.nix
index bfe0726c45431..4fffa6740f8e0 100644
--- a/pkgs/development/libraries/libgtop/default.nix
+++ b/pkgs/development/libraries/libgtop/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgtop";
-  version = "2.40.0";
+  version = "2.41.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1m6jbqk8maa52gxrf223442fr5bvvxgb7ham6v039i3r1i62gwvq";
+    sha256 = "Q+qa0T98r5gwPmQXKxkb6blrqzQLAZ3u7HIlHuFA/js=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libhandy/default.nix b/pkgs/development/libraries/libhandy/default.nix
index ced064e70f822..7507f40b604f0 100644
--- a/pkgs/development/libraries/libhandy/default.nix
+++ b/pkgs/development/libraries/libhandy/default.nix
@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libhandy";
-  version = "1.8.1";
+  version = "1.8.2";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-N2a5qIH+BljMYIBFOiIZCGw/bb2CBp3kCbirP1mUinA=";
+    sha256 = "sha256-0RqizT5XCsbQ79ukbRcxR8EfRYJkV+kkwFmQuy4N+a0=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix
index d76f304881513..2c4041a9cfa7d 100644
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libidn2";
-  version = "2.3.2";
+  version = "2.3.4";
 
   src = fetchurl {
-    url = "mirror://gnu/libidn/${pname}-${version}.tar.gz";
-    sha256 = "sha256-dpQM1Od46Ak1eanRlbJf/16Tbp3GJCBoUotDenZ2T5E=";
+    url = "https://ftp.gnu.org/gnu/libidn/${pname}-${version}.tar.gz";
+    sha256 = "sha256-k8q6crTgUdH41PWgdqtjyZt3+u4Bm3K5eDsmeYbbtF8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index 8fb334e2a4d5a..43e4b447ae78b 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -24,8 +24,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-0HOmItooNsGq6iTIb9M5IPXMwYh2nQ03qfjomkg0d00=";
 
-  auditable = true; # TODO: remove when this is the default
-
   nativeBuildInputs = [ cargo-c ];
 
   postBuild = ''
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 7dc0ae5b8ce2f..b62c95fa5c86a 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, fetchFromGitHub
+, fetchpatch
 , brotli
 , cmake
 , giflib
@@ -33,6 +34,15 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Add missing <atomic> content to fix gcc compilation for RISCV architecture
+    # https://github.com/libjxl/libjxl/pull/2211
+    (fetchpatch {
+      url = "https://github.com/libjxl/libjxl/commit/22d12d74e7bc56b09cfb1973aa89ec8d714fa3fc.patch";
+      hash = "sha256-X4fbYTMS+kHfZRbeGzSdBW5jQKw8UN44FEyFRUtw0qo=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     gtest
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 61e08f31c14f6..c55b0876ce619 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -9,8 +9,10 @@
 , help2man
 , systemd
 , bash-completion
+, bash
 , buildPackages
 , withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withDocs ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 }:
 
@@ -18,7 +20,8 @@ stdenv.mkDerivation rec {
   pname = "libmbim";
   version = "1.28.4";
 
-  outputs = [ "out" "dev" "man" ];
+  outputs = [ "out" "dev" ]
+    ++ lib.optionals withDocs [ "man" ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -31,14 +34,19 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Dudevdir=${placeholder "out"}/lib/udev"
     (lib.mesonBool "introspection" withIntrospection)
+    (lib.mesonBool "man" withDocs)
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     python3
+  ] ++ lib.optionals withDocs [
     help2man
+  ] ++ lib.optionals withIntrospection [
     gobject-introspection
   ];
 
@@ -46,6 +54,7 @@ stdenv.mkDerivation rec {
     glib
     systemd
     bash-completion
+    bash
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libmicrohttpd/generic.nix b/pkgs/development/libraries/libmicrohttpd/generic.nix
index 0af066c71238a..d5bc619e9042d 100644
--- a/pkgs/development/libraries/libmicrohttpd/generic.nix
+++ b/pkgs/development/libraries/libmicrohttpd/generic.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, libgcrypt, curl, gnutls, pkg-config, libiconv, libintl, version, src, meta ? {} }:
+{ lib, stdenv, libgcrypt, curl, gnutls, pkg-config, libiconv, libintl, version, src, meta ? {}, fetchpatch }:
 
 let
   meta_ = meta;
@@ -8,6 +8,17 @@ stdenv.mkDerivation rec {
   pname = "libmicrohttpd";
   inherit version src;
 
+  patches = lib.optionals (lib.versionOlder version "0.9.76") [
+    (fetchpatch {
+      name = "CVE-2023-27371.patch";
+      url = "https://git.gnunet.org/libmicrohttpd.git/patch/?id=e0754d1638c602382384f1eface30854b1defeec";
+      hash = "sha256-vzrq9HPysGpc13rFEk6zLPgpUqp/ST4q/Wp30Dam97k=";
+      excludes = [
+        "ChangeLog"
+      ];
+    })
+  ];
+
   outputs = [ "out" "dev" "devdoc" "info" ];
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libgcrypt curl gnutls libiconv libintl ];
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 10ef8e5395a38..afbfa53495223 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.4";
+  version = "1.2.5";
   pname = "libnftnl";
 
   src = fetchurl {
-    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-wP4jO+TN/XA+fVl37462P8vx0AUrYEThsj1HyjViR38=";
+    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
+    hash = "sha256-lm3gqBIMilPbhZiJdJNov7LLoMTwtMGjDSZOzMRfEiY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index 1238b91920a96..e94ce7e12b1e2 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnotify";
-  version = "0.8.1";
+  version = "0.8.2";
 
   outputs = [ "out" "man" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0DPm1NbMv0akNsMWKKS2YbNtyh9dQXT+AXPidPTmJVc=";
+    sha256 = "xfTtPR+G5bEYx2QVqsuGGHPtPm8MazGBuCjPWE/FxhY=";
   };
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/libomxil-bellagio/default.nix b/pkgs/development/libraries/libomxil-bellagio/default.nix
index 694625c8af818..4f129dc137812 100644
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@@ -33,7 +33,8 @@ stdenv.mkDerivation rec {
   doCheck = false; # fails
 
   env.NIX_CFLAGS_COMPILE =
-    if stdenv.cc.isGNU then "-Wno-error=array-bounds -Wno-error=stringop-overflow=8"
+    # stringop-truncation: see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1028978
+    if stdenv.cc.isGNU then "-Wno-error=array-bounds -Wno-error=stringop-overflow=8 -Wno-error=stringop-truncation"
     else "-Wno-error=absolute-value -Wno-error=enum-conversion -Wno-error=logical-not-parentheses -Wno-error=non-literal-null-conversion";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libpanel/default.nix b/pkgs/development/libraries/libpanel/default.nix
index d3ab5fc0be2dd..3a9c80ed9c4c4 100644
--- a/pkgs/development/libraries/libpanel/default.nix
+++ b/pkgs/development/libraries/libpanel/default.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libpanel";
-  version = "1.0.2";
+  version = "1.2.0";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
   src = fetchurl {
     url = "mirror://gnome/sources/libpanel/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "pnIEOkiuIAUAl8mp+dmPKnOh7IVHgirnu6VNPMiNf+I=";
+    sha256 = "2QVbu6uWJfP1zm0f1xMutuo0proHqH6ZOJAfuLMVgeI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 0f429062e48c8..04c8a0f16ad8d 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -4,6 +4,7 @@
 , flex
 , bison
 , bluez
+, libnl
 , libxcrypt
 , pkg-config
 , withBluez ? false
@@ -19,10 +20,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-KoiFxANRbPewkz7UsU1sqjDgIFJInr1BTcdaxS51WeY=";
   };
 
-  buildInputs = lib.optionals withRemote [ libxcrypt ];
+  buildInputs = lib.optionals stdenv.isLinux [ libnl ]
+    ++ lib.optionals withRemote [ libxcrypt ];
 
   nativeBuildInputs = [ flex bison ]
-    ++ lib.optionals withBluez [ bluez.dev pkg-config ];
+    ++ lib.optionals stdenv.isLinux [ pkg-config ]
+    ++ lib.optionals withBluez [ bluez.dev ];
 
   # We need to force the autodetection because detection doesn't
   # work in pure build environments.
diff --git a/pkgs/development/libraries/libpeas/default.nix b/pkgs/development/libraries/libpeas/default.nix
index e218a78bdfc3b..a345ac704bc85 100644
--- a/pkgs/development/libraries/libpeas/default.nix
+++ b/pkgs/development/libraries/libpeas/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpeas";
-  version = "1.34.0";
+  version = "1.36.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "QwX3Fdq0ta0+gAfa7DFmJecGWpTmPiXvVese+5ZKe/A=";
+    sha256 = "KXy5wszNjoYXYj0aPoQVtFMLjlqJPjUnu/0e3RMje0w=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index a319de5ce6b25..0dc795a96d843 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -1,20 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, autogen, flac, libogg, libopus, libvorbis, pkg-config, python3
-, Carbon, AudioToolbox
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, autogen, pkg-config, python3
+, flac, lame, libmpg123, libogg, libopus, libvorbis
+, alsa-lib, Carbon, AudioToolbox
 }:
 
 stdenv.mkDerivation rec {
   pname = "libsndfile";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-bhIXVSKuUnUzs5aaLDHt21RcnqekEpLU414sFtl2Lro=";
+    hash = "sha256-zd0HDUzVYLyFjhIudBJQaKJUtYMjZeQRLALSkyD9tXU=";
   };
 
   nativeBuildInputs = [ autoreconfHook autogen pkg-config python3 ];
-  buildInputs = [ flac libogg libopus libvorbis ]
+  buildInputs = [ flac lame libmpg123 libogg libopus libvorbis ]
+    ++ lib.optionals stdenv.isLinux [ alsa-lib ]
     ++ lib.optionals stdenv.isDarwin [ Carbon AudioToolbox ];
 
   enableParallelBuilding = true;
@@ -34,6 +36,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A C library for reading and writing files containing sampled sound";
     homepage    = "https://libsndfile.github.io/libsndfile/";
+    changelog   = "https://github.com/libsndfile/libsndfile/releases/tag/${version}";
     license     = licenses.lgpl2Plus;
     maintainers = with maintainers; [ lovek323 ];
     platforms   = platforms.unix;
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index 2ea9978ed48a4..e0db4e702728b 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.2.2";
+  version = "3.4.0";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-g2c8aFuRD7fTnx8o7uWvvvtxwFeY/DUKw78biF4e+qE=";
+    sha256 = "sha256-I+//ascPLB6HNQfaxSZJ7sAywVl6SulRdizjEjeJrMk=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libvmaf/default.nix b/pkgs/development/libraries/libvmaf/default.nix
index c0fc4d1556f3c..55a08d59ed807 100644
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm, xxd }:
 
 stdenv.mkDerivation rec {
   pname = "libvmaf";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ meson ninja nasm ];
+  nativeBuildInputs = [ meson ninja nasm xxd ];
 
   mesonFlags = [ "-Denable_avx512=true" ];
 
diff --git a/pkgs/development/libraries/mesa/generic.nix b/pkgs/development/libraries/mesa/generic.nix
index b60533ca39a8f..82055ecd3427d 100644
--- a/pkgs/development/libraries/mesa/generic.nix
+++ b/pkgs/development/libraries/mesa/generic.nix
@@ -1,6 +1,6 @@
 { version, hash }:
 
-{ stdenv, lib, fetchurl
+{ stdenv, lib, fetchurl, fetchpatch
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
@@ -133,6 +133,13 @@ self = stdenv.mkDerivation {
 
     ./opencl.patch
     ./disk_cache-include-dri-driver-path-in-cache-key.patch
+
+    # FIXME: submitted upstream at https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/22133
+    # Remove when no longer applicable
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/1457f1b752f59258c0b33558619b0063b4ce6280.diff";
+      hash = "sha256-WFemyfmCWY4rJMfGxVZdYeGQvGcOTEDMrRt5OIWp348=";
+    })
   ];
 
   postPatch = ''
@@ -322,6 +329,10 @@ self = stdenv.mkDerivation {
         patchelf --set-rpath "$(patchelf --print-rpath $lib):$drivers/lib" "$lib"
       fi
     done
+    # add RPATH here so Zink can find libvulkan.so
+    ${lib.optionalString haveZink ''
+      patchelf --add-rpath ${vulkan-loader}/lib $drivers/lib/dri/zink_dri.so
+    ''}
   '';
 
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [ "-fno-common" ] ++ lib.optionals enableOpenCL [
diff --git a/pkgs/development/libraries/mesa/stubs.nix b/pkgs/development/libraries/mesa/stubs.nix
index f3ea263cc9ffe..773897548a427 100644
--- a/pkgs/development/libraries/mesa/stubs.nix
+++ b/pkgs/development/libraries/mesa/stubs.nix
@@ -1,12 +1,13 @@
 { stdenv
-, libglvnd, mesa
+, libglvnd
+, mesa
 , OpenGL
 , testers
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  inherit (libglvnd) version;
   pname = "libGL";
+  inherit (if stdenv.hostPlatform.isDarwin then mesa else libglvnd) version;
   outputs = [ "out" "dev" ];
 
   # On macOS, libglvnd is not supported, so we just use what mesa
@@ -77,5 +78,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
-  meta.pkgConfigModules = [ "gl" "egl" "glesv1_cm" "glesv2" ];
+  meta = {
+    description = "Stub bindings using " + (if stdenv.hostPlatform.isDarwin then "mesa" else "libglvnd");
+    pkgConfigModules = [ "gl" "egl" "glesv1_cm" "glesv2" ];
+  } // {
+    inherit (if stdenv.hostPlatform.isDarwin then mesa.meta else libglvnd.meta) homepage license platforms;
+  };
 })
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index a9f7b0304e84d..496412dda320b 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -37,9 +37,14 @@
 , enableContrib ? true
 
 , enableCuda ? (config.cudaSupport or false) && stdenv.hostPlatform.isx86_64
-, cudaPackages ? { }
+, enableCublas ? enableCuda
+, enableCudnn ? false # NOTE: CUDNN has a large impact on closure size so we disable it by default
+, enableCufft ? enableCuda
+, cudaPackages ? {}
+, symlinkJoin
 , nvidia-optical-flow-sdk
 
+, enableLto ? true
 , enableUnfree ? false
 , enableIpp ? false
 , enablePython ? false
@@ -79,9 +84,6 @@
 }:
 
 let
-  inherit (cudaPackages) cudatoolkit;
-  inherit (cudaPackages.cudaFlags) cudaCapabilities;
-
   version = "4.7.0";
 
   src = fetchFromGitHub {
@@ -227,6 +229,33 @@ let
   #multithreaded openblas conflicts with opencv multithreading, which manifest itself in hung tests
   #https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
   openblas_ = blas.provider.override { singleThreaded = true; };
+
+  inherit (cudaPackages) backendStdenv cudaFlags cudaVersion;
+  inherit (cudaFlags) cudaCapabilities;
+
+  cuda-common-redist = with cudaPackages; [
+    cuda_cccl # <thrust/*>
+    libnpp # npp.h
+  ] ++ lib.optionals enableCublas [
+    libcublas # cublas_v2.h
+  ] ++ lib.optionals enableCudnn [
+    cudnn # cudnn.h
+  ] ++ lib.optionals enableCufft [
+    libcufft # cufft.h
+  ];
+
+  cuda-native-redist = symlinkJoin {
+    name = "cuda-native-redist-${cudaVersion}";
+    paths = with cudaPackages; [
+      cuda_cudart # cuda_runtime.h
+      cuda_nvcc
+    ] ++ cuda-common-redist;
+   };
+
+  cuda-redist = symlinkJoin {
+    name = "cuda-redist-${cudaVersion}";
+    paths = cuda-common-redist;
+   };
 in
 
 stdenv.mkDerivation {
@@ -298,17 +327,18 @@ stdenv.mkDerivation {
     ++ lib.optionals enableTesseract [ tesseract leptonica ]
     ++ lib.optional enableTbb tbb
     ++ lib.optionals stdenv.isDarwin [ bzip2 AVFoundation Cocoa VideoDecodeAcceleration CoreMedia MediaToolbox ]
-    ++ lib.optionals enableDocs [ doxygen graphviz-nox ];
+    ++ lib.optionals enableDocs [ doxygen graphviz-nox ]
+    ++ lib.optionals enableCuda [ cuda-redist ];
 
   propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy
-    ++ lib.optionals enableCuda [ cudatoolkit nvidia-optical-flow-sdk ];
+    ++ lib.optionals enableCuda [ nvidia-optical-flow-sdk ];
 
   nativeBuildInputs = [ cmake pkg-config unzip ]
   ++ lib.optionals enablePython [
     pythonPackages.pip
     pythonPackages.wheel
     pythonPackages.setuptools
-  ];
+  ] ++ lib.optionals enableCuda [ cuda-native-redist ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
@@ -338,12 +368,30 @@ stdenv.mkDerivation {
     (opencvFlag "OPENEXR" enableEXR)
     (opencvFlag "OPENJPEG" enableJPEG2000)
     "-DWITH_JASPER=OFF" # OpenCV falls back to a vendored copy of Jasper when OpenJPEG is disabled
-    (opencvFlag "CUDA" enableCuda)
-    (opencvFlag "CUBLAS" enableCuda)
     (opencvFlag "TBB" enableTbb)
+
+    # CUDA options
+    (opencvFlag "CUDA" enableCuda)
+    (opencvFlag "CUDA_FAST_MATH" enableCuda)
+    (opencvFlag "CUBLAS" enableCublas)
+    (opencvFlag "CUDNN" enableCudnn)
+    (opencvFlag "CUFFT" enableCufft)
+
+    # LTO options
+    (opencvFlag "ENABLE_LTO" enableLto)
+    (opencvFlag "ENABLE_THIN_LTO" (
+      enableLto && (
+        # Only clang supports thin LTO, so we must either be using clang through the stdenv,
+        stdenv.cc.isClang ||
+          # or through the backend stdenv.
+          (enableCuda && backendStdenv.cc.isClang)
+      )
+    ))
   ] ++ lib.optionals enableCuda [
     "-DCUDA_FAST_MATH=ON"
-    "-DCUDA_HOST_COMPILER=${cudatoolkit.cc}/bin/cc"
+    # We need to set the C and C++ host compilers for CUDA to the same compiler.
+    "-DCMAKE_C_COMPILER=${backendStdenv.cc}/bin/cc"
+    "-DCMAKE_CXX_COMPILER=${backendStdenv.cc}/bin/c++"
     "-DCUDA_NVCC_FLAGS=--expt-relaxed-constexpr"
 
     # OpenCV respects at least three variables:
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 50e2d5736ff0e..a92f5f6d16505 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pango";
-  version = "1.50.12";
+  version = "1.50.14";
 
   outputs = [ "bin" "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "yu+W0nu+eSpr6ScnxzRo2DKxPaV8gHHvebnfae4Fj+M=";
+    sha256 = "HWfyBb/DGMJ6Kc/ftoKFaN9WZ5XfDLUdIYnN5/LVgeg=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 8fa38c49de76d..64fc9ec034ad7 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -71,7 +71,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.67";
+    version = "0.3.68";
 
     outputs = [
       "out"
@@ -89,7 +89,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-YM1WOv/SqaGnYevwoFxoOQhF6loFVx/fVPHQY3mpaH0=";
+      sha256 = "sha256-dm+mgtvXJEBjCYMBbiBHZq42ikfsEDaybMzLMPLxBcE=";
     };
 
     patches = [
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 3f6c616c39487..377854f16f70a 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "fa8dee92201448cc4eaa92f222b93d0b044d8ea5",
-    "sha256": "16b0q0anlgmfzbdm0jyakb8cxikrr295pj7avzny26x9609lzqga"
+    "rev": "6c09620dc84900c31a2d307a8640dbc15b1fcfdd",
+    "sha256": "0nr8xlfdrgjr6rrd5f99p8vzlxx6n8xch5l2z95pb2lx4w4pz26q"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -26,8 +26,8 @@
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "056294c0493f814c3951ef57e5d0656efe643fb5",
-    "sha256": "0byzmd7azrx06xmd8dsapjljpc9wwnsr39jjccbapjl5rfxywipw"
+    "rev": "2d241e0b79971917845a6ed448e838ef273d73d7",
+    "sha256": "15zk9q1n9yfg4nkr0rs7agsvzim8nlrqzm1h4h9r0iwr91g9vqp5"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
@@ -56,13 +56,13 @@
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "abe44c0f526e499668b1131c5990d9b571f99c46",
-    "sha256": "0llw5lsw368vzsc7dnjy3ahxny8qzb7yz3aakgsbd5glk3dgr4i4"
+    "rev": "dbc9c396199ef78e820b40ddb8a4e76c0a86d48c",
+    "sha256": "18dhnvkv9hialjfcm80g9y38fsxfcfk4fgrrsm3hy2yda6a6g1c6"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "f991e28cb0a670597f1955585c76ce8a26ce9e4b",
-    "sha256": "0bvxjciisq2hixhbxxs68zdwfdyvljy8iq48rnwpynqsdrhh5rma"
+    "rev": "435f931a7e42172e12ceba8f0d9da06ba4ec0bee",
+    "sha256": "1p7hz09jv8whlv0m39cnjz3yc6pjzyxkc8zinl6f0qmrska6m4gp"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
@@ -76,8 +76,8 @@
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "0d7cc33ac1404758886acef4f804b788c6774e98",
-    "sha256": "1ra9iv4pjcgz98927lkbpw494qf1jxsg4vbzxsxi247q2d1dkwzi"
+    "rev": "32557dbe01ba66005b8e28b38033eeee9819a4c6",
+    "sha256": "09mds5v3b3jq34r40hqg2a39q16p4q648wda7cqgm2yp249j06g8"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
@@ -166,8 +166,8 @@
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "f6a1e838e371dc90272c62daeea597fe487dec3e",
-    "sha256": "0v8vcs4jl24h754ilg9dm4qq1q24fk9mmnanpqk1q102ymmz2rac"
+    "rev": "df41e7e3e1f0e5495c5c8c52f1c9bb5a32b0da27",
+    "sha256": "0f292axj0ivgwgx97zc8x744243i7lgqcxbkjxham6md81m1xbwj"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
diff --git a/pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh b/pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh
index 4ca11a223de25..0f17856b4c7d3 100644
--- a/pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh
+++ b/pkgs/development/libraries/qt-5/hooks/fix-qt-builtin-paths.sh
@@ -17,9 +17,9 @@ fixQtBuiltinPaths() {
             if grep -q '\$\$\[QT_' "${pr_:?}"; then
                 echo "fixQtBuiltinPaths: Fixing Qt builtin paths in \`${pr_:?}'..."
                 sed -i "${pr_:?}" \
-                    -e "s|\\\$\\\$\\[QT_HOST_BINS[^]]*\\]|$dev/bin|g" \
+                    -e "s|\\\$\\\$\\[QT_HOST_BINS[^]]*\\]|"'$$'"NIX_OUTPUT_DEV/bin|g" \
                     -e "s|\\\$\\\$\\[QT_HOST_DATA[^]]*\\]/mkspecs|$dev/mkspecs|g" \
-                    -e "s|\\\$\\\$\\[QT_HOST_PREFIX[^]]*\\]|$dev|g" \
+                    -e "s|\\\$\\\$\\[QT_HOST_PREFIX[^]]*\\]|"'$$'"NIX_OUTPUT_DEV|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_ARCHDATA[^]]*\\]|$lib|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_BINS[^]]*\\]|$bin/bin|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_CONFIGURATION[^]]*\\]|$bin|g" \
@@ -30,7 +30,7 @@ fixQtBuiltinPaths() {
                     -e "s|\\\$\\\$\\[QT_INSTALL_LIBS[^]]*\\]|$lib/lib|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_LIBEXECS[^]]*\\]|$lib/libexec|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_PLUGINS[^]]*\\]|$bin/$qtPluginPrefix|g" \
-                    -e "s|\\\$\\\$\\[QT_INSTALL_PREFIX[^]]*\\]|$lib|g" \
+                    -e "s|\\\$\\\$\\[QT_INSTALL_PREFIX[^]]*\\]|"'$$'"NIX_OUTPUT_LIB|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_TESTS[^]]*\\]|$dev/tests|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_TRANSLATIONS[^]]*\\]|$lib/translations|g" \
                     -e "s|\\\$\\\$\\[QT_INSTALL_QML[^]]*\\]|$bin/$qtQmlPrefix|g"
@@ -40,9 +40,9 @@ fixQtBuiltinPaths() {
         if grep -q '\$\$\[QT_' "${dir:?}"; then
             echo "fixQtBuiltinPaths: Fixing Qt builtin paths in \`${dir:?}'..."
             sed -i "${dir:?}" \
-                -e "s|\\\$\\\$\\[QT_HOST_BINS[^]]*\\]|$dev/bin|g" \
+                -e "s|\\\$\\\$\\[QT_HOST_BINS[^]]*\\]|"'$$'"NIX_OUTPUT_DEV/bin|g" \
                 -e "s|\\\$\\\$\\[QT_HOST_DATA[^]]*\\]/mkspecs|$dev/mkspecs|g" \
-                -e "s|\\\$\\\$\\[QT_HOST_PREFIX[^]]*\\]|$dev|g" \
+                -e "s|\\\$\\\$\\[QT_HOST_PREFIX[^]]*\\]|"'$$'"NIX_OUTPUT_DEV|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_ARCHDATA[^]]*\\]|$lib|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_BINS[^]]*\\]|$bin/bin|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_CONFIGURATION[^]]*\\]|$bin|g" \
@@ -53,7 +53,7 @@ fixQtBuiltinPaths() {
                 -e "s|\\\$\\\$\\[QT_INSTALL_LIBS[^]]*\\]|$lib/lib|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_LIBEXECS[^]]*\\]|$lib/libexec|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_PLUGINS[^]]*\\]|$bin/$qtPluginPrefix|g" \
-                -e "s|\\\$\\\$\\[QT_INSTALL_PREFIX[^]]*\\]|$lib|g" \
+                -e "s|\\\$\\\$\\[QT_INSTALL_PREFIX[^]]*\\]|"'$$'"NIX_OUTPUT_LIB|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_TESTS[^]]*\\]|$dev/tests|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_TRANSLATIONS[^]]*\\]|$lib/translations|g" \
                 -e "s|\\\$\\\$\\[QT_INSTALL_QML[^]]*\\]|$bin/$qtQmlPrefix|g"
diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index 0d30f0e26653c..56607df6b4b95 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -22,6 +22,9 @@ qmakePrePhase() {
         qmakeFlags+=( "CONFIG+=release" )
     fi
 
+    # do the stripping ourselves (needed for separateDebugInfo)
+    qmakeFlags+=( "CONFIG+=nostrip" )
+
     qmakeFlags+=( "${qmakeFlags_orig[@]}" )
 }
 prePhases+=" qmakePrePhase"
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index d74bf46dd6c81..8b5d497c5e9a0 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -216,7 +216,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-shared"
     "-accessibility"
     "-optimized-qmake"
-    "-strip"
+    # for separateDebugInfo
+    "-no-strip"
     "-system-proxies"
     "-pkg-config"
 
diff --git a/pkgs/development/libraries/qt-5/modules/qtwayland.nix b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
index c7b61ab11f4be..edb15b0b48b1c 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
@@ -1,4 +1,4 @@
-{ lib, qtModule, qtbase, qtquickcontrols, wayland, pkg-config, fetchpatch }:
+{ qtModule, qtbase, qtquickcontrols, wayland, pkg-config }:
 
 qtModule {
   pname = "qtwayland";
@@ -9,16 +9,7 @@ qtModule {
   patches = [
     # NixOS-specific, ensure that app_id is correctly determined for
     # wrapped executables from `wrapQtAppsHook` (see comment in patch for further
-    # context).  Beware: shared among different Qt5 versions.
+    # context).
     ./qtwayland-app_id.patch
-
-    # Backport of https://codereview.qt-project.org/c/qt/qtwayland/+/388338
-    # Pulled from Fedora as they modified it to not apply to KDE as Plasma 5.x
-    # doesn't behave properly with the patch applied. See the discussion at
-    # https://invent.kde.org/qt/qt/qtwayland/-/merge_requests/39 for details
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/qt5-qtwayland/raw/46376bb00d4c3dd3db2e82ad7ca5301ce16ea4ab/f/0080-Client-set-constraint-adjustments-for-popups-in-xdg.patch";
-      sha256 = "sha256-XP+noYCk8fUdA0ItCqMjV7lSXDlNdB7Az9q7NRpupHc=";
-    })
   ];
 }
diff --git a/pkgs/development/libraries/rustls-ffi/default.nix b/pkgs/development/libraries/rustls-ffi/default.nix
index cf82505f71473..824e84e951033 100644
--- a/pkgs/development/libraries/rustls-ffi/default.nix
+++ b/pkgs/development/libraries/rustls-ffi/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, Security, apacheHttpd }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, Security, apacheHttpd, curl }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rustls-ffi";
@@ -28,6 +28,7 @@ rustPlatform.buildRustPackage rec {
 
   passthru.tests = {
     apacheHttpd = apacheHttpd.override { modTlsSupport = true; };
+    curl = curl.override { opensslSupport = false; rustlsSupport = true; };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/spdk/default.nix b/pkgs/development/libraries/spdk/default.nix
index 31f65784061a3..bcf6b804ed627 100644
--- a/pkgs/development/libraries/spdk/default.nix
+++ b/pkgs/development/libraries/spdk/default.nix
@@ -55,6 +55,11 @@ in stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs .
+
+    # glibc-2.36 adds arc4random, so we don't need the custom implementation
+    # here anymore. Fixed upstream in https://github.com/spdk/spdk/commit/43a3984c6c8fde7201d6c8dfe1b680cb88237269,
+    # but the patch doesn't apply here.
+    sed -i -e '1i #define HAVE_ARC4RANDOM 1' lib/iscsi/iscsi.c
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/spice-gtk/default.nix b/pkgs/development/libraries/spice-gtk/default.nix
index d54ffa3bd19b4..81311fb237007 100644
--- a/pkgs/development/libraries/spice-gtk/default.nix
+++ b/pkgs/development/libraries/spice-gtk/default.nix
@@ -62,25 +62,15 @@
 
 stdenv.mkDerivation rec {
   pname = "spice-gtk";
-  version = "0.41";
+  version = "0.42";
 
   outputs = [ "out" "dev" "devdoc" "man" ];
 
   src = fetchurl {
     url = "https://www.spice-space.org/download/gtk/${pname}-${version}.tar.xz";
-    sha256 = "sha256-2Pi1y+qRhHAu64zCdqZ9cqzbbjbnxzNJ+4RF5byglp8=";
+    sha256 = "sha256-k4ARfxgRrR+qGBLLZgJHm2KQ1KDYzEQtREJ/f2wOelg=";
   };
 
-  postPatch = ''
-    # get rid of absolute path to helper in store so we can use a setuid wrapper
-    substituteInPlace src/usb-acl-helper.c \
-      --replace 'ACL_HELPER_PATH"/' '"'
-    # don't try to setcap/suid in a nix builder
-    substituteInPlace src/meson.build \
-      --replace "meson.add_install_script('../build-aux/setcap-or-suid'," \
-      "# meson.add_install_script('../build-aux/setcap-or-suid',"
-  '';
-
   depsBuildBuild = [
     pkg-config
   ];
@@ -149,6 +139,18 @@ stdenv.mkDerivation rec {
     "-Dcoroutine=gthread" # Fixes "Function missing:makecontext"
   ];
 
+  postPatch = ''
+    # get rid of absolute path to helper in store so we can use a setuid wrapper
+    substituteInPlace src/usb-acl-helper.c \
+      --replace 'ACL_HELPER_PATH"/' '"'
+    # don't try to setcap/suid in a nix builder
+    substituteInPlace src/meson.build \
+      --replace "meson.add_install_script('../build-aux/setcap-or-suid'," \
+      "# meson.add_install_script('../build-aux/setcap-or-suid',"
+
+    patchShebangs subprojects/keycodemapdb/tools/keymap-gen
+  '';
+
   meta = with lib; {
     description = "GTK 3 SPICE widget";
     longDescription = ''
diff --git a/pkgs/development/libraries/spice/default.nix b/pkgs/development/libraries/spice/default.nix
index 7f7493b2acc98..25e60397b3574 100644
--- a/pkgs/development/libraries/spice/default.nix
+++ b/pkgs/development/libraries/spice/default.nix
@@ -25,38 +25,18 @@
 , gdk-pixbuf
 }:
 
-let
-  # This file was mistakenly not included with the 0.15.0 release tarball.
-  # Should be fixed with the next release.
-  # https://gitlab.freedesktop.org/spice/spice/-/issues/56
-  doxygen_sh = fetchurl {
-    url = "https://gitlab.freedesktop.org/spice/spice/-/raw/v0.15.0/doxygen.sh";
-    sha256 = "0g4bx91qclihp1jfhdhyj7wp4hf4289794xxbw32kk58lnd7bzkg";
-  };
-in
-
 stdenv.mkDerivation rec {
   pname = "spice";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchurl {
     url = "https://www.spice-space.org/download/releases/spice-server/${pname}-${version}.tar.bz2";
-    sha256 = "1xd0xffw0g5vvwbq4ksmm3jjfq45f9dw20xpmi82g1fj9f7wy85k";
+    sha256 = "ramvZ6syGRa9frWePWGaSneWwIooxzLt/H8C/ICxo3o=";
   };
 
   patches = [
     ./remove-rt-on-darwin.patch
   ];
-  postPatch = ''
-    install ${doxygen_sh} doxygen.sh
-    patchShebangs build-aux
-
-    # https://gitlab.freedesktop.org/spice/spice-common/-/issues/5
-    substituteInPlace subprojects/spice-common/meson.build \
-      --replace \
-      "cmd = run_command(python, '-m', module)" \
-      "cmd = run_command(python, '-c', 'import @0@'.format(module))"
-  '';
 
   nativeBuildInputs = [
     glib
@@ -99,6 +79,13 @@ stdenv.mkDerivation rec {
     "-Dgstreamer=1.0"
   ];
 
+  postPatch = ''
+    patchShebangs build-aux
+
+    # Forgotten in 0.15.1 tarball
+    sed -i /meson.add_dist_script/d meson.build
+  '';
+
   postInstall = ''
     ln -s spice-server $out/include/spice
   '';
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 706d3449286e2..51adb59a91763 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-bjiWGSmpEbydXtCLP8fRZfPBvdCzBoJxKXTx3BroQbg=";
+    hash = "sha256-VOq3r6ZcbDGGxjqC4IoPMGC5n1APUPUAs9xcRzxdyfk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 162a5f7b2c6e3..961a0c9e31954 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.41.1";
+  version = "3.41.2";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-Ta376rn44WxpXU+7xRwWsvd/uX/0wcPROZGd/AOMnjM=";
+    hash = "sha256-6YwQDdHaTjD6Rgdh2rfAuRpQt4XhZ/jFesxGUU+ulJk=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 27dc3c02b70bb..9943184bd1f36 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.41.1";
+    version = "3.41.2";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-25KQEvkAnn8Hlg5/AX6DLYeJop9LIDBxtP15Ip59eiA=";
+      hash = "sha256-hxkfzsuLcH2aEO2xNgdoYxfXFpwIC5vcXTnQY1g3bMw=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/template-glib/default.nix b/pkgs/development/libraries/template-glib/default.nix
index bbb5aef36f14c..fae25d959d3d0 100644
--- a/pkgs/development/libraries/template-glib/default.nix
+++ b/pkgs/development/libraries/template-glib/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "template-glib";
-  version = "3.36.0";
+  version = "3.36.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "HBKVJa5kQDpmL3Zm9jWDhqgVZohyrPEctWirObuh9CE=";
+    sha256 = "OxZ6Fzha10WvviD634EGxm0wxb10bVqh2b236AP2pQM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index fd4f3dea3750d..08eaad07b1215 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -38,9 +38,15 @@ tcl.mkTclDerivation {
     ++ lib.optional enableAqua "--enable-aqua";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = lib.optional enableAqua (with darwin.apple_sdk.frameworks; [ Cocoa ]);
+  buildInputs = [ ];
 
-  propagatedBuildInputs = [ libXft ];
+  propagatedBuildInputs = [
+    libXft
+  ] ++ lib.optionals enableAqua ([
+    darwin.apple_sdk.frameworks.Cocoa
+  ] ++ lib.optionals (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") [
+    darwin.apple_sdk.frameworks.UniformTypeIdentifiers
+  ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/tracker-miners/default.nix b/pkgs/development/libraries/tracker-miners/default.nix
index 59aa84b9518a5..b32df6b026a21 100644
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@@ -46,11 +46,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker-miners";
-  version = "3.4.3";
+  version = "3.5.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "jk85dkcmQbZI0PjyDeuuGxYpyltWC4YW4RfSnXVvvus=";
+    sha256 = "F5ZmA9xDKphSa0kFhqSKzX+fWZNfeJXfxRcppGppAaM=";
   };
 
   nativeBuildInputs = [
@@ -116,6 +116,7 @@ stdenv.mkDerivation rec {
     # to be safe due to the general state of the project
     "-Dminer_rss=false"
   ] ++ lib.optionals (!stdenv.isLinux) [
+    "-Dbattery_detection=none"
     "-Dnetwork_manager=disabled"
     "-Dsystemd_user_services=false"
   ];
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 2cf6cdf7ddbde..b933f8b97ad98 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -9,14 +9,14 @@
 , gobject-introspection
 , buildPackages
 , withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, vala
 , python3
-, docbook-xsl-nons
-, docbook_xml_dtd_45
+, gi-docgen
+, graphviz
 , libxml2
 , glib
 , wrapGAppsNoGuiHook
 , sqlite
-, libxslt
 , libstemmer
 , gnome
 , icu
@@ -31,19 +31,15 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker";
-  version = "3.4.2";
+  version = "3.5.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Tm3xQqT3BIePypjrtaIkdQ5epUaqKqq6pyanNUC9FzE=";
+    sha256 = "EylCddu7rZY0s6g5DAjm8Svr/oT2zK+3Kyewwjuo2i8=";
   };
 
-  postPatch = ''
-    patchShebangs utils/data-generators/cc/generate
-  '';
-
   strictDeps = true;
 
   depsBuildBuild = [
@@ -57,13 +53,13 @@ stdenv.mkDerivation rec {
     asciidoc
     gettext
     glib
-    libxslt
     wrapGAppsNoGuiHook
-    docbook-xsl-nons
-    docbook_xml_dtd_45
+    gi-docgen
+    graphviz
     (python3.pythonForBuild.withPackages (p: [ p.pygobject3 ]))
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
+    vala
   ];
 
   buildInputs = [
@@ -88,6 +84,7 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Ddocs=true"
     (lib.mesonEnable "introspection" withIntrospection)
+    (lib.mesonEnable "vapi" withIntrospection)
     (lib.mesonBool "test_utils" withIntrospection)
   ] ++ (
     let
@@ -104,7 +101,21 @@ stdenv.mkDerivation rec {
     "-Dsystemd_user_services=false"
   ];
 
-  doCheck = true;
+  doCheck =
+    # https://gitlab.gnome.org/GNOME/tracker/-/issues/397
+    !stdenv.isAarch64
+    # https://gitlab.gnome.org/GNOME/tracker/-/issues/398
+    && !stdenv.isi686;
+
+  postPatch = ''
+    chmod +x \
+      docs/reference/libtracker-sparql/embed-files.py \
+      docs/reference/libtracker-sparql/generate-svgs.sh
+    patchShebangs \
+      utils/data-generators/cc/generate \
+      docs/reference/libtracker-sparql/embed-files.py \
+      docs/reference/libtracker-sparql/generate-svgs.sh
+  '';
 
   preCheck =
     let
@@ -141,6 +152,11 @@ stdenv.mkDerivation rec {
     rm -r $out/lib
   '';
 
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index d331391ce0ed0..a8fed065198b3 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vte";
-  version = "0.70.3";
+  version = "0.72.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-lFcTSgLzFX/KBPfg05vbDzCZvgo86CtxOdDJioB0jyM=";
+    sha256 = "sha256-QP6RTWxw2zQXbJInJbbG6hXV88sqm0TFfiAKX5UKZzY=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index dc102c7e67821..68373413b30f3 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-mzxT6s4ZHShB9tGyyf8jDtVWVEclHPYW+9oKy7v0bC4=";
+    hash = "sha256-iitEA/x9QpbQrYTcV0OzBgnY6bQFhIm+mVq1ryIQ3+0=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 2c22211969df8..7cad0a38779ee 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "sdk-${version}";
-    hash = "sha256-4oxynsbFLmsrpI5NEs7gI50g0XVcaUWuZRn6JKB/+hA=";
+    hash = "sha256-DqgIg0jZxzhoyYrATDQMoNN/Pav9deKdltB7L0XDqPE=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/wayland/darwin.patch b/pkgs/development/libraries/wayland/darwin.patch
new file mode 100644
index 0000000000000..965294dfa5fff
--- /dev/null
+++ b/pkgs/development/libraries/wayland/darwin.patch
@@ -0,0 +1,74 @@
+diff --git a/meson.build b/meson.build
+index 35c3b95..f27e472 100644
+--- a/meson.build
++++ b/meson.build
+@@ -16,7 +16,7 @@ config_h.set_quoted('PACKAGE', meson.project_name())
+ config_h.set_quoted('PACKAGE_VERSION', meson.project_version())
+ 
+ cc_args = []
+-if host_machine.system() != 'freebsd'
++if host_machine.system() not in ['darwin', 'freebsd']
+ 	cc_args += ['-D_POSIX_C_SOURCE=200809L']
+ endif
+ add_project_arguments(cc_args, language: 'c')
+@@ -52,7 +52,7 @@ foreach f: have_funcs
+ endforeach
+ config_h.set10('HAVE_XUCRED_CR_PID', cc.has_member('struct xucred', 'cr_pid', prefix : '#include <sys/ucred.h>'))
+ have_broken_msg_cmsg_cloexec = false
+-if host_machine.system() == 'freebsd'
++if host_machine.system() in ['darwin', 'freebsd']
+ 	have_broken_msg_cmsg_cloexec = not cc.compiles('''
+ #include <sys/param.h> /* To get __FreeBSD_version. */
+ #if __FreeBSD_version < 1300502 || \
+@@ -69,7 +69,7 @@ endif
+ config_h.set10('HAVE_BROKEN_MSG_CMSG_CLOEXEC', have_broken_msg_cmsg_cloexec)
+ 
+ if get_option('libraries')
+-	if host_machine.system() == 'freebsd'
++	if host_machine.system() in ['darwin', 'freebsd']
+ 		# When building for FreeBSD, epoll(7) is provided by a userspace
+ 		# wrapper around kqueue(2).
+ 		epoll_dep = dependency('epoll-shim')
+diff --git a/src/event-loop.c b/src/event-loop.c
+index 37cf95d..49a38cb 100644
+--- a/src/event-loop.c
++++ b/src/event-loop.c
+@@ -48,6 +48,13 @@
+ 
+ #define TIMER_REMOVED -2
+ 
++#ifdef __APPLE__
++struct itimerspec {
++	struct timespec it_interval;
++	struct timespec it_value;
++};
++#endif
++
+ struct wl_event_loop;
+ struct wl_event_source_interface;
+ struct wl_event_source_timer;
+diff --git a/src/wayland-os.c b/src/wayland-os.c
+index a9066ca..483fe64 100644
+--- a/src/wayland-os.c
++++ b/src/wayland-os.c
+@@ -69,17 +69,19 @@ wl_os_socket_cloexec(int domain, int type, int protocol)
+ {
+ 	int fd;
+ 
++#ifdef SOCK_CLOEXEC
+ 	fd = socket(domain, type | SOCK_CLOEXEC, protocol);
+ 	if (fd >= 0)
+ 		return fd;
+ 	if (errno != EINVAL)
+ 		return -1;
++#endif
+ 
+ 	fd = socket(domain, type, protocol);
+ 	return set_cloexec_or_close(fd);
+ }
+ 
+-#if defined(__FreeBSD__)
++#if defined(__APPLE__) || defined(__FreeBSD__)
+ int
+ wl_os_socket_peercred(int sockfd, uid_t *uid, gid_t *gid, pid_t *pid)
+ {
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 0e01e571254cb..a7f0df16b2636 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -8,7 +8,7 @@
 , wayland-scanner
 , expat
 , libxml2
-, withLibraries ? stdenv.isLinux
+, withLibraries ? stdenv.isLinux || stdenv.isDarwin
 , withTests ? stdenv.isLinux
 , libffi
 , epoll-shim
@@ -41,6 +41,10 @@ stdenv.mkDerivation rec {
     sha256 = "1b0ixya9bfw5c9jx8mzlr7yqnlyvd3jv5z8wln9scdv8q5zlvikd";
   };
 
+  patches = [
+    ./darwin.patch
+  ];
+
   postPatch = lib.optionalString withDocumentation ''
     patchShebangs doc/doxygen/gen-doxygen.py
   '' + lib.optionalString stdenv.hostPlatform.isStatic ''
@@ -117,7 +121,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://wayland.freedesktop.org/";
     license = licenses.mit; # Expat version
-    platforms = if withLibraries then platforms.linux else platforms.unix;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ primeos codyopel qyliss ];
   };
 
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 73073a6b7117e..be3a5b26cabec 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -25,6 +25,7 @@
 , enchant2
 , xorg
 , libxkbcommon
+, libavif
 , libepoxy
 , at-spi2-core
 , libxml2
@@ -60,6 +61,7 @@
 , xdg-dbus-proxy
 , substituteAll
 , glib
+, unifdef
 , addOpenGLRunpath
 , enableGeoLocation ? true
 , withLibsecret ? true
@@ -69,8 +71,8 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.38.5";
-  name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "5.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
+  version = "2.40.0";
+  name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
 
   outputs = [ "out" "dev" "devdoc" ];
 
@@ -80,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-QMIMQwIidN9Yk/IrEFT6iUw+6gVzibsIruCMWwuwwac=";
+    hash = "sha256-pGB+ob+JZp6JscssY/quxRP5PeCbauYMxx1qiqt6s5M=";
   };
 
   patches = lib.optionals stdenv.isLinux [
@@ -90,8 +92,6 @@ stdenv.mkDerivation (finalAttrs: {
       inherit (addOpenGLRunpath) driverLink;
     })
 
-    ./libglvnd-headers.patch
-
     # Hardcode path to WPE backend
     # https://github.com/NixOS/nixpkgs/issues/110468
     (substituteAll {
@@ -122,6 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
     ruby
     gi-docgen
     glib # for gdbus-codegen
+    unifdef
   ] ++ lib.optionals stdenv.isLinux [
     wayland # for wayland-scanner
   ];
@@ -129,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     at-spi2-core
     enchant2
+    libavif
     libepoxy
     gnutls
     gst-plugins-bad
diff --git a/pkgs/development/libraries/webkitgtk/fdo-backend-path.patch b/pkgs/development/libraries/webkitgtk/fdo-backend-path.patch
index 9ddef67f1c1de..f46c0fe8a15c0 100644
--- a/pkgs/development/libraries/webkitgtk/fdo-backend-path.patch
+++ b/pkgs/development/libraries/webkitgtk/fdo-backend-path.patch
@@ -1,11 +1,11 @@
 --- a/Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp
 +++ b/Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp
-@@ -89,7 +89,7 @@
+@@ -84,7 +84,7 @@ void WebProcessPool::platformInitializeWebProcess(const WebProcessProxy& process
+ 
  #if PLATFORM(WAYLAND)
      if (WebCore::PlatformDisplay::sharedDisplay().type() == WebCore::PlatformDisplay::Type::Wayland) {
- #if USE(WPE_RENDERER)
 -        wpe_loader_init("libWPEBackend-fdo-1.0.so.1");
 +        wpe_loader_init("@wpebackend_fdo@/lib/libWPEBackend-fdo-1.0.so.1");
          if (AcceleratedBackingStoreWayland::checkRequirements()) {
-             parameters.hostClientFileDescriptor = IPC::Attachment(UnixFileDescriptor(wpe_renderer_host_create_client(), UnixFileDescriptor::Adopt));
+             parameters.hostClientFileDescriptor = UnixFileDescriptor { wpe_renderer_host_create_client(), UnixFileDescriptor::Adopt };
              parameters.implementationLibraryName = FileSystem::fileSystemRepresentation(String::fromLatin1(wpe_loader_get_loaded_implementation_library_name()));
diff --git a/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch b/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch
deleted file mode 100644
index 8d7f2477b55af..0000000000000
--- a/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp b/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
-index 8d848ce4..46d42c11 100644
---- a/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
-+++ b/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
-@@ -31,6 +31,7 @@
- #include "WebKitWaylandServerProtocol.h"
- #include <EGL/egl.h>
- #include <EGL/eglext.h>
-+#include <EGL/eglmesaext.h>
- #include <WebCore/GLContext.h>
- #include <WebCore/PlatformDisplayWayland.h>
- #include <WebCore/Region.h>
diff --git a/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix b/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
index 5f1b7f3f34d1a..3848f1cc953b3 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-gnome";
-  version = "43.1";
+  version = "44.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Ca22bG2RU+bwXfZtqirWKl3g42Zl6dIpUXO7DdxTtM0=";
+    sha256 = "VQEeV/ZLfK8IN0Be+gNKM2uec965+E5cFMyfeo4OezQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/perl-modules/Po4a/default.nix b/pkgs/development/perl-modules/Po4a/default.nix
index 99c100455a8a0..f08b5b2361a3b 100644
--- a/pkgs/development/perl-modules/Po4a/default.nix
+++ b/pkgs/development/perl-modules/Po4a/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, lib, fetchurl, docbook_xsl, docbook_xsl_ns, gettext, libxslt, glibcLocales, docbook_xml_dtd_412, docbook_sgml_dtd_41, texlive, opensp, bash
+{ stdenv, lib, fetchurl, docbook_xsl, docbook_xsl_ns, gettext, libxslt, glibcLocales, docbook_xml_dtd_412, docbook_sgml_dtd_41, opensp, bash
 , perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny
-, fetchpatch
+, fetchpatch, writeShellScriptBin
 }:
 
 buildPerlPackage rec {
@@ -20,7 +20,15 @@ buildPerlPackage rec {
   ];
 
   strictDeps = true;
-  nativeBuildInputs = [ gettext libxslt docbook_xsl docbook_xsl_ns ModuleBuild docbook_xml_dtd_412 docbook_sgml_dtd_41 opensp texlive.combined.scheme-basic glibcLocales ];
+  nativeBuildInputs =
+    # the tests for the tex-format use kpsewhich -- texlive's file finding utility.
+    # We don't want to depend on texlive here, so we replace it with a minimal
+    # shellscript that suffices for the tests in t/fmt/tex/, i.e. it looks up
+    # article.cls to an existing file, but doesn't find article-wrong.cls.
+    let kpsewhich-stub = writeShellScriptBin "kpsewhich"
+      ''[[ $1 = "article.cls" ]] && echo /dev/null'';
+    in
+    [ gettext libxslt docbook_xsl docbook_xsl_ns ModuleBuild docbook_xml_dtd_412 docbook_sgml_dtd_41 opensp kpsewhich-stub glibcLocales ];
   propagatedBuildInputs = lib.optional (!stdenv.hostPlatform.isMusl) TextWrapI18N ++ [ LocaleGettext SGMLSpm UnicodeLineBreak PodParser YAMLTiny ];
   # TODO: TermReadKey was temporarily removed from propagatedBuildInputs to unfreeze the build
   buildInputs = [ bash ];
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index a6e836b9ba297..4f4cfea37c34e 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -24,12 +24,12 @@ let
 
 in buildPythonPackage rec {
   pname = "cython";
-  version = "0.29.33";
+  version = "0.29.34";
 
   src = fetchPypi {
     pname = "Cython";
     inherit version;
-    hash = "sha256-UEB2TEpNLOlko5XaJPDRrlgUSZXauSxrlvRMP01yKGo=";
+    hash = "sha256-GQloj117Uhpgw5bSC7qeR6Gy0nhL+whUAeHh59KaKag=";
   };
 
   nativeBuildInputs = [
@@ -74,6 +74,10 @@ in buildPythonPackage rec {
   doCheck = false;
   # doCheck = !stdenv.isDarwin;
 
+  # force regeneration of generated code in source distributions
+  # https://github.com/cython/cython/issues/5089
+  setupHook = ./setup-hook.sh;
+
   meta = {
     changelog = "https://github.com/cython/cython/blob/${version}/CHANGES.rst";
     description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
diff --git a/pkgs/development/python-modules/Cython/setup-hook.sh b/pkgs/development/python-modules/Cython/setup-hook.sh
new file mode 100644
index 0000000000000..c26330a536446
--- /dev/null
+++ b/pkgs/development/python-modules/Cython/setup-hook.sh
@@ -0,0 +1,3 @@
+if [ -z "${dontForceRegenCython-}"]; then
+  export CYTHON_FORCE_REGEN=1
+fi
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 9fcca373c38bd..91ab8c040fdb3 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -23,6 +23,7 @@
 , freezegun
 , gunicorn
 , pytest-mock
+, pytest-xdist
 , pytestCheckHook
 , re-assert
 , trustme
@@ -79,6 +80,7 @@ buildPythonPackage rec {
     freezegun
     gunicorn
     pytest-mock
+    pytest-xdist
     pytestCheckHook
     re-assert
   ] ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) [
@@ -116,7 +118,7 @@ buildPythonPackage rec {
   '' + lib.optionalString stdenv.isDarwin ''
     # Work around "OSError: AF_UNIX path too long"
     export TMPDIR="/tmp"
-   '';
+  '';
 
   meta = with lib; {
     changelog = "https://github.com/aio-libs/aiohttp/blob/v${version}/CHANGES.rst";
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 83b5d27655c7f..4f44f1bd6de13 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -2,7 +2,6 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pythonOlder
 , setuptools
 , setuptools-scm
@@ -13,6 +12,7 @@
 , hypothesis
 , mock
 , pytest-mock
+, pytest-xdist
 , pytestCheckHook
 , trio
 , trustme
@@ -55,6 +55,7 @@ buildPythonPackage rec {
     curio
     hypothesis
     pytest-mock
+    pytest-xdist
     pytestCheckHook
     trio
     trustme
diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index c4e19328f435f..dca0cfff0e485 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -1,15 +1,15 @@
 { lib
 , stdenv
-, async-timeout
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, typing-extensions
 }:
 
 buildPythonPackage rec {
-  version = "3.5.2";
+  version = "3.6.0";
   pname = "asgiref";
   format = "setuptools";
 
@@ -17,13 +17,13 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "django";
-    repo = pname;
-    rev = version;
-    hash = "sha256-56suF63ePRDprqODhVIPCEGiO8UGgWrpwg2wYEs6OOE=";
+    repo = "asgiref";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Kl4483rfuFKbnD7pBSTND1QAtBsZP6jKsrDlpVCZLDs=";
   };
 
   propagatedBuildInputs = [
-    async-timeout
+    typing-extensions
   ];
 
   nativeCheckInputs = [
@@ -40,6 +40,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "asgiref" ];
 
   meta = with lib; {
+    changelog = "https://github.com/django/asgiref/blob/${src.rev}/CHANGELOG.txt";
     description = "Reference ASGI adapters and channel layers";
     homepage = "https://github.com/django/asgiref";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/bcrypt/default.nix b/pkgs/development/python-modules/bcrypt/default.nix
index adde33b70f6d9..d0084146003cf 100644
--- a/pkgs/development/python-modules/bcrypt/default.nix
+++ b/pkgs/development/python-modules/bcrypt/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "bcrypt";
-  version = "4.0.0";
+  version = "4.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xZwXD8kiX6rQTd4bph2FtBOUbozi5fX1/zDf1nKD8xk=";
+    hash = "sha256-J9N1kDrIJhz+QEf2cJ0W99GNObHskqr3KvmJVSplDr0=";
   };
 
   cargoRoot = "src/_bcrypt";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-HvfRLyUhlXVuvxWrtSDKx3rMKJbjvuiMcDY6g+pYFS0=";
+    hash = "sha256-lDWX69YENZFMu7pyBmavUZaalGvFqbHSHfkwkzmDQaY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index 96f2334935c6b..d0d6280e4e0cc 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -26,13 +26,13 @@
 
 buildPythonPackage rec {
   pname = "certbot";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LhipH6kw/fKBy+nHrC5F7HtCdDbUWSjL85LiEC1bGT8=";
+    hash = "sha256-BQsdhlYABZtz5+SORiCVnWMZdMmiWGM9W1YLqObyFo8=";
   };
 
   sourceRoot = "source/${pname}";
diff --git a/pkgs/development/python-modules/channels/default.nix b/pkgs/development/python-modules/channels/default.nix
index 3b800877be976..083a79284f24b 100644
--- a/pkgs/development/python-modules/channels/default.nix
+++ b/pkgs/development/python-modules/channels/default.nix
@@ -4,6 +4,7 @@
 , daphne
 , django
 , fetchFromGitHub
+, async-timeout
 , pytest-asyncio
 , pytest-django
 , pytestCheckHook
@@ -36,6 +37,7 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
+    async-timeout
     pytest-asyncio
     pytest-django
     pytestCheckHook
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index ba2407923f33a..578d13acf43d1 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -11,6 +11,7 @@
 , six
 , isPyPy
 , cffi
+, pkg-config
 , pytestCheckHook
 , pytest-benchmark
 , pytest-subtests
@@ -28,26 +29,27 @@ let
 in
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "39.0.1"; # Also update the hash in vectors.nix
+  version = "40.0.1"; # Also update the hash in vectors.nix
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0fYZjubZFIQF5JiHgDkH/olioj5sb4PqfZjxwN43VpU=";
+    hash = "sha256-KAPy+LHpX2FEGZJsfm9V2CivxhTKXtYVQ4d65mjMNHI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-0x+KIqJznDEyIUqVuYfIESKmHBWfzirPeX2R/cWlngc=";
+    hash = "sha256-gFfDTc2QWBWHBCycVH1dYlCsWQMVcRZfOBIau+njtDU=";
   };
 
   cargoRoot = "src/rust";
 
   nativeBuildInputs = lib.optionals (!isPyPy) [
     cffi
+    pkg-config
   ] ++ [
     rustPlatform.cargoSetupHook
     setuptools-rust
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index b054f89aa3a6d..71bd22bf738f0 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -9,7 +9,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-DLrrUL2388nXqTsmoEYu9ul8doynjZAoVP4EXDC2gMY=";
+    hash = "sha256-hGBwa1tdDOSoVXHKM4nPiPcAu2oMYTPcn+D1ovW9oEE=";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/distlib/default.nix b/pkgs/development/python-modules/distlib/default.nix
index ae14cc008c8d7..f9668720653b5 100644
--- a/pkgs/development/python-modules/distlib/default.nix
+++ b/pkgs/development/python-modules/distlib/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , setuptools
@@ -18,6 +19,10 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  postFixup = lib.optionalString (!stdenv.targetPlatform.isWindows) ''
+    find $out -name '*.exe' -delete
+  '';
+
   pythonImportsCheck = [
     "distlib"
     "distlib.database"
@@ -39,4 +44,3 @@ buildPythonPackage rec {
     maintainers = with maintainers; [ lnl7 ];
   };
 }
-
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index db702d0ed7a67..26b7391c51efd 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -9,32 +9,31 @@
 , setuptools
 
 # patched in
-, fetchpatch
 , geos
 , gdal
 , withGdal ? false
 
-# propagated
+# propagates
 , asgiref
-, backports-zoneinfo
 , sqlparse
 
-# tests
-, aiosmtpd
+# extras
 , argon2-cffi
 , bcrypt
+
+# tests
+, aiosmtpd
 , docutils
 , geoip2
 , jinja2
-, python-memcached
 , numpy
 , pillow
 , pylibmc
 , pymemcache
 , python
-, pytz
 , pywatchman
 , pyyaml
+, pytz
 , redis
 , selenium
 , tblib
@@ -43,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.1.7";
+  version = "4.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RPcUuBxfGQ2dLdrQGlMv5QL6AcTLj68dCB9CZO0V3Ng=";
+    hash = "sha256-w24qsSgk4qw2r6iyUVpwxTx3QvDW6u+nMR7DeVWNuZc=";
   };
 
   patches = [
@@ -58,6 +57,9 @@ buildPythonPackage rec {
       src = ./django_4_set_zoneinfo_dir.patch;
       zoneinfo = tzdata + "/share/zoneinfo";
     })
+    # make sure the tests don't remove packages from our pythonpath
+    # and disable failing tests
+    ./django_4_tests.patch
   ] ++ lib.optionals withGdal [
     (substituteAll {
       src = ./django_4_set_geos_gdal_lib.patch;
@@ -67,6 +69,11 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace tests/utils_tests/test_autoreload.py \
+      --replace "/usr/bin/python" "${python.interpreter}"
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
@@ -74,44 +81,58 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     asgiref
     sqlparse
-  ] ++ lib.optionals (pythonOlder "3.9") [
-    backports-zoneinfo
   ];
 
-  # Fails to import asgiref in ~200 tests
-  # ModuleNotFoundError: No module named 'asgiref'
-  doCheck = false;
+  passthru.optional-dependencies = {
+    argon2 = [
+      argon2-cffi
+    ];
+    bcrypt = [
+      bcrypt
+    ];
+  };
 
   nativeCheckInputs = [
+    # tests/requirements/py3.txt
     aiosmtpd
-    argon2-cffi
-    asgiref
-    bcrypt
     docutils
     geoip2
     jinja2
-    python-memcached
     numpy
     pillow
     pylibmc
     pymemcache
-    pytz
     pywatchman
     pyyaml
+    pytz
     redis
     selenium
     tblib
     tzdata
-  ];
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  doCheck = !stdenv.isDarwin;
+
+  preCheck = ''
+    # make sure the installed library gets imported
+    rm -rf django
+
+    # provide timezone data, works only on linux
+    export TZDIR=${tzdata}/${python.sitePackages}/tzdata/zoneinfo
+  '';
 
   checkPhase = ''
     runHook preCheck
 
-    ${python.interpreter} tests/runtests.py
+    pushd tests
+    ${python.interpreter} runtests.py --settings=test_sqlite
+    popd
 
     runHook postCheck
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     changelog = "https://docs.djangoproject.com/en/${lib.versions.majorMinor version}/releases/${version}/";
     description = "A high-level Python Web framework that encourages rapid development and clean, pragmatic design.";
diff --git a/pkgs/development/python-modules/django/django_4_tests.patch b/pkgs/development/python-modules/django/django_4_tests.patch
new file mode 100644
index 0000000000000..689e1ed652a8e
--- /dev/null
+++ b/pkgs/development/python-modules/django/django_4_tests.patch
@@ -0,0 +1,51 @@
+diff --git a/tests/admin_scripts/tests.py b/tests/admin_scripts/tests.py
+index 6d67c2931a..0c1f407f88 100644
+--- a/tests/admin_scripts/tests.py
++++ b/tests/admin_scripts/tests.py
+@@ -127,6 +127,7 @@ class AdminScriptTestCase(SimpleTestCase):
+             del test_environ["DJANGO_SETTINGS_MODULE"]
+         python_path = [base_dir, django_dir, tests_dir]
+         python_path.extend(ext_backend_base_dirs)
++        python_path.extend(sys.path)
+         test_environ["PYTHONPATH"] = os.pathsep.join(python_path)
+         test_environ["PYTHONWARNINGS"] = ""
+ 
+diff --git a/tests/auth_tests/test_hashers.py b/tests/auth_tests/test_hashers.py
+index 36f22d5f09..6cc6888980 100644
+--- a/tests/auth_tests/test_hashers.py
++++ b/tests/auth_tests/test_hashers.py
+@@ -1,4 +1,4 @@
+-from unittest import mock, skipUnless
++from unittest import mock, skipUnless, skip
+ 
+ from django.conf.global_settings import PASSWORD_HASHERS
+ from django.contrib.auth.hashers import (
+@@ -241,6 +241,7 @@ class TestUtilsHashPass(SimpleTestCase):
+ 
+     @ignore_warnings(category=RemovedInDjango50Warning)
+     @skipUnless(crypt, "no crypt module to generate password.")
++    @skip("Legacy crypt algorithms are unsupported in nixpkgs")
+     @override_settings(
+         PASSWORD_HASHERS=["django.contrib.auth.hashers.CryptPasswordHasher"]
+     )
+diff --git a/tests/settings_tests/tests.py b/tests/settings_tests/tests.py
+index 62cbffbee9..2f0ec718f8 100644
+--- a/tests/settings_tests/tests.py
++++ b/tests/settings_tests/tests.py
+@@ -2,7 +2,7 @@ import os
+ import sys
+ import unittest
+ from types import ModuleType, SimpleNamespace
+-from unittest import mock
++from unittest import mock, skip
+ 
+ from django.conf import (
+     ENVIRONMENT_VARIABLE,
+@@ -342,6 +342,7 @@ class SettingsTests(SimpleTestCase):
+             getattr(s, "foo")
+ 
+     @requires_tz_support
++    @skip("Assertion fails, exception does not get raised")
+     @mock.patch("django.conf.global_settings.TIME_ZONE", "test")
+     def test_incorrect_timezone(self):
+         with self.assertRaisesMessage(ValueError, "Incorrect timezone setting: test"):
diff --git a/pkgs/development/python-modules/dogtag-pki/default.nix b/pkgs/development/python-modules/dogtag-pki/default.nix
new file mode 100644
index 0000000000000..db41cf80847b5
--- /dev/null
+++ b/pkgs/development/python-modules/dogtag-pki/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, lib, fetchPypi, buildPythonPackage, cryptography,
+python-ldap, requests, six }:
+
+buildPythonPackage rec {
+  pname = "dogtag-pki";
+  version = "11.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-rQSnQPNYr5SyeNbKoFAbnGb2X/8utrfWLa8gu93hy2w=";
+  };
+
+  buildInputs = [ cryptography python-ldap ];
+  pythonImportsCheck = [ "pki" ];
+  propagatedBuildInputs = [ requests six ];
+
+  meta = with lib; {
+    description = "An enterprise-class Certificate Authority";
+    homepage    = "https://github.com/dogtagpki/pki";
+    license     = licenses.gpl2;
+    maintainers = with maintainers; [ s1341 ];
+  };
+}
diff --git a/pkgs/development/python-modules/httpcore/default.nix b/pkgs/development/python-modules/httpcore/default.nix
index 171acd803c552..863a56317055e 100644
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@@ -68,6 +68,8 @@ buildPythonPackage rec {
     "--asyncio-mode=strict"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "A minimal low-level HTTP client";
     homepage = "https://github.com/encode/httpcore";
diff --git a/pkgs/development/python-modules/jedi/default.nix b/pkgs/development/python-modules/jedi/default.nix
index 83efa565ddf57..d12691c177f04 100644
--- a/pkgs/development/python-modules/jedi/default.nix
+++ b/pkgs/development/python-modules/jedi/default.nix
@@ -5,7 +5,7 @@
 , pythonOlder
 , fetchFromGitHub
 , attrs
-, django
+, django_3
 , pytestCheckHook
 , parso
 }:
@@ -29,7 +29,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     attrs
-    django
+    django_3
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/jsonschema-spec/default.nix b/pkgs/development/python-modules/jsonschema-spec/default.nix
index e0220c640d437..2d7d82fd6e46e 100644
--- a/pkgs/development/python-modules/jsonschema-spec/default.nix
+++ b/pkgs/development/python-modules/jsonschema-spec/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "jsonschema-spec";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "p1c2u";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-vDuIMzl9w7/e6r3AYleGVV5RRjrXDSvY6IBhtLuAFIs=";
+    hash = "sha256-kLCV9WPWGrVgpbueafMVqtGmj3ifrBzTChE2kyxpyZk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/markdown/default.nix b/pkgs/development/python-modules/markdown/default.nix
index b9e8f8df517fb..9ad29d3a2c212 100644
--- a/pkgs/development/python-modules/markdown/default.nix
+++ b/pkgs/development/python-modules/markdown/default.nix
@@ -1,26 +1,34 @@
 { lib
 , buildPythonPackage
 , pythonOlder
-, fetchPypi
+, fetchFromGitHub
 , importlib-metadata
 , pyyaml
+, setuptools
 , unittestCheckHook
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "markdown";
-  version = "3.4.1";
+  version = "3.4.3";
 
   disabled = pythonOlder "3.7";
 
-  format = "setuptools";
+  format = "pyproject";
 
-  src = fetchPypi {
-    pname = "Markdown";
-    inherit version;
-    sha256 = "3b809086bb6efad416156e00a0da66fe47618a5d6918dd688f53f40c8e4cfeff";
+  src = fetchFromGitHub {
+    owner = "Python-Markdown";
+    repo = "markdown";
+    rev = "refs/tags/${version}";
+    hash = "sha256-o2MDsrSkR0fMA5I8AoQcJrpwNGO5lXJn8O47tQN7U6o=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ];
@@ -30,7 +38,8 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "markdown" ];
 
   meta = with lib; {
-    description = "A Python implementation of John Gruber's Markdown with Extension support";
+    changelog = "https://github.com/Python-Markdown/markdown/blob/${src.rev}/docs/change_log/index.md";
+    description = "Python implementation of John Gruber's Markdown";
     homepage = "https://github.com/Python-Markdown/markdown";
     license = licenses.bsd3;
     maintainers = with maintainers; [ dotlambda ];
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index b029b4cd26541..1fd70739b4c80 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -135,7 +135,6 @@ buildPythonPackage rec {
     libX11
     tcl
     tk
-    tkinter
   ] ++ lib.optionals stdenv.isDarwin [
     Cocoa
   ];
@@ -167,6 +166,8 @@ buildPythonPackage rec {
     tornado
   ] ++ lib.optionals enableNbagg [
     ipykernel
+  ] ++ lib.optionals enableTk [
+    tkinter
   ];
 
   passthru.config = {
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 2836b39e07a1f..61a545b0d481e 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.8.6";
+  version = "3.8.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,13 +25,13 @@ buildPythonPackage rec {
     owner = "ijl";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-LwLuMcnAubO7U1/KSe6tHaSP9+bi6gDfvGobixzL2gM=";
+    hash = "sha256-0/yvXXj+z2jBEAGxO4BxMnx1zqUoultYSYfSkKs+hKY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-8T//q6nQoZhh8oJWDCeQf3gYRew58dXAaxkYELY4CJM=";
+    hash = "sha256-ogkTRRykLF2dTOxilsfwsRH+Au/O0e1kL1e9sFOFLeY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index c2a7f15402cb5..cf264c504353a 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -6,6 +6,7 @@
 , cryptography
 , pytestCheckHook
 , pythonOlder
+, pytest-xdist
 }:
 
 buildPythonPackage rec {
@@ -28,6 +29,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-xdist
   ] ++ passthru.optional-dependencies.argon2
   ++ passthru.optional-dependencies.bcrypt
   ++ passthru.optional-dependencies.totp;
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 5532816a9c128..c77c31faa9603 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -42,15 +42,19 @@ buildPythonPackage rec {
   # - cpu_times was flaky on darwin
   # - the other disabled tests are likely due to sanboxing (missing specific errors)
   pytestFlagsArray = [
+    # Note: $out must be referenced as test import paths are relative
     "$out/${python.sitePackages}/psutil/tests/test_system.py"
   ];
 
-  # Note: $out must be referenced as test import paths are relative
   disabledTests = [
+    # Some of the tests have build-system hardware-based impurities (like
+    # reading temperature sensor values).  Disable them to avoid the failures
+    # that sometimes result.
     "cpu_freq"
     "cpu_times"
     "disk_io_counters"
     "sensors_battery"
+    "sensors_temperatures"
     "user"
     "test_disk_partitions" # problematic on Hydra's Linux builders, apparently
   ];
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index a5154a3e4abd9..9727c4f2ada8d 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.10.3";
+  version = "2.10.4";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Rlr6Ec6BEujTxQkQ9UP+6u0cYeFsJlj7U346MtRM6QM=";
+    hash = "sha256-n7nLEG2+sSR9wnxM+C8FWc2B+Mx74Pan1+IQf+h2bGU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index 893fd1e64564a..b8337aea56215 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.42.2";
+  version = "3.44.1";
 
   outputs = [ "out" "dev" ];
 
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "rehpXipwc4Sd0DFtMdhyjhXh4Lxx2f9tHAnoa+UryVc=";
+    sha256 = "PGgF0TIb6QzDLmSCFaViQw4NPW7c2o9MXnqdr/ytVxA=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index ec6acefeb49de..df5416ad993c9 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "23.0.0";
+  version = "23.1.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "pyOpenSSL";
     inherit version;
-    hash = "sha256-wcxfhrys78hNrafTEXXK4bFRjV9g09C7WVpngiqGim8=";
+    hash = "sha256-hBSYub7GFiOxtsR+u8AjZ8B9YODhlfGXkIF/EMyNsLc=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/pytest-httpbin/default.nix b/pkgs/development/python-modules/pytest-httpbin/default.nix
index 0020076a1b33c..edfc988cc6c32 100644
--- a/pkgs/development/python-modules/pytest-httpbin/default.nix
+++ b/pkgs/development/python-modules/pytest-httpbin/default.nix
@@ -43,6 +43,8 @@ buildPythonPackage rec {
     requests
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [
     "pytest_httpbin"
   ];
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index 32827333838fc..a0aac8a9d08a0 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "11.1.1";
+  version = "11.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rKtEft/3wpp2uEECB8SNoBQGoWFlPJmjJc9XA9ROsWI=";
+    hash = "sha256-VWEWYehz8cr6OEyC8I0HiDlU9LdkNfS4pbRwwZVFc94=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index 1c4a5b9033eb8..61f12a792d98e 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-xdist";
-  version = "3.2.0";
+  version = "3.2.1";
   disabled = pythonOlder "3.7";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+hD5WiVkzZFlLy0TJyUYPDtZDZ/c3sCdNnc4bs9MHOk=";
+    hash = "sha256-GEm9mNiyQrlI5HLbdHjgkL8zYZEqj+2HmS7ZQIX1Ryc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index b8594e51f8391..474403355f53e 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2022.7.1";
+  version = "2023.2";
 
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AaBoHEuWhKKDBGFeulXRqzGuAL9o7BV+w3CKgYLbvNA=";
+    hash = "sha256-on3PYSwF0uveYm99UGVV8Q38gVs+3cz6rfx9mbEcmgc=";
   };
 
   nativeCheckInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index bd2a9be69b67f..4a365b86dadb0 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -55,6 +55,9 @@ buildPythonPackage rec {
     export SKLEARN_BUILD_PARALLEL=$NIX_BUILD_CORES
   '';
 
+  # TODO: a proper fix?  See around PR #225220
+  NIX_LDFLAGS = if stdenv.cc.isGNU then "-L${stdenv.cc.cc.lib}/lib" else null;
+
   doCheck = !stdenv.isAarch64;
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index 06a638737f6b8..88d8d66cda5f4 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "sphinx-autodoc-typehints";
-  version = "1.23.4";
+  version = "1.22";
 in
 
 buildPythonPackage {
@@ -22,7 +22,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "sphinx_autodoc_typehints";
     inherit version;
-    hash = "sha256-tHw6aQ0QGiWdmqkgzFfH6nn7cF15bA1Xyxfpm9HYCjQ=";
+    hash = "sha256-cfyi1e7psDQgTkxoarILTY9euUCTliFryubIfDjhjqY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 85bfccf8e0eb6..691b67df1696b 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -1,8 +1,8 @@
-{ stdenv
-, lib
+{ lib
 , isPyPy
 , pythonOlder
 , fetchPypi
+, fetchFromGitHub
 , buildPythonPackage
 
 # build
@@ -14,6 +14,7 @@
 , typing-extensions
 
 # optionals
+, aiomysql
 , aiosqlite
 , asyncmy
 , asyncpg
@@ -40,14 +41,16 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "2.0.6";
+  version = "2.0.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-w0PwtUZJX116I5xwv1CpmkjXMhwWW4Kvr6hIO56+v24=";
+  src = fetchFromGitHub {
+    owner = "sqlalchemy";
+    repo = "sqlalchemy";
+    rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
+    hash = "sha256-0WlRZ7Kv6owtZB+PDFKk+8dxEL4p3QQrRPq8eQd2PqM=";
   };
 
   nativeBuildInputs =[
@@ -61,7 +64,7 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
-  passthru.optional-dependencies = rec {
+  passthru.optional-dependencies = lib.fix (self: {
     asyncio = [
       greenlet
     ];
@@ -100,7 +103,7 @@ buildPythonPackage rec {
     ];
     postgresql_asyncpg = [
       asyncpg
-    ] ++ asyncio;
+    ] ++ self.asyncio;
     postgresql_psycopg2binary = [
       psycopg2
     ];
@@ -115,18 +118,18 @@ buildPythonPackage rec {
     ];
     aiomysql = [
       aiomysql
-    ] ++ asyncio;
+    ] ++ self.asyncio;
     asyncmy = [
       asyncmy
-    ] ++ asyncio;
+    ] ++ self.asyncio;
     aiosqlite = [
       aiosqlite
       typing-extensions
-    ] ++ asyncio;
+    ] ++ self.asyncio;
     sqlcipher = [
       # TODO: sqlcipher3
     ];
-  };
+  });
 
   nativeCheckInputs = [
     pytest-xdist
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index f479bc18d2e48..15d2df441435a 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -1,5 +1,5 @@
 { stdenv, bazel_5, buildBazelPackage, isPy3k, lib, fetchFromGitHub, symlinkJoin
-, addOpenGLRunpath, fetchpatch, patchelfUnstable
+, addOpenGLRunpath, fetchpatch
 # Python deps
 , buildPythonPackage, pythonOlder, python
 # Python libraries
@@ -530,8 +530,7 @@ in buildPythonPackage {
     tensorboard
   ];
 
-  # remove patchelfUnstable once patchelf 0.14 with https://github.com/NixOS/patchelf/pull/256 becomes the default
-  nativeBuildInputs = lib.optionals cudaSupport [ addOpenGLRunpath patchelfUnstable ];
+  nativeBuildInputs = lib.optionals cudaSupport [ addOpenGLRunpath ];
 
   postFixup = lib.optionalString cudaSupport ''
     find $out -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
diff --git a/pkgs/development/python-modules/testpath/default.nix b/pkgs/development/python-modules/testpath/default.nix
index 3ce8342084158..5635a61561594 100644
--- a/pkgs/development/python-modules/testpath/default.nix
+++ b/pkgs/development/python-modules/testpath/default.nix
@@ -24,6 +24,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  # exe are only required when testpath is used on windows
+  # https://github.com/jupyter/testpath/blob/de8ca59539eb23b9781e55848b7d2646c8c61df9/testpath/commands.py#L128
+  preBuild = lib.optionalString (!stdenv.targetPlatform.isWindows) ''
+    rm testpath/cli-32.exe testpath/cli-64.exe
+  '';
+
   preCheck = lib.optionalString stdenv.isDarwin ''
     # Work around https://github.com/jupyter/testpath/issues/24
     export TMPDIR="/tmp"
diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index 7ae99a98d2285..c2a6171e1b810 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -14,6 +14,7 @@
 buildPythonPackage rec {
   pname = "typeguard";
   version = "2.13.3";
+  disabled = pythonOlder "3.5";
   outputs = [ "out" "doc" ];
 
   src = fetchPypi {
@@ -21,15 +22,15 @@ buildPythonPackage rec {
     sha256 = "00edaa8da3a133674796cf5ea87d9f4b4c367d77476e185e80251cc13dfbb8c4";
   };
 
-  buildInputs = [ setuptools-scm ];
   nativeBuildInputs = [
     glibcLocales
+    setuptools-scm
     sphinxHook
     sphinx-autodoc-typehints
     sphinx-rtd-theme
   ];
 
-  LC_ALL="en_US.utf-8";
+  LC_ALL = "en_US.utf-8";
 
   postPatch = ''
     substituteInPlace setup.cfg --replace " --cov" ""
@@ -47,11 +48,10 @@ buildPythonPackage rec {
     "test_typed_dict"
   ];
 
-  disabled = pythonOlder "3.3";
-
   meta = with lib; {
     description = "This library provides run-time type checking for functions defined with argument type annotations";
     homepage = "https://github.com/agronholm/typeguard";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/yubico/default.nix b/pkgs/development/python-modules/yubico/default.nix
new file mode 100644
index 0000000000000..0fe6a90bfd7fc
--- /dev/null
+++ b/pkgs/development/python-modules/yubico/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi, pytestCheckHook, pyusb }:
+
+buildPythonPackage rec {
+  pname = "python-yubico";
+  version = "1.3.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1gd3an1cdcq328nr1c9ijrsf32v0crv6dgq7knld8m9cadj517c7";
+  };
+
+  propagatedBuildInputs = [ pyusb ];
+
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "yubico" ];
+
+  disabledTests = [
+    "usb" # requires a physical yubikey to test
+  ];
+
+  meta = with lib; {
+    description = "Python code to talk to YubiKeys";
+    homepage    = "https://github.com/Yubico/python-yubico";
+    license     = licenses.bsd2;
+    maintainers = with maintainers; [ s1341 ];
+  };
+}
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 749ccf0a29c73..5a64808f5f16a 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.8";
-  source.sha256 = "sha256-/oLW+JPyFz4TIykm4rnOtvZwJ8fxZr/B49bsfZaZoWQ=";
+  version = "2.4.10";
+  source.sha256 = "sha256-uYBvqUQGOmqGdqj57Ux8d2o2w7yC8mxXYIZ6AoW0oSE=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/misc/ccache/default.nix b/pkgs/development/tools/misc/ccache/default.nix
index df12d6c2c72cd..ef498f6f6e08b 100644
--- a/pkgs/development/tools/misc/ccache/default.nix
+++ b/pkgs/development/tools/misc/ccache/default.nix
@@ -74,7 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
     # A derivation that provides gcc and g++ commands, but that
     # will end up calling ccache for the given cacheDir
     links = { unwrappedCC, extraConfig }: stdenv.mkDerivation {
-      name = "ccache-links";
+      pname = "ccache-links";
+      inherit (finalAttrs) version;
       passthru = {
         isClang = unwrappedCC.isClang or false;
         isGNU = unwrappedCC.isGNU or false;
diff --git a/pkgs/development/tools/misc/d-spy/default.nix b/pkgs/development/tools/misc/d-spy/default.nix
index 43be248244d71..e89bad9ce4904 100644
--- a/pkgs/development/tools/misc/d-spy/default.nix
+++ b/pkgs/development/tools/misc/d-spy/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "d-spy";
-  version = "1.4.0";
+  version = "1.6.0";
 
   outputs = [ "out" "lib" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/d-spy/${lib.versions.majorMinor version}/d-spy-${version}.tar.xz";
-    sha256 = "6uh0jOpiTFxMdeAhwt8dc3bk+fj76JrEQ0kR7PeIZ3I=";
+    sha256 = "otCiEFE7tGRw0A40VEeRIIMwFT9Ms0+FhxcpEaxPiv0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/profiling/sysprof/default.nix b/pkgs/development/tools/profiling/sysprof/default.nix
index fed8af725fbc3..94293fe852950 100644
--- a/pkgs/development/tools/profiling/sysprof/default.nix
+++ b/pkgs/development/tools/profiling/sysprof/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sysprof";
-  version = "3.46.0";
+  version = "3.48.0";
 
   outputs = [ "out" "lib" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "PkMNV4FQqN0LB1sX0vzBunBNQogCYvDMZR8z5JO+QHE=";
+    sha256 = "B9kIGmbPL7UnU/SP8rha2nXGD/G8GvG9FNiutieXIWg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index e5c32722807de..8198a8b413c33 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "0.14.15";
+  version = "0.14.16";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-+Fb0oaUr8oL5L3uGxN8jojrc6lQ3eTYqzVg4qNITQRA=";
+    hash = "sha256-I7hZctfBsynO6Aii20nIEbhaJVeOlUsJr8W5sgBCTaU=";
   };
 
-  cargoHash = "sha256-HBHcoQT1rBd2DKMwQdBLS3r8QhMowdv6fBcsABGW9Xw=";
+  cargoHash = "sha256-m5rXNnVuVrhyWVJP7wpVFY4eflrTZs314UBhf2JC6D8=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index 94edc184b57c4..caaef7e995616 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -23,8 +23,6 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-cG5g+rNGqCVMlQqNXhP40OtCqkYwTG/C4C353e4z2cU=";
   };
 
-  auditable = true; # TODO: remove when this is the default
-
   cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
   cargoTestFlags = [ "--package" "rust-analyzer" "--package" "proc-macro-srv-cli" ];
 
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 25253633593b1..5ffda91a460e6 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "sdk-${version}";
-    hash = "sha256-xLYykbCHb6OH5wUSgheAfReXhxZtI3RqBJ+PxDZx58s=";
+    hash = "sha256-l44Ru0WjROQEDNU/2YQJGti1uDZP9osRdfsXus5EGX0=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 65797d3c81c39..81be07fdcd0d7 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -23,7 +23,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   # If we were to use "dev" here instead of headers, the setupHook would be
   # placed in that output instead of "out".
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "sdk-${version}";
-    hash = "sha256-k/A0TaERQAHSM0Fal2IOaRvTz3FV2Go/17P12FSBG1s=";
+    hash = "sha256-viVceH8qFz6Cl/RlMMWZnMIdzULELlnIvtPZ87ySs2M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/games/jumpy/default.nix b/pkgs/games/jumpy/default.nix
index 09013892d5910..edd71b39b07ba 100644
--- a/pkgs/games/jumpy/default.nix
+++ b/pkgs/games/jumpy/default.nix
@@ -32,8 +32,6 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
-  auditable = true; # TODO: remove when this is the default
-
   nativeBuildInputs = [
     makeWrapper
   ] ++ lib.optionals stdenv.isLinux [
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index 839548ae8ffd0..1860e150ca1ae 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -160,40 +160,96 @@ in rec {
     };
   };
 
-  overrides = super: {
-    CoreFoundation = lib.overrideDerivation super.CoreFoundation (drv: {
-      setupHook = ./cf-setup-hook.sh;
-    });
-
-    # This framework doesn't exist in newer SDKs (somewhere around 10.13), but
-    # there are references to it in nixpkgs.
-    QuickTime = throw "QuickTime framework not available";
-
-    # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
-    JavaVM = super.JavaNativeFoundation;
-
-    CoreVideo = lib.overrideDerivation super.CoreVideo (drv: {
-      installPhase = drv.installPhase + ''
-        # When used as a module, complains about a missing import for
-        # Darwin.C.stdint. Apparently fixed in later SDKs.
-        awk -i inplace '/CFBase.h/ { print "#include <stdint.h>" } { print }' \
-          $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
-      '';
-    });
-  };
-
-  bareFrameworks = (
-    lib.mapAttrs framework (import ./frameworks.nix {
+  frameworks = let
+    # Dependency map created by gen-frameworks.py.
+    generatedDeps = import ./frameworks.nix {
       inherit frameworks libs;
+    };
+
+    # Additional dependencies that are not picked up by gen-frameworks.py.
+    # Some of these are simply private frameworks the generator does not see.
+    extraDeps = with libs; with frameworks; let
       inherit (pkgs.darwin.apple_sdk_11_0) libnetwork;
       libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
-    })
-  ) // (
-    lib.mapAttrs privateFramework (import ./private-frameworks.nix {
-      inherit frameworks;
-      libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
-    })
-  );
+    in {
+      # Below this comment are entries migrated from before the generator was
+      # added. If, for a given framework, you are able to reverify the extra
+      # deps are really necessary on top of the generator deps, move it above
+      # this comment (and maybe document your findings).
+      AVFoundation            = { inherit ApplicationServices AVFCapture AVFCore; };
+      Accelerate              = { inherit CoreWLAN IOBluetooth; };
+      AddressBook             = { inherit AddressBookCore ContactsPersistence libobjc; };
+      AppKit                  = { inherit AudioToolbox AudioUnit UIFoundation; };
+      AudioToolbox            = { inherit AudioToolboxCore; };
+      AudioUnit               = { inherit Carbon CoreAudio; };
+      Carbon                  = { inherit IOKit QuartzCore libobjc; };
+      CoreAudio               = { inherit IOKit; };
+      CoreFoundation          = { inherit libobjc; };
+      CoreGraphics            = { inherit SystemConfiguration; };
+      CoreMIDIServer          = { inherit CoreMIDI; };
+      CoreMedia               = { inherit ApplicationServices AudioToolbox AudioUnit; };
+      CoreServices            = { inherit CoreAudio NetFS ServiceManagement; };
+      CoreWLAN                = { inherit SecurityFoundation; };
+      DiscRecording           = { inherit IOKit libobjc; };
+      Foundation              = { inherit SystemConfiguration libobjc; };
+      GameKit                 = { inherit GameCenterFoundation GameCenterUI GameCenterUICore ReplayKit; };
+      ICADevices              = { inherit Carbon libobjc; };
+      IOBluetooth             = { inherit CoreBluetooth; };
+      JavaScriptCore          = { inherit libobjc; };
+      Kernel                  = { inherit IOKit; };
+      LinkPresentation        = { inherit URLFormatting; };
+      MediaToolbox            = { inherit AudioUnit; };
+      MetricKit               = { inherit SignpostMetrics; };
+      Network                 = { inherit libnetwork; };
+      PCSC                    = { inherit CoreData; };
+      PassKit                 = { inherit PassKitCore; };
+      QTKit                   = { inherit CoreMedia CoreMediaIO MediaToolbox VideoToolbox; };
+      Quartz                  = { inherit QTKit; };
+      QuartzCore              = { inherit ApplicationServices CoreImage CoreVideo Metal OpenCL libobjc; };
+      Security                = { inherit IOKit libDER; };
+      TWAIN                   = { inherit Carbon; };
+      VideoDecodeAcceleration = { inherit CoreVideo; };
+      WebKit                  = { inherit ApplicationServices Carbon libobjc; };
+    };
 
-  frameworks = bareFrameworks // overrides bareFrameworks;
+    # Overrides for framework derivations.
+    overrides = super: {
+      CoreFoundation = lib.overrideDerivation super.CoreFoundation (drv: {
+        setupHook = ./cf-setup-hook.sh;
+      });
+
+      # This framework doesn't exist in newer SDKs (somewhere around 10.13), but
+      # there are references to it in nixpkgs.
+      QuickTime = throw "QuickTime framework not available";
+
+      # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
+      JavaVM = super.JavaNativeFoundation;
+
+      CoreVideo = lib.overrideDerivation super.CoreVideo (drv: {
+        installPhase = drv.installPhase + ''
+          # When used as a module, complains about a missing import for
+          # Darwin.C.stdint. Apparently fixed in later SDKs.
+          awk -i inplace '/CFBase.h/ { print "#include <stdint.h>" } { print }' \
+            $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
+        '';
+      });
+    };
+
+    # Merge extraDeps into generatedDeps.
+    deps = generatedDeps // (
+      lib.mapAttrs
+        (name: deps: generatedDeps.${name} // deps)
+        extraDeps
+    );
+
+    # Create derivations, and add private frameworks.
+    bareFrameworks = (lib.mapAttrs framework deps) // (
+      lib.mapAttrs privateFramework (import ./private-frameworks.nix {
+        inherit frameworks;
+        libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
+      })
+    );
+  in
+    # Apply derivation overrides.
+    bareFrameworks // overrides bareFrameworks;
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 8c9e16a6ca9a9..1133cca002a8b 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -31,10 +31,7 @@ let
     };
 
     installPhase = ''
-      cd Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk
-
-      mkdir $out
-      cp -r System usr $out/
+      mv Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk $out
     '';
   };
 
@@ -49,10 +46,7 @@ let
     };
 
     installPhase = ''
-      cd Library/Developer/CommandLineTools
-
-      mkdir $out
-      cp -r Library usr $out/
+      mv Library/Developer/CommandLineTools $out
     '';
   };
 
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
index 59cbc2b1063a1..fa6945f76718f 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -1,193 +1,196 @@
-{ frameworks, libs, libobjc, libnetwork }: with frameworks; with libs;
+# This file is generated by gen-frameworks.nix.
+# Do not edit, put overrides in apple_sdk.nix instead.
+{ libs, frameworks }: with libs; with frameworks;
 {
   AGL                              = { inherit Carbon OpenGL; };
-  AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics simd UniformTypeIdentifiers; };
-  AVKit                            = {};
-  Accelerate                       = { inherit CoreWLAN IOBluetooth; };
-  Accessibility                    = {};
-  Accounts                         = {};
-  AdSupport                        = {};
-  AddressBook                      = { inherit AddressBookCore Carbon ContactsPersistence libobjc; };
-  AppKit                           = { inherit ApplicationServices AudioToolbox AudioUnit Foundation QuartzCore UIFoundation; };
-  AppTrackingTransparency          = {};
+  AVFoundation                     = { inherit AudioToolbox CoreAudio CoreAudioTypes CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia CoreVideo Foundation IOKit ImageIO MediaToolbox Metal QuartzCore UniformTypeIdentifiers simd; };
+  AVKit                            = { inherit AVFoundation AppKit Cocoa Foundation; };
+  Accelerate                       = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  Accessibility                    = { inherit CoreGraphics Foundation; };
+  Accounts                         = { inherit Foundation; };
+  AdServices                       = { inherit Foundation; };
+  AdSupport                        = { inherit Foundation; };
+  AddressBook                      = { inherit Carbon Cocoa CoreFoundation Foundation; };
+  AppKit                           = { inherit ApplicationServices CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal OpenGL QuartzCore; };
+  AppTrackingTransparency          = { inherit Foundation; };
   AppleScriptKit                   = {};
-  AppleScriptObjC                  = {};
-  ApplicationServices              = { inherit ColorSync CoreGraphics CoreServices CoreText ImageIO; };
-  AudioToolbox                     = { inherit AudioToolboxCore CoreAudio CoreMIDI; };
-  AudioUnit                        = { inherit AudioToolbox Carbon CoreAudio; };
-  AudioVideoBridging               = { inherit Foundation; };
-  AuthenticationServices           = {};
-  AutomaticAssessmentConfiguration = {};
-  Automator                        = {};
-  BackgroundTasks                  = {};
-  BusinessChat                     = {};
-  CFNetwork                        = {};
+  AppleScriptObjC                  = { inherit Foundation; };
+  ApplicationServices              = { inherit ColorSync CoreFoundation CoreGraphics CoreServices CoreText ImageIO; };
+  AudioToolbox                     = { inherit Carbon CoreAudio CoreAudioTypes CoreFoundation CoreMIDI Foundation; };
+  AudioUnit                        = { inherit AudioToolbox; };
+  AudioVideoBridging               = { inherit Foundation IOKit; };
+  AuthenticationServices           = { inherit AppKit Foundation; };
+  AutomaticAssessmentConfiguration = { inherit Foundation; };
+  Automator                        = { inherit AppKit Cocoa Foundation OSAKit; };
+  BackgroundTasks                  = { inherit Foundation; };
+  BusinessChat                     = { inherit Cocoa Foundation; };
+  CFNetwork                        = { inherit CoreFoundation; };
   CalendarStore                    = {};
-  CallKit                          = {};
-  Carbon                           = { inherit ApplicationServices CoreServices Foundation IOKit QuartzCore Security libobjc; };
-  ClassKit                         = {};
-  CloudKit                         = { inherit CoreLocation; };
-  Cocoa                            = { inherit AppKit CoreData; };
-  Collaboration                    = {};
-  ColorSync                        = {};
+  CallKit                          = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Carbon                           = { inherit ApplicationServices CoreServices Foundation Security; };
+  ClassKit                         = { inherit CoreGraphics Foundation; };
+  CloudKit                         = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
+  Cocoa                            = { inherit AppKit CoreData Foundation; };
+  Collaboration                    = { inherit AppKit CoreServices Foundation; };
+  ColorSync                        = { inherit CoreFoundation; };
   Combine                          = {};
-  Contacts                         = {};
-  ContactsUI                       = {};
-  CoreAudio                        = { inherit IOKit CoreAudioTypes; };
-  CoreAudioKit                     = { inherit AudioUnit; };
-  CoreAudioTypes                   = {};
-  CoreBluetooth                    = {};
-  CoreData                         = { inherit CloudKit; };
+  Contacts                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ContactsUI                       = { inherit AppKit; };
+  CoreAudio                        = { inherit CoreAudioTypes CoreFoundation; };
+  CoreAudioKit                     = { inherit AppKit AudioUnit Cocoa Foundation; };
+  CoreAudioTypes                   = { inherit CoreFoundation; };
+  CoreBluetooth                    = { inherit Foundation; };
+  CoreData                         = { inherit CloudKit Combine CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
   CoreDisplay                      = {};
-  CoreFoundation                   = { inherit libobjc; };
-  CoreGraphics                     = { inherit Accelerate IOKit IOSurface SystemConfiguration; };
-  CoreHaptics                      = {};
-  CoreImage                        = {};
-  CoreLocation                     = {};
-  CoreMIDI                         = {};
-  CoreMIDIServer                   = { inherit CoreMIDI; };
-  CoreML                           = {};
-  CoreMedia                        = { inherit ApplicationServices AudioToolbox AudioUnit CoreAudio CoreGraphics CoreVideo; };
-  CoreMediaIO                      = { inherit CoreMedia; };
-  CoreMotion                       = {};
-  CoreServices                     = { inherit CFNetwork CoreAudio CoreData CoreFoundation DiskArbitration NetFS OpenDirectory Security ServiceManagement; };
-  CoreSpotlight                    = {};
+  CoreFoundation                   = {};
+  CoreGraphics                     = { inherit CoreFoundation IOKit; };
+  CoreHaptics                      = { inherit Foundation; };
+  CoreImage                        = { inherit ApplicationServices CoreFoundation CoreGraphics CoreVideo Foundation IOKit IOSurface ImageIO Metal OpenGL; };
+  CoreLocation                     = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDI                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDIServer                   = {};
+  CoreML                           = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit ImageIO Metal; };
+  CoreMedia                        = { inherit CoreAudio CoreAudioTypes CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  CoreMediaIO                      = { inherit CoreFoundation CoreMedia; };
+  CoreMotion                       = { inherit Foundation; };
+  CoreServices                     = { inherit CFNetwork CoreFoundation DiskArbitration Security; };
+  CoreSpotlight                    = { inherit Foundation UniformTypeIdentifiers; };
   CoreTelephony                    = {};
-  CoreText                         = { inherit CoreGraphics; };
-  CoreVideo                        = { inherit ApplicationServices CoreGraphics IOSurface OpenGL; };
-  CoreWLAN                         = { inherit SecurityFoundation; };
-  CryptoKit                        = {};
-  CryptoTokenKit                   = {};
-  DVDPlayback                      = {};
-  DeveloperToolsSupport            = {};
-  DeviceCheck                      = {};
-  DirectoryService                 = {};
-  DiscRecording                    = { inherit CoreServices IOKit libobjc; };
-  DiscRecordingUI                  = {};
-  DiskArbitration                  = { inherit IOKit; };
+  CoreText                         = { inherit CoreFoundation CoreGraphics; };
+  CoreVideo                        = { inherit ApplicationServices CoreFoundation CoreGraphics IOSurface Metal OpenGL; };
+  CoreWLAN                         = { inherit Foundation IOKit; };
+  CryptoKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit LocalAuthentication Security; };
+  CryptoTokenKit                   = { inherit CoreFoundation CoreGraphics Foundation IOKit Security; };
+  DVDPlayback                      = { inherit ApplicationServices CoreFoundation Security; };
+  DeveloperToolsSupport            = { inherit Foundation; };
+  DeviceCheck                      = { inherit Foundation; };
+  DirectoryService                 = { inherit CoreFoundation; };
+  DiscRecording                    = { inherit CoreServices Foundation; };
+  DiscRecordingUI                  = { inherit Carbon Cocoa DiscRecording; };
+  DiskArbitration                  = { inherit CoreFoundation IOKit; };
   DriverKit                        = {};
-  EventKit                         = {};
-  ExceptionHandling                = {};
-  ExecutionPolicy                  = {};
-  ExternalAccessory                = {};
-  FWAUserLib                       = {};
-  FileProvider                     = {};
-  FileProviderUI                   = {};
-  FinderSync                       = {};
-  ForceFeedback                    = { inherit IOKit; };
-  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration Combine libobjc; };
-  GLKit                            = {};
+  EventKit                         = { inherit CoreGraphics CoreLocation Foundation; };
+  ExceptionHandling                = { inherit Foundation; };
+  ExecutionPolicy                  = { inherit Foundation; };
+  ExternalAccessory                = { inherit Foundation; };
+  FWAUserLib                       = { inherit IOKit; };
+  FileProvider                     = { inherit CoreGraphics Foundation; };
+  FileProviderUI                   = { inherit AppKit FileProvider Foundation; };
+  FinderSync                       = { inherit AppKit Foundation; };
+  ForceFeedback                    = { inherit CoreFoundation IOKit; };
+  Foundation                       = { inherit ApplicationServices Combine CoreFoundation CoreGraphics CoreServices IOKit Security; };
+  GLKit                            = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal ModelIO OpenGL QuartzCore simd; };
   GLUT                             = { inherit OpenGL; };
-  GSS                              = {};
-  GameController                   = {};
-  GameKit                          = { inherit Cocoa Foundation GameCenterFoundation GameCenterUI GameCenterUICore GameController GameplayKit Metal MetalKit ModelIO ReplayKit SceneKit SpriteKit; };
-  GameplayKit                      = {};
-  HIDDriverKit                     = {};
+  GSS                              = { inherit CoreFoundation; };
+  GameController                   = { inherit AppKit Foundation IOKit; };
+  GameKit                          = { inherit AppKit Cocoa Contacts CoreGraphics Foundation GameController GameplayKit Metal MetalKit ModelIO SceneKit SpriteKit simd; };
+  GameplayKit                      = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore SceneKit SpriteKit simd; };
+  HIDDriverKit                     = { inherit IOKit USBDriverKit; };
   Hypervisor                       = {};
-  ICADevices                       = { inherit Carbon IOBluetooth libobjc; };
-  IMServicePlugIn                  = {};
-  IOBluetooth                      = { inherit CoreBluetooth IOKit; };
-  IOBluetoothUI                    = { inherit IOBluetooth; };
-  IOKit                            = {};
-  IOSurface                        = { inherit IOKit; };
-  IOUSBHost                        = {};
-  IdentityLookup                   = {};
-  ImageCaptureCore                 = {};
-  ImageIO                          = { inherit CoreGraphics; };
-  InputMethodKit                   = { inherit Carbon; };
+  ICADevices                       = { inherit CoreFoundation CoreGraphics CoreServices IOBluetooth; };
+  IMServicePlugIn                  = { inherit Foundation; };
+  IOBluetooth                      = { inherit CoreAudio CoreFoundation CoreServices Foundation IOKit; };
+  IOBluetoothUI                    = { inherit Cocoa IOBluetooth; };
+  IOKit                            = { inherit CoreFoundation; };
+  IOSurface                        = { inherit CoreFoundation Foundation IOKit; };
+  IOUSBHost                        = { inherit Foundation IOKit; };
+  IdentityLookup                   = { inherit Foundation; };
+  ImageCaptureCore                 = { inherit Cocoa CoreGraphics Foundation; };
+  ImageIO                          = { inherit CoreFoundation CoreGraphics; };
+  InputMethodKit                   = { inherit Carbon Cocoa Foundation; };
   InstallerPlugins                 = {};
   InstantMessage                   = {};
-  Intents                          = {};
-  JavaNativeFoundation             = {};
-  JavaRuntimeSupport               = {};
-  JavaScriptCore                   = { inherit libobjc; };
+  Intents                          = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
+  JavaNativeFoundation             = { inherit Foundation; };
+  JavaRuntimeSupport               = { inherit ApplicationServices Cocoa Foundation QuartzCore; };
+  JavaScriptCore                   = { inherit CoreFoundation CoreGraphics Foundation; };
   Kerberos                         = {};
-  Kernel                           = { inherit IOKit; };
-  KernelManagement                 = {};
+  Kernel                           = {};
+  KernelManagement                 = { inherit Foundation; };
   LDAP                             = {};
-  LatentSemanticMapping            = { inherit Carbon; };
-  LinkPresentation                 = { inherit URLFormatting; };
-  LocalAuthentication              = {};
-  MLCompute                        = {};
-  MapKit                           = {};
-  MediaAccessibility               = { inherit CoreGraphics CoreText QuartzCore; };
-  MediaLibrary                     = {};
-  MediaPlayer                      = {};
-  MediaToolbox                     = { inherit AudioToolbox AudioUnit CoreMedia; };
+  LatentSemanticMapping            = { inherit Carbon CoreFoundation; };
+  LinkPresentation                 = { inherit AppKit Foundation; };
+  LocalAuthentication              = { inherit Foundation; };
+  MLCompute                        = { inherit CoreFoundation CoreGraphics Foundation IOKit Metal; };
+  MapKit                           = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  MediaAccessibility               = { inherit CoreFoundation CoreGraphics CoreText QuartzCore; };
+  MediaLibrary                     = { inherit Foundation; };
+  MediaPlayer                      = { inherit AVFoundation CoreGraphics Foundation; };
+  MediaToolbox                     = { inherit AudioToolbox CoreFoundation CoreMedia; };
   Message                          = {};
-  Metal                            = {};
-  MetalKit                         = { inherit Metal ModelIO; };
-  MetalPerformanceShaders          = {};
-  MetalPerformanceShadersGraph     = {};
-  MetricKit                        = { inherit SignpostMetrics; };
-  ModelIO                          = {};
-  MultipeerConnectivity            = {};
-  NaturalLanguage                  = {};
-  NearbyInteraction                = {};
-  NetFS                            = {};
-  Network                          = { inherit libnetwork; };
-  NetworkExtension                 = { inherit Network; };
+  Metal                            = { inherit CoreFoundation CoreGraphics Foundation IOKit IOSurface; };
+  MetalKit                         = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal ModelIO QuartzCore simd; };
+  MetalPerformanceShaders          = { inherit CoreGraphics Foundation Metal simd; };
+  MetalPerformanceShadersGraph     = { inherit Foundation MetalPerformanceShaders; };
+  MetricKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ModelIO                          = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  MultipeerConnectivity            = { inherit Cocoa Foundation; };
+  NaturalLanguage                  = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  NearbyInteraction                = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  NetFS                            = { inherit CoreFoundation; };
+  Network                          = { inherit CoreFoundation Foundation Security; };
+  NetworkExtension                 = { inherit Foundation Network Security; };
   NetworkingDriverKit              = {};
-  NotificationCenter               = {};
-  OSAKit                           = { inherit Carbon; };
-  OSLog                            = {};
+  NotificationCenter               = { inherit AppKit Foundation; };
+  OSAKit                           = { inherit Carbon Cocoa; };
+  OSLog                            = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
   OpenAL                           = {};
-  OpenCL                           = { inherit IOSurface OpenGL; };
-  OpenDirectory                    = {};
+  OpenCL                           = { inherit OpenGL; };
+  OpenDirectory                    = { inherit CoreFoundation Foundation; };
   OpenGL                           = {};
-  PCIDriverKit                     = {};
-  PCSC                             = { inherit CoreData; };
-  PDFKit                           = {};
-  ParavirtualizedGraphics          = {};
-  PassKit                          = { inherit PassKitCore; };
-  PencilKit                        = {};
-  Photos                           = {};
-  PhotosUI                         = {};
-  PreferencePanes                  = {};
-  PushKit                          = {};
-  Python                           = {};
-  QTKit                            = { inherit CoreMedia CoreMediaIO MediaToolbox VideoToolbox; };
-  Quartz                           = { inherit QTKit QuartzCore QuickLook PDFKit; };
-  QuartzCore                       = { inherit ApplicationServices CoreImage CoreVideo Metal OpenCL libobjc; };
-  QuickLook                        = { inherit ApplicationServices; };
-  QuickLookThumbnailing            = {};
-  RealityKit                       = {};
-  ReplayKit                        = {};
+  PCIDriverKit                     = { inherit IOKit; };
+  PCSC                             = {};
+  PDFKit                           = { inherit AppKit Cocoa; };
+  ParavirtualizedGraphics          = { inherit AppKit CoreVideo Foundation IOSurface Metal; };
+  PassKit                          = { inherit AppKit Contacts CoreGraphics Foundation; };
+  PencilKit                        = { inherit AppKit CloudKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  Photos                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreLocation CoreMIDI CoreMedia Foundation IOKit ImageIO Metal QuartzCore UniformTypeIdentifiers simd; };
+  PhotosUI                         = { inherit AppKit Foundation MapKit Photos; };
+  PreferencePanes                  = { inherit Cocoa; };
+  PushKit                          = { inherit Foundation; };
+  Python                           = { inherit Carbon; };
+  QTKit                            = {};
+  Quartz                           = { inherit AppKit ApplicationServices Cocoa Foundation ImageCaptureCore OpenGL PDFKit QuartzCore QuickLook; };
+  QuartzCore                       = { inherit CoreFoundation CoreGraphics CoreImage CoreVideo Foundation IOKit Metal OpenGL; };
+  QuickLook                        = { inherit ApplicationServices CoreFoundation; };
+  QuickLookThumbnailing            = { inherit CoreGraphics Foundation UniformTypeIdentifiers; };
+  RealityKit                       = { inherit AVFoundation AppKit AudioToolbox CloudKit Combine CoreAudio CoreData CoreFoundation CoreGraphics CoreImage CoreLocation CoreMIDI CoreText Foundation IOKit Metal MultipeerConnectivity QuartzCore simd; };
+  ReplayKit                        = { inherit AVFoundation AppKit Foundation; };
   Ruby                             = {};
-  SafariServices                   = {};
-  SceneKit                         = {};
-  ScreenSaver                      = {};
-  ScreenTime                       = {};
-  ScriptingBridge                  = {};
-  Security                         = { inherit IOKit libDER; };
-  SecurityFoundation               = { inherit Security; };
-  SecurityInterface                = { inherit Security SecurityFoundation; };
-  SensorKit                        = {};
-  ServiceManagement                = { inherit Security; };
-  Social                           = {};
-  SoundAnalysis                    = {};
-  Speech                           = {};
-  SpriteKit                        = {};
-  StoreKit                         = {};
-  SwiftUI                          = { inherit AppKit DeveloperToolsSupport UniformTypeIdentifiers; };
+  SafariServices                   = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  SceneKit                         = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  ScreenSaver                      = { inherit AppKit Foundation; };
+  ScreenTime                       = { inherit AppKit Foundation; };
+  ScriptingBridge                  = { inherit ApplicationServices CoreServices Foundation; };
+  Security                         = { inherit CoreFoundation; };
+  SecurityFoundation               = { inherit Foundation Security; };
+  SecurityInterface                = { inherit AppKit Cocoa Security SecurityFoundation; };
+  SensorKit                        = { inherit CoreFoundation CoreLocation Foundation; };
+  ServiceManagement                = { inherit CoreFoundation Security; };
+  Social                           = { inherit AppKit Foundation; };
+  SoundAnalysis                    = { inherit AVFoundation CoreML CoreMedia Foundation; };
+  Speech                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia Foundation IOKit Metal QuartzCore UniformTypeIdentifiers simd; };
+  SpriteKit                        = { inherit AppKit CloudKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  StoreKit                         = { inherit AppKit CoreGraphics Foundation; };
+  SwiftUI                          = { inherit AppKit CloudKit Combine CoreData CoreFoundation CoreGraphics CoreImage CoreLocation DeveloperToolsSupport Foundation IOKit Metal QuartzCore UniformTypeIdentifiers; };
   SyncServices                     = {};
   System                           = {};
-  SystemConfiguration              = { inherit Security; };
-  SystemExtensions                 = {};
-  TWAIN                            = { inherit Carbon; };
+  SystemConfiguration              = { inherit CoreFoundation Security; };
+  SystemExtensions                 = { inherit Foundation; };
+  TWAIN                            = {};
   Tcl                              = {};
   Tk                               = {};
-  USBDriverKit                     = {};
-  UniformTypeIdentifiers           = {};
-  UserNotifications                = {};
-  UserNotificationsUI              = {};
-  VideoDecodeAcceleration          = { inherit CoreVideo; };
-  VideoSubscriberAccount           = {};
-  VideoToolbox                     = { inherit CoreMedia CoreVideo; };
-  Virtualization                   = {};
-  Vision                           = {};
-  WebKit                           = { inherit ApplicationServices Carbon JavaScriptCore OpenGL libobjc; };
-  WidgetKit                        = {};
-  iTunesLibrary                    = {};
+  USBDriverKit                     = { inherit IOKit; };
+  UniformTypeIdentifiers           = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  UserNotifications                = { inherit Foundation; };
+  UserNotificationsUI              = { inherit AppKit; };
+  VideoDecodeAcceleration          = {};
+  VideoSubscriberAccount           = { inherit Foundation; };
+  VideoToolbox                     = { inherit CoreFoundation CoreGraphics CoreMedia CoreVideo; };
+  Virtualization                   = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Vision                           = { inherit CoreAudio CoreFoundation CoreGraphics CoreML CoreMedia CoreVideo Foundation IOKit ImageIO Metal simd; };
+  WebKit                           = { inherit AppKit CloudKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit JavaScriptCore Metal OpenGL QuartzCore; };
+  WidgetKit                        = { inherit Combine CoreFoundation CoreGraphics CoreVideo Foundation IOKit Intents Metal SwiftUI; };
+  iTunesLibrary                    = { inherit Foundation; };
   vmnet                            = {};
 }
diff --git a/pkgs/os-specific/darwin/gen-frameworks.py b/pkgs/os-specific/darwin/gen-frameworks.py
new file mode 100755
index 0000000000000..ec2a6c7c16ecd
--- /dev/null
+++ b/pkgs/os-specific/darwin/gen-frameworks.py
@@ -0,0 +1,147 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python -p python3 swiftPackages.swift-unwrapped
+
+"""
+Generate a frameworks.nix for a macOS SDK.
+
+You may point this tool at an Xcode bundled SDK, but more ideal is using the
+SDK from Nixpkgs. For example:
+
+SDK_PATH="$(nix-build --no-link -A darwin.apple_sdk_11_0.MacOSX-SDK)"
+./gen-frameworks.py "$SDK_PATH" > ./new-frameworks.nix
+"""
+
+import json
+import os
+import subprocess
+import sys
+
+ALLOWED_LIBS = ["simd"]
+
+HEADER = """\
+# This file is generated by gen-frameworks.nix.
+# Do not edit, put overrides in apple_sdk.nix instead.
+{ libs, frameworks }: with libs; with frameworks;
+{
+"""
+
+FOOTER = """\
+}
+"""
+
+
+def eprint(*args):
+    print(*args, file=sys.stderr)
+
+
+def name_from_ident(ident):
+    return ident.get("swift", ident.get("clang"))
+
+
+def scan_sdk(sdk):
+    # Find frameworks by scanning the SDK frameworks directory.
+    frameworks = [
+        framework.removesuffix(".framework")
+        for framework in os.listdir(f"{sdk}/System/Library/Frameworks")
+        if not framework.startswith("_")
+    ]
+    frameworks.sort()
+
+    # Determine the longest name for padding output.
+    width = len(max(frameworks, key=len))
+
+    output = HEADER
+
+    for framework in frameworks:
+        deps = []
+
+        # Use Swift to scan dependencies, because a module may have both Clang
+        # and Swift parts. Using Clang only imports the Clang module, whereas
+        # using Swift will usually import both Clang + Swift overlay.
+        #
+        # TODO: The above is an assumption. Not sure if it's possible a Swift
+        # module completely shadows a Clang module. (Seems unlikely)
+        #
+        # TODO: Handle "module 'Foobar' is incompatible with feature 'swift'"
+        #
+        # If there were a similar Clang invocation for scanning, we could fix
+        # the above todos, but that doesn't appear to exist.
+        eprint(f"# scanning {framework}")
+        result = subprocess.run(
+            [
+                "swiftc",
+                "-scan-dependencies",
+                # We provide a source snippet via stdin.
+                "-",
+                # Use the provided SDK.
+                "-sdk",
+                sdk,
+                # This search path is normally added automatically by the
+                # compiler based on the SDK, but we have a patch in place that
+                # removes that for SDKs in /nix/store, because our xcbuild stub
+                # SDK doesn't have the directory.
+                # (swift-prevent-sdk-dirs-warning.patch)
+                "-I",
+                f"{sdk}/usr/lib/swift",
+                # For some reason, 'lib/swift/shims' from both the SDK and
+                # Swift compiler are picked up, causing redefinition errors.
+                # This eliminates the latter.
+                "-resource-dir",
+                f"{sdk}/usr/lib/swift",
+            ],
+            input=f"import {framework}".encode(),
+            stdout=subprocess.PIPE,
+        )
+        if result.returncode != 0:
+            eprint(f"# Scanning {framework} failed (exit code {result.returncode})")
+            result.stdout = b""
+
+        # Parse JSON output.
+        if len(result.stdout) != 0:
+            data = json.loads(result.stdout)
+
+            # Entries in the modules list come in pairs. The first is an
+            # identifier (`{ swift: "foobar" }` or `{ clang: "foobar" }`), and
+            # the second metadata for that module. Here we look for the pair
+            # that matches the framework we're scanning (and ignore the rest).
+            modules = data["modules"]
+            for i in range(0, len(modules), 2):
+                ident, meta = modules[i : i + 2]
+
+                # NOTE: We may match twice, for a Swift module _and_ for a
+                # Clang module. So matching here doesn't break from the loop,
+                # and deps is appended to.
+                if name_from_ident(ident) == framework:
+                    dep_idents = meta["directDependencies"]
+                    deps += [name_from_ident(ident) for ident in dep_idents]
+                    # List unfiltered deps in progress output.
+                    eprint(ident, "->", dep_idents)
+
+        # Filter out modules that are not separate derivations.
+        # Also filter out duplicates (when a Swift overlay imports the Clang module)
+        allowed = frameworks + ALLOWED_LIBS
+        deps = set([dep for dep in deps if dep in allowed])
+
+        # Filter out self-references. (Swift overlay importing Clang module.)
+        if framework in deps:
+            deps.remove(framework)
+
+        # Generate a Nix attribute line.
+        if len(deps) != 0:
+            deps = list(deps)
+            deps.sort()
+            deps = " ".join(deps)
+            output += f"  {framework.ljust(width)} = {{ inherit {deps}; }};\n"
+        else:
+            output += f"  {framework.ljust(width)} = {{}};\n"
+
+    output += FOOTER
+    sys.stdout.write(output)
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        eprint(f"Usage: {sys.argv[0]} <path to MacOSX.sdk>")
+        sys.exit(64)
+
+    scan_sdk(sys.argv[1])
diff --git a/pkgs/os-specific/darwin/moltenvk/default.nix b/pkgs/os-specific/darwin/moltenvk/default.nix
index 16456c5fcad4c..4d247fa58363b 100644
--- a/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.2.2";
+  version = "1.2.3";
 
   buildInputs = [
     AppKit
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XowMXhGqPcxJ0DS3G41tpBO68va94a7SZHOOgguCxy0=";
+    hash = "sha256-GPOF2lyo1eDf1GrPjcj0y1OuUHI/c80L9gSQM+4wEp0=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/bpftools/default.nix b/pkgs/os-specific/linux/bpftools/default.nix
index 287ad9d42264b..a23c4eb7b9e66 100644
--- a/pkgs/os-specific/linux/bpftools/default.nix
+++ b/pkgs/os-specific/linux/bpftools/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, linuxHeaders
 , libopcodes, libopcodes_2_38
 , libbfd, libbfd_2_38
 , elfutils, readline
@@ -8,15 +8,12 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftools";
-  version = "5.19.12";
 
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "sha256-xDalSMcxLOb8WjRyy+rYle749ShB++fHH9jki9/isLo=";
-  };
+  inherit (linuxHeaders) version src;
+
+  separateDebugInfo = true;
 
   patches = [
-    ./strip-binary-name.patch
     # fix unknown type name '__vector128' on ppc64le
     ./include-asm-types-for-ppc64le.patch
   ];
diff --git a/pkgs/os-specific/linux/bpftools/strip-binary-name.patch b/pkgs/os-specific/linux/bpftools/strip-binary-name.patch
deleted file mode 100644
index 623e90963bd9b..0000000000000
--- a/pkgs/os-specific/linux/bpftools/strip-binary-name.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Strip path to the binary from prints.
-
-I see no sense in including the full path in outputs like bpftool --version
-Especially as argv[0] may not include it, based on calling via $PATH or not.
---- a/tools/bpf/bpftool/main.c
-+++ b/tools/bpf/bpftool/main.c
-@@ -443 +443,7 @@
--	bin_name = argv[0];
-+	/* Strip the path if any. */
-+	const char *bin_name_slash = strrchr(argv[0], '/');
-+	if (bin_name_slash) {
-+		bin_name = bin_name_slash + 1;
-+	} else {
-+		bin_name = argv[0];
-+	}
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 71bde6220a02d..228916bd72346 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -21,6 +21,16 @@ stdenv.mkDerivation rec {
       url = "https://github.com/checkpoint-restore/criu/commit/1e6e826ffb7ac05f33fa123051c2fc2ddf0f68ea.patch";
       hash = "sha256-LJjk0jQ5v5wqeprvBMpxhjLXn7v+lSPldEGgazGUM44=";
     })
+
+    # compat fixes for glibc-2.36
+    (fetchpatch {
+      url = "https://github.com/checkpoint-restore/criu/commit/8cd5fccd6cf3d03afb5abe463134d31f54d42258.patch";
+      sha256 = "sha256-b65DdLmyIuZik0dNRuWJKUPcDFA6CKq0bi4Vd26zgS4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/checkpoint-restore/criu/commit/517c0947050e63aac72f63a3bf373d76264723b9.patch";
+      sha256 = "sha256-MPZ6oILVoZ7BQEZFjUlp3RuMC7iKTKXAtrUDFqbN4T8=";
+    })
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/freeipa/default.nix b/pkgs/os-specific/linux/freeipa/default.nix
new file mode 100644
index 0000000000000..5e705bda2cbda
--- /dev/null
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@@ -0,0 +1,171 @@
+{ stdenv
+, lib
+, fetchurl
+, pkg-config
+, autoconf
+, automake
+, kerberos
+, openldap
+, popt
+, sasl
+, curl
+, xmlrpc_c
+, ding-libs
+, p11-kit
+, gettext
+, nspr
+, nss
+, _389-ds-base
+, svrcore
+, libuuid
+, talloc
+, tevent
+, samba
+, libunistring
+, libverto
+, libpwquality
+, systemd
+, python3
+, bind
+, sssd
+, jre
+, rhino
+, lesscpy
+, jansson
+, runtimeShell
+}:
+
+let
+  pathsPy = ./paths.py;
+
+  pythonInputs = with python3.pkgs; [
+    six
+    python-ldap
+    dnspython
+    netaddr
+    netifaces
+    gssapi
+    dogtag-pki
+    pyasn1
+    sssd
+    cffi
+    lxml
+    dbus-python
+    cryptography
+    python-memcached
+    qrcode
+    pyusb
+    yubico
+    setuptools
+    jinja2
+    augeas
+    samba
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "freeipa";
+  version = "4.10.1";
+
+  src = fetchurl {
+    url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
+    sha256 = "sha256-q2rQzcBl1tI4/7+hxEwOY9ND86hObe7O7Y9EEH7cUoA=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.wrapPython
+    jre
+    rhino
+    lesscpy
+    automake
+    autoconf
+    gettext
+  ];
+
+  buildInputs = [
+    kerberos
+    openldap
+    popt
+    sasl
+    curl
+    xmlrpc_c
+    pkg-config
+    ding-libs
+    p11-kit
+    python3
+    nspr
+    nss
+    _389-ds-base
+    svrcore
+    libuuid
+    talloc
+    tevent
+    samba
+    libunistring
+    libverto
+    systemd
+    bind
+    libpwquality
+    jansson
+  ] ++ pythonInputs;
+
+  postPatch = ''
+    patchShebangs makeapi makeaci install/ui/util
+
+    substituteInPlace ipaplatform/setup.py \
+      --replace 'ipaplatform.debian' 'ipaplatform.nixos'
+
+    substituteInPlace ipasetup.py.in \
+      --replace 'int(v)' 'int(v.replace("post", ""))'
+
+    substituteInPlace client/ipa-join.c \
+      --replace /usr/sbin/ipa-getkeytab $out/bin/ipa-getkeytab
+
+    cp -r ipaplatform/{fedora,nixos}
+    substitute ${pathsPy} ipaplatform/nixos/paths.py \
+      --subst-var out \
+      --subst-var-by bind ${bind.dnsutils} \
+      --subst-var-by curl ${curl} \
+      --subst-var-by kerberos ${kerberos}
+  '';
+
+  NIX_CFLAGS_COMPILE = "-I${_389-ds-base}/include/dirsrv";
+  pythonPath = pythonInputs;
+
+  # Building and installing the server fails with silent Rhino errors, skipping
+  # for now. Need a newer Rhino version.
+  #buildFlags = [ "client" "server" ]
+
+  configureFlags = [
+    "--with-systemdsystemunitdir=$out/lib/systemd/system"
+    "--with-ipaplatform=nixos"
+    "--disable-server"
+  ];
+
+  postInstall = ''
+    echo "
+     #!${runtimeShell}
+     echo 'ipa-client-install is not available on NixOS. Please see security.ipa, instead.'
+     exit 1
+    " > $out/sbin/ipa-client-install
+  '';
+
+  postFixup = ''
+    wrapPythonPrograms
+    rm -rf $out/etc/ipa $out/var/lib/ipa-client/sysrestore
+  '';
+
+  meta = with lib; {
+    description = "Identity, Policy and Audit system";
+    longDescription = ''
+      IPA is an integrated solution to provide centrally managed Identity (users,
+      hosts, services), Authentication (SSO, 2FA), and Authorization
+      (host access control, SELinux user roles, services). The solution provides
+      features for further integration with Linux based clients (SUDO, automount)
+      and integration with Active Directory based infrastructures (Trusts).
+    '';
+    homepage = "https://www.freeipa.org/";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.s1341 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/freeipa/paths.py b/pkgs/os-specific/linux/freeipa/paths.py
new file mode 100644
index 0000000000000..36c0cc0c74039
--- /dev/null
+++ b/pkgs/os-specific/linux/freeipa/paths.py
@@ -0,0 +1,13 @@
+from ipaplatform.fedora.paths import FedoraPathNamespace
+
+class NixOSPathNamespace(FedoraPathNamespace):
+    SBIN_IPA_JOIN = "@out@/bin/ipa-join"
+    IPA_GETCERT = "@out@/bin/ipa-getcert"
+    IPA_RMKEYTAB = "@out@/bin/ipa-rmkeytab"
+    IPA_GETKEYTAB = "@out@/bin/ipa-getkeytab"
+    NSUPDATE = "@bind@/bin/nsupdate"
+    BIN_CURL = "@curl@/bin/curl"
+    KINIT = "@kerberos@/bin/kinit"
+    KDESTROY = "@kerberos@/bin/kdestroy"
+
+paths = NixOSPathNamespace()
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 0704860c961fd..9d2848556eaf2 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,39 +1,37 @@
-{ lib, stdenv, fetchurl, pkg-config, pruneLibtoolFiles, flex, bison
+{ lib, stdenv, fetchurl
+, autoreconfHook, pkg-config, pruneLibtoolFiles, flex, bison
 , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap
 , nftablesCompat ? true
 , fetchpatch
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.8.8";
+  version = "1.8.9";
   pname = "iptables";
 
   src = fetchurl {
-    url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ccdYidxxBnZjFVPrFRHaAXe7qvG1USZbkS0jbD9RhZ8=";
+    url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
+    sha256 = "72Y5pDvoMlpPjqaBI/+sI2y2lujHhQG2ToEGr7AIyH8=";
   };
 
   patches = [
-    # xshared: Fix build for -Werror=format-security
     (fetchpatch {
-      url = "https://git.netfilter.org/iptables/patch/?id=b72eb12ea5a61df0655ad99d5048994e916be83a";
-      sha256 = "sha256-pnamqOagwNWoiwlxPnKCqSc2N7MP/eZlT7JiE09c8OE=";
+      name = "format-security.patch";
+      url = "https://git.netfilter.org/iptables/patch/?id=ed4082a7405a5838c205a34c1559e289949200cc";
+      sha256 = "OdytFmHk+3Awu+sDQpGTl5/qip4doRblmW2vQzfNZiU=";
     })
-    # treewide: use uint* instead of u_int*
-    (fetchpatch {
-      url = "https://git.netfilter.org/iptables/patch/?id=f319389525b066b7dc6d389c88f16a0df3b8f189";
-      sha256 = "sha256-rOxCEWZoI8Ac5fQDp286YHAwvreUAoDVAbomboKrGyM=";
-    })
-    # fix Musl build
-    (fetchpatch {
-      url = "https://git.netfilter.org/iptables/patch/?id=0e7cf0ad306cdf95dc3c28d15a254532206a888e";
-      sha256 = "18mnvqfxzd7ifq3zjb4vyifcyadpxdi8iqcj8wsjgw23n49lgrbj";
+    (fetchurl {
+      name = "static.patch";
+      url = "https://lore.kernel.org/netfilter-devel/20230402232939.1060151-1-hi@alyssa.is/raw";
+      sha256 = "PkH+1HbJjBb3//ffBe0XUQok1lBwgj/STL8Ppu/28f4=";
     })
   ];
 
   outputs = [ "out" "dev" "man" ];
 
-  nativeBuildInputs = [ pkg-config pruneLibtoolFiles flex bison ];
+  nativeBuildInputs = [
+    autoreconfHook pkg-config pruneLibtoolFiles flex bison
+  ];
 
   buildInputs = [ libmnl libnetfilter_conntrack libnfnetlink libnftnl libpcap ];
 
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 0237a0555abb6..4cc62ae1b9007 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.19";
-  hash = "sha256-7J/58dmYzisF8a0i3c+UAdIC0CFYEdxGjXjLprCyaHk=";
+  version = "2.03.20";
+  hash = "sha256-kKGHmzZ1rql4RUNYHM0hKMJl7GesBGsYVucG/Ar1w8c=";
 }
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 18c23c46c13c7..49f16db002f3b 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, autoreconfHook, pkg-config, perl, docbook2x
-, docbook_xml_dtd_45, python3Packages, pam
+, docbook_xml_dtd_45, python3Packages, pam, fetchpatch
 
 # Optional Dependencies
 , libapparmor ? null, gnutls ? null, libselinux ? null, libseccomp ? null
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./support-db2x.patch
+
+    # Backport of https://github.com/lxc/lxc/pull/4179 for glibc-2.36 build
+    (fetchpatch {
+      url = "https://github.com/lxc/lxc/commit/c1115e1503bf955c97f4cf3b925a6a9f619764c3.patch";
+      sha256 = "sha256-aC1XQesRJfkyQnloB3NvR4p/1WITrqkGYzw50PDxDrs=";
+      excludes = [ "meson.build" ];
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
index 67e96289e2abc..70d84d6311c41 100644
--- a/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/pkgs/os-specific/linux/lxcfs/default.nix
@@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-+wp29GD+toXGfQbPGYbDJ7/P+FY1uQY4uK3OQxTE9GM=";
   };
 
+  postPatch = ''
+    sed -i -e '1i #include <sys/pidfd.h>' src/bindings.c
+  '';
+
   nativeBuildInputs = [ pkg-config help2man autoreconfHook makeWrapper ];
   buildInputs = [ fuse ];
 
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 340ad619ecb6c..26c7b6a9ea34e 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -9,12 +9,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.6";
+  version = "1.0.7";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.xz";
-    hash = "sha256-JAdDDd2CmHZw5I3C/anigLqoMHq+wEqxjWCd89sAXkw=";
+    hash = "sha256-wSrJQf/5ra7fFzZ9XOITeJuYoNMUJ3vCKz1x4QiR9BI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 0c99fac8bfa20..a3c59a5a6c9b6 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -117,6 +117,7 @@
 , withTimedated ? true
 , withTimesyncd ? true
 , withTpm2Tss ? true
+, withUkify ? false  # adds python to closure which is too much by default
 , withUserDb ? true
 , withUtmp ? !stdenv.hostPlatform.isMusl
   # tests assume too much system access for them to be feasible for us right now
@@ -139,7 +140,7 @@ assert withHomed -> withPam;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "253.1";
+  version = "253.2";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -156,7 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-PyAhkLxDkT5gVocCXh8bst6PBgguASjnA82xinQOtjw=";
+    hash = "sha256-gtJEHLSeJoOSFnutn/+wM27sV9JiV5afsykyUd+XDKQ=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -350,7 +351,7 @@ stdenv.mkDerivation (finalAttrs: {
   # when cross-compiling.
   + ''
     shopt -s extglob
-    patchShebangs tools test src/!(rpm|kernel-install) src/kernel-install/test-kernel-install.sh
+    patchShebangs tools test src/!(rpm|kernel-install|ukify) src/kernel-install/test-kernel-install.sh
   '';
 
   outputs = [ "out" "man" "dev" ];
@@ -415,6 +416,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
     ++ lib.optionals withLibBPF [ libbpf ]
     ++ lib.optional withTpm2Tss tpm2-tss
+    ++ lib.optional withUkify (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
   ;
 
   #dontAddPrefix = true;
@@ -511,11 +513,10 @@ stdenv.mkDerivation (finalAttrs: {
     # more frequent development builds
     "-Dman=true"
 
-    # Temporary disable the ukify tool. see https://github.com/NixOS/nixpkgs/pull/216826#issuecomment-1465228824
-    "-Dukify=false"
-
     "-Defi=${lib.boolToString withEfi}"
     "-Dgnu-efi=${lib.boolToString withEfi}"
+
+    "-Dukify=${lib.boolToString withUkify}"
   ] ++ lib.optionals withEfi [
     "-Defi-libdir=${toString gnu-efi}/lib"
     "-Defi-includedir=${toString gnu-efi}/include/efi"
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 953d4a3de80fe..30b5f0eb747e9 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1402,7 +1402,7 @@ self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libpciaccess = callPackage ({ stdenv, pkg-config, fetchurl, zlib }: stdenv.mkDerivation {
+  libpciaccess = callPackage ({ stdenv, pkg-config, fetchurl, hwdata, zlib }: stdenv.mkDerivation {
     pname = "libpciaccess";
     version = "0.16";
     builder = ./builder.sh;
@@ -1413,7 +1413,8 @@ self: with self; {
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ zlib ];
+    buildInputs = [ hwdata zlib ];
+    configureFlags = [ "--with-pciids-path=${hwdata}/share/hwdata" ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index a3751bf16f00c..819adafd6ad19 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -34,6 +34,7 @@
 $pcMap{"gl"} = "libGL";
 $pcMap{"GL"} = "libGL";
 $pcMap{"gbm"} = "mesa";
+$pcMap{"hwdata"} = "hwdata";
 $pcMap{"\$PIXMAN"} = "pixman";
 $pcMap{"\$RENDERPROTO"} = "xorgproto";
 $pcMap{"\$DRI3PROTO"} = "xorgproto";
@@ -195,6 +196,12 @@
         push @{$extraAttrs{$pkg}}, "postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`\$PKG_CONFIG' '';";
     }
 
+    # libpciaccess requires pci.ids{,.gz} at runtime
+    if ($pkg eq "libpciaccess") {
+        push @requires, "hwdata";
+        push @{$extraAttrs{$pkg}}, "configureFlags = [ \"--with-pciids-path=\${hwdata}/share/hwdata\" ];";
+    }
+
     if (@@ = glob("$tmpDir/*/app-defaults/")) {
         push @nativeRequires, "wrapWithXFileSearchPathHook";
     }
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 7438f35e74b3a..fe572da715652 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -164,6 +164,7 @@ self: super:
   });
 
   xdm = super.xdm.overrideAttrs (attrs: {
+    patches = (attrs.patches or []) ++ [ ./xdm-fix-header-inclusion.patch ];
     buildInputs = attrs.buildInputs ++ [ libxcrypt ];
     configureFlags = attrs.configureFlags or [] ++ [
       "ac_cv_path_RAWCPP=${stdenv.cc.targetPrefix}cpp"
diff --git a/pkgs/servers/x11/xorg/xdm-fix-header-inclusion.patch b/pkgs/servers/x11/xorg/xdm-fix-header-inclusion.patch
new file mode 100644
index 0000000000000..7bde988aefd13
--- /dev/null
+++ b/pkgs/servers/x11/xorg/xdm-fix-header-inclusion.patch
@@ -0,0 +1,29 @@
+On glibc-2.36 this fails with
+
+    genauth.c:45:12: fatal error: bsd/stdlib.h: No such file or directory
+       45 | #  include <bsd/stdlib.h>
+          |            ^~~~~~~~~~~~~~
+
+This is because the file will be included if HAVE_ARC4RANDOM is true and `__linux__` is set.
+However, this is wrong: arc4random is now defined in glibc-2.36 and thus stdlib.h must be included
+even though HAVE_ARC4RANDOM is true.
+
+diff --git a/xdm/genauth.c b/xdm/genauth.c
+index cd2ad61..74d0ae1 100644
+--- a/xdm/genauth.c
++++ b/xdm/genauth.c
+@@ -40,13 +40,7 @@ from The Open Group.
+ 
+ #include <errno.h>
+ 
+-#ifdef HAVE_ARC4RANDOM
+-# ifdef __linux__
+-#  include <bsd/stdlib.h>
+-# else
+-#  include <stdlib.h>
+-# endif
+-#endif
++#include <stdlib.h>
+ 
+ #include <time.h>
+ #define Time_t time_t
diff --git a/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh b/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
index 5b5677eef1366..09bf25f52153f 100644
--- a/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
+++ b/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
@@ -30,6 +30,13 @@ LD_LIBRARY_PATH=$out/lib $LD_BINARY $out/bin/mv $out/lib/libstdc++.* $LIBSTDCXX_
 # use a copy of patchelf.
 LD_LIBRARY_PATH=$out/lib $LD_BINARY $out/bin/cp $out/bin/patchelf .
 
+# Older versions of the bootstrap-files did not compile their
+# patchelf with -static-libgcc, so we have to be very careful not to
+# run patchelf on the same copy of libgcc_s that it links against.
+LD_LIBRARY_PATH=$out/lib $LD_BINARY $out/bin/cp $out/lib/libgcc_s.so.1 .
+LD_LIBRARY_PATH=.:$out/lib:$LIBSTDCXX_SO_DIR $LD_BINARY \
+  ./patchelf --set-rpath $out/lib --force-rpath $out/lib/libgcc_s.so.1
+
 for i in $out/bin/* $out/libexec/gcc/*/*/*; do
     if [ -L "$i" ]; then continue; fi
     if [ -z "${i##*/liblto*}" ]; then continue; fi
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 3f2d77729abc5..17759d9fa1d7f 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -10,13 +10,10 @@
 #
 # Goals of the bootstrap process:
 # 1. final stdenv must not reference any of the bootstrap files.
-# 2. final stdenv must not contain any of the bootstrap files
-#    (the only current violation is libgcc_s.so in glibc).
+# 2. final stdenv must not contain any of the bootstrap files.
 # 3. final stdenv must not contain any of the files directly
 #    generated by the bootstrap code generators (assembler, linker,
-#    compiler). The only current violations are: libgcc_s.so in glibc,
-#    the lib{mpfr,mpc,gmp,isl} which are statically linked
-#    into the final gcc).
+#    compiler).
 #
 # These goals ensure that final packages and final stdenv are built
 # exclusively using nixpkgs package definitions and don't depend
@@ -111,6 +108,21 @@ let
   isBuiltByBootstrapFilesCompiler =
     pkg: isFromNixpkgs pkg && isFromBootstrapFiles pkg.stdenv.cc.cc;
 
+  commonGccOverrides = {
+    # Use a deterministically built compiler
+    # see https://github.com/NixOS/nixpkgs/issues/108475 for context
+    reproducibleBuild = true;
+    profiledCompiler = false;
+
+    # It appears that libcc1 (which is not a g++ plugin; it is a gdb plugin) gets linked against
+    # the libstdc++ from the compiler that *built* g++, not the libstdc++ which was just built.
+    # This causes a reference chain from stdenv to the bootstrapFiles:
+    #
+    #   stdenv -> gcc-lib -> xgcc-lib -> bootstrapFiles
+    #
+    disableGdbPlugin = true;
+  };
+
   commonPreHook =
     ''
       export NIX_ENFORCE_PURITY="''${NIX_ENFORCE_PURITY-1}"
@@ -170,7 +182,7 @@ let
 
         cc = if prevStage.gcc-unwrapped == null
              then null
-             else lib.makeOverridable (import ../../build-support/cc-wrapper) {
+             else (lib.makeOverridable (import ../../build-support/cc-wrapper) {
           name = "${name}-gcc-wrapper";
           nativeTools = false;
           nativeLibc = false;
@@ -184,7 +196,12 @@ let
           inherit lib;
           inherit (prevStage) coreutils gnugrep;
           stdenvNoCC = prevStage.ccWrapperStdenv;
-        };
+        }).overrideAttrs(a: lib.optionalAttrs (prevStage.gcc-unwrapped.passthru.isXgcc or false) {
+          # This affects only `xgcc` (the compiler which compiles the final compiler).
+          postFixup = (a.postFixup or "") + ''
+            echo "--sysroot=${lib.getDev (getLibc prevStage)}" >> $out/nix-support/cc-cflags
+          '';
+        });
 
         overrides = self: super: (overrides self super) // { fetchurl = thisStdenv.fetchurlBoot; };
       };
@@ -226,7 +243,7 @@ in
       ${localSystem.libc} = self.stdenv.mkDerivation {
         pname = "bootstrap-stage0-${localSystem.libc}";
         strictDeps = true;
-        version = "bootstrap";
+        version = "bootstrapFiles";
         enableParallelBuilding = true;
         buildCommand = ''
           mkdir -p $out
@@ -282,7 +299,7 @@ in
       };
       inherit (prevStage)
         ccWrapperStdenv
-        gcc-unwrapped coreutils gnugrep;
+        gcc-unwrapped coreutils gnugrep binutils;
 
       ${localSystem.libc} = getLibc prevStage;
 
@@ -295,6 +312,82 @@ in
     };
   })
 
+  # First rebuild of gcc; this is linked against all sorts of junk
+  # from the bootstrap-files, but we only care about the code that
+  # this compiler *emits*.  The `gcc` binary produced in this stage
+  # is not part of the final stdenv.
+  (prevStage:
+    assert isBuiltByBootstrapFilesCompiler prevStage.binutils-unwrapped;
+    assert            isFromBootstrapFiles prevStage."${localSystem.libc}";
+    assert            isFromBootstrapFiles prevStage.gcc-unwrapped;
+    assert            isFromBootstrapFiles prevStage.coreutils;
+    assert            isFromBootstrapFiles prevStage.gnugrep;
+    assert isBuiltByBootstrapFilesCompiler prevStage.patchelf;
+    stageFun prevStage {
+      name = "bootstrap-stage-xgcc";
+      overrides = final: prev: {
+        inherit (prevStage) ccWrapperStdenv coreutils gnugrep gettext bison texinfo zlib gnum4 perl patchelf;
+        ${localSystem.libc} = getLibc prevStage;
+        gmp      = prev.gmp.override { cxx = false; };
+        gcc-unwrapped =
+          (prev.gcc-unwrapped.override (commonGccOverrides // {
+            # The most logical name for this package would be something like
+            # "gcc-stage1".  Unfortunately "stage" is already reserved for the
+            # layers of stdenv, so using "stage" in the name of this package
+            # would cause massive confusion.
+            #
+            # Gcc calls its "stage1" compiler `xgcc` (--disable-bootstrap results
+            # in `xgcc` being copied to $prefix/bin/gcc).  So we imitate that.
+            #
+            name = "xgcc";
+
+            # xgcc uses ld linked against nixpkgs' glibc and gcc built
+            # against bootstrapTools glibc. We can't allow loading
+            #   $out/libexec/gcc/x86_64-unknown-linux-gnu/13.0.1/liblto_plugin.so
+            # to mix libc.so:
+            #   ...-binutils-patchelfed-ld-2.40/bin/ld: ...-xgcc-13.0.0/libexec/gcc/x86_64-unknown-linux-gnu/13.0.1/liblto_plugin.so:
+            #     error loading plugin: ...-bootstrap-tools/lib/libpthread.so.0: undefined symbol: __libc_vfork, version GLIBC_PRIVATE
+            enableLTO = false;
+          })).overrideAttrs (a: {
+
+            # This signals to cc-wrapper (as overridden above in this file) to add `--sysroot`
+            # to `$out/nix-support/cc-cflags`.
+            passthru = a.passthru // { isXgcc = true; };
+
+            # Gcc will look for the C library headers in
+            #
+            #    ${with_build_sysroot}${native_system_header_dir}
+            #
+            # The ordinary gcc expression sets `--with-build-sysroot=/` and sets
+            # `native-system-header-dir` to `"${lib.getDev stdenv.cc.libc}/include`.
+            #
+            # Unfortunately the value of "--with-native-system-header-dir=" gets "burned in" to the
+            # compiler, and it is quite difficult to get the compiler to change or ignore it
+            # afterwards.  On the other hand, the `sysroot` is very easy to change; you can just pass
+            # a `--sysroot` flag to `gcc`.
+            #
+            # So we override the expression to remove the default settings for these flags, and
+            # replace them such that the concatenated value will be the same as before, but we split
+            # the value between the two variables differently: `--native-system-header-dir=/include`,
+            # and `--with-build-sysroot=${lib.getDev stdenv.cc.libc}`.
+            #
+            configureFlags = (a.configureFlags or []) ++ [
+              "--with-native-system-header-dir=/include"
+              "--with-build-sysroot=${lib.getDev final.stdenv.cc.libc}"
+            ];
+
+            # This is a separate phase because gcc assembles its phase scripts
+            # in bash instead of nix (we should fix that).
+            preFixupPhases = (a.preFixupPhases or []) ++ [ "preFixupXgccPhase" ];
+
+            # This is needed to prevent "error: cycle detected in build of '...-xgcc-....drv'
+            # in the references of output 'lib' from output 'out'"
+            preFixupXgccPhase = ''
+              find $lib/lib/ -name \*.so\* -exec patchelf --shrink-rpath {} \; || true
+            '';
+          });
+      };
+    })
 
   # 2nd stdenv that contains our own rebuilt binutils and is used for
   # compiling our own Glibc.
@@ -303,9 +396,10 @@ in
     # previous stage1 stdenv:
     assert isBuiltByBootstrapFilesCompiler prevStage.binutils-unwrapped;
     assert            isFromBootstrapFiles prevStage."${localSystem.libc}";
-    assert            isFromBootstrapFiles prevStage.gcc-unwrapped;
+    assert isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
     assert            isFromBootstrapFiles prevStage.coreutils;
     assert            isFromBootstrapFiles prevStage.gnugrep;
+    assert isBuiltByBootstrapFilesCompiler prevStage.patchelf;
     stageFun prevStage {
     name = "bootstrap-stage2";
 
@@ -313,7 +407,7 @@ in
       inherit (prevStage)
         ccWrapperStdenv gettext
         gcc-unwrapped coreutils gnugrep
-        perl gnum4 bison;
+        perl gnum4 bison texinfo which;
       dejagnu = super.dejagnu.overrideAttrs (a: { doCheck = false; } );
 
       # We need libidn2 and its dependency libunistring as glibc dependency.
@@ -365,6 +459,14 @@ in
           '';
         };
       };
+
+      # TODO(amjoseph): It is not yet entirely clear why this is necessary.
+      # Something strange is going on with xgcc and libstdc++ on pkgsMusl.
+      patchelf = super.patchelf.overrideAttrs(previousAttrs:
+        lib.optionalAttrs super.stdenv.hostPlatform.isMusl {
+          NIX_CFLAGS_COMPILE = (previousAttrs.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++";
+        });
+
     };
 
     # `libtool` comes with obsolete config.sub/config.guess that don't recognize Risc-V.
@@ -378,11 +480,13 @@ in
   # binutils and rest of the bootstrap tools, including GCC.
   (prevStage:
     # previous stage2 stdenv:
-    assert isBuiltByBootstrapFilesCompiler prevStage.binutils-unwrapped;
-    assert isBuiltByBootstrapFilesCompiler prevStage.${localSystem.libc};
-    assert            isFromBootstrapFiles prevStage.gcc-unwrapped;
+    assert        isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert        isBuiltByNixpkgsCompiler prevStage.${localSystem.libc};
+    assert isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
     assert            isFromBootstrapFiles prevStage.coreutils;
     assert            isFromBootstrapFiles prevStage.gnugrep;
+    assert        isBuiltByNixpkgsCompiler prevStage.patchelf;
+    assert lib.all isBuiltByNixpkgsCompiler (with prevStage; [ gmp isl_0_20 libmpc mpfr ]);
     stageFun prevStage {
     name = "bootstrap-stage3";
 
@@ -390,25 +494,20 @@ in
       inherit (prevStage)
         ccWrapperStdenv
         binutils coreutils gnugrep gettext
-        perl patchelf linuxHeaders gnum4 bison libidn2 libunistring;
+        perl patchelf linuxHeaders gnum4 bison libidn2 libunistring libxcrypt;
+        # We build a special copy of libgmp which doesn't use libstdc++, because
+        # xgcc++'s libstdc++ references the bootstrap-files (which is what
+        # compiles xgcc++).
+        gmp = super.gmp.override { cxx = false; };
+      } // {
       ${localSystem.libc} = getLibc prevStage;
-      gcc-unwrapped =
-        let makeStaticLibrariesAndMark = pkg:
-              lib.makeOverridable (pkg.override { stdenv = self.makeStaticLibraries self.stdenv; })
-                .overrideAttrs (a: { pname = "${a.pname}-stage3"; });
-        in super.gcc-unwrapped.override {
-        # Link GCC statically against GMP etc.  This makes sense because
-        # these builds of the libraries are only used by GCC, so it
-        # reduces the size of the stdenv closure.
-        gmp = makeStaticLibrariesAndMark super.gmp;
-        mpfr = makeStaticLibrariesAndMark super.mpfr;
-        libmpc = makeStaticLibrariesAndMark super.libmpc;
-        isl = makeStaticLibrariesAndMark super.isl_0_20;
-        # Use a deterministically built compiler
-        # see https://github.com/NixOS/nixpkgs/issues/108475 for context
-        reproducibleBuild = true;
-        profiledCompiler = false;
-      };
+      gcc-unwrapped = (super.gcc-unwrapped.override (commonGccOverrides // {
+        inherit (prevStage) which;
+      }
+      )).overrideAttrs (a: {
+        # so we can add them to allowedRequisites below
+        passthru = a.passthru // { inherit (self) gmp mpfr libmpc isl; };
+      });
     };
     extraNativeBuildInputs = [ prevStage.patchelf ] ++
       # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
@@ -422,18 +521,12 @@ in
   #
   (prevStage:
     # previous stage3 stdenv:
-    assert isBuiltByBootstrapFilesCompiler prevStage.binutils-unwrapped;
-    assert isBuiltByBootstrapFilesCompiler prevStage.${localSystem.libc};
-    assert isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
-    assert            isFromBootstrapFiles prevStage.coreutils;
-    assert            isFromBootstrapFiles prevStage.gnugrep;
-    # Can assume prevStage.gcc-unwrapped has almost no code from
-    # bootstrapTools as gcc bootstraps internally. The only
-    # exceptions are crt files from glibc built bybootstrapTools
-    # used to link executables and libraries, and the
-    # bootstrapTools-built, statically-linked
-    # lib{mpfr,mpc,gmp,isl}.a which are linked into the final gcc
-    # (see commit cfde88976ba4cddd01b1bb28b40afd12ea93a11d).
+    assert isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert isBuiltByNixpkgsCompiler prevStage.${localSystem.libc};
+    assert isBuiltByNixpkgsCompiler prevStage.gcc-unwrapped;
+    assert     isFromBootstrapFiles prevStage.coreutils;
+    assert     isFromBootstrapFiles prevStage.gnugrep;
+    assert isBuiltByNixpkgsCompiler prevStage.patchelf;
     stageFun prevStage {
     name = "bootstrap-stage4";
 
@@ -453,11 +546,6 @@ in
         };
       };
 
-      # force gmp to rebuild so we have the option of dynamically linking
-      # libgmp without creating a reference path from:
-      #   stage5.gcc -> stage4.coreutils -> stage3.glibc -> bootstrap
-      gmp = lib.makeOverridable (super.gmp.override { stdenv = self.stdenv; }).overrideAttrs (a: { pname = "${a.pname}-stage4"; });
-
       # To allow users' overrides inhibit dependencies too heavy for
       # bootstrap, like guile: https://github.com/NixOS/nixpkgs/issues/181188
       gnumake = super.gnumake.override { inBootstrap = true; };
@@ -494,11 +582,12 @@ in
   (prevStage:
     # previous stage4 stdenv; see stage3 comment regarding gcc,
     # which applies here as well.
-    assert        isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
-    assert isBuiltByBootstrapFilesCompiler prevStage.${localSystem.libc};
-    assert isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
-    assert        isBuiltByNixpkgsCompiler prevStage.coreutils;
-    assert        isBuiltByNixpkgsCompiler prevStage.gnugrep;
+    assert isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert isBuiltByNixpkgsCompiler prevStage.${localSystem.libc};
+    assert isBuiltByNixpkgsCompiler prevStage.gcc-unwrapped;
+    assert isBuiltByNixpkgsCompiler prevStage.coreutils;
+    assert isBuiltByNixpkgsCompiler prevStage.gnugrep;
+    assert isBuiltByNixpkgsCompiler prevStage.patchelf;
     {
     inherit config overlays;
     stdenv = import ../generic rec {
@@ -546,11 +635,15 @@ in
           )
         # More complicated cases
         ++ (map (x: getOutput x (getLibc prevStage)) [ "out" "dev" "bin" ] )
-        ++  [ /*propagated from .dev*/ linuxHeaders
-            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params
+        ++  [ linuxHeaders # propagated from .dev
+            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params gcc.cc.libgcc glibc.passthru.libgcc
           ]
-          ++ lib.optionals (!localSystem.isx86 || localSystem.libc == "musl")
-            [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ];
+        ++ lib.optionals (!localSystem.isx86 || localSystem.libc == "musl")
+            [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ]
+        ++ (with gcc-unwrapped.passthru; [
+          gmp libmpc mpfr isl
+        ])
+      ;
 
       overrides = self: super: {
         inherit (prevStage)
@@ -579,10 +672,11 @@ in
   (prevStage:
     # previous stage5 stdenv; see stage3 comment regarding gcc,
     # which applies here as well.
-    assert        isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
-    assert isBuiltByBootstrapFilesCompiler prevStage.${localSystem.libc};
-    assert isBuiltByBootstrapFilesCompiler prevStage.gcc-unwrapped;
-    assert        isBuiltByNixpkgsCompiler prevStage.coreutils;
-    assert        isBuiltByNixpkgsCompiler prevStage.gnugrep;
+    assert isBuiltByNixpkgsCompiler prevStage.binutils-unwrapped;
+    assert isBuiltByNixpkgsCompiler prevStage.${localSystem.libc};
+    assert isBuiltByNixpkgsCompiler prevStage.gcc-unwrapped;
+    assert isBuiltByNixpkgsCompiler prevStage.coreutils;
+    assert isBuiltByNixpkgsCompiler prevStage.gnugrep;
+    assert isBuiltByNixpkgsCompiler prevStage.patchelf;
     { inherit (prevStage) config overlays stdenv; })
 ]
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index 3aa7f6a3df537..091130ebf93a8 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -2,6 +2,10 @@
 
 let
   libc = pkgs.stdenv.cc.libc;
+  patchelf = pkgs.patchelf.overrideAttrs(previousAttrs: {
+    NIX_CFLAGS_COMPILE = (previousAttrs.NIX_CFLAGS_COMPILE or []) ++ [ "-static-libgcc" "-static-libstdc++" ];
+    NIX_CFLAGS_LINK = (previousAttrs.NIX_CFLAGS_LINK or []) ++ [ "-static-libgcc" "-static-libstdc++" ];
+  });
 in with pkgs; rec {
 
 
@@ -127,7 +131,7 @@ in with pkgs; rec {
         cp -d ${bootGCC.out}/bin/gcc $out/bin
         cp -d ${bootGCC.out}/bin/cpp $out/bin
         cp -d ${bootGCC.out}/bin/g++ $out/bin
-        cp -d ${bootGCC.lib}/lib/libgcc_s.so* $out/lib
+        cp    ${bootGCC.lib}/lib/libgcc_s.so* $out/lib
         cp -d ${bootGCC.lib}/lib/libstdc++.so* $out/lib
         cp -d ${bootGCC.out}/lib/libssp.a* $out/lib
         cp -d ${bootGCC.out}/lib/libssp_nonshared.a $out/lib
@@ -149,6 +153,7 @@ in with pkgs; rec {
         rm -rf $out/include/c++/*/ext/parallel
 
         cp -d ${gmpxx.out}/lib/libgmp*.so* $out/lib
+        cp -d ${isl.out}/lib/libisl*.so* $out/lib
         cp -d ${mpfr.out}/lib/libmpfr*.so* $out/lib
         cp -d ${libmpc.out}/lib/libmpc*.so* $out/lib
         cp -d ${zlib.out}/lib/libz.so* $out/lib
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 5d154d1630b63..bc810790a3dd5 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -70,6 +70,7 @@ with pkgs;
   trivial-builders = recurseIntoAttrs {
     writeStringReferencesToFile = callPackage ../build-support/trivial-builders/test/writeStringReferencesToFile.nix {};
     writeTextFile = callPackage ../build-support/trivial-builders/test/write-text-file.nix {};
+    writeShellScript = callPackage ../build-support/trivial-builders/test/write-shell-script.nix {};
     references = callPackage ../build-support/trivial-builders/test/references.nix {};
     overriding = callPackage ../build-support/trivial-builders/test-overriding.nix {};
     concat = callPackage ../build-support/trivial-builders/test/concat-test.nix {};
diff --git a/pkgs/test/stdenv/gcc-stageCompare.nix b/pkgs/test/stdenv/gcc-stageCompare.nix
new file mode 100644
index 0000000000000..e5c2ed5921b30
--- /dev/null
+++ b/pkgs/test/stdenv/gcc-stageCompare.nix
@@ -0,0 +1,32 @@
+# This test *must* be run prior to releasing any build of either stdenv or the
+# gcc that it exports!  This check should also be part of CI for any PR that
+# causes a rebuild of `stdenv.cc`.
+#
+# When we used gcc's internal bootstrap it did this check as part of (and
+# serially with) the gcc derivation.  Now that we bootstrap externally this
+# check can be done in parallel with any/all of stdenv's referrers.  But we
+# must remember to do the check.
+#
+
+{ stdenv
+, pkgs
+, lib
+}:
+
+assert stdenv.cc.isGNU;
+with pkgs;
+# rebuild gcc using the "final" stdenv
+let gcc-stageCompare = (gcc-unwrapped.override {
+      reproducibleBuild = true;
+      profiledCompiler = false;
+      stdenv = overrideCC stdenv (wrapCCWith {
+        cc = stdenv.cc;
+      });
+    }).overrideAttrs(_: {
+      NIX_OUTPATH_USED_AS_RANDOM_SEED = stdenv.cc.cc.out;
+    });
+in (runCommand "gcc-stageCompare" {} ''
+  diff -sr ${pkgs.gcc-unwrapped.checksum}/checksums ${gcc-stageCompare.checksum}/checksums && touch $out
+'').overrideAttrs (a: {
+  meta = (a.meta or { }) // { platforms = lib.platforms.linux; };
+})
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index f488c5dcee5af..8e533409d72dd 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -74,7 +74,8 @@ let
     # flask-sqlalchemy 2.5.1 is incompatible with sqlalchemy > 1.4.45
     sqlalchemy = prev.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
       version = "1.4.45";
-      src = oldAttrs.src.override {
+      src = prev.fetchPypi {
+        inherit (oldAttrs) pname;
         inherit version;
         hash = "sha256-/WmFCGAJOj9p/v4KtW0EHt/f4YUQtT2aLq7LovFfp5U=";
       };
diff --git a/pkgs/tools/backup/grab-site/default.nix b/pkgs/tools/backup/grab-site/default.nix
index f4e65ddbcd5dd..168343b4083ab 100644
--- a/pkgs/tools/backup/grab-site/default.nix
+++ b/pkgs/tools/backup/grab-site/default.nix
@@ -5,7 +5,8 @@ let
     packageOverrides = self: super: {
       sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.24";
-        src = oldAttrs.src.override {
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
           inherit version;
           hash = "sha256-67t3fL+TEjWbiXv4G6ANrg9ctp+6KhgmXcwYpvXvdRk=";
         };
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index d49cc314b4a81..41237a953cb88 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.4.1";
+  version = "5.4.2";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "3Rcqy1OGemgBL5TBc4lAGy8nShqlro+Ey/uLfjg+qNM=";
+    sha256 = "sha256-qkmQnL2QKMRmajX6SXX5piA+2YFU+7giPuQ++c7ul8M=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/games/gamemode/default.nix b/pkgs/tools/games/gamemode/default.nix
index 230ccb2ed5f26..25acf8cebb1eb 100644
--- a/pkgs/tools/games/gamemode/default.nix
+++ b/pkgs/tools/games/gamemode/default.nix
@@ -34,6 +34,12 @@ stdenv.mkDerivation rec {
     ./preload-nix-workaround.patch
     # Do not install systemd sysusers configuration
     ./no-install-systemd-sysusers.patch
+
+    # fix build with glibc >=2.36 (declaration of pidfd_open)
+    (fetchpatch {
+      url = "https://github.com/FeralInteractive/gamemode/commit/4934191b1928ef695c3e8af21e75781f8591745f.patch";
+      sha256 = "sha256-pWf2NGbd3gEJFwVP/EIJRbTD29V7keTQHy388enktsY=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index b66c2d0a7590f..c4dcd26849120 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "sdk-${finalAttrs.version}";
-    hash = "sha256-Awtsz4iMuS3JuvaYHRxjo56EnnZPjo9YGfeYAi7lmJY=";
+    hash = "sha256-snxbTI4q0YQq8T5NQD3kcsN59iJnhlLiu1Fvr+fCDeQ=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index a398c4f0e9886..37de2d20aafc2 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "sdk-${version}";
-    hash = "sha256-0t9HGyiYk3twYQLFCcWsrPiXY1dqjdCadjP4yMLoFwA=";
+    hash = "sha256-hxlfSnH4M3ui5nW0Ll5rhto0DnJIHW0tJzS+p4KV0R4=";
   };
 
   nativeBuildInputs = [ cmake jq ];
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index c837e0d3061bd..0150f4e5c6fbc 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -25,13 +25,13 @@
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
   # The version must match that in vulkan-headers
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   src = fetchFromGitHub {
    owner = "LunarG";
    repo = "VulkanTools";
    rev = "sdk-${version}";
-   hash = "sha256-zgkuTy9ccg8D/riA1CM/PnbXW1R0jWEINtcEVilETwk=";
+   hash = "sha256-mvBP6wD1Z0VNLZ0mC4bA3i2IaBDtDr7K6XjHz4S3UA4=";
    fetchSubmodules = true;
  };
 
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index b3a2bca200e17..47a17158653f1 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.239.0";
+  version = "1.3.243.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "sdk-${version}";
-    hash = "sha256-DQGwxTZzS0eATKodMpeJaQdXADvomiqPOspDYoPFZjI=";
+    hash = "sha256-8XJON+iBEPRtuQWf1bPXyOJHRkuRLnLXgTIjk7gYQwE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/desktop-file-utils/default.nix b/pkgs/tools/misc/desktop-file-utils/default.nix
index 597eced414f6d..218eed5eb8bba 100644
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, fetchurl, pkg-config, meson, ninja, glib, libintl }:
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, pkg-config
+, meson
+, ninja
+, glib
+, libintl
+}:
 
 stdenv.mkDerivation rec {
   pname = "desktop-file-utils";
@@ -9,8 +18,29 @@ stdenv.mkDerivation rec {
     sha256 = "02bkfi6fyk4c0gh2avd897882ww5zl7qg7bzzf28qb57kvkvsvdj";
   };
 
-  nativeBuildInputs = [ pkg-config meson ninja ];
-  buildInputs = [ glib libintl ];
+  patches = [
+    # Support Desktop Entry Specification v1.5.
+    # https://gitlab.freedesktop.org/xdg/desktop-file-utils/-/merge_requests/11
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/xdg/desktop-file-utils/-/commit/425177a28b6215e0745f95100160a08e810fd47c.patch";
+      sha256 = "zu9EqTnQQGi5HqKh431JqigtJi+b16RuXSWQYbuuyxA=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/xdg/desktop-file-utils/-/commit/56d220dd679c7c3a8f995a41a27a7d6f3df49dea.patch";
+      sha256 = "p4kamGIm2QBHfIbvDnx+qu5Gi7OU3Z0nQKr39SsEKqk=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  buildInputs = [
+    glib
+    libintl
+  ];
 
   postPatch = ''
     substituteInPlace src/install.c \
@@ -23,6 +53,6 @@ stdenv.mkDerivation rec {
     homepage = "http://www.freedesktop.org/wiki/Software/desktop-file-utils";
     description = "Command line utilities for working with .desktop files";
     platforms = platforms.linux ++ platforms.darwin;
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 38055706004ba..b184545149142 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -13,8 +13,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-AstE8KGICgPhqRKlJecrE9iPUUWaOvca6ocWf85IzNo=";
 
-  auditable = true; # TODO: remove when this is the default
-
   nativeBuildInputs = [ installShellFiles ];
 
   # skip flaky test
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 16136296879ca..c0b488627efa2 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -22,6 +22,7 @@
 , rtmpSupport ? false, rtmpdump
 , scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2
 , wolfsslSupport ? false, wolfssl
+, rustlsSupport ? false, rustls-ffi
 , zlibSupport ? true, zlib
 , zstdSupport ? false, zstd
 
@@ -42,9 +43,7 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-assert !(gnutlsSupport && opensslSupport);
-assert !(gnutlsSupport && wolfsslSupport);
-assert !(opensslSupport && wolfsslSupport);
+assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsSupport ]) > 1);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
@@ -89,6 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
     optional rtmpSupport rtmpdump ++
     optional scpSupport libssh2 ++
     optional wolfsslSupport wolfssl ++
+    optional rustlsSupport rustls-ffi ++
     optional zlibSupport zlib ++
     optional zstdSupport zstd;
 
@@ -104,11 +104,12 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.enableFeature c-aresSupport "ares")
       (lib.enableFeature ldapSupport "ldap")
       (lib.enableFeature ldapSupport "ldaps")
-      # The build fails when using wolfssl with --with-ca-fallback
-      (lib.withFeature (!wolfsslSupport) "ca-fallback")
+      # --with-ca-fallback is only supported for openssl and gnutls https://github.com/curl/curl/blame/curl-8_0_1/acinclude.m4#L1640
+      (lib.withFeature (opensslSupport || gnutlsSupport) "ca-fallback")
       (lib.withFeature http3Support "nghttp3")
       (lib.withFeature http3Support "ngtcp2")
       (lib.withFeature rtmpSupport "librtmp")
+      (lib.withFeature rustlsSupport "rustls")
       (lib.withFeature zstdSupport "zstd")
       (lib.withFeatureAs brotliSupport "brotli" (lib.getDev brotli))
       (lib.withFeatureAs gnutlsSupport "gnutls" (lib.getDev gnutls))
@@ -129,7 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
       # Without this curl might detect /etc/ssl/cert.pem at build time on macOS, causing curl to ignore NIX_SSL_CERT_FILE.
       "--without-ca-bundle"
       "--without-ca-path"
-    ] ++ lib.optionals (!gnutlsSupport && !opensslSupport && !wolfsslSupport) [
+    ] ++ lib.optionals (!gnutlsSupport && !opensslSupport && !wolfsslSupport && !rustlsSupport) [
       "--without-ssl"
     ];
 
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 690cf3d97013b..7e447b4a9be62 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -65,6 +65,8 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withDoH [ libnghttp2 ]
     ++ lib.optionals withPythonModule [ python ];
 
+  enableParallelBuilding = true;
+
   configureFlags = [
     "--with-ssl=${openssl.dev}"
     "--with-libexpat=${expat.dev}"
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index 76b71e24aca60..472334f4a6ffe 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -98,6 +98,13 @@ stdenv.mkDerivation rec {
     patchShebangs \
       po/check-translations.sh \
       tests/unittest_inspector.py
+
+    # Stop tests from failing due to unhandled GTasks uncovered by GLib 2.76 bump.
+    # https://gitlab.freedesktop.org/libfprint/fprintd/-/issues/151
+    substituteInPlace tests/fprintd.py \
+      --replace "env['G_DEBUG'] = 'fatal-criticals'" ""
+    substituteInPlace tests/meson.build \
+      --replace "'G_DEBUG=fatal-criticals'," ""
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 155cca613a7b3..39926cded4bc7 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -13,8 +13,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-TViBclvCJeoOInTt13B7297JDtRkwvOjIf6AVAbpanU=";
 
-  auditable = true; # TODO: remove when this is the default
-
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
   passthru = {
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index be989994dbff0..022f8bd25bb7b 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -22,8 +22,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1kfdgh8dra4jxgcdb0lln5wwrimz0dpp33bq3h7jgs8ngaq2a9wp";
 
-  auditable = true; # TODO: remove when this is the default
-
   nativeBuildInputs = [ asciidoctor installShellFiles ]
     ++ lib.optional withPCRE2 pkg-config;
   buildInputs = lib.optional withPCRE2 pcre2
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 255c208783f97..59fe64072fd86 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -38,7 +38,13 @@ let
       # http://mirrors.ctan.org/systems/doc/kpathsea/kpathsea.pdf for more
       # details
       sed -i '/^#define ST_NLINK_TRICK/d' texk/kpathsea/config.h
-    '';
+    '' +
+    # when cross compiling, we must use himktables from PATH
+    # (i.e. from buildPackages.texlive.bin.core.dev)
+    lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform)  ''
+      sed -i 's|\./himktables|himktables|' texk/web2c/Makefile.in
+    ''
+;
 
     configureFlags = [
       "--with-banner-add=/nixos.org"
@@ -75,13 +81,15 @@ core = stdenv.mkDerivation rec {
 
   inherit (common) src prePatch;
 
-  outputs = [ "out" "doc" ];
+  outputs = [ "out" "doc" "dev" ];
 
   nativeBuildInputs = [
     pkg-config
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     # configure: error: tangle was not found but is required when cross-compiling.
+    # dev (himktables) is used when building hitex to generate the additional source file hitables.c
     texlive.bin.core
+    texlive.bin.core.dev
   ];
 
   buildInputs = [
@@ -121,8 +129,11 @@ core = stdenv.mkDerivation rec {
   installTargets = [ "install" "texlinks" ];
 
   # TODO: perhaps improve texmf.cnf search locations
-  postInstall = /* links format -> engine will be regenerated in texlive.combine */ ''
-    PATH="$out/bin:$PATH" ${buildPackages.texlive.bin.texlinks}/bin/texlinks --cnffile "$out/share/texmf-dist/web2c/fmtutil.cnf" --unlink "$out/bin"
+  postInstall =
+    /* links format -> engine will be regenerated in texlive.combine
+       note: for unlinking, the texlinks patch is irrelevant, so we use
+       the included texlinks.sh to avoid the dependency on bin.texlinks */ ''
+    PATH="$out/bin:$PATH" sh ../texk/texlive/linked_scripts/texlive-extra/texlinks.sh --cnffile "$out/share/texmf-dist/web2c/fmtutil.cnf" --unlink "$out/bin"
   '' + /* a few texmf-dist files are useful; take the rest from pkgs */ ''
     mv "$out/share/texmf-dist/web2c/texmf.cnf" .
     rm -r "$out/share/texmf-dist"
@@ -156,6 +167,9 @@ core = stdenv.mkDerivation rec {
     mv "$out"/share/{man,info} "$doc"/doc
   '' + /* remove manpages for utils that live in texlive.texlive-scripts to avoid a conflict in buildEnv */ ''
     (cd "$doc"/doc/man/man1; rm {fmtutil-sys.1,fmtutil.1,mktexfmt.1,mktexmf.1,mktexpk.1,mktextfm.1,texhash.1,updmap-sys.1,updmap.1})
+  '' + /* install himktables in separate output for use in cross compilation */ ''
+     mkdir -p $dev/bin
+     cp texk/web2c/.libs/himktables $dev/bin/himktables
   '' + cleanBrokenLinks;
 
   setupHook = ./setup-hook.sh; # TODO: maybe texmf-nix -> texmf (and all references)
@@ -192,7 +206,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
 
   hardeningDisable = [ "format" ];
 
-  inherit (core) nativeBuildInputs;
+  inherit (core) nativeBuildInputs depsBuildBuild;
   buildInputs = core.buildInputs ++ [ core cairo harfbuzz icu graphite2 libX11 ];
 
   configureFlags = common.configureFlags
@@ -207,7 +221,15 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
   # we use static libtexlua, because it's only used by a single binary
   postConfigure = let
     luajit = lib.optionalString withLuaJIT ",luajit";
-  in ''
+  in
+  lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform)
+  # without this, the native builds attempt to use the binary
+  # ${target-triple}-gcc, but we need to use the wrapper script.
+  ''
+    export BUILDCC=${buildPackages.stdenv.cc}/bin/cc
+  ''
+  +
+  ''
     mkdir ./WorkDir && cd ./WorkDir
     for path in libs/{pplib,teckit,lua53${luajit}} texk/web2c; do
       (
@@ -216,7 +238,18 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
         else
           extraConfig=""
         fi
-
+  '' + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+    # results of the tests performed by the configure scripts are
+    # toolchain-dependent, so native components and cross components cannot use
+    # the same cached test results.
+    # Disable the caching for components with native subcomponents.
+  ''
+        if [[ "$path" =~ "libs/luajit" ]] || [[ "$path" =~ "texk/web2c" ]]; then
+          extraConfig="$extraConfig --cache-file=/dev/null"
+        fi
+  ''
+  +
+  ''
         mkdir -p "$path" && cd "$path"
         "../../../$path/configure" $configureFlags $extraConfig
 
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 938a686f84735..83b4204d2dc51 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -10,10 +10,29 @@
 , zlib
 , libiconv
 , Security
+, buildPackages
 }:
 
 let
   rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
+
+  # TODO: if another package starts using cargo-c (seems likely),
+  # factor this out into a makeCargoChook expression in
+  # pkgs/build-support/rust/hooks/default.nix
+  ccForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc";
+  cxxForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}c++";
+  ccForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
+  cxxForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
+  rustBuildPlatform = rust.toRustTarget stdenv.buildPlatform;
+  rustTargetPlatform = rust.toRustTarget stdenv.hostPlatform;
+  setEnvVars = ''
+    env \
+      "CC_${rustBuildPlatform}"="${ccForBuild}" \
+      "CXX_${rustBuildPlatform}"="${cxxForBuild}" \
+      "CC_${rustTargetPlatform}"="${ccForHost}" \
+      "CXX_${rustTargetPlatform}"="${cxxForHost}" \
+  '';
+
 in rustPlatform.buildRustPackage rec {
   pname = "rav1e";
   version = "0.6.3";
@@ -25,8 +44,6 @@ in rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-66mVkoqMl+KNCXWsGUbu8nBrazgHP+5dTaT2Ye0btWY=";
 
-  auditable = true; # TODO: remove when this is the default
-
   depsBuildBuild = [ pkg-config ];
 
   nativeBuildInputs = [ cargo-c libgit2 nasm ];
@@ -40,11 +57,13 @@ in rustPlatform.buildRustPackage rec {
 
   checkType = "debug";
 
-  postBuild = ''
+  postBuild =  ''
+    ${setEnvVars} \
     cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
   postInstall = ''
+    ${setEnvVars} \
     cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
diff --git a/pkgs/tools/virtualization/distrobuilder/default.nix b/pkgs/tools/virtualization/distrobuilder/default.nix
index a6f090be33f9e..a6ae67b07e7bf 100644
--- a/pkgs/tools/virtualization/distrobuilder/default.nix
+++ b/pkgs/tools/virtualization/distrobuilder/default.nix
@@ -8,6 +8,7 @@
 , gnutar
 , squashfsTools
 , debootstrap
+, fetchpatch
 }:
 
 let
@@ -23,7 +24,7 @@ buildGoModule rec {
   pname = "distrobuilder";
   version = "2.1";
 
-  vendorSha256 = "sha256-6LsJ6nZIo+aC8kvF+1aZD1WoXNTj9siB8QhKPVA6MSc=";
+  vendorSha256 = "sha256-yRMsf8KfpNmVUX4Rn4ZPLUPFZCT/g78MKAfgbFDPVkE=";
 
   src = fetchFromGitHub {
     owner = "lxc";
@@ -35,6 +36,21 @@ buildGoModule rec {
 
   buildInputs = bins;
 
+  patches = [
+    # go.mod update: needed to to include a newer lxd which contains
+    # https://github.com/lxc/lxd/commit/d83f061a21f509d42b7a334b97403d2a019a7b52
+    # which is needed to fix the build w/glibc-2.36.
+    (fetchpatch {
+      url = "https://github.com/lxc/distrobuilder/commit/5346bcc77dd7f141a36a8da851f016d0b929835e.patch";
+      sha256 = "sha256-H6cSbY0v/FThx72AvoAvUCs2VCYN/PQ0W4H82mQQ3SI=";
+    })
+    # Fixup to keep it building after go.mod update.
+    (fetchpatch {
+      url = "https://github.com/lxc/distrobuilder/commit/2c8cbfbf603e7446efce9f30812812336ccf4f2c.patch";
+      sha256 = "sha256-qqofghcHGosR2qycGb02c8rwErFyRRhsRKdQfyah8Ds=";
+    })
+  ];
+
   # tests require a local keyserver (mkg20001/nixpkgs branch distrobuilder-with-tests) but gpg is currently broken in tests
   doCheck = false;
 
diff --git a/pkgs/tools/wayland/wl-clipboard/default.nix b/pkgs/tools/wayland/wl-clipboard/default.nix
index 59f7c9110cf61..923391b799563 100644
--- a/pkgs/tools/wayland/wl-clipboard/default.nix
+++ b/pkgs/tools/wayland/wl-clipboard/default.nix
@@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
     description = "Command-line copy/paste utilities for Wayland";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ dywedir ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c124bc27d21bd..308a7c6c00a84 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1688,6 +1688,7 @@ mapAliases ({
   way-cooler = throw "way-cooler is abandoned by its author: https://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html"; # Added 2020-01-13
   webbrowser = throw "webbrowser was removed because it's unmaintained upstream and was marked as broken in nixpkgs for over a year"; # Added 2022-03-21
   webkit = throw "'webkit' has been renamed to/replaced by 'webkitgtk'"; # Converted to throw 2022-02-22
+  webkitgtk_5_0 = throw "'webkitgtk_5_0' has been superseded by 'webkitgtk_6_0'"; # Added 2023-02-25
   weechat-matrix-bridge = throw "'weechat-matrix-bridge' has been renamed to/replaced by 'weechatScripts.weechat-matrix-bridge'"; # Converted to throw 2022-02-22
   weighttp = throw "weighttp has been removed: abandoned by upstream"; # Added 2022-04-20
   whirlpool-gui = throw "whirlpool-gui has been removed as it depended on an insecure version of Electron"; # added 2022-02-08
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6d69f89767c83..41cdd367b3838 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2451,6 +2451,8 @@ with pkgs;
 
   krusader = libsForQt5.callPackage ../applications/file-managers/krusader { };
 
+  lesscpy = callPackage ../development/compilers/lesscpy { };
+
   lf = callPackage ../applications/file-managers/lf { };
 
   ctpv = callPackage ../applications/file-managers/lf/ctpv.nix { };
@@ -2836,18 +2838,7 @@ with pkgs;
 
   audiowaveform = callPackage ../tools/audio/audiowaveform { };
 
-  authenticator = callPackage ../applications/misc/authenticator rec {
-    # Remove when GTK is upgraded past 4.8
-    # https://github.com/NixOS/nixpkgs/issues/216770
-    gtk4 = pkgs.gtk4.overrideAttrs (_: rec {
-      version = "4.9.4";
-      src = fetchurl {
-        url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-        sha256 = "sha256-kaOv1YQB1OXYHjCwjuPxE6R2j/EBQDNqcqMmx3JyvjA=";
-      };
-    });
-    wrapGAppsHook4 = wrapGAppsHook.override { gtk3 = gtk4; };
-   };
+  authenticator = callPackage ../applications/misc/authenticator { };
 
   authelia = callPackage ../servers/authelia { };
 
@@ -11779,9 +11770,7 @@ with pkgs;
 
   rmtrash = callPackage ../tools/misc/rmtrash { };
 
-  roc-toolkit = callPackage ../development/libraries/audio/roc-toolkit {
-    scons = sconsPackages.scons_4_1_0;
-  };
+  roc-toolkit = callPackage ../development/libraries/audio/roc-toolkit { };
 
   rockbox-utility = libsForQt5.callPackage ../tools/misc/rockbox-utility { };
 
@@ -15928,11 +15917,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_67 = callPackage ../development/compilers/rust/1_67.nix {
+  rust_1_68 = callPackage ../development/compilers/rust/1_68.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_15 = llvmPackages_15.libllvm;
   };
-  rust = rust_1_67;
+  rust = rust_1_68;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -15941,8 +15930,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_67 = rust_1_67.packages.stable;
-  rustPackages = rustPackages_1_67;
+  rustPackages_1_68 = rust_1_68.packages.stable;
+  rustPackages = rustPackages_1_68;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -19992,6 +19981,16 @@ with pkgs;
     inherit (darwin) autoSignDarwinBinariesHook;
   };
 
+  freeipa = callPackage ../os-specific/linux/freeipa {
+    kerberos = krb5.override {
+      withVerto = true;
+    };
+    sasl = cyrus_sasl;
+    samba = samba4.override {
+      enableLDAP = true;
+    };
+  };
+
   freetts = callPackage ../development/libraries/freetts {
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
@@ -21248,6 +21247,8 @@ with pkgs;
 
   libdecor = callPackage ../development/libraries/libdecor { };
 
+  libdex = callPackage ../development/libraries/libdex { };
+
   libdigidocpp = callPackage ../development/libraries/libdigidocpp { };
 
   libdiscid = callPackage ../development/libraries/libdiscid { };
@@ -22535,7 +22536,10 @@ with pkgs;
   # Bump on staging only, tonnes of packages depend on it.
   # See https://github.com/NixOS/nixpkgs/issues/218232
   # Major versions should be bumped when they have proven to be reasonably stable
-  mesa = mesa_22_3_7;
+  # FIXME: split up libgbm properly
+  # darwin: deferred until stabilized; e.g. see around:
+  #   https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/21859
+  mesa = if stdenv.isDarwin then mesa_22_3_7 else mesa_23_0_1;
 
   mesa_glu =  callPackage ../development/libraries/mesa-glu {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
@@ -24086,7 +24090,7 @@ with pkgs;
 
   wavpack = callPackage ../development/libraries/wavpack { };
 
-  wayland = callPackage ../development/libraries/wayland { };
+  wayland = darwin.apple_sdk_11_0.callPackage ../development/libraries/wayland { };
   wayland-scanner = wayland.bin;
 
   wayland-protocols = callPackage ../development/libraries/wayland/protocols.nix { };
@@ -24107,7 +24111,7 @@ with pkgs;
     libsoup = libsoup_3;
   };
 
-  webkitgtk_5_0 = webkitgtk.override {
+  webkitgtk_6_0 = webkitgtk.override {
     libsoup = libsoup_3;
     gtk3 = gtk4;
   };
@@ -32107,6 +32111,11 @@ with pkgs;
     jack = libjack2;
   };
 
+  libmpg123 = mpg123.override {
+    libOnly = true;
+    withConplay = false;
+  };
+
   mpg321 = callPackage ../applications/audio/mpg321 { };
 
   mpc-cli = callPackage ../applications/audio/mpc {
@@ -32278,7 +32287,7 @@ with pkgs;
   netmaker-full = callPackage ../applications/networking/netmaker { };
 
   newsflash = callPackage ../applications/networking/feedreaders/newsflash {
-    webkitgtk = webkitgtk_5_0;
+    webkitgtk = webkitgtk_6_0;
   };
 
   nicotine-plus = callPackage ../applications/networking/soulseek/nicotine-plus { };
@@ -34218,6 +34227,8 @@ with pkgs;
 
   testssl = callPackage ../applications/networking/testssl { };
 
+  tests-stdenv-gcc-stageCompare = callPackage ../test/stdenv/gcc-stageCompare.nix { };
+
   lavalauncher = callPackage ../applications/misc/lavalauncher { };
 
   t-rec = callPackage ../misc/t-rec {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7589f09fe926f..7f48a398157d5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2861,6 +2861,8 @@ self: super: with self; {
 
   dogpile-cache = callPackage ../development/python-modules/dogpile-cache { };
 
+  dogtag-pki = callPackage ../development/python-modules/dogtag-pki { };
+
   dogtail = callPackage ../development/python-modules/dogtail { };
 
   doit = callPackage ../development/python-modules/doit { };
@@ -12916,6 +12918,8 @@ self: super: with self; {
 
   ytmusicapi = callPackage ../development/python-modules/ytmusicapi { };
 
+  yubico = callPackage ../development/python-modules/yubico { };
+
   yubico-client = callPackage ../development/python-modules/yubico-client { };
 
   z3c-checkversions = callPackage ../development/python-modules/z3c-checkversions { };
diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix
index 7bf4a234bb657..333e285cef0a0 100644
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@@ -150,5 +150,5 @@ with import ./release-lib.nix { inherit supportedSystems nixpkgsArgs; };
   xfsprogs = linux;
   xkeyboard_config = linux;
   zip = all;
-
+  tests-stdenv-gcc-stageCompare = all;
 } ))